1 //===-- asan_rtl.cc -------------------------------------------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file is a part of AddressSanitizer, an address sanity checker.
12 // Main file of the ASan run-time library.
13 //===----------------------------------------------------------------------===//
14 #include "asan_activation.h"
15 #include "asan_allocator.h"
16 #include "asan_interceptors.h"
17 #include "asan_interface_internal.h"
18 #include "asan_internal.h"
19 #include "asan_mapping.h"
20 #include "asan_poisoning.h"
21 #include "asan_report.h"
22 #include "asan_stack.h"
23 #include "asan_stats.h"
24 #include "asan_thread.h"
25 #include "sanitizer_common/sanitizer_atomic.h"
26 #include "sanitizer_common/sanitizer_flags.h"
27 #include "sanitizer_common/sanitizer_libc.h"
28 #include "sanitizer_common/sanitizer_symbolizer.h"
29 #include "lsan/lsan_common.h"
31 int __asan_option_detect_stack_use_after_return
; // Global interface symbol.
32 uptr
*__asan_test_only_reported_buggy_pointer
; // Used only for testing asan.
36 uptr AsanMappingProfile
[kAsanMappingProfileSize
];
38 static void AsanDie() {
39 static atomic_uint32_t num_calls
;
40 if (atomic_fetch_add(&num_calls
, 1, memory_order_relaxed
) != 0) {
41 // Don't die twice - run a busy loop.
44 if (flags()->sleep_before_dying
) {
45 Report("Sleeping for %d second(s)\n", flags()->sleep_before_dying
);
46 SleepForSeconds(flags()->sleep_before_dying
);
48 if (flags()->unmap_shadow_on_exit
) {
50 UnmapOrDie((void*)kLowShadowBeg
, kMidMemBeg
- kLowShadowBeg
);
51 UnmapOrDie((void*)kMidMemEnd
, kHighShadowEnd
- kMidMemEnd
);
53 UnmapOrDie((void*)kLowShadowBeg
, kHighShadowEnd
- kLowShadowBeg
);
56 if (flags()->coverage
)
57 __sanitizer_cov_dump();
60 if (flags()->abort_on_error
)
62 internal__exit(flags()->exitcode
);
65 static void AsanCheckFailed(const char *file
, int line
, const char *cond
,
67 Report("AddressSanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n", file
,
68 line
, cond
, (uptr
)v1
, (uptr
)v2
);
69 // FIXME: check for infinite recursion without a thread-local counter here.
70 PRINT_CURRENT_STACK();
74 // -------------------------- Flags ------------------------- {{{1
75 static const int kDefaultMallocContextSize
= 30;
77 Flags asan_flags_dont_use_directly
; // use via flags().
79 static const char *MaybeCallAsanDefaultOptions() {
80 return (&__asan_default_options
) ? __asan_default_options() : "";
83 static const char *MaybeUseAsanDefaultOptionsCompileDefiniton() {
84 #ifdef ASAN_DEFAULT_OPTIONS
85 // Stringize the macro value.
86 # define ASAN_STRINGIZE(x) #x
87 # define ASAN_STRINGIZE_OPTIONS(options) ASAN_STRINGIZE(options)
88 return ASAN_STRINGIZE_OPTIONS(ASAN_DEFAULT_OPTIONS
);
94 static void ParseFlagsFromString(Flags
*f
, const char *str
) {
95 CommonFlags
*cf
= common_flags();
96 ParseCommonFlagsFromString(cf
, str
);
97 CHECK((uptr
)cf
->malloc_context_size
<= kStackTraceMax
);
98 // Please write meaningful flag descriptions when adding new flags.
99 ParseFlag(str
, &f
->quarantine_size
, "quarantine_size",
100 "Size (in bytes) of quarantine used to detect use-after-free "
101 "errors. Lower value may reduce memory usage but increase the "
102 "chance of false negatives.");
103 ParseFlag(str
, &f
->redzone
, "redzone",
104 "Minimal size (in bytes) of redzones around heap objects. "
105 "Requirement: redzone >= 16, is a power of two.");
106 ParseFlag(str
, &f
->max_redzone
, "max_redzone",
107 "Maximal size (in bytes) of redzones around heap objects.");
108 CHECK_GE(f
->redzone
, 16);
109 CHECK_GE(f
->max_redzone
, f
->redzone
);
110 CHECK_LE(f
->max_redzone
, 2048);
111 CHECK(IsPowerOfTwo(f
->redzone
));
112 CHECK(IsPowerOfTwo(f
->max_redzone
));
114 ParseFlag(str
, &f
->debug
, "debug",
115 "If set, prints some debugging information and does additional checks.");
116 ParseFlag(str
, &f
->report_globals
, "report_globals",
117 "Controls the way to handle globals (0 - don't detect buffer overflow on "
118 "globals, 1 - detect buffer overflow, 2 - print data about registered "
121 ParseFlag(str
, &f
->check_initialization_order
,
122 "check_initialization_order",
123 "If set, attempts to catch initialization order issues.");
125 ParseFlag(str
, &f
->replace_str
, "replace_str",
126 "If set, uses custom wrappers and replacements for libc string functions "
127 "to find more errors.");
129 ParseFlag(str
, &f
->replace_intrin
, "replace_intrin",
130 "If set, uses custom wrappers for memset/memcpy/memmove intinsics.");
131 ParseFlag(str
, &f
->mac_ignore_invalid_free
, "mac_ignore_invalid_free",
132 "Ignore invalid free() calls to work around some bugs. Used on OS X "
134 ParseFlag(str
, &f
->detect_stack_use_after_return
,
135 "detect_stack_use_after_return",
136 "Enables stack-use-after-return checking at run-time.");
137 ParseFlag(str
, &f
->min_uar_stack_size_log
, "min_uar_stack_size_log",
138 "Minimum fake stack size log.");
139 ParseFlag(str
, &f
->max_uar_stack_size_log
, "max_uar_stack_size_log",
140 "Maximum fake stack size log.");
141 ParseFlag(str
, &f
->uar_noreserve
, "uar_noreserve",
142 "Use mmap with 'norserve' flag to allocate fake stack.");
143 ParseFlag(str
, &f
->max_malloc_fill_size
, "max_malloc_fill_size",
144 "ASan allocator flag. max_malloc_fill_size is the maximal amount of "
145 "bytes that will be filled with malloc_fill_byte on malloc.");
146 ParseFlag(str
, &f
->malloc_fill_byte
, "malloc_fill_byte",
147 "Value used to fill the newly allocated memory.");
148 ParseFlag(str
, &f
->exitcode
, "exitcode",
149 "Override the program exit status if the tool found an error.");
150 ParseFlag(str
, &f
->allow_user_poisoning
, "allow_user_poisoning",
151 "If set, user may manually mark memory regions as poisoned or "
153 ParseFlag(str
, &f
->sleep_before_dying
, "sleep_before_dying",
154 "Number of seconds to sleep between printing an error report and "
155 "terminating the program. Useful for debugging purposes (e.g. when one "
156 "needs to attach gdb).");
158 ParseFlag(str
, &f
->check_malloc_usable_size
, "check_malloc_usable_size",
159 "Allows the users to work around the bug in Nvidia drivers prior to "
162 ParseFlag(str
, &f
->unmap_shadow_on_exit
, "unmap_shadow_on_exit",
163 "If set, explicitly unmaps the (huge) shadow at exit.");
164 ParseFlag(str
, &f
->abort_on_error
, "abort_on_error",
165 "If set, the tool calls abort() instead of _exit() after printing the "
167 ParseFlag(str
, &f
->print_stats
, "print_stats",
168 "Print various statistics after printing an error message or if "
170 ParseFlag(str
, &f
->print_legend
, "print_legend",
171 "Print the legend for the shadow bytes.");
172 ParseFlag(str
, &f
->atexit
, "atexit",
173 "If set, prints ASan exit stats even after program terminates "
175 ParseFlag(str
, &f
->coverage
, "coverage",
176 "If set, coverage information will be dumped at program shutdown (if the "
177 "coverage instrumentation was enabled at compile time).");
179 ParseFlag(str
, &f
->disable_core
, "disable_core",
180 "Disable core dumping. By default, disable_core=1 on 64-bit to avoid "
181 "dumping a 16T+ core file.");
183 ParseFlag(str
, &f
->allow_reexec
, "allow_reexec",
184 "Allow the tool to re-exec the program. This may interfere badly with "
187 ParseFlag(str
, &f
->print_full_thread_history
,
188 "print_full_thread_history",
189 "If set, prints thread creation stacks for the threads involved in the "
190 "report and their ancestors up to the main thread.");
192 ParseFlag(str
, &f
->poison_heap
, "poison_heap",
193 "Poison (or not) the heap memory on [de]allocation. Zero value is useful "
194 "for benchmarking the allocator or instrumentator.");
196 ParseFlag(str
, &f
->poison_partial
, "poison_partial",
197 "If true, poison partially addressable 8-byte aligned words "
198 "(default=true). This flag affects heap and global buffers, but not "
201 ParseFlag(str
, &f
->alloc_dealloc_mismatch
, "alloc_dealloc_mismatch",
202 "Report errors on malloc/delete, new/free, new/delete[], etc.");
203 ParseFlag(str
, &f
->strict_memcmp
, "strict_memcmp",
204 "If true, assume that memcmp(p1, p2, n) always reads n bytes before "
205 "comparing p1 and p2.");
207 ParseFlag(str
, &f
->strict_init_order
, "strict_init_order",
208 "If true, assume that dynamic initializers can never access globals from "
209 "other modules, even if the latter are already initialized.");
211 ParseFlag(str
, &f
->start_deactivated
, "start_deactivated",
212 "If true, ASan tweaks a bunch of other flags (quarantine, redzone, heap "
213 "poisoning) to reduce memory consumption as much as possible, and "
214 "restores them to original values when the first instrumented module is "
215 "loaded into the process. This is mainly intended to be used on "
218 ParseFlag(str
, &f
->detect_invalid_pointer_pairs
,
219 "detect_invalid_pointer_pairs",
220 "If non-zero, try to detect operations like <, <=, >, >= and - on "
221 "invalid pointer pairs (e.g. when pointers belong to different objects). "
222 "The bigger the value the harder we try.");
224 ParseFlag(str
, &f
->detect_container_overflow
,
225 "detect_container_overflow",
226 "If true, honor the container overflow annotations. "
227 "See https://code.google.com/p/address-sanitizer/wiki/ContainerOverflow");
230 void InitializeFlags(Flags
*f
, const char *env
) {
231 CommonFlags
*cf
= common_flags();
232 SetCommonFlagsDefaults(cf
);
233 cf
->detect_leaks
= CAN_SANITIZE_LEAKS
;
234 cf
->external_symbolizer_path
= GetEnv("ASAN_SYMBOLIZER_PATH");
235 cf
->malloc_context_size
= kDefaultMallocContextSize
;
236 cf
->intercept_tls_get_addr
= true;
238 internal_memset(f
, 0, sizeof(*f
));
239 f
->quarantine_size
= (ASAN_LOW_MEMORY
) ? 1UL << 26 : 1UL << 28;
241 f
->max_redzone
= 2048;
243 f
->report_globals
= 1;
244 f
->check_initialization_order
= false;
245 f
->replace_str
= true;
246 f
->replace_intrin
= true;
247 f
->mac_ignore_invalid_free
= false;
248 f
->detect_stack_use_after_return
= false; // Also needs the compiler flag.
249 f
->min_uar_stack_size_log
= 16; // We can't do smaller anyway.
250 f
->max_uar_stack_size_log
= 20; // 1Mb per size class, i.e. ~11Mb per thread.
251 f
->uar_noreserve
= false;
252 f
->max_malloc_fill_size
= 0x1000; // By default, fill only the first 4K.
253 f
->malloc_fill_byte
= 0xbe;
254 f
->exitcode
= ASAN_DEFAULT_FAILURE_EXITCODE
;
255 f
->allow_user_poisoning
= true;
256 f
->sleep_before_dying
= 0;
257 f
->check_malloc_usable_size
= true;
258 f
->unmap_shadow_on_exit
= false;
259 f
->abort_on_error
= false;
260 f
->print_stats
= false;
261 f
->print_legend
= true;
264 f
->disable_core
= (SANITIZER_WORDSIZE
== 64);
265 f
->allow_reexec
= true;
266 f
->print_full_thread_history
= true;
267 f
->poison_heap
= true;
268 f
->poison_partial
= true;
269 // Turn off alloc/dealloc mismatch checker on Mac and Windows for now.
270 // TODO(glider,timurrrr): Fix known issues and enable this back.
271 f
->alloc_dealloc_mismatch
= (SANITIZER_MAC
== 0) && (SANITIZER_WINDOWS
== 0);
272 f
->strict_memcmp
= true;
273 f
->strict_init_order
= false;
274 f
->start_deactivated
= false;
275 f
->detect_invalid_pointer_pairs
= 0;
276 f
->detect_container_overflow
= true;
278 // Override from compile definition.
279 ParseFlagsFromString(f
, MaybeUseAsanDefaultOptionsCompileDefiniton());
281 // Override from user-specified string.
282 ParseFlagsFromString(f
, MaybeCallAsanDefaultOptions());
283 VReport(1, "Using the defaults from __asan_default_options: %s\n",
284 MaybeCallAsanDefaultOptions());
286 // Override from command line.
287 ParseFlagsFromString(f
, env
);
288 if (common_flags()->help
) {
289 PrintFlagDescriptions();
292 if (!CAN_SANITIZE_LEAKS
&& cf
->detect_leaks
) {
293 Report("%s: detect_leaks is not supported on this platform.\n",
295 cf
->detect_leaks
= false;
298 // Make "strict_init_order" imply "check_initialization_order".
299 // TODO(samsonov): Use a single runtime flag for an init-order checker.
300 if (f
->strict_init_order
) {
301 f
->check_initialization_order
= true;
305 // Parse flags that may change between startup and activation.
306 // On Android they come from a system property.
307 // On other platforms this is no-op.
308 void ParseExtraActivationFlags() {
310 GetExtraActivationFlags(buf
, sizeof(buf
));
311 ParseFlagsFromString(flags(), buf
);
313 VReport(1, "Extra activation flags: %s\n", buf
);
316 // -------------------------- Globals --------------------- {{{1
318 bool asan_init_is_running
;
319 void (*death_callback
)(void);
321 #if !ASAN_FIXED_MAPPING
322 uptr kHighMemEnd
, kMidMemBeg
, kMidMemEnd
;
325 // -------------------------- Misc ---------------- {{{1
326 void ShowStatsAndAbort() {
327 __asan_print_accumulated_stats();
331 // ---------------------- mmap -------------------- {{{1
332 // Reserve memory range [beg, end].
333 static void ReserveShadowMemoryRange(uptr beg
, uptr end
) {
334 CHECK_EQ((beg
% GetPageSizeCached()), 0);
335 CHECK_EQ(((end
+ 1) % GetPageSizeCached()), 0);
336 uptr size
= end
- beg
+ 1;
337 DecreaseTotalMmap(size
); // Don't count the shadow against mmap_limit_mb.
338 void *res
= MmapFixedNoReserve(beg
, size
);
339 if (res
!= (void*)beg
) {
340 Report("ReserveShadowMemoryRange failed while trying to map 0x%zx bytes. "
341 "Perhaps you're using ulimit -v\n", size
);
346 // --------------- LowLevelAllocateCallbac ---------- {{{1
347 static void OnLowLevelAllocate(uptr ptr
, uptr size
) {
348 PoisonShadow(ptr
, size
, kAsanInternalHeapMagic
);
351 // -------------------------- Run-time entry ------------------- {{{1
352 // exported functions
353 #define ASAN_REPORT_ERROR(type, is_write, size) \
354 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
355 void __asan_report_ ## type ## size(uptr addr); \
356 void __asan_report_ ## type ## size(uptr addr) { \
357 GET_CALLER_PC_BP_SP; \
358 __asan_report_error(pc, bp, sp, addr, is_write, size); \
361 ASAN_REPORT_ERROR(load
, false, 1)
362 ASAN_REPORT_ERROR(load
, false, 2)
363 ASAN_REPORT_ERROR(load
, false, 4)
364 ASAN_REPORT_ERROR(load
, false, 8)
365 ASAN_REPORT_ERROR(load
, false, 16)
366 ASAN_REPORT_ERROR(store
, true, 1)
367 ASAN_REPORT_ERROR(store
, true, 2)
368 ASAN_REPORT_ERROR(store
, true, 4)
369 ASAN_REPORT_ERROR(store
, true, 8)
370 ASAN_REPORT_ERROR(store
, true, 16)
372 #define ASAN_REPORT_ERROR_N(type, is_write) \
373 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
374 void __asan_report_ ## type ## _n(uptr addr, uptr size); \
375 void __asan_report_ ## type ## _n(uptr addr, uptr size) { \
376 GET_CALLER_PC_BP_SP; \
377 __asan_report_error(pc, bp, sp, addr, is_write, size); \
380 ASAN_REPORT_ERROR_N(load
, false)
381 ASAN_REPORT_ERROR_N(store
, true)
383 #define ASAN_MEMORY_ACCESS_CALLBACK(type, is_write, size) \
384 extern "C" NOINLINE INTERFACE_ATTRIBUTE void __asan_##type##size(uptr addr); \
385 void __asan_##type##size(uptr addr) { \
386 uptr sp = MEM_TO_SHADOW(addr); \
387 uptr s = size <= SHADOW_GRANULARITY ? *reinterpret_cast<u8 *>(sp) \
388 : *reinterpret_cast<u16 *>(sp); \
390 if (UNLIKELY(size >= SHADOW_GRANULARITY || \
391 ((s8)((addr & (SHADOW_GRANULARITY - 1)) + size - 1)) >= \
393 if (__asan_test_only_reported_buggy_pointer) { \
394 *__asan_test_only_reported_buggy_pointer = addr; \
396 GET_CALLER_PC_BP_SP; \
397 __asan_report_error(pc, bp, sp, addr, is_write, size); \
403 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 1)
404 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 2)
405 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 4)
406 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 8)
407 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 16)
408 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 1)
409 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 2)
410 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 4)
411 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 8)
412 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 16)
415 NOINLINE INTERFACE_ATTRIBUTE
void __asan_loadN(uptr addr
, uptr size
) {
416 if (__asan_region_is_poisoned(addr
, size
)) {
418 __asan_report_error(pc
, bp
, sp
, addr
, false, size
);
423 NOINLINE INTERFACE_ATTRIBUTE
void __asan_storeN(uptr addr
, uptr size
) {
424 if (__asan_region_is_poisoned(addr
, size
)) {
426 __asan_report_error(pc
, bp
, sp
, addr
, true, size
);
430 // Force the linker to keep the symbols for various ASan interface functions.
431 // We want to keep those in the executable in order to let the instrumented
432 // dynamic libraries access the symbol even if it is not used by the executable
433 // itself. This should help if the build system is removing dead code at link
435 static NOINLINE
void force_interface_symbols() {
436 volatile int fake_condition
= 0; // prevent dead condition elimination.
437 // __asan_report_* functions are noreturn, so we need a switch to prevent
438 // the compiler from removing any of them.
439 switch (fake_condition
) {
440 case 1: __asan_report_load1(0); break;
441 case 2: __asan_report_load2(0); break;
442 case 3: __asan_report_load4(0); break;
443 case 4: __asan_report_load8(0); break;
444 case 5: __asan_report_load16(0); break;
445 case 6: __asan_report_store1(0); break;
446 case 7: __asan_report_store2(0); break;
447 case 8: __asan_report_store4(0); break;
448 case 9: __asan_report_store8(0); break;
449 case 10: __asan_report_store16(0); break;
450 case 12: __asan_register_globals(0, 0); break;
451 case 13: __asan_unregister_globals(0, 0); break;
452 case 14: __asan_set_death_callback(0); break;
453 case 15: __asan_set_error_report_callback(0); break;
454 case 16: __asan_handle_no_return(); break;
455 case 17: __asan_address_is_poisoned(0); break;
456 case 18: __asan_get_allocated_size(0); break;
457 case 19: __asan_get_current_allocated_bytes(); break;
458 case 20: __asan_get_estimated_allocated_size(0); break;
459 case 21: __asan_get_free_bytes(); break;
460 case 22: __asan_get_heap_size(); break;
461 case 23: __asan_get_ownership(0); break;
462 case 24: __asan_get_unmapped_bytes(); break;
463 case 25: __asan_poison_memory_region(0, 0); break;
464 case 26: __asan_unpoison_memory_region(0, 0); break;
465 case 27: __asan_set_error_exit_code(0); break;
466 case 30: __asan_before_dynamic_init(0); break;
467 case 31: __asan_after_dynamic_init(); break;
468 case 32: __asan_poison_stack_memory(0, 0); break;
469 case 33: __asan_unpoison_stack_memory(0, 0); break;
470 case 34: __asan_region_is_poisoned(0, 0); break;
471 case 35: __asan_describe_address(0); break;
475 static void asan_atexit() {
476 Printf("AddressSanitizer exit stats:\n");
477 __asan_print_accumulated_stats();
478 // Print AsanMappingProfile.
479 for (uptr i
= 0; i
< kAsanMappingProfileSize
; i
++) {
480 if (AsanMappingProfile
[i
] == 0) continue;
481 Printf("asan_mapping.h:%zd -- %zd\n", i
, AsanMappingProfile
[i
]);
485 static void InitializeHighMemEnd() {
486 #if !ASAN_FIXED_MAPPING
487 kHighMemEnd
= GetMaxVirtualAddress();
488 // Increase kHighMemEnd to make sure it's properly
489 // aligned together with kHighMemBeg:
490 kHighMemEnd
|= SHADOW_GRANULARITY
* GetPageSizeCached() - 1;
491 #endif // !ASAN_FIXED_MAPPING
492 CHECK_EQ((kHighMemBeg
% GetPageSizeCached()), 0);
495 static void ProtectGap(uptr a
, uptr size
) {
496 CHECK_EQ(a
, (uptr
)Mprotect(a
, size
));
499 static void PrintAddressSpaceLayout() {
500 Printf("|| `[%p, %p]` || HighMem ||\n",
501 (void*)kHighMemBeg
, (void*)kHighMemEnd
);
502 Printf("|| `[%p, %p]` || HighShadow ||\n",
503 (void*)kHighShadowBeg
, (void*)kHighShadowEnd
);
505 Printf("|| `[%p, %p]` || ShadowGap3 ||\n",
506 (void*)kShadowGap3Beg
, (void*)kShadowGap3End
);
507 Printf("|| `[%p, %p]` || MidMem ||\n",
508 (void*)kMidMemBeg
, (void*)kMidMemEnd
);
509 Printf("|| `[%p, %p]` || ShadowGap2 ||\n",
510 (void*)kShadowGap2Beg
, (void*)kShadowGap2End
);
511 Printf("|| `[%p, %p]` || MidShadow ||\n",
512 (void*)kMidShadowBeg
, (void*)kMidShadowEnd
);
514 Printf("|| `[%p, %p]` || ShadowGap ||\n",
515 (void*)kShadowGapBeg
, (void*)kShadowGapEnd
);
517 Printf("|| `[%p, %p]` || LowShadow ||\n",
518 (void*)kLowShadowBeg
, (void*)kLowShadowEnd
);
519 Printf("|| `[%p, %p]` || LowMem ||\n",
520 (void*)kLowMemBeg
, (void*)kLowMemEnd
);
522 Printf("MemToShadow(shadow): %p %p %p %p",
523 (void*)MEM_TO_SHADOW(kLowShadowBeg
),
524 (void*)MEM_TO_SHADOW(kLowShadowEnd
),
525 (void*)MEM_TO_SHADOW(kHighShadowBeg
),
526 (void*)MEM_TO_SHADOW(kHighShadowEnd
));
529 (void*)MEM_TO_SHADOW(kMidShadowBeg
),
530 (void*)MEM_TO_SHADOW(kMidShadowEnd
));
533 Printf("redzone=%zu\n", (uptr
)flags()->redzone
);
534 Printf("max_redzone=%zu\n", (uptr
)flags()->max_redzone
);
535 Printf("quarantine_size=%zuM\n", (uptr
)flags()->quarantine_size
>> 20);
536 Printf("malloc_context_size=%zu\n",
537 (uptr
)common_flags()->malloc_context_size
);
539 Printf("SHADOW_SCALE: %zx\n", (uptr
)SHADOW_SCALE
);
540 Printf("SHADOW_GRANULARITY: %zx\n", (uptr
)SHADOW_GRANULARITY
);
541 Printf("SHADOW_OFFSET: %zx\n", (uptr
)SHADOW_OFFSET
);
542 CHECK(SHADOW_SCALE
>= 3 && SHADOW_SCALE
<= 7);
544 CHECK(kMidShadowBeg
> kLowShadowEnd
&&
545 kMidMemBeg
> kMidShadowEnd
&&
546 kHighShadowBeg
> kMidMemEnd
);
549 static void AsanInitInternal() {
550 if (asan_inited
) return;
551 SanitizerToolName
= "AddressSanitizer";
552 CHECK(!asan_init_is_running
&& "ASan init calls itself!");
553 asan_init_is_running
= true;
554 InitializeHighMemEnd();
556 // Make sure we are not statically linked.
557 AsanDoesNotSupportStaticLinkage();
559 // Install tool-specific callbacks in sanitizer_common.
560 SetDieCallback(AsanDie
);
561 SetCheckFailedCallback(AsanCheckFailed
);
562 SetPrintfAndReportCallback(AppendToErrorMessageBuffer
);
564 // Initialize flags. This must be done early, because most of the
565 // initialization steps look at flags().
566 const char *options
= GetEnv("ASAN_OPTIONS");
567 InitializeFlags(flags(), options
);
569 if (!flags()->start_deactivated
)
570 ParseExtraActivationFlags();
572 __sanitizer_set_report_path(common_flags()->log_path
);
573 __asan_option_detect_stack_use_after_return
=
574 flags()->detect_stack_use_after_return
;
575 CHECK_LE(flags()->min_uar_stack_size_log
, flags()->max_uar_stack_size_log
);
578 VReport(1, "Parsed ASAN_OPTIONS: %s\n", options
);
581 if (flags()->start_deactivated
)
582 AsanStartDeactivated();
584 // Re-exec ourselves if we need to set additional env or command line args.
587 // Setup internal allocator callback.
588 SetLowLevelAllocateCallback(OnLowLevelAllocate
);
590 InitializeAsanInterceptors();
592 ReplaceSystemMalloc();
593 ReplaceOperatorsNewAndDelete();
595 uptr shadow_start
= kLowShadowBeg
;
597 shadow_start
-= GetMmapGranularity();
598 bool full_shadow_is_available
=
599 MemoryRangeIsAvailable(shadow_start
, kHighShadowEnd
);
601 #if SANITIZER_LINUX && defined(__x86_64__) && !ASAN_FIXED_MAPPING
602 if (!full_shadow_is_available
) {
603 kMidMemBeg
= kLowMemEnd
< 0x3000000000ULL
? 0x3000000000ULL
: 0;
604 kMidMemEnd
= kLowMemEnd
< 0x3000000000ULL
? 0x4fffffffffULL
: 0;
608 if (common_flags()->verbosity
)
609 PrintAddressSpaceLayout();
611 if (flags()->disable_core
) {
615 if (full_shadow_is_available
) {
616 // mmap the low shadow plus at least one page at the left.
618 ReserveShadowMemoryRange(shadow_start
, kLowShadowEnd
);
619 // mmap the high shadow.
620 ReserveShadowMemoryRange(kHighShadowBeg
, kHighShadowEnd
);
622 ProtectGap(kShadowGapBeg
, kShadowGapEnd
- kShadowGapBeg
+ 1);
623 CHECK_EQ(kShadowGapEnd
, kHighShadowBeg
- 1);
624 } else if (kMidMemBeg
&&
625 MemoryRangeIsAvailable(shadow_start
, kMidMemBeg
- 1) &&
626 MemoryRangeIsAvailable(kMidMemEnd
+ 1, kHighShadowEnd
)) {
627 CHECK(kLowShadowBeg
!= kLowShadowEnd
);
628 // mmap the low shadow plus at least one page at the left.
629 ReserveShadowMemoryRange(shadow_start
, kLowShadowEnd
);
630 // mmap the mid shadow.
631 ReserveShadowMemoryRange(kMidShadowBeg
, kMidShadowEnd
);
632 // mmap the high shadow.
633 ReserveShadowMemoryRange(kHighShadowBeg
, kHighShadowEnd
);
635 ProtectGap(kShadowGapBeg
, kShadowGapEnd
- kShadowGapBeg
+ 1);
636 ProtectGap(kShadowGap2Beg
, kShadowGap2End
- kShadowGap2Beg
+ 1);
637 ProtectGap(kShadowGap3Beg
, kShadowGap3End
- kShadowGap3Beg
+ 1);
639 Report("Shadow memory range interleaves with an existing memory mapping. "
640 "ASan cannot proceed correctly. ABORTING.\n");
645 AsanTSDInit(PlatformTSDDtor
);
646 InstallDeadlySignalHandlers(AsanOnSIGSEGV
);
648 // Allocator should be initialized before starting external symbolizer, as
649 // fork() on Mac locks the allocator.
650 InitializeAllocator();
652 Symbolizer::Init(common_flags()->external_symbolizer_path
);
654 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
655 // should be set to 1 prior to initializing the threads.
657 asan_init_is_running
= false;
662 if (flags()->coverage
)
663 Atexit(__sanitizer_cov_dump
);
668 // Create main thread.
669 AsanThread
*main_thread
= AsanThread::Create(0, 0);
670 CreateThreadContextArgs create_main_args
= { main_thread
, 0 };
671 u32 main_tid
= asanThreadRegistry().CreateThread(
672 0, true, 0, &create_main_args
);
673 CHECK_EQ(0, main_tid
);
674 SetCurrentThread(main_thread
);
675 main_thread
->ThreadStart(internal_getpid());
676 force_interface_symbols(); // no-op.
677 SanitizerInitializeUnwinder();
679 #if CAN_SANITIZE_LEAKS
680 __lsan::InitCommonLsan();
681 if (common_flags()->detect_leaks
&& common_flags()->leak_check_at_exit
) {
682 Atexit(__lsan::DoLeakCheck
);
684 #endif // CAN_SANITIZE_LEAKS
686 VReport(1, "AddressSanitizer Init done\n");
689 // Initialize as requested from some part of ASan runtime library (interceptors,
691 void AsanInitFromRtl() {
696 // Initialize runtime in case it's LD_PRELOAD-ed into unsanitized executable
697 // (and thus normal initializer from .preinit_array haven't run).
699 class AsanInitializer
{
702 AsanCheckIncompatibleRT();
703 AsanCheckDynamicRTPrereqs();
709 static AsanInitializer asan_initializer
;
710 #endif // ASAN_DYNAMIC
712 } // namespace __asan
714 // ---------------------- Interface ---------------- {{{1
715 using namespace __asan
; // NOLINT
717 #if !SANITIZER_SUPPORTS_WEAK_HOOKS
719 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
720 const char* __asan_default_options() { return ""; }
724 int NOINLINE
__asan_set_error_exit_code(int exit_code
) {
725 int old
= flags()->exitcode
;
726 flags()->exitcode
= exit_code
;
730 void NOINLINE
__asan_handle_no_return() {
732 AsanThread
*curr_thread
= GetCurrentThread();
734 uptr PageSize
= GetPageSizeCached();
735 uptr top
= curr_thread
->stack_top();
736 uptr bottom
= ((uptr
)&local_stack
- PageSize
) & ~(PageSize
-1);
737 static const uptr kMaxExpectedCleanupSize
= 64 << 20; // 64M
738 if (top
- bottom
> kMaxExpectedCleanupSize
) {
739 static bool reported_warning
= false;
740 if (reported_warning
)
742 reported_warning
= true;
743 Report("WARNING: ASan is ignoring requested __asan_handle_no_return: "
744 "stack top: %p; bottom %p; size: %p (%zd)\n"
745 "False positive error reports may follow\n"
747 "http://code.google.com/p/address-sanitizer/issues/detail?id=189\n",
748 top
, bottom
, top
- bottom
, top
- bottom
);
751 PoisonShadow(bottom
, top
- bottom
, 0);
752 if (curr_thread
->has_fake_stack())
753 curr_thread
->fake_stack()->HandleNoReturn();
756 void NOINLINE
__asan_set_death_callback(void (*callback
)(void)) {
757 death_callback
= callback
;
760 // Initialize as requested from instrumented application code.
761 // We use this call as a trigger to wake up ASan from deactivated state.
763 AsanCheckIncompatibleRT();