1 //===-- asan_malloc_linux.cc ----------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
10 // Linux-specific malloc interception.
11 // We simply define functions like malloc, free, realloc, etc.
12 // They will replace the corresponding libc functions automagically.
13 //===----------------------------------------------------------------------===//
15 #include "sanitizer_common/sanitizer_platform.h"
16 #if SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX || \
17 SANITIZER_NETBSD || SANITIZER_RTEMS || SANITIZER_SOLARIS
19 #include "sanitizer_common/sanitizer_allocator_checks.h"
20 #include "sanitizer_common/sanitizer_errno.h"
21 #include "sanitizer_common/sanitizer_tls_get_addr.h"
22 #include "asan_allocator.h"
23 #include "asan_interceptors.h"
24 #include "asan_internal.h"
25 #include "asan_malloc_local.h"
26 #include "asan_stack.h"
28 // ---------------------- Replacement functions ---------------- {{{1
29 using namespace __asan
; // NOLINT
31 static uptr allocated_for_dlsym
;
32 static uptr last_dlsym_alloc_size_in_words
;
33 static const uptr kDlsymAllocPoolSize
= SANITIZER_RTEMS
? 4096 : 1024;
34 static uptr alloc_memory_for_dlsym
[kDlsymAllocPoolSize
];
36 static INLINE
bool IsInDlsymAllocPool(const void *ptr
) {
37 uptr off
= (uptr
)ptr
- (uptr
)alloc_memory_for_dlsym
;
38 return off
< allocated_for_dlsym
* sizeof(alloc_memory_for_dlsym
[0]);
41 static void *AllocateFromLocalPool(uptr size_in_bytes
) {
42 uptr size_in_words
= RoundUpTo(size_in_bytes
, kWordSize
) / kWordSize
;
43 void *mem
= (void*)&alloc_memory_for_dlsym
[allocated_for_dlsym
];
44 last_dlsym_alloc_size_in_words
= size_in_words
;
45 allocated_for_dlsym
+= size_in_words
;
46 CHECK_LT(allocated_for_dlsym
, kDlsymAllocPoolSize
);
50 static void DeallocateFromLocalPool(const void *ptr
) {
51 // Hack: since glibc 2.27 dlsym no longer uses stack-allocated memory to store
52 // error messages and instead uses malloc followed by free. To avoid pool
53 // exhaustion due to long object filenames, handle that special case here.
54 uptr prev_offset
= allocated_for_dlsym
- last_dlsym_alloc_size_in_words
;
55 void *prev_mem
= (void*)&alloc_memory_for_dlsym
[prev_offset
];
56 if (prev_mem
== ptr
) {
57 REAL(memset
)(prev_mem
, 0, last_dlsym_alloc_size_in_words
* kWordSize
);
58 allocated_for_dlsym
= prev_offset
;
59 last_dlsym_alloc_size_in_words
= 0;
63 static int PosixMemalignFromLocalPool(void **memptr
, uptr alignment
,
65 if (UNLIKELY(!CheckPosixMemalignAlignment(alignment
)))
68 CHECK(alignment
>= kWordSize
);
70 uptr addr
= (uptr
)&alloc_memory_for_dlsym
[allocated_for_dlsym
];
71 uptr aligned_addr
= RoundUpTo(addr
, alignment
);
72 uptr aligned_size
= RoundUpTo(size_in_bytes
, kWordSize
);
74 uptr
*end_mem
= (uptr
*)(aligned_addr
+ aligned_size
);
75 uptr allocated
= end_mem
- alloc_memory_for_dlsym
;
76 if (allocated
>= kDlsymAllocPoolSize
)
79 allocated_for_dlsym
= allocated
;
80 *memptr
= (void*)aligned_addr
;
85 void* MemalignFromLocalPool(uptr alignment
, uptr size
) {
87 alignment
= Max(alignment
, kWordSize
);
88 PosixMemalignFromLocalPool(&ptr
, alignment
, size
);
92 bool IsFromLocalPool(const void *ptr
) {
93 return IsInDlsymAllocPool(ptr
);
97 static INLINE
bool MaybeInDlsym() {
98 // Fuchsia doesn't use dlsym-based interceptors.
99 return !SANITIZER_FUCHSIA
&& asan_init_is_running
;
102 static INLINE
bool UseLocalPool() {
103 return EarlyMalloc() || MaybeInDlsym();
106 static void *ReallocFromLocalPool(void *ptr
, uptr size
) {
107 const uptr offset
= (uptr
)ptr
- (uptr
)alloc_memory_for_dlsym
;
108 const uptr copy_size
= Min(size
, kDlsymAllocPoolSize
- offset
);
110 if (UNLIKELY(UseLocalPool())) {
111 new_ptr
= AllocateFromLocalPool(size
);
113 ENSURE_ASAN_INITED();
114 GET_STACK_TRACE_MALLOC
;
115 new_ptr
= asan_malloc(size
, &stack
);
117 internal_memcpy(new_ptr
, ptr
, copy_size
);
121 INTERCEPTOR(void, free
, void *ptr
) {
122 GET_STACK_TRACE_FREE
;
123 if (UNLIKELY(IsInDlsymAllocPool(ptr
))) {
124 DeallocateFromLocalPool(ptr
);
127 asan_free(ptr
, &stack
, FROM_MALLOC
);
130 #if SANITIZER_INTERCEPT_CFREE
131 INTERCEPTOR(void, cfree
, void *ptr
) {
132 GET_STACK_TRACE_FREE
;
133 if (UNLIKELY(IsInDlsymAllocPool(ptr
)))
135 asan_free(ptr
, &stack
, FROM_MALLOC
);
137 #endif // SANITIZER_INTERCEPT_CFREE
139 INTERCEPTOR(void*, malloc
, uptr size
) {
140 if (UNLIKELY(UseLocalPool()))
141 // Hack: dlsym calls malloc before REAL(malloc) is retrieved from dlsym.
142 return AllocateFromLocalPool(size
);
143 ENSURE_ASAN_INITED();
144 GET_STACK_TRACE_MALLOC
;
145 return asan_malloc(size
, &stack
);
148 INTERCEPTOR(void*, calloc
, uptr nmemb
, uptr size
) {
149 if (UNLIKELY(UseLocalPool()))
150 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym.
151 return AllocateFromLocalPool(nmemb
* size
);
152 ENSURE_ASAN_INITED();
153 GET_STACK_TRACE_MALLOC
;
154 return asan_calloc(nmemb
, size
, &stack
);
157 INTERCEPTOR(void*, realloc
, void *ptr
, uptr size
) {
158 if (UNLIKELY(IsInDlsymAllocPool(ptr
)))
159 return ReallocFromLocalPool(ptr
, size
);
160 if (UNLIKELY(UseLocalPool()))
161 return AllocateFromLocalPool(size
);
162 ENSURE_ASAN_INITED();
163 GET_STACK_TRACE_MALLOC
;
164 return asan_realloc(ptr
, size
, &stack
);
167 #if SANITIZER_INTERCEPT_MEMALIGN
168 INTERCEPTOR(void*, memalign
, uptr boundary
, uptr size
) {
169 GET_STACK_TRACE_MALLOC
;
170 return asan_memalign(boundary
, size
, &stack
, FROM_MALLOC
);
173 INTERCEPTOR(void*, __libc_memalign
, uptr boundary
, uptr size
) {
174 GET_STACK_TRACE_MALLOC
;
175 void *res
= asan_memalign(boundary
, size
, &stack
, FROM_MALLOC
);
176 DTLS_on_libc_memalign(res
, size
);
179 #endif // SANITIZER_INTERCEPT_MEMALIGN
181 #if SANITIZER_INTERCEPT_ALIGNED_ALLOC
182 INTERCEPTOR(void*, aligned_alloc
, uptr boundary
, uptr size
) {
183 GET_STACK_TRACE_MALLOC
;
184 return asan_aligned_alloc(boundary
, size
, &stack
);
186 #endif // SANITIZER_INTERCEPT_ALIGNED_ALLOC
188 INTERCEPTOR(uptr
, malloc_usable_size
, void *ptr
) {
189 GET_CURRENT_PC_BP_SP
;
191 return asan_malloc_usable_size(ptr
, pc
, bp
);
194 #if SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO
195 // We avoid including malloc.h for portability reasons.
196 // man mallinfo says the fields are "long", but the implementation uses int.
197 // It doesn't matter much -- we just need to make sure that the libc's mallinfo
199 struct fake_mallinfo
{
203 INTERCEPTOR(struct fake_mallinfo
, mallinfo
, void) {
204 struct fake_mallinfo res
;
205 REAL(memset
)(&res
, 0, sizeof(res
));
209 INTERCEPTOR(int, mallopt
, int cmd
, int value
) {
212 #endif // SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO
214 INTERCEPTOR(int, posix_memalign
, void **memptr
, uptr alignment
, uptr size
) {
215 if (UNLIKELY(UseLocalPool()))
216 return PosixMemalignFromLocalPool(memptr
, alignment
, size
);
217 GET_STACK_TRACE_MALLOC
;
218 return asan_posix_memalign(memptr
, alignment
, size
, &stack
);
221 INTERCEPTOR(void*, valloc
, uptr size
) {
222 GET_STACK_TRACE_MALLOC
;
223 return asan_valloc(size
, &stack
);
226 #if SANITIZER_INTERCEPT_PVALLOC
227 INTERCEPTOR(void*, pvalloc
, uptr size
) {
228 GET_STACK_TRACE_MALLOC
;
229 return asan_pvalloc(size
, &stack
);
231 #endif // SANITIZER_INTERCEPT_PVALLOC
233 INTERCEPTOR(void, malloc_stats
, void) {
234 __asan_print_accumulated_stats();
237 #if SANITIZER_ANDROID
238 // Format of __libc_malloc_dispatch has changed in Android L.
239 // While we are moving towards a solution that does not depend on bionic
240 // internals, here is something to support both K* and L releases.
241 struct MallocDebugK
{
242 void *(*malloc
)(uptr bytes
);
243 void (*free
)(void *mem
);
244 void *(*calloc
)(uptr n_elements
, uptr elem_size
);
245 void *(*realloc
)(void *oldMem
, uptr bytes
);
246 void *(*memalign
)(uptr alignment
, uptr bytes
);
247 uptr (*malloc_usable_size
)(void *mem
);
250 struct MallocDebugL
{
251 void *(*calloc
)(uptr n_elements
, uptr elem_size
);
252 void (*free
)(void *mem
);
253 fake_mallinfo (*mallinfo
)(void);
254 void *(*malloc
)(uptr bytes
);
255 uptr (*malloc_usable_size
)(void *mem
);
256 void *(*memalign
)(uptr alignment
, uptr bytes
);
257 int (*posix_memalign
)(void **memptr
, uptr alignment
, uptr size
);
258 void* (*pvalloc
)(uptr size
);
259 void *(*realloc
)(void *oldMem
, uptr bytes
);
260 void* (*valloc
)(uptr size
);
263 ALIGNED(32) const MallocDebugK asan_malloc_dispatch_k
= {
264 WRAP(malloc
), WRAP(free
), WRAP(calloc
),
265 WRAP(realloc
), WRAP(memalign
), WRAP(malloc_usable_size
)};
267 ALIGNED(32) const MallocDebugL asan_malloc_dispatch_l
= {
268 WRAP(calloc
), WRAP(free
), WRAP(mallinfo
),
269 WRAP(malloc
), WRAP(malloc_usable_size
), WRAP(memalign
),
270 WRAP(posix_memalign
), WRAP(pvalloc
), WRAP(realloc
),
274 void ReplaceSystemMalloc() {
275 void **__libc_malloc_dispatch_p
=
276 (void **)AsanDlSymNext("__libc_malloc_dispatch");
277 if (__libc_malloc_dispatch_p
) {
278 // Decide on K vs L dispatch format by the presence of
279 // __libc_malloc_default_dispatch export in libc.
280 void *default_dispatch_p
= AsanDlSymNext("__libc_malloc_default_dispatch");
281 if (default_dispatch_p
)
282 *__libc_malloc_dispatch_p
= (void *)&asan_malloc_dispatch_k
;
284 *__libc_malloc_dispatch_p
= (void *)&asan_malloc_dispatch_l
;
287 } // namespace __asan
289 #else // SANITIZER_ANDROID
292 void ReplaceSystemMalloc() {
294 } // namespace __asan
295 #endif // SANITIZER_ANDROID
297 #endif // SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX ||
298 // SANITIZER_NETBSD || SANITIZER_SOLARIS