1 //=-- lsan_common_linux.cc ------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of LeakSanitizer.
9 // Implementation of common leak checking functionality. Linux-specific code.
11 //===----------------------------------------------------------------------===//
13 #include "sanitizer_common/sanitizer_platform.h"
14 #include "lsan_common.h"
16 #if CAN_SANITIZE_LEAKS && SANITIZER_LINUX
19 #include "sanitizer_common/sanitizer_common.h"
20 #include "sanitizer_common/sanitizer_flags.h"
21 #include "sanitizer_common/sanitizer_linux.h"
22 #include "sanitizer_common/sanitizer_stackdepot.h"
26 static const char kLinkerName
[] = "ld";
27 // We request 2 modules matching "ld", so we can print a warning if there's more
28 // than one match. But only the first one is actually used.
29 static char linker_placeholder
[2 * sizeof(LoadedModule
)] ALIGNED(64);
30 static LoadedModule
*linker
= nullptr;
32 static bool IsLinker(const char* full_name
) {
33 return LibraryNameIs(full_name
, kLinkerName
);
36 void InitializePlatformSpecificModules() {
37 internal_memset(linker_placeholder
, 0, sizeof(linker_placeholder
));
38 uptr num_matches
= GetListOfModules(
39 reinterpret_cast<LoadedModule
*>(linker_placeholder
), 2, IsLinker
);
40 if (num_matches
== 1) {
41 linker
= reinterpret_cast<LoadedModule
*>(linker_placeholder
);
45 VReport(1, "LeakSanitizer: Dynamic linker not found. "
46 "TLS will not be handled correctly.\n");
47 else if (num_matches
> 1)
48 VReport(1, "LeakSanitizer: Multiple modules match \"%s\". "
49 "TLS will not be handled correctly.\n", kLinkerName
);
53 static int ProcessGlobalRegionsCallback(struct dl_phdr_info
*info
, size_t size
,
55 Frontier
*frontier
= reinterpret_cast<Frontier
*>(data
);
56 for (uptr j
= 0; j
< info
->dlpi_phnum
; j
++) {
57 const ElfW(Phdr
) *phdr
= &(info
->dlpi_phdr
[j
]);
58 // We're looking for .data and .bss sections, which reside in writeable,
60 if (!(phdr
->p_flags
& PF_W
) || (phdr
->p_type
!= PT_LOAD
) ||
63 uptr begin
= info
->dlpi_addr
+ phdr
->p_vaddr
;
64 uptr end
= begin
+ phdr
->p_memsz
;
65 uptr allocator_begin
= 0, allocator_end
= 0;
66 GetAllocatorGlobalRange(&allocator_begin
, &allocator_end
);
67 if (begin
<= allocator_begin
&& allocator_begin
< end
) {
68 CHECK_LE(allocator_begin
, allocator_end
);
69 CHECK_LT(allocator_end
, end
);
70 if (begin
< allocator_begin
)
71 ScanRangeForPointers(begin
, allocator_begin
, frontier
, "GLOBAL",
73 if (allocator_end
< end
)
74 ScanRangeForPointers(allocator_end
, end
, frontier
, "GLOBAL",
77 ScanRangeForPointers(begin
, end
, frontier
, "GLOBAL", kReachable
);
83 // Scans global variables for heap pointers.
84 void ProcessGlobalRegions(Frontier
*frontier
) {
85 if (!flags()->use_globals
) return;
86 dl_iterate_phdr(ProcessGlobalRegionsCallback
, frontier
);
89 static uptr
GetCallerPC(u32 stack_id
, StackDepotReverseMap
*map
) {
91 StackTrace stack
= map
->Get(stack_id
);
92 // The top frame is our malloc/calloc/etc. The next frame is the caller.
94 return stack
.trace
[1];
98 struct ProcessPlatformAllocParam
{
100 StackDepotReverseMap
*stack_depot_reverse_map
;
103 // ForEachChunk callback. Identifies unreachable chunks which must be treated as
104 // reachable. Marks them as reachable and adds them to the frontier.
105 static void ProcessPlatformSpecificAllocationsCb(uptr chunk
, void *arg
) {
107 ProcessPlatformAllocParam
*param
=
108 reinterpret_cast<ProcessPlatformAllocParam
*>(arg
);
109 chunk
= GetUserBegin(chunk
);
110 LsanMetadata
m(chunk
);
111 if (m
.allocated() && m
.tag() != kReachable
&& m
.tag() != kIgnored
) {
112 u32 stack_id
= m
.stack_trace_id();
115 caller_pc
= GetCallerPC(stack_id
, param
->stack_depot_reverse_map
);
116 // If caller_pc is unknown, this chunk may be allocated in a coroutine. Mark
117 // it as reachable, as we can't properly report its allocation stack anyway.
118 if (caller_pc
== 0 || linker
->containsAddress(caller_pc
)) {
119 m
.set_tag(kReachable
);
120 param
->frontier
->push_back(chunk
);
125 // Handles dynamically allocated TLS blocks by treating all chunks allocated
126 // from ld-linux.so as reachable.
127 // Dynamic TLS blocks contain the TLS variables of dynamically loaded modules.
128 // They are allocated with a __libc_memalign() call in allocate_and_init()
129 // (elf/dl-tls.c). Glibc won't tell us the address ranges occupied by those
130 // blocks, but we can make sure they come from our own allocator by intercepting
131 // __libc_memalign(). On top of that, there is no easy way to reach them. Their
132 // addresses are stored in a dynamically allocated array (the DTV) which is
133 // referenced from the static TLS. Unfortunately, we can't just rely on the DTV
134 // being reachable from the static TLS, and the dynamic TLS being reachable from
135 // the DTV. This is because the initial DTV is allocated before our interception
136 // mechanism kicks in, and thus we don't recognize it as allocated memory. We
137 // can't special-case it either, since we don't know its size.
138 // Our solution is to include in the root set all allocations made from
139 // ld-linux.so (which is where allocate_and_init() is implemented). This is
140 // guaranteed to include all dynamic TLS blocks (and possibly other allocations
141 // which we don't care about).
142 void ProcessPlatformSpecificAllocations(Frontier
*frontier
) {
143 if (!flags()->use_tls
) return;
145 StackDepotReverseMap stack_depot_reverse_map
;
146 ProcessPlatformAllocParam arg
= {frontier
, &stack_depot_reverse_map
};
147 ForEachChunk(ProcessPlatformSpecificAllocationsCb
, &arg
);
150 struct DoStopTheWorldParam
{
151 StopTheWorldCallback callback
;
155 static int DoStopTheWorldCallback(struct dl_phdr_info
*info
, size_t size
,
157 DoStopTheWorldParam
*param
= reinterpret_cast<DoStopTheWorldParam
*>(data
);
158 StopTheWorld(param
->callback
, param
->argument
);
162 // LSan calls dl_iterate_phdr() from the tracer task. This may deadlock: if one
163 // of the threads is frozen while holding the libdl lock, the tracer will hang
164 // in dl_iterate_phdr() forever.
165 // Luckily, (a) the lock is reentrant and (b) libc can't distinguish between the
166 // tracer task and the thread that spawned it. Thus, if we run the tracer task
167 // while holding the libdl lock in the parent thread, we can safely reenter it
168 // in the tracer. The solution is to run stoptheworld from a dl_iterate_phdr()
169 // callback in the parent thread.
170 void DoStopTheWorld(StopTheWorldCallback callback
, void *argument
) {
171 DoStopTheWorldParam param
= {callback
, argument
};
172 dl_iterate_phdr(DoStopTheWorldCallback
, ¶m
);
175 } // namespace __lsan
177 #endif // CAN_SANITIZE_LEAKS && SANITIZER_LINUX