1 //===-- asan_globals.cc ---------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
11 //===----------------------------------------------------------------------===//
12 #include "asan_interceptors.h"
13 #include "asan_internal.h"
14 #include "asan_mapping.h"
15 #include "asan_poisoning.h"
16 #include "asan_report.h"
17 #include "asan_stack.h"
18 #include "asan_stats.h"
19 #include "asan_thread.h"
20 #include "sanitizer_common/sanitizer_common.h"
21 #include "sanitizer_common/sanitizer_mutex.h"
22 #include "sanitizer_common/sanitizer_placement_new.h"
26 typedef __asan_global Global
;
28 struct ListOfGlobals
{
33 static BlockingMutex
mu_for_globals(LINKER_INITIALIZED
);
34 static LowLevelAllocator allocator_for_globals
;
35 static ListOfGlobals
*list_of_all_globals
;
37 static const int kDynamicInitGlobalsInitialCapacity
= 512;
38 struct DynInitGlobal
{
42 typedef InternalMmapVector
<DynInitGlobal
> VectorOfGlobals
;
43 // Lazy-initialized and never deleted.
44 static VectorOfGlobals
*dynamic_init_globals
;
46 ALWAYS_INLINE
void PoisonShadowForGlobal(const Global
*g
, u8 value
) {
47 FastPoisonShadow(g
->beg
, g
->size_with_redzone
, value
);
50 ALWAYS_INLINE
void PoisonRedZones(const Global
&g
) {
51 uptr aligned_size
= RoundUpTo(g
.size
, SHADOW_GRANULARITY
);
52 FastPoisonShadow(g
.beg
+ aligned_size
, g
.size_with_redzone
- aligned_size
,
53 kAsanGlobalRedzoneMagic
);
54 if (g
.size
!= aligned_size
) {
55 FastPoisonShadowPartialRightRedzone(
56 g
.beg
+ RoundDownTo(g
.size
, SHADOW_GRANULARITY
),
57 g
.size
% SHADOW_GRANULARITY
,
59 kAsanGlobalRedzoneMagic
);
63 static void ReportGlobal(const Global
&g
, const char *prefix
) {
64 Report("%s Global: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n",
65 prefix
, (void*)g
.beg
, g
.size
, g
.size_with_redzone
, g
.name
,
66 g
.module_name
, g
.has_dynamic_init
);
69 bool DescribeAddressIfGlobal(uptr addr
, uptr size
) {
70 if (!flags()->report_globals
) return false;
71 BlockingMutexLock
lock(&mu_for_globals
);
73 for (ListOfGlobals
*l
= list_of_all_globals
; l
; l
= l
->next
) {
74 const Global
&g
= *l
->g
;
75 if (flags()->report_globals
>= 2)
76 ReportGlobal(g
, "Search");
77 res
|= DescribeAddressRelativeToGlobal(addr
, size
, g
);
82 // Register a global variable.
83 // This function may be called more than once for every global
84 // so we store the globals in a map.
85 static void RegisterGlobal(const Global
*g
) {
87 if (flags()->report_globals
>= 2)
88 ReportGlobal(*g
, "Added");
89 CHECK(flags()->report_globals
);
90 CHECK(AddrIsInMem(g
->beg
));
91 CHECK(AddrIsAlignedByGranularity(g
->beg
));
92 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
93 if (flags()->detect_odr_violation
) {
94 // Try detecting ODR (One Definition Rule) violation, i.e. the situation
95 // where two globals with the same name are defined in different modules.
96 if (__asan_region_is_poisoned(g
->beg
, g
->size_with_redzone
)) {
97 // This check may not be enough: if the first global is much larger
98 // the entire redzone of the second global may be within the first global.
99 for (ListOfGlobals
*l
= list_of_all_globals
; l
; l
= l
->next
) {
100 if (g
->beg
== l
->g
->beg
&&
101 (flags()->detect_odr_violation
>= 2 || g
->size
!= l
->g
->size
))
102 ReportODRViolation(g
, l
->g
);
106 if (flags()->poison_heap
)
108 ListOfGlobals
*l
= new(allocator_for_globals
) ListOfGlobals
;
110 l
->next
= list_of_all_globals
;
111 list_of_all_globals
= l
;
112 if (g
->has_dynamic_init
) {
113 if (dynamic_init_globals
== 0) {
114 dynamic_init_globals
= new(allocator_for_globals
)
115 VectorOfGlobals(kDynamicInitGlobalsInitialCapacity
);
117 DynInitGlobal dyn_global
= { *g
, false };
118 dynamic_init_globals
->push_back(dyn_global
);
122 static void UnregisterGlobal(const Global
*g
) {
124 CHECK(flags()->report_globals
);
125 CHECK(AddrIsInMem(g
->beg
));
126 CHECK(AddrIsAlignedByGranularity(g
->beg
));
127 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
128 if (flags()->poison_heap
)
129 PoisonShadowForGlobal(g
, 0);
130 // We unpoison the shadow memory for the global but we do not remove it from
131 // the list because that would require O(n^2) time with the current list
132 // implementation. It might not be worth doing anyway.
135 void StopInitOrderChecking() {
136 BlockingMutexLock
lock(&mu_for_globals
);
137 if (!flags()->check_initialization_order
|| !dynamic_init_globals
)
139 flags()->check_initialization_order
= false;
140 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
141 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
142 const Global
*g
= &dyn_g
.g
;
143 // Unpoison the whole global.
144 PoisonShadowForGlobal(g
, 0);
145 // Poison redzones back.
150 } // namespace __asan
152 // ---------------------- Interface ---------------- {{{1
153 using namespace __asan
; // NOLINT
155 // Register an array of globals.
156 void __asan_register_globals(__asan_global
*globals
, uptr n
) {
157 if (!flags()->report_globals
) return;
158 BlockingMutexLock
lock(&mu_for_globals
);
159 for (uptr i
= 0; i
< n
; i
++) {
160 RegisterGlobal(&globals
[i
]);
164 // Unregister an array of globals.
165 // We must do this when a shared objects gets dlclosed.
166 void __asan_unregister_globals(__asan_global
*globals
, uptr n
) {
167 if (!flags()->report_globals
) return;
168 BlockingMutexLock
lock(&mu_for_globals
);
169 for (uptr i
= 0; i
< n
; i
++) {
170 UnregisterGlobal(&globals
[i
]);
174 // This method runs immediately prior to dynamic initialization in each TU,
175 // when all dynamically initialized globals are unpoisoned. This method
176 // poisons all global variables not defined in this TU, so that a dynamic
177 // initializer can only touch global variables in the same TU.
178 void __asan_before_dynamic_init(const char *module_name
) {
179 if (!flags()->check_initialization_order
||
180 !flags()->poison_heap
)
182 bool strict_init_order
= flags()->strict_init_order
;
183 CHECK(dynamic_init_globals
);
186 BlockingMutexLock
lock(&mu_for_globals
);
187 if (flags()->report_globals
>= 3)
188 Printf("DynInitPoison module: %s\n", module_name
);
189 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
190 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
191 const Global
*g
= &dyn_g
.g
;
192 if (dyn_g
.initialized
)
194 if (g
->module_name
!= module_name
)
195 PoisonShadowForGlobal(g
, kAsanInitializationOrderMagic
);
196 else if (!strict_init_order
)
197 dyn_g
.initialized
= true;
201 // This method runs immediately after dynamic initialization in each TU, when
202 // all dynamically initialized globals except for those defined in the current
203 // TU are poisoned. It simply unpoisons all dynamically initialized globals.
204 void __asan_after_dynamic_init() {
205 if (!flags()->check_initialization_order
||
206 !flags()->poison_heap
)
209 BlockingMutexLock
lock(&mu_for_globals
);
210 // FIXME: Optionally report that we're unpoisoning globals from a module.
211 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
212 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
213 const Global
*g
= &dyn_g
.g
;
214 if (!dyn_g
.initialized
) {
215 // Unpoison the whole global.
216 PoisonShadowForGlobal(g
, 0);
217 // Poison redzones back.