1 //===-- asan_rtl.cc -------------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
10 // Main file of the ASan run-time library.
11 //===----------------------------------------------------------------------===//
12 #include "asan_activation.h"
13 #include "asan_allocator.h"
14 #include "asan_interceptors.h"
15 #include "asan_interface_internal.h"
16 #include "asan_internal.h"
17 #include "asan_mapping.h"
18 #include "asan_poisoning.h"
19 #include "asan_report.h"
20 #include "asan_stack.h"
21 #include "asan_stats.h"
22 #include "asan_thread.h"
23 #include "sanitizer_common/sanitizer_atomic.h"
24 #include "sanitizer_common/sanitizer_flags.h"
25 #include "sanitizer_common/sanitizer_libc.h"
26 #include "sanitizer_common/sanitizer_symbolizer.h"
27 #include "lsan/lsan_common.h"
29 int __asan_option_detect_stack_use_after_return
; // Global interface symbol.
30 uptr
*__asan_test_only_reported_buggy_pointer
; // Used only for testing asan.
34 uptr AsanMappingProfile
[kAsanMappingProfileSize
];
36 static void AsanDie() {
37 static atomic_uint32_t num_calls
;
38 if (atomic_fetch_add(&num_calls
, 1, memory_order_relaxed
) != 0) {
39 // Don't die twice - run a busy loop.
42 if (flags()->sleep_before_dying
) {
43 Report("Sleeping for %d second(s)\n", flags()->sleep_before_dying
);
44 SleepForSeconds(flags()->sleep_before_dying
);
46 if (flags()->unmap_shadow_on_exit
) {
48 UnmapOrDie((void*)kLowShadowBeg
, kMidMemBeg
- kLowShadowBeg
);
49 UnmapOrDie((void*)kMidMemEnd
, kHighShadowEnd
- kMidMemEnd
);
51 UnmapOrDie((void*)kLowShadowBeg
, kHighShadowEnd
- kLowShadowBeg
);
54 if (common_flags()->coverage
)
55 __sanitizer_cov_dump();
58 if (flags()->abort_on_error
)
60 internal__exit(flags()->exitcode
);
63 static void AsanCheckFailed(const char *file
, int line
, const char *cond
,
65 Report("AddressSanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n", file
,
66 line
, cond
, (uptr
)v1
, (uptr
)v2
);
67 // FIXME: check for infinite recursion without a thread-local counter here.
68 PRINT_CURRENT_STACK();
72 // -------------------------- Flags ------------------------- {{{1
73 static const int kDefaultMallocContextSize
= 30;
75 Flags asan_flags_dont_use_directly
; // use via flags().
77 static const char *MaybeCallAsanDefaultOptions() {
78 return (&__asan_default_options
) ? __asan_default_options() : "";
81 static const char *MaybeUseAsanDefaultOptionsCompileDefinition() {
82 #ifdef ASAN_DEFAULT_OPTIONS
83 // Stringize the macro value.
84 # define ASAN_STRINGIZE(x) #x
85 # define ASAN_STRINGIZE_OPTIONS(options) ASAN_STRINGIZE(options)
86 return ASAN_STRINGIZE_OPTIONS(ASAN_DEFAULT_OPTIONS
);
92 static void ParseFlagsFromString(Flags
*f
, const char *str
) {
93 CommonFlags
*cf
= common_flags();
94 ParseCommonFlagsFromString(cf
, str
);
95 CHECK((uptr
)cf
->malloc_context_size
<= kStackTraceMax
);
96 // Please write meaningful flag descriptions when adding new flags.
97 ParseFlag(str
, &f
->quarantine_size
, "quarantine_size",
98 "Size (in bytes) of quarantine used to detect use-after-free "
99 "errors. Lower value may reduce memory usage but increase the "
100 "chance of false negatives.");
101 ParseFlag(str
, &f
->redzone
, "redzone",
102 "Minimal size (in bytes) of redzones around heap objects. "
103 "Requirement: redzone >= 16, is a power of two.");
104 ParseFlag(str
, &f
->max_redzone
, "max_redzone",
105 "Maximal size (in bytes) of redzones around heap objects.");
106 CHECK_GE(f
->redzone
, 16);
107 CHECK_GE(f
->max_redzone
, f
->redzone
);
108 CHECK_LE(f
->max_redzone
, 2048);
109 CHECK(IsPowerOfTwo(f
->redzone
));
110 CHECK(IsPowerOfTwo(f
->max_redzone
));
112 ParseFlag(str
, &f
->debug
, "debug",
113 "If set, prints some debugging information and does additional checks.");
114 ParseFlag(str
, &f
->report_globals
, "report_globals",
115 "Controls the way to handle globals (0 - don't detect buffer overflow on "
116 "globals, 1 - detect buffer overflow, 2 - print data about registered "
119 ParseFlag(str
, &f
->check_initialization_order
,
120 "check_initialization_order",
121 "If set, attempts to catch initialization order issues.");
123 ParseFlag(str
, &f
->replace_str
, "replace_str",
124 "If set, uses custom wrappers and replacements for libc string functions "
125 "to find more errors.");
127 ParseFlag(str
, &f
->replace_intrin
, "replace_intrin",
128 "If set, uses custom wrappers for memset/memcpy/memmove intinsics.");
129 ParseFlag(str
, &f
->mac_ignore_invalid_free
, "mac_ignore_invalid_free",
130 "Ignore invalid free() calls to work around some bugs. Used on OS X "
132 ParseFlag(str
, &f
->detect_stack_use_after_return
,
133 "detect_stack_use_after_return",
134 "Enables stack-use-after-return checking at run-time.");
135 ParseFlag(str
, &f
->min_uar_stack_size_log
, "min_uar_stack_size_log",
136 "Minimum fake stack size log.");
137 ParseFlag(str
, &f
->max_uar_stack_size_log
, "max_uar_stack_size_log",
138 "Maximum fake stack size log.");
139 ParseFlag(str
, &f
->uar_noreserve
, "uar_noreserve",
140 "Use mmap with 'norserve' flag to allocate fake stack.");
141 ParseFlag(str
, &f
->max_malloc_fill_size
, "max_malloc_fill_size",
142 "ASan allocator flag. max_malloc_fill_size is the maximal amount of "
143 "bytes that will be filled with malloc_fill_byte on malloc.");
144 ParseFlag(str
, &f
->malloc_fill_byte
, "malloc_fill_byte",
145 "Value used to fill the newly allocated memory.");
146 ParseFlag(str
, &f
->exitcode
, "exitcode",
147 "Override the program exit status if the tool found an error.");
148 ParseFlag(str
, &f
->allow_user_poisoning
, "allow_user_poisoning",
149 "If set, user may manually mark memory regions as poisoned or "
151 ParseFlag(str
, &f
->sleep_before_dying
, "sleep_before_dying",
152 "Number of seconds to sleep between printing an error report and "
153 "terminating the program. Useful for debugging purposes (e.g. when one "
154 "needs to attach gdb).");
156 ParseFlag(str
, &f
->check_malloc_usable_size
, "check_malloc_usable_size",
157 "Allows the users to work around the bug in Nvidia drivers prior to "
160 ParseFlag(str
, &f
->unmap_shadow_on_exit
, "unmap_shadow_on_exit",
161 "If set, explicitly unmaps the (huge) shadow at exit.");
162 ParseFlag(str
, &f
->abort_on_error
, "abort_on_error",
163 "If set, the tool calls abort() instead of _exit() after printing the "
165 ParseFlag(str
, &f
->print_stats
, "print_stats",
166 "Print various statistics after printing an error message or if "
168 ParseFlag(str
, &f
->print_legend
, "print_legend",
169 "Print the legend for the shadow bytes.");
170 ParseFlag(str
, &f
->atexit
, "atexit",
171 "If set, prints ASan exit stats even after program terminates "
174 ParseFlag(str
, &f
->disable_core
, "disable_core",
175 "Disable core dumping. By default, disable_core=1 on 64-bit to avoid "
176 "dumping a 16T+ core file. "
177 "Ignored on OSes that don't dump core by default.");
179 ParseFlag(str
, &f
->allow_reexec
, "allow_reexec",
180 "Allow the tool to re-exec the program. This may interfere badly with "
183 ParseFlag(str
, &f
->print_full_thread_history
,
184 "print_full_thread_history",
185 "If set, prints thread creation stacks for the threads involved in the "
186 "report and their ancestors up to the main thread.");
188 ParseFlag(str
, &f
->poison_heap
, "poison_heap",
189 "Poison (or not) the heap memory on [de]allocation. Zero value is useful "
190 "for benchmarking the allocator or instrumentator.");
192 ParseFlag(str
, &f
->poison_partial
, "poison_partial",
193 "If true, poison partially addressable 8-byte aligned words "
194 "(default=true). This flag affects heap and global buffers, but not "
197 ParseFlag(str
, &f
->alloc_dealloc_mismatch
, "alloc_dealloc_mismatch",
198 "Report errors on malloc/delete, new/free, new/delete[], etc.");
199 ParseFlag(str
, &f
->strict_memcmp
, "strict_memcmp",
200 "If true, assume that memcmp(p1, p2, n) always reads n bytes before "
201 "comparing p1 and p2.");
203 ParseFlag(str
, &f
->strict_init_order
, "strict_init_order",
204 "If true, assume that dynamic initializers can never access globals from "
205 "other modules, even if the latter are already initialized.");
207 ParseFlag(str
, &f
->start_deactivated
, "start_deactivated",
208 "If true, ASan tweaks a bunch of other flags (quarantine, redzone, heap "
209 "poisoning) to reduce memory consumption as much as possible, and "
210 "restores them to original values when the first instrumented module is "
211 "loaded into the process. This is mainly intended to be used on "
214 ParseFlag(str
, &f
->detect_invalid_pointer_pairs
,
215 "detect_invalid_pointer_pairs",
216 "If non-zero, try to detect operations like <, <=, >, >= and - on "
217 "invalid pointer pairs (e.g. when pointers belong to different objects). "
218 "The bigger the value the harder we try.");
220 ParseFlag(str
, &f
->detect_container_overflow
,
221 "detect_container_overflow",
222 "If true, honor the container overflow annotations. "
223 "See https://code.google.com/p/address-sanitizer/wiki/ContainerOverflow");
225 ParseFlag(str
, &f
->detect_odr_violation
, "detect_odr_violation",
226 "If >=2, detect violation of One-Definition-Rule (ODR); "
227 "If ==1, detect ODR-violation only if the two variables "
228 "have different sizes");
231 void InitializeFlags(Flags
*f
, const char *env
) {
232 CommonFlags
*cf
= common_flags();
233 SetCommonFlagsDefaults(cf
);
234 cf
->detect_leaks
= CAN_SANITIZE_LEAKS
;
235 cf
->external_symbolizer_path
= GetEnv("ASAN_SYMBOLIZER_PATH");
236 cf
->malloc_context_size
= kDefaultMallocContextSize
;
237 cf
->intercept_tls_get_addr
= true;
238 cf
->coverage
= false;
240 internal_memset(f
, 0, sizeof(*f
));
241 f
->quarantine_size
= (ASAN_LOW_MEMORY
) ? 1UL << 26 : 1UL << 28;
243 f
->max_redzone
= 2048;
245 f
->report_globals
= 1;
246 f
->check_initialization_order
= false;
247 f
->replace_str
= true;
248 f
->replace_intrin
= true;
249 f
->mac_ignore_invalid_free
= false;
250 f
->detect_stack_use_after_return
= false; // Also needs the compiler flag.
251 f
->min_uar_stack_size_log
= 16; // We can't do smaller anyway.
252 f
->max_uar_stack_size_log
= 20; // 1Mb per size class, i.e. ~11Mb per thread.
253 f
->uar_noreserve
= false;
254 f
->max_malloc_fill_size
= 0x1000; // By default, fill only the first 4K.
255 f
->malloc_fill_byte
= 0xbe;
256 f
->exitcode
= ASAN_DEFAULT_FAILURE_EXITCODE
;
257 f
->allow_user_poisoning
= true;
258 f
->sleep_before_dying
= 0;
259 f
->check_malloc_usable_size
= true;
260 f
->unmap_shadow_on_exit
= false;
261 f
->abort_on_error
= false;
262 f
->print_stats
= false;
263 f
->print_legend
= true;
265 f
->disable_core
= (SANITIZER_WORDSIZE
== 64);
266 f
->allow_reexec
= true;
267 f
->print_full_thread_history
= true;
268 f
->poison_heap
= true;
269 f
->poison_partial
= true;
270 // Turn off alloc/dealloc mismatch checker on Mac and Windows for now.
271 // https://code.google.com/p/address-sanitizer/issues/detail?id=131
272 // https://code.google.com/p/address-sanitizer/issues/detail?id=309
273 // TODO(glider,timurrrr): Fix known issues and enable this back.
274 f
->alloc_dealloc_mismatch
= (SANITIZER_MAC
== 0) && (SANITIZER_WINDOWS
== 0);
275 f
->strict_memcmp
= true;
276 f
->strict_init_order
= false;
277 f
->start_deactivated
= false;
278 f
->detect_invalid_pointer_pairs
= 0;
279 f
->detect_container_overflow
= true;
281 // Override from compile definition.
282 ParseFlagsFromString(f
, MaybeUseAsanDefaultOptionsCompileDefinition());
284 // Override from user-specified string.
285 ParseFlagsFromString(f
, MaybeCallAsanDefaultOptions());
286 VReport(1, "Using the defaults from __asan_default_options: %s\n",
287 MaybeCallAsanDefaultOptions());
289 // Override from command line.
290 ParseFlagsFromString(f
, env
);
291 if (common_flags()->help
) {
292 PrintFlagDescriptions();
295 if (!CAN_SANITIZE_LEAKS
&& cf
->detect_leaks
) {
296 Report("%s: detect_leaks is not supported on this platform.\n",
298 cf
->detect_leaks
= false;
301 // Make "strict_init_order" imply "check_initialization_order".
302 // TODO(samsonov): Use a single runtime flag for an init-order checker.
303 if (f
->strict_init_order
) {
304 f
->check_initialization_order
= true;
308 // Parse flags that may change between startup and activation.
309 // On Android they come from a system property.
310 // On other platforms this is no-op.
311 void ParseExtraActivationFlags() {
313 GetExtraActivationFlags(buf
, sizeof(buf
));
314 ParseFlagsFromString(flags(), buf
);
316 VReport(1, "Extra activation flags: %s\n", buf
);
319 // -------------------------- Globals --------------------- {{{1
321 bool asan_init_is_running
;
322 void (*death_callback
)(void);
324 #if !ASAN_FIXED_MAPPING
325 uptr kHighMemEnd
, kMidMemBeg
, kMidMemEnd
;
328 // -------------------------- Misc ---------------- {{{1
329 void ShowStatsAndAbort() {
330 __asan_print_accumulated_stats();
334 // ---------------------- mmap -------------------- {{{1
335 // Reserve memory range [beg, end].
336 static void ReserveShadowMemoryRange(uptr beg
, uptr end
) {
337 CHECK_EQ((beg
% GetPageSizeCached()), 0);
338 CHECK_EQ(((end
+ 1) % GetPageSizeCached()), 0);
339 uptr size
= end
- beg
+ 1;
340 DecreaseTotalMmap(size
); // Don't count the shadow against mmap_limit_mb.
341 void *res
= MmapFixedNoReserve(beg
, size
);
342 if (res
!= (void*)beg
) {
343 Report("ReserveShadowMemoryRange failed while trying to map 0x%zx bytes. "
344 "Perhaps you're using ulimit -v\n", size
);
349 // --------------- LowLevelAllocateCallbac ---------- {{{1
350 static void OnLowLevelAllocate(uptr ptr
, uptr size
) {
351 PoisonShadow(ptr
, size
, kAsanInternalHeapMagic
);
354 // -------------------------- Run-time entry ------------------- {{{1
355 // exported functions
356 #define ASAN_REPORT_ERROR(type, is_write, size) \
357 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
358 void __asan_report_ ## type ## size(uptr addr); \
359 void __asan_report_ ## type ## size(uptr addr) { \
360 GET_CALLER_PC_BP_SP; \
361 __asan_report_error(pc, bp, sp, addr, is_write, size); \
364 ASAN_REPORT_ERROR(load
, false, 1)
365 ASAN_REPORT_ERROR(load
, false, 2)
366 ASAN_REPORT_ERROR(load
, false, 4)
367 ASAN_REPORT_ERROR(load
, false, 8)
368 ASAN_REPORT_ERROR(load
, false, 16)
369 ASAN_REPORT_ERROR(store
, true, 1)
370 ASAN_REPORT_ERROR(store
, true, 2)
371 ASAN_REPORT_ERROR(store
, true, 4)
372 ASAN_REPORT_ERROR(store
, true, 8)
373 ASAN_REPORT_ERROR(store
, true, 16)
375 #define ASAN_REPORT_ERROR_N(type, is_write) \
376 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
377 void __asan_report_ ## type ## _n(uptr addr, uptr size); \
378 void __asan_report_ ## type ## _n(uptr addr, uptr size) { \
379 GET_CALLER_PC_BP_SP; \
380 __asan_report_error(pc, bp, sp, addr, is_write, size); \
383 ASAN_REPORT_ERROR_N(load
, false)
384 ASAN_REPORT_ERROR_N(store
, true)
386 #define ASAN_MEMORY_ACCESS_CALLBACK(type, is_write, size) \
387 extern "C" NOINLINE INTERFACE_ATTRIBUTE void __asan_##type##size(uptr addr); \
388 void __asan_##type##size(uptr addr) { \
389 uptr sp = MEM_TO_SHADOW(addr); \
390 uptr s = size <= SHADOW_GRANULARITY ? *reinterpret_cast<u8 *>(sp) \
391 : *reinterpret_cast<u16 *>(sp); \
393 if (UNLIKELY(size >= SHADOW_GRANULARITY || \
394 ((s8)((addr & (SHADOW_GRANULARITY - 1)) + size - 1)) >= \
396 if (__asan_test_only_reported_buggy_pointer) { \
397 *__asan_test_only_reported_buggy_pointer = addr; \
399 GET_CALLER_PC_BP_SP; \
400 __asan_report_error(pc, bp, sp, addr, is_write, size); \
406 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 1)
407 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 2)
408 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 4)
409 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 8)
410 ASAN_MEMORY_ACCESS_CALLBACK(load
, false, 16)
411 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 1)
412 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 2)
413 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 4)
414 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 8)
415 ASAN_MEMORY_ACCESS_CALLBACK(store
, true, 16)
418 NOINLINE INTERFACE_ATTRIBUTE
void __asan_loadN(uptr addr
, uptr size
) {
419 if (__asan_region_is_poisoned(addr
, size
)) {
421 __asan_report_error(pc
, bp
, sp
, addr
, false, size
);
426 NOINLINE INTERFACE_ATTRIBUTE
void __asan_storeN(uptr addr
, uptr size
) {
427 if (__asan_region_is_poisoned(addr
, size
)) {
429 __asan_report_error(pc
, bp
, sp
, addr
, true, size
);
433 // Force the linker to keep the symbols for various ASan interface functions.
434 // We want to keep those in the executable in order to let the instrumented
435 // dynamic libraries access the symbol even if it is not used by the executable
436 // itself. This should help if the build system is removing dead code at link
438 static NOINLINE
void force_interface_symbols() {
439 volatile int fake_condition
= 0; // prevent dead condition elimination.
440 // __asan_report_* functions are noreturn, so we need a switch to prevent
441 // the compiler from removing any of them.
442 switch (fake_condition
) {
443 case 1: __asan_report_load1(0); break;
444 case 2: __asan_report_load2(0); break;
445 case 3: __asan_report_load4(0); break;
446 case 4: __asan_report_load8(0); break;
447 case 5: __asan_report_load16(0); break;
448 case 6: __asan_report_store1(0); break;
449 case 7: __asan_report_store2(0); break;
450 case 8: __asan_report_store4(0); break;
451 case 9: __asan_report_store8(0); break;
452 case 10: __asan_report_store16(0); break;
453 case 12: __asan_register_globals(0, 0); break;
454 case 13: __asan_unregister_globals(0, 0); break;
455 case 14: __asan_set_death_callback(0); break;
456 case 15: __asan_set_error_report_callback(0); break;
457 case 16: __asan_handle_no_return(); break;
458 case 17: __asan_address_is_poisoned(0); break;
459 case 18: __asan_get_allocated_size(0); break;
460 case 19: __asan_get_current_allocated_bytes(); break;
461 case 20: __asan_get_estimated_allocated_size(0); break;
462 case 21: __asan_get_free_bytes(); break;
463 case 22: __asan_get_heap_size(); break;
464 case 23: __asan_get_ownership(0); break;
465 case 24: __asan_get_unmapped_bytes(); break;
466 case 25: __asan_poison_memory_region(0, 0); break;
467 case 26: __asan_unpoison_memory_region(0, 0); break;
468 case 27: __asan_set_error_exit_code(0); break;
469 case 30: __asan_before_dynamic_init(0); break;
470 case 31: __asan_after_dynamic_init(); break;
471 case 32: __asan_poison_stack_memory(0, 0); break;
472 case 33: __asan_unpoison_stack_memory(0, 0); break;
473 case 34: __asan_region_is_poisoned(0, 0); break;
474 case 35: __asan_describe_address(0); break;
478 static void asan_atexit() {
479 Printf("AddressSanitizer exit stats:\n");
480 __asan_print_accumulated_stats();
481 // Print AsanMappingProfile.
482 for (uptr i
= 0; i
< kAsanMappingProfileSize
; i
++) {
483 if (AsanMappingProfile
[i
] == 0) continue;
484 Printf("asan_mapping.h:%zd -- %zd\n", i
, AsanMappingProfile
[i
]);
488 static void InitializeHighMemEnd() {
489 #if !ASAN_FIXED_MAPPING
490 kHighMemEnd
= GetMaxVirtualAddress();
491 // Increase kHighMemEnd to make sure it's properly
492 // aligned together with kHighMemBeg:
493 kHighMemEnd
|= SHADOW_GRANULARITY
* GetPageSizeCached() - 1;
494 #endif // !ASAN_FIXED_MAPPING
495 CHECK_EQ((kHighMemBeg
% GetPageSizeCached()), 0);
498 static void ProtectGap(uptr a
, uptr size
) {
499 CHECK_EQ(a
, (uptr
)Mprotect(a
, size
));
502 static void PrintAddressSpaceLayout() {
503 Printf("|| `[%p, %p]` || HighMem ||\n",
504 (void*)kHighMemBeg
, (void*)kHighMemEnd
);
505 Printf("|| `[%p, %p]` || HighShadow ||\n",
506 (void*)kHighShadowBeg
, (void*)kHighShadowEnd
);
508 Printf("|| `[%p, %p]` || ShadowGap3 ||\n",
509 (void*)kShadowGap3Beg
, (void*)kShadowGap3End
);
510 Printf("|| `[%p, %p]` || MidMem ||\n",
511 (void*)kMidMemBeg
, (void*)kMidMemEnd
);
512 Printf("|| `[%p, %p]` || ShadowGap2 ||\n",
513 (void*)kShadowGap2Beg
, (void*)kShadowGap2End
);
514 Printf("|| `[%p, %p]` || MidShadow ||\n",
515 (void*)kMidShadowBeg
, (void*)kMidShadowEnd
);
517 Printf("|| `[%p, %p]` || ShadowGap ||\n",
518 (void*)kShadowGapBeg
, (void*)kShadowGapEnd
);
520 Printf("|| `[%p, %p]` || LowShadow ||\n",
521 (void*)kLowShadowBeg
, (void*)kLowShadowEnd
);
522 Printf("|| `[%p, %p]` || LowMem ||\n",
523 (void*)kLowMemBeg
, (void*)kLowMemEnd
);
525 Printf("MemToShadow(shadow): %p %p %p %p",
526 (void*)MEM_TO_SHADOW(kLowShadowBeg
),
527 (void*)MEM_TO_SHADOW(kLowShadowEnd
),
528 (void*)MEM_TO_SHADOW(kHighShadowBeg
),
529 (void*)MEM_TO_SHADOW(kHighShadowEnd
));
532 (void*)MEM_TO_SHADOW(kMidShadowBeg
),
533 (void*)MEM_TO_SHADOW(kMidShadowEnd
));
536 Printf("redzone=%zu\n", (uptr
)flags()->redzone
);
537 Printf("max_redzone=%zu\n", (uptr
)flags()->max_redzone
);
538 Printf("quarantine_size=%zuM\n", (uptr
)flags()->quarantine_size
>> 20);
539 Printf("malloc_context_size=%zu\n",
540 (uptr
)common_flags()->malloc_context_size
);
542 Printf("SHADOW_SCALE: %zx\n", (uptr
)SHADOW_SCALE
);
543 Printf("SHADOW_GRANULARITY: %zx\n", (uptr
)SHADOW_GRANULARITY
);
544 Printf("SHADOW_OFFSET: %zx\n", (uptr
)SHADOW_OFFSET
);
545 CHECK(SHADOW_SCALE
>= 3 && SHADOW_SCALE
<= 7);
547 CHECK(kMidShadowBeg
> kLowShadowEnd
&&
548 kMidMemBeg
> kMidShadowEnd
&&
549 kHighShadowBeg
> kMidMemEnd
);
552 static void AsanInitInternal() {
553 if (LIKELY(asan_inited
)) return;
554 SanitizerToolName
= "AddressSanitizer";
555 CHECK(!asan_init_is_running
&& "ASan init calls itself!");
556 asan_init_is_running
= true;
558 // Initialize flags. This must be done early, because most of the
559 // initialization steps look at flags().
560 const char *options
= GetEnv("ASAN_OPTIONS");
561 InitializeFlags(flags(), options
);
563 InitializeHighMemEnd();
565 // Make sure we are not statically linked.
566 AsanDoesNotSupportStaticLinkage();
568 // Install tool-specific callbacks in sanitizer_common.
569 SetDieCallback(AsanDie
);
570 SetCheckFailedCallback(AsanCheckFailed
);
571 SetPrintfAndReportCallback(AppendToErrorMessageBuffer
);
573 if (!flags()->start_deactivated
)
574 ParseExtraActivationFlags();
576 __sanitizer_set_report_path(common_flags()->log_path
);
577 __asan_option_detect_stack_use_after_return
=
578 flags()->detect_stack_use_after_return
;
579 CHECK_LE(flags()->min_uar_stack_size_log
, flags()->max_uar_stack_size_log
);
582 VReport(1, "Parsed ASAN_OPTIONS: %s\n", options
);
585 if (flags()->start_deactivated
)
586 AsanStartDeactivated();
588 // Re-exec ourselves if we need to set additional env or command line args.
591 // Setup internal allocator callback.
592 SetLowLevelAllocateCallback(OnLowLevelAllocate
);
594 InitializeAsanInterceptors();
596 ReplaceSystemMalloc();
598 uptr shadow_start
= kLowShadowBeg
;
600 shadow_start
-= GetMmapGranularity();
601 bool full_shadow_is_available
=
602 MemoryRangeIsAvailable(shadow_start
, kHighShadowEnd
);
604 #if SANITIZER_LINUX && defined(__x86_64__) && !ASAN_FIXED_MAPPING
605 if (!full_shadow_is_available
) {
606 kMidMemBeg
= kLowMemEnd
< 0x3000000000ULL
? 0x3000000000ULL
: 0;
607 kMidMemEnd
= kLowMemEnd
< 0x3000000000ULL
? 0x4fffffffffULL
: 0;
611 if (common_flags()->verbosity
)
612 PrintAddressSpaceLayout();
614 if (flags()->disable_core
) {
618 if (full_shadow_is_available
) {
619 // mmap the low shadow plus at least one page at the left.
621 ReserveShadowMemoryRange(shadow_start
, kLowShadowEnd
);
622 // mmap the high shadow.
623 ReserveShadowMemoryRange(kHighShadowBeg
, kHighShadowEnd
);
625 ProtectGap(kShadowGapBeg
, kShadowGapEnd
- kShadowGapBeg
+ 1);
626 CHECK_EQ(kShadowGapEnd
, kHighShadowBeg
- 1);
627 } else if (kMidMemBeg
&&
628 MemoryRangeIsAvailable(shadow_start
, kMidMemBeg
- 1) &&
629 MemoryRangeIsAvailable(kMidMemEnd
+ 1, kHighShadowEnd
)) {
630 CHECK(kLowShadowBeg
!= kLowShadowEnd
);
631 // mmap the low shadow plus at least one page at the left.
632 ReserveShadowMemoryRange(shadow_start
, kLowShadowEnd
);
633 // mmap the mid shadow.
634 ReserveShadowMemoryRange(kMidShadowBeg
, kMidShadowEnd
);
635 // mmap the high shadow.
636 ReserveShadowMemoryRange(kHighShadowBeg
, kHighShadowEnd
);
638 ProtectGap(kShadowGapBeg
, kShadowGapEnd
- kShadowGapBeg
+ 1);
639 ProtectGap(kShadowGap2Beg
, kShadowGap2End
- kShadowGap2Beg
+ 1);
640 ProtectGap(kShadowGap3Beg
, kShadowGap3End
- kShadowGap3Beg
+ 1);
642 Report("Shadow memory range interleaves with an existing memory mapping. "
643 "ASan cannot proceed correctly. ABORTING.\n");
648 AsanTSDInit(PlatformTSDDtor
);
649 InstallDeadlySignalHandlers(AsanOnSIGSEGV
);
651 // Allocator should be initialized before starting external symbolizer, as
652 // fork() on Mac locks the allocator.
653 InitializeAllocator();
655 Symbolizer::Init(common_flags()->external_symbolizer_path
);
657 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
658 // should be set to 1 prior to initializing the threads.
660 asan_init_is_running
= false;
665 if (common_flags()->coverage
) {
666 __sanitizer_cov_init();
667 Atexit(__sanitizer_cov_dump
);
673 // Create main thread.
674 AsanThread
*main_thread
= AsanThread::Create(0, 0);
675 CreateThreadContextArgs create_main_args
= { main_thread
, 0 };
676 u32 main_tid
= asanThreadRegistry().CreateThread(
677 0, true, 0, &create_main_args
);
678 CHECK_EQ(0, main_tid
);
679 SetCurrentThread(main_thread
);
680 main_thread
->ThreadStart(internal_getpid());
681 force_interface_symbols(); // no-op.
682 SanitizerInitializeUnwinder();
684 #if CAN_SANITIZE_LEAKS
685 __lsan::InitCommonLsan();
686 if (common_flags()->detect_leaks
&& common_flags()->leak_check_at_exit
) {
687 Atexit(__lsan::DoLeakCheck
);
689 #endif // CAN_SANITIZE_LEAKS
691 VReport(1, "AddressSanitizer Init done\n");
694 // Initialize as requested from some part of ASan runtime library (interceptors,
696 void AsanInitFromRtl() {
701 // Initialize runtime in case it's LD_PRELOAD-ed into unsanitized executable
702 // (and thus normal initializer from .preinit_array haven't run).
704 class AsanInitializer
{
707 AsanCheckIncompatibleRT();
708 AsanCheckDynamicRTPrereqs();
709 if (UNLIKELY(!asan_inited
))
714 static AsanInitializer asan_initializer
;
715 #endif // ASAN_DYNAMIC
717 } // namespace __asan
719 // ---------------------- Interface ---------------- {{{1
720 using namespace __asan
; // NOLINT
722 #if !SANITIZER_SUPPORTS_WEAK_HOOKS
724 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
725 const char* __asan_default_options() { return ""; }
729 int NOINLINE
__asan_set_error_exit_code(int exit_code
) {
730 int old
= flags()->exitcode
;
731 flags()->exitcode
= exit_code
;
735 void NOINLINE
__asan_handle_no_return() {
737 AsanThread
*curr_thread
= GetCurrentThread();
739 uptr PageSize
= GetPageSizeCached();
740 uptr top
= curr_thread
->stack_top();
741 uptr bottom
= ((uptr
)&local_stack
- PageSize
) & ~(PageSize
-1);
742 static const uptr kMaxExpectedCleanupSize
= 64 << 20; // 64M
743 if (top
- bottom
> kMaxExpectedCleanupSize
) {
744 static bool reported_warning
= false;
745 if (reported_warning
)
747 reported_warning
= true;
748 Report("WARNING: ASan is ignoring requested __asan_handle_no_return: "
749 "stack top: %p; bottom %p; size: %p (%zd)\n"
750 "False positive error reports may follow\n"
752 "http://code.google.com/p/address-sanitizer/issues/detail?id=189\n",
753 top
, bottom
, top
- bottom
, top
- bottom
);
756 PoisonShadow(bottom
, top
- bottom
, 0);
757 if (curr_thread
->has_fake_stack())
758 curr_thread
->fake_stack()->HandleNoReturn();
761 void NOINLINE
__asan_set_death_callback(void (*callback
)(void)) {
762 death_callback
= callback
;
765 // Initialize as requested from instrumented application code.
766 // We use this call as a trigger to wake up ASan from deactivated state.
768 AsanCheckIncompatibleRT();