libsanitizer/asan/asan_report.cc

   1 //===-- asan_report.cc ----------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // This file contains error reporting code.
  11 //===----------------------------------------------------------------------===//
  12
  13 #include "asan_flags.h"
  14 #include "asan_internal.h"
  15 #include "asan_mapping.h"
  16 #include "asan_report.h"
  17 #include "asan_stack.h"
  18 #include "asan_thread.h"
  19 #include "sanitizer_common/sanitizer_common.h"
  20 #include "sanitizer_common/sanitizer_flags.h"
  21 #include "sanitizer_common/sanitizer_report_decorator.h"
  22 #include "sanitizer_common/sanitizer_stackdepot.h"
  23 #include "sanitizer_common/sanitizer_symbolizer.h"
  24
  25 namespace __asan {
  26
  27 // -------------------- User-specified callbacks ----------------- {{{1
  28 static void (*error_report_callback)(const char*);
  29 static char *error_message_buffer = nullptr;
  30 static uptr error_message_buffer_pos = 0;
  31 static uptr error_message_buffer_size = 0;
  32
  33 struct ReportData {
  34   uptr pc;
  35   uptr sp;
  36   uptr bp;
  37   uptr addr;
  38   bool is_write;
  39   uptr access_size;
  40   const char *description;
  41 };
  42
  43 static bool report_happened = false;
  44 static ReportData report_data = {};
  45
  46 void AppendToErrorMessageBuffer(const char *buffer) {
  47   if (error_message_buffer) {
  48     uptr length = internal_strlen(buffer);
  49     CHECK_GE(error_message_buffer_size, error_message_buffer_pos);
  50     uptr remaining = error_message_buffer_size - error_message_buffer_pos;
  51     internal_strncpy(error_message_buffer + error_message_buffer_pos,
  52                      buffer, remaining);
  53     error_message_buffer[error_message_buffer_size - 1] = '\0';
  54     // FIXME: reallocate the buffer instead of truncating the message.
  55     error_message_buffer_pos += Min(remaining, length);
  56   }
  57 }
  58
  59 // ---------------------- Decorator ------------------------------ {{{1
  60 class Decorator: public __sanitizer::SanitizerCommonDecorator {
  61  public:
  62   Decorator() : SanitizerCommonDecorator() { }
  63   const char *Access()     { return Blue(); }
  64   const char *EndAccess()  { return Default(); }
  65   const char *Location()   { return Green(); }
  66   const char *EndLocation() { return Default(); }
  67   const char *Allocation()  { return Magenta(); }
  68   const char *EndAllocation()  { return Default(); }
  69
  70   const char *ShadowByte(u8 byte) {
  71     switch (byte) {
  72       case kAsanHeapLeftRedzoneMagic:
  73       case kAsanHeapRightRedzoneMagic:
  74       case kAsanArrayCookieMagic:
  75         return Red();
  76       case kAsanHeapFreeMagic:
  77         return Magenta();
  78       case kAsanStackLeftRedzoneMagic:
  79       case kAsanStackMidRedzoneMagic:
  80       case kAsanStackRightRedzoneMagic:
  81       case kAsanStackPartialRedzoneMagic:
  82         return Red();
  83       case kAsanStackAfterReturnMagic:
  84         return Magenta();
  85       case kAsanInitializationOrderMagic:
  86         return Cyan();
  87       case kAsanUserPoisonedMemoryMagic:
  88       case kAsanContiguousContainerOOBMagic:
  89       case kAsanAllocaLeftMagic:
  90       case kAsanAllocaRightMagic:
  91         return Blue();
  92       case kAsanStackUseAfterScopeMagic:
  93         return Magenta();
  94       case kAsanGlobalRedzoneMagic:
  95         return Red();
  96       case kAsanInternalHeapMagic:
  97         return Yellow();
  98       case kAsanIntraObjectRedzone:
  99         return Yellow();
 100       default:
 101         return Default();
 102     }
 103   }
 104   const char *EndShadowByte() { return Default(); }
 105   const char *MemoryByte() { return Magenta(); }
 106   const char *EndMemoryByte() { return Default(); }
 107 };
 108
 109 // ---------------------- Helper functions ----------------------- {{{1
 110
 111 static void PrintMemoryByte(InternalScopedString *str, const char *before,
 112     u8 byte, bool in_shadow, const char *after = "\n") {
 113   Decorator d;
 114   str->append("%s%s%x%x%s%s", before,
 115               in_shadow ? d.ShadowByte(byte) : d.MemoryByte(),
 116               byte >> 4, byte & 15,
 117               in_shadow ? d.EndShadowByte() : d.EndMemoryByte(), after);
 118 }
 119
 120 static void PrintShadowByte(InternalScopedString *str, const char *before,
 121     u8 byte, const char *after = "\n") {
 122   PrintMemoryByte(str, before, byte, /*in_shadow*/true, after);
 123 }
 124
 125 static void PrintShadowBytes(InternalScopedString *str, const char *before,
 126                              u8 *bytes, u8 *guilty, uptr n) {
 127   Decorator d;
 128   if (before) str->append("%s%p:", before, bytes);
 129   for (uptr i = 0; i < n; i++) {
 130     u8 *p = bytes + i;
 131     const char *before =
 132         p == guilty ? "[" : (p - 1 == guilty && i != 0) ? "" : " ";
 133     const char *after = p == guilty ? "]" : "";
 134     PrintShadowByte(str, before, *p, after);
 135   }
 136   str->append("\n");
 137 }
 138
 139 static void PrintLegend(InternalScopedString *str) {
 140   str->append(
 141       "Shadow byte legend (one shadow byte represents %d "
 142       "application bytes):\n",
 143       (int)SHADOW_GRANULARITY);
 144   PrintShadowByte(str, "  Addressable:           ", 0);
 145   str->append("  Partially addressable: ");
 146   for (u8 i = 1; i < SHADOW_GRANULARITY; i++) PrintShadowByte(str, "", i, " ");
 147   str->append("\n");
 148   PrintShadowByte(str, "  Heap left redzone:       ",
 149                   kAsanHeapLeftRedzoneMagic);
 150   PrintShadowByte(str, "  Heap right redzone:      ",
 151                   kAsanHeapRightRedzoneMagic);
 152   PrintShadowByte(str, "  Freed heap region:       ", kAsanHeapFreeMagic);
 153   PrintShadowByte(str, "  Stack left redzone:      ",
 154                   kAsanStackLeftRedzoneMagic);
 155   PrintShadowByte(str, "  Stack mid redzone:       ",
 156                   kAsanStackMidRedzoneMagic);
 157   PrintShadowByte(str, "  Stack right redzone:     ",
 158                   kAsanStackRightRedzoneMagic);
 159   PrintShadowByte(str, "  Stack partial redzone:   ",
 160                   kAsanStackPartialRedzoneMagic);
 161   PrintShadowByte(str, "  Stack after return:      ",
 162                   kAsanStackAfterReturnMagic);
 163   PrintShadowByte(str, "  Stack use after scope:   ",
 164                   kAsanStackUseAfterScopeMagic);
 165   PrintShadowByte(str, "  Global redzone:          ", kAsanGlobalRedzoneMagic);
 166   PrintShadowByte(str, "  Global init order:       ",
 167                   kAsanInitializationOrderMagic);
 168   PrintShadowByte(str, "  Poisoned by user:        ",
 169                   kAsanUserPoisonedMemoryMagic);
 170   PrintShadowByte(str, "  Container overflow:      ",
 171                   kAsanContiguousContainerOOBMagic);
 172   PrintShadowByte(str, "  Array cookie:            ",
 173                   kAsanArrayCookieMagic);
 174   PrintShadowByte(str, "  Intra object redzone:    ",
 175                   kAsanIntraObjectRedzone);
 176   PrintShadowByte(str, "  ASan internal:           ", kAsanInternalHeapMagic);
 177   PrintShadowByte(str, "  Left alloca redzone:     ", kAsanAllocaLeftMagic);
 178   PrintShadowByte(str, "  Right alloca redzone:    ", kAsanAllocaRightMagic);
 179 }
 180
 181 void MaybeDumpInstructionBytes(uptr pc) {
 182   if (!flags()->dump_instruction_bytes || (pc < GetPageSizeCached()))
 183     return;
 184   InternalScopedString str(1024);
 185   str.append("First 16 instruction bytes at pc: ");
 186   if (IsAccessibleMemoryRange(pc, 16)) {
 187     for (int i = 0; i < 16; ++i) {
 188       PrintMemoryByte(&str, "", ((u8 *)pc)[i], /*in_shadow*/false, " ");
 189     }
 190     str.append("\n");
 191   } else {
 192     str.append("unaccessible\n");
 193   }
 194   Report("%s", str.data());
 195 }
 196
 197 static void PrintShadowMemoryForAddress(uptr addr) {
 198   if (!AddrIsInMem(addr)) return;
 199   uptr shadow_addr = MemToShadow(addr);
 200   const uptr n_bytes_per_row = 16;
 201   uptr aligned_shadow = shadow_addr & ~(n_bytes_per_row - 1);
 202   InternalScopedString str(4096 * 8);
 203   str.append("Shadow bytes around the buggy address:\n");
 204   for (int i = -5; i <= 5; i++) {
 205     const char *prefix = (i == 0) ? "=>" : "  ";
 206     PrintShadowBytes(&str, prefix, (u8 *)(aligned_shadow + i * n_bytes_per_row),
 207                      (u8 *)shadow_addr, n_bytes_per_row);
 208   }
 209   if (flags()->print_legend) PrintLegend(&str);
 210   Printf("%s", str.data());
 211 }
 212
 213 static void PrintZoneForPointer(uptr ptr, uptr zone_ptr,
 214                                 const char *zone_name) {
 215   if (zone_ptr) {
 216     if (zone_name) {
 217       Printf("malloc_zone_from_ptr(%p) = %p, which is %s\n",
 218                  ptr, zone_ptr, zone_name);
 219     } else {
 220       Printf("malloc_zone_from_ptr(%p) = %p, which doesn't have a name\n",
 221                  ptr, zone_ptr);
 222     }
 223   } else {
 224     Printf("malloc_zone_from_ptr(%p) = 0\n", ptr);
 225   }
 226 }
 227
 228 static void DescribeThread(AsanThread *t) {
 229   if (t)
 230     DescribeThread(t->context());
 231 }
 232
 233 // ---------------------- Address Descriptions ------------------- {{{1
 234
 235 static bool IsASCII(unsigned char c) {
 236   return /*0x00 <= c &&*/ c <= 0x7F;
 237 }
 238
 239 static const char *MaybeDemangleGlobalName(const char *name) {
 240   // We can spoil names of globals with C linkage, so use an heuristic
 241   // approach to check if the name should be demangled.
 242   bool should_demangle = false;
 243   if (name[0] == '_' && name[1] == 'Z')
 244     should_demangle = true;
 245   else if (SANITIZER_WINDOWS && name[0] == '\01' && name[1] == '?')
 246     should_demangle = true;
 247
 248   return should_demangle ? Symbolizer::GetOrInit()->Demangle(name) : name;
 249 }
 250
 251 // Check if the global is a zero-terminated ASCII string. If so, print it.
 252 static void PrintGlobalNameIfASCII(InternalScopedString *str,
 253                                    const __asan_global &g) {
 254   for (uptr p = g.beg; p < g.beg + g.size - 1; p++) {
 255     unsigned char c = *(unsigned char*)p;
 256     if (c == '\0' || !IsASCII(c)) return;
 257   }
 258   if (*(char*)(g.beg + g.size - 1) != '\0') return;
 259   str->append("  '%s' is ascii string '%s'\n", MaybeDemangleGlobalName(g.name),
 260               (char *)g.beg);
 261 }
 262
 263 static const char *GlobalFilename(const __asan_global &g) {
 264   const char *res = g.module_name;
 265   // Prefer the filename from source location, if is available.
 266   if (g.location)
 267     res = g.location->filename;
 268   CHECK(res);
 269   return res;
 270 }
 271
 272 static void PrintGlobalLocation(InternalScopedString *str,
 273                                 const __asan_global &g) {
 274   str->append("%s", GlobalFilename(g));
 275   if (!g.location)
 276     return;
 277   if (g.location->line_no)
 278     str->append(":%d", g.location->line_no);
 279   if (g.location->column_no)
 280     str->append(":%d", g.location->column_no);
 281 }
 282
 283 static void DescribeAddressRelativeToGlobal(uptr addr, uptr size,
 284                                             const __asan_global &g) {
 285   InternalScopedString str(4096);
 286   Decorator d;
 287   str.append("%s", d.Location());
 288   if (addr < g.beg) {
 289     str.append("%p is located %zd bytes to the left", (void *)addr,
 290                g.beg - addr);
 291   } else if (addr + size > g.beg + g.size) {
 292     if (addr < g.beg + g.size)
 293       addr = g.beg + g.size;
 294     str.append("%p is located %zd bytes to the right", (void *)addr,
 295                addr - (g.beg + g.size));
 296   } else {
 297     // Can it happen?
 298     str.append("%p is located %zd bytes inside", (void *)addr, addr - g.beg);
 299   }
 300   str.append(" of global variable '%s' defined in '",
 301              MaybeDemangleGlobalName(g.name));
 302   PrintGlobalLocation(&str, g);
 303   str.append("' (0x%zx) of size %zu\n", g.beg, g.size);
 304   str.append("%s", d.EndLocation());
 305   PrintGlobalNameIfASCII(&str, g);
 306   Printf("%s", str.data());
 307 }
 308
 309 static bool DescribeAddressIfGlobal(uptr addr, uptr size,
 310                                     const char *bug_type) {
 311   // Assume address is close to at most four globals.
 312   const int kMaxGlobalsInReport = 4;
 313   __asan_global globals[kMaxGlobalsInReport];
 314   u32 reg_sites[kMaxGlobalsInReport];
 315   int globals_num =
 316       GetGlobalsForAddress(addr, globals, reg_sites, ARRAY_SIZE(globals));
 317   if (globals_num == 0)
 318     return false;
 319   for (int i = 0; i < globals_num; i++) {
 320     DescribeAddressRelativeToGlobal(addr, size, globals[i]);
 321     if (0 == internal_strcmp(bug_type, "initialization-order-fiasco") &&
 322         reg_sites[i]) {
 323       Printf("  registered at:\n");
 324       StackDepotGet(reg_sites[i]).Print();
 325     }
 326   }
 327   return true;
 328 }
 329
 330 bool DescribeAddressIfShadow(uptr addr, AddressDescription *descr, bool print) {
 331   if (AddrIsInMem(addr))
 332     return false;
 333   const char *area_type = nullptr;
 334   if (AddrIsInShadowGap(addr)) area_type = "shadow gap";
 335   else if (AddrIsInHighShadow(addr)) area_type = "high shadow";
 336   else if (AddrIsInLowShadow(addr)) area_type = "low shadow";
 337   if (area_type != nullptr) {
 338     if (print) {
 339       Printf("Address %p is located in the %s area.\n", addr, area_type);
 340     } else {
 341       CHECK(descr);
 342       descr->region_kind = area_type;
 343     }
 344     return true;
 345   }
 346   CHECK(0 && "Address is not in memory and not in shadow?");
 347   return false;
 348 }
 349
 350 // Return " (thread_name) " or an empty string if the name is empty.
 351 const char *ThreadNameWithParenthesis(AsanThreadContext *t, char buff[],
 352                                       uptr buff_len) {
 353   const char *name = t->name;
 354   if (name[0] == '\0') return "";
 355   buff[0] = 0;
 356   internal_strncat(buff, " (", 3);
 357   internal_strncat(buff, name, buff_len - 4);
 358   internal_strncat(buff, ")", 2);
 359   return buff;
 360 }
 361
 362 const char *ThreadNameWithParenthesis(u32 tid, char buff[],
 363                                       uptr buff_len) {
 364   if (tid == kInvalidTid) return "";
 365   asanThreadRegistry().CheckLocked();
 366   AsanThreadContext *t = GetThreadContextByTidLocked(tid);
 367   return ThreadNameWithParenthesis(t, buff, buff_len);
 368 }
 369
 370 static void PrintAccessAndVarIntersection(const StackVarDescr &var, uptr addr,
 371                                           uptr access_size, uptr prev_var_end,
 372                                           uptr next_var_beg) {
 373   uptr var_end = var.beg + var.size;
 374   uptr addr_end = addr + access_size;
 375   const char *pos_descr = nullptr;
 376   // If the variable [var.beg, var_end) is the nearest variable to the
 377   // current memory access, indicate it in the log.
 378   if (addr >= var.beg) {
 379     if (addr_end <= var_end)
 380       pos_descr = "is inside";  // May happen if this is a use-after-return.
 381     else if (addr < var_end)
 382       pos_descr = "partially overflows";
 383     else if (addr_end <= next_var_beg &&
 384              next_var_beg - addr_end >= addr - var_end)
 385       pos_descr = "overflows";
 386   } else {
 387     if (addr_end > var.beg)
 388       pos_descr = "partially underflows";
 389     else if (addr >= prev_var_end &&
 390              addr - prev_var_end >= var.beg - addr_end)
 391       pos_descr = "underflows";
 392   }
 393   InternalScopedString str(1024);
 394   str.append("    [%zd, %zd)", var.beg, var_end);
 395   // Render variable name.
 396   str.append(" '");
 397   for (uptr i = 0; i < var.name_len; ++i) {
 398     str.append("%c", var.name_pos[i]);
 399   }
 400   str.append("'");
 401   if (pos_descr) {
 402     Decorator d;
 403     // FIXME: we may want to also print the size of the access here,
 404     // but in case of accesses generated by memset it may be confusing.
 405     str.append("%s <== Memory access at offset %zd %s this variable%s\n",
 406                d.Location(), addr, pos_descr, d.EndLocation());
 407   } else {
 408     str.append("\n");
 409   }
 410   Printf("%s", str.data());
 411 }
 412
 413 bool ParseFrameDescription(const char *frame_descr,
 414                            InternalMmapVector<StackVarDescr> *vars) {
 415   CHECK(frame_descr);
 416   char *p;
 417   // This string is created by the compiler and has the following form:
 418   // "n alloc_1 alloc_2 ... alloc_n"
 419   // where alloc_i looks like "offset size len ObjectName".
 420   uptr n_objects = (uptr)internal_simple_strtoll(frame_descr, &p, 10);
 421   if (n_objects == 0)
 422     return false;
 423
 424   for (uptr i = 0; i < n_objects; i++) {
 425     uptr beg  = (uptr)internal_simple_strtoll(p, &p, 10);
 426     uptr size = (uptr)internal_simple_strtoll(p, &p, 10);
 427     uptr len  = (uptr)internal_simple_strtoll(p, &p, 10);
 428     if (beg == 0 || size == 0 || *p != ' ') {
 429       return false;
 430     }
 431     p++;
 432     StackVarDescr var = {beg, size, p, len};
 433     vars->push_back(var);
 434     p += len;
 435   }
 436
 437   return true;
 438 }
 439
 440 bool DescribeAddressIfStack(uptr addr, uptr access_size) {
 441   AsanThread *t = FindThreadByStackAddress(addr);
 442   if (!t) return false;
 443
 444   Decorator d;
 445   char tname[128];
 446   Printf("%s", d.Location());
 447   Printf("Address %p is located in stack of thread T%d%s", addr, t->tid(),
 448          ThreadNameWithParenthesis(t->tid(), tname, sizeof(tname)));
 449
 450   // Try to fetch precise stack frame for this access.
 451   AsanThread::StackFrameAccess access;
 452   if (!t->GetStackFrameAccessByAddr(addr, &access)) {
 453     Printf("%s\n", d.EndLocation());
 454     return true;
 455   }
 456   Printf(" at offset %zu in frame%s\n", access.offset, d.EndLocation());
 457
 458   // Now we print the frame where the alloca has happened.
 459   // We print this frame as a stack trace with one element.
 460   // The symbolizer may print more than one frame if inlining was involved.
 461   // The frame numbers may be different than those in the stack trace printed
 462   // previously. That's unfortunate, but I have no better solution,
 463   // especially given that the alloca may be from entirely different place
 464   // (e.g. use-after-scope, or different thread's stack).
 465 #if defined(__powerpc64__) && defined(__BIG_ENDIAN__)
 466   // On PowerPC64 ELFv1, the address of a function actually points to a
 467   // three-doubleword data structure with the first field containing
 468   // the address of the function's code.
 469   access.frame_pc = *reinterpret_cast<uptr *>(access.frame_pc);
 470 #endif
 471   access.frame_pc += 16;
 472   Printf("%s", d.EndLocation());
 473   StackTrace alloca_stack(&access.frame_pc, 1);
 474   alloca_stack.Print();
 475
 476   InternalMmapVector<StackVarDescr> vars(16);
 477   if (!ParseFrameDescription(access.frame_descr, &vars)) {
 478     Printf("AddressSanitizer can't parse the stack frame "
 479            "descriptor: |%s|\n", access.frame_descr);
 480     // 'addr' is a stack address, so return true even if we can't parse frame
 481     return true;
 482   }
 483   uptr n_objects = vars.size();
 484   // Report the number of stack objects.
 485   Printf("  This frame has %zu object(s):\n", n_objects);
 486
 487   // Report all objects in this frame.
 488   for (uptr i = 0; i < n_objects; i++) {
 489     uptr prev_var_end = i ? vars[i - 1].beg + vars[i - 1].size : 0;
 490     uptr next_var_beg = i + 1 < n_objects ? vars[i + 1].beg : ~(0UL);
 491     PrintAccessAndVarIntersection(vars[i], access.offset, access_size,
 492                                   prev_var_end, next_var_beg);
 493   }
 494   Printf("HINT: this may be a false positive if your program uses "
 495          "some custom stack unwind mechanism or swapcontext\n");
 496   if (SANITIZER_WINDOWS)
 497     Printf("      (longjmp, SEH and C++ exceptions *are* supported)\n");
 498   else
 499     Printf("      (longjmp and C++ exceptions *are* supported)\n");
 500
 501   DescribeThread(t);
 502   return true;
 503 }
 504
 505 static void DescribeAccessToHeapChunk(AsanChunkView chunk, uptr addr,
 506                                       uptr access_size) {
 507   sptr offset;
 508   Decorator d;
 509   InternalScopedString str(4096);
 510   str.append("%s", d.Location());
 511   if (chunk.AddrIsAtLeft(addr, access_size, &offset)) {
 512     str.append("%p is located %zd bytes to the left of", (void *)addr, offset);
 513   } else if (chunk.AddrIsAtRight(addr, access_size, &offset)) {
 514     if (offset < 0) {
 515       addr -= offset;
 516       offset = 0;
 517     }
 518     str.append("%p is located %zd bytes to the right of", (void *)addr, offset);
 519   } else if (chunk.AddrIsInside(addr, access_size, &offset)) {
 520     str.append("%p is located %zd bytes inside of", (void*)addr, offset);
 521   } else {
 522     str.append("%p is located somewhere around (this is AddressSanitizer bug!)",
 523                (void *)addr);
 524   }
 525   str.append(" %zu-byte region [%p,%p)\n", chunk.UsedSize(),
 526              (void *)(chunk.Beg()), (void *)(chunk.End()));
 527   str.append("%s", d.EndLocation());
 528   Printf("%s", str.data());
 529 }
 530
 531 void DescribeHeapAddress(uptr addr, uptr access_size) {
 532   AsanChunkView chunk = FindHeapChunkByAddress(addr);
 533   if (!chunk.IsValid()) {
 534     Printf("AddressSanitizer can not describe address in more detail "
 535            "(wild memory access suspected).\n");
 536     return;
 537   }
 538   DescribeAccessToHeapChunk(chunk, addr, access_size);
 539   CHECK(chunk.AllocTid() != kInvalidTid);
 540   asanThreadRegistry().CheckLocked();
 541   AsanThreadContext *alloc_thread =
 542       GetThreadContextByTidLocked(chunk.AllocTid());
 543   StackTrace alloc_stack = chunk.GetAllocStack();
 544   char tname[128];
 545   Decorator d;
 546   AsanThreadContext *free_thread = nullptr;
 547   if (chunk.FreeTid() != kInvalidTid) {
 548     free_thread = GetThreadContextByTidLocked(chunk.FreeTid());
 549     Printf("%sfreed by thread T%d%s here:%s\n", d.Allocation(),
 550            free_thread->tid,
 551            ThreadNameWithParenthesis(free_thread, tname, sizeof(tname)),
 552            d.EndAllocation());
 553     StackTrace free_stack = chunk.GetFreeStack();
 554     free_stack.Print();
 555     Printf("%spreviously allocated by thread T%d%s here:%s\n",
 556            d.Allocation(), alloc_thread->tid,
 557            ThreadNameWithParenthesis(alloc_thread, tname, sizeof(tname)),
 558            d.EndAllocation());
 559   } else {
 560     Printf("%sallocated by thread T%d%s here:%s\n", d.Allocation(),
 561            alloc_thread->tid,
 562            ThreadNameWithParenthesis(alloc_thread, tname, sizeof(tname)),
 563            d.EndAllocation());
 564   }
 565   alloc_stack.Print();
 566   DescribeThread(GetCurrentThread());
 567   if (free_thread)
 568     DescribeThread(free_thread);
 569   DescribeThread(alloc_thread);
 570 }
 571
 572 static void DescribeAddress(uptr addr, uptr access_size, const char *bug_type) {
 573   // Check if this is shadow or shadow gap.
 574   if (DescribeAddressIfShadow(addr))
 575     return;
 576   CHECK(AddrIsInMem(addr));
 577   if (DescribeAddressIfGlobal(addr, access_size, bug_type))
 578     return;
 579   if (DescribeAddressIfStack(addr, access_size))
 580     return;
 581   // Assume it is a heap address.
 582   DescribeHeapAddress(addr, access_size);
 583 }
 584
 585 // ------------------- Thread description -------------------- {{{1
 586
 587 void DescribeThread(AsanThreadContext *context) {
 588   CHECK(context);
 589   asanThreadRegistry().CheckLocked();
 590   // No need to announce the main thread.
 591   if (context->tid == 0 || context->announced) {
 592     return;
 593   }
 594   context->announced = true;
 595   char tname[128];
 596   InternalScopedString str(1024);
 597   str.append("Thread T%d%s", context->tid,
 598              ThreadNameWithParenthesis(context->tid, tname, sizeof(tname)));
 599   if (context->parent_tid == kInvalidTid) {
 600     str.append(" created by unknown thread\n");
 601     Printf("%s", str.data());
 602     return;
 603   }
 604   str.append(
 605       " created by T%d%s here:\n", context->parent_tid,
 606       ThreadNameWithParenthesis(context->parent_tid, tname, sizeof(tname)));
 607   Printf("%s", str.data());
 608   StackDepotGet(context->stack_id).Print();
 609   // Recursively described parent thread if needed.
 610   if (flags()->print_full_thread_history) {
 611     AsanThreadContext *parent_context =
 612         GetThreadContextByTidLocked(context->parent_tid);
 613     DescribeThread(parent_context);
 614   }
 615 }
 616
 617 // -------------------- Different kinds of reports ----------------- {{{1
 618
 619 // Use ScopedInErrorReport to run common actions just before and
 620 // immediately after printing error report.
 621 class ScopedInErrorReport {
 622  public:
 623   explicit ScopedInErrorReport(ReportData *report = nullptr,
 624                                bool fatal = false) {
 625     halt_on_error_ = fatal || flags()->halt_on_error;
 626
 627     if (lock_.TryLock()) {
 628       StartReporting(report);
 629       return;
 630     }
 631
 632     // ASan found two bugs in different threads simultaneously.
 633
 634     u32 current_tid = GetCurrentTidOrInvalid();
 635     if (reporting_thread_tid_ == current_tid ||
 636         reporting_thread_tid_ == kInvalidTid) {
 637       // This is either asynch signal or nested error during error reporting.
 638       // Fail simple to avoid deadlocks in Report().
 639
 640       // Can't use Report() here because of potential deadlocks
 641       // in nested signal handlers.
 642       const char msg[] = "AddressSanitizer: nested bug in the same thread, "
 643                          "aborting.\n";
 644       WriteToFile(kStderrFd, msg, sizeof(msg));
 645
 646       internal__exit(common_flags()->exitcode);
 647     }
 648
 649     if (halt_on_error_) {
 650       // Do not print more than one report, otherwise they will mix up.
 651       // Error reporting functions shouldn't return at this situation, as
 652       // they are effectively no-returns.
 653
 654       Report("AddressSanitizer: while reporting a bug found another one. "
 655              "Ignoring.\n");
 656
 657       // Sleep long enough to make sure that the thread which started
 658       // to print an error report will finish doing it.
 659       SleepForSeconds(Max(100, flags()->sleep_before_dying + 1));
 660
 661       // If we're still not dead for some reason, use raw _exit() instead of
 662       // Die() to bypass any additional checks.
 663       internal__exit(common_flags()->exitcode);
 664     } else {
 665       // The other thread will eventually finish reporting
 666       // so it's safe to wait
 667       lock_.Lock();
 668     }
 669
 670     StartReporting(report);
 671   }
 672
 673   ~ScopedInErrorReport() {
 674     // Make sure the current thread is announced.
 675     DescribeThread(GetCurrentThread());
 676     // We may want to grab this lock again when printing stats.
 677     asanThreadRegistry().Unlock();
 678     // Print memory stats.
 679     if (flags()->print_stats)
 680       __asan_print_accumulated_stats();
 681     if (error_report_callback) {
 682       error_report_callback(error_message_buffer);
 683     }
 684     CommonSanitizerReportMutex.Unlock();
 685     reporting_thread_tid_ = kInvalidTid;
 686     lock_.Unlock();
 687     if (halt_on_error_) {
 688       Report("ABORTING\n");
 689       Die();
 690     }
 691   }
 692
 693  private:
 694   void StartReporting(ReportData *report) {
 695     if (report) report_data = *report;
 696     report_happened = true;
 697     ASAN_ON_ERROR();
 698     // Make sure the registry and sanitizer report mutexes are locked while
 699     // we're printing an error report.
 700     // We can lock them only here to avoid self-deadlock in case of
 701     // recursive reports.
 702     asanThreadRegistry().Lock();
 703     CommonSanitizerReportMutex.Lock();
 704     reporting_thread_tid_ = GetCurrentTidOrInvalid();
 705     Printf("===================================================="
 706            "=============\n");
 707   }
 708
 709   static StaticSpinMutex lock_;
 710   static u32 reporting_thread_tid_;
 711   bool halt_on_error_;
 712 };
 713
 714 StaticSpinMutex ScopedInErrorReport::lock_;
 715 u32 ScopedInErrorReport::reporting_thread_tid_;
 716
 717 void ReportStackOverflow(const SignalContext &sig) {
 718   ScopedInErrorReport in_report;
 719   Decorator d;
 720   Printf("%s", d.Warning());
 721   Report(
 722       "ERROR: AddressSanitizer: stack-overflow on address %p"
 723       " (pc %p bp %p sp %p T%d)\n",
 724       (void *)sig.addr, (void *)sig.pc, (void *)sig.bp, (void *)sig.sp,
 725       GetCurrentTidOrInvalid());
 726   Printf("%s", d.EndWarning());
 727   GET_STACK_TRACE_SIGNAL(sig);
 728   stack.Print();
 729   ReportErrorSummary("stack-overflow", &stack);
 730 }
 731
 732 void ReportDeadlySignal(const char *description, const SignalContext &sig) {
 733   ScopedInErrorReport in_report(/*report*/nullptr, /*fatal*/true);
 734   Decorator d;
 735   Printf("%s", d.Warning());
 736   Report(
 737       "ERROR: AddressSanitizer: %s on unknown address %p"
 738       " (pc %p bp %p sp %p T%d)\n",
 739       description, (void *)sig.addr, (void *)sig.pc, (void *)sig.bp,
 740       (void *)sig.sp, GetCurrentTidOrInvalid());
 741   if (sig.pc < GetPageSizeCached()) {
 742     Report("Hint: pc points to the zero page.\n");
 743   }
 744   Printf("%s", d.EndWarning());
 745   GET_STACK_TRACE_SIGNAL(sig);
 746   stack.Print();
 747   MaybeDumpInstructionBytes(sig.pc);
 748   Printf("AddressSanitizer can not provide additional info.\n");
 749   ReportErrorSummary(description, &stack);
 750 }
 751
 752 void ReportDoubleFree(uptr addr, BufferedStackTrace *free_stack) {
 753   ScopedInErrorReport in_report;
 754   Decorator d;
 755   Printf("%s", d.Warning());
 756   char tname[128];
 757   u32 curr_tid = GetCurrentTidOrInvalid();
 758   Report("ERROR: AddressSanitizer: attempting double-free on %p in "
 759          "thread T%d%s:\n",
 760          addr, curr_tid,
 761          ThreadNameWithParenthesis(curr_tid, tname, sizeof(tname)));
 762   Printf("%s", d.EndWarning());
 763   CHECK_GT(free_stack->size, 0);
 764   GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
 765   stack.Print();
 766   DescribeHeapAddress(addr, 1);
 767   ReportErrorSummary("double-free", &stack);
 768 }
 769
 770 void ReportNewDeleteSizeMismatch(uptr addr, uptr delete_size,
 771                                  BufferedStackTrace *free_stack) {
 772   ScopedInErrorReport in_report;
 773   Decorator d;
 774   Printf("%s", d.Warning());
 775   char tname[128];
 776   u32 curr_tid = GetCurrentTidOrInvalid();
 777   Report("ERROR: AddressSanitizer: new-delete-type-mismatch on %p in "
 778          "thread T%d%s:\n",
 779          addr, curr_tid,
 780          ThreadNameWithParenthesis(curr_tid, tname, sizeof(tname)));
 781   Printf("%s  object passed to delete has wrong type:\n", d.EndWarning());
 782   Printf("  size of the allocated type:   %zd bytes;\n"
 783          "  size of the deallocated type: %zd bytes.\n",
 784          asan_mz_size(reinterpret_cast<void*>(addr)), delete_size);
 785   CHECK_GT(free_stack->size, 0);
 786   GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
 787   stack.Print();
 788   DescribeHeapAddress(addr, 1);
 789   ReportErrorSummary("new-delete-type-mismatch", &stack);
 790   Report("HINT: if you don't care about these errors you may set "
 791          "ASAN_OPTIONS=new_delete_type_mismatch=0\n");
 792 }
 793
 794 void ReportFreeNotMalloced(uptr addr, BufferedStackTrace *free_stack) {
 795   ScopedInErrorReport in_report;
 796   Decorator d;
 797   Printf("%s", d.Warning());
 798   char tname[128];
 799   u32 curr_tid = GetCurrentTidOrInvalid();
 800   Report("ERROR: AddressSanitizer: attempting free on address "
 801              "which was not malloc()-ed: %p in thread T%d%s\n", addr,
 802          curr_tid, ThreadNameWithParenthesis(curr_tid, tname, sizeof(tname)));
 803   Printf("%s", d.EndWarning());
 804   CHECK_GT(free_stack->size, 0);
 805   GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
 806   stack.Print();
 807   DescribeHeapAddress(addr, 1);
 808   ReportErrorSummary("bad-free", &stack);
 809 }
 810
 811 void ReportAllocTypeMismatch(uptr addr, BufferedStackTrace *free_stack,
 812                              AllocType alloc_type,
 813                              AllocType dealloc_type) {
 814   static const char *alloc_names[] =
 815     {"INVALID", "malloc", "operator new", "operator new []"};
 816   static const char *dealloc_names[] =
 817     {"INVALID", "free", "operator delete", "operator delete []"};
 818   CHECK_NE(alloc_type, dealloc_type);
 819   ScopedInErrorReport in_report;
 820   Decorator d;
 821   Printf("%s", d.Warning());
 822   Report("ERROR: AddressSanitizer: alloc-dealloc-mismatch (%s vs %s) on %p\n",
 823         alloc_names[alloc_type], dealloc_names[dealloc_type], addr);
 824   Printf("%s", d.EndWarning());
 825   CHECK_GT(free_stack->size, 0);
 826   GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
 827   stack.Print();
 828   DescribeHeapAddress(addr, 1);
 829   ReportErrorSummary("alloc-dealloc-mismatch", &stack);
 830   Report("HINT: if you don't care about these errors you may set "
 831          "ASAN_OPTIONS=alloc_dealloc_mismatch=0\n");
 832 }
 833
 834 void ReportMallocUsableSizeNotOwned(uptr addr, BufferedStackTrace *stack) {
 835   ScopedInErrorReport in_report;
 836   Decorator d;
 837   Printf("%s", d.Warning());
 838   Report("ERROR: AddressSanitizer: attempting to call "
 839              "malloc_usable_size() for pointer which is "
 840              "not owned: %p\n", addr);
 841   Printf("%s", d.EndWarning());
 842   stack->Print();
 843   DescribeHeapAddress(addr, 1);
 844   ReportErrorSummary("bad-malloc_usable_size", stack);
 845 }
 846
 847 void ReportSanitizerGetAllocatedSizeNotOwned(uptr addr,
 848                                              BufferedStackTrace *stack) {
 849   ScopedInErrorReport in_report;
 850   Decorator d;
 851   Printf("%s", d.Warning());
 852   Report("ERROR: AddressSanitizer: attempting to call "
 853              "__sanitizer_get_allocated_size() for pointer which is "
 854              "not owned: %p\n", addr);
 855   Printf("%s", d.EndWarning());
 856   stack->Print();
 857   DescribeHeapAddress(addr, 1);
 858   ReportErrorSummary("bad-__sanitizer_get_allocated_size", stack);
 859 }
 860
 861 void ReportStringFunctionMemoryRangesOverlap(const char *function,
 862                                              const char *offset1, uptr length1,
 863                                              const char *offset2, uptr length2,
 864                                              BufferedStackTrace *stack) {
 865   ScopedInErrorReport in_report;
 866   Decorator d;
 867   char bug_type[100];
 868   internal_snprintf(bug_type, sizeof(bug_type), "%s-param-overlap", function);
 869   Printf("%s", d.Warning());
 870   Report("ERROR: AddressSanitizer: %s: "
 871              "memory ranges [%p,%p) and [%p, %p) overlap\n", \
 872              bug_type, offset1, offset1 + length1, offset2, offset2 + length2);
 873   Printf("%s", d.EndWarning());
 874   stack->Print();
 875   DescribeAddress((uptr)offset1, length1, bug_type);
 876   DescribeAddress((uptr)offset2, length2, bug_type);
 877   ReportErrorSummary(bug_type, stack);
 878 }
 879
 880 void ReportStringFunctionSizeOverflow(uptr offset, uptr size,
 881                                       BufferedStackTrace *stack) {
 882   ScopedInErrorReport in_report;
 883   Decorator d;
 884   const char *bug_type = "negative-size-param";
 885   Printf("%s", d.Warning());
 886   Report("ERROR: AddressSanitizer: %s: (size=%zd)\n", bug_type, size);
 887   Printf("%s", d.EndWarning());
 888   stack->Print();
 889   DescribeAddress(offset, size, bug_type);
 890   ReportErrorSummary(bug_type, stack);
 891 }
 892
 893 void ReportBadParamsToAnnotateContiguousContainer(uptr beg, uptr end,
 894                                                   uptr old_mid, uptr new_mid,
 895                                                   BufferedStackTrace *stack) {
 896   ScopedInErrorReport in_report;
 897   Report("ERROR: AddressSanitizer: bad parameters to "
 898          "__sanitizer_annotate_contiguous_container:\n"
 899          "      beg     : %p\n"
 900          "      end     : %p\n"
 901          "      old_mid : %p\n"
 902          "      new_mid : %p\n",
 903          beg, end, old_mid, new_mid);
 904   uptr granularity = SHADOW_GRANULARITY;
 905   if (!IsAligned(beg, granularity))
 906     Report("ERROR: beg is not aligned by %d\n", granularity);
 907   stack->Print();
 908   ReportErrorSummary("bad-__sanitizer_annotate_contiguous_container", stack);
 909 }
 910
 911 void ReportODRViolation(const __asan_global *g1, u32 stack_id1,
 912                         const __asan_global *g2, u32 stack_id2) {
 913   ScopedInErrorReport in_report;
 914   Decorator d;
 915   Printf("%s", d.Warning());
 916   Report("ERROR: AddressSanitizer: odr-violation (%p):\n", g1->beg);
 917   Printf("%s", d.EndWarning());
 918   InternalScopedString g1_loc(256), g2_loc(256);
 919   PrintGlobalLocation(&g1_loc, *g1);
 920   PrintGlobalLocation(&g2_loc, *g2);
 921   Printf("  [1] size=%zd '%s' %s\n", g1->size,
 922          MaybeDemangleGlobalName(g1->name), g1_loc.data());
 923   Printf("  [2] size=%zd '%s' %s\n", g2->size,
 924          MaybeDemangleGlobalName(g2->name), g2_loc.data());
 925   if (stack_id1 && stack_id2) {
 926     Printf("These globals were registered at these points:\n");
 927     Printf("  [1]:\n");
 928     StackDepotGet(stack_id1).Print();
 929     Printf("  [2]:\n");
 930     StackDepotGet(stack_id2).Print();
 931   }
 932   Report("HINT: if you don't care about these errors you may set "
 933          "ASAN_OPTIONS=detect_odr_violation=0\n");
 934   InternalScopedString error_msg(256);
 935   error_msg.append("odr-violation: global '%s' at %s",
 936                    MaybeDemangleGlobalName(g1->name), g1_loc.data());
 937   ReportErrorSummary(error_msg.data());
 938 }
 939
 940 // ----------------------- CheckForInvalidPointerPair ----------- {{{1
 941 static NOINLINE void
 942 ReportInvalidPointerPair(uptr pc, uptr bp, uptr sp, uptr a1, uptr a2) {
 943   ScopedInErrorReport in_report;
 944   const char *bug_type = "invalid-pointer-pair";
 945   Decorator d;
 946   Printf("%s", d.Warning());
 947   Report("ERROR: AddressSanitizer: invalid-pointer-pair: %p %p\n", a1, a2);
 948   Printf("%s", d.EndWarning());
 949   GET_STACK_TRACE_FATAL(pc, bp);
 950   stack.Print();
 951   DescribeAddress(a1, 1, bug_type);
 952   DescribeAddress(a2, 1, bug_type);
 953   ReportErrorSummary(bug_type, &stack);
 954 }
 955
 956 static INLINE void CheckForInvalidPointerPair(void *p1, void *p2) {
 957   if (!flags()->detect_invalid_pointer_pairs) return;
 958   uptr a1 = reinterpret_cast<uptr>(p1);
 959   uptr a2 = reinterpret_cast<uptr>(p2);
 960   AsanChunkView chunk1 = FindHeapChunkByAddress(a1);
 961   AsanChunkView chunk2 = FindHeapChunkByAddress(a2);
 962   bool valid1 = chunk1.IsValid();
 963   bool valid2 = chunk2.IsValid();
 964   if ((valid1 != valid2) || (valid1 && valid2 && !chunk1.Eq(chunk2))) {
 965     GET_CALLER_PC_BP_SP;                                              \
 966     return ReportInvalidPointerPair(pc, bp, sp, a1, a2);
 967   }
 968 }
 969 // ----------------------- Mac-specific reports ----------------- {{{1
 970
 971 void WarnMacFreeUnallocated(uptr addr, uptr zone_ptr, const char *zone_name,
 972                             BufferedStackTrace *stack) {
 973   // Just print a warning here.
 974   Printf("free_common(%p) -- attempting to free unallocated memory.\n"
 975              "AddressSanitizer is ignoring this error on Mac OS now.\n",
 976              addr);
 977   PrintZoneForPointer(addr, zone_ptr, zone_name);
 978   stack->Print();
 979   DescribeHeapAddress(addr, 1);
 980 }
 981
 982 void ReportMacMzReallocUnknown(uptr addr, uptr zone_ptr, const char *zone_name,
 983                                BufferedStackTrace *stack) {
 984   ScopedInErrorReport in_report;
 985   Printf("mz_realloc(%p) -- attempting to realloc unallocated memory.\n"
 986              "This is an unrecoverable problem, exiting now.\n",
 987              addr);
 988   PrintZoneForPointer(addr, zone_ptr, zone_name);
 989   stack->Print();
 990   DescribeHeapAddress(addr, 1);
 991 }
 992
 993 void ReportMacCfReallocUnknown(uptr addr, uptr zone_ptr, const char *zone_name,
 994                                BufferedStackTrace *stack) {
 995   ScopedInErrorReport in_report;
 996   Printf("cf_realloc(%p) -- attempting to realloc unallocated memory.\n"
 997              "This is an unrecoverable problem, exiting now.\n",
 998              addr);
 999   PrintZoneForPointer(addr, zone_ptr, zone_name);
1000   stack->Print();
1001   DescribeHeapAddress(addr, 1);
1002 }
1003
1004 void ReportGenericError(uptr pc, uptr bp, uptr sp, uptr addr, bool is_write,
1005                         uptr access_size, u32 exp, bool fatal) {
1006   ENABLE_FRAME_POINTER;
1007
1008   // Optimization experiments.
1009   // The experiments can be used to evaluate potential optimizations that remove
1010   // instrumentation (assess false negatives). Instead of completely removing
1011   // some instrumentation, compiler can emit special calls into runtime
1012   // (e.g. __asan_report_exp_load1 instead of __asan_report_load1) and pass
1013   // mask of experiments (exp).
1014   // The reaction to a non-zero value of exp is to be defined.
1015   (void)exp;
1016
1017   // Determine the error type.
1018   const char *bug_descr = "unknown-crash";
1019   if (AddrIsInMem(addr)) {
1020     u8 *shadow_addr = (u8*)MemToShadow(addr);
1021     // If we are accessing 16 bytes, look at the second shadow byte.
1022     if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY)
1023       shadow_addr++;
1024     // If we are in the partial right redzone, look at the next shadow byte.
1025     if (*shadow_addr > 0 && *shadow_addr < 128)
1026       shadow_addr++;
1027     switch (*shadow_addr) {
1028       case kAsanHeapLeftRedzoneMagic:
1029       case kAsanHeapRightRedzoneMagic:
1030       case kAsanArrayCookieMagic:
1031         bug_descr = "heap-buffer-overflow";
1032         break;
1033       case kAsanHeapFreeMagic:
1034         bug_descr = "heap-use-after-free";
1035         break;
1036       case kAsanStackLeftRedzoneMagic:
1037         bug_descr = "stack-buffer-underflow";
1038         break;
1039       case kAsanInitializationOrderMagic:
1040         bug_descr = "initialization-order-fiasco";
1041         break;
1042       case kAsanStackMidRedzoneMagic:
1043       case kAsanStackRightRedzoneMagic:
1044       case kAsanStackPartialRedzoneMagic:
1045         bug_descr = "stack-buffer-overflow";
1046         break;
1047       case kAsanStackAfterReturnMagic:
1048         bug_descr = "stack-use-after-return";
1049         break;
1050       case kAsanUserPoisonedMemoryMagic:
1051         bug_descr = "use-after-poison";
1052         break;
1053       case kAsanContiguousContainerOOBMagic:
1054         bug_descr = "container-overflow";
1055         break;
1056       case kAsanStackUseAfterScopeMagic:
1057         bug_descr = "stack-use-after-scope";
1058         break;
1059       case kAsanGlobalRedzoneMagic:
1060         bug_descr = "global-buffer-overflow";
1061         break;
1062       case kAsanIntraObjectRedzone:
1063         bug_descr = "intra-object-overflow";
1064         break;
1065       case kAsanAllocaLeftMagic:
1066       case kAsanAllocaRightMagic:
1067         bug_descr = "dynamic-stack-buffer-overflow";
1068         break;
1069     }
1070   }
1071
1072   ReportData report = { pc, sp, bp, addr, (bool)is_write, access_size,
1073                         bug_descr };
1074   ScopedInErrorReport in_report(&report, fatal);
1075
1076   Decorator d;
1077   Printf("%s", d.Warning());
1078   Report("ERROR: AddressSanitizer: %s on address "
1079              "%p at pc %p bp %p sp %p\n",
1080              bug_descr, (void*)addr, pc, bp, sp);
1081   Printf("%s", d.EndWarning());
1082
1083   u32 curr_tid = GetCurrentTidOrInvalid();
1084   char tname[128];
1085   Printf("%s%s of size %zu at %p thread T%d%s%s\n",
1086          d.Access(),
1087          access_size ? (is_write ? "WRITE" : "READ") : "ACCESS",
1088          access_size, (void*)addr, curr_tid,
1089          ThreadNameWithParenthesis(curr_tid, tname, sizeof(tname)),
1090          d.EndAccess());
1091
1092   GET_STACK_TRACE_FATAL(pc, bp);
1093   stack.Print();
1094
1095   DescribeAddress(addr, access_size, bug_descr);
1096   ReportErrorSummary(bug_descr, &stack);
1097   PrintShadowMemoryForAddress(addr);
1098 }
1099
1100 }  // namespace __asan
1101
1102 // --------------------------- Interface --------------------- {{{1
1103 using namespace __asan;  // NOLINT
1104
1105 void __asan_report_error(uptr pc, uptr bp, uptr sp, uptr addr, int is_write,
1106                          uptr access_size, u32 exp) {
1107   ENABLE_FRAME_POINTER;
1108   bool fatal = flags()->halt_on_error;
1109   ReportGenericError(pc, bp, sp, addr, is_write, access_size, exp, fatal);
1110 }
1111
1112 void NOINLINE __asan_set_error_report_callback(void (*callback)(const char*)) {
1113   error_report_callback = callback;
1114   if (callback) {
1115     error_message_buffer_size = 1 << 16;
1116     error_message_buffer =
1117         (char*)MmapOrDie(error_message_buffer_size, __func__);
1118     error_message_buffer_pos = 0;
1119   }
1120 }
1121
1122 void __asan_describe_address(uptr addr) {
1123   // Thread registry must be locked while we're describing an address.
1124   asanThreadRegistry().Lock();
1125   DescribeAddress(addr, 1, "");
1126   asanThreadRegistry().Unlock();
1127 }
1128
1129 int __asan_report_present() {
1130   return report_happened ? 1 : 0;
1131 }
1132
1133 uptr __asan_get_report_pc() {
1134   return report_data.pc;
1135 }
1136
1137 uptr __asan_get_report_bp() {
1138   return report_data.bp;
1139 }
1140
1141 uptr __asan_get_report_sp() {
1142   return report_data.sp;
1143 }
1144
1145 uptr __asan_get_report_address() {
1146   return report_data.addr;
1147 }
1148
1149 int __asan_get_report_access_type() {
1150   return report_data.is_write ? 1 : 0;
1151 }
1152
1153 uptr __asan_get_report_access_size() {
1154   return report_data.access_size;
1155 }
1156
1157 const char *__asan_get_report_description() {
1158   return report_data.description;
1159 }
1160
1161 extern "C" {
1162 SANITIZER_INTERFACE_ATTRIBUTE
1163 void __sanitizer_ptr_sub(void *a, void *b) {
1164   CheckForInvalidPointerPair(a, b);
1165 }
1166 SANITIZER_INTERFACE_ATTRIBUTE
1167 void __sanitizer_ptr_cmp(void *a, void *b) {
1168   CheckForInvalidPointerPair(a, b);
1169 }
1170 } // extern "C"
1171
1172 #if !SANITIZER_SUPPORTS_WEAK_HOOKS
1173 // Provide default implementation of __asan_on_error that does nothing
1174 // and may be overriden by user.
1175 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE NOINLINE
1176 void __asan_on_error() {}
1177 #endif