libsanitizer/asan/asan_globals.cpp

   1 //===-- asan_globals.cpp --------------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This file is a part of AddressSanitizer, an address sanity checker.
  10 //
  11 // Handle globals.
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "asan_interceptors.h"
  15 #include "asan_internal.h"
  16 #include "asan_mapping.h"
  17 #include "asan_poisoning.h"
  18 #include "asan_report.h"
  19 #include "asan_stack.h"
  20 #include "asan_stats.h"
  21 #include "asan_suppressions.h"
  22 #include "asan_thread.h"
  23 #include "sanitizer_common/sanitizer_common.h"
  24 #include "sanitizer_common/sanitizer_mutex.h"
  25 #include "sanitizer_common/sanitizer_placement_new.h"
  26 #include "sanitizer_common/sanitizer_stackdepot.h"
  27 #include "sanitizer_common/sanitizer_symbolizer.h"
  28
  29 namespace __asan {
  30
  31 typedef __asan_global Global;
  32
  33 struct ListOfGlobals {
  34   const Global *g;
  35   ListOfGlobals *next;
  36 };
  37
  38 static Mutex mu_for_globals;
  39 static LowLevelAllocator allocator_for_globals;
  40 static ListOfGlobals *list_of_all_globals;
  41
  42 static const int kDynamicInitGlobalsInitialCapacity = 512;
  43 struct DynInitGlobal {
  44   Global g;
  45   bool initialized;
  46 };
  47 typedef InternalMmapVector<DynInitGlobal> VectorOfGlobals;
  48 // Lazy-initialized and never deleted.
  49 static VectorOfGlobals *dynamic_init_globals;
  50
  51 // We want to remember where a certain range of globals was registered.
  52 struct GlobalRegistrationSite {
  53   u32 stack_id;
  54   Global *g_first, *g_last;
  55 };
  56 typedef InternalMmapVector<GlobalRegistrationSite> GlobalRegistrationSiteVector;
  57 static GlobalRegistrationSiteVector *global_registration_site_vector;
  58
  59 ALWAYS_INLINE void PoisonShadowForGlobal(const Global *g, u8 value) {
  60   FastPoisonShadow(g->beg, g->size_with_redzone, value);
  61 }
  62
  63 ALWAYS_INLINE void PoisonRedZones(const Global &g) {
  64   uptr aligned_size = RoundUpTo(g.size, SHADOW_GRANULARITY);
  65   FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size,
  66                    kAsanGlobalRedzoneMagic);
  67   if (g.size != aligned_size) {
  68     FastPoisonShadowPartialRightRedzone(
  69         g.beg + RoundDownTo(g.size, SHADOW_GRANULARITY),
  70         g.size % SHADOW_GRANULARITY,
  71         SHADOW_GRANULARITY,
  72         kAsanGlobalRedzoneMagic);
  73   }
  74 }
  75
  76 const uptr kMinimalDistanceFromAnotherGlobal = 64;
  77
  78 static bool IsAddressNearGlobal(uptr addr, const __asan_global &g) {
  79   if (addr <= g.beg - kMinimalDistanceFromAnotherGlobal) return false;
  80   if (addr >= g.beg + g.size_with_redzone) return false;
  81   return true;
  82 }
  83
  84 static void ReportGlobal(const Global &g, const char *prefix) {
  85   Report(
  86       "%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu "
  87       "odr_indicator=%p\n",
  88       prefix, &g, (void *)g.beg, g.size, g.size_with_redzone, g.name,
  89       g.module_name, g.has_dynamic_init, (void *)g.odr_indicator);
  90   if (g.location) {
  91     Report("  location (%p): name=%s[%p], %d %d\n", g.location,
  92            g.location->filename, g.location->filename, g.location->line_no,
  93            g.location->column_no);
  94   }
  95 }
  96
  97 static u32 FindRegistrationSite(const Global *g) {
  98   mu_for_globals.CheckLocked();
  99   CHECK(global_registration_site_vector);
 100   for (uptr i = 0, n = global_registration_site_vector->size(); i < n; i++) {
 101     GlobalRegistrationSite &grs = (*global_registration_site_vector)[i];
 102     if (g >= grs.g_first && g <= grs.g_last)
 103       return grs.stack_id;
 104   }
 105   return 0;
 106 }
 107
 108 int GetGlobalsForAddress(uptr addr, Global *globals, u32 *reg_sites,
 109                          int max_globals) {
 110   if (!flags()->report_globals) return 0;
 111   Lock lock(&mu_for_globals);
 112   int res = 0;
 113   for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
 114     const Global &g = *l->g;
 115     if (flags()->report_globals >= 2)
 116       ReportGlobal(g, "Search");
 117     if (IsAddressNearGlobal(addr, g)) {
 118       internal_memcpy(&globals[res], &g, sizeof(g));
 119       if (reg_sites)
 120         reg_sites[res] = FindRegistrationSite(&g);
 121       res++;
 122       if (res == max_globals)
 123         break;
 124     }
 125   }
 126   return res;
 127 }
 128
 129 enum GlobalSymbolState {
 130   UNREGISTERED = 0,
 131   REGISTERED = 1
 132 };
 133
 134 // Check ODR violation for given global G via special ODR indicator. We use
 135 // this method in case compiler instruments global variables through their
 136 // local aliases.
 137 static void CheckODRViolationViaIndicator(const Global *g) {
 138   // Instrumentation requests to skip ODR check.
 139   if (g->odr_indicator == UINTPTR_MAX)
 140     return;
 141   u8 *odr_indicator = reinterpret_cast<u8 *>(g->odr_indicator);
 142   if (*odr_indicator == UNREGISTERED) {
 143     *odr_indicator = REGISTERED;
 144     return;
 145   }
 146   // If *odr_indicator is DEFINED, some module have already registered
 147   // externally visible symbol with the same name. This is an ODR violation.
 148   for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
 149     if (g->odr_indicator == l->g->odr_indicator &&
 150         (flags()->detect_odr_violation >= 2 || g->size != l->g->size) &&
 151         !IsODRViolationSuppressed(g->name))
 152       ReportODRViolation(g, FindRegistrationSite(g),
 153                          l->g, FindRegistrationSite(l->g));
 154   }
 155 }
 156
 157 // Clang provides two different ways for global variables protection:
 158 // it can poison the global itself or its private alias. In former
 159 // case we may poison same symbol multiple times, that can help us to
 160 // cheaply detect ODR violation: if we try to poison an already poisoned
 161 // global, we have ODR violation error.
 162 // In latter case, we poison each symbol exactly once, so we use special
 163 // indicator symbol to perform similar check.
 164 // In either case, compiler provides a special odr_indicator field to Global
 165 // structure, that can contain two kinds of values:
 166 //   1) Non-zero value. In this case, odr_indicator is an address of
 167 //      corresponding indicator variable for given global.
 168 //   2) Zero. This means that we don't use private aliases for global variables
 169 //      and can freely check ODR violation with the first method.
 170 //
 171 // This routine chooses between two different methods of ODR violation
 172 // detection.
 173 static inline bool UseODRIndicator(const Global *g) {
 174   return g->odr_indicator > 0;
 175 }
 176
 177 // Register a global variable.
 178 // This function may be called more than once for every global
 179 // so we store the globals in a map.
 180 static void RegisterGlobal(const Global *g) {
 181   CHECK(asan_inited);
 182   if (flags()->report_globals >= 2)
 183     ReportGlobal(*g, "Added");
 184   CHECK(flags()->report_globals);
 185   CHECK(AddrIsInMem(g->beg));
 186   if (!AddrIsAlignedByGranularity(g->beg)) {
 187     Report("The following global variable is not properly aligned.\n");
 188     Report("This may happen if another global with the same name\n");
 189     Report("resides in another non-instrumented module.\n");
 190     Report("Or the global comes from a C file built w/o -fno-common.\n");
 191     Report("In either case this is likely an ODR violation bug,\n");
 192     Report("but AddressSanitizer can not provide more details.\n");
 193     ReportODRViolation(g, FindRegistrationSite(g), g, FindRegistrationSite(g));
 194     CHECK(AddrIsAlignedByGranularity(g->beg));
 195   }
 196   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
 197   if (flags()->detect_odr_violation) {
 198     // Try detecting ODR (One Definition Rule) violation, i.e. the situation
 199     // where two globals with the same name are defined in different modules.
 200     if (UseODRIndicator(g))
 201       CheckODRViolationViaIndicator(g);
 202   }
 203   if (CanPoisonMemory())
 204     PoisonRedZones(*g);
 205   ListOfGlobals *l = new(allocator_for_globals) ListOfGlobals;
 206   l->g = g;
 207   l->next = list_of_all_globals;
 208   list_of_all_globals = l;
 209   if (g->has_dynamic_init) {
 210     if (!dynamic_init_globals) {
 211       dynamic_init_globals = new (allocator_for_globals) VectorOfGlobals;
 212       dynamic_init_globals->reserve(kDynamicInitGlobalsInitialCapacity);
 213     }
 214     DynInitGlobal dyn_global = { *g, false };
 215     dynamic_init_globals->push_back(dyn_global);
 216   }
 217 }
 218
 219 static void UnregisterGlobal(const Global *g) {
 220   CHECK(asan_inited);
 221   if (flags()->report_globals >= 2)
 222     ReportGlobal(*g, "Removed");
 223   CHECK(flags()->report_globals);
 224   CHECK(AddrIsInMem(g->beg));
 225   CHECK(AddrIsAlignedByGranularity(g->beg));
 226   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
 227   if (CanPoisonMemory())
 228     PoisonShadowForGlobal(g, 0);
 229   // We unpoison the shadow memory for the global but we do not remove it from
 230   // the list because that would require O(n^2) time with the current list
 231   // implementation. It might not be worth doing anyway.
 232
 233   // Release ODR indicator.
 234   if (UseODRIndicator(g) && g->odr_indicator != UINTPTR_MAX) {
 235     u8 *odr_indicator = reinterpret_cast<u8 *>(g->odr_indicator);
 236     *odr_indicator = UNREGISTERED;
 237   }
 238 }
 239
 240 void StopInitOrderChecking() {
 241   Lock lock(&mu_for_globals);
 242   if (!flags()->check_initialization_order || !dynamic_init_globals)
 243     return;
 244   flags()->check_initialization_order = false;
 245   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 246     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 247     const Global *g = &dyn_g.g;
 248     // Unpoison the whole global.
 249     PoisonShadowForGlobal(g, 0);
 250     // Poison redzones back.
 251     PoisonRedZones(*g);
 252   }
 253 }
 254
 255 static bool IsASCII(unsigned char c) { return /*0x00 <= c &&*/ c <= 0x7F; }
 256
 257 const char *MaybeDemangleGlobalName(const char *name) {
 258   // We can spoil names of globals with C linkage, so use an heuristic
 259   // approach to check if the name should be demangled.
 260   bool should_demangle = false;
 261   if (name[0] == '_' && name[1] == 'Z')
 262     should_demangle = true;
 263   else if (SANITIZER_WINDOWS && name[0] == '\01' && name[1] == '?')
 264     should_demangle = true;
 265
 266   return should_demangle ? Symbolizer::GetOrInit()->Demangle(name) : name;
 267 }
 268
 269 // Check if the global is a zero-terminated ASCII string. If so, print it.
 270 void PrintGlobalNameIfASCII(InternalScopedString *str, const __asan_global &g) {
 271   for (uptr p = g.beg; p < g.beg + g.size - 1; p++) {
 272     unsigned char c = *(unsigned char *)p;
 273     if (c == '\0' || !IsASCII(c)) return;
 274   }
 275   if (*(char *)(g.beg + g.size - 1) != '\0') return;
 276   str->append("  '%s' is ascii string '%s'\n", MaybeDemangleGlobalName(g.name),
 277               (char *)g.beg);
 278 }
 279
 280 static const char *GlobalFilename(const __asan_global &g) {
 281   const char *res = g.module_name;
 282   // Prefer the filename from source location, if is available.
 283   if (g.location) res = g.location->filename;
 284   CHECK(res);
 285   return res;
 286 }
 287
 288 void PrintGlobalLocation(InternalScopedString *str, const __asan_global &g) {
 289   str->append("%s", GlobalFilename(g));
 290   if (!g.location) return;
 291   if (g.location->line_no) str->append(":%d", g.location->line_no);
 292   if (g.location->column_no) str->append(":%d", g.location->column_no);
 293 }
 294
 295 } // namespace __asan
 296
 297 // ---------------------- Interface ---------------- {{{1
 298 using namespace __asan;
 299
 300 // Apply __asan_register_globals to all globals found in the same loaded
 301 // executable or shared library as `flag'. The flag tracks whether globals have
 302 // already been registered or not for this image.
 303 void __asan_register_image_globals(uptr *flag) {
 304   if (*flag)
 305     return;
 306   AsanApplyToGlobals(__asan_register_globals, flag);
 307   *flag = 1;
 308 }
 309
 310 // This mirrors __asan_register_image_globals.
 311 void __asan_unregister_image_globals(uptr *flag) {
 312   if (!*flag)
 313     return;
 314   AsanApplyToGlobals(__asan_unregister_globals, flag);
 315   *flag = 0;
 316 }
 317
 318 void __asan_register_elf_globals(uptr *flag, void *start, void *stop) {
 319   if (*flag) return;
 320   if (!start) return;
 321   CHECK_EQ(0, ((uptr)stop - (uptr)start) % sizeof(__asan_global));
 322   __asan_global *globals_start = (__asan_global*)start;
 323   __asan_global *globals_stop = (__asan_global*)stop;
 324   __asan_register_globals(globals_start, globals_stop - globals_start);
 325   *flag = 1;
 326 }
 327
 328 void __asan_unregister_elf_globals(uptr *flag, void *start, void *stop) {
 329   if (!*flag) return;
 330   if (!start) return;
 331   CHECK_EQ(0, ((uptr)stop - (uptr)start) % sizeof(__asan_global));
 332   __asan_global *globals_start = (__asan_global*)start;
 333   __asan_global *globals_stop = (__asan_global*)stop;
 334   __asan_unregister_globals(globals_start, globals_stop - globals_start);
 335   *flag = 0;
 336 }
 337
 338 // Register an array of globals.
 339 void __asan_register_globals(__asan_global *globals, uptr n) {
 340   if (!flags()->report_globals) return;
 341   GET_STACK_TRACE_MALLOC;
 342   u32 stack_id = StackDepotPut(stack);
 343   Lock lock(&mu_for_globals);
 344   if (!global_registration_site_vector) {
 345     global_registration_site_vector =
 346         new (allocator_for_globals) GlobalRegistrationSiteVector;
 347     global_registration_site_vector->reserve(128);
 348   }
 349   GlobalRegistrationSite site = {stack_id, &globals[0], &globals[n - 1]};
 350   global_registration_site_vector->push_back(site);
 351   if (flags()->report_globals >= 2) {
 352     PRINT_CURRENT_STACK();
 353     Printf("=== ID %d; %p %p\n", stack_id, &globals[0], &globals[n - 1]);
 354   }
 355   for (uptr i = 0; i < n; i++) {
 356     if (SANITIZER_WINDOWS && globals[i].beg == 0) {
 357       // The MSVC incremental linker may pad globals out to 256 bytes. As long
 358       // as __asan_global is less than 256 bytes large and its size is a power
 359       // of two, we can skip over the padding.
 360       static_assert(
 361           sizeof(__asan_global) < 256 &&
 362               (sizeof(__asan_global) & (sizeof(__asan_global) - 1)) == 0,
 363           "sizeof(__asan_global) incompatible with incremental linker padding");
 364       // If these are padding bytes, the rest of the global should be zero.
 365       CHECK(globals[i].size == 0 && globals[i].size_with_redzone == 0 &&
 366             globals[i].name == nullptr && globals[i].module_name == nullptr &&
 367             globals[i].odr_indicator == 0);
 368       continue;
 369     }
 370     RegisterGlobal(&globals[i]);
 371   }
 372
 373   // Poison the metadata. It should not be accessible to user code.
 374   PoisonShadow(reinterpret_cast<uptr>(globals), n * sizeof(__asan_global),
 375                kAsanGlobalRedzoneMagic);
 376 }
 377
 378 // Unregister an array of globals.
 379 // We must do this when a shared objects gets dlclosed.
 380 void __asan_unregister_globals(__asan_global *globals, uptr n) {
 381   if (!flags()->report_globals) return;
 382   Lock lock(&mu_for_globals);
 383   for (uptr i = 0; i < n; i++) {
 384     if (SANITIZER_WINDOWS && globals[i].beg == 0) {
 385       // Skip globals that look like padding from the MSVC incremental linker.
 386       // See comment in __asan_register_globals.
 387       continue;
 388     }
 389     UnregisterGlobal(&globals[i]);
 390   }
 391
 392   // Unpoison the metadata.
 393   PoisonShadow(reinterpret_cast<uptr>(globals), n * sizeof(__asan_global), 0);
 394 }
 395
 396 // This method runs immediately prior to dynamic initialization in each TU,
 397 // when all dynamically initialized globals are unpoisoned.  This method
 398 // poisons all global variables not defined in this TU, so that a dynamic
 399 // initializer can only touch global variables in the same TU.
 400 void __asan_before_dynamic_init(const char *module_name) {
 401   if (!flags()->check_initialization_order ||
 402       !CanPoisonMemory() ||
 403       !dynamic_init_globals)
 404     return;
 405   bool strict_init_order = flags()->strict_init_order;
 406   CHECK(module_name);
 407   CHECK(asan_inited);
 408   Lock lock(&mu_for_globals);
 409   if (flags()->report_globals >= 3)
 410     Printf("DynInitPoison module: %s\n", module_name);
 411   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 412     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 413     const Global *g = &dyn_g.g;
 414     if (dyn_g.initialized)
 415       continue;
 416     if (g->module_name != module_name)
 417       PoisonShadowForGlobal(g, kAsanInitializationOrderMagic);
 418     else if (!strict_init_order)
 419       dyn_g.initialized = true;
 420   }
 421 }
 422
 423 // This method runs immediately after dynamic initialization in each TU, when
 424 // all dynamically initialized globals except for those defined in the current
 425 // TU are poisoned.  It simply unpoisons all dynamically initialized globals.
 426 void __asan_after_dynamic_init() {
 427   if (!flags()->check_initialization_order ||
 428       !CanPoisonMemory() ||
 429       !dynamic_init_globals)
 430     return;
 431   CHECK(asan_inited);
 432   Lock lock(&mu_for_globals);
 433   // FIXME: Optionally report that we're unpoisoning globals from a module.
 434   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 435     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 436     const Global *g = &dyn_g.g;
 437     if (!dyn_g.initialized) {
 438       // Unpoison the whole global.
 439       PoisonShadowForGlobal(g, 0);
 440       // Poison redzones back.
 441       PoisonRedZones(*g);
 442     }
 443   }
 444 }