libsanitizer/asan/asan_globals.cc

   1 //===-- asan_globals.cc ---------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // Handle globals.
  11 //===----------------------------------------------------------------------===//
  12 #include "asan_interceptors.h"
  13 #include "asan_internal.h"
  14 #include "asan_mapping.h"
  15 #include "asan_poisoning.h"
  16 #include "asan_report.h"
  17 #include "asan_stack.h"
  18 #include "asan_stats.h"
  19 #include "asan_thread.h"
  20 #include "sanitizer_common/sanitizer_common.h"
  21 #include "sanitizer_common/sanitizer_mutex.h"
  22 #include "sanitizer_common/sanitizer_placement_new.h"
  23 #include "sanitizer_common/sanitizer_stackdepot.h"
  24
  25 namespace __asan {
  26
  27 typedef __asan_global Global;
  28
  29 struct ListOfGlobals {
  30   const Global *g;
  31   ListOfGlobals *next;
  32 };
  33
  34 static BlockingMutex mu_for_globals(LINKER_INITIALIZED);
  35 static LowLevelAllocator allocator_for_globals;
  36 static ListOfGlobals *list_of_all_globals;
  37
  38 static const int kDynamicInitGlobalsInitialCapacity = 512;
  39 struct DynInitGlobal {
  40   Global g;
  41   bool initialized;
  42 };
  43 typedef InternalMmapVector<DynInitGlobal> VectorOfGlobals;
  44 // Lazy-initialized and never deleted.
  45 static VectorOfGlobals *dynamic_init_globals;
  46
  47 // We want to remember where a certain range of globals was registered.
  48 struct GlobalRegistrationSite {
  49   u32 stack_id;
  50   Global *g_first, *g_last;
  51 };
  52 typedef InternalMmapVector<GlobalRegistrationSite> GlobalRegistrationSiteVector;
  53 static GlobalRegistrationSiteVector *global_registration_site_vector;
  54
  55 ALWAYS_INLINE void PoisonShadowForGlobal(const Global *g, u8 value) {
  56   FastPoisonShadow(g->beg, g->size_with_redzone, value);
  57 }
  58
  59 ALWAYS_INLINE void PoisonRedZones(const Global &g) {
  60   uptr aligned_size = RoundUpTo(g.size, SHADOW_GRANULARITY);
  61   FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size,
  62                    kAsanGlobalRedzoneMagic);
  63   if (g.size != aligned_size) {
  64     FastPoisonShadowPartialRightRedzone(
  65         g.beg + RoundDownTo(g.size, SHADOW_GRANULARITY),
  66         g.size % SHADOW_GRANULARITY,
  67         SHADOW_GRANULARITY,
  68         kAsanGlobalRedzoneMagic);
  69   }
  70 }
  71
  72 const uptr kMinimalDistanceFromAnotherGlobal = 64;
  73
  74 bool IsAddressNearGlobal(uptr addr, const __asan_global &g) {
  75   if (addr <= g.beg - kMinimalDistanceFromAnotherGlobal) return false;
  76   if (addr >= g.beg + g.size_with_redzone) return false;
  77   return true;
  78 }
  79
  80 static void ReportGlobal(const Global &g, const char *prefix) {
  81   Report("%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n",
  82          prefix, &g, (void *)g.beg, g.size, g.size_with_redzone, g.name,
  83          g.module_name, g.has_dynamic_init);
  84   if (g.location) {
  85     Report("  location (%p): name=%s[%p], %d %d\n", g.location,
  86            g.location->filename, g.location->filename, g.location->line_no,
  87            g.location->column_no);
  88   }
  89 }
  90
  91 static bool DescribeOrGetInfoIfGlobal(uptr addr, uptr size, bool print,
  92                                       Global *output_global) {
  93   if (!flags()->report_globals) return false;
  94   BlockingMutexLock lock(&mu_for_globals);
  95   bool res = false;
  96   for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
  97     const Global &g = *l->g;
  98     if (print) {
  99       if (flags()->report_globals >= 2)
 100         ReportGlobal(g, "Search");
 101       res |= DescribeAddressRelativeToGlobal(addr, size, g);
 102     } else {
 103       if (IsAddressNearGlobal(addr, g)) {
 104         CHECK(output_global);
 105         *output_global = g;
 106         return true;
 107       }
 108     }
 109   }
 110   return res;
 111 }
 112
 113 bool DescribeAddressIfGlobal(uptr addr, uptr size) {
 114   return DescribeOrGetInfoIfGlobal(addr, size, /* print */ true,
 115                                    /* output_global */ nullptr);
 116 }
 117
 118 bool GetInfoForAddressIfGlobal(uptr addr, AddressDescription *descr) {
 119   Global g = {};
 120   if (DescribeOrGetInfoIfGlobal(addr, /* size */ 1, /* print */ false, &g)) {
 121     internal_strncpy(descr->name, g.name, descr->name_size);
 122     descr->region_address = g.beg;
 123     descr->region_size = g.size;
 124     descr->region_kind = "global";
 125     return true;
 126   }
 127   return false;
 128 }
 129
 130 u32 FindRegistrationSite(const Global *g) {
 131   CHECK(global_registration_site_vector);
 132   for (uptr i = 0, n = global_registration_site_vector->size(); i < n; i++) {
 133     GlobalRegistrationSite &grs = (*global_registration_site_vector)[i];
 134     if (g >= grs.g_first && g <= grs.g_last)
 135       return grs.stack_id;
 136   }
 137   return 0;
 138 }
 139
 140 // Register a global variable.
 141 // This function may be called more than once for every global
 142 // so we store the globals in a map.
 143 static void RegisterGlobal(const Global *g) {
 144   CHECK(asan_inited);
 145   if (flags()->report_globals >= 2)
 146     ReportGlobal(*g, "Added");
 147   CHECK(flags()->report_globals);
 148   CHECK(AddrIsInMem(g->beg));
 149   CHECK(AddrIsAlignedByGranularity(g->beg));
 150   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
 151   if (flags()->detect_odr_violation) {
 152     // Try detecting ODR (One Definition Rule) violation, i.e. the situation
 153     // where two globals with the same name are defined in different modules.
 154     if (__asan_region_is_poisoned(g->beg, g->size_with_redzone)) {
 155       // This check may not be enough: if the first global is much larger
 156       // the entire redzone of the second global may be within the first global.
 157       for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
 158         if (g->beg == l->g->beg &&
 159             (flags()->detect_odr_violation >= 2 || g->size != l->g->size))
 160           ReportODRViolation(g, FindRegistrationSite(g),
 161                              l->g, FindRegistrationSite(l->g));
 162       }
 163     }
 164   }
 165   if (flags()->poison_heap)
 166     PoisonRedZones(*g);
 167   ListOfGlobals *l = new(allocator_for_globals) ListOfGlobals;
 168   l->g = g;
 169   l->next = list_of_all_globals;
 170   list_of_all_globals = l;
 171   if (g->has_dynamic_init) {
 172     if (dynamic_init_globals == 0) {
 173       dynamic_init_globals = new(allocator_for_globals)
 174           VectorOfGlobals(kDynamicInitGlobalsInitialCapacity);
 175     }
 176     DynInitGlobal dyn_global = { *g, false };
 177     dynamic_init_globals->push_back(dyn_global);
 178   }
 179 }
 180
 181 static void UnregisterGlobal(const Global *g) {
 182   CHECK(asan_inited);
 183   CHECK(flags()->report_globals);
 184   CHECK(AddrIsInMem(g->beg));
 185   CHECK(AddrIsAlignedByGranularity(g->beg));
 186   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
 187   if (flags()->poison_heap)
 188     PoisonShadowForGlobal(g, 0);
 189   // We unpoison the shadow memory for the global but we do not remove it from
 190   // the list because that would require O(n^2) time with the current list
 191   // implementation. It might not be worth doing anyway.
 192 }
 193
 194 void StopInitOrderChecking() {
 195   BlockingMutexLock lock(&mu_for_globals);
 196   if (!flags()->check_initialization_order || !dynamic_init_globals)
 197     return;
 198   flags()->check_initialization_order = false;
 199   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 200     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 201     const Global *g = &dyn_g.g;
 202     // Unpoison the whole global.
 203     PoisonShadowForGlobal(g, 0);
 204     // Poison redzones back.
 205     PoisonRedZones(*g);
 206   }
 207 }
 208
 209 }  // namespace __asan
 210
 211 // ---------------------- Interface ---------------- {{{1
 212 using namespace __asan;  // NOLINT
 213
 214 // Register an array of globals.
 215 void __asan_register_globals(__asan_global *globals, uptr n) {
 216   if (!flags()->report_globals) return;
 217   GET_STACK_TRACE_FATAL_HERE;
 218   u32 stack_id = StackDepotPut(stack);
 219   BlockingMutexLock lock(&mu_for_globals);
 220   if (!global_registration_site_vector)
 221     global_registration_site_vector =
 222         new(allocator_for_globals) GlobalRegistrationSiteVector(128);
 223   GlobalRegistrationSite site = {stack_id, &globals[0], &globals[n - 1]};
 224   global_registration_site_vector->push_back(site);
 225   if (flags()->report_globals >= 2) {
 226     PRINT_CURRENT_STACK();
 227     Printf("=== ID %d; %p %p\n", stack_id, &globals[0], &globals[n - 1]);
 228   }
 229   for (uptr i = 0; i < n; i++) {
 230     RegisterGlobal(&globals[i]);
 231   }
 232 }
 233
 234 // Unregister an array of globals.
 235 // We must do this when a shared objects gets dlclosed.
 236 void __asan_unregister_globals(__asan_global *globals, uptr n) {
 237   if (!flags()->report_globals) return;
 238   BlockingMutexLock lock(&mu_for_globals);
 239   for (uptr i = 0; i < n; i++) {
 240     UnregisterGlobal(&globals[i]);
 241   }
 242 }
 243
 244 // This method runs immediately prior to dynamic initialization in each TU,
 245 // when all dynamically initialized globals are unpoisoned.  This method
 246 // poisons all global variables not defined in this TU, so that a dynamic
 247 // initializer can only touch global variables in the same TU.
 248 void __asan_before_dynamic_init(const char *module_name) {
 249   if (!flags()->check_initialization_order ||
 250       !flags()->poison_heap)
 251     return;
 252   bool strict_init_order = flags()->strict_init_order;
 253   CHECK(dynamic_init_globals);
 254   CHECK(module_name);
 255   CHECK(asan_inited);
 256   BlockingMutexLock lock(&mu_for_globals);
 257   if (flags()->report_globals >= 3)
 258     Printf("DynInitPoison module: %s\n", module_name);
 259   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 260     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 261     const Global *g = &dyn_g.g;
 262     if (dyn_g.initialized)
 263       continue;
 264     if (g->module_name != module_name)
 265       PoisonShadowForGlobal(g, kAsanInitializationOrderMagic);
 266     else if (!strict_init_order)
 267       dyn_g.initialized = true;
 268   }
 269 }
 270
 271 // This method runs immediately after dynamic initialization in each TU, when
 272 // all dynamically initialized globals except for those defined in the current
 273 // TU are poisoned.  It simply unpoisons all dynamically initialized globals.
 274 void __asan_after_dynamic_init() {
 275   if (!flags()->check_initialization_order ||
 276       !flags()->poison_heap)
 277     return;
 278   CHECK(asan_inited);
 279   BlockingMutexLock lock(&mu_for_globals);
 280   // FIXME: Optionally report that we're unpoisoning globals from a module.
 281   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 282     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 283     const Global *g = &dyn_g.g;
 284     if (!dyn_g.initialized) {
 285       // Unpoison the whole global.
 286       PoisonShadowForGlobal(g, 0);
 287       // Poison redzones back.
 288       PoisonRedZones(*g);
 289     }
 290   }
 291 }