libsanitizer/asan/asan_thread.cc

   1 //===-- asan_thread.cc ----------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // Thread-related code.
  11 //===----------------------------------------------------------------------===//
  12 #include "asan_allocator.h"
  13 #include "asan_interceptors.h"
  14 #include "asan_poisoning.h"
  15 #include "asan_stack.h"
  16 #include "asan_thread.h"
  17 #include "asan_mapping.h"
  18 #include "sanitizer_common/sanitizer_common.h"
  19 #include "sanitizer_common/sanitizer_placement_new.h"
  20 #include "sanitizer_common/sanitizer_stackdepot.h"
  21 #include "sanitizer_common/sanitizer_tls_get_addr.h"
  22 #include "lsan/lsan_common.h"
  23
  24 namespace __asan {
  25
  26 // AsanThreadContext implementation.
  27
  28 struct CreateThreadContextArgs {
  29   AsanThread *thread;
  30   StackTrace *stack;
  31 };
  32
  33 void AsanThreadContext::OnCreated(void *arg) {
  34   CreateThreadContextArgs *args = static_cast<CreateThreadContextArgs*>(arg);
  35   if (args->stack)
  36     stack_id = StackDepotPut(*args->stack);
  37   thread = args->thread;
  38   thread->set_context(this);
  39 }
  40
  41 void AsanThreadContext::OnFinished() {
  42   // Drop the link to the AsanThread object.
  43   thread = nullptr;
  44 }
  45
  46 // MIPS requires aligned address
  47 static ALIGNED(16) char thread_registry_placeholder[sizeof(ThreadRegistry)];
  48 static ThreadRegistry *asan_thread_registry;
  49
  50 static BlockingMutex mu_for_thread_context(LINKER_INITIALIZED);
  51 static LowLevelAllocator allocator_for_thread_context;
  52
  53 static ThreadContextBase *GetAsanThreadContext(u32 tid) {
  54   BlockingMutexLock lock(&mu_for_thread_context);
  55   return new(allocator_for_thread_context) AsanThreadContext(tid);
  56 }
  57
  58 ThreadRegistry &asanThreadRegistry() {
  59   static bool initialized;
  60   // Don't worry about thread_safety - this should be called when there is
  61   // a single thread.
  62   if (!initialized) {
  63     // Never reuse ASan threads: we store pointer to AsanThreadContext
  64     // in TSD and can't reliably tell when no more TSD destructors will
  65     // be called. It would be wrong to reuse AsanThreadContext for another
  66     // thread before all TSD destructors will be called for it.
  67     asan_thread_registry = new(thread_registry_placeholder) ThreadRegistry(
  68         GetAsanThreadContext, kMaxNumberOfThreads, kMaxNumberOfThreads);
  69     initialized = true;
  70   }
  71   return *asan_thread_registry;
  72 }
  73
  74 AsanThreadContext *GetThreadContextByTidLocked(u32 tid) {
  75   return static_cast<AsanThreadContext *>(
  76       asanThreadRegistry().GetThreadLocked(tid));
  77 }
  78
  79 // AsanThread implementation.
  80
  81 AsanThread *AsanThread::Create(thread_callback_t start_routine, void *arg,
  82                                u32 parent_tid, StackTrace *stack,
  83                                bool detached) {
  84   uptr PageSize = GetPageSizeCached();
  85   uptr size = RoundUpTo(sizeof(AsanThread), PageSize);
  86   AsanThread *thread = (AsanThread*)MmapOrDie(size, __func__);
  87   thread->start_routine_ = start_routine;
  88   thread->arg_ = arg;
  89   CreateThreadContextArgs args = { thread, stack };
  90   asanThreadRegistry().CreateThread(*reinterpret_cast<uptr *>(thread), detached,
  91                                     parent_tid, &args);
  92
  93   return thread;
  94 }
  95
  96 void AsanThread::TSDDtor(void *tsd) {
  97   AsanThreadContext *context = (AsanThreadContext*)tsd;
  98   VReport(1, "T%d TSDDtor\n", context->tid);
  99   if (context->thread)
 100     context->thread->Destroy();
 101 }
 102
 103 void AsanThread::Destroy() {
 104   int tid = this->tid();
 105   VReport(1, "T%d exited\n", tid);
 106
 107   malloc_storage().CommitBack();
 108   if (common_flags()->use_sigaltstack) UnsetAlternateSignalStack();
 109   asanThreadRegistry().FinishThread(tid);
 110   FlushToDeadThreadStats(&stats_);
 111   // We also clear the shadow on thread destruction because
 112   // some code may still be executing in later TSD destructors
 113   // and we don't want it to have any poisoned stack.
 114   ClearShadowForThreadStackAndTLS();
 115   DeleteFakeStack(tid);
 116   uptr size = RoundUpTo(sizeof(AsanThread), GetPageSizeCached());
 117   UnmapOrDie(this, size);
 118   DTLS_Destroy();
 119 }
 120
 121 void AsanThread::StartSwitchFiber(FakeStack **fake_stack_save, uptr bottom,
 122                                   uptr size) {
 123   if (atomic_load(&stack_switching_, memory_order_relaxed)) {
 124     Report("ERROR: starting fiber switch while in fiber switch\n");
 125     Die();
 126   }
 127
 128   next_stack_bottom_ = bottom;
 129   next_stack_top_ = bottom + size;
 130   atomic_store(&stack_switching_, 1, memory_order_release);
 131
 132   FakeStack *current_fake_stack = fake_stack_;
 133   if (fake_stack_save)
 134     *fake_stack_save = fake_stack_;
 135   fake_stack_ = nullptr;
 136   SetTLSFakeStack(nullptr);
 137   // if fake_stack_save is null, the fiber will die, delete the fakestack
 138   if (!fake_stack_save && current_fake_stack)
 139     current_fake_stack->Destroy(this->tid());
 140 }
 141
 142 void AsanThread::FinishSwitchFiber(FakeStack *fake_stack_save,
 143                                    uptr *bottom_old,
 144                                    uptr *size_old) {
 145   if (!atomic_load(&stack_switching_, memory_order_relaxed)) {
 146     Report("ERROR: finishing a fiber switch that has not started\n");
 147     Die();
 148   }
 149
 150   if (fake_stack_save) {
 151     SetTLSFakeStack(fake_stack_save);
 152     fake_stack_ = fake_stack_save;
 153   }
 154
 155   if (bottom_old)
 156     *bottom_old = stack_bottom_;
 157   if (size_old)
 158     *size_old = stack_top_ - stack_bottom_;
 159   stack_bottom_ = next_stack_bottom_;
 160   stack_top_ = next_stack_top_;
 161   atomic_store(&stack_switching_, 0, memory_order_release);
 162   next_stack_top_ = 0;
 163   next_stack_bottom_ = 0;
 164 }
 165
 166 inline AsanThread::StackBounds AsanThread::GetStackBounds() const {
 167   if (!atomic_load(&stack_switching_, memory_order_acquire))
 168     return StackBounds{stack_bottom_, stack_top_};  // NOLINT
 169   char local;
 170   const uptr cur_stack = (uptr)&local;
 171   // Note: need to check next stack first, because FinishSwitchFiber
 172   // may be in process of overwriting stack_top_/bottom_. But in such case
 173   // we are already on the next stack.
 174   if (cur_stack >= next_stack_bottom_ && cur_stack < next_stack_top_)
 175     return StackBounds{next_stack_bottom_, next_stack_top_};  // NOLINT
 176   return StackBounds{stack_bottom_, stack_top_};              // NOLINT
 177 }
 178
 179 uptr AsanThread::stack_top() {
 180   return GetStackBounds().top;
 181 }
 182
 183 uptr AsanThread::stack_bottom() {
 184   return GetStackBounds().bottom;
 185 }
 186
 187 uptr AsanThread::stack_size() {
 188   const auto bounds = GetStackBounds();
 189   return bounds.top - bounds.bottom;
 190 }
 191
 192 // We want to create the FakeStack lazyly on the first use, but not eralier
 193 // than the stack size is known and the procedure has to be async-signal safe.
 194 FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() {
 195   uptr stack_size = this->stack_size();
 196   if (stack_size == 0)  // stack_size is not yet available, don't use FakeStack.
 197     return nullptr;
 198   uptr old_val = 0;
 199   // fake_stack_ has 3 states:
 200   // 0   -- not initialized
 201   // 1   -- being initialized
 202   // ptr -- initialized
 203   // This CAS checks if the state was 0 and if so changes it to state 1,
 204   // if that was successful, it initializes the pointer.
 205   if (atomic_compare_exchange_strong(
 206       reinterpret_cast<atomic_uintptr_t *>(&fake_stack_), &old_val, 1UL,
 207       memory_order_relaxed)) {
 208     uptr stack_size_log = Log2(RoundUpToPowerOfTwo(stack_size));
 209     CHECK_LE(flags()->min_uar_stack_size_log, flags()->max_uar_stack_size_log);
 210     stack_size_log =
 211         Min(stack_size_log, static_cast<uptr>(flags()->max_uar_stack_size_log));
 212     stack_size_log =
 213         Max(stack_size_log, static_cast<uptr>(flags()->min_uar_stack_size_log));
 214     fake_stack_ = FakeStack::Create(stack_size_log);
 215     SetTLSFakeStack(fake_stack_);
 216     return fake_stack_;
 217   }
 218   return nullptr;
 219 }
 220
 221 void AsanThread::Init() {
 222   next_stack_top_ = next_stack_bottom_ = 0;
 223   atomic_store(&stack_switching_, false, memory_order_release);
 224   fake_stack_ = nullptr;  // Will be initialized lazily if needed.
 225   CHECK_EQ(this->stack_size(), 0U);
 226   SetThreadStackAndTls();
 227   CHECK_GT(this->stack_size(), 0U);
 228   CHECK(AddrIsInMem(stack_bottom_));
 229   CHECK(AddrIsInMem(stack_top_ - 1));
 230   ClearShadowForThreadStackAndTLS();
 231   int local = 0;
 232   VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(),
 233           (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_,
 234           &local);
 235 }
 236
 237 thread_return_t AsanThread::ThreadStart(
 238     uptr os_id, atomic_uintptr_t *signal_thread_is_registered) {
 239   Init();
 240   asanThreadRegistry().StartThread(tid(), os_id, nullptr);
 241   if (signal_thread_is_registered)
 242     atomic_store(signal_thread_is_registered, 1, memory_order_release);
 243
 244   if (common_flags()->use_sigaltstack) SetAlternateSignalStack();
 245
 246   if (!start_routine_) {
 247     // start_routine_ == 0 if we're on the main thread or on one of the
 248     // OS X libdispatch worker threads. But nobody is supposed to call
 249     // ThreadStart() for the worker threads.
 250     CHECK_EQ(tid(), 0);
 251     return 0;
 252   }
 253
 254   thread_return_t res = start_routine_(arg_);
 255
 256   // On POSIX systems we defer this to the TSD destructor. LSan will consider
 257   // the thread's memory as non-live from the moment we call Destroy(), even
 258   // though that memory might contain pointers to heap objects which will be
 259   // cleaned up by a user-defined TSD destructor. Thus, calling Destroy() before
 260   // the TSD destructors have run might cause false positives in LSan.
 261   if (!SANITIZER_POSIX)
 262     this->Destroy();
 263
 264   return res;
 265 }
 266
 267 void AsanThread::SetThreadStackAndTls() {
 268   uptr tls_size = 0;
 269   uptr stack_size = 0;
 270   GetThreadStackAndTls(tid() == 0, const_cast<uptr *>(&stack_bottom_),
 271                        const_cast<uptr *>(&stack_size), &tls_begin_, &tls_size);
 272   stack_top_ = stack_bottom_ + stack_size;
 273   tls_end_ = tls_begin_ + tls_size;
 274   dtls_ = DTLS_Get();
 275
 276   int local;
 277   CHECK(AddrIsInStack((uptr)&local));
 278 }
 279
 280 void AsanThread::ClearShadowForThreadStackAndTLS() {
 281   PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0);
 282   if (tls_begin_ != tls_end_)
 283     PoisonShadow(tls_begin_, tls_end_ - tls_begin_, 0);
 284 }
 285
 286 bool AsanThread::GetStackFrameAccessByAddr(uptr addr,
 287                                            StackFrameAccess *access) {
 288   uptr bottom = 0;
 289   if (AddrIsInStack(addr)) {
 290     bottom = stack_bottom();
 291   } else if (has_fake_stack()) {
 292     bottom = fake_stack()->AddrIsInFakeStack(addr);
 293     CHECK(bottom);
 294     access->offset = addr - bottom;
 295     access->frame_pc = ((uptr*)bottom)[2];
 296     access->frame_descr = (const char *)((uptr*)bottom)[1];
 297     return true;
 298   }
 299   uptr aligned_addr = addr & ~(SANITIZER_WORDSIZE/8 - 1);  // align addr.
 300   u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
 301   u8 *shadow_bottom = (u8*)MemToShadow(bottom);
 302
 303   while (shadow_ptr >= shadow_bottom &&
 304          *shadow_ptr != kAsanStackLeftRedzoneMagic) {
 305     shadow_ptr--;
 306   }
 307
 308   while (shadow_ptr >= shadow_bottom &&
 309          *shadow_ptr == kAsanStackLeftRedzoneMagic) {
 310     shadow_ptr--;
 311   }
 312
 313   if (shadow_ptr < shadow_bottom) {
 314     return false;
 315   }
 316
 317   uptr* ptr = (uptr*)SHADOW_TO_MEM((uptr)(shadow_ptr + 1));
 318   CHECK(ptr[0] == kCurrentStackFrameMagic);
 319   access->offset = addr - (uptr)ptr;
 320   access->frame_pc = ptr[2];
 321   access->frame_descr = (const char*)ptr[1];
 322   return true;
 323 }
 324
 325 bool AsanThread::AddrIsInStack(uptr addr) {
 326   const auto bounds = GetStackBounds();
 327   return addr >= bounds.bottom && addr < bounds.top;
 328 }
 329
 330 static bool ThreadStackContainsAddress(ThreadContextBase *tctx_base,
 331                                        void *addr) {
 332   AsanThreadContext *tctx = static_cast<AsanThreadContext*>(tctx_base);
 333   AsanThread *t = tctx->thread;
 334   if (!t) return false;
 335   if (t->AddrIsInStack((uptr)addr)) return true;
 336   if (t->has_fake_stack() && t->fake_stack()->AddrIsInFakeStack((uptr)addr))
 337     return true;
 338   return false;
 339 }
 340
 341 AsanThread *GetCurrentThread() {
 342   AsanThreadContext *context =
 343       reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
 344   if (!context) {
 345     if (SANITIZER_ANDROID) {
 346       // On Android, libc constructor is called _after_ asan_init, and cleans up
 347       // TSD. Try to figure out if this is still the main thread by the stack
 348       // address. We are not entirely sure that we have correct main thread
 349       // limits, so only do this magic on Android, and only if the found thread
 350       // is the main thread.
 351       AsanThreadContext *tctx = GetThreadContextByTidLocked(0);
 352       if (tctx && ThreadStackContainsAddress(tctx, &context)) {
 353         SetCurrentThread(tctx->thread);
 354         return tctx->thread;
 355       }
 356     }
 357     return nullptr;
 358   }
 359   return context->thread;
 360 }
 361
 362 void SetCurrentThread(AsanThread *t) {
 363   CHECK(t->context());
 364   VReport(2, "SetCurrentThread: %p for thread %p\n", t->context(),
 365           (void *)GetThreadSelf());
 366   // Make sure we do not reset the current AsanThread.
 367   CHECK_EQ(0, AsanTSDGet());
 368   AsanTSDSet(t->context());
 369   CHECK_EQ(t->context(), AsanTSDGet());
 370 }
 371
 372 u32 GetCurrentTidOrInvalid() {
 373   AsanThread *t = GetCurrentThread();
 374   return t ? t->tid() : kInvalidTid;
 375 }
 376
 377 AsanThread *FindThreadByStackAddress(uptr addr) {
 378   asanThreadRegistry().CheckLocked();
 379   AsanThreadContext *tctx = static_cast<AsanThreadContext *>(
 380       asanThreadRegistry().FindThreadContextLocked(ThreadStackContainsAddress,
 381                                                    (void *)addr));
 382   return tctx ? tctx->thread : nullptr;
 383 }
 384
 385 void EnsureMainThreadIDIsCorrect() {
 386   AsanThreadContext *context =
 387       reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
 388   if (context && (context->tid == 0))
 389     context->os_id = GetTid();
 390 }
 391
 392 __asan::AsanThread *GetAsanThreadByOsIDLocked(uptr os_id) {
 393   __asan::AsanThreadContext *context = static_cast<__asan::AsanThreadContext *>(
 394       __asan::asanThreadRegistry().FindThreadContextByOsIDLocked(os_id));
 395   if (!context) return nullptr;
 396   return context->thread;
 397 }
 398 } // namespace __asan
 399
 400 // --- Implementation of LSan-specific functions --- {{{1
 401 namespace __lsan {
 402 bool GetThreadRangesLocked(uptr os_id, uptr *stack_begin, uptr *stack_end,
 403                            uptr *tls_begin, uptr *tls_end, uptr *cache_begin,
 404                            uptr *cache_end, DTLS **dtls) {
 405   __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
 406   if (!t) return false;
 407   *stack_begin = t->stack_bottom();
 408   *stack_end = t->stack_top();
 409   *tls_begin = t->tls_begin();
 410   *tls_end = t->tls_end();
 411   // ASan doesn't keep allocator caches in TLS, so these are unused.
 412   *cache_begin = 0;
 413   *cache_end = 0;
 414   *dtls = t->dtls();
 415   return true;
 416 }
 417
 418 void ForEachExtraStackRange(uptr os_id, RangeIteratorCallback callback,
 419                             void *arg) {
 420   __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
 421   if (t && t->has_fake_stack())
 422     t->fake_stack()->ForEachFakeFrame(callback, arg);
 423 }
 424
 425 void LockThreadRegistry() {
 426   __asan::asanThreadRegistry().Lock();
 427 }
 428
 429 void UnlockThreadRegistry() {
 430   __asan::asanThreadRegistry().Unlock();
 431 }
 432
 433 void EnsureMainThreadIDIsCorrect() {
 434   __asan::EnsureMainThreadIDIsCorrect();
 435 }
 436 } // namespace __lsan
 437
 438 // ---------------------- Interface ---------------- {{{1
 439 using namespace __asan;  // NOLINT
 440
 441 extern "C" {
 442 SANITIZER_INTERFACE_ATTRIBUTE
 443 void __sanitizer_start_switch_fiber(void **fakestacksave, const void *bottom,
 444                                     uptr size) {
 445   AsanThread *t = GetCurrentThread();
 446   if (!t) {
 447     VReport(1, "__asan_start_switch_fiber called from unknown thread\n");
 448     return;
 449   }
 450   t->StartSwitchFiber((FakeStack**)fakestacksave, (uptr)bottom, size);
 451 }
 452
 453 SANITIZER_INTERFACE_ATTRIBUTE
 454 void __sanitizer_finish_switch_fiber(void* fakestack,
 455                                      const void **bottom_old,
 456                                      uptr *size_old) {
 457   AsanThread *t = GetCurrentThread();
 458   if (!t) {
 459     VReport(1, "__asan_finish_switch_fiber called from unknown thread\n");
 460     return;
 461   }
 462   t->FinishSwitchFiber((FakeStack*)fakestack,
 463                        (uptr*)bottom_old,
 464                        (uptr*)size_old);
 465 }
 466 }