1 //===-- asan_globals.cc ---------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
11 //===----------------------------------------------------------------------===//
13 #include "asan_interceptors.h"
14 #include "asan_internal.h"
15 #include "asan_mapping.h"
16 #include "asan_poisoning.h"
17 #include "asan_report.h"
18 #include "asan_stack.h"
19 #include "asan_stats.h"
20 #include "asan_suppressions.h"
21 #include "asan_thread.h"
22 #include "sanitizer_common/sanitizer_common.h"
23 #include "sanitizer_common/sanitizer_mutex.h"
24 #include "sanitizer_common/sanitizer_placement_new.h"
25 #include "sanitizer_common/sanitizer_stackdepot.h"
26 #include "sanitizer_common/sanitizer_symbolizer.h"
30 typedef __asan_global Global
;
32 struct ListOfGlobals
{
37 static BlockingMutex
mu_for_globals(LINKER_INITIALIZED
);
38 static LowLevelAllocator allocator_for_globals
;
39 static ListOfGlobals
*list_of_all_globals
;
41 static const int kDynamicInitGlobalsInitialCapacity
= 512;
42 struct DynInitGlobal
{
46 typedef InternalMmapVector
<DynInitGlobal
> VectorOfGlobals
;
47 // Lazy-initialized and never deleted.
48 static VectorOfGlobals
*dynamic_init_globals
;
50 // We want to remember where a certain range of globals was registered.
51 struct GlobalRegistrationSite
{
53 Global
*g_first
, *g_last
;
55 typedef InternalMmapVector
<GlobalRegistrationSite
> GlobalRegistrationSiteVector
;
56 static GlobalRegistrationSiteVector
*global_registration_site_vector
;
58 ALWAYS_INLINE
void PoisonShadowForGlobal(const Global
*g
, u8 value
) {
59 FastPoisonShadow(g
->beg
, g
->size_with_redzone
, value
);
62 ALWAYS_INLINE
void PoisonRedZones(const Global
&g
) {
63 uptr aligned_size
= RoundUpTo(g
.size
, SHADOW_GRANULARITY
);
64 FastPoisonShadow(g
.beg
+ aligned_size
, g
.size_with_redzone
- aligned_size
,
65 kAsanGlobalRedzoneMagic
);
66 if (g
.size
!= aligned_size
) {
67 FastPoisonShadowPartialRightRedzone(
68 g
.beg
+ RoundDownTo(g
.size
, SHADOW_GRANULARITY
),
69 g
.size
% SHADOW_GRANULARITY
,
71 kAsanGlobalRedzoneMagic
);
75 const uptr kMinimalDistanceFromAnotherGlobal
= 64;
77 static bool IsAddressNearGlobal(uptr addr
, const __asan_global
&g
) {
78 if (addr
<= g
.beg
- kMinimalDistanceFromAnotherGlobal
) return false;
79 if (addr
>= g
.beg
+ g
.size_with_redzone
) return false;
83 static void ReportGlobal(const Global
&g
, const char *prefix
) {
84 Report("%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n",
85 prefix
, &g
, (void *)g
.beg
, g
.size
, g
.size_with_redzone
, g
.name
,
86 g
.module_name
, g
.has_dynamic_init
);
88 Report(" location (%p): name=%s[%p], %d %d\n", g
.location
,
89 g
.location
->filename
, g
.location
->filename
, g
.location
->line_no
,
90 g
.location
->column_no
);
94 static u32
FindRegistrationSite(const Global
*g
) {
95 mu_for_globals
.CheckLocked();
96 CHECK(global_registration_site_vector
);
97 for (uptr i
= 0, n
= global_registration_site_vector
->size(); i
< n
; i
++) {
98 GlobalRegistrationSite
&grs
= (*global_registration_site_vector
)[i
];
99 if (g
>= grs
.g_first
&& g
<= grs
.g_last
)
105 int GetGlobalsForAddress(uptr addr
, Global
*globals
, u32
*reg_sites
,
107 if (!flags()->report_globals
) return 0;
108 BlockingMutexLock
lock(&mu_for_globals
);
110 for (ListOfGlobals
*l
= list_of_all_globals
; l
; l
= l
->next
) {
111 const Global
&g
= *l
->g
;
112 if (flags()->report_globals
>= 2)
113 ReportGlobal(g
, "Search");
114 if (IsAddressNearGlobal(addr
, g
)) {
117 reg_sites
[res
] = FindRegistrationSite(&g
);
119 if (res
== max_globals
) break;
125 enum GlobalSymbolState
{
130 // Check ODR violation for given global G via special ODR indicator. We use
131 // this method in case compiler instruments global variables through their
133 static void CheckODRViolationViaIndicator(const Global
*g
) {
134 u8
*odr_indicator
= reinterpret_cast<u8
*>(g
->odr_indicator
);
135 if (*odr_indicator
== UNREGISTERED
) {
136 *odr_indicator
= REGISTERED
;
139 // If *odr_indicator is DEFINED, some module have already registered
140 // externally visible symbol with the same name. This is an ODR violation.
141 for (ListOfGlobals
*l
= list_of_all_globals
; l
; l
= l
->next
) {
142 if (g
->odr_indicator
== l
->g
->odr_indicator
&&
143 (flags()->detect_odr_violation
>= 2 || g
->size
!= l
->g
->size
) &&
144 !IsODRViolationSuppressed(g
->name
))
145 ReportODRViolation(g
, FindRegistrationSite(g
),
146 l
->g
, FindRegistrationSite(l
->g
));
150 // Clang provides two different ways for global variables protection:
151 // it can poison the global itself or its private alias. In former
152 // case we may poison same symbol multiple times, that can help us to
153 // cheaply detect ODR violation: if we try to poison an already poisoned
154 // global, we have ODR violation error.
155 // In latter case, we poison each symbol exactly once, so we use special
156 // indicator symbol to perform similar check.
157 // In either case, compiler provides a special odr_indicator field to Global
158 // structure, that can contain two kinds of values:
159 // 1) Non-zero value. In this case, odr_indicator is an address of
160 // corresponding indicator variable for given global.
161 // 2) Zero. This means that we don't use private aliases for global variables
162 // and can freely check ODR violation with the first method.
164 // This routine chooses between two different methods of ODR violation
166 static inline bool UseODRIndicator(const Global
*g
) {
167 // Use ODR indicator method iff use_odr_indicator flag is set and
168 // indicator symbol address is not 0.
169 return flags()->use_odr_indicator
&& g
->odr_indicator
> 0;
172 // Register a global variable.
173 // This function may be called more than once for every global
174 // so we store the globals in a map.
175 static void RegisterGlobal(const Global
*g
) {
177 if (flags()->report_globals
>= 2)
178 ReportGlobal(*g
, "Added");
179 CHECK(flags()->report_globals
);
180 CHECK(AddrIsInMem(g
->beg
));
181 if (!AddrIsAlignedByGranularity(g
->beg
)) {
182 Report("The following global variable is not properly aligned.\n");
183 Report("This may happen if another global with the same name\n");
184 Report("resides in another non-instrumented module.\n");
185 Report("Or the global comes from a C file built w/o -fno-common.\n");
186 Report("In either case this is likely an ODR violation bug,\n");
187 Report("but AddressSanitizer can not provide more details.\n");
188 ReportODRViolation(g
, FindRegistrationSite(g
), g
, FindRegistrationSite(g
));
189 CHECK(AddrIsAlignedByGranularity(g
->beg
));
191 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
192 if (flags()->detect_odr_violation
) {
193 // Try detecting ODR (One Definition Rule) violation, i.e. the situation
194 // where two globals with the same name are defined in different modules.
195 if (UseODRIndicator(g
))
196 CheckODRViolationViaIndicator(g
);
198 if (CanPoisonMemory())
200 ListOfGlobals
*l
= new(allocator_for_globals
) ListOfGlobals
;
202 l
->next
= list_of_all_globals
;
203 list_of_all_globals
= l
;
204 if (g
->has_dynamic_init
) {
205 if (!dynamic_init_globals
) {
206 dynamic_init_globals
=
207 new (allocator_for_globals
) VectorOfGlobals
; // NOLINT
208 dynamic_init_globals
->reserve(kDynamicInitGlobalsInitialCapacity
);
210 DynInitGlobal dyn_global
= { *g
, false };
211 dynamic_init_globals
->push_back(dyn_global
);
215 static void UnregisterGlobal(const Global
*g
) {
217 if (flags()->report_globals
>= 2)
218 ReportGlobal(*g
, "Removed");
219 CHECK(flags()->report_globals
);
220 CHECK(AddrIsInMem(g
->beg
));
221 CHECK(AddrIsAlignedByGranularity(g
->beg
));
222 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
223 if (CanPoisonMemory())
224 PoisonShadowForGlobal(g
, 0);
225 // We unpoison the shadow memory for the global but we do not remove it from
226 // the list because that would require O(n^2) time with the current list
227 // implementation. It might not be worth doing anyway.
229 // Release ODR indicator.
230 if (UseODRIndicator(g
)) {
231 u8
*odr_indicator
= reinterpret_cast<u8
*>(g
->odr_indicator
);
232 *odr_indicator
= UNREGISTERED
;
236 void StopInitOrderChecking() {
237 BlockingMutexLock
lock(&mu_for_globals
);
238 if (!flags()->check_initialization_order
|| !dynamic_init_globals
)
240 flags()->check_initialization_order
= false;
241 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
242 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
243 const Global
*g
= &dyn_g
.g
;
244 // Unpoison the whole global.
245 PoisonShadowForGlobal(g
, 0);
246 // Poison redzones back.
251 static bool IsASCII(unsigned char c
) { return /*0x00 <= c &&*/ c
<= 0x7F; }
253 const char *MaybeDemangleGlobalName(const char *name
) {
254 // We can spoil names of globals with C linkage, so use an heuristic
255 // approach to check if the name should be demangled.
256 bool should_demangle
= false;
257 if (name
[0] == '_' && name
[1] == 'Z')
258 should_demangle
= true;
259 else if (SANITIZER_WINDOWS
&& name
[0] == '\01' && name
[1] == '?')
260 should_demangle
= true;
262 return should_demangle
? Symbolizer::GetOrInit()->Demangle(name
) : name
;
265 // Check if the global is a zero-terminated ASCII string. If so, print it.
266 void PrintGlobalNameIfASCII(InternalScopedString
*str
, const __asan_global
&g
) {
267 for (uptr p
= g
.beg
; p
< g
.beg
+ g
.size
- 1; p
++) {
268 unsigned char c
= *(unsigned char *)p
;
269 if (c
== '\0' || !IsASCII(c
)) return;
271 if (*(char *)(g
.beg
+ g
.size
- 1) != '\0') return;
272 str
->append(" '%s' is ascii string '%s'\n", MaybeDemangleGlobalName(g
.name
),
276 static const char *GlobalFilename(const __asan_global
&g
) {
277 const char *res
= g
.module_name
;
278 // Prefer the filename from source location, if is available.
279 if (g
.location
) res
= g
.location
->filename
;
284 void PrintGlobalLocation(InternalScopedString
*str
, const __asan_global
&g
) {
285 str
->append("%s", GlobalFilename(g
));
286 if (!g
.location
) return;
287 if (g
.location
->line_no
) str
->append(":%d", g
.location
->line_no
);
288 if (g
.location
->column_no
) str
->append(":%d", g
.location
->column_no
);
291 } // namespace __asan
293 // ---------------------- Interface ---------------- {{{1
294 using namespace __asan
; // NOLINT
297 // Apply __asan_register_globals to all globals found in the same loaded
298 // executable or shared library as `flag'. The flag tracks whether globals have
299 // already been registered or not for this image.
300 void __asan_register_image_globals(uptr
*flag
) {
303 AsanApplyToGlobals(__asan_register_globals
, flag
);
307 // This mirrors __asan_register_image_globals.
308 void __asan_unregister_image_globals(uptr
*flag
) {
311 AsanApplyToGlobals(__asan_unregister_globals
, flag
);
315 void __asan_register_elf_globals(uptr
*flag
, void *start
, void *stop
) {
318 CHECK_EQ(0, ((uptr
)stop
- (uptr
)start
) % sizeof(__asan_global
));
319 __asan_global
*globals_start
= (__asan_global
*)start
;
320 __asan_global
*globals_stop
= (__asan_global
*)stop
;
321 __asan_register_globals(globals_start
, globals_stop
- globals_start
);
325 void __asan_unregister_elf_globals(uptr
*flag
, void *start
, void *stop
) {
328 CHECK_EQ(0, ((uptr
)stop
- (uptr
)start
) % sizeof(__asan_global
));
329 __asan_global
*globals_start
= (__asan_global
*)start
;
330 __asan_global
*globals_stop
= (__asan_global
*)stop
;
331 __asan_unregister_globals(globals_start
, globals_stop
- globals_start
);
335 // Register an array of globals.
336 void __asan_register_globals(__asan_global
*globals
, uptr n
) {
337 if (!flags()->report_globals
) return;
338 GET_STACK_TRACE_MALLOC
;
339 u32 stack_id
= StackDepotPut(stack
);
340 BlockingMutexLock
lock(&mu_for_globals
);
341 if (!global_registration_site_vector
) {
342 global_registration_site_vector
=
343 new (allocator_for_globals
) GlobalRegistrationSiteVector
; // NOLINT
344 global_registration_site_vector
->reserve(128);
346 GlobalRegistrationSite site
= {stack_id
, &globals
[0], &globals
[n
- 1]};
347 global_registration_site_vector
->push_back(site
);
348 if (flags()->report_globals
>= 2) {
349 PRINT_CURRENT_STACK();
350 Printf("=== ID %d; %p %p\n", stack_id
, &globals
[0], &globals
[n
- 1]);
352 for (uptr i
= 0; i
< n
; i
++) {
353 if (SANITIZER_WINDOWS
&& globals
[i
].beg
== 0) {
354 // The MSVC incremental linker may pad globals out to 256 bytes. As long
355 // as __asan_global is less than 256 bytes large and its size is a power
356 // of two, we can skip over the padding.
358 sizeof(__asan_global
) < 256 &&
359 (sizeof(__asan_global
) & (sizeof(__asan_global
) - 1)) == 0,
360 "sizeof(__asan_global) incompatible with incremental linker padding");
361 // If these are padding bytes, the rest of the global should be zero.
362 CHECK(globals
[i
].size
== 0 && globals
[i
].size_with_redzone
== 0 &&
363 globals
[i
].name
== nullptr && globals
[i
].module_name
== nullptr &&
364 globals
[i
].odr_indicator
== 0);
367 RegisterGlobal(&globals
[i
]);
370 // Poison the metadata. It should not be accessible to user code.
371 PoisonShadow(reinterpret_cast<uptr
>(globals
), n
* sizeof(__asan_global
),
372 kAsanGlobalRedzoneMagic
);
375 // Unregister an array of globals.
376 // We must do this when a shared objects gets dlclosed.
377 void __asan_unregister_globals(__asan_global
*globals
, uptr n
) {
378 if (!flags()->report_globals
) return;
379 BlockingMutexLock
lock(&mu_for_globals
);
380 for (uptr i
= 0; i
< n
; i
++) {
381 if (SANITIZER_WINDOWS
&& globals
[i
].beg
== 0) {
382 // Skip globals that look like padding from the MSVC incremental linker.
383 // See comment in __asan_register_globals.
386 UnregisterGlobal(&globals
[i
]);
389 // Unpoison the metadata.
390 PoisonShadow(reinterpret_cast<uptr
>(globals
), n
* sizeof(__asan_global
), 0);
393 // This method runs immediately prior to dynamic initialization in each TU,
394 // when all dynamically initialized globals are unpoisoned. This method
395 // poisons all global variables not defined in this TU, so that a dynamic
396 // initializer can only touch global variables in the same TU.
397 void __asan_before_dynamic_init(const char *module_name
) {
398 if (!flags()->check_initialization_order
||
399 !CanPoisonMemory() ||
400 !dynamic_init_globals
)
402 bool strict_init_order
= flags()->strict_init_order
;
405 BlockingMutexLock
lock(&mu_for_globals
);
406 if (flags()->report_globals
>= 3)
407 Printf("DynInitPoison module: %s\n", module_name
);
408 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
409 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
410 const Global
*g
= &dyn_g
.g
;
411 if (dyn_g
.initialized
)
413 if (g
->module_name
!= module_name
)
414 PoisonShadowForGlobal(g
, kAsanInitializationOrderMagic
);
415 else if (!strict_init_order
)
416 dyn_g
.initialized
= true;
420 // This method runs immediately after dynamic initialization in each TU, when
421 // all dynamically initialized globals except for those defined in the current
422 // TU are poisoned. It simply unpoisons all dynamically initialized globals.
423 void __asan_after_dynamic_init() {
424 if (!flags()->check_initialization_order
||
425 !CanPoisonMemory() ||
426 !dynamic_init_globals
)
429 BlockingMutexLock
lock(&mu_for_globals
);
430 // FIXME: Optionally report that we're unpoisoning globals from a module.
431 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
432 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
433 const Global
*g
= &dyn_g
.g
;
434 if (!dyn_g
.initialized
) {
435 // Unpoison the whole global.
436 PoisonShadowForGlobal(g
, 0);
437 // Poison redzones back.