libsanitizer/asan/asan_malloc_linux.cc

   1 //===-- asan_malloc_linux.cc ----------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // Linux-specific malloc interception.
  11 // We simply define functions like malloc, free, realloc, etc.
  12 // They will replace the corresponding libc functions automagically.
  13 //===----------------------------------------------------------------------===//
  14
  15 #include "sanitizer_common/sanitizer_platform.h"
  16 #if SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX || \
  17     SANITIZER_NETBSD || SANITIZER_RTEMS || SANITIZER_SOLARIS
  18
  19 #include "sanitizer_common/sanitizer_allocator_checks.h"
  20 #include "sanitizer_common/sanitizer_errno.h"
  21 #include "sanitizer_common/sanitizer_tls_get_addr.h"
  22 #include "asan_allocator.h"
  23 #include "asan_interceptors.h"
  24 #include "asan_internal.h"
  25 #include "asan_malloc_local.h"
  26 #include "asan_stack.h"
  27
  28 // ---------------------- Replacement functions ---------------- {{{1
  29 using namespace __asan;  // NOLINT
  30
  31 static uptr allocated_for_dlsym;
  32 static uptr last_dlsym_alloc_size_in_words;
  33 static const uptr kDlsymAllocPoolSize = SANITIZER_RTEMS ? 4096 : 1024;
  34 static uptr alloc_memory_for_dlsym[kDlsymAllocPoolSize];
  35
  36 static INLINE bool IsInDlsymAllocPool(const void *ptr) {
  37   uptr off = (uptr)ptr - (uptr)alloc_memory_for_dlsym;
  38   return off < allocated_for_dlsym * sizeof(alloc_memory_for_dlsym[0]);
  39 }
  40
  41 static void *AllocateFromLocalPool(uptr size_in_bytes) {
  42   uptr size_in_words = RoundUpTo(size_in_bytes, kWordSize) / kWordSize;
  43   void *mem = (void*)&alloc_memory_for_dlsym[allocated_for_dlsym];
  44   last_dlsym_alloc_size_in_words = size_in_words;
  45   allocated_for_dlsym += size_in_words;
  46   CHECK_LT(allocated_for_dlsym, kDlsymAllocPoolSize);
  47   return mem;
  48 }
  49
  50 static void DeallocateFromLocalPool(const void *ptr) {
  51   // Hack: since glibc 2.27 dlsym no longer uses stack-allocated memory to store
  52   // error messages and instead uses malloc followed by free. To avoid pool
  53   // exhaustion due to long object filenames, handle that special case here.
  54   uptr prev_offset = allocated_for_dlsym - last_dlsym_alloc_size_in_words;
  55   void *prev_mem = (void*)&alloc_memory_for_dlsym[prev_offset];
  56   if (prev_mem == ptr) {
  57     REAL(memset)(prev_mem, 0, last_dlsym_alloc_size_in_words * kWordSize);
  58     allocated_for_dlsym = prev_offset;
  59     last_dlsym_alloc_size_in_words = 0;
  60   }
  61 }
  62
  63 static int PosixMemalignFromLocalPool(void **memptr, uptr alignment,
  64                                       uptr size_in_bytes) {
  65   if (UNLIKELY(!CheckPosixMemalignAlignment(alignment)))
  66     return errno_EINVAL;
  67
  68   CHECK(alignment >= kWordSize);
  69
  70   uptr addr = (uptr)&alloc_memory_for_dlsym[allocated_for_dlsym];
  71   uptr aligned_addr = RoundUpTo(addr, alignment);
  72   uptr aligned_size = RoundUpTo(size_in_bytes, kWordSize);
  73
  74   uptr *end_mem = (uptr*)(aligned_addr + aligned_size);
  75   uptr allocated = end_mem - alloc_memory_for_dlsym;
  76   if (allocated >= kDlsymAllocPoolSize)
  77     return errno_ENOMEM;
  78
  79   allocated_for_dlsym = allocated;
  80   *memptr = (void*)aligned_addr;
  81   return 0;
  82 }
  83
  84 #if SANITIZER_RTEMS
  85 void* MemalignFromLocalPool(uptr alignment, uptr size) {
  86   void *ptr = nullptr;
  87   alignment = Max(alignment, kWordSize);
  88   PosixMemalignFromLocalPool(&ptr, alignment, size);
  89   return ptr;
  90 }
  91
  92 bool IsFromLocalPool(const void *ptr) {
  93   return IsInDlsymAllocPool(ptr);
  94 }
  95 #endif
  96
  97 static INLINE bool MaybeInDlsym() {
  98   // Fuchsia doesn't use dlsym-based interceptors.
  99   return !SANITIZER_FUCHSIA && asan_init_is_running;
 100 }
 101
 102 static INLINE bool UseLocalPool() {
 103   return EarlyMalloc() || MaybeInDlsym();
 104 }
 105
 106 static void *ReallocFromLocalPool(void *ptr, uptr size) {
 107   const uptr offset = (uptr)ptr - (uptr)alloc_memory_for_dlsym;
 108   const uptr copy_size = Min(size, kDlsymAllocPoolSize - offset);
 109   void *new_ptr;
 110   if (UNLIKELY(UseLocalPool())) {
 111     new_ptr = AllocateFromLocalPool(size);
 112   } else {
 113     ENSURE_ASAN_INITED();
 114     GET_STACK_TRACE_MALLOC;
 115     new_ptr = asan_malloc(size, &stack);
 116   }
 117   internal_memcpy(new_ptr, ptr, copy_size);
 118   return new_ptr;
 119 }
 120
 121 INTERCEPTOR(void, free, void *ptr) {
 122   GET_STACK_TRACE_FREE;
 123   if (UNLIKELY(IsInDlsymAllocPool(ptr))) {
 124     DeallocateFromLocalPool(ptr);
 125     return;
 126   }
 127   asan_free(ptr, &stack, FROM_MALLOC);
 128 }
 129
 130 #if SANITIZER_INTERCEPT_CFREE
 131 INTERCEPTOR(void, cfree, void *ptr) {
 132   GET_STACK_TRACE_FREE;
 133   if (UNLIKELY(IsInDlsymAllocPool(ptr)))
 134     return;
 135   asan_free(ptr, &stack, FROM_MALLOC);
 136 }
 137 #endif // SANITIZER_INTERCEPT_CFREE
 138
 139 INTERCEPTOR(void*, malloc, uptr size) {
 140   if (UNLIKELY(UseLocalPool()))
 141     // Hack: dlsym calls malloc before REAL(malloc) is retrieved from dlsym.
 142     return AllocateFromLocalPool(size);
 143   ENSURE_ASAN_INITED();
 144   GET_STACK_TRACE_MALLOC;
 145   return asan_malloc(size, &stack);
 146 }
 147
 148 INTERCEPTOR(void*, calloc, uptr nmemb, uptr size) {
 149   if (UNLIKELY(UseLocalPool()))
 150     // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym.
 151     return AllocateFromLocalPool(nmemb * size);
 152   ENSURE_ASAN_INITED();
 153   GET_STACK_TRACE_MALLOC;
 154   return asan_calloc(nmemb, size, &stack);
 155 }
 156
 157 INTERCEPTOR(void*, realloc, void *ptr, uptr size) {
 158   if (UNLIKELY(IsInDlsymAllocPool(ptr)))
 159     return ReallocFromLocalPool(ptr, size);
 160   if (UNLIKELY(UseLocalPool()))
 161     return AllocateFromLocalPool(size);
 162   ENSURE_ASAN_INITED();
 163   GET_STACK_TRACE_MALLOC;
 164   return asan_realloc(ptr, size, &stack);
 165 }
 166
 167 #if SANITIZER_INTERCEPT_MEMALIGN
 168 INTERCEPTOR(void*, memalign, uptr boundary, uptr size) {
 169   GET_STACK_TRACE_MALLOC;
 170   return asan_memalign(boundary, size, &stack, FROM_MALLOC);
 171 }
 172
 173 INTERCEPTOR(void*, __libc_memalign, uptr boundary, uptr size) {
 174   GET_STACK_TRACE_MALLOC;
 175   void *res = asan_memalign(boundary, size, &stack, FROM_MALLOC);
 176   DTLS_on_libc_memalign(res, size);
 177   return res;
 178 }
 179 #endif // SANITIZER_INTERCEPT_MEMALIGN
 180
 181 #if SANITIZER_INTERCEPT_ALIGNED_ALLOC
 182 INTERCEPTOR(void*, aligned_alloc, uptr boundary, uptr size) {
 183   GET_STACK_TRACE_MALLOC;
 184   return asan_aligned_alloc(boundary, size, &stack);
 185 }
 186 #endif // SANITIZER_INTERCEPT_ALIGNED_ALLOC
 187
 188 INTERCEPTOR(uptr, malloc_usable_size, void *ptr) {
 189   GET_CURRENT_PC_BP_SP;
 190   (void)sp;
 191   return asan_malloc_usable_size(ptr, pc, bp);
 192 }
 193
 194 #if SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO
 195 // We avoid including malloc.h for portability reasons.
 196 // man mallinfo says the fields are "long", but the implementation uses int.
 197 // It doesn't matter much -- we just need to make sure that the libc's mallinfo
 198 // is not called.
 199 struct fake_mallinfo {
 200   int x[10];
 201 };
 202
 203 INTERCEPTOR(struct fake_mallinfo, mallinfo, void) {
 204   struct fake_mallinfo res;
 205   REAL(memset)(&res, 0, sizeof(res));
 206   return res;
 207 }
 208
 209 INTERCEPTOR(int, mallopt, int cmd, int value) {
 210   return -1;
 211 }
 212 #endif // SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO
 213
 214 INTERCEPTOR(int, posix_memalign, void **memptr, uptr alignment, uptr size) {
 215   if (UNLIKELY(UseLocalPool()))
 216     return PosixMemalignFromLocalPool(memptr, alignment, size);
 217   GET_STACK_TRACE_MALLOC;
 218   return asan_posix_memalign(memptr, alignment, size, &stack);
 219 }
 220
 221 INTERCEPTOR(void*, valloc, uptr size) {
 222   GET_STACK_TRACE_MALLOC;
 223   return asan_valloc(size, &stack);
 224 }
 225
 226 #if SANITIZER_INTERCEPT_PVALLOC
 227 INTERCEPTOR(void*, pvalloc, uptr size) {
 228   GET_STACK_TRACE_MALLOC;
 229   return asan_pvalloc(size, &stack);
 230 }
 231 #endif // SANITIZER_INTERCEPT_PVALLOC
 232
 233 INTERCEPTOR(void, malloc_stats, void) {
 234   __asan_print_accumulated_stats();
 235 }
 236
 237 #if SANITIZER_ANDROID
 238 // Format of __libc_malloc_dispatch has changed in Android L.
 239 // While we are moving towards a solution that does not depend on bionic
 240 // internals, here is something to support both K* and L releases.
 241 struct MallocDebugK {
 242   void *(*malloc)(uptr bytes);
 243   void (*free)(void *mem);
 244   void *(*calloc)(uptr n_elements, uptr elem_size);
 245   void *(*realloc)(void *oldMem, uptr bytes);
 246   void *(*memalign)(uptr alignment, uptr bytes);
 247   uptr (*malloc_usable_size)(void *mem);
 248 };
 249
 250 struct MallocDebugL {
 251   void *(*calloc)(uptr n_elements, uptr elem_size);
 252   void (*free)(void *mem);
 253   fake_mallinfo (*mallinfo)(void);
 254   void *(*malloc)(uptr bytes);
 255   uptr (*malloc_usable_size)(void *mem);
 256   void *(*memalign)(uptr alignment, uptr bytes);
 257   int (*posix_memalign)(void **memptr, uptr alignment, uptr size);
 258   void* (*pvalloc)(uptr size);
 259   void *(*realloc)(void *oldMem, uptr bytes);
 260   void* (*valloc)(uptr size);
 261 };
 262
 263 ALIGNED(32) const MallocDebugK asan_malloc_dispatch_k = {
 264     WRAP(malloc),  WRAP(free),     WRAP(calloc),
 265     WRAP(realloc), WRAP(memalign), WRAP(malloc_usable_size)};
 266
 267 ALIGNED(32) const MallocDebugL asan_malloc_dispatch_l = {
 268     WRAP(calloc),         WRAP(free),               WRAP(mallinfo),
 269     WRAP(malloc),         WRAP(malloc_usable_size), WRAP(memalign),
 270     WRAP(posix_memalign), WRAP(pvalloc),            WRAP(realloc),
 271     WRAP(valloc)};
 272
 273 namespace __asan {
 274 void ReplaceSystemMalloc() {
 275   void **__libc_malloc_dispatch_p =
 276       (void **)AsanDlSymNext("__libc_malloc_dispatch");
 277   if (__libc_malloc_dispatch_p) {
 278     // Decide on K vs L dispatch format by the presence of
 279     // __libc_malloc_default_dispatch export in libc.
 280     void *default_dispatch_p = AsanDlSymNext("__libc_malloc_default_dispatch");
 281     if (default_dispatch_p)
 282       *__libc_malloc_dispatch_p = (void *)&asan_malloc_dispatch_k;
 283     else
 284       *__libc_malloc_dispatch_p = (void *)&asan_malloc_dispatch_l;
 285   }
 286 }
 287 }  // namespace __asan
 288
 289 #else  // SANITIZER_ANDROID
 290
 291 namespace __asan {
 292 void ReplaceSystemMalloc() {
 293 }
 294 }  // namespace __asan
 295 #endif  // SANITIZER_ANDROID
 296
 297 #endif  // SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX ||
 298         // SANITIZER_NETBSD || SANITIZER_SOLARIS