libsanitizer/asan/asan_globals.cc

   1 //===-- asan_globals.cc ---------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // Handle globals.
  11 //===----------------------------------------------------------------------===//
  12
  13 #include "asan_interceptors.h"
  14 #include "asan_internal.h"
  15 #include "asan_mapping.h"
  16 #include "asan_poisoning.h"
  17 #include "asan_report.h"
  18 #include "asan_stack.h"
  19 #include "asan_stats.h"
  20 #include "asan_suppressions.h"
  21 #include "asan_thread.h"
  22 #include "sanitizer_common/sanitizer_common.h"
  23 #include "sanitizer_common/sanitizer_mutex.h"
  24 #include "sanitizer_common/sanitizer_placement_new.h"
  25 #include "sanitizer_common/sanitizer_stackdepot.h"
  26 #include "sanitizer_common/sanitizer_symbolizer.h"
  27
  28 namespace __asan {
  29
  30 typedef __asan_global Global;
  31
  32 struct ListOfGlobals {
  33   const Global *g;
  34   ListOfGlobals *next;
  35 };
  36
  37 static BlockingMutex mu_for_globals(LINKER_INITIALIZED);
  38 static LowLevelAllocator allocator_for_globals;
  39 static ListOfGlobals *list_of_all_globals;
  40
  41 static const int kDynamicInitGlobalsInitialCapacity = 512;
  42 struct DynInitGlobal {
  43   Global g;
  44   bool initialized;
  45 };
  46 typedef InternalMmapVector<DynInitGlobal> VectorOfGlobals;
  47 // Lazy-initialized and never deleted.
  48 static VectorOfGlobals *dynamic_init_globals;
  49
  50 // We want to remember where a certain range of globals was registered.
  51 struct GlobalRegistrationSite {
  52   u32 stack_id;
  53   Global *g_first, *g_last;
  54 };
  55 typedef InternalMmapVector<GlobalRegistrationSite> GlobalRegistrationSiteVector;
  56 static GlobalRegistrationSiteVector *global_registration_site_vector;
  57
  58 ALWAYS_INLINE void PoisonShadowForGlobal(const Global *g, u8 value) {
  59   FastPoisonShadow(g->beg, g->size_with_redzone, value);
  60 }
  61
  62 ALWAYS_INLINE void PoisonRedZones(const Global &g) {
  63   uptr aligned_size = RoundUpTo(g.size, SHADOW_GRANULARITY);
  64   FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size,
  65                    kAsanGlobalRedzoneMagic);
  66   if (g.size != aligned_size) {
  67     FastPoisonShadowPartialRightRedzone(
  68         g.beg + RoundDownTo(g.size, SHADOW_GRANULARITY),
  69         g.size % SHADOW_GRANULARITY,
  70         SHADOW_GRANULARITY,
  71         kAsanGlobalRedzoneMagic);
  72   }
  73 }
  74
  75 const uptr kMinimalDistanceFromAnotherGlobal = 64;
  76
  77 static bool IsAddressNearGlobal(uptr addr, const __asan_global &g) {
  78   if (addr <= g.beg - kMinimalDistanceFromAnotherGlobal) return false;
  79   if (addr >= g.beg + g.size_with_redzone) return false;
  80   return true;
  81 }
  82
  83 static void ReportGlobal(const Global &g, const char *prefix) {
  84   Report("%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n",
  85          prefix, &g, (void *)g.beg, g.size, g.size_with_redzone, g.name,
  86          g.module_name, g.has_dynamic_init);
  87   if (g.location) {
  88     Report("  location (%p): name=%s[%p], %d %d\n", g.location,
  89            g.location->filename, g.location->filename, g.location->line_no,
  90            g.location->column_no);
  91   }
  92 }
  93
  94 static u32 FindRegistrationSite(const Global *g) {
  95   mu_for_globals.CheckLocked();
  96   CHECK(global_registration_site_vector);
  97   for (uptr i = 0, n = global_registration_site_vector->size(); i < n; i++) {
  98     GlobalRegistrationSite &grs = (*global_registration_site_vector)[i];
  99     if (g >= grs.g_first && g <= grs.g_last)
 100       return grs.stack_id;
 101   }
 102   return 0;
 103 }
 104
 105 int GetGlobalsForAddress(uptr addr, Global *globals, u32 *reg_sites,
 106                          int max_globals) {
 107   if (!flags()->report_globals) return 0;
 108   BlockingMutexLock lock(&mu_for_globals);
 109   int res = 0;
 110   for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
 111     const Global &g = *l->g;
 112     if (flags()->report_globals >= 2)
 113       ReportGlobal(g, "Search");
 114     if (IsAddressNearGlobal(addr, g)) {
 115       globals[res] = g;
 116       if (reg_sites)
 117         reg_sites[res] = FindRegistrationSite(&g);
 118       res++;
 119       if (res == max_globals) break;
 120     }
 121   }
 122   return res;
 123 }
 124
 125 enum GlobalSymbolState {
 126   UNREGISTERED = 0,
 127   REGISTERED = 1
 128 };
 129
 130 // Check ODR violation for given global G via special ODR indicator. We use
 131 // this method in case compiler instruments global variables through their
 132 // local aliases.
 133 static void CheckODRViolationViaIndicator(const Global *g) {
 134   u8 *odr_indicator = reinterpret_cast<u8 *>(g->odr_indicator);
 135   if (*odr_indicator == UNREGISTERED) {
 136     *odr_indicator = REGISTERED;
 137     return;
 138   }
 139   // If *odr_indicator is DEFINED, some module have already registered
 140   // externally visible symbol with the same name. This is an ODR violation.
 141   for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
 142     if (g->odr_indicator == l->g->odr_indicator &&
 143         (flags()->detect_odr_violation >= 2 || g->size != l->g->size) &&
 144         !IsODRViolationSuppressed(g->name))
 145       ReportODRViolation(g, FindRegistrationSite(g),
 146                          l->g, FindRegistrationSite(l->g));
 147   }
 148 }
 149
 150 // Clang provides two different ways for global variables protection:
 151 // it can poison the global itself or its private alias. In former
 152 // case we may poison same symbol multiple times, that can help us to
 153 // cheaply detect ODR violation: if we try to poison an already poisoned
 154 // global, we have ODR violation error.
 155 // In latter case, we poison each symbol exactly once, so we use special
 156 // indicator symbol to perform similar check.
 157 // In either case, compiler provides a special odr_indicator field to Global
 158 // structure, that can contain two kinds of values:
 159 //   1) Non-zero value. In this case, odr_indicator is an address of
 160 //      corresponding indicator variable for given global.
 161 //   2) Zero. This means that we don't use private aliases for global variables
 162 //      and can freely check ODR violation with the first method.
 163 //
 164 // This routine chooses between two different methods of ODR violation
 165 // detection.
 166 static inline bool UseODRIndicator(const Global *g) {
 167   // Use ODR indicator method iff use_odr_indicator flag is set and
 168   // indicator symbol address is not 0.
 169   return flags()->use_odr_indicator && g->odr_indicator > 0;
 170 }
 171
 172 // Register a global variable.
 173 // This function may be called more than once for every global
 174 // so we store the globals in a map.
 175 static void RegisterGlobal(const Global *g) {
 176   CHECK(asan_inited);
 177   if (flags()->report_globals >= 2)
 178     ReportGlobal(*g, "Added");
 179   CHECK(flags()->report_globals);
 180   CHECK(AddrIsInMem(g->beg));
 181   if (!AddrIsAlignedByGranularity(g->beg)) {
 182     Report("The following global variable is not properly aligned.\n");
 183     Report("This may happen if another global with the same name\n");
 184     Report("resides in another non-instrumented module.\n");
 185     Report("Or the global comes from a C file built w/o -fno-common.\n");
 186     Report("In either case this is likely an ODR violation bug,\n");
 187     Report("but AddressSanitizer can not provide more details.\n");
 188     ReportODRViolation(g, FindRegistrationSite(g), g, FindRegistrationSite(g));
 189     CHECK(AddrIsAlignedByGranularity(g->beg));
 190   }
 191   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
 192   if (flags()->detect_odr_violation) {
 193     // Try detecting ODR (One Definition Rule) violation, i.e. the situation
 194     // where two globals with the same name are defined in different modules.
 195     if (UseODRIndicator(g))
 196       CheckODRViolationViaIndicator(g);
 197   }
 198   if (CanPoisonMemory())
 199     PoisonRedZones(*g);
 200   ListOfGlobals *l = new(allocator_for_globals) ListOfGlobals;
 201   l->g = g;
 202   l->next = list_of_all_globals;
 203   list_of_all_globals = l;
 204   if (g->has_dynamic_init) {
 205     if (!dynamic_init_globals) {
 206       dynamic_init_globals = new(allocator_for_globals)
 207           VectorOfGlobals(kDynamicInitGlobalsInitialCapacity);
 208     }
 209     DynInitGlobal dyn_global = { *g, false };
 210     dynamic_init_globals->push_back(dyn_global);
 211   }
 212 }
 213
 214 static void UnregisterGlobal(const Global *g) {
 215   CHECK(asan_inited);
 216   if (flags()->report_globals >= 2)
 217     ReportGlobal(*g, "Removed");
 218   CHECK(flags()->report_globals);
 219   CHECK(AddrIsInMem(g->beg));
 220   CHECK(AddrIsAlignedByGranularity(g->beg));
 221   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
 222   if (CanPoisonMemory())
 223     PoisonShadowForGlobal(g, 0);
 224   // We unpoison the shadow memory for the global but we do not remove it from
 225   // the list because that would require O(n^2) time with the current list
 226   // implementation. It might not be worth doing anyway.
 227
 228   // Release ODR indicator.
 229   if (UseODRIndicator(g)) {
 230     u8 *odr_indicator = reinterpret_cast<u8 *>(g->odr_indicator);
 231     *odr_indicator = UNREGISTERED;
 232   }
 233 }
 234
 235 void StopInitOrderChecking() {
 236   BlockingMutexLock lock(&mu_for_globals);
 237   if (!flags()->check_initialization_order || !dynamic_init_globals)
 238     return;
 239   flags()->check_initialization_order = false;
 240   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 241     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 242     const Global *g = &dyn_g.g;
 243     // Unpoison the whole global.
 244     PoisonShadowForGlobal(g, 0);
 245     // Poison redzones back.
 246     PoisonRedZones(*g);
 247   }
 248 }
 249
 250 static bool IsASCII(unsigned char c) { return /*0x00 <= c &&*/ c <= 0x7F; }
 251
 252 const char *MaybeDemangleGlobalName(const char *name) {
 253   // We can spoil names of globals with C linkage, so use an heuristic
 254   // approach to check if the name should be demangled.
 255   bool should_demangle = false;
 256   if (name[0] == '_' && name[1] == 'Z')
 257     should_demangle = true;
 258   else if (SANITIZER_WINDOWS && name[0] == '\01' && name[1] == '?')
 259     should_demangle = true;
 260
 261   return should_demangle ? Symbolizer::GetOrInit()->Demangle(name) : name;
 262 }
 263
 264 // Check if the global is a zero-terminated ASCII string. If so, print it.
 265 void PrintGlobalNameIfASCII(InternalScopedString *str, const __asan_global &g) {
 266   for (uptr p = g.beg; p < g.beg + g.size - 1; p++) {
 267     unsigned char c = *(unsigned char *)p;
 268     if (c == '\0' || !IsASCII(c)) return;
 269   }
 270   if (*(char *)(g.beg + g.size - 1) != '\0') return;
 271   str->append("  '%s' is ascii string '%s'\n", MaybeDemangleGlobalName(g.name),
 272               (char *)g.beg);
 273 }
 274
 275 static const char *GlobalFilename(const __asan_global &g) {
 276   const char *res = g.module_name;
 277   // Prefer the filename from source location, if is available.
 278   if (g.location) res = g.location->filename;
 279   CHECK(res);
 280   return res;
 281 }
 282
 283 void PrintGlobalLocation(InternalScopedString *str, const __asan_global &g) {
 284   str->append("%s", GlobalFilename(g));
 285   if (!g.location) return;
 286   if (g.location->line_no) str->append(":%d", g.location->line_no);
 287   if (g.location->column_no) str->append(":%d", g.location->column_no);
 288 }
 289
 290 } // namespace __asan
 291
 292 // ---------------------- Interface ---------------- {{{1
 293 using namespace __asan;  // NOLINT
 294
 295
 296 // Apply __asan_register_globals to all globals found in the same loaded
 297 // executable or shared library as `flag'. The flag tracks whether globals have
 298 // already been registered or not for this image.
 299 void __asan_register_image_globals(uptr *flag) {
 300   if (*flag)
 301     return;
 302   AsanApplyToGlobals(__asan_register_globals, flag);
 303   *flag = 1;
 304 }
 305
 306 // This mirrors __asan_register_image_globals.
 307 void __asan_unregister_image_globals(uptr *flag) {
 308   if (!*flag)
 309     return;
 310   AsanApplyToGlobals(__asan_unregister_globals, flag);
 311   *flag = 0;
 312 }
 313
 314 // Register an array of globals.
 315 void __asan_register_globals(__asan_global *globals, uptr n) {
 316   if (!flags()->report_globals) return;
 317   GET_STACK_TRACE_MALLOC;
 318   u32 stack_id = StackDepotPut(stack);
 319   BlockingMutexLock lock(&mu_for_globals);
 320   if (!global_registration_site_vector)
 321     global_registration_site_vector =
 322         new(allocator_for_globals) GlobalRegistrationSiteVector(128);
 323   GlobalRegistrationSite site = {stack_id, &globals[0], &globals[n - 1]};
 324   global_registration_site_vector->push_back(site);
 325   if (flags()->report_globals >= 2) {
 326     PRINT_CURRENT_STACK();
 327     Printf("=== ID %d; %p %p\n", stack_id, &globals[0], &globals[n - 1]);
 328   }
 329   for (uptr i = 0; i < n; i++) {
 330     RegisterGlobal(&globals[i]);
 331   }
 332 }
 333
 334 // Unregister an array of globals.
 335 // We must do this when a shared objects gets dlclosed.
 336 void __asan_unregister_globals(__asan_global *globals, uptr n) {
 337   if (!flags()->report_globals) return;
 338   BlockingMutexLock lock(&mu_for_globals);
 339   for (uptr i = 0; i < n; i++) {
 340     UnregisterGlobal(&globals[i]);
 341   }
 342 }
 343
 344 // This method runs immediately prior to dynamic initialization in each TU,
 345 // when all dynamically initialized globals are unpoisoned.  This method
 346 // poisons all global variables not defined in this TU, so that a dynamic
 347 // initializer can only touch global variables in the same TU.
 348 void __asan_before_dynamic_init(const char *module_name) {
 349   if (!flags()->check_initialization_order ||
 350       !CanPoisonMemory() ||
 351       !dynamic_init_globals)
 352     return;
 353   bool strict_init_order = flags()->strict_init_order;
 354   CHECK(module_name);
 355   CHECK(asan_inited);
 356   BlockingMutexLock lock(&mu_for_globals);
 357   if (flags()->report_globals >= 3)
 358     Printf("DynInitPoison module: %s\n", module_name);
 359   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 360     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 361     const Global *g = &dyn_g.g;
 362     if (dyn_g.initialized)
 363       continue;
 364     if (g->module_name != module_name)
 365       PoisonShadowForGlobal(g, kAsanInitializationOrderMagic);
 366     else if (!strict_init_order)
 367       dyn_g.initialized = true;
 368   }
 369 }
 370
 371 // This method runs immediately after dynamic initialization in each TU, when
 372 // all dynamically initialized globals except for those defined in the current
 373 // TU are poisoned.  It simply unpoisons all dynamically initialized globals.
 374 void __asan_after_dynamic_init() {
 375   if (!flags()->check_initialization_order ||
 376       !CanPoisonMemory() ||
 377       !dynamic_init_globals)
 378     return;
 379   CHECK(asan_inited);
 380   BlockingMutexLock lock(&mu_for_globals);
 381   // FIXME: Optionally report that we're unpoisoning globals from a module.
 382   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 383     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 384     const Global *g = &dyn_g.g;
 385     if (!dyn_g.initialized) {
 386       // Unpoison the whole global.
 387       PoisonShadowForGlobal(g, 0);
 388       // Poison redzones back.
 389       PoisonRedZones(*g);
 390     }
 391   }
 392 }