1 //===-- ubsan_diag.cpp ----------------------------------------------------===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // Diagnostic reporting for the UBSan runtime.
11 //===----------------------------------------------------------------------===//
13 #include "ubsan_platform.h"
15 #include "ubsan_diag.h"
16 #include "ubsan_init.h"
17 #include "ubsan_flags.h"
18 #include "ubsan_monitor.h"
19 #include "sanitizer_common/sanitizer_placement_new.h"
20 #include "sanitizer_common/sanitizer_report_decorator.h"
21 #include "sanitizer_common/sanitizer_stacktrace.h"
22 #include "sanitizer_common/sanitizer_stacktrace_printer.h"
23 #include "sanitizer_common/sanitizer_suppressions.h"
24 #include "sanitizer_common/sanitizer_symbolizer.h"
27 using namespace __ubsan
;
29 // UBSan is combined with runtimes that already provide this functionality
30 // (e.g., ASan) as well as runtimes that lack it (e.g., scudo). Tried to use
31 // weak linkage to resolve this issue which is not portable and breaks on
33 // TODO(yln): This is a temporary workaround. GetStackTrace functions will be
34 // removed in the future.
35 void ubsan_GetStackTrace(BufferedStackTrace
*stack
, uptr max_depth
, uptr pc
,
36 uptr bp
, void *context
, bool request_fast
) {
39 GetThreadStackTopAndBottom(false, &top
, &bottom
);
40 bool fast
= StackTrace::WillUseFastUnwind(request_fast
);
41 stack
->Unwind(max_depth
, pc
, bp
, context
, top
, bottom
, fast
);
44 static void MaybePrintStackTrace(uptr pc
, uptr bp
) {
45 // We assume that flags are already parsed, as UBSan runtime
46 // will definitely be called when we print the first diagnostics message.
47 if (!flags()->print_stacktrace
)
50 BufferedStackTrace stack
;
51 ubsan_GetStackTrace(&stack
, kStackTraceMax
, pc
, bp
, nullptr,
52 common_flags()->fast_unwind_on_fatal
);
56 static const char *ConvertTypeToString(ErrorType Type
) {
58 #define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) \
59 case ErrorType::Name: \
61 #include "ubsan_checks.inc"
64 UNREACHABLE("unknown ErrorType!");
67 static const char *ConvertTypeToFlagName(ErrorType Type
) {
69 #define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) \
70 case ErrorType::Name: \
71 return FSanitizeFlagName;
72 #include "ubsan_checks.inc"
75 UNREACHABLE("unknown ErrorType!");
78 static void MaybeReportErrorSummary(Location Loc
, ErrorType Type
) {
79 if (!common_flags()->print_summary
)
81 if (!flags()->report_error_type
)
82 Type
= ErrorType::GenericUB
;
83 const char *ErrorKind
= ConvertTypeToString(Type
);
84 if (Loc
.isSourceLocation()) {
85 SourceLocation SLoc
= Loc
.getSourceLocation();
86 if (!SLoc
.isInvalid()) {
88 AI
.file
= internal_strdup(SLoc
.getFilename());
89 AI
.line
= SLoc
.getLine();
90 AI
.column
= SLoc
.getColumn();
91 AI
.function
= internal_strdup(""); // Avoid printing ?? as function name.
92 ReportErrorSummary(ErrorKind
, AI
, GetSanititizerToolName());
96 } else if (Loc
.isSymbolizedStack()) {
97 const AddressInfo
&AI
= Loc
.getSymbolizedStack()->info
;
98 ReportErrorSummary(ErrorKind
, AI
, GetSanititizerToolName());
101 ReportErrorSummary(ErrorKind
, GetSanititizerToolName());
105 class Decorator
: public SanitizerCommonDecorator
{
107 Decorator() : SanitizerCommonDecorator() {}
108 const char *Highlight() const { return Green(); }
109 const char *Note() const { return Black(); }
113 SymbolizedStack
*__ubsan::getSymbolizedLocation(uptr PC
) {
114 InitAsStandaloneIfNecessary();
115 return Symbolizer::GetOrInit()->SymbolizePC(PC
);
118 Diag
&Diag::operator<<(const TypeDescriptor
&V
) {
119 return AddArg(V
.getTypeName());
122 Diag
&Diag::operator<<(const Value
&V
) {
123 if (V
.getType().isSignedIntegerTy())
124 AddArg(V
.getSIntValue());
125 else if (V
.getType().isUnsignedIntegerTy())
126 AddArg(V
.getUIntValue());
127 else if (V
.getType().isFloatTy())
128 AddArg(V
.getFloatValue());
134 /// Hexadecimal printing for numbers too large for Printf to handle directly.
135 static void RenderHex(InternalScopedString
*Buffer
, UIntMax Val
) {
137 Buffer
->append("0x%08x%08x%08x%08x", (unsigned int)(Val
>> 96),
138 (unsigned int)(Val
>> 64), (unsigned int)(Val
>> 32),
139 (unsigned int)(Val
));
141 UNREACHABLE("long long smaller than 64 bits?");
145 static void RenderLocation(InternalScopedString
*Buffer
, Location Loc
) {
146 switch (Loc
.getKind()) {
147 case Location::LK_Source
: {
148 SourceLocation SLoc
= Loc
.getSourceLocation();
149 if (SLoc
.isInvalid())
150 Buffer
->append("<unknown>");
152 RenderSourceLocation(Buffer
, SLoc
.getFilename(), SLoc
.getLine(),
153 SLoc
.getColumn(), common_flags()->symbolize_vs_style
,
154 common_flags()->strip_path_prefix
);
157 case Location::LK_Memory
:
158 Buffer
->append("%p", reinterpret_cast<void *>(Loc
.getMemoryLocation()));
160 case Location::LK_Symbolized
: {
161 const AddressInfo
&Info
= Loc
.getSymbolizedStack()->info
;
163 RenderSourceLocation(Buffer
, Info
.file
, Info
.line
, Info
.column
,
164 common_flags()->symbolize_vs_style
,
165 common_flags()->strip_path_prefix
);
166 else if (Info
.module
)
167 RenderModuleLocation(Buffer
, Info
.module
, Info
.module_offset
,
168 Info
.module_arch
, common_flags()->strip_path_prefix
);
170 Buffer
->append("%p", reinterpret_cast<void *>(Info
.address
));
173 case Location::LK_Null
:
174 Buffer
->append("<unknown>");
179 static void RenderText(InternalScopedString
*Buffer
, const char *Message
,
180 const Diag::Arg
*Args
) {
181 for (const char *Msg
= Message
; *Msg
; ++Msg
) {
183 Buffer
->append("%c", *Msg
);
186 const Diag::Arg
&A
= Args
[*++Msg
- '0'];
188 case Diag::AK_String
:
189 Buffer
->append("%s", A
.String
);
191 case Diag::AK_TypeName
: {
192 if (SANITIZER_WINDOWS
)
193 // The Windows implementation demangles names early.
194 Buffer
->append("'%s'", A
.String
);
196 Buffer
->append("'%s'", Symbolizer::GetOrInit()->Demangle(A
.String
));
200 // 'long long' is guaranteed to be at least 64 bits wide.
201 if (A
.SInt
>= INT64_MIN
&& A
.SInt
<= INT64_MAX
)
202 Buffer
->append("%lld", (long long)A
.SInt
);
204 RenderHex(Buffer
, A
.SInt
);
207 if (A
.UInt
<= UINT64_MAX
)
208 Buffer
->append("%llu", (unsigned long long)A
.UInt
);
210 RenderHex(Buffer
, A
.UInt
);
212 case Diag::AK_Float
: {
213 // FIXME: Support floating-point formatting in sanitizer_common's
214 // printf, and stop using snprintf here.
215 char FloatBuffer
[32];
216 #if SANITIZER_WINDOWS
217 sprintf_s(FloatBuffer
, sizeof(FloatBuffer
), "%Lg", (long double)A
.Float
);
219 snprintf(FloatBuffer
, sizeof(FloatBuffer
), "%Lg", (long double)A
.Float
);
221 Buffer
->append("%s", FloatBuffer
);
224 case Diag::AK_Pointer
:
225 Buffer
->append("%p", A
.Pointer
);
231 /// Find the earliest-starting range in Ranges which ends after Loc.
232 static Range
*upperBound(MemoryLocation Loc
, Range
*Ranges
,
233 unsigned NumRanges
) {
235 for (unsigned I
= 0; I
!= NumRanges
; ++I
)
236 if (Ranges
[I
].getEnd().getMemoryLocation() > Loc
&&
238 Best
->getStart().getMemoryLocation() >
239 Ranges
[I
].getStart().getMemoryLocation()))
244 static inline uptr
subtractNoOverflow(uptr LHS
, uptr RHS
) {
245 return (LHS
< RHS
) ? 0 : LHS
- RHS
;
248 static inline uptr
addNoOverflow(uptr LHS
, uptr RHS
) {
249 const uptr Limit
= (uptr
)-1;
250 return (LHS
> Limit
- RHS
) ? Limit
: LHS
+ RHS
;
253 /// Render a snippet of the address space near a location.
254 static void PrintMemorySnippet(const Decorator
&Decor
, MemoryLocation Loc
,
255 Range
*Ranges
, unsigned NumRanges
,
256 const Diag::Arg
*Args
) {
257 // Show at least the 8 bytes surrounding Loc.
258 const unsigned MinBytesNearLoc
= 4;
259 MemoryLocation Min
= subtractNoOverflow(Loc
, MinBytesNearLoc
);
260 MemoryLocation Max
= addNoOverflow(Loc
, MinBytesNearLoc
);
261 MemoryLocation OrigMin
= Min
;
262 for (unsigned I
= 0; I
< NumRanges
; ++I
) {
263 Min
= __sanitizer::Min(Ranges
[I
].getStart().getMemoryLocation(), Min
);
264 Max
= __sanitizer::Max(Ranges
[I
].getEnd().getMemoryLocation(), Max
);
267 // If we have too many interesting bytes, prefer to show bytes after Loc.
268 const unsigned BytesToShow
= 32;
269 if (Max
- Min
> BytesToShow
)
270 Min
= __sanitizer::Min(Max
- BytesToShow
, OrigMin
);
271 Max
= addNoOverflow(Min
, BytesToShow
);
273 if (!IsAccessibleMemoryRange(Min
, Max
- Min
)) {
274 Printf("<memory cannot be printed>\n");
279 InternalScopedString Buffer
;
280 for (uptr P
= Min
; P
!= Max
; ++P
) {
281 unsigned char C
= *reinterpret_cast<const unsigned char*>(P
);
282 Buffer
.append("%s%02x", (P
% 8 == 0) ? " " : " ", C
);
287 Buffer
.append("%s", Decor
.Highlight());
288 Range
*InRange
= upperBound(Min
, Ranges
, NumRanges
);
289 for (uptr P
= Min
; P
!= Max
; ++P
) {
290 char Pad
= ' ', Byte
= ' ';
291 if (InRange
&& InRange
->getEnd().getMemoryLocation() == P
)
292 InRange
= upperBound(P
, Ranges
, NumRanges
);
293 if (!InRange
&& P
> Loc
)
295 if (InRange
&& InRange
->getStart().getMemoryLocation() < P
)
297 if (InRange
&& InRange
->getStart().getMemoryLocation() <= P
)
300 Buffer
.append("%c", Pad
);
301 Buffer
.append("%c", Pad
);
302 Buffer
.append("%c", P
== Loc
? '^' : Byte
);
303 Buffer
.append("%c", Byte
);
305 Buffer
.append("%s\n", Decor
.Default());
307 // Go over the line again, and print names for the ranges.
310 for (uptr P
= Min
; P
!= Max
; ++P
) {
311 if (!InRange
|| InRange
->getEnd().getMemoryLocation() == P
)
312 InRange
= upperBound(P
, Ranges
, NumRanges
);
316 Spaces
+= (P
% 8) == 0 ? 2 : 1;
318 if (InRange
&& InRange
->getStart().getMemoryLocation() == P
) {
321 RenderText(&Buffer
, InRange
->getText(), Args
);
323 // FIXME: We only support naming one range for now!
330 Printf("%s", Buffer
.data());
331 // FIXME: Print names for anything we can identify within the line:
333 // * If we can identify the memory itself as belonging to a particular
334 // global, stack variable, or dynamic allocation, then do so.
336 // * If we have a pointer-size, pointer-aligned range highlighted,
337 // determine whether the value of that range is a pointer to an
338 // entity which we can name, and if so, print that name.
340 // This needs an external symbolizer, or (preferably) ASan instrumentation.
344 // All diagnostics should be printed under report mutex.
345 ScopedReport::CheckLocked();
347 InternalScopedString Buffer
;
349 // Prepare a report that a monitor process can inspect.
350 if (Level
== DL_Error
) {
351 RenderText(&Buffer
, Message
, Args
);
352 UndefinedBehaviorReport UBR
{ConvertTypeToString(ET
), Loc
, Buffer
};
356 Buffer
.append("%s", Decor
.Bold());
357 RenderLocation(&Buffer
, Loc
);
362 Buffer
.append("%s runtime error: %s%s", Decor
.Warning(), Decor
.Default(),
367 Buffer
.append("%s note: %s", Decor
.Note(), Decor
.Default());
371 RenderText(&Buffer
, Message
, Args
);
373 Buffer
.append("%s\n", Decor
.Default());
374 Printf("%s", Buffer
.data());
376 if (Loc
.isMemoryLocation())
377 PrintMemorySnippet(Decor
, Loc
.getMemoryLocation(), Ranges
, NumRanges
, Args
);
380 ScopedReport::Initializer::Initializer() { InitAsStandaloneIfNecessary(); }
382 ScopedReport::ScopedReport(ReportOptions Opts
, Location SummaryLoc
,
384 : Opts(Opts
), SummaryLoc(SummaryLoc
), Type(Type
) {}
386 ScopedReport::~ScopedReport() {
387 MaybePrintStackTrace(Opts
.pc
, Opts
.bp
);
388 MaybeReportErrorSummary(SummaryLoc
, Type
);
390 if (common_flags()->print_module_map
>= 2)
393 if (flags()->halt_on_error
)
397 ALIGNED(64) static char suppression_placeholder
[sizeof(SuppressionContext
)];
398 static SuppressionContext
*suppression_ctx
= nullptr;
399 static const char kVptrCheck
[] = "vptr_check";
400 static const char *kSuppressionTypes
[] = {
401 #define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) FSanitizeFlagName,
402 #include "ubsan_checks.inc"
407 void __ubsan::InitializeSuppressions() {
408 CHECK_EQ(nullptr, suppression_ctx
);
409 suppression_ctx
= new (suppression_placeholder
)
410 SuppressionContext(kSuppressionTypes
, ARRAY_SIZE(kSuppressionTypes
));
411 suppression_ctx
->ParseFromFile(flags()->suppressions
);
414 bool __ubsan::IsVptrCheckSuppressed(const char *TypeName
) {
415 InitAsStandaloneIfNecessary();
416 CHECK(suppression_ctx
);
418 return suppression_ctx
->Match(TypeName
, kVptrCheck
, &s
);
421 bool __ubsan::IsPCSuppressed(ErrorType ET
, uptr PC
, const char *Filename
) {
422 InitAsStandaloneIfNecessary();
423 CHECK(suppression_ctx
);
424 const char *SuppType
= ConvertTypeToFlagName(ET
);
425 // Fast path: don't symbolize PC if there is no suppressions for given UB
427 if (!suppression_ctx
->HasSuppressionType(SuppType
))
429 Suppression
*s
= nullptr;
430 // Suppress by file name known to runtime.
431 if (Filename
!= nullptr && suppression_ctx
->Match(Filename
, SuppType
, &s
))
433 // Suppress by module name.
434 if (const char *Module
= Symbolizer::GetOrInit()->GetModuleNameForPc(PC
)) {
435 if (suppression_ctx
->Match(Module
, SuppType
, &s
))
438 // Suppress by function or source file name from debug info.
439 SymbolizedStackHolder
Stack(Symbolizer::GetOrInit()->SymbolizePC(PC
));
440 const AddressInfo
&AI
= Stack
.get()->info
;
441 return suppression_ctx
->Match(AI
.function
, SuppType
, &s
) ||
442 suppression_ctx
->Match(AI
.file
, SuppType
, &s
);
445 #endif // CAN_SANITIZE_UB