libsanitizer/asan/asan_globals.cc

   1 //===-- asan_globals.cc ---------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // Handle globals.
  11 //===----------------------------------------------------------------------===//
  12 #include "asan_interceptors.h"
  13 #include "asan_internal.h"
  14 #include "asan_mapping.h"
  15 #include "asan_poisoning.h"
  16 #include "asan_report.h"
  17 #include "asan_stack.h"
  18 #include "asan_stats.h"
  19 #include "asan_thread.h"
  20 #include "sanitizer_common/sanitizer_common.h"
  21 #include "sanitizer_common/sanitizer_mutex.h"
  22 #include "sanitizer_common/sanitizer_placement_new.h"
  23
  24 namespace __asan {
  25
  26 typedef __asan_global Global;
  27
  28 struct ListOfGlobals {
  29   const Global *g;
  30   ListOfGlobals *next;
  31 };
  32
  33 static BlockingMutex mu_for_globals(LINKER_INITIALIZED);
  34 static LowLevelAllocator allocator_for_globals;
  35 static ListOfGlobals *list_of_all_globals;
  36
  37 static const int kDynamicInitGlobalsInitialCapacity = 512;
  38 struct DynInitGlobal {
  39   Global g;
  40   bool initialized;
  41 };
  42 typedef InternalMmapVector<DynInitGlobal> VectorOfGlobals;
  43 // Lazy-initialized and never deleted.
  44 static VectorOfGlobals *dynamic_init_globals;
  45
  46 ALWAYS_INLINE void PoisonShadowForGlobal(const Global *g, u8 value) {
  47   FastPoisonShadow(g->beg, g->size_with_redzone, value);
  48 }
  49
  50 ALWAYS_INLINE void PoisonRedZones(const Global &g) {
  51   uptr aligned_size = RoundUpTo(g.size, SHADOW_GRANULARITY);
  52   FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size,
  53                    kAsanGlobalRedzoneMagic);
  54   if (g.size != aligned_size) {
  55     FastPoisonShadowPartialRightRedzone(
  56         g.beg + RoundDownTo(g.size, SHADOW_GRANULARITY),
  57         g.size % SHADOW_GRANULARITY,
  58         SHADOW_GRANULARITY,
  59         kAsanGlobalRedzoneMagic);
  60   }
  61 }
  62
  63 static void ReportGlobal(const Global &g, const char *prefix) {
  64   Report("%s Global: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n",
  65          prefix, (void*)g.beg, g.size, g.size_with_redzone, g.name,
  66          g.module_name, g.has_dynamic_init);
  67 }
  68
  69 bool DescribeAddressIfGlobal(uptr addr, uptr size) {
  70   if (!flags()->report_globals) return false;
  71   BlockingMutexLock lock(&mu_for_globals);
  72   bool res = false;
  73   for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
  74     const Global &g = *l->g;
  75     if (flags()->report_globals >= 2)
  76       ReportGlobal(g, "Search");
  77     res |= DescribeAddressRelativeToGlobal(addr, size, g);
  78   }
  79   return res;
  80 }
  81
  82 // Register a global variable.
  83 // This function may be called more than once for every global
  84 // so we store the globals in a map.
  85 static void RegisterGlobal(const Global *g) {
  86   CHECK(asan_inited);
  87   if (flags()->report_globals >= 2)
  88     ReportGlobal(*g, "Added");
  89   CHECK(flags()->report_globals);
  90   CHECK(AddrIsInMem(g->beg));
  91   CHECK(AddrIsAlignedByGranularity(g->beg));
  92   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
  93   if (flags()->detect_odr_violation) {
  94     // Try detecting ODR (One Definition Rule) violation, i.e. the situation
  95     // where two globals with the same name are defined in different modules.
  96     if (__asan_region_is_poisoned(g->beg, g->size_with_redzone)) {
  97       // This check may not be enough: if the first global is much larger
  98       // the entire redzone of the second global may be within the first global.
  99       for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
 100         if (g->beg == l->g->beg &&
 101             (flags()->detect_odr_violation >= 2 || g->size != l->g->size))
 102           ReportODRViolation(g, l->g);
 103       }
 104     }
 105   }
 106   if (flags()->poison_heap)
 107     PoisonRedZones(*g);
 108   ListOfGlobals *l = new(allocator_for_globals) ListOfGlobals;
 109   l->g = g;
 110   l->next = list_of_all_globals;
 111   list_of_all_globals = l;
 112   if (g->has_dynamic_init) {
 113     if (dynamic_init_globals == 0) {
 114       dynamic_init_globals = new(allocator_for_globals)
 115           VectorOfGlobals(kDynamicInitGlobalsInitialCapacity);
 116     }
 117     DynInitGlobal dyn_global = { *g, false };
 118     dynamic_init_globals->push_back(dyn_global);
 119   }
 120 }
 121
 122 static void UnregisterGlobal(const Global *g) {
 123   CHECK(asan_inited);
 124   CHECK(flags()->report_globals);
 125   CHECK(AddrIsInMem(g->beg));
 126   CHECK(AddrIsAlignedByGranularity(g->beg));
 127   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
 128   if (flags()->poison_heap)
 129     PoisonShadowForGlobal(g, 0);
 130   // We unpoison the shadow memory for the global but we do not remove it from
 131   // the list because that would require O(n^2) time with the current list
 132   // implementation. It might not be worth doing anyway.
 133 }
 134
 135 void StopInitOrderChecking() {
 136   BlockingMutexLock lock(&mu_for_globals);
 137   if (!flags()->check_initialization_order || !dynamic_init_globals)
 138     return;
 139   flags()->check_initialization_order = false;
 140   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 141     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 142     const Global *g = &dyn_g.g;
 143     // Unpoison the whole global.
 144     PoisonShadowForGlobal(g, 0);
 145     // Poison redzones back.
 146     PoisonRedZones(*g);
 147   }
 148 }
 149
 150 }  // namespace __asan
 151
 152 // ---------------------- Interface ---------------- {{{1
 153 using namespace __asan;  // NOLINT
 154
 155 // Register an array of globals.
 156 void __asan_register_globals(__asan_global *globals, uptr n) {
 157   if (!flags()->report_globals) return;
 158   BlockingMutexLock lock(&mu_for_globals);
 159   for (uptr i = 0; i < n; i++) {
 160     RegisterGlobal(&globals[i]);
 161   }
 162 }
 163
 164 // Unregister an array of globals.
 165 // We must do this when a shared objects gets dlclosed.
 166 void __asan_unregister_globals(__asan_global *globals, uptr n) {
 167   if (!flags()->report_globals) return;
 168   BlockingMutexLock lock(&mu_for_globals);
 169   for (uptr i = 0; i < n; i++) {
 170     UnregisterGlobal(&globals[i]);
 171   }
 172 }
 173
 174 // This method runs immediately prior to dynamic initialization in each TU,
 175 // when all dynamically initialized globals are unpoisoned.  This method
 176 // poisons all global variables not defined in this TU, so that a dynamic
 177 // initializer can only touch global variables in the same TU.
 178 void __asan_before_dynamic_init(const char *module_name) {
 179   if (!flags()->check_initialization_order ||
 180       !flags()->poison_heap)
 181     return;
 182   bool strict_init_order = flags()->strict_init_order;
 183   CHECK(dynamic_init_globals);
 184   CHECK(module_name);
 185   CHECK(asan_inited);
 186   BlockingMutexLock lock(&mu_for_globals);
 187   if (flags()->report_globals >= 3)
 188     Printf("DynInitPoison module: %s\n", module_name);
 189   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 190     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 191     const Global *g = &dyn_g.g;
 192     if (dyn_g.initialized)
 193       continue;
 194     if (g->module_name != module_name)
 195       PoisonShadowForGlobal(g, kAsanInitializationOrderMagic);
 196     else if (!strict_init_order)
 197       dyn_g.initialized = true;
 198   }
 199 }
 200
 201 // This method runs immediately after dynamic initialization in each TU, when
 202 // all dynamically initialized globals except for those defined in the current
 203 // TU are poisoned.  It simply unpoisons all dynamically initialized globals.
 204 void __asan_after_dynamic_init() {
 205   if (!flags()->check_initialization_order ||
 206       !flags()->poison_heap)
 207     return;
 208   CHECK(asan_inited);
 209   BlockingMutexLock lock(&mu_for_globals);
 210   // FIXME: Optionally report that we're unpoisoning globals from a module.
 211   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
 212     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
 213     const Global *g = &dyn_g.g;
 214     if (!dyn_g.initialized) {
 215       // Unpoison the whole global.
 216       PoisonShadowForGlobal(g, 0);
 217       // Poison redzones back.
 218       PoisonRedZones(*g);
 219     }
 220   }
 221 }