1 //===-- ubsan_diag.cpp ----------------------------------------------------===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // Diagnostic reporting for the UBSan runtime.
11 //===----------------------------------------------------------------------===//
13 #include "ubsan_platform.h"
15 #include "ubsan_diag.h"
16 #include "ubsan_init.h"
17 #include "ubsan_flags.h"
18 #include "ubsan_monitor.h"
19 #include "sanitizer_common/sanitizer_placement_new.h"
20 #include "sanitizer_common/sanitizer_report_decorator.h"
21 #include "sanitizer_common/sanitizer_stacktrace.h"
22 #include "sanitizer_common/sanitizer_stacktrace_printer.h"
23 #include "sanitizer_common/sanitizer_suppressions.h"
24 #include "sanitizer_common/sanitizer_symbolizer.h"
27 using namespace __ubsan
;
29 // UBSan is combined with runtimes that already provide this functionality
30 // (e.g., ASan) as well as runtimes that lack it (e.g., scudo). Tried to use
31 // weak linkage to resolve this issue which is not portable and breaks on
33 // TODO(yln): This is a temporary workaround. GetStackTrace functions will be
34 // removed in the future.
35 void ubsan_GetStackTrace(BufferedStackTrace
*stack
, uptr max_depth
,
36 uptr pc
, uptr bp
, void *context
, bool fast
) {
39 if (StackTrace::WillUseFastUnwind(fast
)) {
40 GetThreadStackTopAndBottom(false, &top
, &bottom
);
41 stack
->Unwind(max_depth
, pc
, bp
, nullptr, top
, bottom
, true);
43 stack
->Unwind(max_depth
, pc
, bp
, context
, 0, 0, false);
46 static void MaybePrintStackTrace(uptr pc
, uptr bp
) {
47 // We assume that flags are already parsed, as UBSan runtime
48 // will definitely be called when we print the first diagnostics message.
49 if (!flags()->print_stacktrace
)
52 BufferedStackTrace stack
;
53 ubsan_GetStackTrace(&stack
, kStackTraceMax
, pc
, bp
, nullptr,
54 common_flags()->fast_unwind_on_fatal
);
58 static const char *ConvertTypeToString(ErrorType Type
) {
60 #define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) \
61 case ErrorType::Name: \
63 #include "ubsan_checks.inc"
66 UNREACHABLE("unknown ErrorType!");
69 static const char *ConvertTypeToFlagName(ErrorType Type
) {
71 #define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) \
72 case ErrorType::Name: \
73 return FSanitizeFlagName;
74 #include "ubsan_checks.inc"
77 UNREACHABLE("unknown ErrorType!");
80 static void MaybeReportErrorSummary(Location Loc
, ErrorType Type
) {
81 if (!common_flags()->print_summary
)
83 if (!flags()->report_error_type
)
84 Type
= ErrorType::GenericUB
;
85 const char *ErrorKind
= ConvertTypeToString(Type
);
86 if (Loc
.isSourceLocation()) {
87 SourceLocation SLoc
= Loc
.getSourceLocation();
88 if (!SLoc
.isInvalid()) {
90 AI
.file
= internal_strdup(SLoc
.getFilename());
91 AI
.line
= SLoc
.getLine();
92 AI
.column
= SLoc
.getColumn();
93 AI
.function
= internal_strdup(""); // Avoid printing ?? as function name.
94 ReportErrorSummary(ErrorKind
, AI
, GetSanititizerToolName());
98 } else if (Loc
.isSymbolizedStack()) {
99 const AddressInfo
&AI
= Loc
.getSymbolizedStack()->info
;
100 ReportErrorSummary(ErrorKind
, AI
, GetSanititizerToolName());
103 ReportErrorSummary(ErrorKind
, GetSanititizerToolName());
107 class Decorator
: public SanitizerCommonDecorator
{
109 Decorator() : SanitizerCommonDecorator() {}
110 const char *Highlight() const { return Green(); }
111 const char *Note() const { return Black(); }
115 SymbolizedStack
*__ubsan::getSymbolizedLocation(uptr PC
) {
116 InitAsStandaloneIfNecessary();
117 return Symbolizer::GetOrInit()->SymbolizePC(PC
);
120 Diag
&Diag::operator<<(const TypeDescriptor
&V
) {
121 return AddArg(V
.getTypeName());
124 Diag
&Diag::operator<<(const Value
&V
) {
125 if (V
.getType().isSignedIntegerTy())
126 AddArg(V
.getSIntValue());
127 else if (V
.getType().isUnsignedIntegerTy())
128 AddArg(V
.getUIntValue());
129 else if (V
.getType().isFloatTy())
130 AddArg(V
.getFloatValue());
136 /// Hexadecimal printing for numbers too large for Printf to handle directly.
137 static void RenderHex(InternalScopedString
*Buffer
, UIntMax Val
) {
139 Buffer
->append("0x%08x%08x%08x%08x", (unsigned int)(Val
>> 96),
140 (unsigned int)(Val
>> 64), (unsigned int)(Val
>> 32),
141 (unsigned int)(Val
));
143 UNREACHABLE("long long smaller than 64 bits?");
147 static void RenderLocation(InternalScopedString
*Buffer
, Location Loc
) {
148 switch (Loc
.getKind()) {
149 case Location::LK_Source
: {
150 SourceLocation SLoc
= Loc
.getSourceLocation();
151 if (SLoc
.isInvalid())
152 Buffer
->append("<unknown>");
154 RenderSourceLocation(Buffer
, SLoc
.getFilename(), SLoc
.getLine(),
155 SLoc
.getColumn(), common_flags()->symbolize_vs_style
,
156 common_flags()->strip_path_prefix
);
159 case Location::LK_Memory
:
160 Buffer
->append("%p", Loc
.getMemoryLocation());
162 case Location::LK_Symbolized
: {
163 const AddressInfo
&Info
= Loc
.getSymbolizedStack()->info
;
165 RenderSourceLocation(Buffer
, Info
.file
, Info
.line
, Info
.column
,
166 common_flags()->symbolize_vs_style
,
167 common_flags()->strip_path_prefix
);
168 else if (Info
.module
)
169 RenderModuleLocation(Buffer
, Info
.module
, Info
.module_offset
,
170 Info
.module_arch
, common_flags()->strip_path_prefix
);
172 Buffer
->append("%p", Info
.address
);
175 case Location::LK_Null
:
176 Buffer
->append("<unknown>");
181 static void RenderText(InternalScopedString
*Buffer
, const char *Message
,
182 const Diag::Arg
*Args
) {
183 for (const char *Msg
= Message
; *Msg
; ++Msg
) {
185 Buffer
->append("%c", *Msg
);
188 const Diag::Arg
&A
= Args
[*++Msg
- '0'];
190 case Diag::AK_String
:
191 Buffer
->append("%s", A
.String
);
193 case Diag::AK_TypeName
: {
194 if (SANITIZER_WINDOWS
)
195 // The Windows implementation demangles names early.
196 Buffer
->append("'%s'", A
.String
);
198 Buffer
->append("'%s'", Symbolizer::GetOrInit()->Demangle(A
.String
));
202 // 'long long' is guaranteed to be at least 64 bits wide.
203 if (A
.SInt
>= INT64_MIN
&& A
.SInt
<= INT64_MAX
)
204 Buffer
->append("%lld", (long long)A
.SInt
);
206 RenderHex(Buffer
, A
.SInt
);
209 if (A
.UInt
<= UINT64_MAX
)
210 Buffer
->append("%llu", (unsigned long long)A
.UInt
);
212 RenderHex(Buffer
, A
.UInt
);
214 case Diag::AK_Float
: {
215 // FIXME: Support floating-point formatting in sanitizer_common's
216 // printf, and stop using snprintf here.
217 char FloatBuffer
[32];
218 #if SANITIZER_WINDOWS
219 sprintf_s(FloatBuffer
, sizeof(FloatBuffer
), "%Lg", (long double)A
.Float
);
221 snprintf(FloatBuffer
, sizeof(FloatBuffer
), "%Lg", (long double)A
.Float
);
223 Buffer
->append("%s", FloatBuffer
);
226 case Diag::AK_Pointer
:
227 Buffer
->append("%p", A
.Pointer
);
233 /// Find the earliest-starting range in Ranges which ends after Loc.
234 static Range
*upperBound(MemoryLocation Loc
, Range
*Ranges
,
235 unsigned NumRanges
) {
237 for (unsigned I
= 0; I
!= NumRanges
; ++I
)
238 if (Ranges
[I
].getEnd().getMemoryLocation() > Loc
&&
240 Best
->getStart().getMemoryLocation() >
241 Ranges
[I
].getStart().getMemoryLocation()))
246 static inline uptr
subtractNoOverflow(uptr LHS
, uptr RHS
) {
247 return (LHS
< RHS
) ? 0 : LHS
- RHS
;
250 static inline uptr
addNoOverflow(uptr LHS
, uptr RHS
) {
251 const uptr Limit
= (uptr
)-1;
252 return (LHS
> Limit
- RHS
) ? Limit
: LHS
+ RHS
;
255 /// Render a snippet of the address space near a location.
256 static void PrintMemorySnippet(const Decorator
&Decor
, MemoryLocation Loc
,
257 Range
*Ranges
, unsigned NumRanges
,
258 const Diag::Arg
*Args
) {
259 // Show at least the 8 bytes surrounding Loc.
260 const unsigned MinBytesNearLoc
= 4;
261 MemoryLocation Min
= subtractNoOverflow(Loc
, MinBytesNearLoc
);
262 MemoryLocation Max
= addNoOverflow(Loc
, MinBytesNearLoc
);
263 MemoryLocation OrigMin
= Min
;
264 for (unsigned I
= 0; I
< NumRanges
; ++I
) {
265 Min
= __sanitizer::Min(Ranges
[I
].getStart().getMemoryLocation(), Min
);
266 Max
= __sanitizer::Max(Ranges
[I
].getEnd().getMemoryLocation(), Max
);
269 // If we have too many interesting bytes, prefer to show bytes after Loc.
270 const unsigned BytesToShow
= 32;
271 if (Max
- Min
> BytesToShow
)
272 Min
= __sanitizer::Min(Max
- BytesToShow
, OrigMin
);
273 Max
= addNoOverflow(Min
, BytesToShow
);
275 if (!IsAccessibleMemoryRange(Min
, Max
- Min
)) {
276 Printf("<memory cannot be printed>\n");
281 InternalScopedString
Buffer(1024);
282 for (uptr P
= Min
; P
!= Max
; ++P
) {
283 unsigned char C
= *reinterpret_cast<const unsigned char*>(P
);
284 Buffer
.append("%s%02x", (P
% 8 == 0) ? " " : " ", C
);
289 Buffer
.append(Decor
.Highlight());
290 Range
*InRange
= upperBound(Min
, Ranges
, NumRanges
);
291 for (uptr P
= Min
; P
!= Max
; ++P
) {
292 char Pad
= ' ', Byte
= ' ';
293 if (InRange
&& InRange
->getEnd().getMemoryLocation() == P
)
294 InRange
= upperBound(P
, Ranges
, NumRanges
);
295 if (!InRange
&& P
> Loc
)
297 if (InRange
&& InRange
->getStart().getMemoryLocation() < P
)
299 if (InRange
&& InRange
->getStart().getMemoryLocation() <= P
)
302 Buffer
.append("%c", Pad
);
303 Buffer
.append("%c", Pad
);
304 Buffer
.append("%c", P
== Loc
? '^' : Byte
);
305 Buffer
.append("%c", Byte
);
307 Buffer
.append("%s\n", Decor
.Default());
309 // Go over the line again, and print names for the ranges.
312 for (uptr P
= Min
; P
!= Max
; ++P
) {
313 if (!InRange
|| InRange
->getEnd().getMemoryLocation() == P
)
314 InRange
= upperBound(P
, Ranges
, NumRanges
);
318 Spaces
+= (P
% 8) == 0 ? 2 : 1;
320 if (InRange
&& InRange
->getStart().getMemoryLocation() == P
) {
323 RenderText(&Buffer
, InRange
->getText(), Args
);
325 // FIXME: We only support naming one range for now!
332 Printf("%s", Buffer
.data());
333 // FIXME: Print names for anything we can identify within the line:
335 // * If we can identify the memory itself as belonging to a particular
336 // global, stack variable, or dynamic allocation, then do so.
338 // * If we have a pointer-size, pointer-aligned range highlighted,
339 // determine whether the value of that range is a pointer to an
340 // entity which we can name, and if so, print that name.
342 // This needs an external symbolizer, or (preferably) ASan instrumentation.
346 // All diagnostics should be printed under report mutex.
347 ScopedReport::CheckLocked();
349 InternalScopedString
Buffer(1024);
351 // Prepare a report that a monitor process can inspect.
352 if (Level
== DL_Error
) {
353 RenderText(&Buffer
, Message
, Args
);
354 UndefinedBehaviorReport UBR
{ConvertTypeToString(ET
), Loc
, Buffer
};
358 Buffer
.append(Decor
.Bold());
359 RenderLocation(&Buffer
, Loc
);
364 Buffer
.append("%s runtime error: %s%s", Decor
.Warning(), Decor
.Default(),
369 Buffer
.append("%s note: %s", Decor
.Note(), Decor
.Default());
373 RenderText(&Buffer
, Message
, Args
);
375 Buffer
.append("%s\n", Decor
.Default());
376 Printf("%s", Buffer
.data());
378 if (Loc
.isMemoryLocation())
379 PrintMemorySnippet(Decor
, Loc
.getMemoryLocation(), Ranges
, NumRanges
, Args
);
382 ScopedReport::Initializer::Initializer() { InitAsStandaloneIfNecessary(); }
384 ScopedReport::ScopedReport(ReportOptions Opts
, Location SummaryLoc
,
386 : Opts(Opts
), SummaryLoc(SummaryLoc
), Type(Type
) {}
388 ScopedReport::~ScopedReport() {
389 MaybePrintStackTrace(Opts
.pc
, Opts
.bp
);
390 MaybeReportErrorSummary(SummaryLoc
, Type
);
391 if (flags()->halt_on_error
)
395 ALIGNED(64) static char suppression_placeholder
[sizeof(SuppressionContext
)];
396 static SuppressionContext
*suppression_ctx
= nullptr;
397 static const char kVptrCheck
[] = "vptr_check";
398 static const char *kSuppressionTypes
[] = {
399 #define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) FSanitizeFlagName,
400 #include "ubsan_checks.inc"
405 void __ubsan::InitializeSuppressions() {
406 CHECK_EQ(nullptr, suppression_ctx
);
407 suppression_ctx
= new (suppression_placeholder
)
408 SuppressionContext(kSuppressionTypes
, ARRAY_SIZE(kSuppressionTypes
));
409 suppression_ctx
->ParseFromFile(flags()->suppressions
);
412 bool __ubsan::IsVptrCheckSuppressed(const char *TypeName
) {
413 InitAsStandaloneIfNecessary();
414 CHECK(suppression_ctx
);
416 return suppression_ctx
->Match(TypeName
, kVptrCheck
, &s
);
419 bool __ubsan::IsPCSuppressed(ErrorType ET
, uptr PC
, const char *Filename
) {
420 InitAsStandaloneIfNecessary();
421 CHECK(suppression_ctx
);
422 const char *SuppType
= ConvertTypeToFlagName(ET
);
423 // Fast path: don't symbolize PC if there is no suppressions for given UB
425 if (!suppression_ctx
->HasSuppressionType(SuppType
))
427 Suppression
*s
= nullptr;
428 // Suppress by file name known to runtime.
429 if (Filename
!= nullptr && suppression_ctx
->Match(Filename
, SuppType
, &s
))
431 // Suppress by module name.
432 if (const char *Module
= Symbolizer::GetOrInit()->GetModuleNameForPc(PC
)) {
433 if (suppression_ctx
->Match(Module
, SuppType
, &s
))
436 // Suppress by function or source file name from debug info.
437 SymbolizedStackHolder
Stack(Symbolizer::GetOrInit()->SymbolizePC(PC
));
438 const AddressInfo
&AI
= Stack
.get()->info
;
439 return suppression_ctx
->Match(AI
.function
, SuppType
, &s
) ||
440 suppression_ctx
->Match(AI
.file
, SuppType
, &s
);
443 #endif // CAN_SANITIZE_UB