1 //===-- asan_globals.cpp --------------------------------------------------===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // This file is a part of AddressSanitizer, an address sanity checker.
12 //===----------------------------------------------------------------------===//
14 #include "asan_interceptors.h"
15 #include "asan_internal.h"
16 #include "asan_mapping.h"
17 #include "asan_poisoning.h"
18 #include "asan_report.h"
19 #include "asan_stack.h"
20 #include "asan_stats.h"
21 #include "asan_suppressions.h"
22 #include "asan_thread.h"
23 #include "sanitizer_common/sanitizer_common.h"
24 #include "sanitizer_common/sanitizer_mutex.h"
25 #include "sanitizer_common/sanitizer_placement_new.h"
26 #include "sanitizer_common/sanitizer_stackdepot.h"
27 #include "sanitizer_common/sanitizer_symbolizer.h"
31 typedef __asan_global Global
;
33 struct ListOfGlobals
{
38 static Mutex mu_for_globals
;
39 static LowLevelAllocator allocator_for_globals
;
40 static ListOfGlobals
*list_of_all_globals
;
42 static const int kDynamicInitGlobalsInitialCapacity
= 512;
43 struct DynInitGlobal
{
47 typedef InternalMmapVector
<DynInitGlobal
> VectorOfGlobals
;
48 // Lazy-initialized and never deleted.
49 static VectorOfGlobals
*dynamic_init_globals
;
51 // We want to remember where a certain range of globals was registered.
52 struct GlobalRegistrationSite
{
54 Global
*g_first
, *g_last
;
56 typedef InternalMmapVector
<GlobalRegistrationSite
> GlobalRegistrationSiteVector
;
57 static GlobalRegistrationSiteVector
*global_registration_site_vector
;
59 ALWAYS_INLINE
void PoisonShadowForGlobal(const Global
*g
, u8 value
) {
60 FastPoisonShadow(g
->beg
, g
->size_with_redzone
, value
);
63 ALWAYS_INLINE
void PoisonRedZones(const Global
&g
) {
64 uptr aligned_size
= RoundUpTo(g
.size
, ASAN_SHADOW_GRANULARITY
);
65 FastPoisonShadow(g
.beg
+ aligned_size
, g
.size_with_redzone
- aligned_size
,
66 kAsanGlobalRedzoneMagic
);
67 if (g
.size
!= aligned_size
) {
68 FastPoisonShadowPartialRightRedzone(
69 g
.beg
+ RoundDownTo(g
.size
, ASAN_SHADOW_GRANULARITY
),
70 g
.size
% ASAN_SHADOW_GRANULARITY
, ASAN_SHADOW_GRANULARITY
,
71 kAsanGlobalRedzoneMagic
);
75 const uptr kMinimalDistanceFromAnotherGlobal
= 64;
77 static bool IsAddressNearGlobal(uptr addr
, const __asan_global
&g
) {
78 if (addr
<= g
.beg
- kMinimalDistanceFromAnotherGlobal
) return false;
79 if (addr
>= g
.beg
+ g
.size_with_redzone
) return false;
83 static void ReportGlobal(const Global
&g
, const char *prefix
) {
85 "%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu "
87 prefix
, (void *)&g
, (void *)g
.beg
, g
.size
, g
.size_with_redzone
, g
.name
,
88 g
.module_name
, g
.has_dynamic_init
, (void *)g
.odr_indicator
);
91 Symbolizer::GetOrInit()->SymbolizeData(g
.beg
, &info
);
93 Report(" location: name=%s, %d\n", info
.file
, static_cast<int>(info
.line
));
97 static u32
FindRegistrationSite(const Global
*g
) {
98 mu_for_globals
.CheckLocked();
99 CHECK(global_registration_site_vector
);
100 for (uptr i
= 0, n
= global_registration_site_vector
->size(); i
< n
; i
++) {
101 GlobalRegistrationSite
&grs
= (*global_registration_site_vector
)[i
];
102 if (g
>= grs
.g_first
&& g
<= grs
.g_last
)
108 int GetGlobalsForAddress(uptr addr
, Global
*globals
, u32
*reg_sites
,
110 if (!flags()->report_globals
) return 0;
111 Lock
lock(&mu_for_globals
);
113 for (ListOfGlobals
*l
= list_of_all_globals
; l
; l
= l
->next
) {
114 const Global
&g
= *l
->g
;
115 if (flags()->report_globals
>= 2)
116 ReportGlobal(g
, "Search");
117 if (IsAddressNearGlobal(addr
, g
)) {
118 internal_memcpy(&globals
[res
], &g
, sizeof(g
));
120 reg_sites
[res
] = FindRegistrationSite(&g
);
122 if (res
== max_globals
)
129 enum GlobalSymbolState
{
134 // Check ODR violation for given global G via special ODR indicator. We use
135 // this method in case compiler instruments global variables through their
137 static void CheckODRViolationViaIndicator(const Global
*g
) {
138 // Instrumentation requests to skip ODR check.
139 if (g
->odr_indicator
== UINTPTR_MAX
)
141 u8
*odr_indicator
= reinterpret_cast<u8
*>(g
->odr_indicator
);
142 if (*odr_indicator
== UNREGISTERED
) {
143 *odr_indicator
= REGISTERED
;
146 // If *odr_indicator is DEFINED, some module have already registered
147 // externally visible symbol with the same name. This is an ODR violation.
148 for (ListOfGlobals
*l
= list_of_all_globals
; l
; l
= l
->next
) {
149 if (g
->odr_indicator
== l
->g
->odr_indicator
&&
150 (flags()->detect_odr_violation
>= 2 || g
->size
!= l
->g
->size
) &&
151 !IsODRViolationSuppressed(g
->name
))
152 ReportODRViolation(g
, FindRegistrationSite(g
),
153 l
->g
, FindRegistrationSite(l
->g
));
157 // Clang provides two different ways for global variables protection:
158 // it can poison the global itself or its private alias. In former
159 // case we may poison same symbol multiple times, that can help us to
160 // cheaply detect ODR violation: if we try to poison an already poisoned
161 // global, we have ODR violation error.
162 // In latter case, we poison each symbol exactly once, so we use special
163 // indicator symbol to perform similar check.
164 // In either case, compiler provides a special odr_indicator field to Global
165 // structure, that can contain two kinds of values:
166 // 1) Non-zero value. In this case, odr_indicator is an address of
167 // corresponding indicator variable for given global.
168 // 2) Zero. This means that we don't use private aliases for global variables
169 // and can freely check ODR violation with the first method.
171 // This routine chooses between two different methods of ODR violation
173 static inline bool UseODRIndicator(const Global
*g
) {
174 return g
->odr_indicator
> 0;
177 // Register a global variable.
178 // This function may be called more than once for every global
179 // so we store the globals in a map.
180 static void RegisterGlobal(const Global
*g
) {
182 if (flags()->report_globals
>= 2)
183 ReportGlobal(*g
, "Added");
184 CHECK(flags()->report_globals
);
185 CHECK(AddrIsInMem(g
->beg
));
186 if (!AddrIsAlignedByGranularity(g
->beg
)) {
187 Report("The following global variable is not properly aligned.\n");
188 Report("This may happen if another global with the same name\n");
189 Report("resides in another non-instrumented module.\n");
190 Report("Or the global comes from a C file built w/o -fno-common.\n");
191 Report("In either case this is likely an ODR violation bug,\n");
192 Report("but AddressSanitizer can not provide more details.\n");
193 ReportODRViolation(g
, FindRegistrationSite(g
), g
, FindRegistrationSite(g
));
194 CHECK(AddrIsAlignedByGranularity(g
->beg
));
196 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
197 if (flags()->detect_odr_violation
) {
198 // Try detecting ODR (One Definition Rule) violation, i.e. the situation
199 // where two globals with the same name are defined in different modules.
200 if (UseODRIndicator(g
))
201 CheckODRViolationViaIndicator(g
);
203 if (CanPoisonMemory())
205 ListOfGlobals
*l
= new(allocator_for_globals
) ListOfGlobals
;
207 l
->next
= list_of_all_globals
;
208 list_of_all_globals
= l
;
209 if (g
->has_dynamic_init
) {
210 if (!dynamic_init_globals
) {
211 dynamic_init_globals
= new (allocator_for_globals
) VectorOfGlobals
;
212 dynamic_init_globals
->reserve(kDynamicInitGlobalsInitialCapacity
);
214 DynInitGlobal dyn_global
= { *g
, false };
215 dynamic_init_globals
->push_back(dyn_global
);
219 static void UnregisterGlobal(const Global
*g
) {
221 if (flags()->report_globals
>= 2)
222 ReportGlobal(*g
, "Removed");
223 CHECK(flags()->report_globals
);
224 CHECK(AddrIsInMem(g
->beg
));
225 CHECK(AddrIsAlignedByGranularity(g
->beg
));
226 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
227 if (CanPoisonMemory())
228 PoisonShadowForGlobal(g
, 0);
229 // We unpoison the shadow memory for the global but we do not remove it from
230 // the list because that would require O(n^2) time with the current list
231 // implementation. It might not be worth doing anyway.
233 // Release ODR indicator.
234 if (UseODRIndicator(g
) && g
->odr_indicator
!= UINTPTR_MAX
) {
235 u8
*odr_indicator
= reinterpret_cast<u8
*>(g
->odr_indicator
);
236 *odr_indicator
= UNREGISTERED
;
240 void StopInitOrderChecking() {
241 Lock
lock(&mu_for_globals
);
242 if (!flags()->check_initialization_order
|| !dynamic_init_globals
)
244 flags()->check_initialization_order
= false;
245 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
246 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
247 const Global
*g
= &dyn_g
.g
;
248 // Unpoison the whole global.
249 PoisonShadowForGlobal(g
, 0);
250 // Poison redzones back.
255 static bool IsASCII(unsigned char c
) { return /*0x00 <= c &&*/ c
<= 0x7F; }
257 const char *MaybeDemangleGlobalName(const char *name
) {
258 // We can spoil names of globals with C linkage, so use an heuristic
259 // approach to check if the name should be demangled.
260 bool should_demangle
= false;
261 if (name
[0] == '_' && name
[1] == 'Z')
262 should_demangle
= true;
263 else if (SANITIZER_WINDOWS
&& name
[0] == '\01' && name
[1] == '?')
264 should_demangle
= true;
266 return should_demangle
? Symbolizer::GetOrInit()->Demangle(name
) : name
;
269 // Check if the global is a zero-terminated ASCII string. If so, print it.
270 void PrintGlobalNameIfASCII(InternalScopedString
*str
, const __asan_global
&g
) {
271 for (uptr p
= g
.beg
; p
< g
.beg
+ g
.size
- 1; p
++) {
272 unsigned char c
= *(unsigned char *)p
;
273 if (c
== '\0' || !IsASCII(c
)) return;
275 if (*(char *)(g
.beg
+ g
.size
- 1) != '\0') return;
276 str
->append(" '%s' is ascii string '%s'\n", MaybeDemangleGlobalName(g
.name
),
280 void PrintGlobalLocation(InternalScopedString
*str
, const __asan_global
&g
) {
282 Symbolizer::GetOrInit()->SymbolizeData(g
.beg
, &info
);
284 if (info
.line
!= 0) {
285 str
->append("%s:%d", info
.file
, static_cast<int>(info
.line
));
287 str
->append("%s", g
.module_name
);
291 } // namespace __asan
293 // ---------------------- Interface ---------------- {{{1
294 using namespace __asan
;
296 // Apply __asan_register_globals to all globals found in the same loaded
297 // executable or shared library as `flag'. The flag tracks whether globals have
298 // already been registered or not for this image.
299 void __asan_register_image_globals(uptr
*flag
) {
302 AsanApplyToGlobals(__asan_register_globals
, flag
);
306 // This mirrors __asan_register_image_globals.
307 void __asan_unregister_image_globals(uptr
*flag
) {
310 AsanApplyToGlobals(__asan_unregister_globals
, flag
);
314 void __asan_register_elf_globals(uptr
*flag
, void *start
, void *stop
) {
317 CHECK_EQ(0, ((uptr
)stop
- (uptr
)start
) % sizeof(__asan_global
));
318 __asan_global
*globals_start
= (__asan_global
*)start
;
319 __asan_global
*globals_stop
= (__asan_global
*)stop
;
320 __asan_register_globals(globals_start
, globals_stop
- globals_start
);
324 void __asan_unregister_elf_globals(uptr
*flag
, void *start
, void *stop
) {
327 CHECK_EQ(0, ((uptr
)stop
- (uptr
)start
) % sizeof(__asan_global
));
328 __asan_global
*globals_start
= (__asan_global
*)start
;
329 __asan_global
*globals_stop
= (__asan_global
*)stop
;
330 __asan_unregister_globals(globals_start
, globals_stop
- globals_start
);
334 // Register an array of globals.
335 void __asan_register_globals(__asan_global
*globals
, uptr n
) {
336 if (!flags()->report_globals
) return;
337 GET_STACK_TRACE_MALLOC
;
338 u32 stack_id
= StackDepotPut(stack
);
339 Lock
lock(&mu_for_globals
);
340 if (!global_registration_site_vector
) {
341 global_registration_site_vector
=
342 new (allocator_for_globals
) GlobalRegistrationSiteVector
;
343 global_registration_site_vector
->reserve(128);
345 GlobalRegistrationSite site
= {stack_id
, &globals
[0], &globals
[n
- 1]};
346 global_registration_site_vector
->push_back(site
);
347 if (flags()->report_globals
>= 2) {
348 PRINT_CURRENT_STACK();
349 Printf("=== ID %d; %p %p\n", stack_id
, (void *)&globals
[0],
350 (void *)&globals
[n
- 1]);
352 for (uptr i
= 0; i
< n
; i
++) {
353 if (SANITIZER_WINDOWS
&& globals
[i
].beg
== 0) {
354 // The MSVC incremental linker may pad globals out to 256 bytes. As long
355 // as __asan_global is less than 256 bytes large and its size is a power
356 // of two, we can skip over the padding.
358 sizeof(__asan_global
) < 256 &&
359 (sizeof(__asan_global
) & (sizeof(__asan_global
) - 1)) == 0,
360 "sizeof(__asan_global) incompatible with incremental linker padding");
361 // If these are padding bytes, the rest of the global should be zero.
362 CHECK(globals
[i
].size
== 0 && globals
[i
].size_with_redzone
== 0 &&
363 globals
[i
].name
== nullptr && globals
[i
].module_name
== nullptr &&
364 globals
[i
].odr_indicator
== 0);
367 RegisterGlobal(&globals
[i
]);
370 // Poison the metadata. It should not be accessible to user code.
371 PoisonShadow(reinterpret_cast<uptr
>(globals
), n
* sizeof(__asan_global
),
372 kAsanGlobalRedzoneMagic
);
375 // Unregister an array of globals.
376 // We must do this when a shared objects gets dlclosed.
377 void __asan_unregister_globals(__asan_global
*globals
, uptr n
) {
378 if (!flags()->report_globals
) return;
379 Lock
lock(&mu_for_globals
);
380 for (uptr i
= 0; i
< n
; i
++) {
381 if (SANITIZER_WINDOWS
&& globals
[i
].beg
== 0) {
382 // Skip globals that look like padding from the MSVC incremental linker.
383 // See comment in __asan_register_globals.
386 UnregisterGlobal(&globals
[i
]);
389 // Unpoison the metadata.
390 PoisonShadow(reinterpret_cast<uptr
>(globals
), n
* sizeof(__asan_global
), 0);
393 // This method runs immediately prior to dynamic initialization in each TU,
394 // when all dynamically initialized globals are unpoisoned. This method
395 // poisons all global variables not defined in this TU, so that a dynamic
396 // initializer can only touch global variables in the same TU.
397 void __asan_before_dynamic_init(const char *module_name
) {
398 if (!flags()->check_initialization_order
||
399 !CanPoisonMemory() ||
400 !dynamic_init_globals
)
402 bool strict_init_order
= flags()->strict_init_order
;
405 Lock
lock(&mu_for_globals
);
406 if (flags()->report_globals
>= 3)
407 Printf("DynInitPoison module: %s\n", module_name
);
408 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
409 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
410 const Global
*g
= &dyn_g
.g
;
411 if (dyn_g
.initialized
)
413 if (g
->module_name
!= module_name
)
414 PoisonShadowForGlobal(g
, kAsanInitializationOrderMagic
);
415 else if (!strict_init_order
)
416 dyn_g
.initialized
= true;
420 // This method runs immediately after dynamic initialization in each TU, when
421 // all dynamically initialized globals except for those defined in the current
422 // TU are poisoned. It simply unpoisons all dynamically initialized globals.
423 void __asan_after_dynamic_init() {
424 if (!flags()->check_initialization_order
||
425 !CanPoisonMemory() ||
426 !dynamic_init_globals
)
429 Lock
lock(&mu_for_globals
);
430 // FIXME: Optionally report that we're unpoisoning globals from a module.
431 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
432 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
433 const Global
*g
= &dyn_g
.g
;
434 if (!dyn_g
.initialized
) {
435 // Unpoison the whole global.
436 PoisonShadowForGlobal(g
, 0);
437 // Poison redzones back.