1 //===-- asan_globals.cc ---------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
11 //===----------------------------------------------------------------------===//
12 #include "asan_interceptors.h"
13 #include "asan_internal.h"
14 #include "asan_mapping.h"
15 #include "asan_poisoning.h"
16 #include "asan_report.h"
17 #include "asan_stack.h"
18 #include "asan_stats.h"
19 #include "asan_thread.h"
20 #include "sanitizer_common/sanitizer_common.h"
21 #include "sanitizer_common/sanitizer_mutex.h"
22 #include "sanitizer_common/sanitizer_placement_new.h"
26 typedef __asan_global Global
;
28 struct ListOfGlobals
{
33 static BlockingMutex
mu_for_globals(LINKER_INITIALIZED
);
34 static LowLevelAllocator allocator_for_globals
;
35 static ListOfGlobals
*list_of_all_globals
;
37 static const int kDynamicInitGlobalsInitialCapacity
= 512;
38 struct DynInitGlobal
{
42 typedef InternalMmapVector
<DynInitGlobal
> VectorOfGlobals
;
43 // Lazy-initialized and never deleted.
44 static VectorOfGlobals
*dynamic_init_globals
;
46 ALWAYS_INLINE
void PoisonShadowForGlobal(const Global
*g
, u8 value
) {
47 FastPoisonShadow(g
->beg
, g
->size_with_redzone
, value
);
50 ALWAYS_INLINE
void PoisonRedZones(const Global
&g
) {
51 uptr aligned_size
= RoundUpTo(g
.size
, SHADOW_GRANULARITY
);
52 FastPoisonShadow(g
.beg
+ aligned_size
, g
.size_with_redzone
- aligned_size
,
53 kAsanGlobalRedzoneMagic
);
54 if (g
.size
!= aligned_size
) {
55 FastPoisonShadowPartialRightRedzone(
56 g
.beg
+ RoundDownTo(g
.size
, SHADOW_GRANULARITY
),
57 g
.size
% SHADOW_GRANULARITY
,
59 kAsanGlobalRedzoneMagic
);
63 static void ReportGlobal(const Global
&g
, const char *prefix
) {
64 Report("%s Global: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n",
65 prefix
, (void*)g
.beg
, g
.size
, g
.size_with_redzone
, g
.name
,
66 g
.module_name
, g
.has_dynamic_init
);
69 bool DescribeAddressIfGlobal(uptr addr
, uptr size
) {
70 if (!flags()->report_globals
) return false;
71 BlockingMutexLock
lock(&mu_for_globals
);
73 for (ListOfGlobals
*l
= list_of_all_globals
; l
; l
= l
->next
) {
74 const Global
&g
= *l
->g
;
75 if (flags()->report_globals
>= 2)
76 ReportGlobal(g
, "Search");
77 res
|= DescribeAddressRelativeToGlobal(addr
, size
, g
);
82 // Register a global variable.
83 // This function may be called more than once for every global
84 // so we store the globals in a map.
85 static void RegisterGlobal(const Global
*g
) {
87 if (flags()->report_globals
>= 2)
88 ReportGlobal(*g
, "Added");
89 CHECK(flags()->report_globals
);
90 CHECK(AddrIsInMem(g
->beg
));
91 CHECK(AddrIsAlignedByGranularity(g
->beg
));
92 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
93 if (flags()->poison_heap
)
95 ListOfGlobals
*l
= new(allocator_for_globals
) ListOfGlobals
;
97 l
->next
= list_of_all_globals
;
98 list_of_all_globals
= l
;
99 if (g
->has_dynamic_init
) {
100 if (dynamic_init_globals
== 0) {
101 dynamic_init_globals
= new(allocator_for_globals
)
102 VectorOfGlobals(kDynamicInitGlobalsInitialCapacity
);
104 DynInitGlobal dyn_global
= { *g
, false };
105 dynamic_init_globals
->push_back(dyn_global
);
109 static void UnregisterGlobal(const Global
*g
) {
111 CHECK(flags()->report_globals
);
112 CHECK(AddrIsInMem(g
->beg
));
113 CHECK(AddrIsAlignedByGranularity(g
->beg
));
114 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
115 if (flags()->poison_heap
)
116 PoisonShadowForGlobal(g
, 0);
117 // We unpoison the shadow memory for the global but we do not remove it from
118 // the list because that would require O(n^2) time with the current list
119 // implementation. It might not be worth doing anyway.
122 void StopInitOrderChecking() {
123 BlockingMutexLock
lock(&mu_for_globals
);
124 if (!flags()->check_initialization_order
|| !dynamic_init_globals
)
126 flags()->check_initialization_order
= false;
127 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
128 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
129 const Global
*g
= &dyn_g
.g
;
130 // Unpoison the whole global.
131 PoisonShadowForGlobal(g
, 0);
132 // Poison redzones back.
137 } // namespace __asan
139 // ---------------------- Interface ---------------- {{{1
140 using namespace __asan
; // NOLINT
142 // Register an array of globals.
143 void __asan_register_globals(__asan_global
*globals
, uptr n
) {
144 if (!flags()->report_globals
) return;
145 BlockingMutexLock
lock(&mu_for_globals
);
146 for (uptr i
= 0; i
< n
; i
++) {
147 RegisterGlobal(&globals
[i
]);
151 // Unregister an array of globals.
152 // We must do this when a shared objects gets dlclosed.
153 void __asan_unregister_globals(__asan_global
*globals
, uptr n
) {
154 if (!flags()->report_globals
) return;
155 BlockingMutexLock
lock(&mu_for_globals
);
156 for (uptr i
= 0; i
< n
; i
++) {
157 UnregisterGlobal(&globals
[i
]);
161 // This method runs immediately prior to dynamic initialization in each TU,
162 // when all dynamically initialized globals are unpoisoned. This method
163 // poisons all global variables not defined in this TU, so that a dynamic
164 // initializer can only touch global variables in the same TU.
165 void __asan_before_dynamic_init(const char *module_name
) {
166 if (!flags()->check_initialization_order
||
167 !flags()->poison_heap
)
169 bool strict_init_order
= flags()->strict_init_order
;
170 CHECK(dynamic_init_globals
);
173 BlockingMutexLock
lock(&mu_for_globals
);
174 if (flags()->report_globals
>= 3)
175 Printf("DynInitPoison module: %s\n", module_name
);
176 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
177 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
178 const Global
*g
= &dyn_g
.g
;
179 if (dyn_g
.initialized
)
181 if (g
->module_name
!= module_name
)
182 PoisonShadowForGlobal(g
, kAsanInitializationOrderMagic
);
183 else if (!strict_init_order
)
184 dyn_g
.initialized
= true;
188 // This method runs immediately after dynamic initialization in each TU, when
189 // all dynamically initialized globals except for those defined in the current
190 // TU are poisoned. It simply unpoisons all dynamically initialized globals.
191 void __asan_after_dynamic_init() {
192 if (!flags()->check_initialization_order
||
193 !flags()->poison_heap
)
196 BlockingMutexLock
lock(&mu_for_globals
);
197 // FIXME: Optionally report that we're unpoisoning globals from a module.
198 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
199 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
200 const Global
*g
= &dyn_g
.g
;
201 if (!dyn_g
.initialized
) {
202 // Unpoison the whole global.
203 PoisonShadowForGlobal(g
, 0);
204 // Poison redzones back.