1 //===-- asan_malloc_mac.cc ------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
10 // Mac-specific malloc interception.
11 //===----------------------------------------------------------------------===//
13 #include "sanitizer_common/sanitizer_platform.h"
16 #include <AvailabilityMacros.h>
17 #include <CoreFoundation/CFBase.h>
19 #include <malloc/malloc.h>
22 #include "asan_allocator.h"
23 #include "asan_interceptors.h"
24 #include "asan_internal.h"
25 #include "asan_report.h"
26 #include "asan_stack.h"
27 #include "asan_stats.h"
28 #include "sanitizer_common/sanitizer_mac.h"
30 // Similar code is used in Google Perftools,
31 // http://code.google.com/p/google-perftools.
33 // ---------------------- Replacement functions ---------------- {{{1
34 using namespace __asan
; // NOLINT
36 // TODO(glider): do we need both zones?
37 static malloc_zone_t
*system_malloc_zone
= 0;
38 static malloc_zone_t asan_zone
;
40 INTERCEPTOR(malloc_zone_t
*, malloc_create_zone
,
41 vm_size_t start_size
, unsigned zone_flags
) {
43 GET_STACK_TRACE_MALLOC
;
44 uptr page_size
= GetPageSizeCached();
45 uptr allocated_size
= RoundUpTo(sizeof(asan_zone
), page_size
);
46 malloc_zone_t
*new_zone
=
47 (malloc_zone_t
*)asan_memalign(page_size
, allocated_size
,
49 internal_memcpy(new_zone
, &asan_zone
, sizeof(asan_zone
));
50 new_zone
->zone_name
= NULL
; // The name will be changed anyway.
51 if (GetMacosVersion() >= MACOS_VERSION_LION
) {
52 // Prevent the client app from overwriting the zone contents.
53 // Library functions that need to modify the zone will set PROT_WRITE on it.
54 // This matches the behavior of malloc_create_zone() on OSX 10.7 and higher.
55 mprotect(new_zone
, allocated_size
, PROT_READ
);
60 INTERCEPTOR(malloc_zone_t
*, malloc_default_zone
, void) {
65 INTERCEPTOR(malloc_zone_t
*, malloc_default_purgeable_zone
, void) {
66 // FIXME: ASan should support purgeable allocations.
67 // https://code.google.com/p/address-sanitizer/issues/detail?id=139
72 INTERCEPTOR(void, malloc_make_purgeable
, void *ptr
) {
73 // FIXME: ASan should support purgeable allocations. Ignoring them is fine
78 INTERCEPTOR(int, malloc_make_nonpurgeable
, void *ptr
) {
79 // FIXME: ASan should support purgeable allocations. Ignoring them is fine
82 // Must return 0 if the contents were not purged since the last call to
83 // malloc_make_purgeable().
87 INTERCEPTOR(void, malloc_set_zone_name
, malloc_zone_t
*zone
, const char *name
) {
89 // Allocate |strlen("asan-") + 1 + internal_strlen(name)| bytes.
90 size_t buflen
= 6 + (name
? internal_strlen(name
) : 0);
91 InternalScopedString
new_name(buflen
);
92 if (name
&& zone
->introspect
== asan_zone
.introspect
) {
93 new_name
.append("asan-%s", name
);
94 name
= new_name
.data();
97 // Call the system malloc's implementation for both external and our zones,
98 // since that appropriately changes VM region protections on the zone.
99 REAL(malloc_set_zone_name
)(zone
, name
);
102 INTERCEPTOR(void *, malloc
, size_t size
) {
103 ENSURE_ASAN_INITED();
104 GET_STACK_TRACE_MALLOC
;
105 void *res
= asan_malloc(size
, &stack
);
109 INTERCEPTOR(void, free
, void *ptr
) {
110 ENSURE_ASAN_INITED();
112 GET_STACK_TRACE_FREE
;
113 asan_free(ptr
, &stack
, FROM_MALLOC
);
116 INTERCEPTOR(void *, realloc
, void *ptr
, size_t size
) {
117 ENSURE_ASAN_INITED();
118 GET_STACK_TRACE_MALLOC
;
119 return asan_realloc(ptr
, size
, &stack
);
122 INTERCEPTOR(void *, calloc
, size_t nmemb
, size_t size
) {
123 ENSURE_ASAN_INITED();
124 GET_STACK_TRACE_MALLOC
;
125 return asan_calloc(nmemb
, size
, &stack
);
128 INTERCEPTOR(void *, valloc
, size_t size
) {
129 ENSURE_ASAN_INITED();
130 GET_STACK_TRACE_MALLOC
;
131 return asan_memalign(GetPageSizeCached(), size
, &stack
, FROM_MALLOC
);
134 INTERCEPTOR(size_t, malloc_good_size
, size_t size
) {
135 ENSURE_ASAN_INITED();
136 return asan_zone
.introspect
->good_size(&asan_zone
, size
);
139 INTERCEPTOR(int, posix_memalign
, void **memptr
, size_t alignment
, size_t size
) {
140 ENSURE_ASAN_INITED();
142 GET_STACK_TRACE_MALLOC
;
143 void *result
= asan_memalign(alignment
, size
, &stack
, FROM_MALLOC
);
153 // TODO(glider): the __asan_mz_* functions should be united with the Linux
154 // wrappers, as they are basically copied from there.
156 SANITIZER_INTERFACE_ATTRIBUTE
157 size_t __asan_mz_size(malloc_zone_t
* zone
, const void* ptr
) {
158 return asan_mz_size(ptr
);
162 SANITIZER_INTERFACE_ATTRIBUTE
163 void *__asan_mz_malloc(malloc_zone_t
*zone
, uptr size
) {
164 if (UNLIKELY(!asan_inited
)) {
165 CHECK(system_malloc_zone
);
166 return malloc_zone_malloc(system_malloc_zone
, size
);
168 GET_STACK_TRACE_MALLOC
;
169 return asan_malloc(size
, &stack
);
173 SANITIZER_INTERFACE_ATTRIBUTE
174 void *__asan_mz_calloc(malloc_zone_t
*zone
, size_t nmemb
, size_t size
) {
175 if (UNLIKELY(!asan_inited
)) {
176 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym.
177 const size_t kCallocPoolSize
= 1024;
178 static uptr calloc_memory_for_dlsym
[kCallocPoolSize
];
179 static size_t allocated
;
180 size_t size_in_words
= ((nmemb
* size
) + kWordSize
- 1) / kWordSize
;
181 void *mem
= (void*)&calloc_memory_for_dlsym
[allocated
];
182 allocated
+= size_in_words
;
183 CHECK(allocated
< kCallocPoolSize
);
186 GET_STACK_TRACE_MALLOC
;
187 return asan_calloc(nmemb
, size
, &stack
);
191 SANITIZER_INTERFACE_ATTRIBUTE
192 void *__asan_mz_valloc(malloc_zone_t
*zone
, size_t size
) {
193 if (UNLIKELY(!asan_inited
)) {
194 CHECK(system_malloc_zone
);
195 return malloc_zone_valloc(system_malloc_zone
, size
);
197 GET_STACK_TRACE_MALLOC
;
198 return asan_memalign(GetPageSizeCached(), size
, &stack
, FROM_MALLOC
);
201 #define GET_ZONE_FOR_PTR(ptr) \
202 malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); \
203 const char *zone_name = (zone_ptr == 0) ? 0 : zone_ptr->zone_name
205 void ALWAYS_INLINE
free_common(void *context
, void *ptr
) {
207 GET_STACK_TRACE_FREE
;
208 // FIXME: need to retire this flag.
209 if (!flags()->mac_ignore_invalid_free
) {
210 asan_free(ptr
, &stack
, FROM_MALLOC
);
212 GET_ZONE_FOR_PTR(ptr
);
213 WarnMacFreeUnallocated((uptr
)ptr
, (uptr
)zone_ptr
, zone_name
, &stack
);
218 // TODO(glider): the allocation callbacks need to be refactored.
220 SANITIZER_INTERFACE_ATTRIBUTE
221 void __asan_mz_free(malloc_zone_t
*zone
, void *ptr
) {
222 free_common(zone
, ptr
);
226 SANITIZER_INTERFACE_ATTRIBUTE
227 void *__asan_mz_realloc(malloc_zone_t
*zone
, void *ptr
, size_t size
) {
229 GET_STACK_TRACE_MALLOC
;
230 return asan_malloc(size
, &stack
);
232 if (asan_mz_size(ptr
)) {
233 GET_STACK_TRACE_MALLOC
;
234 return asan_realloc(ptr
, size
, &stack
);
236 // We can't recover from reallocating an unknown address, because
237 // this would require reading at most |size| bytes from
238 // potentially unaccessible memory.
239 GET_STACK_TRACE_FREE
;
240 GET_ZONE_FOR_PTR(ptr
);
241 ReportMacMzReallocUnknown((uptr
)ptr
, (uptr
)zone_ptr
, zone_name
, &stack
);
247 SANITIZER_INTERFACE_ATTRIBUTE
248 void __asan_mz_destroy(malloc_zone_t
* zone
) {
249 // A no-op -- we will not be destroyed!
250 Report("__asan_mz_destroy() called -- ignoring\n");
254 SANITIZER_INTERFACE_ATTRIBUTE
255 void *__asan_mz_memalign(malloc_zone_t
*zone
, size_t align
, size_t size
) {
256 if (UNLIKELY(!asan_inited
)) {
257 CHECK(system_malloc_zone
);
258 return malloc_zone_memalign(system_malloc_zone
, align
, size
);
260 GET_STACK_TRACE_MALLOC
;
261 return asan_memalign(align
, size
, &stack
, FROM_MALLOC
);
264 // This function is currently unused, and we build with -Werror.
266 void __asan_mz_free_definite_size(
267 malloc_zone_t
* zone
, void *ptr
, size_t size
) {
268 // TODO(glider): check that |size| is valid.
273 kern_return_t
mi_enumerator(task_t task
, void *,
274 unsigned type_mask
, vm_address_t zone_address
,
275 memory_reader_t reader
,
276 vm_range_recorder_t recorder
) {
277 // Should enumerate all the pointers we have. Seems like a lot of work.
281 size_t mi_good_size(malloc_zone_t
*zone
, size_t size
) {
282 // I think it's always safe to return size, but we maybe could do better.
286 boolean_t
mi_check(malloc_zone_t
*zone
) {
290 void mi_print(malloc_zone_t
*zone
, boolean_t verbose
) {
294 void mi_log(malloc_zone_t
*zone
, void *address
) {
295 // I don't think we support anything like this
298 void mi_force_lock(malloc_zone_t
*zone
) {
299 asan_mz_force_lock();
302 void mi_force_unlock(malloc_zone_t
*zone
) {
303 asan_mz_force_unlock();
306 void mi_statistics(malloc_zone_t
*zone
, malloc_statistics_t
*stats
) {
307 AsanMallocStats malloc_stats
;
308 FillMallocStatistics(&malloc_stats
);
309 CHECK(sizeof(malloc_statistics_t
) == sizeof(AsanMallocStats
));
310 internal_memcpy(stats
, &malloc_stats
, sizeof(malloc_statistics_t
));
313 boolean_t
mi_zone_locked(malloc_zone_t
*zone
) {
318 } // unnamed namespace
322 void ReplaceSystemMalloc() {
323 static malloc_introspection_t asan_introspection
;
324 // Ok to use internal_memset, these places are not performance-critical.
325 internal_memset(&asan_introspection
, 0, sizeof(asan_introspection
));
327 asan_introspection
.enumerator
= &mi_enumerator
;
328 asan_introspection
.good_size
= &mi_good_size
;
329 asan_introspection
.check
= &mi_check
;
330 asan_introspection
.print
= &mi_print
;
331 asan_introspection
.log
= &mi_log
;
332 asan_introspection
.force_lock
= &mi_force_lock
;
333 asan_introspection
.force_unlock
= &mi_force_unlock
;
334 asan_introspection
.statistics
= &mi_statistics
;
335 asan_introspection
.zone_locked
= &mi_zone_locked
;
337 internal_memset(&asan_zone
, 0, sizeof(malloc_zone_t
));
339 // Use version 6 for OSX >= 10.6.
340 asan_zone
.version
= 6;
341 asan_zone
.zone_name
= "asan";
342 asan_zone
.size
= &__asan_mz_size
;
343 asan_zone
.malloc
= &__asan_mz_malloc
;
344 asan_zone
.calloc
= &__asan_mz_calloc
;
345 asan_zone
.valloc
= &__asan_mz_valloc
;
346 asan_zone
.free
= &__asan_mz_free
;
347 asan_zone
.realloc
= &__asan_mz_realloc
;
348 asan_zone
.destroy
= &__asan_mz_destroy
;
349 asan_zone
.batch_malloc
= 0;
350 asan_zone
.batch_free
= 0;
351 asan_zone
.free_definite_size
= 0;
352 asan_zone
.memalign
= &__asan_mz_memalign
;
353 asan_zone
.introspect
= &asan_introspection
;
355 // Register the ASan zone.
356 malloc_zone_register(&asan_zone
);
358 } // namespace __asan
360 #endif // SANITIZER_MAC