libsanitizer/interception/interception.h

   1 //===-- interception.h ------------------------------------------*- C++ -*-===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This file is a part of AddressSanitizer, an address sanity checker.
  10 //
  11 // Machinery for providing replacements/wrappers for system functions.
  12 //===----------------------------------------------------------------------===//
  13
  14 #ifndef INTERCEPTION_H
  15 #define INTERCEPTION_H
  16
  17 #include "sanitizer_common/sanitizer_asm.h"
  18 #include "sanitizer_common/sanitizer_internal_defs.h"
  19
  20 #if !SANITIZER_LINUX && !SANITIZER_FREEBSD && !SANITIZER_APPLE &&    \
  21     !SANITIZER_NETBSD && !SANITIZER_WINDOWS && !SANITIZER_FUCHSIA && \
  22     !SANITIZER_SOLARIS
  23 #  error "Interception doesn't work on this operating system."
  24 #endif
  25
  26 // These typedefs should be used only in the interceptor definitions to replace
  27 // the standard system types (e.g. SSIZE_T instead of ssize_t)
  28 typedef __sanitizer::uptr    SIZE_T;
  29 typedef __sanitizer::sptr    SSIZE_T;
  30 typedef __sanitizer::sptr    PTRDIFF_T;
  31 typedef __sanitizer::s64     INTMAX_T;
  32 typedef __sanitizer::u64     UINTMAX_T;
  33 typedef __sanitizer::OFF_T   OFF_T;
  34 typedef __sanitizer::OFF64_T OFF64_T;
  35
  36 // How to add an interceptor:
  37 // Suppose you need to wrap/replace system function (generally, from libc):
  38 //      int foo(const char *bar, double baz);
  39 // You'll need to:
  40 //      1) define INTERCEPTOR(int, foo, const char *bar, double baz) { ... } in
  41 //         your source file. See the notes below for cases when
  42 //         INTERCEPTOR_WITH_SUFFIX(...) should be used instead.
  43 //      2) Call "INTERCEPT_FUNCTION(foo)" prior to the first call of "foo".
  44 //         INTERCEPT_FUNCTION(foo) evaluates to "true" iff the function was
  45 //         intercepted successfully.
  46 // You can access original function by calling REAL(foo)(bar, baz).
  47 // By default, REAL(foo) will be visible only inside your interceptor, and if
  48 // you want to use it in other parts of RTL, you'll need to:
  49 //      3a) add DECLARE_REAL(int, foo, const char*, double) to a
  50 //          header file.
  51 // However, if the call "INTERCEPT_FUNCTION(foo)" and definition for
  52 // INTERCEPTOR(..., foo, ...) are in different files, you'll instead need to:
  53 //      3b) add DECLARE_REAL_AND_INTERCEPTOR(int, foo, const char*, double)
  54 //          to a header file.
  55
  56 // Notes: 1. Things may not work properly if macro INTERCEPTOR(...) {...} or
  57 //           DECLARE_REAL(...) are located inside namespaces.
  58 //        2. On Mac you can also use: "OVERRIDE_FUNCTION(foo, zoo)" to
  59 //           effectively redirect calls from "foo" to "zoo". In this case
  60 //           you aren't required to implement
  61 //           INTERCEPTOR(int, foo, const char *bar, double baz) {...}
  62 //           but instead you'll have to add
  63 //           DECLARE_REAL(int, foo, const char *bar, double baz) in your
  64 //           source file (to define a pointer to overriden function).
  65 //        3. Some Mac functions have symbol variants discriminated by
  66 //           additional suffixes, e.g. _$UNIX2003 (see
  67 //           https://developer.apple.com/library/mac/#releasenotes/Darwin/SymbolVariantsRelNotes/index.html
  68 //           for more details). To intercept such functions you need to use the
  69 //           INTERCEPTOR_WITH_SUFFIX(...) macro.
  70
  71 // How it works on Linux
  72 // ---------------------
  73 //
  74 // To replace system functions on Linux we just need to declare functions with
  75 // the same names in our library and then obtain the real function pointers
  76 // using dlsym().
  77 //
  78 // There is one complication: a user may also intercept some of the functions we
  79 // intercept. To allow for up to 3 interceptors (including ours) of a given
  80 // function "func", the interceptor implementation is in ___interceptor_func,
  81 // which is aliased by a weak function __interceptor_func, which in turn is
  82 // aliased (via a trampoline) by weak wrapper function "func".
  83 //
  84 // Most user interceptors should define a foreign interceptor as follows:
  85 //
  86 //  - provide a non-weak function "func" that performs interception;
  87 //  - if __interceptor_func exists, call it to perform the real functionality;
  88 //  - if it does not exist, figure out the real function and call it instead.
  89 //
  90 // In rare cases, a foreign interceptor (of another dynamic analysis runtime)
  91 // may be defined as follows (on supported architectures):
  92 //
  93 //  - provide a non-weak function __interceptor_func that performs interception;
  94 //  - if ___interceptor_func exists, call it to perform the real functionality;
  95 //  - if it does not exist, figure out the real function and call it instead;
  96 //  - provide a weak function "func" that is an alias to __interceptor_func.
  97 //
  98 // With this protocol, sanitizer interceptors, foreign user interceptors, and
  99 // foreign interceptors of other dynamic analysis runtimes, or any combination
 100 // thereof, may co-exist simultaneously.
 101 //
 102 // How it works on Mac OS
 103 // ----------------------
 104 //
 105 // This is not so on Mac OS, where the two-level namespace makes our replacement
 106 // functions invisible to other libraries. This may be overcomed using the
 107 // DYLD_FORCE_FLAT_NAMESPACE, but some errors loading the shared libraries in
 108 // Chromium were noticed when doing so.
 109 //
 110 // Instead we create a dylib containing a __DATA,__interpose section that
 111 // associates library functions with their wrappers. When this dylib is
 112 // preloaded before an executable using DYLD_INSERT_LIBRARIES, it routes all the
 113 // calls to interposed functions done through stubs to the wrapper functions.
 114 //
 115 // As it's decided at compile time which functions are to be intercepted on Mac,
 116 // INTERCEPT_FUNCTION() is effectively a no-op on this system.
 117
 118 #if SANITIZER_APPLE
 119 #include <sys/cdefs.h>  // For __DARWIN_ALIAS_C().
 120
 121 // Just a pair of pointers.
 122 struct interpose_substitution {
 123   const __sanitizer::uptr replacement;
 124   const __sanitizer::uptr original;
 125 };
 126
 127 // For a function foo() create a global pair of pointers { wrap_foo, foo } in
 128 // the __DATA,__interpose section.
 129 // As a result all the calls to foo() will be routed to wrap_foo() at runtime.
 130 #define INTERPOSER(func_name) __attribute__((used))     \
 131 const interpose_substitution substitution_##func_name[] \
 132     __attribute__((section("__DATA, __interpose"))) = { \
 133     { reinterpret_cast<const uptr>(WRAP(func_name)),    \
 134       reinterpret_cast<const uptr>(func_name) }         \
 135 }
 136
 137 // For a function foo() and a wrapper function bar() create a global pair
 138 // of pointers { bar, foo } in the __DATA,__interpose section.
 139 // As a result all the calls to foo() will be routed to bar() at runtime.
 140 #define INTERPOSER_2(func_name, wrapper_name) __attribute__((used)) \
 141 const interpose_substitution substitution_##func_name[]             \
 142     __attribute__((section("__DATA, __interpose"))) = {             \
 143     { reinterpret_cast<const uptr>(wrapper_name),                   \
 144       reinterpret_cast<const uptr>(func_name) }                     \
 145 }
 146
 147 # define WRAP(x) wrap_##x
 148 # define TRAMPOLINE(x) WRAP(x)
 149 # define INTERCEPTOR_ATTRIBUTE
 150 # define DECLARE_WRAPPER(ret_type, func, ...)
 151
 152 #elif SANITIZER_WINDOWS
 153 # define WRAP(x) __asan_wrap_##x
 154 # define TRAMPOLINE(x) WRAP(x)
 155 # define INTERCEPTOR_ATTRIBUTE __declspec(dllexport)
 156 # define DECLARE_WRAPPER(ret_type, func, ...)         \
 157     extern "C" ret_type func(__VA_ARGS__);
 158 # define DECLARE_WRAPPER_WINAPI(ret_type, func, ...)  \
 159     extern "C" __declspec(dllimport) ret_type __stdcall func(__VA_ARGS__);
 160 #elif !SANITIZER_FUCHSIA  // LINUX, FREEBSD, NETBSD, SOLARIS
 161 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))
 162 # if ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT
 163 // Weak aliases of weak aliases do not work, therefore we need to set up a
 164 // trampoline function. The function "func" is a weak alias to the trampoline
 165 // (so that we may check if "func" was overridden), which calls the weak
 166 // function __interceptor_func, which in turn aliases the actual interceptor
 167 // implementation ___interceptor_func:
 168 //
 169 //    [wrapper "func": weak] --(alias)--> [TRAMPOLINE(func)]
 170 //                                                |
 171 //                     +--------(tail call)-------+
 172 //                     |
 173 //                     v
 174 //      [__interceptor_func: weak] --(alias)--> [WRAP(func)]
 175 //
 176 // We use inline assembly to define most of this, because not all compilers
 177 // support functions with the "naked" attribute with every architecture.
 178 #  define WRAP(x) ___interceptor_ ## x
 179 #  define TRAMPOLINE(x) __interceptor_trampoline_ ## x
 180 #  if SANITIZER_FREEBSD || SANITIZER_NETBSD
 181 // FreeBSD's dynamic linker (incompliantly) gives non-weak symbols higher
 182 // priority than weak ones so weak aliases won't work for indirect calls
 183 // in position-independent (-fPIC / -fPIE) mode.
 184 #   define __ASM_WEAK_WRAPPER(func) ".globl " #func "\n"
 185 #  else
 186 #   define __ASM_WEAK_WRAPPER(func) ".weak " #func "\n"
 187 #  endif  // SANITIZER_FREEBSD || SANITIZER_NETBSD
 188 #  if defined(__arm__) || defined(__aarch64__)
 189 #   define ASM_TYPE_FUNCTION_STR "%function"
 190 #  else
 191 #   define ASM_TYPE_FUNCTION_STR "@function"
 192 #  endif
 193 // Keep trampoline implementation in sync with sanitizer_common/sanitizer_asm.h
 194 #  define DECLARE_WRAPPER(ret_type, func, ...)                                 \
 195      extern "C" ret_type func(__VA_ARGS__);                                    \
 196      extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__);                        \
 197      extern "C" ret_type __interceptor_##func(__VA_ARGS__)                     \
 198        INTERCEPTOR_ATTRIBUTE __attribute__((weak)) ALIAS(WRAP(func));          \
 199      asm(                                                                      \
 200        ".text\n"                                                               \
 201        __ASM_WEAK_WRAPPER(func)                                                \
 202        ".set " #func ", " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n"           \
 203        ".globl " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n"                    \
 204        ".type  " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", "                    \
 205          ASM_TYPE_FUNCTION_STR "\n"                                            \
 206        SANITIZER_STRINGIFY(TRAMPOLINE(func)) ":\n"                             \
 207        SANITIZER_STRINGIFY(CFI_STARTPROC) "\n"                                 \
 208        C_ASM_TAIL_CALL(SANITIZER_STRINGIFY(TRAMPOLINE(func)),                  \
 209                        "__interceptor_"                                        \
 210                          SANITIZER_STRINGIFY(ASM_PREEMPTIBLE_SYM(func))) "\n"  \
 211        SANITIZER_STRINGIFY(CFI_ENDPROC) "\n"                                   \
 212        ".size  " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", "                    \
 213             ".-" SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n"                    \
 214      );
 215 # else  // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT
 216 // Some architectures cannot implement efficient interceptor trampolines with
 217 // just a plain jump due to complexities of resolving a preemptible symbol. In
 218 // those cases, revert to just this scheme:
 219 //
 220 //    [wrapper "func": weak] --(alias)--> [WRAP(func)]
 221 //
 222 #  define WRAP(x) __interceptor_ ## x
 223 #  define TRAMPOLINE(x) WRAP(x)
 224 #  if SANITIZER_FREEBSD || SANITIZER_NETBSD
 225 #   define __ATTRIBUTE_WEAK_WRAPPER
 226 #  else
 227 #   define __ATTRIBUTE_WEAK_WRAPPER __attribute__((weak))
 228 #  endif  // SANITIZER_FREEBSD || SANITIZER_NETBSD
 229 #  define DECLARE_WRAPPER(ret_type, func, ...)                                 \
 230      extern "C" ret_type func(__VA_ARGS__)                                     \
 231        INTERCEPTOR_ATTRIBUTE __ATTRIBUTE_WEAK_WRAPPER ALIAS(WRAP(func));
 232 # endif  // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT
 233 #endif
 234
 235 #if SANITIZER_FUCHSIA
 236 // There is no general interception at all on Fuchsia.
 237 // Sanitizer runtimes just define functions directly to preempt them,
 238 // and have bespoke ways to access the underlying libc functions.
 239 # include <zircon/sanitizer.h>
 240 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))
 241 # define REAL(x) __unsanitized_##x
 242 # define DECLARE_REAL(ret_type, func, ...)
 243 #elif !SANITIZER_APPLE
 244 # define PTR_TO_REAL(x) real_##x
 245 # define REAL(x) __interception::PTR_TO_REAL(x)
 246 # define FUNC_TYPE(x) x##_type
 247
 248 # define DECLARE_REAL(ret_type, func, ...)            \
 249     typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \
 250     namespace __interception {                        \
 251     extern FUNC_TYPE(func) PTR_TO_REAL(func);         \
 252     }
 253 # define ASSIGN_REAL(dst, src) REAL(dst) = REAL(src)
 254 #else  // SANITIZER_APPLE
 255 # define REAL(x) x
 256 # define DECLARE_REAL(ret_type, func, ...) \
 257     extern "C" ret_type func(__VA_ARGS__);
 258 # define ASSIGN_REAL(x, y)
 259 #endif  // SANITIZER_APPLE
 260
 261 #if !SANITIZER_FUCHSIA
 262 # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...)  \
 263     DECLARE_REAL(ret_type, func, __VA_ARGS__)               \
 264     extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__);      \
 265     extern "C" ret_type WRAP(func)(__VA_ARGS__);
 266 // Declare an interceptor and its wrapper defined in a different translation
 267 // unit (ex. asm).
 268 # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...)  \
 269     extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__);                \
 270     extern "C" ret_type WRAP(func)(__VA_ARGS__);                      \
 271     extern "C" ret_type func(__VA_ARGS__);
 272 #else
 273 # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...)
 274 # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...)
 275 #endif
 276
 277 // Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR
 278 // macros does its job. In exceptional cases you may need to call REAL(foo)
 279 // without defining INTERCEPTOR(..., foo, ...). For example, if you override
 280 // foo with an interceptor for other function.
 281 #if !SANITIZER_APPLE && !SANITIZER_FUCHSIA
 282 #  define DEFINE_REAL(ret_type, func, ...)            \
 283     typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \
 284     namespace __interception {                        \
 285     FUNC_TYPE(func) PTR_TO_REAL(func);                \
 286     }
 287 #else
 288 # define DEFINE_REAL(ret_type, func, ...)
 289 #endif
 290
 291 #if SANITIZER_FUCHSIA
 292
 293 // We need to define the __interceptor_func name just to get
 294 // sanitizer_common/scripts/gen_dynamic_list.py to export func.
 295 // But we don't need to export __interceptor_func to get that.
 296 #define INTERCEPTOR(ret_type, func, ...)                                \
 297   extern "C"[[ gnu::alias(#func), gnu::visibility("hidden") ]] ret_type \
 298       __interceptor_##func(__VA_ARGS__);                                \
 299   extern "C" INTERCEPTOR_ATTRIBUTE ret_type func(__VA_ARGS__)
 300
 301 #elif !SANITIZER_APPLE
 302
 303 #define INTERCEPTOR(ret_type, func, ...)        \
 304   DEFINE_REAL(ret_type, func, __VA_ARGS__)      \
 305   DECLARE_WRAPPER(ret_type, func, __VA_ARGS__)  \
 306   extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__)
 307
 308 // We don't need INTERCEPTOR_WITH_SUFFIX on non-Darwin for now.
 309 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \
 310   INTERCEPTOR(ret_type, func, __VA_ARGS__)
 311
 312 #else  // SANITIZER_APPLE
 313
 314 #define INTERCEPTOR_ZZZ(suffix, ret_type, func, ...)  \
 315   extern "C" ret_type func(__VA_ARGS__) suffix;       \
 316   extern "C" ret_type WRAP(func)(__VA_ARGS__);        \
 317   INTERPOSER(func);                                   \
 318   extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__)
 319
 320 #define INTERCEPTOR(ret_type, func, ...) \
 321   INTERCEPTOR_ZZZ(/*no symbol variants*/, ret_type, func, __VA_ARGS__)
 322
 323 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \
 324   INTERCEPTOR_ZZZ(__DARWIN_ALIAS_C(func), ret_type, func, __VA_ARGS__)
 325
 326 // Override |overridee| with |overrider|.
 327 #define OVERRIDE_FUNCTION(overridee, overrider) \
 328   INTERPOSER_2(overridee, WRAP(overrider))
 329 #endif
 330
 331 #if SANITIZER_WINDOWS
 332 # define INTERCEPTOR_WINAPI(ret_type, func, ...)                \
 333     typedef ret_type (__stdcall *FUNC_TYPE(func))(__VA_ARGS__); \
 334     namespace __interception {                                  \
 335       FUNC_TYPE(func) PTR_TO_REAL(func);                        \
 336     }                                                           \
 337     extern "C" INTERCEPTOR_ATTRIBUTE ret_type __stdcall WRAP(func)(__VA_ARGS__)
 338 #endif
 339
 340 // ISO C++ forbids casting between pointer-to-function and pointer-to-object,
 341 // so we use casting via an integral type __interception::uptr,
 342 // assuming that system is POSIX-compliant. Using other hacks seem
 343 // challenging, as we don't even pass function type to
 344 // INTERCEPT_FUNCTION macro, only its name.
 345 namespace __interception {
 346 #if defined(_WIN64)
 347 typedef unsigned long long uptr;
 348 #else
 349 typedef unsigned long uptr;
 350 #endif  // _WIN64
 351 }  // namespace __interception
 352
 353 #define INCLUDED_FROM_INTERCEPTION_LIB
 354
 355 #if SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_NETBSD || \
 356     SANITIZER_SOLARIS
 357
 358 # include "interception_linux.h"
 359 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_LINUX_OR_FREEBSD(func)
 360 # define INTERCEPT_FUNCTION_VER(func, symver) \
 361     INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver)
 362 #elif SANITIZER_APPLE
 363 # include "interception_mac.h"
 364 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_MAC(func)
 365 # define INTERCEPT_FUNCTION_VER(func, symver) \
 366     INTERCEPT_FUNCTION_VER_MAC(func, symver)
 367 #elif SANITIZER_WINDOWS
 368 # include "interception_win.h"
 369 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_WIN(func)
 370 # define INTERCEPT_FUNCTION_VER(func, symver) \
 371     INTERCEPT_FUNCTION_VER_WIN(func, symver)
 372 #endif
 373
 374 #undef INCLUDED_FROM_INTERCEPTION_LIB
 375
 376 #endif  // INTERCEPTION_H