Record configure regenerate
[official-gcc.git] / libsanitizer / asan / asan_report.cc
blob7f7eaf515e7cfe0e4a21ed121a0b748427b55201
1 //===-- asan_report.cc ----------------------------------------------------===//
2 //
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
5 //
6 //===----------------------------------------------------------------------===//
7 //
8 // This file is a part of AddressSanitizer, an address sanity checker.
9 //
10 // This file contains error reporting code.
11 //===----------------------------------------------------------------------===//
13 #include "asan_flags.h"
14 #include "asan_internal.h"
15 #include "asan_mapping.h"
16 #include "asan_report.h"
17 #include "asan_stack.h"
18 #include "asan_thread.h"
19 #include "sanitizer_common/sanitizer_common.h"
20 #include "sanitizer_common/sanitizer_flags.h"
21 #include "sanitizer_common/sanitizer_report_decorator.h"
22 #include "sanitizer_common/sanitizer_stackdepot.h"
23 #include "sanitizer_common/sanitizer_symbolizer.h"
25 namespace __asan {
27 // -------------------- User-specified callbacks ----------------- {{{1
28 static void (*error_report_callback)(const char*);
29 static char *error_message_buffer = nullptr;
30 static uptr error_message_buffer_pos = 0;
31 static uptr error_message_buffer_size = 0;
33 struct ReportData {
34 uptr pc;
35 uptr sp;
36 uptr bp;
37 uptr addr;
38 bool is_write;
39 uptr access_size;
40 const char *description;
43 static bool report_happened = false;
44 static ReportData report_data = {};
46 void AppendToErrorMessageBuffer(const char *buffer) {
47 if (error_message_buffer) {
48 uptr length = internal_strlen(buffer);
49 CHECK_GE(error_message_buffer_size, error_message_buffer_pos);
50 uptr remaining = error_message_buffer_size - error_message_buffer_pos;
51 internal_strncpy(error_message_buffer + error_message_buffer_pos,
52 buffer, remaining);
53 error_message_buffer[error_message_buffer_size - 1] = '\0';
54 // FIXME: reallocate the buffer instead of truncating the message.
55 error_message_buffer_pos += Min(remaining, length);
59 // ---------------------- Decorator ------------------------------ {{{1
60 class Decorator: public __sanitizer::SanitizerCommonDecorator {
61 public:
62 Decorator() : SanitizerCommonDecorator() { }
63 const char *Access() { return Blue(); }
64 const char *EndAccess() { return Default(); }
65 const char *Location() { return Green(); }
66 const char *EndLocation() { return Default(); }
67 const char *Allocation() { return Magenta(); }
68 const char *EndAllocation() { return Default(); }
70 const char *ShadowByte(u8 byte) {
71 switch (byte) {
72 case kAsanHeapLeftRedzoneMagic:
73 case kAsanHeapRightRedzoneMagic:
74 case kAsanArrayCookieMagic:
75 return Red();
76 case kAsanHeapFreeMagic:
77 return Magenta();
78 case kAsanStackLeftRedzoneMagic:
79 case kAsanStackMidRedzoneMagic:
80 case kAsanStackRightRedzoneMagic:
81 case kAsanStackPartialRedzoneMagic:
82 return Red();
83 case kAsanStackAfterReturnMagic:
84 return Magenta();
85 case kAsanInitializationOrderMagic:
86 return Cyan();
87 case kAsanUserPoisonedMemoryMagic:
88 case kAsanContiguousContainerOOBMagic:
89 case kAsanAllocaLeftMagic:
90 case kAsanAllocaRightMagic:
91 return Blue();
92 case kAsanStackUseAfterScopeMagic:
93 return Magenta();
94 case kAsanGlobalRedzoneMagic:
95 return Red();
96 case kAsanInternalHeapMagic:
97 return Yellow();
98 case kAsanIntraObjectRedzone:
99 return Yellow();
100 default:
101 return Default();
104 const char *EndShadowByte() { return Default(); }
105 const char *MemoryByte() { return Magenta(); }
106 const char *EndMemoryByte() { return Default(); }
109 // ---------------------- Helper functions ----------------------- {{{1
111 static void PrintMemoryByte(InternalScopedString *str, const char *before,
112 u8 byte, bool in_shadow, const char *after = "\n") {
113 Decorator d;
114 str->append("%s%s%x%x%s%s", before,
115 in_shadow ? d.ShadowByte(byte) : d.MemoryByte(),
116 byte >> 4, byte & 15,
117 in_shadow ? d.EndShadowByte() : d.EndMemoryByte(), after);
120 static void PrintShadowByte(InternalScopedString *str, const char *before,
121 u8 byte, const char *after = "\n") {
122 PrintMemoryByte(str, before, byte, /*in_shadow*/true, after);
125 static void PrintShadowBytes(InternalScopedString *str, const char *before,
126 u8 *bytes, u8 *guilty, uptr n) {
127 Decorator d;
128 if (before) str->append("%s%p:", before, bytes);
129 for (uptr i = 0; i < n; i++) {
130 u8 *p = bytes + i;
131 const char *before =
132 p == guilty ? "[" : (p - 1 == guilty && i != 0) ? "" : " ";
133 const char *after = p == guilty ? "]" : "";
134 PrintShadowByte(str, before, *p, after);
136 str->append("\n");
139 static void PrintLegend(InternalScopedString *str) {
140 str->append(
141 "Shadow byte legend (one shadow byte represents %d "
142 "application bytes):\n",
143 (int)SHADOW_GRANULARITY);
144 PrintShadowByte(str, " Addressable: ", 0);
145 str->append(" Partially addressable: ");
146 for (u8 i = 1; i < SHADOW_GRANULARITY; i++) PrintShadowByte(str, "", i, " ");
147 str->append("\n");
148 PrintShadowByte(str, " Heap left redzone: ",
149 kAsanHeapLeftRedzoneMagic);
150 PrintShadowByte(str, " Heap right redzone: ",
151 kAsanHeapRightRedzoneMagic);
152 PrintShadowByte(str, " Freed heap region: ", kAsanHeapFreeMagic);
153 PrintShadowByte(str, " Stack left redzone: ",
154 kAsanStackLeftRedzoneMagic);
155 PrintShadowByte(str, " Stack mid redzone: ",
156 kAsanStackMidRedzoneMagic);
157 PrintShadowByte(str, " Stack right redzone: ",
158 kAsanStackRightRedzoneMagic);
159 PrintShadowByte(str, " Stack partial redzone: ",
160 kAsanStackPartialRedzoneMagic);
161 PrintShadowByte(str, " Stack after return: ",
162 kAsanStackAfterReturnMagic);
163 PrintShadowByte(str, " Stack use after scope: ",
164 kAsanStackUseAfterScopeMagic);
165 PrintShadowByte(str, " Global redzone: ", kAsanGlobalRedzoneMagic);
166 PrintShadowByte(str, " Global init order: ",
167 kAsanInitializationOrderMagic);
168 PrintShadowByte(str, " Poisoned by user: ",
169 kAsanUserPoisonedMemoryMagic);
170 PrintShadowByte(str, " Container overflow: ",
171 kAsanContiguousContainerOOBMagic);
172 PrintShadowByte(str, " Array cookie: ",
173 kAsanArrayCookieMagic);
174 PrintShadowByte(str, " Intra object redzone: ",
175 kAsanIntraObjectRedzone);
176 PrintShadowByte(str, " ASan internal: ", kAsanInternalHeapMagic);
177 PrintShadowByte(str, " Left alloca redzone: ", kAsanAllocaLeftMagic);
178 PrintShadowByte(str, " Right alloca redzone: ", kAsanAllocaRightMagic);
181 void MaybeDumpInstructionBytes(uptr pc) {
182 if (!flags()->dump_instruction_bytes || (pc < GetPageSizeCached()))
183 return;
184 InternalScopedString str(1024);
185 str.append("First 16 instruction bytes at pc: ");
186 if (IsAccessibleMemoryRange(pc, 16)) {
187 for (int i = 0; i < 16; ++i) {
188 PrintMemoryByte(&str, "", ((u8 *)pc)[i], /*in_shadow*/false, " ");
190 str.append("\n");
191 } else {
192 str.append("unaccessible\n");
194 Report("%s", str.data());
197 static void PrintShadowMemoryForAddress(uptr addr) {
198 if (!AddrIsInMem(addr)) return;
199 uptr shadow_addr = MemToShadow(addr);
200 const uptr n_bytes_per_row = 16;
201 uptr aligned_shadow = shadow_addr & ~(n_bytes_per_row - 1);
202 InternalScopedString str(4096 * 8);
203 str.append("Shadow bytes around the buggy address:\n");
204 for (int i = -5; i <= 5; i++) {
205 const char *prefix = (i == 0) ? "=>" : " ";
206 PrintShadowBytes(&str, prefix, (u8 *)(aligned_shadow + i * n_bytes_per_row),
207 (u8 *)shadow_addr, n_bytes_per_row);
209 if (flags()->print_legend) PrintLegend(&str);
210 Printf("%s", str.data());
213 static void PrintZoneForPointer(uptr ptr, uptr zone_ptr,
214 const char *zone_name) {
215 if (zone_ptr) {
216 if (zone_name) {
217 Printf("malloc_zone_from_ptr(%p) = %p, which is %s\n",
218 ptr, zone_ptr, zone_name);
219 } else {
220 Printf("malloc_zone_from_ptr(%p) = %p, which doesn't have a name\n",
221 ptr, zone_ptr);
223 } else {
224 Printf("malloc_zone_from_ptr(%p) = 0\n", ptr);
228 static void DescribeThread(AsanThread *t) {
229 if (t)
230 DescribeThread(t->context());
233 // ---------------------- Address Descriptions ------------------- {{{1
235 static bool IsASCII(unsigned char c) {
236 return /*0x00 <= c &&*/ c <= 0x7F;
239 static const char *MaybeDemangleGlobalName(const char *name) {
240 // We can spoil names of globals with C linkage, so use an heuristic
241 // approach to check if the name should be demangled.
242 bool should_demangle = false;
243 if (name[0] == '_' && name[1] == 'Z')
244 should_demangle = true;
245 else if (SANITIZER_WINDOWS && name[0] == '\01' && name[1] == '?')
246 should_demangle = true;
248 return should_demangle ? Symbolizer::GetOrInit()->Demangle(name) : name;
251 // Check if the global is a zero-terminated ASCII string. If so, print it.
252 static void PrintGlobalNameIfASCII(InternalScopedString *str,
253 const __asan_global &g) {
254 for (uptr p = g.beg; p < g.beg + g.size - 1; p++) {
255 unsigned char c = *(unsigned char*)p;
256 if (c == '\0' || !IsASCII(c)) return;
258 if (*(char*)(g.beg + g.size - 1) != '\0') return;
259 str->append(" '%s' is ascii string '%s'\n", MaybeDemangleGlobalName(g.name),
260 (char *)g.beg);
263 static const char *GlobalFilename(const __asan_global &g) {
264 const char *res = g.module_name;
265 // Prefer the filename from source location, if is available.
266 if (g.location)
267 res = g.location->filename;
268 CHECK(res);
269 return res;
272 static void PrintGlobalLocation(InternalScopedString *str,
273 const __asan_global &g) {
274 str->append("%s", GlobalFilename(g));
275 if (!g.location)
276 return;
277 if (g.location->line_no)
278 str->append(":%d", g.location->line_no);
279 if (g.location->column_no)
280 str->append(":%d", g.location->column_no);
283 static void DescribeAddressRelativeToGlobal(uptr addr, uptr size,
284 const __asan_global &g) {
285 InternalScopedString str(4096);
286 Decorator d;
287 str.append("%s", d.Location());
288 if (addr < g.beg) {
289 str.append("%p is located %zd bytes to the left", (void *)addr,
290 g.beg - addr);
291 } else if (addr + size > g.beg + g.size) {
292 if (addr < g.beg + g.size)
293 addr = g.beg + g.size;
294 str.append("%p is located %zd bytes to the right", (void *)addr,
295 addr - (g.beg + g.size));
296 } else {
297 // Can it happen?
298 str.append("%p is located %zd bytes inside", (void *)addr, addr - g.beg);
300 str.append(" of global variable '%s' defined in '",
301 MaybeDemangleGlobalName(g.name));
302 PrintGlobalLocation(&str, g);
303 str.append("' (0x%zx) of size %zu\n", g.beg, g.size);
304 str.append("%s", d.EndLocation());
305 PrintGlobalNameIfASCII(&str, g);
306 Printf("%s", str.data());
309 static bool DescribeAddressIfGlobal(uptr addr, uptr size,
310 const char *bug_type) {
311 // Assume address is close to at most four globals.
312 const int kMaxGlobalsInReport = 4;
313 __asan_global globals[kMaxGlobalsInReport];
314 u32 reg_sites[kMaxGlobalsInReport];
315 int globals_num =
316 GetGlobalsForAddress(addr, globals, reg_sites, ARRAY_SIZE(globals));
317 if (globals_num == 0)
318 return false;
319 for (int i = 0; i < globals_num; i++) {
320 DescribeAddressRelativeToGlobal(addr, size, globals[i]);
321 if (0 == internal_strcmp(bug_type, "initialization-order-fiasco") &&
322 reg_sites[i]) {
323 Printf(" registered at:\n");
324 StackDepotGet(reg_sites[i]).Print();
327 return true;
330 bool DescribeAddressIfShadow(uptr addr, AddressDescription *descr, bool print) {
331 if (AddrIsInMem(addr))
332 return false;
333 const char *area_type = nullptr;
334 if (AddrIsInShadowGap(addr)) area_type = "shadow gap";
335 else if (AddrIsInHighShadow(addr)) area_type = "high shadow";
336 else if (AddrIsInLowShadow(addr)) area_type = "low shadow";
337 if (area_type != nullptr) {
338 if (print) {
339 Printf("Address %p is located in the %s area.\n", addr, area_type);
340 } else {
341 CHECK(descr);
342 descr->region_kind = area_type;
344 return true;
346 CHECK(0 && "Address is not in memory and not in shadow?");
347 return false;
350 // Return " (thread_name) " or an empty string if the name is empty.
351 const char *ThreadNameWithParenthesis(AsanThreadContext *t, char buff[],
352 uptr buff_len) {
353 const char *name = t->name;
354 if (name[0] == '\0') return "";
355 buff[0] = 0;
356 internal_strncat(buff, " (", 3);
357 internal_strncat(buff, name, buff_len - 4);
358 internal_strncat(buff, ")", 2);
359 return buff;
362 const char *ThreadNameWithParenthesis(u32 tid, char buff[],
363 uptr buff_len) {
364 if (tid == kInvalidTid) return "";
365 asanThreadRegistry().CheckLocked();
366 AsanThreadContext *t = GetThreadContextByTidLocked(tid);
367 return ThreadNameWithParenthesis(t, buff, buff_len);
370 static void PrintAccessAndVarIntersection(const StackVarDescr &var, uptr addr,
371 uptr access_size, uptr prev_var_end,
372 uptr next_var_beg) {
373 uptr var_end = var.beg + var.size;
374 uptr addr_end = addr + access_size;
375 const char *pos_descr = nullptr;
376 // If the variable [var.beg, var_end) is the nearest variable to the
377 // current memory access, indicate it in the log.
378 if (addr >= var.beg) {
379 if (addr_end <= var_end)
380 pos_descr = "is inside"; // May happen if this is a use-after-return.
381 else if (addr < var_end)
382 pos_descr = "partially overflows";
383 else if (addr_end <= next_var_beg &&
384 next_var_beg - addr_end >= addr - var_end)
385 pos_descr = "overflows";
386 } else {
387 if (addr_end > var.beg)
388 pos_descr = "partially underflows";
389 else if (addr >= prev_var_end &&
390 addr - prev_var_end >= var.beg - addr_end)
391 pos_descr = "underflows";
393 InternalScopedString str(1024);
394 str.append(" [%zd, %zd)", var.beg, var_end);
395 // Render variable name.
396 str.append(" '");
397 for (uptr i = 0; i < var.name_len; ++i) {
398 str.append("%c", var.name_pos[i]);
400 str.append("'");
401 if (pos_descr) {
402 Decorator d;
403 // FIXME: we may want to also print the size of the access here,
404 // but in case of accesses generated by memset it may be confusing.
405 str.append("%s <== Memory access at offset %zd %s this variable%s\n",
406 d.Location(), addr, pos_descr, d.EndLocation());
407 } else {
408 str.append("\n");
410 Printf("%s", str.data());
413 bool ParseFrameDescription(const char *frame_descr,
414 InternalMmapVector<StackVarDescr> *vars) {
415 CHECK(frame_descr);
416 char *p;
417 // This string is created by the compiler and has the following form:
418 // "n alloc_1 alloc_2 ... alloc_n"
419 // where alloc_i looks like "offset size len ObjectName".
420 uptr n_objects = (uptr)internal_simple_strtoll(frame_descr, &p, 10);
421 if (n_objects == 0)
422 return false;
424 for (uptr i = 0; i < n_objects; i++) {
425 uptr beg = (uptr)internal_simple_strtoll(p, &p, 10);
426 uptr size = (uptr)internal_simple_strtoll(p, &p, 10);
427 uptr len = (uptr)internal_simple_strtoll(p, &p, 10);
428 if (beg == 0 || size == 0 || *p != ' ') {
429 return false;
431 p++;
432 StackVarDescr var = {beg, size, p, len};
433 vars->push_back(var);
434 p += len;
437 return true;
440 bool DescribeAddressIfStack(uptr addr, uptr access_size) {
441 AsanThread *t = FindThreadByStackAddress(addr);
442 if (!t) return false;
444 Decorator d;
445 char tname[128];
446 Printf("%s", d.Location());
447 Printf("Address %p is located in stack of thread T%d%s", addr, t->tid(),
448 ThreadNameWithParenthesis(t->tid(), tname, sizeof(tname)));
450 // Try to fetch precise stack frame for this access.
451 AsanThread::StackFrameAccess access;
452 if (!t->GetStackFrameAccessByAddr(addr, &access)) {
453 Printf("%s\n", d.EndLocation());
454 return true;
456 Printf(" at offset %zu in frame%s\n", access.offset, d.EndLocation());
458 // Now we print the frame where the alloca has happened.
459 // We print this frame as a stack trace with one element.
460 // The symbolizer may print more than one frame if inlining was involved.
461 // The frame numbers may be different than those in the stack trace printed
462 // previously. That's unfortunate, but I have no better solution,
463 // especially given that the alloca may be from entirely different place
464 // (e.g. use-after-scope, or different thread's stack).
465 #if defined(__powerpc64__) && defined(__BIG_ENDIAN__)
466 // On PowerPC64 ELFv1, the address of a function actually points to a
467 // three-doubleword data structure with the first field containing
468 // the address of the function's code.
469 access.frame_pc = *reinterpret_cast<uptr *>(access.frame_pc);
470 #endif
471 access.frame_pc += 16;
472 Printf("%s", d.EndLocation());
473 StackTrace alloca_stack(&access.frame_pc, 1);
474 alloca_stack.Print();
476 InternalMmapVector<StackVarDescr> vars(16);
477 if (!ParseFrameDescription(access.frame_descr, &vars)) {
478 Printf("AddressSanitizer can't parse the stack frame "
479 "descriptor: |%s|\n", access.frame_descr);
480 // 'addr' is a stack address, so return true even if we can't parse frame
481 return true;
483 uptr n_objects = vars.size();
484 // Report the number of stack objects.
485 Printf(" This frame has %zu object(s):\n", n_objects);
487 // Report all objects in this frame.
488 for (uptr i = 0; i < n_objects; i++) {
489 uptr prev_var_end = i ? vars[i - 1].beg + vars[i - 1].size : 0;
490 uptr next_var_beg = i + 1 < n_objects ? vars[i + 1].beg : ~(0UL);
491 PrintAccessAndVarIntersection(vars[i], access.offset, access_size,
492 prev_var_end, next_var_beg);
494 Printf("HINT: this may be a false positive if your program uses "
495 "some custom stack unwind mechanism or swapcontext\n");
496 if (SANITIZER_WINDOWS)
497 Printf(" (longjmp, SEH and C++ exceptions *are* supported)\n");
498 else
499 Printf(" (longjmp and C++ exceptions *are* supported)\n");
501 DescribeThread(t);
502 return true;
505 static void DescribeAccessToHeapChunk(AsanChunkView chunk, uptr addr,
506 uptr access_size) {
507 sptr offset;
508 Decorator d;
509 InternalScopedString str(4096);
510 str.append("%s", d.Location());
511 if (chunk.AddrIsAtLeft(addr, access_size, &offset)) {
512 str.append("%p is located %zd bytes to the left of", (void *)addr, offset);
513 } else if (chunk.AddrIsAtRight(addr, access_size, &offset)) {
514 if (offset < 0) {
515 addr -= offset;
516 offset = 0;
518 str.append("%p is located %zd bytes to the right of", (void *)addr, offset);
519 } else if (chunk.AddrIsInside(addr, access_size, &offset)) {
520 str.append("%p is located %zd bytes inside of", (void*)addr, offset);
521 } else {
522 str.append("%p is located somewhere around (this is AddressSanitizer bug!)",
523 (void *)addr);
525 str.append(" %zu-byte region [%p,%p)\n", chunk.UsedSize(),
526 (void *)(chunk.Beg()), (void *)(chunk.End()));
527 str.append("%s", d.EndLocation());
528 Printf("%s", str.data());
531 void DescribeHeapAddress(uptr addr, uptr access_size) {
532 AsanChunkView chunk = FindHeapChunkByAddress(addr);
533 if (!chunk.IsValid()) {
534 Printf("AddressSanitizer can not describe address in more detail "
535 "(wild memory access suspected).\n");
536 return;
538 DescribeAccessToHeapChunk(chunk, addr, access_size);
539 CHECK(chunk.AllocTid() != kInvalidTid);
540 asanThreadRegistry().CheckLocked();
541 AsanThreadContext *alloc_thread =
542 GetThreadContextByTidLocked(chunk.AllocTid());
543 StackTrace alloc_stack = chunk.GetAllocStack();
544 char tname[128];
545 Decorator d;
546 AsanThreadContext *free_thread = nullptr;
547 if (chunk.FreeTid() != kInvalidTid) {
548 free_thread = GetThreadContextByTidLocked(chunk.FreeTid());
549 Printf("%sfreed by thread T%d%s here:%s\n", d.Allocation(),
550 free_thread->tid,
551 ThreadNameWithParenthesis(free_thread, tname, sizeof(tname)),
552 d.EndAllocation());
553 StackTrace free_stack = chunk.GetFreeStack();
554 free_stack.Print();
555 Printf("%spreviously allocated by thread T%d%s here:%s\n",
556 d.Allocation(), alloc_thread->tid,
557 ThreadNameWithParenthesis(alloc_thread, tname, sizeof(tname)),
558 d.EndAllocation());
559 } else {
560 Printf("%sallocated by thread T%d%s here:%s\n", d.Allocation(),
561 alloc_thread->tid,
562 ThreadNameWithParenthesis(alloc_thread, tname, sizeof(tname)),
563 d.EndAllocation());
565 alloc_stack.Print();
566 DescribeThread(GetCurrentThread());
567 if (free_thread)
568 DescribeThread(free_thread);
569 DescribeThread(alloc_thread);
572 static void DescribeAddress(uptr addr, uptr access_size, const char *bug_type) {
573 // Check if this is shadow or shadow gap.
574 if (DescribeAddressIfShadow(addr))
575 return;
576 CHECK(AddrIsInMem(addr));
577 if (DescribeAddressIfGlobal(addr, access_size, bug_type))
578 return;
579 if (DescribeAddressIfStack(addr, access_size))
580 return;
581 // Assume it is a heap address.
582 DescribeHeapAddress(addr, access_size);
585 // ------------------- Thread description -------------------- {{{1
587 void DescribeThread(AsanThreadContext *context) {
588 CHECK(context);
589 asanThreadRegistry().CheckLocked();
590 // No need to announce the main thread.
591 if (context->tid == 0 || context->announced) {
592 return;
594 context->announced = true;
595 char tname[128];
596 InternalScopedString str(1024);
597 str.append("Thread T%d%s", context->tid,
598 ThreadNameWithParenthesis(context->tid, tname, sizeof(tname)));
599 if (context->parent_tid == kInvalidTid) {
600 str.append(" created by unknown thread\n");
601 Printf("%s", str.data());
602 return;
604 str.append(
605 " created by T%d%s here:\n", context->parent_tid,
606 ThreadNameWithParenthesis(context->parent_tid, tname, sizeof(tname)));
607 Printf("%s", str.data());
608 StackDepotGet(context->stack_id).Print();
609 // Recursively described parent thread if needed.
610 if (flags()->print_full_thread_history) {
611 AsanThreadContext *parent_context =
612 GetThreadContextByTidLocked(context->parent_tid);
613 DescribeThread(parent_context);
617 // -------------------- Different kinds of reports ----------------- {{{1
619 // Use ScopedInErrorReport to run common actions just before and
620 // immediately after printing error report.
621 class ScopedInErrorReport {
622 public:
623 explicit ScopedInErrorReport(ReportData *report = nullptr,
624 bool fatal = false) {
625 halt_on_error_ = fatal || flags()->halt_on_error;
627 if (lock_.TryLock()) {
628 StartReporting(report);
629 return;
632 // ASan found two bugs in different threads simultaneously.
634 u32 current_tid = GetCurrentTidOrInvalid();
635 if (reporting_thread_tid_ == current_tid ||
636 reporting_thread_tid_ == kInvalidTid) {
637 // This is either asynch signal or nested error during error reporting.
638 // Fail simple to avoid deadlocks in Report().
640 // Can't use Report() here because of potential deadlocks
641 // in nested signal handlers.
642 const char msg[] = "AddressSanitizer: nested bug in the same thread, "
643 "aborting.\n";
644 WriteToFile(kStderrFd, msg, sizeof(msg));
646 internal__exit(common_flags()->exitcode);
649 if (halt_on_error_) {
650 // Do not print more than one report, otherwise they will mix up.
651 // Error reporting functions shouldn't return at this situation, as
652 // they are effectively no-returns.
654 Report("AddressSanitizer: while reporting a bug found another one. "
655 "Ignoring.\n");
657 // Sleep long enough to make sure that the thread which started
658 // to print an error report will finish doing it.
659 SleepForSeconds(Max(100, flags()->sleep_before_dying + 1));
661 // If we're still not dead for some reason, use raw _exit() instead of
662 // Die() to bypass any additional checks.
663 internal__exit(common_flags()->exitcode);
664 } else {
665 // The other thread will eventually finish reporting
666 // so it's safe to wait
667 lock_.Lock();
670 StartReporting(report);
673 ~ScopedInErrorReport() {
674 // Make sure the current thread is announced.
675 DescribeThread(GetCurrentThread());
676 // We may want to grab this lock again when printing stats.
677 asanThreadRegistry().Unlock();
678 // Print memory stats.
679 if (flags()->print_stats)
680 __asan_print_accumulated_stats();
681 if (error_report_callback) {
682 error_report_callback(error_message_buffer);
684 CommonSanitizerReportMutex.Unlock();
685 reporting_thread_tid_ = kInvalidTid;
686 lock_.Unlock();
687 if (halt_on_error_) {
688 Report("ABORTING\n");
689 Die();
693 private:
694 void StartReporting(ReportData *report) {
695 if (report) report_data = *report;
696 report_happened = true;
697 ASAN_ON_ERROR();
698 // Make sure the registry and sanitizer report mutexes are locked while
699 // we're printing an error report.
700 // We can lock them only here to avoid self-deadlock in case of
701 // recursive reports.
702 asanThreadRegistry().Lock();
703 CommonSanitizerReportMutex.Lock();
704 reporting_thread_tid_ = GetCurrentTidOrInvalid();
705 Printf("===================================================="
706 "=============\n");
709 static StaticSpinMutex lock_;
710 static u32 reporting_thread_tid_;
711 bool halt_on_error_;
714 StaticSpinMutex ScopedInErrorReport::lock_;
715 u32 ScopedInErrorReport::reporting_thread_tid_;
717 void ReportStackOverflow(const SignalContext &sig) {
718 ScopedInErrorReport in_report;
719 Decorator d;
720 Printf("%s", d.Warning());
721 Report(
722 "ERROR: AddressSanitizer: stack-overflow on address %p"
723 " (pc %p bp %p sp %p T%d)\n",
724 (void *)sig.addr, (void *)sig.pc, (void *)sig.bp, (void *)sig.sp,
725 GetCurrentTidOrInvalid());
726 Printf("%s", d.EndWarning());
727 GET_STACK_TRACE_SIGNAL(sig);
728 stack.Print();
729 ReportErrorSummary("stack-overflow", &stack);
732 void ReportDeadlySignal(const char *description, const SignalContext &sig) {
733 ScopedInErrorReport in_report(/*report*/nullptr, /*fatal*/true);
734 Decorator d;
735 Printf("%s", d.Warning());
736 Report(
737 "ERROR: AddressSanitizer: %s on unknown address %p"
738 " (pc %p bp %p sp %p T%d)\n",
739 description, (void *)sig.addr, (void *)sig.pc, (void *)sig.bp,
740 (void *)sig.sp, GetCurrentTidOrInvalid());
741 if (sig.pc < GetPageSizeCached()) {
742 Report("Hint: pc points to the zero page.\n");
744 Printf("%s", d.EndWarning());
745 GET_STACK_TRACE_SIGNAL(sig);
746 stack.Print();
747 MaybeDumpInstructionBytes(sig.pc);
748 Printf("AddressSanitizer can not provide additional info.\n");
749 ReportErrorSummary(description, &stack);
752 void ReportDoubleFree(uptr addr, BufferedStackTrace *free_stack) {
753 ScopedInErrorReport in_report;
754 Decorator d;
755 Printf("%s", d.Warning());
756 char tname[128];
757 u32 curr_tid = GetCurrentTidOrInvalid();
758 Report("ERROR: AddressSanitizer: attempting double-free on %p in "
759 "thread T%d%s:\n",
760 addr, curr_tid,
761 ThreadNameWithParenthesis(curr_tid, tname, sizeof(tname)));
762 Printf("%s", d.EndWarning());
763 CHECK_GT(free_stack->size, 0);
764 GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
765 stack.Print();
766 DescribeHeapAddress(addr, 1);
767 ReportErrorSummary("double-free", &stack);
770 void ReportNewDeleteSizeMismatch(uptr addr, uptr delete_size,
771 BufferedStackTrace *free_stack) {
772 ScopedInErrorReport in_report;
773 Decorator d;
774 Printf("%s", d.Warning());
775 char tname[128];
776 u32 curr_tid = GetCurrentTidOrInvalid();
777 Report("ERROR: AddressSanitizer: new-delete-type-mismatch on %p in "
778 "thread T%d%s:\n",
779 addr, curr_tid,
780 ThreadNameWithParenthesis(curr_tid, tname, sizeof(tname)));
781 Printf("%s object passed to delete has wrong type:\n", d.EndWarning());
782 Printf(" size of the allocated type: %zd bytes;\n"
783 " size of the deallocated type: %zd bytes.\n",
784 asan_mz_size(reinterpret_cast<void*>(addr)), delete_size);
785 CHECK_GT(free_stack->size, 0);
786 GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
787 stack.Print();
788 DescribeHeapAddress(addr, 1);
789 ReportErrorSummary("new-delete-type-mismatch", &stack);
790 Report("HINT: if you don't care about these errors you may set "
791 "ASAN_OPTIONS=new_delete_type_mismatch=0\n");
794 void ReportFreeNotMalloced(uptr addr, BufferedStackTrace *free_stack) {
795 ScopedInErrorReport in_report;
796 Decorator d;
797 Printf("%s", d.Warning());
798 char tname[128];
799 u32 curr_tid = GetCurrentTidOrInvalid();
800 Report("ERROR: AddressSanitizer: attempting free on address "
801 "which was not malloc()-ed: %p in thread T%d%s\n", addr,
802 curr_tid, ThreadNameWithParenthesis(curr_tid, tname, sizeof(tname)));
803 Printf("%s", d.EndWarning());
804 CHECK_GT(free_stack->size, 0);
805 GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
806 stack.Print();
807 DescribeHeapAddress(addr, 1);
808 ReportErrorSummary("bad-free", &stack);
811 void ReportAllocTypeMismatch(uptr addr, BufferedStackTrace *free_stack,
812 AllocType alloc_type,
813 AllocType dealloc_type) {
814 static const char *alloc_names[] =
815 {"INVALID", "malloc", "operator new", "operator new []"};
816 static const char *dealloc_names[] =
817 {"INVALID", "free", "operator delete", "operator delete []"};
818 CHECK_NE(alloc_type, dealloc_type);
819 ScopedInErrorReport in_report;
820 Decorator d;
821 Printf("%s", d.Warning());
822 Report("ERROR: AddressSanitizer: alloc-dealloc-mismatch (%s vs %s) on %p\n",
823 alloc_names[alloc_type], dealloc_names[dealloc_type], addr);
824 Printf("%s", d.EndWarning());
825 CHECK_GT(free_stack->size, 0);
826 GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
827 stack.Print();
828 DescribeHeapAddress(addr, 1);
829 ReportErrorSummary("alloc-dealloc-mismatch", &stack);
830 Report("HINT: if you don't care about these errors you may set "
831 "ASAN_OPTIONS=alloc_dealloc_mismatch=0\n");
834 void ReportMallocUsableSizeNotOwned(uptr addr, BufferedStackTrace *stack) {
835 ScopedInErrorReport in_report;
836 Decorator d;
837 Printf("%s", d.Warning());
838 Report("ERROR: AddressSanitizer: attempting to call "
839 "malloc_usable_size() for pointer which is "
840 "not owned: %p\n", addr);
841 Printf("%s", d.EndWarning());
842 stack->Print();
843 DescribeHeapAddress(addr, 1);
844 ReportErrorSummary("bad-malloc_usable_size", stack);
847 void ReportSanitizerGetAllocatedSizeNotOwned(uptr addr,
848 BufferedStackTrace *stack) {
849 ScopedInErrorReport in_report;
850 Decorator d;
851 Printf("%s", d.Warning());
852 Report("ERROR: AddressSanitizer: attempting to call "
853 "__sanitizer_get_allocated_size() for pointer which is "
854 "not owned: %p\n", addr);
855 Printf("%s", d.EndWarning());
856 stack->Print();
857 DescribeHeapAddress(addr, 1);
858 ReportErrorSummary("bad-__sanitizer_get_allocated_size", stack);
861 void ReportStringFunctionMemoryRangesOverlap(const char *function,
862 const char *offset1, uptr length1,
863 const char *offset2, uptr length2,
864 BufferedStackTrace *stack) {
865 ScopedInErrorReport in_report;
866 Decorator d;
867 char bug_type[100];
868 internal_snprintf(bug_type, sizeof(bug_type), "%s-param-overlap", function);
869 Printf("%s", d.Warning());
870 Report("ERROR: AddressSanitizer: %s: "
871 "memory ranges [%p,%p) and [%p, %p) overlap\n", \
872 bug_type, offset1, offset1 + length1, offset2, offset2 + length2);
873 Printf("%s", d.EndWarning());
874 stack->Print();
875 DescribeAddress((uptr)offset1, length1, bug_type);
876 DescribeAddress((uptr)offset2, length2, bug_type);
877 ReportErrorSummary(bug_type, stack);
880 void ReportStringFunctionSizeOverflow(uptr offset, uptr size,
881 BufferedStackTrace *stack) {
882 ScopedInErrorReport in_report;
883 Decorator d;
884 const char *bug_type = "negative-size-param";
885 Printf("%s", d.Warning());
886 Report("ERROR: AddressSanitizer: %s: (size=%zd)\n", bug_type, size);
887 Printf("%s", d.EndWarning());
888 stack->Print();
889 DescribeAddress(offset, size, bug_type);
890 ReportErrorSummary(bug_type, stack);
893 void ReportBadParamsToAnnotateContiguousContainer(uptr beg, uptr end,
894 uptr old_mid, uptr new_mid,
895 BufferedStackTrace *stack) {
896 ScopedInErrorReport in_report;
897 Report("ERROR: AddressSanitizer: bad parameters to "
898 "__sanitizer_annotate_contiguous_container:\n"
899 " beg : %p\n"
900 " end : %p\n"
901 " old_mid : %p\n"
902 " new_mid : %p\n",
903 beg, end, old_mid, new_mid);
904 uptr granularity = SHADOW_GRANULARITY;
905 if (!IsAligned(beg, granularity))
906 Report("ERROR: beg is not aligned by %d\n", granularity);
907 stack->Print();
908 ReportErrorSummary("bad-__sanitizer_annotate_contiguous_container", stack);
911 void ReportODRViolation(const __asan_global *g1, u32 stack_id1,
912 const __asan_global *g2, u32 stack_id2) {
913 ScopedInErrorReport in_report;
914 Decorator d;
915 Printf("%s", d.Warning());
916 Report("ERROR: AddressSanitizer: odr-violation (%p):\n", g1->beg);
917 Printf("%s", d.EndWarning());
918 InternalScopedString g1_loc(256), g2_loc(256);
919 PrintGlobalLocation(&g1_loc, *g1);
920 PrintGlobalLocation(&g2_loc, *g2);
921 Printf(" [1] size=%zd '%s' %s\n", g1->size,
922 MaybeDemangleGlobalName(g1->name), g1_loc.data());
923 Printf(" [2] size=%zd '%s' %s\n", g2->size,
924 MaybeDemangleGlobalName(g2->name), g2_loc.data());
925 if (stack_id1 && stack_id2) {
926 Printf("These globals were registered at these points:\n");
927 Printf(" [1]:\n");
928 StackDepotGet(stack_id1).Print();
929 Printf(" [2]:\n");
930 StackDepotGet(stack_id2).Print();
932 Report("HINT: if you don't care about these errors you may set "
933 "ASAN_OPTIONS=detect_odr_violation=0\n");
934 InternalScopedString error_msg(256);
935 error_msg.append("odr-violation: global '%s' at %s",
936 MaybeDemangleGlobalName(g1->name), g1_loc.data());
937 ReportErrorSummary(error_msg.data());
940 // ----------------------- CheckForInvalidPointerPair ----------- {{{1
941 static NOINLINE void
942 ReportInvalidPointerPair(uptr pc, uptr bp, uptr sp, uptr a1, uptr a2) {
943 ScopedInErrorReport in_report;
944 const char *bug_type = "invalid-pointer-pair";
945 Decorator d;
946 Printf("%s", d.Warning());
947 Report("ERROR: AddressSanitizer: invalid-pointer-pair: %p %p\n", a1, a2);
948 Printf("%s", d.EndWarning());
949 GET_STACK_TRACE_FATAL(pc, bp);
950 stack.Print();
951 DescribeAddress(a1, 1, bug_type);
952 DescribeAddress(a2, 1, bug_type);
953 ReportErrorSummary(bug_type, &stack);
956 static INLINE void CheckForInvalidPointerPair(void *p1, void *p2) {
957 if (!flags()->detect_invalid_pointer_pairs) return;
958 uptr a1 = reinterpret_cast<uptr>(p1);
959 uptr a2 = reinterpret_cast<uptr>(p2);
960 AsanChunkView chunk1 = FindHeapChunkByAddress(a1);
961 AsanChunkView chunk2 = FindHeapChunkByAddress(a2);
962 bool valid1 = chunk1.IsValid();
963 bool valid2 = chunk2.IsValid();
964 if ((valid1 != valid2) || (valid1 && valid2 && !chunk1.Eq(chunk2))) {
965 GET_CALLER_PC_BP_SP; \
966 return ReportInvalidPointerPair(pc, bp, sp, a1, a2);
969 // ----------------------- Mac-specific reports ----------------- {{{1
971 void WarnMacFreeUnallocated(uptr addr, uptr zone_ptr, const char *zone_name,
972 BufferedStackTrace *stack) {
973 // Just print a warning here.
974 Printf("free_common(%p) -- attempting to free unallocated memory.\n"
975 "AddressSanitizer is ignoring this error on Mac OS now.\n",
976 addr);
977 PrintZoneForPointer(addr, zone_ptr, zone_name);
978 stack->Print();
979 DescribeHeapAddress(addr, 1);
982 void ReportMacMzReallocUnknown(uptr addr, uptr zone_ptr, const char *zone_name,
983 BufferedStackTrace *stack) {
984 ScopedInErrorReport in_report;
985 Printf("mz_realloc(%p) -- attempting to realloc unallocated memory.\n"
986 "This is an unrecoverable problem, exiting now.\n",
987 addr);
988 PrintZoneForPointer(addr, zone_ptr, zone_name);
989 stack->Print();
990 DescribeHeapAddress(addr, 1);
993 void ReportMacCfReallocUnknown(uptr addr, uptr zone_ptr, const char *zone_name,
994 BufferedStackTrace *stack) {
995 ScopedInErrorReport in_report;
996 Printf("cf_realloc(%p) -- attempting to realloc unallocated memory.\n"
997 "This is an unrecoverable problem, exiting now.\n",
998 addr);
999 PrintZoneForPointer(addr, zone_ptr, zone_name);
1000 stack->Print();
1001 DescribeHeapAddress(addr, 1);
1004 void ReportGenericError(uptr pc, uptr bp, uptr sp, uptr addr, bool is_write,
1005 uptr access_size, u32 exp, bool fatal) {
1006 ENABLE_FRAME_POINTER;
1008 // Optimization experiments.
1009 // The experiments can be used to evaluate potential optimizations that remove
1010 // instrumentation (assess false negatives). Instead of completely removing
1011 // some instrumentation, compiler can emit special calls into runtime
1012 // (e.g. __asan_report_exp_load1 instead of __asan_report_load1) and pass
1013 // mask of experiments (exp).
1014 // The reaction to a non-zero value of exp is to be defined.
1015 (void)exp;
1017 // Determine the error type.
1018 const char *bug_descr = "unknown-crash";
1019 if (AddrIsInMem(addr)) {
1020 u8 *shadow_addr = (u8*)MemToShadow(addr);
1021 // If we are accessing 16 bytes, look at the second shadow byte.
1022 if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY)
1023 shadow_addr++;
1024 // If we are in the partial right redzone, look at the next shadow byte.
1025 if (*shadow_addr > 0 && *shadow_addr < 128)
1026 shadow_addr++;
1027 switch (*shadow_addr) {
1028 case kAsanHeapLeftRedzoneMagic:
1029 case kAsanHeapRightRedzoneMagic:
1030 case kAsanArrayCookieMagic:
1031 bug_descr = "heap-buffer-overflow";
1032 break;
1033 case kAsanHeapFreeMagic:
1034 bug_descr = "heap-use-after-free";
1035 break;
1036 case kAsanStackLeftRedzoneMagic:
1037 bug_descr = "stack-buffer-underflow";
1038 break;
1039 case kAsanInitializationOrderMagic:
1040 bug_descr = "initialization-order-fiasco";
1041 break;
1042 case kAsanStackMidRedzoneMagic:
1043 case kAsanStackRightRedzoneMagic:
1044 case kAsanStackPartialRedzoneMagic:
1045 bug_descr = "stack-buffer-overflow";
1046 break;
1047 case kAsanStackAfterReturnMagic:
1048 bug_descr = "stack-use-after-return";
1049 break;
1050 case kAsanUserPoisonedMemoryMagic:
1051 bug_descr = "use-after-poison";
1052 break;
1053 case kAsanContiguousContainerOOBMagic:
1054 bug_descr = "container-overflow";
1055 break;
1056 case kAsanStackUseAfterScopeMagic:
1057 bug_descr = "stack-use-after-scope";
1058 break;
1059 case kAsanGlobalRedzoneMagic:
1060 bug_descr = "global-buffer-overflow";
1061 break;
1062 case kAsanIntraObjectRedzone:
1063 bug_descr = "intra-object-overflow";
1064 break;
1065 case kAsanAllocaLeftMagic:
1066 case kAsanAllocaRightMagic:
1067 bug_descr = "dynamic-stack-buffer-overflow";
1068 break;
1072 ReportData report = { pc, sp, bp, addr, (bool)is_write, access_size,
1073 bug_descr };
1074 ScopedInErrorReport in_report(&report, fatal);
1076 Decorator d;
1077 Printf("%s", d.Warning());
1078 Report("ERROR: AddressSanitizer: %s on address "
1079 "%p at pc %p bp %p sp %p\n",
1080 bug_descr, (void*)addr, pc, bp, sp);
1081 Printf("%s", d.EndWarning());
1083 u32 curr_tid = GetCurrentTidOrInvalid();
1084 char tname[128];
1085 Printf("%s%s of size %zu at %p thread T%d%s%s\n",
1086 d.Access(),
1087 access_size ? (is_write ? "WRITE" : "READ") : "ACCESS",
1088 access_size, (void*)addr, curr_tid,
1089 ThreadNameWithParenthesis(curr_tid, tname, sizeof(tname)),
1090 d.EndAccess());
1092 GET_STACK_TRACE_FATAL(pc, bp);
1093 stack.Print();
1095 DescribeAddress(addr, access_size, bug_descr);
1096 ReportErrorSummary(bug_descr, &stack);
1097 PrintShadowMemoryForAddress(addr);
1100 } // namespace __asan
1102 // --------------------------- Interface --------------------- {{{1
1103 using namespace __asan; // NOLINT
1105 void __asan_report_error(uptr pc, uptr bp, uptr sp, uptr addr, int is_write,
1106 uptr access_size, u32 exp) {
1107 ENABLE_FRAME_POINTER;
1108 bool fatal = flags()->halt_on_error;
1109 ReportGenericError(pc, bp, sp, addr, is_write, access_size, exp, fatal);
1112 void NOINLINE __asan_set_error_report_callback(void (*callback)(const char*)) {
1113 error_report_callback = callback;
1114 if (callback) {
1115 error_message_buffer_size = 1 << 16;
1116 error_message_buffer =
1117 (char*)MmapOrDie(error_message_buffer_size, __func__);
1118 error_message_buffer_pos = 0;
1122 void __asan_describe_address(uptr addr) {
1123 // Thread registry must be locked while we're describing an address.
1124 asanThreadRegistry().Lock();
1125 DescribeAddress(addr, 1, "");
1126 asanThreadRegistry().Unlock();
1129 int __asan_report_present() {
1130 return report_happened ? 1 : 0;
1133 uptr __asan_get_report_pc() {
1134 return report_data.pc;
1137 uptr __asan_get_report_bp() {
1138 return report_data.bp;
1141 uptr __asan_get_report_sp() {
1142 return report_data.sp;
1145 uptr __asan_get_report_address() {
1146 return report_data.addr;
1149 int __asan_get_report_access_type() {
1150 return report_data.is_write ? 1 : 0;
1153 uptr __asan_get_report_access_size() {
1154 return report_data.access_size;
1157 const char *__asan_get_report_description() {
1158 return report_data.description;
1161 extern "C" {
1162 SANITIZER_INTERFACE_ATTRIBUTE
1163 void __sanitizer_ptr_sub(void *a, void *b) {
1164 CheckForInvalidPointerPair(a, b);
1166 SANITIZER_INTERFACE_ATTRIBUTE
1167 void __sanitizer_ptr_cmp(void *a, void *b) {
1168 CheckForInvalidPointerPair(a, b);
1170 } // extern "C"
1172 #if !SANITIZER_SUPPORTS_WEAK_HOOKS
1173 // Provide default implementation of __asan_on_error that does nothing
1174 // and may be overriden by user.
1175 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE NOINLINE
1176 void __asan_on_error() {}
1177 #endif