libsanitizer/asan/asan_fake_stack.cc

   1 //===-- asan_fake_stack.cc ------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // FakeStack is used to detect use-after-return bugs.
  11 //===----------------------------------------------------------------------===//
  12
  13 #include "asan_allocator.h"
  14 #include "asan_poisoning.h"
  15 #include "asan_thread.h"
  16
  17 namespace __asan {
  18
  19 static const u64 kMagic1 = kAsanStackAfterReturnMagic;
  20 static const u64 kMagic2 = (kMagic1 << 8) | kMagic1;
  21 static const u64 kMagic4 = (kMagic2 << 16) | kMagic2;
  22 static const u64 kMagic8 = (kMagic4 << 32) | kMagic4;
  23
  24 static const u64 kAllocaRedzoneSize = 32UL;
  25 static const u64 kAllocaRedzoneMask = 31UL;
  26
  27 // For small size classes inline PoisonShadow for better performance.
  28 ALWAYS_INLINE void SetShadow(uptr ptr, uptr size, uptr class_id, u64 magic) {
  29   CHECK_EQ(SHADOW_SCALE, 3);  // This code expects SHADOW_SCALE=3.
  30   u64 *shadow = reinterpret_cast<u64*>(MemToShadow(ptr));
  31   if (class_id <= 6) {
  32     for (uptr i = 0; i < (((uptr)1) << class_id); i++) {
  33       shadow[i] = magic;
  34       // Make sure this does not become memset.
  35       SanitizerBreakOptimization(nullptr);
  36     }
  37   } else {
  38     // The size class is too big, it's cheaper to poison only size bytes.
  39     PoisonShadow(ptr, size, static_cast<u8>(magic));
  40   }
  41 }
  42
  43 FakeStack *FakeStack::Create(uptr stack_size_log) {
  44   static uptr kMinStackSizeLog = 16;
  45   static uptr kMaxStackSizeLog = FIRST_32_SECOND_64(24, 28);
  46   if (stack_size_log < kMinStackSizeLog)
  47     stack_size_log = kMinStackSizeLog;
  48   if (stack_size_log > kMaxStackSizeLog)
  49     stack_size_log = kMaxStackSizeLog;
  50   uptr size = RequiredSize(stack_size_log);
  51   FakeStack *res = reinterpret_cast<FakeStack *>(
  52       flags()->uar_noreserve ? MmapNoReserveOrDie(size, "FakeStack")
  53                              : MmapOrDie(size, "FakeStack"));
  54   res->stack_size_log_ = stack_size_log;
  55   u8 *p = reinterpret_cast<u8 *>(res);
  56   VReport(1, "T%d: FakeStack created: %p -- %p stack_size_log: %zd; "
  57           "mmapped %zdK, noreserve=%d \n",
  58           GetCurrentTidOrInvalid(), p,
  59           p + FakeStack::RequiredSize(stack_size_log), stack_size_log,
  60           size >> 10, flags()->uar_noreserve);
  61   return res;
  62 }
  63
  64 void FakeStack::Destroy(int tid) {
  65   PoisonAll(0);
  66   if (Verbosity() >= 2) {
  67     InternalScopedString str(kNumberOfSizeClasses * 50);
  68     for (uptr class_id = 0; class_id < kNumberOfSizeClasses; class_id++)
  69       str.append("%zd: %zd/%zd; ", class_id, hint_position_[class_id],
  70                  NumberOfFrames(stack_size_log(), class_id));
  71     Report("T%d: FakeStack destroyed: %s\n", tid, str.data());
  72   }
  73   uptr size = RequiredSize(stack_size_log_);
  74   FlushUnneededASanShadowMemory(reinterpret_cast<uptr>(this), size);
  75   UnmapOrDie(this, size);
  76 }
  77
  78 void FakeStack::PoisonAll(u8 magic) {
  79   PoisonShadow(reinterpret_cast<uptr>(this), RequiredSize(stack_size_log()),
  80                magic);
  81 }
  82
  83 #if !defined(_MSC_VER) || defined(__clang__)
  84 ALWAYS_INLINE USED
  85 #endif
  86 FakeFrame *FakeStack::Allocate(uptr stack_size_log, uptr class_id,
  87                                uptr real_stack) {
  88   CHECK_LT(class_id, kNumberOfSizeClasses);
  89   if (needs_gc_)
  90     GC(real_stack);
  91   uptr &hint_position = hint_position_[class_id];
  92   const int num_iter = NumberOfFrames(stack_size_log, class_id);
  93   u8 *flags = GetFlags(stack_size_log, class_id);
  94   for (int i = 0; i < num_iter; i++) {
  95     uptr pos = ModuloNumberOfFrames(stack_size_log, class_id, hint_position++);
  96     // This part is tricky. On one hand, checking and setting flags[pos]
  97     // should be atomic to ensure async-signal safety. But on the other hand,
  98     // if the signal arrives between checking and setting flags[pos], the
  99     // signal handler's fake stack will start from a different hint_position
 100     // and so will not touch this particular byte. So, it is safe to do this
 101     // with regular non-atomic load and store (at least I was not able to make
 102     // this code crash).
 103     if (flags[pos]) continue;
 104     flags[pos] = 1;
 105     FakeFrame *res = reinterpret_cast<FakeFrame *>(
 106         GetFrame(stack_size_log, class_id, pos));
 107     res->real_stack = real_stack;
 108     *SavedFlagPtr(reinterpret_cast<uptr>(res), class_id) = &flags[pos];
 109     return res;
 110   }
 111   return nullptr; // We are out of fake stack.
 112 }
 113
 114 uptr FakeStack::AddrIsInFakeStack(uptr ptr, uptr *frame_beg, uptr *frame_end) {
 115   uptr stack_size_log = this->stack_size_log();
 116   uptr beg = reinterpret_cast<uptr>(GetFrame(stack_size_log, 0, 0));
 117   uptr end = reinterpret_cast<uptr>(this) + RequiredSize(stack_size_log);
 118   if (ptr < beg || ptr >= end) return 0;
 119   uptr class_id = (ptr - beg) >> stack_size_log;
 120   uptr base = beg + (class_id << stack_size_log);
 121   CHECK_LE(base, ptr);
 122   CHECK_LT(ptr, base + (((uptr)1) << stack_size_log));
 123   uptr pos = (ptr - base) >> (kMinStackFrameSizeLog + class_id);
 124   uptr res = base + pos * BytesInSizeClass(class_id);
 125   *frame_end = res + BytesInSizeClass(class_id);
 126   *frame_beg = res + sizeof(FakeFrame);
 127   return res;
 128 }
 129
 130 void FakeStack::HandleNoReturn() {
 131   needs_gc_ = true;
 132 }
 133
 134 // When throw, longjmp or some such happens we don't call OnFree() and
 135 // as the result may leak one or more fake frames, but the good news is that
 136 // we are notified about all such events by HandleNoReturn().
 137 // If we recently had such no-return event we need to collect garbage frames.
 138 // We do it based on their 'real_stack' values -- everything that is lower
 139 // than the current real_stack is garbage.
 140 NOINLINE void FakeStack::GC(uptr real_stack) {
 141   uptr collected = 0;
 142   for (uptr class_id = 0; class_id < kNumberOfSizeClasses; class_id++) {
 143     u8 *flags = GetFlags(stack_size_log(), class_id);
 144     for (uptr i = 0, n = NumberOfFrames(stack_size_log(), class_id); i < n;
 145          i++) {
 146       if (flags[i] == 0) continue;  // not allocated.
 147       FakeFrame *ff = reinterpret_cast<FakeFrame *>(
 148           GetFrame(stack_size_log(), class_id, i));
 149       if (ff->real_stack < real_stack) {
 150         flags[i] = 0;
 151         collected++;
 152       }
 153     }
 154   }
 155   needs_gc_ = false;
 156 }
 157
 158 void FakeStack::ForEachFakeFrame(RangeIteratorCallback callback, void *arg) {
 159   for (uptr class_id = 0; class_id < kNumberOfSizeClasses; class_id++) {
 160     u8 *flags = GetFlags(stack_size_log(), class_id);
 161     for (uptr i = 0, n = NumberOfFrames(stack_size_log(), class_id); i < n;
 162          i++) {
 163       if (flags[i] == 0) continue;  // not allocated.
 164       FakeFrame *ff = reinterpret_cast<FakeFrame *>(
 165           GetFrame(stack_size_log(), class_id, i));
 166       uptr begin = reinterpret_cast<uptr>(ff);
 167       callback(begin, begin + FakeStack::BytesInSizeClass(class_id), arg);
 168     }
 169   }
 170 }
 171
 172 #if (SANITIZER_LINUX && !SANITIZER_ANDROID) || SANITIZER_FUCHSIA
 173 static THREADLOCAL FakeStack *fake_stack_tls;
 174
 175 FakeStack *GetTLSFakeStack() {
 176   return fake_stack_tls;
 177 }
 178 void SetTLSFakeStack(FakeStack *fs) {
 179   fake_stack_tls = fs;
 180 }
 181 #else
 182 FakeStack *GetTLSFakeStack() { return 0; }
 183 void SetTLSFakeStack(FakeStack *fs) { }
 184 #endif  // (SANITIZER_LINUX && !SANITIZER_ANDROID) || SANITIZER_FUCHSIA
 185
 186 static FakeStack *GetFakeStack() {
 187   AsanThread *t = GetCurrentThread();
 188   if (!t) return nullptr;
 189   return t->fake_stack();
 190 }
 191
 192 static FakeStack *GetFakeStackFast() {
 193   if (FakeStack *fs = GetTLSFakeStack())
 194     return fs;
 195   if (!__asan_option_detect_stack_use_after_return)
 196     return nullptr;
 197   return GetFakeStack();
 198 }
 199
 200 ALWAYS_INLINE uptr OnMalloc(uptr class_id, uptr size) {
 201   FakeStack *fs = GetFakeStackFast();
 202   if (!fs) return 0;
 203   uptr local_stack;
 204   uptr real_stack = reinterpret_cast<uptr>(&local_stack);
 205   FakeFrame *ff = fs->Allocate(fs->stack_size_log(), class_id, real_stack);
 206   if (!ff) return 0;  // Out of fake stack.
 207   uptr ptr = reinterpret_cast<uptr>(ff);
 208   SetShadow(ptr, size, class_id, 0);
 209   return ptr;
 210 }
 211
 212 ALWAYS_INLINE void OnFree(uptr ptr, uptr class_id, uptr size) {
 213   FakeStack::Deallocate(ptr, class_id);
 214   SetShadow(ptr, size, class_id, kMagic8);
 215 }
 216
 217 } // namespace __asan
 218
 219 // ---------------------- Interface ---------------- {{{1
 220 using namespace __asan;
 221 #define DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(class_id)                       \
 222   extern "C" SANITIZER_INTERFACE_ATTRIBUTE uptr                                \
 223       __asan_stack_malloc_##class_id(uptr size) {                              \
 224     return OnMalloc(class_id, size);                                           \
 225   }                                                                            \
 226   extern "C" SANITIZER_INTERFACE_ATTRIBUTE void __asan_stack_free_##class_id(  \
 227       uptr ptr, uptr size) {                                                   \
 228     OnFree(ptr, class_id, size);                                               \
 229   }
 230
 231 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(0)
 232 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(1)
 233 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(2)
 234 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(3)
 235 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(4)
 236 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(5)
 237 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(6)
 238 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(7)
 239 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(8)
 240 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(9)
 241 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(10)
 242 extern "C" {
 243 SANITIZER_INTERFACE_ATTRIBUTE
 244 void *__asan_get_current_fake_stack() { return GetFakeStackFast(); }
 245
 246 SANITIZER_INTERFACE_ATTRIBUTE
 247 void *__asan_addr_is_in_fake_stack(void *fake_stack, void *addr, void **beg,
 248                                    void **end) {
 249   FakeStack *fs = reinterpret_cast<FakeStack*>(fake_stack);
 250   if (!fs) return nullptr;
 251   uptr frame_beg, frame_end;
 252   FakeFrame *frame = reinterpret_cast<FakeFrame *>(fs->AddrIsInFakeStack(
 253       reinterpret_cast<uptr>(addr), &frame_beg, &frame_end));
 254   if (!frame) return nullptr;
 255   if (frame->magic != kCurrentStackFrameMagic)
 256     return nullptr;
 257   if (beg) *beg = reinterpret_cast<void*>(frame_beg);
 258   if (end) *end = reinterpret_cast<void*>(frame_end);
 259   return reinterpret_cast<void*>(frame->real_stack);
 260 }
 261
 262 SANITIZER_INTERFACE_ATTRIBUTE
 263 void __asan_alloca_poison(uptr addr, uptr size) {
 264   uptr LeftRedzoneAddr = addr - kAllocaRedzoneSize;
 265   uptr PartialRzAddr = addr + size;
 266   uptr RightRzAddr = (PartialRzAddr + kAllocaRedzoneMask) & ~kAllocaRedzoneMask;
 267   uptr PartialRzAligned = PartialRzAddr & ~(SHADOW_GRANULARITY - 1);
 268   FastPoisonShadow(LeftRedzoneAddr, kAllocaRedzoneSize, kAsanAllocaLeftMagic);
 269   FastPoisonShadowPartialRightRedzone(
 270       PartialRzAligned, PartialRzAddr % SHADOW_GRANULARITY,
 271       RightRzAddr - PartialRzAligned, kAsanAllocaRightMagic);
 272   FastPoisonShadow(RightRzAddr, kAllocaRedzoneSize, kAsanAllocaRightMagic);
 273 }
 274
 275 SANITIZER_INTERFACE_ATTRIBUTE
 276 void __asan_allocas_unpoison(uptr top, uptr bottom) {
 277   if ((!top) || (top > bottom)) return;
 278   REAL(memset)(reinterpret_cast<void*>(MemToShadow(top)), 0,
 279                (bottom - top) / SHADOW_GRANULARITY);
 280 }
 281 } // extern "C"