libsanitizer/asan/asan_fuchsia.cpp

   1 //===-- asan_fuchsia.cpp -------------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===---------------------------------------------------------------------===//
   8 //
   9 // This file is a part of AddressSanitizer, an address sanity checker.
  10 //
  11 // Fuchsia-specific details.
  12 //===---------------------------------------------------------------------===//
  13
  14 #include "sanitizer_common/sanitizer_fuchsia.h"
  15 #if SANITIZER_FUCHSIA
  16
  17 #include <limits.h>
  18 #include <zircon/sanitizer.h>
  19 #include <zircon/syscalls.h>
  20 #include <zircon/threads.h>
  21
  22 #  include "asan_interceptors.h"
  23 #  include "asan_internal.h"
  24 #  include "asan_stack.h"
  25 #  include "asan_thread.h"
  26 #  include "lsan/lsan_common.h"
  27
  28 namespace __asan {
  29
  30 // The system already set up the shadow memory for us.
  31 // __sanitizer::GetMaxUserVirtualAddress has already been called by
  32 // AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp).
  33 // Just do some additional sanity checks here.
  34 void InitializeShadowMemory() {
  35   if (Verbosity())
  36     PrintAddressSpaceLayout();
  37
  38   // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.
  39   __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
  40   DCHECK(kLowShadowBeg != kDefaultShadowSentinel);
  41   __asan_shadow_memory_dynamic_address = kLowShadowBeg;
  42
  43   CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
  44   CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);
  45   CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);
  46   CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base);
  47   CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1);
  48   CHECK_EQ(kLowShadowEnd, 0);
  49   CHECK_EQ(kLowShadowBeg, 0);
  50 }
  51
  52 void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
  53   UNIMPLEMENTED();
  54 }
  55
  56 void AsanCheckDynamicRTPrereqs() {}
  57 void AsanCheckIncompatibleRT() {}
  58 void InitializeAsanInterceptors() {}
  59
  60 void *AsanDoesNotSupportStaticLinkage() { return nullptr; }
  61
  62 void InitializePlatformExceptionHandlers() {}
  63 void AsanOnDeadlySignal(int signo, void *siginfo, void *context) {
  64   UNIMPLEMENTED();
  65 }
  66
  67 bool PlatformUnpoisonStacks() {
  68   // The current sp might not point to the default stack. This
  69   // could be because we are in a crash stack from fuzzing for example.
  70   // Unpoison the default stack and the current stack page.
  71   AsanThread *curr_thread = GetCurrentThread();
  72   CHECK(curr_thread != nullptr);
  73   uptr top = curr_thread->stack_top();
  74   uptr bottom = curr_thread->stack_bottom();
  75   // The default stack grows from top to bottom. (bottom < top).
  76
  77   uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0));
  78   if (local_stack >= bottom && local_stack <= top) {
  79     // The current stack is the default stack.
  80     // We only need to unpoison from where we are using until the end.
  81     bottom = RoundDownTo(local_stack, GetPageSize());
  82     UnpoisonStack(bottom, top, "default");
  83   } else {
  84     // The current stack is not the default stack.
  85     // Unpoison the entire default stack and the current stack page.
  86     UnpoisonStack(bottom, top, "default");
  87     bottom = RoundDownTo(local_stack, GetPageSize());
  88     top = bottom + GetPageSize();
  89     UnpoisonStack(bottom, top, "unknown");
  90     return true;
  91   }
  92
  93   return false;
  94 }
  95
  96 // We can use a plain thread_local variable for TSD.
  97 static thread_local void *per_thread;
  98
  99 void *AsanTSDGet() { return per_thread; }
 100
 101 void AsanTSDSet(void *tsd) { per_thread = tsd; }
 102
 103 // There's no initialization needed, and the passed-in destructor
 104 // will never be called.  Instead, our own thread destruction hook
 105 // (below) will call AsanThread::TSDDtor directly.
 106 void AsanTSDInit(void (*destructor)(void *tsd)) {
 107   DCHECK(destructor == &PlatformTSDDtor);
 108 }
 109
 110 void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); }
 111
 112 static inline size_t AsanThreadMmapSize() {
 113   return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size());
 114 }
 115
 116 struct AsanThread::InitOptions {
 117   uptr stack_bottom, stack_size;
 118 };
 119
 120 // Shared setup between thread creation and startup for the initial thread.
 121 static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid,
 122                                     bool detached, const char *name) {
 123   // In lieu of AsanThread::Create.
 124   AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__);
 125
 126   AsanThreadContext::CreateThreadContextArgs args = {thread, stack};
 127   u32 tid = asanThreadRegistry().CreateThread(0, detached, parent_tid, &args);
 128   asanThreadRegistry().SetThreadName(tid, name);
 129
 130   return thread;
 131 }
 132
 133 // This gets the same arguments passed to Init by CreateAsanThread, above.
 134 // We're in the creator thread before the new thread is actually started,
 135 // but its stack address range is already known.  We don't bother tracking
 136 // the static TLS address range because the system itself already uses an
 137 // ASan-aware allocator for that.
 138 void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) {
 139   DCHECK_NE(GetCurrentThread(), this);
 140   DCHECK_NE(GetCurrentThread(), nullptr);
 141   CHECK_NE(options->stack_bottom, 0);
 142   CHECK_NE(options->stack_size, 0);
 143   stack_bottom_ = options->stack_bottom;
 144   stack_top_ = options->stack_bottom + options->stack_size;
 145 }
 146
 147 // Called by __asan::AsanInitInternal (asan_rtl.c).
 148 AsanThread *CreateMainThread() {
 149   thrd_t self = thrd_current();
 150   char name[ZX_MAX_NAME_LEN];
 151   CHECK_NE(__sanitizer::MainThreadStackBase, 0);
 152   CHECK_GT(__sanitizer::MainThreadStackSize, 0);
 153   AsanThread *t = CreateAsanThread(
 154       nullptr, 0, true,
 155       _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name,
 156                               sizeof(name)) == ZX_OK
 157           ? name
 158           : nullptr);
 159   // We need to set the current thread before calling AsanThread::Init() below,
 160   // since it reads the thread ID.
 161   SetCurrentThread(t);
 162   DCHECK_EQ(t->tid(), 0);
 163
 164   const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase,
 165                                            __sanitizer::MainThreadStackSize};
 166   t->Init(&options);
 167
 168   return t;
 169 }
 170
 171 // This is called before each thread creation is attempted.  So, in
 172 // its first call, the calling thread is the initial and sole thread.
 173 static void *BeforeThreadCreateHook(uptr user_id, bool detached,
 174                                     const char *name, uptr stack_bottom,
 175                                     uptr stack_size) {
 176   EnsureMainThreadIDIsCorrect();
 177   // Strict init-order checking is thread-hostile.
 178   if (flags()->strict_init_order)
 179     StopInitOrderChecking();
 180
 181   GET_STACK_TRACE_THREAD;
 182   u32 parent_tid = GetCurrentTidOrInvalid();
 183
 184   AsanThread *thread = CreateAsanThread(&stack, parent_tid, detached, name);
 185
 186   // On other systems, AsanThread::Init() is called from the new
 187   // thread itself.  But on Fuchsia we already know the stack address
 188   // range beforehand, so we can do most of the setup right now.
 189   const AsanThread::InitOptions options = {stack_bottom, stack_size};
 190   thread->Init(&options);
 191   return thread;
 192 }
 193
 194 // This is called after creating a new thread (in the creating thread),
 195 // with the pointer returned by BeforeThreadCreateHook (above).
 196 static void ThreadCreateHook(void *hook, bool aborted) {
 197   AsanThread *thread = static_cast<AsanThread *>(hook);
 198   if (!aborted) {
 199     // The thread was created successfully.
 200     // ThreadStartHook is already running in the new thread.
 201   } else {
 202     // The thread wasn't created after all.
 203     // Clean up everything we set up in BeforeThreadCreateHook.
 204     asanThreadRegistry().FinishThread(thread->tid());
 205     UnmapOrDie(thread, AsanThreadMmapSize());
 206   }
 207 }
 208
 209 // This is called in the newly-created thread before it runs anything else,
 210 // with the pointer returned by BeforeThreadCreateHook (above).
 211 // cf. asan_interceptors.cpp:asan_thread_start
 212 static void ThreadStartHook(void *hook, uptr os_id) {
 213   AsanThread *thread = static_cast<AsanThread *>(hook);
 214   SetCurrentThread(thread);
 215
 216   // In lieu of AsanThread::ThreadStart.
 217   asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular,
 218                                    nullptr);
 219 }
 220
 221 // Each thread runs this just before it exits,
 222 // with the pointer returned by BeforeThreadCreateHook (above).
 223 // All per-thread destructors have already been called.
 224 static void ThreadExitHook(void *hook, uptr os_id) {
 225   AsanThread::TSDDtor(per_thread);
 226 }
 227
 228 bool HandleDlopenInit() {
 229   // Not supported on this platform.
 230   static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
 231                 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
 232   return false;
 233 }
 234
 235 void FlushUnneededASanShadowMemory(uptr p, uptr size) {
 236   __sanitizer_fill_shadow(p, size, 0, 0);
 237 }
 238
 239 // On Fuchsia, leak detection is done by a special hook after atexit hooks.
 240 // So this doesn't install any atexit hook like on other platforms.
 241 void InstallAtExitCheckLeaks() {}
 242
 243 }  // namespace __asan
 244
 245 namespace __lsan {
 246
 247 bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; }
 248
 249 }  // namespace __lsan
 250
 251 // These are declared (in extern "C") by <zircon/sanitizer.h>.
 252 // The system runtime will call our definitions directly.
 253
 254 void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
 255                                             const char *name, void *stack_base,
 256                                             size_t stack_size) {
 257   return __asan::BeforeThreadCreateHook(
 258       reinterpret_cast<uptr>(thread), detached, name,
 259       reinterpret_cast<uptr>(stack_base), stack_size);
 260 }
 261
 262 void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) {
 263   __asan::ThreadCreateHook(hook, error != thrd_success);
 264 }
 265
 266 void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
 267   __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self));
 268 }
 269
 270 void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {
 271   __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self));
 272 }
 273
 274 #endif  // SANITIZER_FUCHSIA