libsanitizer/asan/asan_rtl.cc

   1 //===-- asan_rtl.cc -------------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // Main file of the ASan run-time library.
  11 //===----------------------------------------------------------------------===//
  12 #include "asan_allocator.h"
  13 #include "asan_interceptors.h"
  14 #include "asan_internal.h"
  15 #include "asan_lock.h"
  16 #include "asan_mapping.h"
  17 #include "asan_report.h"
  18 #include "asan_stack.h"
  19 #include "asan_stats.h"
  20 #include "asan_thread.h"
  21 #include "asan_thread_registry.h"
  22 #include "sanitizer/asan_interface.h"
  23 #include "sanitizer_common/sanitizer_atomic.h"
  24 #include "sanitizer_common/sanitizer_flags.h"
  25 #include "sanitizer_common/sanitizer_libc.h"
  26 #include "sanitizer_common/sanitizer_symbolizer.h"
  27
  28 namespace __asan {
  29
  30 static void AsanDie() {
  31   static atomic_uint32_t num_calls;
  32   if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) {
  33     // Don't die twice - run a busy loop.
  34     while (1) { }
  35   }
  36   if (flags()->sleep_before_dying) {
  37     Report("Sleeping for %d second(s)\n", flags()->sleep_before_dying);
  38     SleepForSeconds(flags()->sleep_before_dying);
  39   }
  40   if (flags()->unmap_shadow_on_exit)
  41     UnmapOrDie((void*)kLowShadowBeg, kHighShadowEnd - kLowShadowBeg);
  42   if (death_callback)
  43     death_callback();
  44   if (flags()->abort_on_error)
  45     Abort();
  46   Exit(flags()->exitcode);
  47 }
  48
  49 static void AsanCheckFailed(const char *file, int line, const char *cond,
  50                             u64 v1, u64 v2) {
  51   Report("AddressSanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n",
  52              file, line, cond, (uptr)v1, (uptr)v2);
  53   // FIXME: check for infinite recursion without a thread-local counter here.
  54   PRINT_CURRENT_STACK();
  55   ShowStatsAndAbort();
  56 }
  57
  58 // -------------------------- Flags ------------------------- {{{1
  59 static const int kDeafultMallocContextSize = 30;
  60
  61 static Flags asan_flags;
  62
  63 Flags *flags() {
  64   return &asan_flags;
  65 }
  66
  67 static void ParseFlagsFromString(Flags *f, const char *str) {
  68   ParseFlag(str, &f->quarantine_size, "quarantine_size");
  69   ParseFlag(str, &f->symbolize, "symbolize");
  70   ParseFlag(str, &f->verbosity, "verbosity");
  71   ParseFlag(str, &f->redzone, "redzone");
  72   CHECK(f->redzone >= 16);
  73   CHECK(IsPowerOfTwo(f->redzone));
  74
  75   ParseFlag(str, &f->debug, "debug");
  76   ParseFlag(str, &f->report_globals, "report_globals");
  77   ParseFlag(str, &f->check_initialization_order, "initialization_order");
  78   ParseFlag(str, &f->malloc_context_size, "malloc_context_size");
  79   CHECK((uptr)f->malloc_context_size <= kStackTraceMax);
  80
  81   ParseFlag(str, &f->replace_str, "replace_str");
  82   ParseFlag(str, &f->replace_intrin, "replace_intrin");
  83   ParseFlag(str, &f->replace_cfallocator, "replace_cfallocator");
  84   ParseFlag(str, &f->mac_ignore_invalid_free, "mac_ignore_invalid_free");
  85   ParseFlag(str, &f->use_fake_stack, "use_fake_stack");
  86   ParseFlag(str, &f->max_malloc_fill_size, "max_malloc_fill_size");
  87   ParseFlag(str, &f->exitcode, "exitcode");
  88   ParseFlag(str, &f->allow_user_poisoning, "allow_user_poisoning");
  89   ParseFlag(str, &f->sleep_before_dying, "sleep_before_dying");
  90   ParseFlag(str, &f->handle_segv, "handle_segv");
  91   ParseFlag(str, &f->use_sigaltstack, "use_sigaltstack");
  92   ParseFlag(str, &f->check_malloc_usable_size, "check_malloc_usable_size");
  93   ParseFlag(str, &f->unmap_shadow_on_exit, "unmap_shadow_on_exit");
  94   ParseFlag(str, &f->abort_on_error, "abort_on_error");
  95   ParseFlag(str, &f->atexit, "atexit");
  96   ParseFlag(str, &f->disable_core, "disable_core");
  97   ParseFlag(str, &f->strip_path_prefix, "strip_path_prefix");
  98   ParseFlag(str, &f->allow_reexec, "allow_reexec");
  99   ParseFlag(str, &f->print_full_thread_history, "print_full_thread_history");
 100   ParseFlag(str, &f->log_path, "log_path");
 101 }
 102
 103 extern "C" {
 104 SANITIZER_WEAK_ATTRIBUTE
 105 SANITIZER_INTERFACE_ATTRIBUTE
 106 const char* __asan_default_options() { return ""; }
 107 }  // extern "C"
 108
 109 void InitializeFlags(Flags *f, const char *env) {
 110   internal_memset(f, 0, sizeof(*f));
 111
 112   f->quarantine_size = (ASAN_LOW_MEMORY) ? 1UL << 26 : 1UL << 28;
 113   f->symbolize = false;
 114   f->verbosity = 0;
 115   f->redzone = (ASAN_LOW_MEMORY) ? 64 : 128;
 116   f->debug = false;
 117   f->report_globals = 1;
 118   f->check_initialization_order = true;
 119   f->malloc_context_size = kDeafultMallocContextSize;
 120   f->replace_str = true;
 121   f->replace_intrin = true;
 122   f->replace_cfallocator = true;
 123   f->mac_ignore_invalid_free = false;
 124   f->use_fake_stack = true;
 125   f->max_malloc_fill_size = 0;
 126   f->exitcode = ASAN_DEFAULT_FAILURE_EXITCODE;
 127   f->allow_user_poisoning = true;
 128   f->sleep_before_dying = 0;
 129   f->handle_segv = ASAN_NEEDS_SEGV;
 130   f->use_sigaltstack = false;
 131   f->check_malloc_usable_size = true;
 132   f->unmap_shadow_on_exit = false;
 133   f->abort_on_error = false;
 134   f->atexit = false;
 135   f->disable_core = (SANITIZER_WORDSIZE == 64);
 136   f->strip_path_prefix = "";
 137   f->allow_reexec = true;
 138   f->print_full_thread_history = true;
 139   f->log_path = 0;
 140
 141   // Override from user-specified string.
 142   ParseFlagsFromString(f, __asan_default_options());
 143   if (flags()->verbosity) {
 144     Report("Using the defaults from __asan_default_options: %s\n",
 145            __asan_default_options());
 146   }
 147
 148   // Override from command line.
 149   ParseFlagsFromString(f, env);
 150 }
 151
 152 // -------------------------- Globals --------------------- {{{1
 153 int asan_inited;
 154 bool asan_init_is_running;
 155 void (*death_callback)(void);
 156
 157 // -------------------------- Misc ---------------- {{{1
 158 void ShowStatsAndAbort() {
 159   __asan_print_accumulated_stats();
 160   Die();
 161 }
 162
 163 // ---------------------- mmap -------------------- {{{1
 164 // Reserve memory range [beg, end].
 165 static void ReserveShadowMemoryRange(uptr beg, uptr end) {
 166   CHECK((beg % GetPageSizeCached()) == 0);
 167   CHECK(((end + 1) % GetPageSizeCached()) == 0);
 168   uptr size = end - beg + 1;
 169   void *res = MmapFixedNoReserve(beg, size);
 170   if (res != (void*)beg) {
 171     Report("ReserveShadowMemoryRange failed while trying to map 0x%zx bytes. "
 172            "Perhaps you're using ulimit -v\n", size);
 173     Abort();
 174   }
 175 }
 176
 177 // --------------- LowLevelAllocateCallbac ---------- {{{1
 178 static void OnLowLevelAllocate(uptr ptr, uptr size) {
 179   PoisonShadow(ptr, size, kAsanInternalHeapMagic);
 180 }
 181
 182 // -------------------------- Run-time entry ------------------- {{{1
 183 // exported functions
 184 #define ASAN_REPORT_ERROR(type, is_write, size)                     \
 185 extern "C" NOINLINE INTERFACE_ATTRIBUTE                        \
 186 void __asan_report_ ## type ## size(uptr addr);                \
 187 void __asan_report_ ## type ## size(uptr addr) {               \
 188   GET_CALLER_PC_BP_SP;                                              \
 189   __asan_report_error(pc, bp, sp, addr, is_write, size);            \
 190 }
 191
 192 ASAN_REPORT_ERROR(load, false, 1)
 193 ASAN_REPORT_ERROR(load, false, 2)
 194 ASAN_REPORT_ERROR(load, false, 4)
 195 ASAN_REPORT_ERROR(load, false, 8)
 196 ASAN_REPORT_ERROR(load, false, 16)
 197 ASAN_REPORT_ERROR(store, true, 1)
 198 ASAN_REPORT_ERROR(store, true, 2)
 199 ASAN_REPORT_ERROR(store, true, 4)
 200 ASAN_REPORT_ERROR(store, true, 8)
 201 ASAN_REPORT_ERROR(store, true, 16)
 202
 203 // Force the linker to keep the symbols for various ASan interface functions.
 204 // We want to keep those in the executable in order to let the instrumented
 205 // dynamic libraries access the symbol even if it is not used by the executable
 206 // itself. This should help if the build system is removing dead code at link
 207 // time.
 208 static NOINLINE void force_interface_symbols() {
 209   volatile int fake_condition = 0;  // prevent dead condition elimination.
 210   // __asan_report_* functions are noreturn, so we need a switch to prevent
 211   // the compiler from removing any of them.
 212   switch (fake_condition) {
 213     case 1: __asan_report_load1(0); break;
 214     case 2: __asan_report_load2(0); break;
 215     case 3: __asan_report_load4(0); break;
 216     case 4: __asan_report_load8(0); break;
 217     case 5: __asan_report_load16(0); break;
 218     case 6: __asan_report_store1(0); break;
 219     case 7: __asan_report_store2(0); break;
 220     case 8: __asan_report_store4(0); break;
 221     case 9: __asan_report_store8(0); break;
 222     case 10: __asan_report_store16(0); break;
 223     case 11: __asan_register_global(0, 0, 0); break;
 224     case 12: __asan_register_globals(0, 0); break;
 225     case 13: __asan_unregister_globals(0, 0); break;
 226     case 14: __asan_set_death_callback(0); break;
 227     case 15: __asan_set_error_report_callback(0); break;
 228     case 16: __asan_handle_no_return(); break;
 229     case 17: __asan_address_is_poisoned(0); break;
 230     case 18: __asan_get_allocated_size(0); break;
 231     case 19: __asan_get_current_allocated_bytes(); break;
 232     case 20: __asan_get_estimated_allocated_size(0); break;
 233     case 21: __asan_get_free_bytes(); break;
 234     case 22: __asan_get_heap_size(); break;
 235     case 23: __asan_get_ownership(0); break;
 236     case 24: __asan_get_unmapped_bytes(); break;
 237     case 25: __asan_poison_memory_region(0, 0); break;
 238     case 26: __asan_unpoison_memory_region(0, 0); break;
 239     case 27: __asan_set_error_exit_code(0); break;
 240     case 28: __asan_stack_free(0, 0, 0); break;
 241     case 29: __asan_stack_malloc(0, 0); break;
 242     case 30: __asan_on_error(); break;
 243     case 31: __asan_default_options(); break;
 244     case 32: __asan_before_dynamic_init(0, 0); break;
 245     case 33: __asan_after_dynamic_init(); break;
 246     case 34: __asan_malloc_hook(0, 0); break;
 247     case 35: __asan_free_hook(0); break;
 248     case 36: __asan_symbolize(0, 0, 0); break;
 249     case 37: __asan_poison_stack_memory(0, 0); break;
 250     case 38: __asan_unpoison_stack_memory(0, 0); break;
 251   }
 252 }
 253
 254 static void asan_atexit() {
 255   Printf("AddressSanitizer exit stats:\n");
 256   __asan_print_accumulated_stats();
 257 }
 258
 259 }  // namespace __asan
 260
 261 // ---------------------- Interface ---------------- {{{1
 262 using namespace __asan;  // NOLINT
 263
 264 int NOINLINE __asan_set_error_exit_code(int exit_code) {
 265   int old = flags()->exitcode;
 266   flags()->exitcode = exit_code;
 267   return old;
 268 }
 269
 270 void NOINLINE __asan_handle_no_return() {
 271   int local_stack;
 272   AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
 273   CHECK(curr_thread);
 274   uptr PageSize = GetPageSizeCached();
 275   uptr top = curr_thread->stack_top();
 276   uptr bottom = ((uptr)&local_stack - PageSize) & ~(PageSize-1);
 277   PoisonShadow(bottom, top - bottom, 0);
 278 }
 279
 280 void NOINLINE __asan_set_death_callback(void (*callback)(void)) {
 281   death_callback = callback;
 282 }
 283
 284 void __asan_init() {
 285   if (asan_inited) return;
 286   CHECK(!asan_init_is_running && "ASan init calls itself!");
 287   asan_init_is_running = true;
 288
 289   // Make sure we are not statically linked.
 290   AsanDoesNotSupportStaticLinkage();
 291
 292   // Install tool-specific callbacks in sanitizer_common.
 293   SetDieCallback(AsanDie);
 294   SetCheckFailedCallback(AsanCheckFailed);
 295   SetPrintfAndReportCallback(AppendToErrorMessageBuffer);
 296
 297   // Initialize flags. This must be done early, because most of the
 298   // initialization steps look at flags().
 299   const char *options = GetEnv("ASAN_OPTIONS");
 300   InitializeFlags(flags(), options);
 301   __sanitizer_set_report_path(flags()->log_path);
 302
 303   if (flags()->verbosity && options) {
 304     Report("Parsed ASAN_OPTIONS: %s\n", options);
 305   }
 306
 307   // Re-exec ourselves if we need to set additional env or command line args.
 308   MaybeReexec();
 309
 310   // Setup internal allocator callback.
 311   SetLowLevelAllocateCallback(OnLowLevelAllocate);
 312
 313   if (flags()->atexit) {
 314     Atexit(asan_atexit);
 315   }
 316
 317   // interceptors
 318   InitializeAsanInterceptors();
 319
 320   ReplaceSystemMalloc();
 321   ReplaceOperatorsNewAndDelete();
 322
 323   if (flags()->verbosity) {
 324     Printf("|| `[%p, %p]` || HighMem    ||\n",
 325            (void*)kHighMemBeg, (void*)kHighMemEnd);
 326     Printf("|| `[%p, %p]` || HighShadow ||\n",
 327            (void*)kHighShadowBeg, (void*)kHighShadowEnd);
 328     Printf("|| `[%p, %p]` || ShadowGap  ||\n",
 329            (void*)kShadowGapBeg, (void*)kShadowGapEnd);
 330     Printf("|| `[%p, %p]` || LowShadow  ||\n",
 331            (void*)kLowShadowBeg, (void*)kLowShadowEnd);
 332     Printf("|| `[%p, %p]` || LowMem     ||\n",
 333            (void*)kLowMemBeg, (void*)kLowMemEnd);
 334     Printf("MemToShadow(shadow): %p %p %p %p\n",
 335            (void*)MEM_TO_SHADOW(kLowShadowBeg),
 336            (void*)MEM_TO_SHADOW(kLowShadowEnd),
 337            (void*)MEM_TO_SHADOW(kHighShadowBeg),
 338            (void*)MEM_TO_SHADOW(kHighShadowEnd));
 339     Printf("red_zone=%zu\n", (uptr)flags()->redzone);
 340     Printf("malloc_context_size=%zu\n", (uptr)flags()->malloc_context_size);
 341
 342     Printf("SHADOW_SCALE: %zx\n", (uptr)SHADOW_SCALE);
 343     Printf("SHADOW_GRANULARITY: %zx\n", (uptr)SHADOW_GRANULARITY);
 344     Printf("SHADOW_OFFSET: %zx\n", (uptr)SHADOW_OFFSET);
 345     CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7);
 346   }
 347
 348   if (flags()->disable_core) {
 349     DisableCoreDumper();
 350   }
 351
 352   uptr shadow_start = kLowShadowBeg;
 353   if (kLowShadowBeg > 0) shadow_start -= GetMmapGranularity();
 354   uptr shadow_end = kHighShadowEnd;
 355   if (MemoryRangeIsAvailable(shadow_start, shadow_end)) {
 356     if (kLowShadowBeg != kLowShadowEnd) {
 357       // mmap the low shadow plus at least one page.
 358       ReserveShadowMemoryRange(kLowShadowBeg - GetMmapGranularity(),
 359                                kLowShadowEnd);
 360     }
 361     // mmap the high shadow.
 362     ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd);
 363     // protect the gap
 364     void *prot = Mprotect(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1);
 365     CHECK(prot == (void*)kShadowGapBeg);
 366   } else {
 367     Report("Shadow memory range interleaves with an existing memory mapping. "
 368            "ASan cannot proceed correctly. ABORTING.\n");
 369     DumpProcessMap();
 370     Die();
 371   }
 372
 373   InstallSignalHandlers();
 374   // Start symbolizer process if necessary.
 375   if (flags()->symbolize) {
 376     const char *external_symbolizer = GetEnv("ASAN_SYMBOLIZER_PATH");
 377     if (external_symbolizer) {
 378       InitializeExternalSymbolizer(external_symbolizer);
 379     }
 380   }
 381
 382   // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
 383   // should be set to 1 prior to initializing the threads.
 384   asan_inited = 1;
 385   asan_init_is_running = false;
 386
 387   asanThreadRegistry().Init();
 388   asanThreadRegistry().GetMain()->ThreadStart();
 389   force_interface_symbols();  // no-op.
 390
 391   if (flags()->verbosity) {
 392     Report("AddressSanitizer Init done\n");
 393   }
 394 }
 395
 396 #if defined(ASAN_USE_PREINIT_ARRAY)
 397   // On Linux, we force __asan_init to be called before anyone else
 398   // by placing it into .preinit_array section.
 399   // FIXME: do we have anything like this on Mac?
 400   __attribute__((section(".preinit_array")))
 401     typeof(__asan_init) *__asan_preinit =__asan_init;
 402 #elif defined(_WIN32) && defined(_DLL)
 403   // On Windows, when using dynamic CRT (/MD), we can put a pointer
 404   // to __asan_init into the global list of C initializers.
 405   // See crt0dat.c in the CRT sources for the details.
 406   #pragma section(".CRT$XIB", long, read)  // NOLINT
 407   __declspec(allocate(".CRT$XIB")) void (*__asan_preinit)() = __asan_init;
 408 #endif