libsanitizer/asan/asan_thread.cpp

   1 //===-- asan_thread.cpp ---------------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This file is a part of AddressSanitizer, an address sanity checker.
  10 //
  11 // Thread-related code.
  12 //===----------------------------------------------------------------------===//
  13 #include "asan_allocator.h"
  14 #include "asan_interceptors.h"
  15 #include "asan_poisoning.h"
  16 #include "asan_stack.h"
  17 #include "asan_thread.h"
  18 #include "asan_mapping.h"
  19 #include "sanitizer_common/sanitizer_common.h"
  20 #include "sanitizer_common/sanitizer_placement_new.h"
  21 #include "sanitizer_common/sanitizer_stackdepot.h"
  22 #include "sanitizer_common/sanitizer_tls_get_addr.h"
  23 #include "lsan/lsan_common.h"
  24
  25 namespace __asan {
  26
  27 // AsanThreadContext implementation.
  28
  29 void AsanThreadContext::OnCreated(void *arg) {
  30   CreateThreadContextArgs *args = static_cast<CreateThreadContextArgs*>(arg);
  31   if (args->stack)
  32     stack_id = StackDepotPut(*args->stack);
  33   thread = args->thread;
  34   thread->set_context(this);
  35 }
  36
  37 void AsanThreadContext::OnFinished() {
  38   // Drop the link to the AsanThread object.
  39   thread = nullptr;
  40 }
  41
  42 // MIPS requires aligned address
  43 static ALIGNED(16) char thread_registry_placeholder[sizeof(ThreadRegistry)];
  44 static ThreadRegistry *asan_thread_registry;
  45
  46 static BlockingMutex mu_for_thread_context(LINKER_INITIALIZED);
  47 static LowLevelAllocator allocator_for_thread_context;
  48
  49 static ThreadContextBase *GetAsanThreadContext(u32 tid) {
  50   BlockingMutexLock lock(&mu_for_thread_context);
  51   return new(allocator_for_thread_context) AsanThreadContext(tid);
  52 }
  53
  54 ThreadRegistry &asanThreadRegistry() {
  55   static bool initialized;
  56   // Don't worry about thread_safety - this should be called when there is
  57   // a single thread.
  58   if (!initialized) {
  59     // Never reuse ASan threads: we store pointer to AsanThreadContext
  60     // in TSD and can't reliably tell when no more TSD destructors will
  61     // be called. It would be wrong to reuse AsanThreadContext for another
  62     // thread before all TSD destructors will be called for it.
  63     asan_thread_registry = new(thread_registry_placeholder) ThreadRegistry(
  64         GetAsanThreadContext, kMaxNumberOfThreads, kMaxNumberOfThreads);
  65     initialized = true;
  66   }
  67   return *asan_thread_registry;
  68 }
  69
  70 AsanThreadContext *GetThreadContextByTidLocked(u32 tid) {
  71   return static_cast<AsanThreadContext *>(
  72       asanThreadRegistry().GetThreadLocked(tid));
  73 }
  74
  75 // AsanThread implementation.
  76
  77 AsanThread *AsanThread::Create(thread_callback_t start_routine, void *arg,
  78                                u32 parent_tid, StackTrace *stack,
  79                                bool detached) {
  80   uptr PageSize = GetPageSizeCached();
  81   uptr size = RoundUpTo(sizeof(AsanThread), PageSize);
  82   AsanThread *thread = (AsanThread*)MmapOrDie(size, __func__);
  83   thread->start_routine_ = start_routine;
  84   thread->arg_ = arg;
  85   AsanThreadContext::CreateThreadContextArgs args = {thread, stack};
  86   asanThreadRegistry().CreateThread(*reinterpret_cast<uptr *>(thread), detached,
  87                                     parent_tid, &args);
  88
  89   return thread;
  90 }
  91
  92 void AsanThread::TSDDtor(void *tsd) {
  93   AsanThreadContext *context = (AsanThreadContext*)tsd;
  94   VReport(1, "T%d TSDDtor\n", context->tid);
  95   if (context->thread)
  96     context->thread->Destroy();
  97 }
  98
  99 void AsanThread::Destroy() {
 100   int tid = this->tid();
 101   VReport(1, "T%d exited\n", tid);
 102
 103   malloc_storage().CommitBack();
 104   if (common_flags()->use_sigaltstack) UnsetAlternateSignalStack();
 105   asanThreadRegistry().FinishThread(tid);
 106   FlushToDeadThreadStats(&stats_);
 107   // We also clear the shadow on thread destruction because
 108   // some code may still be executing in later TSD destructors
 109   // and we don't want it to have any poisoned stack.
 110   ClearShadowForThreadStackAndTLS();
 111   DeleteFakeStack(tid);
 112   uptr size = RoundUpTo(sizeof(AsanThread), GetPageSizeCached());
 113   UnmapOrDie(this, size);
 114   DTLS_Destroy();
 115 }
 116
 117 void AsanThread::StartSwitchFiber(FakeStack **fake_stack_save, uptr bottom,
 118                                   uptr size) {
 119   if (atomic_load(&stack_switching_, memory_order_relaxed)) {
 120     Report("ERROR: starting fiber switch while in fiber switch\n");
 121     Die();
 122   }
 123
 124   next_stack_bottom_ = bottom;
 125   next_stack_top_ = bottom + size;
 126   atomic_store(&stack_switching_, 1, memory_order_release);
 127
 128   FakeStack *current_fake_stack = fake_stack_;
 129   if (fake_stack_save)
 130     *fake_stack_save = fake_stack_;
 131   fake_stack_ = nullptr;
 132   SetTLSFakeStack(nullptr);
 133   // if fake_stack_save is null, the fiber will die, delete the fakestack
 134   if (!fake_stack_save && current_fake_stack)
 135     current_fake_stack->Destroy(this->tid());
 136 }
 137
 138 void AsanThread::FinishSwitchFiber(FakeStack *fake_stack_save,
 139                                    uptr *bottom_old,
 140                                    uptr *size_old) {
 141   if (!atomic_load(&stack_switching_, memory_order_relaxed)) {
 142     Report("ERROR: finishing a fiber switch that has not started\n");
 143     Die();
 144   }
 145
 146   if (fake_stack_save) {
 147     SetTLSFakeStack(fake_stack_save);
 148     fake_stack_ = fake_stack_save;
 149   }
 150
 151   if (bottom_old)
 152     *bottom_old = stack_bottom_;
 153   if (size_old)
 154     *size_old = stack_top_ - stack_bottom_;
 155   stack_bottom_ = next_stack_bottom_;
 156   stack_top_ = next_stack_top_;
 157   atomic_store(&stack_switching_, 0, memory_order_release);
 158   next_stack_top_ = 0;
 159   next_stack_bottom_ = 0;
 160 }
 161
 162 inline AsanThread::StackBounds AsanThread::GetStackBounds() const {
 163   if (!atomic_load(&stack_switching_, memory_order_acquire)) {
 164     // Make sure the stack bounds are fully initialized.
 165     if (stack_bottom_ >= stack_top_) return {0, 0};
 166     return {stack_bottom_, stack_top_};
 167   }
 168   char local;
 169   const uptr cur_stack = (uptr)&local;
 170   // Note: need to check next stack first, because FinishSwitchFiber
 171   // may be in process of overwriting stack_top_/bottom_. But in such case
 172   // we are already on the next stack.
 173   if (cur_stack >= next_stack_bottom_ && cur_stack < next_stack_top_)
 174     return {next_stack_bottom_, next_stack_top_};
 175   return {stack_bottom_, stack_top_};
 176 }
 177
 178 uptr AsanThread::stack_top() {
 179   return GetStackBounds().top;
 180 }
 181
 182 uptr AsanThread::stack_bottom() {
 183   return GetStackBounds().bottom;
 184 }
 185
 186 uptr AsanThread::stack_size() {
 187   const auto bounds = GetStackBounds();
 188   return bounds.top - bounds.bottom;
 189 }
 190
 191 // We want to create the FakeStack lazyly on the first use, but not eralier
 192 // than the stack size is known and the procedure has to be async-signal safe.
 193 FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() {
 194   uptr stack_size = this->stack_size();
 195   if (stack_size == 0)  // stack_size is not yet available, don't use FakeStack.
 196     return nullptr;
 197   uptr old_val = 0;
 198   // fake_stack_ has 3 states:
 199   // 0   -- not initialized
 200   // 1   -- being initialized
 201   // ptr -- initialized
 202   // This CAS checks if the state was 0 and if so changes it to state 1,
 203   // if that was successful, it initializes the pointer.
 204   if (atomic_compare_exchange_strong(
 205       reinterpret_cast<atomic_uintptr_t *>(&fake_stack_), &old_val, 1UL,
 206       memory_order_relaxed)) {
 207     uptr stack_size_log = Log2(RoundUpToPowerOfTwo(stack_size));
 208     CHECK_LE(flags()->min_uar_stack_size_log, flags()->max_uar_stack_size_log);
 209     stack_size_log =
 210         Min(stack_size_log, static_cast<uptr>(flags()->max_uar_stack_size_log));
 211     stack_size_log =
 212         Max(stack_size_log, static_cast<uptr>(flags()->min_uar_stack_size_log));
 213     fake_stack_ = FakeStack::Create(stack_size_log);
 214     SetTLSFakeStack(fake_stack_);
 215     return fake_stack_;
 216   }
 217   return nullptr;
 218 }
 219
 220 void AsanThread::Init(const InitOptions *options) {
 221   next_stack_top_ = next_stack_bottom_ = 0;
 222   atomic_store(&stack_switching_, false, memory_order_release);
 223   CHECK_EQ(this->stack_size(), 0U);
 224   SetThreadStackAndTls(options);
 225   if (stack_top_ != stack_bottom_) {
 226     CHECK_GT(this->stack_size(), 0U);
 227     CHECK(AddrIsInMem(stack_bottom_));
 228     CHECK(AddrIsInMem(stack_top_ - 1));
 229   }
 230   ClearShadowForThreadStackAndTLS();
 231   fake_stack_ = nullptr;
 232   if (__asan_option_detect_stack_use_after_return)
 233     AsyncSignalSafeLazyInitFakeStack();
 234   int local = 0;
 235   VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(),
 236           (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_,
 237           &local);
 238 }
 239
 240 // Fuchsia and RTEMS don't use ThreadStart.
 241 // asan_fuchsia.c/asan_rtems.c define CreateMainThread and
 242 // SetThreadStackAndTls.
 243 #if !SANITIZER_FUCHSIA && !SANITIZER_RTEMS
 244
 245 thread_return_t AsanThread::ThreadStart(
 246     tid_t os_id, atomic_uintptr_t *signal_thread_is_registered) {
 247   Init();
 248   asanThreadRegistry().StartThread(tid(), os_id, ThreadType::Regular, nullptr);
 249   if (signal_thread_is_registered)
 250     atomic_store(signal_thread_is_registered, 1, memory_order_release);
 251
 252   if (common_flags()->use_sigaltstack) SetAlternateSignalStack();
 253
 254   if (!start_routine_) {
 255     // start_routine_ == 0 if we're on the main thread or on one of the
 256     // OS X libdispatch worker threads. But nobody is supposed to call
 257     // ThreadStart() for the worker threads.
 258     CHECK_EQ(tid(), 0);
 259     return 0;
 260   }
 261
 262   thread_return_t res = start_routine_(arg_);
 263
 264   // On POSIX systems we defer this to the TSD destructor. LSan will consider
 265   // the thread's memory as non-live from the moment we call Destroy(), even
 266   // though that memory might contain pointers to heap objects which will be
 267   // cleaned up by a user-defined TSD destructor. Thus, calling Destroy() before
 268   // the TSD destructors have run might cause false positives in LSan.
 269   if (!SANITIZER_POSIX)
 270     this->Destroy();
 271
 272   return res;
 273 }
 274
 275 AsanThread *CreateMainThread() {
 276   AsanThread *main_thread = AsanThread::Create(
 277       /* start_routine */ nullptr, /* arg */ nullptr, /* parent_tid */ 0,
 278       /* stack */ nullptr, /* detached */ true);
 279   SetCurrentThread(main_thread);
 280   main_thread->ThreadStart(internal_getpid(),
 281                            /* signal_thread_is_registered */ nullptr);
 282   return main_thread;
 283 }
 284
 285 // This implementation doesn't use the argument, which is just passed down
 286 // from the caller of Init (which see, above).  It's only there to support
 287 // OS-specific implementations that need more information passed through.
 288 void AsanThread::SetThreadStackAndTls(const InitOptions *options) {
 289   DCHECK_EQ(options, nullptr);
 290   uptr tls_size = 0;
 291   uptr stack_size = 0;
 292   GetThreadStackAndTls(tid() == 0, &stack_bottom_, &stack_size, &tls_begin_,
 293                        &tls_size);
 294   stack_top_ = stack_bottom_ + stack_size;
 295   tls_end_ = tls_begin_ + tls_size;
 296   dtls_ = DTLS_Get();
 297
 298   if (stack_top_ != stack_bottom_) {
 299     int local;
 300     CHECK(AddrIsInStack((uptr)&local));
 301   }
 302 }
 303
 304 #endif  // !SANITIZER_FUCHSIA && !SANITIZER_RTEMS
 305
 306 void AsanThread::ClearShadowForThreadStackAndTLS() {
 307   if (stack_top_ != stack_bottom_)
 308     PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0);
 309   if (tls_begin_ != tls_end_) {
 310     uptr tls_begin_aligned = RoundDownTo(tls_begin_, SHADOW_GRANULARITY);
 311     uptr tls_end_aligned = RoundUpTo(tls_end_, SHADOW_GRANULARITY);
 312     FastPoisonShadowPartialRightRedzone(tls_begin_aligned,
 313                                         tls_end_ - tls_begin_aligned,
 314                                         tls_end_aligned - tls_end_, 0);
 315   }
 316 }
 317
 318 bool AsanThread::GetStackFrameAccessByAddr(uptr addr,
 319                                            StackFrameAccess *access) {
 320   if (stack_top_ == stack_bottom_)
 321     return false;
 322
 323   uptr bottom = 0;
 324   if (AddrIsInStack(addr)) {
 325     bottom = stack_bottom();
 326   } else if (has_fake_stack()) {
 327     bottom = fake_stack()->AddrIsInFakeStack(addr);
 328     CHECK(bottom);
 329     access->offset = addr - bottom;
 330     access->frame_pc = ((uptr*)bottom)[2];
 331     access->frame_descr = (const char *)((uptr*)bottom)[1];
 332     return true;
 333   }
 334   uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8);  // align addr.
 335   uptr mem_ptr = RoundDownTo(aligned_addr, SHADOW_GRANULARITY);
 336   u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
 337   u8 *shadow_bottom = (u8*)MemToShadow(bottom);
 338
 339   while (shadow_ptr >= shadow_bottom &&
 340          *shadow_ptr != kAsanStackLeftRedzoneMagic) {
 341     shadow_ptr--;
 342     mem_ptr -= SHADOW_GRANULARITY;
 343   }
 344
 345   while (shadow_ptr >= shadow_bottom &&
 346          *shadow_ptr == kAsanStackLeftRedzoneMagic) {
 347     shadow_ptr--;
 348     mem_ptr -= SHADOW_GRANULARITY;
 349   }
 350
 351   if (shadow_ptr < shadow_bottom) {
 352     return false;
 353   }
 354
 355   uptr* ptr = (uptr*)(mem_ptr + SHADOW_GRANULARITY);
 356   CHECK(ptr[0] == kCurrentStackFrameMagic);
 357   access->offset = addr - (uptr)ptr;
 358   access->frame_pc = ptr[2];
 359   access->frame_descr = (const char*)ptr[1];
 360   return true;
 361 }
 362
 363 uptr AsanThread::GetStackVariableShadowStart(uptr addr) {
 364   uptr bottom = 0;
 365   if (AddrIsInStack(addr)) {
 366     bottom = stack_bottom();
 367   } else if (has_fake_stack()) {
 368     bottom = fake_stack()->AddrIsInFakeStack(addr);
 369     CHECK(bottom);
 370   } else {
 371     return 0;
 372   }
 373
 374   uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8);  // align addr.
 375   u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
 376   u8 *shadow_bottom = (u8*)MemToShadow(bottom);
 377
 378   while (shadow_ptr >= shadow_bottom &&
 379          (*shadow_ptr != kAsanStackLeftRedzoneMagic &&
 380           *shadow_ptr != kAsanStackMidRedzoneMagic &&
 381           *shadow_ptr != kAsanStackRightRedzoneMagic))
 382     shadow_ptr--;
 383
 384   return (uptr)shadow_ptr + 1;
 385 }
 386
 387 bool AsanThread::AddrIsInStack(uptr addr) {
 388   const auto bounds = GetStackBounds();
 389   return addr >= bounds.bottom && addr < bounds.top;
 390 }
 391
 392 static bool ThreadStackContainsAddress(ThreadContextBase *tctx_base,
 393                                        void *addr) {
 394   AsanThreadContext *tctx = static_cast<AsanThreadContext*>(tctx_base);
 395   AsanThread *t = tctx->thread;
 396   if (!t) return false;
 397   if (t->AddrIsInStack((uptr)addr)) return true;
 398   if (t->has_fake_stack() && t->fake_stack()->AddrIsInFakeStack((uptr)addr))
 399     return true;
 400   return false;
 401 }
 402
 403 AsanThread *GetCurrentThread() {
 404   if (SANITIZER_RTEMS && !asan_inited)
 405     return nullptr;
 406
 407   AsanThreadContext *context =
 408       reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
 409   if (!context) {
 410     if (SANITIZER_ANDROID) {
 411       // On Android, libc constructor is called _after_ asan_init, and cleans up
 412       // TSD. Try to figure out if this is still the main thread by the stack
 413       // address. We are not entirely sure that we have correct main thread
 414       // limits, so only do this magic on Android, and only if the found thread
 415       // is the main thread.
 416       AsanThreadContext *tctx = GetThreadContextByTidLocked(0);
 417       if (tctx && ThreadStackContainsAddress(tctx, &context)) {
 418         SetCurrentThread(tctx->thread);
 419         return tctx->thread;
 420       }
 421     }
 422     return nullptr;
 423   }
 424   return context->thread;
 425 }
 426
 427 void SetCurrentThread(AsanThread *t) {
 428   CHECK(t->context());
 429   VReport(2, "SetCurrentThread: %p for thread %p\n", t->context(),
 430           (void *)GetThreadSelf());
 431   // Make sure we do not reset the current AsanThread.
 432   CHECK_EQ(0, AsanTSDGet());
 433   AsanTSDSet(t->context());
 434   CHECK_EQ(t->context(), AsanTSDGet());
 435 }
 436
 437 u32 GetCurrentTidOrInvalid() {
 438   AsanThread *t = GetCurrentThread();
 439   return t ? t->tid() : kInvalidTid;
 440 }
 441
 442 AsanThread *FindThreadByStackAddress(uptr addr) {
 443   asanThreadRegistry().CheckLocked();
 444   AsanThreadContext *tctx = static_cast<AsanThreadContext *>(
 445       asanThreadRegistry().FindThreadContextLocked(ThreadStackContainsAddress,
 446                                                    (void *)addr));
 447   return tctx ? tctx->thread : nullptr;
 448 }
 449
 450 void EnsureMainThreadIDIsCorrect() {
 451   AsanThreadContext *context =
 452       reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
 453   if (context && (context->tid == 0))
 454     context->os_id = GetTid();
 455 }
 456
 457 __asan::AsanThread *GetAsanThreadByOsIDLocked(tid_t os_id) {
 458   __asan::AsanThreadContext *context = static_cast<__asan::AsanThreadContext *>(
 459       __asan::asanThreadRegistry().FindThreadContextByOsIDLocked(os_id));
 460   if (!context) return nullptr;
 461   return context->thread;
 462 }
 463 } // namespace __asan
 464
 465 // --- Implementation of LSan-specific functions --- {{{1
 466 namespace __lsan {
 467 bool GetThreadRangesLocked(tid_t os_id, uptr *stack_begin, uptr *stack_end,
 468                            uptr *tls_begin, uptr *tls_end, uptr *cache_begin,
 469                            uptr *cache_end, DTLS **dtls) {
 470   __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
 471   if (!t) return false;
 472   *stack_begin = t->stack_bottom();
 473   *stack_end = t->stack_top();
 474   *tls_begin = t->tls_begin();
 475   *tls_end = t->tls_end();
 476   // ASan doesn't keep allocator caches in TLS, so these are unused.
 477   *cache_begin = 0;
 478   *cache_end = 0;
 479   *dtls = t->dtls();
 480   return true;
 481 }
 482
 483 void ForEachExtraStackRange(tid_t os_id, RangeIteratorCallback callback,
 484                             void *arg) {
 485   __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
 486   if (t && t->has_fake_stack())
 487     t->fake_stack()->ForEachFakeFrame(callback, arg);
 488 }
 489
 490 void LockThreadRegistry() {
 491   __asan::asanThreadRegistry().Lock();
 492 }
 493
 494 void UnlockThreadRegistry() {
 495   __asan::asanThreadRegistry().Unlock();
 496 }
 497
 498 ThreadRegistry *GetThreadRegistryLocked() {
 499   __asan::asanThreadRegistry().CheckLocked();
 500   return &__asan::asanThreadRegistry();
 501 }
 502
 503 void EnsureMainThreadIDIsCorrect() {
 504   __asan::EnsureMainThreadIDIsCorrect();
 505 }
 506 } // namespace __lsan
 507
 508 // ---------------------- Interface ---------------- {{{1
 509 using namespace __asan;
 510
 511 extern "C" {
 512 SANITIZER_INTERFACE_ATTRIBUTE
 513 void __sanitizer_start_switch_fiber(void **fakestacksave, const void *bottom,
 514                                     uptr size) {
 515   AsanThread *t = GetCurrentThread();
 516   if (!t) {
 517     VReport(1, "__asan_start_switch_fiber called from unknown thread\n");
 518     return;
 519   }
 520   t->StartSwitchFiber((FakeStack**)fakestacksave, (uptr)bottom, size);
 521 }
 522
 523 SANITIZER_INTERFACE_ATTRIBUTE
 524 void __sanitizer_finish_switch_fiber(void* fakestack,
 525                                      const void **bottom_old,
 526                                      uptr *size_old) {
 527   AsanThread *t = GetCurrentThread();
 528   if (!t) {
 529     VReport(1, "__asan_finish_switch_fiber called from unknown thread\n");
 530     return;
 531   }
 532   t->FinishSwitchFiber((FakeStack*)fakestack,
 533                        (uptr*)bottom_old,
 534                        (uptr*)size_old);
 535 }
 536 }