1 //===-- ubsan_handlers.cc -------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // Error logging entry points for the UBSan runtime.
10 //===----------------------------------------------------------------------===//
12 #include "ubsan_platform.h"
14 #include "ubsan_handlers.h"
15 #include "ubsan_diag.h"
17 #include "sanitizer_common/sanitizer_common.h"
19 using namespace __sanitizer
;
20 using namespace __ubsan
;
23 bool ignoreReport(SourceLocation SLoc
, ReportOptions Opts
, ErrorType ET
) {
24 // We are not allowed to skip error report: if we are in unrecoverable
25 // handler, we have to terminate the program right now, and therefore
26 // have to print some diagnostic.
28 // Even if source location is disabled, it doesn't mean that we have
29 // already report an error to the user: some concurrently running
30 // thread could have acquired it, but not yet printed the report.
31 if (Opts
.FromUnrecoverableHandler
)
33 return SLoc
.isDisabled() || IsPCSuppressed(ET
, Opts
.pc
, SLoc
.getFilename());
36 const char *TypeCheckKinds
[] = {
37 "load of", "store to", "reference binding to", "member access within",
38 "member call on", "constructor call on", "downcast of", "downcast of",
39 "upcast of", "cast to virtual base of"};
42 static void handleTypeMismatchImpl(TypeMismatchData
*Data
, ValueHandle Pointer
,
44 Location Loc
= Data
->Loc
.acquire();
48 ET
= ErrorType::NullPointerUse
;
49 else if (Data
->Alignment
&& (Pointer
& (Data
->Alignment
- 1)))
50 ET
= ErrorType::MisalignedPointerUse
;
52 ET
= ErrorType::InsufficientObjectSize
;
54 // Use the SourceLocation from Data to track deduplication, even if it's
56 if (ignoreReport(Loc
.getSourceLocation(), Opts
, ET
))
59 SymbolizedStackHolder FallbackLoc
;
60 if (Data
->Loc
.isInvalid()) {
61 FallbackLoc
.reset(getCallerLocation(Opts
.pc
));
65 ScopedReport
R(Opts
, Loc
, ET
);
68 case ErrorType::NullPointerUse
:
69 Diag(Loc
, DL_Error
, "%0 null pointer of type %1")
70 << TypeCheckKinds
[Data
->TypeCheckKind
] << Data
->Type
;
72 case ErrorType::MisalignedPointerUse
:
73 Diag(Loc
, DL_Error
, "%0 misaligned address %1 for type %3, "
74 "which requires %2 byte alignment")
75 << TypeCheckKinds
[Data
->TypeCheckKind
] << (void *)Pointer
76 << Data
->Alignment
<< Data
->Type
;
78 case ErrorType::InsufficientObjectSize
:
79 Diag(Loc
, DL_Error
, "%0 address %1 with insufficient space "
80 "for an object of type %2")
81 << TypeCheckKinds
[Data
->TypeCheckKind
] << (void *)Pointer
<< Data
->Type
;
84 UNREACHABLE("unexpected error type!");
88 Diag(Pointer
, DL_Note
, "pointer points here");
91 void __ubsan::__ubsan_handle_type_mismatch(TypeMismatchData
*Data
,
92 ValueHandle Pointer
) {
93 GET_REPORT_OPTIONS(false);
94 handleTypeMismatchImpl(Data
, Pointer
, Opts
);
96 void __ubsan::__ubsan_handle_type_mismatch_abort(TypeMismatchData
*Data
,
97 ValueHandle Pointer
) {
98 GET_REPORT_OPTIONS(true);
99 handleTypeMismatchImpl(Data
, Pointer
, Opts
);
103 /// \brief Common diagnostic emission for various forms of integer overflow.
104 template <typename T
>
105 static void handleIntegerOverflowImpl(OverflowData
*Data
, ValueHandle LHS
,
106 const char *Operator
, T RHS
,
107 ReportOptions Opts
) {
108 SourceLocation Loc
= Data
->Loc
.acquire();
109 bool IsSigned
= Data
->Type
.isSignedIntegerTy();
110 ErrorType ET
= IsSigned
? ErrorType::SignedIntegerOverflow
111 : ErrorType::UnsignedIntegerOverflow
;
113 if (ignoreReport(Loc
, Opts
, ET
))
116 ScopedReport
R(Opts
, Loc
, ET
);
118 Diag(Loc
, DL_Error
, "%0 integer overflow: "
119 "%1 %2 %3 cannot be represented in type %4")
120 << (IsSigned
? "signed" : "unsigned")
121 << Value(Data
->Type
, LHS
) << Operator
<< RHS
<< Data
->Type
;
124 #define UBSAN_OVERFLOW_HANDLER(handler_name, op, unrecoverable) \
125 void __ubsan::handler_name(OverflowData *Data, ValueHandle LHS, \
127 GET_REPORT_OPTIONS(unrecoverable); \
128 handleIntegerOverflowImpl(Data, LHS, op, Value(Data->Type, RHS), Opts); \
133 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_add_overflow
, "+", false)
134 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_add_overflow_abort
, "+", true)
135 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_sub_overflow
, "-", false)
136 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_sub_overflow_abort
, "-", true)
137 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_mul_overflow
, "*", false)
138 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_mul_overflow_abort
, "*", true)
140 static void handleNegateOverflowImpl(OverflowData
*Data
, ValueHandle OldVal
,
141 ReportOptions Opts
) {
142 SourceLocation Loc
= Data
->Loc
.acquire();
143 bool IsSigned
= Data
->Type
.isSignedIntegerTy();
144 ErrorType ET
= IsSigned
? ErrorType::SignedIntegerOverflow
145 : ErrorType::UnsignedIntegerOverflow
;
147 if (ignoreReport(Loc
, Opts
, ET
))
150 ScopedReport
R(Opts
, Loc
, ET
);
154 "negation of %0 cannot be represented in type %1; "
155 "cast to an unsigned type to negate this value to itself")
156 << Value(Data
->Type
, OldVal
) << Data
->Type
;
158 Diag(Loc
, DL_Error
, "negation of %0 cannot be represented in type %1")
159 << Value(Data
->Type
, OldVal
) << Data
->Type
;
162 void __ubsan::__ubsan_handle_negate_overflow(OverflowData
*Data
,
163 ValueHandle OldVal
) {
164 GET_REPORT_OPTIONS(false);
165 handleNegateOverflowImpl(Data
, OldVal
, Opts
);
167 void __ubsan::__ubsan_handle_negate_overflow_abort(OverflowData
*Data
,
168 ValueHandle OldVal
) {
169 GET_REPORT_OPTIONS(true);
170 handleNegateOverflowImpl(Data
, OldVal
, Opts
);
174 static void handleDivremOverflowImpl(OverflowData
*Data
, ValueHandle LHS
,
175 ValueHandle RHS
, ReportOptions Opts
) {
176 SourceLocation Loc
= Data
->Loc
.acquire();
177 Value
LHSVal(Data
->Type
, LHS
);
178 Value
RHSVal(Data
->Type
, RHS
);
181 if (RHSVal
.isMinusOne())
182 ET
= ErrorType::SignedIntegerOverflow
;
183 else if (Data
->Type
.isIntegerTy())
184 ET
= ErrorType::IntegerDivideByZero
;
186 ET
= ErrorType::FloatDivideByZero
;
188 if (ignoreReport(Loc
, Opts
, ET
))
191 ScopedReport
R(Opts
, Loc
, ET
);
194 case ErrorType::SignedIntegerOverflow
:
195 Diag(Loc
, DL_Error
, "division of %0 by -1 cannot be represented in type %1")
196 << LHSVal
<< Data
->Type
;
199 Diag(Loc
, DL_Error
, "division by zero");
204 void __ubsan::__ubsan_handle_divrem_overflow(OverflowData
*Data
,
205 ValueHandle LHS
, ValueHandle RHS
) {
206 GET_REPORT_OPTIONS(false);
207 handleDivremOverflowImpl(Data
, LHS
, RHS
, Opts
);
209 void __ubsan::__ubsan_handle_divrem_overflow_abort(OverflowData
*Data
,
212 GET_REPORT_OPTIONS(true);
213 handleDivremOverflowImpl(Data
, LHS
, RHS
, Opts
);
217 static void handleShiftOutOfBoundsImpl(ShiftOutOfBoundsData
*Data
,
218 ValueHandle LHS
, ValueHandle RHS
,
219 ReportOptions Opts
) {
220 SourceLocation Loc
= Data
->Loc
.acquire();
221 Value
LHSVal(Data
->LHSType
, LHS
);
222 Value
RHSVal(Data
->RHSType
, RHS
);
225 if (RHSVal
.isNegative() ||
226 RHSVal
.getPositiveIntValue() >= Data
->LHSType
.getIntegerBitWidth())
227 ET
= ErrorType::InvalidShiftExponent
;
229 ET
= ErrorType::InvalidShiftBase
;
231 if (ignoreReport(Loc
, Opts
, ET
))
234 ScopedReport
R(Opts
, Loc
, ET
);
236 if (ET
== ErrorType::InvalidShiftExponent
) {
237 if (RHSVal
.isNegative())
238 Diag(Loc
, DL_Error
, "shift exponent %0 is negative") << RHSVal
;
240 Diag(Loc
, DL_Error
, "shift exponent %0 is too large for %1-bit type %2")
241 << RHSVal
<< Data
->LHSType
.getIntegerBitWidth() << Data
->LHSType
;
243 if (LHSVal
.isNegative())
244 Diag(Loc
, DL_Error
, "left shift of negative value %0") << LHSVal
;
247 "left shift of %0 by %1 places cannot be represented in type %2")
248 << LHSVal
<< RHSVal
<< Data
->LHSType
;
252 void __ubsan::__ubsan_handle_shift_out_of_bounds(ShiftOutOfBoundsData
*Data
,
255 GET_REPORT_OPTIONS(false);
256 handleShiftOutOfBoundsImpl(Data
, LHS
, RHS
, Opts
);
258 void __ubsan::__ubsan_handle_shift_out_of_bounds_abort(
259 ShiftOutOfBoundsData
*Data
,
262 GET_REPORT_OPTIONS(true);
263 handleShiftOutOfBoundsImpl(Data
, LHS
, RHS
, Opts
);
267 static void handleOutOfBoundsImpl(OutOfBoundsData
*Data
, ValueHandle Index
,
268 ReportOptions Opts
) {
269 SourceLocation Loc
= Data
->Loc
.acquire();
270 ErrorType ET
= ErrorType::OutOfBoundsIndex
;
272 if (ignoreReport(Loc
, Opts
, ET
))
275 ScopedReport
R(Opts
, Loc
, ET
);
277 Value
IndexVal(Data
->IndexType
, Index
);
278 Diag(Loc
, DL_Error
, "index %0 out of bounds for type %1")
279 << IndexVal
<< Data
->ArrayType
;
282 void __ubsan::__ubsan_handle_out_of_bounds(OutOfBoundsData
*Data
,
284 GET_REPORT_OPTIONS(false);
285 handleOutOfBoundsImpl(Data
, Index
, Opts
);
287 void __ubsan::__ubsan_handle_out_of_bounds_abort(OutOfBoundsData
*Data
,
289 GET_REPORT_OPTIONS(true);
290 handleOutOfBoundsImpl(Data
, Index
, Opts
);
294 static void handleBuiltinUnreachableImpl(UnreachableData
*Data
,
295 ReportOptions Opts
) {
296 ScopedReport
R(Opts
, Data
->Loc
, ErrorType::UnreachableCall
);
297 Diag(Data
->Loc
, DL_Error
, "execution reached a __builtin_unreachable() call");
300 void __ubsan::__ubsan_handle_builtin_unreachable(UnreachableData
*Data
) {
301 GET_REPORT_OPTIONS(true);
302 handleBuiltinUnreachableImpl(Data
, Opts
);
306 static void handleMissingReturnImpl(UnreachableData
*Data
, ReportOptions Opts
) {
307 ScopedReport
R(Opts
, Data
->Loc
, ErrorType::MissingReturn
);
308 Diag(Data
->Loc
, DL_Error
,
309 "execution reached the end of a value-returning function "
310 "without returning a value");
313 void __ubsan::__ubsan_handle_missing_return(UnreachableData
*Data
) {
314 GET_REPORT_OPTIONS(true);
315 handleMissingReturnImpl(Data
, Opts
);
319 static void handleVLABoundNotPositive(VLABoundData
*Data
, ValueHandle Bound
,
320 ReportOptions Opts
) {
321 SourceLocation Loc
= Data
->Loc
.acquire();
322 ErrorType ET
= ErrorType::NonPositiveVLAIndex
;
324 if (ignoreReport(Loc
, Opts
, ET
))
327 ScopedReport
R(Opts
, Loc
, ET
);
329 Diag(Loc
, DL_Error
, "variable length array bound evaluates to "
330 "non-positive value %0")
331 << Value(Data
->Type
, Bound
);
334 void __ubsan::__ubsan_handle_vla_bound_not_positive(VLABoundData
*Data
,
336 GET_REPORT_OPTIONS(false);
337 handleVLABoundNotPositive(Data
, Bound
, Opts
);
339 void __ubsan::__ubsan_handle_vla_bound_not_positive_abort(VLABoundData
*Data
,
341 GET_REPORT_OPTIONS(true);
342 handleVLABoundNotPositive(Data
, Bound
, Opts
);
346 static bool looksLikeFloatCastOverflowDataV1(void *Data
) {
347 // First field is either a pointer to filename or a pointer to a
349 u8
*FilenameOrTypeDescriptor
;
350 internal_memcpy(&FilenameOrTypeDescriptor
, Data
,
351 sizeof(FilenameOrTypeDescriptor
));
353 // Heuristic: For float_cast_overflow, the TypeKind will be either TK_Integer
354 // (0x0), TK_Float (0x1) or TK_Unknown (0xff). If both types are known,
355 // adding both bytes will be 0 or 1 (for BE or LE). If it were a filename,
356 // adding two printable characters will not yield such a value. Otherwise,
357 // if one of them is 0xff, this is most likely TK_Unknown type descriptor.
358 u16 MaybeFromTypeKind
=
359 FilenameOrTypeDescriptor
[0] + FilenameOrTypeDescriptor
[1];
360 return MaybeFromTypeKind
< 2 || FilenameOrTypeDescriptor
[0] == 0xff ||
361 FilenameOrTypeDescriptor
[1] == 0xff;
364 static void handleFloatCastOverflow(void *DataPtr
, ValueHandle From
,
365 ReportOptions Opts
) {
366 SymbolizedStackHolder CallerLoc
;
368 const TypeDescriptor
*FromType
, *ToType
;
369 ErrorType ET
= ErrorType::FloatCastOverflow
;
371 if (looksLikeFloatCastOverflowDataV1(DataPtr
)) {
372 auto Data
= reinterpret_cast<FloatCastOverflowData
*>(DataPtr
);
373 CallerLoc
.reset(getCallerLocation(Opts
.pc
));
375 FromType
= &Data
->FromType
;
376 ToType
= &Data
->ToType
;
378 auto Data
= reinterpret_cast<FloatCastOverflowDataV2
*>(DataPtr
);
379 SourceLocation SLoc
= Data
->Loc
.acquire();
380 if (ignoreReport(SLoc
, Opts
, ET
))
383 FromType
= &Data
->FromType
;
384 ToType
= &Data
->ToType
;
387 ScopedReport
R(Opts
, Loc
, ET
);
390 "value %0 is outside the range of representable values of type %2")
391 << Value(*FromType
, From
) << *FromType
<< *ToType
;
394 void __ubsan::__ubsan_handle_float_cast_overflow(void *Data
, ValueHandle From
) {
395 GET_REPORT_OPTIONS(false);
396 handleFloatCastOverflow(Data
, From
, Opts
);
398 void __ubsan::__ubsan_handle_float_cast_overflow_abort(void *Data
,
400 GET_REPORT_OPTIONS(true);
401 handleFloatCastOverflow(Data
, From
, Opts
);
405 static void handleLoadInvalidValue(InvalidValueData
*Data
, ValueHandle Val
,
406 ReportOptions Opts
) {
407 SourceLocation Loc
= Data
->Loc
.acquire();
408 // This check could be more precise if we used different handlers for
409 // -fsanitize=bool and -fsanitize=enum.
410 bool IsBool
= (0 == internal_strcmp(Data
->Type
.getTypeName(), "'bool'"));
412 IsBool
? ErrorType::InvalidBoolLoad
: ErrorType::InvalidEnumLoad
;
414 if (ignoreReport(Loc
, Opts
, ET
))
417 ScopedReport
R(Opts
, Loc
, ET
);
420 "load of value %0, which is not a valid value for type %1")
421 << Value(Data
->Type
, Val
) << Data
->Type
;
424 void __ubsan::__ubsan_handle_load_invalid_value(InvalidValueData
*Data
,
426 GET_REPORT_OPTIONS(false);
427 handleLoadInvalidValue(Data
, Val
, Opts
);
429 void __ubsan::__ubsan_handle_load_invalid_value_abort(InvalidValueData
*Data
,
431 GET_REPORT_OPTIONS(true);
432 handleLoadInvalidValue(Data
, Val
, Opts
);
436 static void handleFunctionTypeMismatch(FunctionTypeMismatchData
*Data
,
437 ValueHandle Function
,
438 ReportOptions Opts
) {
439 SourceLocation CallLoc
= Data
->Loc
.acquire();
440 ErrorType ET
= ErrorType::FunctionTypeMismatch
;
442 if (ignoreReport(CallLoc
, Opts
, ET
))
445 ScopedReport
R(Opts
, CallLoc
, ET
);
447 SymbolizedStackHolder
FLoc(getSymbolizedLocation(Function
));
448 const char *FName
= FLoc
.get()->info
.function
;
452 Diag(CallLoc
, DL_Error
,
453 "call to function %0 through pointer to incorrect function type %1")
454 << FName
<< Data
->Type
;
455 Diag(FLoc
, DL_Note
, "%0 defined here") << FName
;
459 __ubsan::__ubsan_handle_function_type_mismatch(FunctionTypeMismatchData
*Data
,
460 ValueHandle Function
) {
461 GET_REPORT_OPTIONS(false);
462 handleFunctionTypeMismatch(Data
, Function
, Opts
);
465 void __ubsan::__ubsan_handle_function_type_mismatch_abort(
466 FunctionTypeMismatchData
*Data
, ValueHandle Function
) {
467 GET_REPORT_OPTIONS(true);
468 handleFunctionTypeMismatch(Data
, Function
, Opts
);
472 static void handleNonNullReturn(NonNullReturnData
*Data
, ReportOptions Opts
) {
473 SourceLocation Loc
= Data
->Loc
.acquire();
474 ErrorType ET
= ErrorType::InvalidNullReturn
;
476 if (ignoreReport(Loc
, Opts
, ET
))
479 ScopedReport
R(Opts
, Loc
, ET
);
481 Diag(Loc
, DL_Error
, "null pointer returned from function declared to never "
483 if (!Data
->AttrLoc
.isInvalid())
484 Diag(Data
->AttrLoc
, DL_Note
, "returns_nonnull attribute specified here");
487 void __ubsan::__ubsan_handle_nonnull_return(NonNullReturnData
*Data
) {
488 GET_REPORT_OPTIONS(false);
489 handleNonNullReturn(Data
, Opts
);
492 void __ubsan::__ubsan_handle_nonnull_return_abort(NonNullReturnData
*Data
) {
493 GET_REPORT_OPTIONS(true);
494 handleNonNullReturn(Data
, Opts
);
498 static void handleNonNullArg(NonNullArgData
*Data
, ReportOptions Opts
) {
499 SourceLocation Loc
= Data
->Loc
.acquire();
500 ErrorType ET
= ErrorType::InvalidNullArgument
;
502 if (ignoreReport(Loc
, Opts
, ET
))
505 ScopedReport
R(Opts
, Loc
, ET
);
507 Diag(Loc
, DL_Error
, "null pointer passed as argument %0, which is declared to "
508 "never be null") << Data
->ArgIndex
;
509 if (!Data
->AttrLoc
.isInvalid())
510 Diag(Data
->AttrLoc
, DL_Note
, "nonnull attribute specified here");
513 void __ubsan::__ubsan_handle_nonnull_arg(NonNullArgData
*Data
) {
514 GET_REPORT_OPTIONS(false);
515 handleNonNullArg(Data
, Opts
);
518 void __ubsan::__ubsan_handle_nonnull_arg_abort(NonNullArgData
*Data
) {
519 GET_REPORT_OPTIONS(true);
520 handleNonNullArg(Data
, Opts
);
524 static void handleCFIBadIcall(CFICheckFailData
*Data
, ValueHandle Function
,
525 ReportOptions Opts
) {
526 if (Data
->CheckKind
!= CFITCK_ICall
)
529 SourceLocation Loc
= Data
->Loc
.acquire();
530 ErrorType ET
= ErrorType::CFIBadType
;
532 if (ignoreReport(Loc
, Opts
, ET
))
535 ScopedReport
R(Opts
, Loc
, ET
);
537 Diag(Loc
, DL_Error
, "control flow integrity check for type %0 failed during "
538 "indirect function call")
541 SymbolizedStackHolder
FLoc(getSymbolizedLocation(Function
));
542 const char *FName
= FLoc
.get()->info
.function
;
545 Diag(FLoc
, DL_Note
, "%0 defined here") << FName
;
549 #ifdef UBSAN_CAN_USE_CXXABI
550 SANITIZER_WEAK_ATTRIBUTE
551 void HandleCFIBadType(CFICheckFailData
*Data
, ValueHandle Vtable
,
552 bool ValidVtable
, ReportOptions Opts
);
554 static void HandleCFIBadType(CFICheckFailData
*Data
, ValueHandle Vtable
,
555 bool ValidVtable
, ReportOptions Opts
) {
559 } // namespace __ubsan
561 void __ubsan::__ubsan_handle_cfi_bad_icall(CFIBadIcallData
*CallData
,
562 ValueHandle Function
) {
563 GET_REPORT_OPTIONS(false);
564 CFICheckFailData Data
= {CFITCK_ICall
, CallData
->Loc
, CallData
->Type
};
565 handleCFIBadIcall(&Data
, Function
, Opts
);
568 void __ubsan::__ubsan_handle_cfi_bad_icall_abort(CFIBadIcallData
*CallData
,
569 ValueHandle Function
) {
570 GET_REPORT_OPTIONS(true);
571 CFICheckFailData Data
= {CFITCK_ICall
, CallData
->Loc
, CallData
->Type
};
572 handleCFIBadIcall(&Data
, Function
, Opts
);
576 void __ubsan::__ubsan_handle_cfi_check_fail(CFICheckFailData
*Data
,
579 GET_REPORT_OPTIONS(false);
580 if (Data
->CheckKind
== CFITCK_ICall
)
581 handleCFIBadIcall(Data
, Value
, Opts
);
583 HandleCFIBadType(Data
, Value
, ValidVtable
, Opts
);
586 void __ubsan::__ubsan_handle_cfi_check_fail_abort(CFICheckFailData
*Data
,
589 GET_REPORT_OPTIONS(true);
590 if (Data
->CheckKind
== CFITCK_ICall
)
591 handleCFIBadIcall(Data
, Value
, Opts
);
593 HandleCFIBadType(Data
, Value
, ValidVtable
, Opts
);
597 #endif // CAN_SANITIZE_UB