1 //===-- asan_malloc_linux.cc ----------------------------------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file is a part of AddressSanitizer, an address sanity checker.
12 // Linux-specific malloc interception.
13 // We simply define functions like malloc, free, realloc, etc.
14 // They will replace the corresponding libc functions automagically.
15 //===----------------------------------------------------------------------===//
17 #include "sanitizer_common/sanitizer_platform.h"
18 #if SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX || \
19 SANITIZER_NETBSD || SANITIZER_SOLARIS
21 #include "sanitizer_common/sanitizer_tls_get_addr.h"
22 #include "asan_allocator.h"
23 #include "asan_interceptors.h"
24 #include "asan_internal.h"
25 #include "asan_stack.h"
27 // ---------------------- Replacement functions ---------------- {{{1
28 using namespace __asan; // NOLINT
30 static uptr allocated_for_dlsym;
31 static const uptr kDlsymAllocPoolSize = 1024;
32 static uptr alloc_memory_for_dlsym[kDlsymAllocPoolSize];
34 static INLINE bool IsInDlsymAllocPool(const void *ptr) {
35 uptr off = (uptr)ptr - (uptr)alloc_memory_for_dlsym;
36 return off < allocated_for_dlsym * sizeof(alloc_memory_for_dlsym[0]);
39 static void *AllocateFromLocalPool(uptr size_in_bytes) {
40 uptr size_in_words = RoundUpTo(size_in_bytes, kWordSize) / kWordSize;
41 void *mem = (void*)&alloc_memory_for_dlsym[allocated_for_dlsym];
42 allocated_for_dlsym += size_in_words;
43 CHECK_LT(allocated_for_dlsym, kDlsymAllocPoolSize);
47 static INLINE bool MaybeInDlsym() {
48 // Fuchsia doesn't use dlsym-based interceptors.
49 return !SANITIZER_FUCHSIA && asan_init_is_running;
52 static void *ReallocFromLocalPool(void *ptr, uptr size) {
53 const uptr offset = (uptr)ptr - (uptr)alloc_memory_for_dlsym;
54 const uptr copy_size = Min(size, kDlsymAllocPoolSize - offset);
56 if (UNLIKELY(MaybeInDlsym())) {
57 new_ptr = AllocateFromLocalPool(size);
60 GET_STACK_TRACE_MALLOC;
61 new_ptr = asan_malloc(size, &stack);
63 internal_memcpy(new_ptr, ptr, copy_size);
67 INTERCEPTOR(void, free, void *ptr) {
69 if (UNLIKELY(IsInDlsymAllocPool(ptr)))
71 asan_free(ptr, &stack, FROM_MALLOC);
74 #if SANITIZER_INTERCEPT_CFREE
75 INTERCEPTOR(void, cfree, void *ptr) {
77 if (UNLIKELY(IsInDlsymAllocPool(ptr)))
79 asan_free(ptr, &stack, FROM_MALLOC);
81 #endif // SANITIZER_INTERCEPT_CFREE
83 INTERCEPTOR(void*, malloc, uptr size) {
84 if (UNLIKELY(MaybeInDlsym()))
85 // Hack: dlsym calls malloc before REAL(malloc) is retrieved from dlsym.
86 return AllocateFromLocalPool(size);
88 GET_STACK_TRACE_MALLOC;
89 return asan_malloc(size, &stack);
92 INTERCEPTOR(void*, calloc, uptr nmemb, uptr size) {
93 if (UNLIKELY(MaybeInDlsym()))
94 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym.
95 return AllocateFromLocalPool(nmemb * size);
97 GET_STACK_TRACE_MALLOC;
98 return asan_calloc(nmemb, size, &stack);
101 INTERCEPTOR(void*, realloc, void *ptr, uptr size) {
102 if (UNLIKELY(IsInDlsymAllocPool(ptr)))
103 return ReallocFromLocalPool(ptr, size);
104 if (UNLIKELY(MaybeInDlsym()))
105 return AllocateFromLocalPool(size);
106 ENSURE_ASAN_INITED();
107 GET_STACK_TRACE_MALLOC;
108 return asan_realloc(ptr, size, &stack);
111 #if SANITIZER_INTERCEPT_MEMALIGN
112 INTERCEPTOR(void*, memalign, uptr boundary, uptr size) {
113 GET_STACK_TRACE_MALLOC;
114 return asan_memalign(boundary, size, &stack, FROM_MALLOC);
117 INTERCEPTOR(void*, __libc_memalign, uptr boundary, uptr size) {
118 GET_STACK_TRACE_MALLOC;
119 void *res = asan_memalign(boundary, size, &stack, FROM_MALLOC);
120 DTLS_on_libc_memalign(res, size);
123 #endif // SANITIZER_INTERCEPT_MEMALIGN
125 INTERCEPTOR(void*, aligned_alloc, uptr boundary, uptr size) {
126 GET_STACK_TRACE_MALLOC;
127 return asan_memalign(boundary, size, &stack, FROM_MALLOC);
130 INTERCEPTOR(uptr, malloc_usable_size, void *ptr) {
131 GET_CURRENT_PC_BP_SP;
133 return asan_malloc_usable_size(ptr, pc, bp);
136 #if SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO
137 // We avoid including malloc.h for portability reasons.
138 // man mallinfo says the fields are "long", but the implementation uses int.
139 // It doesn't matter much -- we just need to make sure that the libc's mallinfo
141 struct fake_mallinfo {
145 INTERCEPTOR(struct fake_mallinfo, mallinfo, void) {
146 struct fake_mallinfo res;
147 REAL(memset)(&res, 0, sizeof(res));
151 INTERCEPTOR(int, mallopt, int cmd, int value) {
154 #endif // SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO
156 INTERCEPTOR(int, posix_memalign, void **memptr, uptr alignment, uptr size) {
157 GET_STACK_TRACE_MALLOC;
158 // Printf("posix_memalign: %zx %zu\n", alignment, size);
159 return asan_posix_memalign(memptr, alignment, size, &stack);
162 INTERCEPTOR(void*, valloc, uptr size) {
163 GET_STACK_TRACE_MALLOC;
164 return asan_valloc(size, &stack);
167 #if SANITIZER_INTERCEPT_PVALLOC
168 INTERCEPTOR(void*, pvalloc, uptr size) {
169 GET_STACK_TRACE_MALLOC;
170 return asan_pvalloc(size, &stack);
172 #endif // SANITIZER_INTERCEPT_PVALLOC
174 INTERCEPTOR(void, malloc_stats, void) {
175 __asan_print_accumulated_stats();
178 #if SANITIZER_ANDROID
179 // Format of __libc_malloc_dispatch has changed in Android L.
180 // While we are moving towards a solution that does not depend on bionic
181 // internals, here is something to support both K* and L releases.
182 struct MallocDebugK {
183 void *(*malloc)(uptr bytes);
184 void (*free)(void *mem);
185 void *(*calloc)(uptr n_elements, uptr elem_size);
186 void *(*realloc)(void *oldMem, uptr bytes);
187 void *(*memalign)(uptr alignment, uptr bytes);
188 uptr (*malloc_usable_size)(void *mem);
191 struct MallocDebugL {
192 void *(*calloc)(uptr n_elements, uptr elem_size);
193 void (*free)(void *mem);
194 fake_mallinfo (*mallinfo)(void);
195 void *(*malloc)(uptr bytes);
196 uptr (*malloc_usable_size)(void *mem);
197 void *(*memalign)(uptr alignment, uptr bytes);
198 int (*posix_memalign)(void **memptr, uptr alignment, uptr size);
199 void* (*pvalloc)(uptr size);
200 void *(*realloc)(void *oldMem, uptr bytes);
201 void* (*valloc)(uptr size);
204 ALIGNED(32) const MallocDebugK asan_malloc_dispatch_k = {
205 WRAP(malloc), WRAP(free), WRAP(calloc),
206 WRAP(realloc), WRAP(memalign), WRAP(malloc_usable_size)};
208 ALIGNED(32) const MallocDebugL asan_malloc_dispatch_l = {
209 WRAP(calloc), WRAP(free), WRAP(mallinfo),
210 WRAP(malloc), WRAP(malloc_usable_size), WRAP(memalign),
211 WRAP(posix_memalign), WRAP(pvalloc), WRAP(realloc),
215 void ReplaceSystemMalloc() {
216 void **__libc_malloc_dispatch_p =
217 (void **)AsanDlSymNext("__libc_malloc_dispatch");
218 if (__libc_malloc_dispatch_p) {
219 // Decide on K vs L dispatch format by the presence of
220 // __libc_malloc_default_dispatch export in libc.
221 void *default_dispatch_p = AsanDlSymNext("__libc_malloc_default_dispatch");
222 if (default_dispatch_p)
223 *__libc_malloc_dispatch_p = (void *)&asan_malloc_dispatch_k;
225 *__libc_malloc_dispatch_p = (void *)&asan_malloc_dispatch_l;
228 } // namespace __asan
230 #else // SANITIZER_ANDROID
233 void ReplaceSystemMalloc() {
235 } // namespace __asan
236 #endif // SANITIZER_ANDROID
238 #endif // SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX ||
239 // SANITIZER_NETBSD || SANITIZER_SOLARIS