1 //===-- asan_malloc_mac.cc ------------------------------------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file is a part of AddressSanitizer, an address sanity checker.
12 // Mac-specific malloc interception.
13 //===----------------------------------------------------------------------===//
15 #include "sanitizer_common/sanitizer_platform.h"
18 #include <AvailabilityMacros.h>
19 #include <CoreFoundation/CFBase.h>
21 #include <malloc/malloc.h>
24 #include "asan_allocator.h"
25 #include "asan_interceptors.h"
26 #include "asan_internal.h"
27 #include "asan_report.h"
28 #include "asan_stack.h"
29 #include "asan_stats.h"
30 #include "sanitizer_common/sanitizer_mac.h"
32 // Similar code is used in Google Perftools,
33 // http://code.google.com/p/google-perftools.
35 // ---------------------- Replacement functions ---------------- {{{1
36 using namespace __asan; // NOLINT
38 // TODO(glider): do we need both zones?
39 static malloc_zone_t *system_malloc_zone = 0;
40 static malloc_zone_t asan_zone;
42 INTERCEPTOR(malloc_zone_t *, malloc_create_zone,
43 vm_size_t start_size, unsigned zone_flags) {
45 GET_STACK_TRACE_MALLOC;
46 uptr page_size = GetPageSizeCached();
47 uptr allocated_size = RoundUpTo(sizeof(asan_zone), page_size);
48 malloc_zone_t *new_zone =
49 (malloc_zone_t*)asan_memalign(page_size, allocated_size,
51 internal_memcpy(new_zone, &asan_zone, sizeof(asan_zone));
52 new_zone->zone_name = NULL; // The name will be changed anyway.
53 if (GetMacosVersion() >= MACOS_VERSION_LION) {
54 // Prevent the client app from overwriting the zone contents.
55 // Library functions that need to modify the zone will set PROT_WRITE on it.
56 // This matches the behavior of malloc_create_zone() on OSX 10.7 and higher.
57 mprotect(new_zone, allocated_size, PROT_READ);
62 INTERCEPTOR(malloc_zone_t *, malloc_default_zone, void) {
67 INTERCEPTOR(malloc_zone_t *, malloc_default_purgeable_zone, void) {
68 // FIXME: ASan should support purgeable allocations.
69 // https://code.google.com/p/address-sanitizer/issues/detail?id=139
74 INTERCEPTOR(void, malloc_make_purgeable, void *ptr) {
75 // FIXME: ASan should support purgeable allocations. Ignoring them is fine
80 INTERCEPTOR(int, malloc_make_nonpurgeable, void *ptr) {
81 // FIXME: ASan should support purgeable allocations. Ignoring them is fine
84 // Must return 0 if the contents were not purged since the last call to
85 // malloc_make_purgeable().
89 INTERCEPTOR(void, malloc_set_zone_name, malloc_zone_t *zone, const char *name) {
91 // Allocate |strlen("asan-") + 1 + internal_strlen(name)| bytes.
92 size_t buflen = 6 + (name ? internal_strlen(name) : 0);
93 InternalScopedString new_name(buflen);
94 if (name && zone->introspect == asan_zone.introspect) {
95 new_name.append("asan-%s", name);
96 name = new_name.data();
99 // Call the system malloc's implementation for both external and our zones,
100 // since that appropriately changes VM region protections on the zone.
101 REAL(malloc_set_zone_name)(zone, name);
104 INTERCEPTOR(void *, malloc, size_t size) {
105 ENSURE_ASAN_INITED();
106 GET_STACK_TRACE_MALLOC;
107 void *res = asan_malloc(size, &stack);
111 INTERCEPTOR(void, free, void *ptr) {
112 ENSURE_ASAN_INITED();
114 GET_STACK_TRACE_FREE;
115 asan_free(ptr, &stack, FROM_MALLOC);
118 INTERCEPTOR(void *, realloc, void *ptr, size_t size) {
119 ENSURE_ASAN_INITED();
120 GET_STACK_TRACE_MALLOC;
121 return asan_realloc(ptr, size, &stack);
124 INTERCEPTOR(void *, calloc, size_t nmemb, size_t size) {
125 ENSURE_ASAN_INITED();
126 GET_STACK_TRACE_MALLOC;
127 return asan_calloc(nmemb, size, &stack);
130 INTERCEPTOR(void *, valloc, size_t size) {
131 ENSURE_ASAN_INITED();
132 GET_STACK_TRACE_MALLOC;
133 return asan_memalign(GetPageSizeCached(), size, &stack, FROM_MALLOC);
136 INTERCEPTOR(size_t, malloc_good_size, size_t size) {
137 ENSURE_ASAN_INITED();
138 return asan_zone.introspect->good_size(&asan_zone, size);
141 INTERCEPTOR(int, posix_memalign, void **memptr, size_t alignment, size_t size) {
142 ENSURE_ASAN_INITED();
144 GET_STACK_TRACE_MALLOC;
145 void *result = asan_memalign(alignment, size, &stack, FROM_MALLOC);
155 // TODO(glider): the __asan_mz_* functions should be united with the Linux
156 // wrappers, as they are basically copied from there.
158 SANITIZER_INTERFACE_ATTRIBUTE
159 size_t __asan_mz_size(malloc_zone_t* zone, const void* ptr) {
160 return asan_mz_size(ptr);
164 SANITIZER_INTERFACE_ATTRIBUTE
165 void *__asan_mz_malloc(malloc_zone_t *zone, uptr size) {
166 if (UNLIKELY(!asan_inited)) {
167 CHECK(system_malloc_zone);
168 return malloc_zone_malloc(system_malloc_zone, size);
170 GET_STACK_TRACE_MALLOC;
171 return asan_malloc(size, &stack);
175 SANITIZER_INTERFACE_ATTRIBUTE
176 void *__asan_mz_calloc(malloc_zone_t *zone, size_t nmemb, size_t size) {
177 if (UNLIKELY(!asan_inited)) {
178 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym.
179 const size_t kCallocPoolSize = 1024;
180 static uptr calloc_memory_for_dlsym[kCallocPoolSize];
181 static size_t allocated;
182 size_t size_in_words = ((nmemb * size) + kWordSize - 1) / kWordSize;
183 void *mem = (void*)&calloc_memory_for_dlsym[allocated];
184 allocated += size_in_words;
185 CHECK(allocated < kCallocPoolSize);
188 GET_STACK_TRACE_MALLOC;
189 return asan_calloc(nmemb, size, &stack);
193 SANITIZER_INTERFACE_ATTRIBUTE
194 void *__asan_mz_valloc(malloc_zone_t *zone, size_t size) {
195 if (UNLIKELY(!asan_inited)) {
196 CHECK(system_malloc_zone);
197 return malloc_zone_valloc(system_malloc_zone, size);
199 GET_STACK_TRACE_MALLOC;
200 return asan_memalign(GetPageSizeCached(), size, &stack, FROM_MALLOC);
203 #define GET_ZONE_FOR_PTR(ptr) \
204 malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); \
205 const char *zone_name = (zone_ptr == 0) ? 0 : zone_ptr->zone_name
207 void ALWAYS_INLINE free_common(void *context, void *ptr) {
209 GET_STACK_TRACE_FREE;
210 // FIXME: need to retire this flag.
211 if (!flags()->mac_ignore_invalid_free) {
212 asan_free(ptr, &stack, FROM_MALLOC);
214 GET_ZONE_FOR_PTR(ptr);
215 WarnMacFreeUnallocated((uptr)ptr, (uptr)zone_ptr, zone_name, &stack);
220 // TODO(glider): the allocation callbacks need to be refactored.
222 SANITIZER_INTERFACE_ATTRIBUTE
223 void __asan_mz_free(malloc_zone_t *zone, void *ptr) {
224 free_common(zone, ptr);
228 SANITIZER_INTERFACE_ATTRIBUTE
229 void *__asan_mz_realloc(malloc_zone_t *zone, void *ptr, size_t size) {
231 GET_STACK_TRACE_MALLOC;
232 return asan_malloc(size, &stack);
234 if (asan_mz_size(ptr)) {
235 GET_STACK_TRACE_MALLOC;
236 return asan_realloc(ptr, size, &stack);
238 // We can't recover from reallocating an unknown address, because
239 // this would require reading at most |size| bytes from
240 // potentially unaccessible memory.
241 GET_STACK_TRACE_FREE;
242 GET_ZONE_FOR_PTR(ptr);
243 ReportMacMzReallocUnknown((uptr)ptr, (uptr)zone_ptr, zone_name, &stack);
249 SANITIZER_INTERFACE_ATTRIBUTE
250 void __asan_mz_destroy(malloc_zone_t* zone) {
251 // A no-op -- we will not be destroyed!
252 Report("__asan_mz_destroy() called -- ignoring\n");
256 SANITIZER_INTERFACE_ATTRIBUTE
257 void *__asan_mz_memalign(malloc_zone_t *zone, size_t align, size_t size) {
258 if (UNLIKELY(!asan_inited)) {
259 CHECK(system_malloc_zone);
260 return malloc_zone_memalign(system_malloc_zone, align, size);
262 GET_STACK_TRACE_MALLOC;
263 return asan_memalign(align, size, &stack, FROM_MALLOC);
266 // This function is currently unused, and we build with -Werror.
268 void __asan_mz_free_definite_size(
269 malloc_zone_t* zone, void *ptr, size_t size) {
270 // TODO(glider): check that |size| is valid.
275 kern_return_t mi_enumerator(task_t task, void *,
276 unsigned type_mask, vm_address_t zone_address,
277 memory_reader_t reader,
278 vm_range_recorder_t recorder) {
279 // Should enumerate all the pointers we have. Seems like a lot of work.
283 size_t mi_good_size(malloc_zone_t *zone, size_t size) {
284 // I think it's always safe to return size, but we maybe could do better.
288 boolean_t mi_check(malloc_zone_t *zone) {
292 void mi_print(malloc_zone_t *zone, boolean_t verbose) {
296 void mi_log(malloc_zone_t *zone, void *address) {
297 // I don't think we support anything like this
300 void mi_force_lock(malloc_zone_t *zone) {
301 asan_mz_force_lock();
304 void mi_force_unlock(malloc_zone_t *zone) {
305 asan_mz_force_unlock();
308 void mi_statistics(malloc_zone_t *zone, malloc_statistics_t *stats) {
309 AsanMallocStats malloc_stats;
310 FillMallocStatistics(&malloc_stats);
311 CHECK(sizeof(malloc_statistics_t) == sizeof(AsanMallocStats));
312 internal_memcpy(stats, &malloc_stats, sizeof(malloc_statistics_t));
315 boolean_t mi_zone_locked(malloc_zone_t *zone) {
320 } // unnamed namespace
324 void ReplaceSystemMalloc() {
325 static malloc_introspection_t asan_introspection;
326 // Ok to use internal_memset, these places are not performance-critical.
327 internal_memset(&asan_introspection, 0, sizeof(asan_introspection));
329 asan_introspection.enumerator = &mi_enumerator;
330 asan_introspection.good_size = &mi_good_size;
331 asan_introspection.check = &mi_check;
332 asan_introspection.print = &mi_print;
333 asan_introspection.log = &mi_log;
334 asan_introspection.force_lock = &mi_force_lock;
335 asan_introspection.force_unlock = &mi_force_unlock;
336 asan_introspection.statistics = &mi_statistics;
337 asan_introspection.zone_locked = &mi_zone_locked;
339 internal_memset(&asan_zone, 0, sizeof(malloc_zone_t));
341 // Use version 6 for OSX >= 10.6.
342 asan_zone.version = 6;
343 asan_zone.zone_name = "asan";
344 asan_zone.size = &__asan_mz_size;
345 asan_zone.malloc = &__asan_mz_malloc;
346 asan_zone.calloc = &__asan_mz_calloc;
347 asan_zone.valloc = &__asan_mz_valloc;
348 asan_zone.free = &__asan_mz_free;
349 asan_zone.realloc = &__asan_mz_realloc;
350 asan_zone.destroy = &__asan_mz_destroy;
351 asan_zone.batch_malloc = 0;
352 asan_zone.batch_free = 0;
353 asan_zone.free_definite_size = 0;
354 asan_zone.memalign = &__asan_mz_memalign;
355 asan_zone.introspect = &asan_introspection;
357 // Register the ASan zone.
358 malloc_zone_register(&asan_zone);
360 } // namespace __asan
362 #endif // SANITIZER_MAC