1 //===-- asan_rtl.cc -------------------------------------------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file is a part of AddressSanitizer, an address sanity checker.
12 // Main file of the ASan run-time library.
13 //===----------------------------------------------------------------------===//
15 #include "asan_activation.h"
16 #include "asan_allocator.h"
17 #include "asan_interceptors.h"
18 #include "asan_interface_internal.h"
19 #include "asan_internal.h"
20 #include "asan_mapping.h"
21 #include "asan_poisoning.h"
22 #include "asan_report.h"
23 #include "asan_stack.h"
24 #include "asan_stats.h"
25 #include "asan_suppressions.h"
26 #include "asan_thread.h"
27 #include "sanitizer_common/sanitizer_atomic.h"
28 #include "sanitizer_common/sanitizer_flags.h"
29 #include "sanitizer_common/sanitizer_libc.h"
30 #include "sanitizer_common/sanitizer_symbolizer.h"
31 #include "lsan/lsan_common.h"
32 #include "ubsan/ubsan_init.h"
33 #include "ubsan/ubsan_platform.h"
35 uptr __asan_shadow_memory_dynamic_address; // Global interface symbol.
36 int __asan_option_detect_stack_use_after_return; // Global interface symbol.
37 uptr *__asan_test_only_reported_buggy_pointer; // Used only for testing asan.
41 uptr AsanMappingProfile[kAsanMappingProfileSize];
43 static void AsanDie() {
44 static atomic_uint32_t num_calls;
45 if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) {
46 // Don't die twice - run a busy loop.
49 if (common_flags()->print_module_map >= 1) PrintModuleMap();
50 if (flags()->sleep_before_dying) {
51 Report("Sleeping for %d second(s)\n", flags()->sleep_before_dying);
52 SleepForSeconds(flags()->sleep_before_dying);
54 if (flags()->unmap_shadow_on_exit) {
56 UnmapOrDie((void*)kLowShadowBeg, kMidMemBeg - kLowShadowBeg);
57 UnmapOrDie((void*)kMidMemEnd, kHighShadowEnd - kMidMemEnd);
59 UnmapOrDie((void*)kLowShadowBeg, kHighShadowEnd - kLowShadowBeg);
64 static void AsanCheckFailed(const char *file, int line, const char *cond,
66 Report("AddressSanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n", file,
67 line, cond, (uptr)v1, (uptr)v2);
68 // FIXME: check for infinite recursion without a thread-local counter here.
69 PRINT_CURRENT_STACK_CHECK();
73 // -------------------------- Globals --------------------- {{{1
75 bool asan_init_is_running;
77 #if !ASAN_FIXED_MAPPING
78 uptr kHighMemEnd, kMidMemBeg, kMidMemEnd;
81 // -------------------------- Misc ---------------- {{{1
82 void ShowStatsAndAbort() {
83 __asan_print_accumulated_stats();
87 // --------------- LowLevelAllocateCallbac ---------- {{{1
88 static void OnLowLevelAllocate(uptr ptr, uptr size) {
89 PoisonShadow(ptr, size, kAsanInternalHeapMagic);
92 // -------------------------- Run-time entry ------------------- {{{1
94 #define ASAN_REPORT_ERROR(type, is_write, size) \
95 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
96 void __asan_report_ ## type ## size(uptr addr) { \
97 GET_CALLER_PC_BP_SP; \
98 ReportGenericError(pc, bp, sp, addr, is_write, size, 0, true); \
100 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
101 void __asan_report_exp_ ## type ## size(uptr addr, u32 exp) { \
102 GET_CALLER_PC_BP_SP; \
103 ReportGenericError(pc, bp, sp, addr, is_write, size, exp, true); \
105 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
106 void __asan_report_ ## type ## size ## _noabort(uptr addr) { \
107 GET_CALLER_PC_BP_SP; \
108 ReportGenericError(pc, bp, sp, addr, is_write, size, 0, false); \
111 ASAN_REPORT_ERROR(load, false, 1)
112 ASAN_REPORT_ERROR(load, false, 2)
113 ASAN_REPORT_ERROR(load, false, 4)
114 ASAN_REPORT_ERROR(load, false, 8)
115 ASAN_REPORT_ERROR(load, false, 16)
116 ASAN_REPORT_ERROR(store, true, 1)
117 ASAN_REPORT_ERROR(store, true, 2)
118 ASAN_REPORT_ERROR(store, true, 4)
119 ASAN_REPORT_ERROR(store, true, 8)
120 ASAN_REPORT_ERROR(store, true, 16)
122 #define ASAN_REPORT_ERROR_N(type, is_write) \
123 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
124 void __asan_report_ ## type ## _n(uptr addr, uptr size) { \
125 GET_CALLER_PC_BP_SP; \
126 ReportGenericError(pc, bp, sp, addr, is_write, size, 0, true); \
128 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
129 void __asan_report_exp_ ## type ## _n(uptr addr, uptr size, u32 exp) { \
130 GET_CALLER_PC_BP_SP; \
131 ReportGenericError(pc, bp, sp, addr, is_write, size, exp, true); \
133 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
134 void __asan_report_ ## type ## _n_noabort(uptr addr, uptr size) { \
135 GET_CALLER_PC_BP_SP; \
136 ReportGenericError(pc, bp, sp, addr, is_write, size, 0, false); \
139 ASAN_REPORT_ERROR_N(load, false)
140 ASAN_REPORT_ERROR_N(store, true)
142 #define ASAN_MEMORY_ACCESS_CALLBACK_BODY(type, is_write, size, exp_arg, fatal) \
143 uptr sp = MEM_TO_SHADOW(addr); \
144 uptr s = size <= SHADOW_GRANULARITY ? *reinterpret_cast<u8 *>(sp) \
145 : *reinterpret_cast<u16 *>(sp); \
147 if (UNLIKELY(size >= SHADOW_GRANULARITY || \
148 ((s8)((addr & (SHADOW_GRANULARITY - 1)) + size - 1)) >= \
150 if (__asan_test_only_reported_buggy_pointer) { \
151 *__asan_test_only_reported_buggy_pointer = addr; \
153 GET_CALLER_PC_BP_SP; \
154 ReportGenericError(pc, bp, sp, addr, is_write, size, exp_arg, \
160 #define ASAN_MEMORY_ACCESS_CALLBACK(type, is_write, size) \
161 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
162 void __asan_##type##size(uptr addr) { \
163 ASAN_MEMORY_ACCESS_CALLBACK_BODY(type, is_write, size, 0, true) \
165 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
166 void __asan_exp_##type##size(uptr addr, u32 exp) { \
167 ASAN_MEMORY_ACCESS_CALLBACK_BODY(type, is_write, size, exp, true) \
169 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
170 void __asan_##type##size ## _noabort(uptr addr) { \
171 ASAN_MEMORY_ACCESS_CALLBACK_BODY(type, is_write, size, 0, false) \
174 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 1)
175 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 2)
176 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 4)
177 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 8)
178 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 16)
179 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 1)
180 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 2)
181 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 4)
182 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 8)
183 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 16)
186 NOINLINE INTERFACE_ATTRIBUTE
187 void __asan_loadN(uptr addr, uptr size) {
188 if (__asan_region_is_poisoned(addr, size)) {
190 ReportGenericError(pc, bp, sp, addr, false, size, 0, true);
195 NOINLINE INTERFACE_ATTRIBUTE
196 void __asan_exp_loadN(uptr addr, uptr size, u32 exp) {
197 if (__asan_region_is_poisoned(addr, size)) {
199 ReportGenericError(pc, bp, sp, addr, false, size, exp, true);
204 NOINLINE INTERFACE_ATTRIBUTE
205 void __asan_loadN_noabort(uptr addr, uptr size) {
206 if (__asan_region_is_poisoned(addr, size)) {
208 ReportGenericError(pc, bp, sp, addr, false, size, 0, false);
213 NOINLINE INTERFACE_ATTRIBUTE
214 void __asan_storeN(uptr addr, uptr size) {
215 if (__asan_region_is_poisoned(addr, size)) {
217 ReportGenericError(pc, bp, sp, addr, true, size, 0, true);
222 NOINLINE INTERFACE_ATTRIBUTE
223 void __asan_exp_storeN(uptr addr, uptr size, u32 exp) {
224 if (__asan_region_is_poisoned(addr, size)) {
226 ReportGenericError(pc, bp, sp, addr, true, size, exp, true);
231 NOINLINE INTERFACE_ATTRIBUTE
232 void __asan_storeN_noabort(uptr addr, uptr size) {
233 if (__asan_region_is_poisoned(addr, size)) {
235 ReportGenericError(pc, bp, sp, addr, true, size, 0, false);
239 // Force the linker to keep the symbols for various ASan interface functions.
240 // We want to keep those in the executable in order to let the instrumented
241 // dynamic libraries access the symbol even if it is not used by the executable
242 // itself. This should help if the build system is removing dead code at link
244 static NOINLINE void force_interface_symbols() {
245 volatile int fake_condition = 0; // prevent dead condition elimination.
246 // __asan_report_* functions are noreturn, so we need a switch to prevent
247 // the compiler from removing any of them.
249 switch (fake_condition) {
250 case 1: __asan_report_load1(0); break;
251 case 2: __asan_report_load2(0); break;
252 case 3: __asan_report_load4(0); break;
253 case 4: __asan_report_load8(0); break;
254 case 5: __asan_report_load16(0); break;
255 case 6: __asan_report_load_n(0, 0); break;
256 case 7: __asan_report_store1(0); break;
257 case 8: __asan_report_store2(0); break;
258 case 9: __asan_report_store4(0); break;
259 case 10: __asan_report_store8(0); break;
260 case 11: __asan_report_store16(0); break;
261 case 12: __asan_report_store_n(0, 0); break;
262 case 13: __asan_report_exp_load1(0, 0); break;
263 case 14: __asan_report_exp_load2(0, 0); break;
264 case 15: __asan_report_exp_load4(0, 0); break;
265 case 16: __asan_report_exp_load8(0, 0); break;
266 case 17: __asan_report_exp_load16(0, 0); break;
267 case 18: __asan_report_exp_load_n(0, 0, 0); break;
268 case 19: __asan_report_exp_store1(0, 0); break;
269 case 20: __asan_report_exp_store2(0, 0); break;
270 case 21: __asan_report_exp_store4(0, 0); break;
271 case 22: __asan_report_exp_store8(0, 0); break;
272 case 23: __asan_report_exp_store16(0, 0); break;
273 case 24: __asan_report_exp_store_n(0, 0, 0); break;
274 case 25: __asan_register_globals(nullptr, 0); break;
275 case 26: __asan_unregister_globals(nullptr, 0); break;
276 case 27: __asan_set_death_callback(nullptr); break;
277 case 28: __asan_set_error_report_callback(nullptr); break;
278 case 29: __asan_handle_no_return(); break;
279 case 30: __asan_address_is_poisoned(nullptr); break;
280 case 31: __asan_poison_memory_region(nullptr, 0); break;
281 case 32: __asan_unpoison_memory_region(nullptr, 0); break;
282 case 34: __asan_before_dynamic_init(nullptr); break;
283 case 35: __asan_after_dynamic_init(); break;
284 case 36: __asan_poison_stack_memory(0, 0); break;
285 case 37: __asan_unpoison_stack_memory(0, 0); break;
286 case 38: __asan_region_is_poisoned(0, 0); break;
287 case 39: __asan_describe_address(0); break;
288 case 40: __asan_set_shadow_00(0, 0); break;
289 case 41: __asan_set_shadow_f1(0, 0); break;
290 case 42: __asan_set_shadow_f2(0, 0); break;
291 case 43: __asan_set_shadow_f3(0, 0); break;
292 case 44: __asan_set_shadow_f5(0, 0); break;
293 case 45: __asan_set_shadow_f8(0, 0); break;
298 static void asan_atexit() {
299 Printf("AddressSanitizer exit stats:\n");
300 __asan_print_accumulated_stats();
301 // Print AsanMappingProfile.
302 for (uptr i = 0; i < kAsanMappingProfileSize; i++) {
303 if (AsanMappingProfile[i] == 0) continue;
304 Printf("asan_mapping.h:%zd -- %zd\n", i, AsanMappingProfile[i]);
308 static void InitializeHighMemEnd() {
309 #if !ASAN_FIXED_MAPPING
310 kHighMemEnd = GetMaxUserVirtualAddress();
311 // Increase kHighMemEnd to make sure it's properly
312 // aligned together with kHighMemBeg:
313 kHighMemEnd |= SHADOW_GRANULARITY * GetMmapGranularity() - 1;
314 #endif // !ASAN_FIXED_MAPPING
315 CHECK_EQ((kHighMemBeg % GetMmapGranularity()), 0);
318 void PrintAddressSpaceLayout() {
319 Printf("|| `[%p, %p]` || HighMem ||\n",
320 (void*)kHighMemBeg, (void*)kHighMemEnd);
321 Printf("|| `[%p, %p]` || HighShadow ||\n",
322 (void*)kHighShadowBeg, (void*)kHighShadowEnd);
324 Printf("|| `[%p, %p]` || ShadowGap3 ||\n",
325 (void*)kShadowGap3Beg, (void*)kShadowGap3End);
326 Printf("|| `[%p, %p]` || MidMem ||\n",
327 (void*)kMidMemBeg, (void*)kMidMemEnd);
328 Printf("|| `[%p, %p]` || ShadowGap2 ||\n",
329 (void*)kShadowGap2Beg, (void*)kShadowGap2End);
330 Printf("|| `[%p, %p]` || MidShadow ||\n",
331 (void*)kMidShadowBeg, (void*)kMidShadowEnd);
333 Printf("|| `[%p, %p]` || ShadowGap ||\n",
334 (void*)kShadowGapBeg, (void*)kShadowGapEnd);
336 Printf("|| `[%p, %p]` || LowShadow ||\n",
337 (void*)kLowShadowBeg, (void*)kLowShadowEnd);
338 Printf("|| `[%p, %p]` || LowMem ||\n",
339 (void*)kLowMemBeg, (void*)kLowMemEnd);
341 Printf("MemToShadow(shadow): %p %p %p %p",
342 (void*)MEM_TO_SHADOW(kLowShadowBeg),
343 (void*)MEM_TO_SHADOW(kLowShadowEnd),
344 (void*)MEM_TO_SHADOW(kHighShadowBeg),
345 (void*)MEM_TO_SHADOW(kHighShadowEnd));
348 (void*)MEM_TO_SHADOW(kMidShadowBeg),
349 (void*)MEM_TO_SHADOW(kMidShadowEnd));
352 Printf("redzone=%zu\n", (uptr)flags()->redzone);
353 Printf("max_redzone=%zu\n", (uptr)flags()->max_redzone);
354 Printf("quarantine_size_mb=%zuM\n", (uptr)flags()->quarantine_size_mb);
355 Printf("thread_local_quarantine_size_kb=%zuK\n",
356 (uptr)flags()->thread_local_quarantine_size_kb);
357 Printf("malloc_context_size=%zu\n",
358 (uptr)common_flags()->malloc_context_size);
360 Printf("SHADOW_SCALE: %d\n", (int)SHADOW_SCALE);
361 Printf("SHADOW_GRANULARITY: %d\n", (int)SHADOW_GRANULARITY);
362 Printf("SHADOW_OFFSET: 0x%zx\n", (uptr)SHADOW_OFFSET);
363 CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7);
365 CHECK(kMidShadowBeg > kLowShadowEnd &&
366 kMidMemBeg > kMidShadowEnd &&
367 kHighShadowBeg > kMidMemEnd);
370 static void AsanInitInternal() {
371 if (LIKELY(asan_inited)) return;
372 SanitizerToolName = "AddressSanitizer";
373 CHECK(!asan_init_is_running && "ASan init calls itself!");
374 asan_init_is_running = true;
378 // Initialize flags. This must be done early, because most of the
379 // initialization steps look at flags().
382 AsanCheckIncompatibleRT();
383 AsanCheckDynamicRTPrereqs();
384 AvoidCVE_2016_2143();
386 SetCanPoisonMemory(flags()->poison_heap);
387 SetMallocContextSize(common_flags()->malloc_context_size);
389 InitializePlatformExceptionHandlers();
391 InitializeHighMemEnd();
393 // Make sure we are not statically linked.
394 AsanDoesNotSupportStaticLinkage();
396 // Install tool-specific callbacks in sanitizer_common.
397 AddDieCallback(AsanDie);
398 SetCheckFailedCallback(AsanCheckFailed);
399 SetPrintfAndReportCallback(AppendToErrorMessageBuffer);
401 __sanitizer_set_report_path(common_flags()->log_path);
403 __asan_option_detect_stack_use_after_return =
404 flags()->detect_stack_use_after_return;
406 // Re-exec ourselves if we need to set additional env or command line args.
409 // Setup internal allocator callback.
410 SetLowLevelAllocateMinAlignment(SHADOW_GRANULARITY);
411 SetLowLevelAllocateCallback(OnLowLevelAllocate);
413 InitializeAsanInterceptors();
415 // Enable system log ("adb logcat") on Android.
416 // Doing this before interceptors are initialized crashes in:
417 // AsanInitInternal -> android_log_write -> __interceptor_strcmp
420 ReplaceSystemMalloc();
422 DisableCoreDumperIfNecessary();
424 InitializeShadowMemory();
426 AsanTSDInit(PlatformTSDDtor);
427 InstallDeadlySignalHandlers(AsanOnDeadlySignal);
429 AllocatorOptions allocator_options;
430 allocator_options.SetFrom(flags(), common_flags());
431 InitializeAllocator(allocator_options);
433 MaybeStartBackgroudThread();
434 SetSoftRssLimitExceededCallback(AsanSoftRssLimitExceededCallback);
436 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
437 // should be set to 1 prior to initializing the threads.
439 asan_init_is_running = false;
444 InitializeCoverage(common_flags()->coverage, common_flags()->coverage_dir);
446 // Now that ASan runtime is (mostly) initialized, deactivate it if
447 // necessary, so that it can be re-activated when requested.
448 if (flags()->start_deactivated)
454 // Create main thread.
455 AsanThread *main_thread = CreateMainThread();
456 CHECK_EQ(0, main_thread->tid());
457 force_interface_symbols(); // no-op.
458 SanitizerInitializeUnwinder();
460 if (CAN_SANITIZE_LEAKS) {
461 __lsan::InitCommonLsan();
462 if (common_flags()->detect_leaks && common_flags()->leak_check_at_exit) {
463 if (flags()->halt_on_error)
464 Atexit(__lsan::DoLeakCheck);
466 Atexit(__lsan::DoRecoverableLeakCheckVoid);
471 __ubsan::InitAsPlugin();
474 InitializeSuppressions();
476 if (CAN_SANITIZE_LEAKS) {
477 // LateInitialize() calls dlsym, which can allocate an error string buffer
478 // in the TLS. Let's ignore the allocation to avoid reporting a leak.
479 __lsan::ScopedInterceptorDisabler disabler;
480 Symbolizer::LateInitialize();
482 Symbolizer::LateInitialize();
485 VReport(1, "AddressSanitizer Init done\n");
487 if (flags()->sleep_after_init) {
488 Report("Sleeping for %d second(s)\n", flags()->sleep_after_init);
489 SleepForSeconds(flags()->sleep_after_init);
493 // Initialize as requested from some part of ASan runtime library (interceptors,
495 void AsanInitFromRtl() {
500 // Initialize runtime in case it's LD_PRELOAD-ed into unsanitized executable
501 // (and thus normal initializers from .preinit_array or modules haven't run).
503 class AsanInitializer {
510 static AsanInitializer asan_initializer;
511 #endif // ASAN_DYNAMIC
513 } // namespace __asan
515 // ---------------------- Interface ---------------- {{{1
516 using namespace __asan; // NOLINT
518 void NOINLINE __asan_handle_no_return() {
519 if (asan_init_is_running)
523 AsanThread *curr_thread = GetCurrentThread();
524 uptr PageSize = GetPageSizeCached();
527 top = curr_thread->stack_top();
528 bottom = ((uptr)&local_stack - PageSize) & ~(PageSize - 1);
530 CHECK(!SANITIZER_FUCHSIA);
531 // If we haven't seen this thread, try asking the OS for stack bounds.
532 uptr tls_addr, tls_size, stack_size;
533 GetThreadStackAndTls(/*main=*/false, &bottom, &stack_size, &tls_addr,
535 top = bottom + stack_size;
537 static const uptr kMaxExpectedCleanupSize = 64 << 20; // 64M
538 if (top - bottom > kMaxExpectedCleanupSize) {
539 static bool reported_warning = false;
540 if (reported_warning)
542 reported_warning = true;
543 Report("WARNING: ASan is ignoring requested __asan_handle_no_return: "
544 "stack top: %p; bottom %p; size: %p (%zd)\n"
545 "False positive error reports may follow\n"
547 "https://github.com/google/sanitizers/issues/189\n",
548 top, bottom, top - bottom, top - bottom);
551 PoisonShadow(bottom, top - bottom, 0);
552 if (curr_thread && curr_thread->has_fake_stack())
553 curr_thread->fake_stack()->HandleNoReturn();
556 void NOINLINE __asan_set_death_callback(void (*callback)(void)) {
557 SetUserDieCallback(callback);
560 // Initialize as requested from instrumented application code.
561 // We use this call as a trigger to wake up ASan from deactivated state.
567 void __asan_version_mismatch_check() {