1 //===-- msan.h --------------------------------------------------*- C++ -*-===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file is a part of MemorySanitizer.
12 // Private MSan header.
13 //===----------------------------------------------------------------------===//
18 #include "sanitizer_common/sanitizer_flags.h"
19 #include "sanitizer_common/sanitizer_internal_defs.h"
20 #include "sanitizer_common/sanitizer_stacktrace.h"
21 #include "msan_interface_internal.h"
22 #include "msan_flags.h"
23 #include "ubsan/ubsan_platform.h"
25 #ifndef MSAN_REPLACE_OPERATORS_NEW_AND_DELETE
26 # define MSAN_REPLACE_OPERATORS_NEW_AND_DELETE 1
29 #ifndef MSAN_CONTAINS_UBSAN
30 # define MSAN_CONTAINS_UBSAN CAN_SANITIZE_UB
37 INVALID, APP, SHADOW, ORIGIN
43 #if SANITIZER_LINUX && defined(__mips64)
46 // - 0x0000000000-0x0200000000: Program own segments
47 // - 0xa200000000-0xc000000000: PIE program segments
48 // - 0xe200000000-0xffffffffff: libraries segments.
49 const MappingDesc kMemoryLayout[] = {
50 {0x000000000000ULL, 0x000200000000ULL, MappingDesc::APP, "app-1"},
51 {0x000200000000ULL, 0x002200000000ULL, MappingDesc::INVALID, "invalid"},
52 {0x002200000000ULL, 0x004000000000ULL, MappingDesc::SHADOW, "shadow-2"},
53 {0x004000000000ULL, 0x004200000000ULL, MappingDesc::INVALID, "invalid"},
54 {0x004200000000ULL, 0x006000000000ULL, MappingDesc::ORIGIN, "origin-2"},
55 {0x006000000000ULL, 0x006200000000ULL, MappingDesc::INVALID, "invalid"},
56 {0x006200000000ULL, 0x008000000000ULL, MappingDesc::SHADOW, "shadow-3"},
57 {0x008000000000ULL, 0x008200000000ULL, MappingDesc::SHADOW, "shadow-1"},
58 {0x008200000000ULL, 0x00a000000000ULL, MappingDesc::ORIGIN, "origin-3"},
59 {0x00a000000000ULL, 0x00a200000000ULL, MappingDesc::ORIGIN, "origin-1"},
60 {0x00a200000000ULL, 0x00c000000000ULL, MappingDesc::APP, "app-2"},
61 {0x00c000000000ULL, 0x00e200000000ULL, MappingDesc::INVALID, "invalid"},
62 {0x00e200000000ULL, 0x00ffffffffffULL, MappingDesc::APP, "app-3"}};
64 #define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x8000000000ULL)
65 #define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x2000000000ULL)
67 #elif SANITIZER_LINUX && defined(__aarch64__)
69 // The mapping describes both 39-bits, 42-bits, and 48-bits VMA. AArch64
71 // - 0x0000000000000-0x0000010000000: 39/42/48-bits program own segments
72 // - 0x0005500000000-0x0005600000000: 39-bits PIE program segments
73 // - 0x0007f80000000-0x0007fffffffff: 39-bits libraries segments
74 // - 0x002aa00000000-0x002ab00000000: 42-bits PIE program segments
75 // - 0x003ff00000000-0x003ffffffffff: 42-bits libraries segments
76 // - 0x0aaaaa0000000-0x0aaab00000000: 48-bits PIE program segments
77 // - 0xffff000000000-0x1000000000000: 48-bits libraries segments
78 // It is fragmented in multiples segments to increase the memory available
79 // on 42-bits (12.21% of total VMA available for 42-bits and 13.28 for
80 // 39 bits). The 48-bits segments only cover the usual PIE/default segments
81 // plus some more segments (262144GB total, 0.39% total VMA).
82 const MappingDesc kMemoryLayout[] = {
83 {0x00000000000ULL, 0x01000000000ULL, MappingDesc::INVALID, "invalid"},
84 {0x01000000000ULL, 0x02000000000ULL, MappingDesc::SHADOW, "shadow-2"},
85 {0x02000000000ULL, 0x03000000000ULL, MappingDesc::ORIGIN, "origin-2"},
86 {0x03000000000ULL, 0x04000000000ULL, MappingDesc::SHADOW, "shadow-1"},
87 {0x04000000000ULL, 0x05000000000ULL, MappingDesc::ORIGIN, "origin-1"},
88 {0x05000000000ULL, 0x06000000000ULL, MappingDesc::APP, "app-1"},
89 {0x06000000000ULL, 0x07000000000ULL, MappingDesc::INVALID, "invalid"},
90 {0x07000000000ULL, 0x08000000000ULL, MappingDesc::APP, "app-2"},
91 {0x08000000000ULL, 0x09000000000ULL, MappingDesc::INVALID, "invalid"},
92 // The mappings below are used only for 42-bits VMA.
93 {0x09000000000ULL, 0x0A000000000ULL, MappingDesc::SHADOW, "shadow-3"},
94 {0x0A000000000ULL, 0x0B000000000ULL, MappingDesc::ORIGIN, "origin-3"},
95 {0x0B000000000ULL, 0x0F000000000ULL, MappingDesc::INVALID, "invalid"},
96 {0x0F000000000ULL, 0x10000000000ULL, MappingDesc::APP, "app-3"},
97 {0x10000000000ULL, 0x11000000000ULL, MappingDesc::INVALID, "invalid"},
98 {0x11000000000ULL, 0x12000000000ULL, MappingDesc::APP, "app-4"},
99 {0x12000000000ULL, 0x17000000000ULL, MappingDesc::INVALID, "invalid"},
100 {0x17000000000ULL, 0x18000000000ULL, MappingDesc::SHADOW, "shadow-4"},
101 {0x18000000000ULL, 0x19000000000ULL, MappingDesc::ORIGIN, "origin-4"},
102 {0x19000000000ULL, 0x20000000000ULL, MappingDesc::INVALID, "invalid"},
103 {0x20000000000ULL, 0x21000000000ULL, MappingDesc::APP, "app-5"},
104 {0x21000000000ULL, 0x26000000000ULL, MappingDesc::INVALID, "invalid"},
105 {0x26000000000ULL, 0x27000000000ULL, MappingDesc::SHADOW, "shadow-5"},
106 {0x27000000000ULL, 0x28000000000ULL, MappingDesc::ORIGIN, "origin-5"},
107 {0x28000000000ULL, 0x29000000000ULL, MappingDesc::SHADOW, "shadow-7"},
108 {0x29000000000ULL, 0x2A000000000ULL, MappingDesc::ORIGIN, "origin-7"},
109 {0x2A000000000ULL, 0x2B000000000ULL, MappingDesc::APP, "app-6"},
110 {0x2B000000000ULL, 0x2C000000000ULL, MappingDesc::INVALID, "invalid"},
111 {0x2C000000000ULL, 0x2D000000000ULL, MappingDesc::SHADOW, "shadow-6"},
112 {0x2D000000000ULL, 0x2E000000000ULL, MappingDesc::ORIGIN, "origin-6"},
113 {0x2E000000000ULL, 0x2F000000000ULL, MappingDesc::APP, "app-7"},
114 {0x2F000000000ULL, 0x39000000000ULL, MappingDesc::INVALID, "invalid"},
115 {0x39000000000ULL, 0x3A000000000ULL, MappingDesc::SHADOW, "shadow-9"},
116 {0x3A000000000ULL, 0x3B000000000ULL, MappingDesc::ORIGIN, "origin-9"},
117 {0x3B000000000ULL, 0x3C000000000ULL, MappingDesc::APP, "app-8"},
118 {0x3C000000000ULL, 0x3D000000000ULL, MappingDesc::INVALID, "invalid"},
119 {0x3D000000000ULL, 0x3E000000000ULL, MappingDesc::SHADOW, "shadow-8"},
120 {0x3E000000000ULL, 0x3F000000000ULL, MappingDesc::ORIGIN, "origin-8"},
121 {0x3F000000000ULL, 0x40000000000ULL, MappingDesc::APP, "app-9"},
122 // The mappings below are used only for 48-bits VMA.
123 // TODO(unknown): 48-bit mapping ony covers the usual PIE, non-PIE
124 // segments and some more segments totalizing 262144GB of VMA (which cover
125 // only 0.32% of all 48-bit VMA). Memory avaliability can be increase by
126 // adding multiple application segments like 39 and 42 mapping.
127 {0x0040000000000ULL, 0x0041000000000ULL, MappingDesc::INVALID, "invalid"},
128 {0x0041000000000ULL, 0x0042000000000ULL, MappingDesc::APP, "app-10"},
129 {0x0042000000000ULL, 0x0047000000000ULL, MappingDesc::INVALID, "invalid"},
130 {0x0047000000000ULL, 0x0048000000000ULL, MappingDesc::SHADOW, "shadow-10"},
131 {0x0048000000000ULL, 0x0049000000000ULL, MappingDesc::ORIGIN, "origin-10"},
132 {0x0049000000000ULL, 0x0050000000000ULL, MappingDesc::INVALID, "invalid"},
133 {0x0050000000000ULL, 0x0051000000000ULL, MappingDesc::APP, "app-11"},
134 {0x0051000000000ULL, 0x0056000000000ULL, MappingDesc::INVALID, "invalid"},
135 {0x0056000000000ULL, 0x0057000000000ULL, MappingDesc::SHADOW, "shadow-11"},
136 {0x0057000000000ULL, 0x0058000000000ULL, MappingDesc::ORIGIN, "origin-11"},
137 {0x0058000000000ULL, 0x0059000000000ULL, MappingDesc::APP, "app-12"},
138 {0x0059000000000ULL, 0x005E000000000ULL, MappingDesc::INVALID, "invalid"},
139 {0x005E000000000ULL, 0x005F000000000ULL, MappingDesc::SHADOW, "shadow-12"},
140 {0x005F000000000ULL, 0x0060000000000ULL, MappingDesc::ORIGIN, "origin-12"},
141 {0x0060000000000ULL, 0x0061000000000ULL, MappingDesc::INVALID, "invalid"},
142 {0x0061000000000ULL, 0x0062000000000ULL, MappingDesc::APP, "app-13"},
143 {0x0062000000000ULL, 0x0067000000000ULL, MappingDesc::INVALID, "invalid"},
144 {0x0067000000000ULL, 0x0068000000000ULL, MappingDesc::SHADOW, "shadow-13"},
145 {0x0068000000000ULL, 0x0069000000000ULL, MappingDesc::ORIGIN, "origin-13"},
146 {0x0069000000000ULL, 0x0AAAAA0000000ULL, MappingDesc::INVALID, "invalid"},
147 {0x0AAAAA0000000ULL, 0x0AAAB00000000ULL, MappingDesc::APP, "app-14"},
148 {0x0AAAB00000000ULL, 0x0AACAA0000000ULL, MappingDesc::INVALID, "invalid"},
149 {0x0AACAA0000000ULL, 0x0AACB00000000ULL, MappingDesc::SHADOW, "shadow-14"},
150 {0x0AACB00000000ULL, 0x0AADAA0000000ULL, MappingDesc::INVALID, "invalid"},
151 {0x0AADAA0000000ULL, 0x0AADB00000000ULL, MappingDesc::ORIGIN, "origin-14"},
152 {0x0AADB00000000ULL, 0x0FF9F00000000ULL, MappingDesc::INVALID, "invalid"},
153 {0x0FF9F00000000ULL, 0x0FFA000000000ULL, MappingDesc::SHADOW, "shadow-15"},
154 {0x0FFA000000000ULL, 0x0FFAF00000000ULL, MappingDesc::INVALID, "invalid"},
155 {0x0FFAF00000000ULL, 0x0FFB000000000ULL, MappingDesc::ORIGIN, "origin-15"},
156 {0x0FFB000000000ULL, 0x0FFFF00000000ULL, MappingDesc::INVALID, "invalid"},
157 {0x0FFFF00000000ULL, 0x1000000000000ULL, MappingDesc::APP, "app-15"},
159 # define MEM_TO_SHADOW(mem) ((uptr)mem ^ 0x6000000000ULL)
160 # define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x1000000000ULL)
162 #elif SANITIZER_LINUX && SANITIZER_PPC64
164 const MappingDesc kMemoryLayout[] = {
165 {0x000000000000ULL, 0x000100000000ULL, MappingDesc::APP, "low memory"},
166 {0x000100000000ULL, 0x080000000000ULL, MappingDesc::INVALID, "invalid"},
167 {0x080000000000ULL, 0x180100000000ULL, MappingDesc::SHADOW, "shadow"},
168 {0x180100000000ULL, 0x1C0000000000ULL, MappingDesc::INVALID, "invalid"},
169 {0x1C0000000000ULL, 0x2C0100000000ULL, MappingDesc::ORIGIN, "origin"},
170 {0x2C0100000000ULL, 0x300000000000ULL, MappingDesc::INVALID, "invalid"},
171 {0x300000000000ULL, 0x400000000000ULL, MappingDesc::APP, "high memory"}};
173 // Maps low and high app ranges to contiguous space with zero base:
174 // Low: 0000 0000 0000 - 0000 ffff ffff -> 1000 0000 0000 - 1000 ffff ffff
175 // High: 3000 0000 0000 - 3fff ffff ffff -> 0000 0000 0000 - 0fff ffff ffff
176 #define LINEARIZE_MEM(mem) \
177 (((uptr)(mem) & ~0x200000000000ULL) ^ 0x100000000000ULL)
178 #define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x080000000000ULL)
179 #define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x140000000000ULL)
181 #elif SANITIZER_FREEBSD && SANITIZER_WORDSIZE == 64
183 // Low memory: main binary, MAP_32BIT mappings and modules
184 // High memory: heap, modules and main thread stack
185 const MappingDesc kMemoryLayout[] = {
186 {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "low memory"},
187 {0x010000000000ULL, 0x100000000000ULL, MappingDesc::INVALID, "invalid"},
188 {0x100000000000ULL, 0x310000000000ULL, MappingDesc::SHADOW, "shadow"},
189 {0x310000000000ULL, 0x380000000000ULL, MappingDesc::INVALID, "invalid"},
190 {0x380000000000ULL, 0x590000000000ULL, MappingDesc::ORIGIN, "origin"},
191 {0x590000000000ULL, 0x600000000000ULL, MappingDesc::INVALID, "invalid"},
192 {0x600000000000ULL, 0x800000000000ULL, MappingDesc::APP, "high memory"}};
194 // Maps low and high app ranges to contiguous space with zero base:
195 // Low: 0000 0000 0000 - 00ff ffff ffff -> 2000 0000 0000 - 20ff ffff ffff
196 // High: 6000 0000 0000 - 7fff ffff ffff -> 0000 0000 0000 - 1fff ffff ffff
197 #define LINEARIZE_MEM(mem) \
198 (((uptr)(mem) & ~0xc00000000000ULL) ^ 0x200000000000ULL)
199 #define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x100000000000ULL)
200 #define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x280000000000)
202 #elif SANITIZER_LINUX && SANITIZER_WORDSIZE == 64
204 #ifdef MSAN_LINUX_X86_64_OLD_MAPPING
205 // Requries PIE binary and ASLR enabled.
206 // Main thread stack and DSOs at 0x7f0000000000 (sometimes 0x7e0000000000).
207 // Heap at 0x600000000000.
208 const MappingDesc kMemoryLayout[] = {
209 {0x000000000000ULL, 0x200000000000ULL, MappingDesc::INVALID, "invalid"},
210 {0x200000000000ULL, 0x400000000000ULL, MappingDesc::SHADOW, "shadow"},
211 {0x400000000000ULL, 0x600000000000ULL, MappingDesc::ORIGIN, "origin"},
212 {0x600000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app"}};
214 #define MEM_TO_SHADOW(mem) (((uptr)(mem)) & ~0x400000000000ULL)
215 #define SHADOW_TO_ORIGIN(mem) (((uptr)(mem)) + 0x200000000000ULL)
216 #else // MSAN_LINUX_X86_64_OLD_MAPPING
217 // All of the following configurations are supported.
218 // ASLR disabled: main executable and DSOs at 0x555550000000
219 // PIE and ASLR: main executable and DSOs at 0x7f0000000000
220 // non-PIE: main executable below 0x100000000, DSOs at 0x7f0000000000
221 // Heap at 0x700000000000.
222 const MappingDesc kMemoryLayout[] = {
223 {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app-1"},
224 {0x010000000000ULL, 0x100000000000ULL, MappingDesc::SHADOW, "shadow-2"},
225 {0x100000000000ULL, 0x110000000000ULL, MappingDesc::INVALID, "invalid"},
226 {0x110000000000ULL, 0x200000000000ULL, MappingDesc::ORIGIN, "origin-2"},
227 {0x200000000000ULL, 0x300000000000ULL, MappingDesc::SHADOW, "shadow-3"},
228 {0x300000000000ULL, 0x400000000000ULL, MappingDesc::ORIGIN, "origin-3"},
229 {0x400000000000ULL, 0x500000000000ULL, MappingDesc::INVALID, "invalid"},
230 {0x500000000000ULL, 0x510000000000ULL, MappingDesc::SHADOW, "shadow-1"},
231 {0x510000000000ULL, 0x600000000000ULL, MappingDesc::APP, "app-2"},
232 {0x600000000000ULL, 0x610000000000ULL, MappingDesc::ORIGIN, "origin-1"},
233 {0x610000000000ULL, 0x700000000000ULL, MappingDesc::INVALID, "invalid"},
234 {0x700000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app-3"}};
235 #define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x500000000000ULL)
236 #define SHADOW_TO_ORIGIN(mem) (((uptr)(mem)) + 0x100000000000ULL)
237 #endif // MSAN_LINUX_X86_64_OLD_MAPPING
240 #error "Unsupported platform"
243 const uptr kMemoryLayoutSize = sizeof(kMemoryLayout) / sizeof(kMemoryLayout[0]);
245 #define MEM_TO_ORIGIN(mem) (SHADOW_TO_ORIGIN(MEM_TO_SHADOW((mem))))
248 __attribute__((optimize("unroll-loops")))
250 inline bool addr_is_type(uptr addr, MappingDesc::Type mapping_type) {
251 // It is critical for performance that this loop is unrolled (because then it is
252 // simplified into just a few constant comparisons).
256 for (unsigned i = 0; i < kMemoryLayoutSize; ++i)
257 if (kMemoryLayout[i].type == mapping_type &&
258 addr >= kMemoryLayout[i].start && addr < kMemoryLayout[i].end)
263 #define MEM_IS_APP(mem) addr_is_type((uptr)(mem), MappingDesc::APP)
264 #define MEM_IS_SHADOW(mem) addr_is_type((uptr)(mem), MappingDesc::SHADOW)
265 #define MEM_IS_ORIGIN(mem) addr_is_type((uptr)(mem), MappingDesc::ORIGIN)
267 // These constants must be kept in sync with the ones in MemorySanitizer.cc.
268 const int kMsanParamTlsSize = 800;
269 const int kMsanRetvalTlsSize = 800;
272 extern int msan_inited;
273 extern bool msan_init_is_running;
274 extern int msan_report_count;
276 bool ProtectRange(uptr beg, uptr end);
277 bool InitShadow(bool init_origins);
278 char *GetProcSelfMaps();
279 void InitializeInterceptors();
281 void MsanAllocatorInit();
282 void MsanAllocatorThreadFinish();
283 void MsanDeallocate(StackTrace *stack, void *ptr);
285 void *msan_malloc(uptr size, StackTrace *stack);
286 void *msan_calloc(uptr nmemb, uptr size, StackTrace *stack);
287 void *msan_realloc(void *ptr, uptr size, StackTrace *stack);
288 void *msan_valloc(uptr size, StackTrace *stack);
289 void *msan_pvalloc(uptr size, StackTrace *stack);
290 void *msan_aligned_alloc(uptr alignment, uptr size, StackTrace *stack);
291 void *msan_memalign(uptr alignment, uptr size, StackTrace *stack);
292 int msan_posix_memalign(void **memptr, uptr alignment, uptr size,
295 void InstallTrapHandler();
296 void InstallAtExitHandler();
298 const char *GetStackOriginDescr(u32 id, uptr *pc);
300 void EnterSymbolizer();
301 void ExitSymbolizer();
302 bool IsInSymbolizer();
304 struct SymbolizerScope {
305 SymbolizerScope() { EnterSymbolizer(); }
306 ~SymbolizerScope() { ExitSymbolizer(); }
309 void PrintWarning(uptr pc, uptr bp);
310 void PrintWarningWithOrigin(uptr pc, uptr bp, u32 origin);
312 void GetStackTrace(BufferedStackTrace *stack, uptr max_s, uptr pc, uptr bp,
313 bool request_fast_unwind);
315 void ReportUMR(StackTrace *stack, u32 origin);
316 void ReportExpectedUMRNotFound(StackTrace *stack);
318 void ReportAtExitStatistics();
319 void DescribeMemoryRange(const void *x, uptr size);
320 void ReportUMRInsideAddressRange(const char *what, const void *start, uptr size,
323 // Unpoison first n function arguments.
324 void UnpoisonParam(uptr n);
325 void UnpoisonThreadLocalState();
327 // Returns a "chained" origin id, pointing to the given stack trace followed by
328 // the previous origin id.
329 u32 ChainOrigin(u32 id, StackTrace *stack);
331 const int STACK_TRACE_TAG_POISON = StackTrace::TAG_CUSTOM + 1;
333 #define GET_MALLOC_STACK_TRACE \
334 BufferedStackTrace stack; \
335 if (__msan_get_track_origins() && msan_inited) \
336 GetStackTrace(&stack, common_flags()->malloc_context_size, \
337 StackTrace::GetCurrentPc(), GET_CURRENT_FRAME(), \
338 common_flags()->fast_unwind_on_malloc)
340 // For platforms which support slow unwinder only, we restrict the store context
341 // size to 1, basically only storing the current pc. We do this because the slow
342 // unwinder which is based on libunwind is not async signal safe and causes
343 // random freezes in forking applications as well as in signal handlers.
344 #define GET_STORE_STACK_TRACE_PC_BP(pc, bp) \
345 BufferedStackTrace stack; \
346 if (__msan_get_track_origins() > 1 && msan_inited) { \
347 if (!SANITIZER_CAN_FAST_UNWIND) \
348 GetStackTrace(&stack, Min(1, flags()->store_context_size), pc, bp, \
351 GetStackTrace(&stack, flags()->store_context_size, pc, bp, \
352 common_flags()->fast_unwind_on_malloc); \
355 #define GET_FATAL_STACK_TRACE_PC_BP(pc, bp) \
356 BufferedStackTrace stack; \
358 GetStackTrace(&stack, kStackTraceMax, pc, bp, \
359 common_flags()->fast_unwind_on_fatal)
361 #define GET_STORE_STACK_TRACE \
362 GET_STORE_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())
364 class ScopedThreadLocalStateBackup {
366 ScopedThreadLocalStateBackup() { Backup(); }
367 ~ScopedThreadLocalStateBackup() { Restore(); }
371 u64 va_arg_overflow_size_tls;
374 void MsanTSDInit(void (*destructor)(void *tsd));
376 void MsanTSDSet(void *tsd);
377 void MsanTSDDtor(void *tsd);
379 } // namespace __msan
381 #define MSAN_MALLOC_HOOK(ptr, size) \
383 if (&__sanitizer_malloc_hook) { \
385 __sanitizer_malloc_hook(ptr, size); \
387 RunMallocHooks(ptr, size); \
389 #define MSAN_FREE_HOOK(ptr) \
391 if (&__sanitizer_free_hook) { \
393 __sanitizer_free_hook(ptr); \