contrib/compiler-rt/lib/msan/msan.h

   1 //===-- msan.h --------------------------------------------------*- C++ -*-===//
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 // This file is a part of MemorySanitizer.
  11 //
  12 // Private MSan header.
  13 //===----------------------------------------------------------------------===//
  14
  15 #ifndef MSAN_H
  16 #define MSAN_H
  17
  18 #include "sanitizer_common/sanitizer_flags.h"
  19 #include "sanitizer_common/sanitizer_internal_defs.h"
  20 #include "sanitizer_common/sanitizer_stacktrace.h"
  21 #include "msan_interface_internal.h"
  22 #include "msan_flags.h"
  23 #include "ubsan/ubsan_platform.h"
  24
  25 #ifndef MSAN_REPLACE_OPERATORS_NEW_AND_DELETE
  26 # define MSAN_REPLACE_OPERATORS_NEW_AND_DELETE 1
  27 #endif
  28
  29 #ifndef MSAN_CONTAINS_UBSAN
  30 # define MSAN_CONTAINS_UBSAN CAN_SANITIZE_UB
  31 #endif
  32
  33 struct MappingDesc {
  34   uptr start;
  35   uptr end;
  36   enum Type {
  37     INVALID, APP, SHADOW, ORIGIN
  38   } type;
  39   const char *name;
  40 };
  41
  42
  43 #if SANITIZER_LINUX && defined(__mips64)
  44
  45 // Everything is above 0x00e000000000.
  46 const MappingDesc kMemoryLayout[] = {
  47     {0x000000000000ULL, 0x00a000000000ULL, MappingDesc::INVALID, "invalid"},
  48     {0x00a000000000ULL, 0x00c000000000ULL, MappingDesc::SHADOW, "shadow"},
  49     {0x00c000000000ULL, 0x00e000000000ULL, MappingDesc::ORIGIN, "origin"},
  50     {0x00e000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app"}};
  51
  52 #define MEM_TO_SHADOW(mem) (((uptr)(mem)) & ~0x4000000000ULL)
  53 #define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x002000000000)
  54
  55 #elif SANITIZER_LINUX && defined(__aarch64__)
  56
  57 // The mapping describes both 39-bits and 42-bits.  AArch64 maps:
  58 // - 0x00000000000-0x00010000000: 39/42-bits program own segments
  59 // - 0x05500000000-0x05600000000: 39-bits PIE program segments
  60 // - 0x07f80000000-0x07fffffffff: 39-bits libraries segments
  61 // - 0x2aa00000000-0x2ab00000000: 42-bits PIE program segments
  62 // - 0x3ff00000000-0x3ffffffffff: 42-bits libraries segments
  63 // It is fragmented in multiples segments to increase the memory available
  64 // on 42-bits (12.21% of total VMA available for 42-bits and 13.28 for
  65 // 39 bits).
  66 const MappingDesc kMemoryLayout[] = {
  67     {0x00000000000ULL, 0x01000000000ULL, MappingDesc::INVALID, "invalid"},
  68     {0x01000000000ULL, 0x02000000000ULL, MappingDesc::SHADOW, "shadow-2"},
  69     {0x02000000000ULL, 0x03000000000ULL, MappingDesc::ORIGIN, "origin-2"},
  70     {0x03000000000ULL, 0x04000000000ULL, MappingDesc::SHADOW, "shadow-1"},
  71     {0x04000000000ULL, 0x05000000000ULL, MappingDesc::ORIGIN, "origin-1"},
  72     {0x05000000000ULL, 0x06000000000ULL, MappingDesc::APP, "app-1"},
  73     {0x06000000000ULL, 0x07000000000ULL, MappingDesc::INVALID, "invalid"},
  74     {0x07000000000ULL, 0x08000000000ULL, MappingDesc::APP, "app-2"},
  75     {0x08000000000ULL, 0x09000000000ULL, MappingDesc::INVALID, "invalid"},
  76     // The mappings below are used only for 42-bits VMA.
  77     {0x09000000000ULL, 0x0A000000000ULL, MappingDesc::SHADOW, "shadow-3"},
  78     {0x0A000000000ULL, 0x0B000000000ULL, MappingDesc::ORIGIN, "origin-3"},
  79     {0x0B000000000ULL, 0x0F000000000ULL, MappingDesc::INVALID, "invalid"},
  80     {0x0F000000000ULL, 0x10000000000ULL, MappingDesc::APP, "app-3"},
  81     {0x10000000000ULL, 0x11000000000ULL, MappingDesc::INVALID, "invalid"},
  82     {0x11000000000ULL, 0x12000000000ULL, MappingDesc::APP, "app-4"},
  83     {0x12000000000ULL, 0x17000000000ULL, MappingDesc::INVALID, "invalid"},
  84     {0x17000000000ULL, 0x18000000000ULL, MappingDesc::SHADOW, "shadow-4"},
  85     {0x18000000000ULL, 0x19000000000ULL, MappingDesc::ORIGIN, "origin-4"},
  86     {0x19000000000ULL, 0x20000000000ULL, MappingDesc::INVALID, "invalid"},
  87     {0x20000000000ULL, 0x21000000000ULL, MappingDesc::APP, "app-5"},
  88     {0x21000000000ULL, 0x26000000000ULL, MappingDesc::INVALID, "invalid"},
  89     {0x26000000000ULL, 0x27000000000ULL, MappingDesc::SHADOW, "shadow-5"},
  90     {0x27000000000ULL, 0x28000000000ULL, MappingDesc::ORIGIN, "origin-5"},
  91     {0x28000000000ULL, 0x29000000000ULL, MappingDesc::SHADOW, "shadow-7"},
  92     {0x29000000000ULL, 0x2A000000000ULL, MappingDesc::ORIGIN, "origin-7"},
  93     {0x2A000000000ULL, 0x2B000000000ULL, MappingDesc::APP, "app-6"},
  94     {0x2B000000000ULL, 0x2C000000000ULL, MappingDesc::INVALID, "invalid"},
  95     {0x2C000000000ULL, 0x2D000000000ULL, MappingDesc::SHADOW, "shadow-6"},
  96     {0x2D000000000ULL, 0x2E000000000ULL, MappingDesc::ORIGIN, "origin-6"},
  97     {0x2E000000000ULL, 0x2F000000000ULL, MappingDesc::APP, "app-7"},
  98     {0x2F000000000ULL, 0x39000000000ULL, MappingDesc::INVALID, "invalid"},
  99     {0x39000000000ULL, 0x3A000000000ULL, MappingDesc::SHADOW, "shadow-9"},
 100     {0x3A000000000ULL, 0x3B000000000ULL, MappingDesc::ORIGIN, "origin-9"},
 101     {0x3B000000000ULL, 0x3C000000000ULL, MappingDesc::APP, "app-8"},
 102     {0x3C000000000ULL, 0x3D000000000ULL, MappingDesc::INVALID, "invalid"},
 103     {0x3D000000000ULL, 0x3E000000000ULL, MappingDesc::SHADOW, "shadow-8"},
 104     {0x3E000000000ULL, 0x3F000000000ULL, MappingDesc::ORIGIN, "origin-8"},
 105     {0x3F000000000ULL, 0x40000000000ULL, MappingDesc::APP, "app-9"},
 106 };
 107 # define MEM_TO_SHADOW(mem) ((uptr)mem ^ 0x6000000000ULL)
 108 # define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x1000000000ULL)
 109
 110 #elif SANITIZER_LINUX && SANITIZER_PPC64
 111
 112 const MappingDesc kMemoryLayout[] = {
 113     {0x000000000000ULL, 0x000100000000ULL, MappingDesc::APP, "low memory"},
 114     {0x000100000000ULL, 0x080000000000ULL, MappingDesc::INVALID, "invalid"},
 115     {0x080000000000ULL, 0x180100000000ULL, MappingDesc::SHADOW, "shadow"},
 116     {0x180100000000ULL, 0x1C0000000000ULL, MappingDesc::INVALID, "invalid"},
 117     {0x1C0000000000ULL, 0x2C0100000000ULL, MappingDesc::ORIGIN, "origin"},
 118     {0x2C0100000000ULL, 0x300000000000ULL, MappingDesc::INVALID, "invalid"},
 119     {0x300000000000ULL, 0x400000000000ULL, MappingDesc::APP, "high memory"}};
 120
 121 // Maps low and high app ranges to contiguous space with zero base:
 122 //   Low:  0000 0000 0000 - 0000 ffff ffff  ->  1000 0000 0000 - 1000 ffff ffff
 123 //   High: 3000 0000 0000 - 3fff ffff ffff  ->  0000 0000 0000 - 0fff ffff ffff
 124 #define LINEARIZE_MEM(mem) \
 125   (((uptr)(mem) & ~0x200000000000ULL) ^ 0x100000000000ULL)
 126 #define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x080000000000ULL)
 127 #define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x140000000000ULL)
 128
 129 #elif SANITIZER_FREEBSD && SANITIZER_WORDSIZE == 64
 130
 131 // Low memory: main binary, MAP_32BIT mappings and modules
 132 // High memory: heap, modules and main thread stack
 133 const MappingDesc kMemoryLayout[] = {
 134     {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "low memory"},
 135     {0x010000000000ULL, 0x100000000000ULL, MappingDesc::INVALID, "invalid"},
 136     {0x100000000000ULL, 0x310000000000ULL, MappingDesc::SHADOW, "shadow"},
 137     {0x310000000000ULL, 0x380000000000ULL, MappingDesc::INVALID, "invalid"},
 138     {0x380000000000ULL, 0x590000000000ULL, MappingDesc::ORIGIN, "origin"},
 139     {0x590000000000ULL, 0x600000000000ULL, MappingDesc::INVALID, "invalid"},
 140     {0x600000000000ULL, 0x800000000000ULL, MappingDesc::APP, "high memory"}};
 141
 142 // Maps low and high app ranges to contiguous space with zero base:
 143 //   Low:  0000 0000 0000 - 00ff ffff ffff  ->  2000 0000 0000 - 20ff ffff ffff
 144 //   High: 6000 0000 0000 - 7fff ffff ffff  ->  0000 0000 0000 - 1fff ffff ffff
 145 #define LINEARIZE_MEM(mem) \
 146   (((uptr)(mem) & ~0xc00000000000ULL) ^ 0x200000000000ULL)
 147 #define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x100000000000ULL)
 148 #define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x280000000000)
 149
 150 #elif SANITIZER_LINUX && SANITIZER_WORDSIZE == 64
 151
 152 #ifdef MSAN_LINUX_X86_64_OLD_MAPPING
 153 // Requries PIE binary and ASLR enabled.
 154 // Main thread stack and DSOs at 0x7f0000000000 (sometimes 0x7e0000000000).
 155 // Heap at 0x600000000000.
 156 const MappingDesc kMemoryLayout[] = {
 157     {0x000000000000ULL, 0x200000000000ULL, MappingDesc::INVALID, "invalid"},
 158     {0x200000000000ULL, 0x400000000000ULL, MappingDesc::SHADOW, "shadow"},
 159     {0x400000000000ULL, 0x600000000000ULL, MappingDesc::ORIGIN, "origin"},
 160     {0x600000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app"}};
 161
 162 #define MEM_TO_SHADOW(mem) (((uptr)(mem)) & ~0x400000000000ULL)
 163 #define SHADOW_TO_ORIGIN(mem) (((uptr)(mem)) + 0x200000000000ULL)
 164 #else  // MSAN_LINUX_X86_64_OLD_MAPPING
 165 // All of the following configurations are supported.
 166 // ASLR disabled: main executable and DSOs at 0x555550000000
 167 // PIE and ASLR: main executable and DSOs at 0x7f0000000000
 168 // non-PIE: main executable below 0x100000000, DSOs at 0x7f0000000000
 169 // Heap at 0x700000000000.
 170 const MappingDesc kMemoryLayout[] = {
 171     {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app-1"},
 172     {0x010000000000ULL, 0x100000000000ULL, MappingDesc::SHADOW, "shadow-2"},
 173     {0x100000000000ULL, 0x110000000000ULL, MappingDesc::INVALID, "invalid"},
 174     {0x110000000000ULL, 0x200000000000ULL, MappingDesc::ORIGIN, "origin-2"},
 175     {0x200000000000ULL, 0x300000000000ULL, MappingDesc::SHADOW, "shadow-3"},
 176     {0x300000000000ULL, 0x400000000000ULL, MappingDesc::ORIGIN, "origin-3"},
 177     {0x400000000000ULL, 0x500000000000ULL, MappingDesc::INVALID, "invalid"},
 178     {0x500000000000ULL, 0x510000000000ULL, MappingDesc::SHADOW, "shadow-1"},
 179     {0x510000000000ULL, 0x600000000000ULL, MappingDesc::APP, "app-2"},
 180     {0x600000000000ULL, 0x610000000000ULL, MappingDesc::ORIGIN, "origin-1"},
 181     {0x610000000000ULL, 0x700000000000ULL, MappingDesc::INVALID, "invalid"},
 182     {0x700000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app-3"}};
 183 #define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x500000000000ULL)
 184 #define SHADOW_TO_ORIGIN(mem) (((uptr)(mem)) + 0x100000000000ULL)
 185 #endif  // MSAN_LINUX_X86_64_OLD_MAPPING
 186
 187 #else
 188 #error "Unsupported platform"
 189 #endif
 190
 191 const uptr kMemoryLayoutSize = sizeof(kMemoryLayout) / sizeof(kMemoryLayout[0]);
 192
 193 #define MEM_TO_ORIGIN(mem) (SHADOW_TO_ORIGIN(MEM_TO_SHADOW((mem))))
 194
 195 #ifndef __clang__
 196 __attribute__((optimize("unroll-loops")))
 197 #endif
 198 inline bool addr_is_type(uptr addr, MappingDesc::Type mapping_type) {
 199 // It is critical for performance that this loop is unrolled (because then it is
 200 // simplified into just a few constant comparisons).
 201 #ifdef __clang__
 202 #pragma unroll
 203 #endif
 204   for (unsigned i = 0; i < kMemoryLayoutSize; ++i)
 205     if (kMemoryLayout[i].type == mapping_type &&
 206         addr >= kMemoryLayout[i].start && addr < kMemoryLayout[i].end)
 207       return true;
 208   return false;
 209 }
 210
 211 #define MEM_IS_APP(mem) addr_is_type((uptr)(mem), MappingDesc::APP)
 212 #define MEM_IS_SHADOW(mem) addr_is_type((uptr)(mem), MappingDesc::SHADOW)
 213 #define MEM_IS_ORIGIN(mem) addr_is_type((uptr)(mem), MappingDesc::ORIGIN)
 214
 215 // These constants must be kept in sync with the ones in MemorySanitizer.cc.
 216 const int kMsanParamTlsSize = 800;
 217 const int kMsanRetvalTlsSize = 800;
 218
 219 namespace __msan {
 220 extern int msan_inited;
 221 extern bool msan_init_is_running;
 222 extern int msan_report_count;
 223
 224 bool ProtectRange(uptr beg, uptr end);
 225 bool InitShadow(bool init_origins);
 226 char *GetProcSelfMaps();
 227 void InitializeInterceptors();
 228
 229 void MsanAllocatorInit();
 230 void MsanAllocatorThreadFinish();
 231 void *MsanCalloc(StackTrace *stack, uptr nmemb, uptr size);
 232 void *MsanReallocate(StackTrace *stack, void *oldp, uptr size,
 233                      uptr alignment, bool zeroise);
 234 void MsanDeallocate(StackTrace *stack, void *ptr);
 235 void InstallTrapHandler();
 236 void InstallAtExitHandler();
 237
 238 const char *GetStackOriginDescr(u32 id, uptr *pc);
 239
 240 void EnterSymbolizer();
 241 void ExitSymbolizer();
 242 bool IsInSymbolizer();
 243
 244 struct SymbolizerScope {
 245   SymbolizerScope() { EnterSymbolizer(); }
 246   ~SymbolizerScope() { ExitSymbolizer(); }
 247 };
 248
 249 void PrintWarning(uptr pc, uptr bp);
 250 void PrintWarningWithOrigin(uptr pc, uptr bp, u32 origin);
 251
 252 void GetStackTrace(BufferedStackTrace *stack, uptr max_s, uptr pc, uptr bp,
 253                    bool request_fast_unwind);
 254
 255 void ReportUMR(StackTrace *stack, u32 origin);
 256 void ReportExpectedUMRNotFound(StackTrace *stack);
 257 void ReportStats();
 258 void ReportAtExitStatistics();
 259 void DescribeMemoryRange(const void *x, uptr size);
 260 void ReportUMRInsideAddressRange(const char *what, const void *start, uptr size,
 261                                  uptr offset);
 262
 263 // Unpoison first n function arguments.
 264 void UnpoisonParam(uptr n);
 265 void UnpoisonThreadLocalState();
 266
 267 // Returns a "chained" origin id, pointing to the given stack trace followed by
 268 // the previous origin id.
 269 u32 ChainOrigin(u32 id, StackTrace *stack);
 270
 271 const int STACK_TRACE_TAG_POISON = StackTrace::TAG_CUSTOM + 1;
 272
 273 #define GET_MALLOC_STACK_TRACE                                                 \
 274   BufferedStackTrace stack;                                                    \
 275   if (__msan_get_track_origins() && msan_inited)                               \
 276   GetStackTrace(&stack, common_flags()->malloc_context_size,                   \
 277                 StackTrace::GetCurrentPc(), GET_CURRENT_FRAME(),               \
 278                 common_flags()->fast_unwind_on_malloc)
 279
 280 #define GET_STORE_STACK_TRACE_PC_BP(pc, bp)                                    \
 281   BufferedStackTrace stack;                                                    \
 282   if (__msan_get_track_origins() > 1 && msan_inited)                           \
 283   GetStackTrace(&stack, flags()->store_context_size, pc, bp,                   \
 284                 common_flags()->fast_unwind_on_malloc)
 285
 286 #define GET_FATAL_STACK_TRACE_PC_BP(pc, bp)                                    \
 287   BufferedStackTrace stack;                                                    \
 288   if (msan_inited)                                                             \
 289   GetStackTrace(&stack, kStackTraceMax, pc, bp,                                \
 290                 common_flags()->fast_unwind_on_fatal)
 291
 292 #define GET_STORE_STACK_TRACE \
 293   GET_STORE_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())
 294
 295 class ScopedThreadLocalStateBackup {
 296  public:
 297   ScopedThreadLocalStateBackup() { Backup(); }
 298   ~ScopedThreadLocalStateBackup() { Restore(); }
 299   void Backup();
 300   void Restore();
 301  private:
 302   u64 va_arg_overflow_size_tls;
 303 };
 304
 305 void MsanTSDInit(void (*destructor)(void *tsd));
 306 void *MsanTSDGet();
 307 void MsanTSDSet(void *tsd);
 308 void MsanTSDDtor(void *tsd);
 309
 310 }  // namespace __msan
 311
 312 #define MSAN_MALLOC_HOOK(ptr, size)       \
 313   do {                                    \
 314     if (&__sanitizer_malloc_hook) {       \
 315       UnpoisonParam(2);                   \
 316       __sanitizer_malloc_hook(ptr, size); \
 317     }                                     \
 318     RunMallocHooks(ptr, size);            \
 319   } while (false)
 320 #define MSAN_FREE_HOOK(ptr)       \
 321   do {                            \
 322     if (&__sanitizer_free_hook) { \
 323       UnpoisonParam(1);           \
 324       __sanitizer_free_hook(ptr); \
 325     }                             \
 326     RunFreeHooks(ptr);            \
 327   } while (false)
 328
 329 #endif  // MSAN_H