1 //===-- ubsan_diag.cc -----------------------------------------------------===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // Diagnostic reporting for the UBSan runtime.
11 //===----------------------------------------------------------------------===//
13 #include "ubsan_platform.h"
15 #include "ubsan_diag.h"
16 #include "ubsan_init.h"
17 #include "ubsan_flags.h"
18 #include "ubsan_monitor.h"
19 #include "sanitizer_common/sanitizer_placement_new.h"
20 #include "sanitizer_common/sanitizer_report_decorator.h"
21 #include "sanitizer_common/sanitizer_stacktrace.h"
22 #include "sanitizer_common/sanitizer_stacktrace_printer.h"
23 #include "sanitizer_common/sanitizer_suppressions.h"
24 #include "sanitizer_common/sanitizer_symbolizer.h"
27 using namespace __ubsan;
29 // UBSan is combined with runtimes that already provide this functionality
30 // (e.g., ASan) as well as runtimes that lack it (e.g., scudo). Tried to use
31 // weak linkage to resolve this issue which is not portable and breaks on
33 // TODO(yln): This is a temporary workaround. GetStackTrace functions will be
34 // removed in the future.
35 void ubsan_GetStackTrace(BufferedStackTrace *stack, uptr max_depth,
36 uptr pc, uptr bp, void *context, bool fast) {
39 if (StackTrace::WillUseFastUnwind(fast)) {
40 GetThreadStackTopAndBottom(false, &top, &bottom);
41 stack->Unwind(max_depth, pc, bp, nullptr, top, bottom, true);
43 stack->Unwind(max_depth, pc, bp, context, 0, 0, false);
46 static void MaybePrintStackTrace(uptr pc, uptr bp) {
47 // We assume that flags are already parsed, as UBSan runtime
48 // will definitely be called when we print the first diagnostics message.
49 if (!flags()->print_stacktrace)
52 BufferedStackTrace stack;
53 ubsan_GetStackTrace(&stack, kStackTraceMax, pc, bp, nullptr,
54 common_flags()->fast_unwind_on_fatal);
58 static const char *ConvertTypeToString(ErrorType Type) {
60 #define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) \
61 case ErrorType::Name: \
63 #include "ubsan_checks.inc"
66 UNREACHABLE("unknown ErrorType!");
69 static const char *ConvertTypeToFlagName(ErrorType Type) {
71 #define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) \
72 case ErrorType::Name: \
73 return FSanitizeFlagName;
74 #include "ubsan_checks.inc"
77 UNREACHABLE("unknown ErrorType!");
80 static void MaybeReportErrorSummary(Location Loc, ErrorType Type) {
81 if (!common_flags()->print_summary)
83 if (!flags()->report_error_type)
84 Type = ErrorType::GenericUB;
85 const char *ErrorKind = ConvertTypeToString(Type);
86 if (Loc.isSourceLocation()) {
87 SourceLocation SLoc = Loc.getSourceLocation();
88 if (!SLoc.isInvalid()) {
90 AI.file = internal_strdup(SLoc.getFilename());
91 AI.line = SLoc.getLine();
92 AI.column = SLoc.getColumn();
93 AI.function = internal_strdup(""); // Avoid printing ?? as function name.
94 ReportErrorSummary(ErrorKind, AI, GetSanititizerToolName());
98 } else if (Loc.isSymbolizedStack()) {
99 const AddressInfo &AI = Loc.getSymbolizedStack()->info;
100 ReportErrorSummary(ErrorKind, AI, GetSanititizerToolName());
103 ReportErrorSummary(ErrorKind, GetSanititizerToolName());
107 class Decorator : public SanitizerCommonDecorator {
109 Decorator() : SanitizerCommonDecorator() {}
110 const char *Highlight() const { return Green(); }
111 const char *Note() const { return Black(); }
115 SymbolizedStack *__ubsan::getSymbolizedLocation(uptr PC) {
116 InitAsStandaloneIfNecessary();
117 return Symbolizer::GetOrInit()->SymbolizePC(PC);
120 Diag &Diag::operator<<(const TypeDescriptor &V) {
121 return AddArg(V.getTypeName());
124 Diag &Diag::operator<<(const Value &V) {
125 if (V.getType().isSignedIntegerTy())
126 AddArg(V.getSIntValue());
127 else if (V.getType().isUnsignedIntegerTy())
128 AddArg(V.getUIntValue());
129 else if (V.getType().isFloatTy())
130 AddArg(V.getFloatValue());
136 /// Hexadecimal printing for numbers too large for Printf to handle directly.
137 static void RenderHex(InternalScopedString *Buffer, UIntMax Val) {
139 Buffer->append("0x%08x%08x%08x%08x", (unsigned int)(Val >> 96),
140 (unsigned int)(Val >> 64), (unsigned int)(Val >> 32),
141 (unsigned int)(Val));
143 UNREACHABLE("long long smaller than 64 bits?");
147 static void RenderLocation(InternalScopedString *Buffer, Location Loc) {
148 switch (Loc.getKind()) {
149 case Location::LK_Source: {
150 SourceLocation SLoc = Loc.getSourceLocation();
151 if (SLoc.isInvalid())
152 Buffer->append("<unknown>");
154 RenderSourceLocation(Buffer, SLoc.getFilename(), SLoc.getLine(),
155 SLoc.getColumn(), common_flags()->symbolize_vs_style,
156 common_flags()->strip_path_prefix);
159 case Location::LK_Memory:
160 Buffer->append("%p", Loc.getMemoryLocation());
162 case Location::LK_Symbolized: {
163 const AddressInfo &Info = Loc.getSymbolizedStack()->info;
165 RenderSourceLocation(Buffer, Info.file, Info.line, Info.column,
166 common_flags()->symbolize_vs_style,
167 common_flags()->strip_path_prefix);
168 else if (Info.module)
169 RenderModuleLocation(Buffer, Info.module, Info.module_offset,
170 Info.module_arch, common_flags()->strip_path_prefix);
172 Buffer->append("%p", Info.address);
175 case Location::LK_Null:
176 Buffer->append("<unknown>");
181 static void RenderText(InternalScopedString *Buffer, const char *Message,
182 const Diag::Arg *Args) {
183 for (const char *Msg = Message; *Msg; ++Msg) {
185 Buffer->append("%c", *Msg);
188 const Diag::Arg &A = Args[*++Msg - '0'];
190 case Diag::AK_String:
191 Buffer->append("%s", A.String);
193 case Diag::AK_TypeName: {
194 if (SANITIZER_WINDOWS)
195 // The Windows implementation demangles names early.
196 Buffer->append("'%s'", A.String);
198 Buffer->append("'%s'", Symbolizer::GetOrInit()->Demangle(A.String));
202 // 'long long' is guaranteed to be at least 64 bits wide.
203 if (A.SInt >= INT64_MIN && A.SInt <= INT64_MAX)
204 Buffer->append("%lld", (long long)A.SInt);
206 RenderHex(Buffer, A.SInt);
209 if (A.UInt <= UINT64_MAX)
210 Buffer->append("%llu", (unsigned long long)A.UInt);
212 RenderHex(Buffer, A.UInt);
214 case Diag::AK_Float: {
215 // FIXME: Support floating-point formatting in sanitizer_common's
216 // printf, and stop using snprintf here.
217 char FloatBuffer[32];
218 #if SANITIZER_WINDOWS
219 sprintf_s(FloatBuffer, sizeof(FloatBuffer), "%Lg", (long double)A.Float);
221 snprintf(FloatBuffer, sizeof(FloatBuffer), "%Lg", (long double)A.Float);
223 Buffer->append("%s", FloatBuffer);
226 case Diag::AK_Pointer:
227 Buffer->append("%p", A.Pointer);
233 /// Find the earliest-starting range in Ranges which ends after Loc.
234 static Range *upperBound(MemoryLocation Loc, Range *Ranges,
235 unsigned NumRanges) {
237 for (unsigned I = 0; I != NumRanges; ++I)
238 if (Ranges[I].getEnd().getMemoryLocation() > Loc &&
240 Best->getStart().getMemoryLocation() >
241 Ranges[I].getStart().getMemoryLocation()))
246 static inline uptr subtractNoOverflow(uptr LHS, uptr RHS) {
247 return (LHS < RHS) ? 0 : LHS - RHS;
250 static inline uptr addNoOverflow(uptr LHS, uptr RHS) {
251 const uptr Limit = (uptr)-1;
252 return (LHS > Limit - RHS) ? Limit : LHS + RHS;
255 /// Render a snippet of the address space near a location.
256 static void PrintMemorySnippet(const Decorator &Decor, MemoryLocation Loc,
257 Range *Ranges, unsigned NumRanges,
258 const Diag::Arg *Args) {
259 // Show at least the 8 bytes surrounding Loc.
260 const unsigned MinBytesNearLoc = 4;
261 MemoryLocation Min = subtractNoOverflow(Loc, MinBytesNearLoc);
262 MemoryLocation Max = addNoOverflow(Loc, MinBytesNearLoc);
263 MemoryLocation OrigMin = Min;
264 for (unsigned I = 0; I < NumRanges; ++I) {
265 Min = __sanitizer::Min(Ranges[I].getStart().getMemoryLocation(), Min);
266 Max = __sanitizer::Max(Ranges[I].getEnd().getMemoryLocation(), Max);
269 // If we have too many interesting bytes, prefer to show bytes after Loc.
270 const unsigned BytesToShow = 32;
271 if (Max - Min > BytesToShow)
272 Min = __sanitizer::Min(Max - BytesToShow, OrigMin);
273 Max = addNoOverflow(Min, BytesToShow);
275 if (!IsAccessibleMemoryRange(Min, Max - Min)) {
276 Printf("<memory cannot be printed>\n");
281 InternalScopedString Buffer(1024);
282 for (uptr P = Min; P != Max; ++P) {
283 unsigned char C = *reinterpret_cast<const unsigned char*>(P);
284 Buffer.append("%s%02x", (P % 8 == 0) ? " " : " ", C);
289 Buffer.append(Decor.Highlight());
290 Range *InRange = upperBound(Min, Ranges, NumRanges);
291 for (uptr P = Min; P != Max; ++P) {
292 char Pad = ' ', Byte = ' ';
293 if (InRange && InRange->getEnd().getMemoryLocation() == P)
294 InRange = upperBound(P, Ranges, NumRanges);
295 if (!InRange && P > Loc)
297 if (InRange && InRange->getStart().getMemoryLocation() < P)
299 if (InRange && InRange->getStart().getMemoryLocation() <= P)
302 Buffer.append("%c", Pad);
303 Buffer.append("%c", Pad);
304 Buffer.append("%c", P == Loc ? '^' : Byte);
305 Buffer.append("%c", Byte);
307 Buffer.append("%s\n", Decor.Default());
309 // Go over the line again, and print names for the ranges.
312 for (uptr P = Min; P != Max; ++P) {
313 if (!InRange || InRange->getEnd().getMemoryLocation() == P)
314 InRange = upperBound(P, Ranges, NumRanges);
318 Spaces += (P % 8) == 0 ? 2 : 1;
320 if (InRange && InRange->getStart().getMemoryLocation() == P) {
323 RenderText(&Buffer, InRange->getText(), Args);
325 // FIXME: We only support naming one range for now!
332 Printf("%s", Buffer.data());
333 // FIXME: Print names for anything we can identify within the line:
335 // * If we can identify the memory itself as belonging to a particular
336 // global, stack variable, or dynamic allocation, then do so.
338 // * If we have a pointer-size, pointer-aligned range highlighted,
339 // determine whether the value of that range is a pointer to an
340 // entity which we can name, and if so, print that name.
342 // This needs an external symbolizer, or (preferably) ASan instrumentation.
346 // All diagnostics should be printed under report mutex.
347 ScopedReport::CheckLocked();
349 InternalScopedString Buffer(1024);
351 // Prepare a report that a monitor process can inspect.
352 if (Level == DL_Error) {
353 RenderText(&Buffer, Message, Args);
354 UndefinedBehaviorReport UBR{ConvertTypeToString(ET), Loc, Buffer};
358 Buffer.append(Decor.Bold());
359 RenderLocation(&Buffer, Loc);
364 Buffer.append("%s runtime error: %s%s", Decor.Warning(), Decor.Default(),
369 Buffer.append("%s note: %s", Decor.Note(), Decor.Default());
373 RenderText(&Buffer, Message, Args);
375 Buffer.append("%s\n", Decor.Default());
376 Printf("%s", Buffer.data());
378 if (Loc.isMemoryLocation())
379 PrintMemorySnippet(Decor, Loc.getMemoryLocation(), Ranges, NumRanges, Args);
382 ScopedReport::Initializer::Initializer() { InitAsStandaloneIfNecessary(); }
384 ScopedReport::ScopedReport(ReportOptions Opts, Location SummaryLoc,
386 : Opts(Opts), SummaryLoc(SummaryLoc), Type(Type) {}
388 ScopedReport::~ScopedReport() {
389 MaybePrintStackTrace(Opts.pc, Opts.bp);
390 MaybeReportErrorSummary(SummaryLoc, Type);
391 if (flags()->halt_on_error)
395 ALIGNED(64) static char suppression_placeholder[sizeof(SuppressionContext)];
396 static SuppressionContext *suppression_ctx = nullptr;
397 static const char kVptrCheck[] = "vptr_check";
398 static const char *kSuppressionTypes[] = {
399 #define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) FSanitizeFlagName,
400 #include "ubsan_checks.inc"
405 void __ubsan::InitializeSuppressions() {
406 CHECK_EQ(nullptr, suppression_ctx);
407 suppression_ctx = new (suppression_placeholder) // NOLINT
408 SuppressionContext(kSuppressionTypes, ARRAY_SIZE(kSuppressionTypes));
409 suppression_ctx->ParseFromFile(flags()->suppressions);
412 bool __ubsan::IsVptrCheckSuppressed(const char *TypeName) {
413 InitAsStandaloneIfNecessary();
414 CHECK(suppression_ctx);
416 return suppression_ctx->Match(TypeName, kVptrCheck, &s);
419 bool __ubsan::IsPCSuppressed(ErrorType ET, uptr PC, const char *Filename) {
420 InitAsStandaloneIfNecessary();
421 CHECK(suppression_ctx);
422 const char *SuppType = ConvertTypeToFlagName(ET);
423 // Fast path: don't symbolize PC if there is no suppressions for given UB
425 if (!suppression_ctx->HasSuppressionType(SuppType))
427 Suppression *s = nullptr;
428 // Suppress by file name known to runtime.
429 if (Filename != nullptr && suppression_ctx->Match(Filename, SuppType, &s))
431 // Suppress by module name.
432 if (const char *Module = Symbolizer::GetOrInit()->GetModuleNameForPc(PC)) {
433 if (suppression_ctx->Match(Module, SuppType, &s))
436 // Suppress by function or source file name from debug info.
437 SymbolizedStackHolder Stack(Symbolizer::GetOrInit()->SymbolizePC(PC));
438 const AddressInfo &AI = Stack.get()->info;
439 return suppression_ctx->Match(AI.function, SuppType, &s) ||
440 suppression_ctx->Match(AI.file, SuppType, &s);
443 #endif // CAN_SANITIZE_UB