1 //===-- asan_globals.cc ---------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
11 //===----------------------------------------------------------------------===//
12 #include "asan_interceptors.h"
13 #include "asan_internal.h"
14 #include "asan_mapping.h"
15 #include "asan_poisoning.h"
16 #include "asan_report.h"
17 #include "asan_stack.h"
18 #include "asan_stats.h"
19 #include "asan_thread.h"
20 #include "sanitizer_common/sanitizer_common.h"
21 #include "sanitizer_common/sanitizer_mutex.h"
22 #include "sanitizer_common/sanitizer_placement_new.h"
23 #include "sanitizer_common/sanitizer_stackdepot.h"
27 typedef __asan_global Global
;
29 struct ListOfGlobals
{
34 static BlockingMutex
mu_for_globals(LINKER_INITIALIZED
);
35 static LowLevelAllocator allocator_for_globals
;
36 static ListOfGlobals
*list_of_all_globals
;
38 static const int kDynamicInitGlobalsInitialCapacity
= 512;
39 struct DynInitGlobal
{
43 typedef InternalMmapVector
<DynInitGlobal
> VectorOfGlobals
;
44 // Lazy-initialized and never deleted.
45 static VectorOfGlobals
*dynamic_init_globals
;
47 // We want to remember where a certain range of globals was registered.
48 struct GlobalRegistrationSite
{
50 Global
*g_first
, *g_last
;
52 typedef InternalMmapVector
<GlobalRegistrationSite
> GlobalRegistrationSiteVector
;
53 static GlobalRegistrationSiteVector
*global_registration_site_vector
;
55 ALWAYS_INLINE
void PoisonShadowForGlobal(const Global
*g
, u8 value
) {
56 FastPoisonShadow(g
->beg
, g
->size_with_redzone
, value
);
59 ALWAYS_INLINE
void PoisonRedZones(const Global
&g
) {
60 uptr aligned_size
= RoundUpTo(g
.size
, SHADOW_GRANULARITY
);
61 FastPoisonShadow(g
.beg
+ aligned_size
, g
.size_with_redzone
- aligned_size
,
62 kAsanGlobalRedzoneMagic
);
63 if (g
.size
!= aligned_size
) {
64 FastPoisonShadowPartialRightRedzone(
65 g
.beg
+ RoundDownTo(g
.size
, SHADOW_GRANULARITY
),
66 g
.size
% SHADOW_GRANULARITY
,
68 kAsanGlobalRedzoneMagic
);
72 static void ReportGlobal(const Global
&g
, const char *prefix
) {
73 Report("%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n",
74 prefix
, &g
, (void *)g
.beg
, g
.size
, g
.size_with_redzone
, g
.name
,
75 g
.module_name
, g
.has_dynamic_init
);
77 Report(" location (%p): name=%s[%p], %d %d\n", g
.location
,
78 g
.location
->filename
, g
.location
->filename
, g
.location
->line_no
,
79 g
.location
->column_no
);
83 bool DescribeAddressIfGlobal(uptr addr
, uptr size
) {
84 if (!flags()->report_globals
) return false;
85 BlockingMutexLock
lock(&mu_for_globals
);
87 for (ListOfGlobals
*l
= list_of_all_globals
; l
; l
= l
->next
) {
88 const Global
&g
= *l
->g
;
89 if (flags()->report_globals
>= 2)
90 ReportGlobal(g
, "Search");
91 res
|= DescribeAddressRelativeToGlobal(addr
, size
, g
);
96 u32
FindRegistrationSite(const Global
*g
) {
97 CHECK(global_registration_site_vector
);
98 for (uptr i
= 0, n
= global_registration_site_vector
->size(); i
< n
; i
++) {
99 GlobalRegistrationSite
&grs
= (*global_registration_site_vector
)[i
];
100 if (g
>= grs
.g_first
&& g
<= grs
.g_last
)
106 // Register a global variable.
107 // This function may be called more than once for every global
108 // so we store the globals in a map.
109 static void RegisterGlobal(const Global
*g
) {
111 if (flags()->report_globals
>= 2)
112 ReportGlobal(*g
, "Added");
113 CHECK(flags()->report_globals
);
114 CHECK(AddrIsInMem(g
->beg
));
115 CHECK(AddrIsAlignedByGranularity(g
->beg
));
116 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
117 if (flags()->detect_odr_violation
) {
118 // Try detecting ODR (One Definition Rule) violation, i.e. the situation
119 // where two globals with the same name are defined in different modules.
120 if (__asan_region_is_poisoned(g
->beg
, g
->size_with_redzone
)) {
121 // This check may not be enough: if the first global is much larger
122 // the entire redzone of the second global may be within the first global.
123 for (ListOfGlobals
*l
= list_of_all_globals
; l
; l
= l
->next
) {
124 if (g
->beg
== l
->g
->beg
&&
125 (flags()->detect_odr_violation
>= 2 || g
->size
!= l
->g
->size
))
126 ReportODRViolation(g
, FindRegistrationSite(g
),
127 l
->g
, FindRegistrationSite(l
->g
));
131 if (flags()->poison_heap
)
133 ListOfGlobals
*l
= new(allocator_for_globals
) ListOfGlobals
;
135 l
->next
= list_of_all_globals
;
136 list_of_all_globals
= l
;
137 if (g
->has_dynamic_init
) {
138 if (dynamic_init_globals
== 0) {
139 dynamic_init_globals
= new(allocator_for_globals
)
140 VectorOfGlobals(kDynamicInitGlobalsInitialCapacity
);
142 DynInitGlobal dyn_global
= { *g
, false };
143 dynamic_init_globals
->push_back(dyn_global
);
147 static void UnregisterGlobal(const Global
*g
) {
149 CHECK(flags()->report_globals
);
150 CHECK(AddrIsInMem(g
->beg
));
151 CHECK(AddrIsAlignedByGranularity(g
->beg
));
152 CHECK(AddrIsAlignedByGranularity(g
->size_with_redzone
));
153 if (flags()->poison_heap
)
154 PoisonShadowForGlobal(g
, 0);
155 // We unpoison the shadow memory for the global but we do not remove it from
156 // the list because that would require O(n^2) time with the current list
157 // implementation. It might not be worth doing anyway.
160 void StopInitOrderChecking() {
161 BlockingMutexLock
lock(&mu_for_globals
);
162 if (!flags()->check_initialization_order
|| !dynamic_init_globals
)
164 flags()->check_initialization_order
= false;
165 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
166 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
167 const Global
*g
= &dyn_g
.g
;
168 // Unpoison the whole global.
169 PoisonShadowForGlobal(g
, 0);
170 // Poison redzones back.
175 } // namespace __asan
177 // ---------------------- Interface ---------------- {{{1
178 using namespace __asan
; // NOLINT
180 // Register an array of globals.
181 void __asan_register_globals(__asan_global
*globals
, uptr n
) {
182 if (!flags()->report_globals
) return;
183 GET_STACK_TRACE_FATAL_HERE
;
184 u32 stack_id
= StackDepotPut(stack
.trace
, stack
.size
);
185 BlockingMutexLock
lock(&mu_for_globals
);
186 if (!global_registration_site_vector
)
187 global_registration_site_vector
=
188 new(allocator_for_globals
) GlobalRegistrationSiteVector(128);
189 GlobalRegistrationSite site
= {stack_id
, &globals
[0], &globals
[n
- 1]};
190 global_registration_site_vector
->push_back(site
);
191 if (flags()->report_globals
>= 2) {
192 PRINT_CURRENT_STACK();
193 Printf("=== ID %d; %p %p\n", stack_id
, &globals
[0], &globals
[n
- 1]);
195 for (uptr i
= 0; i
< n
; i
++) {
196 RegisterGlobal(&globals
[i
]);
200 // Unregister an array of globals.
201 // We must do this when a shared objects gets dlclosed.
202 void __asan_unregister_globals(__asan_global
*globals
, uptr n
) {
203 if (!flags()->report_globals
) return;
204 BlockingMutexLock
lock(&mu_for_globals
);
205 for (uptr i
= 0; i
< n
; i
++) {
206 UnregisterGlobal(&globals
[i
]);
210 // This method runs immediately prior to dynamic initialization in each TU,
211 // when all dynamically initialized globals are unpoisoned. This method
212 // poisons all global variables not defined in this TU, so that a dynamic
213 // initializer can only touch global variables in the same TU.
214 void __asan_before_dynamic_init(const char *module_name
) {
215 if (!flags()->check_initialization_order
||
216 !flags()->poison_heap
)
218 bool strict_init_order
= flags()->strict_init_order
;
219 CHECK(dynamic_init_globals
);
222 BlockingMutexLock
lock(&mu_for_globals
);
223 if (flags()->report_globals
>= 3)
224 Printf("DynInitPoison module: %s\n", module_name
);
225 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
226 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
227 const Global
*g
= &dyn_g
.g
;
228 if (dyn_g
.initialized
)
230 if (g
->module_name
!= module_name
)
231 PoisonShadowForGlobal(g
, kAsanInitializationOrderMagic
);
232 else if (!strict_init_order
)
233 dyn_g
.initialized
= true;
237 // This method runs immediately after dynamic initialization in each TU, when
238 // all dynamically initialized globals except for those defined in the current
239 // TU are poisoned. It simply unpoisons all dynamically initialized globals.
240 void __asan_after_dynamic_init() {
241 if (!flags()->check_initialization_order
||
242 !flags()->poison_heap
)
245 BlockingMutexLock
lock(&mu_for_globals
);
246 // FIXME: Optionally report that we're unpoisoning globals from a module.
247 for (uptr i
= 0, n
= dynamic_init_globals
->size(); i
< n
; ++i
) {
248 DynInitGlobal
&dyn_g
= (*dynamic_init_globals
)[i
];
249 const Global
*g
= &dyn_g
.g
;
250 if (!dyn_g
.initialized
) {
251 // Unpoison the whole global.
252 PoisonShadowForGlobal(g
, 0);
253 // Poison redzones back.