1 //===-- asan_malloc_mac.cc ------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
10 // Mac-specific malloc interception.
11 //===----------------------------------------------------------------------===//
15 #include <AvailabilityMacros.h>
16 #include <CoreFoundation/CFBase.h>
18 #include <malloc/malloc.h>
20 #include "asan_allocator.h"
21 #include "asan_interceptors.h"
22 #include "asan_internal.h"
24 #include "asan_report.h"
25 #include "asan_stack.h"
26 #include "asan_stats.h"
27 #include "asan_thread_registry.h"
29 // Similar code is used in Google Perftools,
30 // http://code.google.com/p/google-perftools.
32 // ---------------------- Replacement functions ---------------- {{{1
33 using namespace __asan
; // NOLINT
35 // TODO(glider): do we need both zones?
36 static malloc_zone_t
*system_malloc_zone
= 0;
37 static malloc_zone_t
*system_purgeable_zone
= 0;
38 static malloc_zone_t asan_zone
;
39 CFAllocatorRef cf_asan
= 0;
41 // _CFRuntimeCreateInstance() checks whether the supplied allocator is
42 // kCFAllocatorSystemDefault and, if it is not, stores the allocator reference
43 // at the beginning of the allocated memory and returns the pointer to the
44 // allocated memory plus sizeof(CFAllocatorRef). See
45 // http://www.opensource.apple.com/source/CF/CF-635.21/CFRuntime.c
46 // Pointers returned by _CFRuntimeCreateInstance() can then be passed directly
47 // to free() or CFAllocatorDeallocate(), which leads to false invalid free
49 // The corresponding rdar bug is http://openradar.appspot.com/radar?id=1796404.
50 void* ALWAYS_INLINE
get_saved_cfallocator_ref(void *ptr
) {
51 if (flags()->replace_cfallocator
) {
52 // Make sure we're not hitting the previous page. This may be incorrect
53 // if ASan's malloc returns an address ending with 0xFF8, which will be
54 // then padded to a page boundary with a CFAllocatorRef.
55 uptr arith_ptr
= (uptr
)ptr
;
56 if ((arith_ptr
& 0xFFF) > sizeof(CFAllocatorRef
)) {
57 CFAllocatorRef
*saved
=
58 (CFAllocatorRef
*)(arith_ptr
- sizeof(CFAllocatorRef
));
59 if ((*saved
== cf_asan
) && asan_mz_size(saved
)) ptr
= (void*)saved
;
65 // The free() implementation provided by OS X calls malloc_zone_from_ptr()
66 // to find the owner of |ptr|. If the result is 0, an invalid free() is
67 // reported. Our implementation falls back to asan_free() in this case
68 // in order to print an ASan-style report.
70 // For the objects created by _CFRuntimeCreateInstance a CFAllocatorRef is
71 // placed at the beginning of the allocated chunk and the pointer returned by
72 // our allocator is off by sizeof(CFAllocatorRef). This pointer can be then
73 // passed directly to free(), which will lead to errors.
74 // To overcome this we're checking whether |ptr-sizeof(CFAllocatorRef)|
75 // contains a pointer to our CFAllocator (assuming no other allocator is used).
76 // See http://code.google.com/p/address-sanitizer/issues/detail?id=70 for more
78 INTERCEPTOR(void, free
, void *ptr
) {
79 malloc_zone_t
*zone
= malloc_zone_from_ptr(ptr
);
81 #if defined(MAC_OS_X_VERSION_10_6) && \
82 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
83 if ((zone
->version
>= 6) && (zone
->free_definite_size
)) {
84 zone
->free_definite_size(zone
, ptr
, malloc_size(ptr
));
86 malloc_zone_free(zone
, ptr
);
89 malloc_zone_free(zone
, ptr
);
92 if (!asan_mz_size(ptr
)) ptr
= get_saved_cfallocator_ref(ptr
);
93 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
94 asan_free(ptr
, &stack
);
98 // We can't always replace the default CFAllocator with cf_asan right in
99 // ReplaceSystemMalloc(), because it is sometimes called before
100 // __CFInitialize(), when the default allocator is invalid and replacing it may
101 // crash the program. Instead we wait for the allocator to initialize and jump
102 // in just after __CFInitialize(). Nobody is going to allocate memory using
103 // CFAllocators before that, so we won't miss anything.
105 // See http://code.google.com/p/address-sanitizer/issues/detail?id=87
106 // and http://opensource.apple.com/source/CF/CF-550.43/CFRuntime.c
107 INTERCEPTOR(void, __CFInitialize
, void) {
108 // If the runtime is built as dynamic library, __CFInitialize wrapper may be
109 // called before __asan_init.
110 #if !MAC_INTERPOSE_FUNCTIONS
111 CHECK(flags()->replace_cfallocator
);
114 REAL(__CFInitialize
)();
115 if (!cf_asan
&& asan_inited
) MaybeReplaceCFAllocator();
120 // TODO(glider): the mz_* functions should be united with the Linux wrappers,
121 // as they are basically copied from there.
122 size_t mz_size(malloc_zone_t
* zone
, const void* ptr
) {
123 return asan_mz_size(ptr
);
126 void *mz_malloc(malloc_zone_t
*zone
, size_t size
) {
128 CHECK(system_malloc_zone
);
129 return malloc_zone_malloc(system_malloc_zone
, size
);
131 GET_STACK_TRACE_HERE_FOR_MALLOC
;
132 return asan_malloc(size
, &stack
);
135 void *cf_malloc(CFIndex size
, CFOptionFlags hint
, void *info
) {
137 CHECK(system_malloc_zone
);
138 return malloc_zone_malloc(system_malloc_zone
, size
);
140 GET_STACK_TRACE_HERE_FOR_MALLOC
;
141 return asan_malloc(size
, &stack
);
144 void *mz_calloc(malloc_zone_t
*zone
, size_t nmemb
, size_t size
) {
146 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym.
147 const size_t kCallocPoolSize
= 1024;
148 static uptr calloc_memory_for_dlsym
[kCallocPoolSize
];
149 static size_t allocated
;
150 size_t size_in_words
= ((nmemb
* size
) + kWordSize
- 1) / kWordSize
;
151 void *mem
= (void*)&calloc_memory_for_dlsym
[allocated
];
152 allocated
+= size_in_words
;
153 CHECK(allocated
< kCallocPoolSize
);
156 GET_STACK_TRACE_HERE_FOR_MALLOC
;
157 return asan_calloc(nmemb
, size
, &stack
);
160 void *mz_valloc(malloc_zone_t
*zone
, size_t size
) {
162 CHECK(system_malloc_zone
);
163 return malloc_zone_valloc(system_malloc_zone
, size
);
165 GET_STACK_TRACE_HERE_FOR_MALLOC
;
166 return asan_memalign(GetPageSizeCached(), size
, &stack
);
169 #define GET_ZONE_FOR_PTR(ptr) \
170 malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); \
171 const char *zone_name = (zone_ptr == 0) ? 0 : zone_ptr->zone_name
173 void ALWAYS_INLINE
free_common(void *context
, void *ptr
) {
175 if (asan_mz_size(ptr
)) {
176 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
177 asan_free(ptr
, &stack
);
179 // If the pointer does not belong to any of the zones, use one of the
180 // fallback methods to free memory.
181 malloc_zone_t
*zone_ptr
= malloc_zone_from_ptr(ptr
);
182 if (zone_ptr
== system_purgeable_zone
) {
183 // allocations from malloc_default_purgeable_zone() done before
184 // __asan_init() may be occasionally freed via free_common().
185 // see http://code.google.com/p/address-sanitizer/issues/detail?id=99.
186 malloc_zone_free(zone_ptr
, ptr
);
188 // If the memory chunk pointer was moved to store additional
189 // CFAllocatorRef, fix it back.
190 ptr
= get_saved_cfallocator_ref(ptr
);
191 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
192 if (!flags()->mac_ignore_invalid_free
) {
193 asan_free(ptr
, &stack
);
195 GET_ZONE_FOR_PTR(ptr
);
196 WarnMacFreeUnallocated((uptr
)ptr
, (uptr
)zone_ptr
, zone_name
, &stack
);
203 // TODO(glider): the allocation callbacks need to be refactored.
204 void mz_free(malloc_zone_t
*zone
, void *ptr
) {
205 free_common(zone
, ptr
);
208 void cf_free(void *ptr
, void *info
) {
209 free_common(info
, ptr
);
212 void *mz_realloc(malloc_zone_t
*zone
, void *ptr
, size_t size
) {
214 GET_STACK_TRACE_HERE_FOR_MALLOC
;
215 return asan_malloc(size
, &stack
);
217 if (asan_mz_size(ptr
)) {
218 GET_STACK_TRACE_HERE_FOR_MALLOC
;
219 return asan_realloc(ptr
, size
, &stack
);
221 // We can't recover from reallocating an unknown address, because
222 // this would require reading at most |size| bytes from
223 // potentially unaccessible memory.
224 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
225 GET_ZONE_FOR_PTR(ptr
);
226 ReportMacMzReallocUnknown((uptr
)ptr
, (uptr
)zone_ptr
, zone_name
, &stack
);
231 void *cf_realloc(void *ptr
, CFIndex size
, CFOptionFlags hint
, void *info
) {
233 GET_STACK_TRACE_HERE_FOR_MALLOC
;
234 return asan_malloc(size
, &stack
);
236 if (asan_mz_size(ptr
)) {
237 GET_STACK_TRACE_HERE_FOR_MALLOC
;
238 return asan_realloc(ptr
, size
, &stack
);
240 // We can't recover from reallocating an unknown address, because
241 // this would require reading at most |size| bytes from
242 // potentially unaccessible memory.
243 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
244 GET_ZONE_FOR_PTR(ptr
);
245 ReportMacCfReallocUnknown((uptr
)ptr
, (uptr
)zone_ptr
, zone_name
, &stack
);
250 void mz_destroy(malloc_zone_t
* zone
) {
251 // A no-op -- we will not be destroyed!
252 Printf("mz_destroy() called -- ignoring\n");
254 // from AvailabilityMacros.h
255 #if defined(MAC_OS_X_VERSION_10_6) && \
256 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
257 void *mz_memalign(malloc_zone_t
*zone
, size_t align
, size_t size
) {
259 CHECK(system_malloc_zone
);
260 return malloc_zone_memalign(system_malloc_zone
, align
, size
);
262 GET_STACK_TRACE_HERE_FOR_MALLOC
;
263 return asan_memalign(align
, size
, &stack
);
266 // This function is currently unused, and we build with -Werror.
268 void mz_free_definite_size(malloc_zone_t
* zone
, void *ptr
, size_t size
) {
269 // TODO(glider): check that |size| is valid.
275 kern_return_t
mi_enumerator(task_t task
, void *,
276 unsigned type_mask
, vm_address_t zone_address
,
277 memory_reader_t reader
,
278 vm_range_recorder_t recorder
) {
279 // Should enumerate all the pointers we have. Seems like a lot of work.
283 size_t mi_good_size(malloc_zone_t
*zone
, size_t size
) {
284 // I think it's always safe to return size, but we maybe could do better.
288 boolean_t
mi_check(malloc_zone_t
*zone
) {
292 void mi_print(malloc_zone_t
*zone
, boolean_t verbose
) {
296 void mi_log(malloc_zone_t
*zone
, void *address
) {
297 // I don't think we support anything like this
300 void mi_force_lock(malloc_zone_t
*zone
) {
301 asan_mz_force_lock();
304 void mi_force_unlock(malloc_zone_t
*zone
) {
305 asan_mz_force_unlock();
308 void mi_statistics(malloc_zone_t
*zone
, malloc_statistics_t
*stats
) {
309 AsanMallocStats malloc_stats
;
310 asanThreadRegistry().FillMallocStatistics(&malloc_stats
);
311 CHECK(sizeof(malloc_statistics_t
) == sizeof(AsanMallocStats
));
312 internal_memcpy(stats
, &malloc_stats
, sizeof(malloc_statistics_t
));
315 #if defined(MAC_OS_X_VERSION_10_6) && \
316 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
317 boolean_t
mi_zone_locked(malloc_zone_t
*zone
) {
323 } // unnamed namespace
325 extern int __CFRuntimeClassTableSize
;
328 void MaybeReplaceCFAllocator() {
329 static CFAllocatorContext asan_context
= {
330 /*version*/ 0, /*info*/ &asan_zone
,
331 /*retain*/ 0, /*release*/ 0,
332 /*copyDescription*/0,
333 /*allocate*/ &cf_malloc
,
334 /*reallocate*/ &cf_realloc
,
335 /*deallocate*/ &cf_free
,
336 /*preferredSize*/ 0 };
338 cf_asan
= CFAllocatorCreate(kCFAllocatorUseContext
, &asan_context
);
339 if (flags()->replace_cfallocator
&& CFAllocatorGetDefault() != cf_asan
)
340 CFAllocatorSetDefault(cf_asan
);
343 void ReplaceSystemMalloc() {
344 static malloc_introspection_t asan_introspection
;
345 // Ok to use internal_memset, these places are not performance-critical.
346 internal_memset(&asan_introspection
, 0, sizeof(asan_introspection
));
348 asan_introspection
.enumerator
= &mi_enumerator
;
349 asan_introspection
.good_size
= &mi_good_size
;
350 asan_introspection
.check
= &mi_check
;
351 asan_introspection
.print
= &mi_print
;
352 asan_introspection
.log
= &mi_log
;
353 asan_introspection
.force_lock
= &mi_force_lock
;
354 asan_introspection
.force_unlock
= &mi_force_unlock
;
355 asan_introspection
.statistics
= &mi_statistics
;
357 internal_memset(&asan_zone
, 0, sizeof(malloc_zone_t
));
359 // Start with a version 4 zone which is used for OS X 10.4 and 10.5.
360 asan_zone
.version
= 4;
361 asan_zone
.zone_name
= "asan";
362 asan_zone
.size
= &mz_size
;
363 asan_zone
.malloc
= &mz_malloc
;
364 asan_zone
.calloc
= &mz_calloc
;
365 asan_zone
.valloc
= &mz_valloc
;
366 asan_zone
.free
= &mz_free
;
367 asan_zone
.realloc
= &mz_realloc
;
368 asan_zone
.destroy
= &mz_destroy
;
369 asan_zone
.batch_malloc
= 0;
370 asan_zone
.batch_free
= 0;
371 asan_zone
.introspect
= &asan_introspection
;
373 // from AvailabilityMacros.h
374 #if defined(MAC_OS_X_VERSION_10_6) && \
375 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
376 // Switch to version 6 on OSX 10.6 to support memalign.
377 asan_zone
.version
= 6;
378 asan_zone
.free_definite_size
= 0;
379 asan_zone
.memalign
= &mz_memalign
;
380 asan_introspection
.zone_locked
= &mi_zone_locked
;
382 // Request the default purgable zone to force its creation. The
383 // current default zone is registered with the purgable zone for
384 // doing tiny and small allocs. Sadly, it assumes that the default
385 // zone is the szone implementation from OS X and will crash if it
386 // isn't. By creating the zone now, this will be true and changing
387 // the default zone won't cause a problem. (OS X 10.6 and higher.)
388 system_purgeable_zone
= malloc_default_purgeable_zone();
391 // Register the ASan zone. At this point, it will not be the
393 malloc_zone_register(&asan_zone
);
395 // Unregister and reregister the default zone. Unregistering swaps
396 // the specified zone with the last one registered which for the
397 // default zone makes the more recently registered zone the default
398 // zone. The default zone is then re-registered to ensure that
399 // allocations made from it earlier will be handled correctly.
400 // Things are not guaranteed to work that way, but it's how they work now.
401 system_malloc_zone
= malloc_default_zone();
402 malloc_zone_unregister(system_malloc_zone
);
403 malloc_zone_register(system_malloc_zone
);
404 // Make sure the default allocator was replaced.
405 CHECK(malloc_default_zone() == &asan_zone
);
407 // If __CFInitialize() hasn't been called yet, cf_asan will be created and
408 // installed as the default allocator after __CFInitialize() finishes (see
409 // the interceptor for __CFInitialize() above). Otherwise install cf_asan
410 // right now. On both Snow Leopard and Lion __CFInitialize() calls
411 // __CFAllocatorInitialize(), which initializes the _base._cfisa field of
412 // the default allocators we check here.
413 if (((CFRuntimeBase
*)kCFAllocatorSystemDefault
)->_cfisa
) {
414 MaybeReplaceCFAllocator();
417 } // namespace __asan