1 //===-- asan_rtl.cc -------------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
10 // Main file of the ASan run-time library.
11 //===----------------------------------------------------------------------===//
12 #include "asan_allocator.h"
13 #include "asan_interceptors.h"
14 #include "asan_internal.h"
15 #include "asan_lock.h"
16 #include "asan_mapping.h"
17 #include "asan_report.h"
18 #include "asan_stack.h"
19 #include "asan_stats.h"
20 #include "asan_thread.h"
21 #include "asan_thread_registry.h"
22 #include "sanitizer/asan_interface.h"
23 #include "sanitizer_common/sanitizer_atomic.h"
24 #include "sanitizer_common/sanitizer_flags.h"
25 #include "sanitizer_common/sanitizer_libc.h"
26 #include "sanitizer_common/sanitizer_symbolizer.h"
30 static void AsanDie() {
31 static atomic_uint32_t num_calls
;
32 if (atomic_fetch_add(&num_calls
, 1, memory_order_relaxed
) != 0) {
33 // Don't die twice - run a busy loop.
36 if (flags()->sleep_before_dying
) {
37 Report("Sleeping for %d second(s)\n", flags()->sleep_before_dying
);
38 SleepForSeconds(flags()->sleep_before_dying
);
40 if (flags()->unmap_shadow_on_exit
)
41 UnmapOrDie((void*)kLowShadowBeg
, kHighShadowEnd
- kLowShadowBeg
);
44 if (flags()->abort_on_error
)
46 Exit(flags()->exitcode
);
49 static void AsanCheckFailed(const char *file
, int line
, const char *cond
,
51 Report("AddressSanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n",
52 file
, line
, cond
, (uptr
)v1
, (uptr
)v2
);
53 // FIXME: check for infinite recursion without a thread-local counter here.
54 PRINT_CURRENT_STACK();
58 // -------------------------- Flags ------------------------- {{{1
59 static const int kDeafultMallocContextSize
= 30;
61 static Flags asan_flags
;
67 static void ParseFlagsFromString(Flags
*f
, const char *str
) {
68 ParseFlag(str
, &f
->quarantine_size
, "quarantine_size");
69 ParseFlag(str
, &f
->symbolize
, "symbolize");
70 ParseFlag(str
, &f
->verbosity
, "verbosity");
71 ParseFlag(str
, &f
->redzone
, "redzone");
72 CHECK(f
->redzone
>= 16);
73 CHECK(IsPowerOfTwo(f
->redzone
));
75 ParseFlag(str
, &f
->debug
, "debug");
76 ParseFlag(str
, &f
->report_globals
, "report_globals");
77 ParseFlag(str
, &f
->check_initialization_order
, "initialization_order");
78 ParseFlag(str
, &f
->malloc_context_size
, "malloc_context_size");
79 CHECK((uptr
)f
->malloc_context_size
<= kStackTraceMax
);
81 ParseFlag(str
, &f
->replace_str
, "replace_str");
82 ParseFlag(str
, &f
->replace_intrin
, "replace_intrin");
83 ParseFlag(str
, &f
->replace_cfallocator
, "replace_cfallocator");
84 ParseFlag(str
, &f
->mac_ignore_invalid_free
, "mac_ignore_invalid_free");
85 ParseFlag(str
, &f
->use_fake_stack
, "use_fake_stack");
86 ParseFlag(str
, &f
->max_malloc_fill_size
, "max_malloc_fill_size");
87 ParseFlag(str
, &f
->exitcode
, "exitcode");
88 ParseFlag(str
, &f
->allow_user_poisoning
, "allow_user_poisoning");
89 ParseFlag(str
, &f
->sleep_before_dying
, "sleep_before_dying");
90 ParseFlag(str
, &f
->handle_segv
, "handle_segv");
91 ParseFlag(str
, &f
->use_sigaltstack
, "use_sigaltstack");
92 ParseFlag(str
, &f
->check_malloc_usable_size
, "check_malloc_usable_size");
93 ParseFlag(str
, &f
->unmap_shadow_on_exit
, "unmap_shadow_on_exit");
94 ParseFlag(str
, &f
->abort_on_error
, "abort_on_error");
95 ParseFlag(str
, &f
->atexit
, "atexit");
96 ParseFlag(str
, &f
->disable_core
, "disable_core");
97 ParseFlag(str
, &f
->strip_path_prefix
, "strip_path_prefix");
98 ParseFlag(str
, &f
->allow_reexec
, "allow_reexec");
99 ParseFlag(str
, &f
->print_full_thread_history
, "print_full_thread_history");
100 ParseFlag(str
, &f
->log_path
, "log_path");
104 SANITIZER_WEAK_ATTRIBUTE
105 SANITIZER_INTERFACE_ATTRIBUTE
106 const char* __asan_default_options() { return ""; }
109 void InitializeFlags(Flags
*f
, const char *env
) {
110 internal_memset(f
, 0, sizeof(*f
));
112 f
->quarantine_size
= (ASAN_LOW_MEMORY
) ? 1UL << 26 : 1UL << 28;
113 f
->symbolize
= false;
115 f
->redzone
= (ASAN_LOW_MEMORY
) ? 64 : 128;
117 f
->report_globals
= 1;
118 f
->check_initialization_order
= true;
119 f
->malloc_context_size
= kDeafultMallocContextSize
;
120 f
->replace_str
= true;
121 f
->replace_intrin
= true;
122 f
->replace_cfallocator
= true;
123 f
->mac_ignore_invalid_free
= false;
124 f
->use_fake_stack
= true;
125 f
->max_malloc_fill_size
= 0;
126 f
->exitcode
= ASAN_DEFAULT_FAILURE_EXITCODE
;
127 f
->allow_user_poisoning
= true;
128 f
->sleep_before_dying
= 0;
129 f
->handle_segv
= ASAN_NEEDS_SEGV
;
130 f
->use_sigaltstack
= false;
131 f
->check_malloc_usable_size
= true;
132 f
->unmap_shadow_on_exit
= false;
133 f
->abort_on_error
= false;
135 f
->disable_core
= (SANITIZER_WORDSIZE
== 64);
136 f
->strip_path_prefix
= "";
137 f
->allow_reexec
= true;
138 f
->print_full_thread_history
= true;
141 // Override from user-specified string.
142 ParseFlagsFromString(f
, __asan_default_options());
143 if (flags()->verbosity
) {
144 Report("Using the defaults from __asan_default_options: %s\n",
145 __asan_default_options());
148 // Override from command line.
149 ParseFlagsFromString(f
, env
);
152 // -------------------------- Globals --------------------- {{{1
154 bool asan_init_is_running
;
155 void (*death_callback
)(void);
157 // -------------------------- Misc ---------------- {{{1
158 void ShowStatsAndAbort() {
159 __asan_print_accumulated_stats();
163 // ---------------------- mmap -------------------- {{{1
164 // Reserve memory range [beg, end].
165 static void ReserveShadowMemoryRange(uptr beg
, uptr end
) {
166 CHECK((beg
% GetPageSizeCached()) == 0);
167 CHECK(((end
+ 1) % GetPageSizeCached()) == 0);
168 uptr size
= end
- beg
+ 1;
169 void *res
= MmapFixedNoReserve(beg
, size
);
170 if (res
!= (void*)beg
) {
171 Report("ReserveShadowMemoryRange failed while trying to map 0x%zx bytes. "
172 "Perhaps you're using ulimit -v\n", size
);
177 // --------------- LowLevelAllocateCallbac ---------- {{{1
178 static void OnLowLevelAllocate(uptr ptr
, uptr size
) {
179 PoisonShadow(ptr
, size
, kAsanInternalHeapMagic
);
182 // -------------------------- Run-time entry ------------------- {{{1
183 // exported functions
184 #define ASAN_REPORT_ERROR(type, is_write, size) \
185 extern "C" NOINLINE INTERFACE_ATTRIBUTE \
186 void __asan_report_ ## type ## size(uptr addr); \
187 void __asan_report_ ## type ## size(uptr addr) { \
188 GET_CALLER_PC_BP_SP; \
189 __asan_report_error(pc, bp, sp, addr, is_write, size); \
192 ASAN_REPORT_ERROR(load
, false, 1)
193 ASAN_REPORT_ERROR(load
, false, 2)
194 ASAN_REPORT_ERROR(load
, false, 4)
195 ASAN_REPORT_ERROR(load
, false, 8)
196 ASAN_REPORT_ERROR(load
, false, 16)
197 ASAN_REPORT_ERROR(store
, true, 1)
198 ASAN_REPORT_ERROR(store
, true, 2)
199 ASAN_REPORT_ERROR(store
, true, 4)
200 ASAN_REPORT_ERROR(store
, true, 8)
201 ASAN_REPORT_ERROR(store
, true, 16)
203 // Force the linker to keep the symbols for various ASan interface functions.
204 // We want to keep those in the executable in order to let the instrumented
205 // dynamic libraries access the symbol even if it is not used by the executable
206 // itself. This should help if the build system is removing dead code at link
208 static NOINLINE
void force_interface_symbols() {
209 volatile int fake_condition
= 0; // prevent dead condition elimination.
210 // __asan_report_* functions are noreturn, so we need a switch to prevent
211 // the compiler from removing any of them.
212 switch (fake_condition
) {
213 case 1: __asan_report_load1(0); break;
214 case 2: __asan_report_load2(0); break;
215 case 3: __asan_report_load4(0); break;
216 case 4: __asan_report_load8(0); break;
217 case 5: __asan_report_load16(0); break;
218 case 6: __asan_report_store1(0); break;
219 case 7: __asan_report_store2(0); break;
220 case 8: __asan_report_store4(0); break;
221 case 9: __asan_report_store8(0); break;
222 case 10: __asan_report_store16(0); break;
223 case 11: __asan_register_global(0, 0, 0); break;
224 case 12: __asan_register_globals(0, 0); break;
225 case 13: __asan_unregister_globals(0, 0); break;
226 case 14: __asan_set_death_callback(0); break;
227 case 15: __asan_set_error_report_callback(0); break;
228 case 16: __asan_handle_no_return(); break;
229 case 17: __asan_address_is_poisoned(0); break;
230 case 18: __asan_get_allocated_size(0); break;
231 case 19: __asan_get_current_allocated_bytes(); break;
232 case 20: __asan_get_estimated_allocated_size(0); break;
233 case 21: __asan_get_free_bytes(); break;
234 case 22: __asan_get_heap_size(); break;
235 case 23: __asan_get_ownership(0); break;
236 case 24: __asan_get_unmapped_bytes(); break;
237 case 25: __asan_poison_memory_region(0, 0); break;
238 case 26: __asan_unpoison_memory_region(0, 0); break;
239 case 27: __asan_set_error_exit_code(0); break;
240 case 28: __asan_stack_free(0, 0, 0); break;
241 case 29: __asan_stack_malloc(0, 0); break;
242 case 30: __asan_on_error(); break;
243 case 31: __asan_default_options(); break;
244 case 32: __asan_before_dynamic_init(0, 0); break;
245 case 33: __asan_after_dynamic_init(); break;
246 case 34: __asan_malloc_hook(0, 0); break;
247 case 35: __asan_free_hook(0); break;
248 case 36: __asan_symbolize(0, 0, 0); break;
249 case 37: __asan_poison_stack_memory(0, 0); break;
250 case 38: __asan_unpoison_stack_memory(0, 0); break;
254 static void asan_atexit() {
255 Printf("AddressSanitizer exit stats:\n");
256 __asan_print_accumulated_stats();
259 } // namespace __asan
261 // ---------------------- Interface ---------------- {{{1
262 using namespace __asan
; // NOLINT
264 int NOINLINE
__asan_set_error_exit_code(int exit_code
) {
265 int old
= flags()->exitcode
;
266 flags()->exitcode
= exit_code
;
270 void NOINLINE
__asan_handle_no_return() {
272 AsanThread
*curr_thread
= asanThreadRegistry().GetCurrent();
274 uptr PageSize
= GetPageSizeCached();
275 uptr top
= curr_thread
->stack_top();
276 uptr bottom
= ((uptr
)&local_stack
- PageSize
) & ~(PageSize
-1);
277 PoisonShadow(bottom
, top
- bottom
, 0);
280 void NOINLINE
__asan_set_death_callback(void (*callback
)(void)) {
281 death_callback
= callback
;
285 if (asan_inited
) return;
286 CHECK(!asan_init_is_running
&& "ASan init calls itself!");
287 asan_init_is_running
= true;
289 // Make sure we are not statically linked.
290 AsanDoesNotSupportStaticLinkage();
292 // Install tool-specific callbacks in sanitizer_common.
293 SetDieCallback(AsanDie
);
294 SetCheckFailedCallback(AsanCheckFailed
);
295 SetPrintfAndReportCallback(AppendToErrorMessageBuffer
);
297 // Initialize flags. This must be done early, because most of the
298 // initialization steps look at flags().
299 const char *options
= GetEnv("ASAN_OPTIONS");
300 InitializeFlags(flags(), options
);
301 __sanitizer_set_report_path(flags()->log_path
);
303 if (flags()->verbosity
&& options
) {
304 Report("Parsed ASAN_OPTIONS: %s\n", options
);
307 // Re-exec ourselves if we need to set additional env or command line args.
310 // Setup internal allocator callback.
311 SetLowLevelAllocateCallback(OnLowLevelAllocate
);
313 if (flags()->atexit
) {
318 InitializeAsanInterceptors();
320 ReplaceSystemMalloc();
321 ReplaceOperatorsNewAndDelete();
323 if (flags()->verbosity
) {
324 Printf("|| `[%p, %p]` || HighMem ||\n",
325 (void*)kHighMemBeg
, (void*)kHighMemEnd
);
326 Printf("|| `[%p, %p]` || HighShadow ||\n",
327 (void*)kHighShadowBeg
, (void*)kHighShadowEnd
);
328 Printf("|| `[%p, %p]` || ShadowGap ||\n",
329 (void*)kShadowGapBeg
, (void*)kShadowGapEnd
);
330 Printf("|| `[%p, %p]` || LowShadow ||\n",
331 (void*)kLowShadowBeg
, (void*)kLowShadowEnd
);
332 Printf("|| `[%p, %p]` || LowMem ||\n",
333 (void*)kLowMemBeg
, (void*)kLowMemEnd
);
334 Printf("MemToShadow(shadow): %p %p %p %p\n",
335 (void*)MEM_TO_SHADOW(kLowShadowBeg
),
336 (void*)MEM_TO_SHADOW(kLowShadowEnd
),
337 (void*)MEM_TO_SHADOW(kHighShadowBeg
),
338 (void*)MEM_TO_SHADOW(kHighShadowEnd
));
339 Printf("red_zone=%zu\n", (uptr
)flags()->redzone
);
340 Printf("malloc_context_size=%zu\n", (uptr
)flags()->malloc_context_size
);
342 Printf("SHADOW_SCALE: %zx\n", (uptr
)SHADOW_SCALE
);
343 Printf("SHADOW_GRANULARITY: %zx\n", (uptr
)SHADOW_GRANULARITY
);
344 Printf("SHADOW_OFFSET: %zx\n", (uptr
)SHADOW_OFFSET
);
345 CHECK(SHADOW_SCALE
>= 3 && SHADOW_SCALE
<= 7);
348 if (flags()->disable_core
) {
352 uptr shadow_start
= kLowShadowBeg
;
353 if (kLowShadowBeg
> 0) shadow_start
-= GetMmapGranularity();
354 uptr shadow_end
= kHighShadowEnd
;
355 if (MemoryRangeIsAvailable(shadow_start
, shadow_end
)) {
356 if (kLowShadowBeg
!= kLowShadowEnd
) {
357 // mmap the low shadow plus at least one page.
358 ReserveShadowMemoryRange(kLowShadowBeg
- GetMmapGranularity(),
361 // mmap the high shadow.
362 ReserveShadowMemoryRange(kHighShadowBeg
, kHighShadowEnd
);
364 void *prot
= Mprotect(kShadowGapBeg
, kShadowGapEnd
- kShadowGapBeg
+ 1);
365 CHECK(prot
== (void*)kShadowGapBeg
);
367 Report("Shadow memory range interleaves with an existing memory mapping. "
368 "ASan cannot proceed correctly. ABORTING.\n");
373 InstallSignalHandlers();
374 // Start symbolizer process if necessary.
375 if (flags()->symbolize
) {
376 const char *external_symbolizer
= GetEnv("ASAN_SYMBOLIZER_PATH");
377 if (external_symbolizer
) {
378 InitializeExternalSymbolizer(external_symbolizer
);
382 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
383 // should be set to 1 prior to initializing the threads.
385 asan_init_is_running
= false;
387 asanThreadRegistry().Init();
388 asanThreadRegistry().GetMain()->ThreadStart();
389 force_interface_symbols(); // no-op.
391 if (flags()->verbosity
) {
392 Report("AddressSanitizer Init done\n");
396 #if defined(ASAN_USE_PREINIT_ARRAY)
397 // On Linux, we force __asan_init to be called before anyone else
398 // by placing it into .preinit_array section.
399 // FIXME: do we have anything like this on Mac?
400 __attribute__((section(".preinit_array")))
401 typeof(__asan_init
) *__asan_preinit
=__asan_init
;
402 #elif defined(_WIN32) && defined(_DLL)
403 // On Windows, when using dynamic CRT (/MD), we can put a pointer
404 // to __asan_init into the global list of C initializers.
405 // See crt0dat.c in the CRT sources for the details.
406 #pragma section(".CRT$XIB", long, read) // NOLINT
407 __declspec(allocate(".CRT$XIB")) void (*__asan_preinit
)() = __asan_init
;