1 //===-- ubsan_handlers_cxx.cpp --------------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // Error logging entry points for the UBSan runtime, which are only used for C++
10 // compilations. This file is permitted to use language features which require
11 // linking against a C++ ABI library.
12 //
13 //===----------------------------------------------------------------------===//
14
15 #include "ubsan_platform.h"
16 #if CAN_SANITIZE_UB
17 #include "ubsan_handlers.h"
18 #include "ubsan_handlers_cxx.h"
19 #include "ubsan_diag.h"
20 #include "ubsan_type_hash.h"
21
22 #include "sanitizer_common/sanitizer_common.h"
23 #include "sanitizer_common/sanitizer_suppressions.h"
24
25 using namespace __sanitizer;
26 using namespace __ubsan;
27
28 namespace __ubsan {
29 extern const char *TypeCheckKinds[];
30 }
31
32 // Returns true if UBSan has printed an error report.
HandleDynamicTypeCacheMiss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash,ReportOptions Opts)33 static bool HandleDynamicTypeCacheMiss(
34 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
35 ReportOptions Opts) {
36 if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
37 // Just a cache miss. The type matches after all.
38 return false;
39
40 // Check if error report should be suppressed.
41 DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
42 if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
43 return false;
44
45 SourceLocation Loc = Data->Loc.acquire();
46 ErrorType ET = ErrorType::DynamicTypeMismatch;
47 if (ignoreReport(Loc, Opts, ET))
48 return false;
49
50 ScopedReport R(Opts, Loc, ET);
51
52 Diag(Loc, DL_Error, ET,
53 "%0 address %1 which does not point to an object of type %2")
54 << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
55
56 // If possible, say what type it actually points to.
57 if (!DTI.isValid()) {
58 if (DTI.getOffset() < -VptrMaxOffsetToTop || DTI.getOffset() > VptrMaxOffsetToTop) {
59 Diag(Pointer, DL_Note, ET,
60 "object has a possibly invalid vptr: abs(offset to top) too big")
61 << TypeName(DTI.getMostDerivedTypeName())
62 << Range(Pointer, Pointer + sizeof(uptr), "possibly invalid vptr");
63 } else {
64 Diag(Pointer, DL_Note, ET, "object has invalid vptr")
65 << TypeName(DTI.getMostDerivedTypeName())
66 << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
67 }
68 } else if (!DTI.getOffset())
69 Diag(Pointer, DL_Note, ET, "object is of type %0")
70 << TypeName(DTI.getMostDerivedTypeName())
71 << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
72 else
73 // FIXME: Find the type at the specified offset, and include that
74 // in the note.
75 Diag(Pointer - DTI.getOffset(), DL_Note, ET,
76 "object is base class subobject at offset %0 within object of type %1")
77 << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
78 << TypeName(DTI.getSubobjectTypeName())
79 << Range(Pointer, Pointer + sizeof(uptr),
80 "vptr for %2 base class of %1");
81 return true;
82 }
83
__ubsan_handle_dynamic_type_cache_miss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)84 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
85 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
86 GET_REPORT_OPTIONS(false);
87 HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
88 }
__ubsan_handle_dynamic_type_cache_miss_abort(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)89 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
90 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
91 // Note: -fsanitize=vptr is always recoverable.
92 GET_REPORT_OPTIONS(false);
93 if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts))
94 Die();
95 }
96
97 namespace __ubsan {
__ubsan_handle_cfi_bad_type(CFICheckFailData * Data,ValueHandle Vtable,bool ValidVtable,ReportOptions Opts)98 void __ubsan_handle_cfi_bad_type(CFICheckFailData *Data, ValueHandle Vtable,
99 bool ValidVtable, ReportOptions Opts) {
100 SourceLocation Loc = Data->Loc.acquire();
101 ErrorType ET = ErrorType::CFIBadType;
102
103 if (ignoreReport(Loc, Opts, ET))
104 return;
105
106 ScopedReport R(Opts, Loc, ET);
107 DynamicTypeInfo DTI = ValidVtable
108 ? getDynamicTypeInfoFromVtable((void *)Vtable)
109 : DynamicTypeInfo(0, 0, 0);
110
111 const char *CheckKindStr;
112 switch (Data->CheckKind) {
113 case CFITCK_VCall:
114 CheckKindStr = "virtual call";
115 break;
116 case CFITCK_NVCall:
117 CheckKindStr = "non-virtual call";
118 break;
119 case CFITCK_DerivedCast:
120 CheckKindStr = "base-to-derived cast";
121 break;
122 case CFITCK_UnrelatedCast:
123 CheckKindStr = "cast to unrelated type";
124 break;
125 case CFITCK_VMFCall:
126 CheckKindStr = "virtual pointer to member function call";
127 break;
128 case CFITCK_ICall:
129 case CFITCK_NVMFCall:
130 Die();
131 }
132
133 Diag(Loc, DL_Error, ET,
134 "control flow integrity check for type %0 failed during "
135 "%1 (vtable address %2)")
136 << Data->Type << CheckKindStr << (void *)Vtable;
137
138 // If possible, say what type it actually points to.
139 if (!DTI.isValid())
140 Diag(Vtable, DL_Note, ET, "invalid vtable");
141 else
142 Diag(Vtable, DL_Note, ET, "vtable is of type %0")
143 << TypeName(DTI.getMostDerivedTypeName());
144
145 // If the failure involved different DSOs for the check location and vtable,
146 // report the DSO names.
147 const char *DstModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Vtable);
148 if (!DstModule)
149 DstModule = "(unknown)";
150
151 const char *SrcModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Opts.pc);
152 if (!SrcModule)
153 SrcModule = "(unknown)";
154
155 if (internal_strcmp(SrcModule, DstModule))
156 Diag(Loc, DL_Note, ET, "check failed in %0, vtable located in %1")
157 << SrcModule << DstModule;
158 }
159
handleFunctionTypeMismatch(FunctionTypeMismatchData * Data,ValueHandle Function,ValueHandle calleeRTTI,ValueHandle fnRTTI,ReportOptions Opts)160 static bool handleFunctionTypeMismatch(FunctionTypeMismatchData *Data,
161 ValueHandle Function,
162 ValueHandle calleeRTTI,
163 ValueHandle fnRTTI, ReportOptions Opts) {
164 if (checkTypeInfoEquality(reinterpret_cast<void *>(calleeRTTI),
165 reinterpret_cast<void *>(fnRTTI)))
166 return false;
167
168 SourceLocation CallLoc = Data->Loc.acquire();
169 ErrorType ET = ErrorType::FunctionTypeMismatch;
170
171 if (ignoreReport(CallLoc, Opts, ET))
172 return true;
173
174 ScopedReport R(Opts, CallLoc, ET);
175
176 SymbolizedStackHolder FLoc(getSymbolizedLocation(Function));
177 const char *FName = FLoc.get()->info.function;
178 if (!FName)
179 FName = "(unknown)";
180
181 Diag(CallLoc, DL_Error, ET,
182 "call to function %0 through pointer to incorrect function type %1")
183 << FName << Data->Type;
184 Diag(FLoc, DL_Note, ET, "%0 defined here") << FName;
185 return true;
186 }
187
__ubsan_handle_function_type_mismatch_v1(FunctionTypeMismatchData * Data,ValueHandle Function,ValueHandle calleeRTTI,ValueHandle fnRTTI)188 void __ubsan_handle_function_type_mismatch_v1(FunctionTypeMismatchData *Data,
189 ValueHandle Function,
190 ValueHandle calleeRTTI,
191 ValueHandle fnRTTI) {
192 GET_REPORT_OPTIONS(false);
193 handleFunctionTypeMismatch(Data, Function, calleeRTTI, fnRTTI, Opts);
194 }
195
__ubsan_handle_function_type_mismatch_v1_abort(FunctionTypeMismatchData * Data,ValueHandle Function,ValueHandle calleeRTTI,ValueHandle fnRTTI)196 void __ubsan_handle_function_type_mismatch_v1_abort(
197 FunctionTypeMismatchData *Data, ValueHandle Function,
198 ValueHandle calleeRTTI, ValueHandle fnRTTI) {
199 GET_REPORT_OPTIONS(true);
200 if (handleFunctionTypeMismatch(Data, Function, calleeRTTI, fnRTTI, Opts))
201 Die();
202 }
203 } // namespace __ubsan
204
205 #endif // CAN_SANITIZE_UB
206