1 //===-- asan_poisoning.cc -------------------------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is a part of AddressSanitizer, an address sanity checker.
11 //
12 // Shadow memory poisoning by ASan RTL and by user application.
13 //===----------------------------------------------------------------------===//
14
15 #include "asan_interceptors.h"
16 #include "asan_internal.h"
17 #include "asan_mapping.h"
18 #include "sanitizer/asan_interface.h"
19
20 namespace __asan {
21
PoisonShadow(uptr addr,uptr size,u8 value)22 void PoisonShadow(uptr addr, uptr size, u8 value) {
23 CHECK(AddrIsAlignedByGranularity(addr));
24 CHECK(AddrIsAlignedByGranularity(addr + size));
25 uptr shadow_beg = MemToShadow(addr);
26 uptr shadow_end = MemToShadow(addr + size);
27 CHECK(REAL(memset) != 0);
28 REAL(memset)((void*)shadow_beg, value, shadow_end - shadow_beg);
29 }
30
PoisonShadowPartialRightRedzone(uptr addr,uptr size,uptr redzone_size,u8 value)31 void PoisonShadowPartialRightRedzone(uptr addr,
32 uptr size,
33 uptr redzone_size,
34 u8 value) {
35 CHECK(AddrIsAlignedByGranularity(addr));
36 u8 *shadow = (u8*)MemToShadow(addr);
37 for (uptr i = 0; i < redzone_size;
38 i += SHADOW_GRANULARITY, shadow++) {
39 if (i + SHADOW_GRANULARITY <= size) {
40 *shadow = 0; // fully addressable
41 } else if (i >= size) {
42 *shadow = (SHADOW_GRANULARITY == 128) ? 0xff : value; // unaddressable
43 } else {
44 *shadow = size - i; // first size-i bytes are addressable
45 }
46 }
47 }
48
49
50 struct ShadowSegmentEndpoint {
51 u8 *chunk;
52 s8 offset; // in [0, SHADOW_GRANULARITY)
53 s8 value; // = *chunk;
54
ShadowSegmentEndpoint__asan::ShadowSegmentEndpoint55 explicit ShadowSegmentEndpoint(uptr address) {
56 chunk = (u8*)MemToShadow(address);
57 offset = address & (SHADOW_GRANULARITY - 1);
58 value = *chunk;
59 }
60 };
61
62 } // namespace __asan
63
64 // ---------------------- Interface ---------------- {{{1
65 using namespace __asan; // NOLINT
66
67 // Current implementation of __asan_(un)poison_memory_region doesn't check
68 // that user program (un)poisons the memory it owns. It poisons memory
69 // conservatively, and unpoisons progressively to make sure asan shadow
70 // mapping invariant is preserved (see detailed mapping description here:
71 // http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm).
72 //
73 // * if user asks to poison region [left, right), the program poisons
74 // at least [left, AlignDown(right)).
75 // * if user asks to unpoison region [left, right), the program unpoisons
76 // at most [AlignDown(left), right).
__asan_poison_memory_region(void const volatile * addr,uptr size)77 void __asan_poison_memory_region(void const volatile *addr, uptr size) {
78 if (!flags()->allow_user_poisoning || size == 0) return;
79 uptr beg_addr = (uptr)addr;
80 uptr end_addr = beg_addr + size;
81 if (flags()->verbosity >= 1) {
82 Printf("Trying to poison memory region [%p, %p)\n",
83 (void*)beg_addr, (void*)end_addr);
84 }
85 ShadowSegmentEndpoint beg(beg_addr);
86 ShadowSegmentEndpoint end(end_addr);
87 if (beg.chunk == end.chunk) {
88 CHECK(beg.offset < end.offset);
89 s8 value = beg.value;
90 CHECK(value == end.value);
91 // We can only poison memory if the byte in end.offset is unaddressable.
92 // No need to re-poison memory if it is poisoned already.
93 if (value > 0 && value <= end.offset) {
94 if (beg.offset > 0) {
95 *beg.chunk = Min(value, beg.offset);
96 } else {
97 *beg.chunk = kAsanUserPoisonedMemoryMagic;
98 }
99 }
100 return;
101 }
102 CHECK(beg.chunk < end.chunk);
103 if (beg.offset > 0) {
104 // Mark bytes from beg.offset as unaddressable.
105 if (beg.value == 0) {
106 *beg.chunk = beg.offset;
107 } else {
108 *beg.chunk = Min(beg.value, beg.offset);
109 }
110 beg.chunk++;
111 }
112 REAL(memset)(beg.chunk, kAsanUserPoisonedMemoryMagic, end.chunk - beg.chunk);
113 // Poison if byte in end.offset is unaddressable.
114 if (end.value > 0 && end.value <= end.offset) {
115 *end.chunk = kAsanUserPoisonedMemoryMagic;
116 }
117 }
118
__asan_unpoison_memory_region(void const volatile * addr,uptr size)119 void __asan_unpoison_memory_region(void const volatile *addr, uptr size) {
120 if (!flags()->allow_user_poisoning || size == 0) return;
121 uptr beg_addr = (uptr)addr;
122 uptr end_addr = beg_addr + size;
123 if (flags()->verbosity >= 1) {
124 Printf("Trying to unpoison memory region [%p, %p)\n",
125 (void*)beg_addr, (void*)end_addr);
126 }
127 ShadowSegmentEndpoint beg(beg_addr);
128 ShadowSegmentEndpoint end(end_addr);
129 if (beg.chunk == end.chunk) {
130 CHECK(beg.offset < end.offset);
131 s8 value = beg.value;
132 CHECK(value == end.value);
133 // We unpoison memory bytes up to enbytes up to end.offset if it is not
134 // unpoisoned already.
135 if (value != 0) {
136 *beg.chunk = Max(value, end.offset);
137 }
138 return;
139 }
140 CHECK(beg.chunk < end.chunk);
141 if (beg.offset > 0) {
142 *beg.chunk = 0;
143 beg.chunk++;
144 }
145 REAL(memset)(beg.chunk, 0, end.chunk - beg.chunk);
146 if (end.offset > 0 && end.value != 0) {
147 *end.chunk = Max(end.value, end.offset);
148 }
149 }
150
__asan_address_is_poisoned(void const volatile * addr)151 bool __asan_address_is_poisoned(void const volatile *addr) {
152 return __asan::AddressIsPoisoned((uptr)addr);
153 }
154