1 //===-- asan_globals.cc ---------------------------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is a part of AddressSanitizer, an address sanity checker.
11 //
12 // Handle globals.
13 //===----------------------------------------------------------------------===//
14
15 #include "asan_interceptors.h"
16 #include "asan_internal.h"
17 #include "asan_mapping.h"
18 #include "asan_poisoning.h"
19 #include "asan_report.h"
20 #include "asan_stack.h"
21 #include "asan_stats.h"
22 #include "asan_suppressions.h"
23 #include "asan_thread.h"
24 #include "sanitizer_common/sanitizer_common.h"
25 #include "sanitizer_common/sanitizer_mutex.h"
26 #include "sanitizer_common/sanitizer_placement_new.h"
27 #include "sanitizer_common/sanitizer_stackdepot.h"
28
29 namespace __asan {
30
31 typedef __asan_global Global;
32
33 struct ListOfGlobals {
34 const Global *g;
35 ListOfGlobals *next;
36 };
37
38 static BlockingMutex mu_for_globals(LINKER_INITIALIZED);
39 static LowLevelAllocator allocator_for_globals;
40 static ListOfGlobals *list_of_all_globals;
41
42 static const int kDynamicInitGlobalsInitialCapacity = 512;
43 struct DynInitGlobal {
44 Global g;
45 bool initialized;
46 };
47 typedef InternalMmapVector<DynInitGlobal> VectorOfGlobals;
48 // Lazy-initialized and never deleted.
49 static VectorOfGlobals *dynamic_init_globals;
50
51 // We want to remember where a certain range of globals was registered.
52 struct GlobalRegistrationSite {
53 u32 stack_id;
54 Global *g_first, *g_last;
55 };
56 typedef InternalMmapVector<GlobalRegistrationSite> GlobalRegistrationSiteVector;
57 static GlobalRegistrationSiteVector *global_registration_site_vector;
58
PoisonShadowForGlobal(const Global * g,u8 value)59 ALWAYS_INLINE void PoisonShadowForGlobal(const Global *g, u8 value) {
60 FastPoisonShadow(g->beg, g->size_with_redzone, value);
61 }
62
PoisonRedZones(const Global & g)63 ALWAYS_INLINE void PoisonRedZones(const Global &g) {
64 uptr aligned_size = RoundUpTo(g.size, SHADOW_GRANULARITY);
65 FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size,
66 kAsanGlobalRedzoneMagic);
67 if (g.size != aligned_size) {
68 FastPoisonShadowPartialRightRedzone(
69 g.beg + RoundDownTo(g.size, SHADOW_GRANULARITY),
70 g.size % SHADOW_GRANULARITY,
71 SHADOW_GRANULARITY,
72 kAsanGlobalRedzoneMagic);
73 }
74 }
75
76 const uptr kMinimalDistanceFromAnotherGlobal = 64;
77
IsAddressNearGlobal(uptr addr,const __asan_global & g)78 static bool IsAddressNearGlobal(uptr addr, const __asan_global &g) {
79 if (addr <= g.beg - kMinimalDistanceFromAnotherGlobal) return false;
80 if (addr >= g.beg + g.size_with_redzone) return false;
81 return true;
82 }
83
ReportGlobal(const Global & g,const char * prefix)84 static void ReportGlobal(const Global &g, const char *prefix) {
85 Report("%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n",
86 prefix, &g, (void *)g.beg, g.size, g.size_with_redzone, g.name,
87 g.module_name, g.has_dynamic_init);
88 if (g.location) {
89 Report(" location (%p): name=%s[%p], %d %d\n", g.location,
90 g.location->filename, g.location->filename, g.location->line_no,
91 g.location->column_no);
92 }
93 }
94
FindRegistrationSite(const Global * g)95 static u32 FindRegistrationSite(const Global *g) {
96 mu_for_globals.CheckLocked();
97 CHECK(global_registration_site_vector);
98 for (uptr i = 0, n = global_registration_site_vector->size(); i < n; i++) {
99 GlobalRegistrationSite &grs = (*global_registration_site_vector)[i];
100 if (g >= grs.g_first && g <= grs.g_last)
101 return grs.stack_id;
102 }
103 return 0;
104 }
105
GetGlobalsForAddress(uptr addr,Global * globals,u32 * reg_sites,int max_globals)106 int GetGlobalsForAddress(uptr addr, Global *globals, u32 *reg_sites,
107 int max_globals) {
108 if (!flags()->report_globals) return 0;
109 BlockingMutexLock lock(&mu_for_globals);
110 int res = 0;
111 for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
112 const Global &g = *l->g;
113 if (flags()->report_globals >= 2)
114 ReportGlobal(g, "Search");
115 if (IsAddressNearGlobal(addr, g)) {
116 globals[res] = g;
117 if (reg_sites)
118 reg_sites[res] = FindRegistrationSite(&g);
119 res++;
120 if (res == max_globals) break;
121 }
122 }
123 return res;
124 }
125
GetInfoForAddressIfGlobal(uptr addr,AddressDescription * descr)126 bool GetInfoForAddressIfGlobal(uptr addr, AddressDescription *descr) {
127 Global g = {};
128 if (GetGlobalsForAddress(addr, &g, nullptr, 1)) {
129 internal_strncpy(descr->name, g.name, descr->name_size);
130 descr->region_address = g.beg;
131 descr->region_size = g.size;
132 descr->region_kind = "global";
133 return true;
134 }
135 return false;
136 }
137
138 // Register a global variable.
139 // This function may be called more than once for every global
140 // so we store the globals in a map.
RegisterGlobal(const Global * g)141 static void RegisterGlobal(const Global *g) {
142 CHECK(asan_inited);
143 if (flags()->report_globals >= 2)
144 ReportGlobal(*g, "Added");
145 CHECK(flags()->report_globals);
146 CHECK(AddrIsInMem(g->beg));
147 CHECK(AddrIsAlignedByGranularity(g->beg));
148 CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
149 if (flags()->detect_odr_violation) {
150 // Try detecting ODR (One Definition Rule) violation, i.e. the situation
151 // where two globals with the same name are defined in different modules.
152 if (__asan_region_is_poisoned(g->beg, g->size_with_redzone)) {
153 // This check may not be enough: if the first global is much larger
154 // the entire redzone of the second global may be within the first global.
155 for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
156 if (g->beg == l->g->beg &&
157 (flags()->detect_odr_violation >= 2 || g->size != l->g->size) &&
158 !IsODRViolationSuppressed(g->name))
159 ReportODRViolation(g, FindRegistrationSite(g),
160 l->g, FindRegistrationSite(l->g));
161 }
162 }
163 }
164 if (CanPoisonMemory())
165 PoisonRedZones(*g);
166 ListOfGlobals *l = new(allocator_for_globals) ListOfGlobals;
167 l->g = g;
168 l->next = list_of_all_globals;
169 list_of_all_globals = l;
170 if (g->has_dynamic_init) {
171 if (!dynamic_init_globals) {
172 dynamic_init_globals = new(allocator_for_globals)
173 VectorOfGlobals(kDynamicInitGlobalsInitialCapacity);
174 }
175 DynInitGlobal dyn_global = { *g, false };
176 dynamic_init_globals->push_back(dyn_global);
177 }
178 }
179
UnregisterGlobal(const Global * g)180 static void UnregisterGlobal(const Global *g) {
181 CHECK(asan_inited);
182 if (flags()->report_globals >= 2)
183 ReportGlobal(*g, "Removed");
184 CHECK(flags()->report_globals);
185 CHECK(AddrIsInMem(g->beg));
186 CHECK(AddrIsAlignedByGranularity(g->beg));
187 CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
188 if (CanPoisonMemory())
189 PoisonShadowForGlobal(g, 0);
190 // We unpoison the shadow memory for the global but we do not remove it from
191 // the list because that would require O(n^2) time with the current list
192 // implementation. It might not be worth doing anyway.
193 }
194
StopInitOrderChecking()195 void StopInitOrderChecking() {
196 BlockingMutexLock lock(&mu_for_globals);
197 if (!flags()->check_initialization_order || !dynamic_init_globals)
198 return;
199 flags()->check_initialization_order = false;
200 for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
201 DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
202 const Global *g = &dyn_g.g;
203 // Unpoison the whole global.
204 PoisonShadowForGlobal(g, 0);
205 // Poison redzones back.
206 PoisonRedZones(*g);
207 }
208 }
209
210 } // namespace __asan
211
212 // ---------------------- Interface ---------------- {{{1
213 using namespace __asan; // NOLINT
214
215 // Register an array of globals.
__asan_register_globals(__asan_global * globals,uptr n)216 void __asan_register_globals(__asan_global *globals, uptr n) {
217 if (!flags()->report_globals) return;
218 GET_STACK_TRACE_MALLOC;
219 u32 stack_id = StackDepotPut(stack);
220 BlockingMutexLock lock(&mu_for_globals);
221 if (!global_registration_site_vector)
222 global_registration_site_vector =
223 new(allocator_for_globals) GlobalRegistrationSiteVector(128);
224 GlobalRegistrationSite site = {stack_id, &globals[0], &globals[n - 1]};
225 global_registration_site_vector->push_back(site);
226 if (flags()->report_globals >= 2) {
227 PRINT_CURRENT_STACK();
228 Printf("=== ID %d; %p %p\n", stack_id, &globals[0], &globals[n - 1]);
229 }
230 for (uptr i = 0; i < n; i++) {
231 RegisterGlobal(&globals[i]);
232 }
233 }
234
235 // Unregister an array of globals.
236 // We must do this when a shared objects gets dlclosed.
__asan_unregister_globals(__asan_global * globals,uptr n)237 void __asan_unregister_globals(__asan_global *globals, uptr n) {
238 if (!flags()->report_globals) return;
239 BlockingMutexLock lock(&mu_for_globals);
240 for (uptr i = 0; i < n; i++) {
241 UnregisterGlobal(&globals[i]);
242 }
243 }
244
245 // This method runs immediately prior to dynamic initialization in each TU,
246 // when all dynamically initialized globals are unpoisoned. This method
247 // poisons all global variables not defined in this TU, so that a dynamic
248 // initializer can only touch global variables in the same TU.
__asan_before_dynamic_init(const char * module_name)249 void __asan_before_dynamic_init(const char *module_name) {
250 if (!flags()->check_initialization_order ||
251 !CanPoisonMemory())
252 return;
253 bool strict_init_order = flags()->strict_init_order;
254 CHECK(dynamic_init_globals);
255 CHECK(module_name);
256 CHECK(asan_inited);
257 BlockingMutexLock lock(&mu_for_globals);
258 if (flags()->report_globals >= 3)
259 Printf("DynInitPoison module: %s\n", module_name);
260 for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
261 DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
262 const Global *g = &dyn_g.g;
263 if (dyn_g.initialized)
264 continue;
265 if (g->module_name != module_name)
266 PoisonShadowForGlobal(g, kAsanInitializationOrderMagic);
267 else if (!strict_init_order)
268 dyn_g.initialized = true;
269 }
270 }
271
272 // This method runs immediately after dynamic initialization in each TU, when
273 // all dynamically initialized globals except for those defined in the current
274 // TU are poisoned. It simply unpoisons all dynamically initialized globals.
__asan_after_dynamic_init()275 void __asan_after_dynamic_init() {
276 if (!flags()->check_initialization_order ||
277 !CanPoisonMemory())
278 return;
279 CHECK(asan_inited);
280 BlockingMutexLock lock(&mu_for_globals);
281 // FIXME: Optionally report that we're unpoisoning globals from a module.
282 for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
283 DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
284 const Global *g = &dyn_g.g;
285 if (!dyn_g.initialized) {
286 // Unpoison the whole global.
287 PoisonShadowForGlobal(g, 0);
288 // Poison redzones back.
289 PoisonRedZones(*g);
290 }
291 }
292 }
293