1 //===-- msan.h --------------------------------------------------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is a part of MemorySanitizer.
11 //
12 // Private MSan header.
13 //===----------------------------------------------------------------------===//
14
15 #ifndef MSAN_H
16 #define MSAN_H
17
18 #include "sanitizer_common/sanitizer_flags.h"
19 #include "sanitizer_common/sanitizer_internal_defs.h"
20 #include "sanitizer_common/sanitizer_stacktrace.h"
21 #include "msan_interface_internal.h"
22 #include "msan_flags.h"
23 #include "ubsan/ubsan_platform.h"
24
25 #ifndef MSAN_REPLACE_OPERATORS_NEW_AND_DELETE
26 # define MSAN_REPLACE_OPERATORS_NEW_AND_DELETE 1
27 #endif
28
29 #ifndef MSAN_CONTAINS_UBSAN
30 # define MSAN_CONTAINS_UBSAN CAN_SANITIZE_UB
31 #endif
32
33 struct MappingDesc {
34 uptr start;
35 uptr end;
36 enum Type {
37 INVALID, APP, SHADOW, ORIGIN
38 } type;
39 const char *name;
40 };
41
42
43 #if SANITIZER_LINUX && defined(__mips64)
44
45 // Everything is above 0x00e000000000.
46 const MappingDesc kMemoryLayout[] = {
47 {0x000000000000ULL, 0x00a000000000ULL, MappingDesc::INVALID, "invalid"},
48 {0x00a000000000ULL, 0x00c000000000ULL, MappingDesc::SHADOW, "shadow"},
49 {0x00c000000000ULL, 0x00e000000000ULL, MappingDesc::ORIGIN, "origin"},
50 {0x00e000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app"}};
51
52 #define MEM_TO_SHADOW(mem) (((uptr)(mem)) & ~0x4000000000ULL)
53 #define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x002000000000)
54
55 #elif SANITIZER_LINUX && defined(__aarch64__)
56
57 // The mapping describes both 39-bits and 42-bits. AArch64 maps:
58 // - 0x00000000000-0x00010000000: 39/42-bits program own segments
59 // - 0x05500000000-0x05600000000: 39-bits PIE program segments
60 // - 0x07f80000000-0x07fffffffff: 39-bits libraries segments
61 // - 0x2aa00000000-0x2ab00000000: 42-bits PIE program segments
62 // - 0x3ff00000000-0x3ffffffffff: 42-bits libraries segments
63 // It is fragmented in multiples segments to increase the memory available
64 // on 42-bits (12.21% of total VMA available for 42-bits and 13.28 for
65 // 39 bits).
66 const MappingDesc kMemoryLayout[] = {
67 {0x00000000000ULL, 0x01000000000ULL, MappingDesc::INVALID, "invalid"},
68 {0x01000000000ULL, 0x02000000000ULL, MappingDesc::SHADOW, "shadow-2"},
69 {0x02000000000ULL, 0x03000000000ULL, MappingDesc::ORIGIN, "origin-2"},
70 {0x03000000000ULL, 0x04000000000ULL, MappingDesc::SHADOW, "shadow-1"},
71 {0x04000000000ULL, 0x05000000000ULL, MappingDesc::ORIGIN, "origin-1"},
72 {0x05000000000ULL, 0x06000000000ULL, MappingDesc::APP, "app-1"},
73 {0x06000000000ULL, 0x07000000000ULL, MappingDesc::INVALID, "invalid"},
74 {0x07000000000ULL, 0x08000000000ULL, MappingDesc::APP, "app-2"},
75 {0x08000000000ULL, 0x09000000000ULL, MappingDesc::INVALID, "invalid"},
76 // The mappings below are used only for 42-bits VMA.
77 {0x09000000000ULL, 0x0A000000000ULL, MappingDesc::SHADOW, "shadow-3"},
78 {0x0A000000000ULL, 0x0B000000000ULL, MappingDesc::ORIGIN, "origin-3"},
79 {0x0B000000000ULL, 0x0F000000000ULL, MappingDesc::INVALID, "invalid"},
80 {0x0F000000000ULL, 0x10000000000ULL, MappingDesc::APP, "app-3"},
81 {0x10000000000ULL, 0x11000000000ULL, MappingDesc::INVALID, "invalid"},
82 {0x11000000000ULL, 0x12000000000ULL, MappingDesc::APP, "app-4"},
83 {0x12000000000ULL, 0x17000000000ULL, MappingDesc::INVALID, "invalid"},
84 {0x17000000000ULL, 0x18000000000ULL, MappingDesc::SHADOW, "shadow-4"},
85 {0x18000000000ULL, 0x19000000000ULL, MappingDesc::ORIGIN, "origin-4"},
86 {0x19000000000ULL, 0x20000000000ULL, MappingDesc::INVALID, "invalid"},
87 {0x20000000000ULL, 0x21000000000ULL, MappingDesc::APP, "app-5"},
88 {0x21000000000ULL, 0x26000000000ULL, MappingDesc::INVALID, "invalid"},
89 {0x26000000000ULL, 0x27000000000ULL, MappingDesc::SHADOW, "shadow-5"},
90 {0x27000000000ULL, 0x28000000000ULL, MappingDesc::ORIGIN, "origin-5"},
91 {0x28000000000ULL, 0x29000000000ULL, MappingDesc::SHADOW, "shadow-7"},
92 {0x29000000000ULL, 0x2A000000000ULL, MappingDesc::ORIGIN, "origin-7"},
93 {0x2A000000000ULL, 0x2B000000000ULL, MappingDesc::APP, "app-6"},
94 {0x2B000000000ULL, 0x2C000000000ULL, MappingDesc::INVALID, "invalid"},
95 {0x2C000000000ULL, 0x2D000000000ULL, MappingDesc::SHADOW, "shadow-6"},
96 {0x2D000000000ULL, 0x2E000000000ULL, MappingDesc::ORIGIN, "origin-6"},
97 {0x2E000000000ULL, 0x2F000000000ULL, MappingDesc::APP, "app-7"},
98 {0x2F000000000ULL, 0x39000000000ULL, MappingDesc::INVALID, "invalid"},
99 {0x39000000000ULL, 0x3A000000000ULL, MappingDesc::SHADOW, "shadow-9"},
100 {0x3A000000000ULL, 0x3B000000000ULL, MappingDesc::ORIGIN, "origin-9"},
101 {0x3B000000000ULL, 0x3C000000000ULL, MappingDesc::APP, "app-8"},
102 {0x3C000000000ULL, 0x3D000000000ULL, MappingDesc::INVALID, "invalid"},
103 {0x3D000000000ULL, 0x3E000000000ULL, MappingDesc::SHADOW, "shadow-8"},
104 {0x3E000000000ULL, 0x3F000000000ULL, MappingDesc::ORIGIN, "origin-8"},
105 {0x3F000000000ULL, 0x40000000000ULL, MappingDesc::APP, "app-9"},
106 };
107 # define MEM_TO_SHADOW(mem) ((uptr)mem ^ 0x6000000000ULL)
108 # define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x1000000000ULL)
109
110 #elif SANITIZER_LINUX && SANITIZER_PPC64
111
112 const MappingDesc kMemoryLayout[] = {
113 {0x000000000000ULL, 0x000100000000ULL, MappingDesc::APP, "low memory"},
114 {0x000100000000ULL, 0x080000000000ULL, MappingDesc::INVALID, "invalid"},
115 {0x080000000000ULL, 0x180100000000ULL, MappingDesc::SHADOW, "shadow"},
116 {0x180100000000ULL, 0x1C0000000000ULL, MappingDesc::INVALID, "invalid"},
117 {0x1C0000000000ULL, 0x2C0100000000ULL, MappingDesc::ORIGIN, "origin"},
118 {0x2C0100000000ULL, 0x300000000000ULL, MappingDesc::INVALID, "invalid"},
119 {0x300000000000ULL, 0x400000000000ULL, MappingDesc::APP, "high memory"}};
120
121 // Maps low and high app ranges to contiguous space with zero base:
122 // Low: 0000 0000 0000 - 0000 ffff ffff -> 1000 0000 0000 - 1000 ffff ffff
123 // High: 3000 0000 0000 - 3fff ffff ffff -> 0000 0000 0000 - 0fff ffff ffff
124 #define LINEARIZE_MEM(mem) \
125 (((uptr)(mem) & ~0x200000000000ULL) ^ 0x100000000000ULL)
126 #define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x080000000000ULL)
127 #define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x140000000000ULL)
128
129 #elif SANITIZER_FREEBSD && SANITIZER_WORDSIZE == 64
130
131 // Low memory: main binary, MAP_32BIT mappings and modules
132 // High memory: heap, modules and main thread stack
133 const MappingDesc kMemoryLayout[] = {
134 {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "low memory"},
135 {0x010000000000ULL, 0x100000000000ULL, MappingDesc::INVALID, "invalid"},
136 {0x100000000000ULL, 0x310000000000ULL, MappingDesc::SHADOW, "shadow"},
137 {0x310000000000ULL, 0x380000000000ULL, MappingDesc::INVALID, "invalid"},
138 {0x380000000000ULL, 0x590000000000ULL, MappingDesc::ORIGIN, "origin"},
139 {0x590000000000ULL, 0x600000000000ULL, MappingDesc::INVALID, "invalid"},
140 {0x600000000000ULL, 0x800000000000ULL, MappingDesc::APP, "high memory"}};
141
142 // Maps low and high app ranges to contiguous space with zero base:
143 // Low: 0000 0000 0000 - 00ff ffff ffff -> 2000 0000 0000 - 20ff ffff ffff
144 // High: 6000 0000 0000 - 7fff ffff ffff -> 0000 0000 0000 - 1fff ffff ffff
145 #define LINEARIZE_MEM(mem) \
146 (((uptr)(mem) & ~0xc00000000000ULL) ^ 0x200000000000ULL)
147 #define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x100000000000ULL)
148 #define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x280000000000)
149
150 #elif SANITIZER_LINUX && SANITIZER_WORDSIZE == 64
151
152 #ifdef MSAN_LINUX_X86_64_OLD_MAPPING
153 // Requries PIE binary and ASLR enabled.
154 // Main thread stack and DSOs at 0x7f0000000000 (sometimes 0x7e0000000000).
155 // Heap at 0x600000000000.
156 const MappingDesc kMemoryLayout[] = {
157 {0x000000000000ULL, 0x200000000000ULL, MappingDesc::INVALID, "invalid"},
158 {0x200000000000ULL, 0x400000000000ULL, MappingDesc::SHADOW, "shadow"},
159 {0x400000000000ULL, 0x600000000000ULL, MappingDesc::ORIGIN, "origin"},
160 {0x600000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app"}};
161
162 #define MEM_TO_SHADOW(mem) (((uptr)(mem)) & ~0x400000000000ULL)
163 #define SHADOW_TO_ORIGIN(mem) (((uptr)(mem)) + 0x200000000000ULL)
164 #else // MSAN_LINUX_X86_64_OLD_MAPPING
165 // All of the following configurations are supported.
166 // ASLR disabled: main executable and DSOs at 0x555550000000
167 // PIE and ASLR: main executable and DSOs at 0x7f0000000000
168 // non-PIE: main executable below 0x100000000, DSOs at 0x7f0000000000
169 // Heap at 0x700000000000.
170 const MappingDesc kMemoryLayout[] = {
171 {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app-1"},
172 {0x010000000000ULL, 0x100000000000ULL, MappingDesc::SHADOW, "shadow-2"},
173 {0x100000000000ULL, 0x110000000000ULL, MappingDesc::INVALID, "invalid"},
174 {0x110000000000ULL, 0x200000000000ULL, MappingDesc::ORIGIN, "origin-2"},
175 {0x200000000000ULL, 0x300000000000ULL, MappingDesc::SHADOW, "shadow-3"},
176 {0x300000000000ULL, 0x400000000000ULL, MappingDesc::ORIGIN, "origin-3"},
177 {0x400000000000ULL, 0x500000000000ULL, MappingDesc::INVALID, "invalid"},
178 {0x500000000000ULL, 0x510000000000ULL, MappingDesc::SHADOW, "shadow-1"},
179 {0x510000000000ULL, 0x600000000000ULL, MappingDesc::APP, "app-2"},
180 {0x600000000000ULL, 0x610000000000ULL, MappingDesc::ORIGIN, "origin-1"},
181 {0x610000000000ULL, 0x700000000000ULL, MappingDesc::INVALID, "invalid"},
182 {0x700000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app-3"}};
183 #define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x500000000000ULL)
184 #define SHADOW_TO_ORIGIN(mem) (((uptr)(mem)) + 0x100000000000ULL)
185 #endif // MSAN_LINUX_X86_64_OLD_MAPPING
186
187 #else
188 #error "Unsupported platform"
189 #endif
190
191 const uptr kMemoryLayoutSize = sizeof(kMemoryLayout) / sizeof(kMemoryLayout[0]);
192
193 #define MEM_TO_ORIGIN(mem) (SHADOW_TO_ORIGIN(MEM_TO_SHADOW((mem))))
194
195 #ifndef __clang__
196 __attribute__((optimize("unroll-loops")))
197 #endif
addr_is_type(uptr addr,MappingDesc::Type mapping_type)198 inline bool addr_is_type(uptr addr, MappingDesc::Type mapping_type) {
199 // It is critical for performance that this loop is unrolled (because then it is
200 // simplified into just a few constant comparisons).
201 #ifdef __clang__
202 #pragma unroll
203 #endif
204 for (unsigned i = 0; i < kMemoryLayoutSize; ++i)
205 if (kMemoryLayout[i].type == mapping_type &&
206 addr >= kMemoryLayout[i].start && addr < kMemoryLayout[i].end)
207 return true;
208 return false;
209 }
210
211 #define MEM_IS_APP(mem) addr_is_type((uptr)(mem), MappingDesc::APP)
212 #define MEM_IS_SHADOW(mem) addr_is_type((uptr)(mem), MappingDesc::SHADOW)
213 #define MEM_IS_ORIGIN(mem) addr_is_type((uptr)(mem), MappingDesc::ORIGIN)
214
215 // These constants must be kept in sync with the ones in MemorySanitizer.cc.
216 const int kMsanParamTlsSize = 800;
217 const int kMsanRetvalTlsSize = 800;
218
219 namespace __msan {
220 extern int msan_inited;
221 extern bool msan_init_is_running;
222 extern int msan_report_count;
223
224 bool ProtectRange(uptr beg, uptr end);
225 bool InitShadow(bool init_origins);
226 char *GetProcSelfMaps();
227 void InitializeInterceptors();
228
229 void MsanAllocatorInit();
230 void MsanAllocatorThreadFinish();
231 void *MsanCalloc(StackTrace *stack, uptr nmemb, uptr size);
232 void *MsanReallocate(StackTrace *stack, void *oldp, uptr size,
233 uptr alignment, bool zeroise);
234 void MsanDeallocate(StackTrace *stack, void *ptr);
235 void InstallTrapHandler();
236 void InstallAtExitHandler();
237
238 const char *GetStackOriginDescr(u32 id, uptr *pc);
239
240 void EnterSymbolizer();
241 void ExitSymbolizer();
242 bool IsInSymbolizer();
243
244 struct SymbolizerScope {
SymbolizerScopeSymbolizerScope245 SymbolizerScope() { EnterSymbolizer(); }
~SymbolizerScopeSymbolizerScope246 ~SymbolizerScope() { ExitSymbolizer(); }
247 };
248
249 void PrintWarning(uptr pc, uptr bp);
250 void PrintWarningWithOrigin(uptr pc, uptr bp, u32 origin);
251
252 void GetStackTrace(BufferedStackTrace *stack, uptr max_s, uptr pc, uptr bp,
253 bool request_fast_unwind);
254
255 void ReportUMR(StackTrace *stack, u32 origin);
256 void ReportExpectedUMRNotFound(StackTrace *stack);
257 void ReportStats();
258 void ReportAtExitStatistics();
259 void DescribeMemoryRange(const void *x, uptr size);
260 void ReportUMRInsideAddressRange(const char *what, const void *start, uptr size,
261 uptr offset);
262
263 // Unpoison first n function arguments.
264 void UnpoisonParam(uptr n);
265 void UnpoisonThreadLocalState();
266
267 // Returns a "chained" origin id, pointing to the given stack trace followed by
268 // the previous origin id.
269 u32 ChainOrigin(u32 id, StackTrace *stack);
270
271 const int STACK_TRACE_TAG_POISON = StackTrace::TAG_CUSTOM + 1;
272
273 #define GET_MALLOC_STACK_TRACE \
274 BufferedStackTrace stack; \
275 if (__msan_get_track_origins() && msan_inited) \
276 GetStackTrace(&stack, common_flags()->malloc_context_size, \
277 StackTrace::GetCurrentPc(), GET_CURRENT_FRAME(), \
278 common_flags()->fast_unwind_on_malloc)
279
280 #define GET_STORE_STACK_TRACE_PC_BP(pc, bp) \
281 BufferedStackTrace stack; \
282 if (__msan_get_track_origins() > 1 && msan_inited) \
283 GetStackTrace(&stack, flags()->store_context_size, pc, bp, \
284 common_flags()->fast_unwind_on_malloc)
285
286 #define GET_FATAL_STACK_TRACE_PC_BP(pc, bp) \
287 BufferedStackTrace stack; \
288 if (msan_inited) \
289 GetStackTrace(&stack, kStackTraceMax, pc, bp, \
290 common_flags()->fast_unwind_on_fatal)
291
292 #define GET_STORE_STACK_TRACE \
293 GET_STORE_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())
294
295 class ScopedThreadLocalStateBackup {
296 public:
ScopedThreadLocalStateBackup()297 ScopedThreadLocalStateBackup() { Backup(); }
~ScopedThreadLocalStateBackup()298 ~ScopedThreadLocalStateBackup() { Restore(); }
299 void Backup();
300 void Restore();
301 private:
302 u64 va_arg_overflow_size_tls;
303 };
304
305 void MsanTSDInit(void (*destructor)(void *tsd));
306 void *MsanTSDGet();
307 void MsanTSDSet(void *tsd);
308 void MsanTSDDtor(void *tsd);
309
310 } // namespace __msan
311
312 #define MSAN_MALLOC_HOOK(ptr, size) \
313 do { \
314 if (&__sanitizer_malloc_hook) { \
315 UnpoisonParam(2); \
316 __sanitizer_malloc_hook(ptr, size); \
317 } \
318 RunMallocHooks(ptr, size); \
319 } while (false)
320 #define MSAN_FREE_HOOK(ptr) \
321 do { \
322 if (&__sanitizer_free_hook) { \
323 UnpoisonParam(1); \
324 __sanitizer_free_hook(ptr); \
325 } \
326 RunFreeHooks(ptr); \
327 } while (false)
328
329 #endif // MSAN_H
330