2012-06-04 21:50:10 +08:00
|
|
|
//===-- asan_thread.cc ----------------------------------------------------===//
|
2011-11-30 09:07:02 +08:00
|
|
|
//
|
|
|
|
// The LLVM Compiler Infrastructure
|
|
|
|
//
|
|
|
|
// This file is distributed under the University of Illinois Open Source
|
|
|
|
// License. See LICENSE.TXT for details.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
//
|
|
|
|
// This file is a part of AddressSanitizer, an address sanity checker.
|
|
|
|
//
|
|
|
|
// Thread-related code.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "asan_allocator.h"
|
|
|
|
#include "asan_interceptors.h"
|
2013-03-28 23:42:43 +08:00
|
|
|
#include "asan_poisoning.h"
|
2012-01-17 14:35:31 +08:00
|
|
|
#include "asan_stack.h"
|
2011-11-30 09:07:02 +08:00
|
|
|
#include "asan_thread.h"
|
|
|
|
#include "asan_mapping.h"
|
2012-06-07 15:13:46 +08:00
|
|
|
#include "sanitizer_common/sanitizer_common.h"
|
2013-03-21 19:23:41 +08:00
|
|
|
#include "sanitizer_common/sanitizer_placement_new.h"
|
2013-05-21 21:40:13 +08:00
|
|
|
#include "lsan/lsan_common.h"
|
2011-11-30 09:07:02 +08:00
|
|
|
|
|
|
|
namespace __asan {
|
|
|
|
|
2013-03-21 19:23:41 +08:00
|
|
|
// AsanThreadContext implementation.
|
2011-11-30 09:07:02 +08:00
|
|
|
|
2013-03-21 19:23:41 +08:00
|
|
|
void AsanThreadContext::OnCreated(void *arg) {
|
|
|
|
CreateThreadContextArgs *args = static_cast<CreateThreadContextArgs*>(arg);
|
|
|
|
if (args->stack) {
|
|
|
|
internal_memcpy(&stack, args->stack, sizeof(stack));
|
|
|
|
}
|
|
|
|
thread = args->thread;
|
|
|
|
thread->set_context(this);
|
|
|
|
}
|
|
|
|
|
|
|
|
void AsanThreadContext::OnFinished() {
|
|
|
|
// Drop the link to the AsanThread object.
|
|
|
|
thread = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static char thread_registry_placeholder[sizeof(ThreadRegistry)];
|
|
|
|
static ThreadRegistry *asan_thread_registry;
|
|
|
|
|
|
|
|
static ThreadContextBase *GetAsanThreadContext(u32 tid) {
|
|
|
|
void *mem = MmapOrDie(sizeof(AsanThreadContext), "AsanThreadContext");
|
|
|
|
return new(mem) AsanThreadContext(tid);
|
|
|
|
}
|
|
|
|
|
|
|
|
ThreadRegistry &asanThreadRegistry() {
|
|
|
|
static bool initialized;
|
|
|
|
// Don't worry about thread_safety - this should be called when there is
|
|
|
|
// a single thread.
|
|
|
|
if (!initialized) {
|
|
|
|
// Never reuse ASan threads: we store pointer to AsanThreadContext
|
|
|
|
// in TSD and can't reliably tell when no more TSD destructors will
|
|
|
|
// be called. It would be wrong to reuse AsanThreadContext for another
|
|
|
|
// thread before all TSD destructors will be called for it.
|
|
|
|
asan_thread_registry = new(thread_registry_placeholder) ThreadRegistry(
|
|
|
|
GetAsanThreadContext, kMaxNumberOfThreads, kMaxNumberOfThreads);
|
|
|
|
initialized = true;
|
|
|
|
}
|
|
|
|
return *asan_thread_registry;
|
|
|
|
}
|
|
|
|
|
|
|
|
AsanThreadContext *GetThreadContextByTidLocked(u32 tid) {
|
|
|
|
return static_cast<AsanThreadContext *>(
|
|
|
|
asanThreadRegistry().GetThreadLocked(tid));
|
|
|
|
}
|
|
|
|
|
|
|
|
// AsanThread implementation.
|
|
|
|
|
|
|
|
AsanThread *AsanThread::Create(thread_callback_t start_routine,
|
|
|
|
void *arg) {
|
2012-11-23 23:38:49 +08:00
|
|
|
uptr PageSize = GetPageSizeCached();
|
|
|
|
uptr size = RoundUpTo(sizeof(AsanThread), PageSize);
|
2012-06-07 00:15:07 +08:00
|
|
|
AsanThread *thread = (AsanThread*)MmapOrDie(size, __FUNCTION__);
|
2012-01-17 14:35:31 +08:00
|
|
|
thread->start_routine_ = start_routine;
|
|
|
|
thread->arg_ = arg;
|
2013-03-21 19:23:41 +08:00
|
|
|
thread->context_ = 0;
|
2012-01-17 14:35:31 +08:00
|
|
|
|
|
|
|
return thread;
|
2011-11-30 09:07:02 +08:00
|
|
|
}
|
|
|
|
|
2013-03-21 19:23:41 +08:00
|
|
|
void AsanThread::TSDDtor(void *tsd) {
|
|
|
|
AsanThreadContext *context = (AsanThreadContext*)tsd;
|
|
|
|
if (flags()->verbosity >= 1)
|
|
|
|
Report("T%d TSDDtor\n", context->tid);
|
|
|
|
if (context->thread)
|
|
|
|
context->thread->Destroy();
|
2012-02-07 08:27:15 +08:00
|
|
|
}
|
|
|
|
|
2012-01-07 03:44:11 +08:00
|
|
|
void AsanThread::Destroy() {
|
2012-07-09 22:36:04 +08:00
|
|
|
if (flags()->verbosity >= 1) {
|
2012-02-07 08:27:15 +08:00
|
|
|
Report("T%d exited\n", tid());
|
|
|
|
}
|
|
|
|
|
2013-03-21 19:23:41 +08:00
|
|
|
asanThreadRegistry().FinishThread(tid());
|
|
|
|
FlushToAccumulatedStats(&stats_);
|
2011-11-30 09:07:02 +08:00
|
|
|
// We also clear the shadow on thread destruction because
|
|
|
|
// some code may still be executing in later TSD destructors
|
|
|
|
// and we don't want it to have any poisoned stack.
|
|
|
|
ClearShadowForThreadStack();
|
2012-01-17 14:35:31 +08:00
|
|
|
fake_stack().Cleanup();
|
2012-11-23 23:38:49 +08:00
|
|
|
uptr size = RoundUpTo(sizeof(AsanThread), GetPageSizeCached());
|
2012-06-07 00:15:07 +08:00
|
|
|
UnmapOrDie(this, size);
|
2011-11-30 09:07:02 +08:00
|
|
|
}
|
|
|
|
|
2011-12-17 03:13:35 +08:00
|
|
|
void AsanThread::Init() {
|
2011-11-30 09:07:02 +08:00
|
|
|
SetThreadStackTopAndBottom();
|
2012-01-17 14:35:31 +08:00
|
|
|
CHECK(AddrIsInMem(stack_bottom_));
|
2013-01-18 19:30:36 +08:00
|
|
|
CHECK(AddrIsInMem(stack_top_ - 1));
|
2012-01-17 14:35:31 +08:00
|
|
|
ClearShadowForThreadStack();
|
2012-07-09 22:36:04 +08:00
|
|
|
if (flags()->verbosity >= 1) {
|
2011-11-30 09:07:02 +08:00
|
|
|
int local = 0;
|
2012-03-21 19:32:46 +08:00
|
|
|
Report("T%d: stack [%p,%p) size 0x%zx; local=%p\n",
|
2012-06-06 18:46:00 +08:00
|
|
|
tid(), (void*)stack_bottom_, (void*)stack_top_,
|
2012-01-10 03:18:27 +08:00
|
|
|
stack_top_ - stack_bottom_, &local);
|
2011-11-30 09:07:02 +08:00
|
|
|
}
|
2012-01-17 14:35:31 +08:00
|
|
|
fake_stack_.Init(stack_size());
|
2012-07-23 22:07:58 +08:00
|
|
|
AsanPlatformThreadInit();
|
2011-12-17 03:13:35 +08:00
|
|
|
}
|
|
|
|
|
2013-03-21 19:23:41 +08:00
|
|
|
thread_return_t AsanThread::ThreadStart(uptr os_id) {
|
2011-12-17 03:13:35 +08:00
|
|
|
Init();
|
2013-03-21 19:23:41 +08:00
|
|
|
asanThreadRegistry().StartThread(tid(), os_id, 0);
|
2012-07-09 22:36:04 +08:00
|
|
|
if (flags()->use_sigaltstack) SetAlternateSignalStack();
|
2011-11-30 09:07:02 +08:00
|
|
|
|
|
|
|
if (!start_routine_) {
|
2012-05-31 22:35:53 +08:00
|
|
|
// start_routine_ == 0 if we're on the main thread or on one of the
|
2011-11-30 09:07:02 +08:00
|
|
|
// OS X libdispatch worker threads. But nobody is supposed to call
|
|
|
|
// ThreadStart() for the worker threads.
|
2013-04-05 22:40:25 +08:00
|
|
|
CHECK_EQ(tid(), 0);
|
2011-11-30 09:07:02 +08:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2012-02-24 23:28:43 +08:00
|
|
|
thread_return_t res = start_routine_(arg_);
|
2011-11-30 09:07:02 +08:00
|
|
|
malloc_storage().CommitBack();
|
2012-07-09 22:36:04 +08:00
|
|
|
if (flags()->use_sigaltstack) UnsetAlternateSignalStack();
|
2011-11-30 09:07:02 +08:00
|
|
|
|
2012-01-11 10:03:16 +08:00
|
|
|
this->Destroy();
|
|
|
|
|
2011-11-30 09:07:02 +08:00
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2012-06-07 15:13:46 +08:00
|
|
|
void AsanThread::SetThreadStackTopAndBottom() {
|
|
|
|
GetThreadStackTopAndBottom(tid() == 0, &stack_top_, &stack_bottom_);
|
|
|
|
int local;
|
|
|
|
CHECK(AddrIsInStack((uptr)&local));
|
|
|
|
}
|
|
|
|
|
2012-01-17 14:35:31 +08:00
|
|
|
void AsanThread::ClearShadowForThreadStack() {
|
|
|
|
PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0);
|
|
|
|
}
|
|
|
|
|
[asan] Change the way we report the alloca frame on stack-buff-overflow.
Before: the function name was stored by the compiler as a constant string
and the run-time was printing it.
Now: the PC is stored instead and the run-time prints the full symbolized frame.
This adds a couple of instructions into every function with non-empty stack frame,
but also reduces the binary size because we store less strings (I saw 2% size reduction).
This change bumps the asan ABI version to v3.
compiler-rt part, llvm part will follow.
Example of report (now):
==31711==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffa77cf1c5 at pc 0x41feb0 bp 0x7fffa77cefb0 sp 0x7fffa77cefa8
READ of size 1 at 0x7fffa77cf1c5 thread T0
#0 0x41feaf in Frame0(int, char*, char*, char*) stack-oob-frames.cc:20
#1 0x41f7ff in Frame1(int, char*, char*) stack-oob-frames.cc:24
#2 0x41f477 in Frame2(int, char*) stack-oob-frames.cc:28
#3 0x41f194 in Frame3(int) stack-oob-frames.cc:32
#4 0x41eee0 in main stack-oob-frames.cc:38
#5 0x7f0c5566f76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
#6 0x41eb1c (/usr/local/google/kcc/llvm_cmake/a.out+0x41eb1c)
Address 0x7fffa77cf1c5 is located in stack of thread T0 at offset 293 in frame
#0 0x41f87f in Frame0(int, char*, char*, char*) stack-oob-frames.cc:12 <<<<<<<<<<<<<< this is new
This frame has 6 object(s):
[32, 36) 'frame.addr'
[96, 104) 'a.addr'
[160, 168) 'b.addr'
[224, 232) 'c.addr'
[288, 292) 's'
[352, 360) 'd'
llvm-svn: 177723
2013-03-22 18:36:24 +08:00
|
|
|
const char *AsanThread::GetFrameNameByAddr(uptr addr, uptr *offset,
|
|
|
|
uptr *frame_pc) {
|
2012-05-31 22:35:53 +08:00
|
|
|
uptr bottom = 0;
|
2011-11-30 09:07:02 +08:00
|
|
|
if (AddrIsInStack(addr)) {
|
|
|
|
bottom = stack_bottom();
|
|
|
|
} else {
|
|
|
|
bottom = fake_stack().AddrIsInFakeStack(addr);
|
|
|
|
CHECK(bottom);
|
2012-11-15 23:24:42 +08:00
|
|
|
*offset = addr - bottom;
|
[asan] Change the way we report the alloca frame on stack-buff-overflow.
Before: the function name was stored by the compiler as a constant string
and the run-time was printing it.
Now: the PC is stored instead and the run-time prints the full symbolized frame.
This adds a couple of instructions into every function with non-empty stack frame,
but also reduces the binary size because we store less strings (I saw 2% size reduction).
This change bumps the asan ABI version to v3.
compiler-rt part, llvm part will follow.
Example of report (now):
==31711==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffa77cf1c5 at pc 0x41feb0 bp 0x7fffa77cefb0 sp 0x7fffa77cefa8
READ of size 1 at 0x7fffa77cf1c5 thread T0
#0 0x41feaf in Frame0(int, char*, char*, char*) stack-oob-frames.cc:20
#1 0x41f7ff in Frame1(int, char*, char*) stack-oob-frames.cc:24
#2 0x41f477 in Frame2(int, char*) stack-oob-frames.cc:28
#3 0x41f194 in Frame3(int) stack-oob-frames.cc:32
#4 0x41eee0 in main stack-oob-frames.cc:38
#5 0x7f0c5566f76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
#6 0x41eb1c (/usr/local/google/kcc/llvm_cmake/a.out+0x41eb1c)
Address 0x7fffa77cf1c5 is located in stack of thread T0 at offset 293 in frame
#0 0x41f87f in Frame0(int, char*, char*, char*) stack-oob-frames.cc:12 <<<<<<<<<<<<<< this is new
This frame has 6 object(s):
[32, 36) 'frame.addr'
[96, 104) 'a.addr'
[160, 168) 'b.addr'
[224, 232) 'c.addr'
[288, 292) 's'
[352, 360) 'd'
llvm-svn: 177723
2013-03-22 18:36:24 +08:00
|
|
|
*frame_pc = ((uptr*)bottom)[2];
|
2012-11-15 23:24:42 +08:00
|
|
|
return (const char *)((uptr*)bottom)[1];
|
2011-11-30 09:07:02 +08:00
|
|
|
}
|
2012-11-21 20:38:58 +08:00
|
|
|
uptr aligned_addr = addr & ~(SANITIZER_WORDSIZE/8 - 1); // align addr.
|
2012-05-31 23:02:07 +08:00
|
|
|
u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
|
|
|
|
u8 *shadow_bottom = (u8*)MemToShadow(bottom);
|
2012-05-12 20:33:10 +08:00
|
|
|
|
|
|
|
while (shadow_ptr >= shadow_bottom &&
|
2012-11-15 23:24:42 +08:00
|
|
|
*shadow_ptr != kAsanStackLeftRedzoneMagic) {
|
2012-05-12 20:33:10 +08:00
|
|
|
shadow_ptr--;
|
|
|
|
}
|
|
|
|
|
|
|
|
while (shadow_ptr >= shadow_bottom &&
|
2012-11-15 23:24:42 +08:00
|
|
|
*shadow_ptr == kAsanStackLeftRedzoneMagic) {
|
2012-05-12 20:33:10 +08:00
|
|
|
shadow_ptr--;
|
2011-11-30 09:07:02 +08:00
|
|
|
}
|
2012-05-12 20:33:10 +08:00
|
|
|
|
|
|
|
if (shadow_ptr < shadow_bottom) {
|
2012-11-15 23:24:42 +08:00
|
|
|
*offset = 0;
|
|
|
|
return "UNKNOWN";
|
2012-05-12 20:33:10 +08:00
|
|
|
}
|
|
|
|
|
2012-05-31 22:35:53 +08:00
|
|
|
uptr* ptr = (uptr*)SHADOW_TO_MEM((uptr)(shadow_ptr + 1));
|
2012-11-15 23:24:42 +08:00
|
|
|
CHECK(ptr[0] == kCurrentStackFrameMagic);
|
2012-05-31 22:35:53 +08:00
|
|
|
*offset = addr - (uptr)ptr;
|
[asan] Change the way we report the alloca frame on stack-buff-overflow.
Before: the function name was stored by the compiler as a constant string
and the run-time was printing it.
Now: the PC is stored instead and the run-time prints the full symbolized frame.
This adds a couple of instructions into every function with non-empty stack frame,
but also reduces the binary size because we store less strings (I saw 2% size reduction).
This change bumps the asan ABI version to v3.
compiler-rt part, llvm part will follow.
Example of report (now):
==31711==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffa77cf1c5 at pc 0x41feb0 bp 0x7fffa77cefb0 sp 0x7fffa77cefa8
READ of size 1 at 0x7fffa77cf1c5 thread T0
#0 0x41feaf in Frame0(int, char*, char*, char*) stack-oob-frames.cc:20
#1 0x41f7ff in Frame1(int, char*, char*) stack-oob-frames.cc:24
#2 0x41f477 in Frame2(int, char*) stack-oob-frames.cc:28
#3 0x41f194 in Frame3(int) stack-oob-frames.cc:32
#4 0x41eee0 in main stack-oob-frames.cc:38
#5 0x7f0c5566f76c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
#6 0x41eb1c (/usr/local/google/kcc/llvm_cmake/a.out+0x41eb1c)
Address 0x7fffa77cf1c5 is located in stack of thread T0 at offset 293 in frame
#0 0x41f87f in Frame0(int, char*, char*, char*) stack-oob-frames.cc:12 <<<<<<<<<<<<<< this is new
This frame has 6 object(s):
[32, 36) 'frame.addr'
[96, 104) 'a.addr'
[160, 168) 'b.addr'
[224, 232) 'c.addr'
[288, 292) 's'
[352, 360) 'd'
llvm-svn: 177723
2013-03-22 18:36:24 +08:00
|
|
|
*frame_pc = ptr[2];
|
2012-05-12 20:33:10 +08:00
|
|
|
return (const char*)ptr[1];
|
2011-11-30 09:07:02 +08:00
|
|
|
}
|
|
|
|
|
2013-03-21 19:23:41 +08:00
|
|
|
static bool ThreadStackContainsAddress(ThreadContextBase *tctx_base,
|
|
|
|
void *addr) {
|
|
|
|
AsanThreadContext *tctx = static_cast<AsanThreadContext*>(tctx_base);
|
|
|
|
AsanThread *t = tctx->thread;
|
|
|
|
return (t && t->fake_stack().StackSize() &&
|
|
|
|
(t->fake_stack().AddrIsInFakeStack((uptr)addr) ||
|
|
|
|
t->AddrIsInStack((uptr)addr)));
|
|
|
|
}
|
|
|
|
|
2013-03-20 17:23:28 +08:00
|
|
|
AsanThread *GetCurrentThread() {
|
2013-03-21 19:23:41 +08:00
|
|
|
AsanThreadContext *context = (AsanThreadContext*)AsanTSDGet();
|
|
|
|
if (!context) {
|
|
|
|
if (SANITIZER_ANDROID) {
|
|
|
|
// On Android, libc constructor is called _after_ asan_init, and cleans up
|
|
|
|
// TSD. Try to figure out if this is still the main thread by the stack
|
|
|
|
// address. We are not entirely sure that we have correct main thread
|
2013-03-22 15:29:59 +08:00
|
|
|
// limits, so only do this magic on Android, and only if the found thread
|
|
|
|
// is the main thread.
|
2013-03-21 19:23:41 +08:00
|
|
|
AsanThreadContext *tctx = GetThreadContextByTidLocked(0);
|
|
|
|
if (ThreadStackContainsAddress(tctx, &context)) {
|
|
|
|
SetCurrentThread(tctx->thread);
|
|
|
|
return tctx->thread;
|
|
|
|
}
|
2013-03-20 17:23:28 +08:00
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
2013-03-21 19:23:41 +08:00
|
|
|
return context->thread;
|
2013-03-20 17:23:28 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void SetCurrentThread(AsanThread *t) {
|
2013-03-21 19:23:41 +08:00
|
|
|
CHECK(t->context());
|
2013-03-20 17:23:28 +08:00
|
|
|
if (flags()->verbosity >= 2) {
|
|
|
|
Report("SetCurrentThread: %p for thread %p\n",
|
2013-03-21 19:23:41 +08:00
|
|
|
t->context(), (void*)GetThreadSelf());
|
2013-03-20 17:23:28 +08:00
|
|
|
}
|
|
|
|
// Make sure we do not reset the current AsanThread.
|
2013-03-21 19:23:41 +08:00
|
|
|
CHECK_EQ(0, AsanTSDGet());
|
|
|
|
AsanTSDSet(t->context());
|
|
|
|
CHECK_EQ(t->context(), AsanTSDGet());
|
2013-03-20 17:23:28 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
u32 GetCurrentTidOrInvalid() {
|
|
|
|
AsanThread *t = GetCurrentThread();
|
|
|
|
return t ? t->tid() : kInvalidTid;
|
|
|
|
}
|
|
|
|
|
2013-03-21 19:23:41 +08:00
|
|
|
AsanThread *FindThreadByStackAddress(uptr addr) {
|
|
|
|
asanThreadRegistry().CheckLocked();
|
|
|
|
AsanThreadContext *tctx = static_cast<AsanThreadContext *>(
|
|
|
|
asanThreadRegistry().FindThreadContextLocked(ThreadStackContainsAddress,
|
|
|
|
(void *)addr));
|
|
|
|
return tctx ? tctx->thread : 0;
|
|
|
|
}
|
2011-11-30 09:07:02 +08:00
|
|
|
} // namespace __asan
|
2013-05-21 21:40:13 +08:00
|
|
|
|
|
|
|
// --- Implementation of LSan-specific functions --- {{{1
|
|
|
|
namespace __lsan {
|
|
|
|
bool GetThreadRangesLocked(uptr os_id, uptr *stack_begin, uptr *stack_end,
|
|
|
|
uptr *tls_begin, uptr *tls_end,
|
|
|
|
uptr *cache_begin, uptr *cache_end) {
|
|
|
|
// FIXME: Stub.
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
void LockThreadRegistry() {
|
|
|
|
__asan::asanThreadRegistry().Lock();
|
|
|
|
}
|
|
|
|
|
|
|
|
void UnlockThreadRegistry() {
|
|
|
|
__asan::asanThreadRegistry().Unlock();
|
|
|
|
}
|
|
|
|
} // namespace __lsan
|