1 //===-- asan_globals.cc ---------------------------------------------------===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file is a part of AddressSanitizer, an address sanity checker. 11 // 12 // Handle globals. 13 //===----------------------------------------------------------------------===// 14 #include "asan_interceptors.h" 15 #include "asan_internal.h" 16 #include "asan_mapping.h" 17 #include "asan_poisoning.h" 18 #include "asan_report.h" 19 #include "asan_stack.h" 20 #include "asan_stats.h" 21 #include "asan_thread.h" 22 #include "sanitizer_common/sanitizer_common.h" 23 #include "sanitizer_common/sanitizer_mutex.h" 24 #include "sanitizer_common/sanitizer_placement_new.h" 25 26 namespace __asan { 27 28 typedef __asan_global Global; 29 30 struct ListOfGlobals { 31 const Global *g; 32 ListOfGlobals *next; 33 }; 34 35 static BlockingMutex mu_for_globals(LINKER_INITIALIZED); 36 static LowLevelAllocator allocator_for_globals; 37 static ListOfGlobals *list_of_all_globals; 38 39 static const int kDynamicInitGlobalsInitialCapacity = 512; 40 struct DynInitGlobal { 41 Global g; 42 bool initialized; 43 }; 44 typedef InternalMmapVector<DynInitGlobal> VectorOfGlobals; 45 // Lazy-initialized and never deleted. 46 static VectorOfGlobals *dynamic_init_globals; 47 48 ALWAYS_INLINE void PoisonShadowForGlobal(const Global *g, u8 value) { 49 FastPoisonShadow(g->beg, g->size_with_redzone, value); 50 } 51 52 ALWAYS_INLINE void PoisonRedZones(const Global &g) { 53 uptr aligned_size = RoundUpTo(g.size, SHADOW_GRANULARITY); 54 FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size, 55 kAsanGlobalRedzoneMagic); 56 if (g.size != aligned_size) { 57 FastPoisonShadowPartialRightRedzone( 58 g.beg + RoundDownTo(g.size, SHADOW_GRANULARITY), 59 g.size % SHADOW_GRANULARITY, 60 SHADOW_GRANULARITY, 61 kAsanGlobalRedzoneMagic); 62 } 63 } 64 65 static void ReportGlobal(const Global &g, const char *prefix) { 66 Report("%s Global: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n", 67 prefix, (void*)g.beg, g.size, g.size_with_redzone, g.name, 68 g.module_name, g.has_dynamic_init); 69 } 70 71 bool DescribeAddressIfGlobal(uptr addr, uptr size) { 72 if (!flags()->report_globals) return false; 73 BlockingMutexLock lock(&mu_for_globals); 74 bool res = false; 75 for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) { 76 const Global &g = *l->g; 77 if (flags()->report_globals >= 2) 78 ReportGlobal(g, "Search"); 79 res |= DescribeAddressRelativeToGlobal(addr, size, g); 80 } 81 return res; 82 } 83 84 // Register a global variable. 85 // This function may be called more than once for every global 86 // so we store the globals in a map. 87 static void RegisterGlobal(const Global *g) { 88 CHECK(asan_inited); 89 if (flags()->report_globals >= 2) 90 ReportGlobal(*g, "Added"); 91 CHECK(flags()->report_globals); 92 CHECK(AddrIsInMem(g->beg)); 93 CHECK(AddrIsAlignedByGranularity(g->beg)); 94 CHECK(AddrIsAlignedByGranularity(g->size_with_redzone)); 95 if (flags()->poison_heap) 96 PoisonRedZones(*g); 97 ListOfGlobals *l = 98 (ListOfGlobals*)allocator_for_globals.Allocate(sizeof(ListOfGlobals)); 99 l->g = g; 100 l->next = list_of_all_globals; 101 list_of_all_globals = l; 102 if (g->has_dynamic_init) { 103 if (dynamic_init_globals == 0) { 104 void *mem = allocator_for_globals.Allocate(sizeof(VectorOfGlobals)); 105 dynamic_init_globals = new(mem) 106 VectorOfGlobals(kDynamicInitGlobalsInitialCapacity); 107 } 108 DynInitGlobal dyn_global = { *g, false }; 109 dynamic_init_globals->push_back(dyn_global); 110 } 111 } 112 113 static void UnregisterGlobal(const Global *g) { 114 CHECK(asan_inited); 115 CHECK(flags()->report_globals); 116 CHECK(AddrIsInMem(g->beg)); 117 CHECK(AddrIsAlignedByGranularity(g->beg)); 118 CHECK(AddrIsAlignedByGranularity(g->size_with_redzone)); 119 if (flags()->poison_heap) 120 PoisonShadowForGlobal(g, 0); 121 // We unpoison the shadow memory for the global but we do not remove it from 122 // the list because that would require O(n^2) time with the current list 123 // implementation. It might not be worth doing anyway. 124 } 125 126 void StopInitOrderChecking() { 127 BlockingMutexLock lock(&mu_for_globals); 128 if (!flags()->check_initialization_order || !dynamic_init_globals) 129 return; 130 flags()->check_initialization_order = false; 131 for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) { 132 DynInitGlobal &dyn_g = (*dynamic_init_globals)[i]; 133 const Global *g = &dyn_g.g; 134 // Unpoison the whole global. 135 PoisonShadowForGlobal(g, 0); 136 // Poison redzones back. 137 PoisonRedZones(*g); 138 } 139 } 140 141 } // namespace __asan 142 143 // ---------------------- Interface ---------------- {{{1 144 using namespace __asan; // NOLINT 145 146 // Register an array of globals. 147 void __asan_register_globals(__asan_global *globals, uptr n) { 148 if (!flags()->report_globals) return; 149 BlockingMutexLock lock(&mu_for_globals); 150 for (uptr i = 0; i < n; i++) { 151 RegisterGlobal(&globals[i]); 152 } 153 } 154 155 // Unregister an array of globals. 156 // We must do this when a shared objects gets dlclosed. 157 void __asan_unregister_globals(__asan_global *globals, uptr n) { 158 if (!flags()->report_globals) return; 159 BlockingMutexLock lock(&mu_for_globals); 160 for (uptr i = 0; i < n; i++) { 161 UnregisterGlobal(&globals[i]); 162 } 163 } 164 165 // This method runs immediately prior to dynamic initialization in each TU, 166 // when all dynamically initialized globals are unpoisoned. This method 167 // poisons all global variables not defined in this TU, so that a dynamic 168 // initializer can only touch global variables in the same TU. 169 void __asan_before_dynamic_init(const char *module_name) { 170 if (!flags()->check_initialization_order || 171 !flags()->poison_heap) 172 return; 173 bool strict_init_order = flags()->strict_init_order; 174 CHECK(dynamic_init_globals); 175 CHECK(module_name); 176 CHECK(asan_inited); 177 BlockingMutexLock lock(&mu_for_globals); 178 if (flags()->report_globals >= 3) 179 Printf("DynInitPoison module: %s\n", module_name); 180 for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) { 181 DynInitGlobal &dyn_g = (*dynamic_init_globals)[i]; 182 const Global *g = &dyn_g.g; 183 if (dyn_g.initialized) 184 continue; 185 if (g->module_name != module_name) 186 PoisonShadowForGlobal(g, kAsanInitializationOrderMagic); 187 else if (!strict_init_order) 188 dyn_g.initialized = true; 189 } 190 } 191 192 // This method runs immediately after dynamic initialization in each TU, when 193 // all dynamically initialized globals except for those defined in the current 194 // TU are poisoned. It simply unpoisons all dynamically initialized globals. 195 void __asan_after_dynamic_init() { 196 if (!flags()->check_initialization_order || 197 !flags()->poison_heap) 198 return; 199 CHECK(asan_inited); 200 BlockingMutexLock lock(&mu_for_globals); 201 // FIXME: Optionally report that we're unpoisoning globals from a module. 202 for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) { 203 DynInitGlobal &dyn_g = (*dynamic_init_globals)[i]; 204 const Global *g = &dyn_g.g; 205 if (!dyn_g.initialized) { 206 // Unpoison the whole global. 207 PoisonShadowForGlobal(g, 0); 208 // Poison redzones back. 209 PoisonRedZones(*g); 210 } 211 } 212 } 213
