1 //===-- asan_malloc_mac.cc ------------------------------------------------===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file is a part of AddressSanitizer, an address sanity checker. 11 // 12 // Mac-specific malloc interception. 13 //===----------------------------------------------------------------------===// 14 15 #include "sanitizer_common/sanitizer_platform.h" 16 #if SANITIZER_MAC 17 18 #include <AvailabilityMacros.h> 19 #include <CoreFoundation/CFBase.h> 20 #include <dlfcn.h> 21 #include <malloc/malloc.h> 22 #include <sys/mman.h> 23 24 #include "asan_allocator.h" 25 #include "asan_interceptors.h" 26 #include "asan_internal.h" 27 #include "asan_report.h" 28 #include "asan_stack.h" 29 #include "asan_stats.h" 30 #include "sanitizer_common/sanitizer_mac.h" 31 32 // Similar code is used in Google Perftools, 33 // http://code.google.com/p/google-perftools. 34 35 // ---------------------- Replacement functions ---------------- {{{1 36 using namespace __asan; // NOLINT 37 38 // TODO(glider): do we need both zones? 39 static malloc_zone_t *system_malloc_zone = 0; 40 static malloc_zone_t asan_zone; 41 42 INTERCEPTOR(malloc_zone_t *, malloc_create_zone, 43 vm_size_t start_size, unsigned zone_flags) { 44 ENSURE_ASAN_INITED(); 45 GET_STACK_TRACE_MALLOC; 46 uptr page_size = GetPageSizeCached(); 47 uptr allocated_size = RoundUpTo(sizeof(asan_zone), page_size); 48 malloc_zone_t *new_zone = 49 (malloc_zone_t*)asan_memalign(page_size, allocated_size, 50 &stack, FROM_MALLOC); 51 internal_memcpy(new_zone, &asan_zone, sizeof(asan_zone)); 52 new_zone->zone_name = NULL; // The name will be changed anyway. 53 if (GetMacosVersion() >= MACOS_VERSION_LION) { 54 // Prevent the client app from overwriting the zone contents. 55 // Library functions that need to modify the zone will set PROT_WRITE on it. 56 // This matches the behavior of malloc_create_zone() on OSX 10.7 and higher. 57 mprotect(new_zone, allocated_size, PROT_READ); 58 } 59 return new_zone; 60 } 61 62 INTERCEPTOR(malloc_zone_t *, malloc_default_zone, void) { 63 ENSURE_ASAN_INITED(); 64 return &asan_zone; 65 } 66 67 INTERCEPTOR(malloc_zone_t *, malloc_default_purgeable_zone, void) { 68 // FIXME: ASan should support purgeable allocations. 69 // https://code.google.com/p/address-sanitizer/issues/detail?id=139 70 ENSURE_ASAN_INITED(); 71 return &asan_zone; 72 } 73 74 INTERCEPTOR(void, malloc_make_purgeable, void *ptr) { 75 // FIXME: ASan should support purgeable allocations. Ignoring them is fine 76 // for now. 77 ENSURE_ASAN_INITED(); 78 } 79 80 INTERCEPTOR(int, malloc_make_nonpurgeable, void *ptr) { 81 // FIXME: ASan should support purgeable allocations. Ignoring them is fine 82 // for now. 83 ENSURE_ASAN_INITED(); 84 // Must return 0 if the contents were not purged since the last call to 85 // malloc_make_purgeable(). 86 return 0; 87 } 88 89 INTERCEPTOR(void, malloc_set_zone_name, malloc_zone_t *zone, const char *name) { 90 ENSURE_ASAN_INITED(); 91 // Allocate |strlen("asan-") + 1 + internal_strlen(name)| bytes. 92 size_t buflen = 6 + (name ? internal_strlen(name) : 0); 93 InternalScopedBuffer<char> new_name(buflen); 94 if (name && zone->introspect == asan_zone.introspect) { 95 internal_snprintf(new_name.data(), buflen, "asan-%s", name); 96 name = new_name.data(); 97 } 98 99 // Call the system malloc's implementation for both external and our zones, 100 // since that appropriately changes VM region protections on the zone. 101 REAL(malloc_set_zone_name)(zone, name); 102 } 103 104 INTERCEPTOR(void *, malloc, size_t size) { 105 ENSURE_ASAN_INITED(); 106 GET_STACK_TRACE_MALLOC; 107 void *res = asan_malloc(size, &stack); 108 return res; 109 } 110 111 INTERCEPTOR(void, free, void *ptr) { 112 ENSURE_ASAN_INITED(); 113 if (!ptr) return; 114 GET_STACK_TRACE_FREE; 115 asan_free(ptr, &stack, FROM_MALLOC); 116 } 117 118 INTERCEPTOR(void *, realloc, void *ptr, size_t size) { 119 ENSURE_ASAN_INITED(); 120 GET_STACK_TRACE_MALLOC; 121 return asan_realloc(ptr, size, &stack); 122 } 123 124 INTERCEPTOR(void *, calloc, size_t nmemb, size_t size) { 125 ENSURE_ASAN_INITED(); 126 GET_STACK_TRACE_MALLOC; 127 return asan_calloc(nmemb, size, &stack); 128 } 129 130 INTERCEPTOR(void *, valloc, size_t size) { 131 ENSURE_ASAN_INITED(); 132 GET_STACK_TRACE_MALLOC; 133 return asan_memalign(GetPageSizeCached(), size, &stack, FROM_MALLOC); 134 } 135 136 INTERCEPTOR(size_t, malloc_good_size, size_t size) { 137 ENSURE_ASAN_INITED(); 138 return asan_zone.introspect->good_size(&asan_zone, size); 139 } 140 141 INTERCEPTOR(int, posix_memalign, void **memptr, size_t alignment, size_t size) { 142 ENSURE_ASAN_INITED(); 143 CHECK(memptr); 144 GET_STACK_TRACE_MALLOC; 145 void *result = asan_memalign(alignment, size, &stack, FROM_MALLOC); 146 if (result) { 147 *memptr = result; 148 return 0; 149 } 150 return -1; 151 } 152 153 namespace { 154 155 // TODO(glider): the mz_* functions should be united with the Linux wrappers, 156 // as they are basically copied from there. 157 size_t mz_size(malloc_zone_t* zone, const void* ptr) { 158 return asan_mz_size(ptr); 159 } 160 161 void *mz_malloc(malloc_zone_t *zone, size_t size) { 162 if (UNLIKELY(!asan_inited)) { 163 CHECK(system_malloc_zone); 164 return malloc_zone_malloc(system_malloc_zone, size); 165 } 166 GET_STACK_TRACE_MALLOC; 167 return asan_malloc(size, &stack); 168 } 169 170 void *mz_calloc(malloc_zone_t *zone, size_t nmemb, size_t size) { 171 if (UNLIKELY(!asan_inited)) { 172 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym. 173 const size_t kCallocPoolSize = 1024; 174 static uptr calloc_memory_for_dlsym[kCallocPoolSize]; 175 static size_t allocated; 176 size_t size_in_words = ((nmemb * size) + kWordSize - 1) / kWordSize; 177 void *mem = (void*)&calloc_memory_for_dlsym[allocated]; 178 allocated += size_in_words; 179 CHECK(allocated < kCallocPoolSize); 180 return mem; 181 } 182 GET_STACK_TRACE_MALLOC; 183 return asan_calloc(nmemb, size, &stack); 184 } 185 186 void *mz_valloc(malloc_zone_t *zone, size_t size) { 187 if (UNLIKELY(!asan_inited)) { 188 CHECK(system_malloc_zone); 189 return malloc_zone_valloc(system_malloc_zone, size); 190 } 191 GET_STACK_TRACE_MALLOC; 192 return asan_memalign(GetPageSizeCached(), size, &stack, FROM_MALLOC); 193 } 194 195 #define GET_ZONE_FOR_PTR(ptr) \ 196 malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); \ 197 const char *zone_name = (zone_ptr == 0) ? 0 : zone_ptr->zone_name 198 199 void ALWAYS_INLINE free_common(void *context, void *ptr) { 200 if (!ptr) return; 201 GET_STACK_TRACE_FREE; 202 // FIXME: need to retire this flag. 203 if (!flags()->mac_ignore_invalid_free) { 204 asan_free(ptr, &stack, FROM_MALLOC); 205 } else { 206 GET_ZONE_FOR_PTR(ptr); 207 WarnMacFreeUnallocated((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); 208 return; 209 } 210 } 211 212 // TODO(glider): the allocation callbacks need to be refactored. 213 void mz_free(malloc_zone_t *zone, void *ptr) { 214 free_common(zone, ptr); 215 } 216 217 void *mz_realloc(malloc_zone_t *zone, void *ptr, size_t size) { 218 if (!ptr) { 219 GET_STACK_TRACE_MALLOC; 220 return asan_malloc(size, &stack); 221 } else { 222 if (asan_mz_size(ptr)) { 223 GET_STACK_TRACE_MALLOC; 224 return asan_realloc(ptr, size, &stack); 225 } else { 226 // We can't recover from reallocating an unknown address, because 227 // this would require reading at most |size| bytes from 228 // potentially unaccessible memory. 229 GET_STACK_TRACE_FREE; 230 GET_ZONE_FOR_PTR(ptr); 231 ReportMacMzReallocUnknown((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); 232 } 233 } 234 } 235 236 void mz_destroy(malloc_zone_t* zone) { 237 // A no-op -- we will not be destroyed! 238 Report("mz_destroy() called -- ignoring\n"); 239 } 240 241 // from AvailabilityMacros.h 242 #if defined(MAC_OS_X_VERSION_10_6) && \ 243 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 244 void *mz_memalign(malloc_zone_t *zone, size_t align, size_t size) { 245 if (UNLIKELY(!asan_inited)) { 246 CHECK(system_malloc_zone); 247 return malloc_zone_memalign(system_malloc_zone, align, size); 248 } 249 GET_STACK_TRACE_MALLOC; 250 return asan_memalign(align, size, &stack, FROM_MALLOC); 251 } 252 253 // This function is currently unused, and we build with -Werror. 254 #if 0 255 void mz_free_definite_size(malloc_zone_t* zone, void *ptr, size_t size) { 256 // TODO(glider): check that |size| is valid. 257 UNIMPLEMENTED(); 258 } 259 #endif 260 #endif 261 262 kern_return_t mi_enumerator(task_t task, void *, 263 unsigned type_mask, vm_address_t zone_address, 264 memory_reader_t reader, 265 vm_range_recorder_t recorder) { 266 // Should enumerate all the pointers we have. Seems like a lot of work. 267 return KERN_FAILURE; 268 } 269 270 size_t mi_good_size(malloc_zone_t *zone, size_t size) { 271 // I think it's always safe to return size, but we maybe could do better. 272 return size; 273 } 274 275 boolean_t mi_check(malloc_zone_t *zone) { 276 UNIMPLEMENTED(); 277 } 278 279 void mi_print(malloc_zone_t *zone, boolean_t verbose) { 280 UNIMPLEMENTED(); 281 } 282 283 void mi_log(malloc_zone_t *zone, void *address) { 284 // I don't think we support anything like this 285 } 286 287 void mi_force_lock(malloc_zone_t *zone) { 288 asan_mz_force_lock(); 289 } 290 291 void mi_force_unlock(malloc_zone_t *zone) { 292 asan_mz_force_unlock(); 293 } 294 295 void mi_statistics(malloc_zone_t *zone, malloc_statistics_t *stats) { 296 AsanMallocStats malloc_stats; 297 FillMallocStatistics(&malloc_stats); 298 CHECK(sizeof(malloc_statistics_t) == sizeof(AsanMallocStats)); 299 internal_memcpy(stats, &malloc_stats, sizeof(malloc_statistics_t)); 300 } 301 302 #if defined(MAC_OS_X_VERSION_10_6) && \ 303 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 304 boolean_t mi_zone_locked(malloc_zone_t *zone) { 305 // UNIMPLEMENTED(); 306 return false; 307 } 308 #endif 309 310 } // unnamed namespace 311 312 namespace __asan { 313 314 void ReplaceSystemMalloc() { 315 static malloc_introspection_t asan_introspection; 316 // Ok to use internal_memset, these places are not performance-critical. 317 internal_memset(&asan_introspection, 0, sizeof(asan_introspection)); 318 319 asan_introspection.enumerator = &mi_enumerator; 320 asan_introspection.good_size = &mi_good_size; 321 asan_introspection.check = &mi_check; 322 asan_introspection.print = &mi_print; 323 asan_introspection.log = &mi_log; 324 asan_introspection.force_lock = &mi_force_lock; 325 asan_introspection.force_unlock = &mi_force_unlock; 326 asan_introspection.statistics = &mi_statistics; 327 328 internal_memset(&asan_zone, 0, sizeof(malloc_zone_t)); 329 330 // Start with a version 4 zone which is used for OS X 10.4 and 10.5. 331 asan_zone.version = 4; 332 asan_zone.zone_name = "asan"; 333 asan_zone.size = &mz_size; 334 asan_zone.malloc = &mz_malloc; 335 asan_zone.calloc = &mz_calloc; 336 asan_zone.valloc = &mz_valloc; 337 asan_zone.free = &mz_free; 338 asan_zone.realloc = &mz_realloc; 339 asan_zone.destroy = &mz_destroy; 340 asan_zone.batch_malloc = 0; 341 asan_zone.batch_free = 0; 342 asan_zone.introspect = &asan_introspection; 343 344 // from AvailabilityMacros.h 345 #if defined(MAC_OS_X_VERSION_10_6) && \ 346 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 347 // Switch to version 6 on OSX 10.6 to support memalign. 348 asan_zone.version = 6; 349 asan_zone.free_definite_size = 0; 350 asan_zone.memalign = &mz_memalign; 351 asan_introspection.zone_locked = &mi_zone_locked; 352 #endif 353 354 // Register the ASan zone. 355 malloc_zone_register(&asan_zone); 356 } 357 } // namespace __asan 358 359 #endif // SANITIZER_MAC 360
