Home | History | Annotate | Download | only in ubsan 
      1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 // Error logging entry points for the UBSan runtime, which are only used for C++
     11 // compilations. This file is permitted to use language features which require
     12 // linking against a C++ ABI library.
     13 //
     14 //===----------------------------------------------------------------------===//
     15 
     16 #include "ubsan_platform.h"
     17 #if CAN_SANITIZE_UB
     18 #include "ubsan_handlers_cxx.h"
     19 #include "ubsan_diag.h"
     20 #include "ubsan_type_hash.h"
     21 
     22 #include "sanitizer_common/sanitizer_common.h"
     23 #include "sanitizer_common/sanitizer_suppressions.h"
     24 
     25 using namespace __sanitizer;
     26 using namespace __ubsan;
     27 
     28 namespace __ubsan {
     29   extern const char *TypeCheckKinds[];
     30 }
     31 
     32 // Returns true if UBSan has printed an error report.
     33 static bool HandleDynamicTypeCacheMiss(
     34     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
     35     ReportOptions Opts) {
     36   if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
     37     // Just a cache miss. The type matches after all.
     38     return false;
     39 
     40   // Check if error report should be suppressed.
     41   DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
     42   if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
     43     return false;
     44 
     45   SourceLocation Loc = Data->Loc.acquire();
     46   ErrorType ET = ErrorType::DynamicTypeMismatch;
     47   if (ignoreReport(Loc, Opts, ET))
     48     return false;
     49 
     50   ScopedReport R(Opts, Loc, ET);
     51 
     52   Diag(Loc, DL_Error,
     53        "%0 address %1 which does not point to an object of type %2")
     54     << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
     55 
     56   // If possible, say what type it actually points to.
     57   if (!DTI.isValid())
     58     Diag(Pointer, DL_Note, "object has invalid vptr")
     59         << TypeName(DTI.getMostDerivedTypeName())
     60         << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
     61   else if (!DTI.getOffset())
     62     Diag(Pointer, DL_Note, "object is of type %0")
     63         << TypeName(DTI.getMostDerivedTypeName())
     64         << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
     65   else
     66     // FIXME: Find the type at the specified offset, and include that
     67     //        in the note.
     68     Diag(Pointer - DTI.getOffset(), DL_Note,
     69          "object is base class subobject at offset %0 within object of type %1")
     70         << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
     71         << TypeName(DTI.getSubobjectTypeName())
     72         << Range(Pointer, Pointer + sizeof(uptr),
     73                  "vptr for %2 base class of %1");
     74   return true;
     75 }
     76 
     77 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
     78     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
     79   GET_REPORT_OPTIONS(false);
     80   HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
     81 }
     82 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
     83     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
     84   // Note: -fsanitize=vptr is always recoverable.
     85   GET_REPORT_OPTIONS(false);
     86   if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts))
     87     Die();
     88 }
     89 
     90 static void HandleCFIBadType(CFIBadTypeData *Data, ValueHandle Vtable,
     91                              ReportOptions Opts) {
     92   SourceLocation Loc = Data->Loc.acquire();
     93   ErrorType ET = ErrorType::CFIBadType;
     94 
     95   if (ignoreReport(Loc, Opts, ET))
     96     return;
     97 
     98   ScopedReport R(Opts, Loc, ET);
     99   DynamicTypeInfo DTI = getDynamicTypeInfoFromVtable((void*)Vtable);
    100 
    101   static const char *TypeCheckKinds[] = {
    102     "virtual call",
    103     "non-virtual call",
    104     "base-to-derived cast",
    105     "cast to unrelated type",
    106   };
    107 
    108   Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
    109                       "%1 (vtable address %2)")
    110       << Data->Type << TypeCheckKinds[Data->TypeCheckKind] << (void *)Vtable;
    111 
    112   // If possible, say what type it actually points to.
    113   if (!DTI.isValid())
    114     Diag(Vtable, DL_Note, "invalid vtable");
    115   else
    116     Diag(Vtable, DL_Note, "vtable is of type %0")
    117         << TypeName(DTI.getMostDerivedTypeName());
    118 }
    119 
    120 void __ubsan::__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data,
    121                                           ValueHandle Vtable) {
    122   GET_REPORT_OPTIONS(false);
    123   HandleCFIBadType(Data, Vtable, Opts);
    124 }
    125 
    126 void __ubsan::__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data,
    127                                                 ValueHandle Vtable) {
    128   GET_REPORT_OPTIONS(true);
    129   HandleCFIBadType(Data, Vtable, Opts);
    130   Die();
    131 }
    132 
    133 #endif  // CAN_SANITIZE_UB
    134