1 //===-- asan_fake_stack.cc ------------------------------------------------===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file is a part of AddressSanitizer, an address sanity checker. 11 // 12 // FakeStack is used to detect use-after-return bugs. 13 //===----------------------------------------------------------------------===// 14 15 #include "asan_allocator.h" 16 #include "asan_poisoning.h" 17 #include "asan_thread.h" 18 19 namespace __asan { 20 21 static const u64 kMagic1 = kAsanStackAfterReturnMagic; 22 static const u64 kMagic2 = (kMagic1 << 8) | kMagic1; 23 static const u64 kMagic4 = (kMagic2 << 16) | kMagic2; 24 static const u64 kMagic8 = (kMagic4 << 32) | kMagic4; 25 26 static const u64 kAllocaRedzoneSize = 32UL; 27 static const u64 kAllocaRedzoneMask = 31UL; 28 29 // For small size classes inline PoisonShadow for better performance. 30 ALWAYS_INLINE void SetShadow(uptr ptr, uptr size, uptr class_id, u64 magic) { 31 CHECK_EQ(SHADOW_SCALE, 3); // This code expects SHADOW_SCALE=3. 32 u64 *shadow = reinterpret_cast<u64*>(MemToShadow(ptr)); 33 if (class_id <= 6) { 34 for (uptr i = 0; i < (((uptr)1) << class_id); i++) { 35 shadow[i] = magic; 36 // Make sure this does not become memset. 37 SanitizerBreakOptimization(nullptr); 38 } 39 } else { 40 // The size class is too big, it's cheaper to poison only size bytes. 41 PoisonShadow(ptr, size, static_cast<u8>(magic)); 42 } 43 } 44 45 FakeStack *FakeStack::Create(uptr stack_size_log) { 46 static uptr kMinStackSizeLog = 16; 47 static uptr kMaxStackSizeLog = FIRST_32_SECOND_64(24, 28); 48 if (stack_size_log < kMinStackSizeLog) 49 stack_size_log = kMinStackSizeLog; 50 if (stack_size_log > kMaxStackSizeLog) 51 stack_size_log = kMaxStackSizeLog; 52 uptr size = RequiredSize(stack_size_log); 53 FakeStack *res = reinterpret_cast<FakeStack *>( 54 flags()->uar_noreserve ? MmapNoReserveOrDie(size, "FakeStack") 55 : MmapOrDie(size, "FakeStack")); 56 res->stack_size_log_ = stack_size_log; 57 u8 *p = reinterpret_cast<u8 *>(res); 58 VReport(1, "T%d: FakeStack created: %p -- %p stack_size_log: %zd; " 59 "mmapped %zdK, noreserve=%d \n", 60 GetCurrentTidOrInvalid(), p, 61 p + FakeStack::RequiredSize(stack_size_log), stack_size_log, 62 size >> 10, flags()->uar_noreserve); 63 return res; 64 } 65 66 void FakeStack::Destroy(int tid) { 67 PoisonAll(0); 68 if (Verbosity() >= 2) { 69 InternalScopedString str(kNumberOfSizeClasses * 50); 70 for (uptr class_id = 0; class_id < kNumberOfSizeClasses; class_id++) 71 str.append("%zd: %zd/%zd; ", class_id, hint_position_[class_id], 72 NumberOfFrames(stack_size_log(), class_id)); 73 Report("T%d: FakeStack destroyed: %s\n", tid, str.data()); 74 } 75 uptr size = RequiredSize(stack_size_log_); 76 FlushUnneededASanShadowMemory(reinterpret_cast<uptr>(this), size); 77 UnmapOrDie(this, size); 78 } 79 80 void FakeStack::PoisonAll(u8 magic) { 81 PoisonShadow(reinterpret_cast<uptr>(this), RequiredSize(stack_size_log()), 82 magic); 83 } 84 85 #if !defined(_MSC_VER) || defined(__clang__) 86 ALWAYS_INLINE USED 87 #endif 88 FakeFrame *FakeStack::Allocate(uptr stack_size_log, uptr class_id, 89 uptr real_stack) { 90 CHECK_LT(class_id, kNumberOfSizeClasses); 91 if (needs_gc_) 92 GC(real_stack); 93 uptr &hint_position = hint_position_[class_id]; 94 const int num_iter = NumberOfFrames(stack_size_log, class_id); 95 u8 *flags = GetFlags(stack_size_log, class_id); 96 for (int i = 0; i < num_iter; i++) { 97 uptr pos = ModuloNumberOfFrames(stack_size_log, class_id, hint_position++); 98 // This part is tricky. On one hand, checking and setting flags[pos] 99 // should be atomic to ensure async-signal safety. But on the other hand, 100 // if the signal arrives between checking and setting flags[pos], the 101 // signal handler's fake stack will start from a different hint_position 102 // and so will not touch this particular byte. So, it is safe to do this 103 // with regular non-atimic load and store (at least I was not able to make 104 // this code crash). 105 if (flags[pos]) continue; 106 flags[pos] = 1; 107 FakeFrame *res = reinterpret_cast<FakeFrame *>( 108 GetFrame(stack_size_log, class_id, pos)); 109 res->real_stack = real_stack; 110 *SavedFlagPtr(reinterpret_cast<uptr>(res), class_id) = &flags[pos]; 111 return res; 112 } 113 return nullptr; // We are out of fake stack. 114 } 115 116 uptr FakeStack::AddrIsInFakeStack(uptr ptr, uptr *frame_beg, uptr *frame_end) { 117 uptr stack_size_log = this->stack_size_log(); 118 uptr beg = reinterpret_cast<uptr>(GetFrame(stack_size_log, 0, 0)); 119 uptr end = reinterpret_cast<uptr>(this) + RequiredSize(stack_size_log); 120 if (ptr < beg || ptr >= end) return 0; 121 uptr class_id = (ptr - beg) >> stack_size_log; 122 uptr base = beg + (class_id << stack_size_log); 123 CHECK_LE(base, ptr); 124 CHECK_LT(ptr, base + (((uptr)1) << stack_size_log)); 125 uptr pos = (ptr - base) >> (kMinStackFrameSizeLog + class_id); 126 uptr res = base + pos * BytesInSizeClass(class_id); 127 *frame_end = res + BytesInSizeClass(class_id); 128 *frame_beg = res + sizeof(FakeFrame); 129 return res; 130 } 131 132 void FakeStack::HandleNoReturn() { 133 needs_gc_ = true; 134 } 135 136 // When throw, longjmp or some such happens we don't call OnFree() and 137 // as the result may leak one or more fake frames, but the good news is that 138 // we are notified about all such events by HandleNoReturn(). 139 // If we recently had such no-return event we need to collect garbage frames. 140 // We do it based on their 'real_stack' values -- everything that is lower 141 // than the current real_stack is garbage. 142 NOINLINE void FakeStack::GC(uptr real_stack) { 143 uptr collected = 0; 144 for (uptr class_id = 0; class_id < kNumberOfSizeClasses; class_id++) { 145 u8 *flags = GetFlags(stack_size_log(), class_id); 146 for (uptr i = 0, n = NumberOfFrames(stack_size_log(), class_id); i < n; 147 i++) { 148 if (flags[i] == 0) continue; // not allocated. 149 FakeFrame *ff = reinterpret_cast<FakeFrame *>( 150 GetFrame(stack_size_log(), class_id, i)); 151 if (ff->real_stack < real_stack) { 152 flags[i] = 0; 153 collected++; 154 } 155 } 156 } 157 needs_gc_ = false; 158 } 159 160 void FakeStack::ForEachFakeFrame(RangeIteratorCallback callback, void *arg) { 161 for (uptr class_id = 0; class_id < kNumberOfSizeClasses; class_id++) { 162 u8 *flags = GetFlags(stack_size_log(), class_id); 163 for (uptr i = 0, n = NumberOfFrames(stack_size_log(), class_id); i < n; 164 i++) { 165 if (flags[i] == 0) continue; // not allocated. 166 FakeFrame *ff = reinterpret_cast<FakeFrame *>( 167 GetFrame(stack_size_log(), class_id, i)); 168 uptr begin = reinterpret_cast<uptr>(ff); 169 callback(begin, begin + FakeStack::BytesInSizeClass(class_id), arg); 170 } 171 } 172 } 173 174 #if SANITIZER_LINUX && !SANITIZER_ANDROID 175 static THREADLOCAL FakeStack *fake_stack_tls; 176 177 FakeStack *GetTLSFakeStack() { 178 return fake_stack_tls; 179 } 180 void SetTLSFakeStack(FakeStack *fs) { 181 fake_stack_tls = fs; 182 } 183 #else 184 FakeStack *GetTLSFakeStack() { return 0; } 185 void SetTLSFakeStack(FakeStack *fs) { } 186 #endif // SANITIZER_LINUX && !SANITIZER_ANDROID 187 188 static FakeStack *GetFakeStack() { 189 AsanThread *t = GetCurrentThread(); 190 if (!t) return nullptr; 191 return t->fake_stack(); 192 } 193 194 static FakeStack *GetFakeStackFast() { 195 if (FakeStack *fs = GetTLSFakeStack()) 196 return fs; 197 if (!__asan_option_detect_stack_use_after_return) 198 return nullptr; 199 return GetFakeStack(); 200 } 201 202 ALWAYS_INLINE uptr OnMalloc(uptr class_id, uptr size) { 203 FakeStack *fs = GetFakeStackFast(); 204 if (!fs) return 0; 205 uptr local_stack; 206 uptr real_stack = reinterpret_cast<uptr>(&local_stack); 207 FakeFrame *ff = fs->Allocate(fs->stack_size_log(), class_id, real_stack); 208 if (!ff) return 0; // Out of fake stack. 209 uptr ptr = reinterpret_cast<uptr>(ff); 210 SetShadow(ptr, size, class_id, 0); 211 return ptr; 212 } 213 214 ALWAYS_INLINE void OnFree(uptr ptr, uptr class_id, uptr size) { 215 FakeStack::Deallocate(ptr, class_id); 216 SetShadow(ptr, size, class_id, kMagic8); 217 } 218 219 } // namespace __asan 220 221 // ---------------------- Interface ---------------- {{{1 222 using namespace __asan; 223 #define DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(class_id) \ 224 extern "C" SANITIZER_INTERFACE_ATTRIBUTE uptr \ 225 __asan_stack_malloc_##class_id(uptr size) { \ 226 return OnMalloc(class_id, size); \ 227 } \ 228 extern "C" SANITIZER_INTERFACE_ATTRIBUTE void __asan_stack_free_##class_id( \ 229 uptr ptr, uptr size) { \ 230 OnFree(ptr, class_id, size); \ 231 } 232 233 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(0) 234 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(1) 235 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(2) 236 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(3) 237 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(4) 238 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(5) 239 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(6) 240 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(7) 241 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(8) 242 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(9) 243 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(10) 244 extern "C" { 245 SANITIZER_INTERFACE_ATTRIBUTE 246 void *__asan_get_current_fake_stack() { return GetFakeStackFast(); } 247 248 SANITIZER_INTERFACE_ATTRIBUTE 249 void *__asan_addr_is_in_fake_stack(void *fake_stack, void *addr, void **beg, 250 void **end) { 251 FakeStack *fs = reinterpret_cast<FakeStack*>(fake_stack); 252 if (!fs) return nullptr; 253 uptr frame_beg, frame_end; 254 FakeFrame *frame = reinterpret_cast<FakeFrame *>(fs->AddrIsInFakeStack( 255 reinterpret_cast<uptr>(addr), &frame_beg, &frame_end)); 256 if (!frame) return nullptr; 257 if (frame->magic != kCurrentStackFrameMagic) 258 return nullptr; 259 if (beg) *beg = reinterpret_cast<void*>(frame_beg); 260 if (end) *end = reinterpret_cast<void*>(frame_end); 261 return reinterpret_cast<void*>(frame->real_stack); 262 } 263 264 SANITIZER_INTERFACE_ATTRIBUTE 265 void __asan_alloca_poison(uptr addr, uptr size) { 266 uptr LeftRedzoneAddr = addr - kAllocaRedzoneSize; 267 uptr PartialRzAddr = addr + size; 268 uptr RightRzAddr = (PartialRzAddr + kAllocaRedzoneMask) & ~kAllocaRedzoneMask; 269 uptr PartialRzAligned = PartialRzAddr & ~(SHADOW_GRANULARITY - 1); 270 FastPoisonShadow(LeftRedzoneAddr, kAllocaRedzoneSize, kAsanAllocaLeftMagic); 271 FastPoisonShadowPartialRightRedzone( 272 PartialRzAligned, PartialRzAddr % SHADOW_GRANULARITY, 273 RightRzAddr - PartialRzAligned, kAsanAllocaRightMagic); 274 FastPoisonShadow(RightRzAddr, kAllocaRedzoneSize, kAsanAllocaRightMagic); 275 } 276 277 SANITIZER_INTERFACE_ATTRIBUTE 278 void __asan_allocas_unpoison(uptr top, uptr bottom) { 279 if ((!top) || (top > bottom)) return; 280 REAL(memset)(reinterpret_cast<void*>(MemToShadow(top)), 0, 281 (bottom - top) / SHADOW_GRANULARITY); 282 } 283 } // extern "C" 284
