Home | History | Annotate | Download | only in asan 
      1 //===-- asan_thread.cc ----------------------------------------------------===//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 // This file is a part of AddressSanitizer, an address sanity checker.
     11 //
     12 // Thread-related code.
     13 //===----------------------------------------------------------------------===//
     14 #include "asan_allocator.h"
     15 #include "asan_interceptors.h"
     16 #include "asan_poisoning.h"
     17 #include "asan_stack.h"
     18 #include "asan_thread.h"
     19 #include "asan_mapping.h"
     20 #include "sanitizer_common/sanitizer_common.h"
     21 #include "sanitizer_common/sanitizer_placement_new.h"
     22 #include "sanitizer_common/sanitizer_stackdepot.h"
     23 #include "sanitizer_common/sanitizer_tls_get_addr.h"
     24 #include "lsan/lsan_common.h"
     25 
     26 namespace __asan {
     27 
     28 // AsanThreadContext implementation.
     29 
     30 struct CreateThreadContextArgs {
     31   AsanThread *thread;
     32   StackTrace *stack;
     33 };
     34 
     35 void AsanThreadContext::OnCreated(void *arg) {
     36   CreateThreadContextArgs *args = static_cast<CreateThreadContextArgs*>(arg);
     37   if (args->stack)
     38     stack_id = StackDepotPut(*args->stack);
     39   thread = args->thread;
     40   thread->set_context(this);
     41 }
     42 
     43 void AsanThreadContext::OnFinished() {
     44   // Drop the link to the AsanThread object.
     45   thread = nullptr;
     46 }
     47 
     48 // MIPS requires aligned address
     49 static ALIGNED(16) char thread_registry_placeholder[sizeof(ThreadRegistry)];
     50 static ThreadRegistry *asan_thread_registry;
     51 
     52 static BlockingMutex mu_for_thread_context(LINKER_INITIALIZED);
     53 static LowLevelAllocator allocator_for_thread_context;
     54 
     55 static ThreadContextBase *GetAsanThreadContext(u32 tid) {
     56   BlockingMutexLock lock(&mu_for_thread_context);
     57   return new(allocator_for_thread_context) AsanThreadContext(tid);
     58 }
     59 
     60 ThreadRegistry &asanThreadRegistry() {
     61   static bool initialized;
     62   // Don't worry about thread_safety - this should be called when there is
     63   // a single thread.
     64   if (!initialized) {
     65     // Never reuse ASan threads: we store pointer to AsanThreadContext
     66     // in TSD and can't reliably tell when no more TSD destructors will
     67     // be called. It would be wrong to reuse AsanThreadContext for another
     68     // thread before all TSD destructors will be called for it.
     69     asan_thread_registry = new(thread_registry_placeholder) ThreadRegistry(
     70         GetAsanThreadContext, kMaxNumberOfThreads, kMaxNumberOfThreads);
     71     initialized = true;
     72   }
     73   return *asan_thread_registry;
     74 }
     75 
     76 AsanThreadContext *GetThreadContextByTidLocked(u32 tid) {
     77   return static_cast<AsanThreadContext *>(
     78       asanThreadRegistry().GetThreadLocked(tid));
     79 }
     80 
     81 // AsanThread implementation.
     82 
     83 AsanThread *AsanThread::Create(thread_callback_t start_routine, void *arg,
     84                                u32 parent_tid, StackTrace *stack,
     85                                bool detached) {
     86   uptr PageSize = GetPageSizeCached();
     87   uptr size = RoundUpTo(sizeof(AsanThread), PageSize);
     88   AsanThread *thread = (AsanThread*)MmapOrDie(size, __func__);
     89   thread->start_routine_ = start_routine;
     90   thread->arg_ = arg;
     91   CreateThreadContextArgs args = { thread, stack };
     92   asanThreadRegistry().CreateThread(*reinterpret_cast<uptr *>(thread), detached,
     93                                     parent_tid, &args);
     94 
     95   return thread;
     96 }
     97 
     98 void AsanThread::TSDDtor(void *tsd) {
     99   AsanThreadContext *context = (AsanThreadContext*)tsd;
    100   VReport(1, "T%d TSDDtor\n", context->tid);
    101   if (context->thread)
    102     context->thread->Destroy();
    103 }
    104 
    105 void AsanThread::Destroy() {
    106   int tid = this->tid();
    107   VReport(1, "T%d exited\n", tid);
    108 
    109   malloc_storage().CommitBack();
    110   if (common_flags()->use_sigaltstack) UnsetAlternateSignalStack();
    111   asanThreadRegistry().FinishThread(tid);
    112   FlushToDeadThreadStats(&stats_);
    113   // We also clear the shadow on thread destruction because
    114   // some code may still be executing in later TSD destructors
    115   // and we don't want it to have any poisoned stack.
    116   ClearShadowForThreadStackAndTLS();
    117   DeleteFakeStack(tid);
    118   uptr size = RoundUpTo(sizeof(AsanThread), GetPageSizeCached());
    119   UnmapOrDie(this, size);
    120   DTLS_Destroy();
    121 }
    122 
    123 void AsanThread::StartSwitchFiber(FakeStack **fake_stack_save, uptr bottom,
    124                                   uptr size) {
    125   if (atomic_load(&stack_switching_, memory_order_relaxed)) {
    126     Report("ERROR: starting fiber switch while in fiber switch\n");
    127     Die();
    128   }
    129 
    130   next_stack_bottom_ = bottom;
    131   next_stack_top_ = bottom + size;
    132   atomic_store(&stack_switching_, 1, memory_order_release);
    133 
    134   FakeStack *current_fake_stack = fake_stack_;
    135   if (fake_stack_save)
    136     *fake_stack_save = fake_stack_;
    137   fake_stack_ = nullptr;
    138   SetTLSFakeStack(nullptr);
    139   // if fake_stack_save is null, the fiber will die, delete the fakestack
    140   if (!fake_stack_save && current_fake_stack)
    141     current_fake_stack->Destroy(this->tid());
    142 }
    143 
    144 void AsanThread::FinishSwitchFiber(FakeStack *fake_stack_save) {
    145   if (!atomic_load(&stack_switching_, memory_order_relaxed)) {
    146     Report("ERROR: finishing a fiber switch that has not started\n");
    147     Die();
    148   }
    149 
    150   if (fake_stack_save) {
    151     SetTLSFakeStack(fake_stack_save);
    152     fake_stack_ = fake_stack_save;
    153   }
    154 
    155   stack_bottom_ = next_stack_bottom_;
    156   stack_top_ = next_stack_top_;
    157   atomic_store(&stack_switching_, 0, memory_order_release);
    158   next_stack_top_ = 0;
    159   next_stack_bottom_ = 0;
    160 }
    161 
    162 inline AsanThread::StackBounds AsanThread::GetStackBounds() const {
    163   if (!atomic_load(&stack_switching_, memory_order_acquire))
    164     return StackBounds{stack_bottom_, stack_top_};  // NOLINT
    165   char local;
    166   const uptr cur_stack = (uptr)&local;
    167   // Note: need to check next stack first, because FinishSwitchFiber
    168   // may be in process of overwriting stack_top_/bottom_. But in such case
    169   // we are already on the next stack.
    170   if (cur_stack >= next_stack_bottom_ && cur_stack < next_stack_top_)
    171     return StackBounds{next_stack_bottom_, next_stack_top_};  // NOLINT
    172   return StackBounds{stack_bottom_, stack_top_};              // NOLINT
    173 }
    174 
    175 uptr AsanThread::stack_top() {
    176   return GetStackBounds().top;
    177 }
    178 
    179 uptr AsanThread::stack_bottom() {
    180   return GetStackBounds().bottom;
    181 }
    182 
    183 uptr AsanThread::stack_size() {
    184   const auto bounds = GetStackBounds();
    185   return bounds.top - bounds.bottom;
    186 }
    187 
    188 // We want to create the FakeStack lazyly on the first use, but not eralier
    189 // than the stack size is known and the procedure has to be async-signal safe.
    190 FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() {
    191   uptr stack_size = this->stack_size();
    192   if (stack_size == 0)  // stack_size is not yet available, don't use FakeStack.
    193     return nullptr;
    194   uptr old_val = 0;
    195   // fake_stack_ has 3 states:
    196   // 0   -- not initialized
    197   // 1   -- being initialized
    198   // ptr -- initialized
    199   // This CAS checks if the state was 0 and if so changes it to state 1,
    200   // if that was successful, it initializes the pointer.
    201   if (atomic_compare_exchange_strong(
    202       reinterpret_cast<atomic_uintptr_t *>(&fake_stack_), &old_val, 1UL,
    203       memory_order_relaxed)) {
    204     uptr stack_size_log = Log2(RoundUpToPowerOfTwo(stack_size));
    205     CHECK_LE(flags()->min_uar_stack_size_log, flags()->max_uar_stack_size_log);
    206     stack_size_log =
    207         Min(stack_size_log, static_cast<uptr>(flags()->max_uar_stack_size_log));
    208     stack_size_log =
    209         Max(stack_size_log, static_cast<uptr>(flags()->min_uar_stack_size_log));
    210     fake_stack_ = FakeStack::Create(stack_size_log);
    211     SetTLSFakeStack(fake_stack_);
    212     return fake_stack_;
    213   }
    214   return nullptr;
    215 }
    216 
    217 void AsanThread::Init() {
    218   next_stack_top_ = next_stack_bottom_ = 0;
    219   atomic_store(&stack_switching_, false, memory_order_release);
    220   fake_stack_ = nullptr;  // Will be initialized lazily if needed.
    221   CHECK_EQ(this->stack_size(), 0U);
    222   SetThreadStackAndTls();
    223   CHECK_GT(this->stack_size(), 0U);
    224   CHECK(AddrIsInMem(stack_bottom_));
    225   CHECK(AddrIsInMem(stack_top_ - 1));
    226   ClearShadowForThreadStackAndTLS();
    227   int local = 0;
    228   VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(),
    229           (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_,
    230           &local);
    231 }
    232 
    233 thread_return_t AsanThread::ThreadStart(
    234     uptr os_id, atomic_uintptr_t *signal_thread_is_registered) {
    235   Init();
    236   asanThreadRegistry().StartThread(tid(), os_id, nullptr);
    237   if (signal_thread_is_registered)
    238     atomic_store(signal_thread_is_registered, 1, memory_order_release);
    239 
    240   if (common_flags()->use_sigaltstack) SetAlternateSignalStack();
    241 
    242   if (!start_routine_) {
    243     // start_routine_ == 0 if we're on the main thread or on one of the
    244     // OS X libdispatch worker threads. But nobody is supposed to call
    245     // ThreadStart() for the worker threads.
    246     CHECK_EQ(tid(), 0);
    247     return 0;
    248   }
    249 
    250   thread_return_t res = start_routine_(arg_);
    251 
    252   // On POSIX systems we defer this to the TSD destructor. LSan will consider
    253   // the thread's memory as non-live from the moment we call Destroy(), even
    254   // though that memory might contain pointers to heap objects which will be
    255   // cleaned up by a user-defined TSD destructor. Thus, calling Destroy() before
    256   // the TSD destructors have run might cause false positives in LSan.
    257   if (!SANITIZER_POSIX)
    258     this->Destroy();
    259 
    260   return res;
    261 }
    262 
    263 void AsanThread::SetThreadStackAndTls() {
    264   uptr tls_size = 0;
    265   uptr stack_size = 0;
    266   GetThreadStackAndTls(tid() == 0, const_cast<uptr *>(&stack_bottom_),
    267                        const_cast<uptr *>(&stack_size), &tls_begin_, &tls_size);
    268   stack_top_ = stack_bottom_ + stack_size;
    269   tls_end_ = tls_begin_ + tls_size;
    270   dtls_ = DTLS_Get();
    271 
    272   int local;
    273   CHECK(AddrIsInStack((uptr)&local));
    274 }
    275 
    276 void AsanThread::ClearShadowForThreadStackAndTLS() {
    277   PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0);
    278   if (tls_begin_ != tls_end_)
    279     PoisonShadow(tls_begin_, tls_end_ - tls_begin_, 0);
    280 }
    281 
    282 bool AsanThread::GetStackFrameAccessByAddr(uptr addr,
    283                                            StackFrameAccess *access) {
    284   uptr bottom = 0;
    285   if (AddrIsInStack(addr)) {
    286     bottom = stack_bottom();
    287   } else if (has_fake_stack()) {
    288     bottom = fake_stack()->AddrIsInFakeStack(addr);
    289     CHECK(bottom);
    290     access->offset = addr - bottom;
    291     access->frame_pc = ((uptr*)bottom)[2];
    292     access->frame_descr = (const char *)((uptr*)bottom)[1];
    293     return true;
    294   }
    295   uptr aligned_addr = addr & ~(SANITIZER_WORDSIZE/8 - 1);  // align addr.
    296   u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
    297   u8 *shadow_bottom = (u8*)MemToShadow(bottom);
    298 
    299   while (shadow_ptr >= shadow_bottom &&
    300          *shadow_ptr != kAsanStackLeftRedzoneMagic) {
    301     shadow_ptr--;
    302   }
    303 
    304   while (shadow_ptr >= shadow_bottom &&
    305          *shadow_ptr == kAsanStackLeftRedzoneMagic) {
    306     shadow_ptr--;
    307   }
    308 
    309   if (shadow_ptr < shadow_bottom) {
    310     return false;
    311   }
    312 
    313   uptr* ptr = (uptr*)SHADOW_TO_MEM((uptr)(shadow_ptr + 1));
    314   CHECK(ptr[0] == kCurrentStackFrameMagic);
    315   access->offset = addr - (uptr)ptr;
    316   access->frame_pc = ptr[2];
    317   access->frame_descr = (const char*)ptr[1];
    318   return true;
    319 }
    320 
    321 bool AsanThread::AddrIsInStack(uptr addr) {
    322   const auto bounds = GetStackBounds();
    323   return addr >= bounds.bottom && addr < bounds.top;
    324 }
    325 
    326 static bool ThreadStackContainsAddress(ThreadContextBase *tctx_base,
    327                                        void *addr) {
    328   AsanThreadContext *tctx = static_cast<AsanThreadContext*>(tctx_base);
    329   AsanThread *t = tctx->thread;
    330   if (!t) return false;
    331   if (t->AddrIsInStack((uptr)addr)) return true;
    332   if (t->has_fake_stack() && t->fake_stack()->AddrIsInFakeStack((uptr)addr))
    333     return true;
    334   return false;
    335 }
    336 
    337 AsanThread *GetCurrentThread() {
    338   AsanThreadContext *context =
    339       reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
    340   if (!context) {
    341     if (SANITIZER_ANDROID) {
    342       // On Android, libc constructor is called _after_ asan_init, and cleans up
    343       // TSD. Try to figure out if this is still the main thread by the stack
    344       // address. We are not entirely sure that we have correct main thread
    345       // limits, so only do this magic on Android, and only if the found thread
    346       // is the main thread.
    347       AsanThreadContext *tctx = GetThreadContextByTidLocked(0);
    348       if (ThreadStackContainsAddress(tctx, &context)) {
    349         SetCurrentThread(tctx->thread);
    350         return tctx->thread;
    351       }
    352     }
    353     return nullptr;
    354   }
    355   return context->thread;
    356 }
    357 
    358 void SetCurrentThread(AsanThread *t) {
    359   CHECK(t->context());
    360   VReport(2, "SetCurrentThread: %p for thread %p\n", t->context(),
    361           (void *)GetThreadSelf());
    362   // Make sure we do not reset the current AsanThread.
    363   CHECK_EQ(0, AsanTSDGet());
    364   AsanTSDSet(t->context());
    365   CHECK_EQ(t->context(), AsanTSDGet());
    366 }
    367 
    368 u32 GetCurrentTidOrInvalid() {
    369   AsanThread *t = GetCurrentThread();
    370   return t ? t->tid() : kInvalidTid;
    371 }
    372 
    373 AsanThread *FindThreadByStackAddress(uptr addr) {
    374   asanThreadRegistry().CheckLocked();
    375   AsanThreadContext *tctx = static_cast<AsanThreadContext *>(
    376       asanThreadRegistry().FindThreadContextLocked(ThreadStackContainsAddress,
    377                                                    (void *)addr));
    378   return tctx ? tctx->thread : nullptr;
    379 }
    380 
    381 void EnsureMainThreadIDIsCorrect() {
    382   AsanThreadContext *context =
    383       reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
    384   if (context && (context->tid == 0))
    385     context->os_id = GetTid();
    386 }
    387 
    388 __asan::AsanThread *GetAsanThreadByOsIDLocked(uptr os_id) {
    389   __asan::AsanThreadContext *context = static_cast<__asan::AsanThreadContext *>(
    390       __asan::asanThreadRegistry().FindThreadContextByOsIDLocked(os_id));
    391   if (!context) return nullptr;
    392   return context->thread;
    393 }
    394 } // namespace __asan
    395 
    396 // --- Implementation of LSan-specific functions --- {{{1
    397 namespace __lsan {
    398 bool GetThreadRangesLocked(uptr os_id, uptr *stack_begin, uptr *stack_end,
    399                            uptr *tls_begin, uptr *tls_end, uptr *cache_begin,
    400                            uptr *cache_end, DTLS **dtls) {
    401   __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
    402   if (!t) return false;
    403   *stack_begin = t->stack_bottom();
    404   *stack_end = t->stack_top();
    405   *tls_begin = t->tls_begin();
    406   *tls_end = t->tls_end();
    407   // ASan doesn't keep allocator caches in TLS, so these are unused.
    408   *cache_begin = 0;
    409   *cache_end = 0;
    410   *dtls = t->dtls();
    411   return true;
    412 }
    413 
    414 void ForEachExtraStackRange(uptr os_id, RangeIteratorCallback callback,
    415                             void *arg) {
    416   __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
    417   if (t && t->has_fake_stack())
    418     t->fake_stack()->ForEachFakeFrame(callback, arg);
    419 }
    420 
    421 void LockThreadRegistry() {
    422   __asan::asanThreadRegistry().Lock();
    423 }
    424 
    425 void UnlockThreadRegistry() {
    426   __asan::asanThreadRegistry().Unlock();
    427 }
    428 
    429 void EnsureMainThreadIDIsCorrect() {
    430   __asan::EnsureMainThreadIDIsCorrect();
    431 }
    432 } // namespace __lsan
    433 
    434 // ---------------------- Interface ---------------- {{{1
    435 using namespace __asan;  // NOLINT
    436 
    437 extern "C" {
    438 SANITIZER_INTERFACE_ATTRIBUTE
    439 void __sanitizer_start_switch_fiber(void **fakestacksave, const void *bottom,
    440                                     uptr size) {
    441   AsanThread *t = GetCurrentThread();
    442   if (!t) {
    443     VReport(1, "__asan_start_switch_fiber called from unknown thread\n");
    444     return;
    445   }
    446   t->StartSwitchFiber((FakeStack**)fakestacksave, (uptr)bottom, size);
    447 }
    448 
    449 SANITIZER_INTERFACE_ATTRIBUTE
    450 void __sanitizer_finish_switch_fiber(void* fakestack) {
    451   AsanThread *t = GetCurrentThread();
    452   if (!t) {
    453     VReport(1, "__asan_finish_switch_fiber called from unknown thread\n");
    454     return;
    455   }
    456   t->FinishSwitchFiber((FakeStack*)fakestack);
    457 }
    458 }
    459