1 //===-- asan_fake_stack.cc ------------------------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is a part of AddressSanitizer, an address sanity checker.
11 //
12 // FakeStack is used to detect use-after-return bugs.
13 //===----------------------------------------------------------------------===//
14 #include "asan_allocator.h"
15 #include "asan_poisoning.h"
16 #include "asan_thread.h"
17
18 namespace __asan {
19
20 static const u64 kMagic1 = kAsanStackAfterReturnMagic;
21 static const u64 kMagic2 = (kMagic1 << 8) | kMagic1;
22 static const u64 kMagic4 = (kMagic2 << 16) | kMagic2;
23 static const u64 kMagic8 = (kMagic4 << 32) | kMagic4;
24
25 // For small size classes inline PoisonShadow for better performance.
SetShadow(uptr ptr,uptr size,uptr class_id,u64 magic)26 ALWAYS_INLINE void SetShadow(uptr ptr, uptr size, uptr class_id, u64 magic) {
27 CHECK_EQ(SHADOW_SCALE, 3); // This code expects SHADOW_SCALE=3.
28 u64 *shadow = reinterpret_cast<u64*>(MemToShadow(ptr));
29 if (class_id <= 6) {
30 for (uptr i = 0; i < (1U << class_id); i++) {
31 shadow[i] = magic;
32 SanitizerBreakOptimization(0); // Make sure this does not become memset.
33 }
34 } else {
35 // The size class is too big, it's cheaper to poison only size bytes.
36 PoisonShadow(ptr, size, static_cast<u8>(magic));
37 }
38 }
39
Create(uptr stack_size_log)40 FakeStack *FakeStack::Create(uptr stack_size_log) {
41 static uptr kMinStackSizeLog = 16;
42 static uptr kMaxStackSizeLog = FIRST_32_SECOND_64(24, 28);
43 if (stack_size_log < kMinStackSizeLog)
44 stack_size_log = kMinStackSizeLog;
45 if (stack_size_log > kMaxStackSizeLog)
46 stack_size_log = kMaxStackSizeLog;
47 uptr size = RequiredSize(stack_size_log);
48 FakeStack *res = reinterpret_cast<FakeStack *>(
49 flags()->uar_noreserve ? MmapNoReserveOrDie(size, "FakeStack")
50 : MmapOrDie(size, "FakeStack"));
51 res->stack_size_log_ = stack_size_log;
52 u8 *p = reinterpret_cast<u8 *>(res);
53 VReport(1, "T%d: FakeStack created: %p -- %p stack_size_log: %zd; "
54 "mmapped %zdK, noreserve=%d \n",
55 GetCurrentTidOrInvalid(), p,
56 p + FakeStack::RequiredSize(stack_size_log), stack_size_log,
57 size >> 10, flags()->uar_noreserve);
58 return res;
59 }
60
Destroy(int tid)61 void FakeStack::Destroy(int tid) {
62 PoisonAll(0);
63 if (Verbosity() >= 2) {
64 InternalScopedString str(kNumberOfSizeClasses * 50);
65 for (uptr class_id = 0; class_id < kNumberOfSizeClasses; class_id++)
66 str.append("%zd: %zd/%zd; ", class_id, hint_position_[class_id],
67 NumberOfFrames(stack_size_log(), class_id));
68 Report("T%d: FakeStack destroyed: %s\n", tid, str.data());
69 }
70 uptr size = RequiredSize(stack_size_log_);
71 FlushUnneededASanShadowMemory(reinterpret_cast<uptr>(this), size);
72 UnmapOrDie(this, size);
73 }
74
PoisonAll(u8 magic)75 void FakeStack::PoisonAll(u8 magic) {
76 PoisonShadow(reinterpret_cast<uptr>(this), RequiredSize(stack_size_log()),
77 magic);
78 }
79
80 ALWAYS_INLINE USED
Allocate(uptr stack_size_log,uptr class_id,uptr real_stack)81 FakeFrame *FakeStack::Allocate(uptr stack_size_log, uptr class_id,
82 uptr real_stack) {
83 CHECK_LT(class_id, kNumberOfSizeClasses);
84 if (needs_gc_)
85 GC(real_stack);
86 uptr &hint_position = hint_position_[class_id];
87 const int num_iter = NumberOfFrames(stack_size_log, class_id);
88 u8 *flags = GetFlags(stack_size_log, class_id);
89 for (int i = 0; i < num_iter; i++) {
90 uptr pos = ModuloNumberOfFrames(stack_size_log, class_id, hint_position++);
91 // This part is tricky. On one hand, checking and setting flags[pos]
92 // should be atomic to ensure async-signal safety. But on the other hand,
93 // if the signal arrives between checking and setting flags[pos], the
94 // signal handler's fake stack will start from a different hint_position
95 // and so will not touch this particular byte. So, it is safe to do this
96 // with regular non-atimic load and store (at least I was not able to make
97 // this code crash).
98 if (flags[pos]) continue;
99 flags[pos] = 1;
100 FakeFrame *res = reinterpret_cast<FakeFrame *>(
101 GetFrame(stack_size_log, class_id, pos));
102 res->real_stack = real_stack;
103 *SavedFlagPtr(reinterpret_cast<uptr>(res), class_id) = &flags[pos];
104 return res;
105 }
106 return 0; // We are out of fake stack.
107 }
108
AddrIsInFakeStack(uptr ptr,uptr * frame_beg,uptr * frame_end)109 uptr FakeStack::AddrIsInFakeStack(uptr ptr, uptr *frame_beg, uptr *frame_end) {
110 uptr stack_size_log = this->stack_size_log();
111 uptr beg = reinterpret_cast<uptr>(GetFrame(stack_size_log, 0, 0));
112 uptr end = reinterpret_cast<uptr>(this) + RequiredSize(stack_size_log);
113 if (ptr < beg || ptr >= end) return 0;
114 uptr class_id = (ptr - beg) >> stack_size_log;
115 uptr base = beg + (class_id << stack_size_log);
116 CHECK_LE(base, ptr);
117 CHECK_LT(ptr, base + (1UL << stack_size_log));
118 uptr pos = (ptr - base) >> (kMinStackFrameSizeLog + class_id);
119 uptr res = base + pos * BytesInSizeClass(class_id);
120 *frame_end = res + BytesInSizeClass(class_id);
121 *frame_beg = res + sizeof(FakeFrame);
122 return res;
123 }
124
HandleNoReturn()125 void FakeStack::HandleNoReturn() {
126 needs_gc_ = true;
127 }
128
129 // When throw, longjmp or some such happens we don't call OnFree() and
130 // as the result may leak one or more fake frames, but the good news is that
131 // we are notified about all such events by HandleNoReturn().
132 // If we recently had such no-return event we need to collect garbage frames.
133 // We do it based on their 'real_stack' values -- everything that is lower
134 // than the current real_stack is garbage.
GC(uptr real_stack)135 NOINLINE void FakeStack::GC(uptr real_stack) {
136 uptr collected = 0;
137 for (uptr class_id = 0; class_id < kNumberOfSizeClasses; class_id++) {
138 u8 *flags = GetFlags(stack_size_log(), class_id);
139 for (uptr i = 0, n = NumberOfFrames(stack_size_log(), class_id); i < n;
140 i++) {
141 if (flags[i] == 0) continue; // not allocated.
142 FakeFrame *ff = reinterpret_cast<FakeFrame *>(
143 GetFrame(stack_size_log(), class_id, i));
144 if (ff->real_stack < real_stack) {
145 flags[i] = 0;
146 collected++;
147 }
148 }
149 }
150 needs_gc_ = false;
151 }
152
ForEachFakeFrame(RangeIteratorCallback callback,void * arg)153 void FakeStack::ForEachFakeFrame(RangeIteratorCallback callback, void *arg) {
154 for (uptr class_id = 0; class_id < kNumberOfSizeClasses; class_id++) {
155 u8 *flags = GetFlags(stack_size_log(), class_id);
156 for (uptr i = 0, n = NumberOfFrames(stack_size_log(), class_id); i < n;
157 i++) {
158 if (flags[i] == 0) continue; // not allocated.
159 FakeFrame *ff = reinterpret_cast<FakeFrame *>(
160 GetFrame(stack_size_log(), class_id, i));
161 uptr begin = reinterpret_cast<uptr>(ff);
162 callback(begin, begin + FakeStack::BytesInSizeClass(class_id), arg);
163 }
164 }
165 }
166
167 #if SANITIZER_LINUX && !SANITIZER_ANDROID
168 static THREADLOCAL FakeStack *fake_stack_tls;
169
GetTLSFakeStack()170 FakeStack *GetTLSFakeStack() {
171 return fake_stack_tls;
172 }
SetTLSFakeStack(FakeStack * fs)173 void SetTLSFakeStack(FakeStack *fs) {
174 fake_stack_tls = fs;
175 }
176 #else
GetTLSFakeStack()177 FakeStack *GetTLSFakeStack() { return 0; }
SetTLSFakeStack(FakeStack * fs)178 void SetTLSFakeStack(FakeStack *fs) { }
179 #endif // SANITIZER_LINUX && !SANITIZER_ANDROID
180
GetFakeStack()181 static FakeStack *GetFakeStack() {
182 AsanThread *t = GetCurrentThread();
183 if (!t) return 0;
184 return t->fake_stack();
185 }
186
GetFakeStackFast()187 static FakeStack *GetFakeStackFast() {
188 if (FakeStack *fs = GetTLSFakeStack())
189 return fs;
190 if (!__asan_option_detect_stack_use_after_return)
191 return 0;
192 return GetFakeStack();
193 }
194
OnMalloc(uptr class_id,uptr size)195 ALWAYS_INLINE uptr OnMalloc(uptr class_id, uptr size) {
196 FakeStack *fs = GetFakeStackFast();
197 if (!fs) return 0;
198 uptr local_stack;
199 uptr real_stack = reinterpret_cast<uptr>(&local_stack);
200 FakeFrame *ff = fs->Allocate(fs->stack_size_log(), class_id, real_stack);
201 if (!ff) return 0; // Out of fake stack.
202 uptr ptr = reinterpret_cast<uptr>(ff);
203 SetShadow(ptr, size, class_id, 0);
204 return ptr;
205 }
206
OnFree(uptr ptr,uptr class_id,uptr size)207 ALWAYS_INLINE void OnFree(uptr ptr, uptr class_id, uptr size) {
208 FakeStack::Deallocate(ptr, class_id);
209 SetShadow(ptr, size, class_id, kMagic8);
210 }
211
212 } // namespace __asan
213
214 // ---------------------- Interface ---------------- {{{1
215 using namespace __asan;
216 #define DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(class_id) \
217 extern "C" SANITIZER_INTERFACE_ATTRIBUTE uptr \
218 __asan_stack_malloc_##class_id(uptr size) { \
219 return OnMalloc(class_id, size); \
220 } \
221 extern "C" SANITIZER_INTERFACE_ATTRIBUTE void __asan_stack_free_##class_id( \
222 uptr ptr, uptr size) { \
223 OnFree(ptr, class_id, size); \
224 }
225
226 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(0)
227 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(1)
228 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(2)
229 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(3)
230 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(4)
231 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(5)
232 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(6)
233 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(7)
234 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(8)
235 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(9)
236 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(10)
237 extern "C" {
238 SANITIZER_INTERFACE_ATTRIBUTE
__asan_get_current_fake_stack()239 void *__asan_get_current_fake_stack() { return GetFakeStackFast(); }
240
241 SANITIZER_INTERFACE_ATTRIBUTE
__asan_addr_is_in_fake_stack(void * fake_stack,void * addr,void ** beg,void ** end)242 void *__asan_addr_is_in_fake_stack(void *fake_stack, void *addr, void **beg,
243 void **end) {
244 FakeStack *fs = reinterpret_cast<FakeStack*>(fake_stack);
245 if (!fs) return 0;
246 uptr frame_beg, frame_end;
247 FakeFrame *frame = reinterpret_cast<FakeFrame *>(fs->AddrIsInFakeStack(
248 reinterpret_cast<uptr>(addr), &frame_beg, &frame_end));
249 if (!frame) return 0;
250 if (frame->magic != kCurrentStackFrameMagic)
251 return 0;
252 if (beg) *beg = reinterpret_cast<void*>(frame_beg);
253 if (end) *end = reinterpret_cast<void*>(frame_end);
254 return reinterpret_cast<void*>(frame->real_stack);
255 }
256 } // extern "C"
257