1 //===-- asan_thread.cc ----------------------------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is a part of AddressSanitizer, an address sanity checker.
11 //
12 // Thread-related code.
13 //===----------------------------------------------------------------------===//
14 #include "asan_allocator.h"
15 #include "asan_interceptors.h"
16 #include "asan_poisoning.h"
17 #include "asan_stack.h"
18 #include "asan_thread.h"
19 #include "asan_mapping.h"
20 #include "sanitizer_common/sanitizer_common.h"
21 #include "sanitizer_common/sanitizer_placement_new.h"
22 #include "sanitizer_common/sanitizer_stackdepot.h"
23 #include "sanitizer_common/sanitizer_tls_get_addr.h"
24 #include "lsan/lsan_common.h"
25
26 namespace __asan {
27
28 // AsanThreadContext implementation.
29
30 struct CreateThreadContextArgs {
31 AsanThread *thread;
32 StackTrace *stack;
33 };
34
OnCreated(void * arg)35 void AsanThreadContext::OnCreated(void *arg) {
36 CreateThreadContextArgs *args = static_cast<CreateThreadContextArgs*>(arg);
37 if (args->stack)
38 stack_id = StackDepotPut(*args->stack);
39 thread = args->thread;
40 thread->set_context(this);
41 }
42
OnFinished()43 void AsanThreadContext::OnFinished() {
44 // Drop the link to the AsanThread object.
45 thread = nullptr;
46 }
47
48 // MIPS requires aligned address
49 static ALIGNED(16) char thread_registry_placeholder[sizeof(ThreadRegistry)];
50 static ThreadRegistry *asan_thread_registry;
51
52 static BlockingMutex mu_for_thread_context(LINKER_INITIALIZED);
53 static LowLevelAllocator allocator_for_thread_context;
54
GetAsanThreadContext(u32 tid)55 static ThreadContextBase *GetAsanThreadContext(u32 tid) {
56 BlockingMutexLock lock(&mu_for_thread_context);
57 return new(allocator_for_thread_context) AsanThreadContext(tid);
58 }
59
asanThreadRegistry()60 ThreadRegistry &asanThreadRegistry() {
61 static bool initialized;
62 // Don't worry about thread_safety - this should be called when there is
63 // a single thread.
64 if (!initialized) {
65 // Never reuse ASan threads: we store pointer to AsanThreadContext
66 // in TSD and can't reliably tell when no more TSD destructors will
67 // be called. It would be wrong to reuse AsanThreadContext for another
68 // thread before all TSD destructors will be called for it.
69 asan_thread_registry = new(thread_registry_placeholder) ThreadRegistry(
70 GetAsanThreadContext, kMaxNumberOfThreads, kMaxNumberOfThreads);
71 initialized = true;
72 }
73 return *asan_thread_registry;
74 }
75
GetThreadContextByTidLocked(u32 tid)76 AsanThreadContext *GetThreadContextByTidLocked(u32 tid) {
77 return static_cast<AsanThreadContext *>(
78 asanThreadRegistry().GetThreadLocked(tid));
79 }
80
81 // AsanThread implementation.
82
Create(thread_callback_t start_routine,void * arg,u32 parent_tid,StackTrace * stack,bool detached)83 AsanThread *AsanThread::Create(thread_callback_t start_routine, void *arg,
84 u32 parent_tid, StackTrace *stack,
85 bool detached) {
86 uptr PageSize = GetPageSizeCached();
87 uptr size = RoundUpTo(sizeof(AsanThread), PageSize);
88 AsanThread *thread = (AsanThread*)MmapOrDie(size, __func__);
89 thread->start_routine_ = start_routine;
90 thread->arg_ = arg;
91 CreateThreadContextArgs args = { thread, stack };
92 asanThreadRegistry().CreateThread(*reinterpret_cast<uptr *>(thread), detached,
93 parent_tid, &args);
94
95 return thread;
96 }
97
TSDDtor(void * tsd)98 void AsanThread::TSDDtor(void *tsd) {
99 AsanThreadContext *context = (AsanThreadContext*)tsd;
100 VReport(1, "T%d TSDDtor\n", context->tid);
101 if (context->thread)
102 context->thread->Destroy();
103 }
104
Destroy()105 void AsanThread::Destroy() {
106 int tid = this->tid();
107 VReport(1, "T%d exited\n", tid);
108
109 malloc_storage().CommitBack();
110 if (common_flags()->use_sigaltstack) UnsetAlternateSignalStack();
111 asanThreadRegistry().FinishThread(tid);
112 FlushToDeadThreadStats(&stats_);
113 // We also clear the shadow on thread destruction because
114 // some code may still be executing in later TSD destructors
115 // and we don't want it to have any poisoned stack.
116 ClearShadowForThreadStackAndTLS();
117 DeleteFakeStack(tid);
118 uptr size = RoundUpTo(sizeof(AsanThread), GetPageSizeCached());
119 UnmapOrDie(this, size);
120 DTLS_Destroy();
121 }
122
123 // We want to create the FakeStack lazyly on the first use, but not eralier
124 // than the stack size is known and the procedure has to be async-signal safe.
AsyncSignalSafeLazyInitFakeStack()125 FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() {
126 uptr stack_size = this->stack_size();
127 if (stack_size == 0) // stack_size is not yet available, don't use FakeStack.
128 return nullptr;
129 uptr old_val = 0;
130 // fake_stack_ has 3 states:
131 // 0 -- not initialized
132 // 1 -- being initialized
133 // ptr -- initialized
134 // This CAS checks if the state was 0 and if so changes it to state 1,
135 // if that was successful, it initializes the pointer.
136 if (atomic_compare_exchange_strong(
137 reinterpret_cast<atomic_uintptr_t *>(&fake_stack_), &old_val, 1UL,
138 memory_order_relaxed)) {
139 uptr stack_size_log = Log2(RoundUpToPowerOfTwo(stack_size));
140 CHECK_LE(flags()->min_uar_stack_size_log, flags()->max_uar_stack_size_log);
141 stack_size_log =
142 Min(stack_size_log, static_cast<uptr>(flags()->max_uar_stack_size_log));
143 stack_size_log =
144 Max(stack_size_log, static_cast<uptr>(flags()->min_uar_stack_size_log));
145 fake_stack_ = FakeStack::Create(stack_size_log);
146 SetTLSFakeStack(fake_stack_);
147 return fake_stack_;
148 }
149 return nullptr;
150 }
151
Init()152 void AsanThread::Init() {
153 fake_stack_ = nullptr; // Will be initialized lazily if needed.
154 CHECK_EQ(this->stack_size(), 0U);
155 SetThreadStackAndTls();
156 CHECK_GT(this->stack_size(), 0U);
157 CHECK(AddrIsInMem(stack_bottom_));
158 CHECK(AddrIsInMem(stack_top_ - 1));
159 ClearShadowForThreadStackAndTLS();
160 int local = 0;
161 VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(),
162 (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_,
163 &local);
164 }
165
ThreadStart(uptr os_id,atomic_uintptr_t * signal_thread_is_registered)166 thread_return_t AsanThread::ThreadStart(
167 uptr os_id, atomic_uintptr_t *signal_thread_is_registered) {
168 Init();
169 asanThreadRegistry().StartThread(tid(), os_id, nullptr);
170 if (signal_thread_is_registered)
171 atomic_store(signal_thread_is_registered, 1, memory_order_release);
172
173 if (common_flags()->use_sigaltstack) SetAlternateSignalStack();
174
175 if (!start_routine_) {
176 // start_routine_ == 0 if we're on the main thread or on one of the
177 // OS X libdispatch worker threads. But nobody is supposed to call
178 // ThreadStart() for the worker threads.
179 CHECK_EQ(tid(), 0);
180 return 0;
181 }
182
183 thread_return_t res = start_routine_(arg_);
184
185 // On POSIX systems we defer this to the TSD destructor. LSan will consider
186 // the thread's memory as non-live from the moment we call Destroy(), even
187 // though that memory might contain pointers to heap objects which will be
188 // cleaned up by a user-defined TSD destructor. Thus, calling Destroy() before
189 // the TSD destructors have run might cause false positives in LSan.
190 if (!SANITIZER_POSIX)
191 this->Destroy();
192
193 return res;
194 }
195
SetThreadStackAndTls()196 void AsanThread::SetThreadStackAndTls() {
197 uptr tls_size = 0;
198 GetThreadStackAndTls(tid() == 0, &stack_bottom_, &stack_size_, &tls_begin_,
199 &tls_size);
200 stack_top_ = stack_bottom_ + stack_size_;
201 tls_end_ = tls_begin_ + tls_size;
202
203 int local;
204 CHECK(AddrIsInStack((uptr)&local));
205 }
206
ClearShadowForThreadStackAndTLS()207 void AsanThread::ClearShadowForThreadStackAndTLS() {
208 PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0);
209 if (tls_begin_ != tls_end_)
210 PoisonShadow(tls_begin_, tls_end_ - tls_begin_, 0);
211 }
212
GetStackFrameAccessByAddr(uptr addr,StackFrameAccess * access)213 bool AsanThread::GetStackFrameAccessByAddr(uptr addr,
214 StackFrameAccess *access) {
215 uptr bottom = 0;
216 if (AddrIsInStack(addr)) {
217 bottom = stack_bottom();
218 } else if (has_fake_stack()) {
219 bottom = fake_stack()->AddrIsInFakeStack(addr);
220 CHECK(bottom);
221 access->offset = addr - bottom;
222 access->frame_pc = ((uptr*)bottom)[2];
223 access->frame_descr = (const char *)((uptr*)bottom)[1];
224 return true;
225 }
226 uptr aligned_addr = addr & ~(SANITIZER_WORDSIZE/8 - 1); // align addr.
227 u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
228 u8 *shadow_bottom = (u8*)MemToShadow(bottom);
229
230 while (shadow_ptr >= shadow_bottom &&
231 *shadow_ptr != kAsanStackLeftRedzoneMagic) {
232 shadow_ptr--;
233 }
234
235 while (shadow_ptr >= shadow_bottom &&
236 *shadow_ptr == kAsanStackLeftRedzoneMagic) {
237 shadow_ptr--;
238 }
239
240 if (shadow_ptr < shadow_bottom) {
241 return false;
242 }
243
244 uptr* ptr = (uptr*)SHADOW_TO_MEM((uptr)(shadow_ptr + 1));
245 CHECK(ptr[0] == kCurrentStackFrameMagic);
246 access->offset = addr - (uptr)ptr;
247 access->frame_pc = ptr[2];
248 access->frame_descr = (const char*)ptr[1];
249 return true;
250 }
251
ThreadStackContainsAddress(ThreadContextBase * tctx_base,void * addr)252 static bool ThreadStackContainsAddress(ThreadContextBase *tctx_base,
253 void *addr) {
254 AsanThreadContext *tctx = static_cast<AsanThreadContext*>(tctx_base);
255 AsanThread *t = tctx->thread;
256 if (!t) return false;
257 if (t->AddrIsInStack((uptr)addr)) return true;
258 if (t->has_fake_stack() && t->fake_stack()->AddrIsInFakeStack((uptr)addr))
259 return true;
260 return false;
261 }
262
GetCurrentThread()263 AsanThread *GetCurrentThread() {
264 AsanThreadContext *context =
265 reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
266 if (!context) {
267 if (SANITIZER_ANDROID) {
268 // On Android, libc constructor is called _after_ asan_init, and cleans up
269 // TSD. Try to figure out if this is still the main thread by the stack
270 // address. We are not entirely sure that we have correct main thread
271 // limits, so only do this magic on Android, and only if the found thread
272 // is the main thread.
273 AsanThreadContext *tctx = GetThreadContextByTidLocked(0);
274 if (ThreadStackContainsAddress(tctx, &context)) {
275 SetCurrentThread(tctx->thread);
276 return tctx->thread;
277 }
278 }
279 return nullptr;
280 }
281 return context->thread;
282 }
283
SetCurrentThread(AsanThread * t)284 void SetCurrentThread(AsanThread *t) {
285 CHECK(t->context());
286 VReport(2, "SetCurrentThread: %p for thread %p\n", t->context(),
287 (void *)GetThreadSelf());
288 // Make sure we do not reset the current AsanThread.
289 CHECK_EQ(0, AsanTSDGet());
290 AsanTSDSet(t->context());
291 CHECK_EQ(t->context(), AsanTSDGet());
292 }
293
GetCurrentTidOrInvalid()294 u32 GetCurrentTidOrInvalid() {
295 AsanThread *t = GetCurrentThread();
296 return t ? t->tid() : kInvalidTid;
297 }
298
FindThreadByStackAddress(uptr addr)299 AsanThread *FindThreadByStackAddress(uptr addr) {
300 asanThreadRegistry().CheckLocked();
301 AsanThreadContext *tctx = static_cast<AsanThreadContext *>(
302 asanThreadRegistry().FindThreadContextLocked(ThreadStackContainsAddress,
303 (void *)addr));
304 return tctx ? tctx->thread : nullptr;
305 }
306
EnsureMainThreadIDIsCorrect()307 void EnsureMainThreadIDIsCorrect() {
308 AsanThreadContext *context =
309 reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
310 if (context && (context->tid == 0))
311 context->os_id = GetTid();
312 }
313
GetAsanThreadByOsIDLocked(uptr os_id)314 __asan::AsanThread *GetAsanThreadByOsIDLocked(uptr os_id) {
315 __asan::AsanThreadContext *context = static_cast<__asan::AsanThreadContext *>(
316 __asan::asanThreadRegistry().FindThreadContextByOsIDLocked(os_id));
317 if (!context) return nullptr;
318 return context->thread;
319 }
320 } // namespace __asan
321
322 // --- Implementation of LSan-specific functions --- {{{1
323 namespace __lsan {
GetThreadRangesLocked(uptr os_id,uptr * stack_begin,uptr * stack_end,uptr * tls_begin,uptr * tls_end,uptr * cache_begin,uptr * cache_end)324 bool GetThreadRangesLocked(uptr os_id, uptr *stack_begin, uptr *stack_end,
325 uptr *tls_begin, uptr *tls_end,
326 uptr *cache_begin, uptr *cache_end) {
327 __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
328 if (!t) return false;
329 *stack_begin = t->stack_bottom();
330 *stack_end = t->stack_top();
331 *tls_begin = t->tls_begin();
332 *tls_end = t->tls_end();
333 // ASan doesn't keep allocator caches in TLS, so these are unused.
334 *cache_begin = 0;
335 *cache_end = 0;
336 return true;
337 }
338
ForEachExtraStackRange(uptr os_id,RangeIteratorCallback callback,void * arg)339 void ForEachExtraStackRange(uptr os_id, RangeIteratorCallback callback,
340 void *arg) {
341 __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
342 if (t && t->has_fake_stack())
343 t->fake_stack()->ForEachFakeFrame(callback, arg);
344 }
345
LockThreadRegistry()346 void LockThreadRegistry() {
347 __asan::asanThreadRegistry().Lock();
348 }
349
UnlockThreadRegistry()350 void UnlockThreadRegistry() {
351 __asan::asanThreadRegistry().Unlock();
352 }
353
EnsureMainThreadIDIsCorrect()354 void EnsureMainThreadIDIsCorrect() {
355 __asan::EnsureMainThreadIDIsCorrect();
356 }
357 } // namespace __lsan
358