1 //===-- asan_rtl.cc -------------------------------------------------------===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is a part of AddressSanitizer, an address sanity checker.
11 //
12 // Main file of the ASan run-time library.
13 //===----------------------------------------------------------------------===//
14 
15 #include "asan_activation.h"
16 #include "asan_allocator.h"
17 #include "asan_interceptors.h"
18 #include "asan_interface_internal.h"
19 #include "asan_internal.h"
20 #include "asan_mapping.h"
21 #include "asan_poisoning.h"
22 #include "asan_report.h"
23 #include "asan_stack.h"
24 #include "asan_stats.h"
25 #include "asan_suppressions.h"
26 #include "asan_thread.h"
27 #include "sanitizer_common/sanitizer_atomic.h"
28 #include "sanitizer_common/sanitizer_flags.h"
29 #include "sanitizer_common/sanitizer_libc.h"
30 #include "sanitizer_common/sanitizer_symbolizer.h"
31 #include "lsan/lsan_common.h"
32 #include "ubsan/ubsan_init.h"
33 #include "ubsan/ubsan_platform.h"
34 
35 int __asan_option_detect_stack_use_after_return;  // Global interface symbol.
36 uptr *__asan_test_only_reported_buggy_pointer;  // Used only for testing asan.
37 
38 namespace __asan {
39 
40 uptr AsanMappingProfile[kAsanMappingProfileSize];
41 
AsanDie()42 static void AsanDie() {
43   static atomic_uint32_t num_calls;
44   if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) {
45     // Don't die twice - run a busy loop.
46     while (1) { }
47   }
48   if (flags()->sleep_before_dying) {
49     Report("Sleeping for %d second(s)\n", flags()->sleep_before_dying);
50     SleepForSeconds(flags()->sleep_before_dying);
51   }
52   if (flags()->unmap_shadow_on_exit) {
53     if (kMidMemBeg) {
54       UnmapOrDie((void*)kLowShadowBeg, kMidMemBeg - kLowShadowBeg);
55       UnmapOrDie((void*)kMidMemEnd, kHighShadowEnd - kMidMemEnd);
56     } else {
57       UnmapOrDie((void*)kLowShadowBeg, kHighShadowEnd - kLowShadowBeg);
58     }
59   }
60 }
61 
AsanCheckFailed(const char * file,int line,const char * cond,u64 v1,u64 v2)62 static void AsanCheckFailed(const char *file, int line, const char *cond,
63                             u64 v1, u64 v2) {
64   Report("AddressSanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n", file,
65          line, cond, (uptr)v1, (uptr)v2);
66   // FIXME: check for infinite recursion without a thread-local counter here.
67   PRINT_CURRENT_STACK_CHECK();
68   Die();
69 }
70 
71 // -------------------------- Globals --------------------- {{{1
72 int asan_inited;
73 bool asan_init_is_running;
74 
75 #if !ASAN_FIXED_MAPPING
76 uptr kHighMemEnd, kMidMemBeg, kMidMemEnd;
77 #endif
78 
79 // -------------------------- Misc ---------------- {{{1
ShowStatsAndAbort()80 void ShowStatsAndAbort() {
81   __asan_print_accumulated_stats();
82   Die();
83 }
84 
85 // ---------------------- mmap -------------------- {{{1
86 // Reserve memory range [beg, end].
87 // We need to use inclusive range because end+1 may not be representable.
ReserveShadowMemoryRange(uptr beg,uptr end,const char * name)88 void ReserveShadowMemoryRange(uptr beg, uptr end, const char *name) {
89   CHECK_EQ((beg % GetMmapGranularity()), 0);
90   CHECK_EQ(((end + 1) % GetMmapGranularity()), 0);
91   uptr size = end - beg + 1;
92   DecreaseTotalMmap(size);  // Don't count the shadow against mmap_limit_mb.
93   void *res = MmapFixedNoReserve(beg, size, name);
94   if (res != (void*)beg) {
95     Report("ReserveShadowMemoryRange failed while trying to map 0x%zx bytes. "
96            "Perhaps you're using ulimit -v\n", size);
97     Abort();
98   }
99   if (common_flags()->no_huge_pages_for_shadow)
100     NoHugePagesInRegion(beg, size);
101   if (common_flags()->use_madv_dontdump)
102     DontDumpShadowMemory(beg, size);
103 }
104 
105 // --------------- LowLevelAllocateCallbac ---------- {{{1
OnLowLevelAllocate(uptr ptr,uptr size)106 static void OnLowLevelAllocate(uptr ptr, uptr size) {
107   PoisonShadow(ptr, size, kAsanInternalHeapMagic);
108 }
109 
110 // -------------------------- Run-time entry ------------------- {{{1
111 // exported functions
112 #define ASAN_REPORT_ERROR(type, is_write, size)                     \
113 extern "C" NOINLINE INTERFACE_ATTRIBUTE                             \
114 void __asan_report_ ## type ## size(uptr addr) {                    \
115   GET_CALLER_PC_BP_SP;                                              \
116   ReportGenericError(pc, bp, sp, addr, is_write, size, 0, true);    \
117 }                                                                   \
118 extern "C" NOINLINE INTERFACE_ATTRIBUTE                             \
119 void __asan_report_exp_ ## type ## size(uptr addr, u32 exp) {       \
120   GET_CALLER_PC_BP_SP;                                              \
121   ReportGenericError(pc, bp, sp, addr, is_write, size, exp, true);  \
122 }                                                                   \
123 extern "C" NOINLINE INTERFACE_ATTRIBUTE                             \
124 void __asan_report_ ## type ## size ## _noabort(uptr addr) {        \
125   GET_CALLER_PC_BP_SP;                                              \
126   ReportGenericError(pc, bp, sp, addr, is_write, size, 0, false);   \
127 }                                                                   \
128 
129 ASAN_REPORT_ERROR(load, false, 1)
130 ASAN_REPORT_ERROR(load, false, 2)
131 ASAN_REPORT_ERROR(load, false, 4)
132 ASAN_REPORT_ERROR(load, false, 8)
133 ASAN_REPORT_ERROR(load, false, 16)
134 ASAN_REPORT_ERROR(store, true, 1)
135 ASAN_REPORT_ERROR(store, true, 2)
136 ASAN_REPORT_ERROR(store, true, 4)
137 ASAN_REPORT_ERROR(store, true, 8)
138 ASAN_REPORT_ERROR(store, true, 16)
139 
140 #define ASAN_REPORT_ERROR_N(type, is_write)                                 \
141 extern "C" NOINLINE INTERFACE_ATTRIBUTE                                     \
142 void __asan_report_ ## type ## _n(uptr addr, uptr size) {                   \
143   GET_CALLER_PC_BP_SP;                                                      \
144   ReportGenericError(pc, bp, sp, addr, is_write, size, 0, true);            \
145 }                                                                           \
146 extern "C" NOINLINE INTERFACE_ATTRIBUTE                                     \
147 void __asan_report_exp_ ## type ## _n(uptr addr, uptr size, u32 exp) {      \
148   GET_CALLER_PC_BP_SP;                                                      \
149   ReportGenericError(pc, bp, sp, addr, is_write, size, exp, true);          \
150 }                                                                           \
151 extern "C" NOINLINE INTERFACE_ATTRIBUTE                                     \
152 void __asan_report_ ## type ## _n_noabort(uptr addr, uptr size) {           \
153   GET_CALLER_PC_BP_SP;                                                      \
154   ReportGenericError(pc, bp, sp, addr, is_write, size, 0, false);           \
155 }                                                                           \
156 
ASAN_REPORT_ERROR_N(load,false)157 ASAN_REPORT_ERROR_N(load, false)
158 ASAN_REPORT_ERROR_N(store, true)
159 
160 #define ASAN_MEMORY_ACCESS_CALLBACK_BODY(type, is_write, size, exp_arg, fatal) \
161     uptr sp = MEM_TO_SHADOW(addr);                                             \
162     uptr s = size <= SHADOW_GRANULARITY ? *reinterpret_cast<u8 *>(sp)          \
163                                         : *reinterpret_cast<u16 *>(sp);        \
164     if (UNLIKELY(s)) {                                                         \
165       if (UNLIKELY(size >= SHADOW_GRANULARITY ||                               \
166                    ((s8)((addr & (SHADOW_GRANULARITY - 1)) + size - 1)) >=     \
167                        (s8)s)) {                                               \
168         if (__asan_test_only_reported_buggy_pointer) {                         \
169           *__asan_test_only_reported_buggy_pointer = addr;                     \
170         } else {                                                               \
171           GET_CALLER_PC_BP_SP;                                                 \
172           ReportGenericError(pc, bp, sp, addr, is_write, size, exp_arg,        \
173                               fatal);                                          \
174         }                                                                      \
175       }                                                                        \
176     }
177 
178 #define ASAN_MEMORY_ACCESS_CALLBACK(type, is_write, size)                      \
179   extern "C" NOINLINE INTERFACE_ATTRIBUTE                                      \
180   void __asan_##type##size(uptr addr) {                                        \
181     ASAN_MEMORY_ACCESS_CALLBACK_BODY(type, is_write, size, 0, true)            \
182   }                                                                            \
183   extern "C" NOINLINE INTERFACE_ATTRIBUTE                                      \
184   void __asan_exp_##type##size(uptr addr, u32 exp) {                           \
185     ASAN_MEMORY_ACCESS_CALLBACK_BODY(type, is_write, size, exp, true)          \
186   }                                                                            \
187   extern "C" NOINLINE INTERFACE_ATTRIBUTE                                      \
188   void __asan_##type##size ## _noabort(uptr addr) {                            \
189     ASAN_MEMORY_ACCESS_CALLBACK_BODY(type, is_write, size, 0, false)           \
190   }                                                                            \
191 
192 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 1)
193 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 2)
194 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 4)
195 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 8)
196 ASAN_MEMORY_ACCESS_CALLBACK(load, false, 16)
197 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 1)
198 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 2)
199 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 4)
200 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 8)
201 ASAN_MEMORY_ACCESS_CALLBACK(store, true, 16)
202 
203 extern "C"
204 NOINLINE INTERFACE_ATTRIBUTE
205 void __asan_loadN(uptr addr, uptr size) {
206   if (__asan_region_is_poisoned(addr, size)) {
207     GET_CALLER_PC_BP_SP;
208     ReportGenericError(pc, bp, sp, addr, false, size, 0, true);
209   }
210 }
211 
212 extern "C"
213 NOINLINE INTERFACE_ATTRIBUTE
__asan_exp_loadN(uptr addr,uptr size,u32 exp)214 void __asan_exp_loadN(uptr addr, uptr size, u32 exp) {
215   if (__asan_region_is_poisoned(addr, size)) {
216     GET_CALLER_PC_BP_SP;
217     ReportGenericError(pc, bp, sp, addr, false, size, exp, true);
218   }
219 }
220 
221 extern "C"
222 NOINLINE INTERFACE_ATTRIBUTE
__asan_loadN_noabort(uptr addr,uptr size)223 void __asan_loadN_noabort(uptr addr, uptr size) {
224   if (__asan_region_is_poisoned(addr, size)) {
225     GET_CALLER_PC_BP_SP;
226     ReportGenericError(pc, bp, sp, addr, false, size, 0, false);
227   }
228 }
229 
230 extern "C"
231 NOINLINE INTERFACE_ATTRIBUTE
__asan_storeN(uptr addr,uptr size)232 void __asan_storeN(uptr addr, uptr size) {
233   if (__asan_region_is_poisoned(addr, size)) {
234     GET_CALLER_PC_BP_SP;
235     ReportGenericError(pc, bp, sp, addr, true, size, 0, true);
236   }
237 }
238 
239 extern "C"
240 NOINLINE INTERFACE_ATTRIBUTE
__asan_exp_storeN(uptr addr,uptr size,u32 exp)241 void __asan_exp_storeN(uptr addr, uptr size, u32 exp) {
242   if (__asan_region_is_poisoned(addr, size)) {
243     GET_CALLER_PC_BP_SP;
244     ReportGenericError(pc, bp, sp, addr, true, size, exp, true);
245   }
246 }
247 
248 extern "C"
249 NOINLINE INTERFACE_ATTRIBUTE
__asan_storeN_noabort(uptr addr,uptr size)250 void __asan_storeN_noabort(uptr addr, uptr size) {
251   if (__asan_region_is_poisoned(addr, size)) {
252     GET_CALLER_PC_BP_SP;
253     ReportGenericError(pc, bp, sp, addr, true, size, 0, false);
254   }
255 }
256 
257 // Force the linker to keep the symbols for various ASan interface functions.
258 // We want to keep those in the executable in order to let the instrumented
259 // dynamic libraries access the symbol even if it is not used by the executable
260 // itself. This should help if the build system is removing dead code at link
261 // time.
force_interface_symbols()262 static NOINLINE void force_interface_symbols() {
263   volatile int fake_condition = 0;  // prevent dead condition elimination.
264   // __asan_report_* functions are noreturn, so we need a switch to prevent
265   // the compiler from removing any of them.
266   switch (fake_condition) {
267     case 1: __asan_report_load1(0); break;
268     case 2: __asan_report_load2(0); break;
269     case 3: __asan_report_load4(0); break;
270     case 4: __asan_report_load8(0); break;
271     case 5: __asan_report_load16(0); break;
272     case 6: __asan_report_load_n(0, 0); break;
273     case 7: __asan_report_store1(0); break;
274     case 8: __asan_report_store2(0); break;
275     case 9: __asan_report_store4(0); break;
276     case 10: __asan_report_store8(0); break;
277     case 11: __asan_report_store16(0); break;
278     case 12: __asan_report_store_n(0, 0); break;
279     case 13: __asan_report_exp_load1(0, 0); break;
280     case 14: __asan_report_exp_load2(0, 0); break;
281     case 15: __asan_report_exp_load4(0, 0); break;
282     case 16: __asan_report_exp_load8(0, 0); break;
283     case 17: __asan_report_exp_load16(0, 0); break;
284     case 18: __asan_report_exp_load_n(0, 0, 0); break;
285     case 19: __asan_report_exp_store1(0, 0); break;
286     case 20: __asan_report_exp_store2(0, 0); break;
287     case 21: __asan_report_exp_store4(0, 0); break;
288     case 22: __asan_report_exp_store8(0, 0); break;
289     case 23: __asan_report_exp_store16(0, 0); break;
290     case 24: __asan_report_exp_store_n(0, 0, 0); break;
291     case 25: __asan_register_globals(nullptr, 0); break;
292     case 26: __asan_unregister_globals(nullptr, 0); break;
293     case 27: __asan_set_death_callback(nullptr); break;
294     case 28: __asan_set_error_report_callback(nullptr); break;
295     case 29: __asan_handle_no_return(); break;
296     case 30: __asan_address_is_poisoned(nullptr); break;
297     case 31: __asan_poison_memory_region(nullptr, 0); break;
298     case 32: __asan_unpoison_memory_region(nullptr, 0); break;
299     case 34: __asan_before_dynamic_init(nullptr); break;
300     case 35: __asan_after_dynamic_init(); break;
301     case 36: __asan_poison_stack_memory(0, 0); break;
302     case 37: __asan_unpoison_stack_memory(0, 0); break;
303     case 38: __asan_region_is_poisoned(0, 0); break;
304     case 39: __asan_describe_address(0); break;
305   }
306 }
307 
asan_atexit()308 static void asan_atexit() {
309   Printf("AddressSanitizer exit stats:\n");
310   __asan_print_accumulated_stats();
311   // Print AsanMappingProfile.
312   for (uptr i = 0; i < kAsanMappingProfileSize; i++) {
313     if (AsanMappingProfile[i] == 0) continue;
314     Printf("asan_mapping.h:%zd -- %zd\n", i, AsanMappingProfile[i]);
315   }
316 }
317 
InitializeHighMemEnd()318 static void InitializeHighMemEnd() {
319 #if !ASAN_FIXED_MAPPING
320   kHighMemEnd = GetMaxVirtualAddress();
321   // Increase kHighMemEnd to make sure it's properly
322   // aligned together with kHighMemBeg:
323   kHighMemEnd |= SHADOW_GRANULARITY * GetMmapGranularity() - 1;
324 #endif  // !ASAN_FIXED_MAPPING
325   CHECK_EQ((kHighMemBeg % GetMmapGranularity()), 0);
326 }
327 
ProtectGap(uptr addr,uptr size)328 static void ProtectGap(uptr addr, uptr size) {
329   if (!flags()->protect_shadow_gap)
330     return;
331   void *res = MmapFixedNoAccess(addr, size, "shadow gap");
332   if (addr == (uptr)res)
333     return;
334   // A few pages at the start of the address space can not be protected.
335   // But we really want to protect as much as possible, to prevent this memory
336   // being returned as a result of a non-FIXED mmap().
337   if (addr == kZeroBaseShadowStart) {
338     uptr step = GetMmapGranularity();
339     while (size > step && addr < kZeroBaseMaxShadowStart) {
340       addr += step;
341       size -= step;
342       void *res = MmapFixedNoAccess(addr, size, "shadow gap");
343       if (addr == (uptr)res)
344         return;
345     }
346   }
347 
348   Report("ERROR: Failed to protect the shadow gap. "
349          "ASan cannot proceed correctly. ABORTING.\n");
350   DumpProcessMap();
351   Die();
352 }
353 
PrintAddressSpaceLayout()354 static void PrintAddressSpaceLayout() {
355   Printf("|| `[%p, %p]` || HighMem    ||\n",
356          (void*)kHighMemBeg, (void*)kHighMemEnd);
357   Printf("|| `[%p, %p]` || HighShadow ||\n",
358          (void*)kHighShadowBeg, (void*)kHighShadowEnd);
359   if (kMidMemBeg) {
360     Printf("|| `[%p, %p]` || ShadowGap3 ||\n",
361            (void*)kShadowGap3Beg, (void*)kShadowGap3End);
362     Printf("|| `[%p, %p]` || MidMem     ||\n",
363            (void*)kMidMemBeg, (void*)kMidMemEnd);
364     Printf("|| `[%p, %p]` || ShadowGap2 ||\n",
365            (void*)kShadowGap2Beg, (void*)kShadowGap2End);
366     Printf("|| `[%p, %p]` || MidShadow  ||\n",
367            (void*)kMidShadowBeg, (void*)kMidShadowEnd);
368   }
369   Printf("|| `[%p, %p]` || ShadowGap  ||\n",
370          (void*)kShadowGapBeg, (void*)kShadowGapEnd);
371   if (kLowShadowBeg) {
372     Printf("|| `[%p, %p]` || LowShadow  ||\n",
373            (void*)kLowShadowBeg, (void*)kLowShadowEnd);
374     Printf("|| `[%p, %p]` || LowMem     ||\n",
375            (void*)kLowMemBeg, (void*)kLowMemEnd);
376   }
377   Printf("MemToShadow(shadow): %p %p %p %p",
378          (void*)MEM_TO_SHADOW(kLowShadowBeg),
379          (void*)MEM_TO_SHADOW(kLowShadowEnd),
380          (void*)MEM_TO_SHADOW(kHighShadowBeg),
381          (void*)MEM_TO_SHADOW(kHighShadowEnd));
382   if (kMidMemBeg) {
383     Printf(" %p %p",
384            (void*)MEM_TO_SHADOW(kMidShadowBeg),
385            (void*)MEM_TO_SHADOW(kMidShadowEnd));
386   }
387   Printf("\n");
388   Printf("redzone=%zu\n", (uptr)flags()->redzone);
389   Printf("max_redzone=%zu\n", (uptr)flags()->max_redzone);
390   Printf("quarantine_size_mb=%zuM\n", (uptr)flags()->quarantine_size_mb);
391   Printf("malloc_context_size=%zu\n",
392          (uptr)common_flags()->malloc_context_size);
393 
394   Printf("SHADOW_SCALE: %d\n", (int)SHADOW_SCALE);
395   Printf("SHADOW_GRANULARITY: %d\n", (int)SHADOW_GRANULARITY);
396   Printf("SHADOW_OFFSET: 0x%zx\n", (uptr)SHADOW_OFFSET);
397   CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7);
398   if (kMidMemBeg)
399     CHECK(kMidShadowBeg > kLowShadowEnd &&
400           kMidMemBeg > kMidShadowEnd &&
401           kHighShadowBeg > kMidMemEnd);
402 }
403 
AsanInitInternal()404 static void AsanInitInternal() {
405   if (LIKELY(asan_inited)) return;
406   SanitizerToolName = "AddressSanitizer";
407   CHECK(!asan_init_is_running && "ASan init calls itself!");
408   asan_init_is_running = true;
409 
410   CacheBinaryName();
411 
412   // Initialize flags. This must be done early, because most of the
413   // initialization steps look at flags().
414   InitializeFlags();
415 
416   AsanCheckIncompatibleRT();
417   AsanCheckDynamicRTPrereqs();
418   AvoidCVE_2016_2143();
419 
420   SetCanPoisonMemory(flags()->poison_heap);
421   SetMallocContextSize(common_flags()->malloc_context_size);
422 
423   InitializePlatformExceptionHandlers();
424 
425   InitializeHighMemEnd();
426 
427   // Make sure we are not statically linked.
428   AsanDoesNotSupportStaticLinkage();
429 
430   // Install tool-specific callbacks in sanitizer_common.
431   AddDieCallback(AsanDie);
432   SetCheckFailedCallback(AsanCheckFailed);
433   SetPrintfAndReportCallback(AppendToErrorMessageBuffer);
434 
435   __sanitizer_set_report_path(common_flags()->log_path);
436 
437   // Enable UAR detection, if required.
438   __asan_option_detect_stack_use_after_return =
439       flags()->detect_stack_use_after_return;
440 
441   // Re-exec ourselves if we need to set additional env or command line args.
442   MaybeReexec();
443 
444   // Setup internal allocator callback.
445   SetLowLevelAllocateCallback(OnLowLevelAllocate);
446 
447   InitializeAsanInterceptors();
448 
449   // Enable system log ("adb logcat") on Android.
450   // Doing this before interceptors are initialized crashes in:
451   // AsanInitInternal -> android_log_write -> __interceptor_strcmp
452   AndroidLogInit();
453 
454   ReplaceSystemMalloc();
455 
456   uptr shadow_start = kLowShadowBeg;
457   if (kLowShadowBeg)
458     shadow_start -= GetMmapGranularity();
459   bool full_shadow_is_available =
460       MemoryRangeIsAvailable(shadow_start, kHighShadowEnd);
461 
462 #if SANITIZER_LINUX && defined(__x86_64__) && defined(_LP64) &&                \
463     !ASAN_FIXED_MAPPING
464   if (!full_shadow_is_available) {
465     kMidMemBeg = kLowMemEnd < 0x3000000000ULL ? 0x3000000000ULL : 0;
466     kMidMemEnd = kLowMemEnd < 0x3000000000ULL ? 0x4fffffffffULL : 0;
467   }
468 #elif SANITIZER_WINDOWS64
469   // Disable the "mid mem" shadow layout.
470   if (!full_shadow_is_available) {
471     kMidMemBeg = 0;
472     kMidMemEnd = 0;
473   }
474 #endif
475 
476   if (Verbosity()) PrintAddressSpaceLayout();
477 
478   DisableCoreDumperIfNecessary();
479 
480   if (full_shadow_is_available) {
481     // mmap the low shadow plus at least one page at the left.
482     if (kLowShadowBeg)
483       ReserveShadowMemoryRange(shadow_start, kLowShadowEnd, "low shadow");
484     // mmap the high shadow.
485     ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd, "high shadow");
486     // protect the gap.
487     ProtectGap(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1);
488     CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
489   } else if (kMidMemBeg &&
490       MemoryRangeIsAvailable(shadow_start, kMidMemBeg - 1) &&
491       MemoryRangeIsAvailable(kMidMemEnd + 1, kHighShadowEnd)) {
492     CHECK(kLowShadowBeg != kLowShadowEnd);
493     // mmap the low shadow plus at least one page at the left.
494     ReserveShadowMemoryRange(shadow_start, kLowShadowEnd, "low shadow");
495     // mmap the mid shadow.
496     ReserveShadowMemoryRange(kMidShadowBeg, kMidShadowEnd, "mid shadow");
497     // mmap the high shadow.
498     ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd, "high shadow");
499     // protect the gaps.
500     ProtectGap(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1);
501     ProtectGap(kShadowGap2Beg, kShadowGap2End - kShadowGap2Beg + 1);
502     ProtectGap(kShadowGap3Beg, kShadowGap3End - kShadowGap3Beg + 1);
503   } else {
504     Report("Shadow memory range interleaves with an existing memory mapping. "
505            "ASan cannot proceed correctly. ABORTING.\n");
506     Report("ASan shadow was supposed to be located in the [%p-%p] range.\n",
507            shadow_start, kHighShadowEnd);
508     DumpProcessMap();
509     Die();
510   }
511 
512   AsanTSDInit(PlatformTSDDtor);
513   InstallDeadlySignalHandlers(AsanOnDeadlySignal);
514 
515   AllocatorOptions allocator_options;
516   allocator_options.SetFrom(flags(), common_flags());
517   InitializeAllocator(allocator_options);
518 
519   MaybeStartBackgroudThread();
520   SetSoftRssLimitExceededCallback(AsanSoftRssLimitExceededCallback);
521 
522   // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
523   // should be set to 1 prior to initializing the threads.
524   asan_inited = 1;
525   asan_init_is_running = false;
526 
527   if (flags()->atexit)
528     Atexit(asan_atexit);
529 
530   InitializeCoverage(common_flags()->coverage, common_flags()->coverage_dir);
531 
532   // Now that ASan runtime is (mostly) initialized, deactivate it if
533   // necessary, so that it can be re-activated when requested.
534   if (flags()->start_deactivated)
535     AsanDeactivate();
536 
537   // interceptors
538   InitTlsSize();
539 
540   // Create main thread.
541   AsanThread *main_thread = AsanThread::Create(
542       /* start_routine */ nullptr, /* arg */ nullptr, /* parent_tid */ 0,
543       /* stack */ nullptr, /* detached */ true);
544   CHECK_EQ(0, main_thread->tid());
545   SetCurrentThread(main_thread);
546   main_thread->ThreadStart(internal_getpid(),
547                            /* signal_thread_is_registered */ nullptr);
548   force_interface_symbols();  // no-op.
549   SanitizerInitializeUnwinder();
550 
551   if (CAN_SANITIZE_LEAKS) {
552     __lsan::InitCommonLsan();
553     if (common_flags()->detect_leaks && common_flags()->leak_check_at_exit) {
554       Atexit(__lsan::DoLeakCheck);
555     }
556   }
557 
558 #if CAN_SANITIZE_UB
559   __ubsan::InitAsPlugin();
560 #endif
561 
562   InitializeSuppressions();
563 
564   if (CAN_SANITIZE_LEAKS) {
565     // LateInitialize() calls dlsym, which can allocate an error string buffer
566     // in the TLS.  Let's ignore the allocation to avoid reporting a leak.
567     __lsan::ScopedInterceptorDisabler disabler;
568     Symbolizer::LateInitialize();
569   } else {
570     Symbolizer::LateInitialize();
571   }
572 
573   VReport(1, "AddressSanitizer Init done\n");
574 }
575 
576 // Initialize as requested from some part of ASan runtime library (interceptors,
577 // allocator, etc).
AsanInitFromRtl()578 void AsanInitFromRtl() {
579   AsanInitInternal();
580 }
581 
582 #if ASAN_DYNAMIC
583 // Initialize runtime in case it's LD_PRELOAD-ed into unsanitized executable
584 // (and thus normal initializers from .preinit_array or modules haven't run).
585 
586 class AsanInitializer {
587 public:  // NOLINT
AsanInitializer()588   AsanInitializer() {
589     AsanInitFromRtl();
590   }
591 };
592 
593 static AsanInitializer asan_initializer;
594 #endif  // ASAN_DYNAMIC
595 
596 } // namespace __asan
597 
598 // ---------------------- Interface ---------------- {{{1
599 using namespace __asan;  // NOLINT
600 
__asan_handle_no_return()601 void NOINLINE __asan_handle_no_return() {
602   int local_stack;
603   AsanThread *curr_thread = GetCurrentThread();
604   uptr PageSize = GetPageSizeCached();
605   uptr top, bottom;
606   if (curr_thread) {
607     top = curr_thread->stack_top();
608     bottom = ((uptr)&local_stack - PageSize) & ~(PageSize - 1);
609   } else {
610     // If we haven't seen this thread, try asking the OS for stack bounds.
611     uptr tls_addr, tls_size, stack_size;
612     GetThreadStackAndTls(/*main=*/false, &bottom, &stack_size, &tls_addr,
613                          &tls_size);
614     top = bottom + stack_size;
615   }
616   static const uptr kMaxExpectedCleanupSize = 64 << 20;  // 64M
617   if (top - bottom > kMaxExpectedCleanupSize) {
618     static bool reported_warning = false;
619     if (reported_warning)
620       return;
621     reported_warning = true;
622     Report("WARNING: ASan is ignoring requested __asan_handle_no_return: "
623            "stack top: %p; bottom %p; size: %p (%zd)\n"
624            "False positive error reports may follow\n"
625            "For details see "
626            "https://github.com/google/sanitizers/issues/189\n",
627            top, bottom, top - bottom, top - bottom);
628     return;
629   }
630   PoisonShadow(bottom, top - bottom, 0);
631   if (curr_thread && curr_thread->has_fake_stack())
632     curr_thread->fake_stack()->HandleNoReturn();
633 }
634 
__asan_set_death_callback(void (* callback)(void))635 void NOINLINE __asan_set_death_callback(void (*callback)(void)) {
636   SetUserDieCallback(callback);
637 }
638 
639 // Initialize as requested from instrumented application code.
640 // We use this call as a trigger to wake up ASan from deactivated state.
__asan_init()641 void __asan_init() {
642   AsanActivate();
643   AsanInitInternal();
644 }
645 
__asan_version_mismatch_check()646 void __asan_version_mismatch_check() {
647   // Do nothing.
648 }
649