1 //===-- sanitizer_linux.cc ------------------------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file is shared between AddressSanitizer and ThreadSanitizer
11 // run-time libraries and implements linux-specific functions from
12 // sanitizer_libc.h.
13 //===----------------------------------------------------------------------===//
14
15 #include "sanitizer_platform.h"
16 #if SANITIZER_FREEBSD || SANITIZER_LINUX
17
18 #include "sanitizer_allocator_internal.h"
19 #include "sanitizer_common.h"
20 #include "sanitizer_flags.h"
21 #include "sanitizer_internal_defs.h"
22 #include "sanitizer_libc.h"
23 #include "sanitizer_linux.h"
24 #include "sanitizer_mutex.h"
25 #include "sanitizer_placement_new.h"
26 #include "sanitizer_procmaps.h"
27 #include "sanitizer_stacktrace.h"
28 #include "sanitizer_symbolizer.h"
29
30 #if !SANITIZER_FREEBSD
31 #include <asm/param.h>
32 #endif
33
34 // For mips64, syscall(__NR_stat) fills the buffer in the 'struct kernel_stat'
35 // format. Struct kernel_stat is defined as 'struct stat' in asm/stat.h. To
36 // access stat from asm/stat.h, without conflicting with definition in
37 // sys/stat.h, we use this trick.
38 #if defined(__mips64)
39 #include <asm/unistd.h>
40 #include <sys/types.h>
41 #define stat kernel_stat
42 #include <asm/stat.h>
43 #undef stat
44 #endif
45
46 #include <dlfcn.h>
47 #include <errno.h>
48 #include <fcntl.h>
49 #include <link.h>
50 #include <pthread.h>
51 #include <sched.h>
52 #include <sys/mman.h>
53 #include <sys/ptrace.h>
54 #include <sys/resource.h>
55 #include <sys/stat.h>
56 #include <sys/syscall.h>
57 #include <sys/time.h>
58 #include <sys/types.h>
59 #include <ucontext.h>
60 #include <unistd.h>
61
62 #if SANITIZER_FREEBSD
63 #include <sys/sysctl.h>
64 #include <machine/atomic.h>
65 extern "C" {
66 // <sys/umtx.h> must be included after <errno.h> and <sys/types.h> on
67 // FreeBSD 9.2 and 10.0.
68 #include <sys/umtx.h>
69 }
70 extern char **environ; // provided by crt1
71 #endif // SANITIZER_FREEBSD
72
73 #if !SANITIZER_ANDROID
74 #include <sys/signal.h>
75 #endif
76
77 #if SANITIZER_ANDROID
78 #include <android/log.h>
79 #include <sys/system_properties.h>
80 #endif
81
82 #if SANITIZER_LINUX
83 // <linux/time.h>
84 struct kernel_timeval {
85 long tv_sec;
86 long tv_usec;
87 };
88
89 // <linux/futex.h> is broken on some linux distributions.
90 const int FUTEX_WAIT = 0;
91 const int FUTEX_WAKE = 1;
92 #endif // SANITIZER_LINUX
93
94 // Are we using 32-bit or 64-bit Linux syscalls?
95 // x32 (which defines __x86_64__) has SANITIZER_WORDSIZE == 32
96 // but it still needs to use 64-bit syscalls.
97 #if SANITIZER_LINUX && (defined(__x86_64__) || SANITIZER_WORDSIZE == 64)
98 # define SANITIZER_LINUX_USES_64BIT_SYSCALLS 1
99 #else
100 # define SANITIZER_LINUX_USES_64BIT_SYSCALLS 0
101 #endif
102
103 namespace __sanitizer {
104
105 #if SANITIZER_LINUX && defined(__x86_64__)
106 #include "sanitizer_syscall_linux_x86_64.inc"
107 #else
108 #include "sanitizer_syscall_generic.inc"
109 #endif
110
111 // --------------- sanitizer_libc.h
internal_mmap(void * addr,uptr length,int prot,int flags,int fd,OFF_T offset)112 uptr internal_mmap(void *addr, uptr length, int prot, int flags, int fd,
113 OFF_T offset) {
114 #if SANITIZER_FREEBSD || SANITIZER_LINUX_USES_64BIT_SYSCALLS
115 return internal_syscall(SYSCALL(mmap), (uptr)addr, length, prot, flags, fd,
116 offset);
117 #else
118 // mmap2 specifies file offset in 4096-byte units.
119 CHECK(IsAligned(offset, 4096));
120 return internal_syscall(SYSCALL(mmap2), addr, length, prot, flags, fd,
121 offset / 4096);
122 #endif
123 }
124
internal_munmap(void * addr,uptr length)125 uptr internal_munmap(void *addr, uptr length) {
126 return internal_syscall(SYSCALL(munmap), (uptr)addr, length);
127 }
128
internal_mprotect(void * addr,uptr length,int prot)129 int internal_mprotect(void *addr, uptr length, int prot) {
130 return internal_syscall(SYSCALL(mprotect), (uptr)addr, length, prot);
131 }
132
internal_close(fd_t fd)133 uptr internal_close(fd_t fd) {
134 return internal_syscall(SYSCALL(close), fd);
135 }
136
internal_open(const char * filename,int flags)137 uptr internal_open(const char *filename, int flags) {
138 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
139 return internal_syscall(SYSCALL(openat), AT_FDCWD, (uptr)filename, flags);
140 #else
141 return internal_syscall(SYSCALL(open), (uptr)filename, flags);
142 #endif
143 }
144
internal_open(const char * filename,int flags,u32 mode)145 uptr internal_open(const char *filename, int flags, u32 mode) {
146 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
147 return internal_syscall(SYSCALL(openat), AT_FDCWD, (uptr)filename, flags,
148 mode);
149 #else
150 return internal_syscall(SYSCALL(open), (uptr)filename, flags, mode);
151 #endif
152 }
153
internal_read(fd_t fd,void * buf,uptr count)154 uptr internal_read(fd_t fd, void *buf, uptr count) {
155 sptr res;
156 HANDLE_EINTR(res, (sptr)internal_syscall(SYSCALL(read), fd, (uptr)buf,
157 count));
158 return res;
159 }
160
internal_write(fd_t fd,const void * buf,uptr count)161 uptr internal_write(fd_t fd, const void *buf, uptr count) {
162 sptr res;
163 HANDLE_EINTR(res, (sptr)internal_syscall(SYSCALL(write), fd, (uptr)buf,
164 count));
165 return res;
166 }
167
internal_ftruncate(fd_t fd,uptr size)168 uptr internal_ftruncate(fd_t fd, uptr size) {
169 sptr res;
170 HANDLE_EINTR(res, (sptr)internal_syscall(SYSCALL(ftruncate), fd,
171 (OFF_T)size));
172 return res;
173 }
174
175 #if !SANITIZER_LINUX_USES_64BIT_SYSCALLS && !SANITIZER_FREEBSD
stat64_to_stat(struct stat64 * in,struct stat * out)176 static void stat64_to_stat(struct stat64 *in, struct stat *out) {
177 internal_memset(out, 0, sizeof(*out));
178 out->st_dev = in->st_dev;
179 out->st_ino = in->st_ino;
180 out->st_mode = in->st_mode;
181 out->st_nlink = in->st_nlink;
182 out->st_uid = in->st_uid;
183 out->st_gid = in->st_gid;
184 out->st_rdev = in->st_rdev;
185 out->st_size = in->st_size;
186 out->st_blksize = in->st_blksize;
187 out->st_blocks = in->st_blocks;
188 out->st_atime = in->st_atime;
189 out->st_mtime = in->st_mtime;
190 out->st_ctime = in->st_ctime;
191 out->st_ino = in->st_ino;
192 }
193 #endif
194
195 #if defined(__mips64)
kernel_stat_to_stat(struct kernel_stat * in,struct stat * out)196 static void kernel_stat_to_stat(struct kernel_stat *in, struct stat *out) {
197 internal_memset(out, 0, sizeof(*out));
198 out->st_dev = in->st_dev;
199 out->st_ino = in->st_ino;
200 out->st_mode = in->st_mode;
201 out->st_nlink = in->st_nlink;
202 out->st_uid = in->st_uid;
203 out->st_gid = in->st_gid;
204 out->st_rdev = in->st_rdev;
205 out->st_size = in->st_size;
206 out->st_blksize = in->st_blksize;
207 out->st_blocks = in->st_blocks;
208 out->st_atime = in->st_atime_nsec;
209 out->st_mtime = in->st_mtime_nsec;
210 out->st_ctime = in->st_ctime_nsec;
211 out->st_ino = in->st_ino;
212 }
213 #endif
214
internal_stat(const char * path,void * buf)215 uptr internal_stat(const char *path, void *buf) {
216 #if SANITIZER_FREEBSD
217 return internal_syscall(SYSCALL(stat), path, buf);
218 #elif SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
219 return internal_syscall(SYSCALL(newfstatat), AT_FDCWD, (uptr)path,
220 (uptr)buf, 0);
221 #elif SANITIZER_LINUX_USES_64BIT_SYSCALLS
222 # if defined(__mips64)
223 // For mips64, stat syscall fills buffer in the format of kernel_stat
224 struct kernel_stat kbuf;
225 int res = internal_syscall(SYSCALL(stat), path, &kbuf);
226 kernel_stat_to_stat(&kbuf, (struct stat *)buf);
227 return res;
228 # else
229 return internal_syscall(SYSCALL(stat), (uptr)path, (uptr)buf);
230 # endif
231 #else
232 struct stat64 buf64;
233 int res = internal_syscall(SYSCALL(stat64), path, &buf64);
234 stat64_to_stat(&buf64, (struct stat *)buf);
235 return res;
236 #endif
237 }
238
internal_lstat(const char * path,void * buf)239 uptr internal_lstat(const char *path, void *buf) {
240 #if SANITIZER_FREEBSD
241 return internal_syscall(SYSCALL(lstat), path, buf);
242 #elif SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
243 return internal_syscall(SYSCALL(newfstatat), AT_FDCWD, (uptr)path,
244 (uptr)buf, AT_SYMLINK_NOFOLLOW);
245 #elif SANITIZER_LINUX_USES_64BIT_SYSCALLS
246 return internal_syscall(SYSCALL(lstat), (uptr)path, (uptr)buf);
247 #else
248 struct stat64 buf64;
249 int res = internal_syscall(SYSCALL(lstat64), path, &buf64);
250 stat64_to_stat(&buf64, (struct stat *)buf);
251 return res;
252 #endif
253 }
254
internal_fstat(fd_t fd,void * buf)255 uptr internal_fstat(fd_t fd, void *buf) {
256 #if SANITIZER_FREEBSD || SANITIZER_LINUX_USES_64BIT_SYSCALLS
257 return internal_syscall(SYSCALL(fstat), fd, (uptr)buf);
258 #else
259 struct stat64 buf64;
260 int res = internal_syscall(SYSCALL(fstat64), fd, &buf64);
261 stat64_to_stat(&buf64, (struct stat *)buf);
262 return res;
263 #endif
264 }
265
internal_filesize(fd_t fd)266 uptr internal_filesize(fd_t fd) {
267 struct stat st;
268 if (internal_fstat(fd, &st))
269 return -1;
270 return (uptr)st.st_size;
271 }
272
internal_dup2(int oldfd,int newfd)273 uptr internal_dup2(int oldfd, int newfd) {
274 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
275 return internal_syscall(SYSCALL(dup3), oldfd, newfd, 0);
276 #else
277 return internal_syscall(SYSCALL(dup2), oldfd, newfd);
278 #endif
279 }
280
internal_readlink(const char * path,char * buf,uptr bufsize)281 uptr internal_readlink(const char *path, char *buf, uptr bufsize) {
282 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
283 return internal_syscall(SYSCALL(readlinkat), AT_FDCWD,
284 (uptr)path, (uptr)buf, bufsize);
285 #else
286 return internal_syscall(SYSCALL(readlink), (uptr)path, (uptr)buf, bufsize);
287 #endif
288 }
289
internal_unlink(const char * path)290 uptr internal_unlink(const char *path) {
291 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
292 return internal_syscall(SYSCALL(unlinkat), AT_FDCWD, (uptr)path, 0);
293 #else
294 return internal_syscall(SYSCALL(unlink), (uptr)path);
295 #endif
296 }
297
internal_rename(const char * oldpath,const char * newpath)298 uptr internal_rename(const char *oldpath, const char *newpath) {
299 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
300 return internal_syscall(SYSCALL(renameat), AT_FDCWD, (uptr)oldpath, AT_FDCWD,
301 (uptr)newpath);
302 #else
303 return internal_syscall(SYSCALL(rename), (uptr)oldpath, (uptr)newpath);
304 #endif
305 }
306
internal_sched_yield()307 uptr internal_sched_yield() {
308 return internal_syscall(SYSCALL(sched_yield));
309 }
310
internal__exit(int exitcode)311 void internal__exit(int exitcode) {
312 #if SANITIZER_FREEBSD
313 internal_syscall(SYSCALL(exit), exitcode);
314 #else
315 internal_syscall(SYSCALL(exit_group), exitcode);
316 #endif
317 Die(); // Unreachable.
318 }
319
internal_execve(const char * filename,char * const argv[],char * const envp[])320 uptr internal_execve(const char *filename, char *const argv[],
321 char *const envp[]) {
322 return internal_syscall(SYSCALL(execve), (uptr)filename, (uptr)argv,
323 (uptr)envp);
324 }
325
326 // ----------------- sanitizer_common.h
FileExists(const char * filename)327 bool FileExists(const char *filename) {
328 struct stat st;
329 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
330 if (internal_syscall(SYSCALL(newfstatat), AT_FDCWD, filename, &st, 0))
331 #else
332 if (internal_stat(filename, &st))
333 #endif
334 return false;
335 // Sanity check: filename is a regular file.
336 return S_ISREG(st.st_mode);
337 }
338
GetTid()339 uptr GetTid() {
340 #if SANITIZER_FREEBSD
341 return (uptr)pthread_self();
342 #else
343 return internal_syscall(SYSCALL(gettid));
344 #endif
345 }
346
NanoTime()347 u64 NanoTime() {
348 #if SANITIZER_FREEBSD
349 timeval tv;
350 #else
351 kernel_timeval tv;
352 #endif
353 internal_memset(&tv, 0, sizeof(tv));
354 internal_syscall(SYSCALL(gettimeofday), (uptr)&tv, 0);
355 return (u64)tv.tv_sec * 1000*1000*1000 + tv.tv_usec * 1000;
356 }
357
358 // Like getenv, but reads env directly from /proc (on Linux) or parses the
359 // 'environ' array (on FreeBSD) and does not use libc. This function should be
360 // called first inside __asan_init.
GetEnv(const char * name)361 const char *GetEnv(const char *name) {
362 #if SANITIZER_FREEBSD
363 if (::environ != 0) {
364 uptr NameLen = internal_strlen(name);
365 for (char **Env = ::environ; *Env != 0; Env++) {
366 if (internal_strncmp(*Env, name, NameLen) == 0 && (*Env)[NameLen] == '=')
367 return (*Env) + NameLen + 1;
368 }
369 }
370 return 0; // Not found.
371 #elif SANITIZER_LINUX
372 static char *environ;
373 static uptr len;
374 static bool inited;
375 if (!inited) {
376 inited = true;
377 uptr environ_size;
378 len = ReadFileToBuffer("/proc/self/environ",
379 &environ, &environ_size, 1 << 26);
380 }
381 if (!environ || len == 0) return 0;
382 uptr namelen = internal_strlen(name);
383 const char *p = environ;
384 while (*p != '\0') { // will happen at the \0\0 that terminates the buffer
385 // proc file has the format NAME=value\0NAME=value\0NAME=value\0...
386 const char* endp =
387 (char*)internal_memchr(p, '\0', len - (p - environ));
388 if (endp == 0) // this entry isn't NUL terminated
389 return 0;
390 else if (!internal_memcmp(p, name, namelen) && p[namelen] == '=') // Match.
391 return p + namelen + 1; // point after =
392 p = endp + 1;
393 }
394 return 0; // Not found.
395 #else
396 #error "Unsupported platform"
397 #endif
398 }
399
400 extern "C" {
401 SANITIZER_WEAK_ATTRIBUTE extern void *__libc_stack_end;
402 }
403
404 #if !SANITIZER_GO
ReadNullSepFileToArray(const char * path,char *** arr,int arr_size)405 static void ReadNullSepFileToArray(const char *path, char ***arr,
406 int arr_size) {
407 char *buff;
408 uptr buff_size = 0;
409 *arr = (char **)MmapOrDie(arr_size * sizeof(char *), "NullSepFileArray");
410 ReadFileToBuffer(path, &buff, &buff_size, 1024 * 1024);
411 (*arr)[0] = buff;
412 int count, i;
413 for (count = 1, i = 1; ; i++) {
414 if (buff[i] == 0) {
415 if (buff[i+1] == 0) break;
416 (*arr)[count] = &buff[i+1];
417 CHECK_LE(count, arr_size - 1); // FIXME: make this more flexible.
418 count++;
419 }
420 }
421 (*arr)[count] = 0;
422 }
423 #endif
424
GetArgsAndEnv(char *** argv,char *** envp)425 static void GetArgsAndEnv(char*** argv, char*** envp) {
426 #if !SANITIZER_GO
427 if (&__libc_stack_end) {
428 #endif
429 uptr* stack_end = (uptr*)__libc_stack_end;
430 int argc = *stack_end;
431 *argv = (char**)(stack_end + 1);
432 *envp = (char**)(stack_end + argc + 2);
433 #if !SANITIZER_GO
434 } else {
435 static const int kMaxArgv = 2000, kMaxEnvp = 2000;
436 ReadNullSepFileToArray("/proc/self/cmdline", argv, kMaxArgv);
437 ReadNullSepFileToArray("/proc/self/environ", envp, kMaxEnvp);
438 }
439 #endif
440 }
441
ReExec()442 void ReExec() {
443 char **argv, **envp;
444 GetArgsAndEnv(&argv, &envp);
445 uptr rv = internal_execve("/proc/self/exe", argv, envp);
446 int rverrno;
447 CHECK_EQ(internal_iserror(rv, &rverrno), true);
448 Printf("execve failed, errno %d\n", rverrno);
449 Die();
450 }
451
452 enum MutexState {
453 MtxUnlocked = 0,
454 MtxLocked = 1,
455 MtxSleeping = 2
456 };
457
BlockingMutex()458 BlockingMutex::BlockingMutex() {
459 internal_memset(this, 0, sizeof(*this));
460 }
461
Lock()462 void BlockingMutex::Lock() {
463 CHECK_EQ(owner_, 0);
464 atomic_uint32_t *m = reinterpret_cast<atomic_uint32_t *>(&opaque_storage_);
465 if (atomic_exchange(m, MtxLocked, memory_order_acquire) == MtxUnlocked)
466 return;
467 while (atomic_exchange(m, MtxSleeping, memory_order_acquire) != MtxUnlocked) {
468 #if SANITIZER_FREEBSD
469 _umtx_op(m, UMTX_OP_WAIT_UINT, MtxSleeping, 0, 0);
470 #else
471 internal_syscall(SYSCALL(futex), (uptr)m, FUTEX_WAIT, MtxSleeping, 0, 0, 0);
472 #endif
473 }
474 }
475
Unlock()476 void BlockingMutex::Unlock() {
477 atomic_uint32_t *m = reinterpret_cast<atomic_uint32_t *>(&opaque_storage_);
478 u32 v = atomic_exchange(m, MtxUnlocked, memory_order_relaxed);
479 CHECK_NE(v, MtxUnlocked);
480 if (v == MtxSleeping) {
481 #if SANITIZER_FREEBSD
482 _umtx_op(m, UMTX_OP_WAKE, 1, 0, 0);
483 #else
484 internal_syscall(SYSCALL(futex), (uptr)m, FUTEX_WAKE, 1, 0, 0, 0);
485 #endif
486 }
487 }
488
CheckLocked()489 void BlockingMutex::CheckLocked() {
490 atomic_uint32_t *m = reinterpret_cast<atomic_uint32_t *>(&opaque_storage_);
491 CHECK_NE(MtxUnlocked, atomic_load(m, memory_order_relaxed));
492 }
493
494 // ----------------- sanitizer_linux.h
495 // The actual size of this structure is specified by d_reclen.
496 // Note that getdents64 uses a different structure format. We only provide the
497 // 32-bit syscall here.
498 struct linux_dirent {
499 #if SANITIZER_X32
500 u64 d_ino;
501 u64 d_off;
502 #else
503 unsigned long d_ino;
504 unsigned long d_off;
505 #endif
506 unsigned short d_reclen;
507 char d_name[256];
508 };
509
510 // Syscall wrappers.
internal_ptrace(int request,int pid,void * addr,void * data)511 uptr internal_ptrace(int request, int pid, void *addr, void *data) {
512 return internal_syscall(SYSCALL(ptrace), request, pid, (uptr)addr,
513 (uptr)data);
514 }
515
internal_waitpid(int pid,int * status,int options)516 uptr internal_waitpid(int pid, int *status, int options) {
517 return internal_syscall(SYSCALL(wait4), pid, (uptr)status, options,
518 0 /* rusage */);
519 }
520
internal_getpid()521 uptr internal_getpid() {
522 return internal_syscall(SYSCALL(getpid));
523 }
524
internal_getppid()525 uptr internal_getppid() {
526 return internal_syscall(SYSCALL(getppid));
527 }
528
internal_getdents(fd_t fd,struct linux_dirent * dirp,unsigned int count)529 uptr internal_getdents(fd_t fd, struct linux_dirent *dirp, unsigned int count) {
530 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
531 return internal_syscall(SYSCALL(getdents64), fd, (uptr)dirp, count);
532 #else
533 return internal_syscall(SYSCALL(getdents), fd, (uptr)dirp, count);
534 #endif
535 }
536
internal_lseek(fd_t fd,OFF_T offset,int whence)537 uptr internal_lseek(fd_t fd, OFF_T offset, int whence) {
538 return internal_syscall(SYSCALL(lseek), fd, offset, whence);
539 }
540
541 #if SANITIZER_LINUX
internal_prctl(int option,uptr arg2,uptr arg3,uptr arg4,uptr arg5)542 uptr internal_prctl(int option, uptr arg2, uptr arg3, uptr arg4, uptr arg5) {
543 return internal_syscall(SYSCALL(prctl), option, arg2, arg3, arg4, arg5);
544 }
545 #endif
546
internal_sigaltstack(const struct sigaltstack * ss,struct sigaltstack * oss)547 uptr internal_sigaltstack(const struct sigaltstack *ss,
548 struct sigaltstack *oss) {
549 return internal_syscall(SYSCALL(sigaltstack), (uptr)ss, (uptr)oss);
550 }
551
internal_fork()552 int internal_fork() {
553 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
554 return internal_syscall(SYSCALL(clone), SIGCHLD, 0);
555 #else
556 return internal_syscall(SYSCALL(fork));
557 #endif
558 }
559
560 #if SANITIZER_LINUX
561 #define SA_RESTORER 0x04000000
562 // Doesn't set sa_restorer, use with caution (see below).
internal_sigaction_norestorer(int signum,const void * act,void * oldact)563 int internal_sigaction_norestorer(int signum, const void *act, void *oldact) {
564 __sanitizer_kernel_sigaction_t k_act, k_oldact;
565 internal_memset(&k_act, 0, sizeof(__sanitizer_kernel_sigaction_t));
566 internal_memset(&k_oldact, 0, sizeof(__sanitizer_kernel_sigaction_t));
567 const __sanitizer_sigaction *u_act = (const __sanitizer_sigaction *)act;
568 __sanitizer_sigaction *u_oldact = (__sanitizer_sigaction *)oldact;
569 if (u_act) {
570 k_act.handler = u_act->handler;
571 k_act.sigaction = u_act->sigaction;
572 internal_memcpy(&k_act.sa_mask, &u_act->sa_mask,
573 sizeof(__sanitizer_kernel_sigset_t));
574 // Without SA_RESTORER kernel ignores the calls (probably returns EINVAL).
575 k_act.sa_flags = u_act->sa_flags | SA_RESTORER;
576 // FIXME: most often sa_restorer is unset, however the kernel requires it
577 // to point to a valid signal restorer that calls the rt_sigreturn syscall.
578 // If sa_restorer passed to the kernel is NULL, the program may crash upon
579 // signal delivery or fail to unwind the stack in the signal handler.
580 // libc implementation of sigaction() passes its own restorer to
581 // rt_sigaction, so we need to do the same (we'll need to reimplement the
582 // restorers; for x86_64 the restorer address can be obtained from
583 // oldact->sa_restorer upon a call to sigaction(xxx, NULL, oldact).
584 k_act.sa_restorer = u_act->sa_restorer;
585 }
586
587 uptr result = internal_syscall(SYSCALL(rt_sigaction), (uptr)signum,
588 (uptr)(u_act ? &k_act : NULL),
589 (uptr)(u_oldact ? &k_oldact : NULL),
590 (uptr)sizeof(__sanitizer_kernel_sigset_t));
591
592 if ((result == 0) && u_oldact) {
593 u_oldact->handler = k_oldact.handler;
594 u_oldact->sigaction = k_oldact.sigaction;
595 internal_memcpy(&u_oldact->sa_mask, &k_oldact.sa_mask,
596 sizeof(__sanitizer_kernel_sigset_t));
597 u_oldact->sa_flags = k_oldact.sa_flags;
598 u_oldact->sa_restorer = k_oldact.sa_restorer;
599 }
600 return result;
601 }
602 #endif // SANITIZER_LINUX
603
internal_sigprocmask(int how,__sanitizer_sigset_t * set,__sanitizer_sigset_t * oldset)604 uptr internal_sigprocmask(int how, __sanitizer_sigset_t *set,
605 __sanitizer_sigset_t *oldset) {
606 #if SANITIZER_FREEBSD
607 return internal_syscall(SYSCALL(sigprocmask), how, set, oldset);
608 #else
609 __sanitizer_kernel_sigset_t *k_set = (__sanitizer_kernel_sigset_t *)set;
610 __sanitizer_kernel_sigset_t *k_oldset = (__sanitizer_kernel_sigset_t *)oldset;
611 return internal_syscall(SYSCALL(rt_sigprocmask), (uptr)how,
612 (uptr)&k_set->sig[0], (uptr)&k_oldset->sig[0],
613 sizeof(__sanitizer_kernel_sigset_t));
614 #endif
615 }
616
internal_sigfillset(__sanitizer_sigset_t * set)617 void internal_sigfillset(__sanitizer_sigset_t *set) {
618 internal_memset(set, 0xff, sizeof(*set));
619 }
620
621 #if SANITIZER_LINUX
internal_sigdelset(__sanitizer_sigset_t * set,int signum)622 void internal_sigdelset(__sanitizer_sigset_t *set, int signum) {
623 signum -= 1;
624 CHECK_GE(signum, 0);
625 CHECK_LT(signum, sizeof(*set) * 8);
626 __sanitizer_kernel_sigset_t *k_set = (__sanitizer_kernel_sigset_t *)set;
627 const uptr idx = signum / (sizeof(k_set->sig[0]) * 8);
628 const uptr bit = signum % (sizeof(k_set->sig[0]) * 8);
629 k_set->sig[idx] &= ~(1 << bit);
630 }
631 #endif // SANITIZER_LINUX
632
633 // ThreadLister implementation.
ThreadLister(int pid)634 ThreadLister::ThreadLister(int pid)
635 : pid_(pid),
636 descriptor_(-1),
637 buffer_(4096),
638 error_(true),
639 entry_((struct linux_dirent *)buffer_.data()),
640 bytes_read_(0) {
641 char task_directory_path[80];
642 internal_snprintf(task_directory_path, sizeof(task_directory_path),
643 "/proc/%d/task/", pid);
644 uptr openrv = internal_open(task_directory_path, O_RDONLY | O_DIRECTORY);
645 if (internal_iserror(openrv)) {
646 error_ = true;
647 Report("Can't open /proc/%d/task for reading.\n", pid);
648 } else {
649 error_ = false;
650 descriptor_ = openrv;
651 }
652 }
653
GetNextTID()654 int ThreadLister::GetNextTID() {
655 int tid = -1;
656 do {
657 if (error_)
658 return -1;
659 if ((char *)entry_ >= &buffer_[bytes_read_] && !GetDirectoryEntries())
660 return -1;
661 if (entry_->d_ino != 0 && entry_->d_name[0] >= '0' &&
662 entry_->d_name[0] <= '9') {
663 // Found a valid tid.
664 tid = (int)internal_atoll(entry_->d_name);
665 }
666 entry_ = (struct linux_dirent *)(((char *)entry_) + entry_->d_reclen);
667 } while (tid < 0);
668 return tid;
669 }
670
Reset()671 void ThreadLister::Reset() {
672 if (error_ || descriptor_ < 0)
673 return;
674 internal_lseek(descriptor_, 0, SEEK_SET);
675 }
676
~ThreadLister()677 ThreadLister::~ThreadLister() {
678 if (descriptor_ >= 0)
679 internal_close(descriptor_);
680 }
681
error()682 bool ThreadLister::error() { return error_; }
683
GetDirectoryEntries()684 bool ThreadLister::GetDirectoryEntries() {
685 CHECK_GE(descriptor_, 0);
686 CHECK_NE(error_, true);
687 bytes_read_ = internal_getdents(descriptor_,
688 (struct linux_dirent *)buffer_.data(),
689 buffer_.size());
690 if (internal_iserror(bytes_read_)) {
691 Report("Can't read directory entries from /proc/%d/task.\n", pid_);
692 error_ = true;
693 return false;
694 } else if (bytes_read_ == 0) {
695 return false;
696 }
697 entry_ = (struct linux_dirent *)buffer_.data();
698 return true;
699 }
700
GetPageSize()701 uptr GetPageSize() {
702 #if SANITIZER_LINUX && (defined(__x86_64__) || defined(__i386__))
703 return EXEC_PAGESIZE;
704 #else
705 return sysconf(_SC_PAGESIZE); // EXEC_PAGESIZE may not be trustworthy.
706 #endif
707 }
708
ReadBinaryName(char * buf,uptr buf_len)709 uptr ReadBinaryName(/*out*/char *buf, uptr buf_len) {
710 #if SANITIZER_FREEBSD
711 const int Mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_PATHNAME, -1 };
712 const char *default_module_name = "kern.proc.pathname";
713 size_t Size = buf_len;
714 bool IsErr = (sysctl(Mib, ARRAY_SIZE(Mib), buf, &Size, NULL, 0) != 0);
715 int readlink_error = IsErr ? errno : 0;
716 uptr module_name_len = Size;
717 #else
718 const char *default_module_name = "/proc/self/exe";
719 uptr module_name_len = internal_readlink(
720 default_module_name, buf, buf_len);
721 int readlink_error;
722 bool IsErr = internal_iserror(module_name_len, &readlink_error);
723 #endif
724 if (IsErr) {
725 // We can't read binary name for some reason, assume it's unknown.
726 Report("WARNING: reading executable name failed with errno %d, "
727 "some stack frames may not be symbolized\n", readlink_error);
728 module_name_len = internal_snprintf(buf, buf_len, "%s",
729 default_module_name);
730 CHECK_LT(module_name_len, buf_len);
731 }
732 return module_name_len;
733 }
734
735 // Match full names of the form /path/to/base_name{-,.}*
LibraryNameIs(const char * full_name,const char * base_name)736 bool LibraryNameIs(const char *full_name, const char *base_name) {
737 const char *name = full_name;
738 // Strip path.
739 while (*name != '\0') name++;
740 while (name > full_name && *name != '/') name--;
741 if (*name == '/') name++;
742 uptr base_name_length = internal_strlen(base_name);
743 if (internal_strncmp(name, base_name, base_name_length)) return false;
744 return (name[base_name_length] == '-' || name[base_name_length] == '.');
745 }
746
747 #if !SANITIZER_ANDROID
748 // Call cb for each region mapped by map.
ForEachMappedRegion(link_map * map,void (* cb)(const void *,uptr))749 void ForEachMappedRegion(link_map *map, void (*cb)(const void *, uptr)) {
750 CHECK_NE(map, nullptr);
751 #if !SANITIZER_FREEBSD
752 typedef ElfW(Phdr) Elf_Phdr;
753 typedef ElfW(Ehdr) Elf_Ehdr;
754 #endif // !SANITIZER_FREEBSD
755 char *base = (char *)map->l_addr;
756 Elf_Ehdr *ehdr = (Elf_Ehdr *)base;
757 char *phdrs = base + ehdr->e_phoff;
758 char *phdrs_end = phdrs + ehdr->e_phnum * ehdr->e_phentsize;
759
760 // Find the segment with the minimum base so we can "relocate" the p_vaddr
761 // fields. Typically ET_DYN objects (DSOs) have base of zero and ET_EXEC
762 // objects have a non-zero base.
763 uptr preferred_base = (uptr)-1;
764 for (char *iter = phdrs; iter != phdrs_end; iter += ehdr->e_phentsize) {
765 Elf_Phdr *phdr = (Elf_Phdr *)iter;
766 if (phdr->p_type == PT_LOAD && preferred_base > (uptr)phdr->p_vaddr)
767 preferred_base = (uptr)phdr->p_vaddr;
768 }
769
770 // Compute the delta from the real base to get a relocation delta.
771 sptr delta = (uptr)base - preferred_base;
772 // Now we can figure out what the loader really mapped.
773 for (char *iter = phdrs; iter != phdrs_end; iter += ehdr->e_phentsize) {
774 Elf_Phdr *phdr = (Elf_Phdr *)iter;
775 if (phdr->p_type == PT_LOAD) {
776 uptr seg_start = phdr->p_vaddr + delta;
777 uptr seg_end = seg_start + phdr->p_memsz;
778 // None of these values are aligned. We consider the ragged edges of the
779 // load command as defined, since they are mapped from the file.
780 seg_start = RoundDownTo(seg_start, GetPageSizeCached());
781 seg_end = RoundUpTo(seg_end, GetPageSizeCached());
782 cb((void *)seg_start, seg_end - seg_start);
783 }
784 }
785 }
786 #endif
787
788 #if defined(__x86_64__) && SANITIZER_LINUX
789 // We cannot use glibc's clone wrapper, because it messes with the child
790 // task's TLS. It writes the PID and TID of the child task to its thread
791 // descriptor, but in our case the child task shares the thread descriptor with
792 // the parent (because we don't know how to allocate a new thread
793 // descriptor to keep glibc happy). So the stock version of clone(), when
794 // used with CLONE_VM, would end up corrupting the parent's thread descriptor.
internal_clone(int (* fn)(void *),void * child_stack,int flags,void * arg,int * parent_tidptr,void * newtls,int * child_tidptr)795 uptr internal_clone(int (*fn)(void *), void *child_stack, int flags, void *arg,
796 int *parent_tidptr, void *newtls, int *child_tidptr) {
797 long long res;
798 if (!fn || !child_stack)
799 return -EINVAL;
800 CHECK_EQ(0, (uptr)child_stack % 16);
801 child_stack = (char *)child_stack - 2 * sizeof(unsigned long long);
802 ((unsigned long long *)child_stack)[0] = (uptr)fn;
803 ((unsigned long long *)child_stack)[1] = (uptr)arg;
804 register void *r8 __asm__("r8") = newtls;
805 register int *r10 __asm__("r10") = child_tidptr;
806 __asm__ __volatile__(
807 /* %rax = syscall(%rax = SYSCALL(clone),
808 * %rdi = flags,
809 * %rsi = child_stack,
810 * %rdx = parent_tidptr,
811 * %r8 = new_tls,
812 * %r10 = child_tidptr)
813 */
814 "syscall\n"
815
816 /* if (%rax != 0)
817 * return;
818 */
819 "testq %%rax,%%rax\n"
820 "jnz 1f\n"
821
822 /* In the child. Terminate unwind chain. */
823 // XXX: We should also terminate the CFI unwind chain
824 // here. Unfortunately clang 3.2 doesn't support the
825 // necessary CFI directives, so we skip that part.
826 "xorq %%rbp,%%rbp\n"
827
828 /* Call "fn(arg)". */
829 "popq %%rax\n"
830 "popq %%rdi\n"
831 "call *%%rax\n"
832
833 /* Call _exit(%rax). */
834 "movq %%rax,%%rdi\n"
835 "movq %2,%%rax\n"
836 "syscall\n"
837
838 /* Return to parent. */
839 "1:\n"
840 : "=a" (res)
841 : "a"(SYSCALL(clone)), "i"(SYSCALL(exit)),
842 "S"(child_stack),
843 "D"(flags),
844 "d"(parent_tidptr),
845 "r"(r8),
846 "r"(r10)
847 : "rsp", "memory", "r11", "rcx");
848 return res;
849 }
850 #elif defined(__mips__)
internal_clone(int (* fn)(void *),void * child_stack,int flags,void * arg,int * parent_tidptr,void * newtls,int * child_tidptr)851 uptr internal_clone(int (*fn)(void *), void *child_stack, int flags, void *arg,
852 int *parent_tidptr, void *newtls, int *child_tidptr) {
853 long long res;
854 if (!fn || !child_stack)
855 return -EINVAL;
856 CHECK_EQ(0, (uptr)child_stack % 16);
857 child_stack = (char *)child_stack - 2 * sizeof(unsigned long long);
858 ((unsigned long long *)child_stack)[0] = (uptr)fn;
859 ((unsigned long long *)child_stack)[1] = (uptr)arg;
860 register void *a3 __asm__("$7") = newtls;
861 register int *a4 __asm__("$8") = child_tidptr;
862 // We don't have proper CFI directives here because it requires alot of code
863 // for very marginal benefits.
864 __asm__ __volatile__(
865 /* $v0 = syscall($v0 = __NR_clone,
866 * $a0 = flags,
867 * $a1 = child_stack,
868 * $a2 = parent_tidptr,
869 * $a3 = new_tls,
870 * $a4 = child_tidptr)
871 */
872 ".cprestore 16;\n"
873 "move $4,%1;\n"
874 "move $5,%2;\n"
875 "move $6,%3;\n"
876 "move $7,%4;\n"
877 /* Store the fifth argument on stack
878 * if we are using 32-bit abi.
879 */
880 #if SANITIZER_WORDSIZE == 32
881 "lw %5,16($29);\n"
882 #else
883 "move $8,%5;\n"
884 #endif
885 "li $2,%6;\n"
886 "syscall;\n"
887
888 /* if ($v0 != 0)
889 * return;
890 */
891 "bnez $2,1f;\n"
892
893 /* Call "fn(arg)". */
894 "ld $25,0($29);\n"
895 "ld $4,8($29);\n"
896 "jal $25;\n"
897
898 /* Call _exit($v0). */
899 "move $4,$2;\n"
900 "li $2,%7;\n"
901 "syscall;\n"
902
903 /* Return to parent. */
904 "1:\n"
905 : "=r" (res)
906 : "r"(flags),
907 "r"(child_stack),
908 "r"(parent_tidptr),
909 "r"(a3),
910 "r"(a4),
911 "i"(__NR_clone),
912 "i"(__NR_exit)
913 : "memory", "$29" );
914 return res;
915 }
916 #endif // defined(__x86_64__) && SANITIZER_LINUX
917
918 #if SANITIZER_ANDROID
919 static atomic_uint8_t android_log_initialized;
920
AndroidLogInit()921 void AndroidLogInit() {
922 atomic_store(&android_log_initialized, 1, memory_order_release);
923 }
924 // This thing is not, strictly speaking, async signal safe, but it does not seem
925 // to cause any issues. Alternative is writing to log devices directly, but
926 // their location and message format might change in the future, so we'd really
927 // like to avoid that.
AndroidLogWrite(const char * buffer)928 void AndroidLogWrite(const char *buffer) {
929 if (!atomic_load(&android_log_initialized, memory_order_acquire))
930 return;
931
932 char *copy = internal_strdup(buffer);
933 char *p = copy;
934 char *q;
935 // __android_log_write has an implicit message length limit.
936 // Print one line at a time.
937 do {
938 q = internal_strchr(p, '\n');
939 if (q) *q = '\0';
940 __android_log_write(ANDROID_LOG_INFO, NULL, p);
941 if (q) p = q + 1;
942 } while (q);
943 InternalFree(copy);
944 }
945
GetExtraActivationFlags(char * buf,uptr size)946 void GetExtraActivationFlags(char *buf, uptr size) {
947 CHECK(size > PROP_VALUE_MAX);
948 __system_property_get("asan.options", buf);
949 }
950
951 #if __ANDROID_API__ < 21
952 extern "C" __attribute__((weak)) int dl_iterate_phdr(
953 int (*)(struct dl_phdr_info *, size_t, void *), void *);
954 #endif
955
dl_iterate_phdr_test_cb(struct dl_phdr_info * info,size_t size,void * data)956 static int dl_iterate_phdr_test_cb(struct dl_phdr_info *info, size_t size,
957 void *data) {
958 // Any name starting with "lib" indicates a bug in L where library base names
959 // are returned instead of paths.
960 if (info->dlpi_name && info->dlpi_name[0] == 'l' &&
961 info->dlpi_name[1] == 'i' && info->dlpi_name[2] == 'b') {
962 *(bool *)data = true;
963 return 1;
964 }
965 return 0;
966 }
967
968 static atomic_uint32_t android_api_level;
969
AndroidDetectApiLevel()970 static AndroidApiLevel AndroidDetectApiLevel() {
971 if (!&dl_iterate_phdr)
972 return ANDROID_KITKAT; // K or lower
973 bool base_name_seen = false;
974 dl_iterate_phdr(dl_iterate_phdr_test_cb, &base_name_seen);
975 if (base_name_seen)
976 return ANDROID_LOLLIPOP_MR1; // L MR1
977 return ANDROID_POST_LOLLIPOP; // post-L
978 // Plain L (API level 21) is completely broken wrt ASan and not very
979 // interesting to detect.
980 }
981
AndroidGetApiLevel()982 AndroidApiLevel AndroidGetApiLevel() {
983 AndroidApiLevel level =
984 (AndroidApiLevel)atomic_load(&android_api_level, memory_order_relaxed);
985 if (level) return level;
986 level = AndroidDetectApiLevel();
987 atomic_store(&android_api_level, level, memory_order_relaxed);
988 return level;
989 }
990
991 #endif
992
IsDeadlySignal(int signum)993 bool IsDeadlySignal(int signum) {
994 if (common_flags()->handle_abort && signum == SIGABRT)
995 return true;
996 return (signum == SIGSEGV || signum == SIGBUS) && common_flags()->handle_segv;
997 }
998
999 #ifndef SANITIZER_GO
internal_start_thread(void (* func)(void * arg),void * arg)1000 void *internal_start_thread(void(*func)(void *arg), void *arg) {
1001 // Start the thread with signals blocked, otherwise it can steal user signals.
1002 __sanitizer_sigset_t set, old;
1003 internal_sigfillset(&set);
1004 #if SANITIZER_LINUX && !SANITIZER_ANDROID
1005 // Glibc uses SIGSETXID signal during setuid call. If this signal is blocked
1006 // on any thread, setuid call hangs (see test/tsan/setuid.c).
1007 internal_sigdelset(&set, 33);
1008 #endif
1009 internal_sigprocmask(SIG_SETMASK, &set, &old);
1010 void *th;
1011 real_pthread_create(&th, 0, (void*(*)(void *arg))func, arg);
1012 internal_sigprocmask(SIG_SETMASK, &old, 0);
1013 return th;
1014 }
1015
internal_join_thread(void * th)1016 void internal_join_thread(void *th) {
1017 real_pthread_join(th, 0);
1018 }
1019 #else
internal_start_thread(void (* func)(void *),void * arg)1020 void *internal_start_thread(void (*func)(void *), void *arg) { return 0; }
1021
internal_join_thread(void * th)1022 void internal_join_thread(void *th) {}
1023 #endif
1024
GetPcSpBp(void * context,uptr * pc,uptr * sp,uptr * bp)1025 void GetPcSpBp(void *context, uptr *pc, uptr *sp, uptr *bp) {
1026 #if defined(__arm__)
1027 ucontext_t *ucontext = (ucontext_t*)context;
1028 *pc = ucontext->uc_mcontext.arm_pc;
1029 *bp = ucontext->uc_mcontext.arm_fp;
1030 *sp = ucontext->uc_mcontext.arm_sp;
1031 #elif defined(__aarch64__)
1032 ucontext_t *ucontext = (ucontext_t*)context;
1033 *pc = ucontext->uc_mcontext.pc;
1034 *bp = ucontext->uc_mcontext.regs[29];
1035 *sp = ucontext->uc_mcontext.sp;
1036 #elif defined(__hppa__)
1037 ucontext_t *ucontext = (ucontext_t*)context;
1038 *pc = ucontext->uc_mcontext.sc_iaoq[0];
1039 /* GCC uses %r3 whenever a frame pointer is needed. */
1040 *bp = ucontext->uc_mcontext.sc_gr[3];
1041 *sp = ucontext->uc_mcontext.sc_gr[30];
1042 #elif defined(__x86_64__)
1043 # if SANITIZER_FREEBSD
1044 ucontext_t *ucontext = (ucontext_t*)context;
1045 *pc = ucontext->uc_mcontext.mc_rip;
1046 *bp = ucontext->uc_mcontext.mc_rbp;
1047 *sp = ucontext->uc_mcontext.mc_rsp;
1048 # else
1049 ucontext_t *ucontext = (ucontext_t*)context;
1050 *pc = ucontext->uc_mcontext.gregs[REG_RIP];
1051 *bp = ucontext->uc_mcontext.gregs[REG_RBP];
1052 *sp = ucontext->uc_mcontext.gregs[REG_RSP];
1053 # endif
1054 #elif defined(__i386__)
1055 # if SANITIZER_FREEBSD
1056 ucontext_t *ucontext = (ucontext_t*)context;
1057 *pc = ucontext->uc_mcontext.mc_eip;
1058 *bp = ucontext->uc_mcontext.mc_ebp;
1059 *sp = ucontext->uc_mcontext.mc_esp;
1060 # else
1061 ucontext_t *ucontext = (ucontext_t*)context;
1062 *pc = ucontext->uc_mcontext.gregs[REG_EIP];
1063 *bp = ucontext->uc_mcontext.gregs[REG_EBP];
1064 *sp = ucontext->uc_mcontext.gregs[REG_ESP];
1065 # endif
1066 #elif defined(__powerpc__) || defined(__powerpc64__)
1067 ucontext_t *ucontext = (ucontext_t*)context;
1068 *pc = ucontext->uc_mcontext.regs->nip;
1069 *sp = ucontext->uc_mcontext.regs->gpr[PT_R1];
1070 // The powerpc{,64}-linux ABIs do not specify r31 as the frame
1071 // pointer, but GCC always uses r31 when we need a frame pointer.
1072 *bp = ucontext->uc_mcontext.regs->gpr[PT_R31];
1073 #elif defined(__sparc__)
1074 ucontext_t *ucontext = (ucontext_t*)context;
1075 uptr *stk_ptr;
1076 # if defined (__arch64__)
1077 *pc = ucontext->uc_mcontext.mc_gregs[MC_PC];
1078 *sp = ucontext->uc_mcontext.mc_gregs[MC_O6];
1079 stk_ptr = (uptr *) (*sp + 2047);
1080 *bp = stk_ptr[15];
1081 # else
1082 *pc = ucontext->uc_mcontext.gregs[REG_PC];
1083 *sp = ucontext->uc_mcontext.gregs[REG_O6];
1084 stk_ptr = (uptr *) *sp;
1085 *bp = stk_ptr[15];
1086 # endif
1087 #elif defined(__mips__)
1088 ucontext_t *ucontext = (ucontext_t*)context;
1089 *pc = ucontext->uc_mcontext.pc;
1090 *bp = ucontext->uc_mcontext.gregs[30];
1091 *sp = ucontext->uc_mcontext.gregs[29];
1092 #else
1093 # error "Unsupported arch"
1094 #endif
1095 }
1096
1097 } // namespace __sanitizer
1098
1099 #endif // SANITIZER_FREEBSD || SANITIZER_LINUX
1100