2014-09-21 17:33:12 +00:00
|
|
|
//===-- asan_report.cc ----------------------------------------------------===//
|
|
|
|
//
|
|
|
|
// This file is distributed under the University of Illinois Open Source
|
|
|
|
// License. See LICENSE.TXT for details.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
//
|
|
|
|
// This file is a part of AddressSanitizer, an address sanity checker.
|
|
|
|
//
|
|
|
|
// This file contains error reporting code.
|
|
|
|
//===----------------------------------------------------------------------===//
|
2017-04-10 11:32:00 +00:00
|
|
|
|
2017-10-07 00:16:47 +00:00
|
|
|
#include "asan_errors.h"
|
2014-09-21 17:33:12 +00:00
|
|
|
#include "asan_flags.h"
|
2017-10-07 00:16:47 +00:00
|
|
|
#include "asan_descriptions.h"
|
2014-09-21 17:33:12 +00:00
|
|
|
#include "asan_internal.h"
|
|
|
|
#include "asan_mapping.h"
|
|
|
|
#include "asan_report.h"
|
2017-10-07 00:16:47 +00:00
|
|
|
#include "asan_scariness_score.h"
|
2014-09-21 17:33:12 +00:00
|
|
|
#include "asan_stack.h"
|
|
|
|
#include "asan_thread.h"
|
|
|
|
#include "sanitizer_common/sanitizer_common.h"
|
|
|
|
#include "sanitizer_common/sanitizer_flags.h"
|
|
|
|
#include "sanitizer_common/sanitizer_report_decorator.h"
|
|
|
|
#include "sanitizer_common/sanitizer_stackdepot.h"
|
|
|
|
#include "sanitizer_common/sanitizer_symbolizer.h"
|
|
|
|
|
|
|
|
namespace __asan {
|
|
|
|
|
|
|
|
// -------------------- User-specified callbacks ----------------- {{{1
|
|
|
|
static void (*error_report_callback)(const char*);
|
2017-04-10 11:32:00 +00:00
|
|
|
static char *error_message_buffer = nullptr;
|
2014-09-21 17:33:12 +00:00
|
|
|
static uptr error_message_buffer_pos = 0;
|
2017-10-07 00:16:47 +00:00
|
|
|
static BlockingMutex error_message_buf_mutex(LINKER_INITIALIZED);
|
|
|
|
static const unsigned kAsanBuggyPcPoolSize = 25;
|
|
|
|
static __sanitizer::atomic_uintptr_t AsanBuggyPcPool[kAsanBuggyPcPoolSize];
|
2015-08-28 15:33:40 +00:00
|
|
|
|
2014-09-21 17:33:12 +00:00
|
|
|
void AppendToErrorMessageBuffer(const char *buffer) {
|
2017-10-07 00:16:47 +00:00
|
|
|
BlockingMutexLock l(&error_message_buf_mutex);
|
|
|
|
if (!error_message_buffer) {
|
|
|
|
error_message_buffer =
|
|
|
|
(char*)MmapOrDieQuietly(kErrorMessageBufferSize, __func__);
|
|
|
|
error_message_buffer_pos = 0;
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
2017-10-07 00:16:47 +00:00
|
|
|
uptr length = internal_strlen(buffer);
|
|
|
|
RAW_CHECK(kErrorMessageBufferSize >= error_message_buffer_pos);
|
|
|
|
uptr remaining = kErrorMessageBufferSize - error_message_buffer_pos;
|
|
|
|
internal_strncpy(error_message_buffer + error_message_buffer_pos,
|
|
|
|
buffer, remaining);
|
|
|
|
error_message_buffer[kErrorMessageBufferSize - 1] = '\0';
|
|
|
|
// FIXME: reallocate the buffer instead of truncating the message.
|
|
|
|
error_message_buffer_pos += Min(remaining, length);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ---------------------- Helper functions ----------------------- {{{1
|
|
|
|
|
2017-10-07 00:16:47 +00:00
|
|
|
void PrintMemoryByte(InternalScopedString *str, const char *before, u8 byte,
|
|
|
|
bool in_shadow, const char *after) {
|
2014-09-21 17:33:12 +00:00
|
|
|
Decorator d;
|
2015-08-28 15:33:40 +00:00
|
|
|
str->append("%s%s%x%x%s%s", before,
|
2018-12-28 15:30:48 +00:00
|
|
|
in_shadow ? d.ShadowByte(byte) : d.MemoryByte(), byte >> 4,
|
|
|
|
byte & 15, d.Default(), after);
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
2014-09-21 17:33:12 +00:00
|
|
|
static void PrintZoneForPointer(uptr ptr, uptr zone_ptr,
|
|
|
|
const char *zone_name) {
|
|
|
|
if (zone_ptr) {
|
|
|
|
if (zone_name) {
|
|
|
|
Printf("malloc_zone_from_ptr(%p) = %p, which is %s\n",
|
|
|
|
ptr, zone_ptr, zone_name);
|
|
|
|
} else {
|
|
|
|
Printf("malloc_zone_from_ptr(%p) = %p, which doesn't have a name\n",
|
|
|
|
ptr, zone_ptr);
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
Printf("malloc_zone_from_ptr(%p) = 0\n", ptr);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// ---------------------- Address Descriptions ------------------- {{{1
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
bool ParseFrameDescription(const char *frame_descr,
|
|
|
|
InternalMmapVector<StackVarDescr> *vars) {
|
|
|
|
CHECK(frame_descr);
|
2019-06-02 15:48:37 +00:00
|
|
|
const char *p;
|
2015-08-28 15:33:40 +00:00
|
|
|
// This string is created by the compiler and has the following form:
|
|
|
|
// "n alloc_1 alloc_2 ... alloc_n"
|
2018-12-28 15:30:48 +00:00
|
|
|
// where alloc_i looks like "offset size len ObjectName"
|
|
|
|
// or "offset size len ObjectName:line".
|
2015-08-28 15:33:40 +00:00
|
|
|
uptr n_objects = (uptr)internal_simple_strtoll(frame_descr, &p, 10);
|
|
|
|
if (n_objects == 0)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
for (uptr i = 0; i < n_objects; i++) {
|
|
|
|
uptr beg = (uptr)internal_simple_strtoll(p, &p, 10);
|
|
|
|
uptr size = (uptr)internal_simple_strtoll(p, &p, 10);
|
|
|
|
uptr len = (uptr)internal_simple_strtoll(p, &p, 10);
|
|
|
|
if (beg == 0 || size == 0 || *p != ' ') {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
p++;
|
2018-12-28 15:30:48 +00:00
|
|
|
char *colon_pos = internal_strchr(p, ':');
|
|
|
|
uptr line = 0;
|
|
|
|
uptr name_len = len;
|
|
|
|
if (colon_pos != nullptr && colon_pos < p + len) {
|
|
|
|
name_len = colon_pos - p;
|
|
|
|
line = (uptr)internal_simple_strtoll(colon_pos + 1, nullptr, 10);
|
|
|
|
}
|
|
|
|
StackVarDescr var = {beg, size, p, name_len, line};
|
2015-08-28 15:33:40 +00:00
|
|
|
vars->push_back(var);
|
|
|
|
p += len;
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
2014-09-21 17:33:12 +00:00
|
|
|
|
|
|
|
// -------------------- Different kinds of reports ----------------- {{{1
|
|
|
|
|
|
|
|
// Use ScopedInErrorReport to run common actions just before and
|
|
|
|
// immediately after printing error report.
|
|
|
|
class ScopedInErrorReport {
|
|
|
|
public:
|
2018-12-28 15:30:48 +00:00
|
|
|
explicit ScopedInErrorReport(bool fatal = false)
|
|
|
|
: halt_on_error_(fatal || flags()->halt_on_error) {
|
|
|
|
// Make sure the registry and sanitizer report mutexes are locked while
|
|
|
|
// we're printing an error report.
|
|
|
|
// We can lock them only here to avoid self-deadlock in case of
|
|
|
|
// recursive reports.
|
|
|
|
asanThreadRegistry().Lock();
|
|
|
|
Printf(
|
|
|
|
"=================================================================\n");
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
2017-04-10 11:32:00 +00:00
|
|
|
|
|
|
|
~ScopedInErrorReport() {
|
2019-06-02 15:48:37 +00:00
|
|
|
if (halt_on_error_ && !__sanitizer_acquire_crash_state()) {
|
|
|
|
asanThreadRegistry().Unlock();
|
|
|
|
return;
|
|
|
|
}
|
2017-10-07 00:16:47 +00:00
|
|
|
ASAN_ON_ERROR();
|
|
|
|
if (current_error_.IsValid()) current_error_.Print();
|
|
|
|
|
2014-09-21 17:33:12 +00:00
|
|
|
// Make sure the current thread is announced.
|
|
|
|
DescribeThread(GetCurrentThread());
|
2015-08-28 15:33:40 +00:00
|
|
|
// We may want to grab this lock again when printing stats.
|
|
|
|
asanThreadRegistry().Unlock();
|
2014-09-21 17:33:12 +00:00
|
|
|
// Print memory stats.
|
|
|
|
if (flags()->print_stats)
|
|
|
|
__asan_print_accumulated_stats();
|
2017-10-07 00:16:47 +00:00
|
|
|
|
|
|
|
if (common_flags()->print_cmdline)
|
|
|
|
PrintCmdline();
|
|
|
|
|
2018-12-28 15:30:48 +00:00
|
|
|
if (common_flags()->print_module_map == 2) PrintModuleMap();
|
|
|
|
|
2017-10-07 00:16:47 +00:00
|
|
|
// Copy the message buffer so that we could start logging without holding a
|
|
|
|
// lock that gets aquired during printing.
|
2019-06-02 15:48:37 +00:00
|
|
|
InternalMmapVector<char> buffer_copy(kErrorMessageBufferSize);
|
2017-10-07 00:16:47 +00:00
|
|
|
{
|
|
|
|
BlockingMutexLock l(&error_message_buf_mutex);
|
|
|
|
internal_memcpy(buffer_copy.data(),
|
|
|
|
error_message_buffer, kErrorMessageBufferSize);
|
|
|
|
}
|
|
|
|
|
|
|
|
LogFullErrorReport(buffer_copy.data());
|
|
|
|
|
2014-09-21 17:33:12 +00:00
|
|
|
if (error_report_callback) {
|
2017-10-07 00:16:47 +00:00
|
|
|
error_report_callback(buffer_copy.data());
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
2017-10-07 00:16:47 +00:00
|
|
|
|
2018-12-28 15:30:48 +00:00
|
|
|
if (halt_on_error_ && common_flags()->abort_on_error) {
|
|
|
|
// On Android the message is truncated to 512 characters.
|
|
|
|
// FIXME: implement "compact" error format, possibly without, or with
|
|
|
|
// highly compressed stack traces?
|
|
|
|
// FIXME: or just use the summary line as abort message?
|
|
|
|
SetAbortMessage(buffer_copy.data());
|
|
|
|
}
|
|
|
|
|
2017-10-07 00:16:47 +00:00
|
|
|
// In halt_on_error = false mode, reset the current error object (before
|
|
|
|
// unlocking).
|
|
|
|
if (!halt_on_error_)
|
|
|
|
internal_memset(¤t_error_, 0, sizeof(current_error_));
|
|
|
|
|
2017-04-10 11:32:00 +00:00
|
|
|
if (halt_on_error_) {
|
|
|
|
Report("ABORTING\n");
|
|
|
|
Die();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-10-07 00:16:47 +00:00
|
|
|
void ReportError(const ErrorDescription &description) {
|
|
|
|
// Can only report one error per ScopedInErrorReport.
|
|
|
|
CHECK_EQ(current_error_.kind, kErrorKindInvalid);
|
|
|
|
current_error_ = description;
|
|
|
|
}
|
|
|
|
|
|
|
|
static ErrorDescription &CurrentError() {
|
|
|
|
return current_error_;
|
|
|
|
}
|
|
|
|
|
2017-04-10 11:32:00 +00:00
|
|
|
private:
|
2018-12-28 15:30:48 +00:00
|
|
|
ScopedErrorReportLock error_report_lock_;
|
2017-10-07 00:16:47 +00:00
|
|
|
// Error currently being reported. This enables the destructor to interact
|
|
|
|
// with the debugger and point it to an error description.
|
|
|
|
static ErrorDescription current_error_;
|
2017-04-10 11:32:00 +00:00
|
|
|
bool halt_on_error_;
|
2014-09-21 17:33:12 +00:00
|
|
|
};
|
|
|
|
|
2019-06-02 15:48:37 +00:00
|
|
|
ErrorDescription ScopedInErrorReport::current_error_(LINKER_INITIALIZED);
|
2017-04-10 11:32:00 +00:00
|
|
|
|
2018-12-28 15:30:48 +00:00
|
|
|
void ReportDeadlySignal(const SignalContext &sig) {
|
2017-10-07 00:16:47 +00:00
|
|
|
ScopedInErrorReport in_report(/*fatal*/ true);
|
2018-12-28 15:30:48 +00:00
|
|
|
ErrorDeadlySignal error(GetCurrentTidOrInvalid(), sig);
|
2017-10-07 00:16:47 +00:00
|
|
|
in_report.ReportError(error);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
void ReportDoubleFree(uptr addr, BufferedStackTrace *free_stack) {
|
2014-09-21 17:33:12 +00:00
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorDoubleFree error(GetCurrentTidOrInvalid(), free_stack, addr);
|
|
|
|
in_report.ReportError(error);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2019-06-02 15:48:37 +00:00
|
|
|
void ReportNewDeleteTypeMismatch(uptr addr, uptr delete_size,
|
|
|
|
uptr delete_alignment,
|
2015-08-28 15:33:40 +00:00
|
|
|
BufferedStackTrace *free_stack) {
|
|
|
|
ScopedInErrorReport in_report;
|
2019-06-02 15:48:37 +00:00
|
|
|
ErrorNewDeleteTypeMismatch error(GetCurrentTidOrInvalid(), free_stack, addr,
|
|
|
|
delete_size, delete_alignment);
|
2017-10-07 00:16:47 +00:00
|
|
|
in_report.ReportError(error);
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void ReportFreeNotMalloced(uptr addr, BufferedStackTrace *free_stack) {
|
2014-09-21 17:33:12 +00:00
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorFreeNotMalloced error(GetCurrentTidOrInvalid(), free_stack, addr);
|
|
|
|
in_report.ReportError(error);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
void ReportAllocTypeMismatch(uptr addr, BufferedStackTrace *free_stack,
|
2014-09-21 17:33:12 +00:00
|
|
|
AllocType alloc_type,
|
|
|
|
AllocType dealloc_type) {
|
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorAllocTypeMismatch error(GetCurrentTidOrInvalid(), free_stack, addr,
|
|
|
|
alloc_type, dealloc_type);
|
|
|
|
in_report.ReportError(error);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
void ReportMallocUsableSizeNotOwned(uptr addr, BufferedStackTrace *stack) {
|
2014-09-21 17:33:12 +00:00
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorMallocUsableSizeNotOwned error(GetCurrentTidOrInvalid(), stack, addr);
|
|
|
|
in_report.ReportError(error);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
void ReportSanitizerGetAllocatedSizeNotOwned(uptr addr,
|
|
|
|
BufferedStackTrace *stack) {
|
2014-09-21 17:33:12 +00:00
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorSanitizerGetAllocatedSizeNotOwned error(GetCurrentTidOrInvalid(), stack,
|
|
|
|
addr);
|
|
|
|
in_report.ReportError(error);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2019-06-02 15:48:37 +00:00
|
|
|
void ReportCallocOverflow(uptr count, uptr size, BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report(/*fatal*/ true);
|
|
|
|
ErrorCallocOverflow error(GetCurrentTidOrInvalid(), stack, count, size);
|
|
|
|
in_report.ReportError(error);
|
|
|
|
}
|
|
|
|
|
|
|
|
void ReportPvallocOverflow(uptr size, BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report(/*fatal*/ true);
|
|
|
|
ErrorPvallocOverflow error(GetCurrentTidOrInvalid(), stack, size);
|
|
|
|
in_report.ReportError(error);
|
|
|
|
}
|
|
|
|
|
|
|
|
void ReportInvalidAllocationAlignment(uptr alignment,
|
|
|
|
BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report(/*fatal*/ true);
|
|
|
|
ErrorInvalidAllocationAlignment error(GetCurrentTidOrInvalid(), stack,
|
|
|
|
alignment);
|
|
|
|
in_report.ReportError(error);
|
|
|
|
}
|
|
|
|
|
|
|
|
void ReportInvalidAlignedAllocAlignment(uptr size, uptr alignment,
|
|
|
|
BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report(/*fatal*/ true);
|
|
|
|
ErrorInvalidAlignedAllocAlignment error(GetCurrentTidOrInvalid(), stack,
|
|
|
|
size, alignment);
|
|
|
|
in_report.ReportError(error);
|
|
|
|
}
|
|
|
|
|
|
|
|
void ReportInvalidPosixMemalignAlignment(uptr alignment,
|
|
|
|
BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report(/*fatal*/ true);
|
|
|
|
ErrorInvalidPosixMemalignAlignment error(GetCurrentTidOrInvalid(), stack,
|
|
|
|
alignment);
|
|
|
|
in_report.ReportError(error);
|
|
|
|
}
|
|
|
|
|
|
|
|
void ReportAllocationSizeTooBig(uptr user_size, uptr total_size, uptr max_size,
|
|
|
|
BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report(/*fatal*/ true);
|
|
|
|
ErrorAllocationSizeTooBig error(GetCurrentTidOrInvalid(), stack, user_size,
|
|
|
|
total_size, max_size);
|
|
|
|
in_report.ReportError(error);
|
|
|
|
}
|
|
|
|
|
|
|
|
void ReportRssLimitExceeded(BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report(/*fatal*/ true);
|
|
|
|
ErrorRssLimitExceeded error(GetCurrentTidOrInvalid(), stack);
|
|
|
|
in_report.ReportError(error);
|
|
|
|
}
|
|
|
|
|
|
|
|
void ReportOutOfMemory(uptr requested_size, BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report(/*fatal*/ true);
|
|
|
|
ErrorOutOfMemory error(GetCurrentTidOrInvalid(), stack, requested_size);
|
|
|
|
in_report.ReportError(error);
|
|
|
|
}
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
void ReportStringFunctionMemoryRangesOverlap(const char *function,
|
|
|
|
const char *offset1, uptr length1,
|
|
|
|
const char *offset2, uptr length2,
|
|
|
|
BufferedStackTrace *stack) {
|
2014-09-21 17:33:12 +00:00
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorStringFunctionMemoryRangesOverlap error(
|
|
|
|
GetCurrentTidOrInvalid(), stack, (uptr)offset1, length1, (uptr)offset2,
|
|
|
|
length2, function);
|
|
|
|
in_report.ReportError(error);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
void ReportStringFunctionSizeOverflow(uptr offset, uptr size,
|
|
|
|
BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorStringFunctionSizeOverflow error(GetCurrentTidOrInvalid(), stack, offset,
|
|
|
|
size);
|
|
|
|
in_report.ReportError(error);
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void ReportBadParamsToAnnotateContiguousContainer(uptr beg, uptr end,
|
|
|
|
uptr old_mid, uptr new_mid,
|
|
|
|
BufferedStackTrace *stack) {
|
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorBadParamsToAnnotateContiguousContainer error(
|
|
|
|
GetCurrentTidOrInvalid(), stack, beg, end, old_mid, new_mid);
|
|
|
|
in_report.ReportError(error);
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void ReportODRViolation(const __asan_global *g1, u32 stack_id1,
|
|
|
|
const __asan_global *g2, u32 stack_id2) {
|
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorODRViolation error(GetCurrentTidOrInvalid(), g1, stack_id1, g2,
|
|
|
|
stack_id2);
|
|
|
|
in_report.ReportError(error);
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ----------------------- CheckForInvalidPointerPair ----------- {{{1
|
2017-10-07 00:16:47 +00:00
|
|
|
static NOINLINE void ReportInvalidPointerPair(uptr pc, uptr bp, uptr sp,
|
|
|
|
uptr a1, uptr a2) {
|
2015-08-28 15:33:40 +00:00
|
|
|
ScopedInErrorReport in_report;
|
2017-10-07 00:16:47 +00:00
|
|
|
ErrorInvalidPointerPair error(GetCurrentTidOrInvalid(), pc, bp, sp, a1, a2);
|
|
|
|
in_report.ReportError(error);
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
2018-12-28 15:30:48 +00:00
|
|
|
static bool IsInvalidPointerPair(uptr a1, uptr a2) {
|
|
|
|
if (a1 == a2)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
// 256B in shadow memory can be iterated quite fast
|
|
|
|
static const uptr kMaxOffset = 2048;
|
|
|
|
|
|
|
|
uptr left = a1 < a2 ? a1 : a2;
|
|
|
|
uptr right = a1 < a2 ? a2 : a1;
|
|
|
|
uptr offset = right - left;
|
|
|
|
if (offset <= kMaxOffset)
|
|
|
|
return __asan_region_is_poisoned(left, offset);
|
|
|
|
|
|
|
|
AsanThread *t = GetCurrentThread();
|
|
|
|
|
|
|
|
// check whether left is a stack memory pointer
|
|
|
|
if (uptr shadow_offset1 = t->GetStackVariableShadowStart(left)) {
|
|
|
|
uptr shadow_offset2 = t->GetStackVariableShadowStart(right);
|
|
|
|
return shadow_offset2 == 0 || shadow_offset1 != shadow_offset2;
|
|
|
|
}
|
|
|
|
|
|
|
|
// check whether left is a heap memory address
|
|
|
|
HeapAddressDescription hdesc1, hdesc2;
|
|
|
|
if (GetHeapAddressInformation(left, 0, &hdesc1) &&
|
|
|
|
hdesc1.chunk_access.access_type == kAccessTypeInside)
|
|
|
|
return !GetHeapAddressInformation(right, 0, &hdesc2) ||
|
|
|
|
hdesc2.chunk_access.access_type != kAccessTypeInside ||
|
|
|
|
hdesc1.chunk_access.chunk_begin != hdesc2.chunk_access.chunk_begin;
|
|
|
|
|
|
|
|
// check whether left is an address of a global variable
|
|
|
|
GlobalAddressDescription gdesc1, gdesc2;
|
|
|
|
if (GetGlobalAddressInformation(left, 0, &gdesc1))
|
|
|
|
return !GetGlobalAddressInformation(right - 1, 0, &gdesc2) ||
|
|
|
|
!gdesc1.PointsInsideTheSameVariable(gdesc2);
|
|
|
|
|
|
|
|
if (t->GetStackVariableShadowStart(right) ||
|
|
|
|
GetHeapAddressInformation(right, 0, &hdesc2) ||
|
|
|
|
GetGlobalAddressInformation(right - 1, 0, &gdesc2))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
// At this point we know nothing about both a1 and a2 addresses.
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
static INLINE void CheckForInvalidPointerPair(void *p1, void *p2) {
|
2018-12-28 15:30:48 +00:00
|
|
|
switch (flags()->detect_invalid_pointer_pairs) {
|
|
|
|
case 0 : return;
|
|
|
|
case 1 : if (p1 == nullptr || p2 == nullptr) return; break;
|
|
|
|
}
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
uptr a1 = reinterpret_cast<uptr>(p1);
|
|
|
|
uptr a2 = reinterpret_cast<uptr>(p2);
|
2018-12-28 15:30:48 +00:00
|
|
|
|
|
|
|
if (IsInvalidPointerPair(a1, a2)) {
|
2017-10-07 00:16:47 +00:00
|
|
|
GET_CALLER_PC_BP_SP;
|
2018-12-28 15:30:48 +00:00
|
|
|
ReportInvalidPointerPair(pc, bp, sp, a1, a2);
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
}
|
2014-09-21 17:33:12 +00:00
|
|
|
// ----------------------- Mac-specific reports ----------------- {{{1
|
|
|
|
|
2015-08-28 15:33:40 +00:00
|
|
|
void ReportMacMzReallocUnknown(uptr addr, uptr zone_ptr, const char *zone_name,
|
|
|
|
BufferedStackTrace *stack) {
|
2014-09-21 17:33:12 +00:00
|
|
|
ScopedInErrorReport in_report;
|
|
|
|
Printf("mz_realloc(%p) -- attempting to realloc unallocated memory.\n"
|
|
|
|
"This is an unrecoverable problem, exiting now.\n",
|
|
|
|
addr);
|
|
|
|
PrintZoneForPointer(addr, zone_ptr, zone_name);
|
2015-08-28 15:33:40 +00:00
|
|
|
stack->Print();
|
2017-10-07 00:16:47 +00:00
|
|
|
DescribeAddressIfHeap(addr);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2017-10-07 00:16:47 +00:00
|
|
|
// -------------- SuppressErrorReport -------------- {{{1
|
|
|
|
// Avoid error reports duplicating for ASan recover mode.
|
|
|
|
static bool SuppressErrorReport(uptr pc) {
|
|
|
|
if (!common_flags()->suppress_equal_pcs) return false;
|
|
|
|
for (unsigned i = 0; i < kAsanBuggyPcPoolSize; i++) {
|
|
|
|
uptr cmp = atomic_load_relaxed(&AsanBuggyPcPool[i]);
|
|
|
|
if (cmp == 0 && atomic_compare_exchange_strong(&AsanBuggyPcPool[i], &cmp,
|
|
|
|
pc, memory_order_relaxed))
|
|
|
|
return false;
|
|
|
|
if (cmp == pc) return true;
|
|
|
|
}
|
|
|
|
Die();
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2017-04-10 11:32:00 +00:00
|
|
|
void ReportGenericError(uptr pc, uptr bp, uptr sp, uptr addr, bool is_write,
|
|
|
|
uptr access_size, u32 exp, bool fatal) {
|
2017-10-07 00:16:47 +00:00
|
|
|
if (!fatal && SuppressErrorReport(pc)) return;
|
2017-04-10 11:32:00 +00:00
|
|
|
ENABLE_FRAME_POINTER;
|
2014-09-21 17:33:12 +00:00
|
|
|
|
2017-04-10 11:32:00 +00:00
|
|
|
// Optimization experiments.
|
|
|
|
// The experiments can be used to evaluate potential optimizations that remove
|
|
|
|
// instrumentation (assess false negatives). Instead of completely removing
|
|
|
|
// some instrumentation, compiler can emit special calls into runtime
|
|
|
|
// (e.g. __asan_report_exp_load1 instead of __asan_report_load1) and pass
|
|
|
|
// mask of experiments (exp).
|
|
|
|
// The reaction to a non-zero value of exp is to be defined.
|
|
|
|
(void)exp;
|
2014-09-21 17:33:12 +00:00
|
|
|
|
2017-10-07 00:16:47 +00:00
|
|
|
ScopedInErrorReport in_report(fatal);
|
|
|
|
ErrorGeneric error(GetCurrentTidOrInvalid(), pc, bp, sp, addr, is_write,
|
|
|
|
access_size);
|
|
|
|
in_report.ReportError(error);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
|
|
|
|
2017-04-10 11:32:00 +00:00
|
|
|
} // namespace __asan
|
|
|
|
|
|
|
|
// --------------------------- Interface --------------------- {{{1
|
|
|
|
using namespace __asan; // NOLINT
|
|
|
|
|
|
|
|
void __asan_report_error(uptr pc, uptr bp, uptr sp, uptr addr, int is_write,
|
|
|
|
uptr access_size, u32 exp) {
|
|
|
|
ENABLE_FRAME_POINTER;
|
|
|
|
bool fatal = flags()->halt_on_error;
|
|
|
|
ReportGenericError(pc, bp, sp, addr, is_write, access_size, exp, fatal);
|
|
|
|
}
|
|
|
|
|
2014-09-21 17:33:12 +00:00
|
|
|
void NOINLINE __asan_set_error_report_callback(void (*callback)(const char*)) {
|
2017-10-07 00:16:47 +00:00
|
|
|
BlockingMutexLock l(&error_message_buf_mutex);
|
2014-09-21 17:33:12 +00:00
|
|
|
error_report_callback = callback;
|
|
|
|
}
|
|
|
|
|
|
|
|
void __asan_describe_address(uptr addr) {
|
2015-08-28 15:33:40 +00:00
|
|
|
// Thread registry must be locked while we're describing an address.
|
|
|
|
asanThreadRegistry().Lock();
|
2017-10-07 00:16:47 +00:00
|
|
|
PrintAddressDescription(addr, 1, "");
|
2015-08-28 15:33:40 +00:00
|
|
|
asanThreadRegistry().Unlock();
|
|
|
|
}
|
|
|
|
|
|
|
|
int __asan_report_present() {
|
2018-12-28 15:30:48 +00:00
|
|
|
return ScopedInErrorReport::CurrentError().kind != kErrorKindInvalid;
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
uptr __asan_get_report_pc() {
|
2017-10-07 00:16:47 +00:00
|
|
|
if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
|
|
|
|
return ScopedInErrorReport::CurrentError().Generic.pc;
|
|
|
|
return 0;
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
uptr __asan_get_report_bp() {
|
2017-10-07 00:16:47 +00:00
|
|
|
if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
|
|
|
|
return ScopedInErrorReport::CurrentError().Generic.bp;
|
|
|
|
return 0;
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
uptr __asan_get_report_sp() {
|
2017-10-07 00:16:47 +00:00
|
|
|
if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
|
|
|
|
return ScopedInErrorReport::CurrentError().Generic.sp;
|
|
|
|
return 0;
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
uptr __asan_get_report_address() {
|
2018-12-28 15:30:48 +00:00
|
|
|
ErrorDescription &err = ScopedInErrorReport::CurrentError();
|
|
|
|
if (err.kind == kErrorKindGeneric)
|
|
|
|
return err.Generic.addr_description.Address();
|
|
|
|
else if (err.kind == kErrorKindDoubleFree)
|
|
|
|
return err.DoubleFree.addr_description.addr;
|
2017-10-07 00:16:47 +00:00
|
|
|
return 0;
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int __asan_get_report_access_type() {
|
2017-10-07 00:16:47 +00:00
|
|
|
if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
|
|
|
|
return ScopedInErrorReport::CurrentError().Generic.is_write;
|
|
|
|
return 0;
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
uptr __asan_get_report_access_size() {
|
2017-10-07 00:16:47 +00:00
|
|
|
if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
|
|
|
|
return ScopedInErrorReport::CurrentError().Generic.access_size;
|
|
|
|
return 0;
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
const char *__asan_get_report_description() {
|
2017-10-07 00:16:47 +00:00
|
|
|
if (ScopedInErrorReport::CurrentError().kind == kErrorKindGeneric)
|
|
|
|
return ScopedInErrorReport::CurrentError().Generic.bug_descr;
|
2018-12-28 15:30:48 +00:00
|
|
|
return ScopedInErrorReport::CurrentError().Base.scariness.GetDescription();
|
2015-08-28 15:33:40 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
extern "C" {
|
|
|
|
SANITIZER_INTERFACE_ATTRIBUTE
|
|
|
|
void __sanitizer_ptr_sub(void *a, void *b) {
|
|
|
|
CheckForInvalidPointerPair(a, b);
|
|
|
|
}
|
|
|
|
SANITIZER_INTERFACE_ATTRIBUTE
|
|
|
|
void __sanitizer_ptr_cmp(void *a, void *b) {
|
|
|
|
CheckForInvalidPointerPair(a, b);
|
2014-09-21 17:33:12 +00:00
|
|
|
}
|
2017-04-10 11:32:00 +00:00
|
|
|
} // extern "C"
|
2014-09-21 17:33:12 +00:00
|
|
|
|
|
|
|
// Provide default implementation of __asan_on_error that does nothing
|
|
|
|
// and may be overriden by user.
|
2018-12-28 15:30:48 +00:00
|
|
|
SANITIZER_INTERFACE_WEAK_DEF(void, __asan_on_error, void) {}
|