compiler-rt/lib/asan/asan_fuchsia.cpp

   1 //===-- asan_fuchsia.cpp -------------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===---------------------------------------------------------------------===//
   8 //
   9 // This file is a part of AddressSanitizer, an address sanity checker.
  10 //
  11 // Fuchsia-specific details.
  12 //===---------------------------------------------------------------------===//
  13
  14 #include "sanitizer_common/sanitizer_fuchsia.h"
  15 #if SANITIZER_FUCHSIA
  16
  17 #include <limits.h>
  18 #include <zircon/sanitizer.h>
  19 #include <zircon/syscalls.h>
  20 #include <zircon/threads.h>
  21
  22 #  include "asan_interceptors.h"
  23 #  include "asan_internal.h"
  24 #  include "asan_stack.h"
  25 #  include "asan_thread.h"
  26 #  include "lsan/lsan_common.h"
  27
  28 namespace __asan {
  29
  30 // The system already set up the shadow memory for us.
  31 // __sanitizer::GetMaxUserVirtualAddress has already been called by
  32 // AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp).
  33 // Just do some additional sanity checks here.
  34 void InitializeShadowMemory() {
  35   if (Verbosity())
  36     PrintAddressSpaceLayout();
  37
  38   // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.
  39   __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
  40   DCHECK(kLowShadowBeg != kDefaultShadowSentinel);
  41   __asan_shadow_memory_dynamic_address = kLowShadowBeg;
  42
  43   CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
  44   CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);
  45   CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);
  46   CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base);
  47   CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1);
  48   CHECK_EQ(kLowShadowEnd, 0);
  49   CHECK_EQ(kLowShadowBeg, 0);
  50 }
  51
  52 void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
  53   UNIMPLEMENTED();
  54 }
  55
  56 void AsanCheckDynamicRTPrereqs() {}
  57 void AsanCheckIncompatibleRT() {}
  58 void InitializeAsanInterceptors() {}
  59
  60 void InitializePlatformExceptionHandlers() {}
  61 void AsanOnDeadlySignal(int signo, void *siginfo, void *context) {
  62   UNIMPLEMENTED();
  63 }
  64
  65 bool PlatformUnpoisonStacks() {
  66   // The current sp might not point to the default stack. This
  67   // could be because we are in a crash stack from fuzzing for example.
  68   // Unpoison the default stack and the current stack page.
  69   AsanThread *curr_thread = GetCurrentThread();
  70   CHECK(curr_thread != nullptr);
  71   uptr top = curr_thread->stack_top();
  72   uptr bottom = curr_thread->stack_bottom();
  73   // The default stack grows from top to bottom. (bottom < top).
  74
  75   uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0));
  76   if (local_stack >= bottom && local_stack <= top) {
  77     // The current stack is the default stack.
  78     // We only need to unpoison from where we are using until the end.
  79     bottom = RoundDownTo(local_stack, GetPageSize());
  80     UnpoisonStack(bottom, top, "default");
  81   } else {
  82     // The current stack is not the default stack.
  83     // Unpoison the entire default stack and the current stack page.
  84     UnpoisonStack(bottom, top, "default");
  85     bottom = RoundDownTo(local_stack, GetPageSize());
  86     top = bottom + GetPageSize();
  87     UnpoisonStack(bottom, top, "unknown");
  88     return true;
  89   }
  90
  91   return false;
  92 }
  93
  94 // We can use a plain thread_local variable for TSD.
  95 static thread_local void *per_thread;
  96
  97 void *AsanTSDGet() { return per_thread; }
  98
  99 void AsanTSDSet(void *tsd) { per_thread = tsd; }
 100
 101 // There's no initialization needed, and the passed-in destructor
 102 // will never be called.  Instead, our own thread destruction hook
 103 // (below) will call AsanThread::TSDDtor directly.
 104 void AsanTSDInit(void (*destructor)(void *tsd)) {
 105   DCHECK(destructor == &PlatformTSDDtor);
 106 }
 107
 108 void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); }
 109
 110 static inline size_t AsanThreadMmapSize() {
 111   return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size());
 112 }
 113
 114 struct AsanThread::InitOptions {
 115   uptr stack_bottom, stack_size;
 116 };
 117
 118 // Shared setup between thread creation and startup for the initial thread.
 119 static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid,
 120                                     bool detached, const char *name) {
 121   // In lieu of AsanThread::Create.
 122   AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__);
 123
 124   AsanThreadContext::CreateThreadContextArgs args = {thread, stack};
 125   u32 tid = asanThreadRegistry().CreateThread(0, detached, parent_tid, &args);
 126   asanThreadRegistry().SetThreadName(tid, name);
 127
 128   return thread;
 129 }
 130
 131 // This gets the same arguments passed to Init by CreateAsanThread, above.
 132 // We're in the creator thread before the new thread is actually started,
 133 // but its stack address range is already known.  We don't bother tracking
 134 // the static TLS address range because the system itself already uses an
 135 // ASan-aware allocator for that.
 136 void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) {
 137   DCHECK_NE(GetCurrentThread(), this);
 138   DCHECK_NE(GetCurrentThread(), nullptr);
 139   CHECK_NE(options->stack_bottom, 0);
 140   CHECK_NE(options->stack_size, 0);
 141   stack_bottom_ = options->stack_bottom;
 142   stack_top_ = options->stack_bottom + options->stack_size;
 143 }
 144
 145 // Called by __asan::AsanInitInternal (asan_rtl.c).
 146 AsanThread *CreateMainThread() {
 147   thrd_t self = thrd_current();
 148   char name[ZX_MAX_NAME_LEN];
 149   CHECK_NE(__sanitizer::MainThreadStackBase, 0);
 150   CHECK_GT(__sanitizer::MainThreadStackSize, 0);
 151   AsanThread *t = CreateAsanThread(
 152       nullptr, 0, true,
 153       _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name,
 154                               sizeof(name)) == ZX_OK
 155           ? name
 156           : nullptr);
 157   // We need to set the current thread before calling AsanThread::Init() below,
 158   // since it reads the thread ID.
 159   SetCurrentThread(t);
 160   DCHECK_EQ(t->tid(), 0);
 161
 162   const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase,
 163                                            __sanitizer::MainThreadStackSize};
 164   t->Init(&options);
 165
 166   return t;
 167 }
 168
 169 // This is called before each thread creation is attempted.  So, in
 170 // its first call, the calling thread is the initial and sole thread.
 171 static void *BeforeThreadCreateHook(uptr user_id, bool detached,
 172                                     const char *name, uptr stack_bottom,
 173                                     uptr stack_size) {
 174   EnsureMainThreadIDIsCorrect();
 175   // Strict init-order checking is thread-hostile.
 176   if (flags()->strict_init_order)
 177     StopInitOrderChecking();
 178
 179   GET_STACK_TRACE_THREAD;
 180   u32 parent_tid = GetCurrentTidOrInvalid();
 181
 182   AsanThread *thread = CreateAsanThread(&stack, parent_tid, detached, name);
 183
 184   // On other systems, AsanThread::Init() is called from the new
 185   // thread itself.  But on Fuchsia we already know the stack address
 186   // range beforehand, so we can do most of the setup right now.
 187   const AsanThread::InitOptions options = {stack_bottom, stack_size};
 188   thread->Init(&options);
 189   return thread;
 190 }
 191
 192 // This is called after creating a new thread (in the creating thread),
 193 // with the pointer returned by BeforeThreadCreateHook (above).
 194 static void ThreadCreateHook(void *hook, bool aborted) {
 195   AsanThread *thread = static_cast<AsanThread *>(hook);
 196   if (!aborted) {
 197     // The thread was created successfully.
 198     // ThreadStartHook is already running in the new thread.
 199   } else {
 200     // The thread wasn't created after all.
 201     // Clean up everything we set up in BeforeThreadCreateHook.
 202     asanThreadRegistry().FinishThread(thread->tid());
 203     UnmapOrDie(thread, AsanThreadMmapSize());
 204   }
 205 }
 206
 207 // This is called in the newly-created thread before it runs anything else,
 208 // with the pointer returned by BeforeThreadCreateHook (above).
 209 // cf. asan_interceptors.cpp:asan_thread_start
 210 static void ThreadStartHook(void *hook, uptr os_id) {
 211   AsanThread *thread = static_cast<AsanThread *>(hook);
 212   SetCurrentThread(thread);
 213
 214   // In lieu of AsanThread::ThreadStart.
 215   asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular,
 216                                    nullptr);
 217 }
 218
 219 // Each thread runs this just before it exits,
 220 // with the pointer returned by BeforeThreadCreateHook (above).
 221 // All per-thread destructors have already been called.
 222 static void ThreadExitHook(void *hook, uptr os_id) {
 223   AsanThread::TSDDtor(per_thread);
 224 }
 225
 226 bool HandleDlopenInit() {
 227   // Not supported on this platform.
 228   static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
 229                 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
 230   return false;
 231 }
 232
 233 void FlushUnneededASanShadowMemory(uptr p, uptr size) {
 234   __sanitizer_fill_shadow(p, size, 0, 0);
 235 }
 236
 237 // On Fuchsia, leak detection is done by a special hook after atexit hooks.
 238 // So this doesn't install any atexit hook like on other platforms.
 239 void InstallAtExitCheckLeaks() {}
 240
 241 void InstallAtForkHandler() {}
 242
 243 }  // namespace __asan
 244
 245 namespace __lsan {
 246
 247 bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; }
 248
 249 }  // namespace __lsan
 250
 251 // These are declared (in extern "C") by <zircon/sanitizer.h>.
 252 // The system runtime will call our definitions directly.
 253
 254 void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
 255                                             const char *name, void *stack_base,
 256                                             size_t stack_size) {
 257   return __asan::BeforeThreadCreateHook(
 258       reinterpret_cast<uptr>(thread), detached, name,
 259       reinterpret_cast<uptr>(stack_base), stack_size);
 260 }
 261
 262 void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) {
 263   __asan::ThreadCreateHook(hook, error != thrd_success);
 264 }
 265
 266 void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
 267   __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self));
 268 }
 269
 270 void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {
 271   __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self));
 272 }
 273
 274 #endif  // SANITIZER_FUCHSIA