libsanitizer/asan/asan_fuchsia.cpp

   1 //===-- asan_fuchsia.cpp -------------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===---------------------------------------------------------------------===//
   8 //
   9 // This file is a part of AddressSanitizer, an address sanity checker.
  10 //
  11 // Fuchsia-specific details.
  12 //===---------------------------------------------------------------------===//
  13
  14 #include "sanitizer_common/sanitizer_fuchsia.h"
  15 #if SANITIZER_FUCHSIA
  16
  17 #include <limits.h>
  18 #include <zircon/sanitizer.h>
  19 #include <zircon/syscalls.h>
  20 #include <zircon/threads.h>
  21
  22 #  include "asan_interceptors.h"
  23 #  include "asan_internal.h"
  24 #  include "asan_stack.h"
  25 #  include "asan_thread.h"
  26 #  include "lsan/lsan_common.h"
  27
  28 namespace __asan {
  29
  30 // The system already set up the shadow memory for us.
  31 // __sanitizer::GetMaxUserVirtualAddress has already been called by
  32 // AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp).
  33 // Just do some additional sanity checks here.
  34 void InitializeShadowMemory() {
  35   if (Verbosity())
  36     PrintAddressSpaceLayout();
  37
  38   // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.
  39   __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
  40   DCHECK(kLowShadowBeg != kDefaultShadowSentinel);
  41   __asan_shadow_memory_dynamic_address = kLowShadowBeg;
  42
  43   CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
  44   CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);
  45   CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);
  46   CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base);
  47   CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1);
  48   CHECK_EQ(kLowShadowEnd, 0);
  49   CHECK_EQ(kLowShadowBeg, 0);
  50 }
  51
  52 void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
  53   UNIMPLEMENTED();
  54 }
  55
  56 void AsanCheckDynamicRTPrereqs() {}
  57 void AsanCheckIncompatibleRT() {}
  58 void InitializeAsanInterceptors() {}
  59
  60 void InitializePlatformExceptionHandlers() {}
  61 void AsanOnDeadlySignal(int signo, void *siginfo, void *context) {
  62   UNIMPLEMENTED();
  63 }
  64
  65 bool PlatformUnpoisonStacks() {
  66   // The current sp might not point to the default stack. This
  67   // could be because we are in a crash stack from fuzzing for example.
  68   // Unpoison the default stack and the current stack page.
  69   AsanThread *curr_thread = GetCurrentThread();
  70   CHECK(curr_thread != nullptr);
  71   uptr top = curr_thread->stack_top();
  72   uptr bottom = curr_thread->stack_bottom();
  73   // The default stack grows from top to bottom. (bottom < top).
  74
  75   uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0));
  76   if (local_stack >= bottom && local_stack <= top) {
  77     // The current stack is the default stack.
  78     // We only need to unpoison from where we are using until the end.
  79     bottom = RoundDownTo(local_stack, GetPageSize());
  80     UnpoisonStack(bottom, top, "default");
  81   } else {
  82     // The current stack is not the default stack.
  83     // Unpoison the entire default stack and the current stack page.
  84     UnpoisonStack(bottom, top, "default");
  85     bottom = RoundDownTo(local_stack, GetPageSize());
  86     top = bottom + GetPageSize();
  87     UnpoisonStack(bottom, top, "unknown");
  88     return true;
  89   }
  90
  91   return false;
  92 }
  93
  94 // We can use a plain thread_local variable for TSD.
  95 static thread_local void *per_thread;
  96
  97 void *AsanTSDGet() { return per_thread; }
  98
  99 void AsanTSDSet(void *tsd) { per_thread = tsd; }
 100
 101 // There's no initialization needed, and the passed-in destructor
 102 // will never be called.  Instead, our own thread destruction hook
 103 // (below) will call AsanThread::TSDDtor directly.
 104 void AsanTSDInit(void (*destructor)(void *tsd)) {
 105   DCHECK(destructor == &PlatformTSDDtor);
 106 }
 107
 108 void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); }
 109
 110 static inline size_t AsanThreadMmapSize() {
 111   return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size());
 112 }
 113
 114 struct AsanThread::InitOptions {
 115   uptr stack_bottom, stack_size;
 116 };
 117
 118 // Shared setup between thread creation and startup for the initial thread.
 119 static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid,
 120                                     bool detached, const char *name) {
 121   // In lieu of AsanThread::Create.
 122   AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__);
 123
 124   u32 tid = asanThreadRegistry().CreateThread(0, detached, parent_tid, thread);
 125   asanThreadRegistry().SetThreadName(tid, name);
 126
 127   return thread;
 128 }
 129
 130 // This gets the same arguments passed to Init by CreateAsanThread, above.
 131 // We're in the creator thread before the new thread is actually started,
 132 // but its stack address range is already known.  We don't bother tracking
 133 // the static TLS address range because the system itself already uses an
 134 // ASan-aware allocator for that.
 135 void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) {
 136   DCHECK_NE(GetCurrentThread(), this);
 137   DCHECK_NE(GetCurrentThread(), nullptr);
 138   CHECK_NE(options->stack_bottom, 0);
 139   CHECK_NE(options->stack_size, 0);
 140   stack_bottom_ = options->stack_bottom;
 141   stack_top_ = options->stack_bottom + options->stack_size;
 142 }
 143
 144 // Called by __asan::AsanInitInternal (asan_rtl.c).
 145 AsanThread *CreateMainThread() {
 146   thrd_t self = thrd_current();
 147   char name[ZX_MAX_NAME_LEN];
 148   CHECK_NE(__sanitizer::MainThreadStackBase, 0);
 149   CHECK_GT(__sanitizer::MainThreadStackSize, 0);
 150   AsanThread *t = CreateAsanThread(
 151       nullptr, 0, true,
 152       _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name,
 153                               sizeof(name)) == ZX_OK
 154           ? name
 155           : nullptr);
 156   // We need to set the current thread before calling AsanThread::Init() below,
 157   // since it reads the thread ID.
 158   SetCurrentThread(t);
 159   DCHECK_EQ(t->tid(), 0);
 160
 161   const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase,
 162                                            __sanitizer::MainThreadStackSize};
 163   t->Init(&options);
 164
 165   return t;
 166 }
 167
 168 // This is called before each thread creation is attempted.  So, in
 169 // its first call, the calling thread is the initial and sole thread.
 170 static void *BeforeThreadCreateHook(uptr user_id, bool detached,
 171                                     const char *name, uptr stack_bottom,
 172                                     uptr stack_size) {
 173   EnsureMainThreadIDIsCorrect();
 174   // Strict init-order checking is thread-hostile.
 175   if (flags()->strict_init_order)
 176     StopInitOrderChecking();
 177
 178   GET_STACK_TRACE_THREAD;
 179   u32 parent_tid = GetCurrentTidOrInvalid();
 180
 181   AsanThread *thread = CreateAsanThread(&stack, parent_tid, detached, name);
 182
 183   // On other systems, AsanThread::Init() is called from the new
 184   // thread itself.  But on Fuchsia we already know the stack address
 185   // range beforehand, so we can do most of the setup right now.
 186   const AsanThread::InitOptions options = {stack_bottom, stack_size};
 187   thread->Init(&options);
 188   return thread;
 189 }
 190
 191 // This is called after creating a new thread (in the creating thread),
 192 // with the pointer returned by BeforeThreadCreateHook (above).
 193 static void ThreadCreateHook(void *hook, bool aborted) {
 194   AsanThread *thread = static_cast<AsanThread *>(hook);
 195   if (!aborted) {
 196     // The thread was created successfully.
 197     // ThreadStartHook is already running in the new thread.
 198   } else {
 199     // The thread wasn't created after all.
 200     // Clean up everything we set up in BeforeThreadCreateHook.
 201     asanThreadRegistry().FinishThread(thread->tid());
 202     UnmapOrDie(thread, AsanThreadMmapSize());
 203   }
 204 }
 205
 206 // This is called in the newly-created thread before it runs anything else,
 207 // with the pointer returned by BeforeThreadCreateHook (above).
 208 // cf. asan_interceptors.cpp:asan_thread_start
 209 static void ThreadStartHook(void *hook, uptr os_id) {
 210   AsanThread *thread = static_cast<AsanThread *>(hook);
 211   SetCurrentThread(thread);
 212
 213   // In lieu of AsanThread::ThreadStart.
 214   asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular,
 215                                    nullptr);
 216 }
 217
 218 // Each thread runs this just before it exits,
 219 // with the pointer returned by BeforeThreadCreateHook (above).
 220 // All per-thread destructors have already been called.
 221 static void ThreadExitHook(void *hook, uptr os_id) {
 222   AsanThread::TSDDtor(per_thread);
 223 }
 224
 225 bool HandleDlopenInit() {
 226   // Not supported on this platform.
 227   static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
 228                 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
 229   return false;
 230 }
 231
 232 void FlushUnneededASanShadowMemory(uptr p, uptr size) {
 233   __sanitizer_fill_shadow(p, size, 0, 0);
 234 }
 235
 236 // On Fuchsia, leak detection is done by a special hook after atexit hooks.
 237 // So this doesn't install any atexit hook like on other platforms.
 238 void InstallAtExitCheckLeaks() {}
 239
 240 void InstallAtForkHandler() {}
 241
 242 }  // namespace __asan
 243
 244 namespace __lsan {
 245
 246 bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; }
 247
 248 }  // namespace __lsan
 249
 250 // These are declared (in extern "C") by <zircon/sanitizer.h>.
 251 // The system runtime will call our definitions directly.
 252
 253 void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
 254                                             const char *name, void *stack_base,
 255                                             size_t stack_size) {
 256   return __asan::BeforeThreadCreateHook(
 257       reinterpret_cast<uptr>(thread), detached, name,
 258       reinterpret_cast<uptr>(stack_base), stack_size);
 259 }
 260
 261 void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) {
 262   __asan::ThreadCreateHook(hook, error != thrd_success);
 263 }
 264
 265 void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
 266   __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self));
 267 }
 268
 269 void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {
 270   __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self));
 271 }
 272
 273 #endif  // SANITIZER_FUCHSIA