1 //===-- hwasan.cpp --------------------------------------------------------===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // This file is a part of HWAddressSanitizer.
11 // HWAddressSanitizer runtime.
12 //===----------------------------------------------------------------------===//
16 #include "hwasan_checks.h"
17 #include "hwasan_dynamic_shadow.h"
18 #include "hwasan_globals.h"
19 #include "hwasan_mapping.h"
20 #include "hwasan_poisoning.h"
21 #include "hwasan_report.h"
22 #include "hwasan_thread.h"
23 #include "hwasan_thread_list.h"
24 #include "sanitizer_common/sanitizer_atomic.h"
25 #include "sanitizer_common/sanitizer_common.h"
26 #include "sanitizer_common/sanitizer_flag_parser.h"
27 #include "sanitizer_common/sanitizer_flags.h"
28 #include "sanitizer_common/sanitizer_interface_internal.h"
29 #include "sanitizer_common/sanitizer_libc.h"
30 #include "sanitizer_common/sanitizer_procmaps.h"
31 #include "sanitizer_common/sanitizer_stackdepot.h"
32 #include "sanitizer_common/sanitizer_stacktrace.h"
33 #include "sanitizer_common/sanitizer_symbolizer.h"
34 #include "ubsan/ubsan_flags.h"
35 #include "ubsan/ubsan_init.h"
37 // ACHTUNG! No system header includes in this file.
39 using namespace __sanitizer
;
43 static Flags hwasan_flags
;
49 int hwasan_inited
= 0;
50 int hwasan_instrumentation_inited
= 0;
51 bool hwasan_init_is_running
;
53 int hwasan_report_count
= 0;
57 uptr kHighShadowStart
;
60 void Flags::SetDefaults() {
61 #define HWASAN_FLAG(Type, Name, DefaultValue, Description) Name = DefaultValue;
62 #include "hwasan_flags.inc"
66 static void RegisterHwasanFlags(FlagParser
*parser
, Flags
*f
) {
67 #define HWASAN_FLAG(Type, Name, DefaultValue, Description) \
68 RegisterFlag(parser, #Name, Description, &f->Name);
69 #include "hwasan_flags.inc"
73 static void InitializeFlags() {
74 SetCommonFlagsDefaults();
77 cf
.CopyFrom(*common_flags());
78 cf
.external_symbolizer_path
= GetEnv("HWASAN_SYMBOLIZER_PATH");
79 cf
.malloc_context_size
= 20;
80 cf
.handle_ioctl
= true;
81 // FIXME: test and enable.
82 cf
.check_printf
= false;
83 cf
.intercept_tls_get_addr
= true;
85 // 8 shadow pages ~512kB, small enough to cover common stack sizes.
86 cf
.clear_shadow_mmap_threshold
= 4096 * (SANITIZER_ANDROID
? 2 : 8);
87 // Sigtrap is used in error reporting.
88 cf
.handle_sigtrap
= kHandleSignalExclusive
;
91 // Let platform handle other signals. It is better at reporting them then we
93 cf
.handle_segv
= kHandleSignalNo
;
94 cf
.handle_sigbus
= kHandleSignalNo
;
95 cf
.handle_abort
= kHandleSignalNo
;
96 cf
.handle_sigill
= kHandleSignalNo
;
97 cf
.handle_sigfpe
= kHandleSignalNo
;
99 OverrideCommonFlags(cf
);
106 RegisterHwasanFlags(&parser
, f
);
107 RegisterCommonFlags(&parser
);
109 #if HWASAN_CONTAINS_UBSAN
110 __ubsan::Flags
*uf
= __ubsan::flags();
113 FlagParser ubsan_parser
;
114 __ubsan::RegisterUbsanFlags(&ubsan_parser
, uf
);
115 RegisterCommonFlags(&ubsan_parser
);
118 // Override from user-specified string.
119 if (__hwasan_default_options
)
120 parser
.ParseString(__hwasan_default_options());
121 #if HWASAN_CONTAINS_UBSAN
122 const char *ubsan_default_options
= __ubsan_default_options();
123 ubsan_parser
.ParseString(ubsan_default_options
);
126 parser
.ParseStringFromEnv("HWASAN_OPTIONS");
127 #if HWASAN_CONTAINS_UBSAN
128 ubsan_parser
.ParseStringFromEnv("UBSAN_OPTIONS");
131 InitializeCommonFlags();
133 if (Verbosity()) ReportUnrecognizedFlags();
135 if (common_flags()->help
) parser
.PrintFlagDescriptions();
138 static void CheckUnwind() {
139 GET_FATAL_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME());
143 static void HwasanFormatMemoryUsage(InternalScopedString
&s
) {
144 HwasanThreadList
&thread_list
= hwasanThreadList();
145 auto thread_stats
= thread_list
.GetThreadStats();
146 auto sds
= StackDepotGetStats();
147 AllocatorStatCounters asc
;
148 GetAllocatorStats(asc
);
150 "HWASAN pid: %d rss: %zd threads: %zd stacks: %zd"
151 " thr_aux: %zd stack_depot: %zd uniq_stacks: %zd"
153 internal_getpid(), GetRSS(), thread_stats
.n_live_threads
,
154 thread_stats
.total_stack_size
,
155 thread_stats
.n_live_threads
* thread_list
.MemoryUsedPerThread(),
156 sds
.allocated
, sds
.n_uniq_ids
, asc
[AllocatorStatMapped
]);
159 #if SANITIZER_ANDROID
160 static constexpr uptr kMemoryUsageBufferSize
= 4096;
162 static char *memory_usage_buffer
= nullptr;
164 static void InitMemoryUsage() {
165 memory_usage_buffer
=
166 (char *)MmapOrDie(kMemoryUsageBufferSize
, "memory usage string");
167 CHECK(memory_usage_buffer
);
168 memory_usage_buffer
[0] = '\0';
169 DecorateMapping((uptr
)memory_usage_buffer
, kMemoryUsageBufferSize
,
170 memory_usage_buffer
);
173 void UpdateMemoryUsage() {
174 if (!flags()->export_memory_stats
)
176 if (!memory_usage_buffer
)
178 InternalScopedString s
;
179 HwasanFormatMemoryUsage(s
);
180 internal_strncpy(memory_usage_buffer
, s
.data(), kMemoryUsageBufferSize
- 1);
181 memory_usage_buffer
[kMemoryUsageBufferSize
- 1] = '\0';
184 void UpdateMemoryUsage() {}
187 void HwasanAtExit() {
188 if (common_flags()->print_module_map
)
190 if (flags()->print_stats
&& (flags()->atexit
|| hwasan_report_count
> 0))
192 if (hwasan_report_count
> 0) {
193 // ReportAtExitStatistics();
194 if (common_flags()->exitcode
)
195 internal__exit(common_flags()->exitcode
);
199 void HandleTagMismatch(AccessInfo ai
, uptr pc
, uptr frame
, void *uc
,
200 uptr
*registers_frame
) {
201 InternalMmapVector
<BufferedStackTrace
> stack_buffer(1);
202 BufferedStackTrace
*stack
= stack_buffer
.data();
204 stack
->Unwind(pc
, frame
, uc
, common_flags()->fast_unwind_on_fatal
);
206 // The second stack frame contains the failure __hwasan_check function, as
207 // we have a stack frame for the registers saved in __hwasan_tag_mismatch that
208 // we wish to ignore. This (currently) only occurs on AArch64, as x64
209 // implementations use SIGTRAP to implement the failure, and thus do not go
210 // through the stack saver.
211 if (registers_frame
&& stack
->trace
&& stack
->size
> 0) {
216 bool fatal
= flags()->halt_on_error
|| !ai
.recover
;
217 ReportTagMismatch(stack
, ai
.addr
, ai
.size
, ai
.is_store
, fatal
,
221 void HwasanTagMismatch(uptr addr
, uptr access_info
, uptr
*registers_frame
,
223 __hwasan::AccessInfo ai
;
224 ai
.is_store
= access_info
& 0x10;
225 ai
.is_load
= !ai
.is_store
;
226 ai
.recover
= access_info
& 0x20;
228 if ((access_info
& 0xf) == 0xf)
231 ai
.size
= 1 << (access_info
& 0xf);
233 HandleTagMismatch(ai
, (uptr
)__builtin_return_address(0),
234 (uptr
)__builtin_frame_address(0), nullptr, registers_frame
);
235 __builtin_unreachable();
238 Thread
*GetCurrentThread() {
239 uptr
*ThreadLongPtr
= GetCurrentThreadLongPtr();
240 if (UNLIKELY(*ThreadLongPtr
== 0))
242 auto *R
= (StackAllocationsRingBuffer
*)ThreadLongPtr
;
243 return hwasanThreadList().GetThreadByBufferAddress((uptr
)R
->Next());
246 } // namespace __hwasan
248 using namespace __hwasan
;
250 void __sanitizer::BufferedStackTrace::UnwindImpl(
251 uptr pc
, uptr bp
, void *context
, bool request_fast
, u32 max_depth
) {
252 Thread
*t
= GetCurrentThread();
254 // The thread is still being created, or has already been destroyed.
258 Unwind(max_depth
, pc
, bp
, context
, t
->stack_top(), t
->stack_bottom(),
262 static bool InitializeSingleGlobal(const hwasan_global
&global
) {
263 uptr full_granule_size
= RoundDownTo(global
.size(), 16);
264 TagMemoryAligned(global
.addr(), full_granule_size
, global
.tag());
265 if (global
.size() % 16)
266 TagMemoryAligned(global
.addr() + full_granule_size
, 16, global
.size() % 16);
270 static void InitLoadedGlobals() {
272 [](dl_phdr_info
*info
, size_t /* size */, void * /* data */) -> int {
273 for (const hwasan_global
&global
: HwasanGlobalsFor(
274 info
->dlpi_addr
, info
->dlpi_phdr
, info
->dlpi_phnum
))
275 InitializeSingleGlobal(global
);
281 // Prepare to run instrumented code on the main thread.
282 static void InitInstrumentation() {
283 if (hwasan_instrumentation_inited
) return;
285 InitializeOsSupport();
288 Printf("FATAL: HWAddressSanitizer cannot mmap the shadow memory.\n");
295 hwasan_instrumentation_inited
= 1;
300 uptr __hwasan_shadow_memory_dynamic_address
; // Global interface symbol.
302 // This function was used by the old frame descriptor mechanism. We keep it
303 // around to avoid breaking ABI.
304 void __hwasan_init_frames(uptr beg
, uptr end
) {}
306 void __hwasan_init_static() {
308 InitInstrumentation();
310 // In the non-static code path we call dl_iterate_phdr here. But at this point
311 // libc might not have been initialized enough for dl_iterate_phdr to work.
312 // Fortunately, since this is a statically linked executable we can use the
313 // linker-defined symbol __ehdr_start to find the only relevant set of phdrs.
314 extern ElfW(Ehdr
) __ehdr_start
;
315 for (const hwasan_global
&global
: HwasanGlobalsFor(
317 reinterpret_cast<const ElfW(Phdr
) *>(
318 reinterpret_cast<const char *>(&__ehdr_start
) +
319 __ehdr_start
.e_phoff
),
320 __ehdr_start
.e_phnum
))
321 InitializeSingleGlobal(global
);
324 __attribute__((constructor(0))) void __hwasan_init() {
325 CHECK(!hwasan_init_is_running
);
326 if (hwasan_inited
) return;
327 hwasan_init_is_running
= 1;
328 SanitizerToolName
= "HWAddressSanitizer";
335 // Install tool-specific callbacks in sanitizer_common.
336 SetCheckUnwindCallback(CheckUnwind
);
338 __sanitizer_set_report_path(common_flags()->log_path
);
340 AndroidTestTlsSlot();
342 DisableCoreDumperIfNecessary();
344 InitInstrumentation();
347 // Needs to be called here because flags()->random_tags might not have been
348 // initialized when InitInstrumentation() was called.
349 GetCurrentThread()->EnsureRandomStateInited();
351 SetPrintfAndReportCallback(AppendToErrorMessageBuffer
);
352 // This may call libc -> needs initialized shadow.
355 InitializeInterceptors();
356 InstallDeadlySignalHandlers(HwasanOnDeadlySignal
);
357 InstallAtExitHandler(); // Needs __cxa_atexit interceptor.
359 InitializeCoverage(common_flags()->coverage
, common_flags()->coverage_dir
);
362 HwasanTSDThreadInit();
364 HwasanAllocatorInit();
365 HwasanInstallAtForkHandler();
367 #if HWASAN_CONTAINS_UBSAN
368 __ubsan::InitAsPlugin();
371 VPrintf(1, "HWAddressSanitizer init done\n");
373 hwasan_init_is_running
= 0;
377 void __hwasan_library_loaded(ElfW(Addr
) base
, const ElfW(Phdr
) * phdr
,
379 for (const hwasan_global
&global
: HwasanGlobalsFor(base
, phdr
, phnum
))
380 InitializeSingleGlobal(global
);
383 void __hwasan_library_unloaded(ElfW(Addr
) base
, const ElfW(Phdr
) * phdr
,
385 for (; phnum
!= 0; ++phdr
, --phnum
)
386 if (phdr
->p_type
== PT_LOAD
)
387 TagMemory(base
+ phdr
->p_vaddr
, phdr
->p_memsz
, 0);
390 void __hwasan_print_shadow(const void *p
, uptr sz
) {
391 uptr ptr_raw
= UntagAddr(reinterpret_cast<uptr
>(p
));
392 uptr shadow_first
= MemToShadow(ptr_raw
);
393 uptr shadow_last
= MemToShadow(ptr_raw
+ sz
- 1);
394 Printf("HWASan shadow map for %zx .. %zx (pointer tag %x)\n", ptr_raw
,
395 ptr_raw
+ sz
, GetTagFromPointer((uptr
)p
));
396 for (uptr s
= shadow_first
; s
<= shadow_last
; ++s
) {
397 tag_t mem_tag
= *reinterpret_cast<tag_t
*>(s
);
398 uptr granule_addr
= ShadowToMem(s
);
399 if (mem_tag
&& mem_tag
< kShadowAlignment
)
400 Printf(" %zx: %02x(%02x)\n", granule_addr
, mem_tag
,
401 *reinterpret_cast<tag_t
*>(granule_addr
+ kShadowAlignment
- 1));
403 Printf(" %zx: %02x\n", granule_addr
, mem_tag
);
407 sptr
__hwasan_test_shadow(const void *p
, uptr sz
) {
410 tag_t ptr_tag
= GetTagFromPointer((uptr
)p
);
411 uptr ptr_raw
= UntagAddr(reinterpret_cast<uptr
>(p
));
412 uptr shadow_first
= MemToShadow(ptr_raw
);
413 uptr shadow_last
= MemToShadow(ptr_raw
+ sz
- 1);
414 for (uptr s
= shadow_first
; s
<= shadow_last
; ++s
)
415 if (*(tag_t
*)s
!= ptr_tag
) {
416 sptr offset
= ShadowToMem(s
) - ptr_raw
;
417 return offset
< 0 ? 0 : offset
;
422 u16
__sanitizer_unaligned_load16(const uu16
*p
) {
425 u32
__sanitizer_unaligned_load32(const uu32
*p
) {
428 u64
__sanitizer_unaligned_load64(const uu64
*p
) {
431 void __sanitizer_unaligned_store16(uu16
*p
, u16 x
) {
434 void __sanitizer_unaligned_store32(uu32
*p
, u32 x
) {
437 void __sanitizer_unaligned_store64(uu64
*p
, u64 x
) {
441 void __hwasan_loadN(uptr p
, uptr sz
) {
442 CheckAddressSized
<ErrorAction::Abort
, AccessType::Load
>(p
, sz
);
444 void __hwasan_load1(uptr p
) {
445 CheckAddress
<ErrorAction::Abort
, AccessType::Load
, 0>(p
);
447 void __hwasan_load2(uptr p
) {
448 CheckAddress
<ErrorAction::Abort
, AccessType::Load
, 1>(p
);
450 void __hwasan_load4(uptr p
) {
451 CheckAddress
<ErrorAction::Abort
, AccessType::Load
, 2>(p
);
453 void __hwasan_load8(uptr p
) {
454 CheckAddress
<ErrorAction::Abort
, AccessType::Load
, 3>(p
);
456 void __hwasan_load16(uptr p
) {
457 CheckAddress
<ErrorAction::Abort
, AccessType::Load
, 4>(p
);
460 void __hwasan_loadN_noabort(uptr p
, uptr sz
) {
461 CheckAddressSized
<ErrorAction::Recover
, AccessType::Load
>(p
, sz
);
463 void __hwasan_load1_noabort(uptr p
) {
464 CheckAddress
<ErrorAction::Recover
, AccessType::Load
, 0>(p
);
466 void __hwasan_load2_noabort(uptr p
) {
467 CheckAddress
<ErrorAction::Recover
, AccessType::Load
, 1>(p
);
469 void __hwasan_load4_noabort(uptr p
) {
470 CheckAddress
<ErrorAction::Recover
, AccessType::Load
, 2>(p
);
472 void __hwasan_load8_noabort(uptr p
) {
473 CheckAddress
<ErrorAction::Recover
, AccessType::Load
, 3>(p
);
475 void __hwasan_load16_noabort(uptr p
) {
476 CheckAddress
<ErrorAction::Recover
, AccessType::Load
, 4>(p
);
479 void __hwasan_storeN(uptr p
, uptr sz
) {
480 CheckAddressSized
<ErrorAction::Abort
, AccessType::Store
>(p
, sz
);
482 void __hwasan_store1(uptr p
) {
483 CheckAddress
<ErrorAction::Abort
, AccessType::Store
, 0>(p
);
485 void __hwasan_store2(uptr p
) {
486 CheckAddress
<ErrorAction::Abort
, AccessType::Store
, 1>(p
);
488 void __hwasan_store4(uptr p
) {
489 CheckAddress
<ErrorAction::Abort
, AccessType::Store
, 2>(p
);
491 void __hwasan_store8(uptr p
) {
492 CheckAddress
<ErrorAction::Abort
, AccessType::Store
, 3>(p
);
494 void __hwasan_store16(uptr p
) {
495 CheckAddress
<ErrorAction::Abort
, AccessType::Store
, 4>(p
);
498 void __hwasan_storeN_noabort(uptr p
, uptr sz
) {
499 CheckAddressSized
<ErrorAction::Recover
, AccessType::Store
>(p
, sz
);
501 void __hwasan_store1_noabort(uptr p
) {
502 CheckAddress
<ErrorAction::Recover
, AccessType::Store
, 0>(p
);
504 void __hwasan_store2_noabort(uptr p
) {
505 CheckAddress
<ErrorAction::Recover
, AccessType::Store
, 1>(p
);
507 void __hwasan_store4_noabort(uptr p
) {
508 CheckAddress
<ErrorAction::Recover
, AccessType::Store
, 2>(p
);
510 void __hwasan_store8_noabort(uptr p
) {
511 CheckAddress
<ErrorAction::Recover
, AccessType::Store
, 3>(p
);
513 void __hwasan_store16_noabort(uptr p
) {
514 CheckAddress
<ErrorAction::Recover
, AccessType::Store
, 4>(p
);
517 void __hwasan_tag_memory(uptr p
, u8 tag
, uptr sz
) {
518 TagMemoryAligned(p
, sz
, tag
);
521 uptr
__hwasan_tag_pointer(uptr p
, u8 tag
) {
522 return AddTagToPointer(p
, tag
);
525 void __hwasan_handle_longjmp(const void *sp_dst
) {
526 uptr dst
= (uptr
)sp_dst
;
527 // HWASan does not support tagged SP.
528 CHECK(GetTagFromPointer(dst
) == 0);
530 uptr sp
= (uptr
)__builtin_frame_address(0);
531 static const uptr kMaxExpectedCleanupSize
= 64 << 20; // 64M
532 if (dst
< sp
|| dst
- sp
> kMaxExpectedCleanupSize
) {
534 "WARNING: HWASan is ignoring requested __hwasan_handle_longjmp: "
535 "stack top: %p; target %p; distance: %p (%zd)\n"
536 "False positive error reports may follow\n",
537 (void *)sp
, (void *)dst
, dst
- sp
);
540 TagMemory(sp
, dst
- sp
, 0);
543 void __hwasan_handle_vfork(const void *sp_dst
) {
544 uptr sp
= (uptr
)sp_dst
;
545 Thread
*t
= GetCurrentThread();
547 uptr top
= t
->stack_top();
548 uptr bottom
= t
->stack_bottom();
549 if (top
== 0 || bottom
== 0 || sp
< bottom
|| sp
>= top
) {
551 "WARNING: HWASan is ignoring requested __hwasan_handle_vfork: "
552 "stack top: %zx; current %zx; bottom: %zx \n"
553 "False positive error reports may follow\n",
557 TagMemory(bottom
, sp
- bottom
, 0);
560 extern "C" void *__hwasan_extra_spill_area() {
561 Thread
*t
= GetCurrentThread();
562 return &t
->vfork_spill();
565 void __hwasan_print_memory_usage() {
566 InternalScopedString s
;
567 HwasanFormatMemoryUsage(s
);
568 Printf("%s\n", s
.data());
571 static const u8 kFallbackTag
= 0xBB & kTagMask
;
573 u8
__hwasan_generate_tag() {
574 Thread
*t
= GetCurrentThread();
575 if (!t
) return kFallbackTag
;
576 return t
->GenerateRandomTag();
579 #if !SANITIZER_SUPPORTS_WEAK_HOOKS
581 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
582 const char* __hwasan_default_options() { return ""; }
587 SANITIZER_INTERFACE_ATTRIBUTE
588 void __sanitizer_print_stack_trace() {
589 GET_FATAL_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME());
593 // Entry point for interoperability between __hwasan_tag_mismatch (ASM) and the
594 // rest of the mismatch handling code (C++).
595 void __hwasan_tag_mismatch4(uptr addr
, uptr access_info
, uptr
*registers_frame
,
597 __hwasan::HwasanTagMismatch(addr
, access_info
, registers_frame
, outsize
);