compiler-rt/lib/hwasan/hwasan_interceptors.cpp

   1 //===-- hwasan_interceptors.cpp -------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This file is a part of HWAddressSanitizer.
  10 //
  11 // Interceptors for standard library functions.
  12 //
  13 // FIXME: move as many interceptors as possible into
  14 // sanitizer_common/sanitizer_common_interceptors.h
  15 //===----------------------------------------------------------------------===//
  16
  17 #include "interception/interception.h"
  18 #include "hwasan.h"
  19 #include "hwasan_thread.h"
  20 #include "sanitizer_common/sanitizer_stackdepot.h"
  21
  22 #if !SANITIZER_FUCHSIA
  23
  24 using namespace __hwasan;
  25
  26 #if HWASAN_WITH_INTERCEPTORS
  27
  28 struct ThreadStartArg {
  29   thread_callback_t callback;
  30   void *param;
  31 };
  32
  33 static void *HwasanThreadStartFunc(void *arg) {
  34   __hwasan_thread_enter();
  35   ThreadStartArg A = *reinterpret_cast<ThreadStartArg*>(arg);
  36   UnmapOrDie(arg, GetPageSizeCached());
  37   return A.callback(A.param);
  38 }
  39
  40 INTERCEPTOR(int, pthread_create, void *th, void *attr, void *(*callback)(void*),
  41             void * param) {
  42   EnsureMainThreadIDIsCorrect();
  43   ScopedTaggingDisabler tagging_disabler;
  44   ThreadStartArg *A = reinterpret_cast<ThreadStartArg *> (MmapOrDie(
  45       GetPageSizeCached(), "pthread_create"));
  46   *A = {callback, param};
  47   int res;
  48   {
  49     // ASAN uses the same approach to disable leaks from pthread_create.
  50 #    if CAN_SANITIZE_LEAKS
  51     __lsan::ScopedInterceptorDisabler lsan_disabler;
  52 #    endif
  53     res = REAL(pthread_create)(th, attr, &HwasanThreadStartFunc, A);
  54   }
  55   return res;
  56 }
  57
  58 INTERCEPTOR(int, pthread_join, void *t, void **arg) {
  59   return REAL(pthread_join)(t, arg);
  60 }
  61
  62 DEFINE_REAL_PTHREAD_FUNCTIONS
  63
  64 DEFINE_REAL(int, vfork)
  65 DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(int, vfork)
  66
  67 // Get and/or change the set of blocked signals.
  68 extern "C" int sigprocmask(int __how, const __hw_sigset_t *__restrict __set,
  69                            __hw_sigset_t *__restrict __oset);
  70 #define SIG_BLOCK 0
  71 #define SIG_SETMASK 2
  72 extern "C" int __sigjmp_save(__hw_sigjmp_buf env, int savemask) {
  73   env[0].__magic = kHwJmpBufMagic;
  74   env[0].__mask_was_saved =
  75       (savemask && sigprocmask(SIG_BLOCK, (__hw_sigset_t *)0,
  76                                &env[0].__saved_mask) == 0);
  77   return 0;
  78 }
  79
  80 static void __attribute__((always_inline))
  81 InternalLongjmp(__hw_register_buf env, int retval) {
  82 #    if defined(__aarch64__)
  83   constexpr size_t kSpIndex = 13;
  84 #    elif defined(__x86_64__)
  85   constexpr size_t kSpIndex = 6;
  86 #    elif SANITIZER_RISCV64
  87   constexpr size_t kSpIndex = 13;
  88 #    endif
  89
  90   // Clear all memory tags on the stack between here and where we're going.
  91   unsigned long long stack_pointer = env[kSpIndex];
  92   // The stack pointer should never be tagged, so we don't need to clear the
  93   // tag for this function call.
  94   __hwasan_handle_longjmp((void *)stack_pointer);
  95
  96   // Run code for handling a longjmp.
  97   // Need to use a register that isn't going to be loaded from the environment
  98   // buffer -- hence why we need to specify the register to use.
  99   // Must implement this ourselves, since we don't know the order of registers
 100   // in different libc implementations and many implementations mangle the
 101   // stack pointer so we can't use it without knowing the demangling scheme.
 102 #    if defined(__aarch64__)
 103   register long int retval_tmp asm("x1") = retval;
 104   register void *env_address asm("x0") = &env[0];
 105   asm volatile("ldp     x19, x20, [%0, #0<<3];"
 106                "ldp     x21, x22, [%0, #2<<3];"
 107                "ldp     x23, x24, [%0, #4<<3];"
 108                "ldp     x25, x26, [%0, #6<<3];"
 109                "ldp     x27, x28, [%0, #8<<3];"
 110                "ldp     x29, x30, [%0, #10<<3];"
 111                "ldp      d8,  d9, [%0, #14<<3];"
 112                "ldp     d10, d11, [%0, #16<<3];"
 113                "ldp     d12, d13, [%0, #18<<3];"
 114                "ldp     d14, d15, [%0, #20<<3];"
 115                "ldr     x5, [%0, #13<<3];"
 116                "mov     sp, x5;"
 117                // Return the value requested to return through arguments.
 118                // This should be in x1 given what we requested above.
 119                "cmp     %1, #0;"
 120                "mov     x0, #1;"
 121                "csel    x0, %1, x0, ne;"
 122                "br      x30;"
 123                : "+r"(env_address)
 124                : "r"(retval_tmp));
 125 #    elif defined(__x86_64__)
 126   register long int retval_tmp asm("%rsi") = retval;
 127   register void *env_address asm("%rdi") = &env[0];
 128   asm volatile(
 129       // Restore registers.
 130       "mov (0*8)(%0),%%rbx;"
 131       "mov (1*8)(%0),%%rbp;"
 132       "mov (2*8)(%0),%%r12;"
 133       "mov (3*8)(%0),%%r13;"
 134       "mov (4*8)(%0),%%r14;"
 135       "mov (5*8)(%0),%%r15;"
 136       "mov (6*8)(%0),%%rsp;"
 137       "mov (7*8)(%0),%%rdx;"
 138       // Return 1 if retval is 0.
 139       "mov $1,%%rax;"
 140       "test %1,%1;"
 141       "cmovnz %1,%%rax;"
 142       "jmp *%%rdx;" ::"r"(env_address),
 143       "r"(retval_tmp));
 144 #    elif SANITIZER_RISCV64
 145   register long int retval_tmp asm("x11") = retval;
 146   register void *env_address asm("x10") = &env[0];
 147   asm volatile(
 148       "ld     ra,   0<<3(%0);"
 149       "ld     s0,   1<<3(%0);"
 150       "ld     s1,   2<<3(%0);"
 151       "ld     s2,   3<<3(%0);"
 152       "ld     s3,   4<<3(%0);"
 153       "ld     s4,   5<<3(%0);"
 154       "ld     s5,   6<<3(%0);"
 155       "ld     s6,   7<<3(%0);"
 156       "ld     s7,   8<<3(%0);"
 157       "ld     s8,   9<<3(%0);"
 158       "ld     s9,   10<<3(%0);"
 159       "ld     s10,  11<<3(%0);"
 160       "ld     s11,  12<<3(%0);"
 161 #      if __riscv_float_abi_double
 162       "fld    fs0,  14<<3(%0);"
 163       "fld    fs1,  15<<3(%0);"
 164       "fld    fs2,  16<<3(%0);"
 165       "fld    fs3,  17<<3(%0);"
 166       "fld    fs4,  18<<3(%0);"
 167       "fld    fs5,  19<<3(%0);"
 168       "fld    fs6,  20<<3(%0);"
 169       "fld    fs7,  21<<3(%0);"
 170       "fld    fs8,  22<<3(%0);"
 171       "fld    fs9,  23<<3(%0);"
 172       "fld    fs10, 24<<3(%0);"
 173       "fld    fs11, 25<<3(%0);"
 174 #      elif __riscv_float_abi_soft
 175 #      else
 176 #        error "Unsupported case"
 177 #      endif
 178       "ld     a4, 13<<3(%0);"
 179       "mv     sp, a4;"
 180       // Return the value requested to return through arguments.
 181       // This should be in x11 given what we requested above.
 182       "seqz   a0, %1;"
 183       "add    a0, a0, %1;"
 184       "ret;"
 185       : "+r"(env_address)
 186       : "r"(retval_tmp));
 187 #    endif
 188 }
 189
 190 INTERCEPTOR(void, siglongjmp, __hw_sigjmp_buf env, int val) {
 191   if (env[0].__magic != kHwJmpBufMagic) {
 192     Printf(
 193         "WARNING: Unexpected bad jmp_buf. Either setjmp was not called or "
 194         "there is a bug in HWASan.\n");
 195     return REAL(siglongjmp)(env, val);
 196   }
 197
 198   if (env[0].__mask_was_saved)
 199     // Restore the saved signal mask.
 200     (void)sigprocmask(SIG_SETMASK, &env[0].__saved_mask,
 201                       (__hw_sigset_t *)0);
 202   InternalLongjmp(env[0].__jmpbuf, val);
 203 }
 204
 205 // Required since glibc libpthread calls __libc_longjmp on pthread_exit, and
 206 // _setjmp on start_thread.  Hence we have to intercept the longjmp on
 207 // pthread_exit so the __hw_jmp_buf order matches.
 208 INTERCEPTOR(void, __libc_longjmp, __hw_jmp_buf env, int val) {
 209   if (env[0].__magic != kHwJmpBufMagic)
 210     return REAL(__libc_longjmp)(env, val);
 211   InternalLongjmp(env[0].__jmpbuf, val);
 212 }
 213
 214 INTERCEPTOR(void, longjmp, __hw_jmp_buf env, int val) {
 215   if (env[0].__magic != kHwJmpBufMagic) {
 216     Printf(
 217         "WARNING: Unexpected bad jmp_buf. Either setjmp was not called or "
 218         "there is a bug in HWASan.\n");
 219     return REAL(longjmp)(env, val);
 220   }
 221   InternalLongjmp(env[0].__jmpbuf, val);
 222 }
 223 #undef SIG_BLOCK
 224 #undef SIG_SETMASK
 225
 226 #  endif  // HWASAN_WITH_INTERCEPTORS
 227
 228 namespace __hwasan {
 229
 230 int OnExit() {
 231   if (CAN_SANITIZE_LEAKS && common_flags()->detect_leaks &&
 232       __lsan::HasReportedLeaks()) {
 233     return common_flags()->exitcode;
 234   }
 235   // FIXME: ask frontend whether we need to return failure.
 236   return 0;
 237 }
 238
 239 } // namespace __hwasan
 240
 241 namespace __hwasan {
 242
 243 void InitializeInterceptors() {
 244   static int inited = 0;
 245   CHECK_EQ(inited, 0);
 246
 247 #if HWASAN_WITH_INTERCEPTORS
 248 #if defined(__linux__)
 249   INTERCEPT_FUNCTION(__libc_longjmp);
 250   INTERCEPT_FUNCTION(longjmp);
 251   INTERCEPT_FUNCTION(siglongjmp);
 252   INTERCEPT_FUNCTION(vfork);
 253 #endif  // __linux__
 254   INTERCEPT_FUNCTION(pthread_create);
 255   INTERCEPT_FUNCTION(pthread_join);
 256 #  endif
 257
 258   inited = 1;
 259 }
 260 } // namespace __hwasan
 261
 262 #endif  // #if !SANITIZER_FUCHSIA