asan_fake_stack.h 6.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175
  1. //===-- asan_fake_stack.h ---------------------------------------*- C++ -*-===//
  2. //
  3. // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
  4. // See https://llvm.org/LICENSE.txt for license information.
  5. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
  6. //
  7. //===----------------------------------------------------------------------===//
  8. //
  9. // This file is a part of AddressSanitizer, an address sanity checker.
  10. //
  11. // ASan-private header for asan_fake_stack.cpp, implements FakeStack.
  12. //===----------------------------------------------------------------------===//
  13. #ifndef ASAN_FAKE_STACK_H
  14. #define ASAN_FAKE_STACK_H
  15. #include "sanitizer_common/sanitizer_common.h"
  16. namespace __asan {
  17. // Fake stack frame contains local variables of one function.
  18. struct FakeFrame {
  19. uptr magic; // Modified by the instrumented code.
  20. uptr descr; // Modified by the instrumented code.
  21. uptr pc; // Modified by the instrumented code.
  22. uptr real_stack;
  23. };
  24. // For each thread we create a fake stack and place stack objects on this fake
  25. // stack instead of the real stack. The fake stack is not really a stack but
  26. // a fast malloc-like allocator so that when a function exits the fake stack
  27. // is not popped but remains there for quite some time until gets used again.
  28. // So, we poison the objects on the fake stack when function returns.
  29. // It helps us find use-after-return bugs.
  30. //
  31. // The FakeStack objects is allocated by a single mmap call and has no other
  32. // pointers. The size of the fake stack depends on the actual thread stack size
  33. // and thus can not be a constant.
  34. // stack_size is a power of two greater or equal to the thread's stack size;
  35. // we store it as its logarithm (stack_size_log).
  36. // FakeStack has kNumberOfSizeClasses (11) size classes, each size class
  37. // is a power of two, starting from 64 bytes. Each size class occupies
  38. // stack_size bytes and thus can allocate
  39. // NumberOfFrames=(stack_size/BytesInSizeClass) fake frames (also a power of 2).
  40. // For each size class we have NumberOfFrames allocation flags,
  41. // each flag indicates whether the given frame is currently allocated.
  42. // All flags for size classes 0 .. 10 are stored in a single contiguous region
  43. // followed by another contiguous region which contains the actual memory for
  44. // size classes. The addresses are computed by GetFlags and GetFrame without
  45. // any memory accesses solely based on 'this' and stack_size_log.
  46. // Allocate() flips the appropriate allocation flag atomically, thus achieving
  47. // async-signal safety.
  48. // This allocator does not have quarantine per se, but it tries to allocate the
  49. // frames in round robin fashion to maximize the delay between a deallocation
  50. // and the next allocation.
  51. class FakeStack {
  52. static const uptr kMinStackFrameSizeLog = 6; // Min frame is 64B.
  53. static const uptr kMaxStackFrameSizeLog = 16; // Max stack frame is 64K.
  54. public:
  55. static const uptr kNumberOfSizeClasses =
  56. kMaxStackFrameSizeLog - kMinStackFrameSizeLog + 1;
  57. // CTOR: create the FakeStack as a single mmap-ed object.
  58. static FakeStack *Create(uptr stack_size_log);
  59. void Destroy(int tid);
  60. // stack_size_log is at least 15 (stack_size >= 32K).
  61. static uptr SizeRequiredForFlags(uptr stack_size_log) {
  62. return ((uptr)1) << (stack_size_log + 1 - kMinStackFrameSizeLog);
  63. }
  64. // Each size class occupies stack_size bytes.
  65. static uptr SizeRequiredForFrames(uptr stack_size_log) {
  66. return (((uptr)1) << stack_size_log) * kNumberOfSizeClasses;
  67. }
  68. // Number of bytes requires for the whole object.
  69. static uptr RequiredSize(uptr stack_size_log) {
  70. return kFlagsOffset + SizeRequiredForFlags(stack_size_log) +
  71. SizeRequiredForFrames(stack_size_log);
  72. }
  73. // Offset of the given flag from the first flag.
  74. // The flags for class 0 begin at offset 000000000
  75. // The flags for class 1 begin at offset 100000000
  76. // ....................2................ 110000000
  77. // ....................3................ 111000000
  78. // and so on.
  79. static uptr FlagsOffset(uptr stack_size_log, uptr class_id) {
  80. uptr t = kNumberOfSizeClasses - 1 - class_id;
  81. const uptr all_ones = (((uptr)1) << (kNumberOfSizeClasses - 1)) - 1;
  82. return ((all_ones >> t) << t) << (stack_size_log - 15);
  83. }
  84. static uptr NumberOfFrames(uptr stack_size_log, uptr class_id) {
  85. return ((uptr)1) << (stack_size_log - kMinStackFrameSizeLog - class_id);
  86. }
  87. // Divide n by the number of frames in size class.
  88. static uptr ModuloNumberOfFrames(uptr stack_size_log, uptr class_id, uptr n) {
  89. return n & (NumberOfFrames(stack_size_log, class_id) - 1);
  90. }
  91. // The pointer to the flags of the given class_id.
  92. u8 *GetFlags(uptr stack_size_log, uptr class_id) {
  93. return reinterpret_cast<u8 *>(this) + kFlagsOffset +
  94. FlagsOffset(stack_size_log, class_id);
  95. }
  96. // Get frame by class_id and pos.
  97. u8 *GetFrame(uptr stack_size_log, uptr class_id, uptr pos) {
  98. return reinterpret_cast<u8 *>(this) + kFlagsOffset +
  99. SizeRequiredForFlags(stack_size_log) +
  100. (((uptr)1) << stack_size_log) * class_id +
  101. BytesInSizeClass(class_id) * pos;
  102. }
  103. // Allocate the fake frame.
  104. FakeFrame *Allocate(uptr stack_size_log, uptr class_id, uptr real_stack);
  105. // Deallocate the fake frame: read the saved flag address and write 0 there.
  106. static void Deallocate(uptr x, uptr class_id) {
  107. **SavedFlagPtr(x, class_id) = 0;
  108. }
  109. // Poison the entire FakeStack's shadow with the magic value.
  110. void PoisonAll(u8 magic);
  111. // Return the beginning of the FakeFrame or 0 if the address is not ours.
  112. uptr AddrIsInFakeStack(uptr addr, uptr *frame_beg, uptr *frame_end);
  113. USED uptr AddrIsInFakeStack(uptr addr) {
  114. uptr t1, t2;
  115. return AddrIsInFakeStack(addr, &t1, &t2);
  116. }
  117. // Number of bytes in a fake frame of this size class.
  118. static uptr BytesInSizeClass(uptr class_id) {
  119. return ((uptr)1) << (class_id + kMinStackFrameSizeLog);
  120. }
  121. // The fake frame is guaranteed to have a right redzone.
  122. // We use the last word of that redzone to store the address of the flag
  123. // that corresponds to the current frame to make faster deallocation.
  124. static u8 **SavedFlagPtr(uptr x, uptr class_id) {
  125. return reinterpret_cast<u8 **>(x + BytesInSizeClass(class_id) - sizeof(x));
  126. }
  127. uptr stack_size_log() const { return stack_size_log_; }
  128. void HandleNoReturn();
  129. void GC(uptr real_stack);
  130. void ForEachFakeFrame(RangeIteratorCallback callback, void *arg);
  131. private:
  132. FakeStack() { }
  133. static const uptr kFlagsOffset = 4096; // This is were the flags begin.
  134. // Must match the number of uses of DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID
  135. COMPILER_CHECK(kNumberOfSizeClasses == 11);
  136. static const uptr kMaxStackMallocSize = ((uptr)1) << kMaxStackFrameSizeLog;
  137. uptr hint_position_[kNumberOfSizeClasses];
  138. uptr stack_size_log_;
  139. // a bit is set if something was allocated from the corresponding size class.
  140. bool needs_gc_;
  141. };
  142. FakeStack *GetTLSFakeStack();
  143. void SetTLSFakeStack(FakeStack *fs);
  144. } // namespace __asan
  145. #endif // ASAN_FAKE_STACK_H