asan_fuchsia.cpp 9.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274
  1. //===-- asan_fuchsia.cpp -------------------------------------------------===//
  2. //
  3. // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
  4. // See https://llvm.org/LICENSE.txt for license information.
  5. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
  6. //
  7. //===---------------------------------------------------------------------===//
  8. //
  9. // This file is a part of AddressSanitizer, an address sanity checker.
  10. //
  11. // Fuchsia-specific details.
  12. //===---------------------------------------------------------------------===//
  13. #include "sanitizer_common/sanitizer_fuchsia.h"
  14. #if SANITIZER_FUCHSIA
  15. #include <limits.h>
  16. #error #include <zircon/sanitizer.h>
  17. #error #include <zircon/syscalls.h>
  18. #error #include <zircon/threads.h>
  19. # include "asan_interceptors.h"
  20. # include "asan_internal.h"
  21. # include "asan_stack.h"
  22. # include "asan_thread.h"
  23. # include "lsan/lsan_common.h"
  24. namespace __asan {
  25. // The system already set up the shadow memory for us.
  26. // __sanitizer::GetMaxUserVirtualAddress has already been called by
  27. // AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp).
  28. // Just do some additional sanity checks here.
  29. void InitializeShadowMemory() {
  30. if (Verbosity())
  31. PrintAddressSpaceLayout();
  32. // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.
  33. __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
  34. DCHECK(kLowShadowBeg != kDefaultShadowSentinel);
  35. __asan_shadow_memory_dynamic_address = kLowShadowBeg;
  36. CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);
  37. CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);
  38. CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);
  39. CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base);
  40. CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1);
  41. CHECK_EQ(kLowShadowEnd, 0);
  42. CHECK_EQ(kLowShadowBeg, 0);
  43. }
  44. void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {
  45. UNIMPLEMENTED();
  46. }
  47. void AsanCheckDynamicRTPrereqs() {}
  48. void AsanCheckIncompatibleRT() {}
  49. void InitializeAsanInterceptors() {}
  50. void *AsanDoesNotSupportStaticLinkage() { return nullptr; }
  51. void InitializePlatformExceptionHandlers() {}
  52. void AsanOnDeadlySignal(int signo, void *siginfo, void *context) {
  53. UNIMPLEMENTED();
  54. }
  55. bool PlatformUnpoisonStacks() {
  56. // The current sp might not point to the default stack. This
  57. // could be because we are in a crash stack from fuzzing for example.
  58. // Unpoison the default stack and the current stack page.
  59. AsanThread *curr_thread = GetCurrentThread();
  60. CHECK(curr_thread != nullptr);
  61. uptr top = curr_thread->stack_top();
  62. uptr bottom = curr_thread->stack_bottom();
  63. // The default stack grows from top to bottom. (bottom < top).
  64. uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0));
  65. if (local_stack >= bottom && local_stack <= top) {
  66. // The current stack is the default stack.
  67. // We only need to unpoison from where we are using until the end.
  68. bottom = RoundDownTo(local_stack, GetPageSize());
  69. UnpoisonStack(bottom, top, "default");
  70. } else {
  71. // The current stack is not the default stack.
  72. // Unpoison the entire default stack and the current stack page.
  73. UnpoisonStack(bottom, top, "default");
  74. bottom = RoundDownTo(local_stack, GetPageSize());
  75. top = bottom + GetPageSize();
  76. UnpoisonStack(bottom, top, "unknown");
  77. return true;
  78. }
  79. return false;
  80. }
  81. // We can use a plain thread_local variable for TSD.
  82. static thread_local void *per_thread;
  83. void *AsanTSDGet() { return per_thread; }
  84. void AsanTSDSet(void *tsd) { per_thread = tsd; }
  85. // There's no initialization needed, and the passed-in destructor
  86. // will never be called. Instead, our own thread destruction hook
  87. // (below) will call AsanThread::TSDDtor directly.
  88. void AsanTSDInit(void (*destructor)(void *tsd)) {
  89. DCHECK(destructor == &PlatformTSDDtor);
  90. }
  91. void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); }
  92. static inline size_t AsanThreadMmapSize() {
  93. return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size());
  94. }
  95. struct AsanThread::InitOptions {
  96. uptr stack_bottom, stack_size;
  97. };
  98. // Shared setup between thread creation and startup for the initial thread.
  99. static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid,
  100. bool detached, const char *name) {
  101. // In lieu of AsanThread::Create.
  102. AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__);
  103. AsanThreadContext::CreateThreadContextArgs args = {thread, stack};
  104. u32 tid = asanThreadRegistry().CreateThread(0, detached, parent_tid, &args);
  105. asanThreadRegistry().SetThreadName(tid, name);
  106. return thread;
  107. }
  108. // This gets the same arguments passed to Init by CreateAsanThread, above.
  109. // We're in the creator thread before the new thread is actually started,
  110. // but its stack address range is already known. We don't bother tracking
  111. // the static TLS address range because the system itself already uses an
  112. // ASan-aware allocator for that.
  113. void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) {
  114. DCHECK_NE(GetCurrentThread(), this);
  115. DCHECK_NE(GetCurrentThread(), nullptr);
  116. CHECK_NE(options->stack_bottom, 0);
  117. CHECK_NE(options->stack_size, 0);
  118. stack_bottom_ = options->stack_bottom;
  119. stack_top_ = options->stack_bottom + options->stack_size;
  120. }
  121. // Called by __asan::AsanInitInternal (asan_rtl.c).
  122. AsanThread *CreateMainThread() {
  123. thrd_t self = thrd_current();
  124. char name[ZX_MAX_NAME_LEN];
  125. CHECK_NE(__sanitizer::MainThreadStackBase, 0);
  126. CHECK_GT(__sanitizer::MainThreadStackSize, 0);
  127. AsanThread *t = CreateAsanThread(
  128. nullptr, 0, true,
  129. _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name,
  130. sizeof(name)) == ZX_OK
  131. ? name
  132. : nullptr);
  133. // We need to set the current thread before calling AsanThread::Init() below,
  134. // since it reads the thread ID.
  135. SetCurrentThread(t);
  136. DCHECK_EQ(t->tid(), 0);
  137. const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase,
  138. __sanitizer::MainThreadStackSize};
  139. t->Init(&options);
  140. return t;
  141. }
  142. // This is called before each thread creation is attempted. So, in
  143. // its first call, the calling thread is the initial and sole thread.
  144. static void *BeforeThreadCreateHook(uptr user_id, bool detached,
  145. const char *name, uptr stack_bottom,
  146. uptr stack_size) {
  147. EnsureMainThreadIDIsCorrect();
  148. // Strict init-order checking is thread-hostile.
  149. if (flags()->strict_init_order)
  150. StopInitOrderChecking();
  151. GET_STACK_TRACE_THREAD;
  152. u32 parent_tid = GetCurrentTidOrInvalid();
  153. AsanThread *thread = CreateAsanThread(&stack, parent_tid, detached, name);
  154. // On other systems, AsanThread::Init() is called from the new
  155. // thread itself. But on Fuchsia we already know the stack address
  156. // range beforehand, so we can do most of the setup right now.
  157. const AsanThread::InitOptions options = {stack_bottom, stack_size};
  158. thread->Init(&options);
  159. return thread;
  160. }
  161. // This is called after creating a new thread (in the creating thread),
  162. // with the pointer returned by BeforeThreadCreateHook (above).
  163. static void ThreadCreateHook(void *hook, bool aborted) {
  164. AsanThread *thread = static_cast<AsanThread *>(hook);
  165. if (!aborted) {
  166. // The thread was created successfully.
  167. // ThreadStartHook is already running in the new thread.
  168. } else {
  169. // The thread wasn't created after all.
  170. // Clean up everything we set up in BeforeThreadCreateHook.
  171. asanThreadRegistry().FinishThread(thread->tid());
  172. UnmapOrDie(thread, AsanThreadMmapSize());
  173. }
  174. }
  175. // This is called in the newly-created thread before it runs anything else,
  176. // with the pointer returned by BeforeThreadCreateHook (above).
  177. // cf. asan_interceptors.cpp:asan_thread_start
  178. static void ThreadStartHook(void *hook, uptr os_id) {
  179. AsanThread *thread = static_cast<AsanThread *>(hook);
  180. SetCurrentThread(thread);
  181. // In lieu of AsanThread::ThreadStart.
  182. asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular,
  183. nullptr);
  184. }
  185. // Each thread runs this just before it exits,
  186. // with the pointer returned by BeforeThreadCreateHook (above).
  187. // All per-thread destructors have already been called.
  188. static void ThreadExitHook(void *hook, uptr os_id) {
  189. AsanThread::TSDDtor(per_thread);
  190. }
  191. bool HandleDlopenInit() {
  192. // Not supported on this platform.
  193. static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
  194. "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
  195. return false;
  196. }
  197. void FlushUnneededASanShadowMemory(uptr p, uptr size) {
  198. __sanitizer_fill_shadow(p, size, 0, 0);
  199. }
  200. // On Fuchsia, leak detection is done by a special hook after atexit hooks.
  201. // So this doesn't install any atexit hook like on other platforms.
  202. void InstallAtExitCheckLeaks() {}
  203. } // namespace __asan
  204. namespace __lsan {
  205. bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; }
  206. } // namespace __lsan
  207. // These are declared (in extern "C") by <zircon/sanitizer.h>.
  208. // The system runtime will call our definitions directly.
  209. void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,
  210. const char *name, void *stack_base,
  211. size_t stack_size) {
  212. return __asan::BeforeThreadCreateHook(
  213. reinterpret_cast<uptr>(thread), detached, name,
  214. reinterpret_cast<uptr>(stack_base), stack_size);
  215. }
  216. void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) {
  217. __asan::ThreadCreateHook(hook, error != thrd_success);
  218. }
  219. void __sanitizer_thread_start_hook(void *hook, thrd_t self) {
  220. __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self));
  221. }
  222. void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {
  223. __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self));
  224. }
  225. #endif // SANITIZER_FUCHSIA