msan_report.cpp 8.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282
  1. //===-- msan_report.cpp ---------------------------------------------------===//
  2. //
  3. // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
  4. // See https://llvm.org/LICENSE.txt for license information.
  5. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
  6. //
  7. //===----------------------------------------------------------------------===//
  8. //
  9. // This file is a part of MemorySanitizer.
  10. //
  11. // Error reporting.
  12. //===----------------------------------------------------------------------===//
  13. #include "msan_report.h"
  14. #include "msan.h"
  15. #include "msan_chained_origin_depot.h"
  16. #include "msan_origin.h"
  17. #include "sanitizer_common/sanitizer_allocator_internal.h"
  18. #include "sanitizer_common/sanitizer_common.h"
  19. #include "sanitizer_common/sanitizer_flags.h"
  20. #include "sanitizer_common/sanitizer_mutex.h"
  21. #include "sanitizer_common/sanitizer_report_decorator.h"
  22. #include "sanitizer_common/sanitizer_stackdepot.h"
  23. #include "sanitizer_common/sanitizer_stacktrace_printer.h"
  24. #include "sanitizer_common/sanitizer_symbolizer.h"
  25. using namespace __sanitizer;
  26. namespace __msan {
  27. class Decorator: public __sanitizer::SanitizerCommonDecorator {
  28. public:
  29. Decorator() : SanitizerCommonDecorator() { }
  30. const char *Origin() const { return Magenta(); }
  31. const char *Name() const { return Green(); }
  32. };
  33. static void DescribeStackOrigin(const char *so, uptr pc) {
  34. Decorator d;
  35. Printf("%s", d.Origin());
  36. if (so) {
  37. Printf(
  38. " %sUninitialized value was created by an allocation of '%s%s%s'"
  39. " in the stack frame%s\n",
  40. d.Origin(), d.Name(), so, d.Origin(), d.Default());
  41. } else {
  42. Printf(" %sUninitialized value was created in the stack frame%s\n",
  43. d.Origin(), d.Default());
  44. }
  45. if (pc)
  46. StackTrace(&pc, 1).Print();
  47. }
  48. static void DescribeOrigin(u32 id) {
  49. VPrintf(1, " raw origin id: %d\n", id);
  50. Decorator d;
  51. Origin o = Origin::FromRawId(id);
  52. while (o.isChainedOrigin()) {
  53. StackTrace stack;
  54. o = o.getNextChainedOrigin(&stack);
  55. Printf(" %sUninitialized value was stored to memory at%s\n", d.Origin(),
  56. d.Default());
  57. stack.Print();
  58. }
  59. if (o.isStackOrigin()) {
  60. uptr pc;
  61. const char *so = GetStackOriginDescr(o.getStackId(), &pc);
  62. DescribeStackOrigin(so, pc);
  63. } else {
  64. StackTrace stack = o.getStackTraceForHeapOrigin();
  65. switch (stack.tag) {
  66. case StackTrace::TAG_ALLOC:
  67. Printf(" %sUninitialized value was created by a heap allocation%s\n",
  68. d.Origin(), d.Default());
  69. break;
  70. case StackTrace::TAG_DEALLOC:
  71. Printf(" %sUninitialized value was created by a heap deallocation%s\n",
  72. d.Origin(), d.Default());
  73. break;
  74. case STACK_TRACE_TAG_POISON:
  75. Printf(" %sMemory was marked as uninitialized%s\n", d.Origin(),
  76. d.Default());
  77. break;
  78. case STACK_TRACE_TAG_FIELDS:
  79. Printf(" %sMember fields were destroyed%s\n", d.Origin(), d.Default());
  80. break;
  81. case STACK_TRACE_TAG_VPTR:
  82. Printf(" %sVirtual table ptr was destroyed%s\n", d.Origin(),
  83. d.Default());
  84. break;
  85. default:
  86. Printf(" %sUninitialized value was created%s\n", d.Origin(),
  87. d.Default());
  88. break;
  89. }
  90. stack.Print();
  91. }
  92. }
  93. void ReportUMR(StackTrace *stack, u32 origin) {
  94. if (!__msan::flags()->report_umrs) return;
  95. ScopedErrorReportLock l;
  96. Decorator d;
  97. Printf("%s", d.Warning());
  98. Report("WARNING: MemorySanitizer: use-of-uninitialized-value\n");
  99. Printf("%s", d.Default());
  100. stack->Print();
  101. if (origin) {
  102. DescribeOrigin(origin);
  103. }
  104. ReportErrorSummary("use-of-uninitialized-value", stack);
  105. }
  106. void ReportExpectedUMRNotFound(StackTrace *stack) {
  107. ScopedErrorReportLock l;
  108. Printf("WARNING: Expected use of uninitialized value not found\n");
  109. stack->Print();
  110. }
  111. void ReportStats() {
  112. ScopedErrorReportLock l;
  113. if (__msan_get_track_origins() > 0) {
  114. StackDepotStats stack_depot_stats = StackDepotGetStats();
  115. // FIXME: we want this at normal exit, too!
  116. // FIXME: but only with verbosity=1 or something
  117. Printf("Unique heap origins: %zu\n", stack_depot_stats.n_uniq_ids);
  118. Printf("Stack depot allocated bytes: %zu\n", stack_depot_stats.allocated);
  119. StackDepotStats chained_origin_depot_stats = ChainedOriginDepotGetStats();
  120. Printf("Unique origin histories: %zu\n",
  121. chained_origin_depot_stats.n_uniq_ids);
  122. Printf("History depot allocated bytes: %zu\n",
  123. chained_origin_depot_stats.allocated);
  124. }
  125. }
  126. void ReportAtExitStatistics() {
  127. ScopedErrorReportLock l;
  128. if (msan_report_count > 0) {
  129. Decorator d;
  130. Printf("%s", d.Warning());
  131. Printf("MemorySanitizer: %d warnings reported.\n", msan_report_count);
  132. Printf("%s", d.Default());
  133. }
  134. }
  135. class OriginSet {
  136. public:
  137. OriginSet() : next_id_(0) {}
  138. int insert(u32 o) {
  139. // Scan from the end for better locality.
  140. for (int i = next_id_ - 1; i >= 0; --i)
  141. if (origins_[i] == o) return i;
  142. if (next_id_ == kMaxSize_) return OVERFLOW;
  143. int id = next_id_++;
  144. origins_[id] = o;
  145. return id;
  146. }
  147. int size() { return next_id_; }
  148. u32 get(int id) { return origins_[id]; }
  149. static char asChar(int id) {
  150. switch (id) {
  151. case MISSING:
  152. return '.';
  153. case OVERFLOW:
  154. return '*';
  155. default:
  156. return 'A' + id;
  157. }
  158. }
  159. static const int OVERFLOW = -1;
  160. static const int MISSING = -2;
  161. private:
  162. static const int kMaxSize_ = 'Z' - 'A' + 1;
  163. u32 origins_[kMaxSize_];
  164. int next_id_;
  165. };
  166. void DescribeMemoryRange(const void *x, uptr size) {
  167. // Real limits.
  168. uptr start = MEM_TO_SHADOW(x);
  169. uptr end = start + size;
  170. // Scan limits: align start down to 4; align size up to 16.
  171. uptr s = start & ~3UL;
  172. size = end - s;
  173. size = (size + 15) & ~15UL;
  174. uptr e = s + size;
  175. // Single letter names to origin id mapping.
  176. OriginSet origin_set;
  177. uptr pos = 0; // Offset from aligned start.
  178. bool with_origins = __msan_get_track_origins();
  179. // True if there is at least 1 poisoned bit in the last 4-byte group.
  180. bool last_quad_poisoned;
  181. int origin_ids[4]; // Single letter origin ids for the current line.
  182. Decorator d;
  183. Printf("%s", d.Warning());
  184. uptr start_x = reinterpret_cast<uptr>(x);
  185. Printf("Shadow map [%p, %p) of [%p, %p), %zu bytes:\n",
  186. reinterpret_cast<void *>(start), reinterpret_cast<void *>(end),
  187. reinterpret_cast<void *>(start_x),
  188. reinterpret_cast<void *>(start_x + end - start), end - start);
  189. Printf("%s", d.Default());
  190. while (s < e) {
  191. // Line start.
  192. if (pos % 16 == 0) {
  193. for (int i = 0; i < 4; ++i) origin_ids[i] = -1;
  194. Printf("%p[%p]:", reinterpret_cast<void *>(s),
  195. reinterpret_cast<void *>(start_x - start + s));
  196. }
  197. // Group start.
  198. if (pos % 4 == 0) {
  199. Printf(" ");
  200. last_quad_poisoned = false;
  201. }
  202. // Print shadow byte.
  203. if (s < start || s >= end) {
  204. Printf("..");
  205. } else {
  206. unsigned char v = *(unsigned char *)s;
  207. if (v) last_quad_poisoned = true;
  208. Printf("%x%x", v >> 4, v & 0xf);
  209. }
  210. // Group end.
  211. if (pos % 4 == 3 && with_origins) {
  212. int id = OriginSet::MISSING;
  213. if (last_quad_poisoned) {
  214. u32 o = *(u32 *)SHADOW_TO_ORIGIN(s - 3);
  215. id = origin_set.insert(o);
  216. }
  217. origin_ids[(pos % 16) / 4] = id;
  218. }
  219. // Line end.
  220. if (pos % 16 == 15) {
  221. if (with_origins) {
  222. Printf(" |");
  223. for (int i = 0; i < 4; ++i) {
  224. char c = OriginSet::asChar(origin_ids[i]);
  225. Printf("%c", c);
  226. if (i != 3) Printf(" ");
  227. }
  228. Printf("|");
  229. }
  230. Printf("\n");
  231. }
  232. size--;
  233. s++;
  234. pos++;
  235. }
  236. Printf("\n");
  237. for (int i = 0; i < origin_set.size(); ++i) {
  238. u32 o = origin_set.get(i);
  239. Printf("Origin %c (origin_id %x):\n", OriginSet::asChar(i), o);
  240. DescribeOrigin(o);
  241. }
  242. }
  243. void ReportUMRInsideAddressRange(const char *function, const void *start,
  244. uptr size, uptr offset) {
  245. function = StackTracePrinter::GetOrInit()->StripFunctionName(function);
  246. Decorator d;
  247. Printf("%s", d.Warning());
  248. Printf("%sUninitialized bytes in %s%s%s at offset %zu inside [%p, %zu)%s\n",
  249. d.Warning(), d.Name(), function, d.Warning(), offset, start, size,
  250. d.Default());
  251. if (__sanitizer::Verbosity())
  252. DescribeMemoryRange(start, size);
  253. }
  254. } // namespace __msan