279 lines · cpp
1//===-- asan_fuchsia.cpp -------------------------------------------------===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===---------------------------------------------------------------------===//8//9// This file is a part of AddressSanitizer, an address sanity checker.10//11// Fuchsia-specific details.12//===---------------------------------------------------------------------===//13 14#include "sanitizer_common/sanitizer_fuchsia.h"15#if SANITIZER_FUCHSIA16 17#include <limits.h>18#include <zircon/sanitizer.h>19#include <zircon/syscalls.h>20#include <zircon/threads.h>21 22# include "asan_interceptors.h"23# include "asan_internal.h"24# include "asan_stack.h"25# include "asan_thread.h"26# include "lsan/lsan_common.h"27 28namespace __sanitizer {29// ASan doesn't need to do anything else special in the startup hook.30void EarlySanitizerInit() {}31} // namespace __sanitizer32 33namespace __asan {34 35void InitializeShadowMemory() {36 // Explicitly setup shadow here right beforer any of the ShadowBounds members37 // are used.38 InitShadowBounds();39 40 if (Verbosity())41 PrintAddressSpaceLayout();42 43 // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address.44 __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;45 DCHECK(kLowShadowBeg != kDefaultShadowSentinel);46 __asan_shadow_memory_dynamic_address = kLowShadowBeg;47 48 CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1);49 CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1);50 CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit);51 CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base);52 CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1);53 CHECK_EQ(kLowShadowEnd, 0);54 CHECK_EQ(kLowShadowBeg, 0);55}56 57void AsanApplyToGlobals(globals_op_fptr op, const void *needle) {58 UNIMPLEMENTED();59}60 61void AsanCheckDynamicRTPrereqs() {}62void AsanCheckIncompatibleRT() {}63void InitializeAsanInterceptors() {}64 65void InitializePlatformExceptionHandlers() {}66void AsanOnDeadlySignal(int signo, void *siginfo, void *context) {67 UNIMPLEMENTED();68}69 70bool PlatformUnpoisonStacks() {71 // The current sp might not point to the default stack. This72 // could be because we are in a crash stack from fuzzing for example.73 // Unpoison the default stack and the current stack page.74 AsanThread *curr_thread = GetCurrentThread();75 CHECK(curr_thread != nullptr);76 uptr top = curr_thread->stack_top();77 uptr bottom = curr_thread->stack_bottom();78 // The default stack grows from top to bottom. (bottom < top).79 80 uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0));81 if (local_stack >= bottom && local_stack <= top) {82 // The current stack is the default stack.83 // We only need to unpoison from where we are using until the end.84 bottom = RoundDownTo(local_stack, GetPageSize());85 UnpoisonStack(bottom, top, "default");86 } else {87 // The current stack is not the default stack.88 // Unpoison the entire default stack and the current stack page.89 UnpoisonStack(bottom, top, "default");90 bottom = RoundDownTo(local_stack, GetPageSize());91 top = bottom + GetPageSize();92 UnpoisonStack(bottom, top, "unknown");93 return true;94 }95 96 return false;97}98 99// We can use a plain thread_local variable for TSD.100static thread_local void *per_thread;101 102void *AsanTSDGet() { return per_thread; }103 104void AsanTSDSet(void *tsd) { per_thread = tsd; }105 106// There's no initialization needed, and the passed-in destructor107// will never be called. Instead, our own thread destruction hook108// (below) will call AsanThread::TSDDtor directly.109void AsanTSDInit(void (*destructor)(void *tsd)) {110 DCHECK(destructor == &PlatformTSDDtor);111}112 113void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); }114 115static inline size_t AsanThreadMmapSize() {116 return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size());117}118 119struct AsanThread::InitOptions {120 uptr stack_bottom, stack_size;121};122 123// Shared setup between thread creation and startup for the initial thread.124static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid,125 bool detached, const char *name) {126 // In lieu of AsanThread::Create.127 AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__);128 129 u32 tid = asanThreadRegistry().CreateThread(0, detached, parent_tid, thread);130 asanThreadRegistry().SetThreadName(tid, name);131 132 return thread;133}134 135// This gets the same arguments passed to Init by CreateAsanThread, above.136// We're in the creator thread before the new thread is actually started,137// but its stack address range is already known. We don't bother tracking138// the static TLS address range because the system itself already uses an139// ASan-aware allocator for that.140void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) {141 DCHECK_NE(GetCurrentThread(), this);142 DCHECK_NE(GetCurrentThread(), nullptr);143 CHECK_NE(options->stack_bottom, 0);144 CHECK_NE(options->stack_size, 0);145 stack_bottom_ = options->stack_bottom;146 stack_top_ = options->stack_bottom + options->stack_size;147}148 149// Called by __asan::AsanInitInternal (asan_rtl.c).150AsanThread *CreateMainThread() {151 thrd_t self = thrd_current();152 char name[ZX_MAX_NAME_LEN];153 CHECK_NE(__sanitizer::MainThreadStackBase, 0);154 CHECK_GT(__sanitizer::MainThreadStackSize, 0);155 AsanThread *t = CreateAsanThread(156 nullptr, 0, true,157 _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name,158 sizeof(name)) == ZX_OK159 ? name160 : nullptr);161 // We need to set the current thread before calling AsanThread::Init() below,162 // since it reads the thread ID.163 SetCurrentThread(t);164 DCHECK_EQ(t->tid(), 0);165 166 const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase,167 __sanitizer::MainThreadStackSize};168 t->Init(&options);169 170 return t;171}172 173// This is called before each thread creation is attempted. So, in174// its first call, the calling thread is the initial and sole thread.175static void *BeforeThreadCreateHook(uptr user_id, bool detached,176 const char *name, uptr stack_bottom,177 uptr stack_size) {178 EnsureMainThreadIDIsCorrect();179 // Strict init-order checking is thread-hostile.180 if (flags()->strict_init_order)181 StopInitOrderChecking();182 183 GET_STACK_TRACE_THREAD;184 u32 parent_tid = GetCurrentTidOrInvalid();185 186 AsanThread *thread = CreateAsanThread(&stack, parent_tid, detached, name);187 188 // On other systems, AsanThread::Init() is called from the new189 // thread itself. But on Fuchsia we already know the stack address190 // range beforehand, so we can do most of the setup right now.191 const AsanThread::InitOptions options = {stack_bottom, stack_size};192 thread->Init(&options);193 return thread;194}195 196// This is called after creating a new thread (in the creating thread),197// with the pointer returned by BeforeThreadCreateHook (above).198static void ThreadCreateHook(void *hook, bool aborted) {199 AsanThread *thread = static_cast<AsanThread *>(hook);200 if (!aborted) {201 // The thread was created successfully.202 // ThreadStartHook is already running in the new thread.203 } else {204 // The thread wasn't created after all.205 // Clean up everything we set up in BeforeThreadCreateHook.206 asanThreadRegistry().FinishThread(thread->tid());207 UnmapOrDie(thread, AsanThreadMmapSize());208 }209}210 211// This is called in the newly-created thread before it runs anything else,212// with the pointer returned by BeforeThreadCreateHook (above).213// cf. asan_interceptors.cpp:asan_thread_start214static void ThreadStartHook(void *hook, uptr os_id) {215 AsanThread *thread = static_cast<AsanThread *>(hook);216 SetCurrentThread(thread);217 218 // In lieu of AsanThread::ThreadStart.219 asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular,220 nullptr);221}222 223// Each thread runs this just before it exits,224// with the pointer returned by BeforeThreadCreateHook (above).225// All per-thread destructors have already been called.226static void ThreadExitHook(void *hook, uptr os_id) {227 AsanThread::TSDDtor(per_thread);228}229 230bool HandleDlopenInit() {231 // Not supported on this platform.232 static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,233 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");234 return false;235}236 237void FlushUnneededASanShadowMemory(uptr p, uptr size) {238 __sanitizer_fill_shadow(p, size, 0, 0);239}240 241// On Fuchsia, leak detection is done by a special hook after atexit hooks.242// So this doesn't install any atexit hook like on other platforms.243void InstallAtExitCheckLeaks() {}244 245void InstallAtForkHandler() {}246 247} // namespace __asan248 249namespace __lsan {250 251bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; }252 253} // namespace __lsan254 255// These are declared (in extern "C") by <zircon/sanitizer.h>.256// The system runtime will call our definitions directly.257 258void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached,259 const char *name, void *stack_base,260 size_t stack_size) {261 return __asan::BeforeThreadCreateHook(262 reinterpret_cast<uptr>(thread), detached, name,263 reinterpret_cast<uptr>(stack_base), stack_size);264}265 266void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) {267 __asan::ThreadCreateHook(hook, error != thrd_success);268}269 270void __sanitizer_thread_start_hook(void *hook, thrd_t self) {271 __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self));272}273 274void __sanitizer_thread_exit_hook(void *hook, thrd_t self) {275 __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self));276}277 278#endif // SANITIZER_FUCHSIA279