407 lines · c
1//===-- interception.h ------------------------------------------*- C++ -*-===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// This file is a part of AddressSanitizer, an address sanity checker.10//11// Machinery for providing replacements/wrappers for system functions.12//===----------------------------------------------------------------------===//13 14#ifndef INTERCEPTION_H15#define INTERCEPTION_H16 17#include "sanitizer_common/sanitizer_asm.h"18#include "sanitizer_common/sanitizer_internal_defs.h"19 20#if !SANITIZER_LINUX && !SANITIZER_FREEBSD && !SANITIZER_APPLE && \21 !SANITIZER_NETBSD && !SANITIZER_WINDOWS && !SANITIZER_FUCHSIA && \22 !SANITIZER_SOLARIS && !SANITIZER_HAIKU && !SANITIZER_AIX23# error "Interception doesn't work on this operating system."24#endif25 26// These typedefs should be used only in the interceptor definitions to replace27// the standard system types (e.g. SSIZE_T instead of ssize_t)28// On Windows the system headers (basetsd.h) provide a conflicting definition29// of SIZE_T/SSIZE_T that do not match the real size_t/ssize_t for 32-bit30// systems (using long instead of the expected int). Work around the typedef31// redefinition by #defining SIZE_T instead of using a typedef.32// TODO: We should be using __sanitizer::usize (and a new ssize) instead of33// these new macros as long as we ensure they match the real system definitions.34#if SANITIZER_WINDOWS35// Ensure that (S)SIZE_T were already defined as we are about to override them.36# include <basetsd.h>37#endif38 39#define SIZE_T __sanitizer::usize40#define SSIZE_T __sanitizer::ssize41typedef __sanitizer::sptr PTRDIFF_T;42typedef __sanitizer::s64 INTMAX_T;43typedef __sanitizer::u64 UINTMAX_T;44typedef __sanitizer::OFF_T OFF_T;45typedef __sanitizer::OFF64_T OFF64_T;46 47// How to add an interceptor:48// Suppose you need to wrap/replace system function (generally, from libc):49// int foo(const char *bar, double baz);50// You'll need to:51// 1) define INTERCEPTOR(int, foo, const char *bar, double baz) { ... } in52// your source file. See the notes below for cases when53// INTERCEPTOR_WITH_SUFFIX(...) should be used instead.54// 2) Call "INTERCEPT_FUNCTION(foo)" prior to the first call of "foo".55// INTERCEPT_FUNCTION(foo) evaluates to "true" iff the function was56// intercepted successfully.57// You can access original function by calling REAL(foo)(bar, baz).58// By default, REAL(foo) will be visible only inside your interceptor, and if59// you want to use it in other parts of RTL, you'll need to:60// 3a) add DECLARE_REAL(int, foo, const char*, double) to a61// header file.62// However, if the call "INTERCEPT_FUNCTION(foo)" and definition for63// INTERCEPTOR(..., foo, ...) are in different files, you'll instead need to:64// 3b) add DECLARE_REAL_AND_INTERCEPTOR(int, foo, const char*, double)65// to a header file.66 67// Notes: 1. Things may not work properly if macro INTERCEPTOR(...) {...} or68// DECLARE_REAL(...) are located inside namespaces.69// 2. On Mac you can also use: "OVERRIDE_FUNCTION(foo, zoo)" to70// effectively redirect calls from "foo" to "zoo". In this case71// you aren't required to implement72// INTERCEPTOR(int, foo, const char *bar, double baz) {...}73// but instead you'll have to add74// DECLARE_REAL(int, foo, const char *bar, double baz) in your75// source file (to define a pointer to overriden function).76// 3. Some Mac functions have symbol variants discriminated by77// additional suffixes, e.g. _$UNIX2003 (see78// https://developer.apple.com/library/mac/#releasenotes/Darwin/SymbolVariantsRelNotes/index.html79// for more details). To intercept such functions you need to use the80// INTERCEPTOR_WITH_SUFFIX(...) macro.81 82// How it works on Linux83// ---------------------84//85// To replace system functions on Linux we just need to declare functions with86// the same names in our library and then obtain the real function pointers87// using dlsym().88//89// There is one complication: a user may also intercept some of the functions we90// intercept. To allow for up to 3 interceptors (including ours) of a given91// function "func", the interceptor implementation is in ___interceptor_func,92// which is aliased by a weak function __interceptor_func, which in turn is93// aliased (via a trampoline) by weak wrapper function "func".94//95// Most user interceptors should define a foreign interceptor as follows:96//97// - provide a non-weak function "func" that performs interception;98// - if __interceptor_func exists, call it to perform the real functionality;99// - if it does not exist, figure out the real function and call it instead.100//101// In rare cases, a foreign interceptor (of another dynamic analysis runtime)102// may be defined as follows (on supported architectures):103//104// - provide a non-weak function __interceptor_func that performs interception;105// - if ___interceptor_func exists, call it to perform the real functionality;106// - if it does not exist, figure out the real function and call it instead;107// - provide a weak function "func" that is an alias to __interceptor_func.108//109// With this protocol, sanitizer interceptors, foreign user interceptors, and110// foreign interceptors of other dynamic analysis runtimes, or any combination111// thereof, may co-exist simultaneously.112//113// How it works on Mac OS114// ----------------------115//116// This is not so on Mac OS, where the two-level namespace makes our replacement117// functions invisible to other libraries. This may be overcomed using the118// DYLD_FORCE_FLAT_NAMESPACE, but some errors loading the shared libraries in119// Chromium were noticed when doing so.120//121// Instead we create a dylib containing a __DATA,__interpose section that122// associates library functions with their wrappers. When this dylib is123// preloaded before an executable using DYLD_INSERT_LIBRARIES, it routes all the124// calls to interposed functions done through stubs to the wrapper functions.125//126// As it's decided at compile time which functions are to be intercepted on Mac,127// INTERCEPT_FUNCTION() is effectively a no-op on this system.128 129#if SANITIZER_APPLE130#include <sys/cdefs.h> // For __DARWIN_ALIAS_C().131 132// Just a pair of pointers.133struct interpose_substitution {134 const __sanitizer::uptr replacement;135 const __sanitizer::uptr original;136};137 138// For a function foo() create a global pair of pointers { wrap_foo, foo } in139// the __DATA,__interpose section.140// As a result all the calls to foo() will be routed to wrap_foo() at runtime.141#define INTERPOSER(func_name) __attribute__((used)) \142const interpose_substitution substitution_##func_name[] \143 __attribute__((section("__DATA, __interpose"))) = { \144 { reinterpret_cast<const uptr>(WRAP(func_name)), \145 reinterpret_cast<const uptr>(func_name) } \146}147 148// For a function foo() and a wrapper function bar() create a global pair149// of pointers { bar, foo } in the __DATA,__interpose section.150// As a result all the calls to foo() will be routed to bar() at runtime.151#define INTERPOSER_2(func_name, wrapper_name) __attribute__((used)) \152const interpose_substitution substitution_##func_name[] \153 __attribute__((section("__DATA, __interpose"))) = { \154 { reinterpret_cast<const uptr>(wrapper_name), \155 reinterpret_cast<const uptr>(func_name) } \156}157 158# define WRAP(x) wrap_##x159# define TRAMPOLINE(x) WRAP(x)160# define INTERCEPTOR_ATTRIBUTE161# define DECLARE_WRAPPER(ret_type, func, ...)162 163#elif SANITIZER_WINDOWS164# define WRAP(x) __asan_wrap_##x165# define TRAMPOLINE(x) WRAP(x)166# define INTERCEPTOR_ATTRIBUTE __declspec(dllexport)167# define DECLARE_WRAPPER(ret_type, func, ...) \168 extern "C" ret_type func(__VA_ARGS__);169# define DECLARE_WRAPPER_WINAPI(ret_type, func, ...) \170 extern "C" __declspec(dllimport) ret_type __stdcall func(__VA_ARGS__);171#elif SANITIZER_AIX172# define WRAP(x) __interceptor_##x173# define TRAMPOLINE(x) WRAP(x)174// # define WRAPPER_NAME(x) "__interceptor_" #x175# define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))176// AIX's linker will not select the weak symbol, so don't use weak for the177// interceptors.178# define DECLARE_WRAPPER(ret_type, func, ...) \179 extern "C" ret_type func(__VA_ARGS__) \180 __attribute__((alias("__interceptor_" #func), visibility("default")));181#elif !SANITIZER_FUCHSIA // LINUX, FREEBSD, NETBSD, SOLARIS182# define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))183# if ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT184// Weak aliases of weak aliases do not work, therefore we need to set up a185// trampoline function. The function "func" is a weak alias to the trampoline186// (so that we may check if "func" was overridden), which calls the weak187// function __interceptor_func, which in turn aliases the actual interceptor188// implementation ___interceptor_func:189//190// [wrapper "func": weak] --(alias)--> [TRAMPOLINE(func)]191// |192// +--------(tail call)-------+193// |194// v195// [__interceptor_func: weak] --(alias)--> [WRAP(func)]196//197// We use inline assembly to define most of this, because not all compilers198// support functions with the "naked" attribute with every architecture.199# define WRAP(x) ___interceptor_ ## x200# define TRAMPOLINE(x) __interceptor_trampoline_ ## x201# if SANITIZER_FREEBSD || SANITIZER_NETBSD202// FreeBSD's dynamic linker (incompliantly) gives non-weak symbols higher203// priority than weak ones so weak aliases won't work for indirect calls204// in position-independent (-fPIC / -fPIE) mode.205# define __ASM_WEAK_WRAPPER(func) ".globl " #func "\n"206# else207# define __ASM_WEAK_WRAPPER(func) ".weak " #func "\n"208# endif // SANITIZER_FREEBSD || SANITIZER_NETBSD209# if defined(__arm__) || defined(__aarch64__)210# define ASM_TYPE_FUNCTION_STR "%function"211# else212# define ASM_TYPE_FUNCTION_STR "@function"213# endif214// Keep trampoline implementation in sync with sanitizer_common/sanitizer_asm.h215# define DECLARE_WRAPPER(ret_type, func, ...) \216 extern "C" ret_type func(__VA_ARGS__); \217 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \218 extern "C" ret_type __interceptor_##func(__VA_ARGS__) \219 INTERCEPTOR_ATTRIBUTE __attribute__((weak)) ALIAS(WRAP(func)); \220 asm( \221 ".text\n" \222 __ASM_WEAK_WRAPPER(func) \223 ".set " #func ", " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \224 ".globl " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \225 ".type " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \226 ASM_TYPE_FUNCTION_STR "\n" \227 SANITIZER_STRINGIFY(TRAMPOLINE(func)) ":\n" \228 C_ASM_STARTPROC "\n" \229 C_ASM_TAIL_CALL(SANITIZER_STRINGIFY(TRAMPOLINE(func)), \230 "__interceptor_" \231 SANITIZER_STRINGIFY(ASM_PREEMPTIBLE_SYM(func))) "\n" \232 C_ASM_ENDPROC "\n" \233 ".size " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \234 ".-" SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \235 );236# else // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT237// Some architectures cannot implement efficient interceptor trampolines with238// just a plain jump due to complexities of resolving a preemptible symbol. In239// those cases, revert to just this scheme:240//241// [wrapper "func": weak] --(alias)--> [WRAP(func)]242//243# define WRAP(x) __interceptor_ ## x244# define TRAMPOLINE(x) WRAP(x)245# if SANITIZER_FREEBSD || SANITIZER_NETBSD246# define __ATTRIBUTE_WEAK_WRAPPER247# else248# define __ATTRIBUTE_WEAK_WRAPPER __attribute__((weak))249# endif // SANITIZER_FREEBSD || SANITIZER_NETBSD250# define DECLARE_WRAPPER(ret_type, func, ...) \251 extern "C" ret_type func(__VA_ARGS__) \252 INTERCEPTOR_ATTRIBUTE __ATTRIBUTE_WEAK_WRAPPER ALIAS(WRAP(func));253# endif // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT254#endif255 256#if SANITIZER_FUCHSIA257// There is no general interception at all on Fuchsia.258// Sanitizer runtimes just define functions directly to preempt them,259// and have bespoke ways to access the underlying libc functions.260# include <zircon/sanitizer.h>261# define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))262# define REAL(x) __unsanitized_##x263# define DECLARE_REAL(ret_type, func, ...)264#elif !SANITIZER_APPLE265# define PTR_TO_REAL(x) real_##x266# define REAL(x) __interception::PTR_TO_REAL(x)267# define FUNC_TYPE(x) x##_type268 269# define DECLARE_REAL(ret_type, func, ...) \270 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \271 namespace __interception { \272 extern FUNC_TYPE(func) PTR_TO_REAL(func); \273 }274# define ASSIGN_REAL(dst, src) REAL(dst) = REAL(src)275#else // SANITIZER_APPLE276# define REAL(x) x277# define DECLARE_REAL(ret_type, func, ...) \278 extern "C" ret_type func(__VA_ARGS__);279# define ASSIGN_REAL(x, y)280#endif // SANITIZER_APPLE281 282#if !SANITIZER_FUCHSIA283# define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) \284 DECLARE_REAL(ret_type, func, __VA_ARGS__) \285 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \286 extern "C" ret_type WRAP(func)(__VA_ARGS__);287// Declare an interceptor and its wrapper defined in a different translation288// unit (ex. asm).289# define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) \290 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \291 extern "C" ret_type WRAP(func)(__VA_ARGS__); \292 extern "C" ret_type func(__VA_ARGS__);293#else294# define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...)295# define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...)296#endif297 298// Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR299// macros does its job. In exceptional cases you may need to call REAL(foo)300// without defining INTERCEPTOR(..., foo, ...). For example, if you override301// foo with an interceptor for other function.302#if !SANITIZER_APPLE && !SANITIZER_FUCHSIA303# define DEFINE_REAL(ret_type, func, ...) \304 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \305 namespace __interception { \306 FUNC_TYPE(func) PTR_TO_REAL(func); \307 }308#else309# define DEFINE_REAL(ret_type, func, ...)310#endif311 312#if SANITIZER_FUCHSIA313 314// We need to define the __interceptor_func name just to get315// sanitizer_common/scripts/gen_dynamic_list.py to export func.316// But we don't need to export __interceptor_func to get that.317#define INTERCEPTOR(ret_type, func, ...) \318 extern "C"[[ gnu::alias(#func), gnu::visibility("hidden") ]] ret_type \319 __interceptor_##func(__VA_ARGS__); \320 extern "C" INTERCEPTOR_ATTRIBUTE ret_type func(__VA_ARGS__)321 322#elif !SANITIZER_APPLE323 324#define INTERCEPTOR(ret_type, func, ...) \325 DEFINE_REAL(ret_type, func, __VA_ARGS__) \326 DECLARE_WRAPPER(ret_type, func, __VA_ARGS__) \327 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__)328 329// We don't need INTERCEPTOR_WITH_SUFFIX on non-Darwin for now.330#define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \331 INTERCEPTOR(ret_type, func, __VA_ARGS__)332 333#else // SANITIZER_APPLE334 335#define INTERCEPTOR_ZZZ(suffix, ret_type, func, ...) \336 extern "C" ret_type func(__VA_ARGS__) suffix; \337 extern "C" ret_type WRAP(func)(__VA_ARGS__); \338 INTERPOSER(func); \339 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__)340 341#define INTERCEPTOR(ret_type, func, ...) \342 INTERCEPTOR_ZZZ(/*no symbol variants*/, ret_type, func, __VA_ARGS__)343 344#define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \345 INTERCEPTOR_ZZZ(__DARWIN_ALIAS_C(func), ret_type, func, __VA_ARGS__)346 347// Override |overridee| with |overrider|.348#define OVERRIDE_FUNCTION(overridee, overrider) \349 INTERPOSER_2(overridee, WRAP(overrider))350#endif351 352#if SANITIZER_WINDOWS353# define INTERCEPTOR_WINAPI(ret_type, func, ...) \354 typedef ret_type (__stdcall *FUNC_TYPE(func))(__VA_ARGS__); \355 namespace __interception { \356 FUNC_TYPE(func) PTR_TO_REAL(func); \357 } \358 extern "C" INTERCEPTOR_ATTRIBUTE ret_type __stdcall WRAP(func)(__VA_ARGS__)359#endif360 361// ISO C++ forbids casting between pointer-to-function and pointer-to-object,362// so we use casts via uintptr_t (the local __sanitizer::uptr equivalent).363namespace __interception {364 365#if defined(__ELF__) && !SANITIZER_FUCHSIA366// The use of interceptors makes many sanitizers unusable for static linking.367// Define a function, if called, will cause a linker error (undefined _DYNAMIC).368// However, -static-pie (which is not common) cannot be detected at link time.369extern uptr kDynamic[] asm("_DYNAMIC");370inline void DoesNotSupportStaticLinking() {371 [[maybe_unused]] volatile auto x = &kDynamic;372}373#else374inline void DoesNotSupportStaticLinking() {}375#endif376} // namespace __interception377 378#define INCLUDED_FROM_INTERCEPTION_LIB379 380#if SANITIZER_AIX381# include "interception_aix.h"382# define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_AIX(func)383# define INTERCEPT_FUNCTION_VER(func, symver) INTERCEPT_FUNCTION_AIX(func)384 385#elif SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_NETBSD || \386 SANITIZER_SOLARIS || SANITIZER_HAIKU387 388# include "interception_linux.h"389# define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_LINUX_OR_FREEBSD(func)390# define INTERCEPT_FUNCTION_VER(func, symver) \391 INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver)392#elif SANITIZER_APPLE393# include "interception_mac.h"394# define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_MAC(func)395# define INTERCEPT_FUNCTION_VER(func, symver) \396 INTERCEPT_FUNCTION_VER_MAC(func, symver)397#elif SANITIZER_WINDOWS398# include "interception_win.h"399# define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_WIN(func)400# define INTERCEPT_FUNCTION_VER(func, symver) \401 INTERCEPT_FUNCTION_VER_WIN(func, symver)402#endif403 404#undef INCLUDED_FROM_INTERCEPTION_LIB405 406#endif // INTERCEPTION_H407