370 lines · c
1//===-- msan.h --------------------------------------------------*- C++ -*-===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// This file is a part of MemorySanitizer.10//11// Private MSan header.12//===----------------------------------------------------------------------===//13 14#ifndef MSAN_H15#define MSAN_H16 17#include "sanitizer_common/sanitizer_flags.h"18#include "sanitizer_common/sanitizer_internal_defs.h"19#include "sanitizer_common/sanitizer_stacktrace.h"20#include "msan_interface_internal.h"21#include "msan_flags.h"22#include "ubsan/ubsan_platform.h"23 24#ifndef MSAN_REPLACE_OPERATORS_NEW_AND_DELETE25# define MSAN_REPLACE_OPERATORS_NEW_AND_DELETE 126#endif27 28#ifndef MSAN_CONTAINS_UBSAN29# define MSAN_CONTAINS_UBSAN CAN_SANITIZE_UB30#endif31 32struct MappingDesc {33 uptr start;34 uptr end;35 enum Type {36 INVALID = 1,37 ALLOCATOR = 2,38 APP = 4,39 SHADOW = 8,40 ORIGIN = 16,41 } type;42 const char *name;43};44 45// Note: MappingDesc::ALLOCATOR entries are only used to check for memory46// layout compatibility. The actual allocation settings are in47// msan_allocator.cpp, which need to be kept in sync.48#if SANITIZER_LINUX && defined(__mips64)49 50// MIPS64 maps:51// - 0x0000000000-0x0200000000: Program own segments52// - 0xa200000000-0xc000000000: PIE program segments53// - 0xe200000000-0xffffffffff: libraries segments.54const MappingDesc kMemoryLayout[] = {55 {0x000000000000ULL, 0x000200000000ULL, MappingDesc::APP, "app-1"},56 {0x000200000000ULL, 0x002200000000ULL, MappingDesc::INVALID, "invalid"},57 {0x002200000000ULL, 0x004000000000ULL, MappingDesc::SHADOW, "shadow-2"},58 {0x004000000000ULL, 0x004200000000ULL, MappingDesc::INVALID, "invalid"},59 {0x004200000000ULL, 0x006000000000ULL, MappingDesc::ORIGIN, "origin-2"},60 {0x006000000000ULL, 0x006200000000ULL, MappingDesc::INVALID, "invalid"},61 {0x006200000000ULL, 0x008000000000ULL, MappingDesc::SHADOW, "shadow-3"},62 {0x008000000000ULL, 0x008200000000ULL, MappingDesc::SHADOW, "shadow-1"},63 {0x008200000000ULL, 0x00a000000000ULL, MappingDesc::ORIGIN, "origin-3"},64 {0x00a000000000ULL, 0x00a200000000ULL, MappingDesc::ORIGIN, "origin-1"},65 {0x00a200000000ULL, 0x00c000000000ULL, MappingDesc::APP, "app-2"},66 {0x00c000000000ULL, 0x00e200000000ULL, MappingDesc::INVALID, "invalid"},67 {0x00e200000000ULL, 0x00ffffffffffULL, MappingDesc::APP, "app-3"}};68 69#define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x8000000000ULL)70#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x2000000000ULL)71 72#elif SANITIZER_LINUX && defined(__aarch64__)73 74// The mapping assumes 48-bit VMA. AArch64 maps:75// - 0x0000000000000-0x0100000000000: 39/42/48-bits program own segments76// - 0x0a00000000000-0x0b00000000000: 48-bits PIE program segments77// Ideally, this would extend to 0x0c00000000000 (2^45 bytes - the78// maximum ASLR region for 48-bit VMA) but it is too hard to fit in79// the larger app/shadow/origin regions.80// - 0x0e00000000000-0x1000000000000: 48-bits libraries segments81const MappingDesc kMemoryLayout[] = {82 {0X0000000000000, 0X0100000000000, MappingDesc::APP, "app-10-13"},83 {0X0100000000000, 0X0200000000000, MappingDesc::SHADOW, "shadow-14"},84 {0X0200000000000, 0X0300000000000, MappingDesc::INVALID, "invalid"},85 {0X0300000000000, 0X0400000000000, MappingDesc::ORIGIN, "origin-14"},86 {0X0400000000000, 0X0600000000000, MappingDesc::SHADOW, "shadow-15"},87 {0X0600000000000, 0X0800000000000, MappingDesc::ORIGIN, "origin-15"},88 {0X0800000000000, 0X0A00000000000, MappingDesc::INVALID, "invalid"},89 {0X0A00000000000, 0X0B00000000000, MappingDesc::APP, "app-14"},90 {0X0B00000000000, 0X0C00000000000, MappingDesc::SHADOW, "shadow-10-13"},91 {0X0C00000000000, 0X0D00000000000, MappingDesc::INVALID, "invalid"},92 {0X0D00000000000, 0X0E00000000000, MappingDesc::ORIGIN, "origin-10-13"},93 {0x0E00000000000, 0x0E40000000000, MappingDesc::ALLOCATOR, "allocator"},94 {0X0E40000000000, 0X1000000000000, MappingDesc::APP, "app-15"},95};96# define MEM_TO_SHADOW(mem) ((uptr)mem ^ 0xB00000000000ULL)97# define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x200000000000ULL)98 99#elif SANITIZER_LINUX && SANITIZER_LOONGARCH64100// LoongArch64 maps:101// - 0x000000000000-0x010000000000: Program own segments102// - 0x555500000000-0x555600000000: PIE program segments103// - 0x7fff00000000-0x7fffffffffff: libraries segments.104const MappingDesc kMemoryLayout[] = {105 {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app-1"},106 {0x010000000000ULL, 0x100000000000ULL, MappingDesc::SHADOW, "shadow-2"},107 {0x100000000000ULL, 0x110000000000ULL, MappingDesc::INVALID, "invalid"},108 {0x110000000000ULL, 0x200000000000ULL, MappingDesc::ORIGIN, "origin-2"},109 {0x200000000000ULL, 0x300000000000ULL, MappingDesc::SHADOW, "shadow-3"},110 {0x300000000000ULL, 0x400000000000ULL, MappingDesc::ORIGIN, "origin-3"},111 {0x400000000000ULL, 0x500000000000ULL, MappingDesc::INVALID, "invalid"},112 {0x500000000000ULL, 0x510000000000ULL, MappingDesc::SHADOW, "shadow-1"},113 {0x510000000000ULL, 0x600000000000ULL, MappingDesc::APP, "app-2"},114 {0x600000000000ULL, 0x610000000000ULL, MappingDesc::ORIGIN, "origin-1"},115 {0x610000000000ULL, 0x700000000000ULL, MappingDesc::INVALID, "invalid"},116 {0x700000000000ULL, 0x740000000000ULL, MappingDesc::ALLOCATOR, "allocator"},117 {0x740000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app-3"}};118# define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x500000000000ULL)119# define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x100000000000ULL)120 121#elif SANITIZER_LINUX && SANITIZER_PPC64122const MappingDesc kMemoryLayout[] = {123 {0x000000000000ULL, 0x000200000000ULL, MappingDesc::APP, "low memory"},124 {0x000200000000ULL, 0x080000000000ULL, MappingDesc::INVALID, "invalid"},125 {0x080000000000ULL, 0x180200000000ULL, MappingDesc::SHADOW, "shadow"},126 {0x180200000000ULL, 0x1C0000000000ULL, MappingDesc::INVALID, "invalid"},127 {0x1C0000000000ULL, 0x2C0200000000ULL, MappingDesc::ORIGIN, "origin"},128 {0x2C0200000000ULL, 0x300000000000ULL, MappingDesc::INVALID, "invalid"},129 {0x300000000000ULL, 0x320000000000ULL, MappingDesc::ALLOCATOR, "allocator"},130 {0x320000000000ULL, 0x800000000000ULL, MappingDesc::APP, "high memory"}};131 132// Various kernels use different low end ranges but we can combine them into one133// big range. They also use different high end ranges but we can map them all to134// one range.135// Maps low and high app ranges to contiguous space with zero base:136// Low: 0000 0000 0000 - 0001 ffff ffff -> 1000 0000 0000 - 1001 ffff ffff137// High: 3000 0000 0000 - 3fff ffff ffff -> 0000 0000 0000 - 0fff ffff ffff138// High: 4000 0000 0000 - 4fff ffff ffff -> 0000 0000 0000 - 0fff ffff ffff139// High: 7000 0000 0000 - 7fff ffff ffff -> 0000 0000 0000 - 0fff ffff ffff140#define LINEARIZE_MEM(mem) \141 (((uptr)(mem) & ~0xE00000000000ULL) ^ 0x100000000000ULL)142#define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x080000000000ULL)143#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x140000000000ULL)144 145#elif SANITIZER_LINUX && SANITIZER_S390_64146const MappingDesc kMemoryLayout[] = {147 {0x000000000000ULL, 0x040000000000ULL, MappingDesc::APP, "low memory"},148 {0x040000000000ULL, 0x080000000000ULL, MappingDesc::INVALID, "invalid"},149 {0x080000000000ULL, 0x180000000000ULL, MappingDesc::SHADOW, "shadow"},150 {0x180000000000ULL, 0x1C0000000000ULL, MappingDesc::INVALID, "invalid"},151 {0x1C0000000000ULL, 0x2C0000000000ULL, MappingDesc::ORIGIN, "origin"},152 {0x2C0000000000ULL, 0x440000000000ULL, MappingDesc::INVALID, "invalid"},153 {0x440000000000ULL, 0x460000000000ULL, MappingDesc::ALLOCATOR, "allocator"},154 {0x460000000000ULL, 0x500000000000ULL, MappingDesc::APP, "high memory"}};155 156#define MEM_TO_SHADOW(mem) \157 ((((uptr)(mem)) & ~0xC00000000000ULL) + 0x080000000000ULL)158#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x140000000000ULL)159 160#elif SANITIZER_FREEBSD && defined(__aarch64__)161 162// Low memory: main binary, MAP_32BIT mappings and modules163// High memory: heap, modules and main thread stack164const MappingDesc kMemoryLayout[] = {165 {0x000000000000ULL, 0x020000000000ULL, MappingDesc::APP, "low memory"},166 {0x020000000000ULL, 0x200000000000ULL, MappingDesc::INVALID, "invalid"},167 {0x200000000000ULL, 0x620000000000ULL, MappingDesc::SHADOW, "shadow"},168 {0x620000000000ULL, 0x700000000000ULL, MappingDesc::INVALID, "invalid"},169 {0x700000000000ULL, 0xb20000000000ULL, MappingDesc::ORIGIN, "origin"},170 {0xb20000000000ULL, 0xc00000000000ULL, MappingDesc::INVALID, "invalid"},171 {0xc00000000000ULL, 0x1000000000000ULL, MappingDesc::APP, "high memory"}};172 173// Maps low and high app ranges to contiguous space with zero base:174// Low: 0000 0000 0000 - 01ff ffff ffff -> 4000 0000 0000 - 41ff ffff ffff175// High: c000 0000 0000 - ffff ffff ffff -> 0000 0000 0000 - 3fff ffff ffff176#define LINEARIZE_MEM(mem) \177 (((uptr)(mem) & ~0x1800000000000ULL) ^ 0x400000000000ULL)178#define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x200000000000ULL)179#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x500000000000)180 181#elif SANITIZER_FREEBSD && SANITIZER_WORDSIZE == 64182 183// Low memory: main binary, MAP_32BIT mappings and modules184// High memory: heap, modules and main thread stack185const MappingDesc kMemoryLayout[] = {186 {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "low memory"},187 {0x010000000000ULL, 0x100000000000ULL, MappingDesc::INVALID, "invalid"},188 {0x100000000000ULL, 0x310000000000ULL, MappingDesc::SHADOW, "shadow"},189 {0x310000000000ULL, 0x380000000000ULL, MappingDesc::INVALID, "invalid"},190 {0x380000000000ULL, 0x590000000000ULL, MappingDesc::ORIGIN, "origin"},191 {0x590000000000ULL, 0x600000000000ULL, MappingDesc::INVALID, "invalid"},192 {0x600000000000ULL, 0x800000000000ULL, MappingDesc::APP, "high memory"}};193 194// Maps low and high app ranges to contiguous space with zero base:195// Low: 0000 0000 0000 - 00ff ffff ffff -> 2000 0000 0000 - 20ff ffff ffff196// High: 6000 0000 0000 - 7fff ffff ffff -> 0000 0000 0000 - 1fff ffff ffff197#define LINEARIZE_MEM(mem) \198 (((uptr)(mem) & ~0xc00000000000ULL) ^ 0x200000000000ULL)199#define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x100000000000ULL)200#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x280000000000)201 202#elif SANITIZER_NETBSD || (SANITIZER_LINUX && SANITIZER_WORDSIZE == 64)203 204// All of the following configurations are supported.205// ASLR disabled: main executable and DSOs at 0x555550000000206// PIE and ASLR: main executable and DSOs at 0x7f0000000000207// non-PIE: main executable below 0x100000000, DSOs at 0x7f0000000000208// Heap at 0x700000000000.209const MappingDesc kMemoryLayout[] = {210 {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app-1"},211 {0x010000000000ULL, 0x100000000000ULL, MappingDesc::SHADOW, "shadow-2"},212 {0x100000000000ULL, 0x110000000000ULL, MappingDesc::INVALID, "invalid"},213 {0x110000000000ULL, 0x200000000000ULL, MappingDesc::ORIGIN, "origin-2"},214 {0x200000000000ULL, 0x300000000000ULL, MappingDesc::SHADOW, "shadow-3"},215 {0x300000000000ULL, 0x400000000000ULL, MappingDesc::ORIGIN, "origin-3"},216 {0x400000000000ULL, 0x500000000000ULL, MappingDesc::INVALID, "invalid"},217 {0x500000000000ULL, 0x510000000000ULL, MappingDesc::SHADOW, "shadow-1"},218 {0x510000000000ULL, 0x600000000000ULL, MappingDesc::APP, "app-2"},219 {0x600000000000ULL, 0x610000000000ULL, MappingDesc::ORIGIN, "origin-1"},220 {0x610000000000ULL, 0x700000000000ULL, MappingDesc::INVALID, "invalid"},221 {0x700000000000ULL, 0x740000000000ULL, MappingDesc::ALLOCATOR, "allocator"},222 {0x740000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app-3"}};223#define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x500000000000ULL)224#define SHADOW_TO_ORIGIN(mem) (((uptr)(mem)) + 0x100000000000ULL)225 226#else227#error "Unsupported platform"228#endif229 230const uptr kMemoryLayoutSize = sizeof(kMemoryLayout) / sizeof(kMemoryLayout[0]);231 232#define MEM_TO_ORIGIN(mem) (SHADOW_TO_ORIGIN(MEM_TO_SHADOW((mem))))233 234#ifndef __clang__235__attribute__((optimize("unroll-loops")))236#endif237inline bool238addr_is_type(uptr addr, int mapping_types) {239// It is critical for performance that this loop is unrolled (because then it is240// simplified into just a few constant comparisons).241#ifdef __clang__242#pragma unroll243#endif244 for (unsigned i = 0; i < kMemoryLayoutSize; ++i)245 if ((kMemoryLayout[i].type & mapping_types) &&246 addr >= kMemoryLayout[i].start && addr < kMemoryLayout[i].end)247 return true;248 return false;249}250 251#define MEM_IS_APP(mem) \252 (addr_is_type((uptr)(mem), MappingDesc::APP | MappingDesc::ALLOCATOR))253#define MEM_IS_SHADOW(mem) addr_is_type((uptr)(mem), MappingDesc::SHADOW)254#define MEM_IS_ORIGIN(mem) addr_is_type((uptr)(mem), MappingDesc::ORIGIN)255 256// These constants must be kept in sync with the ones in MemorySanitizer.cpp.257const int kMsanParamTlsSize = 800;258const int kMsanRetvalTlsSize = 800;259 260namespace __msan {261extern int msan_inited;262extern bool msan_init_is_running;263extern int msan_report_count;264 265bool ProtectRange(uptr beg, uptr end);266bool InitShadowWithReExec(bool init_origins);267char *GetProcSelfMaps();268void InitializeInterceptors();269 270void MsanAllocatorInit();271void MsanDeallocate(BufferedStackTrace *stack, void *ptr);272 273void *msan_malloc(uptr size, BufferedStackTrace *stack);274void *msan_calloc(uptr nmemb, uptr size, BufferedStackTrace *stack);275void *msan_realloc(void *ptr, uptr size, BufferedStackTrace *stack);276void *msan_reallocarray(void *ptr, uptr nmemb, uptr size,277 BufferedStackTrace *stack);278void *msan_valloc(uptr size, BufferedStackTrace *stack);279void *msan_pvalloc(uptr size, BufferedStackTrace *stack);280void *msan_aligned_alloc(uptr alignment, uptr size, BufferedStackTrace *stack);281void *msan_memalign(uptr alignment, uptr size, BufferedStackTrace *stack);282int msan_posix_memalign(void **memptr, uptr alignment, uptr size,283 BufferedStackTrace *stack);284 285void InstallTrapHandler();286void InstallAtExitHandler();287 288const char *GetStackOriginDescr(u32 id, uptr *pc);289 290bool IsInSymbolizerOrUnwider();291 292void PrintWarning(uptr pc, uptr bp);293void PrintWarningWithOrigin(uptr pc, uptr bp, u32 origin);294 295// Unpoison first n function arguments.296void UnpoisonParam(uptr n);297void UnpoisonThreadLocalState();298 299// Returns a "chained" origin id, pointing to the given stack trace followed by300// the previous origin id.301u32 ChainOrigin(u32 id, StackTrace *stack);302 303const int STACK_TRACE_TAG_POISON = StackTrace::TAG_CUSTOM + 1;304const int STACK_TRACE_TAG_FIELDS = STACK_TRACE_TAG_POISON + 1;305const int STACK_TRACE_TAG_VPTR = STACK_TRACE_TAG_FIELDS + 1;306const int STACK_TRACE_TAG_ALLOC_PADDING = STACK_TRACE_TAG_VPTR + 1;307 308#define GET_MALLOC_STACK_TRACE \309 UNINITIALIZED BufferedStackTrace stack; \310 if (__msan_get_track_origins() && msan_inited) { \311 stack.Unwind(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME(), nullptr, \312 common_flags()->fast_unwind_on_malloc, \313 common_flags()->malloc_context_size); \314 }315 316// For platforms which support slow unwinder only, we restrict the store context317// size to 1, basically only storing the current pc. We do this because the slow318// unwinder which is based on libunwind is not async signal safe and causes319// random freezes in forking applications as well as in signal handlers.320#define GET_STORE_STACK_TRACE_PC_BP(pc, bp) \321 UNINITIALIZED BufferedStackTrace stack; \322 if (__msan_get_track_origins() > 1 && msan_inited) { \323 int size = flags()->store_context_size; \324 if (!SANITIZER_CAN_FAST_UNWIND) \325 size = Min(size, 1); \326 stack.Unwind(pc, bp, nullptr, common_flags()->fast_unwind_on_malloc, \327 size); \328 }329 330#define GET_STORE_STACK_TRACE \331 GET_STORE_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())332 333#define GET_FATAL_STACK_TRACE_PC_BP(pc, bp) \334 UNINITIALIZED BufferedStackTrace stack; \335 if (msan_inited) { \336 stack.Unwind(pc, bp, nullptr, common_flags()->fast_unwind_on_fatal); \337 }338 339#define GET_FATAL_STACK_TRACE \340 GET_FATAL_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())341 342// Unwind the stack for fatal error, as the parameter `stack` is343// empty without origins.344#define GET_FATAL_STACK_TRACE_IF_EMPTY(STACK) \345 if (msan_inited && (STACK)->size == 0) { \346 (STACK)->Unwind(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME(), nullptr, \347 common_flags()->fast_unwind_on_fatal); \348 }349 350class ScopedThreadLocalStateBackup {351 public:352 ScopedThreadLocalStateBackup() { Backup(); }353 ~ScopedThreadLocalStateBackup() { Restore(); }354 void Backup();355 void Restore();356 private:357 u64 va_arg_overflow_size_tls;358};359 360void MsanTSDInit(void (*destructor)(void *tsd));361void *MsanTSDGet();362void MsanTSDSet(void *tsd);363void MsanTSDDtor(void *tsd);364 365void InstallAtForkHandler();366 367} // namespace __msan368 369#endif // MSAN_H370