1 //===-- interception.h ------------------------------------------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file is a part of AddressSanitizer, an address sanity checker.
10 //
11 // Machinery for providing replacements/wrappers for system functions.
12 //===----------------------------------------------------------------------===//
13
14 #ifndef INTERCEPTION_H
15 #define INTERCEPTION_H
16
17 #include "sanitizer_common/sanitizer_asm.h"
18 #include "sanitizer_common/sanitizer_internal_defs.h"
19
20 #if !SANITIZER_LINUX && !SANITIZER_FREEBSD && !SANITIZER_APPLE && \
21 !SANITIZER_NETBSD && !SANITIZER_WINDOWS && !SANITIZER_FUCHSIA && \
22 !SANITIZER_SOLARIS
23 # error "Interception doesn't work on this operating system."
24 #endif
25
26 // These typedefs should be used only in the interceptor definitions to replace
27 // the standard system types (e.g. SSIZE_T instead of ssize_t)
28 typedef __sanitizer::uptr SIZE_T;
29 typedef __sanitizer::sptr SSIZE_T;
30 typedef __sanitizer::sptr PTRDIFF_T;
31 typedef __sanitizer::s64 INTMAX_T;
32 typedef __sanitizer::u64 UINTMAX_T;
33 typedef __sanitizer::OFF_T OFF_T;
34 typedef __sanitizer::OFF64_T OFF64_T;
35
36 // How to add an interceptor:
37 // Suppose you need to wrap/replace system function (generally, from libc):
38 // int foo(const char *bar, double baz);
39 // You'll need to:
40 // 1) define INTERCEPTOR(int, foo, const char *bar, double baz) { ... } in
41 // your source file. See the notes below for cases when
42 // INTERCEPTOR_WITH_SUFFIX(...) should be used instead.
43 // 2) Call "INTERCEPT_FUNCTION(foo)" prior to the first call of "foo".
44 // INTERCEPT_FUNCTION(foo) evaluates to "true" iff the function was
45 // intercepted successfully.
46 // You can access original function by calling REAL(foo)(bar, baz).
47 // By default, REAL(foo) will be visible only inside your interceptor, and if
48 // you want to use it in other parts of RTL, you'll need to:
49 // 3a) add DECLARE_REAL(int, foo, const char*, double) to a
50 // header file.
51 // However, if the call "INTERCEPT_FUNCTION(foo)" and definition for
52 // INTERCEPTOR(..., foo, ...) are in different files, you'll instead need to:
53 // 3b) add DECLARE_REAL_AND_INTERCEPTOR(int, foo, const char*, double)
54 // to a header file.
55
56 // Notes: 1. Things may not work properly if macro INTERCEPTOR(...) {...} or
57 // DECLARE_REAL(...) are located inside namespaces.
58 // 2. On Mac you can also use: "OVERRIDE_FUNCTION(foo, zoo)" to
59 // effectively redirect calls from "foo" to "zoo". In this case
60 // you aren't required to implement
61 // INTERCEPTOR(int, foo, const char *bar, double baz) {...}
62 // but instead you'll have to add
63 // DECLARE_REAL(int, foo, const char *bar, double baz) in your
64 // source file (to define a pointer to overriden function).
65 // 3. Some Mac functions have symbol variants discriminated by
66 // additional suffixes, e.g. _$UNIX2003 (see
67 // https://developer.apple.com/library/mac/#releasenotes/Darwin/SymbolVariantsRelNotes/index.html
68 // for more details). To intercept such functions you need to use the
69 // INTERCEPTOR_WITH_SUFFIX(...) macro.
70
71 // How it works on Linux
72 // ---------------------
73 //
74 // To replace system functions on Linux we just need to declare functions with
75 // the same names in our library and then obtain the real function pointers
76 // using dlsym().
77 //
78 // There is one complication: a user may also intercept some of the functions we
79 // intercept. To allow for up to 3 interceptors (including ours) of a given
80 // function "func", the interceptor implementation is in ___interceptor_func,
81 // which is aliased by a weak function __interceptor_func, which in turn is
82 // aliased (via a trampoline) by weak wrapper function "func".
83 //
84 // Most user interceptors should define a foreign interceptor as follows:
85 //
86 // - provide a non-weak function "func" that performs interception;
87 // - if __interceptor_func exists, call it to perform the real functionality;
88 // - if it does not exist, figure out the real function and call it instead.
89 //
90 // In rare cases, a foreign interceptor (of another dynamic analysis runtime)
91 // may be defined as follows (on supported architectures):
92 //
93 // - provide a non-weak function __interceptor_func that performs interception;
94 // - if ___interceptor_func exists, call it to perform the real functionality;
95 // - if it does not exist, figure out the real function and call it instead;
96 // - provide a weak function "func" that is an alias to __interceptor_func.
97 //
98 // With this protocol, sanitizer interceptors, foreign user interceptors, and
99 // foreign interceptors of other dynamic analysis runtimes, or any combination
100 // thereof, may co-exist simultaneously.
101 //
102 // How it works on Mac OS
103 // ----------------------
104 //
105 // This is not so on Mac OS, where the two-level namespace makes our replacement
106 // functions invisible to other libraries. This may be overcomed using the
107 // DYLD_FORCE_FLAT_NAMESPACE, but some errors loading the shared libraries in
108 // Chromium were noticed when doing so.
109 //
110 // Instead we create a dylib containing a __DATA,__interpose section that
111 // associates library functions with their wrappers. When this dylib is
112 // preloaded before an executable using DYLD_INSERT_LIBRARIES, it routes all the
113 // calls to interposed functions done through stubs to the wrapper functions.
114 //
115 // As it's decided at compile time which functions are to be intercepted on Mac,
116 // INTERCEPT_FUNCTION() is effectively a no-op on this system.
117
118 #if SANITIZER_APPLE
119 #include <sys/cdefs.h> // For __DARWIN_ALIAS_C().
120
121 // Just a pair of pointers.
122 struct interpose_substitution {
123 const __sanitizer::uptr replacement;
124 const __sanitizer::uptr original;
125 };
126
127 // For a function foo() create a global pair of pointers { wrap_foo, foo } in
128 // the __DATA,__interpose section.
129 // As a result all the calls to foo() will be routed to wrap_foo() at runtime.
130 #define INTERPOSER(func_name) __attribute__((used)) \
131 const interpose_substitution substitution_##func_name[] \
132 __attribute__((section("__DATA, __interpose"))) = { \
133 { reinterpret_cast<const uptr>(WRAP(func_name)), \
134 reinterpret_cast<const uptr>(func_name) } \
135 }
136
137 // For a function foo() and a wrapper function bar() create a global pair
138 // of pointers { bar, foo } in the __DATA,__interpose section.
139 // As a result all the calls to foo() will be routed to bar() at runtime.
140 #define INTERPOSER_2(func_name, wrapper_name) __attribute__((used)) \
141 const interpose_substitution substitution_##func_name[] \
142 __attribute__((section("__DATA, __interpose"))) = { \
143 { reinterpret_cast<const uptr>(wrapper_name), \
144 reinterpret_cast<const uptr>(func_name) } \
145 }
146
147 # define WRAP(x) wrap_##x
148 # define TRAMPOLINE(x) WRAP(x)
149 # define INTERCEPTOR_ATTRIBUTE
150 # define DECLARE_WRAPPER(ret_type, func, ...)
151
152 #elif SANITIZER_WINDOWS
153 # define WRAP(x) __asan_wrap_##x
154 # define TRAMPOLINE(x) WRAP(x)
155 # define INTERCEPTOR_ATTRIBUTE __declspec(dllexport)
156 # define DECLARE_WRAPPER(ret_type, func, ...) \
157 extern "C" ret_type func(__VA_ARGS__);
158 # define DECLARE_WRAPPER_WINAPI(ret_type, func, ...) \
159 extern "C" __declspec(dllimport) ret_type __stdcall func(__VA_ARGS__);
160 #elif !SANITIZER_FUCHSIA // LINUX, FREEBSD, NETBSD, SOLARIS
161 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))
162 # if ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT
163 // Weak aliases of weak aliases do not work, therefore we need to set up a
164 // trampoline function. The function "func" is a weak alias to the trampoline
165 // (so that we may check if "func" was overridden), which calls the weak
166 // function __interceptor_func, which in turn aliases the actual interceptor
167 // implementation ___interceptor_func:
168 //
169 // [wrapper "func": weak] --(alias)--> [TRAMPOLINE(func)]
170 // |
171 // +--------(tail call)-------+
172 // |
173 // v
174 // [__interceptor_func: weak] --(alias)--> [WRAP(func)]
175 //
176 // We use inline assembly to define most of this, because not all compilers
177 // support functions with the "naked" attribute with every architecture.
178 # define WRAP(x) ___interceptor_ ## x
179 # define TRAMPOLINE(x) __interceptor_trampoline_ ## x
180 # if SANITIZER_FREEBSD || SANITIZER_NETBSD
181 // FreeBSD's dynamic linker (incompliantly) gives non-weak symbols higher
182 // priority than weak ones so weak aliases won't work for indirect calls
183 // in position-independent (-fPIC / -fPIE) mode.
184 # define __ASM_WEAK_WRAPPER(func) ".globl " #func "\n"
185 # else
186 # define __ASM_WEAK_WRAPPER(func) ".weak " #func "\n"
187 # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD
188 # if defined(__arm__) || defined(__aarch64__)
189 # define ASM_TYPE_FUNCTION_STR "%function"
190 # else
191 # define ASM_TYPE_FUNCTION_STR "@function"
192 # endif
193 // Keep trampoline implementation in sync with sanitizer_common/sanitizer_asm.h
194 # define DECLARE_WRAPPER(ret_type, func, ...) \
195 extern "C" ret_type func(__VA_ARGS__); \
196 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \
197 extern "C" ret_type __interceptor_##func(__VA_ARGS__) \
198 INTERCEPTOR_ATTRIBUTE __attribute__((weak)) ALIAS(WRAP(func)); \
199 asm( \
200 ".text\n" \
201 __ASM_WEAK_WRAPPER(func) \
202 ".set " #func ", " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \
203 ".globl " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \
204 ".type " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \
205 ASM_TYPE_FUNCTION_STR "\n" \
206 SANITIZER_STRINGIFY(TRAMPOLINE(func)) ":\n" \
207 C_ASM_STARTPROC "\n" \
208 C_ASM_TAIL_CALL(SANITIZER_STRINGIFY(TRAMPOLINE(func)), \
209 "__interceptor_" \
210 SANITIZER_STRINGIFY(ASM_PREEMPTIBLE_SYM(func))) "\n" \
211 C_ASM_ENDPROC "\n" \
212 ".size " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \
213 ".-" SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \
214 );
215 # else // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT
216 // Some architectures cannot implement efficient interceptor trampolines with
217 // just a plain jump due to complexities of resolving a preemptible symbol. In
218 // those cases, revert to just this scheme:
219 //
220 // [wrapper "func": weak] --(alias)--> [WRAP(func)]
221 //
222 # define WRAP(x) __interceptor_ ## x
223 # define TRAMPOLINE(x) WRAP(x)
224 # if SANITIZER_FREEBSD || SANITIZER_NETBSD
225 # define __ATTRIBUTE_WEAK_WRAPPER
226 # else
227 # define __ATTRIBUTE_WEAK_WRAPPER __attribute__((weak))
228 # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD
229 # define DECLARE_WRAPPER(ret_type, func, ...) \
230 extern "C" ret_type func(__VA_ARGS__) \
231 INTERCEPTOR_ATTRIBUTE __ATTRIBUTE_WEAK_WRAPPER ALIAS(WRAP(func));
232 # endif // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT
233 #endif
234
235 #if SANITIZER_FUCHSIA
236 // There is no general interception at all on Fuchsia.
237 // Sanitizer runtimes just define functions directly to preempt them,
238 // and have bespoke ways to access the underlying libc functions.
239 # include <zircon/sanitizer.h>
240 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))
241 # define REAL(x) __unsanitized_##x
242 # define DECLARE_REAL(ret_type, func, ...)
243 #elif !SANITIZER_APPLE
244 # define PTR_TO_REAL(x) real_##x
245 # define REAL(x) __interception::PTR_TO_REAL(x)
246 # define FUNC_TYPE(x) x##_type
247
248 # define DECLARE_REAL(ret_type, func, ...) \
249 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \
250 namespace __interception { \
251 extern FUNC_TYPE(func) PTR_TO_REAL(func); \
252 }
253 # define ASSIGN_REAL(dst, src) REAL(dst) = REAL(src)
254 #else // SANITIZER_APPLE
255 # define REAL(x) x
256 # define DECLARE_REAL(ret_type, func, ...) \
257 extern "C" ret_type func(__VA_ARGS__);
258 # define ASSIGN_REAL(x, y)
259 #endif // SANITIZER_APPLE
260
261 #if !SANITIZER_FUCHSIA
262 # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) \
263 DECLARE_REAL(ret_type, func, __VA_ARGS__) \
264 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \
265 extern "C" ret_type WRAP(func)(__VA_ARGS__);
266 // Declare an interceptor and its wrapper defined in a different translation
267 // unit (ex. asm).
268 # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) \
269 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \
270 extern "C" ret_type WRAP(func)(__VA_ARGS__); \
271 extern "C" ret_type func(__VA_ARGS__);
272 #else
273 # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...)
274 # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...)
275 #endif
276
277 // Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR
278 // macros does its job. In exceptional cases you may need to call REAL(foo)
279 // without defining INTERCEPTOR(..., foo, ...). For example, if you override
280 // foo with an interceptor for other function.
281 #if !SANITIZER_APPLE && !SANITIZER_FUCHSIA
282 # define DEFINE_REAL(ret_type, func, ...) \
283 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \
284 namespace __interception { \
285 FUNC_TYPE(func) PTR_TO_REAL(func); \
286 }
287 #else
288 # define DEFINE_REAL(ret_type, func, ...)
289 #endif
290
291 #if SANITIZER_FUCHSIA
292
293 // We need to define the __interceptor_func name just to get
294 // sanitizer_common/scripts/gen_dynamic_list.py to export func.
295 // But we don't need to export __interceptor_func to get that.
296 #define INTERCEPTOR(ret_type, func, ...) \
297 extern "C"[[ gnu::alias(#func), gnu::visibility("hidden") ]] ret_type \
298 __interceptor_##func(__VA_ARGS__); \
299 extern "C" INTERCEPTOR_ATTRIBUTE ret_type func(__VA_ARGS__)
300
301 #elif !SANITIZER_APPLE
302
303 #define INTERCEPTOR(ret_type, func, ...) \
304 DEFINE_REAL(ret_type, func, __VA_ARGS__) \
305 DECLARE_WRAPPER(ret_type, func, __VA_ARGS__) \
306 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__)
307
308 // We don't need INTERCEPTOR_WITH_SUFFIX on non-Darwin for now.
309 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \
310 INTERCEPTOR(ret_type, func, __VA_ARGS__)
311
312 #else // SANITIZER_APPLE
313
314 #define INTERCEPTOR_ZZZ(suffix, ret_type, func, ...) \
315 extern "C" ret_type func(__VA_ARGS__) suffix; \
316 extern "C" ret_type WRAP(func)(__VA_ARGS__); \
317 INTERPOSER(func); \
318 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__)
319
320 #define INTERCEPTOR(ret_type, func, ...) \
321 INTERCEPTOR_ZZZ(/*no symbol variants*/, ret_type, func, __VA_ARGS__)
322
323 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \
324 INTERCEPTOR_ZZZ(__DARWIN_ALIAS_C(func), ret_type, func, __VA_ARGS__)
325
326 // Override |overridee| with |overrider|.
327 #define OVERRIDE_FUNCTION(overridee, overrider) \
328 INTERPOSER_2(overridee, WRAP(overrider))
329 #endif
330
331 #if SANITIZER_WINDOWS
332 # define INTERCEPTOR_WINAPI(ret_type, func, ...) \
333 typedef ret_type (__stdcall *FUNC_TYPE(func))(__VA_ARGS__); \
334 namespace __interception { \
335 FUNC_TYPE(func) PTR_TO_REAL(func); \
336 } \
337 extern "C" INTERCEPTOR_ATTRIBUTE ret_type __stdcall WRAP(func)(__VA_ARGS__)
338 #endif
339
340 // ISO C++ forbids casting between pointer-to-function and pointer-to-object,
341 // so we use casting via an integral type __interception::uptr,
342 // assuming that system is POSIX-compliant. Using other hacks seem
343 // challenging, as we don't even pass function type to
344 // INTERCEPT_FUNCTION macro, only its name.
345 namespace __interception {
346 #if defined(_WIN64)
347 typedef unsigned long long uptr;
348 #else
349 typedef unsigned long uptr;
350 #endif // _WIN64
351
352 #if defined(__ELF__) && !SANITIZER_FUCHSIA
353 // The use of interceptors makes many sanitizers unusable for static linking.
354 // Define a function, if called, will cause a linker error (undefined _DYNAMIC).
355 // However, -static-pie (which is not common) cannot be detected at link time.
356 extern uptr kDynamic[] asm("_DYNAMIC");
DoesNotSupportStaticLinking()357 inline void DoesNotSupportStaticLinking() {
358 [[maybe_unused]] volatile auto x = &kDynamic;
359 }
360 #else
DoesNotSupportStaticLinking()361 inline void DoesNotSupportStaticLinking() {}
362 #endif
363 } // namespace __interception
364
365 #define INCLUDED_FROM_INTERCEPTION_LIB
366
367 #if SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_NETBSD || \
368 SANITIZER_SOLARIS
369
370 # include "interception_linux.h"
371 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_LINUX_OR_FREEBSD(func)
372 # define INTERCEPT_FUNCTION_VER(func, symver) \
373 INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver)
374 #elif SANITIZER_APPLE
375 # include "interception_mac.h"
376 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_MAC(func)
377 # define INTERCEPT_FUNCTION_VER(func, symver) \
378 INTERCEPT_FUNCTION_VER_MAC(func, symver)
379 #elif SANITIZER_WINDOWS
380 # include "interception_win.h"
381 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_WIN(func)
382 # define INTERCEPT_FUNCTION_VER(func, symver) \
383 INTERCEPT_FUNCTION_VER_WIN(func, symver)
384 #endif
385
386 #undef INCLUDED_FROM_INTERCEPTION_LIB
387
388 #endif // INTERCEPTION_H
389