168d75effSDimitry Andric //===-- asan_errors.cpp -----------------------------------------*- C++ -*-===// 268d75effSDimitry Andric // 368d75effSDimitry Andric // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 468d75effSDimitry Andric // See https://llvm.org/LICENSE.txt for license information. 568d75effSDimitry Andric // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 668d75effSDimitry Andric // 768d75effSDimitry Andric //===----------------------------------------------------------------------===// 868d75effSDimitry Andric // 968d75effSDimitry Andric // This file is a part of AddressSanitizer, an address sanity checker. 1068d75effSDimitry Andric // 1168d75effSDimitry Andric // ASan implementation for error structures. 1268d75effSDimitry Andric //===----------------------------------------------------------------------===// 1368d75effSDimitry Andric 1468d75effSDimitry Andric #include "asan_errors.h" 1568d75effSDimitry Andric #include "asan_descriptions.h" 1668d75effSDimitry Andric #include "asan_mapping.h" 1768d75effSDimitry Andric #include "asan_report.h" 1868d75effSDimitry Andric #include "asan_stack.h" 1968d75effSDimitry Andric #include "sanitizer_common/sanitizer_stackdepot.h" 2068d75effSDimitry Andric 2168d75effSDimitry Andric namespace __asan { 2268d75effSDimitry Andric 2368d75effSDimitry Andric static void OnStackUnwind(const SignalContext &sig, 2468d75effSDimitry Andric const void *callback_context, 2568d75effSDimitry Andric BufferedStackTrace *stack) { 2668d75effSDimitry Andric bool fast = common_flags()->fast_unwind_on_fatal; 2768d75effSDimitry Andric #if SANITIZER_FREEBSD || SANITIZER_NETBSD 2868d75effSDimitry Andric // On FreeBSD the slow unwinding that leverages _Unwind_Backtrace() 2968d75effSDimitry Andric // yields the call stack of the signal's handler and not of the code 3068d75effSDimitry Andric // that raised the signal (as it does on Linux). 3168d75effSDimitry Andric fast = true; 3268d75effSDimitry Andric #endif 3368d75effSDimitry Andric // Tests and maybe some users expect that scariness is going to be printed 3468d75effSDimitry Andric // just before the stack. As only asan has scariness score we have no 3568d75effSDimitry Andric // corresponding code in the sanitizer_common and we use this callback to 3668d75effSDimitry Andric // print it. 3768d75effSDimitry Andric static_cast<const ScarinessScoreBase *>(callback_context)->Print(); 3868d75effSDimitry Andric stack->Unwind(StackTrace::GetNextInstructionPc(sig.pc), sig.bp, sig.context, 3968d75effSDimitry Andric fast); 4068d75effSDimitry Andric } 4168d75effSDimitry Andric 4268d75effSDimitry Andric void ErrorDeadlySignal::Print() { 4368d75effSDimitry Andric ReportDeadlySignal(signal, tid, &OnStackUnwind, &scariness); 4468d75effSDimitry Andric } 4568d75effSDimitry Andric 4668d75effSDimitry Andric void ErrorDoubleFree::Print() { 4768d75effSDimitry Andric Decorator d; 4868d75effSDimitry Andric Printf("%s", d.Error()); 49349cc55cSDimitry Andric Report("ERROR: AddressSanitizer: attempting %s on %p in thread %s:\n", 50349cc55cSDimitry Andric scariness.GetDescription(), (void *)addr_description.addr, 5168d75effSDimitry Andric AsanThreadIdAndName(tid).c_str()); 5268d75effSDimitry Andric Printf("%s", d.Default()); 5368d75effSDimitry Andric scariness.Print(); 5468d75effSDimitry Andric GET_STACK_TRACE_FATAL(second_free_stack->trace[0], 5568d75effSDimitry Andric second_free_stack->top_frame_bp); 5668d75effSDimitry Andric stack.Print(); 5768d75effSDimitry Andric addr_description.Print(); 5868d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack); 5968d75effSDimitry Andric } 6068d75effSDimitry Andric 6168d75effSDimitry Andric void ErrorNewDeleteTypeMismatch::Print() { 6268d75effSDimitry Andric Decorator d; 6368d75effSDimitry Andric Printf("%s", d.Error()); 64349cc55cSDimitry Andric Report("ERROR: AddressSanitizer: %s on %p in thread %s:\n", 65349cc55cSDimitry Andric scariness.GetDescription(), (void *)addr_description.addr, 6668d75effSDimitry Andric AsanThreadIdAndName(tid).c_str()); 6768d75effSDimitry Andric Printf("%s object passed to delete has wrong type:\n", d.Default()); 6868d75effSDimitry Andric if (delete_size != 0) { 6968d75effSDimitry Andric Printf( 7068d75effSDimitry Andric " size of the allocated type: %zd bytes;\n" 7168d75effSDimitry Andric " size of the deallocated type: %zd bytes.\n", 7268d75effSDimitry Andric addr_description.chunk_access.chunk_size, delete_size); 7368d75effSDimitry Andric } 7468d75effSDimitry Andric const uptr user_alignment = 7568d75effSDimitry Andric addr_description.chunk_access.user_requested_alignment; 7668d75effSDimitry Andric if (delete_alignment != user_alignment) { 7768d75effSDimitry Andric char user_alignment_str[32]; 7868d75effSDimitry Andric char delete_alignment_str[32]; 7968d75effSDimitry Andric internal_snprintf(user_alignment_str, sizeof(user_alignment_str), 8068d75effSDimitry Andric "%zd bytes", user_alignment); 8168d75effSDimitry Andric internal_snprintf(delete_alignment_str, sizeof(delete_alignment_str), 8268d75effSDimitry Andric "%zd bytes", delete_alignment); 8368d75effSDimitry Andric static const char *kDefaultAlignment = "default-aligned"; 8468d75effSDimitry Andric Printf( 8568d75effSDimitry Andric " alignment of the allocated type: %s;\n" 8668d75effSDimitry Andric " alignment of the deallocated type: %s.\n", 8768d75effSDimitry Andric user_alignment > 0 ? user_alignment_str : kDefaultAlignment, 8868d75effSDimitry Andric delete_alignment > 0 ? delete_alignment_str : kDefaultAlignment); 8968d75effSDimitry Andric } 9068d75effSDimitry Andric CHECK_GT(free_stack->size, 0); 9168d75effSDimitry Andric scariness.Print(); 9268d75effSDimitry Andric GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp); 9368d75effSDimitry Andric stack.Print(); 9468d75effSDimitry Andric addr_description.Print(); 9568d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack); 9668d75effSDimitry Andric Report( 9768d75effSDimitry Andric "HINT: if you don't care about these errors you may set " 9868d75effSDimitry Andric "ASAN_OPTIONS=new_delete_type_mismatch=0\n"); 9968d75effSDimitry Andric } 10068d75effSDimitry Andric 10168d75effSDimitry Andric void ErrorFreeNotMalloced::Print() { 10268d75effSDimitry Andric Decorator d; 10368d75effSDimitry Andric Printf("%s", d.Error()); 10468d75effSDimitry Andric Report( 10568d75effSDimitry Andric "ERROR: AddressSanitizer: attempting free on address " 10668d75effSDimitry Andric "which was not malloc()-ed: %p in thread %s\n", 107349cc55cSDimitry Andric (void *)addr_description.Address(), AsanThreadIdAndName(tid).c_str()); 10868d75effSDimitry Andric Printf("%s", d.Default()); 10968d75effSDimitry Andric CHECK_GT(free_stack->size, 0); 11068d75effSDimitry Andric scariness.Print(); 11168d75effSDimitry Andric GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp); 11268d75effSDimitry Andric stack.Print(); 11368d75effSDimitry Andric addr_description.Print(); 11468d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack); 11568d75effSDimitry Andric } 11668d75effSDimitry Andric 11768d75effSDimitry Andric void ErrorAllocTypeMismatch::Print() { 11868d75effSDimitry Andric static const char *alloc_names[] = {"INVALID", "malloc", "operator new", 11968d75effSDimitry Andric "operator new []"}; 12068d75effSDimitry Andric static const char *dealloc_names[] = {"INVALID", "free", "operator delete", 12168d75effSDimitry Andric "operator delete []"}; 12268d75effSDimitry Andric CHECK_NE(alloc_type, dealloc_type); 12368d75effSDimitry Andric Decorator d; 12468d75effSDimitry Andric Printf("%s", d.Error()); 12568d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s (%s vs %s) on %p\n", 12668d75effSDimitry Andric scariness.GetDescription(), alloc_names[alloc_type], 127349cc55cSDimitry Andric dealloc_names[dealloc_type], (void *)addr_description.Address()); 12868d75effSDimitry Andric Printf("%s", d.Default()); 12968d75effSDimitry Andric CHECK_GT(dealloc_stack->size, 0); 13068d75effSDimitry Andric scariness.Print(); 13168d75effSDimitry Andric GET_STACK_TRACE_FATAL(dealloc_stack->trace[0], dealloc_stack->top_frame_bp); 13268d75effSDimitry Andric stack.Print(); 13368d75effSDimitry Andric addr_description.Print(); 13468d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack); 13568d75effSDimitry Andric Report( 13668d75effSDimitry Andric "HINT: if you don't care about these errors you may set " 13768d75effSDimitry Andric "ASAN_OPTIONS=alloc_dealloc_mismatch=0\n"); 13868d75effSDimitry Andric } 13968d75effSDimitry Andric 14068d75effSDimitry Andric void ErrorMallocUsableSizeNotOwned::Print() { 14168d75effSDimitry Andric Decorator d; 14268d75effSDimitry Andric Printf("%s", d.Error()); 14368d75effSDimitry Andric Report( 14468d75effSDimitry Andric "ERROR: AddressSanitizer: attempting to call malloc_usable_size() for " 14568d75effSDimitry Andric "pointer which is not owned: %p\n", 146349cc55cSDimitry Andric (void *)addr_description.Address()); 14768d75effSDimitry Andric Printf("%s", d.Default()); 14868d75effSDimitry Andric stack->Print(); 14968d75effSDimitry Andric addr_description.Print(); 15068d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 15168d75effSDimitry Andric } 15268d75effSDimitry Andric 15368d75effSDimitry Andric void ErrorSanitizerGetAllocatedSizeNotOwned::Print() { 15468d75effSDimitry Andric Decorator d; 15568d75effSDimitry Andric Printf("%s", d.Error()); 15668d75effSDimitry Andric Report( 15768d75effSDimitry Andric "ERROR: AddressSanitizer: attempting to call " 15868d75effSDimitry Andric "__sanitizer_get_allocated_size() for pointer which is not owned: %p\n", 159349cc55cSDimitry Andric (void *)addr_description.Address()); 16068d75effSDimitry Andric Printf("%s", d.Default()); 16168d75effSDimitry Andric stack->Print(); 16268d75effSDimitry Andric addr_description.Print(); 16368d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 16468d75effSDimitry Andric } 16568d75effSDimitry Andric 16668d75effSDimitry Andric void ErrorCallocOverflow::Print() { 16768d75effSDimitry Andric Decorator d; 16868d75effSDimitry Andric Printf("%s", d.Error()); 16968d75effSDimitry Andric Report( 17068d75effSDimitry Andric "ERROR: AddressSanitizer: calloc parameters overflow: count * size " 17168d75effSDimitry Andric "(%zd * %zd) cannot be represented in type size_t (thread %s)\n", 17268d75effSDimitry Andric count, size, AsanThreadIdAndName(tid).c_str()); 17368d75effSDimitry Andric Printf("%s", d.Default()); 17468d75effSDimitry Andric stack->Print(); 17568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull(); 17668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 17768d75effSDimitry Andric } 17868d75effSDimitry Andric 17968d75effSDimitry Andric void ErrorReallocArrayOverflow::Print() { 18068d75effSDimitry Andric Decorator d; 18168d75effSDimitry Andric Printf("%s", d.Error()); 18268d75effSDimitry Andric Report( 18368d75effSDimitry Andric "ERROR: AddressSanitizer: reallocarray parameters overflow: count * size " 18468d75effSDimitry Andric "(%zd * %zd) cannot be represented in type size_t (thread %s)\n", 18568d75effSDimitry Andric count, size, AsanThreadIdAndName(tid).c_str()); 18668d75effSDimitry Andric Printf("%s", d.Default()); 18768d75effSDimitry Andric stack->Print(); 18868d75effSDimitry Andric PrintHintAllocatorCannotReturnNull(); 18968d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 19068d75effSDimitry Andric } 19168d75effSDimitry Andric 19268d75effSDimitry Andric void ErrorPvallocOverflow::Print() { 19368d75effSDimitry Andric Decorator d; 19468d75effSDimitry Andric Printf("%s", d.Error()); 19568d75effSDimitry Andric Report( 19668d75effSDimitry Andric "ERROR: AddressSanitizer: pvalloc parameters overflow: size 0x%zx " 19768d75effSDimitry Andric "rounded up to system page size 0x%zx cannot be represented in type " 19868d75effSDimitry Andric "size_t (thread %s)\n", 19968d75effSDimitry Andric size, GetPageSizeCached(), AsanThreadIdAndName(tid).c_str()); 20068d75effSDimitry Andric Printf("%s", d.Default()); 20168d75effSDimitry Andric stack->Print(); 20268d75effSDimitry Andric PrintHintAllocatorCannotReturnNull(); 20368d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 20468d75effSDimitry Andric } 20568d75effSDimitry Andric 20668d75effSDimitry Andric void ErrorInvalidAllocationAlignment::Print() { 20768d75effSDimitry Andric Decorator d; 20868d75effSDimitry Andric Printf("%s", d.Error()); 20968d75effSDimitry Andric Report( 21068d75effSDimitry Andric "ERROR: AddressSanitizer: invalid allocation alignment: %zd, " 21168d75effSDimitry Andric "alignment must be a power of two (thread %s)\n", 21268d75effSDimitry Andric alignment, AsanThreadIdAndName(tid).c_str()); 21368d75effSDimitry Andric Printf("%s", d.Default()); 21468d75effSDimitry Andric stack->Print(); 21568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull(); 21668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 21768d75effSDimitry Andric } 21868d75effSDimitry Andric 21968d75effSDimitry Andric void ErrorInvalidAlignedAllocAlignment::Print() { 22068d75effSDimitry Andric Decorator d; 22168d75effSDimitry Andric Printf("%s", d.Error()); 22268d75effSDimitry Andric #if SANITIZER_POSIX 22368d75effSDimitry Andric Report("ERROR: AddressSanitizer: invalid alignment requested in " 22468d75effSDimitry Andric "aligned_alloc: %zd, alignment must be a power of two and the " 22568d75effSDimitry Andric "requested size 0x%zx must be a multiple of alignment " 22668d75effSDimitry Andric "(thread %s)\n", alignment, size, AsanThreadIdAndName(tid).c_str()); 22768d75effSDimitry Andric #else 22868d75effSDimitry Andric Report("ERROR: AddressSanitizer: invalid alignment requested in " 22968d75effSDimitry Andric "aligned_alloc: %zd, the requested size 0x%zx must be a multiple of " 23068d75effSDimitry Andric "alignment (thread %s)\n", alignment, size, 23168d75effSDimitry Andric AsanThreadIdAndName(tid).c_str()); 23268d75effSDimitry Andric #endif 23368d75effSDimitry Andric Printf("%s", d.Default()); 23468d75effSDimitry Andric stack->Print(); 23568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull(); 23668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 23768d75effSDimitry Andric } 23868d75effSDimitry Andric 23968d75effSDimitry Andric void ErrorInvalidPosixMemalignAlignment::Print() { 24068d75effSDimitry Andric Decorator d; 24168d75effSDimitry Andric Printf("%s", d.Error()); 24268d75effSDimitry Andric Report( 24368d75effSDimitry Andric "ERROR: AddressSanitizer: invalid alignment requested in posix_memalign: " 24468d75effSDimitry Andric "%zd, alignment must be a power of two and a multiple of sizeof(void*) " 24568d75effSDimitry Andric "== %zd (thread %s)\n", 24668d75effSDimitry Andric alignment, sizeof(void *), AsanThreadIdAndName(tid).c_str()); 24768d75effSDimitry Andric Printf("%s", d.Default()); 24868d75effSDimitry Andric stack->Print(); 24968d75effSDimitry Andric PrintHintAllocatorCannotReturnNull(); 25068d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 25168d75effSDimitry Andric } 25268d75effSDimitry Andric 25368d75effSDimitry Andric void ErrorAllocationSizeTooBig::Print() { 25468d75effSDimitry Andric Decorator d; 25568d75effSDimitry Andric Printf("%s", d.Error()); 25668d75effSDimitry Andric Report( 25768d75effSDimitry Andric "ERROR: AddressSanitizer: requested allocation size 0x%zx (0x%zx after " 25868d75effSDimitry Andric "adjustments for alignment, red zones etc.) exceeds maximum supported " 25968d75effSDimitry Andric "size of 0x%zx (thread %s)\n", 26068d75effSDimitry Andric user_size, total_size, max_size, AsanThreadIdAndName(tid).c_str()); 26168d75effSDimitry Andric Printf("%s", d.Default()); 26268d75effSDimitry Andric stack->Print(); 26368d75effSDimitry Andric PrintHintAllocatorCannotReturnNull(); 26468d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 26568d75effSDimitry Andric } 26668d75effSDimitry Andric 26768d75effSDimitry Andric void ErrorRssLimitExceeded::Print() { 26868d75effSDimitry Andric Decorator d; 26968d75effSDimitry Andric Printf("%s", d.Error()); 27068d75effSDimitry Andric Report( 27168d75effSDimitry Andric "ERROR: AddressSanitizer: specified RSS limit exceeded, currently set to " 27268d75effSDimitry Andric "soft_rss_limit_mb=%zd\n", common_flags()->soft_rss_limit_mb); 27368d75effSDimitry Andric Printf("%s", d.Default()); 27468d75effSDimitry Andric stack->Print(); 27568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull(); 27668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 27768d75effSDimitry Andric } 27868d75effSDimitry Andric 27968d75effSDimitry Andric void ErrorOutOfMemory::Print() { 28068d75effSDimitry Andric Decorator d; 28168d75effSDimitry Andric Printf("%s", d.Error()); 28281ad6265SDimitry Andric ERROR_OOM("allocator is trying to allocate 0x%zx bytes\n", requested_size); 28368d75effSDimitry Andric Printf("%s", d.Default()); 28468d75effSDimitry Andric stack->Print(); 28568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull(); 28668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 28768d75effSDimitry Andric } 28868d75effSDimitry Andric 28968d75effSDimitry Andric void ErrorStringFunctionMemoryRangesOverlap::Print() { 29068d75effSDimitry Andric Decorator d; 29168d75effSDimitry Andric char bug_type[100]; 29268d75effSDimitry Andric internal_snprintf(bug_type, sizeof(bug_type), "%s-param-overlap", function); 29368d75effSDimitry Andric Printf("%s", d.Error()); 29468d75effSDimitry Andric Report( 29568d75effSDimitry Andric "ERROR: AddressSanitizer: %s: memory ranges [%p,%p) and [%p, %p) " 29668d75effSDimitry Andric "overlap\n", 297349cc55cSDimitry Andric bug_type, (void *)addr1_description.Address(), 298349cc55cSDimitry Andric (void *)(addr1_description.Address() + length1), 299349cc55cSDimitry Andric (void *)addr2_description.Address(), 300349cc55cSDimitry Andric (void *)(addr2_description.Address() + length2)); 30168d75effSDimitry Andric Printf("%s", d.Default()); 30268d75effSDimitry Andric scariness.Print(); 30368d75effSDimitry Andric stack->Print(); 30468d75effSDimitry Andric addr1_description.Print(); 30568d75effSDimitry Andric addr2_description.Print(); 30668d75effSDimitry Andric ReportErrorSummary(bug_type, stack); 30768d75effSDimitry Andric } 30868d75effSDimitry Andric 30968d75effSDimitry Andric void ErrorStringFunctionSizeOverflow::Print() { 31068d75effSDimitry Andric Decorator d; 31168d75effSDimitry Andric Printf("%s", d.Error()); 31268d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s: (size=%zd)\n", 31368d75effSDimitry Andric scariness.GetDescription(), size); 31468d75effSDimitry Andric Printf("%s", d.Default()); 31568d75effSDimitry Andric scariness.Print(); 31668d75effSDimitry Andric stack->Print(); 31768d75effSDimitry Andric addr_description.Print(); 31868d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 31968d75effSDimitry Andric } 32068d75effSDimitry Andric 32168d75effSDimitry Andric void ErrorBadParamsToAnnotateContiguousContainer::Print() { 32268d75effSDimitry Andric Report( 32368d75effSDimitry Andric "ERROR: AddressSanitizer: bad parameters to " 32468d75effSDimitry Andric "__sanitizer_annotate_contiguous_container:\n" 32568d75effSDimitry Andric " beg : %p\n" 32668d75effSDimitry Andric " end : %p\n" 32768d75effSDimitry Andric " old_mid : %p\n" 32868d75effSDimitry Andric " new_mid : %p\n", 329349cc55cSDimitry Andric (void *)beg, (void *)end, (void *)old_mid, (void *)new_mid); 3300eae32dcSDimitry Andric uptr granularity = ASAN_SHADOW_GRANULARITY; 33168d75effSDimitry Andric if (!IsAligned(beg, granularity)) 332349cc55cSDimitry Andric Report("ERROR: beg is not aligned by %zu\n", granularity); 33368d75effSDimitry Andric stack->Print(); 33468d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 33568d75effSDimitry Andric } 33668d75effSDimitry Andric 337bdd1243dSDimitry Andric void ErrorBadParamsToAnnotateDoubleEndedContiguousContainer::Print() { 338bdd1243dSDimitry Andric Report( 339bdd1243dSDimitry Andric "ERROR: AddressSanitizer: bad parameters to " 340bdd1243dSDimitry Andric "__sanitizer_annotate_double_ended_contiguous_container:\n" 341bdd1243dSDimitry Andric " storage_beg : %p\n" 342bdd1243dSDimitry Andric " storage_end : %p\n" 343bdd1243dSDimitry Andric " old_container_beg : %p\n" 344bdd1243dSDimitry Andric " old_container_end : %p\n" 345bdd1243dSDimitry Andric " new_container_beg : %p\n" 346bdd1243dSDimitry Andric " new_container_end : %p\n", 347bdd1243dSDimitry Andric (void *)storage_beg, (void *)storage_end, (void *)old_container_beg, 348bdd1243dSDimitry Andric (void *)old_container_end, (void *)new_container_beg, 349bdd1243dSDimitry Andric (void *)new_container_end); 350bdd1243dSDimitry Andric uptr granularity = ASAN_SHADOW_GRANULARITY; 351bdd1243dSDimitry Andric if (!IsAligned(storage_beg, granularity)) 352bdd1243dSDimitry Andric Report("ERROR: storage_beg is not aligned by %zu\n", granularity); 353bdd1243dSDimitry Andric stack->Print(); 354bdd1243dSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack); 355bdd1243dSDimitry Andric } 356bdd1243dSDimitry Andric 35768d75effSDimitry Andric void ErrorODRViolation::Print() { 35868d75effSDimitry Andric Decorator d; 35968d75effSDimitry Andric Printf("%s", d.Error()); 36068d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s (%p):\n", scariness.GetDescription(), 361349cc55cSDimitry Andric (void *)global1.beg); 36268d75effSDimitry Andric Printf("%s", d.Default()); 363fe6060f1SDimitry Andric InternalScopedString g1_loc; 364fe6060f1SDimitry Andric InternalScopedString g2_loc; 365*5f757f3fSDimitry Andric PrintGlobalLocation(&g1_loc, global1, /*print_module_name=*/true); 366*5f757f3fSDimitry Andric PrintGlobalLocation(&g2_loc, global2, /*print_module_name=*/true); 36768d75effSDimitry Andric Printf(" [1] size=%zd '%s' %s\n", global1.size, 36868d75effSDimitry Andric MaybeDemangleGlobalName(global1.name), g1_loc.data()); 36968d75effSDimitry Andric Printf(" [2] size=%zd '%s' %s\n", global2.size, 37068d75effSDimitry Andric MaybeDemangleGlobalName(global2.name), g2_loc.data()); 37168d75effSDimitry Andric if (stack_id1 && stack_id2) { 37268d75effSDimitry Andric Printf("These globals were registered at these points:\n"); 37368d75effSDimitry Andric Printf(" [1]:\n"); 37468d75effSDimitry Andric StackDepotGet(stack_id1).Print(); 37568d75effSDimitry Andric Printf(" [2]:\n"); 37668d75effSDimitry Andric StackDepotGet(stack_id2).Print(); 37768d75effSDimitry Andric } 37868d75effSDimitry Andric Report( 37968d75effSDimitry Andric "HINT: if you don't care about these errors you may set " 38068d75effSDimitry Andric "ASAN_OPTIONS=detect_odr_violation=0\n"); 381fe6060f1SDimitry Andric InternalScopedString error_msg; 382*5f757f3fSDimitry Andric error_msg.AppendF("%s: global '%s' at %s", scariness.GetDescription(), 38368d75effSDimitry Andric MaybeDemangleGlobalName(global1.name), g1_loc.data()); 38468d75effSDimitry Andric ReportErrorSummary(error_msg.data()); 38568d75effSDimitry Andric } 38668d75effSDimitry Andric 38768d75effSDimitry Andric void ErrorInvalidPointerPair::Print() { 38868d75effSDimitry Andric Decorator d; 38968d75effSDimitry Andric Printf("%s", d.Error()); 39068d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s: %p %p\n", scariness.GetDescription(), 391349cc55cSDimitry Andric (void *)addr1_description.Address(), 392349cc55cSDimitry Andric (void *)addr2_description.Address()); 39368d75effSDimitry Andric Printf("%s", d.Default()); 39468d75effSDimitry Andric GET_STACK_TRACE_FATAL(pc, bp); 39568d75effSDimitry Andric stack.Print(); 39668d75effSDimitry Andric addr1_description.Print(); 39768d75effSDimitry Andric addr2_description.Print(); 39868d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack); 39968d75effSDimitry Andric } 40068d75effSDimitry Andric 40168d75effSDimitry Andric static bool AdjacentShadowValuesAreFullyPoisoned(u8 *s) { 40268d75effSDimitry Andric return s[-1] > 127 && s[1] > 127; 40368d75effSDimitry Andric } 40468d75effSDimitry Andric 40568d75effSDimitry Andric ErrorGeneric::ErrorGeneric(u32 tid, uptr pc_, uptr bp_, uptr sp_, uptr addr, 40668d75effSDimitry Andric bool is_write_, uptr access_size_) 40768d75effSDimitry Andric : ErrorBase(tid), 40868d75effSDimitry Andric addr_description(addr, access_size_, /*shouldLockThreadRegistry=*/false), 40968d75effSDimitry Andric pc(pc_), 41068d75effSDimitry Andric bp(bp_), 41168d75effSDimitry Andric sp(sp_), 41268d75effSDimitry Andric access_size(access_size_), 41368d75effSDimitry Andric is_write(is_write_), 41468d75effSDimitry Andric shadow_val(0) { 41568d75effSDimitry Andric scariness.Clear(); 41668d75effSDimitry Andric if (access_size) { 41768d75effSDimitry Andric if (access_size <= 9) { 41868d75effSDimitry Andric char desr[] = "?-byte"; 41968d75effSDimitry Andric desr[0] = '0' + access_size; 42068d75effSDimitry Andric scariness.Scare(access_size + access_size / 2, desr); 42168d75effSDimitry Andric } else if (access_size >= 10) { 42268d75effSDimitry Andric scariness.Scare(15, "multi-byte"); 42368d75effSDimitry Andric } 42468d75effSDimitry Andric is_write ? scariness.Scare(20, "write") : scariness.Scare(1, "read"); 42568d75effSDimitry Andric 42668d75effSDimitry Andric // Determine the error type. 42768d75effSDimitry Andric bug_descr = "unknown-crash"; 42868d75effSDimitry Andric if (AddrIsInMem(addr)) { 42968d75effSDimitry Andric u8 *shadow_addr = (u8 *)MemToShadow(addr); 43068d75effSDimitry Andric // If we are accessing 16 bytes, look at the second shadow byte. 4310eae32dcSDimitry Andric if (*shadow_addr == 0 && access_size > ASAN_SHADOW_GRANULARITY) 4320eae32dcSDimitry Andric shadow_addr++; 43368d75effSDimitry Andric // If we are in the partial right redzone, look at the next shadow byte. 43468d75effSDimitry Andric if (*shadow_addr > 0 && *shadow_addr < 128) shadow_addr++; 43568d75effSDimitry Andric bool far_from_bounds = false; 43668d75effSDimitry Andric shadow_val = *shadow_addr; 43768d75effSDimitry Andric int bug_type_score = 0; 43868d75effSDimitry Andric // For use-after-frees reads are almost as bad as writes. 43968d75effSDimitry Andric int read_after_free_bonus = 0; 44068d75effSDimitry Andric switch (shadow_val) { 44168d75effSDimitry Andric case kAsanHeapLeftRedzoneMagic: 44268d75effSDimitry Andric case kAsanArrayCookieMagic: 44368d75effSDimitry Andric bug_descr = "heap-buffer-overflow"; 44468d75effSDimitry Andric bug_type_score = 10; 44568d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); 44668d75effSDimitry Andric break; 44768d75effSDimitry Andric case kAsanHeapFreeMagic: 44868d75effSDimitry Andric bug_descr = "heap-use-after-free"; 44968d75effSDimitry Andric bug_type_score = 20; 45068d75effSDimitry Andric if (!is_write) read_after_free_bonus = 18; 45168d75effSDimitry Andric break; 45268d75effSDimitry Andric case kAsanStackLeftRedzoneMagic: 45368d75effSDimitry Andric bug_descr = "stack-buffer-underflow"; 45468d75effSDimitry Andric bug_type_score = 25; 45568d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); 45668d75effSDimitry Andric break; 45768d75effSDimitry Andric case kAsanInitializationOrderMagic: 45868d75effSDimitry Andric bug_descr = "initialization-order-fiasco"; 45968d75effSDimitry Andric bug_type_score = 1; 46068d75effSDimitry Andric break; 46168d75effSDimitry Andric case kAsanStackMidRedzoneMagic: 46268d75effSDimitry Andric case kAsanStackRightRedzoneMagic: 46368d75effSDimitry Andric bug_descr = "stack-buffer-overflow"; 46468d75effSDimitry Andric bug_type_score = 25; 46568d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); 46668d75effSDimitry Andric break; 46768d75effSDimitry Andric case kAsanStackAfterReturnMagic: 46868d75effSDimitry Andric bug_descr = "stack-use-after-return"; 46968d75effSDimitry Andric bug_type_score = 30; 47068d75effSDimitry Andric if (!is_write) read_after_free_bonus = 18; 47168d75effSDimitry Andric break; 47268d75effSDimitry Andric case kAsanUserPoisonedMemoryMagic: 47368d75effSDimitry Andric bug_descr = "use-after-poison"; 47468d75effSDimitry Andric bug_type_score = 20; 47568d75effSDimitry Andric break; 47668d75effSDimitry Andric case kAsanContiguousContainerOOBMagic: 47768d75effSDimitry Andric bug_descr = "container-overflow"; 47868d75effSDimitry Andric bug_type_score = 10; 47968d75effSDimitry Andric break; 48068d75effSDimitry Andric case kAsanStackUseAfterScopeMagic: 48168d75effSDimitry Andric bug_descr = "stack-use-after-scope"; 48268d75effSDimitry Andric bug_type_score = 10; 48368d75effSDimitry Andric break; 48468d75effSDimitry Andric case kAsanGlobalRedzoneMagic: 48568d75effSDimitry Andric bug_descr = "global-buffer-overflow"; 48668d75effSDimitry Andric bug_type_score = 10; 48768d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); 48868d75effSDimitry Andric break; 48968d75effSDimitry Andric case kAsanIntraObjectRedzone: 49068d75effSDimitry Andric bug_descr = "intra-object-overflow"; 49168d75effSDimitry Andric bug_type_score = 10; 49268d75effSDimitry Andric break; 49368d75effSDimitry Andric case kAsanAllocaLeftMagic: 49468d75effSDimitry Andric case kAsanAllocaRightMagic: 49568d75effSDimitry Andric bug_descr = "dynamic-stack-buffer-overflow"; 49668d75effSDimitry Andric bug_type_score = 25; 49768d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr); 49868d75effSDimitry Andric break; 49968d75effSDimitry Andric } 50068d75effSDimitry Andric scariness.Scare(bug_type_score + read_after_free_bonus, bug_descr); 50168d75effSDimitry Andric if (far_from_bounds) scariness.Scare(10, "far-from-bounds"); 50268d75effSDimitry Andric } 50368d75effSDimitry Andric } 50468d75effSDimitry Andric } 50568d75effSDimitry Andric 50668d75effSDimitry Andric static void PrintContainerOverflowHint() { 50768d75effSDimitry Andric Printf("HINT: if you don't care about these errors you may set " 50868d75effSDimitry Andric "ASAN_OPTIONS=detect_container_overflow=0.\n" 50968d75effSDimitry Andric "If you suspect a false positive see also: " 51068d75effSDimitry Andric "https://github.com/google/sanitizers/wiki/" 51168d75effSDimitry Andric "AddressSanitizerContainerOverflow.\n"); 51268d75effSDimitry Andric } 51368d75effSDimitry Andric 51468d75effSDimitry Andric static void PrintShadowByte(InternalScopedString *str, const char *before, 51568d75effSDimitry Andric u8 byte, const char *after = "\n") { 51668d75effSDimitry Andric PrintMemoryByte(str, before, byte, /*in_shadow*/true, after); 51768d75effSDimitry Andric } 51868d75effSDimitry Andric 51968d75effSDimitry Andric static void PrintLegend(InternalScopedString *str) { 520*5f757f3fSDimitry Andric str->AppendF( 52168d75effSDimitry Andric "Shadow byte legend (one shadow byte represents %d " 52268d75effSDimitry Andric "application bytes):\n", 5230eae32dcSDimitry Andric (int)ASAN_SHADOW_GRANULARITY); 52468d75effSDimitry Andric PrintShadowByte(str, " Addressable: ", 0); 525*5f757f3fSDimitry Andric str->AppendF(" Partially addressable: "); 5260eae32dcSDimitry Andric for (u8 i = 1; i < ASAN_SHADOW_GRANULARITY; i++) 5270eae32dcSDimitry Andric PrintShadowByte(str, "", i, " "); 528*5f757f3fSDimitry Andric str->AppendF("\n"); 52968d75effSDimitry Andric PrintShadowByte(str, " Heap left redzone: ", 53068d75effSDimitry Andric kAsanHeapLeftRedzoneMagic); 53168d75effSDimitry Andric PrintShadowByte(str, " Freed heap region: ", kAsanHeapFreeMagic); 53268d75effSDimitry Andric PrintShadowByte(str, " Stack left redzone: ", 53368d75effSDimitry Andric kAsanStackLeftRedzoneMagic); 53468d75effSDimitry Andric PrintShadowByte(str, " Stack mid redzone: ", 53568d75effSDimitry Andric kAsanStackMidRedzoneMagic); 53668d75effSDimitry Andric PrintShadowByte(str, " Stack right redzone: ", 53768d75effSDimitry Andric kAsanStackRightRedzoneMagic); 53868d75effSDimitry Andric PrintShadowByte(str, " Stack after return: ", 53968d75effSDimitry Andric kAsanStackAfterReturnMagic); 54068d75effSDimitry Andric PrintShadowByte(str, " Stack use after scope: ", 54168d75effSDimitry Andric kAsanStackUseAfterScopeMagic); 54268d75effSDimitry Andric PrintShadowByte(str, " Global redzone: ", kAsanGlobalRedzoneMagic); 54368d75effSDimitry Andric PrintShadowByte(str, " Global init order: ", 54468d75effSDimitry Andric kAsanInitializationOrderMagic); 54568d75effSDimitry Andric PrintShadowByte(str, " Poisoned by user: ", 54668d75effSDimitry Andric kAsanUserPoisonedMemoryMagic); 54768d75effSDimitry Andric PrintShadowByte(str, " Container overflow: ", 54868d75effSDimitry Andric kAsanContiguousContainerOOBMagic); 54968d75effSDimitry Andric PrintShadowByte(str, " Array cookie: ", 55068d75effSDimitry Andric kAsanArrayCookieMagic); 55168d75effSDimitry Andric PrintShadowByte(str, " Intra object redzone: ", 55268d75effSDimitry Andric kAsanIntraObjectRedzone); 55368d75effSDimitry Andric PrintShadowByte(str, " ASan internal: ", kAsanInternalHeapMagic); 55468d75effSDimitry Andric PrintShadowByte(str, " Left alloca redzone: ", kAsanAllocaLeftMagic); 55568d75effSDimitry Andric PrintShadowByte(str, " Right alloca redzone: ", kAsanAllocaRightMagic); 55668d75effSDimitry Andric } 55768d75effSDimitry Andric 55868d75effSDimitry Andric static void PrintShadowBytes(InternalScopedString *str, const char *before, 55968d75effSDimitry Andric u8 *bytes, u8 *guilty, uptr n) { 56068d75effSDimitry Andric Decorator d; 561349cc55cSDimitry Andric if (before) 562*5f757f3fSDimitry Andric str->AppendF("%s%p:", before, 563bdd1243dSDimitry Andric (void *)ShadowToMem(reinterpret_cast<uptr>(bytes))); 56468d75effSDimitry Andric for (uptr i = 0; i < n; i++) { 56568d75effSDimitry Andric u8 *p = bytes + i; 56668d75effSDimitry Andric const char *before = 56768d75effSDimitry Andric p == guilty ? "[" : (p - 1 == guilty && i != 0) ? "" : " "; 56868d75effSDimitry Andric const char *after = p == guilty ? "]" : ""; 56968d75effSDimitry Andric PrintShadowByte(str, before, *p, after); 57068d75effSDimitry Andric } 571*5f757f3fSDimitry Andric str->AppendF("\n"); 57268d75effSDimitry Andric } 57368d75effSDimitry Andric 57468d75effSDimitry Andric static void PrintShadowMemoryForAddress(uptr addr) { 57568d75effSDimitry Andric if (!AddrIsInMem(addr)) return; 57668d75effSDimitry Andric uptr shadow_addr = MemToShadow(addr); 57768d75effSDimitry Andric const uptr n_bytes_per_row = 16; 57868d75effSDimitry Andric uptr aligned_shadow = shadow_addr & ~(n_bytes_per_row - 1); 579fe6060f1SDimitry Andric InternalScopedString str; 580*5f757f3fSDimitry Andric str.AppendF("Shadow bytes around the buggy address:\n"); 58168d75effSDimitry Andric for (int i = -5; i <= 5; i++) { 58268d75effSDimitry Andric uptr row_shadow_addr = aligned_shadow + i * n_bytes_per_row; 58368d75effSDimitry Andric // Skip rows that would be outside the shadow range. This can happen when 58468d75effSDimitry Andric // the user address is near the bottom, top, or shadow gap of the address 58568d75effSDimitry Andric // space. 58668d75effSDimitry Andric if (!AddrIsInShadow(row_shadow_addr)) continue; 58768d75effSDimitry Andric const char *prefix = (i == 0) ? "=>" : " "; 58868d75effSDimitry Andric PrintShadowBytes(&str, prefix, (u8 *)row_shadow_addr, (u8 *)shadow_addr, 58968d75effSDimitry Andric n_bytes_per_row); 59068d75effSDimitry Andric } 59168d75effSDimitry Andric if (flags()->print_legend) PrintLegend(&str); 59268d75effSDimitry Andric Printf("%s", str.data()); 59368d75effSDimitry Andric } 59468d75effSDimitry Andric 59568d75effSDimitry Andric void ErrorGeneric::Print() { 59668d75effSDimitry Andric Decorator d; 59768d75effSDimitry Andric Printf("%s", d.Error()); 59868d75effSDimitry Andric uptr addr = addr_description.Address(); 59968d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s on address %p at pc %p bp %p sp %p\n", 600349cc55cSDimitry Andric bug_descr, (void *)addr, (void *)pc, (void *)bp, (void *)sp); 60168d75effSDimitry Andric Printf("%s", d.Default()); 60268d75effSDimitry Andric 60368d75effSDimitry Andric Printf("%s%s of size %zu at %p thread %s%s\n", d.Access(), 60468d75effSDimitry Andric access_size ? (is_write ? "WRITE" : "READ") : "ACCESS", access_size, 60568d75effSDimitry Andric (void *)addr, AsanThreadIdAndName(tid).c_str(), d.Default()); 60668d75effSDimitry Andric 60768d75effSDimitry Andric scariness.Print(); 60868d75effSDimitry Andric GET_STACK_TRACE_FATAL(pc, bp); 60968d75effSDimitry Andric stack.Print(); 61068d75effSDimitry Andric 61168d75effSDimitry Andric // Pass bug_descr because we have a special case for 61268d75effSDimitry Andric // initialization-order-fiasco 61368d75effSDimitry Andric addr_description.Print(bug_descr); 61468d75effSDimitry Andric if (shadow_val == kAsanContiguousContainerOOBMagic) 61568d75effSDimitry Andric PrintContainerOverflowHint(); 61668d75effSDimitry Andric ReportErrorSummary(bug_descr, &stack); 61768d75effSDimitry Andric PrintShadowMemoryForAddress(addr); 61868d75effSDimitry Andric } 61968d75effSDimitry Andric 62068d75effSDimitry Andric } // namespace __asan 621