xref: /freebsd/contrib/llvm-project/compiler-rt/lib/asan/asan_globals.cpp (revision 5956d97f4b3204318ceb6aa9c77bd0bc6ea87a41)
1 //===-- asan_globals.cpp --------------------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file is a part of AddressSanitizer, an address sanity checker.
10 //
11 // Handle globals.
12 //===----------------------------------------------------------------------===//
13 
14 #include "asan_interceptors.h"
15 #include "asan_internal.h"
16 #include "asan_mapping.h"
17 #include "asan_poisoning.h"
18 #include "asan_report.h"
19 #include "asan_stack.h"
20 #include "asan_stats.h"
21 #include "asan_suppressions.h"
22 #include "asan_thread.h"
23 #include "sanitizer_common/sanitizer_common.h"
24 #include "sanitizer_common/sanitizer_mutex.h"
25 #include "sanitizer_common/sanitizer_placement_new.h"
26 #include "sanitizer_common/sanitizer_stackdepot.h"
27 #include "sanitizer_common/sanitizer_symbolizer.h"
28 
29 namespace __asan {
30 
31 typedef __asan_global Global;
32 
33 struct ListOfGlobals {
34   const Global *g;
35   ListOfGlobals *next;
36 };
37 
38 static Mutex mu_for_globals;
39 static LowLevelAllocator allocator_for_globals;
40 static ListOfGlobals *list_of_all_globals;
41 
42 static const int kDynamicInitGlobalsInitialCapacity = 512;
43 struct DynInitGlobal {
44   Global g;
45   bool initialized;
46 };
47 typedef InternalMmapVector<DynInitGlobal> VectorOfGlobals;
48 // Lazy-initialized and never deleted.
49 static VectorOfGlobals *dynamic_init_globals;
50 
51 // We want to remember where a certain range of globals was registered.
52 struct GlobalRegistrationSite {
53   u32 stack_id;
54   Global *g_first, *g_last;
55 };
56 typedef InternalMmapVector<GlobalRegistrationSite> GlobalRegistrationSiteVector;
57 static GlobalRegistrationSiteVector *global_registration_site_vector;
58 
59 ALWAYS_INLINE void PoisonShadowForGlobal(const Global *g, u8 value) {
60   FastPoisonShadow(g->beg, g->size_with_redzone, value);
61 }
62 
63 ALWAYS_INLINE void PoisonRedZones(const Global &g) {
64   uptr aligned_size = RoundUpTo(g.size, ASAN_SHADOW_GRANULARITY);
65   FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size,
66                    kAsanGlobalRedzoneMagic);
67   if (g.size != aligned_size) {
68     FastPoisonShadowPartialRightRedzone(
69         g.beg + RoundDownTo(g.size, ASAN_SHADOW_GRANULARITY),
70         g.size % ASAN_SHADOW_GRANULARITY, ASAN_SHADOW_GRANULARITY,
71         kAsanGlobalRedzoneMagic);
72   }
73 }
74 
75 const uptr kMinimalDistanceFromAnotherGlobal = 64;
76 
77 static bool IsAddressNearGlobal(uptr addr, const __asan_global &g) {
78   if (addr <= g.beg - kMinimalDistanceFromAnotherGlobal) return false;
79   if (addr >= g.beg + g.size_with_redzone) return false;
80   return true;
81 }
82 
83 static void ReportGlobal(const Global &g, const char *prefix) {
84   Report(
85       "%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu "
86       "odr_indicator=%p\n",
87       prefix, (void *)&g, (void *)g.beg, g.size, g.size_with_redzone, g.name,
88       g.module_name, g.has_dynamic_init, (void *)g.odr_indicator);
89   if (g.location) {
90     Report("  location (%p): name=%s[%p], %d %d\n", (void *)g.location,
91            g.location->filename, (void *)g.location->filename,
92            g.location->line_no, g.location->column_no);
93   }
94 }
95 
96 static u32 FindRegistrationSite(const Global *g) {
97   mu_for_globals.CheckLocked();
98   CHECK(global_registration_site_vector);
99   for (uptr i = 0, n = global_registration_site_vector->size(); i < n; i++) {
100     GlobalRegistrationSite &grs = (*global_registration_site_vector)[i];
101     if (g >= grs.g_first && g <= grs.g_last)
102       return grs.stack_id;
103   }
104   return 0;
105 }
106 
107 int GetGlobalsForAddress(uptr addr, Global *globals, u32 *reg_sites,
108                          int max_globals) {
109   if (!flags()->report_globals) return 0;
110   Lock lock(&mu_for_globals);
111   int res = 0;
112   for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
113     const Global &g = *l->g;
114     if (flags()->report_globals >= 2)
115       ReportGlobal(g, "Search");
116     if (IsAddressNearGlobal(addr, g)) {
117       internal_memcpy(&globals[res], &g, sizeof(g));
118       if (reg_sites)
119         reg_sites[res] = FindRegistrationSite(&g);
120       res++;
121       if (res == max_globals)
122         break;
123     }
124   }
125   return res;
126 }
127 
128 enum GlobalSymbolState {
129   UNREGISTERED = 0,
130   REGISTERED = 1
131 };
132 
133 // Check ODR violation for given global G via special ODR indicator. We use
134 // this method in case compiler instruments global variables through their
135 // local aliases.
136 static void CheckODRViolationViaIndicator(const Global *g) {
137   // Instrumentation requests to skip ODR check.
138   if (g->odr_indicator == UINTPTR_MAX)
139     return;
140   u8 *odr_indicator = reinterpret_cast<u8 *>(g->odr_indicator);
141   if (*odr_indicator == UNREGISTERED) {
142     *odr_indicator = REGISTERED;
143     return;
144   }
145   // If *odr_indicator is DEFINED, some module have already registered
146   // externally visible symbol with the same name. This is an ODR violation.
147   for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
148     if (g->odr_indicator == l->g->odr_indicator &&
149         (flags()->detect_odr_violation >= 2 || g->size != l->g->size) &&
150         !IsODRViolationSuppressed(g->name))
151       ReportODRViolation(g, FindRegistrationSite(g),
152                          l->g, FindRegistrationSite(l->g));
153   }
154 }
155 
156 // Check ODR violation for given global G by checking if it's already poisoned.
157 // We use this method in case compiler doesn't use private aliases for global
158 // variables.
159 static void CheckODRViolationViaPoisoning(const Global *g) {
160   if (__asan_region_is_poisoned(g->beg, g->size_with_redzone)) {
161     // This check may not be enough: if the first global is much larger
162     // the entire redzone of the second global may be within the first global.
163     for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) {
164       if (g->beg == l->g->beg &&
165           (flags()->detect_odr_violation >= 2 || g->size != l->g->size) &&
166           !IsODRViolationSuppressed(g->name))
167         ReportODRViolation(g, FindRegistrationSite(g),
168                            l->g, FindRegistrationSite(l->g));
169     }
170   }
171 }
172 
173 // Clang provides two different ways for global variables protection:
174 // it can poison the global itself or its private alias. In former
175 // case we may poison same symbol multiple times, that can help us to
176 // cheaply detect ODR violation: if we try to poison an already poisoned
177 // global, we have ODR violation error.
178 // In latter case, we poison each symbol exactly once, so we use special
179 // indicator symbol to perform similar check.
180 // In either case, compiler provides a special odr_indicator field to Global
181 // structure, that can contain two kinds of values:
182 //   1) Non-zero value. In this case, odr_indicator is an address of
183 //      corresponding indicator variable for given global.
184 //   2) Zero. This means that we don't use private aliases for global variables
185 //      and can freely check ODR violation with the first method.
186 //
187 // This routine chooses between two different methods of ODR violation
188 // detection.
189 static inline bool UseODRIndicator(const Global *g) {
190   return g->odr_indicator > 0;
191 }
192 
193 // Register a global variable.
194 // This function may be called more than once for every global
195 // so we store the globals in a map.
196 static void RegisterGlobal(const Global *g) {
197   CHECK(asan_inited);
198   if (flags()->report_globals >= 2)
199     ReportGlobal(*g, "Added");
200   CHECK(flags()->report_globals);
201   CHECK(AddrIsInMem(g->beg));
202   if (!AddrIsAlignedByGranularity(g->beg)) {
203     Report("The following global variable is not properly aligned.\n");
204     Report("This may happen if another global with the same name\n");
205     Report("resides in another non-instrumented module.\n");
206     Report("Or the global comes from a C file built w/o -fno-common.\n");
207     Report("In either case this is likely an ODR violation bug,\n");
208     Report("but AddressSanitizer can not provide more details.\n");
209     ReportODRViolation(g, FindRegistrationSite(g), g, FindRegistrationSite(g));
210     CHECK(AddrIsAlignedByGranularity(g->beg));
211   }
212   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
213   if (flags()->detect_odr_violation) {
214     // Try detecting ODR (One Definition Rule) violation, i.e. the situation
215     // where two globals with the same name are defined in different modules.
216     if (UseODRIndicator(g))
217       CheckODRViolationViaIndicator(g);
218     else
219       CheckODRViolationViaPoisoning(g);
220   }
221   if (CanPoisonMemory())
222     PoisonRedZones(*g);
223   ListOfGlobals *l = new(allocator_for_globals) ListOfGlobals;
224   l->g = g;
225   l->next = list_of_all_globals;
226   list_of_all_globals = l;
227   if (g->has_dynamic_init) {
228     if (!dynamic_init_globals) {
229       dynamic_init_globals = new (allocator_for_globals) VectorOfGlobals;
230       dynamic_init_globals->reserve(kDynamicInitGlobalsInitialCapacity);
231     }
232     DynInitGlobal dyn_global = { *g, false };
233     dynamic_init_globals->push_back(dyn_global);
234   }
235 }
236 
237 static void UnregisterGlobal(const Global *g) {
238   CHECK(asan_inited);
239   if (flags()->report_globals >= 2)
240     ReportGlobal(*g, "Removed");
241   CHECK(flags()->report_globals);
242   CHECK(AddrIsInMem(g->beg));
243   CHECK(AddrIsAlignedByGranularity(g->beg));
244   CHECK(AddrIsAlignedByGranularity(g->size_with_redzone));
245   if (CanPoisonMemory())
246     PoisonShadowForGlobal(g, 0);
247   // We unpoison the shadow memory for the global but we do not remove it from
248   // the list because that would require O(n^2) time with the current list
249   // implementation. It might not be worth doing anyway.
250 
251   // Release ODR indicator.
252   if (UseODRIndicator(g) && g->odr_indicator != UINTPTR_MAX) {
253     u8 *odr_indicator = reinterpret_cast<u8 *>(g->odr_indicator);
254     *odr_indicator = UNREGISTERED;
255   }
256 }
257 
258 void StopInitOrderChecking() {
259   Lock lock(&mu_for_globals);
260   if (!flags()->check_initialization_order || !dynamic_init_globals)
261     return;
262   flags()->check_initialization_order = false;
263   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
264     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
265     const Global *g = &dyn_g.g;
266     // Unpoison the whole global.
267     PoisonShadowForGlobal(g, 0);
268     // Poison redzones back.
269     PoisonRedZones(*g);
270   }
271 }
272 
273 static bool IsASCII(unsigned char c) { return /*0x00 <= c &&*/ c <= 0x7F; }
274 
275 const char *MaybeDemangleGlobalName(const char *name) {
276   // We can spoil names of globals with C linkage, so use an heuristic
277   // approach to check if the name should be demangled.
278   bool should_demangle = false;
279   if (name[0] == '_' && name[1] == 'Z')
280     should_demangle = true;
281   else if (SANITIZER_WINDOWS && name[0] == '\01' && name[1] == '?')
282     should_demangle = true;
283 
284   return should_demangle ? Symbolizer::GetOrInit()->Demangle(name) : name;
285 }
286 
287 // Check if the global is a zero-terminated ASCII string. If so, print it.
288 void PrintGlobalNameIfASCII(InternalScopedString *str, const __asan_global &g) {
289   for (uptr p = g.beg; p < g.beg + g.size - 1; p++) {
290     unsigned char c = *(unsigned char *)p;
291     if (c == '\0' || !IsASCII(c)) return;
292   }
293   if (*(char *)(g.beg + g.size - 1) != '\0') return;
294   str->append("  '%s' is ascii string '%s'\n", MaybeDemangleGlobalName(g.name),
295               (char *)g.beg);
296 }
297 
298 static const char *GlobalFilename(const __asan_global &g) {
299   const char *res = g.module_name;
300   // Prefer the filename from source location, if is available.
301   if (g.location) res = g.location->filename;
302   CHECK(res);
303   return res;
304 }
305 
306 void PrintGlobalLocation(InternalScopedString *str, const __asan_global &g) {
307   str->append("%s", GlobalFilename(g));
308   if (!g.location) return;
309   if (g.location->line_no) str->append(":%d", g.location->line_no);
310   if (g.location->column_no) str->append(":%d", g.location->column_no);
311 }
312 
313 } // namespace __asan
314 
315 // ---------------------- Interface ---------------- {{{1
316 using namespace __asan;
317 
318 // Apply __asan_register_globals to all globals found in the same loaded
319 // executable or shared library as `flag'. The flag tracks whether globals have
320 // already been registered or not for this image.
321 void __asan_register_image_globals(uptr *flag) {
322   if (*flag)
323     return;
324   AsanApplyToGlobals(__asan_register_globals, flag);
325   *flag = 1;
326 }
327 
328 // This mirrors __asan_register_image_globals.
329 void __asan_unregister_image_globals(uptr *flag) {
330   if (!*flag)
331     return;
332   AsanApplyToGlobals(__asan_unregister_globals, flag);
333   *flag = 0;
334 }
335 
336 void __asan_register_elf_globals(uptr *flag, void *start, void *stop) {
337   if (*flag) return;
338   if (!start) return;
339   CHECK_EQ(0, ((uptr)stop - (uptr)start) % sizeof(__asan_global));
340   __asan_global *globals_start = (__asan_global*)start;
341   __asan_global *globals_stop = (__asan_global*)stop;
342   __asan_register_globals(globals_start, globals_stop - globals_start);
343   *flag = 1;
344 }
345 
346 void __asan_unregister_elf_globals(uptr *flag, void *start, void *stop) {
347   if (!*flag) return;
348   if (!start) return;
349   CHECK_EQ(0, ((uptr)stop - (uptr)start) % sizeof(__asan_global));
350   __asan_global *globals_start = (__asan_global*)start;
351   __asan_global *globals_stop = (__asan_global*)stop;
352   __asan_unregister_globals(globals_start, globals_stop - globals_start);
353   *flag = 0;
354 }
355 
356 // Register an array of globals.
357 void __asan_register_globals(__asan_global *globals, uptr n) {
358   if (!flags()->report_globals) return;
359   GET_STACK_TRACE_MALLOC;
360   u32 stack_id = StackDepotPut(stack);
361   Lock lock(&mu_for_globals);
362   if (!global_registration_site_vector) {
363     global_registration_site_vector =
364         new (allocator_for_globals) GlobalRegistrationSiteVector;
365     global_registration_site_vector->reserve(128);
366   }
367   GlobalRegistrationSite site = {stack_id, &globals[0], &globals[n - 1]};
368   global_registration_site_vector->push_back(site);
369   if (flags()->report_globals >= 2) {
370     PRINT_CURRENT_STACK();
371     Printf("=== ID %d; %p %p\n", stack_id, (void *)&globals[0],
372            (void *)&globals[n - 1]);
373   }
374   for (uptr i = 0; i < n; i++) {
375     if (SANITIZER_WINDOWS && globals[i].beg == 0) {
376       // The MSVC incremental linker may pad globals out to 256 bytes. As long
377       // as __asan_global is less than 256 bytes large and its size is a power
378       // of two, we can skip over the padding.
379       static_assert(
380           sizeof(__asan_global) < 256 &&
381               (sizeof(__asan_global) & (sizeof(__asan_global) - 1)) == 0,
382           "sizeof(__asan_global) incompatible with incremental linker padding");
383       // If these are padding bytes, the rest of the global should be zero.
384       CHECK(globals[i].size == 0 && globals[i].size_with_redzone == 0 &&
385             globals[i].name == nullptr && globals[i].module_name == nullptr &&
386             globals[i].odr_indicator == 0);
387       continue;
388     }
389     RegisterGlobal(&globals[i]);
390   }
391 
392   // Poison the metadata. It should not be accessible to user code.
393   PoisonShadow(reinterpret_cast<uptr>(globals), n * sizeof(__asan_global),
394                kAsanGlobalRedzoneMagic);
395 }
396 
397 // Unregister an array of globals.
398 // We must do this when a shared objects gets dlclosed.
399 void __asan_unregister_globals(__asan_global *globals, uptr n) {
400   if (!flags()->report_globals) return;
401   Lock lock(&mu_for_globals);
402   for (uptr i = 0; i < n; i++) {
403     if (SANITIZER_WINDOWS && globals[i].beg == 0) {
404       // Skip globals that look like padding from the MSVC incremental linker.
405       // See comment in __asan_register_globals.
406       continue;
407     }
408     UnregisterGlobal(&globals[i]);
409   }
410 
411   // Unpoison the metadata.
412   PoisonShadow(reinterpret_cast<uptr>(globals), n * sizeof(__asan_global), 0);
413 }
414 
415 // This method runs immediately prior to dynamic initialization in each TU,
416 // when all dynamically initialized globals are unpoisoned.  This method
417 // poisons all global variables not defined in this TU, so that a dynamic
418 // initializer can only touch global variables in the same TU.
419 void __asan_before_dynamic_init(const char *module_name) {
420   if (!flags()->check_initialization_order ||
421       !CanPoisonMemory() ||
422       !dynamic_init_globals)
423     return;
424   bool strict_init_order = flags()->strict_init_order;
425   CHECK(module_name);
426   CHECK(asan_inited);
427   Lock lock(&mu_for_globals);
428   if (flags()->report_globals >= 3)
429     Printf("DynInitPoison module: %s\n", module_name);
430   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
431     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
432     const Global *g = &dyn_g.g;
433     if (dyn_g.initialized)
434       continue;
435     if (g->module_name != module_name)
436       PoisonShadowForGlobal(g, kAsanInitializationOrderMagic);
437     else if (!strict_init_order)
438       dyn_g.initialized = true;
439   }
440 }
441 
442 // This method runs immediately after dynamic initialization in each TU, when
443 // all dynamically initialized globals except for those defined in the current
444 // TU are poisoned.  It simply unpoisons all dynamically initialized globals.
445 void __asan_after_dynamic_init() {
446   if (!flags()->check_initialization_order ||
447       !CanPoisonMemory() ||
448       !dynamic_init_globals)
449     return;
450   CHECK(asan_inited);
451   Lock lock(&mu_for_globals);
452   // FIXME: Optionally report that we're unpoisoning globals from a module.
453   for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) {
454     DynInitGlobal &dyn_g = (*dynamic_init_globals)[i];
455     const Global *g = &dyn_g.g;
456     if (!dyn_g.initialized) {
457       // Unpoison the whole global.
458       PoisonShadowForGlobal(g, 0);
459       // Poison redzones back.
460       PoisonRedZones(*g);
461     }
462   }
463 }
464