1 2 #include "hwasan_thread.h" 3 4 #include "hwasan.h" 5 #include "hwasan_interface_internal.h" 6 #include "hwasan_mapping.h" 7 #include "hwasan_poisoning.h" 8 #include "sanitizer_common/sanitizer_atomic.h" 9 #include "sanitizer_common/sanitizer_file.h" 10 #include "sanitizer_common/sanitizer_placement_new.h" 11 #include "sanitizer_common/sanitizer_tls_get_addr.h" 12 13 namespace __hwasan { 14 15 static u32 RandomSeed() { 16 u32 seed; 17 do { 18 if (UNLIKELY(!GetRandom(reinterpret_cast<void *>(&seed), sizeof(seed), 19 /*blocking=*/false))) { 20 seed = static_cast<u32>( 21 (NanoTime() >> 12) ^ 22 (reinterpret_cast<uptr>(__builtin_frame_address(0)) >> 4)); 23 } 24 } while (!seed); 25 return seed; 26 } 27 28 void Thread::InitRandomState() { 29 random_state_ = flags()->random_tags ? RandomSeed() : unique_id_; 30 random_state_inited_ = true; 31 32 // Push a random number of zeros onto the ring buffer so that the first stack 33 // tag base will be random. 34 for (tag_t i = 0, e = GenerateRandomTag(); i != e; ++i) 35 stack_allocations_->push(0); 36 } 37 38 void Thread::Init(uptr stack_buffer_start, uptr stack_buffer_size, 39 const InitState *state) { 40 CHECK_EQ(0, unique_id_); // try to catch bad stack reuse 41 CHECK_EQ(0, stack_top_); 42 CHECK_EQ(0, stack_bottom_); 43 44 static atomic_uint64_t unique_id; 45 unique_id_ = atomic_fetch_add(&unique_id, 1, memory_order_relaxed); 46 47 if (auto sz = flags()->heap_history_size) 48 heap_allocations_ = HeapAllocationsRingBuffer::New(sz); 49 50 #if !SANITIZER_FUCHSIA 51 // Do not initialize the stack ring buffer just yet on Fuchsia. Threads will 52 // be initialized before we enter the thread itself, so we will instead call 53 // this later. 54 InitStackRingBuffer(stack_buffer_start, stack_buffer_size); 55 #endif 56 InitStackAndTls(state); 57 } 58 59 void Thread::InitStackRingBuffer(uptr stack_buffer_start, 60 uptr stack_buffer_size) { 61 HwasanTSDThreadInit(); // Only needed with interceptors. 62 uptr *ThreadLong = GetCurrentThreadLongPtr(); 63 // The following implicitly sets (this) as the current thread. 64 stack_allocations_ = new (ThreadLong) 65 StackAllocationsRingBuffer((void *)stack_buffer_start, stack_buffer_size); 66 // Check that it worked. 67 CHECK_EQ(GetCurrentThread(), this); 68 69 // ScopedTaggingDisable needs GetCurrentThread to be set up. 70 ScopedTaggingDisabler disabler; 71 72 if (stack_bottom_) { 73 int local; 74 CHECK(AddrIsInStack((uptr)&local)); 75 CHECK(MemIsApp(stack_bottom_)); 76 CHECK(MemIsApp(stack_top_ - 1)); 77 } 78 79 if (flags()->verbose_threads) { 80 if (IsMainThread()) { 81 Printf("sizeof(Thread): %zd sizeof(HeapRB): %zd sizeof(StackRB): %zd\n", 82 sizeof(Thread), heap_allocations_->SizeInBytes(), 83 stack_allocations_->size() * sizeof(uptr)); 84 } 85 Print("Creating : "); 86 } 87 } 88 89 void Thread::ClearShadowForThreadStackAndTLS() { 90 if (stack_top_ != stack_bottom_) 91 TagMemory(stack_bottom_, stack_top_ - stack_bottom_, 0); 92 if (tls_begin_ != tls_end_) 93 TagMemory(tls_begin_, tls_end_ - tls_begin_, 0); 94 } 95 96 void Thread::Destroy() { 97 if (flags()->verbose_threads) 98 Print("Destroying: "); 99 AllocatorSwallowThreadLocalCache(allocator_cache()); 100 ClearShadowForThreadStackAndTLS(); 101 if (heap_allocations_) 102 heap_allocations_->Delete(); 103 DTLS_Destroy(); 104 // Unregister this as the current thread. 105 // Instrumented code can not run on this thread from this point onwards, but 106 // malloc/free can still be served. Glibc may call free() very late, after all 107 // TSD destructors are done. 108 CHECK_EQ(GetCurrentThread(), this); 109 *GetCurrentThreadLongPtr() = 0; 110 } 111 112 void Thread::Print(const char *Prefix) { 113 Printf("%sT%zd %p stack: [%p,%p) sz: %zd tls: [%p,%p)\n", Prefix, unique_id_, 114 (void *)this, stack_bottom(), stack_top(), 115 stack_top() - stack_bottom(), tls_begin(), tls_end()); 116 } 117 118 static u32 xorshift(u32 state) { 119 state ^= state << 13; 120 state ^= state >> 17; 121 state ^= state << 5; 122 return state; 123 } 124 125 // Generate a (pseudo-)random non-zero tag. 126 tag_t Thread::GenerateRandomTag(uptr num_bits) { 127 DCHECK_GT(num_bits, 0); 128 if (tagging_disabled_) 129 return 0; 130 tag_t tag; 131 const uptr tag_mask = (1ULL << num_bits) - 1; 132 do { 133 if (flags()->random_tags) { 134 if (!random_buffer_) { 135 EnsureRandomStateInited(); 136 random_buffer_ = random_state_ = xorshift(random_state_); 137 } 138 CHECK(random_buffer_); 139 tag = random_buffer_ & tag_mask; 140 random_buffer_ >>= num_bits; 141 } else { 142 EnsureRandomStateInited(); 143 random_state_ += 1; 144 tag = random_state_ & tag_mask; 145 } 146 } while (!tag); 147 return tag; 148 } 149 150 } // namespace __hwasan 151