1 //===-- interception.h ------------------------------------------*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is a part of AddressSanitizer, an address sanity checker. 10 // 11 // Machinery for providing replacements/wrappers for system functions. 12 //===----------------------------------------------------------------------===// 13 14 #ifndef INTERCEPTION_H 15 #define INTERCEPTION_H 16 17 #include "sanitizer_common/sanitizer_asm.h" 18 #include "sanitizer_common/sanitizer_internal_defs.h" 19 20 #if !SANITIZER_LINUX && !SANITIZER_FREEBSD && !SANITIZER_APPLE && \ 21 !SANITIZER_NETBSD && !SANITIZER_WINDOWS && !SANITIZER_FUCHSIA && \ 22 !SANITIZER_SOLARIS && !SANITIZER_HAIKU && !SANITIZER_AIX 23 # error "Interception doesn't work on this operating system." 24 #endif 25 26 // These typedefs should be used only in the interceptor definitions to replace 27 // the standard system types (e.g. SSIZE_T instead of ssize_t) 28 // On Windows the system headers (basetsd.h) provide a conflicting definition 29 // of SIZE_T/SSIZE_T that do not match the real size_t/ssize_t for 32-bit 30 // systems (using long instead of the expected int). Work around the typedef 31 // redefinition by #defining SIZE_T instead of using a typedef. 32 // TODO: We should be using __sanitizer::usize (and a new ssize) instead of 33 // these new macros as long as we ensure they match the real system definitions. 34 #if SANITIZER_WINDOWS 35 // Ensure that (S)SIZE_T were already defined as we are about to override them. 36 # include <basetsd.h> 37 #endif 38 39 #define SIZE_T __sanitizer::usize 40 #define SSIZE_T __sanitizer::ssize 41 typedef __sanitizer::sptr PTRDIFF_T; 42 typedef __sanitizer::s64 INTMAX_T; 43 typedef __sanitizer::u64 UINTMAX_T; 44 typedef __sanitizer::OFF_T OFF_T; 45 typedef __sanitizer::OFF64_T OFF64_T; 46 47 // How to add an interceptor: 48 // Suppose you need to wrap/replace system function (generally, from libc): 49 // int foo(const char *bar, double baz); 50 // You'll need to: 51 // 1) define INTERCEPTOR(int, foo, const char *bar, double baz) { ... } in 52 // your source file. See the notes below for cases when 53 // INTERCEPTOR_WITH_SUFFIX(...) should be used instead. 54 // 2) Call "INTERCEPT_FUNCTION(foo)" prior to the first call of "foo". 55 // INTERCEPT_FUNCTION(foo) evaluates to "true" iff the function was 56 // intercepted successfully. 57 // You can access original function by calling REAL(foo)(bar, baz). 58 // By default, REAL(foo) will be visible only inside your interceptor, and if 59 // you want to use it in other parts of RTL, you'll need to: 60 // 3a) add DECLARE_REAL(int, foo, const char*, double) to a 61 // header file. 62 // However, if the call "INTERCEPT_FUNCTION(foo)" and definition for 63 // INTERCEPTOR(..., foo, ...) are in different files, you'll instead need to: 64 // 3b) add DECLARE_REAL_AND_INTERCEPTOR(int, foo, const char*, double) 65 // to a header file. 66 67 // Notes: 1. Things may not work properly if macro INTERCEPTOR(...) {...} or 68 // DECLARE_REAL(...) are located inside namespaces. 69 // 2. On Mac you can also use: "OVERRIDE_FUNCTION(foo, zoo)" to 70 // effectively redirect calls from "foo" to "zoo". In this case 71 // you aren't required to implement 72 // INTERCEPTOR(int, foo, const char *bar, double baz) {...} 73 // but instead you'll have to add 74 // DECLARE_REAL(int, foo, const char *bar, double baz) in your 75 // source file (to define a pointer to overriden function). 76 // 3. Some Mac functions have symbol variants discriminated by 77 // additional suffixes, e.g. _$UNIX2003 (see 78 // https://developer.apple.com/library/mac/#releasenotes/Darwin/SymbolVariantsRelNotes/index.html 79 // for more details). To intercept such functions you need to use the 80 // INTERCEPTOR_WITH_SUFFIX(...) macro. 81 82 // How it works on Linux 83 // --------------------- 84 // 85 // To replace system functions on Linux we just need to declare functions with 86 // the same names in our library and then obtain the real function pointers 87 // using dlsym(). 88 // 89 // There is one complication: a user may also intercept some of the functions we 90 // intercept. To allow for up to 3 interceptors (including ours) of a given 91 // function "func", the interceptor implementation is in ___interceptor_func, 92 // which is aliased by a weak function __interceptor_func, which in turn is 93 // aliased (via a trampoline) by weak wrapper function "func". 94 // 95 // Most user interceptors should define a foreign interceptor as follows: 96 // 97 // - provide a non-weak function "func" that performs interception; 98 // - if __interceptor_func exists, call it to perform the real functionality; 99 // - if it does not exist, figure out the real function and call it instead. 100 // 101 // In rare cases, a foreign interceptor (of another dynamic analysis runtime) 102 // may be defined as follows (on supported architectures): 103 // 104 // - provide a non-weak function __interceptor_func that performs interception; 105 // - if ___interceptor_func exists, call it to perform the real functionality; 106 // - if it does not exist, figure out the real function and call it instead; 107 // - provide a weak function "func" that is an alias to __interceptor_func. 108 // 109 // With this protocol, sanitizer interceptors, foreign user interceptors, and 110 // foreign interceptors of other dynamic analysis runtimes, or any combination 111 // thereof, may co-exist simultaneously. 112 // 113 // How it works on Mac OS 114 // ---------------------- 115 // 116 // This is not so on Mac OS, where the two-level namespace makes our replacement 117 // functions invisible to other libraries. This may be overcomed using the 118 // DYLD_FORCE_FLAT_NAMESPACE, but some errors loading the shared libraries in 119 // Chromium were noticed when doing so. 120 // 121 // Instead we create a dylib containing a __DATA,__interpose section that 122 // associates library functions with their wrappers. When this dylib is 123 // preloaded before an executable using DYLD_INSERT_LIBRARIES, it routes all the 124 // calls to interposed functions done through stubs to the wrapper functions. 125 // 126 // As it's decided at compile time which functions are to be intercepted on Mac, 127 // INTERCEPT_FUNCTION() is effectively a no-op on this system. 128 129 #if SANITIZER_APPLE 130 #include <sys/cdefs.h> // For __DARWIN_ALIAS_C(). 131 132 // Just a pair of pointers. 133 struct interpose_substitution { 134 const __sanitizer::uptr replacement; 135 const __sanitizer::uptr original; 136 }; 137 138 // For a function foo() create a global pair of pointers { wrap_foo, foo } in 139 // the __DATA,__interpose section. 140 // As a result all the calls to foo() will be routed to wrap_foo() at runtime. 141 #define INTERPOSER(func_name) __attribute__((used)) \ 142 const interpose_substitution substitution_##func_name[] \ 143 __attribute__((section("__DATA, __interpose"))) = { \ 144 { reinterpret_cast<const uptr>(WRAP(func_name)), \ 145 reinterpret_cast<const uptr>(func_name) } \ 146 } 147 148 // For a function foo() and a wrapper function bar() create a global pair 149 // of pointers { bar, foo } in the __DATA,__interpose section. 150 // As a result all the calls to foo() will be routed to bar() at runtime. 151 #define INTERPOSER_2(func_name, wrapper_name) __attribute__((used)) \ 152 const interpose_substitution substitution_##func_name[] \ 153 __attribute__((section("__DATA, __interpose"))) = { \ 154 { reinterpret_cast<const uptr>(wrapper_name), \ 155 reinterpret_cast<const uptr>(func_name) } \ 156 } 157 158 # define WRAP(x) wrap_##x 159 # define TRAMPOLINE(x) WRAP(x) 160 # define INTERCEPTOR_ATTRIBUTE 161 # define DECLARE_WRAPPER(ret_type, func, ...) 162 163 #elif SANITIZER_WINDOWS 164 # define WRAP(x) __asan_wrap_##x 165 # define TRAMPOLINE(x) WRAP(x) 166 # define INTERCEPTOR_ATTRIBUTE __declspec(dllexport) 167 # define DECLARE_WRAPPER(ret_type, func, ...) \ 168 extern "C" ret_type func(__VA_ARGS__); 169 # define DECLARE_WRAPPER_WINAPI(ret_type, func, ...) \ 170 extern "C" __declspec(dllimport) ret_type __stdcall func(__VA_ARGS__); 171 #elif SANITIZER_AIX 172 # define WRAP(x) __interceptor_##x 173 # define TRAMPOLINE(x) WRAP(x) 174 // # define WRAPPER_NAME(x) "__interceptor_" #x 175 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) 176 // AIX's linker will not select the weak symbol, so don't use weak for the 177 // interceptors. 178 # define DECLARE_WRAPPER(ret_type, func, ...) \ 179 extern "C" ret_type func(__VA_ARGS__) \ 180 __attribute__((alias("__interceptor_" #func), visibility("default"))); 181 #elif !SANITIZER_FUCHSIA // LINUX, FREEBSD, NETBSD, SOLARIS 182 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) 183 # if ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT 184 // Weak aliases of weak aliases do not work, therefore we need to set up a 185 // trampoline function. The function "func" is a weak alias to the trampoline 186 // (so that we may check if "func" was overridden), which calls the weak 187 // function __interceptor_func, which in turn aliases the actual interceptor 188 // implementation ___interceptor_func: 189 // 190 // [wrapper "func": weak] --(alias)--> [TRAMPOLINE(func)] 191 // | 192 // +--------(tail call)-------+ 193 // | 194 // v 195 // [__interceptor_func: weak] --(alias)--> [WRAP(func)] 196 // 197 // We use inline assembly to define most of this, because not all compilers 198 // support functions with the "naked" attribute with every architecture. 199 # define WRAP(x) ___interceptor_ ## x 200 # define TRAMPOLINE(x) __interceptor_trampoline_ ## x 201 # if SANITIZER_FREEBSD || SANITIZER_NETBSD 202 // FreeBSD's dynamic linker (incompliantly) gives non-weak symbols higher 203 // priority than weak ones so weak aliases won't work for indirect calls 204 // in position-independent (-fPIC / -fPIE) mode. 205 # define __ASM_WEAK_WRAPPER(func) ".globl " #func "\n" 206 # else 207 # define __ASM_WEAK_WRAPPER(func) ".weak " #func "\n" 208 # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD 209 # if defined(__arm__) || defined(__aarch64__) 210 # define ASM_TYPE_FUNCTION_STR "%function" 211 # else 212 # define ASM_TYPE_FUNCTION_STR "@function" 213 # endif 214 // Keep trampoline implementation in sync with sanitizer_common/sanitizer_asm.h 215 # define DECLARE_WRAPPER(ret_type, func, ...) \ 216 extern "C" ret_type func(__VA_ARGS__); \ 217 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \ 218 extern "C" ret_type __interceptor_##func(__VA_ARGS__) \ 219 INTERCEPTOR_ATTRIBUTE __attribute__((weak)) ALIAS(WRAP(func)); \ 220 asm( \ 221 ".text\n" \ 222 __ASM_WEAK_WRAPPER(func) \ 223 ".set " #func ", " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \ 224 ".globl " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \ 225 ".type " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \ 226 ASM_TYPE_FUNCTION_STR "\n" \ 227 SANITIZER_STRINGIFY(TRAMPOLINE(func)) ":\n" \ 228 C_ASM_STARTPROC "\n" \ 229 C_ASM_TAIL_CALL(SANITIZER_STRINGIFY(TRAMPOLINE(func)), \ 230 "__interceptor_" \ 231 SANITIZER_STRINGIFY(ASM_PREEMPTIBLE_SYM(func))) "\n" \ 232 C_ASM_ENDPROC "\n" \ 233 ".size " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \ 234 ".-" SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \ 235 ); 236 # else // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT 237 // Some architectures cannot implement efficient interceptor trampolines with 238 // just a plain jump due to complexities of resolving a preemptible symbol. In 239 // those cases, revert to just this scheme: 240 // 241 // [wrapper "func": weak] --(alias)--> [WRAP(func)] 242 // 243 # define WRAP(x) __interceptor_ ## x 244 # define TRAMPOLINE(x) WRAP(x) 245 # if SANITIZER_FREEBSD || SANITIZER_NETBSD 246 # define __ATTRIBUTE_WEAK_WRAPPER 247 # else 248 # define __ATTRIBUTE_WEAK_WRAPPER __attribute__((weak)) 249 # endif // SANITIZER_FREEBSD || SANITIZER_NETBSD 250 # define DECLARE_WRAPPER(ret_type, func, ...) \ 251 extern "C" ret_type func(__VA_ARGS__) \ 252 INTERCEPTOR_ATTRIBUTE __ATTRIBUTE_WEAK_WRAPPER ALIAS(WRAP(func)); 253 # endif // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT 254 #endif 255 256 #if SANITIZER_FUCHSIA 257 // There is no general interception at all on Fuchsia. 258 // Sanitizer runtimes just define functions directly to preempt them, 259 // and have bespoke ways to access the underlying libc functions. 260 # include <zircon/sanitizer.h> 261 # define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default"))) 262 # define REAL(x) __unsanitized_##x 263 # define DECLARE_REAL(ret_type, func, ...) 264 #elif !SANITIZER_APPLE 265 # define PTR_TO_REAL(x) real_##x 266 # define REAL(x) __interception::PTR_TO_REAL(x) 267 # define FUNC_TYPE(x) x##_type 268 269 # define DECLARE_REAL(ret_type, func, ...) \ 270 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \ 271 namespace __interception { \ 272 extern FUNC_TYPE(func) PTR_TO_REAL(func); \ 273 } 274 # define ASSIGN_REAL(dst, src) REAL(dst) = REAL(src) 275 #else // SANITIZER_APPLE 276 # define REAL(x) x 277 # define DECLARE_REAL(ret_type, func, ...) \ 278 extern "C" ret_type func(__VA_ARGS__); 279 # define ASSIGN_REAL(x, y) 280 #endif // SANITIZER_APPLE 281 282 #if !SANITIZER_FUCHSIA 283 # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) \ 284 DECLARE_REAL(ret_type, func, __VA_ARGS__) \ 285 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \ 286 extern "C" ret_type WRAP(func)(__VA_ARGS__); 287 // Declare an interceptor and its wrapper defined in a different translation 288 // unit (ex. asm). 289 # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) \ 290 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \ 291 extern "C" ret_type WRAP(func)(__VA_ARGS__); \ 292 extern "C" ret_type func(__VA_ARGS__); 293 #else 294 # define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) 295 # define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) 296 #endif 297 298 // Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR 299 // macros does its job. In exceptional cases you may need to call REAL(foo) 300 // without defining INTERCEPTOR(..., foo, ...). For example, if you override 301 // foo with an interceptor for other function. 302 #if !SANITIZER_APPLE && !SANITIZER_FUCHSIA 303 # define DEFINE_REAL(ret_type, func, ...) \ 304 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \ 305 namespace __interception { \ 306 FUNC_TYPE(func) PTR_TO_REAL(func); \ 307 } 308 #else 309 # define DEFINE_REAL(ret_type, func, ...) 310 #endif 311 312 #if SANITIZER_FUCHSIA 313 314 // We need to define the __interceptor_func name just to get 315 // sanitizer_common/scripts/gen_dynamic_list.py to export func. 316 // But we don't need to export __interceptor_func to get that. 317 #define INTERCEPTOR(ret_type, func, ...) \ 318 extern "C"[[ gnu::alias(#func), gnu::visibility("hidden") ]] ret_type \ 319 __interceptor_##func(__VA_ARGS__); \ 320 extern "C" INTERCEPTOR_ATTRIBUTE ret_type func(__VA_ARGS__) 321 322 #elif !SANITIZER_APPLE 323 324 #define INTERCEPTOR(ret_type, func, ...) \ 325 DEFINE_REAL(ret_type, func, __VA_ARGS__) \ 326 DECLARE_WRAPPER(ret_type, func, __VA_ARGS__) \ 327 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__) 328 329 // We don't need INTERCEPTOR_WITH_SUFFIX on non-Darwin for now. 330 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \ 331 INTERCEPTOR(ret_type, func, __VA_ARGS__) 332 333 #else // SANITIZER_APPLE 334 335 #define INTERCEPTOR_ZZZ(suffix, ret_type, func, ...) \ 336 extern "C" ret_type func(__VA_ARGS__) suffix; \ 337 extern "C" ret_type WRAP(func)(__VA_ARGS__); \ 338 INTERPOSER(func); \ 339 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__) 340 341 #define INTERCEPTOR(ret_type, func, ...) \ 342 INTERCEPTOR_ZZZ(/*no symbol variants*/, ret_type, func, __VA_ARGS__) 343 344 #define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \ 345 INTERCEPTOR_ZZZ(__DARWIN_ALIAS_C(func), ret_type, func, __VA_ARGS__) 346 347 // Override |overridee| with |overrider|. 348 #define OVERRIDE_FUNCTION(overridee, overrider) \ 349 INTERPOSER_2(overridee, WRAP(overrider)) 350 #endif 351 352 #if SANITIZER_WINDOWS 353 # define INTERCEPTOR_WINAPI(ret_type, func, ...) \ 354 typedef ret_type (__stdcall *FUNC_TYPE(func))(__VA_ARGS__); \ 355 namespace __interception { \ 356 FUNC_TYPE(func) PTR_TO_REAL(func); \ 357 } \ 358 extern "C" INTERCEPTOR_ATTRIBUTE ret_type __stdcall WRAP(func)(__VA_ARGS__) 359 #endif 360 361 // ISO C++ forbids casting between pointer-to-function and pointer-to-object, 362 // so we use casts via uintptr_t (the local __sanitizer::uptr equivalent). 363 namespace __interception { 364 365 #if defined(__ELF__) && !SANITIZER_FUCHSIA 366 // The use of interceptors makes many sanitizers unusable for static linking. 367 // Define a function, if called, will cause a linker error (undefined _DYNAMIC). 368 // However, -static-pie (which is not common) cannot be detected at link time. 369 extern uptr kDynamic[] asm("_DYNAMIC"); 370 inline void DoesNotSupportStaticLinking() { 371 [[maybe_unused]] volatile auto x = &kDynamic; 372 } 373 #else 374 inline void DoesNotSupportStaticLinking() {} 375 #endif 376 } // namespace __interception 377 378 #define INCLUDED_FROM_INTERCEPTION_LIB 379 380 #if SANITIZER_AIX 381 # include "interception_aix.h" 382 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_AIX(func) 383 # define INTERCEPT_FUNCTION_VER(func, symver) INTERCEPT_FUNCTION_AIX(func) 384 385 #elif SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_NETBSD || \ 386 SANITIZER_SOLARIS || SANITIZER_HAIKU 387 388 # include "interception_linux.h" 389 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_LINUX_OR_FREEBSD(func) 390 # define INTERCEPT_FUNCTION_VER(func, symver) \ 391 INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver) 392 #elif SANITIZER_APPLE 393 # include "interception_mac.h" 394 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_MAC(func) 395 # define INTERCEPT_FUNCTION_VER(func, symver) \ 396 INTERCEPT_FUNCTION_VER_MAC(func, symver) 397 #elif SANITIZER_WINDOWS 398 # include "interception_win.h" 399 # define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_WIN(func) 400 # define INTERCEPT_FUNCTION_VER(func, symver) \ 401 INTERCEPT_FUNCTION_VER_WIN(func, symver) 402 #endif 403 404 #undef INCLUDED_FROM_INTERCEPTION_LIB 405 406 #endif // INTERCEPTION_H 407