1 //=-- lsan_common.h -------------------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is a part of LeakSanitizer. 10 // Private LSan header. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #ifndef LSAN_COMMON_H 15 #define LSAN_COMMON_H 16 17 #include "sanitizer_common/sanitizer_allocator.h" 18 #include "sanitizer_common/sanitizer_common.h" 19 #include "sanitizer_common/sanitizer_internal_defs.h" 20 #include "sanitizer_common/sanitizer_platform.h" 21 #include "sanitizer_common/sanitizer_stackdepot.h" 22 #include "sanitizer_common/sanitizer_stoptheworld.h" 23 #include "sanitizer_common/sanitizer_symbolizer.h" 24 25 // LeakSanitizer relies on some Glibc's internals (e.g. TLS machinery) on Linux. 26 // Also, LSan doesn't like 32 bit architectures 27 // because of "small" (4 bytes) pointer size that leads to high false negative 28 // ratio on large leaks. But we still want to have it for some 32 bit arches 29 // (e.g. x86), see https://github.com/google/sanitizers/issues/403. 30 // To enable LeakSanitizer on a new architecture, one needs to implement the 31 // internal_clone function as well as (probably) adjust the TLS machinery for 32 // the new architecture inside the sanitizer library. 33 // Exclude leak-detection on arm32 for Android because `__aeabi_read_tp` 34 // is missing. This caused a link error. 35 #if SANITIZER_ANDROID && (__ANDROID_API__ < 28 || defined(__arm__)) 36 # define CAN_SANITIZE_LEAKS 0 37 #elif (SANITIZER_LINUX || SANITIZER_APPLE) && (SANITIZER_WORDSIZE == 64) && \ 38 (defined(__x86_64__) || defined(__mips64) || defined(__aarch64__) || \ 39 defined(__powerpc64__) || defined(__s390x__)) 40 # define CAN_SANITIZE_LEAKS 1 41 #elif defined(__i386__) && (SANITIZER_LINUX || SANITIZER_APPLE) 42 # define CAN_SANITIZE_LEAKS 1 43 #elif defined(__arm__) && SANITIZER_LINUX 44 # define CAN_SANITIZE_LEAKS 1 45 #elif SANITIZER_RISCV64 && SANITIZER_LINUX 46 # define CAN_SANITIZE_LEAKS 1 47 #elif SANITIZER_NETBSD || SANITIZER_FUCHSIA 48 # define CAN_SANITIZE_LEAKS 1 49 #else 50 # define CAN_SANITIZE_LEAKS 0 51 #endif 52 53 namespace __sanitizer { 54 class FlagParser; 55 class ThreadRegistry; 56 class ThreadContextBase; 57 struct DTLS; 58 } 59 60 namespace __lsan { 61 62 // Chunk tags. 63 enum ChunkTag { 64 kDirectlyLeaked = 0, // default 65 kIndirectlyLeaked = 1, 66 kReachable = 2, 67 kIgnored = 3 68 }; 69 70 struct Flags { 71 #define LSAN_FLAG(Type, Name, DefaultValue, Description) Type Name; 72 #include "lsan_flags.inc" 73 #undef LSAN_FLAG 74 75 void SetDefaults(); 76 uptr pointer_alignment() const { 77 return use_unaligned ? 1 : sizeof(uptr); 78 } 79 }; 80 81 extern Flags lsan_flags; 82 inline Flags *flags() { return &lsan_flags; } 83 void RegisterLsanFlags(FlagParser *parser, Flags *f); 84 85 struct LeakedChunk { 86 uptr chunk; 87 u32 stack_trace_id; 88 uptr leaked_size; 89 ChunkTag tag; 90 }; 91 92 using LeakedChunks = InternalMmapVector<LeakedChunk>; 93 94 struct Leak { 95 u32 id; 96 uptr hit_count; 97 uptr total_size; 98 u32 stack_trace_id; 99 bool is_directly_leaked; 100 bool is_suppressed; 101 }; 102 103 struct LeakedObject { 104 u32 leak_id; 105 uptr addr; 106 uptr size; 107 }; 108 109 // Aggregates leaks by stack trace prefix. 110 class LeakReport { 111 public: 112 LeakReport() {} 113 void AddLeakedChunks(const LeakedChunks &chunks); 114 void ReportTopLeaks(uptr max_leaks); 115 void PrintSummary(); 116 uptr ApplySuppressions(); 117 uptr UnsuppressedLeakCount(); 118 uptr IndirectUnsuppressedLeakCount(); 119 120 private: 121 void PrintReportForLeak(uptr index); 122 void PrintLeakedObjectsForLeak(uptr index); 123 124 u32 next_id_ = 0; 125 InternalMmapVector<Leak> leaks_; 126 InternalMmapVector<LeakedObject> leaked_objects_; 127 }; 128 129 typedef InternalMmapVector<uptr> Frontier; 130 131 // Platform-specific functions. 132 void InitializePlatformSpecificModules(); 133 void ProcessGlobalRegions(Frontier *frontier); 134 void ProcessPlatformSpecificAllocations(Frontier *frontier); 135 136 struct RootRegion { 137 uptr begin; 138 uptr size; 139 }; 140 141 // LockStuffAndStopTheWorld can start to use Scan* calls to collect into 142 // this Frontier vector before the StopTheWorldCallback actually runs. 143 // This is used when the OS has a unified callback API for suspending 144 // threads and enumerating roots. 145 struct CheckForLeaksParam { 146 Frontier frontier; 147 LeakedChunks leaks; 148 bool success = false; 149 }; 150 151 InternalMmapVectorNoCtor<RootRegion> const *GetRootRegions(); 152 void ScanRootRegion(Frontier *frontier, RootRegion const ®ion, 153 uptr region_begin, uptr region_end, bool is_readable); 154 void ForEachExtraStackRangeCb(uptr begin, uptr end, void* arg); 155 void GetAdditionalThreadContextPtrs(ThreadContextBase *tctx, void *ptrs); 156 // Run stoptheworld while holding any platform-specific locks, as well as the 157 // allocator and thread registry locks. 158 void LockStuffAndStopTheWorld(StopTheWorldCallback callback, 159 CheckForLeaksParam* argument); 160 161 void ScanRangeForPointers(uptr begin, uptr end, 162 Frontier *frontier, 163 const char *region_type, ChunkTag tag); 164 void ScanGlobalRange(uptr begin, uptr end, Frontier *frontier); 165 166 enum IgnoreObjectResult { 167 kIgnoreObjectSuccess, 168 kIgnoreObjectAlreadyIgnored, 169 kIgnoreObjectInvalid 170 }; 171 172 // Functions called from the parent tool. 173 const char *MaybeCallLsanDefaultOptions(); 174 void InitCommonLsan(); 175 void DoLeakCheck(); 176 void DoRecoverableLeakCheckVoid(); 177 void DisableCounterUnderflow(); 178 bool DisabledInThisThread(); 179 180 // Used to implement __lsan::ScopedDisabler. 181 void DisableInThisThread(); 182 void EnableInThisThread(); 183 // Can be used to ignore memory allocated by an intercepted 184 // function. 185 struct ScopedInterceptorDisabler { 186 ScopedInterceptorDisabler() { DisableInThisThread(); } 187 ~ScopedInterceptorDisabler() { EnableInThisThread(); } 188 }; 189 190 // According to Itanium C++ ABI array cookie is a one word containing 191 // size of allocated array. 192 static inline bool IsItaniumABIArrayCookie(uptr chunk_beg, uptr chunk_size, 193 uptr addr) { 194 return chunk_size == sizeof(uptr) && chunk_beg + chunk_size == addr && 195 *reinterpret_cast<uptr *>(chunk_beg) == 0; 196 } 197 198 // According to ARM C++ ABI array cookie consists of two words: 199 // struct array_cookie { 200 // std::size_t element_size; // element_size != 0 201 // std::size_t element_count; 202 // }; 203 static inline bool IsARMABIArrayCookie(uptr chunk_beg, uptr chunk_size, 204 uptr addr) { 205 return chunk_size == 2 * sizeof(uptr) && chunk_beg + chunk_size == addr && 206 *reinterpret_cast<uptr *>(chunk_beg + sizeof(uptr)) == 0; 207 } 208 209 // Special case for "new T[0]" where T is a type with DTOR. 210 // new T[0] will allocate a cookie (one or two words) for the array size (0) 211 // and store a pointer to the end of allocated chunk. The actual cookie layout 212 // varies between platforms according to their C++ ABI implementation. 213 inline bool IsSpecialCaseOfOperatorNew0(uptr chunk_beg, uptr chunk_size, 214 uptr addr) { 215 #if defined(__arm__) 216 return IsARMABIArrayCookie(chunk_beg, chunk_size, addr); 217 #else 218 return IsItaniumABIArrayCookie(chunk_beg, chunk_size, addr); 219 #endif 220 } 221 222 // The following must be implemented in the parent tool. 223 224 void ForEachChunk(ForEachChunkCallback callback, void *arg); 225 // Returns the address range occupied by the global allocator object. 226 void GetAllocatorGlobalRange(uptr *begin, uptr *end); 227 // Wrappers for allocator's ForceLock()/ForceUnlock(). 228 void LockAllocator(); 229 void UnlockAllocator(); 230 // Returns true if [addr, addr + sizeof(void *)) is poisoned. 231 bool WordIsPoisoned(uptr addr); 232 // Wrappers for ThreadRegistry access. 233 void LockThreadRegistry() SANITIZER_NO_THREAD_SAFETY_ANALYSIS; 234 void UnlockThreadRegistry() SANITIZER_NO_THREAD_SAFETY_ANALYSIS; 235 236 struct ScopedStopTheWorldLock { 237 ScopedStopTheWorldLock() { 238 LockThreadRegistry(); 239 LockAllocator(); 240 } 241 242 ~ScopedStopTheWorldLock() { 243 UnlockAllocator(); 244 UnlockThreadRegistry(); 245 } 246 247 ScopedStopTheWorldLock &operator=(const ScopedStopTheWorldLock &) = delete; 248 ScopedStopTheWorldLock(const ScopedStopTheWorldLock &) = delete; 249 }; 250 251 ThreadRegistry *GetThreadRegistryLocked(); 252 bool GetThreadRangesLocked(tid_t os_id, uptr *stack_begin, uptr *stack_end, 253 uptr *tls_begin, uptr *tls_end, uptr *cache_begin, 254 uptr *cache_end, DTLS **dtls); 255 void GetAllThreadAllocatorCachesLocked(InternalMmapVector<uptr> *caches); 256 void ForEachExtraStackRange(tid_t os_id, RangeIteratorCallback callback, 257 void *arg); 258 // If called from the main thread, updates the main thread's TID in the thread 259 // registry. We need this to handle processes that fork() without a subsequent 260 // exec(), which invalidates the recorded TID. To update it, we must call 261 // gettid() from the main thread. Our solution is to call this function before 262 // leak checking and also before every call to pthread_create() (to handle cases 263 // where leak checking is initiated from a non-main thread). 264 void EnsureMainThreadIDIsCorrect(); 265 // If p points into a chunk that has been allocated to the user, returns its 266 // user-visible address. Otherwise, returns 0. 267 uptr PointsIntoChunk(void *p); 268 // Returns address of user-visible chunk contained in this allocator chunk. 269 uptr GetUserBegin(uptr chunk); 270 // Helper for __lsan_ignore_object(). 271 IgnoreObjectResult IgnoreObjectLocked(const void *p); 272 273 // Return the linker module, if valid for the platform. 274 LoadedModule *GetLinker(); 275 276 // Return true if LSan has finished leak checking and reported leaks. 277 bool HasReportedLeaks(); 278 279 // Run platform-specific leak handlers. 280 void HandleLeaks(); 281 282 // Wrapper for chunk metadata operations. 283 class LsanMetadata { 284 public: 285 // Constructor accepts address of user-visible chunk. 286 explicit LsanMetadata(uptr chunk); 287 bool allocated() const; 288 ChunkTag tag() const; 289 void set_tag(ChunkTag value); 290 uptr requested_size() const; 291 u32 stack_trace_id() const; 292 private: 293 void *metadata_; 294 }; 295 296 } // namespace __lsan 297 298 extern "C" { 299 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE 300 const char *__lsan_default_options(); 301 302 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE 303 int __lsan_is_turned_off(); 304 305 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE 306 const char *__lsan_default_suppressions(); 307 308 SANITIZER_INTERFACE_ATTRIBUTE 309 void __lsan_register_root_region(const void *p, __lsan::uptr size); 310 311 SANITIZER_INTERFACE_ATTRIBUTE 312 void __lsan_unregister_root_region(const void *p, __lsan::uptr size); 313 314 } // extern "C" 315 316 #endif // LSAN_COMMON_H 317