1 //===-- ubsan_handlers_cxx.cpp --------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // Error logging entry points for the UBSan runtime, which are only used for C++ 10 // compilations. This file is permitted to use language features which require 11 // linking against a C++ ABI library. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "ubsan_platform.h" 16 #if CAN_SANITIZE_UB 17 #include "ubsan_handlers.h" 18 #include "ubsan_handlers_cxx.h" 19 #include "ubsan_diag.h" 20 #include "ubsan_type_hash.h" 21 22 #include "sanitizer_common/sanitizer_common.h" 23 #include "sanitizer_common/sanitizer_suppressions.h" 24 25 using namespace __sanitizer; 26 using namespace __ubsan; 27 28 namespace __ubsan { 29 extern const char *TypeCheckKinds[]; 30 } 31 32 // Returns true if UBSan has printed an error report. 33 static bool HandleDynamicTypeCacheMiss( 34 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash, 35 ReportOptions Opts) { 36 if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash)) 37 // Just a cache miss. The type matches after all. 38 return false; 39 40 // Check if error report should be suppressed. 41 DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer); 42 if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName())) 43 return false; 44 45 SourceLocation Loc = Data->Loc.acquire(); 46 ErrorType ET = ErrorType::DynamicTypeMismatch; 47 if (ignoreReport(Loc, Opts, ET)) 48 return false; 49 50 ScopedReport R(Opts, Loc, ET); 51 52 Diag(Loc, DL_Error, ET, 53 "%0 address %1 which does not point to an object of type %2") 54 << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type; 55 56 // If possible, say what type it actually points to. 57 if (!DTI.isValid()) { 58 if (DTI.getOffset() < -VptrMaxOffsetToTop || DTI.getOffset() > VptrMaxOffsetToTop) { 59 Diag(Pointer, DL_Note, ET, 60 "object has a possibly invalid vptr: abs(offset to top) too big") 61 << TypeName(DTI.getMostDerivedTypeName()) 62 << Range(Pointer, Pointer + sizeof(uptr), "possibly invalid vptr"); 63 } else { 64 Diag(Pointer, DL_Note, ET, "object has invalid vptr") 65 << TypeName(DTI.getMostDerivedTypeName()) 66 << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr"); 67 } 68 } else if (!DTI.getOffset()) 69 Diag(Pointer, DL_Note, ET, "object is of type %0") 70 << TypeName(DTI.getMostDerivedTypeName()) 71 << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0"); 72 else 73 // FIXME: Find the type at the specified offset, and include that 74 // in the note. 75 Diag(Pointer - DTI.getOffset(), DL_Note, ET, 76 "object is base class subobject at offset %0 within object of type %1") 77 << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName()) 78 << TypeName(DTI.getSubobjectTypeName()) 79 << Range(Pointer, Pointer + sizeof(uptr), 80 "vptr for %2 base class of %1"); 81 return true; 82 } 83 84 void __ubsan::__ubsan_handle_dynamic_type_cache_miss( 85 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) { 86 GET_REPORT_OPTIONS(false); 87 HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts); 88 } 89 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort( 90 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) { 91 // Note: -fsanitize=vptr is always recoverable. 92 GET_REPORT_OPTIONS(false); 93 if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts)) 94 Die(); 95 } 96 97 namespace __ubsan { 98 void __ubsan_handle_cfi_bad_type(CFICheckFailData *Data, ValueHandle Vtable, 99 bool ValidVtable, ReportOptions Opts) { 100 SourceLocation Loc = Data->Loc.acquire(); 101 ErrorType ET = ErrorType::CFIBadType; 102 103 if (ignoreReport(Loc, Opts, ET)) 104 return; 105 106 ScopedReport R(Opts, Loc, ET); 107 DynamicTypeInfo DTI = ValidVtable 108 ? getDynamicTypeInfoFromVtable((void *)Vtable) 109 : DynamicTypeInfo(0, 0, 0); 110 111 const char *CheckKindStr; 112 switch (Data->CheckKind) { 113 case CFITCK_VCall: 114 CheckKindStr = "virtual call"; 115 break; 116 case CFITCK_NVCall: 117 CheckKindStr = "non-virtual call"; 118 break; 119 case CFITCK_DerivedCast: 120 CheckKindStr = "base-to-derived cast"; 121 break; 122 case CFITCK_UnrelatedCast: 123 CheckKindStr = "cast to unrelated type"; 124 break; 125 case CFITCK_VMFCall: 126 CheckKindStr = "virtual pointer to member function call"; 127 break; 128 case CFITCK_ICall: 129 case CFITCK_NVMFCall: 130 Die(); 131 } 132 133 Diag(Loc, DL_Error, ET, 134 "control flow integrity check for type %0 failed during " 135 "%1 (vtable address %2)") 136 << Data->Type << CheckKindStr << (void *)Vtable; 137 138 // If possible, say what type it actually points to. 139 if (!DTI.isValid()) 140 Diag(Vtable, DL_Note, ET, "invalid vtable"); 141 else 142 Diag(Vtable, DL_Note, ET, "vtable is of type %0") 143 << TypeName(DTI.getMostDerivedTypeName()); 144 145 // If the failure involved different DSOs for the check location and vtable, 146 // report the DSO names. 147 const char *DstModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Vtable); 148 if (!DstModule) 149 DstModule = "(unknown)"; 150 151 const char *SrcModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Opts.pc); 152 if (!SrcModule) 153 SrcModule = "(unknown)"; 154 155 if (internal_strcmp(SrcModule, DstModule)) 156 Diag(Loc, DL_Note, ET, "check failed in %0, vtable located in %1") 157 << SrcModule << DstModule; 158 } 159 160 static bool handleFunctionTypeMismatch(FunctionTypeMismatchData *Data, 161 ValueHandle Function, 162 ValueHandle calleeRTTI, 163 ValueHandle fnRTTI, ReportOptions Opts) { 164 if (checkTypeInfoEquality(reinterpret_cast<void *>(calleeRTTI), 165 reinterpret_cast<void *>(fnRTTI))) 166 return false; 167 168 SourceLocation CallLoc = Data->Loc.acquire(); 169 ErrorType ET = ErrorType::FunctionTypeMismatch; 170 171 if (ignoreReport(CallLoc, Opts, ET)) 172 return true; 173 174 ScopedReport R(Opts, CallLoc, ET); 175 176 SymbolizedStackHolder FLoc(getSymbolizedLocation(Function)); 177 const char *FName = FLoc.get()->info.function; 178 if (!FName) 179 FName = "(unknown)"; 180 181 Diag(CallLoc, DL_Error, ET, 182 "call to function %0 through pointer to incorrect function type %1") 183 << FName << Data->Type; 184 Diag(FLoc, DL_Note, ET, "%0 defined here") << FName; 185 return true; 186 } 187 188 void __ubsan_handle_function_type_mismatch_v1(FunctionTypeMismatchData *Data, 189 ValueHandle Function, 190 ValueHandle calleeRTTI, 191 ValueHandle fnRTTI) { 192 GET_REPORT_OPTIONS(false); 193 handleFunctionTypeMismatch(Data, Function, calleeRTTI, fnRTTI, Opts); 194 } 195 196 void __ubsan_handle_function_type_mismatch_v1_abort( 197 FunctionTypeMismatchData *Data, ValueHandle Function, 198 ValueHandle calleeRTTI, ValueHandle fnRTTI) { 199 GET_REPORT_OPTIONS(true); 200 if (handleFunctionTypeMismatch(Data, Function, calleeRTTI, fnRTTI, Opts)) 201 Die(); 202 } 203 } // namespace __ubsan 204 205 #endif // CAN_SANITIZE_UB 206