145
|
1 //===-- asan_descriptions.cpp -----------------------------------*- C++ -*-===//
|
|
2 //
|
|
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
4 // See https://llvm.org/LICENSE.txt for license information.
|
|
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
6 //
|
|
7 //===----------------------------------------------------------------------===//
|
|
8 //
|
|
9 // This file is a part of AddressSanitizer, an address sanity checker.
|
|
10 //
|
|
11 // ASan functions for getting information about an address and/or printing it.
|
|
12 //===----------------------------------------------------------------------===//
|
|
13
|
|
14 #include "asan_descriptions.h"
|
|
15 #include "asan_mapping.h"
|
|
16 #include "asan_report.h"
|
|
17 #include "asan_stack.h"
|
|
18 #include "sanitizer_common/sanitizer_stackdepot.h"
|
|
19
|
|
20 namespace __asan {
|
|
21
|
|
22 AsanThreadIdAndName::AsanThreadIdAndName(AsanThreadContext *t) {
|
|
23 Init(t->tid, t->name);
|
|
24 }
|
|
25
|
|
26 AsanThreadIdAndName::AsanThreadIdAndName(u32 tid) {
|
|
27 if (tid == kInvalidTid) {
|
|
28 Init(tid, "");
|
|
29 } else {
|
|
30 asanThreadRegistry().CheckLocked();
|
|
31 AsanThreadContext *t = GetThreadContextByTidLocked(tid);
|
|
32 Init(tid, t->name);
|
|
33 }
|
|
34 }
|
|
35
|
|
36 void AsanThreadIdAndName::Init(u32 tid, const char *tname) {
|
|
37 int len = internal_snprintf(name, sizeof(name), "T%d", tid);
|
|
38 CHECK(((unsigned int)len) < sizeof(name));
|
|
39 if (tname[0] != '\0')
|
|
40 internal_snprintf(&name[len], sizeof(name) - len, " (%s)", tname);
|
|
41 }
|
|
42
|
|
43 void DescribeThread(AsanThreadContext *context) {
|
|
44 CHECK(context);
|
|
45 asanThreadRegistry().CheckLocked();
|
|
46 // No need to announce the main thread.
|
|
47 if (context->tid == 0 || context->announced) {
|
|
48 return;
|
|
49 }
|
|
50 context->announced = true;
|
|
51 InternalScopedString str(1024);
|
|
52 str.append("Thread %s", AsanThreadIdAndName(context).c_str());
|
|
53 if (context->parent_tid == kInvalidTid) {
|
|
54 str.append(" created by unknown thread\n");
|
|
55 Printf("%s", str.data());
|
|
56 return;
|
|
57 }
|
|
58 str.append(" created by %s here:\n",
|
|
59 AsanThreadIdAndName(context->parent_tid).c_str());
|
|
60 Printf("%s", str.data());
|
|
61 StackDepotGet(context->stack_id).Print();
|
|
62 // Recursively described parent thread if needed.
|
|
63 if (flags()->print_full_thread_history) {
|
|
64 AsanThreadContext *parent_context =
|
|
65 GetThreadContextByTidLocked(context->parent_tid);
|
|
66 DescribeThread(parent_context);
|
|
67 }
|
|
68 }
|
|
69
|
|
70 // Shadow descriptions
|
|
71 static bool GetShadowKind(uptr addr, ShadowKind *shadow_kind) {
|
|
72 CHECK(!AddrIsInMem(addr));
|
|
73 if (AddrIsInShadowGap(addr)) {
|
|
74 *shadow_kind = kShadowKindGap;
|
|
75 } else if (AddrIsInHighShadow(addr)) {
|
|
76 *shadow_kind = kShadowKindHigh;
|
|
77 } else if (AddrIsInLowShadow(addr)) {
|
|
78 *shadow_kind = kShadowKindLow;
|
|
79 } else {
|
|
80 CHECK(0 && "Address is not in memory and not in shadow?");
|
|
81 return false;
|
|
82 }
|
|
83 return true;
|
|
84 }
|
|
85
|
|
86 bool DescribeAddressIfShadow(uptr addr) {
|
|
87 ShadowAddressDescription descr;
|
|
88 if (!GetShadowAddressInformation(addr, &descr)) return false;
|
|
89 descr.Print();
|
|
90 return true;
|
|
91 }
|
|
92
|
|
93 bool GetShadowAddressInformation(uptr addr, ShadowAddressDescription *descr) {
|
|
94 if (AddrIsInMem(addr)) return false;
|
|
95 ShadowKind shadow_kind;
|
|
96 if (!GetShadowKind(addr, &shadow_kind)) return false;
|
|
97 if (shadow_kind != kShadowKindGap) descr->shadow_byte = *(u8 *)addr;
|
|
98 descr->addr = addr;
|
|
99 descr->kind = shadow_kind;
|
|
100 return true;
|
|
101 }
|
|
102
|
|
103 // Heap descriptions
|
|
104 static void GetAccessToHeapChunkInformation(ChunkAccess *descr,
|
|
105 AsanChunkView chunk, uptr addr,
|
|
106 uptr access_size) {
|
|
107 descr->bad_addr = addr;
|
|
108 if (chunk.AddrIsAtLeft(addr, access_size, &descr->offset)) {
|
|
109 descr->access_type = kAccessTypeLeft;
|
|
110 } else if (chunk.AddrIsAtRight(addr, access_size, &descr->offset)) {
|
|
111 descr->access_type = kAccessTypeRight;
|
|
112 if (descr->offset < 0) {
|
|
113 descr->bad_addr -= descr->offset;
|
|
114 descr->offset = 0;
|
|
115 }
|
|
116 } else if (chunk.AddrIsInside(addr, access_size, &descr->offset)) {
|
|
117 descr->access_type = kAccessTypeInside;
|
|
118 } else {
|
|
119 descr->access_type = kAccessTypeUnknown;
|
|
120 }
|
|
121 descr->chunk_begin = chunk.Beg();
|
|
122 descr->chunk_size = chunk.UsedSize();
|
|
123 descr->user_requested_alignment = chunk.UserRequestedAlignment();
|
|
124 descr->alloc_type = chunk.GetAllocType();
|
|
125 }
|
|
126
|
|
127 static void PrintHeapChunkAccess(uptr addr, const ChunkAccess &descr) {
|
|
128 Decorator d;
|
|
129 InternalScopedString str(4096);
|
|
130 str.append("%s", d.Location());
|
|
131 switch (descr.access_type) {
|
|
132 case kAccessTypeLeft:
|
|
133 str.append("%p is located %zd bytes to the left of",
|
|
134 (void *)descr.bad_addr, descr.offset);
|
|
135 break;
|
|
136 case kAccessTypeRight:
|
|
137 str.append("%p is located %zd bytes to the right of",
|
|
138 (void *)descr.bad_addr, descr.offset);
|
|
139 break;
|
|
140 case kAccessTypeInside:
|
|
141 str.append("%p is located %zd bytes inside of", (void *)descr.bad_addr,
|
|
142 descr.offset);
|
|
143 break;
|
|
144 case kAccessTypeUnknown:
|
|
145 str.append(
|
|
146 "%p is located somewhere around (this is AddressSanitizer bug!)",
|
|
147 (void *)descr.bad_addr);
|
|
148 }
|
|
149 str.append(" %zu-byte region [%p,%p)\n", descr.chunk_size,
|
|
150 (void *)descr.chunk_begin,
|
|
151 (void *)(descr.chunk_begin + descr.chunk_size));
|
|
152 str.append("%s", d.Default());
|
|
153 Printf("%s", str.data());
|
|
154 }
|
|
155
|
|
156 bool GetHeapAddressInformation(uptr addr, uptr access_size,
|
|
157 HeapAddressDescription *descr) {
|
|
158 AsanChunkView chunk = FindHeapChunkByAddress(addr);
|
|
159 if (!chunk.IsValid()) {
|
|
160 return false;
|
|
161 }
|
|
162 descr->addr = addr;
|
|
163 GetAccessToHeapChunkInformation(&descr->chunk_access, chunk, addr,
|
|
164 access_size);
|
|
165 CHECK_NE(chunk.AllocTid(), kInvalidTid);
|
|
166 descr->alloc_tid = chunk.AllocTid();
|
|
167 descr->alloc_stack_id = chunk.GetAllocStackId();
|
|
168 descr->free_tid = chunk.FreeTid();
|
|
169 if (descr->free_tid != kInvalidTid)
|
|
170 descr->free_stack_id = chunk.GetFreeStackId();
|
|
171 return true;
|
|
172 }
|
|
173
|
|
174 static StackTrace GetStackTraceFromId(u32 id) {
|
|
175 CHECK(id);
|
|
176 StackTrace res = StackDepotGet(id);
|
|
177 CHECK(res.trace);
|
|
178 return res;
|
|
179 }
|
|
180
|
|
181 bool DescribeAddressIfHeap(uptr addr, uptr access_size) {
|
|
182 HeapAddressDescription descr;
|
|
183 if (!GetHeapAddressInformation(addr, access_size, &descr)) {
|
|
184 Printf(
|
|
185 "AddressSanitizer can not describe address in more detail "
|
|
186 "(wild memory access suspected).\n");
|
|
187 return false;
|
|
188 }
|
|
189 descr.Print();
|
|
190 return true;
|
|
191 }
|
|
192
|
|
193 // Stack descriptions
|
|
194 bool GetStackAddressInformation(uptr addr, uptr access_size,
|
|
195 StackAddressDescription *descr) {
|
|
196 AsanThread *t = FindThreadByStackAddress(addr);
|
|
197 if (!t) return false;
|
|
198
|
|
199 descr->addr = addr;
|
|
200 descr->tid = t->tid();
|
|
201 // Try to fetch precise stack frame for this access.
|
|
202 AsanThread::StackFrameAccess access;
|
|
203 if (!t->GetStackFrameAccessByAddr(addr, &access)) {
|
|
204 descr->frame_descr = nullptr;
|
|
205 return true;
|
|
206 }
|
|
207
|
|
208 descr->offset = access.offset;
|
|
209 descr->access_size = access_size;
|
|
210 descr->frame_pc = access.frame_pc;
|
|
211 descr->frame_descr = access.frame_descr;
|
|
212
|
|
213 #if SANITIZER_PPC64V1
|
|
214 // On PowerPC64 ELFv1, the address of a function actually points to a
|
|
215 // three-doubleword data structure with the first field containing
|
|
216 // the address of the function's code.
|
|
217 descr->frame_pc = *reinterpret_cast<uptr *>(descr->frame_pc);
|
|
218 #endif
|
|
219 descr->frame_pc += 16;
|
|
220
|
|
221 return true;
|
|
222 }
|
|
223
|
|
224 static void PrintAccessAndVarIntersection(const StackVarDescr &var, uptr addr,
|
|
225 uptr access_size, uptr prev_var_end,
|
|
226 uptr next_var_beg) {
|
|
227 uptr var_end = var.beg + var.size;
|
|
228 uptr addr_end = addr + access_size;
|
|
229 const char *pos_descr = nullptr;
|
|
230 // If the variable [var.beg, var_end) is the nearest variable to the
|
|
231 // current memory access, indicate it in the log.
|
|
232 if (addr >= var.beg) {
|
|
233 if (addr_end <= var_end)
|
|
234 pos_descr = "is inside"; // May happen if this is a use-after-return.
|
|
235 else if (addr < var_end)
|
|
236 pos_descr = "partially overflows";
|
|
237 else if (addr_end <= next_var_beg &&
|
|
238 next_var_beg - addr_end >= addr - var_end)
|
|
239 pos_descr = "overflows";
|
|
240 } else {
|
|
241 if (addr_end > var.beg)
|
|
242 pos_descr = "partially underflows";
|
|
243 else if (addr >= prev_var_end && addr - prev_var_end >= var.beg - addr_end)
|
|
244 pos_descr = "underflows";
|
|
245 }
|
|
246 InternalScopedString str(1024);
|
|
247 str.append(" [%zd, %zd)", var.beg, var_end);
|
|
248 // Render variable name.
|
|
249 str.append(" '");
|
|
250 for (uptr i = 0; i < var.name_len; ++i) {
|
|
251 str.append("%c", var.name_pos[i]);
|
|
252 }
|
|
253 str.append("'");
|
|
254 if (var.line > 0) {
|
|
255 str.append(" (line %d)", var.line);
|
|
256 }
|
|
257 if (pos_descr) {
|
|
258 Decorator d;
|
|
259 // FIXME: we may want to also print the size of the access here,
|
|
260 // but in case of accesses generated by memset it may be confusing.
|
|
261 str.append("%s <== Memory access at offset %zd %s this variable%s\n",
|
|
262 d.Location(), addr, pos_descr, d.Default());
|
|
263 } else {
|
|
264 str.append("\n");
|
|
265 }
|
|
266 Printf("%s", str.data());
|
|
267 }
|
|
268
|
|
269 bool DescribeAddressIfStack(uptr addr, uptr access_size) {
|
|
270 StackAddressDescription descr;
|
|
271 if (!GetStackAddressInformation(addr, access_size, &descr)) return false;
|
|
272 descr.Print();
|
|
273 return true;
|
|
274 }
|
|
275
|
|
276 // Global descriptions
|
|
277 static void DescribeAddressRelativeToGlobal(uptr addr, uptr access_size,
|
|
278 const __asan_global &g) {
|
|
279 InternalScopedString str(4096);
|
|
280 Decorator d;
|
|
281 str.append("%s", d.Location());
|
|
282 if (addr < g.beg) {
|
|
283 str.append("%p is located %zd bytes to the left", (void *)addr,
|
|
284 g.beg - addr);
|
|
285 } else if (addr + access_size > g.beg + g.size) {
|
|
286 if (addr < g.beg + g.size) addr = g.beg + g.size;
|
|
287 str.append("%p is located %zd bytes to the right", (void *)addr,
|
|
288 addr - (g.beg + g.size));
|
|
289 } else {
|
|
290 // Can it happen?
|
|
291 str.append("%p is located %zd bytes inside", (void *)addr, addr - g.beg);
|
|
292 }
|
|
293 str.append(" of global variable '%s' defined in '",
|
|
294 MaybeDemangleGlobalName(g.name));
|
|
295 PrintGlobalLocation(&str, g);
|
|
296 str.append("' (0x%zx) of size %zu\n", g.beg, g.size);
|
|
297 str.append("%s", d.Default());
|
|
298 PrintGlobalNameIfASCII(&str, g);
|
|
299 Printf("%s", str.data());
|
|
300 }
|
|
301
|
|
302 bool GetGlobalAddressInformation(uptr addr, uptr access_size,
|
|
303 GlobalAddressDescription *descr) {
|
|
304 descr->addr = addr;
|
|
305 int globals_num = GetGlobalsForAddress(addr, descr->globals, descr->reg_sites,
|
|
306 ARRAY_SIZE(descr->globals));
|
|
307 descr->size = globals_num;
|
|
308 descr->access_size = access_size;
|
|
309 return globals_num != 0;
|
|
310 }
|
|
311
|
|
312 bool DescribeAddressIfGlobal(uptr addr, uptr access_size,
|
|
313 const char *bug_type) {
|
|
314 GlobalAddressDescription descr;
|
|
315 if (!GetGlobalAddressInformation(addr, access_size, &descr)) return false;
|
|
316
|
|
317 descr.Print(bug_type);
|
|
318 return true;
|
|
319 }
|
|
320
|
|
321 void ShadowAddressDescription::Print() const {
|
|
322 Printf("Address %p is located in the %s area.\n", addr, ShadowNames[kind]);
|
|
323 }
|
|
324
|
|
325 void GlobalAddressDescription::Print(const char *bug_type) const {
|
|
326 for (int i = 0; i < size; i++) {
|
|
327 DescribeAddressRelativeToGlobal(addr, access_size, globals[i]);
|
|
328 if (bug_type &&
|
|
329 0 == internal_strcmp(bug_type, "initialization-order-fiasco") &&
|
|
330 reg_sites[i]) {
|
|
331 Printf(" registered at:\n");
|
|
332 StackDepotGet(reg_sites[i]).Print();
|
|
333 }
|
|
334 }
|
|
335 }
|
|
336
|
|
337 bool GlobalAddressDescription::PointsInsideTheSameVariable(
|
|
338 const GlobalAddressDescription &other) const {
|
|
339 if (size == 0 || other.size == 0) return false;
|
|
340
|
|
341 for (uptr i = 0; i < size; i++) {
|
|
342 const __asan_global &a = globals[i];
|
|
343 for (uptr j = 0; j < other.size; j++) {
|
|
344 const __asan_global &b = other.globals[j];
|
|
345 if (a.beg == b.beg &&
|
|
346 a.beg <= addr &&
|
|
347 b.beg <= other.addr &&
|
|
348 (addr + access_size) < (a.beg + a.size) &&
|
|
349 (other.addr + other.access_size) < (b.beg + b.size))
|
|
350 return true;
|
|
351 }
|
|
352 }
|
|
353
|
|
354 return false;
|
|
355 }
|
|
356
|
|
357 void StackAddressDescription::Print() const {
|
|
358 Decorator d;
|
|
359 Printf("%s", d.Location());
|
|
360 Printf("Address %p is located in stack of thread %s", addr,
|
|
361 AsanThreadIdAndName(tid).c_str());
|
|
362
|
|
363 if (!frame_descr) {
|
|
364 Printf("%s\n", d.Default());
|
|
365 return;
|
|
366 }
|
|
367 Printf(" at offset %zu in frame%s\n", offset, d.Default());
|
|
368
|
|
369 // Now we print the frame where the alloca has happened.
|
|
370 // We print this frame as a stack trace with one element.
|
|
371 // The symbolizer may print more than one frame if inlining was involved.
|
|
372 // The frame numbers may be different than those in the stack trace printed
|
|
373 // previously. That's unfortunate, but I have no better solution,
|
|
374 // especially given that the alloca may be from entirely different place
|
|
375 // (e.g. use-after-scope, or different thread's stack).
|
|
376 Printf("%s", d.Default());
|
|
377 StackTrace alloca_stack(&frame_pc, 1);
|
|
378 alloca_stack.Print();
|
|
379
|
|
380 InternalMmapVector<StackVarDescr> vars;
|
|
381 vars.reserve(16);
|
|
382 if (!ParseFrameDescription(frame_descr, &vars)) {
|
|
383 Printf(
|
|
384 "AddressSanitizer can't parse the stack frame "
|
|
385 "descriptor: |%s|\n",
|
|
386 frame_descr);
|
|
387 // 'addr' is a stack address, so return true even if we can't parse frame
|
|
388 return;
|
|
389 }
|
|
390 uptr n_objects = vars.size();
|
|
391 // Report the number of stack objects.
|
|
392 Printf(" This frame has %zu object(s):\n", n_objects);
|
|
393
|
|
394 // Report all objects in this frame.
|
|
395 for (uptr i = 0; i < n_objects; i++) {
|
|
396 uptr prev_var_end = i ? vars[i - 1].beg + vars[i - 1].size : 0;
|
|
397 uptr next_var_beg = i + 1 < n_objects ? vars[i + 1].beg : ~(0UL);
|
|
398 PrintAccessAndVarIntersection(vars[i], offset, access_size, prev_var_end,
|
|
399 next_var_beg);
|
|
400 }
|
|
401 Printf(
|
|
402 "HINT: this may be a false positive if your program uses "
|
|
403 "some custom stack unwind mechanism, swapcontext or vfork\n");
|
|
404 if (SANITIZER_WINDOWS)
|
|
405 Printf(" (longjmp, SEH and C++ exceptions *are* supported)\n");
|
|
406 else
|
|
407 Printf(" (longjmp and C++ exceptions *are* supported)\n");
|
|
408
|
|
409 DescribeThread(GetThreadContextByTidLocked(tid));
|
|
410 }
|
|
411
|
|
412 void HeapAddressDescription::Print() const {
|
|
413 PrintHeapChunkAccess(addr, chunk_access);
|
|
414
|
|
415 asanThreadRegistry().CheckLocked();
|
|
416 AsanThreadContext *alloc_thread = GetThreadContextByTidLocked(alloc_tid);
|
|
417 StackTrace alloc_stack = GetStackTraceFromId(alloc_stack_id);
|
|
418
|
|
419 Decorator d;
|
|
420 AsanThreadContext *free_thread = nullptr;
|
|
421 if (free_tid != kInvalidTid) {
|
|
422 free_thread = GetThreadContextByTidLocked(free_tid);
|
|
423 Printf("%sfreed by thread %s here:%s\n", d.Allocation(),
|
|
424 AsanThreadIdAndName(free_thread).c_str(), d.Default());
|
|
425 StackTrace free_stack = GetStackTraceFromId(free_stack_id);
|
|
426 free_stack.Print();
|
|
427 Printf("%spreviously allocated by thread %s here:%s\n", d.Allocation(),
|
|
428 AsanThreadIdAndName(alloc_thread).c_str(), d.Default());
|
|
429 } else {
|
|
430 Printf("%sallocated by thread %s here:%s\n", d.Allocation(),
|
|
431 AsanThreadIdAndName(alloc_thread).c_str(), d.Default());
|
|
432 }
|
|
433 alloc_stack.Print();
|
|
434 DescribeThread(GetCurrentThread());
|
|
435 if (free_thread) DescribeThread(free_thread);
|
|
436 DescribeThread(alloc_thread);
|
|
437 }
|
|
438
|
|
439 AddressDescription::AddressDescription(uptr addr, uptr access_size,
|
|
440 bool shouldLockThreadRegistry) {
|
|
441 if (GetShadowAddressInformation(addr, &data.shadow)) {
|
|
442 data.kind = kAddressKindShadow;
|
|
443 return;
|
|
444 }
|
|
445 if (GetHeapAddressInformation(addr, access_size, &data.heap)) {
|
|
446 data.kind = kAddressKindHeap;
|
|
447 return;
|
|
448 }
|
|
449
|
|
450 bool isStackMemory = false;
|
|
451 if (shouldLockThreadRegistry) {
|
|
452 ThreadRegistryLock l(&asanThreadRegistry());
|
|
453 isStackMemory = GetStackAddressInformation(addr, access_size, &data.stack);
|
|
454 } else {
|
|
455 isStackMemory = GetStackAddressInformation(addr, access_size, &data.stack);
|
|
456 }
|
|
457 if (isStackMemory) {
|
|
458 data.kind = kAddressKindStack;
|
|
459 return;
|
|
460 }
|
|
461
|
|
462 if (GetGlobalAddressInformation(addr, access_size, &data.global)) {
|
|
463 data.kind = kAddressKindGlobal;
|
|
464 return;
|
|
465 }
|
|
466 data.kind = kAddressKindWild;
|
|
467 addr = 0;
|
|
468 }
|
|
469
|
|
470 void PrintAddressDescription(uptr addr, uptr access_size,
|
|
471 const char *bug_type) {
|
|
472 ShadowAddressDescription shadow_descr;
|
|
473 if (GetShadowAddressInformation(addr, &shadow_descr)) {
|
|
474 shadow_descr.Print();
|
|
475 return;
|
|
476 }
|
|
477
|
|
478 GlobalAddressDescription global_descr;
|
|
479 if (GetGlobalAddressInformation(addr, access_size, &global_descr)) {
|
|
480 global_descr.Print(bug_type);
|
|
481 return;
|
|
482 }
|
|
483
|
|
484 StackAddressDescription stack_descr;
|
|
485 if (GetStackAddressInformation(addr, access_size, &stack_descr)) {
|
|
486 stack_descr.Print();
|
|
487 return;
|
|
488 }
|
|
489
|
|
490 HeapAddressDescription heap_descr;
|
|
491 if (GetHeapAddressInformation(addr, access_size, &heap_descr)) {
|
|
492 heap_descr.Print();
|
|
493 return;
|
|
494 }
|
|
495
|
|
496 // We exhausted our possibilities. Bail out.
|
|
497 Printf(
|
|
498 "AddressSanitizer can not describe address in more detail "
|
|
499 "(wild memory access suspected).\n");
|
|
500 }
|
|
501 } // namespace __asan
|