1 //=-- lsan_common_mac.cpp -------------------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file is a part of LeakSanitizer.
10 // Implementation of common leak checking functionality. Darwin-specific code.
11 //
12 //===----------------------------------------------------------------------===//
13
14 #include "sanitizer_common/sanitizer_platform.h"
15 #include "sanitizer_common/sanitizer_libc.h"
16 #include "lsan_common.h"
17
18 #if CAN_SANITIZE_LEAKS && SANITIZER_APPLE
19
20 # include <mach/mach.h>
21 # include <mach/vm_statistics.h>
22 # include <pthread.h>
23
24 # include "lsan_allocator.h"
25 # include "sanitizer_common/sanitizer_allocator_internal.h"
26 namespace __lsan {
27
28 enum class SeenRegion {
29 None = 0,
30 AllocOnce = 1 << 0,
31 LibDispatch = 1 << 1,
32 Foundation = 1 << 2,
33 All = AllocOnce | LibDispatch | Foundation
34 };
35
operator |(SeenRegion left,SeenRegion right)36 inline SeenRegion operator|(SeenRegion left, SeenRegion right) {
37 return static_cast<SeenRegion>(static_cast<int>(left) |
38 static_cast<int>(right));
39 }
40
operator |=(SeenRegion & left,const SeenRegion & right)41 inline SeenRegion &operator|=(SeenRegion &left, const SeenRegion &right) {
42 left = left | right;
43 return left;
44 }
45
46 struct RegionScanState {
47 SeenRegion seen_regions = SeenRegion::None;
48 bool in_libdispatch = false;
49 };
50
51 typedef struct {
52 int disable_counter;
53 u32 current_thread_id;
54 AllocatorCache cache;
55 } thread_local_data_t;
56
57 static pthread_key_t key;
58 static pthread_once_t key_once = PTHREAD_ONCE_INIT;
59
60 // The main thread destructor requires the current thread id,
61 // so we can't destroy it until it's been used and reset to invalid tid
restore_tid_data(void * ptr)62 void restore_tid_data(void *ptr) {
63 thread_local_data_t *data = (thread_local_data_t *)ptr;
64 if (data->current_thread_id != kInvalidTid)
65 pthread_setspecific(key, data);
66 }
67
make_tls_key()68 static void make_tls_key() {
69 CHECK_EQ(pthread_key_create(&key, restore_tid_data), 0);
70 }
71
get_tls_val(bool alloc)72 static thread_local_data_t *get_tls_val(bool alloc) {
73 pthread_once(&key_once, make_tls_key);
74
75 thread_local_data_t *ptr = (thread_local_data_t *)pthread_getspecific(key);
76 if (ptr == NULL && alloc) {
77 ptr = (thread_local_data_t *)InternalAlloc(sizeof(*ptr));
78 ptr->disable_counter = 0;
79 ptr->current_thread_id = kInvalidTid;
80 ptr->cache = AllocatorCache();
81 pthread_setspecific(key, ptr);
82 }
83
84 return ptr;
85 }
86
DisabledInThisThread()87 bool DisabledInThisThread() {
88 thread_local_data_t *data = get_tls_val(false);
89 return data ? data->disable_counter > 0 : false;
90 }
91
DisableInThisThread()92 void DisableInThisThread() { ++get_tls_val(true)->disable_counter; }
93
EnableInThisThread()94 void EnableInThisThread() {
95 int *disable_counter = &get_tls_val(true)->disable_counter;
96 if (*disable_counter == 0) {
97 DisableCounterUnderflow();
98 }
99 --*disable_counter;
100 }
101
GetCurrentThread()102 u32 GetCurrentThread() {
103 thread_local_data_t *data = get_tls_val(false);
104 return data ? data->current_thread_id : kInvalidTid;
105 }
106
SetCurrentThread(u32 tid)107 void SetCurrentThread(u32 tid) { get_tls_val(true)->current_thread_id = tid; }
108
GetAllocatorCache()109 AllocatorCache *GetAllocatorCache() { return &get_tls_val(true)->cache; }
110
GetLinker()111 LoadedModule *GetLinker() { return nullptr; }
112
113 // Required on Linux for initialization of TLS behavior, but should not be
114 // required on Darwin.
InitializePlatformSpecificModules()115 void InitializePlatformSpecificModules() {}
116
117 // Sections which can't contain contain global pointers. This list errs on the
118 // side of caution to avoid false positives, at the expense of performance.
119 //
120 // Other potentially safe sections include:
121 // __all_image_info, __crash_info, __const, __got, __interpose, __objc_msg_break
122 //
123 // Sections which definitely cannot be included here are:
124 // __objc_data, __objc_const, __data, __bss, __common, __thread_data,
125 // __thread_bss, __thread_vars, __objc_opt_rw, __objc_opt_ptrs
126 static const char *kSkippedSecNames[] = {
127 "__cfstring", "__la_symbol_ptr", "__mod_init_func",
128 "__mod_term_func", "__nl_symbol_ptr", "__objc_classlist",
129 "__objc_classrefs", "__objc_imageinfo", "__objc_nlclslist",
130 "__objc_protolist", "__objc_selrefs", "__objc_superrefs"};
131
132 // Scans global variables for heap pointers.
ProcessGlobalRegions(Frontier * frontier)133 void ProcessGlobalRegions(Frontier *frontier) {
134 for (auto name : kSkippedSecNames)
135 CHECK(internal_strnlen(name, kMaxSegName + 1) <= kMaxSegName);
136
137 MemoryMappingLayout memory_mapping(false);
138 InternalMmapVector<LoadedModule> modules;
139 modules.reserve(128);
140 memory_mapping.DumpListOfModules(&modules);
141 for (uptr i = 0; i < modules.size(); ++i) {
142 // Even when global scanning is disabled, we still need to scan
143 // system libraries for stashed pointers
144 if (!flags()->use_globals && modules[i].instrumented()) continue;
145
146 for (const __sanitizer::LoadedModule::AddressRange &range :
147 modules[i].ranges()) {
148 // Sections storing global variables are writable and non-executable
149 if (range.executable || !range.writable) continue;
150
151 for (auto name : kSkippedSecNames) {
152 if (!internal_strcmp(range.name, name)) continue;
153 }
154
155 ScanGlobalRange(range.beg, range.end, frontier);
156 }
157 }
158 }
159
ProcessPlatformSpecificAllocations(Frontier * frontier)160 void ProcessPlatformSpecificAllocations(Frontier *frontier) {
161 vm_address_t address = 0;
162 kern_return_t err = KERN_SUCCESS;
163
164 InternalMmapVectorNoCtor<RootRegion> const *root_regions = GetRootRegions();
165
166 RegionScanState scan_state;
167 while (err == KERN_SUCCESS) {
168 vm_size_t size = 0;
169 unsigned depth = 1;
170 struct vm_region_submap_info_64 info;
171 mach_msg_type_number_t count = VM_REGION_SUBMAP_INFO_COUNT_64;
172 err = vm_region_recurse_64(mach_task_self(), &address, &size, &depth,
173 (vm_region_info_t)&info, &count);
174
175 uptr end_address = address + size;
176 if (info.user_tag == VM_MEMORY_OS_ALLOC_ONCE) {
177 // libxpc stashes some pointers in the Kernel Alloc Once page,
178 // make sure not to report those as leaks.
179 scan_state.seen_regions |= SeenRegion::AllocOnce;
180 ScanRangeForPointers(address, end_address, frontier, "GLOBAL",
181 kReachable);
182 } else if (info.user_tag == VM_MEMORY_FOUNDATION) {
183 // Objective-C block trampolines use the Foundation region.
184 scan_state.seen_regions |= SeenRegion::Foundation;
185 ScanRangeForPointers(address, end_address, frontier, "GLOBAL",
186 kReachable);
187 } else if (info.user_tag == VM_MEMORY_LIBDISPATCH) {
188 // Dispatch continuations use the libdispatch region. Empirically, there
189 // can be more than one region with this tag, so we'll optimistically
190 // assume that they're continguous. Otherwise, we would need to scan every
191 // region to ensure we find them all.
192 scan_state.in_libdispatch = true;
193 ScanRangeForPointers(address, end_address, frontier, "GLOBAL",
194 kReachable);
195 } else if (scan_state.in_libdispatch) {
196 scan_state.seen_regions |= SeenRegion::LibDispatch;
197 scan_state.in_libdispatch = false;
198 }
199
200 // Recursing over the full memory map is very slow, break out
201 // early if we don't need the full iteration.
202 if (scan_state.seen_regions == SeenRegion::All &&
203 !(flags()->use_root_regions && root_regions->size() > 0)) {
204 break;
205 }
206
207 // This additional root region scan is required on Darwin in order to
208 // detect root regions contained within mmap'd memory regions, because
209 // the Darwin implementation of sanitizer_procmaps traverses images
210 // as loaded by dyld, and not the complete set of all memory regions.
211 //
212 // TODO(fjricci) - remove this once sanitizer_procmaps_mac has the same
213 // behavior as sanitizer_procmaps_linux and traverses all memory regions
214 if (flags()->use_root_regions) {
215 for (uptr i = 0; i < root_regions->size(); i++) {
216 ScanRootRegion(frontier, (*root_regions)[i], address, end_address,
217 info.protection & kProtectionRead);
218 }
219 }
220
221 address = end_address;
222 }
223 }
224
225 // On darwin, we can intercept _exit gracefully, and return a failing exit code
226 // if required at that point. Calling Die() here is undefined behavior and
227 // causes rare race conditions.
HandleLeaks()228 void HandleLeaks() {}
229
LockStuffAndStopTheWorld(StopTheWorldCallback callback,CheckForLeaksParam * argument)230 void LockStuffAndStopTheWorld(StopTheWorldCallback callback,
231 CheckForLeaksParam *argument) {
232 ScopedStopTheWorldLock lock;
233 StopTheWorld(callback, argument);
234 }
235
236 } // namespace __lsan
237
238 #endif // CAN_SANITIZE_LEAKS && SANITIZER_APPLE
239