1 //===-- asan_mac.cc -------------------------------------------------------===//
2 //
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
5 //
6 //===----------------------------------------------------------------------===//
7 //
8 // This file is a part of AddressSanitizer, an address sanity checker.
9 //
10 // Mac-specific details.
11 //===----------------------------------------------------------------------===//
12
13 #ifdef __APPLE__
14
15 #include "asan_interceptors.h"
16 #include "asan_internal.h"
17 #include "asan_mac.h"
18 #include "asan_mapping.h"
19 #include "asan_stack.h"
20 #include "asan_thread.h"
21 #include "asan_thread_registry.h"
22 #include "sanitizer_common/sanitizer_libc.h"
23
24 #include <crt_externs.h> // for _NSGetArgv
25 #include <dlfcn.h> // for dladdr()
26 #include <mach-o/dyld.h>
27 #include <mach-o/loader.h>
28 #include <sys/mman.h>
29 #include <sys/resource.h>
30 #include <sys/sysctl.h>
31 #include <sys/ucontext.h>
32 #include <fcntl.h>
33 #include <pthread.h>
34 #include <stdlib.h> // for free()
35 #include <unistd.h>
36 #include <libkern/OSAtomic.h>
37
38 namespace __asan {
39
GetPcSpBp(void * context,uptr * pc,uptr * sp,uptr * bp)40 void GetPcSpBp(void *context, uptr *pc, uptr *sp, uptr *bp) {
41 ucontext_t *ucontext = (ucontext_t*)context;
42 # if SANITIZER_WORDSIZE == 64
43 *pc = ucontext->uc_mcontext->__ss.__rip;
44 *bp = ucontext->uc_mcontext->__ss.__rbp;
45 *sp = ucontext->uc_mcontext->__ss.__rsp;
46 # else
47 *pc = ucontext->uc_mcontext->__ss.__eip;
48 *bp = ucontext->uc_mcontext->__ss.__ebp;
49 *sp = ucontext->uc_mcontext->__ss.__esp;
50 # endif // SANITIZER_WORDSIZE
51 }
52
GetMacosVersion()53 int GetMacosVersion() {
54 int mib[2] = { CTL_KERN, KERN_OSRELEASE };
55 char version[100];
56 uptr len = 0, maxlen = sizeof(version) / sizeof(version[0]);
57 for (uptr i = 0; i < maxlen; i++) version[i] = '\0';
58 // Get the version length.
59 CHECK(sysctl(mib, 2, 0, &len, 0, 0) != -1);
60 CHECK(len < maxlen);
61 CHECK(sysctl(mib, 2, version, &len, 0, 0) != -1);
62 switch (version[0]) {
63 case '9': return MACOS_VERSION_LEOPARD;
64 case '1': {
65 switch (version[1]) {
66 case '0': return MACOS_VERSION_SNOW_LEOPARD;
67 case '1': return MACOS_VERSION_LION;
68 case '2': return MACOS_VERSION_MOUNTAIN_LION;
69 default: return MACOS_VERSION_UNKNOWN;
70 }
71 }
72 default: return MACOS_VERSION_UNKNOWN;
73 }
74 }
75
PlatformHasDifferentMemcpyAndMemmove()76 bool PlatformHasDifferentMemcpyAndMemmove() {
77 // On OS X 10.7 memcpy() and memmove() are both resolved
78 // into memmove$VARIANT$sse42.
79 // See also http://code.google.com/p/address-sanitizer/issues/detail?id=34.
80 // TODO(glider): need to check dynamically that memcpy() and memmove() are
81 // actually the same function.
82 return GetMacosVersion() == MACOS_VERSION_SNOW_LEOPARD;
83 }
84
85 extern "C"
86 void __asan_init();
87
88 static const char kDyldInsertLibraries[] = "DYLD_INSERT_LIBRARIES";
89 LowLevelAllocator allocator_for_env;
90
91 // Change the value of the env var |name|, leaking the original value.
92 // If |name_value| is NULL, the variable is deleted from the environment,
93 // otherwise the corresponding "NAME=value" string is replaced with
94 // |name_value|.
LeakyResetEnv(const char * name,const char * name_value)95 void LeakyResetEnv(const char *name, const char *name_value) {
96 char ***env_ptr = _NSGetEnviron();
97 CHECK(env_ptr);
98 char **environ = *env_ptr;
99 CHECK(environ);
100 uptr name_len = internal_strlen(name);
101 while (*environ != 0) {
102 uptr len = internal_strlen(*environ);
103 if (len > name_len) {
104 const char *p = *environ;
105 if (!internal_memcmp(p, name, name_len) && p[name_len] == '=') {
106 // Match.
107 if (name_value) {
108 // Replace the old value with the new one.
109 *environ = const_cast<char*>(name_value);
110 } else {
111 // Shift the subsequent pointers back.
112 char **del = environ;
113 do {
114 del[0] = del[1];
115 } while (*del++);
116 }
117 }
118 }
119 environ++;
120 }
121 }
122
MaybeReexec()123 void MaybeReexec() {
124 if (!flags()->allow_reexec) return;
125 // Make sure the dynamic ASan runtime library is preloaded so that the
126 // wrappers work. If it is not, set DYLD_INSERT_LIBRARIES and re-exec
127 // ourselves.
128 Dl_info info;
129 CHECK(dladdr((void*)((uptr)__asan_init), &info));
130 char *dyld_insert_libraries =
131 const_cast<char*>(GetEnv(kDyldInsertLibraries));
132 uptr old_env_len = dyld_insert_libraries ?
133 internal_strlen(dyld_insert_libraries) : 0;
134 uptr fname_len = internal_strlen(info.dli_fname);
135 if (!dyld_insert_libraries ||
136 !REAL(strstr)(dyld_insert_libraries, info.dli_fname)) {
137 // DYLD_INSERT_LIBRARIES is not set or does not contain the runtime
138 // library.
139 char program_name[1024];
140 uint32_t buf_size = sizeof(program_name);
141 _NSGetExecutablePath(program_name, &buf_size);
142 char *new_env = const_cast<char*>(info.dli_fname);
143 if (dyld_insert_libraries) {
144 // Append the runtime dylib name to the existing value of
145 // DYLD_INSERT_LIBRARIES.
146 new_env = (char*)allocator_for_env.Allocate(old_env_len + fname_len + 2);
147 internal_strncpy(new_env, dyld_insert_libraries, old_env_len);
148 new_env[old_env_len] = ':';
149 // Copy fname_len and add a trailing zero.
150 internal_strncpy(new_env + old_env_len + 1, info.dli_fname,
151 fname_len + 1);
152 // Ok to use setenv() since the wrappers don't depend on the value of
153 // asan_inited.
154 setenv(kDyldInsertLibraries, new_env, /*overwrite*/1);
155 } else {
156 // Set DYLD_INSERT_LIBRARIES equal to the runtime dylib name.
157 setenv(kDyldInsertLibraries, info.dli_fname, /*overwrite*/0);
158 }
159 if (flags()->verbosity >= 1) {
160 Report("exec()-ing the program with\n");
161 Report("%s=%s\n", kDyldInsertLibraries, new_env);
162 Report("to enable ASan wrappers.\n");
163 Report("Set ASAN_OPTIONS=allow_reexec=0 to disable this.\n");
164 }
165 execv(program_name, *_NSGetArgv());
166 } else {
167 // DYLD_INSERT_LIBRARIES is set and contains the runtime library.
168 if (old_env_len == fname_len) {
169 // It's just the runtime library name - fine to unset the variable.
170 LeakyResetEnv(kDyldInsertLibraries, NULL);
171 } else {
172 uptr env_name_len = internal_strlen(kDyldInsertLibraries);
173 // Allocate memory to hold the previous env var name, its value, the '='
174 // sign and the '\0' char.
175 char *new_env = (char*)allocator_for_env.Allocate(
176 old_env_len + 2 + env_name_len);
177 CHECK(new_env);
178 internal_memset(new_env, '\0', old_env_len + 2 + env_name_len);
179 internal_strncpy(new_env, kDyldInsertLibraries, env_name_len);
180 new_env[env_name_len] = '=';
181 char *new_env_pos = new_env + env_name_len + 1;
182
183 // Iterate over colon-separated pieces of |dyld_insert_libraries|.
184 char *piece_start = dyld_insert_libraries;
185 char *piece_end = NULL;
186 char *old_env_end = dyld_insert_libraries + old_env_len;
187 do {
188 if (piece_start[0] == ':') piece_start++;
189 piece_end = REAL(strchr)(piece_start, ':');
190 if (!piece_end) piece_end = dyld_insert_libraries + old_env_len;
191 if ((uptr)(piece_start - dyld_insert_libraries) > old_env_len) break;
192 uptr piece_len = piece_end - piece_start;
193
194 // If the current piece isn't the runtime library name,
195 // append it to new_env.
196 if ((piece_len != fname_len) ||
197 (internal_strncmp(piece_start, info.dli_fname, fname_len) != 0)) {
198 if (new_env_pos != new_env + env_name_len + 1) {
199 new_env_pos[0] = ':';
200 new_env_pos++;
201 }
202 internal_strncpy(new_env_pos, piece_start, piece_len);
203 }
204 // Move on to the next piece.
205 new_env_pos += piece_len;
206 piece_start = piece_end;
207 } while (piece_start < old_env_end);
208
209 // Can't use setenv() here, because it requires the allocator to be
210 // initialized.
211 // FIXME: instead of filtering DYLD_INSERT_LIBRARIES here, do it in
212 // a separate function called after InitializeAllocator().
213 LeakyResetEnv(kDyldInsertLibraries, new_env);
214 }
215 }
216 }
217
218 // No-op. Mac does not support static linkage anyway.
AsanDoesNotSupportStaticLinkage()219 void *AsanDoesNotSupportStaticLinkage() {
220 return 0;
221 }
222
AsanInterceptsSignal(int signum)223 bool AsanInterceptsSignal(int signum) {
224 return (signum == SIGSEGV || signum == SIGBUS) && flags()->handle_segv;
225 }
226
AsanPlatformThreadInit()227 void AsanPlatformThreadInit() {
228 }
229
GetStackTrace(StackTrace * stack,uptr max_s,uptr pc,uptr bp,bool fast)230 void GetStackTrace(StackTrace *stack, uptr max_s, uptr pc, uptr bp, bool fast) {
231 (void)fast;
232 stack->size = 0;
233 stack->trace[0] = pc;
234 if ((max_s) > 1) {
235 stack->max_size = max_s;
236 if (!asan_inited) return;
237 if (AsanThread *t = asanThreadRegistry().GetCurrent())
238 stack->FastUnwindStack(pc, bp, t->stack_top(), t->stack_bottom());
239 }
240 }
241
ReadContextStack(void * context,uptr * stack,uptr * ssize)242 void ReadContextStack(void *context, uptr *stack, uptr *ssize) {
243 UNIMPLEMENTED();
244 }
245
246 // Support for the following functions from libdispatch on Mac OS:
247 // dispatch_async_f()
248 // dispatch_async()
249 // dispatch_sync_f()
250 // dispatch_sync()
251 // dispatch_after_f()
252 // dispatch_after()
253 // dispatch_group_async_f()
254 // dispatch_group_async()
255 // TODO(glider): libdispatch API contains other functions that we don't support
256 // yet.
257 //
258 // dispatch_sync() and dispatch_sync_f() are synchronous, although chances are
259 // they can cause jobs to run on a thread different from the current one.
260 // TODO(glider): if so, we need a test for this (otherwise we should remove
261 // them).
262 //
263 // The following functions use dispatch_barrier_async_f() (which isn't a library
264 // function but is exported) and are thus supported:
265 // dispatch_source_set_cancel_handler_f()
266 // dispatch_source_set_cancel_handler()
267 // dispatch_source_set_event_handler_f()
268 // dispatch_source_set_event_handler()
269 //
270 // The reference manual for Grand Central Dispatch is available at
271 // http://developer.apple.com/library/mac/#documentation/Performance/Reference/GCD_libdispatch_Ref/Reference/reference.html
272 // The implementation details are at
273 // http://libdispatch.macosforge.org/trac/browser/trunk/src/queue.c
274
275 typedef void* dispatch_group_t;
276 typedef void* dispatch_queue_t;
277 typedef void* dispatch_source_t;
278 typedef u64 dispatch_time_t;
279 typedef void (*dispatch_function_t)(void *block);
280 typedef void* (*worker_t)(void *block);
281
282 // A wrapper for the ObjC blocks used to support libdispatch.
283 typedef struct {
284 void *block;
285 dispatch_function_t func;
286 u32 parent_tid;
287 } asan_block_context_t;
288
289 // We use extern declarations of libdispatch functions here instead
290 // of including <dispatch/dispatch.h>. This header is not present on
291 // Mac OS X Leopard and eariler, and although we don't expect ASan to
292 // work on legacy systems, it's bad to break the build of
293 // LLVM compiler-rt there.
294 extern "C" {
295 void dispatch_async_f(dispatch_queue_t dq, void *ctxt,
296 dispatch_function_t func);
297 void dispatch_sync_f(dispatch_queue_t dq, void *ctxt,
298 dispatch_function_t func);
299 void dispatch_after_f(dispatch_time_t when, dispatch_queue_t dq, void *ctxt,
300 dispatch_function_t func);
301 void dispatch_barrier_async_f(dispatch_queue_t dq, void *ctxt,
302 dispatch_function_t func);
303 void dispatch_group_async_f(dispatch_group_t group, dispatch_queue_t dq,
304 void *ctxt, dispatch_function_t func);
305 } // extern "C"
306
307 static ALWAYS_INLINE
asan_register_worker_thread(int parent_tid,StackTrace * stack)308 void asan_register_worker_thread(int parent_tid, StackTrace *stack) {
309 AsanThread *t = asanThreadRegistry().GetCurrent();
310 if (!t) {
311 t = AsanThread::Create(parent_tid, 0, 0, stack);
312 asanThreadRegistry().RegisterThread(t);
313 t->Init();
314 asanThreadRegistry().SetCurrent(t);
315 }
316 }
317
318 // For use by only those functions that allocated the context via
319 // alloc_asan_context().
320 extern "C"
asan_dispatch_call_block_and_release(void * block)321 void asan_dispatch_call_block_and_release(void *block) {
322 GET_STACK_TRACE_THREAD;
323 asan_block_context_t *context = (asan_block_context_t*)block;
324 if (flags()->verbosity >= 2) {
325 Report("asan_dispatch_call_block_and_release(): "
326 "context: %p, pthread_self: %p\n",
327 block, pthread_self());
328 }
329 asan_register_worker_thread(context->parent_tid, &stack);
330 // Call the original dispatcher for the block.
331 context->func(context->block);
332 asan_free(context, &stack, FROM_MALLOC);
333 }
334
335 } // namespace __asan
336
337 using namespace __asan; // NOLINT
338
339 // Wrap |ctxt| and |func| into an asan_block_context_t.
340 // The caller retains control of the allocated context.
341 extern "C"
alloc_asan_context(void * ctxt,dispatch_function_t func,StackTrace * stack)342 asan_block_context_t *alloc_asan_context(void *ctxt, dispatch_function_t func,
343 StackTrace *stack) {
344 asan_block_context_t *asan_ctxt =
345 (asan_block_context_t*) asan_malloc(sizeof(asan_block_context_t), stack);
346 asan_ctxt->block = ctxt;
347 asan_ctxt->func = func;
348 asan_ctxt->parent_tid = asanThreadRegistry().GetCurrentTidOrInvalid();
349 return asan_ctxt;
350 }
351
352 // Define interceptor for dispatch_*_f function with the three most common
353 // parameters: dispatch_queue_t, context, dispatch_function_t.
354 #define INTERCEPT_DISPATCH_X_F_3(dispatch_x_f) \
355 INTERCEPTOR(void, dispatch_x_f, dispatch_queue_t dq, void *ctxt, \
356 dispatch_function_t func) { \
357 GET_STACK_TRACE_THREAD; \
358 asan_block_context_t *asan_ctxt = alloc_asan_context(ctxt, func, &stack); \
359 if (flags()->verbosity >= 2) { \
360 Report(#dispatch_x_f "(): context: %p, pthread_self: %p\n", \
361 asan_ctxt, pthread_self()); \
362 PRINT_CURRENT_STACK(); \
363 } \
364 return REAL(dispatch_x_f)(dq, (void*)asan_ctxt, \
365 asan_dispatch_call_block_and_release); \
366 }
367
368 INTERCEPT_DISPATCH_X_F_3(dispatch_async_f)
INTERCEPT_DISPATCH_X_F_3(dispatch_sync_f)369 INTERCEPT_DISPATCH_X_F_3(dispatch_sync_f)
370 INTERCEPT_DISPATCH_X_F_3(dispatch_barrier_async_f)
371
372 INTERCEPTOR(void, dispatch_after_f, dispatch_time_t when,
373 dispatch_queue_t dq, void *ctxt,
374 dispatch_function_t func) {
375 GET_STACK_TRACE_THREAD;
376 asan_block_context_t *asan_ctxt = alloc_asan_context(ctxt, func, &stack);
377 if (flags()->verbosity >= 2) {
378 Report("dispatch_after_f: %p\n", asan_ctxt);
379 PRINT_CURRENT_STACK();
380 }
381 return REAL(dispatch_after_f)(when, dq, (void*)asan_ctxt,
382 asan_dispatch_call_block_and_release);
383 }
384
INTERCEPTOR(void,dispatch_group_async_f,dispatch_group_t group,dispatch_queue_t dq,void * ctxt,dispatch_function_t func)385 INTERCEPTOR(void, dispatch_group_async_f, dispatch_group_t group,
386 dispatch_queue_t dq, void *ctxt,
387 dispatch_function_t func) {
388 GET_STACK_TRACE_THREAD;
389 asan_block_context_t *asan_ctxt = alloc_asan_context(ctxt, func, &stack);
390 if (flags()->verbosity >= 2) {
391 Report("dispatch_group_async_f(): context: %p, pthread_self: %p\n",
392 asan_ctxt, pthread_self());
393 PRINT_CURRENT_STACK();
394 }
395 REAL(dispatch_group_async_f)(group, dq, (void*)asan_ctxt,
396 asan_dispatch_call_block_and_release);
397 }
398
399 #if !defined(MISSING_BLOCKS_SUPPORT)
400 extern "C" {
401 // FIXME: consolidate these declarations with asan_intercepted_functions.h.
402 void dispatch_async(dispatch_queue_t dq, void(^work)(void));
403 void dispatch_group_async(dispatch_group_t dg, dispatch_queue_t dq,
404 void(^work)(void));
405 void dispatch_after(dispatch_time_t when, dispatch_queue_t queue,
406 void(^work)(void));
407 void dispatch_source_set_cancel_handler(dispatch_source_t ds,
408 void(^work)(void));
409 void dispatch_source_set_event_handler(dispatch_source_t ds, void(^work)(void));
410 }
411
412 #define GET_ASAN_BLOCK(work) \
413 void (^asan_block)(void); \
414 int parent_tid = asanThreadRegistry().GetCurrentTidOrInvalid(); \
415 asan_block = ^(void) { \
416 GET_STACK_TRACE_THREAD; \
417 asan_register_worker_thread(parent_tid, &stack); \
418 work(); \
419 }
420
421 INTERCEPTOR(void, dispatch_async,
422 dispatch_queue_t dq, void(^work)(void)) {
423 GET_ASAN_BLOCK(work);
424 REAL(dispatch_async)(dq, asan_block);
425 }
426
427 INTERCEPTOR(void, dispatch_group_async,
428 dispatch_group_t dg, dispatch_queue_t dq, void(^work)(void)) {
429 GET_ASAN_BLOCK(work);
430 REAL(dispatch_group_async)(dg, dq, asan_block);
431 }
432
433 INTERCEPTOR(void, dispatch_after,
434 dispatch_time_t when, dispatch_queue_t queue, void(^work)(void)) {
435 GET_ASAN_BLOCK(work);
436 REAL(dispatch_after)(when, queue, asan_block);
437 }
438
439 INTERCEPTOR(void, dispatch_source_set_cancel_handler,
440 dispatch_source_t ds, void(^work)(void)) {
441 GET_ASAN_BLOCK(work);
442 REAL(dispatch_source_set_cancel_handler)(ds, asan_block);
443 }
444
445 INTERCEPTOR(void, dispatch_source_set_event_handler,
446 dispatch_source_t ds, void(^work)(void)) {
447 GET_ASAN_BLOCK(work);
448 REAL(dispatch_source_set_event_handler)(ds, asan_block);
449 }
450 #endif
451
452 #endif // __APPLE__
453