1 //===-- InstrumentationRuntimeASan.cpp ------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8
9 #include "InstrumentationRuntimeASan.h"
10
11 #include "lldb/Breakpoint/StoppointCallbackContext.h"
12 #include "lldb/Core/Debugger.h"
13 #include "lldb/Core/Module.h"
14 #include "lldb/Core/PluginInterface.h"
15 #include "lldb/Core/PluginManager.h"
16 #include "lldb/Core/StreamFile.h"
17 #include "lldb/Core/ValueObject.h"
18 #include "lldb/Expression/UserExpression.h"
19 #include "lldb/Interpreter/CommandReturnObject.h"
20 #include "lldb/Symbol/Symbol.h"
21 #include "lldb/Target/InstrumentationRuntimeStopInfo.h"
22 #include "lldb/Target/StopInfo.h"
23 #include "lldb/Target/Target.h"
24 #include "lldb/Target/Thread.h"
25 #include "lldb/Utility/RegularExpression.h"
26 #include "lldb/Utility/Stream.h"
27
28 #include "llvm/ADT/StringSwitch.h"
29
30 using namespace lldb;
31 using namespace lldb_private;
32
LLDB_PLUGIN_DEFINE(InstrumentationRuntimeASan)33 LLDB_PLUGIN_DEFINE(InstrumentationRuntimeASan)
34
35 lldb::InstrumentationRuntimeSP
36 InstrumentationRuntimeASan::CreateInstance(const lldb::ProcessSP &process_sp) {
37 return InstrumentationRuntimeSP(new InstrumentationRuntimeASan(process_sp));
38 }
39
Initialize()40 void InstrumentationRuntimeASan::Initialize() {
41 PluginManager::RegisterPlugin(
42 GetPluginNameStatic(), "AddressSanitizer instrumentation runtime plugin.",
43 CreateInstance, GetTypeStatic);
44 }
45
Terminate()46 void InstrumentationRuntimeASan::Terminate() {
47 PluginManager::UnregisterPlugin(CreateInstance);
48 }
49
GetTypeStatic()50 lldb::InstrumentationRuntimeType InstrumentationRuntimeASan::GetTypeStatic() {
51 return eInstrumentationRuntimeTypeAddressSanitizer;
52 }
53
~InstrumentationRuntimeASan()54 InstrumentationRuntimeASan::~InstrumentationRuntimeASan() { Deactivate(); }
55
56 const RegularExpression &
GetPatternForRuntimeLibrary()57 InstrumentationRuntimeASan::GetPatternForRuntimeLibrary() {
58 // FIXME: This shouldn't include the "dylib" suffix.
59 static RegularExpression regex(
60 llvm::StringRef("libclang_rt.asan_(.*)_dynamic\\.dylib"));
61 return regex;
62 }
63
CheckIfRuntimeIsValid(const lldb::ModuleSP module_sp)64 bool InstrumentationRuntimeASan::CheckIfRuntimeIsValid(
65 const lldb::ModuleSP module_sp) {
66 const Symbol *symbol = module_sp->FindFirstSymbolWithNameAndType(
67 ConstString("__asan_get_alloc_stack"), lldb::eSymbolTypeAny);
68
69 return symbol != nullptr;
70 }
71
72 const char *address_sanitizer_retrieve_report_data_prefix = R"(
73 extern "C"
74 {
75 int __asan_report_present();
76 void *__asan_get_report_pc();
77 void *__asan_get_report_bp();
78 void *__asan_get_report_sp();
79 void *__asan_get_report_address();
80 const char *__asan_get_report_description();
81 int __asan_get_report_access_type();
82 size_t __asan_get_report_access_size();
83 }
84 )";
85
86 const char *address_sanitizer_retrieve_report_data_command = R"(
87 struct {
88 int present;
89 int access_type;
90 void *pc;
91 void *bp;
92 void *sp;
93 void *address;
94 size_t access_size;
95 const char *description;
96 } t;
97
98 t.present = __asan_report_present();
99 t.access_type = __asan_get_report_access_type();
100 t.pc = __asan_get_report_pc();
101 t.bp = __asan_get_report_bp();
102 t.sp = __asan_get_report_sp();
103 t.address = __asan_get_report_address();
104 t.access_size = __asan_get_report_access_size();
105 t.description = __asan_get_report_description();
106 t
107 )";
108
RetrieveReportData()109 StructuredData::ObjectSP InstrumentationRuntimeASan::RetrieveReportData() {
110 ProcessSP process_sp = GetProcessSP();
111 if (!process_sp)
112 return StructuredData::ObjectSP();
113
114 ThreadSP thread_sp =
115 process_sp->GetThreadList().GetExpressionExecutionThread();
116 StackFrameSP frame_sp = thread_sp->GetSelectedFrame();
117
118 if (!frame_sp)
119 return StructuredData::ObjectSP();
120
121 EvaluateExpressionOptions options;
122 options.SetUnwindOnError(true);
123 options.SetTryAllThreads(true);
124 options.SetStopOthers(true);
125 options.SetIgnoreBreakpoints(true);
126 options.SetTimeout(process_sp->GetUtilityExpressionTimeout());
127 options.SetPrefix(address_sanitizer_retrieve_report_data_prefix);
128 options.SetAutoApplyFixIts(false);
129 options.SetLanguage(eLanguageTypeObjC_plus_plus);
130
131 ValueObjectSP return_value_sp;
132 ExecutionContext exe_ctx;
133 Status eval_error;
134 frame_sp->CalculateExecutionContext(exe_ctx);
135 ExpressionResults result = UserExpression::Evaluate(
136 exe_ctx, options, address_sanitizer_retrieve_report_data_command, "",
137 return_value_sp, eval_error);
138 if (result != eExpressionCompleted) {
139 StreamString ss;
140 ss << "cannot evaluate AddressSanitizer expression:\n";
141 ss << eval_error.AsCString();
142 Debugger::ReportWarning(ss.GetString().str(),
143 process_sp->GetTarget().GetDebugger().GetID());
144 return StructuredData::ObjectSP();
145 }
146
147 int present = return_value_sp->GetValueForExpressionPath(".present")
148 ->GetValueAsUnsigned(0);
149 if (present != 1)
150 return StructuredData::ObjectSP();
151
152 addr_t pc =
153 return_value_sp->GetValueForExpressionPath(".pc")->GetValueAsUnsigned(0);
154 /* commented out because rdar://problem/18533301
155 addr_t bp =
156 return_value_sp->GetValueForExpressionPath(".bp")->GetValueAsUnsigned(0);
157 addr_t sp =
158 return_value_sp->GetValueForExpressionPath(".sp")->GetValueAsUnsigned(0);
159 */
160 addr_t address = return_value_sp->GetValueForExpressionPath(".address")
161 ->GetValueAsUnsigned(0);
162 addr_t access_type =
163 return_value_sp->GetValueForExpressionPath(".access_type")
164 ->GetValueAsUnsigned(0);
165 addr_t access_size =
166 return_value_sp->GetValueForExpressionPath(".access_size")
167 ->GetValueAsUnsigned(0);
168 addr_t description_ptr =
169 return_value_sp->GetValueForExpressionPath(".description")
170 ->GetValueAsUnsigned(0);
171 std::string description;
172 Status error;
173 process_sp->ReadCStringFromMemory(description_ptr, description, error);
174
175 StructuredData::Dictionary *dict = new StructuredData::Dictionary();
176 dict->AddStringItem("instrumentation_class", "AddressSanitizer");
177 dict->AddStringItem("stop_type", "fatal_error");
178 dict->AddIntegerItem("pc", pc);
179 /* commented out because rdar://problem/18533301
180 dict->AddIntegerItem("bp", bp);
181 dict->AddIntegerItem("sp", sp);
182 */
183 dict->AddIntegerItem("address", address);
184 dict->AddIntegerItem("access_type", access_type);
185 dict->AddIntegerItem("access_size", access_size);
186 dict->AddStringItem("description", description);
187
188 return StructuredData::ObjectSP(dict);
189 }
190
191 std::string
FormatDescription(StructuredData::ObjectSP report)192 InstrumentationRuntimeASan::FormatDescription(StructuredData::ObjectSP report) {
193 std::string description = std::string(report->GetAsDictionary()
194 ->GetValueForKey("description")
195 ->GetAsString()
196 ->GetValue());
197 return llvm::StringSwitch<std::string>(description)
198 .Case("heap-use-after-free", "Use of deallocated memory")
199 .Case("heap-buffer-overflow", "Heap buffer overflow")
200 .Case("stack-buffer-underflow", "Stack buffer underflow")
201 .Case("initialization-order-fiasco", "Initialization order problem")
202 .Case("stack-buffer-overflow", "Stack buffer overflow")
203 .Case("stack-use-after-return", "Use of stack memory after return")
204 .Case("use-after-poison", "Use of poisoned memory")
205 .Case("container-overflow", "Container overflow")
206 .Case("stack-use-after-scope", "Use of out-of-scope stack memory")
207 .Case("global-buffer-overflow", "Global buffer overflow")
208 .Case("unknown-crash", "Invalid memory access")
209 .Case("stack-overflow", "Stack space exhausted")
210 .Case("null-deref", "Dereference of null pointer")
211 .Case("wild-jump", "Jump to non-executable address")
212 .Case("wild-addr-write", "Write through wild pointer")
213 .Case("wild-addr-read", "Read from wild pointer")
214 .Case("wild-addr", "Access through wild pointer")
215 .Case("signal", "Deadly signal")
216 .Case("double-free", "Deallocation of freed memory")
217 .Case("new-delete-type-mismatch",
218 "Deallocation size different from allocation size")
219 .Case("bad-free", "Deallocation of non-allocated memory")
220 .Case("alloc-dealloc-mismatch",
221 "Mismatch between allocation and deallocation APIs")
222 .Case("bad-malloc_usable_size", "Invalid argument to malloc_usable_size")
223 .Case("bad-__sanitizer_get_allocated_size",
224 "Invalid argument to __sanitizer_get_allocated_size")
225 .Case("param-overlap",
226 "Call to function disallowing overlapping memory ranges")
227 .Case("negative-size-param", "Negative size used when accessing memory")
228 .Case("bad-__sanitizer_annotate_contiguous_container",
229 "Invalid argument to __sanitizer_annotate_contiguous_container")
230 .Case("odr-violation", "Symbol defined in multiple translation units")
231 .Case(
232 "invalid-pointer-pair",
233 "Comparison or arithmetic on pointers from different memory regions")
234 // for unknown report codes just show the code
235 .Default("AddressSanitizer detected: " + description);
236 }
237
NotifyBreakpointHit(void * baton,StoppointCallbackContext * context,user_id_t break_id,user_id_t break_loc_id)238 bool InstrumentationRuntimeASan::NotifyBreakpointHit(
239 void *baton, StoppointCallbackContext *context, user_id_t break_id,
240 user_id_t break_loc_id) {
241 assert(baton && "null baton");
242 if (!baton)
243 return false;
244
245 InstrumentationRuntimeASan *const instance =
246 static_cast<InstrumentationRuntimeASan *>(baton);
247
248 ProcessSP process_sp = instance->GetProcessSP();
249
250 if (process_sp->GetModIDRef().IsLastResumeForUserExpression())
251 return false;
252
253 StructuredData::ObjectSP report = instance->RetrieveReportData();
254 std::string description;
255 if (report) {
256 description = instance->FormatDescription(report);
257 }
258 // Make sure this is the right process
259 if (process_sp && process_sp == context->exe_ctx_ref.GetProcessSP()) {
260 ThreadSP thread_sp = context->exe_ctx_ref.GetThreadSP();
261 if (thread_sp)
262 thread_sp->SetStopInfo(InstrumentationRuntimeStopInfo::
263 CreateStopReasonWithInstrumentationData(
264 *thread_sp, description, report));
265
266 StreamFileSP stream_sp(
267 process_sp->GetTarget().GetDebugger().GetOutputStreamSP());
268 if (stream_sp) {
269 stream_sp->Printf("AddressSanitizer report breakpoint hit. Use 'thread "
270 "info -s' to get extended information about the "
271 "report.\n");
272 }
273 return true; // Return true to stop the target
274 } else
275 return false; // Let target run
276 }
277
Activate()278 void InstrumentationRuntimeASan::Activate() {
279 if (IsActive())
280 return;
281
282 ProcessSP process_sp = GetProcessSP();
283 if (!process_sp)
284 return;
285
286 ConstString symbol_name("_ZN6__asanL7AsanDieEv");
287 const Symbol *symbol = GetRuntimeModuleSP()->FindFirstSymbolWithNameAndType(
288 symbol_name, eSymbolTypeCode);
289
290 if (symbol == nullptr)
291 return;
292
293 if (!symbol->ValueIsAddress() || !symbol->GetAddressRef().IsValid())
294 return;
295
296 Target &target = process_sp->GetTarget();
297 addr_t symbol_address = symbol->GetAddressRef().GetOpcodeLoadAddress(&target);
298
299 if (symbol_address == LLDB_INVALID_ADDRESS)
300 return;
301
302 const bool internal = true;
303 const bool hardware = false;
304 const bool sync = false;
305 Breakpoint *breakpoint =
306 process_sp->GetTarget()
307 .CreateBreakpoint(symbol_address, internal, hardware)
308 .get();
309 breakpoint->SetCallback(InstrumentationRuntimeASan::NotifyBreakpointHit, this,
310 sync);
311 breakpoint->SetBreakpointKind("address-sanitizer-report");
312 SetBreakpointID(breakpoint->GetID());
313
314 SetActive(true);
315 }
316
Deactivate()317 void InstrumentationRuntimeASan::Deactivate() {
318 if (GetBreakpointID() != LLDB_INVALID_BREAK_ID) {
319 ProcessSP process_sp = GetProcessSP();
320 if (process_sp) {
321 process_sp->GetTarget().RemoveBreakpointByID(GetBreakpointID());
322 SetBreakpointID(LLDB_INVALID_BREAK_ID);
323 }
324 }
325 SetActive(false);
326 }
327