1//===-- interception.h ------------------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11// Machinery for providing replacements/wrappers for system functions.
12//===----------------------------------------------------------------------===//
13
14#ifndef INTERCEPTION_H
15#define INTERCEPTION_H
16
17#include "sanitizer_common/sanitizer_asm.h"
18#include "sanitizer_common/sanitizer_internal_defs.h"
19
20#if !SANITIZER_LINUX && !SANITIZER_FREEBSD && !SANITIZER_APPLE && \
21 !SANITIZER_NETBSD && !SANITIZER_WINDOWS && !SANITIZER_FUCHSIA && \
22 !SANITIZER_SOLARIS && !SANITIZER_HAIKU && !SANITIZER_AIX
23# error "Interception doesn't work on this operating system."
24#endif
25
26// These typedefs should be used only in the interceptor definitions to replace
27// the standard system types (e.g. SSIZE_T instead of ssize_t)
28// On Windows the system headers (basetsd.h) provide a conflicting definition
29// of SIZE_T/SSIZE_T that do not match the real size_t/ssize_t for 32-bit
30// systems (using long instead of the expected int). Work around the typedef
31// redefinition by #defining SIZE_T instead of using a typedef.
32// TODO: We should be using __sanitizer::usize (and a new ssize) instead of
33// these new macros as long as we ensure they match the real system definitions.
34#if SANITIZER_WINDOWS
35// Ensure that (S)SIZE_T were already defined as we are about to override them.
36# include <basetsd.h>
37#endif
38
39#define SIZE_T __sanitizer::usize
40#define SSIZE_T __sanitizer::ssize
41typedef __sanitizer::sptr PTRDIFF_T;
42typedef __sanitizer::s64 INTMAX_T;
43typedef __sanitizer::u64 UINTMAX_T;
44typedef __sanitizer::OFF_T OFF_T;
45typedef __sanitizer::OFF64_T OFF64_T;
46
47// How to add an interceptor:
48// Suppose you need to wrap/replace system function (generally, from libc):
49// int foo(const char *bar, double baz);
50// You'll need to:
51// 1) define INTERCEPTOR(int, foo, const char *bar, double baz) { ... } in
52// your source file. See the notes below for cases when
53// INTERCEPTOR_WITH_SUFFIX(...) should be used instead.
54// 2) Call "INTERCEPT_FUNCTION(foo)" prior to the first call of "foo".
55// INTERCEPT_FUNCTION(foo) evaluates to "true" iff the function was
56// intercepted successfully.
57// You can access original function by calling REAL(foo)(bar, baz).
58// By default, REAL(foo) will be visible only inside your interceptor, and if
59// you want to use it in other parts of RTL, you'll need to:
60// 3a) add DECLARE_REAL(int, foo, const char*, double) to a
61// header file.
62// However, if the call "INTERCEPT_FUNCTION(foo)" and definition for
63// INTERCEPTOR(..., foo, ...) are in different files, you'll instead need to:
64// 3b) add DECLARE_REAL_AND_INTERCEPTOR(int, foo, const char*, double)
65// to a header file.
66
67// Notes: 1. Things may not work properly if macro INTERCEPTOR(...) {...} or
68// DECLARE_REAL(...) are located inside namespaces.
69// 2. On Mac you can also use: "OVERRIDE_FUNCTION(foo, zoo)" to
70// effectively redirect calls from "foo" to "zoo". In this case
71// you aren't required to implement
72// INTERCEPTOR(int, foo, const char *bar, double baz) {...}
73// but instead you'll have to add
74// DECLARE_REAL(int, foo, const char *bar, double baz) in your
75// source file (to define a pointer to overriden function).
76// 3. Some Mac functions have symbol variants discriminated by
77// additional suffixes, e.g. _$UNIX2003 (see
78// https://developer.apple.com/library/mac/#releasenotes/Darwin/SymbolVariantsRelNotes/index.html
79// for more details). To intercept such functions you need to use the
80// INTERCEPTOR_WITH_SUFFIX(...) macro.
81
82// How it works on Linux
83// ---------------------
84//
85// To replace system functions on Linux we just need to declare functions with
86// the same names in our library and then obtain the real function pointers
87// using dlsym().
88//
89// There is one complication: a user may also intercept some of the functions we
90// intercept. To allow for up to 3 interceptors (including ours) of a given
91// function "func", the interceptor implementation is in ___interceptor_func,
92// which is aliased by a weak function __interceptor_func, which in turn is
93// aliased (via a trampoline) by weak wrapper function "func".
94//
95// Most user interceptors should define a foreign interceptor as follows:
96//
97// - provide a non-weak function "func" that performs interception;
98// - if __interceptor_func exists, call it to perform the real functionality;
99// - if it does not exist, figure out the real function and call it instead.
100//
101// In rare cases, a foreign interceptor (of another dynamic analysis runtime)
102// may be defined as follows (on supported architectures):
103//
104// - provide a non-weak function __interceptor_func that performs interception;
105// - if ___interceptor_func exists, call it to perform the real functionality;
106// - if it does not exist, figure out the real function and call it instead;
107// - provide a weak function "func" that is an alias to __interceptor_func.
108//
109// With this protocol, sanitizer interceptors, foreign user interceptors, and
110// foreign interceptors of other dynamic analysis runtimes, or any combination
111// thereof, may co-exist simultaneously.
112//
113// How it works on Mac OS
114// ----------------------
115//
116// This is not so on Mac OS, where the two-level namespace makes our replacement
117// functions invisible to other libraries. This may be overcomed using the
118// DYLD_FORCE_FLAT_NAMESPACE, but some errors loading the shared libraries in
119// Chromium were noticed when doing so.
120//
121// Instead we create a dylib containing a __DATA,__interpose section that
122// associates library functions with their wrappers. When this dylib is
123// preloaded before an executable using DYLD_INSERT_LIBRARIES, it routes all the
124// calls to interposed functions done through stubs to the wrapper functions.
125//
126// As it's decided at compile time which functions are to be intercepted on Mac,
127// INTERCEPT_FUNCTION() is effectively a no-op on this system.
128
129#if SANITIZER_APPLE
130#include <sys/cdefs.h> // For __DARWIN_ALIAS_C().
131
132// Just a pair of pointers.
133struct interpose_substitution {
134 const __sanitizer::uptr replacement;
135 const __sanitizer::uptr original;
136};
137
138// For a function foo() create a global pair of pointers { wrap_foo, foo } in
139// the __DATA,__interpose section.
140// As a result all the calls to foo() will be routed to wrap_foo() at runtime.
141#define INTERPOSER(func_name) __attribute__((used)) \
142const interpose_substitution substitution_##func_name[] \
143 __attribute__((section("__DATA, __interpose"))) = { \
144 { reinterpret_cast<const uptr>(WRAP(func_name)), \
145 reinterpret_cast<const uptr>(func_name) } \
146}
147
148// For a function foo() and a wrapper function bar() create a global pair
149// of pointers { bar, foo } in the __DATA,__interpose section.
150// As a result all the calls to foo() will be routed to bar() at runtime.
151#define INTERPOSER_2(func_name, wrapper_name) __attribute__((used)) \
152const interpose_substitution substitution_##func_name[] \
153 __attribute__((section("__DATA, __interpose"))) = { \
154 { reinterpret_cast<const uptr>(wrapper_name), \
155 reinterpret_cast<const uptr>(func_name) } \
156}
157
158# define WRAP(x) wrap_##x
159# define TRAMPOLINE(x) WRAP(x)
160# define INTERCEPTOR_ATTRIBUTE
161# define DECLARE_WRAPPER(ret_type, func, ...)
162
163#elif SANITIZER_WINDOWS
164# define WRAP(x) __asan_wrap_##x
165# define TRAMPOLINE(x) WRAP(x)
166# define INTERCEPTOR_ATTRIBUTE __declspec(dllexport)
167# define DECLARE_WRAPPER(ret_type, func, ...) \
168 extern "C" ret_type func(__VA_ARGS__);
169# define DECLARE_WRAPPER_WINAPI(ret_type, func, ...) \
170 extern "C" __declspec(dllimport) ret_type __stdcall func(__VA_ARGS__);
171#elif SANITIZER_AIX
172# define WRAP(x) __interceptor_##x
173# define TRAMPOLINE(x) WRAP(x)
174// # define WRAPPER_NAME(x) "__interceptor_" #x
175# define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))
176// AIX's linker will not select the weak symbol, so don't use weak for the
177// interceptors.
178# define DECLARE_WRAPPER(ret_type, func, ...) \
179 extern "C" ret_type func(__VA_ARGS__) \
180 __attribute__((alias("__interceptor_" #func), visibility("default")));
181#elif !SANITIZER_FUCHSIA // LINUX, FREEBSD, NETBSD, SOLARIS
182# define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))
183# if ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT
184// Weak aliases of weak aliases do not work, therefore we need to set up a
185// trampoline function. The function "func" is a weak alias to the trampoline
186// (so that we may check if "func" was overridden), which calls the weak
187// function __interceptor_func, which in turn aliases the actual interceptor
188// implementation ___interceptor_func:
189//
190// [wrapper "func": weak] --(alias)--> [TRAMPOLINE(func)]
191// |
192// +--------(tail call)-------+
193// |
194// v
195// [__interceptor_func: weak] --(alias)--> [WRAP(func)]
196//
197// We use inline assembly to define most of this, because not all compilers
198// support functions with the "naked" attribute with every architecture.
199# define WRAP(x) ___interceptor_ ## x
200# define TRAMPOLINE(x) __interceptor_trampoline_ ## x
201# if SANITIZER_FREEBSD || SANITIZER_NETBSD
202// FreeBSD's dynamic linker (incompliantly) gives non-weak symbols higher
203// priority than weak ones so weak aliases won't work for indirect calls
204// in position-independent (-fPIC / -fPIE) mode.
205# define __ASM_WEAK_WRAPPER(func) ".globl " #func "\n"
206# else
207# define __ASM_WEAK_WRAPPER(func) ".weak " #func "\n"
208# endif // SANITIZER_FREEBSD || SANITIZER_NETBSD
209# if defined(__arm__) || defined(__aarch64__)
210# define ASM_TYPE_FUNCTION_STR "%function"
211# else
212# define ASM_TYPE_FUNCTION_STR "@function"
213# endif
214// Keep trampoline implementation in sync with sanitizer_common/sanitizer_asm.h
215# define DECLARE_WRAPPER(ret_type, func, ...) \
216 extern "C" ret_type func(__VA_ARGS__); \
217 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \
218 extern "C" ret_type __interceptor_##func(__VA_ARGS__) \
219 INTERCEPTOR_ATTRIBUTE __attribute__((weak)) ALIAS(WRAP(func)); \
220 asm( \
221 ".text\n" \
222 __ASM_WEAK_WRAPPER(func) \
223 ".set " #func ", " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \
224 ".globl " SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \
225 ".type " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \
226 ASM_TYPE_FUNCTION_STR "\n" \
227 SANITIZER_STRINGIFY(TRAMPOLINE(func)) ":\n" \
228 C_ASM_STARTPROC "\n" \
229 C_ASM_TAIL_CALL(SANITIZER_STRINGIFY(TRAMPOLINE(func)), \
230 "__interceptor_" \
231 SANITIZER_STRINGIFY(ASM_PREEMPTIBLE_SYM(func))) "\n" \
232 C_ASM_ENDPROC "\n" \
233 ".size " SANITIZER_STRINGIFY(TRAMPOLINE(func)) ", " \
234 ".-" SANITIZER_STRINGIFY(TRAMPOLINE(func)) "\n" \
235 );
236# else // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT
237// Some architectures cannot implement efficient interceptor trampolines with
238// just a plain jump due to complexities of resolving a preemptible symbol. In
239// those cases, revert to just this scheme:
240//
241// [wrapper "func": weak] --(alias)--> [WRAP(func)]
242//
243# define WRAP(x) __interceptor_ ## x
244# define TRAMPOLINE(x) WRAP(x)
245# if SANITIZER_FREEBSD || SANITIZER_NETBSD
246# define __ATTRIBUTE_WEAK_WRAPPER
247# else
248# define __ATTRIBUTE_WEAK_WRAPPER __attribute__((weak))
249# endif // SANITIZER_FREEBSD || SANITIZER_NETBSD
250# define DECLARE_WRAPPER(ret_type, func, ...) \
251 extern "C" ret_type func(__VA_ARGS__) \
252 INTERCEPTOR_ATTRIBUTE __ATTRIBUTE_WEAK_WRAPPER ALIAS(WRAP(func));
253# endif // ASM_INTERCEPTOR_TRAMPOLINE_SUPPORT
254#endif
255
256#if SANITIZER_FUCHSIA
257// There is no general interception at all on Fuchsia.
258// Sanitizer runtimes just define functions directly to preempt them,
259// and have bespoke ways to access the underlying libc functions.
260# include <zircon/sanitizer.h>
261# define INTERCEPTOR_ATTRIBUTE __attribute__((visibility("default")))
262# define REAL(x) __unsanitized_##x
263# define DECLARE_REAL(ret_type, func, ...)
264#elif !SANITIZER_APPLE
265# define PTR_TO_REAL(x) real_##x
266# define REAL(x) __interception::PTR_TO_REAL(x)
267# define FUNC_TYPE(x) x##_type
268
269# define DECLARE_REAL(ret_type, func, ...) \
270 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \
271 namespace __interception { \
272 extern FUNC_TYPE(func) PTR_TO_REAL(func); \
273 }
274# define ASSIGN_REAL(dst, src) REAL(dst) = REAL(src)
275#else // SANITIZER_APPLE
276# define REAL(x) x
277# define DECLARE_REAL(ret_type, func, ...) \
278 extern "C" ret_type func(__VA_ARGS__);
279# define ASSIGN_REAL(x, y)
280#endif // SANITIZER_APPLE
281
282#if !SANITIZER_FUCHSIA
283# define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...) \
284 DECLARE_REAL(ret_type, func, __VA_ARGS__) \
285 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \
286 extern "C" ret_type WRAP(func)(__VA_ARGS__);
287// Declare an interceptor and its wrapper defined in a different translation
288// unit (ex. asm).
289# define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...) \
290 extern "C" ret_type TRAMPOLINE(func)(__VA_ARGS__); \
291 extern "C" ret_type WRAP(func)(__VA_ARGS__); \
292 extern "C" ret_type func(__VA_ARGS__);
293#else
294# define DECLARE_REAL_AND_INTERCEPTOR(ret_type, func, ...)
295# define DECLARE_EXTERN_INTERCEPTOR_AND_WRAPPER(ret_type, func, ...)
296#endif
297
298// Generally, you don't need to use DEFINE_REAL by itself, as INTERCEPTOR
299// macros does its job. In exceptional cases you may need to call REAL(foo)
300// without defining INTERCEPTOR(..., foo, ...). For example, if you override
301// foo with an interceptor for other function.
302#if !SANITIZER_APPLE && !SANITIZER_FUCHSIA
303# define DEFINE_REAL(ret_type, func, ...) \
304 typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \
305 namespace __interception { \
306 FUNC_TYPE(func) PTR_TO_REAL(func); \
307 }
308#else
309# define DEFINE_REAL(ret_type, func, ...)
310#endif
311
312#if SANITIZER_FUCHSIA
313
314// We need to define the __interceptor_func name just to get
315// sanitizer_common/scripts/gen_dynamic_list.py to export func.
316// But we don't need to export __interceptor_func to get that.
317#define INTERCEPTOR(ret_type, func, ...) \
318 extern "C"[[ gnu::alias(#func), gnu::visibility("hidden") ]] ret_type \
319 __interceptor_##func(__VA_ARGS__); \
320 extern "C" INTERCEPTOR_ATTRIBUTE ret_type func(__VA_ARGS__)
321
322#elif !SANITIZER_APPLE
323
324#define INTERCEPTOR(ret_type, func, ...) \
325 DEFINE_REAL(ret_type, func, __VA_ARGS__) \
326 DECLARE_WRAPPER(ret_type, func, __VA_ARGS__) \
327 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__)
328
329// We don't need INTERCEPTOR_WITH_SUFFIX on non-Darwin for now.
330#define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \
331 INTERCEPTOR(ret_type, func, __VA_ARGS__)
332
333#else // SANITIZER_APPLE
334
335#define INTERCEPTOR_ZZZ(suffix, ret_type, func, ...) \
336 extern "C" ret_type func(__VA_ARGS__) suffix; \
337 extern "C" ret_type WRAP(func)(__VA_ARGS__); \
338 INTERPOSER(func); \
339 extern "C" INTERCEPTOR_ATTRIBUTE ret_type WRAP(func)(__VA_ARGS__)
340
341#define INTERCEPTOR(ret_type, func, ...) \
342 INTERCEPTOR_ZZZ(/*no symbol variants*/, ret_type, func, __VA_ARGS__)
343
344#define INTERCEPTOR_WITH_SUFFIX(ret_type, func, ...) \
345 INTERCEPTOR_ZZZ(__DARWIN_ALIAS_C(func), ret_type, func, __VA_ARGS__)
346
347// Override |overridee| with |overrider|.
348#define OVERRIDE_FUNCTION(overridee, overrider) \
349 INTERPOSER_2(overridee, WRAP(overrider))
350#endif
351
352#if SANITIZER_WINDOWS
353# define INTERCEPTOR_WINAPI(ret_type, func, ...) \
354 typedef ret_type (__stdcall *FUNC_TYPE(func))(__VA_ARGS__); \
355 namespace __interception { \
356 FUNC_TYPE(func) PTR_TO_REAL(func); \
357 } \
358 extern "C" INTERCEPTOR_ATTRIBUTE ret_type __stdcall WRAP(func)(__VA_ARGS__)
359#endif
360
361// ISO C++ forbids casting between pointer-to-function and pointer-to-object,
362// so we use casts via uintptr_t (the local __sanitizer::uptr equivalent).
363namespace __interception {
364
365#if defined(__ELF__) && !SANITIZER_FUCHSIA
366// The use of interceptors makes many sanitizers unusable for static linking.
367// Define a function, if called, will cause a linker error (undefined _DYNAMIC).
368// However, -static-pie (which is not common) cannot be detected at link time.
369extern uptr kDynamic[] asm("_DYNAMIC");
370inline void DoesNotSupportStaticLinking() {
371 [[maybe_unused]] volatile auto x = &kDynamic;
372}
373#else
374inline void DoesNotSupportStaticLinking() {}
375#endif
376} // namespace __interception
377
378#define INCLUDED_FROM_INTERCEPTION_LIB
379
380#if SANITIZER_AIX
381# include "interception_aix.h"
382# define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_AIX(func)
383# define INTERCEPT_FUNCTION_VER(func, symver) INTERCEPT_FUNCTION_AIX(func)
384
385#elif SANITIZER_LINUX || SANITIZER_FREEBSD || SANITIZER_NETBSD || \
386 SANITIZER_SOLARIS || SANITIZER_HAIKU
387
388# include "interception_linux.h"
389# define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_LINUX_OR_FREEBSD(func)
390# define INTERCEPT_FUNCTION_VER(func, symver) \
391 INTERCEPT_FUNCTION_VER_LINUX_OR_FREEBSD(func, symver)
392#elif SANITIZER_APPLE
393# include "interception_mac.h"
394# define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_MAC(func)
395# define INTERCEPT_FUNCTION_VER(func, symver) \
396 INTERCEPT_FUNCTION_VER_MAC(func, symver)
397#elif SANITIZER_WINDOWS
398# include "interception_win.h"
399# define INTERCEPT_FUNCTION(func) INTERCEPT_FUNCTION_WIN(func)
400# define INTERCEPT_FUNCTION_VER(func, symver) \
401 INTERCEPT_FUNCTION_VER_WIN(func, symver)
402#endif
403
404#undef INCLUDED_FROM_INTERCEPTION_LIB
405
406#endif // INTERCEPTION_H
407