| 1 | //=-- lsan_common.cpp -----------------------------------------------------===// |
| 2 | // |
| 3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| 4 | // See https://llvm.org/LICENSE.txt for license information. |
| 5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
| 6 | // |
| 7 | //===----------------------------------------------------------------------===// |
| 8 | // |
| 9 | // This file is a part of LeakSanitizer. |
| 10 | // Implementation of common leak checking functionality. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
| 14 | #include "lsan_common.h" |
| 15 | |
| 16 | #include "sanitizer_common/sanitizer_common.h" |
| 17 | #include "sanitizer_common/sanitizer_flag_parser.h" |
| 18 | #include "sanitizer_common/sanitizer_flags.h" |
| 19 | #include "sanitizer_common/sanitizer_placement_new.h" |
| 20 | #include "sanitizer_common/sanitizer_procmaps.h" |
| 21 | #include "sanitizer_common/sanitizer_report_decorator.h" |
| 22 | #include "sanitizer_common/sanitizer_stackdepot.h" |
| 23 | #include "sanitizer_common/sanitizer_stacktrace.h" |
| 24 | #include "sanitizer_common/sanitizer_suppressions.h" |
| 25 | #include "sanitizer_common/sanitizer_thread_registry.h" |
| 26 | #include "sanitizer_common/sanitizer_tls_get_addr.h" |
| 27 | |
| 28 | #if CAN_SANITIZE_LEAKS |
| 29 | |
| 30 | # if SANITIZER_APPLE |
| 31 | // https://github.com/apple-oss-distributions/objc4/blob/8701d5672d3fd3cd817aeb84db1077aafe1a1604/runtime/objc-runtime-new.h#L127 |
| 32 | # if SANITIZER_IOS && !SANITIZER_IOSSIM |
| 33 | # define OBJC_DATA_MASK 0x0000007ffffffff8UL |
| 34 | # else |
| 35 | # define OBJC_DATA_MASK 0x00007ffffffffff8UL |
| 36 | # endif |
| 37 | # endif |
| 38 | |
| 39 | namespace __lsan { |
| 40 | |
| 41 | // This mutex is used to prevent races between DoLeakCheck and IgnoreObject, and |
| 42 | // also to protect the global list of root regions. |
| 43 | static Mutex global_mutex; |
| 44 | |
| 45 | void LockGlobal() SANITIZER_ACQUIRE(global_mutex) { global_mutex.Lock(); } |
| 46 | void UnlockGlobal() SANITIZER_RELEASE(global_mutex) { global_mutex.Unlock(); } |
| 47 | |
| 48 | Flags lsan_flags; |
| 49 | |
| 50 | void DisableCounterUnderflow() { |
| 51 | if (common_flags()->detect_leaks) { |
| 52 | Report(format: "Unmatched call to __lsan_enable().\n" ); |
| 53 | Die(); |
| 54 | } |
| 55 | } |
| 56 | |
| 57 | void Flags::SetDefaults() { |
| 58 | # define LSAN_FLAG(Type, Name, DefaultValue, Description) Name = DefaultValue; |
| 59 | # include "lsan_flags.inc" |
| 60 | # undef LSAN_FLAG |
| 61 | } |
| 62 | |
| 63 | void RegisterLsanFlags(FlagParser *parser, Flags *f) { |
| 64 | # define LSAN_FLAG(Type, Name, DefaultValue, Description) \ |
| 65 | RegisterFlag(parser, #Name, Description, &f->Name); |
| 66 | # include "lsan_flags.inc" |
| 67 | # undef LSAN_FLAG |
| 68 | } |
| 69 | |
| 70 | # define LOG_POINTERS(...) \ |
| 71 | do { \ |
| 72 | if (flags()->log_pointers) \ |
| 73 | Report(__VA_ARGS__); \ |
| 74 | } while (0) |
| 75 | |
| 76 | # define LOG_THREADS(...) \ |
| 77 | do { \ |
| 78 | if (flags()->log_threads) \ |
| 79 | Report(__VA_ARGS__); \ |
| 80 | } while (0) |
| 81 | |
| 82 | class LeakSuppressionContext { |
| 83 | bool parsed = false; |
| 84 | SuppressionContext context; |
| 85 | bool suppressed_stacks_sorted = true; |
| 86 | InternalMmapVector<u32> suppressed_stacks; |
| 87 | const LoadedModule *suppress_module = nullptr; |
| 88 | |
| 89 | void LazyInit(); |
| 90 | Suppression *GetSuppressionForAddr(uptr addr); |
| 91 | bool SuppressInvalid(const StackTrace &stack); |
| 92 | bool SuppressByRule(const StackTrace &stack, uptr hit_count, uptr total_size); |
| 93 | |
| 94 | public: |
| 95 | LeakSuppressionContext(const char *supprression_types[], |
| 96 | int suppression_types_num) |
| 97 | : context(supprression_types, suppression_types_num) {} |
| 98 | |
| 99 | bool Suppress(u32 stack_trace_id, uptr hit_count, uptr total_size); |
| 100 | |
| 101 | const InternalMmapVector<u32> &GetSortedSuppressedStacks() { |
| 102 | if (!suppressed_stacks_sorted) { |
| 103 | suppressed_stacks_sorted = true; |
| 104 | SortAndDedup(v&: suppressed_stacks); |
| 105 | } |
| 106 | return suppressed_stacks; |
| 107 | } |
| 108 | void PrintMatchedSuppressions(); |
| 109 | }; |
| 110 | |
| 111 | alignas(64) static char suppression_placeholder[sizeof(LeakSuppressionContext)]; |
| 112 | static LeakSuppressionContext *suppression_ctx = nullptr; |
| 113 | static const char kSuppressionLeak[] = "leak" ; |
| 114 | static const char *kSuppressionTypes[] = {kSuppressionLeak}; |
| 115 | static const char kStdSuppressions[] = |
| 116 | # if SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT |
| 117 | // For more details refer to the SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT |
| 118 | // definition. |
| 119 | "leak:*pthread_exit*\n" |
| 120 | # endif // SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT |
| 121 | # if SANITIZER_APPLE |
| 122 | // For Darwin and os_log/os_trace: https://reviews.llvm.org/D35173 |
| 123 | "leak:*_os_trace*\n" |
| 124 | # endif |
| 125 | // TLS leak in some glibc versions, described in |
| 126 | // https://sourceware.org/bugzilla/show_bug.cgi?id=12650. |
| 127 | "leak:*tls_get_addr*\n" |
| 128 | "leak:*dlerror*\n" ; |
| 129 | |
| 130 | void InitializeSuppressions() { |
| 131 | CHECK_EQ(nullptr, suppression_ctx); |
| 132 | suppression_ctx = new (suppression_placeholder) |
| 133 | LeakSuppressionContext(kSuppressionTypes, ARRAY_SIZE(kSuppressionTypes)); |
| 134 | } |
| 135 | |
| 136 | void LeakSuppressionContext::LazyInit() { |
| 137 | if (!parsed) { |
| 138 | parsed = true; |
| 139 | context.ParseFromFile(filename: flags()->suppressions); |
| 140 | if (&__lsan_default_suppressions) |
| 141 | context.Parse(str: __lsan_default_suppressions()); |
| 142 | context.Parse(str: kStdSuppressions); |
| 143 | if (flags()->use_tls && flags()->use_ld_allocations) |
| 144 | suppress_module = GetLinker(); |
| 145 | } |
| 146 | } |
| 147 | |
| 148 | Suppression *LeakSuppressionContext::GetSuppressionForAddr(uptr addr) { |
| 149 | Suppression *s = nullptr; |
| 150 | |
| 151 | // Suppress by module name. |
| 152 | const char *module_name = Symbolizer::GetOrInit()->GetModuleNameForPc(pc: addr); |
| 153 | if (!module_name) |
| 154 | module_name = "<unknown module>" ; |
| 155 | if (context.Match(str: module_name, type: kSuppressionLeak, s: &s)) |
| 156 | return s; |
| 157 | |
| 158 | // Suppress by file or function name. |
| 159 | SymbolizedStackHolder symbolized_stack( |
| 160 | Symbolizer::GetOrInit()->SymbolizePC(address: addr)); |
| 161 | const SymbolizedStack *frames = symbolized_stack.get(); |
| 162 | for (const SymbolizedStack *cur = frames; cur; cur = cur->next) { |
| 163 | if (context.Match(str: cur->info.function, type: kSuppressionLeak, s: &s) || |
| 164 | context.Match(str: cur->info.file, type: kSuppressionLeak, s: &s)) { |
| 165 | break; |
| 166 | } |
| 167 | } |
| 168 | return s; |
| 169 | } |
| 170 | |
| 171 | static uptr GetCallerPC(const StackTrace &stack) { |
| 172 | // The top frame is our malloc/calloc/etc. The next frame is the caller. |
| 173 | if (stack.size >= 2) |
| 174 | return stack.trace[1]; |
| 175 | return 0; |
| 176 | } |
| 177 | |
| 178 | # if SANITIZER_APPLE |
| 179 | // Several pointers in the Objective-C runtime (method cache and class_rw_t, |
| 180 | // for example) are tagged with additional bits we need to strip. |
| 181 | static inline void *TransformPointer(void *p) { |
| 182 | uptr ptr = reinterpret_cast<uptr>(p); |
| 183 | return reinterpret_cast<void *>(ptr & OBJC_DATA_MASK); |
| 184 | } |
| 185 | # endif |
| 186 | |
| 187 | // On Linux, treats all chunks allocated from ld-linux.so as reachable, which |
| 188 | // covers dynamically allocated TLS blocks, internal dynamic loader's loaded |
| 189 | // modules accounting etc. |
| 190 | // Dynamic TLS blocks contain the TLS variables of dynamically loaded modules. |
| 191 | // They are allocated with a __libc_memalign() call in allocate_and_init() |
| 192 | // (elf/dl-tls.c). Glibc won't tell us the address ranges occupied by those |
| 193 | // blocks, but we can make sure they come from our own allocator by intercepting |
| 194 | // __libc_memalign(). On top of that, there is no easy way to reach them. Their |
| 195 | // addresses are stored in a dynamically allocated array (the DTV) which is |
| 196 | // referenced from the static TLS. Unfortunately, we can't just rely on the DTV |
| 197 | // being reachable from the static TLS, and the dynamic TLS being reachable from |
| 198 | // the DTV. This is because the initial DTV is allocated before our interception |
| 199 | // mechanism kicks in, and thus we don't recognize it as allocated memory. We |
| 200 | // can't special-case it either, since we don't know its size. |
| 201 | // Our solution is to include in the root set all allocations made from |
| 202 | // ld-linux.so (which is where allocate_and_init() is implemented). This is |
| 203 | // guaranteed to include all dynamic TLS blocks (and possibly other allocations |
| 204 | // which we don't care about). |
| 205 | // On all other platforms, this simply checks to ensure that the caller pc is |
| 206 | // valid before reporting chunks as leaked. |
| 207 | bool LeakSuppressionContext::SuppressInvalid(const StackTrace &stack) { |
| 208 | uptr caller_pc = GetCallerPC(stack); |
| 209 | // If caller_pc is unknown, this chunk may be allocated in a coroutine. Mark |
| 210 | // it as reachable, as we can't properly report its allocation stack anyway. |
| 211 | return !caller_pc || |
| 212 | (suppress_module && suppress_module->containsAddress(address: caller_pc)); |
| 213 | } |
| 214 | |
| 215 | bool LeakSuppressionContext::SuppressByRule(const StackTrace &stack, |
| 216 | uptr hit_count, uptr total_size) { |
| 217 | for (uptr i = 0; i < stack.size; i++) { |
| 218 | Suppression *s = GetSuppressionForAddr( |
| 219 | addr: StackTrace::GetPreviousInstructionPc(pc: stack.trace[i])); |
| 220 | if (s) { |
| 221 | s->weight += total_size; |
| 222 | atomic_fetch_add(a: &s->hit_count, v: hit_count, mo: memory_order_relaxed); |
| 223 | return true; |
| 224 | } |
| 225 | } |
| 226 | return false; |
| 227 | } |
| 228 | |
| 229 | bool LeakSuppressionContext::Suppress(u32 stack_trace_id, uptr hit_count, |
| 230 | uptr total_size) { |
| 231 | LazyInit(); |
| 232 | StackTrace stack = StackDepotGet(id: stack_trace_id); |
| 233 | if (!SuppressInvalid(stack) && !SuppressByRule(stack, hit_count, total_size)) |
| 234 | return false; |
| 235 | suppressed_stacks_sorted = false; |
| 236 | suppressed_stacks.push_back(element: stack_trace_id); |
| 237 | return true; |
| 238 | } |
| 239 | |
| 240 | static LeakSuppressionContext *GetSuppressionContext() { |
| 241 | CHECK(suppression_ctx); |
| 242 | return suppression_ctx; |
| 243 | } |
| 244 | |
| 245 | void InitCommonLsan() { |
| 246 | if (common_flags()->detect_leaks) { |
| 247 | // Initialization which can fail or print warnings should only be done if |
| 248 | // LSan is actually enabled. |
| 249 | InitializeSuppressions(); |
| 250 | InitializePlatformSpecificModules(); |
| 251 | } |
| 252 | } |
| 253 | |
| 254 | class Decorator : public __sanitizer::SanitizerCommonDecorator { |
| 255 | public: |
| 256 | Decorator() : SanitizerCommonDecorator() {} |
| 257 | const char *Error() { return Red(); } |
| 258 | const char *Leak() { return Blue(); } |
| 259 | }; |
| 260 | |
| 261 | static inline bool MaybeUserPointer(uptr p) { |
| 262 | // Since our heap is located in mmap-ed memory, we can assume a sensible lower |
| 263 | // bound on heap addresses. |
| 264 | const uptr kMinAddress = 4 * 4096; |
| 265 | if (p < kMinAddress) |
| 266 | return false; |
| 267 | # if defined(__x86_64__) |
| 268 | // TODO: support LAM48 and 5 level page tables. |
| 269 | // LAM_U57 mask format |
| 270 | // * top byte: 0x81 because the format is: [0] [6-bit tag] [0] |
| 271 | // * top-1 byte: 0xff because it should be 0 |
| 272 | // * top-2 byte: 0x80 because Linux uses 128 TB VMA ending at 0x7fffffffffff |
| 273 | constexpr uptr kLAM_U57Mask = 0x81ff80; |
| 274 | constexpr uptr kPointerMask = kLAM_U57Mask << 40; |
| 275 | return ((p & kPointerMask) == 0); |
| 276 | # elif defined(__mips64) |
| 277 | return ((p >> 40) == 0); |
| 278 | # elif defined(__aarch64__) |
| 279 | // TBI (Top Byte Ignore) feature of AArch64: bits [63:56] are ignored in |
| 280 | // address translation and can be used to store a tag. |
| 281 | constexpr uptr kPointerMask = 255ULL << 48; |
| 282 | // Accept up to 48 bit VMA. |
| 283 | return ((p & kPointerMask) == 0); |
| 284 | # elif defined(__loongarch_lp64) |
| 285 | // Allow 47-bit user-space VMA at current. |
| 286 | return ((p >> 47) == 0); |
| 287 | # else |
| 288 | return true; |
| 289 | # endif |
| 290 | } |
| 291 | |
| 292 | namespace { |
| 293 | struct DirectMemoryAccessor { |
| 294 | void Init(uptr begin, uptr end) {}; |
| 295 | void *LoadPtr(uptr p) const { return *reinterpret_cast<void **>(p); } |
| 296 | }; |
| 297 | |
| 298 | struct CopyMemoryAccessor { |
| 299 | void Init(uptr begin, uptr end) { |
| 300 | this->begin = begin; |
| 301 | buffer.clear(); |
| 302 | buffer.resize(new_size: end - begin); |
| 303 | MemCpyAccessible(dest: buffer.data(), src: reinterpret_cast<void *>(begin), |
| 304 | n: buffer.size()); |
| 305 | }; |
| 306 | |
| 307 | void *LoadPtr(uptr p) const { |
| 308 | uptr offset = p - begin; |
| 309 | CHECK_LE(offset + sizeof(void *), reinterpret_cast<uptr>(buffer.size())); |
| 310 | return *reinterpret_cast<void **>(offset + |
| 311 | reinterpret_cast<uptr>(buffer.data())); |
| 312 | } |
| 313 | |
| 314 | private: |
| 315 | uptr begin; |
| 316 | InternalMmapVector<char> buffer; |
| 317 | }; |
| 318 | } // namespace |
| 319 | |
| 320 | // Scans the memory range, looking for byte patterns that point into allocator |
| 321 | // chunks. Marks those chunks with |tag| and adds them to |frontier|. |
| 322 | // There are two usage modes for this function: finding reachable chunks |
| 323 | // (|tag| = kReachable) and finding indirectly leaked chunks |
| 324 | // (|tag| = kIndirectlyLeaked). In the second case, there's no flood fill, |
| 325 | // so |frontier| = 0. |
| 326 | template <class Accessor> |
| 327 | void ScanForPointers(uptr begin, uptr end, Frontier *frontier, |
| 328 | const char *region_type, ChunkTag tag, |
| 329 | Accessor &accessor) { |
| 330 | CHECK(tag == kReachable || tag == kIndirectlyLeaked); |
| 331 | const uptr alignment = flags()->pointer_alignment(); |
| 332 | LOG_POINTERS("Scanning %s range %p-%p.\n" , region_type, (void *)begin, |
| 333 | (void *)end); |
| 334 | accessor.Init(begin, end); |
| 335 | uptr pp = begin; |
| 336 | if (pp % alignment) |
| 337 | pp = pp + alignment - pp % alignment; |
| 338 | for (; pp + sizeof(void *) <= end; pp += alignment) { |
| 339 | void *p = accessor.LoadPtr(pp); |
| 340 | # if SANITIZER_APPLE |
| 341 | p = TransformPointer(p); |
| 342 | # endif |
| 343 | if (!MaybeUserPointer(p: reinterpret_cast<uptr>(p))) |
| 344 | continue; |
| 345 | uptr chunk = PointsIntoChunk(p); |
| 346 | if (!chunk) |
| 347 | continue; |
| 348 | // Pointers to self don't count. This matters when tag == kIndirectlyLeaked. |
| 349 | if (chunk == begin) |
| 350 | continue; |
| 351 | LsanMetadata m(chunk); |
| 352 | if (m.tag() == kReachable || m.tag() == kIgnored) |
| 353 | continue; |
| 354 | |
| 355 | // Do this check relatively late so we can log only the interesting cases. |
| 356 | if (!flags()->use_poisoned && WordIsPoisoned(addr: pp)) { |
| 357 | LOG_POINTERS( |
| 358 | "%p is poisoned: ignoring %p pointing into chunk %p-%p of size " |
| 359 | "%zu.\n" , |
| 360 | (void *)pp, p, (void *)chunk, (void *)(chunk + m.requested_size()), |
| 361 | m.requested_size()); |
| 362 | continue; |
| 363 | } |
| 364 | |
| 365 | m.set_tag(tag); |
| 366 | LOG_POINTERS("%p: found %p pointing into chunk %p-%p of size %zu.\n" , |
| 367 | (void *)pp, p, (void *)chunk, |
| 368 | (void *)(chunk + m.requested_size()), m.requested_size()); |
| 369 | if (frontier) |
| 370 | frontier->push_back(element: chunk); |
| 371 | } |
| 372 | } |
| 373 | |
| 374 | void ScanRangeForPointers(uptr begin, uptr end, Frontier *frontier, |
| 375 | const char *region_type, ChunkTag tag) { |
| 376 | DirectMemoryAccessor accessor; |
| 377 | ScanForPointers(begin, end, frontier, region_type, tag, accessor); |
| 378 | } |
| 379 | |
| 380 | // Scans a global range for pointers |
| 381 | void ScanGlobalRange(uptr begin, uptr end, Frontier *frontier) { |
| 382 | uptr allocator_begin = 0, allocator_end = 0; |
| 383 | GetAllocatorGlobalRange(begin: &allocator_begin, end: &allocator_end); |
| 384 | if (begin <= allocator_begin && allocator_begin < end) { |
| 385 | CHECK_LE(allocator_begin, allocator_end); |
| 386 | CHECK_LE(allocator_end, end); |
| 387 | if (begin < allocator_begin) |
| 388 | ScanRangeForPointers(begin, end: allocator_begin, frontier, region_type: "GLOBAL" , |
| 389 | tag: kReachable); |
| 390 | if (allocator_end < end) |
| 391 | ScanRangeForPointers(begin: allocator_end, end, frontier, region_type: "GLOBAL" , tag: kReachable); |
| 392 | } else { |
| 393 | ScanRangeForPointers(begin, end, frontier, region_type: "GLOBAL" , tag: kReachable); |
| 394 | } |
| 395 | } |
| 396 | |
| 397 | template <class Accessor> |
| 398 | void ScanRanges(const InternalMmapVector<Range> &ranges, Frontier *frontier, |
| 399 | const char *region_type, Accessor &accessor) { |
| 400 | for (uptr i = 0; i < ranges.size(); i++) { |
| 401 | ScanForPointers(ranges[i].begin, ranges[i].end, frontier, region_type, |
| 402 | kReachable, accessor); |
| 403 | } |
| 404 | } |
| 405 | |
| 406 | void (const InternalMmapVector<Range> &ranges, |
| 407 | Frontier *frontier) { |
| 408 | DirectMemoryAccessor accessor; |
| 409 | ScanRanges(ranges, frontier, region_type: "FAKE STACK" , accessor); |
| 410 | } |
| 411 | |
| 412 | # if SANITIZER_FUCHSIA |
| 413 | |
| 414 | // Fuchsia handles all threads together with its own callback. |
| 415 | static void ProcessThreads(SuspendedThreadsList const &, Frontier *, tid_t, |
| 416 | uptr) {} |
| 417 | |
| 418 | # else |
| 419 | |
| 420 | # if SANITIZER_ANDROID |
| 421 | // FIXME: Move this out into *libcdep.cpp |
| 422 | extern "C" SANITIZER_WEAK_ATTRIBUTE void __libc_iterate_dynamic_tls( |
| 423 | pid_t, void (*cb)(void *, void *, uptr, void *), void *); |
| 424 | # endif |
| 425 | |
| 426 | static void ProcessThreadRegistry(Frontier *frontier) { |
| 427 | InternalMmapVector<uptr> ptrs; |
| 428 | GetAdditionalThreadContextPtrsLocked(ptrs: &ptrs); |
| 429 | |
| 430 | for (uptr i = 0; i < ptrs.size(); ++i) { |
| 431 | void *ptr = reinterpret_cast<void *>(ptrs[i]); |
| 432 | uptr chunk = PointsIntoChunk(p: ptr); |
| 433 | if (!chunk) |
| 434 | continue; |
| 435 | LsanMetadata m(chunk); |
| 436 | if (!m.allocated()) |
| 437 | continue; |
| 438 | |
| 439 | // Mark as reachable and add to frontier. |
| 440 | LOG_POINTERS("Treating pointer %p from ThreadContext as reachable\n" , ptr); |
| 441 | m.set_tag(kReachable); |
| 442 | frontier->push_back(element: chunk); |
| 443 | } |
| 444 | } |
| 445 | |
| 446 | // Scans thread data (stacks and TLS) for heap pointers. |
| 447 | template <class Accessor> |
| 448 | static void ProcessThread(tid_t os_id, uptr sp, |
| 449 | const InternalMmapVector<uptr> ®isters, |
| 450 | InternalMmapVector<Range> &, |
| 451 | Frontier *frontier, Accessor &accessor) { |
| 452 | // `extra_ranges` is outside of the function and the loop to reused mapped |
| 453 | // memory. |
| 454 | CHECK(extra_ranges.empty()); |
| 455 | LOG_THREADS("Processing thread %llu.\n" , os_id); |
| 456 | uptr stack_begin, stack_end, tls_begin, tls_end, cache_begin, cache_end; |
| 457 | DTLS *dtls; |
| 458 | bool thread_found = |
| 459 | GetThreadRangesLocked(os_id, stack_begin: &stack_begin, stack_end: &stack_end, tls_begin: &tls_begin, |
| 460 | tls_end: &tls_end, cache_begin: &cache_begin, cache_end: &cache_end, dtls: &dtls); |
| 461 | if (!thread_found) { |
| 462 | // If a thread can't be found in the thread registry, it's probably in the |
| 463 | // process of destruction. Log this event and move on. |
| 464 | LOG_THREADS("Thread %llu not found in registry.\n" , os_id); |
| 465 | return; |
| 466 | } |
| 467 | |
| 468 | if (!sp) |
| 469 | sp = stack_begin; |
| 470 | |
| 471 | if (flags()->use_registers) { |
| 472 | uptr registers_begin = reinterpret_cast<uptr>(registers.data()); |
| 473 | uptr registers_end = |
| 474 | reinterpret_cast<uptr>(registers.data() + registers.size()); |
| 475 | ScanForPointers(registers_begin, registers_end, frontier, "REGISTERS" , |
| 476 | kReachable, accessor); |
| 477 | } |
| 478 | |
| 479 | if (flags()->use_stacks) { |
| 480 | LOG_THREADS("Stack at %p-%p (SP = %p).\n" , (void *)stack_begin, |
| 481 | (void *)stack_end, (void *)sp); |
| 482 | if (sp < stack_begin || sp >= stack_end) { |
| 483 | // SP is outside the recorded stack range (e.g. the thread is running a |
| 484 | // signal handler on alternate stack, or swapcontext was used). |
| 485 | // Again, consider the entire stack range to be reachable. |
| 486 | LOG_THREADS("WARNING: stack pointer not in stack range.\n" ); |
| 487 | uptr page_size = GetPageSizeCached(); |
| 488 | int skipped = 0; |
| 489 | while (stack_begin < stack_end && |
| 490 | !IsAccessibleMemoryRange(beg: stack_begin, size: 1)) { |
| 491 | skipped++; |
| 492 | stack_begin += page_size; |
| 493 | } |
| 494 | LOG_THREADS("Skipped %d guard page(s) to obtain stack %p-%p.\n" , skipped, |
| 495 | (void *)stack_begin, (void *)stack_end); |
| 496 | } else { |
| 497 | // Shrink the stack range to ignore out-of-scope values. |
| 498 | stack_begin = sp; |
| 499 | } |
| 500 | ScanForPointers(stack_begin, stack_end, frontier, "STACK" , kReachable, |
| 501 | accessor); |
| 502 | GetThreadExtraStackRangesLocked(os_id, ranges: &extra_ranges); |
| 503 | ScanRanges(extra_ranges, frontier, "FAKE STACK" , accessor); |
| 504 | } |
| 505 | |
| 506 | if (flags()->use_tls) { |
| 507 | if (tls_begin) { |
| 508 | LOG_THREADS("TLS at %p-%p.\n" , (void *)tls_begin, (void *)tls_end); |
| 509 | // If the tls and cache ranges don't overlap, scan full tls range, |
| 510 | // otherwise, only scan the non-overlapping portions |
| 511 | if (cache_begin == cache_end || tls_end < cache_begin || |
| 512 | tls_begin > cache_end) { |
| 513 | ScanForPointers(tls_begin, tls_end, frontier, "TLS" , kReachable, |
| 514 | accessor); |
| 515 | } else { |
| 516 | if (tls_begin < cache_begin) |
| 517 | ScanForPointers(tls_begin, cache_begin, frontier, "TLS" , kReachable, |
| 518 | accessor); |
| 519 | if (tls_end > cache_end) |
| 520 | ScanForPointers(cache_end, tls_end, frontier, "TLS" , kReachable, |
| 521 | accessor); |
| 522 | } |
| 523 | } |
| 524 | # if SANITIZER_ANDROID |
| 525 | extra_ranges.clear(); |
| 526 | auto *cb = +[](void *dtls_begin, void *dtls_end, uptr /*dso_idd*/, |
| 527 | void *arg) -> void { |
| 528 | reinterpret_cast<InternalMmapVector<Range> *>(arg)->push_back( |
| 529 | {reinterpret_cast<uptr>(dtls_begin), |
| 530 | reinterpret_cast<uptr>(dtls_end)}); |
| 531 | }; |
| 532 | ScanRanges(extra_ranges, frontier, "DTLS" , accessor); |
| 533 | // FIXME: There might be a race-condition here (and in Bionic) if the |
| 534 | // thread is suspended in the middle of updating its DTLS. IOWs, we |
| 535 | // could scan already freed memory. (probably fine for now) |
| 536 | __libc_iterate_dynamic_tls(os_id, cb, frontier); |
| 537 | # else |
| 538 | if (dtls && !DTLSInDestruction(dtls)) { |
| 539 | ForEachDVT(dtls, [&](const DTLS::DTV &dtv, int id) { |
| 540 | uptr dtls_beg = dtv.beg; |
| 541 | uptr dtls_end = dtls_beg + dtv.size; |
| 542 | if (dtls_beg < dtls_end) { |
| 543 | LOG_THREADS("DTLS %d at %p-%p.\n" , id, (void *)dtls_beg, |
| 544 | (void *)dtls_end); |
| 545 | ScanForPointers(dtls_beg, dtls_end, frontier, "DTLS" , kReachable, |
| 546 | accessor); |
| 547 | } |
| 548 | }); |
| 549 | } else { |
| 550 | // We are handling a thread with DTLS under destruction. Log about |
| 551 | // this and continue. |
| 552 | LOG_THREADS("Thread %llu has DTLS under destruction.\n" , os_id); |
| 553 | } |
| 554 | # endif |
| 555 | } |
| 556 | } |
| 557 | |
| 558 | static void ProcessThreads(SuspendedThreadsList const &suspended_threads, |
| 559 | Frontier *frontier, tid_t caller_tid, |
| 560 | uptr caller_sp) { |
| 561 | InternalMmapVector<tid_t> done_threads; |
| 562 | InternalMmapVector<uptr> registers; |
| 563 | InternalMmapVector<Range> ; |
| 564 | for (uptr i = 0; i < suspended_threads.ThreadCount(); i++) { |
| 565 | registers.clear(); |
| 566 | extra_ranges.clear(); |
| 567 | |
| 568 | const tid_t os_id = suspended_threads.GetThreadID(index: i); |
| 569 | uptr sp = 0; |
| 570 | PtraceRegistersStatus have_registers = |
| 571 | suspended_threads.GetRegistersAndSP(index: i, buffer: ®isters, sp: &sp); |
| 572 | if (have_registers != REGISTERS_AVAILABLE) { |
| 573 | VReport(1, "Unable to get registers from thread %llu.\n" , os_id); |
| 574 | // If unable to get SP, consider the entire stack to be reachable unless |
| 575 | // GetRegistersAndSP failed with ESRCH. |
| 576 | if (have_registers == REGISTERS_UNAVAILABLE_FATAL) |
| 577 | continue; |
| 578 | sp = 0; |
| 579 | } |
| 580 | |
| 581 | if (os_id == caller_tid) |
| 582 | sp = caller_sp; |
| 583 | |
| 584 | DirectMemoryAccessor accessor; |
| 585 | ProcessThread(os_id, sp, registers, extra_ranges, frontier, accessor); |
| 586 | if (flags()->use_detached) |
| 587 | done_threads.push_back(element: os_id); |
| 588 | } |
| 589 | |
| 590 | if (flags()->use_detached) { |
| 591 | CopyMemoryAccessor accessor; |
| 592 | InternalMmapVector<tid_t> known_threads; |
| 593 | GetRunningThreadsLocked(threads: &known_threads); |
| 594 | Sort(v: done_threads.data(), size: done_threads.size()); |
| 595 | for (tid_t os_id : known_threads) { |
| 596 | registers.clear(); |
| 597 | extra_ranges.clear(); |
| 598 | |
| 599 | uptr i = InternalLowerBound(v: done_threads, val: os_id); |
| 600 | if (i >= done_threads.size() || done_threads[i] != os_id) { |
| 601 | uptr sp = (os_id == caller_tid) ? caller_sp : 0; |
| 602 | ProcessThread(os_id, sp, registers, extra_ranges, frontier, accessor); |
| 603 | } |
| 604 | } |
| 605 | } |
| 606 | |
| 607 | // Add pointers reachable from ThreadContexts |
| 608 | ProcessThreadRegistry(frontier); |
| 609 | } |
| 610 | |
| 611 | # endif // SANITIZER_FUCHSIA |
| 612 | |
| 613 | // A map that contains [region_begin, region_end) pairs. |
| 614 | using RootRegions = DenseMap<detail::DenseMapPair<uptr, uptr>, uptr>; |
| 615 | |
| 616 | static RootRegions &GetRootRegionsLocked() { |
| 617 | global_mutex.CheckLocked(); |
| 618 | static RootRegions *regions = nullptr; |
| 619 | alignas(RootRegions) static char placeholder[sizeof(RootRegions)]; |
| 620 | if (!regions) |
| 621 | regions = new (placeholder) RootRegions(); |
| 622 | return *regions; |
| 623 | } |
| 624 | |
| 625 | bool HasRootRegions() { return !GetRootRegionsLocked().empty(); } |
| 626 | |
| 627 | void ScanRootRegions(Frontier *frontier, |
| 628 | const InternalMmapVectorNoCtor<Region> &mapped_regions) { |
| 629 | if (!flags()->use_root_regions) |
| 630 | return; |
| 631 | |
| 632 | InternalMmapVector<Region> regions; |
| 633 | GetRootRegionsLocked().forEach(fn: [&](const auto &kv) { |
| 634 | regions.push_back(element: {kv.first.first, kv.first.second}); |
| 635 | return true; |
| 636 | }); |
| 637 | |
| 638 | InternalMmapVector<Region> intersection; |
| 639 | Intersect(a: mapped_regions, b: regions, output&: intersection); |
| 640 | |
| 641 | for (const Region &r : intersection) { |
| 642 | LOG_POINTERS("Root region intersects with mapped region at %p-%p\n" , |
| 643 | (void *)r.begin, (void *)r.end); |
| 644 | ScanRangeForPointers(begin: r.begin, end: r.end, frontier, region_type: "ROOT" , tag: kReachable); |
| 645 | } |
| 646 | } |
| 647 | |
| 648 | // Scans root regions for heap pointers. |
| 649 | static void ProcessRootRegions(Frontier *frontier) { |
| 650 | if (!flags()->use_root_regions || !HasRootRegions()) |
| 651 | return; |
| 652 | MemoryMappingLayout proc_maps(/*cache_enabled*/ true); |
| 653 | MemoryMappedSegment segment; |
| 654 | InternalMmapVector<Region> mapped_regions; |
| 655 | while (proc_maps.Next(segment: &segment)) |
| 656 | if (segment.IsReadable()) |
| 657 | mapped_regions.push_back(element: {.begin: segment.start, .end: segment.end}); |
| 658 | ScanRootRegions(frontier, mapped_regions); |
| 659 | } |
| 660 | |
| 661 | static void FloodFillTag(Frontier *frontier, ChunkTag tag) { |
| 662 | while (frontier->size()) { |
| 663 | uptr next_chunk = frontier->back(); |
| 664 | frontier->pop_back(); |
| 665 | LsanMetadata m(next_chunk); |
| 666 | ScanRangeForPointers(begin: next_chunk, end: next_chunk + m.requested_size(), frontier, |
| 667 | region_type: "HEAP" , tag); |
| 668 | } |
| 669 | } |
| 670 | |
| 671 | // ForEachChunk callback. If the chunk is marked as leaked, marks all chunks |
| 672 | // which are reachable from it as indirectly leaked. |
| 673 | static void MarkIndirectlyLeakedCb(uptr chunk, void *arg) { |
| 674 | chunk = GetUserBegin(chunk); |
| 675 | LsanMetadata m(chunk); |
| 676 | if (m.allocated() && m.tag() != kReachable) { |
| 677 | ScanRangeForPointers(begin: chunk, end: chunk + m.requested_size(), |
| 678 | /* frontier */ nullptr, region_type: "HEAP" , tag: kIndirectlyLeaked); |
| 679 | } |
| 680 | } |
| 681 | |
| 682 | static void IgnoredSuppressedCb(uptr chunk, void *arg) { |
| 683 | CHECK(arg); |
| 684 | chunk = GetUserBegin(chunk); |
| 685 | LsanMetadata m(chunk); |
| 686 | if (!m.allocated() || m.tag() == kIgnored) |
| 687 | return; |
| 688 | |
| 689 | const InternalMmapVector<u32> &suppressed = |
| 690 | *static_cast<const InternalMmapVector<u32> *>(arg); |
| 691 | uptr idx = InternalLowerBound(v: suppressed, val: m.stack_trace_id()); |
| 692 | if (idx >= suppressed.size() || m.stack_trace_id() != suppressed[idx]) |
| 693 | return; |
| 694 | |
| 695 | LOG_POINTERS("Suppressed: chunk %p-%p of size %zu.\n" , (void *)chunk, |
| 696 | (void *)(chunk + m.requested_size()), m.requested_size()); |
| 697 | m.set_tag(kIgnored); |
| 698 | } |
| 699 | |
| 700 | // ForEachChunk callback. If chunk is marked as ignored, adds its address to |
| 701 | // frontier. |
| 702 | static void CollectIgnoredCb(uptr chunk, void *arg) { |
| 703 | CHECK(arg); |
| 704 | chunk = GetUserBegin(chunk); |
| 705 | LsanMetadata m(chunk); |
| 706 | if (m.allocated() && m.tag() == kIgnored) { |
| 707 | LOG_POINTERS("Ignored: chunk %p-%p of size %zu.\n" , (void *)chunk, |
| 708 | (void *)(chunk + m.requested_size()), m.requested_size()); |
| 709 | reinterpret_cast<Frontier *>(arg)->push_back(element: chunk); |
| 710 | } |
| 711 | } |
| 712 | |
| 713 | // Sets the appropriate tag on each chunk. |
| 714 | static void ClassifyAllChunks(SuspendedThreadsList const &suspended_threads, |
| 715 | Frontier *frontier, tid_t caller_tid, |
| 716 | uptr caller_sp) { |
| 717 | const InternalMmapVector<u32> &suppressed_stacks = |
| 718 | GetSuppressionContext()->GetSortedSuppressedStacks(); |
| 719 | if (!suppressed_stacks.empty()) { |
| 720 | ForEachChunk(callback: IgnoredSuppressedCb, |
| 721 | arg: const_cast<InternalMmapVector<u32> *>(&suppressed_stacks)); |
| 722 | } |
| 723 | ForEachChunk(callback: CollectIgnoredCb, arg: frontier); |
| 724 | ProcessGlobalRegions(frontier); |
| 725 | ProcessThreads(suspended_threads, frontier, caller_tid, caller_sp); |
| 726 | ProcessRootRegions(frontier); |
| 727 | FloodFillTag(frontier, tag: kReachable); |
| 728 | |
| 729 | // The check here is relatively expensive, so we do this in a separate flood |
| 730 | // fill. That way we can skip the check for chunks that are reachable |
| 731 | // otherwise. |
| 732 | LOG_POINTERS("Processing platform-specific allocations.\n" ); |
| 733 | ProcessPlatformSpecificAllocations(frontier); |
| 734 | FloodFillTag(frontier, tag: kReachable); |
| 735 | |
| 736 | // Iterate over leaked chunks and mark those that are reachable from other |
| 737 | // leaked chunks. |
| 738 | LOG_POINTERS("Scanning leaked chunks.\n" ); |
| 739 | ForEachChunk(callback: MarkIndirectlyLeakedCb, arg: nullptr); |
| 740 | } |
| 741 | |
| 742 | // ForEachChunk callback. Resets the tags to pre-leak-check state. |
| 743 | static void ResetTagsCb(uptr chunk, void *arg) { |
| 744 | (void)arg; |
| 745 | chunk = GetUserBegin(chunk); |
| 746 | LsanMetadata m(chunk); |
| 747 | if (m.allocated() && m.tag() != kIgnored) |
| 748 | m.set_tag(kDirectlyLeaked); |
| 749 | } |
| 750 | |
| 751 | // ForEachChunk callback. Aggregates information about unreachable chunks into |
| 752 | // a LeakReport. |
| 753 | static void CollectLeaksCb(uptr chunk, void *arg) { |
| 754 | CHECK(arg); |
| 755 | LeakedChunks *leaks = reinterpret_cast<LeakedChunks *>(arg); |
| 756 | chunk = GetUserBegin(chunk); |
| 757 | LsanMetadata m(chunk); |
| 758 | if (!m.allocated()) |
| 759 | return; |
| 760 | if (m.tag() == kDirectlyLeaked || m.tag() == kIndirectlyLeaked) |
| 761 | leaks->push_back(element: {.chunk: chunk, .stack_trace_id: m.stack_trace_id(), .leaked_size: m.requested_size(), .tag: m.tag()}); |
| 762 | } |
| 763 | |
| 764 | void LeakSuppressionContext::PrintMatchedSuppressions() { |
| 765 | InternalMmapVector<Suppression *> matched; |
| 766 | context.GetMatched(matched: &matched); |
| 767 | if (!matched.size()) |
| 768 | return; |
| 769 | const char *line = "-----------------------------------------------------" ; |
| 770 | Printf(format: "%s\n" , line); |
| 771 | Printf(format: "Suppressions used:\n" ); |
| 772 | Printf(format: " count bytes template\n" ); |
| 773 | for (uptr i = 0; i < matched.size(); i++) { |
| 774 | Printf(format: "%7zu %10zu %s\n" , |
| 775 | static_cast<uptr>(atomic_load_relaxed(a: &matched[i]->hit_count)), |
| 776 | matched[i]->weight, matched[i]->templ); |
| 777 | } |
| 778 | Printf(format: "%s\n\n" , line); |
| 779 | } |
| 780 | |
| 781 | # if SANITIZER_FUCHSIA |
| 782 | |
| 783 | // Fuchsia provides a libc interface that guarantees all threads are |
| 784 | // covered, and SuspendedThreadList is never really used. |
| 785 | static bool ReportUnsuspendedThreads(const SuspendedThreadsList &) { |
| 786 | return true; |
| 787 | } |
| 788 | |
| 789 | # else // !SANITIZER_FUCHSIA |
| 790 | |
| 791 | static bool ReportUnsuspendedThreads( |
| 792 | const SuspendedThreadsList &suspended_threads) { |
| 793 | InternalMmapVector<tid_t> threads(suspended_threads.ThreadCount()); |
| 794 | for (uptr i = 0; i < suspended_threads.ThreadCount(); ++i) |
| 795 | threads[i] = suspended_threads.GetThreadID(index: i); |
| 796 | |
| 797 | Sort(v: threads.data(), size: threads.size()); |
| 798 | |
| 799 | InternalMmapVector<tid_t> known_threads; |
| 800 | GetRunningThreadsLocked(threads: &known_threads); |
| 801 | |
| 802 | bool succeded = true; |
| 803 | for (auto os_id : known_threads) { |
| 804 | uptr i = InternalLowerBound(v: threads, val: os_id); |
| 805 | if (i >= threads.size() || threads[i] != os_id) { |
| 806 | succeded = false; |
| 807 | Report( |
| 808 | format: "Running thread %zu was not suspended. False leaks are possible.\n" , |
| 809 | os_id); |
| 810 | } |
| 811 | } |
| 812 | return succeded; |
| 813 | } |
| 814 | |
| 815 | # endif // !SANITIZER_FUCHSIA |
| 816 | |
| 817 | static void CheckForLeaksCallback(const SuspendedThreadsList &suspended_threads, |
| 818 | void *arg) { |
| 819 | CheckForLeaksParam *param = reinterpret_cast<CheckForLeaksParam *>(arg); |
| 820 | CHECK(param); |
| 821 | CHECK(!param->success); |
| 822 | if (!ReportUnsuspendedThreads(suspended_threads)) { |
| 823 | switch (flags()->thread_suspend_fail) { |
| 824 | case 0: |
| 825 | param->success = true; |
| 826 | return; |
| 827 | case 1: |
| 828 | break; |
| 829 | case 2: |
| 830 | // Will crash on return. |
| 831 | return; |
| 832 | } |
| 833 | } |
| 834 | ClassifyAllChunks(suspended_threads, frontier: ¶m->frontier, caller_tid: param->caller_tid, |
| 835 | caller_sp: param->caller_sp); |
| 836 | ForEachChunk(callback: CollectLeaksCb, arg: ¶m->leaks); |
| 837 | // Clean up for subsequent leak checks. This assumes we did not overwrite any |
| 838 | // kIgnored tags. |
| 839 | ForEachChunk(callback: ResetTagsCb, arg: nullptr); |
| 840 | param->success = true; |
| 841 | } |
| 842 | |
| 843 | static bool PrintResults(LeakReport &report) { |
| 844 | uptr unsuppressed_count = report.UnsuppressedLeakCount(); |
| 845 | if (unsuppressed_count) { |
| 846 | Decorator d; |
| 847 | Printf( |
| 848 | format: "\n" |
| 849 | "=================================================================" |
| 850 | "\n" ); |
| 851 | Printf(format: "%s" , d.Error()); |
| 852 | Report(format: "ERROR: LeakSanitizer: detected memory leaks\n" ); |
| 853 | Printf(format: "%s" , d.Default()); |
| 854 | report.ReportTopLeaks(max_leaks: flags()->max_leaks); |
| 855 | } |
| 856 | if (common_flags()->print_suppressions) |
| 857 | GetSuppressionContext()->PrintMatchedSuppressions(); |
| 858 | if (unsuppressed_count) |
| 859 | report.PrintSummary(); |
| 860 | if ((unsuppressed_count && common_flags()->verbosity >= 2) || |
| 861 | flags()->log_threads) |
| 862 | PrintThreads(); |
| 863 | return unsuppressed_count; |
| 864 | } |
| 865 | |
| 866 | static bool CheckForLeaksOnce() { |
| 867 | if (&__lsan_is_turned_off && __lsan_is_turned_off()) { |
| 868 | VReport(1, "LeakSanitizer is disabled\n" ); |
| 869 | return false; |
| 870 | } |
| 871 | VReport(1, "LeakSanitizer: checking for leaks\n" ); |
| 872 | // Inside LockStuffAndStopTheWorld we can't run symbolizer, so we can't match |
| 873 | // suppressions. However if a stack id was previously suppressed, it should be |
| 874 | // suppressed in future checks as well. |
| 875 | for (int i = 0;; ++i) { |
| 876 | EnsureMainThreadIDIsCorrect(); |
| 877 | CheckForLeaksParam param; |
| 878 | // Capture calling thread's stack pointer early, to avoid false negatives. |
| 879 | // Old frame with dead pointers might be overlapped by new frame inside |
| 880 | // CheckForLeaks which does not use bytes with pointers before the |
| 881 | // threads are suspended and stack pointers captured. |
| 882 | param.caller_tid = GetTid(); |
| 883 | param.caller_sp = reinterpret_cast<uptr>(__builtin_frame_address(0)); |
| 884 | LockStuffAndStopTheWorld(callback: CheckForLeaksCallback, argument: ¶m); |
| 885 | if (!param.success) { |
| 886 | Report(format: "LeakSanitizer has encountered a fatal error.\n" ); |
| 887 | Report( |
| 888 | format: "HINT: For debugging, try setting environment variable " |
| 889 | "LSAN_OPTIONS=verbosity=1:log_threads=1\n" ); |
| 890 | Report( |
| 891 | format: "HINT: LeakSanitizer does not work under ptrace (strace, gdb, " |
| 892 | "etc)\n" ); |
| 893 | Die(); |
| 894 | } |
| 895 | LeakReport leak_report; |
| 896 | leak_report.AddLeakedChunks(chunks: param.leaks); |
| 897 | |
| 898 | // No new suppressions stacks, so rerun will not help and we can report. |
| 899 | if (!leak_report.ApplySuppressions()) |
| 900 | return PrintResults(report&: leak_report); |
| 901 | |
| 902 | // No indirect leaks to report, so we are done here. |
| 903 | if (!leak_report.IndirectUnsuppressedLeakCount()) |
| 904 | return PrintResults(report&: leak_report); |
| 905 | |
| 906 | if (i >= 8) { |
| 907 | Report(format: "WARNING: LeakSanitizer gave up on indirect leaks suppression.\n" ); |
| 908 | return PrintResults(report&: leak_report); |
| 909 | } |
| 910 | |
| 911 | // We found a new previously unseen suppressed call stack. Rerun to make |
| 912 | // sure it does not hold indirect leaks. |
| 913 | VReport(1, "Rerun with %zu suppressed stacks." , |
| 914 | GetSuppressionContext()->GetSortedSuppressedStacks().size()); |
| 915 | } |
| 916 | } |
| 917 | |
| 918 | static bool CheckForLeaks() { |
| 919 | int leaking_tries = 0; |
| 920 | for (int i = 0; i < flags()->tries; ++i) leaking_tries += CheckForLeaksOnce(); |
| 921 | return leaking_tries == flags()->tries; |
| 922 | } |
| 923 | |
| 924 | static bool has_reported_leaks = false; |
| 925 | bool HasReportedLeaks() { return has_reported_leaks; } |
| 926 | |
| 927 | void DoLeakCheck() { |
| 928 | Lock l(&global_mutex); |
| 929 | static bool already_done; |
| 930 | if (already_done) |
| 931 | return; |
| 932 | already_done = true; |
| 933 | has_reported_leaks = CheckForLeaks(); |
| 934 | if (has_reported_leaks) |
| 935 | HandleLeaks(); |
| 936 | } |
| 937 | |
| 938 | static int DoRecoverableLeakCheck() { |
| 939 | Lock l(&global_mutex); |
| 940 | bool have_leaks = CheckForLeaks(); |
| 941 | return have_leaks ? 1 : 0; |
| 942 | } |
| 943 | |
| 944 | void DoRecoverableLeakCheckVoid() { DoRecoverableLeakCheck(); } |
| 945 | |
| 946 | ///// LeakReport implementation. ///// |
| 947 | |
| 948 | // A hard limit on the number of distinct leaks, to avoid quadratic complexity |
| 949 | // in LeakReport::AddLeakedChunk(). We don't expect to ever see this many leaks |
| 950 | // in real-world applications. |
| 951 | // FIXME: Get rid of this limit by moving logic into DedupLeaks. |
| 952 | const uptr kMaxLeaksConsidered = 5000; |
| 953 | |
| 954 | void LeakReport::AddLeakedChunks(const LeakedChunks &chunks) { |
| 955 | for (const LeakedChunk &leak : chunks) { |
| 956 | uptr chunk = leak.chunk; |
| 957 | u32 stack_trace_id = leak.stack_trace_id; |
| 958 | uptr leaked_size = leak.leaked_size; |
| 959 | ChunkTag tag = leak.tag; |
| 960 | CHECK(tag == kDirectlyLeaked || tag == kIndirectlyLeaked); |
| 961 | |
| 962 | if (u32 resolution = flags()->resolution) { |
| 963 | StackTrace stack = StackDepotGet(id: stack_trace_id); |
| 964 | stack.size = Min(a: stack.size, b: resolution); |
| 965 | stack_trace_id = StackDepotPut(stack); |
| 966 | } |
| 967 | |
| 968 | bool is_directly_leaked = (tag == kDirectlyLeaked); |
| 969 | uptr i; |
| 970 | for (i = 0; i < leaks_.size(); i++) { |
| 971 | if (leaks_[i].stack_trace_id == stack_trace_id && |
| 972 | leaks_[i].is_directly_leaked == is_directly_leaked) { |
| 973 | leaks_[i].hit_count++; |
| 974 | leaks_[i].total_size += leaked_size; |
| 975 | break; |
| 976 | } |
| 977 | } |
| 978 | if (i == leaks_.size()) { |
| 979 | if (leaks_.size() == kMaxLeaksConsidered) |
| 980 | return; |
| 981 | Leak leak = {.id: next_id_++, /* hit_count */ 1, |
| 982 | .total_size: leaked_size, .stack_trace_id: stack_trace_id, |
| 983 | .is_directly_leaked: is_directly_leaked, /* is_suppressed */ false}; |
| 984 | leaks_.push_back(element: leak); |
| 985 | } |
| 986 | if (flags()->report_objects) { |
| 987 | LeakedObject obj = {.leak_id: leaks_[i].id, .addr: GetUserAddr(chunk), .size: leaked_size}; |
| 988 | leaked_objects_.push_back(element: obj); |
| 989 | } |
| 990 | } |
| 991 | } |
| 992 | |
| 993 | static bool LeakComparator(const Leak &leak1, const Leak &leak2) { |
| 994 | if (leak1.is_directly_leaked == leak2.is_directly_leaked) |
| 995 | return leak1.total_size > leak2.total_size; |
| 996 | else |
| 997 | return leak1.is_directly_leaked; |
| 998 | } |
| 999 | |
| 1000 | void LeakReport::ReportTopLeaks(uptr num_leaks_to_report) { |
| 1001 | CHECK(leaks_.size() <= kMaxLeaksConsidered); |
| 1002 | Printf(format: "\n" ); |
| 1003 | if (leaks_.size() == kMaxLeaksConsidered) |
| 1004 | Printf( |
| 1005 | format: "Too many leaks! Only the first %zu leaks encountered will be " |
| 1006 | "reported.\n" , |
| 1007 | kMaxLeaksConsidered); |
| 1008 | |
| 1009 | uptr unsuppressed_count = UnsuppressedLeakCount(); |
| 1010 | if (num_leaks_to_report > 0 && num_leaks_to_report < unsuppressed_count) |
| 1011 | Printf(format: "The %zu top leak(s):\n" , num_leaks_to_report); |
| 1012 | Sort(v: leaks_.data(), size: leaks_.size(), comp: &LeakComparator); |
| 1013 | uptr leaks_reported = 0; |
| 1014 | for (uptr i = 0; i < leaks_.size(); i++) { |
| 1015 | if (leaks_[i].is_suppressed) |
| 1016 | continue; |
| 1017 | PrintReportForLeak(index: i); |
| 1018 | leaks_reported++; |
| 1019 | if (leaks_reported == num_leaks_to_report) |
| 1020 | break; |
| 1021 | } |
| 1022 | if (leaks_reported < unsuppressed_count) { |
| 1023 | uptr remaining = unsuppressed_count - leaks_reported; |
| 1024 | Printf(format: "Omitting %zu more leak(s).\n" , remaining); |
| 1025 | } |
| 1026 | } |
| 1027 | |
| 1028 | void LeakReport::PrintReportForLeak(uptr index) { |
| 1029 | Decorator d; |
| 1030 | Printf(format: "%s" , d.Leak()); |
| 1031 | Printf(format: "%s leak of %zu byte(s) in %zu object(s) allocated from:\n" , |
| 1032 | leaks_[index].is_directly_leaked ? "Direct" : "Indirect" , |
| 1033 | leaks_[index].total_size, leaks_[index].hit_count); |
| 1034 | Printf(format: "%s" , d.Default()); |
| 1035 | |
| 1036 | CHECK(leaks_[index].stack_trace_id); |
| 1037 | StackDepotGet(id: leaks_[index].stack_trace_id).Print(); |
| 1038 | |
| 1039 | if (flags()->report_objects) { |
| 1040 | Printf(format: "Objects leaked above:\n" ); |
| 1041 | PrintLeakedObjectsForLeak(index); |
| 1042 | Printf(format: "\n" ); |
| 1043 | } |
| 1044 | } |
| 1045 | |
| 1046 | void LeakReport::PrintLeakedObjectsForLeak(uptr index) { |
| 1047 | u32 leak_id = leaks_[index].id; |
| 1048 | for (uptr j = 0; j < leaked_objects_.size(); j++) { |
| 1049 | if (leaked_objects_[j].leak_id == leak_id) |
| 1050 | Printf(format: "%p (%zu bytes)\n" , (void *)leaked_objects_[j].addr, |
| 1051 | leaked_objects_[j].size); |
| 1052 | } |
| 1053 | } |
| 1054 | |
| 1055 | void LeakReport::PrintSummary() { |
| 1056 | CHECK(leaks_.size() <= kMaxLeaksConsidered); |
| 1057 | uptr bytes = 0, allocations = 0; |
| 1058 | for (uptr i = 0; i < leaks_.size(); i++) { |
| 1059 | if (leaks_[i].is_suppressed) |
| 1060 | continue; |
| 1061 | bytes += leaks_[i].total_size; |
| 1062 | allocations += leaks_[i].hit_count; |
| 1063 | } |
| 1064 | InternalScopedString summary; |
| 1065 | summary.AppendF(format: "%zu byte(s) leaked in %zu allocation(s)." , bytes, |
| 1066 | allocations); |
| 1067 | ReportErrorSummary(error_message: summary.data()); |
| 1068 | } |
| 1069 | |
| 1070 | uptr LeakReport::ApplySuppressions() { |
| 1071 | LeakSuppressionContext *suppressions = GetSuppressionContext(); |
| 1072 | uptr new_suppressions = 0; |
| 1073 | for (uptr i = 0; i < leaks_.size(); i++) { |
| 1074 | if (suppressions->Suppress(stack_trace_id: leaks_[i].stack_trace_id, hit_count: leaks_[i].hit_count, |
| 1075 | total_size: leaks_[i].total_size)) { |
| 1076 | leaks_[i].is_suppressed = true; |
| 1077 | ++new_suppressions; |
| 1078 | } |
| 1079 | } |
| 1080 | return new_suppressions; |
| 1081 | } |
| 1082 | |
| 1083 | uptr LeakReport::UnsuppressedLeakCount() { |
| 1084 | uptr result = 0; |
| 1085 | for (uptr i = 0; i < leaks_.size(); i++) |
| 1086 | if (!leaks_[i].is_suppressed) |
| 1087 | result++; |
| 1088 | return result; |
| 1089 | } |
| 1090 | |
| 1091 | uptr LeakReport::IndirectUnsuppressedLeakCount() { |
| 1092 | uptr result = 0; |
| 1093 | for (uptr i = 0; i < leaks_.size(); i++) |
| 1094 | if (!leaks_[i].is_suppressed && !leaks_[i].is_directly_leaked) |
| 1095 | result++; |
| 1096 | return result; |
| 1097 | } |
| 1098 | |
| 1099 | } // namespace __lsan |
| 1100 | #else // CAN_SANITIZE_LEAKS |
| 1101 | namespace __lsan { |
| 1102 | void InitCommonLsan() {} |
| 1103 | void DoLeakCheck() {} |
| 1104 | void DoRecoverableLeakCheckVoid() {} |
| 1105 | void DisableInThisThread() {} |
| 1106 | void EnableInThisThread() {} |
| 1107 | } // namespace __lsan |
| 1108 | #endif // CAN_SANITIZE_LEAKS |
| 1109 | |
| 1110 | using namespace __lsan; |
| 1111 | |
| 1112 | extern "C" { |
| 1113 | SANITIZER_INTERFACE_ATTRIBUTE |
| 1114 | void __lsan_ignore_object(const void *p) { |
| 1115 | #if CAN_SANITIZE_LEAKS |
| 1116 | if (!common_flags()->detect_leaks) |
| 1117 | return; |
| 1118 | // Cannot use PointsIntoChunk or LsanMetadata here, since the allocator is not |
| 1119 | // locked. |
| 1120 | Lock l(&global_mutex); |
| 1121 | IgnoreObjectResult res = IgnoreObject(p); |
| 1122 | if (res == kIgnoreObjectInvalid) |
| 1123 | VReport(1, "__lsan_ignore_object(): no heap object found at %p\n" , p); |
| 1124 | if (res == kIgnoreObjectAlreadyIgnored) |
| 1125 | VReport(1, |
| 1126 | "__lsan_ignore_object(): " |
| 1127 | "heap object at %p is already being ignored\n" , |
| 1128 | p); |
| 1129 | if (res == kIgnoreObjectSuccess) |
| 1130 | VReport(1, "__lsan_ignore_object(): ignoring heap object at %p\n" , p); |
| 1131 | #endif // CAN_SANITIZE_LEAKS |
| 1132 | } |
| 1133 | |
| 1134 | SANITIZER_INTERFACE_ATTRIBUTE |
| 1135 | void __lsan_register_root_region(const void *begin, uptr size) { |
| 1136 | #if CAN_SANITIZE_LEAKS |
| 1137 | VReport(1, "Registered root region at %p of size %zu\n" , begin, size); |
| 1138 | uptr b = reinterpret_cast<uptr>(begin); |
| 1139 | uptr e = b + size; |
| 1140 | CHECK_LT(b, e); |
| 1141 | |
| 1142 | Lock l(&global_mutex); |
| 1143 | ++GetRootRegionsLocked()[{b, e}]; |
| 1144 | #endif // CAN_SANITIZE_LEAKS |
| 1145 | } |
| 1146 | |
| 1147 | SANITIZER_INTERFACE_ATTRIBUTE |
| 1148 | void __lsan_unregister_root_region(const void *begin, uptr size) { |
| 1149 | #if CAN_SANITIZE_LEAKS |
| 1150 | uptr b = reinterpret_cast<uptr>(begin); |
| 1151 | uptr e = b + size; |
| 1152 | CHECK_LT(b, e); |
| 1153 | VReport(1, "Unregistered root region at %p of size %zu\n" , begin, size); |
| 1154 | |
| 1155 | { |
| 1156 | Lock l(&global_mutex); |
| 1157 | if (auto *f = GetRootRegionsLocked().find(Key: {b, e})) { |
| 1158 | if (--(f->second) == 0) |
| 1159 | GetRootRegionsLocked().erase(I: f); |
| 1160 | return; |
| 1161 | } |
| 1162 | } |
| 1163 | Report( |
| 1164 | format: "__lsan_unregister_root_region(): region at %p of size %zu has not " |
| 1165 | "been registered.\n" , |
| 1166 | begin, size); |
| 1167 | Die(); |
| 1168 | #endif // CAN_SANITIZE_LEAKS |
| 1169 | } |
| 1170 | |
| 1171 | SANITIZER_INTERFACE_ATTRIBUTE |
| 1172 | void __lsan_disable() { |
| 1173 | #if CAN_SANITIZE_LEAKS |
| 1174 | __lsan::DisableInThisThread(); |
| 1175 | #endif |
| 1176 | } |
| 1177 | |
| 1178 | SANITIZER_INTERFACE_ATTRIBUTE |
| 1179 | void __lsan_enable() { |
| 1180 | #if CAN_SANITIZE_LEAKS |
| 1181 | __lsan::EnableInThisThread(); |
| 1182 | #endif |
| 1183 | } |
| 1184 | |
| 1185 | SANITIZER_INTERFACE_ATTRIBUTE |
| 1186 | void __lsan_do_leak_check() { |
| 1187 | #if CAN_SANITIZE_LEAKS |
| 1188 | if (common_flags()->detect_leaks) |
| 1189 | __lsan::DoLeakCheck(); |
| 1190 | #endif // CAN_SANITIZE_LEAKS |
| 1191 | } |
| 1192 | |
| 1193 | SANITIZER_INTERFACE_ATTRIBUTE |
| 1194 | int __lsan_do_recoverable_leak_check() { |
| 1195 | #if CAN_SANITIZE_LEAKS |
| 1196 | if (common_flags()->detect_leaks) |
| 1197 | return __lsan::DoRecoverableLeakCheck(); |
| 1198 | #endif // CAN_SANITIZE_LEAKS |
| 1199 | return 0; |
| 1200 | } |
| 1201 | |
| 1202 | SANITIZER_INTERFACE_WEAK_DEF(const char *, __lsan_default_options, void) { |
| 1203 | return "" ; |
| 1204 | } |
| 1205 | |
| 1206 | #if !SANITIZER_SUPPORTS_WEAK_HOOKS |
| 1207 | SANITIZER_INTERFACE_WEAK_DEF(int, __lsan_is_turned_off, void) { |
| 1208 | return 0; |
| 1209 | } |
| 1210 | |
| 1211 | SANITIZER_INTERFACE_WEAK_DEF(const char *, __lsan_default_suppressions, void) { |
| 1212 | return "" ; |
| 1213 | } |
| 1214 | #endif |
| 1215 | } // extern "C" |
| 1216 | |