1 | //===-- asan_fuchsia.cpp -------------------------------------------------===// |
2 | // |
3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
4 | // See https://llvm.org/LICENSE.txt for license information. |
5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
6 | // |
7 | //===---------------------------------------------------------------------===// |
8 | // |
9 | // This file is a part of AddressSanitizer, an address sanity checker. |
10 | // |
11 | // Fuchsia-specific details. |
12 | //===---------------------------------------------------------------------===// |
13 | |
14 | #include "sanitizer_common/sanitizer_fuchsia.h" |
15 | #if SANITIZER_FUCHSIA |
16 | |
17 | #include <limits.h> |
18 | #include <zircon/sanitizer.h> |
19 | #include <zircon/syscalls.h> |
20 | #include <zircon/threads.h> |
21 | |
22 | # include "asan_interceptors.h" |
23 | # include "asan_internal.h" |
24 | # include "asan_stack.h" |
25 | # include "asan_thread.h" |
26 | # include "lsan/lsan_common.h" |
27 | |
28 | namespace __sanitizer { |
29 | // ASan doesn't need to do anything else special in the startup hook. |
30 | void EarlySanitizerInit() {} |
31 | } // namespace __sanitizer |
32 | |
33 | namespace __asan { |
34 | |
35 | // The system already set up the shadow memory for us. |
36 | // __sanitizer::GetMaxUserVirtualAddress has already been called by |
37 | // AsanInitInternal->InitializeHighMemEnd (asan_rtl.cpp). |
38 | // Just do some additional sanity checks here. |
39 | void InitializeShadowMemory() { |
40 | if (Verbosity()) |
41 | PrintAddressSpaceLayout(); |
42 | |
43 | // Make sure SHADOW_OFFSET doesn't use __asan_shadow_memory_dynamic_address. |
44 | __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel; |
45 | DCHECK(kLowShadowBeg != kDefaultShadowSentinel); |
46 | __asan_shadow_memory_dynamic_address = kLowShadowBeg; |
47 | |
48 | CHECK_EQ(kShadowGapEnd, kHighShadowBeg - 1); |
49 | CHECK_EQ(kHighMemEnd, __sanitizer::ShadowBounds.memory_limit - 1); |
50 | CHECK_EQ(kHighMemBeg, __sanitizer::ShadowBounds.shadow_limit); |
51 | CHECK_EQ(kHighShadowBeg, __sanitizer::ShadowBounds.shadow_base); |
52 | CHECK_EQ(kShadowGapEnd, __sanitizer::ShadowBounds.shadow_base - 1); |
53 | CHECK_EQ(kLowShadowEnd, 0); |
54 | CHECK_EQ(kLowShadowBeg, 0); |
55 | } |
56 | |
57 | void AsanApplyToGlobals(globals_op_fptr op, const void *needle) { |
58 | UNIMPLEMENTED(); |
59 | } |
60 | |
61 | void AsanCheckDynamicRTPrereqs() {} |
62 | void AsanCheckIncompatibleRT() {} |
63 | void InitializeAsanInterceptors() {} |
64 | |
65 | void InitializePlatformExceptionHandlers() {} |
66 | void AsanOnDeadlySignal(int signo, void *siginfo, void *context) { |
67 | UNIMPLEMENTED(); |
68 | } |
69 | |
70 | bool PlatformUnpoisonStacks() { |
71 | // The current sp might not point to the default stack. This |
72 | // could be because we are in a crash stack from fuzzing for example. |
73 | // Unpoison the default stack and the current stack page. |
74 | AsanThread *curr_thread = GetCurrentThread(); |
75 | CHECK(curr_thread != nullptr); |
76 | uptr top = curr_thread->stack_top(); |
77 | uptr bottom = curr_thread->stack_bottom(); |
78 | // The default stack grows from top to bottom. (bottom < top). |
79 | |
80 | uptr local_stack = reinterpret_cast<uptr>(__builtin_frame_address(0)); |
81 | if (local_stack >= bottom && local_stack <= top) { |
82 | // The current stack is the default stack. |
83 | // We only need to unpoison from where we are using until the end. |
84 | bottom = RoundDownTo(local_stack, GetPageSize()); |
85 | UnpoisonStack(bottom, top, "default" ); |
86 | } else { |
87 | // The current stack is not the default stack. |
88 | // Unpoison the entire default stack and the current stack page. |
89 | UnpoisonStack(bottom, top, "default" ); |
90 | bottom = RoundDownTo(local_stack, GetPageSize()); |
91 | top = bottom + GetPageSize(); |
92 | UnpoisonStack(bottom, top, "unknown" ); |
93 | return true; |
94 | } |
95 | |
96 | return false; |
97 | } |
98 | |
99 | // We can use a plain thread_local variable for TSD. |
100 | static thread_local void *per_thread; |
101 | |
102 | void *AsanTSDGet() { return per_thread; } |
103 | |
104 | void AsanTSDSet(void *tsd) { per_thread = tsd; } |
105 | |
106 | // There's no initialization needed, and the passed-in destructor |
107 | // will never be called. Instead, our own thread destruction hook |
108 | // (below) will call AsanThread::TSDDtor directly. |
109 | void AsanTSDInit(void (*destructor)(void *tsd)) { |
110 | DCHECK(destructor == &PlatformTSDDtor); |
111 | } |
112 | |
113 | void PlatformTSDDtor(void *tsd) { UNREACHABLE(__func__); } |
114 | |
115 | static inline size_t AsanThreadMmapSize() { |
116 | return RoundUpTo(sizeof(AsanThread), _zx_system_get_page_size()); |
117 | } |
118 | |
119 | struct AsanThread::InitOptions { |
120 | uptr stack_bottom, stack_size; |
121 | }; |
122 | |
123 | // Shared setup between thread creation and startup for the initial thread. |
124 | static AsanThread *CreateAsanThread(StackTrace *stack, u32 parent_tid, |
125 | bool detached, const char *name) { |
126 | // In lieu of AsanThread::Create. |
127 | AsanThread *thread = (AsanThread *)MmapOrDie(AsanThreadMmapSize(), __func__); |
128 | |
129 | u32 tid = asanThreadRegistry().CreateThread(0, detached, parent_tid, thread); |
130 | asanThreadRegistry().SetThreadName(tid, name); |
131 | |
132 | return thread; |
133 | } |
134 | |
135 | // This gets the same arguments passed to Init by CreateAsanThread, above. |
136 | // We're in the creator thread before the new thread is actually started, |
137 | // but its stack address range is already known. We don't bother tracking |
138 | // the static TLS address range because the system itself already uses an |
139 | // ASan-aware allocator for that. |
140 | void AsanThread::SetThreadStackAndTls(const AsanThread::InitOptions *options) { |
141 | DCHECK_NE(GetCurrentThread(), this); |
142 | DCHECK_NE(GetCurrentThread(), nullptr); |
143 | CHECK_NE(options->stack_bottom, 0); |
144 | CHECK_NE(options->stack_size, 0); |
145 | stack_bottom_ = options->stack_bottom; |
146 | stack_top_ = options->stack_bottom + options->stack_size; |
147 | } |
148 | |
149 | // Called by __asan::AsanInitInternal (asan_rtl.c). |
150 | AsanThread *CreateMainThread() { |
151 | thrd_t self = thrd_current(); |
152 | char name[ZX_MAX_NAME_LEN]; |
153 | CHECK_NE(__sanitizer::MainThreadStackBase, 0); |
154 | CHECK_GT(__sanitizer::MainThreadStackSize, 0); |
155 | AsanThread *t = CreateAsanThread( |
156 | nullptr, 0, true, |
157 | _zx_object_get_property(thrd_get_zx_handle(self), ZX_PROP_NAME, name, |
158 | sizeof(name)) == ZX_OK |
159 | ? name |
160 | : nullptr); |
161 | // We need to set the current thread before calling AsanThread::Init() below, |
162 | // since it reads the thread ID. |
163 | SetCurrentThread(t); |
164 | DCHECK_EQ(t->tid(), 0); |
165 | |
166 | const AsanThread::InitOptions options = {__sanitizer::MainThreadStackBase, |
167 | __sanitizer::MainThreadStackSize}; |
168 | t->Init(&options); |
169 | |
170 | return t; |
171 | } |
172 | |
173 | // This is called before each thread creation is attempted. So, in |
174 | // its first call, the calling thread is the initial and sole thread. |
175 | static void *BeforeThreadCreateHook(uptr user_id, bool detached, |
176 | const char *name, uptr stack_bottom, |
177 | uptr stack_size) { |
178 | EnsureMainThreadIDIsCorrect(); |
179 | // Strict init-order checking is thread-hostile. |
180 | if (flags()->strict_init_order) |
181 | StopInitOrderChecking(); |
182 | |
183 | GET_STACK_TRACE_THREAD; |
184 | u32 parent_tid = GetCurrentTidOrInvalid(); |
185 | |
186 | AsanThread *thread = CreateAsanThread(&stack, parent_tid, detached, name); |
187 | |
188 | // On other systems, AsanThread::Init() is called from the new |
189 | // thread itself. But on Fuchsia we already know the stack address |
190 | // range beforehand, so we can do most of the setup right now. |
191 | const AsanThread::InitOptions options = {stack_bottom, stack_size}; |
192 | thread->Init(&options); |
193 | return thread; |
194 | } |
195 | |
196 | // This is called after creating a new thread (in the creating thread), |
197 | // with the pointer returned by BeforeThreadCreateHook (above). |
198 | static void ThreadCreateHook(void *hook, bool aborted) { |
199 | AsanThread *thread = static_cast<AsanThread *>(hook); |
200 | if (!aborted) { |
201 | // The thread was created successfully. |
202 | // ThreadStartHook is already running in the new thread. |
203 | } else { |
204 | // The thread wasn't created after all. |
205 | // Clean up everything we set up in BeforeThreadCreateHook. |
206 | asanThreadRegistry().FinishThread(thread->tid()); |
207 | UnmapOrDie(thread, AsanThreadMmapSize()); |
208 | } |
209 | } |
210 | |
211 | // This is called in the newly-created thread before it runs anything else, |
212 | // with the pointer returned by BeforeThreadCreateHook (above). |
213 | // cf. asan_interceptors.cpp:asan_thread_start |
214 | static void ThreadStartHook(void *hook, uptr os_id) { |
215 | AsanThread *thread = static_cast<AsanThread *>(hook); |
216 | SetCurrentThread(thread); |
217 | |
218 | // In lieu of AsanThread::ThreadStart. |
219 | asanThreadRegistry().StartThread(thread->tid(), os_id, ThreadType::Regular, |
220 | nullptr); |
221 | } |
222 | |
223 | // Each thread runs this just before it exits, |
224 | // with the pointer returned by BeforeThreadCreateHook (above). |
225 | // All per-thread destructors have already been called. |
226 | static void ThreadExitHook(void *hook, uptr os_id) { |
227 | AsanThread::TSDDtor(per_thread); |
228 | } |
229 | |
230 | bool HandleDlopenInit() { |
231 | // Not supported on this platform. |
232 | static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN, |
233 | "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false" ); |
234 | return false; |
235 | } |
236 | |
237 | void FlushUnneededASanShadowMemory(uptr p, uptr size) { |
238 | __sanitizer_fill_shadow(p, size, 0, 0); |
239 | } |
240 | |
241 | // On Fuchsia, leak detection is done by a special hook after atexit hooks. |
242 | // So this doesn't install any atexit hook like on other platforms. |
243 | void InstallAtExitCheckLeaks() {} |
244 | |
245 | void InstallAtForkHandler() {} |
246 | |
247 | } // namespace __asan |
248 | |
249 | namespace __lsan { |
250 | |
251 | bool UseExitcodeOnLeak() { return __asan::flags()->halt_on_error; } |
252 | |
253 | } // namespace __lsan |
254 | |
255 | // These are declared (in extern "C") by <zircon/sanitizer.h>. |
256 | // The system runtime will call our definitions directly. |
257 | |
258 | void *__sanitizer_before_thread_create_hook(thrd_t thread, bool detached, |
259 | const char *name, void *stack_base, |
260 | size_t stack_size) { |
261 | return __asan::BeforeThreadCreateHook( |
262 | reinterpret_cast<uptr>(thread), detached, name, |
263 | reinterpret_cast<uptr>(stack_base), stack_size); |
264 | } |
265 | |
266 | void __sanitizer_thread_create_hook(void *hook, thrd_t thread, int error) { |
267 | __asan::ThreadCreateHook(hook, error != thrd_success); |
268 | } |
269 | |
270 | void __sanitizer_thread_start_hook(void *hook, thrd_t self) { |
271 | __asan::ThreadStartHook(hook, reinterpret_cast<uptr>(self)); |
272 | } |
273 | |
274 | void __sanitizer_thread_exit_hook(void *hook, thrd_t self) { |
275 | __asan::ThreadExitHook(hook, reinterpret_cast<uptr>(self)); |
276 | } |
277 | |
278 | #endif // SANITIZER_FUCHSIA |
279 | |