1//===-- sanitizer_posix_libcdep.cpp ---------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is shared between AddressSanitizer and ThreadSanitizer
10// run-time libraries and implements libc-dependent POSIX-specific functions
11// from sanitizer_libc.h.
12//===----------------------------------------------------------------------===//
13
14#include "sanitizer_platform.h"
15
16#if SANITIZER_POSIX
17
18#include "sanitizer_common.h"
19#include "sanitizer_flags.h"
20#include "sanitizer_platform_limits_netbsd.h"
21#include "sanitizer_platform_limits_posix.h"
22#include "sanitizer_platform_limits_solaris.h"
23#include "sanitizer_posix.h"
24#include "sanitizer_procmaps.h"
25
26#include <errno.h>
27#include <fcntl.h>
28#include <pthread.h>
29#include <signal.h>
30#include <stdlib.h>
31#include <sys/mman.h>
32#include <sys/resource.h>
33#include <sys/stat.h>
34#include <sys/time.h>
35#include <sys/types.h>
36#include <sys/wait.h>
37#include <unistd.h>
38
39#if SANITIZER_FREEBSD
40// The MAP_NORESERVE define has been removed in FreeBSD 11.x, and even before
41// that, it was never implemented. So just define it to zero.
42#undef MAP_NORESERVE
43#define MAP_NORESERVE 0
44#endif
45
46typedef void (*sa_sigaction_t)(int, siginfo_t *, void *);
47
48namespace __sanitizer {
49
50u32 GetUid() {
51 return getuid();
52}
53
54uptr GetThreadSelf() {
55 return (uptr)pthread_self();
56}
57
58void ReleaseMemoryPagesToOS(uptr beg, uptr end) {
59 uptr page_size = GetPageSizeCached();
60 uptr beg_aligned = RoundUpTo(size: beg, boundary: page_size);
61 uptr end_aligned = RoundDownTo(x: end, boundary: page_size);
62 if (beg_aligned < end_aligned)
63 internal_madvise(addr: beg_aligned, length: end_aligned - beg_aligned,
64 SANITIZER_MADVISE_DONTNEED);
65}
66
67void SetShadowRegionHugePageMode(uptr addr, uptr size) {
68#ifdef MADV_NOHUGEPAGE // May not be defined on old systems.
69 if (common_flags()->no_huge_pages_for_shadow)
70 internal_madvise(addr, length: size, MADV_NOHUGEPAGE);
71 else
72 internal_madvise(addr, length: size, MADV_HUGEPAGE);
73#endif // MADV_NOHUGEPAGE
74}
75
76bool DontDumpShadowMemory(uptr addr, uptr length) {
77#if defined(MADV_DONTDUMP)
78 return internal_madvise(addr, length, MADV_DONTDUMP) == 0;
79#elif defined(MADV_NOCORE)
80 return internal_madvise(addr, length, MADV_NOCORE) == 0;
81#else
82 return true;
83#endif // MADV_DONTDUMP
84}
85
86static rlim_t getlim(int res) {
87 rlimit rlim;
88 CHECK_EQ(0, getrlimit(res, &rlim));
89 return rlim.rlim_cur;
90}
91
92static void setlim(int res, rlim_t lim) {
93 struct rlimit rlim;
94 if (getrlimit(resource: res, rlimits: &rlim)) {
95 Report(format: "ERROR: %s getrlimit() failed %d\n", SanitizerToolName, errno);
96 Die();
97 }
98 rlim.rlim_cur = lim;
99 if (setrlimit(resource: res, rlimits: &rlim)) {
100 Report(format: "ERROR: %s setrlimit() failed %d\n", SanitizerToolName, errno);
101 Die();
102 }
103}
104
105void DisableCoreDumperIfNecessary() {
106 if (common_flags()->disable_coredump) {
107 rlimit rlim;
108 CHECK_EQ(0, getrlimit(RLIMIT_CORE, &rlim));
109 // On Linux, if the kernel.core_pattern sysctl starts with a '|' (i.e. it
110 // is being piped to a coredump handler such as systemd-coredumpd), the
111 // kernel ignores RLIMIT_CORE (since we aren't creating a file in the file
112 // system) except for the magic value of 1, which disables coredumps when
113 // piping. 1 byte is too small for any kind of valid core dump, so it
114 // also disables coredumps if kernel.core_pattern creates files directly.
115 // While most piped coredump handlers do respect the crashing processes'
116 // RLIMIT_CORE, this is notable not the case for Debian's systemd-coredump
117 // due to a local patch that changes sysctl.d/50-coredump.conf to ignore
118 // the specified limit and instead use RLIM_INFINITY.
119 //
120 // The alternative to using RLIMIT_CORE=1 would be to use prctl() with the
121 // PR_SET_DUMPABLE flag, however that also prevents ptrace(), so makes it
122 // impossible to attach a debugger.
123 //
124 // Note: we use rlim_max in the Min() call here since that is the upper
125 // limit for what can be set without getting an EINVAL error.
126 rlim.rlim_cur = Min<rlim_t>(SANITIZER_LINUX ? 1 : 0, b: rlim.rlim_max);
127 CHECK_EQ(0, setrlimit(RLIMIT_CORE, &rlim));
128 }
129}
130
131bool StackSizeIsUnlimited() {
132 rlim_t stack_size = getlim(RLIMIT_STACK);
133 return (stack_size == RLIM_INFINITY);
134}
135
136void SetStackSizeLimitInBytes(uptr limit) {
137 setlim(RLIMIT_STACK, lim: (rlim_t)limit);
138 CHECK(!StackSizeIsUnlimited());
139}
140
141bool AddressSpaceIsUnlimited() {
142 rlim_t as_size = getlim(RLIMIT_AS);
143 return (as_size == RLIM_INFINITY);
144}
145
146void SetAddressSpaceUnlimited() {
147 setlim(RLIMIT_AS, RLIM_INFINITY);
148 CHECK(AddressSpaceIsUnlimited());
149}
150
151void Abort() {
152#if !SANITIZER_GO
153 // If we are handling SIGABRT, unhandle it first.
154 // TODO(vitalybuka): Check if handler belongs to sanitizer.
155 if (GetHandleSignalMode(SIGABRT) != kHandleSignalNo) {
156 struct sigaction sigact;
157 internal_memset(s: &sigact, c: 0, n: sizeof(sigact));
158 sigact.sa_handler = SIG_DFL;
159 internal_sigaction(SIGABRT, act: &sigact, oldact: nullptr);
160 }
161#endif
162
163 abort();
164}
165
166int Atexit(void (*function)(void)) {
167#if !SANITIZER_GO
168 return atexit(func: function);
169#else
170 return 0;
171#endif
172}
173
174bool CreateDir(const char *pathname) { return mkdir(path: pathname, mode: 0755) == 0; }
175
176bool SupportsColoredOutput(fd_t fd) {
177 return isatty(fd: fd) != 0;
178}
179
180#if !SANITIZER_GO
181// TODO(glider): different tools may require different altstack size.
182static uptr GetAltStackSize() {
183 // Note: since GLIBC_2.31, SIGSTKSZ may be a function call, so this may be
184 // more costly that you think. However GetAltStackSize is only call 2-3 times
185 // per thread so don't cache the evaluation.
186 return SIGSTKSZ * 4;
187}
188
189void SetAlternateSignalStack() {
190 stack_t altstack, oldstack;
191 CHECK_EQ(0, sigaltstack(nullptr, &oldstack));
192 // If the alternate stack is already in place, do nothing.
193 // Android always sets an alternate stack, but it's too small for us.
194 if (!SANITIZER_ANDROID && !(oldstack.ss_flags & SS_DISABLE)) return;
195 // TODO(glider): the mapped stack should have the MAP_STACK flag in the
196 // future. It is not required by man 2 sigaltstack now (they're using
197 // malloc()).
198 altstack.ss_size = GetAltStackSize();
199 altstack.ss_sp = (char *)MmapOrDie(size: altstack.ss_size, mem_type: __func__);
200 altstack.ss_flags = 0;
201 CHECK_EQ(0, sigaltstack(&altstack, nullptr));
202}
203
204void UnsetAlternateSignalStack() {
205 stack_t altstack, oldstack;
206 altstack.ss_sp = nullptr;
207 altstack.ss_flags = SS_DISABLE;
208 altstack.ss_size = GetAltStackSize(); // Some sane value required on Darwin.
209 CHECK_EQ(0, sigaltstack(&altstack, &oldstack));
210 UnmapOrDie(addr: oldstack.ss_sp, size: oldstack.ss_size);
211}
212
213static void MaybeInstallSigaction(int signum,
214 SignalHandlerType handler) {
215 if (GetHandleSignalMode(signum) == kHandleSignalNo) return;
216
217 struct sigaction sigact;
218 internal_memset(s: &sigact, c: 0, n: sizeof(sigact));
219 sigact.sa_sigaction = (sa_sigaction_t)handler;
220 // Do not block the signal from being received in that signal's handler.
221 // Clients are responsible for handling this correctly.
222 sigact.sa_flags = SA_SIGINFO | SA_NODEFER;
223 if (common_flags()->use_sigaltstack) sigact.sa_flags |= SA_ONSTACK;
224 CHECK_EQ(0, internal_sigaction(signum, &sigact, nullptr));
225 VReport(1, "Installed the sigaction for signal %d\n", signum);
226}
227
228void InstallDeadlySignalHandlers(SignalHandlerType handler) {
229 // Set the alternate signal stack for the main thread.
230 // This will cause SetAlternateSignalStack to be called twice, but the stack
231 // will be actually set only once.
232 if (common_flags()->use_sigaltstack) SetAlternateSignalStack();
233 MaybeInstallSigaction(SIGSEGV, handler);
234 MaybeInstallSigaction(SIGBUS, handler);
235 MaybeInstallSigaction(SIGABRT, handler);
236 MaybeInstallSigaction(SIGFPE, handler);
237 MaybeInstallSigaction(SIGILL, handler);
238 MaybeInstallSigaction(SIGTRAP, handler);
239}
240
241bool SignalContext::IsStackOverflow() const {
242 // Access at a reasonable offset above SP, or slightly below it (to account
243 // for x86_64 or PowerPC redzone, ARM push of multiple registers, etc) is
244 // probably a stack overflow.
245#ifdef __s390__
246 // On s390, the fault address in siginfo points to start of the page, not
247 // to the precise word that was accessed. Mask off the low bits of sp to
248 // take it into account.
249 bool IsStackAccess = addr >= (sp & ~0xFFF) && addr < sp + 0xFFFF;
250#else
251 // Let's accept up to a page size away from top of stack. Things like stack
252 // probing can trigger accesses with such large offsets.
253 bool IsStackAccess = addr + GetPageSizeCached() > sp && addr < sp + 0xFFFF;
254#endif
255
256#if __powerpc__
257 // Large stack frames can be allocated with e.g.
258 // lis r0,-10000
259 // stdux r1,r1,r0 # store sp to [sp-10000] and update sp by -10000
260 // If the store faults then sp will not have been updated, so test above
261 // will not work, because the fault address will be more than just "slightly"
262 // below sp.
263 if (!IsStackAccess && IsAccessibleMemoryRange(pc, 4)) {
264 u32 inst = *(unsigned *)pc;
265 u32 ra = (inst >> 16) & 0x1F;
266 u32 opcd = inst >> 26;
267 u32 xo = (inst >> 1) & 0x3FF;
268 // Check for store-with-update to sp. The instructions we accept are:
269 // stbu rs,d(ra) stbux rs,ra,rb
270 // sthu rs,d(ra) sthux rs,ra,rb
271 // stwu rs,d(ra) stwux rs,ra,rb
272 // stdu rs,ds(ra) stdux rs,ra,rb
273 // where ra is r1 (the stack pointer).
274 if (ra == 1 &&
275 (opcd == 39 || opcd == 45 || opcd == 37 || opcd == 62 ||
276 (opcd == 31 && (xo == 247 || xo == 439 || xo == 183 || xo == 181))))
277 IsStackAccess = true;
278 }
279#endif // __powerpc__
280
281 // We also check si_code to filter out SEGV caused by something else other
282 // then hitting the guard page or unmapped memory, like, for example,
283 // unaligned memory access.
284 auto si = static_cast<const siginfo_t *>(siginfo);
285 return IsStackAccess &&
286 (si->si_code == si_SEGV_MAPERR || si->si_code == si_SEGV_ACCERR);
287}
288
289#endif // SANITIZER_GO
290
291static void SetNonBlock(int fd) {
292 int res = fcntl(fd: fd, F_GETFL, 0);
293 CHECK(!internal_iserror(res, nullptr));
294
295 res |= O_NONBLOCK;
296 res = fcntl(fd: fd, F_SETFL, res);
297 CHECK(!internal_iserror(res, nullptr));
298}
299
300bool IsAccessibleMemoryRange(uptr beg, uptr size) {
301 while (size) {
302 // `read` from `fds[0]` into a dummy buffer to free up the pipe buffer for
303 // more `write` is slower than just recreating a pipe.
304 int fds[2];
305 CHECK_EQ(0, pipe(fds));
306
307 auto cleanup = at_scope_exit(fn: [&]() {
308 internal_close(fd: fds[0]);
309 internal_close(fd: fds[1]);
310 });
311
312 SetNonBlock(fds[1]);
313
314 int write_errno;
315 uptr w = internal_write(fd: fds[1], buf: reinterpret_cast<char *>(beg), count: size);
316 if (internal_iserror(retval: w, rverrno: &write_errno)) {
317 if (write_errno == EINTR)
318 continue;
319 CHECK_EQ(EFAULT, write_errno);
320 return false;
321 }
322 size -= w;
323 beg += w;
324 }
325
326 return true;
327}
328
329bool TryMemCpy(void *dest, const void *src, uptr n) {
330 if (!n)
331 return true;
332 int fds[2];
333 CHECK_EQ(0, pipe(fds));
334
335 auto cleanup = at_scope_exit(fn: [&]() {
336 internal_close(fd: fds[0]);
337 internal_close(fd: fds[1]);
338 });
339
340 SetNonBlock(fds[0]);
341 SetNonBlock(fds[1]);
342
343 char *d = static_cast<char *>(dest);
344 const char *s = static_cast<const char *>(src);
345
346 while (n) {
347 int e;
348 uptr w = internal_write(fd: fds[1], buf: s, count: n);
349 if (internal_iserror(retval: w, rverrno: &e)) {
350 if (e == EINTR)
351 continue;
352 CHECK_EQ(EFAULT, e);
353 return false;
354 }
355 s += w;
356 n -= w;
357
358 while (w) {
359 uptr r = internal_read(fd: fds[0], buf: d, count: w);
360 if (internal_iserror(retval: r, rverrno: &e)) {
361 CHECK_EQ(EINTR, e);
362 continue;
363 }
364
365 d += r;
366 w -= r;
367 }
368 }
369
370 return true;
371}
372
373void PlatformPrepareForSandboxing(void *args) {
374 // Some kinds of sandboxes may forbid filesystem access, so we won't be able
375 // to read the file mappings from /proc/self/maps. Luckily, neither the
376 // process will be able to load additional libraries, so it's fine to use the
377 // cached mappings.
378 MemoryMappingLayout::CacheMemoryMappings();
379}
380
381static bool MmapFixed(uptr fixed_addr, uptr size, int additional_flags,
382 const char *name) {
383 size = RoundUpTo(size, boundary: GetPageSizeCached());
384 fixed_addr = RoundDownTo(x: fixed_addr, boundary: GetPageSizeCached());
385 uptr p =
386 MmapNamed(addr: (void *)fixed_addr, length: size, PROT_READ | PROT_WRITE,
387 MAP_PRIVATE | MAP_FIXED | additional_flags | MAP_ANON, name);
388 int reserrno;
389 if (internal_iserror(retval: p, rverrno: &reserrno)) {
390 Report(
391 format: "ERROR: %s failed to "
392 "allocate 0x%zx (%zd) bytes at address %p (errno: %d)\n",
393 SanitizerToolName, size, size, (void *)fixed_addr, reserrno);
394 return false;
395 }
396 IncreaseTotalMmap(size);
397 return true;
398}
399
400bool MmapFixedNoReserve(uptr fixed_addr, uptr size, const char *name) {
401 return MmapFixed(fixed_addr, size, MAP_NORESERVE, name);
402}
403
404bool MmapFixedSuperNoReserve(uptr fixed_addr, uptr size, const char *name) {
405#if SANITIZER_FREEBSD
406 if (common_flags()->no_huge_pages_for_shadow)
407 return MmapFixedNoReserve(fixed_addr, size, name);
408 // MAP_NORESERVE is implicit with FreeBSD
409 return MmapFixed(fixed_addr, size, MAP_ALIGNED_SUPER, name);
410#else
411 bool r = MmapFixedNoReserve(fixed_addr, size, name);
412 if (r)
413 SetShadowRegionHugePageMode(addr: fixed_addr, size);
414 return r;
415#endif
416}
417
418uptr ReservedAddressRange::Init(uptr size, const char *name, uptr fixed_addr) {
419 base_ = fixed_addr ? MmapFixedNoAccess(fixed_addr, size, name)
420 : MmapNoAccess(size);
421 size_ = size;
422 name_ = name;
423 (void)os_handle_; // unsupported
424 return reinterpret_cast<uptr>(base_);
425}
426
427// Uses fixed_addr for now.
428// Will use offset instead once we've implemented this function for real.
429uptr ReservedAddressRange::Map(uptr fixed_addr, uptr size, const char *name) {
430 return reinterpret_cast<uptr>(
431 MmapFixedOrDieOnFatalError(fixed_addr, size, name));
432}
433
434uptr ReservedAddressRange::MapOrDie(uptr fixed_addr, uptr size,
435 const char *name) {
436 return reinterpret_cast<uptr>(MmapFixedOrDie(fixed_addr, size, name));
437}
438
439void ReservedAddressRange::Unmap(uptr addr, uptr size) {
440 CHECK_LE(size, size_);
441 if (addr == reinterpret_cast<uptr>(base_))
442 // If we unmap the whole range, just null out the base.
443 base_ = (size == size_) ? nullptr : reinterpret_cast<void*>(addr + size);
444 else
445 CHECK_EQ(addr + size, reinterpret_cast<uptr>(base_) + size_);
446 size_ -= size;
447 UnmapOrDie(addr: reinterpret_cast<void*>(addr), size);
448}
449
450void *MmapFixedNoAccess(uptr fixed_addr, uptr size, const char *name) {
451 return (void *)MmapNamed(addr: (void *)fixed_addr, length: size, PROT_NONE,
452 MAP_PRIVATE | MAP_FIXED | MAP_NORESERVE | MAP_ANON,
453 name);
454}
455
456void *MmapNoAccess(uptr size) {
457 unsigned flags = MAP_PRIVATE | MAP_ANON | MAP_NORESERVE;
458 return (void *)internal_mmap(addr: nullptr, length: size, PROT_NONE, flags, fd: -1, offset: 0);
459}
460
461// This function is defined elsewhere if we intercepted pthread_attr_getstack.
462extern "C" {
463SANITIZER_WEAK_ATTRIBUTE int
464real_pthread_attr_getstack(void *attr, void **addr, size_t *size);
465} // extern "C"
466
467int internal_pthread_attr_getstack(void *attr, void **addr, uptr *size) {
468#if !SANITIZER_GO && !SANITIZER_APPLE
469 if (&real_pthread_attr_getstack)
470 return real_pthread_attr_getstack(attr: (pthread_attr_t *)attr, addr,
471 size: (size_t *)size);
472#endif
473 return pthread_attr_getstack(attr: (pthread_attr_t *)attr, stackaddr: addr, stacksize: (size_t *)size);
474}
475
476#if !SANITIZER_GO
477void AdjustStackSize(void *attr_) {
478 pthread_attr_t *attr = (pthread_attr_t *)attr_;
479 uptr stackaddr = 0;
480 uptr stacksize = 0;
481 internal_pthread_attr_getstack(attr, addr: (void **)&stackaddr, size: &stacksize);
482 // GLibC will return (0 - stacksize) as the stack address in the case when
483 // stacksize is set, but stackaddr is not.
484 bool stack_set = (stackaddr != 0) && (stackaddr + stacksize != 0);
485 // We place a lot of tool data into TLS, account for that.
486 const uptr minstacksize = GetTlsSize() + 128*1024;
487 if (stacksize < minstacksize) {
488 if (!stack_set) {
489 if (stacksize != 0) {
490 VPrintf(1, "Sanitizer: increasing stacksize %zu->%zu\n", stacksize,
491 minstacksize);
492 pthread_attr_setstacksize(attr: attr, stacksize: minstacksize);
493 }
494 } else {
495 Printf(format: "Sanitizer: pre-allocated stack size is insufficient: "
496 "%zu < %zu\n", stacksize, minstacksize);
497 Printf(format: "Sanitizer: pthread_create is likely to fail.\n");
498 }
499 }
500}
501#endif // !SANITIZER_GO
502
503pid_t StartSubprocess(const char *program, const char *const argv[],
504 const char *const envp[], fd_t stdin_fd, fd_t stdout_fd,
505 fd_t stderr_fd) {
506 auto file_closer = at_scope_exit(fn: [&] {
507 if (stdin_fd != kInvalidFd) {
508 internal_close(fd: stdin_fd);
509 }
510 if (stdout_fd != kInvalidFd) {
511 internal_close(fd: stdout_fd);
512 }
513 if (stderr_fd != kInvalidFd) {
514 internal_close(fd: stderr_fd);
515 }
516 });
517
518 int pid = internal_fork();
519
520 if (pid < 0) {
521 int rverrno;
522 if (internal_iserror(retval: pid, rverrno: &rverrno)) {
523 Report(format: "WARNING: failed to fork (errno %d)\n", rverrno);
524 }
525 return pid;
526 }
527
528 if (pid == 0) {
529 // Child subprocess
530 if (stdin_fd != kInvalidFd) {
531 internal_close(STDIN_FILENO);
532 internal_dup2(oldfd: stdin_fd, STDIN_FILENO);
533 internal_close(fd: stdin_fd);
534 }
535 if (stdout_fd != kInvalidFd) {
536 internal_close(STDOUT_FILENO);
537 internal_dup2(oldfd: stdout_fd, STDOUT_FILENO);
538 internal_close(fd: stdout_fd);
539 }
540 if (stderr_fd != kInvalidFd) {
541 internal_close(STDERR_FILENO);
542 internal_dup2(oldfd: stderr_fd, STDERR_FILENO);
543 internal_close(fd: stderr_fd);
544 }
545
546# if SANITIZER_FREEBSD
547 internal_close_range(3, ~static_cast<fd_t>(0), 0);
548# else
549 for (int fd = sysconf(_SC_OPEN_MAX); fd > 2; fd--) internal_close(fd);
550# endif
551
552 internal_execve(filename: program, argv: const_cast<char **>(&argv[0]),
553 envp: const_cast<char *const *>(envp));
554 internal__exit(exitcode: 1);
555 }
556
557 return pid;
558}
559
560bool IsProcessRunning(pid_t pid) {
561 int process_status;
562 uptr waitpid_status = internal_waitpid(pid, status: &process_status, WNOHANG);
563 int local_errno;
564 if (internal_iserror(retval: waitpid_status, rverrno: &local_errno)) {
565 VReport(1, "Waiting on the process failed (errno %d).\n", local_errno);
566 return false;
567 }
568 return waitpid_status == 0;
569}
570
571int WaitForProcess(pid_t pid) {
572 int process_status;
573 uptr waitpid_status = internal_waitpid(pid, status: &process_status, options: 0);
574 int local_errno;
575 if (internal_iserror(retval: waitpid_status, rverrno: &local_errno)) {
576 VReport(1, "Waiting on the process failed (errno %d).\n", local_errno);
577 return -1;
578 }
579 return process_status;
580}
581
582bool IsStateDetached(int state) {
583 return state == PTHREAD_CREATE_DETACHED;
584}
585
586} // namespace __sanitizer
587
588#endif // SANITIZER_POSIX
589