lsan_common.cpp revision 360784
1//=-- lsan_common.cpp -----------------------------------------------------===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file is a part of LeakSanitizer. 10// Implementation of common leak checking functionality. 11// 12//===----------------------------------------------------------------------===// 13 14#include "lsan_common.h" 15 16#include "sanitizer_common/sanitizer_common.h" 17#include "sanitizer_common/sanitizer_flag_parser.h" 18#include "sanitizer_common/sanitizer_flags.h" 19#include "sanitizer_common/sanitizer_placement_new.h" 20#include "sanitizer_common/sanitizer_procmaps.h" 21#include "sanitizer_common/sanitizer_report_decorator.h" 22#include "sanitizer_common/sanitizer_stackdepot.h" 23#include "sanitizer_common/sanitizer_stacktrace.h" 24#include "sanitizer_common/sanitizer_suppressions.h" 25#include "sanitizer_common/sanitizer_thread_registry.h" 26#include "sanitizer_common/sanitizer_tls_get_addr.h" 27 28#if CAN_SANITIZE_LEAKS 29namespace __lsan { 30 31// This mutex is used to prevent races between DoLeakCheck and IgnoreObject, and 32// also to protect the global list of root regions. 33BlockingMutex global_mutex(LINKER_INITIALIZED); 34 35Flags lsan_flags; 36 37void DisableCounterUnderflow() { 38 if (common_flags()->detect_leaks) { 39 Report("Unmatched call to __lsan_enable().\n"); 40 Die(); 41 } 42} 43 44void Flags::SetDefaults() { 45#define LSAN_FLAG(Type, Name, DefaultValue, Description) Name = DefaultValue; 46#include "lsan_flags.inc" 47#undef LSAN_FLAG 48} 49 50void RegisterLsanFlags(FlagParser *parser, Flags *f) { 51#define LSAN_FLAG(Type, Name, DefaultValue, Description) \ 52 RegisterFlag(parser, #Name, Description, &f->Name); 53#include "lsan_flags.inc" 54#undef LSAN_FLAG 55} 56 57#define LOG_POINTERS(...) \ 58 do { \ 59 if (flags()->log_pointers) Report(__VA_ARGS__); \ 60 } while (0) 61 62#define LOG_THREADS(...) \ 63 do { \ 64 if (flags()->log_threads) Report(__VA_ARGS__); \ 65 } while (0) 66 67ALIGNED(64) static char suppression_placeholder[sizeof(SuppressionContext)]; 68static SuppressionContext *suppression_ctx = nullptr; 69static const char kSuppressionLeak[] = "leak"; 70static const char *kSuppressionTypes[] = { kSuppressionLeak }; 71static const char kStdSuppressions[] = 72#if SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT 73 // For more details refer to the SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT 74 // definition. 75 "leak:*pthread_exit*\n" 76#endif // SANITIZER_SUPPRESS_LEAK_ON_PTHREAD_EXIT 77#if SANITIZER_MAC 78 // For Darwin and os_log/os_trace: https://reviews.llvm.org/D35173 79 "leak:*_os_trace*\n" 80#endif 81 // TLS leak in some glibc versions, described in 82 // https://sourceware.org/bugzilla/show_bug.cgi?id=12650. 83 "leak:*tls_get_addr*\n"; 84 85void InitializeSuppressions() { 86 CHECK_EQ(nullptr, suppression_ctx); 87 suppression_ctx = new (suppression_placeholder) 88 SuppressionContext(kSuppressionTypes, ARRAY_SIZE(kSuppressionTypes)); 89 suppression_ctx->ParseFromFile(flags()->suppressions); 90 if (&__lsan_default_suppressions) 91 suppression_ctx->Parse(__lsan_default_suppressions()); 92 suppression_ctx->Parse(kStdSuppressions); 93} 94 95static SuppressionContext *GetSuppressionContext() { 96 CHECK(suppression_ctx); 97 return suppression_ctx; 98} 99 100static InternalMmapVector<RootRegion> *root_regions; 101 102InternalMmapVector<RootRegion> const *GetRootRegions() { return root_regions; } 103 104void InitializeRootRegions() { 105 CHECK(!root_regions); 106 ALIGNED(64) static char placeholder[sizeof(InternalMmapVector<RootRegion>)]; 107 root_regions = new (placeholder) InternalMmapVector<RootRegion>(); 108} 109 110const char *MaybeCallLsanDefaultOptions() { 111 return (&__lsan_default_options) ? __lsan_default_options() : ""; 112} 113 114void InitCommonLsan() { 115 InitializeRootRegions(); 116 if (common_flags()->detect_leaks) { 117 // Initialization which can fail or print warnings should only be done if 118 // LSan is actually enabled. 119 InitializeSuppressions(); 120 InitializePlatformSpecificModules(); 121 } 122} 123 124class Decorator: public __sanitizer::SanitizerCommonDecorator { 125 public: 126 Decorator() : SanitizerCommonDecorator() { } 127 const char *Error() { return Red(); } 128 const char *Leak() { return Blue(); } 129}; 130 131static inline bool CanBeAHeapPointer(uptr p) { 132 // Since our heap is located in mmap-ed memory, we can assume a sensible lower 133 // bound on heap addresses. 134 const uptr kMinAddress = 4 * 4096; 135 if (p < kMinAddress) return false; 136#if defined(__x86_64__) 137 // Accept only canonical form user-space addresses. 138 return ((p >> 47) == 0); 139#elif defined(__mips64) 140 return ((p >> 40) == 0); 141#elif defined(__aarch64__) 142 unsigned runtimeVMA = 143 (MostSignificantSetBitIndex(GET_CURRENT_FRAME()) + 1); 144 return ((p >> runtimeVMA) == 0); 145#else 146 return true; 147#endif 148} 149 150// Scans the memory range, looking for byte patterns that point into allocator 151// chunks. Marks those chunks with |tag| and adds them to |frontier|. 152// There are two usage modes for this function: finding reachable chunks 153// (|tag| = kReachable) and finding indirectly leaked chunks 154// (|tag| = kIndirectlyLeaked). In the second case, there's no flood fill, 155// so |frontier| = 0. 156void ScanRangeForPointers(uptr begin, uptr end, 157 Frontier *frontier, 158 const char *region_type, ChunkTag tag) { 159 CHECK(tag == kReachable || tag == kIndirectlyLeaked); 160 const uptr alignment = flags()->pointer_alignment(); 161 LOG_POINTERS("Scanning %s range %p-%p.\n", region_type, begin, end); 162 uptr pp = begin; 163 if (pp % alignment) 164 pp = pp + alignment - pp % alignment; 165 for (; pp + sizeof(void *) <= end; pp += alignment) { 166 void *p = *reinterpret_cast<void **>(pp); 167 if (!CanBeAHeapPointer(reinterpret_cast<uptr>(p))) continue; 168 uptr chunk = PointsIntoChunk(p); 169 if (!chunk) continue; 170 // Pointers to self don't count. This matters when tag == kIndirectlyLeaked. 171 if (chunk == begin) continue; 172 LsanMetadata m(chunk); 173 if (m.tag() == kReachable || m.tag() == kIgnored) continue; 174 175 // Do this check relatively late so we can log only the interesting cases. 176 if (!flags()->use_poisoned && WordIsPoisoned(pp)) { 177 LOG_POINTERS( 178 "%p is poisoned: ignoring %p pointing into chunk %p-%p of size " 179 "%zu.\n", 180 pp, p, chunk, chunk + m.requested_size(), m.requested_size()); 181 continue; 182 } 183 184 m.set_tag(tag); 185 LOG_POINTERS("%p: found %p pointing into chunk %p-%p of size %zu.\n", pp, p, 186 chunk, chunk + m.requested_size(), m.requested_size()); 187 if (frontier) 188 frontier->push_back(chunk); 189 } 190} 191 192// Scans a global range for pointers 193void ScanGlobalRange(uptr begin, uptr end, Frontier *frontier) { 194 uptr allocator_begin = 0, allocator_end = 0; 195 GetAllocatorGlobalRange(&allocator_begin, &allocator_end); 196 if (begin <= allocator_begin && allocator_begin < end) { 197 CHECK_LE(allocator_begin, allocator_end); 198 CHECK_LE(allocator_end, end); 199 if (begin < allocator_begin) 200 ScanRangeForPointers(begin, allocator_begin, frontier, "GLOBAL", 201 kReachable); 202 if (allocator_end < end) 203 ScanRangeForPointers(allocator_end, end, frontier, "GLOBAL", kReachable); 204 } else { 205 ScanRangeForPointers(begin, end, frontier, "GLOBAL", kReachable); 206 } 207} 208 209void ForEachExtraStackRangeCb(uptr begin, uptr end, void* arg) { 210 Frontier *frontier = reinterpret_cast<Frontier *>(arg); 211 ScanRangeForPointers(begin, end, frontier, "FAKE STACK", kReachable); 212} 213 214// Scans thread data (stacks and TLS) for heap pointers. 215static void ProcessThreads(SuspendedThreadsList const &suspended_threads, 216 Frontier *frontier) { 217 InternalMmapVector<uptr> registers(suspended_threads.RegisterCount()); 218 uptr registers_begin = reinterpret_cast<uptr>(registers.data()); 219 uptr registers_end = 220 reinterpret_cast<uptr>(registers.data() + registers.size()); 221 for (uptr i = 0; i < suspended_threads.ThreadCount(); i++) { 222 tid_t os_id = static_cast<tid_t>(suspended_threads.GetThreadID(i)); 223 LOG_THREADS("Processing thread %d.\n", os_id); 224 uptr stack_begin, stack_end, tls_begin, tls_end, cache_begin, cache_end; 225 DTLS *dtls; 226 bool thread_found = GetThreadRangesLocked(os_id, &stack_begin, &stack_end, 227 &tls_begin, &tls_end, 228 &cache_begin, &cache_end, &dtls); 229 if (!thread_found) { 230 // If a thread can't be found in the thread registry, it's probably in the 231 // process of destruction. Log this event and move on. 232 LOG_THREADS("Thread %d not found in registry.\n", os_id); 233 continue; 234 } 235 uptr sp; 236 PtraceRegistersStatus have_registers = 237 suspended_threads.GetRegistersAndSP(i, registers.data(), &sp); 238 if (have_registers != REGISTERS_AVAILABLE) { 239 Report("Unable to get registers from thread %d.\n", os_id); 240 // If unable to get SP, consider the entire stack to be reachable unless 241 // GetRegistersAndSP failed with ESRCH. 242 if (have_registers == REGISTERS_UNAVAILABLE_FATAL) continue; 243 sp = stack_begin; 244 } 245 246 if (flags()->use_registers && have_registers) 247 ScanRangeForPointers(registers_begin, registers_end, frontier, 248 "REGISTERS", kReachable); 249 250 if (flags()->use_stacks) { 251 LOG_THREADS("Stack at %p-%p (SP = %p).\n", stack_begin, stack_end, sp); 252 if (sp < stack_begin || sp >= stack_end) { 253 // SP is outside the recorded stack range (e.g. the thread is running a 254 // signal handler on alternate stack, or swapcontext was used). 255 // Again, consider the entire stack range to be reachable. 256 LOG_THREADS("WARNING: stack pointer not in stack range.\n"); 257 uptr page_size = GetPageSizeCached(); 258 int skipped = 0; 259 while (stack_begin < stack_end && 260 !IsAccessibleMemoryRange(stack_begin, 1)) { 261 skipped++; 262 stack_begin += page_size; 263 } 264 LOG_THREADS("Skipped %d guard page(s) to obtain stack %p-%p.\n", 265 skipped, stack_begin, stack_end); 266 } else { 267 // Shrink the stack range to ignore out-of-scope values. 268 stack_begin = sp; 269 } 270 ScanRangeForPointers(stack_begin, stack_end, frontier, "STACK", 271 kReachable); 272 ForEachExtraStackRange(os_id, ForEachExtraStackRangeCb, frontier); 273 } 274 275 if (flags()->use_tls) { 276 if (tls_begin) { 277 LOG_THREADS("TLS at %p-%p.\n", tls_begin, tls_end); 278 // If the tls and cache ranges don't overlap, scan full tls range, 279 // otherwise, only scan the non-overlapping portions 280 if (cache_begin == cache_end || tls_end < cache_begin || 281 tls_begin > cache_end) { 282 ScanRangeForPointers(tls_begin, tls_end, frontier, "TLS", kReachable); 283 } else { 284 if (tls_begin < cache_begin) 285 ScanRangeForPointers(tls_begin, cache_begin, frontier, "TLS", 286 kReachable); 287 if (tls_end > cache_end) 288 ScanRangeForPointers(cache_end, tls_end, frontier, "TLS", 289 kReachable); 290 } 291 } 292 if (dtls && !DTLSInDestruction(dtls)) { 293 for (uptr j = 0; j < dtls->dtv_size; ++j) { 294 uptr dtls_beg = dtls->dtv[j].beg; 295 uptr dtls_end = dtls_beg + dtls->dtv[j].size; 296 if (dtls_beg < dtls_end) { 297 LOG_THREADS("DTLS %zu at %p-%p.\n", j, dtls_beg, dtls_end); 298 ScanRangeForPointers(dtls_beg, dtls_end, frontier, "DTLS", 299 kReachable); 300 } 301 } 302 } else { 303 // We are handling a thread with DTLS under destruction. Log about 304 // this and continue. 305 LOG_THREADS("Thread %d has DTLS under destruction.\n", os_id); 306 } 307 } 308 } 309} 310 311void ScanRootRegion(Frontier *frontier, const RootRegion &root_region, 312 uptr region_begin, uptr region_end, bool is_readable) { 313 uptr intersection_begin = Max(root_region.begin, region_begin); 314 uptr intersection_end = Min(region_end, root_region.begin + root_region.size); 315 if (intersection_begin >= intersection_end) return; 316 LOG_POINTERS("Root region %p-%p intersects with mapped region %p-%p (%s)\n", 317 root_region.begin, root_region.begin + root_region.size, 318 region_begin, region_end, 319 is_readable ? "readable" : "unreadable"); 320 if (is_readable) 321 ScanRangeForPointers(intersection_begin, intersection_end, frontier, "ROOT", 322 kReachable); 323} 324 325static void ProcessRootRegion(Frontier *frontier, 326 const RootRegion &root_region) { 327 MemoryMappingLayout proc_maps(/*cache_enabled*/ true); 328 MemoryMappedSegment segment; 329 while (proc_maps.Next(&segment)) { 330 ScanRootRegion(frontier, root_region, segment.start, segment.end, 331 segment.IsReadable()); 332 } 333} 334 335// Scans root regions for heap pointers. 336static void ProcessRootRegions(Frontier *frontier) { 337 if (!flags()->use_root_regions) return; 338 CHECK(root_regions); 339 for (uptr i = 0; i < root_regions->size(); i++) { 340 ProcessRootRegion(frontier, (*root_regions)[i]); 341 } 342} 343 344static void FloodFillTag(Frontier *frontier, ChunkTag tag) { 345 while (frontier->size()) { 346 uptr next_chunk = frontier->back(); 347 frontier->pop_back(); 348 LsanMetadata m(next_chunk); 349 ScanRangeForPointers(next_chunk, next_chunk + m.requested_size(), frontier, 350 "HEAP", tag); 351 } 352} 353 354// ForEachChunk callback. If the chunk is marked as leaked, marks all chunks 355// which are reachable from it as indirectly leaked. 356static void MarkIndirectlyLeakedCb(uptr chunk, void *arg) { 357 chunk = GetUserBegin(chunk); 358 LsanMetadata m(chunk); 359 if (m.allocated() && m.tag() != kReachable) { 360 ScanRangeForPointers(chunk, chunk + m.requested_size(), 361 /* frontier */ nullptr, "HEAP", kIndirectlyLeaked); 362 } 363} 364 365// ForEachChunk callback. If chunk is marked as ignored, adds its address to 366// frontier. 367static void CollectIgnoredCb(uptr chunk, void *arg) { 368 CHECK(arg); 369 chunk = GetUserBegin(chunk); 370 LsanMetadata m(chunk); 371 if (m.allocated() && m.tag() == kIgnored) { 372 LOG_POINTERS("Ignored: chunk %p-%p of size %zu.\n", 373 chunk, chunk + m.requested_size(), m.requested_size()); 374 reinterpret_cast<Frontier *>(arg)->push_back(chunk); 375 } 376} 377 378static uptr GetCallerPC(u32 stack_id, StackDepotReverseMap *map) { 379 CHECK(stack_id); 380 StackTrace stack = map->Get(stack_id); 381 // The top frame is our malloc/calloc/etc. The next frame is the caller. 382 if (stack.size >= 2) 383 return stack.trace[1]; 384 return 0; 385} 386 387struct InvalidPCParam { 388 Frontier *frontier; 389 StackDepotReverseMap *stack_depot_reverse_map; 390 bool skip_linker_allocations; 391}; 392 393// ForEachChunk callback. If the caller pc is invalid or is within the linker, 394// mark as reachable. Called by ProcessPlatformSpecificAllocations. 395static void MarkInvalidPCCb(uptr chunk, void *arg) { 396 CHECK(arg); 397 InvalidPCParam *param = reinterpret_cast<InvalidPCParam *>(arg); 398 chunk = GetUserBegin(chunk); 399 LsanMetadata m(chunk); 400 if (m.allocated() && m.tag() != kReachable && m.tag() != kIgnored) { 401 u32 stack_id = m.stack_trace_id(); 402 uptr caller_pc = 0; 403 if (stack_id > 0) 404 caller_pc = GetCallerPC(stack_id, param->stack_depot_reverse_map); 405 // If caller_pc is unknown, this chunk may be allocated in a coroutine. Mark 406 // it as reachable, as we can't properly report its allocation stack anyway. 407 if (caller_pc == 0 || (param->skip_linker_allocations && 408 GetLinker()->containsAddress(caller_pc))) { 409 m.set_tag(kReachable); 410 param->frontier->push_back(chunk); 411 } 412 } 413} 414 415// On Linux, treats all chunks allocated from ld-linux.so as reachable, which 416// covers dynamically allocated TLS blocks, internal dynamic loader's loaded 417// modules accounting etc. 418// Dynamic TLS blocks contain the TLS variables of dynamically loaded modules. 419// They are allocated with a __libc_memalign() call in allocate_and_init() 420// (elf/dl-tls.c). Glibc won't tell us the address ranges occupied by those 421// blocks, but we can make sure they come from our own allocator by intercepting 422// __libc_memalign(). On top of that, there is no easy way to reach them. Their 423// addresses are stored in a dynamically allocated array (the DTV) which is 424// referenced from the static TLS. Unfortunately, we can't just rely on the DTV 425// being reachable from the static TLS, and the dynamic TLS being reachable from 426// the DTV. This is because the initial DTV is allocated before our interception 427// mechanism kicks in, and thus we don't recognize it as allocated memory. We 428// can't special-case it either, since we don't know its size. 429// Our solution is to include in the root set all allocations made from 430// ld-linux.so (which is where allocate_and_init() is implemented). This is 431// guaranteed to include all dynamic TLS blocks (and possibly other allocations 432// which we don't care about). 433// On all other platforms, this simply checks to ensure that the caller pc is 434// valid before reporting chunks as leaked. 435void ProcessPC(Frontier *frontier) { 436 StackDepotReverseMap stack_depot_reverse_map; 437 InvalidPCParam arg; 438 arg.frontier = frontier; 439 arg.stack_depot_reverse_map = &stack_depot_reverse_map; 440 arg.skip_linker_allocations = 441 flags()->use_tls && flags()->use_ld_allocations && GetLinker() != nullptr; 442 ForEachChunk(MarkInvalidPCCb, &arg); 443} 444 445// Sets the appropriate tag on each chunk. 446static void ClassifyAllChunks(SuspendedThreadsList const &suspended_threads) { 447 // Holds the flood fill frontier. 448 Frontier frontier; 449 450 ForEachChunk(CollectIgnoredCb, &frontier); 451 ProcessGlobalRegions(&frontier); 452 ProcessThreads(suspended_threads, &frontier); 453 ProcessRootRegions(&frontier); 454 FloodFillTag(&frontier, kReachable); 455 456 CHECK_EQ(0, frontier.size()); 457 ProcessPC(&frontier); 458 459 // The check here is relatively expensive, so we do this in a separate flood 460 // fill. That way we can skip the check for chunks that are reachable 461 // otherwise. 462 LOG_POINTERS("Processing platform-specific allocations.\n"); 463 ProcessPlatformSpecificAllocations(&frontier); 464 FloodFillTag(&frontier, kReachable); 465 466 // Iterate over leaked chunks and mark those that are reachable from other 467 // leaked chunks. 468 LOG_POINTERS("Scanning leaked chunks.\n"); 469 ForEachChunk(MarkIndirectlyLeakedCb, nullptr); 470} 471 472// ForEachChunk callback. Resets the tags to pre-leak-check state. 473static void ResetTagsCb(uptr chunk, void *arg) { 474 (void)arg; 475 chunk = GetUserBegin(chunk); 476 LsanMetadata m(chunk); 477 if (m.allocated() && m.tag() != kIgnored) 478 m.set_tag(kDirectlyLeaked); 479} 480 481static void PrintStackTraceById(u32 stack_trace_id) { 482 CHECK(stack_trace_id); 483 StackDepotGet(stack_trace_id).Print(); 484} 485 486// ForEachChunk callback. Aggregates information about unreachable chunks into 487// a LeakReport. 488static void CollectLeaksCb(uptr chunk, void *arg) { 489 CHECK(arg); 490 LeakReport *leak_report = reinterpret_cast<LeakReport *>(arg); 491 chunk = GetUserBegin(chunk); 492 LsanMetadata m(chunk); 493 if (!m.allocated()) return; 494 if (m.tag() == kDirectlyLeaked || m.tag() == kIndirectlyLeaked) { 495 u32 resolution = flags()->resolution; 496 u32 stack_trace_id = 0; 497 if (resolution > 0) { 498 StackTrace stack = StackDepotGet(m.stack_trace_id()); 499 stack.size = Min(stack.size, resolution); 500 stack_trace_id = StackDepotPut(stack); 501 } else { 502 stack_trace_id = m.stack_trace_id(); 503 } 504 leak_report->AddLeakedChunk(chunk, stack_trace_id, m.requested_size(), 505 m.tag()); 506 } 507} 508 509static void PrintMatchedSuppressions() { 510 InternalMmapVector<Suppression *> matched; 511 GetSuppressionContext()->GetMatched(&matched); 512 if (!matched.size()) 513 return; 514 const char *line = "-----------------------------------------------------"; 515 Printf("%s\n", line); 516 Printf("Suppressions used:\n"); 517 Printf(" count bytes template\n"); 518 for (uptr i = 0; i < matched.size(); i++) 519 Printf("%7zu %10zu %s\n", static_cast<uptr>(atomic_load_relaxed( 520 &matched[i]->hit_count)), matched[i]->weight, matched[i]->templ); 521 Printf("%s\n\n", line); 522} 523 524struct CheckForLeaksParam { 525 bool success; 526 LeakReport leak_report; 527}; 528 529static void ReportIfNotSuspended(ThreadContextBase *tctx, void *arg) { 530 const InternalMmapVector<tid_t> &suspended_threads = 531 *(const InternalMmapVector<tid_t> *)arg; 532 if (tctx->status == ThreadStatusRunning) { 533 uptr i = InternalLowerBound(suspended_threads, 0, suspended_threads.size(), 534 tctx->os_id, CompareLess<int>()); 535 if (i >= suspended_threads.size() || suspended_threads[i] != tctx->os_id) 536 Report("Running thread %d was not suspended. False leaks are possible.\n", 537 tctx->os_id); 538 } 539} 540 541static void ReportUnsuspendedThreads( 542 const SuspendedThreadsList &suspended_threads) { 543 InternalMmapVector<tid_t> threads(suspended_threads.ThreadCount()); 544 for (uptr i = 0; i < suspended_threads.ThreadCount(); ++i) 545 threads[i] = suspended_threads.GetThreadID(i); 546 547 Sort(threads.data(), threads.size()); 548 549 GetThreadRegistryLocked()->RunCallbackForEachThreadLocked( 550 &ReportIfNotSuspended, &threads); 551} 552 553static void CheckForLeaksCallback(const SuspendedThreadsList &suspended_threads, 554 void *arg) { 555 CheckForLeaksParam *param = reinterpret_cast<CheckForLeaksParam *>(arg); 556 CHECK(param); 557 CHECK(!param->success); 558 ReportUnsuspendedThreads(suspended_threads); 559 ClassifyAllChunks(suspended_threads); 560 ForEachChunk(CollectLeaksCb, ¶m->leak_report); 561 // Clean up for subsequent leak checks. This assumes we did not overwrite any 562 // kIgnored tags. 563 ForEachChunk(ResetTagsCb, nullptr); 564 param->success = true; 565} 566 567static bool CheckForLeaks() { 568 if (&__lsan_is_turned_off && __lsan_is_turned_off()) 569 return false; 570 EnsureMainThreadIDIsCorrect(); 571 CheckForLeaksParam param; 572 param.success = false; 573 LockStuffAndStopTheWorld(CheckForLeaksCallback, ¶m); 574 575 if (!param.success) { 576 Report("LeakSanitizer has encountered a fatal error.\n"); 577 Report( 578 "HINT: For debugging, try setting environment variable " 579 "LSAN_OPTIONS=verbosity=1:log_threads=1\n"); 580 Report( 581 "HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)\n"); 582 Die(); 583 } 584 param.leak_report.ApplySuppressions(); 585 uptr unsuppressed_count = param.leak_report.UnsuppressedLeakCount(); 586 if (unsuppressed_count > 0) { 587 Decorator d; 588 Printf("\n" 589 "=================================================================" 590 "\n"); 591 Printf("%s", d.Error()); 592 Report("ERROR: LeakSanitizer: detected memory leaks\n"); 593 Printf("%s", d.Default()); 594 param.leak_report.ReportTopLeaks(flags()->max_leaks); 595 } 596 if (common_flags()->print_suppressions) 597 PrintMatchedSuppressions(); 598 if (unsuppressed_count > 0) { 599 param.leak_report.PrintSummary(); 600 return true; 601 } 602 return false; 603} 604 605static bool has_reported_leaks = false; 606bool HasReportedLeaks() { return has_reported_leaks; } 607 608void DoLeakCheck() { 609 BlockingMutexLock l(&global_mutex); 610 static bool already_done; 611 if (already_done) return; 612 already_done = true; 613 has_reported_leaks = CheckForLeaks(); 614 if (has_reported_leaks) HandleLeaks(); 615} 616 617static int DoRecoverableLeakCheck() { 618 BlockingMutexLock l(&global_mutex); 619 bool have_leaks = CheckForLeaks(); 620 return have_leaks ? 1 : 0; 621} 622 623void DoRecoverableLeakCheckVoid() { DoRecoverableLeakCheck(); } 624 625static Suppression *GetSuppressionForAddr(uptr addr) { 626 Suppression *s = nullptr; 627 628 // Suppress by module name. 629 SuppressionContext *suppressions = GetSuppressionContext(); 630 if (const char *module_name = 631 Symbolizer::GetOrInit()->GetModuleNameForPc(addr)) 632 if (suppressions->Match(module_name, kSuppressionLeak, &s)) 633 return s; 634 635 // Suppress by file or function name. 636 SymbolizedStack *frames = Symbolizer::GetOrInit()->SymbolizePC(addr); 637 for (SymbolizedStack *cur = frames; cur; cur = cur->next) { 638 if (suppressions->Match(cur->info.function, kSuppressionLeak, &s) || 639 suppressions->Match(cur->info.file, kSuppressionLeak, &s)) { 640 break; 641 } 642 } 643 frames->ClearAll(); 644 return s; 645} 646 647static Suppression *GetSuppressionForStack(u32 stack_trace_id) { 648 StackTrace stack = StackDepotGet(stack_trace_id); 649 for (uptr i = 0; i < stack.size; i++) { 650 Suppression *s = GetSuppressionForAddr( 651 StackTrace::GetPreviousInstructionPc(stack.trace[i])); 652 if (s) return s; 653 } 654 return nullptr; 655} 656 657///// LeakReport implementation. ///// 658 659// A hard limit on the number of distinct leaks, to avoid quadratic complexity 660// in LeakReport::AddLeakedChunk(). We don't expect to ever see this many leaks 661// in real-world applications. 662// FIXME: Get rid of this limit by changing the implementation of LeakReport to 663// use a hash table. 664const uptr kMaxLeaksConsidered = 5000; 665 666void LeakReport::AddLeakedChunk(uptr chunk, u32 stack_trace_id, 667 uptr leaked_size, ChunkTag tag) { 668 CHECK(tag == kDirectlyLeaked || tag == kIndirectlyLeaked); 669 bool is_directly_leaked = (tag == kDirectlyLeaked); 670 uptr i; 671 for (i = 0; i < leaks_.size(); i++) { 672 if (leaks_[i].stack_trace_id == stack_trace_id && 673 leaks_[i].is_directly_leaked == is_directly_leaked) { 674 leaks_[i].hit_count++; 675 leaks_[i].total_size += leaked_size; 676 break; 677 } 678 } 679 if (i == leaks_.size()) { 680 if (leaks_.size() == kMaxLeaksConsidered) return; 681 Leak leak = { next_id_++, /* hit_count */ 1, leaked_size, stack_trace_id, 682 is_directly_leaked, /* is_suppressed */ false }; 683 leaks_.push_back(leak); 684 } 685 if (flags()->report_objects) { 686 LeakedObject obj = {leaks_[i].id, chunk, leaked_size}; 687 leaked_objects_.push_back(obj); 688 } 689} 690 691static bool LeakComparator(const Leak &leak1, const Leak &leak2) { 692 if (leak1.is_directly_leaked == leak2.is_directly_leaked) 693 return leak1.total_size > leak2.total_size; 694 else 695 return leak1.is_directly_leaked; 696} 697 698void LeakReport::ReportTopLeaks(uptr num_leaks_to_report) { 699 CHECK(leaks_.size() <= kMaxLeaksConsidered); 700 Printf("\n"); 701 if (leaks_.size() == kMaxLeaksConsidered) 702 Printf("Too many leaks! Only the first %zu leaks encountered will be " 703 "reported.\n", 704 kMaxLeaksConsidered); 705 706 uptr unsuppressed_count = UnsuppressedLeakCount(); 707 if (num_leaks_to_report > 0 && num_leaks_to_report < unsuppressed_count) 708 Printf("The %zu top leak(s):\n", num_leaks_to_report); 709 Sort(leaks_.data(), leaks_.size(), &LeakComparator); 710 uptr leaks_reported = 0; 711 for (uptr i = 0; i < leaks_.size(); i++) { 712 if (leaks_[i].is_suppressed) continue; 713 PrintReportForLeak(i); 714 leaks_reported++; 715 if (leaks_reported == num_leaks_to_report) break; 716 } 717 if (leaks_reported < unsuppressed_count) { 718 uptr remaining = unsuppressed_count - leaks_reported; 719 Printf("Omitting %zu more leak(s).\n", remaining); 720 } 721} 722 723void LeakReport::PrintReportForLeak(uptr index) { 724 Decorator d; 725 Printf("%s", d.Leak()); 726 Printf("%s leak of %zu byte(s) in %zu object(s) allocated from:\n", 727 leaks_[index].is_directly_leaked ? "Direct" : "Indirect", 728 leaks_[index].total_size, leaks_[index].hit_count); 729 Printf("%s", d.Default()); 730 731 PrintStackTraceById(leaks_[index].stack_trace_id); 732 733 if (flags()->report_objects) { 734 Printf("Objects leaked above:\n"); 735 PrintLeakedObjectsForLeak(index); 736 Printf("\n"); 737 } 738} 739 740void LeakReport::PrintLeakedObjectsForLeak(uptr index) { 741 u32 leak_id = leaks_[index].id; 742 for (uptr j = 0; j < leaked_objects_.size(); j++) { 743 if (leaked_objects_[j].leak_id == leak_id) 744 Printf("%p (%zu bytes)\n", leaked_objects_[j].addr, 745 leaked_objects_[j].size); 746 } 747} 748 749void LeakReport::PrintSummary() { 750 CHECK(leaks_.size() <= kMaxLeaksConsidered); 751 uptr bytes = 0, allocations = 0; 752 for (uptr i = 0; i < leaks_.size(); i++) { 753 if (leaks_[i].is_suppressed) continue; 754 bytes += leaks_[i].total_size; 755 allocations += leaks_[i].hit_count; 756 } 757 InternalScopedString summary(kMaxSummaryLength); 758 summary.append("%zu byte(s) leaked in %zu allocation(s).", bytes, 759 allocations); 760 ReportErrorSummary(summary.data()); 761} 762 763void LeakReport::ApplySuppressions() { 764 for (uptr i = 0; i < leaks_.size(); i++) { 765 Suppression *s = GetSuppressionForStack(leaks_[i].stack_trace_id); 766 if (s) { 767 s->weight += leaks_[i].total_size; 768 atomic_store_relaxed(&s->hit_count, atomic_load_relaxed(&s->hit_count) + 769 leaks_[i].hit_count); 770 leaks_[i].is_suppressed = true; 771 } 772 } 773} 774 775uptr LeakReport::UnsuppressedLeakCount() { 776 uptr result = 0; 777 for (uptr i = 0; i < leaks_.size(); i++) 778 if (!leaks_[i].is_suppressed) result++; 779 return result; 780} 781 782} // namespace __lsan 783#else // CAN_SANITIZE_LEAKS 784namespace __lsan { 785void InitCommonLsan() { } 786void DoLeakCheck() { } 787void DoRecoverableLeakCheckVoid() { } 788void DisableInThisThread() { } 789void EnableInThisThread() { } 790} 791#endif // CAN_SANITIZE_LEAKS 792 793using namespace __lsan; 794 795extern "C" { 796SANITIZER_INTERFACE_ATTRIBUTE 797void __lsan_ignore_object(const void *p) { 798#if CAN_SANITIZE_LEAKS 799 if (!common_flags()->detect_leaks) 800 return; 801 // Cannot use PointsIntoChunk or LsanMetadata here, since the allocator is not 802 // locked. 803 BlockingMutexLock l(&global_mutex); 804 IgnoreObjectResult res = IgnoreObjectLocked(p); 805 if (res == kIgnoreObjectInvalid) 806 VReport(1, "__lsan_ignore_object(): no heap object found at %p", p); 807 if (res == kIgnoreObjectAlreadyIgnored) 808 VReport(1, "__lsan_ignore_object(): " 809 "heap object at %p is already being ignored\n", p); 810 if (res == kIgnoreObjectSuccess) 811 VReport(1, "__lsan_ignore_object(): ignoring heap object at %p\n", p); 812#endif // CAN_SANITIZE_LEAKS 813} 814 815SANITIZER_INTERFACE_ATTRIBUTE 816void __lsan_register_root_region(const void *begin, uptr size) { 817#if CAN_SANITIZE_LEAKS 818 BlockingMutexLock l(&global_mutex); 819 CHECK(root_regions); 820 RootRegion region = {reinterpret_cast<uptr>(begin), size}; 821 root_regions->push_back(region); 822 VReport(1, "Registered root region at %p of size %llu\n", begin, size); 823#endif // CAN_SANITIZE_LEAKS 824} 825 826SANITIZER_INTERFACE_ATTRIBUTE 827void __lsan_unregister_root_region(const void *begin, uptr size) { 828#if CAN_SANITIZE_LEAKS 829 BlockingMutexLock l(&global_mutex); 830 CHECK(root_regions); 831 bool removed = false; 832 for (uptr i = 0; i < root_regions->size(); i++) { 833 RootRegion region = (*root_regions)[i]; 834 if (region.begin == reinterpret_cast<uptr>(begin) && region.size == size) { 835 removed = true; 836 uptr last_index = root_regions->size() - 1; 837 (*root_regions)[i] = (*root_regions)[last_index]; 838 root_regions->pop_back(); 839 VReport(1, "Unregistered root region at %p of size %llu\n", begin, size); 840 break; 841 } 842 } 843 if (!removed) { 844 Report( 845 "__lsan_unregister_root_region(): region at %p of size %llu has not " 846 "been registered.\n", 847 begin, size); 848 Die(); 849 } 850#endif // CAN_SANITIZE_LEAKS 851} 852 853SANITIZER_INTERFACE_ATTRIBUTE 854void __lsan_disable() { 855#if CAN_SANITIZE_LEAKS 856 __lsan::DisableInThisThread(); 857#endif 858} 859 860SANITIZER_INTERFACE_ATTRIBUTE 861void __lsan_enable() { 862#if CAN_SANITIZE_LEAKS 863 __lsan::EnableInThisThread(); 864#endif 865} 866 867SANITIZER_INTERFACE_ATTRIBUTE 868void __lsan_do_leak_check() { 869#if CAN_SANITIZE_LEAKS 870 if (common_flags()->detect_leaks) 871 __lsan::DoLeakCheck(); 872#endif // CAN_SANITIZE_LEAKS 873} 874 875SANITIZER_INTERFACE_ATTRIBUTE 876int __lsan_do_recoverable_leak_check() { 877#if CAN_SANITIZE_LEAKS 878 if (common_flags()->detect_leaks) 879 return __lsan::DoRecoverableLeakCheck(); 880#endif // CAN_SANITIZE_LEAKS 881 return 0; 882} 883 884#if !SANITIZER_SUPPORTS_WEAK_HOOKS 885SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE 886const char * __lsan_default_options() { 887 return ""; 888} 889 890SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE 891int __lsan_is_turned_off() { 892 return 0; 893} 894 895SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE 896const char *__lsan_default_suppressions() { 897 return ""; 898} 899#endif 900} // extern "C" 901