1//=-- lsan_common_mac.cpp -------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of LeakSanitizer.
10// Implementation of common leak checking functionality. Darwin-specific code.
11//
12//===----------------------------------------------------------------------===//
13
14#include "sanitizer_common/sanitizer_platform.h"
15#include "sanitizer_common/sanitizer_libc.h"
16#include "lsan_common.h"
17
18#if CAN_SANITIZE_LEAKS && SANITIZER_MAC
19
20#include "sanitizer_common/sanitizer_allocator_internal.h"
21#include "lsan_allocator.h"
22
23#include <pthread.h>
24
25#include <mach/mach.h>
26
27// Only introduced in Mac OS X 10.9.
28#ifdef VM_MEMORY_OS_ALLOC_ONCE
29static const int kSanitizerVmMemoryOsAllocOnce = VM_MEMORY_OS_ALLOC_ONCE;
30#else
31static const int kSanitizerVmMemoryOsAllocOnce = 73;
32#endif
33
34namespace __lsan {
35
36typedef struct {
37  int disable_counter;
38  u32 current_thread_id;
39  AllocatorCache cache;
40} thread_local_data_t;
41
42static pthread_key_t key;
43static pthread_once_t key_once = PTHREAD_ONCE_INIT;
44
45// The main thread destructor requires the current thread id,
46// so we can't destroy it until it's been used and reset to invalid tid
47void restore_tid_data(void *ptr) {
48  thread_local_data_t *data = (thread_local_data_t *)ptr;
49  if (data->current_thread_id != kInvalidTid)
50    pthread_setspecific(key, data);
51}
52
53static void make_tls_key() {
54  CHECK_EQ(pthread_key_create(&key, restore_tid_data), 0);
55}
56
57static thread_local_data_t *get_tls_val(bool alloc) {
58  pthread_once(&key_once, make_tls_key);
59
60  thread_local_data_t *ptr = (thread_local_data_t *)pthread_getspecific(key);
61  if (ptr == NULL && alloc) {
62    ptr = (thread_local_data_t *)InternalAlloc(sizeof(*ptr));
63    ptr->disable_counter = 0;
64    ptr->current_thread_id = kInvalidTid;
65    ptr->cache = AllocatorCache();
66    pthread_setspecific(key, ptr);
67  }
68
69  return ptr;
70}
71
72bool DisabledInThisThread() {
73  thread_local_data_t *data = get_tls_val(false);
74  return data ? data->disable_counter > 0 : false;
75}
76
77void DisableInThisThread() { ++get_tls_val(true)->disable_counter; }
78
79void EnableInThisThread() {
80  int *disable_counter = &get_tls_val(true)->disable_counter;
81  if (*disable_counter == 0) {
82    DisableCounterUnderflow();
83  }
84  --*disable_counter;
85}
86
87u32 GetCurrentThread() {
88  thread_local_data_t *data = get_tls_val(false);
89  return data ? data->current_thread_id : kInvalidTid;
90}
91
92void SetCurrentThread(u32 tid) { get_tls_val(true)->current_thread_id = tid; }
93
94AllocatorCache *GetAllocatorCache() { return &get_tls_val(true)->cache; }
95
96LoadedModule *GetLinker() { return nullptr; }
97
98// Required on Linux for initialization of TLS behavior, but should not be
99// required on Darwin.
100void InitializePlatformSpecificModules() {}
101
102// Sections which can't contain contain global pointers. This list errs on the
103// side of caution to avoid false positives, at the expense of performance.
104//
105// Other potentially safe sections include:
106// __all_image_info, __crash_info, __const, __got, __interpose, __objc_msg_break
107//
108// Sections which definitely cannot be included here are:
109// __objc_data, __objc_const, __data, __bss, __common, __thread_data,
110// __thread_bss, __thread_vars, __objc_opt_rw, __objc_opt_ptrs
111static const char *kSkippedSecNames[] = {
112    "__cfstring",       "__la_symbol_ptr",  "__mod_init_func",
113    "__mod_term_func",  "__nl_symbol_ptr",  "__objc_classlist",
114    "__objc_classrefs", "__objc_imageinfo", "__objc_nlclslist",
115    "__objc_protolist", "__objc_selrefs",   "__objc_superrefs"};
116
117// Scans global variables for heap pointers.
118void ProcessGlobalRegions(Frontier *frontier) {
119  for (auto name : kSkippedSecNames)
120    CHECK(internal_strnlen(name, kMaxSegName + 1) <= kMaxSegName);
121
122  MemoryMappingLayout memory_mapping(false);
123  InternalMmapVector<LoadedModule> modules;
124  modules.reserve(128);
125  memory_mapping.DumpListOfModules(&modules);
126  for (uptr i = 0; i < modules.size(); ++i) {
127    // Even when global scanning is disabled, we still need to scan
128    // system libraries for stashed pointers
129    if (!flags()->use_globals && modules[i].instrumented()) continue;
130
131    for (const __sanitizer::LoadedModule::AddressRange &range :
132         modules[i].ranges()) {
133      // Sections storing global variables are writable and non-executable
134      if (range.executable || !range.writable) continue;
135
136      for (auto name : kSkippedSecNames) {
137        if (!internal_strcmp(range.name, name)) continue;
138      }
139
140      ScanGlobalRange(range.beg, range.end, frontier);
141    }
142  }
143}
144
145void ProcessPlatformSpecificAllocations(Frontier *frontier) {
146  unsigned depth = 1;
147  vm_size_t size = 0;
148  vm_address_t address = 0;
149  kern_return_t err = KERN_SUCCESS;
150  mach_msg_type_number_t count = VM_REGION_SUBMAP_INFO_COUNT_64;
151
152  InternalMmapVector<RootRegion> const *root_regions = GetRootRegions();
153
154  while (err == KERN_SUCCESS) {
155    struct vm_region_submap_info_64 info;
156    err = vm_region_recurse_64(mach_task_self(), &address, &size, &depth,
157                               (vm_region_info_t)&info, &count);
158
159    uptr end_address = address + size;
160
161    // libxpc stashes some pointers in the Kernel Alloc Once page,
162    // make sure not to report those as leaks.
163    if (info.user_tag == kSanitizerVmMemoryOsAllocOnce) {
164      ScanRangeForPointers(address, end_address, frontier, "GLOBAL",
165                           kReachable);
166
167      // Recursing over the full memory map is very slow, break out
168      // early if we don't need the full iteration.
169      if (!flags()->use_root_regions || !root_regions->size())
170        break;
171    }
172
173    // This additional root region scan is required on Darwin in order to
174    // detect root regions contained within mmap'd memory regions, because
175    // the Darwin implementation of sanitizer_procmaps traverses images
176    // as loaded by dyld, and not the complete set of all memory regions.
177    //
178    // TODO(fjricci) - remove this once sanitizer_procmaps_mac has the same
179    // behavior as sanitizer_procmaps_linux and traverses all memory regions
180    if (flags()->use_root_regions) {
181      for (uptr i = 0; i < root_regions->size(); i++) {
182        ScanRootRegion(frontier, (*root_regions)[i], address, end_address,
183                       info.protection & kProtectionRead);
184      }
185    }
186
187    address = end_address;
188  }
189}
190
191// On darwin, we can intercept _exit gracefully, and return a failing exit code
192// if required at that point. Calling Die() here is undefined behavior and
193// causes rare race conditions.
194void HandleLeaks() {}
195
196void LockStuffAndStopTheWorld(StopTheWorldCallback callback, void *argument) {
197  LockThreadRegistry();
198  LockAllocator();
199  StopTheWorld(callback, argument);
200  UnlockAllocator();
201  UnlockThreadRegistry();
202}
203
204} // namespace __lsan
205
206#endif // CAN_SANITIZE_LEAKS && SANITIZER_MAC
207