1//===-- asan_thread.cpp ---------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11// Thread-related code.
12//===----------------------------------------------------------------------===//
13#include "asan_thread.h"
14
15#include "asan_allocator.h"
16#include "asan_interceptors.h"
17#include "asan_mapping.h"
18#include "asan_poisoning.h"
19#include "asan_stack.h"
20#include "lsan/lsan_common.h"
21#include "sanitizer_common/sanitizer_common.h"
22#include "sanitizer_common/sanitizer_placement_new.h"
23#include "sanitizer_common/sanitizer_stackdepot.h"
24#include "sanitizer_common/sanitizer_tls_get_addr.h"
25
26namespace __asan {
27
28// AsanThreadContext implementation.
29
30void AsanThreadContext::OnCreated(void *arg) {
31  CreateThreadContextArgs *args = static_cast<CreateThreadContextArgs *>(arg);
32  if (args->stack)
33    stack_id = StackDepotPut(*args->stack);
34  thread = args->thread;
35  thread->set_context(this);
36}
37
38void AsanThreadContext::OnFinished() {
39  // Drop the link to the AsanThread object.
40  thread = nullptr;
41}
42
43static ThreadRegistry *asan_thread_registry;
44static ThreadArgRetval *thread_data;
45
46static Mutex mu_for_thread_context;
47
48static ThreadContextBase *GetAsanThreadContext(u32 tid) {
49  Lock lock(&mu_for_thread_context);
50  return new (GetGlobalLowLevelAllocator()) AsanThreadContext(tid);
51}
52
53static void InitThreads() {
54  static bool initialized;
55  // Don't worry about thread_safety - this should be called when there is
56  // a single thread.
57  if (LIKELY(initialized))
58    return;
59  // Never reuse ASan threads: we store pointer to AsanThreadContext
60  // in TSD and can't reliably tell when no more TSD destructors will
61  // be called. It would be wrong to reuse AsanThreadContext for another
62  // thread before all TSD destructors will be called for it.
63
64  // MIPS requires aligned address
65  static ALIGNED(alignof(
66      ThreadRegistry)) char thread_registry_placeholder[sizeof(ThreadRegistry)];
67  static ALIGNED(alignof(
68      ThreadArgRetval)) char thread_data_placeholder[sizeof(ThreadArgRetval)];
69
70  asan_thread_registry =
71      new (thread_registry_placeholder) ThreadRegistry(GetAsanThreadContext);
72  thread_data = new (thread_data_placeholder) ThreadArgRetval();
73  initialized = true;
74}
75
76ThreadRegistry &asanThreadRegistry() {
77  InitThreads();
78  return *asan_thread_registry;
79}
80
81ThreadArgRetval &asanThreadArgRetval() {
82  InitThreads();
83  return *thread_data;
84}
85
86AsanThreadContext *GetThreadContextByTidLocked(u32 tid) {
87  return static_cast<AsanThreadContext *>(
88      asanThreadRegistry().GetThreadLocked(tid));
89}
90
91// AsanThread implementation.
92
93AsanThread *AsanThread::Create(const void *start_data, uptr data_size,
94                               u32 parent_tid, StackTrace *stack,
95                               bool detached) {
96  uptr PageSize = GetPageSizeCached();
97  uptr size = RoundUpTo(sizeof(AsanThread), PageSize);
98  AsanThread *thread = (AsanThread *)MmapOrDie(size, __func__);
99  if (data_size) {
100    uptr availible_size = (uptr)thread + size - (uptr)(thread->start_data_);
101    CHECK_LE(data_size, availible_size);
102    internal_memcpy(thread->start_data_, start_data, data_size);
103  }
104  AsanThreadContext::CreateThreadContextArgs args = {thread, stack};
105  asanThreadRegistry().CreateThread(0, detached, parent_tid, &args);
106
107  return thread;
108}
109
110void AsanThread::GetStartData(void *out, uptr out_size) const {
111  internal_memcpy(out, start_data_, out_size);
112}
113
114void AsanThread::TSDDtor(void *tsd) {
115  AsanThreadContext *context = (AsanThreadContext *)tsd;
116  VReport(1, "T%d TSDDtor\n", context->tid);
117  if (context->thread)
118    context->thread->Destroy();
119}
120
121void AsanThread::Destroy() {
122  int tid = this->tid();
123  VReport(1, "T%d exited\n", tid);
124
125  bool was_running =
126      (asanThreadRegistry().FinishThread(tid) == ThreadStatusRunning);
127  if (was_running) {
128    if (AsanThread *thread = GetCurrentThread())
129      CHECK_EQ(this, thread);
130    malloc_storage().CommitBack();
131    if (common_flags()->use_sigaltstack)
132      UnsetAlternateSignalStack();
133    FlushToDeadThreadStats(&stats_);
134    // We also clear the shadow on thread destruction because
135    // some code may still be executing in later TSD destructors
136    // and we don't want it to have any poisoned stack.
137    ClearShadowForThreadStackAndTLS();
138    DeleteFakeStack(tid);
139  } else {
140    CHECK_NE(this, GetCurrentThread());
141  }
142  uptr size = RoundUpTo(sizeof(AsanThread), GetPageSizeCached());
143  UnmapOrDie(this, size);
144  if (was_running)
145    DTLS_Destroy();
146}
147
148void AsanThread::StartSwitchFiber(FakeStack **fake_stack_save, uptr bottom,
149                                  uptr size) {
150  if (atomic_load(&stack_switching_, memory_order_relaxed)) {
151    Report("ERROR: starting fiber switch while in fiber switch\n");
152    Die();
153  }
154
155  next_stack_bottom_ = bottom;
156  next_stack_top_ = bottom + size;
157  atomic_store(&stack_switching_, 1, memory_order_release);
158
159  FakeStack *current_fake_stack = fake_stack_;
160  if (fake_stack_save)
161    *fake_stack_save = fake_stack_;
162  fake_stack_ = nullptr;
163  SetTLSFakeStack(nullptr);
164  // if fake_stack_save is null, the fiber will die, delete the fakestack
165  if (!fake_stack_save && current_fake_stack)
166    current_fake_stack->Destroy(this->tid());
167}
168
169void AsanThread::FinishSwitchFiber(FakeStack *fake_stack_save, uptr *bottom_old,
170                                   uptr *size_old) {
171  if (!atomic_load(&stack_switching_, memory_order_relaxed)) {
172    Report("ERROR: finishing a fiber switch that has not started\n");
173    Die();
174  }
175
176  if (fake_stack_save) {
177    SetTLSFakeStack(fake_stack_save);
178    fake_stack_ = fake_stack_save;
179  }
180
181  if (bottom_old)
182    *bottom_old = stack_bottom_;
183  if (size_old)
184    *size_old = stack_top_ - stack_bottom_;
185  stack_bottom_ = next_stack_bottom_;
186  stack_top_ = next_stack_top_;
187  atomic_store(&stack_switching_, 0, memory_order_release);
188  next_stack_top_ = 0;
189  next_stack_bottom_ = 0;
190}
191
192inline AsanThread::StackBounds AsanThread::GetStackBounds() const {
193  if (!atomic_load(&stack_switching_, memory_order_acquire)) {
194    // Make sure the stack bounds are fully initialized.
195    if (stack_bottom_ >= stack_top_)
196      return {0, 0};
197    return {stack_bottom_, stack_top_};
198  }
199  char local;
200  const uptr cur_stack = (uptr)&local;
201  // Note: need to check next stack first, because FinishSwitchFiber
202  // may be in process of overwriting stack_top_/bottom_. But in such case
203  // we are already on the next stack.
204  if (cur_stack >= next_stack_bottom_ && cur_stack < next_stack_top_)
205    return {next_stack_bottom_, next_stack_top_};
206  return {stack_bottom_, stack_top_};
207}
208
209uptr AsanThread::stack_top() { return GetStackBounds().top; }
210
211uptr AsanThread::stack_bottom() { return GetStackBounds().bottom; }
212
213uptr AsanThread::stack_size() {
214  const auto bounds = GetStackBounds();
215  return bounds.top - bounds.bottom;
216}
217
218// We want to create the FakeStack lazily on the first use, but not earlier
219// than the stack size is known and the procedure has to be async-signal safe.
220FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() {
221  uptr stack_size = this->stack_size();
222  if (stack_size == 0)  // stack_size is not yet available, don't use FakeStack.
223    return nullptr;
224  uptr old_val = 0;
225  // fake_stack_ has 3 states:
226  // 0   -- not initialized
227  // 1   -- being initialized
228  // ptr -- initialized
229  // This CAS checks if the state was 0 and if so changes it to state 1,
230  // if that was successful, it initializes the pointer.
231  if (atomic_compare_exchange_strong(
232          reinterpret_cast<atomic_uintptr_t *>(&fake_stack_), &old_val, 1UL,
233          memory_order_relaxed)) {
234    uptr stack_size_log = Log2(RoundUpToPowerOfTwo(stack_size));
235    CHECK_LE(flags()->min_uar_stack_size_log, flags()->max_uar_stack_size_log);
236    stack_size_log =
237        Min(stack_size_log, static_cast<uptr>(flags()->max_uar_stack_size_log));
238    stack_size_log =
239        Max(stack_size_log, static_cast<uptr>(flags()->min_uar_stack_size_log));
240    fake_stack_ = FakeStack::Create(stack_size_log);
241    DCHECK_EQ(GetCurrentThread(), this);
242    SetTLSFakeStack(fake_stack_);
243    return fake_stack_;
244  }
245  return nullptr;
246}
247
248void AsanThread::Init(const InitOptions *options) {
249  DCHECK_NE(tid(), kInvalidTid);
250  next_stack_top_ = next_stack_bottom_ = 0;
251  atomic_store(&stack_switching_, false, memory_order_release);
252  CHECK_EQ(this->stack_size(), 0U);
253  SetThreadStackAndTls(options);
254  if (stack_top_ != stack_bottom_) {
255    CHECK_GT(this->stack_size(), 0U);
256    CHECK(AddrIsInMem(stack_bottom_));
257    CHECK(AddrIsInMem(stack_top_ - 1));
258  }
259  ClearShadowForThreadStackAndTLS();
260  fake_stack_ = nullptr;
261  if (__asan_option_detect_stack_use_after_return &&
262      tid() == GetCurrentTidOrInvalid()) {
263    // AsyncSignalSafeLazyInitFakeStack makes use of threadlocals and must be
264    // called from the context of the thread it is initializing, not its parent.
265    // Most platforms call AsanThread::Init on the newly-spawned thread, but
266    // Fuchsia calls this function from the parent thread.  To support that
267    // approach, we avoid calling AsyncSignalSafeLazyInitFakeStack here; it will
268    // be called by the new thread when it first attempts to access the fake
269    // stack.
270    AsyncSignalSafeLazyInitFakeStack();
271  }
272  int local = 0;
273  VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(),
274          (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_,
275          (void *)&local);
276}
277
278// Fuchsia doesn't use ThreadStart.
279// asan_fuchsia.c definies CreateMainThread and SetThreadStackAndTls.
280#if !SANITIZER_FUCHSIA
281
282void AsanThread::ThreadStart(tid_t os_id) {
283  Init();
284  asanThreadRegistry().StartThread(tid(), os_id, ThreadType::Regular, nullptr);
285
286  if (common_flags()->use_sigaltstack)
287    SetAlternateSignalStack();
288}
289
290AsanThread *CreateMainThread() {
291  AsanThread *main_thread = AsanThread::Create(
292      /* parent_tid */ kMainTid,
293      /* stack */ nullptr, /* detached */ true);
294  SetCurrentThread(main_thread);
295  main_thread->ThreadStart(internal_getpid());
296  return main_thread;
297}
298
299// This implementation doesn't use the argument, which is just passed down
300// from the caller of Init (which see, above).  It's only there to support
301// OS-specific implementations that need more information passed through.
302void AsanThread::SetThreadStackAndTls(const InitOptions *options) {
303  DCHECK_EQ(options, nullptr);
304  uptr tls_size = 0;
305  uptr stack_size = 0;
306  GetThreadStackAndTls(tid() == kMainTid, &stack_bottom_, &stack_size,
307                       &tls_begin_, &tls_size);
308  stack_top_ = RoundDownTo(stack_bottom_ + stack_size, ASAN_SHADOW_GRANULARITY);
309  stack_bottom_ = RoundDownTo(stack_bottom_, ASAN_SHADOW_GRANULARITY);
310  tls_end_ = tls_begin_ + tls_size;
311  dtls_ = DTLS_Get();
312
313  if (stack_top_ != stack_bottom_) {
314    int local;
315    CHECK(AddrIsInStack((uptr)&local));
316  }
317}
318
319#endif  // !SANITIZER_FUCHSIA
320
321void AsanThread::ClearShadowForThreadStackAndTLS() {
322  if (stack_top_ != stack_bottom_)
323    PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0);
324  if (tls_begin_ != tls_end_) {
325    uptr tls_begin_aligned = RoundDownTo(tls_begin_, ASAN_SHADOW_GRANULARITY);
326    uptr tls_end_aligned = RoundUpTo(tls_end_, ASAN_SHADOW_GRANULARITY);
327    FastPoisonShadow(tls_begin_aligned, tls_end_aligned - tls_begin_aligned, 0);
328  }
329}
330
331bool AsanThread::GetStackFrameAccessByAddr(uptr addr,
332                                           StackFrameAccess *access) {
333  if (stack_top_ == stack_bottom_)
334    return false;
335
336  uptr bottom = 0;
337  if (AddrIsInStack(addr)) {
338    bottom = stack_bottom();
339  } else if (FakeStack *fake_stack = get_fake_stack()) {
340    bottom = fake_stack->AddrIsInFakeStack(addr);
341    CHECK(bottom);
342    access->offset = addr - bottom;
343    access->frame_pc = ((uptr *)bottom)[2];
344    access->frame_descr = (const char *)((uptr *)bottom)[1];
345    return true;
346  }
347  uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8);  // align addr.
348  uptr mem_ptr = RoundDownTo(aligned_addr, ASAN_SHADOW_GRANULARITY);
349  u8 *shadow_ptr = (u8 *)MemToShadow(aligned_addr);
350  u8 *shadow_bottom = (u8 *)MemToShadow(bottom);
351
352  while (shadow_ptr >= shadow_bottom &&
353         *shadow_ptr != kAsanStackLeftRedzoneMagic) {
354    shadow_ptr--;
355    mem_ptr -= ASAN_SHADOW_GRANULARITY;
356  }
357
358  while (shadow_ptr >= shadow_bottom &&
359         *shadow_ptr == kAsanStackLeftRedzoneMagic) {
360    shadow_ptr--;
361    mem_ptr -= ASAN_SHADOW_GRANULARITY;
362  }
363
364  if (shadow_ptr < shadow_bottom) {
365    return false;
366  }
367
368  uptr *ptr = (uptr *)(mem_ptr + ASAN_SHADOW_GRANULARITY);
369  CHECK(ptr[0] == kCurrentStackFrameMagic);
370  access->offset = addr - (uptr)ptr;
371  access->frame_pc = ptr[2];
372  access->frame_descr = (const char *)ptr[1];
373  return true;
374}
375
376uptr AsanThread::GetStackVariableShadowStart(uptr addr) {
377  uptr bottom = 0;
378  if (AddrIsInStack(addr)) {
379    bottom = stack_bottom();
380  } else if (FakeStack *fake_stack = get_fake_stack()) {
381    bottom = fake_stack->AddrIsInFakeStack(addr);
382    if (bottom == 0) {
383      return 0;
384    }
385  } else {
386    return 0;
387  }
388
389  uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8);  // align addr.
390  u8 *shadow_ptr = (u8 *)MemToShadow(aligned_addr);
391  u8 *shadow_bottom = (u8 *)MemToShadow(bottom);
392
393  while (shadow_ptr >= shadow_bottom &&
394         (*shadow_ptr != kAsanStackLeftRedzoneMagic &&
395          *shadow_ptr != kAsanStackMidRedzoneMagic &&
396          *shadow_ptr != kAsanStackRightRedzoneMagic))
397    shadow_ptr--;
398
399  return (uptr)shadow_ptr + 1;
400}
401
402bool AsanThread::AddrIsInStack(uptr addr) {
403  const auto bounds = GetStackBounds();
404  return addr >= bounds.bottom && addr < bounds.top;
405}
406
407static bool ThreadStackContainsAddress(ThreadContextBase *tctx_base,
408                                       void *addr) {
409  AsanThreadContext *tctx = static_cast<AsanThreadContext *>(tctx_base);
410  AsanThread *t = tctx->thread;
411  if (!t)
412    return false;
413  if (t->AddrIsInStack((uptr)addr))
414    return true;
415  FakeStack *fake_stack = t->get_fake_stack();
416  if (!fake_stack)
417    return false;
418  return fake_stack->AddrIsInFakeStack((uptr)addr);
419}
420
421AsanThread *GetCurrentThread() {
422  AsanThreadContext *context =
423      reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
424  if (!context) {
425    if (SANITIZER_ANDROID) {
426      // On Android, libc constructor is called _after_ asan_init, and cleans up
427      // TSD. Try to figure out if this is still the main thread by the stack
428      // address. We are not entirely sure that we have correct main thread
429      // limits, so only do this magic on Android, and only if the found thread
430      // is the main thread.
431      AsanThreadContext *tctx = GetThreadContextByTidLocked(kMainTid);
432      if (tctx && ThreadStackContainsAddress(tctx, &context)) {
433        SetCurrentThread(tctx->thread);
434        return tctx->thread;
435      }
436    }
437    return nullptr;
438  }
439  return context->thread;
440}
441
442void SetCurrentThread(AsanThread *t) {
443  CHECK(t->context());
444  VReport(2, "SetCurrentThread: %p for thread %p\n", (void *)t->context(),
445          (void *)GetThreadSelf());
446  // Make sure we do not reset the current AsanThread.
447  CHECK_EQ(0, AsanTSDGet());
448  AsanTSDSet(t->context());
449  CHECK_EQ(t->context(), AsanTSDGet());
450}
451
452u32 GetCurrentTidOrInvalid() {
453  AsanThread *t = GetCurrentThread();
454  return t ? t->tid() : kInvalidTid;
455}
456
457AsanThread *FindThreadByStackAddress(uptr addr) {
458  asanThreadRegistry().CheckLocked();
459  AsanThreadContext *tctx = static_cast<AsanThreadContext *>(
460      asanThreadRegistry().FindThreadContextLocked(ThreadStackContainsAddress,
461                                                   (void *)addr));
462  return tctx ? tctx->thread : nullptr;
463}
464
465void EnsureMainThreadIDIsCorrect() {
466  AsanThreadContext *context =
467      reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
468  if (context && (context->tid == kMainTid))
469    context->os_id = GetTid();
470}
471
472__asan::AsanThread *GetAsanThreadByOsIDLocked(tid_t os_id) {
473  __asan::AsanThreadContext *context = static_cast<__asan::AsanThreadContext *>(
474      __asan::asanThreadRegistry().FindThreadContextByOsIDLocked(os_id));
475  if (!context)
476    return nullptr;
477  return context->thread;
478}
479}  // namespace __asan
480
481// --- Implementation of LSan-specific functions --- {{{1
482namespace __lsan {
483void LockThreads() {
484  __asan::asanThreadRegistry().Lock();
485  __asan::asanThreadArgRetval().Lock();
486}
487
488void UnlockThreads() {
489  __asan::asanThreadArgRetval().Unlock();
490  __asan::asanThreadRegistry().Unlock();
491}
492
493static ThreadRegistry *GetAsanThreadRegistryLocked() {
494  __asan::asanThreadRegistry().CheckLocked();
495  return &__asan::asanThreadRegistry();
496}
497
498void EnsureMainThreadIDIsCorrect() { __asan::EnsureMainThreadIDIsCorrect(); }
499
500bool GetThreadRangesLocked(tid_t os_id, uptr *stack_begin, uptr *stack_end,
501                           uptr *tls_begin, uptr *tls_end, uptr *cache_begin,
502                           uptr *cache_end, DTLS **dtls) {
503  __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
504  if (!t)
505    return false;
506  *stack_begin = t->stack_bottom();
507  *stack_end = t->stack_top();
508  *tls_begin = t->tls_begin();
509  *tls_end = t->tls_end();
510  // ASan doesn't keep allocator caches in TLS, so these are unused.
511  *cache_begin = 0;
512  *cache_end = 0;
513  *dtls = t->dtls();
514  return true;
515}
516
517void GetAllThreadAllocatorCachesLocked(InternalMmapVector<uptr> *caches) {}
518
519void GetThreadExtraStackRangesLocked(tid_t os_id,
520                                     InternalMmapVector<Range> *ranges) {
521  __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
522  if (!t)
523    return;
524  __asan::FakeStack *fake_stack = t->get_fake_stack();
525  if (!fake_stack)
526    return;
527
528  fake_stack->ForEachFakeFrame(
529      [](uptr begin, uptr end, void *arg) {
530        reinterpret_cast<InternalMmapVector<Range> *>(arg)->push_back(
531            {begin, end});
532      },
533      ranges);
534}
535
536void GetThreadExtraStackRangesLocked(InternalMmapVector<Range> *ranges) {
537  GetAsanThreadRegistryLocked()->RunCallbackForEachThreadLocked(
538      [](ThreadContextBase *tctx, void *arg) {
539        GetThreadExtraStackRangesLocked(
540            tctx->os_id, reinterpret_cast<InternalMmapVector<Range> *>(arg));
541      },
542      ranges);
543}
544
545void GetAdditionalThreadContextPtrsLocked(InternalMmapVector<uptr> *ptrs) {
546  __asan::asanThreadArgRetval().GetAllPtrsLocked(ptrs);
547}
548
549void GetRunningThreadsLocked(InternalMmapVector<tid_t> *threads) {
550  GetAsanThreadRegistryLocked()->RunCallbackForEachThreadLocked(
551      [](ThreadContextBase *tctx, void *threads) {
552        if (tctx->status == ThreadStatusRunning)
553          reinterpret_cast<InternalMmapVector<tid_t> *>(threads)->push_back(
554              tctx->os_id);
555      },
556      threads);
557}
558
559}  // namespace __lsan
560
561// ---------------------- Interface ---------------- {{{1
562using namespace __asan;
563
564extern "C" {
565SANITIZER_INTERFACE_ATTRIBUTE
566void __sanitizer_start_switch_fiber(void **fakestacksave, const void *bottom,
567                                    uptr size) {
568  AsanThread *t = GetCurrentThread();
569  if (!t) {
570    VReport(1, "__asan_start_switch_fiber called from unknown thread\n");
571    return;
572  }
573  t->StartSwitchFiber((FakeStack **)fakestacksave, (uptr)bottom, size);
574}
575
576SANITIZER_INTERFACE_ATTRIBUTE
577void __sanitizer_finish_switch_fiber(void *fakestack, const void **bottom_old,
578                                     uptr *size_old) {
579  AsanThread *t = GetCurrentThread();
580  if (!t) {
581    VReport(1, "__asan_finish_switch_fiber called from unknown thread\n");
582    return;
583  }
584  t->FinishSwitchFiber((FakeStack *)fakestack, (uptr *)bottom_old,
585                       (uptr *)size_old);
586}
587}
588