1//===-- msan.h --------------------------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of MemorySanitizer.
10//
11// Private MSan header.
12//===----------------------------------------------------------------------===//
13
14#ifndef MSAN_H
15#define MSAN_H
16
17#include "sanitizer_common/sanitizer_flags.h"
18#include "sanitizer_common/sanitizer_internal_defs.h"
19#include "sanitizer_common/sanitizer_stacktrace.h"
20#include "msan_interface_internal.h"
21#include "msan_flags.h"
22#include "ubsan/ubsan_platform.h"
23
24#ifndef MSAN_REPLACE_OPERATORS_NEW_AND_DELETE
25# define MSAN_REPLACE_OPERATORS_NEW_AND_DELETE 1
26#endif
27
28#ifndef MSAN_CONTAINS_UBSAN
29# define MSAN_CONTAINS_UBSAN CAN_SANITIZE_UB
30#endif
31
32struct MappingDesc {
33  uptr start;
34  uptr end;
35  enum Type {
36    INVALID = 1,
37    ALLOCATOR = 2,
38    APP = 4,
39    SHADOW = 8,
40    ORIGIN = 16,
41  } type;
42  const char *name;
43};
44
45// Note: MappingDesc::ALLOCATOR entries are only used to check for memory
46// layout compatibility. The actual allocation settings are in
47// msan_allocator.cpp, which need to be kept in sync.
48#if SANITIZER_LINUX && defined(__mips64)
49
50// MIPS64 maps:
51// - 0x0000000000-0x0200000000: Program own segments
52// - 0xa200000000-0xc000000000: PIE program segments
53// - 0xe200000000-0xffffffffff: libraries segments.
54const MappingDesc kMemoryLayout[] = {
55    {0x000000000000ULL, 0x000200000000ULL, MappingDesc::APP, "app-1"},
56    {0x000200000000ULL, 0x002200000000ULL, MappingDesc::INVALID, "invalid"},
57    {0x002200000000ULL, 0x004000000000ULL, MappingDesc::SHADOW, "shadow-2"},
58    {0x004000000000ULL, 0x004200000000ULL, MappingDesc::INVALID, "invalid"},
59    {0x004200000000ULL, 0x006000000000ULL, MappingDesc::ORIGIN, "origin-2"},
60    {0x006000000000ULL, 0x006200000000ULL, MappingDesc::INVALID, "invalid"},
61    {0x006200000000ULL, 0x008000000000ULL, MappingDesc::SHADOW, "shadow-3"},
62    {0x008000000000ULL, 0x008200000000ULL, MappingDesc::SHADOW, "shadow-1"},
63    {0x008200000000ULL, 0x00a000000000ULL, MappingDesc::ORIGIN, "origin-3"},
64    {0x00a000000000ULL, 0x00a200000000ULL, MappingDesc::ORIGIN, "origin-1"},
65    {0x00a200000000ULL, 0x00c000000000ULL, MappingDesc::APP, "app-2"},
66    {0x00c000000000ULL, 0x00e200000000ULL, MappingDesc::INVALID, "invalid"},
67    {0x00e200000000ULL, 0x00ffffffffffULL, MappingDesc::APP, "app-3"}};
68
69#define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x8000000000ULL)
70#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x2000000000ULL)
71
72#elif SANITIZER_LINUX && defined(__aarch64__)
73
74// The mapping assumes 48-bit VMA. AArch64 maps:
75// - 0x0000000000000-0x0100000000000: 39/42/48-bits program own segments
76// - 0x0a00000000000-0x0b00000000000: 48-bits PIE program segments
77//   Ideally, this would extend to 0x0c00000000000 (2^45 bytes - the
78//   maximum ASLR region for 48-bit VMA) but it is too hard to fit in
79//   the larger app/shadow/origin regions.
80// - 0x0e00000000000-0x1000000000000: 48-bits libraries segments
81const MappingDesc kMemoryLayout[] = {
82    {0X0000000000000, 0X0100000000000, MappingDesc::APP, "app-10-13"},
83    {0X0100000000000, 0X0200000000000, MappingDesc::SHADOW, "shadow-14"},
84    {0X0200000000000, 0X0300000000000, MappingDesc::INVALID, "invalid"},
85    {0X0300000000000, 0X0400000000000, MappingDesc::ORIGIN, "origin-14"},
86    {0X0400000000000, 0X0600000000000, MappingDesc::SHADOW, "shadow-15"},
87    {0X0600000000000, 0X0800000000000, MappingDesc::ORIGIN, "origin-15"},
88    {0X0800000000000, 0X0A00000000000, MappingDesc::INVALID, "invalid"},
89    {0X0A00000000000, 0X0B00000000000, MappingDesc::APP, "app-14"},
90    {0X0B00000000000, 0X0C00000000000, MappingDesc::SHADOW, "shadow-10-13"},
91    {0X0C00000000000, 0X0D00000000000, MappingDesc::INVALID, "invalid"},
92    {0X0D00000000000, 0X0E00000000000, MappingDesc::ORIGIN, "origin-10-13"},
93    {0x0E00000000000, 0x0E40000000000, MappingDesc::ALLOCATOR, "allocator"},
94    {0X0E40000000000, 0X1000000000000, MappingDesc::APP, "app-15"},
95};
96# define MEM_TO_SHADOW(mem) ((uptr)mem ^ 0xB00000000000ULL)
97# define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x200000000000ULL)
98
99#elif SANITIZER_LINUX && SANITIZER_LOONGARCH64
100// LoongArch64 maps:
101// - 0x000000000000-0x010000000000: Program own segments
102// - 0x555500000000-0x555600000000: PIE program segments
103// - 0x7fff00000000-0x7fffffffffff: libraries segments.
104const MappingDesc kMemoryLayout[] = {
105    {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app-1"},
106    {0x010000000000ULL, 0x100000000000ULL, MappingDesc::SHADOW, "shadow-2"},
107    {0x100000000000ULL, 0x110000000000ULL, MappingDesc::INVALID, "invalid"},
108    {0x110000000000ULL, 0x200000000000ULL, MappingDesc::ORIGIN, "origin-2"},
109    {0x200000000000ULL, 0x300000000000ULL, MappingDesc::SHADOW, "shadow-3"},
110    {0x300000000000ULL, 0x400000000000ULL, MappingDesc::ORIGIN, "origin-3"},
111    {0x400000000000ULL, 0x500000000000ULL, MappingDesc::INVALID, "invalid"},
112    {0x500000000000ULL, 0x510000000000ULL, MappingDesc::SHADOW, "shadow-1"},
113    {0x510000000000ULL, 0x600000000000ULL, MappingDesc::APP, "app-2"},
114    {0x600000000000ULL, 0x610000000000ULL, MappingDesc::ORIGIN, "origin-1"},
115    {0x610000000000ULL, 0x700000000000ULL, MappingDesc::INVALID, "invalid"},
116    {0x700000000000ULL, 0x740000000000ULL, MappingDesc::ALLOCATOR, "allocator"},
117    {0x740000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app-3"}};
118#  define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x500000000000ULL)
119#  define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x100000000000ULL)
120
121#elif SANITIZER_LINUX && SANITIZER_PPC64
122const MappingDesc kMemoryLayout[] = {
123    {0x000000000000ULL, 0x000200000000ULL, MappingDesc::APP, "low memory"},
124    {0x000200000000ULL, 0x080000000000ULL, MappingDesc::INVALID, "invalid"},
125    {0x080000000000ULL, 0x180200000000ULL, MappingDesc::SHADOW, "shadow"},
126    {0x180200000000ULL, 0x1C0000000000ULL, MappingDesc::INVALID, "invalid"},
127    {0x1C0000000000ULL, 0x2C0200000000ULL, MappingDesc::ORIGIN, "origin"},
128    {0x2C0200000000ULL, 0x300000000000ULL, MappingDesc::INVALID, "invalid"},
129    {0x300000000000ULL, 0x320000000000ULL, MappingDesc::ALLOCATOR, "allocator"},
130    {0x320000000000ULL, 0x800000000000ULL, MappingDesc::APP, "high memory"}};
131
132// Various kernels use different low end ranges but we can combine them into one
133// big range. They also use different high end ranges but we can map them all to
134// one range.
135// Maps low and high app ranges to contiguous space with zero base:
136//   Low:  0000 0000 0000 - 0001 ffff ffff  ->  1000 0000 0000 - 1001 ffff ffff
137//   High: 3000 0000 0000 - 3fff ffff ffff  ->  0000 0000 0000 - 0fff ffff ffff
138//   High: 4000 0000 0000 - 4fff ffff ffff  ->  0000 0000 0000 - 0fff ffff ffff
139//   High: 7000 0000 0000 - 7fff ffff ffff  ->  0000 0000 0000 - 0fff ffff ffff
140#define LINEARIZE_MEM(mem) \
141  (((uptr)(mem) & ~0xE00000000000ULL) ^ 0x100000000000ULL)
142#define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x080000000000ULL)
143#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x140000000000ULL)
144
145#elif SANITIZER_LINUX && SANITIZER_S390_64
146const MappingDesc kMemoryLayout[] = {
147    {0x000000000000ULL, 0x040000000000ULL, MappingDesc::APP, "low memory"},
148    {0x040000000000ULL, 0x080000000000ULL, MappingDesc::INVALID, "invalid"},
149    {0x080000000000ULL, 0x180000000000ULL, MappingDesc::SHADOW, "shadow"},
150    {0x180000000000ULL, 0x1C0000000000ULL, MappingDesc::INVALID, "invalid"},
151    {0x1C0000000000ULL, 0x2C0000000000ULL, MappingDesc::ORIGIN, "origin"},
152    {0x2C0000000000ULL, 0x440000000000ULL, MappingDesc::INVALID, "invalid"},
153    {0x440000000000ULL, 0x460000000000ULL, MappingDesc::ALLOCATOR, "allocator"},
154    {0x460000000000ULL, 0x500000000000ULL, MappingDesc::APP, "high memory"}};
155
156#define MEM_TO_SHADOW(mem) \
157  ((((uptr)(mem)) & ~0xC00000000000ULL) + 0x080000000000ULL)
158#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x140000000000ULL)
159
160#elif SANITIZER_FREEBSD && defined(__aarch64__)
161
162// Low memory: main binary, MAP_32BIT mappings and modules
163// High memory: heap, modules and main thread stack
164const MappingDesc kMemoryLayout[] = {
165    {0x000000000000ULL, 0x020000000000ULL, MappingDesc::APP, "low memory"},
166    {0x020000000000ULL, 0x200000000000ULL, MappingDesc::INVALID, "invalid"},
167    {0x200000000000ULL, 0x620000000000ULL, MappingDesc::SHADOW, "shadow"},
168    {0x620000000000ULL, 0x700000000000ULL, MappingDesc::INVALID, "invalid"},
169    {0x700000000000ULL, 0xb20000000000ULL, MappingDesc::ORIGIN, "origin"},
170    {0xb20000000000ULL, 0xc00000000000ULL, MappingDesc::INVALID, "invalid"},
171    {0xc00000000000ULL, 0x1000000000000ULL, MappingDesc::APP, "high memory"}};
172
173// Maps low and high app ranges to contiguous space with zero base:
174//   Low:  0000 0000 0000 - 01ff ffff ffff -> 4000 0000 0000 - 41ff ffff ffff
175//   High: c000 0000 0000 - ffff ffff ffff -> 0000 0000 0000 - 3fff ffff ffff
176#define LINEARIZE_MEM(mem) \
177  (((uptr)(mem) & ~0x1800000000000ULL) ^ 0x400000000000ULL)
178#define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x200000000000ULL)
179#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x500000000000)
180
181#elif SANITIZER_FREEBSD && SANITIZER_WORDSIZE == 64
182
183// Low memory: main binary, MAP_32BIT mappings and modules
184// High memory: heap, modules and main thread stack
185const MappingDesc kMemoryLayout[] = {
186    {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "low memory"},
187    {0x010000000000ULL, 0x100000000000ULL, MappingDesc::INVALID, "invalid"},
188    {0x100000000000ULL, 0x310000000000ULL, MappingDesc::SHADOW, "shadow"},
189    {0x310000000000ULL, 0x380000000000ULL, MappingDesc::INVALID, "invalid"},
190    {0x380000000000ULL, 0x590000000000ULL, MappingDesc::ORIGIN, "origin"},
191    {0x590000000000ULL, 0x600000000000ULL, MappingDesc::INVALID, "invalid"},
192    {0x600000000000ULL, 0x800000000000ULL, MappingDesc::APP, "high memory"}};
193
194// Maps low and high app ranges to contiguous space with zero base:
195//   Low:  0000 0000 0000 - 00ff ffff ffff  ->  2000 0000 0000 - 20ff ffff ffff
196//   High: 6000 0000 0000 - 7fff ffff ffff  ->  0000 0000 0000 - 1fff ffff ffff
197#define LINEARIZE_MEM(mem) \
198  (((uptr)(mem) & ~0xc00000000000ULL) ^ 0x200000000000ULL)
199#define MEM_TO_SHADOW(mem) (LINEARIZE_MEM((mem)) + 0x100000000000ULL)
200#define SHADOW_TO_ORIGIN(shadow) (((uptr)(shadow)) + 0x280000000000)
201
202#elif SANITIZER_NETBSD || (SANITIZER_LINUX && SANITIZER_WORDSIZE == 64)
203
204// All of the following configurations are supported.
205// ASLR disabled: main executable and DSOs at 0x555550000000
206// PIE and ASLR: main executable and DSOs at 0x7f0000000000
207// non-PIE: main executable below 0x100000000, DSOs at 0x7f0000000000
208// Heap at 0x700000000000.
209const MappingDesc kMemoryLayout[] = {
210    {0x000000000000ULL, 0x010000000000ULL, MappingDesc::APP, "app-1"},
211    {0x010000000000ULL, 0x100000000000ULL, MappingDesc::SHADOW, "shadow-2"},
212    {0x100000000000ULL, 0x110000000000ULL, MappingDesc::INVALID, "invalid"},
213    {0x110000000000ULL, 0x200000000000ULL, MappingDesc::ORIGIN, "origin-2"},
214    {0x200000000000ULL, 0x300000000000ULL, MappingDesc::SHADOW, "shadow-3"},
215    {0x300000000000ULL, 0x400000000000ULL, MappingDesc::ORIGIN, "origin-3"},
216    {0x400000000000ULL, 0x500000000000ULL, MappingDesc::INVALID, "invalid"},
217    {0x500000000000ULL, 0x510000000000ULL, MappingDesc::SHADOW, "shadow-1"},
218    {0x510000000000ULL, 0x600000000000ULL, MappingDesc::APP, "app-2"},
219    {0x600000000000ULL, 0x610000000000ULL, MappingDesc::ORIGIN, "origin-1"},
220    {0x610000000000ULL, 0x700000000000ULL, MappingDesc::INVALID, "invalid"},
221    {0x700000000000ULL, 0x740000000000ULL, MappingDesc::ALLOCATOR, "allocator"},
222    {0x740000000000ULL, 0x800000000000ULL, MappingDesc::APP, "app-3"}};
223#define MEM_TO_SHADOW(mem) (((uptr)(mem)) ^ 0x500000000000ULL)
224#define SHADOW_TO_ORIGIN(mem) (((uptr)(mem)) + 0x100000000000ULL)
225
226#else
227#error "Unsupported platform"
228#endif
229
230const uptr kMemoryLayoutSize = sizeof(kMemoryLayout) / sizeof(kMemoryLayout[0]);
231
232#define MEM_TO_ORIGIN(mem) (SHADOW_TO_ORIGIN(MEM_TO_SHADOW((mem))))
233
234#ifndef __clang__
235__attribute__((optimize("unroll-loops")))
236#endif
237inline bool
238addr_is_type(uptr addr, int mapping_types) {
239// It is critical for performance that this loop is unrolled (because then it is
240// simplified into just a few constant comparisons).
241#ifdef __clang__
242#pragma unroll
243#endif
244  for (unsigned i = 0; i < kMemoryLayoutSize; ++i)
245    if ((kMemoryLayout[i].type & mapping_types) &&
246        addr >= kMemoryLayout[i].start && addr < kMemoryLayout[i].end)
247      return true;
248  return false;
249}
250
251#define MEM_IS_APP(mem) \
252  (addr_is_type((uptr)(mem), MappingDesc::APP | MappingDesc::ALLOCATOR))
253#define MEM_IS_SHADOW(mem) addr_is_type((uptr)(mem), MappingDesc::SHADOW)
254#define MEM_IS_ORIGIN(mem) addr_is_type((uptr)(mem), MappingDesc::ORIGIN)
255
256// These constants must be kept in sync with the ones in MemorySanitizer.cpp.
257const int kMsanParamTlsSize = 800;
258const int kMsanRetvalTlsSize = 800;
259
260namespace __msan {
261extern int msan_inited;
262extern bool msan_init_is_running;
263extern int msan_report_count;
264
265bool ProtectRange(uptr beg, uptr end);
266bool InitShadowWithReExec(bool init_origins);
267char *GetProcSelfMaps();
268void InitializeInterceptors();
269
270void MsanAllocatorInit();
271void MsanDeallocate(BufferedStackTrace *stack, void *ptr);
272
273void *msan_malloc(uptr size, BufferedStackTrace *stack);
274void *msan_calloc(uptr nmemb, uptr size, BufferedStackTrace *stack);
275void *msan_realloc(void *ptr, uptr size, BufferedStackTrace *stack);
276void *msan_reallocarray(void *ptr, uptr nmemb, uptr size,
277                        BufferedStackTrace *stack);
278void *msan_valloc(uptr size, BufferedStackTrace *stack);
279void *msan_pvalloc(uptr size, BufferedStackTrace *stack);
280void *msan_aligned_alloc(uptr alignment, uptr size, BufferedStackTrace *stack);
281void *msan_memalign(uptr alignment, uptr size, BufferedStackTrace *stack);
282int msan_posix_memalign(void **memptr, uptr alignment, uptr size,
283                        BufferedStackTrace *stack);
284
285void InstallTrapHandler();
286void InstallAtExitHandler();
287
288const char *GetStackOriginDescr(u32 id, uptr *pc);
289
290bool IsInSymbolizerOrUnwider();
291
292void PrintWarning(uptr pc, uptr bp);
293void PrintWarningWithOrigin(uptr pc, uptr bp, u32 origin);
294
295// Unpoison first n function arguments.
296void UnpoisonParam(uptr n);
297void UnpoisonThreadLocalState();
298
299// Returns a "chained" origin id, pointing to the given stack trace followed by
300// the previous origin id.
301u32 ChainOrigin(u32 id, StackTrace *stack);
302
303const int STACK_TRACE_TAG_POISON = StackTrace::TAG_CUSTOM + 1;
304const int STACK_TRACE_TAG_FIELDS = STACK_TRACE_TAG_POISON + 1;
305const int STACK_TRACE_TAG_VPTR = STACK_TRACE_TAG_FIELDS + 1;
306
307#define GET_MALLOC_STACK_TRACE                                             \
308  UNINITIALIZED BufferedStackTrace stack;                                  \
309  if (__msan_get_track_origins() && msan_inited) {                         \
310    stack.Unwind(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME(), nullptr, \
311                 common_flags()->fast_unwind_on_malloc,                    \
312                 common_flags()->malloc_context_size);                     \
313  }
314
315// For platforms which support slow unwinder only, we restrict the store context
316// size to 1, basically only storing the current pc. We do this because the slow
317// unwinder which is based on libunwind is not async signal safe and causes
318// random freezes in forking applications as well as in signal handlers.
319#define GET_STORE_STACK_TRACE_PC_BP(pc, bp)                              \
320  UNINITIALIZED BufferedStackTrace stack;                                \
321  if (__msan_get_track_origins() > 1 && msan_inited) {                   \
322    int size = flags()->store_context_size;                              \
323    if (!SANITIZER_CAN_FAST_UNWIND)                                      \
324      size = Min(size, 1);                                               \
325    stack.Unwind(pc, bp, nullptr, common_flags()->fast_unwind_on_malloc, \
326                 size);                                                  \
327  }
328
329#define GET_STORE_STACK_TRACE \
330  GET_STORE_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())
331
332#define GET_FATAL_STACK_TRACE_PC_BP(pc, bp)                              \
333  UNINITIALIZED BufferedStackTrace stack;                                \
334  if (msan_inited) {                                                     \
335    stack.Unwind(pc, bp, nullptr, common_flags()->fast_unwind_on_fatal); \
336  }
337
338#define GET_FATAL_STACK_TRACE \
339  GET_FATAL_STACK_TRACE_PC_BP(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME())
340
341// Unwind the stack for fatal error, as the parameter `stack` is
342// empty without origins.
343#define GET_FATAL_STACK_TRACE_IF_EMPTY(STACK)                                 \
344  if (msan_inited && (STACK)->size == 0) {                                    \
345    (STACK)->Unwind(StackTrace::GetCurrentPc(), GET_CURRENT_FRAME(), nullptr, \
346                    common_flags()->fast_unwind_on_fatal);                    \
347  }
348
349class ScopedThreadLocalStateBackup {
350 public:
351  ScopedThreadLocalStateBackup() { Backup(); }
352  ~ScopedThreadLocalStateBackup() { Restore(); }
353  void Backup();
354  void Restore();
355 private:
356  u64 va_arg_overflow_size_tls;
357};
358
359void MsanTSDInit(void (*destructor)(void *tsd));
360void *MsanTSDGet();
361void MsanTSDSet(void *tsd);
362void MsanTSDDtor(void *tsd);
363
364void InstallAtForkHandler();
365
366}  // namespace __msan
367
368#endif  // MSAN_H
369