1//===-- asan_malloc_linux.cc ----------------------------------------------===// 2// 3// This file is distributed under the University of Illinois Open Source 4// License. See LICENSE.TXT for details. 5// 6//===----------------------------------------------------------------------===// 7// 8// This file is a part of AddressSanitizer, an address sanity checker. 9// 10// Linux-specific malloc interception. 11// We simply define functions like malloc, free, realloc, etc. 12// They will replace the corresponding libc functions automagically. 13//===----------------------------------------------------------------------===// 14 15#include "sanitizer_common/sanitizer_platform.h" 16#if SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX || \ 17 SANITIZER_NETBSD || SANITIZER_RTEMS || SANITIZER_SOLARIS 18 19#include "sanitizer_common/sanitizer_allocator_checks.h" 20#include "sanitizer_common/sanitizer_errno.h" 21#include "sanitizer_common/sanitizer_tls_get_addr.h" 22#include "asan_allocator.h" 23#include "asan_interceptors.h" 24#include "asan_internal.h" 25#include "asan_malloc_local.h" 26#include "asan_stack.h" 27 28// ---------------------- Replacement functions ---------------- {{{1 29using namespace __asan; // NOLINT 30 31static uptr allocated_for_dlsym; 32static uptr last_dlsym_alloc_size_in_words; 33static const uptr kDlsymAllocPoolSize = SANITIZER_RTEMS ? 4096 : 1024; 34static uptr alloc_memory_for_dlsym[kDlsymAllocPoolSize]; 35 36static INLINE bool IsInDlsymAllocPool(const void *ptr) { 37 uptr off = (uptr)ptr - (uptr)alloc_memory_for_dlsym; 38 return off < allocated_for_dlsym * sizeof(alloc_memory_for_dlsym[0]); 39} 40 41static void *AllocateFromLocalPool(uptr size_in_bytes) { 42 uptr size_in_words = RoundUpTo(size_in_bytes, kWordSize) / kWordSize; 43 void *mem = (void*)&alloc_memory_for_dlsym[allocated_for_dlsym]; 44 last_dlsym_alloc_size_in_words = size_in_words; 45 allocated_for_dlsym += size_in_words; 46 CHECK_LT(allocated_for_dlsym, kDlsymAllocPoolSize); 47 return mem; 48} 49 50static void DeallocateFromLocalPool(const void *ptr) { 51 // Hack: since glibc 2.27 dlsym no longer uses stack-allocated memory to store 52 // error messages and instead uses malloc followed by free. To avoid pool 53 // exhaustion due to long object filenames, handle that special case here. 54 uptr prev_offset = allocated_for_dlsym - last_dlsym_alloc_size_in_words; 55 void *prev_mem = (void*)&alloc_memory_for_dlsym[prev_offset]; 56 if (prev_mem == ptr) { 57 REAL(memset)(prev_mem, 0, last_dlsym_alloc_size_in_words * kWordSize); 58 allocated_for_dlsym = prev_offset; 59 last_dlsym_alloc_size_in_words = 0; 60 } 61} 62 63static int PosixMemalignFromLocalPool(void **memptr, uptr alignment, 64 uptr size_in_bytes) { 65 if (UNLIKELY(!CheckPosixMemalignAlignment(alignment))) 66 return errno_EINVAL; 67 68 CHECK(alignment >= kWordSize); 69 70 uptr addr = (uptr)&alloc_memory_for_dlsym[allocated_for_dlsym]; 71 uptr aligned_addr = RoundUpTo(addr, alignment); 72 uptr aligned_size = RoundUpTo(size_in_bytes, kWordSize); 73 74 uptr *end_mem = (uptr*)(aligned_addr + aligned_size); 75 uptr allocated = end_mem - alloc_memory_for_dlsym; 76 if (allocated >= kDlsymAllocPoolSize) 77 return errno_ENOMEM; 78 79 allocated_for_dlsym = allocated; 80 *memptr = (void*)aligned_addr; 81 return 0; 82} 83 84#if SANITIZER_RTEMS 85void* MemalignFromLocalPool(uptr alignment, uptr size) { 86 void *ptr = nullptr; 87 alignment = Max(alignment, kWordSize); 88 PosixMemalignFromLocalPool(&ptr, alignment, size); 89 return ptr; 90} 91 92bool IsFromLocalPool(const void *ptr) { 93 return IsInDlsymAllocPool(ptr); 94} 95#endif 96 97static INLINE bool MaybeInDlsym() { 98 // Fuchsia doesn't use dlsym-based interceptors. 99 return !SANITIZER_FUCHSIA && asan_init_is_running; 100} 101 102static INLINE bool UseLocalPool() { 103 return EarlyMalloc() || MaybeInDlsym(); 104} 105 106static void *ReallocFromLocalPool(void *ptr, uptr size) { 107 const uptr offset = (uptr)ptr - (uptr)alloc_memory_for_dlsym; 108 const uptr copy_size = Min(size, kDlsymAllocPoolSize - offset); 109 void *new_ptr; 110 if (UNLIKELY(UseLocalPool())) { 111 new_ptr = AllocateFromLocalPool(size); 112 } else { 113 ENSURE_ASAN_INITED(); 114 GET_STACK_TRACE_MALLOC; 115 new_ptr = asan_malloc(size, &stack); 116 } 117 internal_memcpy(new_ptr, ptr, copy_size); 118 return new_ptr; 119} 120 121INTERCEPTOR(void, free, void *ptr) { 122 GET_STACK_TRACE_FREE; 123 if (UNLIKELY(IsInDlsymAllocPool(ptr))) { 124 DeallocateFromLocalPool(ptr); 125 return; 126 } 127 asan_free(ptr, &stack, FROM_MALLOC); 128} 129 130#if SANITIZER_INTERCEPT_CFREE 131INTERCEPTOR(void, cfree, void *ptr) { 132 GET_STACK_TRACE_FREE; 133 if (UNLIKELY(IsInDlsymAllocPool(ptr))) 134 return; 135 asan_free(ptr, &stack, FROM_MALLOC); 136} 137#endif // SANITIZER_INTERCEPT_CFREE 138 139INTERCEPTOR(void*, malloc, uptr size) { 140 if (UNLIKELY(UseLocalPool())) 141 // Hack: dlsym calls malloc before REAL(malloc) is retrieved from dlsym. 142 return AllocateFromLocalPool(size); 143 ENSURE_ASAN_INITED(); 144 GET_STACK_TRACE_MALLOC; 145 return asan_malloc(size, &stack); 146} 147 148INTERCEPTOR(void*, calloc, uptr nmemb, uptr size) { 149 if (UNLIKELY(UseLocalPool())) 150 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym. 151 return AllocateFromLocalPool(nmemb * size); 152 ENSURE_ASAN_INITED(); 153 GET_STACK_TRACE_MALLOC; 154 return asan_calloc(nmemb, size, &stack); 155} 156 157INTERCEPTOR(void*, realloc, void *ptr, uptr size) { 158 if (UNLIKELY(IsInDlsymAllocPool(ptr))) 159 return ReallocFromLocalPool(ptr, size); 160 if (UNLIKELY(UseLocalPool())) 161 return AllocateFromLocalPool(size); 162 ENSURE_ASAN_INITED(); 163 GET_STACK_TRACE_MALLOC; 164 return asan_realloc(ptr, size, &stack); 165} 166 167#if SANITIZER_INTERCEPT_MEMALIGN 168INTERCEPTOR(void*, memalign, uptr boundary, uptr size) { 169 GET_STACK_TRACE_MALLOC; 170 return asan_memalign(boundary, size, &stack, FROM_MALLOC); 171} 172 173INTERCEPTOR(void*, __libc_memalign, uptr boundary, uptr size) { 174 GET_STACK_TRACE_MALLOC; 175 void *res = asan_memalign(boundary, size, &stack, FROM_MALLOC); 176 DTLS_on_libc_memalign(res, size); 177 return res; 178} 179#endif // SANITIZER_INTERCEPT_MEMALIGN 180 181#if SANITIZER_INTERCEPT_ALIGNED_ALLOC 182INTERCEPTOR(void*, aligned_alloc, uptr boundary, uptr size) { 183 GET_STACK_TRACE_MALLOC; 184 return asan_aligned_alloc(boundary, size, &stack); 185} 186#endif // SANITIZER_INTERCEPT_ALIGNED_ALLOC 187 188INTERCEPTOR(uptr, malloc_usable_size, void *ptr) { 189 GET_CURRENT_PC_BP_SP; 190 (void)sp; 191 return asan_malloc_usable_size(ptr, pc, bp); 192} 193 194#if SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO 195// We avoid including malloc.h for portability reasons. 196// man mallinfo says the fields are "long", but the implementation uses int. 197// It doesn't matter much -- we just need to make sure that the libc's mallinfo 198// is not called. 199struct fake_mallinfo { 200 int x[10]; 201}; 202 203INTERCEPTOR(struct fake_mallinfo, mallinfo, void) { 204 struct fake_mallinfo res; 205 REAL(memset)(&res, 0, sizeof(res)); 206 return res; 207} 208 209INTERCEPTOR(int, mallopt, int cmd, int value) { 210 return -1; 211} 212#endif // SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO 213 214INTERCEPTOR(int, posix_memalign, void **memptr, uptr alignment, uptr size) { 215 if (UNLIKELY(UseLocalPool())) 216 return PosixMemalignFromLocalPool(memptr, alignment, size); 217 GET_STACK_TRACE_MALLOC; 218 return asan_posix_memalign(memptr, alignment, size, &stack); 219} 220 221INTERCEPTOR(void*, valloc, uptr size) { 222 GET_STACK_TRACE_MALLOC; 223 return asan_valloc(size, &stack); 224} 225 226#if SANITIZER_INTERCEPT_PVALLOC 227INTERCEPTOR(void*, pvalloc, uptr size) { 228 GET_STACK_TRACE_MALLOC; 229 return asan_pvalloc(size, &stack); 230} 231#endif // SANITIZER_INTERCEPT_PVALLOC 232 233INTERCEPTOR(void, malloc_stats, void) { 234 __asan_print_accumulated_stats(); 235} 236 237#if SANITIZER_ANDROID 238// Format of __libc_malloc_dispatch has changed in Android L. 239// While we are moving towards a solution that does not depend on bionic 240// internals, here is something to support both K* and L releases. 241struct MallocDebugK { 242 void *(*malloc)(uptr bytes); 243 void (*free)(void *mem); 244 void *(*calloc)(uptr n_elements, uptr elem_size); 245 void *(*realloc)(void *oldMem, uptr bytes); 246 void *(*memalign)(uptr alignment, uptr bytes); 247 uptr (*malloc_usable_size)(void *mem); 248}; 249 250struct MallocDebugL { 251 void *(*calloc)(uptr n_elements, uptr elem_size); 252 void (*free)(void *mem); 253 fake_mallinfo (*mallinfo)(void); 254 void *(*malloc)(uptr bytes); 255 uptr (*malloc_usable_size)(void *mem); 256 void *(*memalign)(uptr alignment, uptr bytes); 257 int (*posix_memalign)(void **memptr, uptr alignment, uptr size); 258 void* (*pvalloc)(uptr size); 259 void *(*realloc)(void *oldMem, uptr bytes); 260 void* (*valloc)(uptr size); 261}; 262 263ALIGNED(32) const MallocDebugK asan_malloc_dispatch_k = { 264 WRAP(malloc), WRAP(free), WRAP(calloc), 265 WRAP(realloc), WRAP(memalign), WRAP(malloc_usable_size)}; 266 267ALIGNED(32) const MallocDebugL asan_malloc_dispatch_l = { 268 WRAP(calloc), WRAP(free), WRAP(mallinfo), 269 WRAP(malloc), WRAP(malloc_usable_size), WRAP(memalign), 270 WRAP(posix_memalign), WRAP(pvalloc), WRAP(realloc), 271 WRAP(valloc)}; 272 273namespace __asan { 274void ReplaceSystemMalloc() { 275 void **__libc_malloc_dispatch_p = 276 (void **)AsanDlSymNext("__libc_malloc_dispatch"); 277 if (__libc_malloc_dispatch_p) { 278 // Decide on K vs L dispatch format by the presence of 279 // __libc_malloc_default_dispatch export in libc. 280 void *default_dispatch_p = AsanDlSymNext("__libc_malloc_default_dispatch"); 281 if (default_dispatch_p) 282 *__libc_malloc_dispatch_p = (void *)&asan_malloc_dispatch_k; 283 else 284 *__libc_malloc_dispatch_p = (void *)&asan_malloc_dispatch_l; 285 } 286} 287} // namespace __asan 288 289#else // SANITIZER_ANDROID 290 291namespace __asan { 292void ReplaceSystemMalloc() { 293} 294} // namespace __asan 295#endif // SANITIZER_ANDROID 296 297#endif // SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX || 298 // SANITIZER_NETBSD || SANITIZER_SOLARIS 299