1//===-- asan_malloc_linux.cc ----------------------------------------------===//
2//
3// This file is distributed under the University of Illinois Open Source
4// License. See LICENSE.TXT for details.
5//
6//===----------------------------------------------------------------------===//
7//
8// This file is a part of AddressSanitizer, an address sanity checker.
9//
10// Linux-specific malloc interception.
11// We simply define functions like malloc, free, realloc, etc.
12// They will replace the corresponding libc functions automagically.
13//===----------------------------------------------------------------------===//
14
15#include "sanitizer_common/sanitizer_platform.h"
16#if SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX || \
17    SANITIZER_NETBSD || SANITIZER_RTEMS || SANITIZER_SOLARIS
18
19#include "sanitizer_common/sanitizer_allocator_checks.h"
20#include "sanitizer_common/sanitizer_errno.h"
21#include "sanitizer_common/sanitizer_tls_get_addr.h"
22#include "asan_allocator.h"
23#include "asan_interceptors.h"
24#include "asan_internal.h"
25#include "asan_malloc_local.h"
26#include "asan_stack.h"
27
28// ---------------------- Replacement functions ---------------- {{{1
29using namespace __asan;  // NOLINT
30
31static uptr allocated_for_dlsym;
32static uptr last_dlsym_alloc_size_in_words;
33static const uptr kDlsymAllocPoolSize = SANITIZER_RTEMS ? 4096 : 1024;
34static uptr alloc_memory_for_dlsym[kDlsymAllocPoolSize];
35
36static INLINE bool IsInDlsymAllocPool(const void *ptr) {
37  uptr off = (uptr)ptr - (uptr)alloc_memory_for_dlsym;
38  return off < allocated_for_dlsym * sizeof(alloc_memory_for_dlsym[0]);
39}
40
41static void *AllocateFromLocalPool(uptr size_in_bytes) {
42  uptr size_in_words = RoundUpTo(size_in_bytes, kWordSize) / kWordSize;
43  void *mem = (void*)&alloc_memory_for_dlsym[allocated_for_dlsym];
44  last_dlsym_alloc_size_in_words = size_in_words;
45  allocated_for_dlsym += size_in_words;
46  CHECK_LT(allocated_for_dlsym, kDlsymAllocPoolSize);
47  return mem;
48}
49
50static void DeallocateFromLocalPool(const void *ptr) {
51  // Hack: since glibc 2.27 dlsym no longer uses stack-allocated memory to store
52  // error messages and instead uses malloc followed by free. To avoid pool
53  // exhaustion due to long object filenames, handle that special case here.
54  uptr prev_offset = allocated_for_dlsym - last_dlsym_alloc_size_in_words;
55  void *prev_mem = (void*)&alloc_memory_for_dlsym[prev_offset];
56  if (prev_mem == ptr) {
57    REAL(memset)(prev_mem, 0, last_dlsym_alloc_size_in_words * kWordSize);
58    allocated_for_dlsym = prev_offset;
59    last_dlsym_alloc_size_in_words = 0;
60  }
61}
62
63static int PosixMemalignFromLocalPool(void **memptr, uptr alignment,
64                                      uptr size_in_bytes) {
65  if (UNLIKELY(!CheckPosixMemalignAlignment(alignment)))
66    return errno_EINVAL;
67
68  CHECK(alignment >= kWordSize);
69
70  uptr addr = (uptr)&alloc_memory_for_dlsym[allocated_for_dlsym];
71  uptr aligned_addr = RoundUpTo(addr, alignment);
72  uptr aligned_size = RoundUpTo(size_in_bytes, kWordSize);
73
74  uptr *end_mem = (uptr*)(aligned_addr + aligned_size);
75  uptr allocated = end_mem - alloc_memory_for_dlsym;
76  if (allocated >= kDlsymAllocPoolSize)
77    return errno_ENOMEM;
78
79  allocated_for_dlsym = allocated;
80  *memptr = (void*)aligned_addr;
81  return 0;
82}
83
84#if SANITIZER_RTEMS
85void* MemalignFromLocalPool(uptr alignment, uptr size) {
86  void *ptr = nullptr;
87  alignment = Max(alignment, kWordSize);
88  PosixMemalignFromLocalPool(&ptr, alignment, size);
89  return ptr;
90}
91
92bool IsFromLocalPool(const void *ptr) {
93  return IsInDlsymAllocPool(ptr);
94}
95#endif
96
97static INLINE bool MaybeInDlsym() {
98  // Fuchsia doesn't use dlsym-based interceptors.
99  return !SANITIZER_FUCHSIA && asan_init_is_running;
100}
101
102static INLINE bool UseLocalPool() {
103  return EarlyMalloc() || MaybeInDlsym();
104}
105
106static void *ReallocFromLocalPool(void *ptr, uptr size) {
107  const uptr offset = (uptr)ptr - (uptr)alloc_memory_for_dlsym;
108  const uptr copy_size = Min(size, kDlsymAllocPoolSize - offset);
109  void *new_ptr;
110  if (UNLIKELY(UseLocalPool())) {
111    new_ptr = AllocateFromLocalPool(size);
112  } else {
113    ENSURE_ASAN_INITED();
114    GET_STACK_TRACE_MALLOC;
115    new_ptr = asan_malloc(size, &stack);
116  }
117  internal_memcpy(new_ptr, ptr, copy_size);
118  return new_ptr;
119}
120
121INTERCEPTOR(void, free, void *ptr) {
122  GET_STACK_TRACE_FREE;
123  if (UNLIKELY(IsInDlsymAllocPool(ptr))) {
124    DeallocateFromLocalPool(ptr);
125    return;
126  }
127  asan_free(ptr, &stack, FROM_MALLOC);
128}
129
130#if SANITIZER_INTERCEPT_CFREE
131INTERCEPTOR(void, cfree, void *ptr) {
132  GET_STACK_TRACE_FREE;
133  if (UNLIKELY(IsInDlsymAllocPool(ptr)))
134    return;
135  asan_free(ptr, &stack, FROM_MALLOC);
136}
137#endif // SANITIZER_INTERCEPT_CFREE
138
139INTERCEPTOR(void*, malloc, uptr size) {
140  if (UNLIKELY(UseLocalPool()))
141    // Hack: dlsym calls malloc before REAL(malloc) is retrieved from dlsym.
142    return AllocateFromLocalPool(size);
143  ENSURE_ASAN_INITED();
144  GET_STACK_TRACE_MALLOC;
145  return asan_malloc(size, &stack);
146}
147
148INTERCEPTOR(void*, calloc, uptr nmemb, uptr size) {
149  if (UNLIKELY(UseLocalPool()))
150    // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym.
151    return AllocateFromLocalPool(nmemb * size);
152  ENSURE_ASAN_INITED();
153  GET_STACK_TRACE_MALLOC;
154  return asan_calloc(nmemb, size, &stack);
155}
156
157INTERCEPTOR(void*, realloc, void *ptr, uptr size) {
158  if (UNLIKELY(IsInDlsymAllocPool(ptr)))
159    return ReallocFromLocalPool(ptr, size);
160  if (UNLIKELY(UseLocalPool()))
161    return AllocateFromLocalPool(size);
162  ENSURE_ASAN_INITED();
163  GET_STACK_TRACE_MALLOC;
164  return asan_realloc(ptr, size, &stack);
165}
166
167#if SANITIZER_INTERCEPT_MEMALIGN
168INTERCEPTOR(void*, memalign, uptr boundary, uptr size) {
169  GET_STACK_TRACE_MALLOC;
170  return asan_memalign(boundary, size, &stack, FROM_MALLOC);
171}
172
173INTERCEPTOR(void*, __libc_memalign, uptr boundary, uptr size) {
174  GET_STACK_TRACE_MALLOC;
175  void *res = asan_memalign(boundary, size, &stack, FROM_MALLOC);
176  DTLS_on_libc_memalign(res, size);
177  return res;
178}
179#endif // SANITIZER_INTERCEPT_MEMALIGN
180
181#if SANITIZER_INTERCEPT_ALIGNED_ALLOC
182INTERCEPTOR(void*, aligned_alloc, uptr boundary, uptr size) {
183  GET_STACK_TRACE_MALLOC;
184  return asan_aligned_alloc(boundary, size, &stack);
185}
186#endif // SANITIZER_INTERCEPT_ALIGNED_ALLOC
187
188INTERCEPTOR(uptr, malloc_usable_size, void *ptr) {
189  GET_CURRENT_PC_BP_SP;
190  (void)sp;
191  return asan_malloc_usable_size(ptr, pc, bp);
192}
193
194#if SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO
195// We avoid including malloc.h for portability reasons.
196// man mallinfo says the fields are "long", but the implementation uses int.
197// It doesn't matter much -- we just need to make sure that the libc's mallinfo
198// is not called.
199struct fake_mallinfo {
200  int x[10];
201};
202
203INTERCEPTOR(struct fake_mallinfo, mallinfo, void) {
204  struct fake_mallinfo res;
205  REAL(memset)(&res, 0, sizeof(res));
206  return res;
207}
208
209INTERCEPTOR(int, mallopt, int cmd, int value) {
210  return -1;
211}
212#endif // SANITIZER_INTERCEPT_MALLOPT_AND_MALLINFO
213
214INTERCEPTOR(int, posix_memalign, void **memptr, uptr alignment, uptr size) {
215  if (UNLIKELY(UseLocalPool()))
216    return PosixMemalignFromLocalPool(memptr, alignment, size);
217  GET_STACK_TRACE_MALLOC;
218  return asan_posix_memalign(memptr, alignment, size, &stack);
219}
220
221INTERCEPTOR(void*, valloc, uptr size) {
222  GET_STACK_TRACE_MALLOC;
223  return asan_valloc(size, &stack);
224}
225
226#if SANITIZER_INTERCEPT_PVALLOC
227INTERCEPTOR(void*, pvalloc, uptr size) {
228  GET_STACK_TRACE_MALLOC;
229  return asan_pvalloc(size, &stack);
230}
231#endif // SANITIZER_INTERCEPT_PVALLOC
232
233INTERCEPTOR(void, malloc_stats, void) {
234  __asan_print_accumulated_stats();
235}
236
237#if SANITIZER_ANDROID
238// Format of __libc_malloc_dispatch has changed in Android L.
239// While we are moving towards a solution that does not depend on bionic
240// internals, here is something to support both K* and L releases.
241struct MallocDebugK {
242  void *(*malloc)(uptr bytes);
243  void (*free)(void *mem);
244  void *(*calloc)(uptr n_elements, uptr elem_size);
245  void *(*realloc)(void *oldMem, uptr bytes);
246  void *(*memalign)(uptr alignment, uptr bytes);
247  uptr (*malloc_usable_size)(void *mem);
248};
249
250struct MallocDebugL {
251  void *(*calloc)(uptr n_elements, uptr elem_size);
252  void (*free)(void *mem);
253  fake_mallinfo (*mallinfo)(void);
254  void *(*malloc)(uptr bytes);
255  uptr (*malloc_usable_size)(void *mem);
256  void *(*memalign)(uptr alignment, uptr bytes);
257  int (*posix_memalign)(void **memptr, uptr alignment, uptr size);
258  void* (*pvalloc)(uptr size);
259  void *(*realloc)(void *oldMem, uptr bytes);
260  void* (*valloc)(uptr size);
261};
262
263ALIGNED(32) const MallocDebugK asan_malloc_dispatch_k = {
264    WRAP(malloc),  WRAP(free),     WRAP(calloc),
265    WRAP(realloc), WRAP(memalign), WRAP(malloc_usable_size)};
266
267ALIGNED(32) const MallocDebugL asan_malloc_dispatch_l = {
268    WRAP(calloc),         WRAP(free),               WRAP(mallinfo),
269    WRAP(malloc),         WRAP(malloc_usable_size), WRAP(memalign),
270    WRAP(posix_memalign), WRAP(pvalloc),            WRAP(realloc),
271    WRAP(valloc)};
272
273namespace __asan {
274void ReplaceSystemMalloc() {
275  void **__libc_malloc_dispatch_p =
276      (void **)AsanDlSymNext("__libc_malloc_dispatch");
277  if (__libc_malloc_dispatch_p) {
278    // Decide on K vs L dispatch format by the presence of
279    // __libc_malloc_default_dispatch export in libc.
280    void *default_dispatch_p = AsanDlSymNext("__libc_malloc_default_dispatch");
281    if (default_dispatch_p)
282      *__libc_malloc_dispatch_p = (void *)&asan_malloc_dispatch_k;
283    else
284      *__libc_malloc_dispatch_p = (void *)&asan_malloc_dispatch_l;
285  }
286}
287}  // namespace __asan
288
289#else  // SANITIZER_ANDROID
290
291namespace __asan {
292void ReplaceSystemMalloc() {
293}
294}  // namespace __asan
295#endif  // SANITIZER_ANDROID
296
297#endif  // SANITIZER_FREEBSD || SANITIZER_FUCHSIA || SANITIZER_LINUX ||
298        // SANITIZER_NETBSD || SANITIZER_SOLARIS
299