1//=-- lsan_common_mac.cc --------------------------------------------------===//
2//
3// This file is distributed under the University of Illinois Open Source
4// License. See LICENSE.TXT for details.
5//
6//===----------------------------------------------------------------------===//
7//
8// This file is a part of LeakSanitizer.
9// Implementation of common leak checking functionality. Darwin-specific code.
10//
11//===----------------------------------------------------------------------===//
12
13#include "sanitizer_common/sanitizer_platform.h"
14#include "lsan_common.h"
15
16#if CAN_SANITIZE_LEAKS && SANITIZER_MAC
17
18#include "sanitizer_common/sanitizer_allocator_internal.h"
19#include "lsan_allocator.h"
20
21#include <pthread.h>
22
23#include <mach/mach.h>
24
25// Only introduced in Mac OS X 10.9.
26#ifdef VM_MEMORY_OS_ALLOC_ONCE
27static const int kSanitizerVmMemoryOsAllocOnce = VM_MEMORY_OS_ALLOC_ONCE;
28#else
29static const int kSanitizerVmMemoryOsAllocOnce = 73;
30#endif
31
32namespace __lsan {
33
34typedef struct {
35  int disable_counter;
36  u32 current_thread_id;
37  AllocatorCache cache;
38} thread_local_data_t;
39
40static pthread_key_t key;
41static pthread_once_t key_once = PTHREAD_ONCE_INIT;
42
43// The main thread destructor requires the current thread id,
44// so we can't destroy it until it's been used and reset to invalid tid
45void restore_tid_data(void *ptr) {
46  thread_local_data_t *data = (thread_local_data_t *)ptr;
47  if (data->current_thread_id != kInvalidTid)
48    pthread_setspecific(key, data);
49}
50
51static void make_tls_key() {
52  CHECK_EQ(pthread_key_create(&key, restore_tid_data), 0);
53}
54
55static thread_local_data_t *get_tls_val(bool alloc) {
56  pthread_once(&key_once, make_tls_key);
57
58  thread_local_data_t *ptr = (thread_local_data_t *)pthread_getspecific(key);
59  if (ptr == NULL && alloc) {
60    ptr = (thread_local_data_t *)InternalAlloc(sizeof(*ptr));
61    ptr->disable_counter = 0;
62    ptr->current_thread_id = kInvalidTid;
63    ptr->cache = AllocatorCache();
64    pthread_setspecific(key, ptr);
65  }
66
67  return ptr;
68}
69
70bool DisabledInThisThread() {
71  thread_local_data_t *data = get_tls_val(false);
72  return data ? data->disable_counter > 0 : false;
73}
74
75void DisableInThisThread() { ++get_tls_val(true)->disable_counter; }
76
77void EnableInThisThread() {
78  int *disable_counter = &get_tls_val(true)->disable_counter;
79  if (*disable_counter == 0) {
80    DisableCounterUnderflow();
81  }
82  --*disable_counter;
83}
84
85u32 GetCurrentThread() {
86  thread_local_data_t *data = get_tls_val(false);
87  return data ? data->current_thread_id : kInvalidTid;
88}
89
90void SetCurrentThread(u32 tid) { get_tls_val(true)->current_thread_id = tid; }
91
92AllocatorCache *GetAllocatorCache() { return &get_tls_val(true)->cache; }
93
94LoadedModule *GetLinker() { return nullptr; }
95
96// Required on Linux for initialization of TLS behavior, but should not be
97// required on Darwin.
98void InitializePlatformSpecificModules() {}
99
100// Sections which can't contain contain global pointers. This list errs on the
101// side of caution to avoid false positives, at the expense of performance.
102//
103// Other potentially safe sections include:
104// __all_image_info, __crash_info, __const, __got, __interpose, __objc_msg_break
105//
106// Sections which definitely cannot be included here are:
107// __objc_data, __objc_const, __data, __bss, __common, __thread_data,
108// __thread_bss, __thread_vars, __objc_opt_rw, __objc_opt_ptrs
109static const char *kSkippedSecNames[] = {
110    "__cfstring",       "__la_symbol_ptr",  "__mod_init_func",
111    "__mod_term_func",  "__nl_symbol_ptr",  "__objc_classlist",
112    "__objc_classrefs", "__objc_imageinfo", "__objc_nlclslist",
113    "__objc_protolist", "__objc_selrefs",   "__objc_superrefs"};
114
115// Scans global variables for heap pointers.
116void ProcessGlobalRegions(Frontier *frontier) {
117  for (auto name : kSkippedSecNames) CHECK(ARRAY_SIZE(name) < kMaxSegName);
118
119  MemoryMappingLayout memory_mapping(false);
120  InternalMmapVector<LoadedModule> modules;
121  modules.reserve(128);
122  memory_mapping.DumpListOfModules(&modules);
123  for (uptr i = 0; i < modules.size(); ++i) {
124    // Even when global scanning is disabled, we still need to scan
125    // system libraries for stashed pointers
126    if (!flags()->use_globals && modules[i].instrumented()) continue;
127
128    for (const __sanitizer::LoadedModule::AddressRange &range :
129         modules[i].ranges()) {
130      // Sections storing global variables are writable and non-executable
131      if (range.executable || !range.writable) continue;
132
133      for (auto name : kSkippedSecNames) {
134        if (!internal_strcmp(range.name, name)) continue;
135      }
136
137      ScanGlobalRange(range.beg, range.end, frontier);
138    }
139  }
140}
141
142void ProcessPlatformSpecificAllocations(Frontier *frontier) {
143  unsigned depth = 1;
144  vm_size_t size = 0;
145  vm_address_t address = 0;
146  kern_return_t err = KERN_SUCCESS;
147  mach_msg_type_number_t count = VM_REGION_SUBMAP_INFO_COUNT_64;
148
149  InternalMmapVector<RootRegion> const *root_regions = GetRootRegions();
150
151  while (err == KERN_SUCCESS) {
152    struct vm_region_submap_info_64 info;
153    err = vm_region_recurse_64(mach_task_self(), &address, &size, &depth,
154                               (vm_region_info_t)&info, &count);
155
156    uptr end_address = address + size;
157
158    // libxpc stashes some pointers in the Kernel Alloc Once page,
159    // make sure not to report those as leaks.
160    if (info.user_tag == kSanitizerVmMemoryOsAllocOnce) {
161      ScanRangeForPointers(address, end_address, frontier, "GLOBAL",
162                           kReachable);
163
164      // Recursing over the full memory map is very slow, break out
165      // early if we don't need the full iteration.
166      if (!flags()->use_root_regions || !root_regions->size())
167        break;
168    }
169
170    // This additional root region scan is required on Darwin in order to
171    // detect root regions contained within mmap'd memory regions, because
172    // the Darwin implementation of sanitizer_procmaps traverses images
173    // as loaded by dyld, and not the complete set of all memory regions.
174    //
175    // TODO(fjricci) - remove this once sanitizer_procmaps_mac has the same
176    // behavior as sanitizer_procmaps_linux and traverses all memory regions
177    if (flags()->use_root_regions) {
178      for (uptr i = 0; i < root_regions->size(); i++) {
179        ScanRootRegion(frontier, (*root_regions)[i], address, end_address,
180                       info.protection & kProtectionRead);
181      }
182    }
183
184    address = end_address;
185  }
186}
187
188// On darwin, we can intercept _exit gracefully, and return a failing exit code
189// if required at that point. Calling Die() here is undefined behavior and
190// causes rare race conditions.
191void HandleLeaks() {}
192
193void DoStopTheWorld(StopTheWorldCallback callback, void *argument) {
194  StopTheWorld(callback, argument);
195}
196
197} // namespace __lsan
198
199#endif // CAN_SANITIZE_LEAKS && SANITIZER_MAC
200