1//=-- lsan_common_mac.cc --------------------------------------------------===// 2// 3// This file is distributed under the University of Illinois Open Source 4// License. See LICENSE.TXT for details. 5// 6//===----------------------------------------------------------------------===// 7// 8// This file is a part of LeakSanitizer. 9// Implementation of common leak checking functionality. Darwin-specific code. 10// 11//===----------------------------------------------------------------------===// 12 13#include "sanitizer_common/sanitizer_platform.h" 14#include "lsan_common.h" 15 16#if CAN_SANITIZE_LEAKS && SANITIZER_MAC 17 18#include "sanitizer_common/sanitizer_allocator_internal.h" 19#include "lsan_allocator.h" 20 21#include <pthread.h> 22 23#include <mach/mach.h> 24 25// Only introduced in Mac OS X 10.9. 26#ifdef VM_MEMORY_OS_ALLOC_ONCE 27static const int kSanitizerVmMemoryOsAllocOnce = VM_MEMORY_OS_ALLOC_ONCE; 28#else 29static const int kSanitizerVmMemoryOsAllocOnce = 73; 30#endif 31 32namespace __lsan { 33 34typedef struct { 35 int disable_counter; 36 u32 current_thread_id; 37 AllocatorCache cache; 38} thread_local_data_t; 39 40static pthread_key_t key; 41static pthread_once_t key_once = PTHREAD_ONCE_INIT; 42 43// The main thread destructor requires the current thread id, 44// so we can't destroy it until it's been used and reset to invalid tid 45void restore_tid_data(void *ptr) { 46 thread_local_data_t *data = (thread_local_data_t *)ptr; 47 if (data->current_thread_id != kInvalidTid) 48 pthread_setspecific(key, data); 49} 50 51static void make_tls_key() { 52 CHECK_EQ(pthread_key_create(&key, restore_tid_data), 0); 53} 54 55static thread_local_data_t *get_tls_val(bool alloc) { 56 pthread_once(&key_once, make_tls_key); 57 58 thread_local_data_t *ptr = (thread_local_data_t *)pthread_getspecific(key); 59 if (ptr == NULL && alloc) { 60 ptr = (thread_local_data_t *)InternalAlloc(sizeof(*ptr)); 61 ptr->disable_counter = 0; 62 ptr->current_thread_id = kInvalidTid; 63 ptr->cache = AllocatorCache(); 64 pthread_setspecific(key, ptr); 65 } 66 67 return ptr; 68} 69 70bool DisabledInThisThread() { 71 thread_local_data_t *data = get_tls_val(false); 72 return data ? data->disable_counter > 0 : false; 73} 74 75void DisableInThisThread() { ++get_tls_val(true)->disable_counter; } 76 77void EnableInThisThread() { 78 int *disable_counter = &get_tls_val(true)->disable_counter; 79 if (*disable_counter == 0) { 80 DisableCounterUnderflow(); 81 } 82 --*disable_counter; 83} 84 85u32 GetCurrentThread() { 86 thread_local_data_t *data = get_tls_val(false); 87 return data ? data->current_thread_id : kInvalidTid; 88} 89 90void SetCurrentThread(u32 tid) { get_tls_val(true)->current_thread_id = tid; } 91 92AllocatorCache *GetAllocatorCache() { return &get_tls_val(true)->cache; } 93 94LoadedModule *GetLinker() { return nullptr; } 95 96// Required on Linux for initialization of TLS behavior, but should not be 97// required on Darwin. 98void InitializePlatformSpecificModules() {} 99 100// Sections which can't contain contain global pointers. This list errs on the 101// side of caution to avoid false positives, at the expense of performance. 102// 103// Other potentially safe sections include: 104// __all_image_info, __crash_info, __const, __got, __interpose, __objc_msg_break 105// 106// Sections which definitely cannot be included here are: 107// __objc_data, __objc_const, __data, __bss, __common, __thread_data, 108// __thread_bss, __thread_vars, __objc_opt_rw, __objc_opt_ptrs 109static const char *kSkippedSecNames[] = { 110 "__cfstring", "__la_symbol_ptr", "__mod_init_func", 111 "__mod_term_func", "__nl_symbol_ptr", "__objc_classlist", 112 "__objc_classrefs", "__objc_imageinfo", "__objc_nlclslist", 113 "__objc_protolist", "__objc_selrefs", "__objc_superrefs"}; 114 115// Scans global variables for heap pointers. 116void ProcessGlobalRegions(Frontier *frontier) { 117 for (auto name : kSkippedSecNames) CHECK(ARRAY_SIZE(name) < kMaxSegName); 118 119 MemoryMappingLayout memory_mapping(false); 120 InternalMmapVector<LoadedModule> modules; 121 modules.reserve(128); 122 memory_mapping.DumpListOfModules(&modules); 123 for (uptr i = 0; i < modules.size(); ++i) { 124 // Even when global scanning is disabled, we still need to scan 125 // system libraries for stashed pointers 126 if (!flags()->use_globals && modules[i].instrumented()) continue; 127 128 for (const __sanitizer::LoadedModule::AddressRange &range : 129 modules[i].ranges()) { 130 // Sections storing global variables are writable and non-executable 131 if (range.executable || !range.writable) continue; 132 133 for (auto name : kSkippedSecNames) { 134 if (!internal_strcmp(range.name, name)) continue; 135 } 136 137 ScanGlobalRange(range.beg, range.end, frontier); 138 } 139 } 140} 141 142void ProcessPlatformSpecificAllocations(Frontier *frontier) { 143 unsigned depth = 1; 144 vm_size_t size = 0; 145 vm_address_t address = 0; 146 kern_return_t err = KERN_SUCCESS; 147 mach_msg_type_number_t count = VM_REGION_SUBMAP_INFO_COUNT_64; 148 149 InternalMmapVector<RootRegion> const *root_regions = GetRootRegions(); 150 151 while (err == KERN_SUCCESS) { 152 struct vm_region_submap_info_64 info; 153 err = vm_region_recurse_64(mach_task_self(), &address, &size, &depth, 154 (vm_region_info_t)&info, &count); 155 156 uptr end_address = address + size; 157 158 // libxpc stashes some pointers in the Kernel Alloc Once page, 159 // make sure not to report those as leaks. 160 if (info.user_tag == kSanitizerVmMemoryOsAllocOnce) { 161 ScanRangeForPointers(address, end_address, frontier, "GLOBAL", 162 kReachable); 163 164 // Recursing over the full memory map is very slow, break out 165 // early if we don't need the full iteration. 166 if (!flags()->use_root_regions || !root_regions->size()) 167 break; 168 } 169 170 // This additional root region scan is required on Darwin in order to 171 // detect root regions contained within mmap'd memory regions, because 172 // the Darwin implementation of sanitizer_procmaps traverses images 173 // as loaded by dyld, and not the complete set of all memory regions. 174 // 175 // TODO(fjricci) - remove this once sanitizer_procmaps_mac has the same 176 // behavior as sanitizer_procmaps_linux and traverses all memory regions 177 if (flags()->use_root_regions) { 178 for (uptr i = 0; i < root_regions->size(); i++) { 179 ScanRootRegion(frontier, (*root_regions)[i], address, end_address, 180 info.protection & kProtectionRead); 181 } 182 } 183 184 address = end_address; 185 } 186} 187 188// On darwin, we can intercept _exit gracefully, and return a failing exit code 189// if required at that point. Calling Die() here is undefined behavior and 190// causes rare race conditions. 191void HandleLeaks() {} 192 193void DoStopTheWorld(StopTheWorldCallback callback, void *argument) { 194 StopTheWorld(callback, argument); 195} 196 197} // namespace __lsan 198 199#endif // CAN_SANITIZE_LEAKS && SANITIZER_MAC 200