1//===-- asan_thread.cc ----------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Thread-related code. 13//===----------------------------------------------------------------------===// 14#include "asan_allocator.h" 15#include "asan_interceptors.h" 16#include "asan_poisoning.h" 17#include "asan_stack.h" 18#include "asan_thread.h" 19#include "asan_mapping.h" 20#include "sanitizer_common/sanitizer_common.h" 21#include "sanitizer_common/sanitizer_placement_new.h" 22#include "sanitizer_common/sanitizer_stackdepot.h" 23#include "sanitizer_common/sanitizer_tls_get_addr.h" 24#include "lsan/lsan_common.h" 25 26namespace __asan { 27 28// AsanThreadContext implementation. 29 30void AsanThreadContext::OnCreated(void *arg) { 31 CreateThreadContextArgs *args = static_cast<CreateThreadContextArgs*>(arg); 32 if (args->stack) 33 stack_id = StackDepotPut(*args->stack); 34 thread = args->thread; 35 thread->set_context(this); 36} 37 38void AsanThreadContext::OnFinished() { 39 // Drop the link to the AsanThread object. 40 thread = nullptr; 41} 42 43// MIPS requires aligned address 44static ALIGNED(16) char thread_registry_placeholder[sizeof(ThreadRegistry)]; 45static ThreadRegistry *asan_thread_registry; 46 47static BlockingMutex mu_for_thread_context(LINKER_INITIALIZED); 48static LowLevelAllocator allocator_for_thread_context; 49 50static ThreadContextBase *GetAsanThreadContext(u32 tid) { 51 BlockingMutexLock lock(&mu_for_thread_context); 52 return new(allocator_for_thread_context) AsanThreadContext(tid); 53} 54 55ThreadRegistry &asanThreadRegistry() { 56 static bool initialized; 57 // Don't worry about thread_safety - this should be called when there is 58 // a single thread. 59 if (!initialized) { 60 // Never reuse ASan threads: we store pointer to AsanThreadContext 61 // in TSD and can't reliably tell when no more TSD destructors will 62 // be called. It would be wrong to reuse AsanThreadContext for another 63 // thread before all TSD destructors will be called for it. 64 asan_thread_registry = new(thread_registry_placeholder) ThreadRegistry( 65 GetAsanThreadContext, kMaxNumberOfThreads, kMaxNumberOfThreads); 66 initialized = true; 67 } 68 return *asan_thread_registry; 69} 70 71AsanThreadContext *GetThreadContextByTidLocked(u32 tid) { 72 return static_cast<AsanThreadContext *>( 73 asanThreadRegistry().GetThreadLocked(tid)); 74} 75 76// AsanThread implementation. 77 78AsanThread *AsanThread::Create(thread_callback_t start_routine, void *arg, 79 u32 parent_tid, StackTrace *stack, 80 bool detached) { 81 uptr PageSize = GetPageSizeCached(); 82 uptr size = RoundUpTo(sizeof(AsanThread), PageSize); 83 AsanThread *thread = (AsanThread*)MmapOrDie(size, __func__); 84 thread->start_routine_ = start_routine; 85 thread->arg_ = arg; 86 AsanThreadContext::CreateThreadContextArgs args = {thread, stack}; 87 asanThreadRegistry().CreateThread(*reinterpret_cast<uptr *>(thread), detached, 88 parent_tid, &args); 89 90 return thread; 91} 92 93void AsanThread::TSDDtor(void *tsd) { 94 AsanThreadContext *context = (AsanThreadContext*)tsd; 95 VReport(1, "T%d TSDDtor\n", context->tid); 96 if (context->thread) 97 context->thread->Destroy(); 98} 99 100void AsanThread::Destroy() { 101 int tid = this->tid(); 102 VReport(1, "T%d exited\n", tid); 103 104 malloc_storage().CommitBack(); 105 if (common_flags()->use_sigaltstack) UnsetAlternateSignalStack(); 106 asanThreadRegistry().FinishThread(tid); 107 FlushToDeadThreadStats(&stats_); 108 // We also clear the shadow on thread destruction because 109 // some code may still be executing in later TSD destructors 110 // and we don't want it to have any poisoned stack. 111 ClearShadowForThreadStackAndTLS(); 112 DeleteFakeStack(tid); 113 uptr size = RoundUpTo(sizeof(AsanThread), GetPageSizeCached()); 114 UnmapOrDie(this, size); 115 DTLS_Destroy(); 116} 117 118void AsanThread::StartSwitchFiber(FakeStack **fake_stack_save, uptr bottom, 119 uptr size) { 120 if (atomic_load(&stack_switching_, memory_order_relaxed)) { 121 Report("ERROR: starting fiber switch while in fiber switch\n"); 122 Die(); 123 } 124 125 next_stack_bottom_ = bottom; 126 next_stack_top_ = bottom + size; 127 atomic_store(&stack_switching_, 1, memory_order_release); 128 129 FakeStack *current_fake_stack = fake_stack_; 130 if (fake_stack_save) 131 *fake_stack_save = fake_stack_; 132 fake_stack_ = nullptr; 133 SetTLSFakeStack(nullptr); 134 // if fake_stack_save is null, the fiber will die, delete the fakestack 135 if (!fake_stack_save && current_fake_stack) 136 current_fake_stack->Destroy(this->tid()); 137} 138 139void AsanThread::FinishSwitchFiber(FakeStack *fake_stack_save, 140 uptr *bottom_old, 141 uptr *size_old) { 142 if (!atomic_load(&stack_switching_, memory_order_relaxed)) { 143 Report("ERROR: finishing a fiber switch that has not started\n"); 144 Die(); 145 } 146 147 if (fake_stack_save) { 148 SetTLSFakeStack(fake_stack_save); 149 fake_stack_ = fake_stack_save; 150 } 151 152 if (bottom_old) 153 *bottom_old = stack_bottom_; 154 if (size_old) 155 *size_old = stack_top_ - stack_bottom_; 156 stack_bottom_ = next_stack_bottom_; 157 stack_top_ = next_stack_top_; 158 atomic_store(&stack_switching_, 0, memory_order_release); 159 next_stack_top_ = 0; 160 next_stack_bottom_ = 0; 161} 162 163inline AsanThread::StackBounds AsanThread::GetStackBounds() const { 164 if (!atomic_load(&stack_switching_, memory_order_acquire)) { 165 // Make sure the stack bounds are fully initialized. 166 if (stack_bottom_ >= stack_top_) return {0, 0}; 167 return {stack_bottom_, stack_top_}; 168 } 169 char local; 170 const uptr cur_stack = (uptr)&local; 171 // Note: need to check next stack first, because FinishSwitchFiber 172 // may be in process of overwriting stack_top_/bottom_. But in such case 173 // we are already on the next stack. 174 if (cur_stack >= next_stack_bottom_ && cur_stack < next_stack_top_) 175 return {next_stack_bottom_, next_stack_top_}; 176 return {stack_bottom_, stack_top_}; 177} 178 179uptr AsanThread::stack_top() { 180 return GetStackBounds().top; 181} 182 183uptr AsanThread::stack_bottom() { 184 return GetStackBounds().bottom; 185} 186 187uptr AsanThread::stack_size() { 188 const auto bounds = GetStackBounds(); 189 return bounds.top - bounds.bottom; 190} 191 192// We want to create the FakeStack lazyly on the first use, but not eralier 193// than the stack size is known and the procedure has to be async-signal safe. 194FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() { 195 uptr stack_size = this->stack_size(); 196 if (stack_size == 0) // stack_size is not yet available, don't use FakeStack. 197 return nullptr; 198 uptr old_val = 0; 199 // fake_stack_ has 3 states: 200 // 0 -- not initialized 201 // 1 -- being initialized 202 // ptr -- initialized 203 // This CAS checks if the state was 0 and if so changes it to state 1, 204 // if that was successful, it initializes the pointer. 205 if (atomic_compare_exchange_strong( 206 reinterpret_cast<atomic_uintptr_t *>(&fake_stack_), &old_val, 1UL, 207 memory_order_relaxed)) { 208 uptr stack_size_log = Log2(RoundUpToPowerOfTwo(stack_size)); 209 CHECK_LE(flags()->min_uar_stack_size_log, flags()->max_uar_stack_size_log); 210 stack_size_log = 211 Min(stack_size_log, static_cast<uptr>(flags()->max_uar_stack_size_log)); 212 stack_size_log = 213 Max(stack_size_log, static_cast<uptr>(flags()->min_uar_stack_size_log)); 214 fake_stack_ = FakeStack::Create(stack_size_log); 215 SetTLSFakeStack(fake_stack_); 216 return fake_stack_; 217 } 218 return nullptr; 219} 220 221void AsanThread::Init(const InitOptions *options) { 222 next_stack_top_ = next_stack_bottom_ = 0; 223 atomic_store(&stack_switching_, false, memory_order_release); 224 CHECK_EQ(this->stack_size(), 0U); 225 SetThreadStackAndTls(options); 226 if (stack_top_ != stack_bottom_) { 227 CHECK_GT(this->stack_size(), 0U); 228 CHECK(AddrIsInMem(stack_bottom_)); 229 CHECK(AddrIsInMem(stack_top_ - 1)); 230 } 231 ClearShadowForThreadStackAndTLS(); 232 fake_stack_ = nullptr; 233 if (__asan_option_detect_stack_use_after_return) 234 AsyncSignalSafeLazyInitFakeStack(); 235 int local = 0; 236 VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(), 237 (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_, 238 &local); 239} 240 241// Fuchsia and RTEMS don't use ThreadStart. 242// asan_fuchsia.c/asan_rtems.c define CreateMainThread and 243// SetThreadStackAndTls. 244#if !SANITIZER_FUCHSIA && !SANITIZER_RTEMS 245 246thread_return_t AsanThread::ThreadStart( 247 tid_t os_id, atomic_uintptr_t *signal_thread_is_registered) { 248 Init(); 249 asanThreadRegistry().StartThread(tid(), os_id, /*workerthread*/ false, 250 nullptr); 251 if (signal_thread_is_registered) 252 atomic_store(signal_thread_is_registered, 1, memory_order_release); 253 254 if (common_flags()->use_sigaltstack) SetAlternateSignalStack(); 255 256 if (!start_routine_) { 257 // start_routine_ == 0 if we're on the main thread or on one of the 258 // OS X libdispatch worker threads. But nobody is supposed to call 259 // ThreadStart() for the worker threads. 260 CHECK_EQ(tid(), 0); 261 return 0; 262 } 263 264 thread_return_t res = start_routine_(arg_); 265 266 // On POSIX systems we defer this to the TSD destructor. LSan will consider 267 // the thread's memory as non-live from the moment we call Destroy(), even 268 // though that memory might contain pointers to heap objects which will be 269 // cleaned up by a user-defined TSD destructor. Thus, calling Destroy() before 270 // the TSD destructors have run might cause false positives in LSan. 271 if (!SANITIZER_POSIX) 272 this->Destroy(); 273 274 return res; 275} 276 277AsanThread *CreateMainThread() { 278 AsanThread *main_thread = AsanThread::Create( 279 /* start_routine */ nullptr, /* arg */ nullptr, /* parent_tid */ 0, 280 /* stack */ nullptr, /* detached */ true); 281 SetCurrentThread(main_thread); 282 main_thread->ThreadStart(internal_getpid(), 283 /* signal_thread_is_registered */ nullptr); 284 return main_thread; 285} 286 287// This implementation doesn't use the argument, which is just passed down 288// from the caller of Init (which see, above). It's only there to support 289// OS-specific implementations that need more information passed through. 290void AsanThread::SetThreadStackAndTls(const InitOptions *options) { 291 DCHECK_EQ(options, nullptr); 292 uptr tls_size = 0; 293 uptr stack_size = 0; 294 GetThreadStackAndTls(tid() == 0, &stack_bottom_, &stack_size, &tls_begin_, 295 &tls_size); 296 stack_top_ = stack_bottom_ + stack_size; 297 tls_end_ = tls_begin_ + tls_size; 298 dtls_ = DTLS_Get(); 299 300 if (stack_top_ != stack_bottom_) { 301 int local; 302 CHECK(AddrIsInStack((uptr)&local)); 303 } 304} 305 306#endif // !SANITIZER_FUCHSIA && !SANITIZER_RTEMS 307 308void AsanThread::ClearShadowForThreadStackAndTLS() { 309 if (stack_top_ != stack_bottom_) 310 PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0); 311 if (tls_begin_ != tls_end_) { 312 uptr tls_begin_aligned = RoundDownTo(tls_begin_, SHADOW_GRANULARITY); 313 uptr tls_end_aligned = RoundUpTo(tls_end_, SHADOW_GRANULARITY); 314 FastPoisonShadowPartialRightRedzone(tls_begin_aligned, 315 tls_end_ - tls_begin_aligned, 316 tls_end_aligned - tls_end_, 0); 317 } 318} 319 320bool AsanThread::GetStackFrameAccessByAddr(uptr addr, 321 StackFrameAccess *access) { 322 if (stack_top_ == stack_bottom_) 323 return false; 324 325 uptr bottom = 0; 326 if (AddrIsInStack(addr)) { 327 bottom = stack_bottom(); 328 } else if (has_fake_stack()) { 329 bottom = fake_stack()->AddrIsInFakeStack(addr); 330 CHECK(bottom); 331 access->offset = addr - bottom; 332 access->frame_pc = ((uptr*)bottom)[2]; 333 access->frame_descr = (const char *)((uptr*)bottom)[1]; 334 return true; 335 } 336 uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8); // align addr. 337 uptr mem_ptr = RoundDownTo(aligned_addr, SHADOW_GRANULARITY); 338 u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr); 339 u8 *shadow_bottom = (u8*)MemToShadow(bottom); 340 341 while (shadow_ptr >= shadow_bottom && 342 *shadow_ptr != kAsanStackLeftRedzoneMagic) { 343 shadow_ptr--; 344 mem_ptr -= SHADOW_GRANULARITY; 345 } 346 347 while (shadow_ptr >= shadow_bottom && 348 *shadow_ptr == kAsanStackLeftRedzoneMagic) { 349 shadow_ptr--; 350 mem_ptr -= SHADOW_GRANULARITY; 351 } 352 353 if (shadow_ptr < shadow_bottom) { 354 return false; 355 } 356 357 uptr* ptr = (uptr*)(mem_ptr + SHADOW_GRANULARITY); 358 CHECK(ptr[0] == kCurrentStackFrameMagic); 359 access->offset = addr - (uptr)ptr; 360 access->frame_pc = ptr[2]; 361 access->frame_descr = (const char*)ptr[1]; 362 return true; 363} 364 365uptr AsanThread::GetStackVariableShadowStart(uptr addr) { 366 uptr bottom = 0; 367 if (AddrIsInStack(addr)) { 368 bottom = stack_bottom(); 369 } else if (has_fake_stack()) { 370 bottom = fake_stack()->AddrIsInFakeStack(addr); 371 CHECK(bottom); 372 } else 373 return 0; 374 375 uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8); // align addr. 376 u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr); 377 u8 *shadow_bottom = (u8*)MemToShadow(bottom); 378 379 while (shadow_ptr >= shadow_bottom && 380 (*shadow_ptr != kAsanStackLeftRedzoneMagic && 381 *shadow_ptr != kAsanStackMidRedzoneMagic && 382 *shadow_ptr != kAsanStackRightRedzoneMagic)) 383 shadow_ptr--; 384 385 return (uptr)shadow_ptr + 1; 386} 387 388bool AsanThread::AddrIsInStack(uptr addr) { 389 const auto bounds = GetStackBounds(); 390 return addr >= bounds.bottom && addr < bounds.top; 391} 392 393static bool ThreadStackContainsAddress(ThreadContextBase *tctx_base, 394 void *addr) { 395 AsanThreadContext *tctx = static_cast<AsanThreadContext*>(tctx_base); 396 AsanThread *t = tctx->thread; 397 if (!t) return false; 398 if (t->AddrIsInStack((uptr)addr)) return true; 399 if (t->has_fake_stack() && t->fake_stack()->AddrIsInFakeStack((uptr)addr)) 400 return true; 401 return false; 402} 403 404AsanThread *GetCurrentThread() { 405 if (SANITIZER_RTEMS && !asan_inited) 406 return nullptr; 407 408 AsanThreadContext *context = 409 reinterpret_cast<AsanThreadContext *>(AsanTSDGet()); 410 if (!context) { 411 if (SANITIZER_ANDROID) { 412 // On Android, libc constructor is called _after_ asan_init, and cleans up 413 // TSD. Try to figure out if this is still the main thread by the stack 414 // address. We are not entirely sure that we have correct main thread 415 // limits, so only do this magic on Android, and only if the found thread 416 // is the main thread. 417 AsanThreadContext *tctx = GetThreadContextByTidLocked(0); 418 if (tctx && ThreadStackContainsAddress(tctx, &context)) { 419 SetCurrentThread(tctx->thread); 420 return tctx->thread; 421 } 422 } 423 return nullptr; 424 } 425 return context->thread; 426} 427 428void SetCurrentThread(AsanThread *t) { 429 CHECK(t->context()); 430 VReport(2, "SetCurrentThread: %p for thread %p\n", t->context(), 431 (void *)GetThreadSelf()); 432 // Make sure we do not reset the current AsanThread. 433 CHECK_EQ(0, AsanTSDGet()); 434 AsanTSDSet(t->context()); 435 CHECK_EQ(t->context(), AsanTSDGet()); 436} 437 438u32 GetCurrentTidOrInvalid() { 439 AsanThread *t = GetCurrentThread(); 440 return t ? t->tid() : kInvalidTid; 441} 442 443AsanThread *FindThreadByStackAddress(uptr addr) { 444 asanThreadRegistry().CheckLocked(); 445 AsanThreadContext *tctx = static_cast<AsanThreadContext *>( 446 asanThreadRegistry().FindThreadContextLocked(ThreadStackContainsAddress, 447 (void *)addr)); 448 return tctx ? tctx->thread : nullptr; 449} 450 451void EnsureMainThreadIDIsCorrect() { 452 AsanThreadContext *context = 453 reinterpret_cast<AsanThreadContext *>(AsanTSDGet()); 454 if (context && (context->tid == 0)) 455 context->os_id = GetTid(); 456} 457 458__asan::AsanThread *GetAsanThreadByOsIDLocked(tid_t os_id) { 459 __asan::AsanThreadContext *context = static_cast<__asan::AsanThreadContext *>( 460 __asan::asanThreadRegistry().FindThreadContextByOsIDLocked(os_id)); 461 if (!context) return nullptr; 462 return context->thread; 463} 464} // namespace __asan 465 466// --- Implementation of LSan-specific functions --- {{{1 467namespace __lsan { 468bool GetThreadRangesLocked(tid_t os_id, uptr *stack_begin, uptr *stack_end, 469 uptr *tls_begin, uptr *tls_end, uptr *cache_begin, 470 uptr *cache_end, DTLS **dtls) { 471 __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id); 472 if (!t) return false; 473 *stack_begin = t->stack_bottom(); 474 *stack_end = t->stack_top(); 475 *tls_begin = t->tls_begin(); 476 *tls_end = t->tls_end(); 477 // ASan doesn't keep allocator caches in TLS, so these are unused. 478 *cache_begin = 0; 479 *cache_end = 0; 480 *dtls = t->dtls(); 481 return true; 482} 483 484void ForEachExtraStackRange(tid_t os_id, RangeIteratorCallback callback, 485 void *arg) { 486 __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id); 487 if (t && t->has_fake_stack()) 488 t->fake_stack()->ForEachFakeFrame(callback, arg); 489} 490 491void LockThreadRegistry() { 492 __asan::asanThreadRegistry().Lock(); 493} 494 495void UnlockThreadRegistry() { 496 __asan::asanThreadRegistry().Unlock(); 497} 498 499ThreadRegistry *GetThreadRegistryLocked() { 500 __asan::asanThreadRegistry().CheckLocked(); 501 return &__asan::asanThreadRegistry(); 502} 503 504void EnsureMainThreadIDIsCorrect() { 505 __asan::EnsureMainThreadIDIsCorrect(); 506} 507} // namespace __lsan 508 509// ---------------------- Interface ---------------- {{{1 510using namespace __asan; // NOLINT 511 512extern "C" { 513SANITIZER_INTERFACE_ATTRIBUTE 514void __sanitizer_start_switch_fiber(void **fakestacksave, const void *bottom, 515 uptr size) { 516 AsanThread *t = GetCurrentThread(); 517 if (!t) { 518 VReport(1, "__asan_start_switch_fiber called from unknown thread\n"); 519 return; 520 } 521 t->StartSwitchFiber((FakeStack**)fakestacksave, (uptr)bottom, size); 522} 523 524SANITIZER_INTERFACE_ATTRIBUTE 525void __sanitizer_finish_switch_fiber(void* fakestack, 526 const void **bottom_old, 527 uptr *size_old) { 528 AsanThread *t = GetCurrentThread(); 529 if (!t) { 530 VReport(1, "__asan_finish_switch_fiber called from unknown thread\n"); 531 return; 532 } 533 t->FinishSwitchFiber((FakeStack*)fakestack, 534 (uptr*)bottom_old, 535 (uptr*)size_old); 536} 537} 538