1//===-- sanitizer_linux_libcdep.cpp ---------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is shared between AddressSanitizer and ThreadSanitizer
10// run-time libraries and implements linux-specific functions from
11// sanitizer_libc.h.
12//===----------------------------------------------------------------------===//
13
14#include "sanitizer_platform.h"
15
16#if SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD || \
17    SANITIZER_SOLARIS
18
19#include "sanitizer_allocator_internal.h"
20#include "sanitizer_atomic.h"
21#include "sanitizer_common.h"
22#include "sanitizer_file.h"
23#include "sanitizer_flags.h"
24#include "sanitizer_freebsd.h"
25#include "sanitizer_getauxval.h"
26#include "sanitizer_glibc_version.h"
27#include "sanitizer_linux.h"
28#include "sanitizer_placement_new.h"
29#include "sanitizer_procmaps.h"
30#include "sanitizer_solaris.h"
31
32#if SANITIZER_NETBSD
33#define _RTLD_SOURCE  // for __lwp_gettcb_fast() / __lwp_getprivate_fast()
34#endif
35
36#include <dlfcn.h>  // for dlsym()
37#include <link.h>
38#include <pthread.h>
39#include <signal.h>
40#include <sys/mman.h>
41#include <sys/resource.h>
42#include <syslog.h>
43
44#if !defined(ElfW)
45#define ElfW(type) Elf_##type
46#endif
47
48#if SANITIZER_FREEBSD
49#include <pthread_np.h>
50#include <osreldate.h>
51#include <sys/sysctl.h>
52#define pthread_getattr_np pthread_attr_get_np
53// The MAP_NORESERVE define has been removed in FreeBSD 11.x, and even before
54// that, it was never implemented. So just define it to zero.
55#undef MAP_NORESERVE
56#define MAP_NORESERVE 0
57#endif
58
59#if SANITIZER_NETBSD
60#include <sys/sysctl.h>
61#include <sys/tls.h>
62#include <lwp.h>
63#endif
64
65#if SANITIZER_SOLARIS
66#include <stddef.h>
67#include <stdlib.h>
68#include <thread.h>
69#endif
70
71#if SANITIZER_ANDROID
72#include <android/api-level.h>
73#if !defined(CPU_COUNT) && !defined(__aarch64__)
74#include <dirent.h>
75#include <fcntl.h>
76struct __sanitizer::linux_dirent {
77  long           d_ino;
78  off_t          d_off;
79  unsigned short d_reclen;
80  char           d_name[];
81};
82#endif
83#endif
84
85#if !SANITIZER_ANDROID
86#include <elf.h>
87#include <unistd.h>
88#endif
89
90namespace __sanitizer {
91
92SANITIZER_WEAK_ATTRIBUTE int
93real_sigaction(int signum, const void *act, void *oldact);
94
95int internal_sigaction(int signum, const void *act, void *oldact) {
96#if !SANITIZER_GO
97  if (&real_sigaction)
98    return real_sigaction(signum, act, oldact);
99#endif
100  return sigaction(signum, (const struct sigaction *)act,
101                   (struct sigaction *)oldact);
102}
103
104void GetThreadStackTopAndBottom(bool at_initialization, uptr *stack_top,
105                                uptr *stack_bottom) {
106  CHECK(stack_top);
107  CHECK(stack_bottom);
108  if (at_initialization) {
109    // This is the main thread. Libpthread may not be initialized yet.
110    struct rlimit rl;
111    CHECK_EQ(getrlimit(RLIMIT_STACK, &rl), 0);
112
113    // Find the mapping that contains a stack variable.
114    MemoryMappingLayout proc_maps(/*cache_enabled*/true);
115    if (proc_maps.Error()) {
116      *stack_top = *stack_bottom = 0;
117      return;
118    }
119    MemoryMappedSegment segment;
120    uptr prev_end = 0;
121    while (proc_maps.Next(&segment)) {
122      if ((uptr)&rl < segment.end) break;
123      prev_end = segment.end;
124    }
125    CHECK((uptr)&rl >= segment.start && (uptr)&rl < segment.end);
126
127    // Get stacksize from rlimit, but clip it so that it does not overlap
128    // with other mappings.
129    uptr stacksize = rl.rlim_cur;
130    if (stacksize > segment.end - prev_end) stacksize = segment.end - prev_end;
131    // When running with unlimited stack size, we still want to set some limit.
132    // The unlimited stack size is caused by 'ulimit -s unlimited'.
133    // Also, for some reason, GNU make spawns subprocesses with unlimited stack.
134    if (stacksize > kMaxThreadStackSize)
135      stacksize = kMaxThreadStackSize;
136    *stack_top = segment.end;
137    *stack_bottom = segment.end - stacksize;
138    return;
139  }
140  uptr stacksize = 0;
141  void *stackaddr = nullptr;
142#if SANITIZER_SOLARIS
143  stack_t ss;
144  CHECK_EQ(thr_stksegment(&ss), 0);
145  stacksize = ss.ss_size;
146  stackaddr = (char *)ss.ss_sp - stacksize;
147#else  // !SANITIZER_SOLARIS
148  pthread_attr_t attr;
149  pthread_attr_init(&attr);
150  CHECK_EQ(pthread_getattr_np(pthread_self(), &attr), 0);
151  my_pthread_attr_getstack(&attr, &stackaddr, &stacksize);
152  pthread_attr_destroy(&attr);
153#endif  // SANITIZER_SOLARIS
154
155  *stack_top = (uptr)stackaddr + stacksize;
156  *stack_bottom = (uptr)stackaddr;
157}
158
159#if !SANITIZER_GO
160bool SetEnv(const char *name, const char *value) {
161  void *f = dlsym(RTLD_NEXT, "setenv");
162  if (!f)
163    return false;
164  typedef int(*setenv_ft)(const char *name, const char *value, int overwrite);
165  setenv_ft setenv_f;
166  CHECK_EQ(sizeof(setenv_f), sizeof(f));
167  internal_memcpy(&setenv_f, &f, sizeof(f));
168  return setenv_f(name, value, 1) == 0;
169}
170#endif
171
172__attribute__((unused)) static bool GetLibcVersion(int *major, int *minor,
173                                                   int *patch) {
174#ifdef _CS_GNU_LIBC_VERSION
175  char buf[64];
176  uptr len = confstr(_CS_GNU_LIBC_VERSION, buf, sizeof(buf));
177  if (len >= sizeof(buf))
178    return false;
179  buf[len] = 0;
180  static const char kGLibC[] = "glibc ";
181  if (internal_strncmp(buf, kGLibC, sizeof(kGLibC) - 1) != 0)
182    return false;
183  const char *p = buf + sizeof(kGLibC) - 1;
184  *major = internal_simple_strtoll(p, &p, 10);
185  *minor = (*p == '.') ? internal_simple_strtoll(p + 1, &p, 10) : 0;
186  *patch = (*p == '.') ? internal_simple_strtoll(p + 1, &p, 10) : 0;
187  return true;
188#else
189  return false;
190#endif
191}
192
193// True if we can use dlpi_tls_data. glibc before 2.25 may leave NULL (BZ
194// #19826) so dlpi_tls_data cannot be used.
195//
196// musl before 1.2.3 and FreeBSD as of 12.2 incorrectly set dlpi_tls_data to
197// the TLS initialization image
198// https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254774
199__attribute__((unused)) static int g_use_dlpi_tls_data;
200
201#if SANITIZER_GLIBC && !SANITIZER_GO
202__attribute__((unused)) static size_t g_tls_size;
203void InitTlsSize() {
204  int major, minor, patch;
205  g_use_dlpi_tls_data =
206      GetLibcVersion(&major, &minor, &patch) && major == 2 && minor >= 25;
207
208#if defined(__aarch64__) || defined(__x86_64__) || defined(__powerpc64__) || \
209    defined(__loongarch__)
210  void *get_tls_static_info = dlsym(RTLD_NEXT, "_dl_get_tls_static_info");
211  size_t tls_align;
212  ((void (*)(size_t *, size_t *))get_tls_static_info)(&g_tls_size, &tls_align);
213#endif
214}
215#else
216void InitTlsSize() { }
217#endif  // SANITIZER_GLIBC && !SANITIZER_GO
218
219// On glibc x86_64, ThreadDescriptorSize() needs to be precise due to the usage
220// of g_tls_size. On other targets, ThreadDescriptorSize() is only used by lsan
221// to get the pointer to thread-specific data keys in the thread control block.
222#if (SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_SOLARIS) && \
223    !SANITIZER_ANDROID && !SANITIZER_GO
224// sizeof(struct pthread) from glibc.
225static atomic_uintptr_t thread_descriptor_size;
226
227static uptr ThreadDescriptorSizeFallback() {
228  uptr val = 0;
229#if defined(__x86_64__) || defined(__i386__) || defined(__arm__)
230  int major;
231  int minor;
232  int patch;
233  if (GetLibcVersion(&major, &minor, &patch) && major == 2) {
234    /* sizeof(struct pthread) values from various glibc versions.  */
235    if (SANITIZER_X32)
236      val = 1728; // Assume only one particular version for x32.
237    // For ARM sizeof(struct pthread) changed in Glibc 2.23.
238    else if (SANITIZER_ARM)
239      val = minor <= 22 ? 1120 : 1216;
240    else if (minor <= 3)
241      val = FIRST_32_SECOND_64(1104, 1696);
242    else if (minor == 4)
243      val = FIRST_32_SECOND_64(1120, 1728);
244    else if (minor == 5)
245      val = FIRST_32_SECOND_64(1136, 1728);
246    else if (minor <= 9)
247      val = FIRST_32_SECOND_64(1136, 1712);
248    else if (minor == 10)
249      val = FIRST_32_SECOND_64(1168, 1776);
250    else if (minor == 11 || (minor == 12 && patch == 1))
251      val = FIRST_32_SECOND_64(1168, 2288);
252    else if (minor <= 14)
253      val = FIRST_32_SECOND_64(1168, 2304);
254    else if (minor < 32)  // Unknown version
255      val = FIRST_32_SECOND_64(1216, 2304);
256    else  // minor == 32
257      val = FIRST_32_SECOND_64(1344, 2496);
258  }
259#elif defined(__s390__) || defined(__sparc__)
260  // The size of a prefix of TCB including pthread::{specific_1stblock,specific}
261  // suffices. Just return offsetof(struct pthread, specific_used), which hasn't
262  // changed since 2007-05. Technically this applies to i386/x86_64 as well but
263  // we call _dl_get_tls_static_info and need the precise size of struct
264  // pthread.
265  return FIRST_32_SECOND_64(524, 1552);
266#elif defined(__mips__)
267  // TODO(sagarthakur): add more values as per different glibc versions.
268  val = FIRST_32_SECOND_64(1152, 1776);
269#elif SANITIZER_LOONGARCH64
270  val = 1856; // from glibc 2.36
271#elif SANITIZER_RISCV64
272  int major;
273  int minor;
274  int patch;
275  if (GetLibcVersion(&major, &minor, &patch) && major == 2) {
276    // TODO: consider adding an optional runtime check for an unknown (untested)
277    // glibc version
278    if (minor <= 28)  // WARNING: the highest tested version is 2.29
279      val = 1772;     // no guarantees for this one
280    else if (minor <= 31)
281      val = 1772;  // tested against glibc 2.29, 2.31
282    else
283      val = 1936;  // tested against glibc 2.32
284  }
285
286#elif defined(__aarch64__)
287  // The sizeof (struct pthread) is the same from GLIBC 2.17 to 2.22.
288  val = 1776;
289#elif defined(__powerpc64__)
290  val = 1776; // from glibc.ppc64le 2.20-8.fc21
291#endif
292  return val;
293}
294
295uptr ThreadDescriptorSize() {
296  uptr val = atomic_load_relaxed(&thread_descriptor_size);
297  if (val)
298    return val;
299  // _thread_db_sizeof_pthread is a GLIBC_PRIVATE symbol that is exported in
300  // glibc 2.34 and later.
301  if (unsigned *psizeof = static_cast<unsigned *>(
302          dlsym(RTLD_DEFAULT, "_thread_db_sizeof_pthread")))
303    val = *psizeof;
304  if (!val)
305    val = ThreadDescriptorSizeFallback();
306  atomic_store_relaxed(&thread_descriptor_size, val);
307  return val;
308}
309
310#if defined(__mips__) || defined(__powerpc64__) || SANITIZER_RISCV64 || \
311    SANITIZER_LOONGARCH64
312// TlsPreTcbSize includes size of struct pthread_descr and size of tcb
313// head structure. It lies before the static tls blocks.
314static uptr TlsPreTcbSize() {
315#if defined(__mips__)
316  const uptr kTcbHead = 16; // sizeof (tcbhead_t)
317#elif defined(__powerpc64__)
318  const uptr kTcbHead = 88; // sizeof (tcbhead_t)
319#elif SANITIZER_RISCV64
320  const uptr kTcbHead = 16;  // sizeof (tcbhead_t)
321#elif SANITIZER_LOONGARCH64
322  const uptr kTcbHead = 16;  // sizeof (tcbhead_t)
323#endif
324  const uptr kTlsAlign = 16;
325  const uptr kTlsPreTcbSize =
326      RoundUpTo(ThreadDescriptorSize() + kTcbHead, kTlsAlign);
327  return kTlsPreTcbSize;
328}
329#endif
330
331namespace {
332struct TlsBlock {
333  uptr begin, end, align;
334  size_t tls_modid;
335  bool operator<(const TlsBlock &rhs) const { return begin < rhs.begin; }
336};
337}  // namespace
338
339#ifdef __s390__
340extern "C" uptr __tls_get_offset(void *arg);
341
342static uptr TlsGetOffset(uptr ti_module, uptr ti_offset) {
343  // The __tls_get_offset ABI requires %r12 to point to GOT and %r2 to be an
344  // offset of a struct tls_index inside GOT. We don't possess either of the
345  // two, so violate the letter of the "ELF Handling For Thread-Local
346  // Storage" document and assume that the implementation just dereferences
347  // %r2 + %r12.
348  uptr tls_index[2] = {ti_module, ti_offset};
349  register uptr r2 asm("2") = 0;
350  register void *r12 asm("12") = tls_index;
351  asm("basr %%r14, %[__tls_get_offset]"
352      : "+r"(r2)
353      : [__tls_get_offset] "r"(__tls_get_offset), "r"(r12)
354      : "memory", "cc", "0", "1", "3", "4", "5", "14");
355  return r2;
356}
357#else
358extern "C" void *__tls_get_addr(size_t *);
359#endif
360
361static size_t main_tls_modid;
362
363static int CollectStaticTlsBlocks(struct dl_phdr_info *info, size_t size,
364                                  void *data) {
365  size_t tls_modid;
366#if SANITIZER_SOLARIS
367  // dlpi_tls_modid is only available since Solaris 11.4 SRU 10.  Use
368  // dlinfo(RTLD_DI_LINKMAP) instead which works on all of Solaris 11.3,
369  // 11.4, and Illumos.  The tlsmodid of the executable was changed to 1 in
370  // 11.4 to match other implementations.
371  if (size >= offsetof(dl_phdr_info_test, dlpi_tls_modid))
372    main_tls_modid = 1;
373  else
374    main_tls_modid = 0;
375  g_use_dlpi_tls_data = 0;
376  Rt_map *map;
377  dlinfo(RTLD_SELF, RTLD_DI_LINKMAP, &map);
378  tls_modid = map->rt_tlsmodid;
379#else
380  main_tls_modid = 1;
381  tls_modid = info->dlpi_tls_modid;
382#endif
383
384  if (tls_modid < main_tls_modid)
385    return 0;
386  uptr begin;
387#if !SANITIZER_SOLARIS
388  begin = (uptr)info->dlpi_tls_data;
389#endif
390  if (!g_use_dlpi_tls_data) {
391    // Call __tls_get_addr as a fallback. This forces TLS allocation on glibc
392    // and FreeBSD.
393#ifdef __s390__
394    begin = (uptr)__builtin_thread_pointer() +
395            TlsGetOffset(tls_modid, 0);
396#else
397    size_t mod_and_off[2] = {tls_modid, 0};
398    begin = (uptr)__tls_get_addr(mod_and_off);
399#endif
400  }
401  for (unsigned i = 0; i != info->dlpi_phnum; ++i)
402    if (info->dlpi_phdr[i].p_type == PT_TLS) {
403      static_cast<InternalMmapVector<TlsBlock> *>(data)->push_back(
404          TlsBlock{begin, begin + info->dlpi_phdr[i].p_memsz,
405                   info->dlpi_phdr[i].p_align, tls_modid});
406      break;
407    }
408  return 0;
409}
410
411__attribute__((unused)) static void GetStaticTlsBoundary(uptr *addr, uptr *size,
412                                                         uptr *align) {
413  InternalMmapVector<TlsBlock> ranges;
414  dl_iterate_phdr(CollectStaticTlsBlocks, &ranges);
415  uptr len = ranges.size();
416  Sort(ranges.begin(), len);
417  // Find the range with tls_modid == main_tls_modid. For glibc, because
418  // libc.so uses PT_TLS, this module is guaranteed to exist and is one of
419  // the initially loaded modules.
420  uptr one = 0;
421  while (one != len && ranges[one].tls_modid != main_tls_modid) ++one;
422  if (one == len) {
423    // This may happen with musl if no module uses PT_TLS.
424    *addr = 0;
425    *size = 0;
426    *align = 1;
427    return;
428  }
429  // Find the maximum consecutive ranges. We consider two modules consecutive if
430  // the gap is smaller than the alignment of the latter range. The dynamic
431  // loader places static TLS blocks this way not to waste space.
432  uptr l = one;
433  *align = ranges[l].align;
434  while (l != 0 && ranges[l].begin < ranges[l - 1].end + ranges[l].align)
435    *align = Max(*align, ranges[--l].align);
436  uptr r = one + 1;
437  while (r != len && ranges[r].begin < ranges[r - 1].end + ranges[r].align)
438    *align = Max(*align, ranges[r++].align);
439  *addr = ranges[l].begin;
440  *size = ranges[r - 1].end - ranges[l].begin;
441}
442#endif  // (x86_64 || i386 || mips || ...) && (SANITIZER_FREEBSD ||
443        // SANITIZER_LINUX) && !SANITIZER_ANDROID && !SANITIZER_GO
444
445#if SANITIZER_NETBSD
446static struct tls_tcb * ThreadSelfTlsTcb() {
447  struct tls_tcb *tcb = nullptr;
448#ifdef __HAVE___LWP_GETTCB_FAST
449  tcb = (struct tls_tcb *)__lwp_gettcb_fast();
450#elif defined(__HAVE___LWP_GETPRIVATE_FAST)
451  tcb = (struct tls_tcb *)__lwp_getprivate_fast();
452#endif
453  return tcb;
454}
455
456uptr ThreadSelf() {
457  return (uptr)ThreadSelfTlsTcb()->tcb_pthread;
458}
459
460int GetSizeFromHdr(struct dl_phdr_info *info, size_t size, void *data) {
461  const Elf_Phdr *hdr = info->dlpi_phdr;
462  const Elf_Phdr *last_hdr = hdr + info->dlpi_phnum;
463
464  for (; hdr != last_hdr; ++hdr) {
465    if (hdr->p_type == PT_TLS && info->dlpi_tls_modid == 1) {
466      *(uptr*)data = hdr->p_memsz;
467      break;
468    }
469  }
470  return 0;
471}
472#endif  // SANITIZER_NETBSD
473
474#if SANITIZER_ANDROID
475// Bionic provides this API since S.
476extern "C" SANITIZER_WEAK_ATTRIBUTE void __libc_get_static_tls_bounds(void **,
477                                                                      void **);
478#endif
479
480#if !SANITIZER_GO
481static void GetTls(uptr *addr, uptr *size) {
482#if SANITIZER_ANDROID
483  if (&__libc_get_static_tls_bounds) {
484    void *start_addr;
485    void *end_addr;
486    __libc_get_static_tls_bounds(&start_addr, &end_addr);
487    *addr = reinterpret_cast<uptr>(start_addr);
488    *size =
489        reinterpret_cast<uptr>(end_addr) - reinterpret_cast<uptr>(start_addr);
490  } else {
491    *addr = 0;
492    *size = 0;
493  }
494#elif SANITIZER_GLIBC && defined(__x86_64__)
495  // For aarch64 and x86-64, use an O(1) approach which requires relatively
496  // precise ThreadDescriptorSize. g_tls_size was initialized in InitTlsSize.
497#  if SANITIZER_X32
498  asm("mov %%fs:8,%0" : "=r"(*addr));
499#  else
500  asm("mov %%fs:16,%0" : "=r"(*addr));
501#  endif
502  *size = g_tls_size;
503  *addr -= *size;
504  *addr += ThreadDescriptorSize();
505#elif SANITIZER_GLIBC && defined(__aarch64__)
506  *addr = reinterpret_cast<uptr>(__builtin_thread_pointer()) -
507          ThreadDescriptorSize();
508  *size = g_tls_size + ThreadDescriptorSize();
509#elif SANITIZER_GLIBC && defined(__loongarch__)
510#  ifdef __clang__
511  *addr = reinterpret_cast<uptr>(__builtin_thread_pointer()) -
512          ThreadDescriptorSize();
513#  else
514  asm("or %0,$tp,$zero" : "=r"(*addr));
515  *addr -= ThreadDescriptorSize();
516#  endif
517  *size = g_tls_size + ThreadDescriptorSize();
518#elif SANITIZER_GLIBC && defined(__powerpc64__)
519  // Workaround for glibc<2.25(?). 2.27 is known to not need this.
520  uptr tp;
521  asm("addi %0,13,-0x7000" : "=r"(tp));
522  const uptr pre_tcb_size = TlsPreTcbSize();
523  *addr = tp - pre_tcb_size;
524  *size = g_tls_size + pre_tcb_size;
525#elif SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_SOLARIS
526  uptr align;
527  GetStaticTlsBoundary(addr, size, &align);
528#if defined(__x86_64__) || defined(__i386__) || defined(__s390__) || \
529    defined(__sparc__)
530  if (SANITIZER_GLIBC) {
531#if defined(__x86_64__) || defined(__i386__)
532    align = Max<uptr>(align, 64);
533#else
534    align = Max<uptr>(align, 16);
535#endif
536  }
537  const uptr tp = RoundUpTo(*addr + *size, align);
538
539  // lsan requires the range to additionally cover the static TLS surplus
540  // (elf/dl-tls.c defines 1664). Otherwise there may be false positives for
541  // allocations only referenced by tls in dynamically loaded modules.
542  if (SANITIZER_GLIBC)
543    *size += 1644;
544  else if (SANITIZER_FREEBSD)
545    *size += 128;  // RTLD_STATIC_TLS_EXTRA
546
547  // Extend the range to include the thread control block. On glibc, lsan needs
548  // the range to include pthread::{specific_1stblock,specific} so that
549  // allocations only referenced by pthread_setspecific can be scanned. This may
550  // underestimate by at most TLS_TCB_ALIGN-1 bytes but it should be fine
551  // because the number of bytes after pthread::specific is larger.
552  *addr = tp - RoundUpTo(*size, align);
553  *size = tp - *addr + ThreadDescriptorSize();
554#else
555  if (SANITIZER_GLIBC)
556    *size += 1664;
557  else if (SANITIZER_FREEBSD)
558    *size += 128;  // RTLD_STATIC_TLS_EXTRA
559#if defined(__mips__) || defined(__powerpc64__) || SANITIZER_RISCV64
560  const uptr pre_tcb_size = TlsPreTcbSize();
561  *addr -= pre_tcb_size;
562  *size += pre_tcb_size;
563#else
564  // arm and aarch64 reserve two words at TP, so this underestimates the range.
565  // However, this is sufficient for the purpose of finding the pointers to
566  // thread-specific data keys.
567  const uptr tcb_size = ThreadDescriptorSize();
568  *addr -= tcb_size;
569  *size += tcb_size;
570#endif
571#endif
572#elif SANITIZER_NETBSD
573  struct tls_tcb * const tcb = ThreadSelfTlsTcb();
574  *addr = 0;
575  *size = 0;
576  if (tcb != 0) {
577    // Find size (p_memsz) of dlpi_tls_modid 1 (TLS block of the main program).
578    // ld.elf_so hardcodes the index 1.
579    dl_iterate_phdr(GetSizeFromHdr, size);
580
581    if (*size != 0) {
582      // The block has been found and tcb_dtv[1] contains the base address
583      *addr = (uptr)tcb->tcb_dtv[1];
584    }
585  }
586#else
587#error "Unknown OS"
588#endif
589}
590#endif
591
592#if !SANITIZER_GO
593uptr GetTlsSize() {
594#if SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD || \
595    SANITIZER_SOLARIS
596  uptr addr, size;
597  GetTls(&addr, &size);
598  return size;
599#else
600  return 0;
601#endif
602}
603#endif
604
605void GetThreadStackAndTls(bool main, uptr *stk_addr, uptr *stk_size,
606                          uptr *tls_addr, uptr *tls_size) {
607#if SANITIZER_GO
608  // Stub implementation for Go.
609  *stk_addr = *stk_size = *tls_addr = *tls_size = 0;
610#else
611  GetTls(tls_addr, tls_size);
612
613  uptr stack_top, stack_bottom;
614  GetThreadStackTopAndBottom(main, &stack_top, &stack_bottom);
615  *stk_addr = stack_bottom;
616  *stk_size = stack_top - stack_bottom;
617
618  if (!main) {
619    // If stack and tls intersect, make them non-intersecting.
620    if (*tls_addr > *stk_addr && *tls_addr < *stk_addr + *stk_size) {
621      if (*stk_addr + *stk_size < *tls_addr + *tls_size)
622        *tls_size = *stk_addr + *stk_size - *tls_addr;
623      *stk_size = *tls_addr - *stk_addr;
624    }
625  }
626#endif
627}
628
629#if !SANITIZER_FREEBSD
630typedef ElfW(Phdr) Elf_Phdr;
631#elif SANITIZER_WORDSIZE == 32 && __FreeBSD_version <= 902001  // v9.2
632#define Elf_Phdr XElf32_Phdr
633#define dl_phdr_info xdl_phdr_info
634#define dl_iterate_phdr(c, b) xdl_iterate_phdr((c), (b))
635#endif  // !SANITIZER_FREEBSD
636
637struct DlIteratePhdrData {
638  InternalMmapVectorNoCtor<LoadedModule> *modules;
639  bool first;
640};
641
642static int AddModuleSegments(const char *module_name, dl_phdr_info *info,
643                             InternalMmapVectorNoCtor<LoadedModule> *modules) {
644  if (module_name[0] == '\0')
645    return 0;
646  LoadedModule cur_module;
647  cur_module.set(module_name, info->dlpi_addr);
648  for (int i = 0; i < (int)info->dlpi_phnum; i++) {
649    const Elf_Phdr *phdr = &info->dlpi_phdr[i];
650    if (phdr->p_type == PT_LOAD) {
651      uptr cur_beg = info->dlpi_addr + phdr->p_vaddr;
652      uptr cur_end = cur_beg + phdr->p_memsz;
653      bool executable = phdr->p_flags & PF_X;
654      bool writable = phdr->p_flags & PF_W;
655      cur_module.addAddressRange(cur_beg, cur_end, executable,
656                                 writable);
657    } else if (phdr->p_type == PT_NOTE) {
658#  ifdef NT_GNU_BUILD_ID
659      uptr off = 0;
660      while (off + sizeof(ElfW(Nhdr)) < phdr->p_memsz) {
661        auto *nhdr = reinterpret_cast<const ElfW(Nhdr) *>(info->dlpi_addr +
662                                                          phdr->p_vaddr + off);
663        constexpr auto kGnuNamesz = 4;  // "GNU" with NUL-byte.
664        static_assert(kGnuNamesz % 4 == 0, "kGnuNameSize is aligned to 4.");
665        if (nhdr->n_type == NT_GNU_BUILD_ID && nhdr->n_namesz == kGnuNamesz) {
666          if (off + sizeof(ElfW(Nhdr)) + nhdr->n_namesz + nhdr->n_descsz >
667              phdr->p_memsz) {
668            // Something is very wrong, bail out instead of reading potentially
669            // arbitrary memory.
670            break;
671          }
672          const char *name =
673              reinterpret_cast<const char *>(nhdr) + sizeof(*nhdr);
674          if (internal_memcmp(name, "GNU", 3) == 0) {
675            const char *value = reinterpret_cast<const char *>(nhdr) +
676                                sizeof(*nhdr) + kGnuNamesz;
677            cur_module.setUuid(value, nhdr->n_descsz);
678            break;
679          }
680        }
681        off += sizeof(*nhdr) + RoundUpTo(nhdr->n_namesz, 4) +
682               RoundUpTo(nhdr->n_descsz, 4);
683      }
684#  endif
685    }
686  }
687  modules->push_back(cur_module);
688  return 0;
689}
690
691static int dl_iterate_phdr_cb(dl_phdr_info *info, size_t size, void *arg) {
692  DlIteratePhdrData *data = (DlIteratePhdrData *)arg;
693  if (data->first) {
694    InternalMmapVector<char> module_name(kMaxPathLength);
695    data->first = false;
696    // First module is the binary itself.
697    ReadBinaryNameCached(module_name.data(), module_name.size());
698    return AddModuleSegments(module_name.data(), info, data->modules);
699  }
700
701  if (info->dlpi_name) {
702    InternalScopedString module_name;
703    module_name.append("%s", info->dlpi_name);
704    return AddModuleSegments(module_name.data(), info, data->modules);
705  }
706
707  return 0;
708}
709
710#if SANITIZER_ANDROID && __ANDROID_API__ < 21
711extern "C" __attribute__((weak)) int dl_iterate_phdr(
712    int (*)(struct dl_phdr_info *, size_t, void *), void *);
713#endif
714
715static bool requiresProcmaps() {
716#if SANITIZER_ANDROID && __ANDROID_API__ <= 22
717  // Fall back to /proc/maps if dl_iterate_phdr is unavailable or broken.
718  // The runtime check allows the same library to work with
719  // both K and L (and future) Android releases.
720  return AndroidGetApiLevel() <= ANDROID_LOLLIPOP_MR1;
721#else
722  return false;
723#endif
724}
725
726static void procmapsInit(InternalMmapVectorNoCtor<LoadedModule> *modules) {
727  MemoryMappingLayout memory_mapping(/*cache_enabled*/true);
728  memory_mapping.DumpListOfModules(modules);
729}
730
731void ListOfModules::init() {
732  clearOrInit();
733  if (requiresProcmaps()) {
734    procmapsInit(&modules_);
735  } else {
736    DlIteratePhdrData data = {&modules_, true};
737    dl_iterate_phdr(dl_iterate_phdr_cb, &data);
738  }
739}
740
741// When a custom loader is used, dl_iterate_phdr may not contain the full
742// list of modules. Allow callers to fall back to using procmaps.
743void ListOfModules::fallbackInit() {
744  if (!requiresProcmaps()) {
745    clearOrInit();
746    procmapsInit(&modules_);
747  } else {
748    clear();
749  }
750}
751
752// getrusage does not give us the current RSS, only the max RSS.
753// Still, this is better than nothing if /proc/self/statm is not available
754// for some reason, e.g. due to a sandbox.
755static uptr GetRSSFromGetrusage() {
756  struct rusage usage;
757  if (getrusage(RUSAGE_SELF, &usage))  // Failed, probably due to a sandbox.
758    return 0;
759  return usage.ru_maxrss << 10;  // ru_maxrss is in Kb.
760}
761
762uptr GetRSS() {
763  if (!common_flags()->can_use_proc_maps_statm)
764    return GetRSSFromGetrusage();
765  fd_t fd = OpenFile("/proc/self/statm", RdOnly);
766  if (fd == kInvalidFd)
767    return GetRSSFromGetrusage();
768  char buf[64];
769  uptr len = internal_read(fd, buf, sizeof(buf) - 1);
770  internal_close(fd);
771  if ((sptr)len <= 0)
772    return 0;
773  buf[len] = 0;
774  // The format of the file is:
775  // 1084 89 69 11 0 79 0
776  // We need the second number which is RSS in pages.
777  char *pos = buf;
778  // Skip the first number.
779  while (*pos >= '0' && *pos <= '9')
780    pos++;
781  // Skip whitespaces.
782  while (!(*pos >= '0' && *pos <= '9') && *pos != 0)
783    pos++;
784  // Read the number.
785  uptr rss = 0;
786  while (*pos >= '0' && *pos <= '9')
787    rss = rss * 10 + *pos++ - '0';
788  return rss * GetPageSizeCached();
789}
790
791// sysconf(_SC_NPROCESSORS_{CONF,ONLN}) cannot be used on most platforms as
792// they allocate memory.
793u32 GetNumberOfCPUs() {
794#if SANITIZER_FREEBSD || SANITIZER_NETBSD
795  u32 ncpu;
796  int req[2];
797  uptr len = sizeof(ncpu);
798  req[0] = CTL_HW;
799  req[1] = HW_NCPU;
800  CHECK_EQ(internal_sysctl(req, 2, &ncpu, &len, NULL, 0), 0);
801  return ncpu;
802#elif SANITIZER_ANDROID && !defined(CPU_COUNT) && !defined(__aarch64__)
803  // Fall back to /sys/devices/system/cpu on Android when cpu_set_t doesn't
804  // exist in sched.h. That is the case for toolchains generated with older
805  // NDKs.
806  // This code doesn't work on AArch64 because internal_getdents makes use of
807  // the 64bit getdents syscall, but cpu_set_t seems to always exist on AArch64.
808  uptr fd = internal_open("/sys/devices/system/cpu", O_RDONLY | O_DIRECTORY);
809  if (internal_iserror(fd))
810    return 0;
811  InternalMmapVector<u8> buffer(4096);
812  uptr bytes_read = buffer.size();
813  uptr n_cpus = 0;
814  u8 *d_type;
815  struct linux_dirent *entry = (struct linux_dirent *)&buffer[bytes_read];
816  while (true) {
817    if ((u8 *)entry >= &buffer[bytes_read]) {
818      bytes_read = internal_getdents(fd, (struct linux_dirent *)buffer.data(),
819                                     buffer.size());
820      if (internal_iserror(bytes_read) || !bytes_read)
821        break;
822      entry = (struct linux_dirent *)buffer.data();
823    }
824    d_type = (u8 *)entry + entry->d_reclen - 1;
825    if (d_type >= &buffer[bytes_read] ||
826        (u8 *)&entry->d_name[3] >= &buffer[bytes_read])
827      break;
828    if (entry->d_ino != 0 && *d_type == DT_DIR) {
829      if (entry->d_name[0] == 'c' && entry->d_name[1] == 'p' &&
830          entry->d_name[2] == 'u' &&
831          entry->d_name[3] >= '0' && entry->d_name[3] <= '9')
832        n_cpus++;
833    }
834    entry = (struct linux_dirent *)(((u8 *)entry) + entry->d_reclen);
835  }
836  internal_close(fd);
837  return n_cpus;
838#elif SANITIZER_SOLARIS
839  return sysconf(_SC_NPROCESSORS_ONLN);
840#else
841  cpu_set_t CPUs;
842  CHECK_EQ(sched_getaffinity(0, sizeof(cpu_set_t), &CPUs), 0);
843  return CPU_COUNT(&CPUs);
844#endif
845}
846
847#if SANITIZER_LINUX
848
849#if SANITIZER_ANDROID
850static atomic_uint8_t android_log_initialized;
851
852void AndroidLogInit() {
853  openlog(GetProcessName(), 0, LOG_USER);
854  atomic_store(&android_log_initialized, 1, memory_order_release);
855}
856
857static bool ShouldLogAfterPrintf() {
858  return atomic_load(&android_log_initialized, memory_order_acquire);
859}
860
861extern "C" SANITIZER_WEAK_ATTRIBUTE
862int async_safe_write_log(int pri, const char* tag, const char* msg);
863extern "C" SANITIZER_WEAK_ATTRIBUTE
864int __android_log_write(int prio, const char* tag, const char* msg);
865
866// ANDROID_LOG_INFO is 4, but can't be resolved at runtime.
867#define SANITIZER_ANDROID_LOG_INFO 4
868
869// async_safe_write_log is a new public version of __libc_write_log that is
870// used behind syslog. It is preferable to syslog as it will not do any dynamic
871// memory allocation or formatting.
872// If the function is not available, syslog is preferred for L+ (it was broken
873// pre-L) as __android_log_write triggers a racey behavior with the strncpy
874// interceptor. Fallback to __android_log_write pre-L.
875void WriteOneLineToSyslog(const char *s) {
876  if (&async_safe_write_log) {
877    async_safe_write_log(SANITIZER_ANDROID_LOG_INFO, GetProcessName(), s);
878  } else if (AndroidGetApiLevel() > ANDROID_KITKAT) {
879    syslog(LOG_INFO, "%s", s);
880  } else {
881    CHECK(&__android_log_write);
882    __android_log_write(SANITIZER_ANDROID_LOG_INFO, nullptr, s);
883  }
884}
885
886extern "C" SANITIZER_WEAK_ATTRIBUTE
887void android_set_abort_message(const char *);
888
889void SetAbortMessage(const char *str) {
890  if (&android_set_abort_message)
891    android_set_abort_message(str);
892}
893#else
894void AndroidLogInit() {}
895
896static bool ShouldLogAfterPrintf() { return true; }
897
898void WriteOneLineToSyslog(const char *s) { syslog(LOG_INFO, "%s", s); }
899
900void SetAbortMessage(const char *str) {}
901#endif  // SANITIZER_ANDROID
902
903void LogMessageOnPrintf(const char *str) {
904  if (common_flags()->log_to_syslog && ShouldLogAfterPrintf())
905    WriteToSyslog(str);
906}
907
908#endif  // SANITIZER_LINUX
909
910#if SANITIZER_GLIBC && !SANITIZER_GO
911// glibc crashes when using clock_gettime from a preinit_array function as the
912// vDSO function pointers haven't been initialized yet. __progname is
913// initialized after the vDSO function pointers, so if it exists, is not null
914// and is not empty, we can use clock_gettime.
915extern "C" SANITIZER_WEAK_ATTRIBUTE char *__progname;
916inline bool CanUseVDSO() { return &__progname && __progname && *__progname; }
917
918// MonotonicNanoTime is a timing function that can leverage the vDSO by calling
919// clock_gettime. real_clock_gettime only exists if clock_gettime is
920// intercepted, so define it weakly and use it if available.
921extern "C" SANITIZER_WEAK_ATTRIBUTE
922int real_clock_gettime(u32 clk_id, void *tp);
923u64 MonotonicNanoTime() {
924  timespec ts;
925  if (CanUseVDSO()) {
926    if (&real_clock_gettime)
927      real_clock_gettime(CLOCK_MONOTONIC, &ts);
928    else
929      clock_gettime(CLOCK_MONOTONIC, &ts);
930  } else {
931    internal_clock_gettime(CLOCK_MONOTONIC, &ts);
932  }
933  return (u64)ts.tv_sec * (1000ULL * 1000 * 1000) + ts.tv_nsec;
934}
935#else
936// Non-glibc & Go always use the regular function.
937u64 MonotonicNanoTime() {
938  timespec ts;
939  clock_gettime(CLOCK_MONOTONIC, &ts);
940  return (u64)ts.tv_sec * (1000ULL * 1000 * 1000) + ts.tv_nsec;
941}
942#endif  // SANITIZER_GLIBC && !SANITIZER_GO
943
944void ReExec() {
945  const char *pathname = "/proc/self/exe";
946
947#if SANITIZER_NETBSD
948  static const int name[] = {
949      CTL_KERN,
950      KERN_PROC_ARGS,
951      -1,
952      KERN_PROC_PATHNAME,
953  };
954  char path[400];
955  uptr len;
956
957  len = sizeof(path);
958  if (internal_sysctl(name, ARRAY_SIZE(name), path, &len, NULL, 0) != -1)
959    pathname = path;
960#elif SANITIZER_SOLARIS
961  pathname = getexecname();
962  CHECK_NE(pathname, NULL);
963#elif SANITIZER_USE_GETAUXVAL
964  // Calling execve with /proc/self/exe sets that as $EXEC_ORIGIN. Binaries that
965  // rely on that will fail to load shared libraries. Query AT_EXECFN instead.
966  pathname = reinterpret_cast<const char *>(getauxval(AT_EXECFN));
967#endif
968
969  uptr rv = internal_execve(pathname, GetArgv(), GetEnviron());
970  int rverrno;
971  CHECK_EQ(internal_iserror(rv, &rverrno), true);
972  Printf("execve failed, errno %d\n", rverrno);
973  Die();
974}
975
976void UnmapFromTo(uptr from, uptr to) {
977  if (to == from)
978    return;
979  CHECK(to >= from);
980  uptr res = internal_munmap(reinterpret_cast<void *>(from), to - from);
981  if (UNLIKELY(internal_iserror(res))) {
982    Report("ERROR: %s failed to unmap 0x%zx (%zd) bytes at address %p\n",
983           SanitizerToolName, to - from, to - from, (void *)from);
984    CHECK("unable to unmap" && 0);
985  }
986}
987
988uptr MapDynamicShadow(uptr shadow_size_bytes, uptr shadow_scale,
989                      uptr min_shadow_base_alignment,
990                      UNUSED uptr &high_mem_end) {
991  const uptr granularity = GetMmapGranularity();
992  const uptr alignment =
993      Max<uptr>(granularity << shadow_scale, 1ULL << min_shadow_base_alignment);
994  const uptr left_padding =
995      Max<uptr>(granularity, 1ULL << min_shadow_base_alignment);
996
997  const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity);
998  const uptr map_size = shadow_size + left_padding + alignment;
999
1000  const uptr map_start = (uptr)MmapNoAccess(map_size);
1001  CHECK_NE(map_start, ~(uptr)0);
1002
1003  const uptr shadow_start = RoundUpTo(map_start + left_padding, alignment);
1004
1005  UnmapFromTo(map_start, shadow_start - left_padding);
1006  UnmapFromTo(shadow_start + shadow_size, map_start + map_size);
1007
1008  return shadow_start;
1009}
1010
1011static uptr MmapSharedNoReserve(uptr addr, uptr size) {
1012  return internal_mmap(
1013      reinterpret_cast<void *>(addr), size, PROT_READ | PROT_WRITE,
1014      MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS | MAP_NORESERVE, -1, 0);
1015}
1016
1017static uptr MremapCreateAlias(uptr base_addr, uptr alias_addr,
1018                              uptr alias_size) {
1019#if SANITIZER_LINUX
1020  return internal_mremap(reinterpret_cast<void *>(base_addr), 0, alias_size,
1021                         MREMAP_MAYMOVE | MREMAP_FIXED,
1022                         reinterpret_cast<void *>(alias_addr));
1023#else
1024  CHECK(false && "mremap is not supported outside of Linux");
1025  return 0;
1026#endif
1027}
1028
1029static void CreateAliases(uptr start_addr, uptr alias_size, uptr num_aliases) {
1030  uptr total_size = alias_size * num_aliases;
1031  uptr mapped = MmapSharedNoReserve(start_addr, total_size);
1032  CHECK_EQ(mapped, start_addr);
1033
1034  for (uptr i = 1; i < num_aliases; ++i) {
1035    uptr alias_addr = start_addr + i * alias_size;
1036    CHECK_EQ(MremapCreateAlias(start_addr, alias_addr, alias_size), alias_addr);
1037  }
1038}
1039
1040uptr MapDynamicShadowAndAliases(uptr shadow_size, uptr alias_size,
1041                                uptr num_aliases, uptr ring_buffer_size) {
1042  CHECK_EQ(alias_size & (alias_size - 1), 0);
1043  CHECK_EQ(num_aliases & (num_aliases - 1), 0);
1044  CHECK_EQ(ring_buffer_size & (ring_buffer_size - 1), 0);
1045
1046  const uptr granularity = GetMmapGranularity();
1047  shadow_size = RoundUpTo(shadow_size, granularity);
1048  CHECK_EQ(shadow_size & (shadow_size - 1), 0);
1049
1050  const uptr alias_region_size = alias_size * num_aliases;
1051  const uptr alignment =
1052      2 * Max(Max(shadow_size, alias_region_size), ring_buffer_size);
1053  const uptr left_padding = ring_buffer_size;
1054
1055  const uptr right_size = alignment;
1056  const uptr map_size = left_padding + 2 * alignment;
1057
1058  const uptr map_start = reinterpret_cast<uptr>(MmapNoAccess(map_size));
1059  CHECK_NE(map_start, static_cast<uptr>(-1));
1060  const uptr right_start = RoundUpTo(map_start + left_padding, alignment);
1061
1062  UnmapFromTo(map_start, right_start - left_padding);
1063  UnmapFromTo(right_start + right_size, map_start + map_size);
1064
1065  CreateAliases(right_start + right_size / 2, alias_size, num_aliases);
1066
1067  return right_start;
1068}
1069
1070void InitializePlatformCommonFlags(CommonFlags *cf) {
1071#if SANITIZER_ANDROID
1072  if (&__libc_get_static_tls_bounds == nullptr)
1073    cf->detect_leaks = false;
1074#endif
1075}
1076
1077} // namespace __sanitizer
1078
1079#endif
1080