1//===-- sanitizer_linux_libcdep.cpp ---------------------------------------===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file is shared between AddressSanitizer and ThreadSanitizer 10// run-time libraries and implements linux-specific functions from 11// sanitizer_libc.h. 12//===----------------------------------------------------------------------===// 13 14#include "sanitizer_platform.h" 15 16#if SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD || \ 17 SANITIZER_SOLARIS 18 19#include "sanitizer_allocator_internal.h" 20#include "sanitizer_atomic.h" 21#include "sanitizer_common.h" 22#include "sanitizer_file.h" 23#include "sanitizer_flags.h" 24#include "sanitizer_freebsd.h" 25#include "sanitizer_getauxval.h" 26#include "sanitizer_glibc_version.h" 27#include "sanitizer_linux.h" 28#include "sanitizer_placement_new.h" 29#include "sanitizer_procmaps.h" 30#include "sanitizer_solaris.h" 31 32#if SANITIZER_NETBSD 33#define _RTLD_SOURCE // for __lwp_gettcb_fast() / __lwp_getprivate_fast() 34#endif 35 36#include <dlfcn.h> // for dlsym() 37#include <link.h> 38#include <pthread.h> 39#include <signal.h> 40#include <sys/mman.h> 41#include <sys/resource.h> 42#include <syslog.h> 43 44#if !defined(ElfW) 45#define ElfW(type) Elf_##type 46#endif 47 48#if SANITIZER_FREEBSD 49#include <pthread_np.h> 50#include <osreldate.h> 51#include <sys/sysctl.h> 52#define pthread_getattr_np pthread_attr_get_np 53// The MAP_NORESERVE define has been removed in FreeBSD 11.x, and even before 54// that, it was never implemented. So just define it to zero. 55#undef MAP_NORESERVE 56#define MAP_NORESERVE 0 57#endif 58 59#if SANITIZER_NETBSD 60#include <sys/sysctl.h> 61#include <sys/tls.h> 62#include <lwp.h> 63#endif 64 65#if SANITIZER_SOLARIS 66#include <stddef.h> 67#include <stdlib.h> 68#include <thread.h> 69#endif 70 71#if SANITIZER_ANDROID 72#include <android/api-level.h> 73#if !defined(CPU_COUNT) && !defined(__aarch64__) 74#include <dirent.h> 75#include <fcntl.h> 76struct __sanitizer::linux_dirent { 77 long d_ino; 78 off_t d_off; 79 unsigned short d_reclen; 80 char d_name[]; 81}; 82#endif 83#endif 84 85#if !SANITIZER_ANDROID 86#include <elf.h> 87#include <unistd.h> 88#endif 89 90namespace __sanitizer { 91 92SANITIZER_WEAK_ATTRIBUTE int 93real_sigaction(int signum, const void *act, void *oldact); 94 95int internal_sigaction(int signum, const void *act, void *oldact) { 96#if !SANITIZER_GO 97 if (&real_sigaction) 98 return real_sigaction(signum, act, oldact); 99#endif 100 return sigaction(signum, (const struct sigaction *)act, 101 (struct sigaction *)oldact); 102} 103 104void GetThreadStackTopAndBottom(bool at_initialization, uptr *stack_top, 105 uptr *stack_bottom) { 106 CHECK(stack_top); 107 CHECK(stack_bottom); 108 if (at_initialization) { 109 // This is the main thread. Libpthread may not be initialized yet. 110 struct rlimit rl; 111 CHECK_EQ(getrlimit(RLIMIT_STACK, &rl), 0); 112 113 // Find the mapping that contains a stack variable. 114 MemoryMappingLayout proc_maps(/*cache_enabled*/true); 115 if (proc_maps.Error()) { 116 *stack_top = *stack_bottom = 0; 117 return; 118 } 119 MemoryMappedSegment segment; 120 uptr prev_end = 0; 121 while (proc_maps.Next(&segment)) { 122 if ((uptr)&rl < segment.end) break; 123 prev_end = segment.end; 124 } 125 CHECK((uptr)&rl >= segment.start && (uptr)&rl < segment.end); 126 127 // Get stacksize from rlimit, but clip it so that it does not overlap 128 // with other mappings. 129 uptr stacksize = rl.rlim_cur; 130 if (stacksize > segment.end - prev_end) stacksize = segment.end - prev_end; 131 // When running with unlimited stack size, we still want to set some limit. 132 // The unlimited stack size is caused by 'ulimit -s unlimited'. 133 // Also, for some reason, GNU make spawns subprocesses with unlimited stack. 134 if (stacksize > kMaxThreadStackSize) 135 stacksize = kMaxThreadStackSize; 136 *stack_top = segment.end; 137 *stack_bottom = segment.end - stacksize; 138 return; 139 } 140 uptr stacksize = 0; 141 void *stackaddr = nullptr; 142#if SANITIZER_SOLARIS 143 stack_t ss; 144 CHECK_EQ(thr_stksegment(&ss), 0); 145 stacksize = ss.ss_size; 146 stackaddr = (char *)ss.ss_sp - stacksize; 147#else // !SANITIZER_SOLARIS 148 pthread_attr_t attr; 149 pthread_attr_init(&attr); 150 CHECK_EQ(pthread_getattr_np(pthread_self(), &attr), 0); 151 my_pthread_attr_getstack(&attr, &stackaddr, &stacksize); 152 pthread_attr_destroy(&attr); 153#endif // SANITIZER_SOLARIS 154 155 *stack_top = (uptr)stackaddr + stacksize; 156 *stack_bottom = (uptr)stackaddr; 157} 158 159#if !SANITIZER_GO 160bool SetEnv(const char *name, const char *value) { 161 void *f = dlsym(RTLD_NEXT, "setenv"); 162 if (!f) 163 return false; 164 typedef int(*setenv_ft)(const char *name, const char *value, int overwrite); 165 setenv_ft setenv_f; 166 CHECK_EQ(sizeof(setenv_f), sizeof(f)); 167 internal_memcpy(&setenv_f, &f, sizeof(f)); 168 return setenv_f(name, value, 1) == 0; 169} 170#endif 171 172__attribute__((unused)) static bool GetLibcVersion(int *major, int *minor, 173 int *patch) { 174#ifdef _CS_GNU_LIBC_VERSION 175 char buf[64]; 176 uptr len = confstr(_CS_GNU_LIBC_VERSION, buf, sizeof(buf)); 177 if (len >= sizeof(buf)) 178 return false; 179 buf[len] = 0; 180 static const char kGLibC[] = "glibc "; 181 if (internal_strncmp(buf, kGLibC, sizeof(kGLibC) - 1) != 0) 182 return false; 183 const char *p = buf + sizeof(kGLibC) - 1; 184 *major = internal_simple_strtoll(p, &p, 10); 185 *minor = (*p == '.') ? internal_simple_strtoll(p + 1, &p, 10) : 0; 186 *patch = (*p == '.') ? internal_simple_strtoll(p + 1, &p, 10) : 0; 187 return true; 188#else 189 return false; 190#endif 191} 192 193// True if we can use dlpi_tls_data. glibc before 2.25 may leave NULL (BZ 194// #19826) so dlpi_tls_data cannot be used. 195// 196// musl before 1.2.3 and FreeBSD as of 12.2 incorrectly set dlpi_tls_data to 197// the TLS initialization image 198// https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254774 199__attribute__((unused)) static int g_use_dlpi_tls_data; 200 201#if SANITIZER_GLIBC && !SANITIZER_GO 202__attribute__((unused)) static size_t g_tls_size; 203void InitTlsSize() { 204 int major, minor, patch; 205 g_use_dlpi_tls_data = 206 GetLibcVersion(&major, &minor, &patch) && major == 2 && minor >= 25; 207 208#if defined(__aarch64__) || defined(__x86_64__) || defined(__powerpc64__) || \ 209 defined(__loongarch__) 210 void *get_tls_static_info = dlsym(RTLD_NEXT, "_dl_get_tls_static_info"); 211 size_t tls_align; 212 ((void (*)(size_t *, size_t *))get_tls_static_info)(&g_tls_size, &tls_align); 213#endif 214} 215#else 216void InitTlsSize() { } 217#endif // SANITIZER_GLIBC && !SANITIZER_GO 218 219// On glibc x86_64, ThreadDescriptorSize() needs to be precise due to the usage 220// of g_tls_size. On other targets, ThreadDescriptorSize() is only used by lsan 221// to get the pointer to thread-specific data keys in the thread control block. 222#if (SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_SOLARIS) && \ 223 !SANITIZER_ANDROID && !SANITIZER_GO 224// sizeof(struct pthread) from glibc. 225static atomic_uintptr_t thread_descriptor_size; 226 227static uptr ThreadDescriptorSizeFallback() { 228 uptr val = 0; 229#if defined(__x86_64__) || defined(__i386__) || defined(__arm__) 230 int major; 231 int minor; 232 int patch; 233 if (GetLibcVersion(&major, &minor, &patch) && major == 2) { 234 /* sizeof(struct pthread) values from various glibc versions. */ 235 if (SANITIZER_X32) 236 val = 1728; // Assume only one particular version for x32. 237 // For ARM sizeof(struct pthread) changed in Glibc 2.23. 238 else if (SANITIZER_ARM) 239 val = minor <= 22 ? 1120 : 1216; 240 else if (minor <= 3) 241 val = FIRST_32_SECOND_64(1104, 1696); 242 else if (minor == 4) 243 val = FIRST_32_SECOND_64(1120, 1728); 244 else if (minor == 5) 245 val = FIRST_32_SECOND_64(1136, 1728); 246 else if (minor <= 9) 247 val = FIRST_32_SECOND_64(1136, 1712); 248 else if (minor == 10) 249 val = FIRST_32_SECOND_64(1168, 1776); 250 else if (minor == 11 || (minor == 12 && patch == 1)) 251 val = FIRST_32_SECOND_64(1168, 2288); 252 else if (minor <= 14) 253 val = FIRST_32_SECOND_64(1168, 2304); 254 else if (minor < 32) // Unknown version 255 val = FIRST_32_SECOND_64(1216, 2304); 256 else // minor == 32 257 val = FIRST_32_SECOND_64(1344, 2496); 258 } 259#elif defined(__s390__) || defined(__sparc__) 260 // The size of a prefix of TCB including pthread::{specific_1stblock,specific} 261 // suffices. Just return offsetof(struct pthread, specific_used), which hasn't 262 // changed since 2007-05. Technically this applies to i386/x86_64 as well but 263 // we call _dl_get_tls_static_info and need the precise size of struct 264 // pthread. 265 return FIRST_32_SECOND_64(524, 1552); 266#elif defined(__mips__) 267 // TODO(sagarthakur): add more values as per different glibc versions. 268 val = FIRST_32_SECOND_64(1152, 1776); 269#elif SANITIZER_LOONGARCH64 270 val = 1856; // from glibc 2.36 271#elif SANITIZER_RISCV64 272 int major; 273 int minor; 274 int patch; 275 if (GetLibcVersion(&major, &minor, &patch) && major == 2) { 276 // TODO: consider adding an optional runtime check for an unknown (untested) 277 // glibc version 278 if (minor <= 28) // WARNING: the highest tested version is 2.29 279 val = 1772; // no guarantees for this one 280 else if (minor <= 31) 281 val = 1772; // tested against glibc 2.29, 2.31 282 else 283 val = 1936; // tested against glibc 2.32 284 } 285 286#elif defined(__aarch64__) 287 // The sizeof (struct pthread) is the same from GLIBC 2.17 to 2.22. 288 val = 1776; 289#elif defined(__powerpc64__) 290 val = 1776; // from glibc.ppc64le 2.20-8.fc21 291#endif 292 return val; 293} 294 295uptr ThreadDescriptorSize() { 296 uptr val = atomic_load_relaxed(&thread_descriptor_size); 297 if (val) 298 return val; 299 // _thread_db_sizeof_pthread is a GLIBC_PRIVATE symbol that is exported in 300 // glibc 2.34 and later. 301 if (unsigned *psizeof = static_cast<unsigned *>( 302 dlsym(RTLD_DEFAULT, "_thread_db_sizeof_pthread"))) 303 val = *psizeof; 304 if (!val) 305 val = ThreadDescriptorSizeFallback(); 306 atomic_store_relaxed(&thread_descriptor_size, val); 307 return val; 308} 309 310#if defined(__mips__) || defined(__powerpc64__) || SANITIZER_RISCV64 || \ 311 SANITIZER_LOONGARCH64 312// TlsPreTcbSize includes size of struct pthread_descr and size of tcb 313// head structure. It lies before the static tls blocks. 314static uptr TlsPreTcbSize() { 315#if defined(__mips__) 316 const uptr kTcbHead = 16; // sizeof (tcbhead_t) 317#elif defined(__powerpc64__) 318 const uptr kTcbHead = 88; // sizeof (tcbhead_t) 319#elif SANITIZER_RISCV64 320 const uptr kTcbHead = 16; // sizeof (tcbhead_t) 321#elif SANITIZER_LOONGARCH64 322 const uptr kTcbHead = 16; // sizeof (tcbhead_t) 323#endif 324 const uptr kTlsAlign = 16; 325 const uptr kTlsPreTcbSize = 326 RoundUpTo(ThreadDescriptorSize() + kTcbHead, kTlsAlign); 327 return kTlsPreTcbSize; 328} 329#endif 330 331namespace { 332struct TlsBlock { 333 uptr begin, end, align; 334 size_t tls_modid; 335 bool operator<(const TlsBlock &rhs) const { return begin < rhs.begin; } 336}; 337} // namespace 338 339#ifdef __s390__ 340extern "C" uptr __tls_get_offset(void *arg); 341 342static uptr TlsGetOffset(uptr ti_module, uptr ti_offset) { 343 // The __tls_get_offset ABI requires %r12 to point to GOT and %r2 to be an 344 // offset of a struct tls_index inside GOT. We don't possess either of the 345 // two, so violate the letter of the "ELF Handling For Thread-Local 346 // Storage" document and assume that the implementation just dereferences 347 // %r2 + %r12. 348 uptr tls_index[2] = {ti_module, ti_offset}; 349 register uptr r2 asm("2") = 0; 350 register void *r12 asm("12") = tls_index; 351 asm("basr %%r14, %[__tls_get_offset]" 352 : "+r"(r2) 353 : [__tls_get_offset] "r"(__tls_get_offset), "r"(r12) 354 : "memory", "cc", "0", "1", "3", "4", "5", "14"); 355 return r2; 356} 357#else 358extern "C" void *__tls_get_addr(size_t *); 359#endif 360 361static size_t main_tls_modid; 362 363static int CollectStaticTlsBlocks(struct dl_phdr_info *info, size_t size, 364 void *data) { 365 size_t tls_modid; 366#if SANITIZER_SOLARIS 367 // dlpi_tls_modid is only available since Solaris 11.4 SRU 10. Use 368 // dlinfo(RTLD_DI_LINKMAP) instead which works on all of Solaris 11.3, 369 // 11.4, and Illumos. The tlsmodid of the executable was changed to 1 in 370 // 11.4 to match other implementations. 371 if (size >= offsetof(dl_phdr_info_test, dlpi_tls_modid)) 372 main_tls_modid = 1; 373 else 374 main_tls_modid = 0; 375 g_use_dlpi_tls_data = 0; 376 Rt_map *map; 377 dlinfo(RTLD_SELF, RTLD_DI_LINKMAP, &map); 378 tls_modid = map->rt_tlsmodid; 379#else 380 main_tls_modid = 1; 381 tls_modid = info->dlpi_tls_modid; 382#endif 383 384 if (tls_modid < main_tls_modid) 385 return 0; 386 uptr begin; 387#if !SANITIZER_SOLARIS 388 begin = (uptr)info->dlpi_tls_data; 389#endif 390 if (!g_use_dlpi_tls_data) { 391 // Call __tls_get_addr as a fallback. This forces TLS allocation on glibc 392 // and FreeBSD. 393#ifdef __s390__ 394 begin = (uptr)__builtin_thread_pointer() + 395 TlsGetOffset(tls_modid, 0); 396#else 397 size_t mod_and_off[2] = {tls_modid, 0}; 398 begin = (uptr)__tls_get_addr(mod_and_off); 399#endif 400 } 401 for (unsigned i = 0; i != info->dlpi_phnum; ++i) 402 if (info->dlpi_phdr[i].p_type == PT_TLS) { 403 static_cast<InternalMmapVector<TlsBlock> *>(data)->push_back( 404 TlsBlock{begin, begin + info->dlpi_phdr[i].p_memsz, 405 info->dlpi_phdr[i].p_align, tls_modid}); 406 break; 407 } 408 return 0; 409} 410 411__attribute__((unused)) static void GetStaticTlsBoundary(uptr *addr, uptr *size, 412 uptr *align) { 413 InternalMmapVector<TlsBlock> ranges; 414 dl_iterate_phdr(CollectStaticTlsBlocks, &ranges); 415 uptr len = ranges.size(); 416 Sort(ranges.begin(), len); 417 // Find the range with tls_modid == main_tls_modid. For glibc, because 418 // libc.so uses PT_TLS, this module is guaranteed to exist and is one of 419 // the initially loaded modules. 420 uptr one = 0; 421 while (one != len && ranges[one].tls_modid != main_tls_modid) ++one; 422 if (one == len) { 423 // This may happen with musl if no module uses PT_TLS. 424 *addr = 0; 425 *size = 0; 426 *align = 1; 427 return; 428 } 429 // Find the maximum consecutive ranges. We consider two modules consecutive if 430 // the gap is smaller than the alignment of the latter range. The dynamic 431 // loader places static TLS blocks this way not to waste space. 432 uptr l = one; 433 *align = ranges[l].align; 434 while (l != 0 && ranges[l].begin < ranges[l - 1].end + ranges[l].align) 435 *align = Max(*align, ranges[--l].align); 436 uptr r = one + 1; 437 while (r != len && ranges[r].begin < ranges[r - 1].end + ranges[r].align) 438 *align = Max(*align, ranges[r++].align); 439 *addr = ranges[l].begin; 440 *size = ranges[r - 1].end - ranges[l].begin; 441} 442#endif // (x86_64 || i386 || mips || ...) && (SANITIZER_FREEBSD || 443 // SANITIZER_LINUX) && !SANITIZER_ANDROID && !SANITIZER_GO 444 445#if SANITIZER_NETBSD 446static struct tls_tcb * ThreadSelfTlsTcb() { 447 struct tls_tcb *tcb = nullptr; 448#ifdef __HAVE___LWP_GETTCB_FAST 449 tcb = (struct tls_tcb *)__lwp_gettcb_fast(); 450#elif defined(__HAVE___LWP_GETPRIVATE_FAST) 451 tcb = (struct tls_tcb *)__lwp_getprivate_fast(); 452#endif 453 return tcb; 454} 455 456uptr ThreadSelf() { 457 return (uptr)ThreadSelfTlsTcb()->tcb_pthread; 458} 459 460int GetSizeFromHdr(struct dl_phdr_info *info, size_t size, void *data) { 461 const Elf_Phdr *hdr = info->dlpi_phdr; 462 const Elf_Phdr *last_hdr = hdr + info->dlpi_phnum; 463 464 for (; hdr != last_hdr; ++hdr) { 465 if (hdr->p_type == PT_TLS && info->dlpi_tls_modid == 1) { 466 *(uptr*)data = hdr->p_memsz; 467 break; 468 } 469 } 470 return 0; 471} 472#endif // SANITIZER_NETBSD 473 474#if SANITIZER_ANDROID 475// Bionic provides this API since S. 476extern "C" SANITIZER_WEAK_ATTRIBUTE void __libc_get_static_tls_bounds(void **, 477 void **); 478#endif 479 480#if !SANITIZER_GO 481static void GetTls(uptr *addr, uptr *size) { 482#if SANITIZER_ANDROID 483 if (&__libc_get_static_tls_bounds) { 484 void *start_addr; 485 void *end_addr; 486 __libc_get_static_tls_bounds(&start_addr, &end_addr); 487 *addr = reinterpret_cast<uptr>(start_addr); 488 *size = 489 reinterpret_cast<uptr>(end_addr) - reinterpret_cast<uptr>(start_addr); 490 } else { 491 *addr = 0; 492 *size = 0; 493 } 494#elif SANITIZER_GLIBC && defined(__x86_64__) 495 // For aarch64 and x86-64, use an O(1) approach which requires relatively 496 // precise ThreadDescriptorSize. g_tls_size was initialized in InitTlsSize. 497# if SANITIZER_X32 498 asm("mov %%fs:8,%0" : "=r"(*addr)); 499# else 500 asm("mov %%fs:16,%0" : "=r"(*addr)); 501# endif 502 *size = g_tls_size; 503 *addr -= *size; 504 *addr += ThreadDescriptorSize(); 505#elif SANITIZER_GLIBC && defined(__aarch64__) 506 *addr = reinterpret_cast<uptr>(__builtin_thread_pointer()) - 507 ThreadDescriptorSize(); 508 *size = g_tls_size + ThreadDescriptorSize(); 509#elif SANITIZER_GLIBC && defined(__loongarch__) 510# ifdef __clang__ 511 *addr = reinterpret_cast<uptr>(__builtin_thread_pointer()) - 512 ThreadDescriptorSize(); 513# else 514 asm("or %0,$tp,$zero" : "=r"(*addr)); 515 *addr -= ThreadDescriptorSize(); 516# endif 517 *size = g_tls_size + ThreadDescriptorSize(); 518#elif SANITIZER_GLIBC && defined(__powerpc64__) 519 // Workaround for glibc<2.25(?). 2.27 is known to not need this. 520 uptr tp; 521 asm("addi %0,13,-0x7000" : "=r"(tp)); 522 const uptr pre_tcb_size = TlsPreTcbSize(); 523 *addr = tp - pre_tcb_size; 524 *size = g_tls_size + pre_tcb_size; 525#elif SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_SOLARIS 526 uptr align; 527 GetStaticTlsBoundary(addr, size, &align); 528#if defined(__x86_64__) || defined(__i386__) || defined(__s390__) || \ 529 defined(__sparc__) 530 if (SANITIZER_GLIBC) { 531#if defined(__x86_64__) || defined(__i386__) 532 align = Max<uptr>(align, 64); 533#else 534 align = Max<uptr>(align, 16); 535#endif 536 } 537 const uptr tp = RoundUpTo(*addr + *size, align); 538 539 // lsan requires the range to additionally cover the static TLS surplus 540 // (elf/dl-tls.c defines 1664). Otherwise there may be false positives for 541 // allocations only referenced by tls in dynamically loaded modules. 542 if (SANITIZER_GLIBC) 543 *size += 1644; 544 else if (SANITIZER_FREEBSD) 545 *size += 128; // RTLD_STATIC_TLS_EXTRA 546 547 // Extend the range to include the thread control block. On glibc, lsan needs 548 // the range to include pthread::{specific_1stblock,specific} so that 549 // allocations only referenced by pthread_setspecific can be scanned. This may 550 // underestimate by at most TLS_TCB_ALIGN-1 bytes but it should be fine 551 // because the number of bytes after pthread::specific is larger. 552 *addr = tp - RoundUpTo(*size, align); 553 *size = tp - *addr + ThreadDescriptorSize(); 554#else 555 if (SANITIZER_GLIBC) 556 *size += 1664; 557 else if (SANITIZER_FREEBSD) 558 *size += 128; // RTLD_STATIC_TLS_EXTRA 559#if defined(__mips__) || defined(__powerpc64__) || SANITIZER_RISCV64 560 const uptr pre_tcb_size = TlsPreTcbSize(); 561 *addr -= pre_tcb_size; 562 *size += pre_tcb_size; 563#else 564 // arm and aarch64 reserve two words at TP, so this underestimates the range. 565 // However, this is sufficient for the purpose of finding the pointers to 566 // thread-specific data keys. 567 const uptr tcb_size = ThreadDescriptorSize(); 568 *addr -= tcb_size; 569 *size += tcb_size; 570#endif 571#endif 572#elif SANITIZER_NETBSD 573 struct tls_tcb * const tcb = ThreadSelfTlsTcb(); 574 *addr = 0; 575 *size = 0; 576 if (tcb != 0) { 577 // Find size (p_memsz) of dlpi_tls_modid 1 (TLS block of the main program). 578 // ld.elf_so hardcodes the index 1. 579 dl_iterate_phdr(GetSizeFromHdr, size); 580 581 if (*size != 0) { 582 // The block has been found and tcb_dtv[1] contains the base address 583 *addr = (uptr)tcb->tcb_dtv[1]; 584 } 585 } 586#else 587#error "Unknown OS" 588#endif 589} 590#endif 591 592#if !SANITIZER_GO 593uptr GetTlsSize() { 594#if SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD || \ 595 SANITIZER_SOLARIS 596 uptr addr, size; 597 GetTls(&addr, &size); 598 return size; 599#else 600 return 0; 601#endif 602} 603#endif 604 605void GetThreadStackAndTls(bool main, uptr *stk_addr, uptr *stk_size, 606 uptr *tls_addr, uptr *tls_size) { 607#if SANITIZER_GO 608 // Stub implementation for Go. 609 *stk_addr = *stk_size = *tls_addr = *tls_size = 0; 610#else 611 GetTls(tls_addr, tls_size); 612 613 uptr stack_top, stack_bottom; 614 GetThreadStackTopAndBottom(main, &stack_top, &stack_bottom); 615 *stk_addr = stack_bottom; 616 *stk_size = stack_top - stack_bottom; 617 618 if (!main) { 619 // If stack and tls intersect, make them non-intersecting. 620 if (*tls_addr > *stk_addr && *tls_addr < *stk_addr + *stk_size) { 621 if (*stk_addr + *stk_size < *tls_addr + *tls_size) 622 *tls_size = *stk_addr + *stk_size - *tls_addr; 623 *stk_size = *tls_addr - *stk_addr; 624 } 625 } 626#endif 627} 628 629#if !SANITIZER_FREEBSD 630typedef ElfW(Phdr) Elf_Phdr; 631#elif SANITIZER_WORDSIZE == 32 && __FreeBSD_version <= 902001 // v9.2 632#define Elf_Phdr XElf32_Phdr 633#define dl_phdr_info xdl_phdr_info 634#define dl_iterate_phdr(c, b) xdl_iterate_phdr((c), (b)) 635#endif // !SANITIZER_FREEBSD 636 637struct DlIteratePhdrData { 638 InternalMmapVectorNoCtor<LoadedModule> *modules; 639 bool first; 640}; 641 642static int AddModuleSegments(const char *module_name, dl_phdr_info *info, 643 InternalMmapVectorNoCtor<LoadedModule> *modules) { 644 if (module_name[0] == '\0') 645 return 0; 646 LoadedModule cur_module; 647 cur_module.set(module_name, info->dlpi_addr); 648 for (int i = 0; i < (int)info->dlpi_phnum; i++) { 649 const Elf_Phdr *phdr = &info->dlpi_phdr[i]; 650 if (phdr->p_type == PT_LOAD) { 651 uptr cur_beg = info->dlpi_addr + phdr->p_vaddr; 652 uptr cur_end = cur_beg + phdr->p_memsz; 653 bool executable = phdr->p_flags & PF_X; 654 bool writable = phdr->p_flags & PF_W; 655 cur_module.addAddressRange(cur_beg, cur_end, executable, 656 writable); 657 } else if (phdr->p_type == PT_NOTE) { 658# ifdef NT_GNU_BUILD_ID 659 uptr off = 0; 660 while (off + sizeof(ElfW(Nhdr)) < phdr->p_memsz) { 661 auto *nhdr = reinterpret_cast<const ElfW(Nhdr) *>(info->dlpi_addr + 662 phdr->p_vaddr + off); 663 constexpr auto kGnuNamesz = 4; // "GNU" with NUL-byte. 664 static_assert(kGnuNamesz % 4 == 0, "kGnuNameSize is aligned to 4."); 665 if (nhdr->n_type == NT_GNU_BUILD_ID && nhdr->n_namesz == kGnuNamesz) { 666 if (off + sizeof(ElfW(Nhdr)) + nhdr->n_namesz + nhdr->n_descsz > 667 phdr->p_memsz) { 668 // Something is very wrong, bail out instead of reading potentially 669 // arbitrary memory. 670 break; 671 } 672 const char *name = 673 reinterpret_cast<const char *>(nhdr) + sizeof(*nhdr); 674 if (internal_memcmp(name, "GNU", 3) == 0) { 675 const char *value = reinterpret_cast<const char *>(nhdr) + 676 sizeof(*nhdr) + kGnuNamesz; 677 cur_module.setUuid(value, nhdr->n_descsz); 678 break; 679 } 680 } 681 off += sizeof(*nhdr) + RoundUpTo(nhdr->n_namesz, 4) + 682 RoundUpTo(nhdr->n_descsz, 4); 683 } 684# endif 685 } 686 } 687 modules->push_back(cur_module); 688 return 0; 689} 690 691static int dl_iterate_phdr_cb(dl_phdr_info *info, size_t size, void *arg) { 692 DlIteratePhdrData *data = (DlIteratePhdrData *)arg; 693 if (data->first) { 694 InternalMmapVector<char> module_name(kMaxPathLength); 695 data->first = false; 696 // First module is the binary itself. 697 ReadBinaryNameCached(module_name.data(), module_name.size()); 698 return AddModuleSegments(module_name.data(), info, data->modules); 699 } 700 701 if (info->dlpi_name) { 702 InternalScopedString module_name; 703 module_name.append("%s", info->dlpi_name); 704 return AddModuleSegments(module_name.data(), info, data->modules); 705 } 706 707 return 0; 708} 709 710#if SANITIZER_ANDROID && __ANDROID_API__ < 21 711extern "C" __attribute__((weak)) int dl_iterate_phdr( 712 int (*)(struct dl_phdr_info *, size_t, void *), void *); 713#endif 714 715static bool requiresProcmaps() { 716#if SANITIZER_ANDROID && __ANDROID_API__ <= 22 717 // Fall back to /proc/maps if dl_iterate_phdr is unavailable or broken. 718 // The runtime check allows the same library to work with 719 // both K and L (and future) Android releases. 720 return AndroidGetApiLevel() <= ANDROID_LOLLIPOP_MR1; 721#else 722 return false; 723#endif 724} 725 726static void procmapsInit(InternalMmapVectorNoCtor<LoadedModule> *modules) { 727 MemoryMappingLayout memory_mapping(/*cache_enabled*/true); 728 memory_mapping.DumpListOfModules(modules); 729} 730 731void ListOfModules::init() { 732 clearOrInit(); 733 if (requiresProcmaps()) { 734 procmapsInit(&modules_); 735 } else { 736 DlIteratePhdrData data = {&modules_, true}; 737 dl_iterate_phdr(dl_iterate_phdr_cb, &data); 738 } 739} 740 741// When a custom loader is used, dl_iterate_phdr may not contain the full 742// list of modules. Allow callers to fall back to using procmaps. 743void ListOfModules::fallbackInit() { 744 if (!requiresProcmaps()) { 745 clearOrInit(); 746 procmapsInit(&modules_); 747 } else { 748 clear(); 749 } 750} 751 752// getrusage does not give us the current RSS, only the max RSS. 753// Still, this is better than nothing if /proc/self/statm is not available 754// for some reason, e.g. due to a sandbox. 755static uptr GetRSSFromGetrusage() { 756 struct rusage usage; 757 if (getrusage(RUSAGE_SELF, &usage)) // Failed, probably due to a sandbox. 758 return 0; 759 return usage.ru_maxrss << 10; // ru_maxrss is in Kb. 760} 761 762uptr GetRSS() { 763 if (!common_flags()->can_use_proc_maps_statm) 764 return GetRSSFromGetrusage(); 765 fd_t fd = OpenFile("/proc/self/statm", RdOnly); 766 if (fd == kInvalidFd) 767 return GetRSSFromGetrusage(); 768 char buf[64]; 769 uptr len = internal_read(fd, buf, sizeof(buf) - 1); 770 internal_close(fd); 771 if ((sptr)len <= 0) 772 return 0; 773 buf[len] = 0; 774 // The format of the file is: 775 // 1084 89 69 11 0 79 0 776 // We need the second number which is RSS in pages. 777 char *pos = buf; 778 // Skip the first number. 779 while (*pos >= '0' && *pos <= '9') 780 pos++; 781 // Skip whitespaces. 782 while (!(*pos >= '0' && *pos <= '9') && *pos != 0) 783 pos++; 784 // Read the number. 785 uptr rss = 0; 786 while (*pos >= '0' && *pos <= '9') 787 rss = rss * 10 + *pos++ - '0'; 788 return rss * GetPageSizeCached(); 789} 790 791// sysconf(_SC_NPROCESSORS_{CONF,ONLN}) cannot be used on most platforms as 792// they allocate memory. 793u32 GetNumberOfCPUs() { 794#if SANITIZER_FREEBSD || SANITIZER_NETBSD 795 u32 ncpu; 796 int req[2]; 797 uptr len = sizeof(ncpu); 798 req[0] = CTL_HW; 799 req[1] = HW_NCPU; 800 CHECK_EQ(internal_sysctl(req, 2, &ncpu, &len, NULL, 0), 0); 801 return ncpu; 802#elif SANITIZER_ANDROID && !defined(CPU_COUNT) && !defined(__aarch64__) 803 // Fall back to /sys/devices/system/cpu on Android when cpu_set_t doesn't 804 // exist in sched.h. That is the case for toolchains generated with older 805 // NDKs. 806 // This code doesn't work on AArch64 because internal_getdents makes use of 807 // the 64bit getdents syscall, but cpu_set_t seems to always exist on AArch64. 808 uptr fd = internal_open("/sys/devices/system/cpu", O_RDONLY | O_DIRECTORY); 809 if (internal_iserror(fd)) 810 return 0; 811 InternalMmapVector<u8> buffer(4096); 812 uptr bytes_read = buffer.size(); 813 uptr n_cpus = 0; 814 u8 *d_type; 815 struct linux_dirent *entry = (struct linux_dirent *)&buffer[bytes_read]; 816 while (true) { 817 if ((u8 *)entry >= &buffer[bytes_read]) { 818 bytes_read = internal_getdents(fd, (struct linux_dirent *)buffer.data(), 819 buffer.size()); 820 if (internal_iserror(bytes_read) || !bytes_read) 821 break; 822 entry = (struct linux_dirent *)buffer.data(); 823 } 824 d_type = (u8 *)entry + entry->d_reclen - 1; 825 if (d_type >= &buffer[bytes_read] || 826 (u8 *)&entry->d_name[3] >= &buffer[bytes_read]) 827 break; 828 if (entry->d_ino != 0 && *d_type == DT_DIR) { 829 if (entry->d_name[0] == 'c' && entry->d_name[1] == 'p' && 830 entry->d_name[2] == 'u' && 831 entry->d_name[3] >= '0' && entry->d_name[3] <= '9') 832 n_cpus++; 833 } 834 entry = (struct linux_dirent *)(((u8 *)entry) + entry->d_reclen); 835 } 836 internal_close(fd); 837 return n_cpus; 838#elif SANITIZER_SOLARIS 839 return sysconf(_SC_NPROCESSORS_ONLN); 840#else 841 cpu_set_t CPUs; 842 CHECK_EQ(sched_getaffinity(0, sizeof(cpu_set_t), &CPUs), 0); 843 return CPU_COUNT(&CPUs); 844#endif 845} 846 847#if SANITIZER_LINUX 848 849#if SANITIZER_ANDROID 850static atomic_uint8_t android_log_initialized; 851 852void AndroidLogInit() { 853 openlog(GetProcessName(), 0, LOG_USER); 854 atomic_store(&android_log_initialized, 1, memory_order_release); 855} 856 857static bool ShouldLogAfterPrintf() { 858 return atomic_load(&android_log_initialized, memory_order_acquire); 859} 860 861extern "C" SANITIZER_WEAK_ATTRIBUTE 862int async_safe_write_log(int pri, const char* tag, const char* msg); 863extern "C" SANITIZER_WEAK_ATTRIBUTE 864int __android_log_write(int prio, const char* tag, const char* msg); 865 866// ANDROID_LOG_INFO is 4, but can't be resolved at runtime. 867#define SANITIZER_ANDROID_LOG_INFO 4 868 869// async_safe_write_log is a new public version of __libc_write_log that is 870// used behind syslog. It is preferable to syslog as it will not do any dynamic 871// memory allocation or formatting. 872// If the function is not available, syslog is preferred for L+ (it was broken 873// pre-L) as __android_log_write triggers a racey behavior with the strncpy 874// interceptor. Fallback to __android_log_write pre-L. 875void WriteOneLineToSyslog(const char *s) { 876 if (&async_safe_write_log) { 877 async_safe_write_log(SANITIZER_ANDROID_LOG_INFO, GetProcessName(), s); 878 } else if (AndroidGetApiLevel() > ANDROID_KITKAT) { 879 syslog(LOG_INFO, "%s", s); 880 } else { 881 CHECK(&__android_log_write); 882 __android_log_write(SANITIZER_ANDROID_LOG_INFO, nullptr, s); 883 } 884} 885 886extern "C" SANITIZER_WEAK_ATTRIBUTE 887void android_set_abort_message(const char *); 888 889void SetAbortMessage(const char *str) { 890 if (&android_set_abort_message) 891 android_set_abort_message(str); 892} 893#else 894void AndroidLogInit() {} 895 896static bool ShouldLogAfterPrintf() { return true; } 897 898void WriteOneLineToSyslog(const char *s) { syslog(LOG_INFO, "%s", s); } 899 900void SetAbortMessage(const char *str) {} 901#endif // SANITIZER_ANDROID 902 903void LogMessageOnPrintf(const char *str) { 904 if (common_flags()->log_to_syslog && ShouldLogAfterPrintf()) 905 WriteToSyslog(str); 906} 907 908#endif // SANITIZER_LINUX 909 910#if SANITIZER_GLIBC && !SANITIZER_GO 911// glibc crashes when using clock_gettime from a preinit_array function as the 912// vDSO function pointers haven't been initialized yet. __progname is 913// initialized after the vDSO function pointers, so if it exists, is not null 914// and is not empty, we can use clock_gettime. 915extern "C" SANITIZER_WEAK_ATTRIBUTE char *__progname; 916inline bool CanUseVDSO() { return &__progname && __progname && *__progname; } 917 918// MonotonicNanoTime is a timing function that can leverage the vDSO by calling 919// clock_gettime. real_clock_gettime only exists if clock_gettime is 920// intercepted, so define it weakly and use it if available. 921extern "C" SANITIZER_WEAK_ATTRIBUTE 922int real_clock_gettime(u32 clk_id, void *tp); 923u64 MonotonicNanoTime() { 924 timespec ts; 925 if (CanUseVDSO()) { 926 if (&real_clock_gettime) 927 real_clock_gettime(CLOCK_MONOTONIC, &ts); 928 else 929 clock_gettime(CLOCK_MONOTONIC, &ts); 930 } else { 931 internal_clock_gettime(CLOCK_MONOTONIC, &ts); 932 } 933 return (u64)ts.tv_sec * (1000ULL * 1000 * 1000) + ts.tv_nsec; 934} 935#else 936// Non-glibc & Go always use the regular function. 937u64 MonotonicNanoTime() { 938 timespec ts; 939 clock_gettime(CLOCK_MONOTONIC, &ts); 940 return (u64)ts.tv_sec * (1000ULL * 1000 * 1000) + ts.tv_nsec; 941} 942#endif // SANITIZER_GLIBC && !SANITIZER_GO 943 944void ReExec() { 945 const char *pathname = "/proc/self/exe"; 946 947#if SANITIZER_NETBSD 948 static const int name[] = { 949 CTL_KERN, 950 KERN_PROC_ARGS, 951 -1, 952 KERN_PROC_PATHNAME, 953 }; 954 char path[400]; 955 uptr len; 956 957 len = sizeof(path); 958 if (internal_sysctl(name, ARRAY_SIZE(name), path, &len, NULL, 0) != -1) 959 pathname = path; 960#elif SANITIZER_SOLARIS 961 pathname = getexecname(); 962 CHECK_NE(pathname, NULL); 963#elif SANITIZER_USE_GETAUXVAL 964 // Calling execve with /proc/self/exe sets that as $EXEC_ORIGIN. Binaries that 965 // rely on that will fail to load shared libraries. Query AT_EXECFN instead. 966 pathname = reinterpret_cast<const char *>(getauxval(AT_EXECFN)); 967#endif 968 969 uptr rv = internal_execve(pathname, GetArgv(), GetEnviron()); 970 int rverrno; 971 CHECK_EQ(internal_iserror(rv, &rverrno), true); 972 Printf("execve failed, errno %d\n", rverrno); 973 Die(); 974} 975 976void UnmapFromTo(uptr from, uptr to) { 977 if (to == from) 978 return; 979 CHECK(to >= from); 980 uptr res = internal_munmap(reinterpret_cast<void *>(from), to - from); 981 if (UNLIKELY(internal_iserror(res))) { 982 Report("ERROR: %s failed to unmap 0x%zx (%zd) bytes at address %p\n", 983 SanitizerToolName, to - from, to - from, (void *)from); 984 CHECK("unable to unmap" && 0); 985 } 986} 987 988uptr MapDynamicShadow(uptr shadow_size_bytes, uptr shadow_scale, 989 uptr min_shadow_base_alignment, 990 UNUSED uptr &high_mem_end) { 991 const uptr granularity = GetMmapGranularity(); 992 const uptr alignment = 993 Max<uptr>(granularity << shadow_scale, 1ULL << min_shadow_base_alignment); 994 const uptr left_padding = 995 Max<uptr>(granularity, 1ULL << min_shadow_base_alignment); 996 997 const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity); 998 const uptr map_size = shadow_size + left_padding + alignment; 999 1000 const uptr map_start = (uptr)MmapNoAccess(map_size); 1001 CHECK_NE(map_start, ~(uptr)0); 1002 1003 const uptr shadow_start = RoundUpTo(map_start + left_padding, alignment); 1004 1005 UnmapFromTo(map_start, shadow_start - left_padding); 1006 UnmapFromTo(shadow_start + shadow_size, map_start + map_size); 1007 1008 return shadow_start; 1009} 1010 1011static uptr MmapSharedNoReserve(uptr addr, uptr size) { 1012 return internal_mmap( 1013 reinterpret_cast<void *>(addr), size, PROT_READ | PROT_WRITE, 1014 MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS | MAP_NORESERVE, -1, 0); 1015} 1016 1017static uptr MremapCreateAlias(uptr base_addr, uptr alias_addr, 1018 uptr alias_size) { 1019#if SANITIZER_LINUX 1020 return internal_mremap(reinterpret_cast<void *>(base_addr), 0, alias_size, 1021 MREMAP_MAYMOVE | MREMAP_FIXED, 1022 reinterpret_cast<void *>(alias_addr)); 1023#else 1024 CHECK(false && "mremap is not supported outside of Linux"); 1025 return 0; 1026#endif 1027} 1028 1029static void CreateAliases(uptr start_addr, uptr alias_size, uptr num_aliases) { 1030 uptr total_size = alias_size * num_aliases; 1031 uptr mapped = MmapSharedNoReserve(start_addr, total_size); 1032 CHECK_EQ(mapped, start_addr); 1033 1034 for (uptr i = 1; i < num_aliases; ++i) { 1035 uptr alias_addr = start_addr + i * alias_size; 1036 CHECK_EQ(MremapCreateAlias(start_addr, alias_addr, alias_size), alias_addr); 1037 } 1038} 1039 1040uptr MapDynamicShadowAndAliases(uptr shadow_size, uptr alias_size, 1041 uptr num_aliases, uptr ring_buffer_size) { 1042 CHECK_EQ(alias_size & (alias_size - 1), 0); 1043 CHECK_EQ(num_aliases & (num_aliases - 1), 0); 1044 CHECK_EQ(ring_buffer_size & (ring_buffer_size - 1), 0); 1045 1046 const uptr granularity = GetMmapGranularity(); 1047 shadow_size = RoundUpTo(shadow_size, granularity); 1048 CHECK_EQ(shadow_size & (shadow_size - 1), 0); 1049 1050 const uptr alias_region_size = alias_size * num_aliases; 1051 const uptr alignment = 1052 2 * Max(Max(shadow_size, alias_region_size), ring_buffer_size); 1053 const uptr left_padding = ring_buffer_size; 1054 1055 const uptr right_size = alignment; 1056 const uptr map_size = left_padding + 2 * alignment; 1057 1058 const uptr map_start = reinterpret_cast<uptr>(MmapNoAccess(map_size)); 1059 CHECK_NE(map_start, static_cast<uptr>(-1)); 1060 const uptr right_start = RoundUpTo(map_start + left_padding, alignment); 1061 1062 UnmapFromTo(map_start, right_start - left_padding); 1063 UnmapFromTo(right_start + right_size, map_start + map_size); 1064 1065 CreateAliases(right_start + right_size / 2, alias_size, num_aliases); 1066 1067 return right_start; 1068} 1069 1070void InitializePlatformCommonFlags(CommonFlags *cf) { 1071#if SANITIZER_ANDROID 1072 if (&__libc_get_static_tls_bounds == nullptr) 1073 cf->detect_leaks = false; 1074#endif 1075} 1076 1077} // namespace __sanitizer 1078 1079#endif 1080