| //===-- asan_thread.cpp ---------------------------------------------------===// |
| // |
| // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| // See https://llvm.org/LICENSE.txt for license information. |
| // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
| // |
| //===----------------------------------------------------------------------===// |
| // |
| // This file is a part of AddressSanitizer, an address sanity checker. |
| // |
| // Thread-related code. |
| //===----------------------------------------------------------------------===// |
| #include "asan_allocator.h" |
| #include "asan_interceptors.h" |
| #include "asan_poisoning.h" |
| #include "asan_stack.h" |
| #include "asan_thread.h" |
| #include "asan_mapping.h" |
| #include "sanitizer_common/sanitizer_common.h" |
| #include "sanitizer_common/sanitizer_placement_new.h" |
| #include "sanitizer_common/sanitizer_stackdepot.h" |
| #include "sanitizer_common/sanitizer_tls_get_addr.h" |
| #include "lsan/lsan_common.h" |
| |
| namespace __asan { |
| |
| // AsanThreadContext implementation. |
| |
| void AsanThreadContext::OnCreated(void *arg) { |
| CreateThreadContextArgs *args = static_cast<CreateThreadContextArgs*>(arg); |
| if (args->stack) |
| stack_id = StackDepotPut(*args->stack); |
| thread = args->thread; |
| thread->set_context(this); |
| } |
| |
| void AsanThreadContext::OnFinished() { |
| // Drop the link to the AsanThread object. |
| thread = nullptr; |
| } |
| |
| // MIPS requires aligned address |
| static ALIGNED(16) char thread_registry_placeholder[sizeof(ThreadRegistry)]; |
| static ThreadRegistry *asan_thread_registry; |
| |
| static Mutex mu_for_thread_context; |
| static LowLevelAllocator allocator_for_thread_context; |
| |
| static ThreadContextBase *GetAsanThreadContext(u32 tid) { |
| Lock lock(&mu_for_thread_context); |
| return new(allocator_for_thread_context) AsanThreadContext(tid); |
| } |
| |
| ThreadRegistry &asanThreadRegistry() { |
| static bool initialized; |
| // Don't worry about thread_safety - this should be called when there is |
| // a single thread. |
| if (!initialized) { |
| // Never reuse ASan threads: we store pointer to AsanThreadContext |
| // in TSD and can't reliably tell when no more TSD destructors will |
| // be called. It would be wrong to reuse AsanThreadContext for another |
| // thread before all TSD destructors will be called for it. |
| asan_thread_registry = |
| new (thread_registry_placeholder) ThreadRegistry(GetAsanThreadContext); |
| initialized = true; |
| } |
| return *asan_thread_registry; |
| } |
| |
| AsanThreadContext *GetThreadContextByTidLocked(u32 tid) { |
| return static_cast<AsanThreadContext *>( |
| asanThreadRegistry().GetThreadLocked(tid)); |
| } |
| |
| // AsanThread implementation. |
| |
| AsanThread *AsanThread::Create(thread_callback_t start_routine, void *arg, |
| u32 parent_tid, StackTrace *stack, |
| bool detached) { |
| uptr PageSize = GetPageSizeCached(); |
| uptr size = RoundUpTo(sizeof(AsanThread), PageSize); |
| AsanThread *thread = (AsanThread*)MmapOrDie(size, __func__); |
| thread->start_routine_ = start_routine; |
| thread->arg_ = arg; |
| AsanThreadContext::CreateThreadContextArgs args = {thread, stack}; |
| asanThreadRegistry().CreateThread(*reinterpret_cast<uptr *>(thread), detached, |
| parent_tid, &args); |
| |
| return thread; |
| } |
| |
| void AsanThread::TSDDtor(void *tsd) { |
| AsanThreadContext *context = (AsanThreadContext*)tsd; |
| VReport(1, "T%d TSDDtor\n", context->tid); |
| if (context->thread) |
| context->thread->Destroy(); |
| } |
| |
| void AsanThread::Destroy() { |
| int tid = this->tid(); |
| VReport(1, "T%d exited\n", tid); |
| |
| bool was_running = |
| (asanThreadRegistry().FinishThread(tid) == ThreadStatusRunning); |
| if (was_running) { |
| if (AsanThread *thread = GetCurrentThread()) |
| CHECK_EQ(this, thread); |
| malloc_storage().CommitBack(); |
| if (common_flags()->use_sigaltstack) |
| UnsetAlternateSignalStack(); |
| FlushToDeadThreadStats(&stats_); |
| // We also clear the shadow on thread destruction because |
| // some code may still be executing in later TSD destructors |
| // and we don't want it to have any poisoned stack. |
| ClearShadowForThreadStackAndTLS(); |
| DeleteFakeStack(tid); |
| } else { |
| CHECK_NE(this, GetCurrentThread()); |
| } |
| uptr size = RoundUpTo(sizeof(AsanThread), GetPageSizeCached()); |
| UnmapOrDie(this, size); |
| if (was_running) |
| DTLS_Destroy(); |
| } |
| |
| void AsanThread::StartSwitchFiber(FakeStack **fake_stack_save, uptr bottom, |
| uptr size) { |
| if (atomic_load(&stack_switching_, memory_order_relaxed)) { |
| Report("ERROR: starting fiber switch while in fiber switch\n"); |
| Die(); |
| } |
| |
| next_stack_bottom_ = bottom; |
| next_stack_top_ = bottom + size; |
| atomic_store(&stack_switching_, 1, memory_order_release); |
| |
| FakeStack *current_fake_stack = fake_stack_; |
| if (fake_stack_save) |
| *fake_stack_save = fake_stack_; |
| fake_stack_ = nullptr; |
| SetTLSFakeStack(nullptr); |
| // if fake_stack_save is null, the fiber will die, delete the fakestack |
| if (!fake_stack_save && current_fake_stack) |
| current_fake_stack->Destroy(this->tid()); |
| } |
| |
| void AsanThread::FinishSwitchFiber(FakeStack *fake_stack_save, |
| uptr *bottom_old, |
| uptr *size_old) { |
| if (!atomic_load(&stack_switching_, memory_order_relaxed)) { |
| Report("ERROR: finishing a fiber switch that has not started\n"); |
| Die(); |
| } |
| |
| if (fake_stack_save) { |
| SetTLSFakeStack(fake_stack_save); |
| fake_stack_ = fake_stack_save; |
| } |
| |
| if (bottom_old) |
| *bottom_old = stack_bottom_; |
| if (size_old) |
| *size_old = stack_top_ - stack_bottom_; |
| stack_bottom_ = next_stack_bottom_; |
| stack_top_ = next_stack_top_; |
| atomic_store(&stack_switching_, 0, memory_order_release); |
| next_stack_top_ = 0; |
| next_stack_bottom_ = 0; |
| } |
| |
| inline AsanThread::StackBounds AsanThread::GetStackBounds() const { |
| if (!atomic_load(&stack_switching_, memory_order_acquire)) { |
| // Make sure the stack bounds are fully initialized. |
| if (stack_bottom_ >= stack_top_) return {0, 0}; |
| return {stack_bottom_, stack_top_}; |
| } |
| char local; |
| const uptr cur_stack = (uptr)&local; |
| // Note: need to check next stack first, because FinishSwitchFiber |
| // may be in process of overwriting stack_top_/bottom_. But in such case |
| // we are already on the next stack. |
| if (cur_stack >= next_stack_bottom_ && cur_stack < next_stack_top_) |
| return {next_stack_bottom_, next_stack_top_}; |
| return {stack_bottom_, stack_top_}; |
| } |
| |
| uptr AsanThread::stack_top() { |
| return GetStackBounds().top; |
| } |
| |
| uptr AsanThread::stack_bottom() { |
| return GetStackBounds().bottom; |
| } |
| |
| uptr AsanThread::stack_size() { |
| const auto bounds = GetStackBounds(); |
| return bounds.top - bounds.bottom; |
| } |
| |
| // We want to create the FakeStack lazily on the first use, but not earlier |
| // than the stack size is known and the procedure has to be async-signal safe. |
| FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() { |
| uptr stack_size = this->stack_size(); |
| if (stack_size == 0) // stack_size is not yet available, don't use FakeStack. |
| return nullptr; |
| uptr old_val = 0; |
| // fake_stack_ has 3 states: |
| // 0 -- not initialized |
| // 1 -- being initialized |
| // ptr -- initialized |
| // This CAS checks if the state was 0 and if so changes it to state 1, |
| // if that was successful, it initializes the pointer. |
| if (atomic_compare_exchange_strong( |
| reinterpret_cast<atomic_uintptr_t *>(&fake_stack_), &old_val, 1UL, |
| memory_order_relaxed)) { |
| uptr stack_size_log = Log2(RoundUpToPowerOfTwo(stack_size)); |
| CHECK_LE(flags()->min_uar_stack_size_log, flags()->max_uar_stack_size_log); |
| stack_size_log = |
| Min(stack_size_log, static_cast<uptr>(flags()->max_uar_stack_size_log)); |
| stack_size_log = |
| Max(stack_size_log, static_cast<uptr>(flags()->min_uar_stack_size_log)); |
| fake_stack_ = FakeStack::Create(stack_size_log); |
| DCHECK_EQ(GetCurrentThread(), this); |
| SetTLSFakeStack(fake_stack_); |
| return fake_stack_; |
| } |
| return nullptr; |
| } |
| |
| void AsanThread::Init(const InitOptions *options) { |
| DCHECK_NE(tid(), kInvalidTid); |
| next_stack_top_ = next_stack_bottom_ = 0; |
| atomic_store(&stack_switching_, false, memory_order_release); |
| CHECK_EQ(this->stack_size(), 0U); |
| SetThreadStackAndTls(options); |
| if (stack_top_ != stack_bottom_) { |
| CHECK_GT(this->stack_size(), 0U); |
| CHECK(AddrIsInMem(stack_bottom_)); |
| CHECK(AddrIsInMem(stack_top_ - 1)); |
| } |
| ClearShadowForThreadStackAndTLS(); |
| fake_stack_ = nullptr; |
| if (__asan_option_detect_stack_use_after_return && |
| tid() == GetCurrentTidOrInvalid()) { |
| // AsyncSignalSafeLazyInitFakeStack makes use of threadlocals and must be |
| // called from the context of the thread it is initializing, not its parent. |
| // Most platforms call AsanThread::Init on the newly-spawned thread, but |
| // Fuchsia calls this function from the parent thread. To support that |
| // approach, we avoid calling AsyncSignalSafeLazyInitFakeStack here; it will |
| // be called by the new thread when it first attempts to access the fake |
| // stack. |
| AsyncSignalSafeLazyInitFakeStack(); |
| } |
| int local = 0; |
| VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(), |
| (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_, |
| &local); |
| } |
| |
| // Fuchsia doesn't use ThreadStart. |
| // asan_fuchsia.c definies CreateMainThread and SetThreadStackAndTls. |
| #if !SANITIZER_FUCHSIA |
| |
| thread_return_t AsanThread::ThreadStart(tid_t os_id) { |
| Init(); |
| asanThreadRegistry().StartThread(tid(), os_id, ThreadType::Regular, nullptr); |
| |
| if (common_flags()->use_sigaltstack) SetAlternateSignalStack(); |
| |
| if (!start_routine_) { |
| // start_routine_ == 0 if we're on the main thread or on one of the |
| // OS X libdispatch worker threads. But nobody is supposed to call |
| // ThreadStart() for the worker threads. |
| CHECK_EQ(tid(), 0); |
| return 0; |
| } |
| |
| thread_return_t res = start_routine_(arg_); |
| |
| // On POSIX systems we defer this to the TSD destructor. LSan will consider |
| // the thread's memory as non-live from the moment we call Destroy(), even |
| // though that memory might contain pointers to heap objects which will be |
| // cleaned up by a user-defined TSD destructor. Thus, calling Destroy() before |
| // the TSD destructors have run might cause false positives in LSan. |
| if (!SANITIZER_POSIX) |
| this->Destroy(); |
| |
| return res; |
| } |
| |
| AsanThread *CreateMainThread() { |
| AsanThread *main_thread = AsanThread::Create( |
| /* start_routine */ nullptr, /* arg */ nullptr, /* parent_tid */ kMainTid, |
| /* stack */ nullptr, /* detached */ true); |
| SetCurrentThread(main_thread); |
| main_thread->ThreadStart(internal_getpid()); |
| return main_thread; |
| } |
| |
| // This implementation doesn't use the argument, which is just passed down |
| // from the caller of Init (which see, above). It's only there to support |
| // OS-specific implementations that need more information passed through. |
| void AsanThread::SetThreadStackAndTls(const InitOptions *options) { |
| DCHECK_EQ(options, nullptr); |
| uptr tls_size = 0; |
| uptr stack_size = 0; |
| GetThreadStackAndTls(tid() == kMainTid, &stack_bottom_, &stack_size, |
| &tls_begin_, &tls_size); |
| stack_top_ = RoundDownTo(stack_bottom_ + stack_size, SHADOW_GRANULARITY); |
| tls_end_ = tls_begin_ + tls_size; |
| dtls_ = DTLS_Get(); |
| |
| if (stack_top_ != stack_bottom_) { |
| int local; |
| CHECK(AddrIsInStack((uptr)&local)); |
| } |
| } |
| |
| #endif // !SANITIZER_FUCHSIA |
| |
| void AsanThread::ClearShadowForThreadStackAndTLS() { |
| if (stack_top_ != stack_bottom_) |
| PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0); |
| if (tls_begin_ != tls_end_) { |
| uptr tls_begin_aligned = RoundDownTo(tls_begin_, SHADOW_GRANULARITY); |
| uptr tls_end_aligned = RoundUpTo(tls_end_, SHADOW_GRANULARITY); |
| FastPoisonShadowPartialRightRedzone(tls_begin_aligned, |
| tls_end_ - tls_begin_aligned, |
| tls_end_aligned - tls_end_, 0); |
| } |
| } |
| |
| bool AsanThread::GetStackFrameAccessByAddr(uptr addr, |
| StackFrameAccess *access) { |
| if (stack_top_ == stack_bottom_) |
| return false; |
| |
| uptr bottom = 0; |
| if (AddrIsInStack(addr)) { |
| bottom = stack_bottom(); |
| } else if (FakeStack *fake_stack = get_fake_stack()) { |
| bottom = fake_stack->AddrIsInFakeStack(addr); |
| CHECK(bottom); |
| access->offset = addr - bottom; |
| access->frame_pc = ((uptr*)bottom)[2]; |
| access->frame_descr = (const char *)((uptr*)bottom)[1]; |
| return true; |
| } |
| uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8); // align addr. |
| uptr mem_ptr = RoundDownTo(aligned_addr, SHADOW_GRANULARITY); |
| u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr); |
| u8 *shadow_bottom = (u8*)MemToShadow(bottom); |
| |
| while (shadow_ptr >= shadow_bottom && |
| *shadow_ptr != kAsanStackLeftRedzoneMagic) { |
| shadow_ptr--; |
| mem_ptr -= SHADOW_GRANULARITY; |
| } |
| |
| while (shadow_ptr >= shadow_bottom && |
| *shadow_ptr == kAsanStackLeftRedzoneMagic) { |
| shadow_ptr--; |
| mem_ptr -= SHADOW_GRANULARITY; |
| } |
| |
| if (shadow_ptr < shadow_bottom) { |
| return false; |
| } |
| |
| uptr* ptr = (uptr*)(mem_ptr + SHADOW_GRANULARITY); |
| CHECK(ptr[0] == kCurrentStackFrameMagic); |
| access->offset = addr - (uptr)ptr; |
| access->frame_pc = ptr[2]; |
| access->frame_descr = (const char*)ptr[1]; |
| return true; |
| } |
| |
| uptr AsanThread::GetStackVariableShadowStart(uptr addr) { |
| uptr bottom = 0; |
| if (AddrIsInStack(addr)) { |
| bottom = stack_bottom(); |
| } else if (FakeStack *fake_stack = get_fake_stack()) { |
| bottom = fake_stack->AddrIsInFakeStack(addr); |
| if (bottom == 0) { |
| return 0; |
| } |
| } else { |
| return 0; |
| } |
| |
| uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8); // align addr. |
| u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr); |
| u8 *shadow_bottom = (u8*)MemToShadow(bottom); |
| |
| while (shadow_ptr >= shadow_bottom && |
| (*shadow_ptr != kAsanStackLeftRedzoneMagic && |
| *shadow_ptr != kAsanStackMidRedzoneMagic && |
| *shadow_ptr != kAsanStackRightRedzoneMagic)) |
| shadow_ptr--; |
| |
| return (uptr)shadow_ptr + 1; |
| } |
| |
| bool AsanThread::AddrIsInStack(uptr addr) { |
| const auto bounds = GetStackBounds(); |
| return addr >= bounds.bottom && addr < bounds.top; |
| } |
| |
| static bool ThreadStackContainsAddress(ThreadContextBase *tctx_base, |
| void *addr) { |
| AsanThreadContext *tctx = static_cast<AsanThreadContext *>(tctx_base); |
| AsanThread *t = tctx->thread; |
| if (!t) |
| return false; |
| if (t->AddrIsInStack((uptr)addr)) |
| return true; |
| FakeStack *fake_stack = t->get_fake_stack(); |
| if (!fake_stack) |
| return false; |
| return fake_stack->AddrIsInFakeStack((uptr)addr); |
| } |
| |
| AsanThread *GetCurrentThread() { |
| AsanThreadContext *context = |
| reinterpret_cast<AsanThreadContext *>(AsanTSDGet()); |
| if (!context) { |
| if (SANITIZER_ANDROID) { |
| // On Android, libc constructor is called _after_ asan_init, and cleans up |
| // TSD. Try to figure out if this is still the main thread by the stack |
| // address. We are not entirely sure that we have correct main thread |
| // limits, so only do this magic on Android, and only if the found thread |
| // is the main thread. |
| AsanThreadContext *tctx = GetThreadContextByTidLocked(kMainTid); |
| if (tctx && ThreadStackContainsAddress(tctx, &context)) { |
| SetCurrentThread(tctx->thread); |
| return tctx->thread; |
| } |
| } |
| return nullptr; |
| } |
| return context->thread; |
| } |
| |
| void SetCurrentThread(AsanThread *t) { |
| CHECK(t->context()); |
| VReport(2, "SetCurrentThread: %p for thread %p\n", t->context(), |
| (void *)GetThreadSelf()); |
| // Make sure we do not reset the current AsanThread. |
| CHECK_EQ(0, AsanTSDGet()); |
| AsanTSDSet(t->context()); |
| CHECK_EQ(t->context(), AsanTSDGet()); |
| } |
| |
| u32 GetCurrentTidOrInvalid() { |
| AsanThread *t = GetCurrentThread(); |
| return t ? t->tid() : kInvalidTid; |
| } |
| |
| AsanThread *FindThreadByStackAddress(uptr addr) { |
| asanThreadRegistry().CheckLocked(); |
| AsanThreadContext *tctx = static_cast<AsanThreadContext *>( |
| asanThreadRegistry().FindThreadContextLocked(ThreadStackContainsAddress, |
| (void *)addr)); |
| return tctx ? tctx->thread : nullptr; |
| } |
| |
| void EnsureMainThreadIDIsCorrect() { |
| AsanThreadContext *context = |
| reinterpret_cast<AsanThreadContext *>(AsanTSDGet()); |
| if (context && (context->tid == kMainTid)) |
| context->os_id = GetTid(); |
| } |
| |
| __asan::AsanThread *GetAsanThreadByOsIDLocked(tid_t os_id) { |
| __asan::AsanThreadContext *context = static_cast<__asan::AsanThreadContext *>( |
| __asan::asanThreadRegistry().FindThreadContextByOsIDLocked(os_id)); |
| if (!context) return nullptr; |
| return context->thread; |
| } |
| } // namespace __asan |
| |
| // --- Implementation of LSan-specific functions --- {{{1 |
| namespace __lsan { |
| bool GetThreadRangesLocked(tid_t os_id, uptr *stack_begin, uptr *stack_end, |
| uptr *tls_begin, uptr *tls_end, uptr *cache_begin, |
| uptr *cache_end, DTLS **dtls) { |
| __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id); |
| if (!t) return false; |
| *stack_begin = t->stack_bottom(); |
| *stack_end = t->stack_top(); |
| *tls_begin = t->tls_begin(); |
| *tls_end = t->tls_end(); |
| // ASan doesn't keep allocator caches in TLS, so these are unused. |
| *cache_begin = 0; |
| *cache_end = 0; |
| *dtls = t->dtls(); |
| return true; |
| } |
| |
| void GetAllThreadAllocatorCachesLocked(InternalMmapVector<uptr> *caches) {} |
| |
| void ForEachExtraStackRange(tid_t os_id, RangeIteratorCallback callback, |
| void *arg) { |
| __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id); |
| if (!t) |
| return; |
| __asan::FakeStack *fake_stack = t->get_fake_stack(); |
| if (!fake_stack) |
| return; |
| fake_stack->ForEachFakeFrame(callback, arg); |
| } |
| |
| void LockThreadRegistry() { |
| __asan::asanThreadRegistry().Lock(); |
| } |
| |
| void UnlockThreadRegistry() { |
| __asan::asanThreadRegistry().Unlock(); |
| } |
| |
| ThreadRegistry *GetThreadRegistryLocked() { |
| __asan::asanThreadRegistry().CheckLocked(); |
| return &__asan::asanThreadRegistry(); |
| } |
| |
| void EnsureMainThreadIDIsCorrect() { |
| __asan::EnsureMainThreadIDIsCorrect(); |
| } |
| } // namespace __lsan |
| |
| // ---------------------- Interface ---------------- {{{1 |
| using namespace __asan; |
| |
| extern "C" { |
| SANITIZER_INTERFACE_ATTRIBUTE |
| void __sanitizer_start_switch_fiber(void **fakestacksave, const void *bottom, |
| uptr size) { |
| AsanThread *t = GetCurrentThread(); |
| if (!t) { |
| VReport(1, "__asan_start_switch_fiber called from unknown thread\n"); |
| return; |
| } |
| t->StartSwitchFiber((FakeStack**)fakestacksave, (uptr)bottom, size); |
| } |
| |
| SANITIZER_INTERFACE_ATTRIBUTE |
| void __sanitizer_finish_switch_fiber(void* fakestack, |
| const void **bottom_old, |
| uptr *size_old) { |
| AsanThread *t = GetCurrentThread(); |
| if (!t) { |
| VReport(1, "__asan_finish_switch_fiber called from unknown thread\n"); |
| return; |
| } |
| t->FinishSwitchFiber((FakeStack*)fakestack, |
| (uptr*)bottom_old, |
| (uptr*)size_old); |
| } |
| } |