1 //===-- asan_thread.cc ----------------------------------------------------===//
2 //
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
5 //
6 //===----------------------------------------------------------------------===//
7 //
8 // This file is a part of AddressSanitizer, an address sanity checker.
9 //
10 // Thread-related code.
11 //===----------------------------------------------------------------------===//
12
13 #define __EXPOSE_STACK
14 #include <sys/param.h>
15
16 #include "asan_allocator.h"
17 #include "asan_interceptors.h"
18 #include "asan_poisoning.h"
19 #include "asan_stack.h"
20 #include "asan_thread.h"
21 #include "asan_mapping.h"
22 #include "sanitizer_common/sanitizer_common.h"
23 #include "sanitizer_common/sanitizer_placement_new.h"
24 #include "sanitizer_common/sanitizer_stackdepot.h"
25 #include "sanitizer_common/sanitizer_tls_get_addr.h"
26 #include "lsan/lsan_common.h"
27
28 namespace __asan {
29
30 // AsanThreadContext implementation.
31
OnCreated(void * arg)32 void AsanThreadContext::OnCreated(void *arg) {
33 CreateThreadContextArgs *args = static_cast<CreateThreadContextArgs*>(arg);
34 if (args->stack)
35 stack_id = StackDepotPut(*args->stack);
36 thread = args->thread;
37 thread->set_context(this);
38 }
39
OnFinished()40 void AsanThreadContext::OnFinished() {
41 // Drop the link to the AsanThread object.
42 thread = nullptr;
43 }
44
45 // MIPS requires aligned address
46 static ALIGNED(16) char thread_registry_placeholder[sizeof(ThreadRegistry)];
47 static ThreadRegistry *asan_thread_registry;
48
49 static BlockingMutex mu_for_thread_context(LINKER_INITIALIZED);
50 static LowLevelAllocator allocator_for_thread_context;
51
GetAsanThreadContext(u32 tid)52 static ThreadContextBase *GetAsanThreadContext(u32 tid) {
53 BlockingMutexLock lock(&mu_for_thread_context);
54 return new(allocator_for_thread_context) AsanThreadContext(tid);
55 }
56
asanThreadRegistry()57 ThreadRegistry &asanThreadRegistry() {
58 static bool initialized;
59 // Don't worry about thread_safety - this should be called when there is
60 // a single thread.
61 if (!initialized) {
62 // Never reuse ASan threads: we store pointer to AsanThreadContext
63 // in TSD and can't reliably tell when no more TSD destructors will
64 // be called. It would be wrong to reuse AsanThreadContext for another
65 // thread before all TSD destructors will be called for it.
66 asan_thread_registry = new(thread_registry_placeholder) ThreadRegistry(
67 GetAsanThreadContext, kMaxNumberOfThreads, kMaxNumberOfThreads);
68 initialized = true;
69 }
70 return *asan_thread_registry;
71 }
72
GetThreadContextByTidLocked(u32 tid)73 AsanThreadContext *GetThreadContextByTidLocked(u32 tid) {
74 return static_cast<AsanThreadContext *>(
75 asanThreadRegistry().GetThreadLocked(tid));
76 }
77
78 // AsanThread implementation.
79
Create(thread_callback_t start_routine,void * arg,u32 parent_tid,StackTrace * stack,bool detached)80 AsanThread *AsanThread::Create(thread_callback_t start_routine, void *arg,
81 u32 parent_tid, StackTrace *stack,
82 bool detached) {
83 uptr PageSize = GetPageSizeCached();
84 uptr size = RoundUpTo(sizeof(AsanThread), PageSize);
85 AsanThread *thread = (AsanThread*)MmapOrDie(size, __func__);
86 thread->start_routine_ = start_routine;
87 thread->arg_ = arg;
88 AsanThreadContext::CreateThreadContextArgs args = {thread, stack};
89 asanThreadRegistry().CreateThread(*reinterpret_cast<uptr *>(thread), detached,
90 parent_tid, &args);
91
92 return thread;
93 }
94
TSDDtor(void * tsd)95 void AsanThread::TSDDtor(void *tsd) {
96 AsanThreadContext *context = (AsanThreadContext*)tsd;
97 VReport(1, "T%d TSDDtor\n", context->tid);
98 if (context->thread)
99 context->thread->Destroy();
100 }
101
Destroy()102 void AsanThread::Destroy() {
103 int tid = this->tid();
104 VReport(1, "T%d exited\n", tid);
105
106 malloc_storage().CommitBack();
107 if (common_flags()->use_sigaltstack) UnsetAlternateSignalStack();
108 asanThreadRegistry().FinishThread(tid);
109 FlushToDeadThreadStats(&stats_);
110 // We also clear the shadow on thread destruction because
111 // some code may still be executing in later TSD destructors
112 // and we don't want it to have any poisoned stack.
113 ClearShadowForThreadStackAndTLS();
114 DeleteFakeStack(tid);
115 uptr size = RoundUpTo(sizeof(AsanThread), GetPageSizeCached());
116 UnmapOrDie(this, size);
117 DTLS_Destroy();
118 }
119
StartSwitchFiber(FakeStack ** fake_stack_save,uptr bottom,uptr size)120 void AsanThread::StartSwitchFiber(FakeStack **fake_stack_save, uptr bottom,
121 uptr size) {
122 if (atomic_load(&stack_switching_, memory_order_relaxed)) {
123 Report("ERROR: starting fiber switch while in fiber switch\n");
124 Die();
125 }
126
127 next_stack_bottom_ = bottom;
128 next_stack_top_ = bottom + size;
129 atomic_store(&stack_switching_, 1, memory_order_release);
130
131 FakeStack *current_fake_stack = fake_stack_;
132 if (fake_stack_save)
133 *fake_stack_save = fake_stack_;
134 fake_stack_ = nullptr;
135 SetTLSFakeStack(nullptr);
136 // if fake_stack_save is null, the fiber will die, delete the fakestack
137 if (!fake_stack_save && current_fake_stack)
138 current_fake_stack->Destroy(this->tid());
139 }
140
FinishSwitchFiber(FakeStack * fake_stack_save,uptr * bottom_old,uptr * size_old)141 void AsanThread::FinishSwitchFiber(FakeStack *fake_stack_save,
142 uptr *bottom_old,
143 uptr *size_old) {
144 if (!atomic_load(&stack_switching_, memory_order_relaxed)) {
145 Report("ERROR: finishing a fiber switch that has not started\n");
146 Die();
147 }
148
149 if (fake_stack_save) {
150 SetTLSFakeStack(fake_stack_save);
151 fake_stack_ = fake_stack_save;
152 }
153
154 if (bottom_old)
155 *bottom_old = stack_bottom_;
156 if (size_old)
157 *size_old = stack_top_ - stack_bottom_;
158 stack_bottom_ = next_stack_bottom_;
159 stack_top_ = next_stack_top_;
160 atomic_store(&stack_switching_, 0, memory_order_release);
161 next_stack_top_ = 0;
162 next_stack_bottom_ = 0;
163 }
164
GetStackBounds() const165 inline AsanThread::StackBounds AsanThread::GetStackBounds() const {
166 if (!atomic_load(&stack_switching_, memory_order_acquire)) {
167 // Make sure the stack bounds are fully initialized.
168 if (stack_bottom_ >= stack_top_) return {0, 0};
169 return {stack_bottom_, stack_top_};
170 }
171 char local;
172 const uptr cur_stack = (uptr)&local;
173 // Note: need to check next stack first, because FinishSwitchFiber
174 // may be in process of overwriting stack_top_/bottom_. But in such case
175 // we are already on the next stack.
176 if (cur_stack >= next_stack_bottom_ && cur_stack < next_stack_top_)
177 return {next_stack_bottom_, next_stack_top_};
178 return {stack_bottom_, stack_top_};
179 }
180
stack_top()181 uptr AsanThread::stack_top() {
182 return GetStackBounds().top;
183 }
184
stack_bottom()185 uptr AsanThread::stack_bottom() {
186 return GetStackBounds().bottom;
187 }
188
stack_size()189 uptr AsanThread::stack_size() {
190 const auto bounds = GetStackBounds();
191 return bounds.top - bounds.bottom;
192 }
193
194 // We want to create the FakeStack lazyly on the first use, but not eralier
195 // than the stack size is known and the procedure has to be async-signal safe.
AsyncSignalSafeLazyInitFakeStack()196 FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() {
197 uptr stack_size = this->stack_size();
198 if (stack_size == 0) // stack_size is not yet available, don't use FakeStack.
199 return nullptr;
200 uptr old_val = 0;
201 // fake_stack_ has 3 states:
202 // 0 -- not initialized
203 // 1 -- being initialized
204 // ptr -- initialized
205 // This CAS checks if the state was 0 and if so changes it to state 1,
206 // if that was successful, it initializes the pointer.
207 if (atomic_compare_exchange_strong(
208 reinterpret_cast<atomic_uintptr_t *>(&fake_stack_), &old_val, 1UL,
209 memory_order_relaxed)) {
210 uptr stack_size_log = Log2(RoundUpToPowerOfTwo(stack_size));
211 CHECK_LE(flags()->min_uar_stack_size_log, flags()->max_uar_stack_size_log);
212 stack_size_log =
213 Min(stack_size_log, static_cast<uptr>(flags()->max_uar_stack_size_log));
214 stack_size_log =
215 Max(stack_size_log, static_cast<uptr>(flags()->min_uar_stack_size_log));
216 fake_stack_ = FakeStack::Create(stack_size_log);
217 SetTLSFakeStack(fake_stack_);
218 return fake_stack_;
219 }
220 return nullptr;
221 }
222
Init(const InitOptions * options)223 void AsanThread::Init(const InitOptions *options) {
224 next_stack_top_ = next_stack_bottom_ = 0;
225 atomic_store(&stack_switching_, false, memory_order_release);
226 CHECK_EQ(this->stack_size(), 0U);
227 SetThreadStackAndTls(options);
228 CHECK_GT(this->stack_size(), 0U);
229 CHECK(AddrIsInMem(stack_bottom_));
230 CHECK(AddrIsInMem(stack_top_ - 1));
231 ClearShadowForThreadStackAndTLS();
232 fake_stack_ = nullptr;
233 if (__asan_option_detect_stack_use_after_return)
234 AsyncSignalSafeLazyInitFakeStack();
235 int local = 0;
236 VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(),
237 (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_,
238 &local);
239 }
240
241 // Fuchsia and RTEMS don't use ThreadStart.
242 // asan_fuchsia.c/asan_rtems.c define CreateMainThread and
243 // SetThreadStackAndTls.
244 #if !SANITIZER_FUCHSIA && !SANITIZER_RTEMS
245
ThreadStart(tid_t os_id,atomic_uintptr_t * signal_thread_is_registered)246 thread_return_t AsanThread::ThreadStart(
247 tid_t os_id, atomic_uintptr_t *signal_thread_is_registered) {
248 Init();
249 asanThreadRegistry().StartThread(tid(), os_id, /*workerthread*/ false,
250 nullptr);
251 if (signal_thread_is_registered)
252 atomic_store(signal_thread_is_registered, 1, memory_order_release);
253
254 if (common_flags()->use_sigaltstack) SetAlternateSignalStack();
255
256 if (!start_routine_) {
257 // start_routine_ == 0 if we're on the main thread or on one of the
258 // OS X libdispatch worker threads. But nobody is supposed to call
259 // ThreadStart() for the worker threads.
260 CHECK_EQ(tid(), 0);
261 return 0;
262 }
263
264 thread_return_t res = start_routine_(arg_);
265
266 // On POSIX systems we defer this to the TSD destructor. LSan will consider
267 // the thread's memory as non-live from the moment we call Destroy(), even
268 // though that memory might contain pointers to heap objects which will be
269 // cleaned up by a user-defined TSD destructor. Thus, calling Destroy() before
270 // the TSD destructors have run might cause false positives in LSan.
271 if (!SANITIZER_POSIX)
272 this->Destroy();
273
274 return res;
275 }
276
CreateMainThread()277 AsanThread *CreateMainThread() {
278 AsanThread *main_thread = AsanThread::Create(
279 /* start_routine */ nullptr, /* arg */ nullptr, /* parent_tid */ 0,
280 /* stack */ nullptr, /* detached */ true);
281 SetCurrentThread(main_thread);
282 main_thread->ThreadStart(internal_getpid(),
283 /* signal_thread_is_registered */ nullptr);
284 return main_thread;
285 }
286
287 // This implementation doesn't use the argument, which is just passed down
288 // from the caller of Init (which see, above). It's only there to support
289 // OS-specific implementations that need more information passed through.
SetThreadStackAndTls(const InitOptions * options)290 void AsanThread::SetThreadStackAndTls(const InitOptions *options) {
291 DCHECK_EQ(options, nullptr);
292 uptr tls_size = 0;
293 uptr stack_size = 0;
294 GetThreadStackAndTls(tid() == 0, const_cast<uptr *>(&stack_bottom_),
295 const_cast<uptr *>(&stack_size), &tls_begin_, &tls_size);
296 stack_top_ = stack_bottom_ + stack_size;
297 tls_end_ = tls_begin_ + tls_size;
298 dtls_ = DTLS_Get();
299
300 int local;
301 CHECK(AddrIsInStack((uptr)&local));
302 }
303
304 #endif // !SANITIZER_FUCHSIA && !SANITIZER_RTEMS
305
ClearShadowForThreadStackAndTLS()306 void AsanThread::ClearShadowForThreadStackAndTLS() {
307 PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0);
308 if (tls_begin_ != tls_end_) {
309 uptr tls_begin_aligned = RoundDownTo(tls_begin_, SHADOW_GRANULARITY);
310 uptr tls_end_aligned = RoundUpTo(tls_end_, SHADOW_GRANULARITY);
311 FastPoisonShadowPartialRightRedzone(tls_begin_aligned,
312 tls_end_ - tls_begin_aligned,
313 tls_end_aligned - tls_end_, 0);
314 }
315 }
316
GetStackFrameAccessByAddr(uptr addr,StackFrameAccess * access)317 bool AsanThread::GetStackFrameAccessByAddr(uptr addr,
318 StackFrameAccess *access) {
319 uptr bottom = 0;
320 if (AddrIsInStack(addr)) {
321 bottom = stack_bottom();
322 } else if (has_fake_stack()) {
323 bottom = fake_stack()->AddrIsInFakeStack(addr);
324 CHECK(bottom);
325 access->offset = addr - bottom;
326 access->frame_pc = ((uptr*)bottom)[2];
327 access->frame_descr = (const char *)((uptr*)bottom)[1];
328 return true;
329 }
330 #ifdef STACK_ALIGNBYTES
331 # define STACK_ALIGNMENT (STACK_ALIGNBYTES+1)
332 #else
333 # define STACK_ALIGNMENT (SANITIZER_WORDSIZE/8)
334 #endif
335 uptr aligned_addr = RoundDownTo(addr, STACK_ALIGNMENT); // align addr.
336 uptr mem_ptr = RoundDownTo(aligned_addr, SHADOW_GRANULARITY);
337 u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
338 u8 *shadow_bottom = (u8*)MemToShadow(bottom);
339
340 while (shadow_ptr >= shadow_bottom &&
341 *shadow_ptr != kAsanStackLeftRedzoneMagic) {
342 shadow_ptr--;
343 mem_ptr -= SHADOW_GRANULARITY;
344 }
345
346 while (shadow_ptr >= shadow_bottom &&
347 *shadow_ptr == kAsanStackLeftRedzoneMagic) {
348 shadow_ptr--;
349 mem_ptr -= SHADOW_GRANULARITY;
350 }
351
352 if (shadow_ptr < shadow_bottom) {
353 return false;
354 }
355
356 uptr* ptr = (uptr*)(mem_ptr + SHADOW_GRANULARITY);
357 CHECK(ptr[0] == kCurrentStackFrameMagic);
358 access->offset = addr - (uptr)ptr;
359 access->frame_pc = ptr[2];
360 access->frame_descr = (const char*)ptr[1];
361 return true;
362 }
363
GetStackVariableShadowStart(uptr addr)364 uptr AsanThread::GetStackVariableShadowStart(uptr addr) {
365 uptr bottom = 0;
366 if (AddrIsInStack(addr)) {
367 bottom = stack_bottom();
368 } else if (has_fake_stack()) {
369 bottom = fake_stack()->AddrIsInFakeStack(addr);
370 CHECK(bottom);
371 } else
372 return 0;
373
374 uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8); // align addr.
375 u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
376 u8 *shadow_bottom = (u8*)MemToShadow(bottom);
377
378 while (shadow_ptr >= shadow_bottom &&
379 (*shadow_ptr != kAsanStackLeftRedzoneMagic &&
380 *shadow_ptr != kAsanStackMidRedzoneMagic &&
381 *shadow_ptr != kAsanStackRightRedzoneMagic))
382 shadow_ptr--;
383
384 return (uptr)shadow_ptr + 1;
385 }
386
AddrIsInStack(uptr addr)387 bool AsanThread::AddrIsInStack(uptr addr) {
388 const auto bounds = GetStackBounds();
389 return addr >= bounds.bottom && addr < bounds.top;
390 }
391
ThreadStackContainsAddress(ThreadContextBase * tctx_base,void * addr)392 static bool ThreadStackContainsAddress(ThreadContextBase *tctx_base,
393 void *addr) {
394 AsanThreadContext *tctx = static_cast<AsanThreadContext*>(tctx_base);
395 AsanThread *t = tctx->thread;
396 if (!t) return false;
397 if (t->AddrIsInStack((uptr)addr)) return true;
398 if (t->has_fake_stack() && t->fake_stack()->AddrIsInFakeStack((uptr)addr))
399 return true;
400 return false;
401 }
402
GetCurrentThread()403 AsanThread *GetCurrentThread() {
404 if (SANITIZER_RTEMS && !asan_inited)
405 return nullptr;
406
407 AsanThreadContext *context =
408 reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
409 if (!context) {
410 if (SANITIZER_ANDROID) {
411 // On Android, libc constructor is called _after_ asan_init, and cleans up
412 // TSD. Try to figure out if this is still the main thread by the stack
413 // address. We are not entirely sure that we have correct main thread
414 // limits, so only do this magic on Android, and only if the found thread
415 // is the main thread.
416 AsanThreadContext *tctx = GetThreadContextByTidLocked(0);
417 if (tctx && ThreadStackContainsAddress(tctx, &context)) {
418 SetCurrentThread(tctx->thread);
419 return tctx->thread;
420 }
421 }
422 return nullptr;
423 }
424 return context->thread;
425 }
426
SetCurrentThread(AsanThread * t)427 void SetCurrentThread(AsanThread *t) {
428 CHECK(t->context());
429 VReport(2, "SetCurrentThread: %p for thread %p\n", t->context(),
430 (void *)GetThreadSelf());
431 // Make sure we do not reset the current AsanThread.
432 CHECK_EQ(0, AsanTSDGet());
433 AsanTSDSet(t->context());
434 CHECK_EQ(t->context(), AsanTSDGet());
435 }
436
GetCurrentTidOrInvalid()437 u32 GetCurrentTidOrInvalid() {
438 AsanThread *t = GetCurrentThread();
439 return t ? t->tid() : kInvalidTid;
440 }
441
FindThreadByStackAddress(uptr addr)442 AsanThread *FindThreadByStackAddress(uptr addr) {
443 asanThreadRegistry().CheckLocked();
444 AsanThreadContext *tctx = static_cast<AsanThreadContext *>(
445 asanThreadRegistry().FindThreadContextLocked(ThreadStackContainsAddress,
446 (void *)addr));
447 return tctx ? tctx->thread : nullptr;
448 }
449
EnsureMainThreadIDIsCorrect()450 void EnsureMainThreadIDIsCorrect() {
451 AsanThreadContext *context =
452 reinterpret_cast<AsanThreadContext *>(AsanTSDGet());
453 if (context && (context->tid == 0))
454 context->os_id = GetTid();
455 }
456
GetAsanThreadByOsIDLocked(tid_t os_id)457 __asan::AsanThread *GetAsanThreadByOsIDLocked(tid_t os_id) {
458 __asan::AsanThreadContext *context = static_cast<__asan::AsanThreadContext *>(
459 __asan::asanThreadRegistry().FindThreadContextByOsIDLocked(os_id));
460 if (!context) return nullptr;
461 return context->thread;
462 }
463 } // namespace __asan
464
465 // --- Implementation of LSan-specific functions --- {{{1
466 namespace __lsan {
GetThreadRangesLocked(tid_t os_id,uptr * stack_begin,uptr * stack_end,uptr * tls_begin,uptr * tls_end,uptr * cache_begin,uptr * cache_end,DTLS ** dtls)467 bool GetThreadRangesLocked(tid_t os_id, uptr *stack_begin, uptr *stack_end,
468 uptr *tls_begin, uptr *tls_end, uptr *cache_begin,
469 uptr *cache_end, DTLS **dtls) {
470 __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
471 if (!t) return false;
472 *stack_begin = t->stack_bottom();
473 *stack_end = t->stack_top();
474 *tls_begin = t->tls_begin();
475 *tls_end = t->tls_end();
476 // ASan doesn't keep allocator caches in TLS, so these are unused.
477 *cache_begin = 0;
478 *cache_end = 0;
479 *dtls = t->dtls();
480 return true;
481 }
482
ForEachExtraStackRange(tid_t os_id,RangeIteratorCallback callback,void * arg)483 void ForEachExtraStackRange(tid_t os_id, RangeIteratorCallback callback,
484 void *arg) {
485 __asan::AsanThread *t = __asan::GetAsanThreadByOsIDLocked(os_id);
486 if (t && t->has_fake_stack())
487 t->fake_stack()->ForEachFakeFrame(callback, arg);
488 }
489
LockThreadRegistry()490 void LockThreadRegistry() {
491 __asan::asanThreadRegistry().Lock();
492 }
493
UnlockThreadRegistry()494 void UnlockThreadRegistry() {
495 __asan::asanThreadRegistry().Unlock();
496 }
497
GetThreadRegistryLocked()498 ThreadRegistry *GetThreadRegistryLocked() {
499 __asan::asanThreadRegistry().CheckLocked();
500 return &__asan::asanThreadRegistry();
501 }
502
EnsureMainThreadIDIsCorrect()503 void EnsureMainThreadIDIsCorrect() {
504 __asan::EnsureMainThreadIDIsCorrect();
505 }
506 } // namespace __lsan
507
508 // ---------------------- Interface ---------------- {{{1
509 using namespace __asan; // NOLINT
510
511 extern "C" {
512 SANITIZER_INTERFACE_ATTRIBUTE
__sanitizer_start_switch_fiber(void ** fakestacksave,const void * bottom,uptr size)513 void __sanitizer_start_switch_fiber(void **fakestacksave, const void *bottom,
514 uptr size) {
515 AsanThread *t = GetCurrentThread();
516 if (!t) {
517 VReport(1, "__asan_start_switch_fiber called from unknown thread\n");
518 return;
519 }
520 t->StartSwitchFiber((FakeStack**)fakestacksave, (uptr)bottom, size);
521 }
522
523 SANITIZER_INTERFACE_ATTRIBUTE
__sanitizer_finish_switch_fiber(void * fakestack,const void ** bottom_old,uptr * size_old)524 void __sanitizer_finish_switch_fiber(void* fakestack,
525 const void **bottom_old,
526 uptr *size_old) {
527 AsanThread *t = GetCurrentThread();
528 if (!t) {
529 VReport(1, "__asan_finish_switch_fiber called from unknown thread\n");
530 return;
531 }
532 t->FinishSwitchFiber((FakeStack*)fakestack,
533 (uptr*)bottom_old,
534 (uptr*)size_old);
535 }
536 }
537