1 //===-- sanitizer_mac.cpp -------------------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file is shared between various sanitizers' runtime libraries and
10 // implements OSX-specific functions.
11 //===----------------------------------------------------------------------===//
12
13 #include "sanitizer_platform.h"
14 #if SANITIZER_MAC
15 #include "sanitizer_mac.h"
16 #include "interception/interception.h"
17
18 // Use 64-bit inodes in file operations. ASan does not support OS X 10.5, so
19 // the clients will most certainly use 64-bit ones as well.
20 #ifndef _DARWIN_USE_64_BIT_INODE
21 #define _DARWIN_USE_64_BIT_INODE 1
22 #endif
23 #include <stdio.h>
24
25 #include "sanitizer_common.h"
26 #include "sanitizer_file.h"
27 #include "sanitizer_flags.h"
28 #include "sanitizer_internal_defs.h"
29 #include "sanitizer_libc.h"
30 #include "sanitizer_platform_limits_posix.h"
31 #include "sanitizer_procmaps.h"
32 #include "sanitizer_ptrauth.h"
33
34 #if !SANITIZER_IOS
35 #include <crt_externs.h> // for _NSGetEnviron
36 #else
37 extern char **environ;
38 #endif
39
40 #if defined(__has_include) && __has_include(<os/trace.h>) && defined(__BLOCKS__)
41 #define SANITIZER_OS_TRACE 1
42 #include <os/trace.h>
43 #else
44 #define SANITIZER_OS_TRACE 0
45 #endif
46
47 // import new crash reporting api
48 #if defined(__has_include) && __has_include(<CrashReporterClient.h>)
49 #define HAVE_CRASHREPORTERCLIENT_H 1
50 #include <CrashReporterClient.h>
51 #else
52 #define HAVE_CRASHREPORTERCLIENT_H 0
53 #endif
54
55 #if !SANITIZER_IOS
56 #include <crt_externs.h> // for _NSGetArgv and _NSGetEnviron
57 #else
58 extern "C" {
59 extern char ***_NSGetArgv(void);
60 }
61 #endif
62
63 #include <asl.h>
64 #include <dlfcn.h> // for dladdr()
65 #include <errno.h>
66 #include <fcntl.h>
67 #include <libkern/OSAtomic.h>
68 #include <mach-o/dyld.h>
69 #include <mach/mach.h>
70 #include <mach/mach_time.h>
71 #include <mach/vm_statistics.h>
72 #include <malloc/malloc.h>
73 #if defined(__has_builtin) && __has_builtin(__builtin_os_log_format)
74 # include <os/log.h>
75 #else
76 /* Without support for __builtin_os_log_format, fall back to the older
77 method. */
78 # define OS_LOG_DEFAULT 0
79 # define os_log_error(A,B,C) \
80 asl_log(nullptr, nullptr, ASL_LEVEL_ERR, "%s", (C));
81 #endif
82 #include <pthread.h>
83 #include <sched.h>
84 #include <signal.h>
85 #include <spawn.h>
86 #include <stdlib.h>
87 #include <sys/ioctl.h>
88 #include <sys/mman.h>
89 #include <sys/resource.h>
90 #include <sys/stat.h>
91 #include <sys/sysctl.h>
92 #include <sys/types.h>
93 #include <sys/wait.h>
94 #include <unistd.h>
95 #include <util.h>
96
97 // From <crt_externs.h>, but we don't have that file on iOS.
98 extern "C" {
99 extern char ***_NSGetArgv(void);
100 extern char ***_NSGetEnviron(void);
101 }
102
103 // From <mach/mach_vm.h>, but we don't have that file on iOS.
104 extern "C" {
105 extern kern_return_t mach_vm_region_recurse(
106 vm_map_t target_task,
107 mach_vm_address_t *address,
108 mach_vm_size_t *size,
109 natural_t *nesting_depth,
110 vm_region_recurse_info_t info,
111 mach_msg_type_number_t *infoCnt);
112 }
113
114 namespace __sanitizer {
115
116 #include "sanitizer_syscall_generic.inc"
117
118 // Direct syscalls, don't call libmalloc hooks (but not available on 10.6).
119 extern "C" void *__mmap(void *addr, size_t len, int prot, int flags, int fildes,
120 off_t off) SANITIZER_WEAK_ATTRIBUTE;
121 extern "C" int __munmap(void *, size_t) SANITIZER_WEAK_ATTRIBUTE;
122
123 // ---------------------- sanitizer_libc.h
124
125 // From <mach/vm_statistics.h>, but not on older OSs.
126 #ifndef VM_MEMORY_SANITIZER
127 #define VM_MEMORY_SANITIZER 99
128 #endif
129
130 // XNU on Darwin provides a mmap flag that optimizes allocation/deallocation of
131 // giant memory regions (i.e. shadow memory regions).
132 #define kXnuFastMmapFd 0x4
133 static size_t kXnuFastMmapThreshold = 2 << 30; // 2 GB
134 static bool use_xnu_fast_mmap = false;
135
internal_mmap(void * addr,size_t length,int prot,int flags,int fd,u64 offset)136 uptr internal_mmap(void *addr, size_t length, int prot, int flags,
137 int fd, u64 offset) {
138 if (fd == -1) {
139 fd = VM_MAKE_TAG(VM_MEMORY_SANITIZER);
140 if (length >= kXnuFastMmapThreshold) {
141 if (use_xnu_fast_mmap) fd |= kXnuFastMmapFd;
142 }
143 }
144 if (&__mmap) return (uptr)__mmap(addr, length, prot, flags, fd, offset);
145 return (uptr)mmap(addr, length, prot, flags, fd, offset);
146 }
147
internal_munmap(void * addr,uptr length)148 uptr internal_munmap(void *addr, uptr length) {
149 if (&__munmap) return __munmap(addr, length);
150 return munmap(addr, length);
151 }
152
internal_mremap(void * old_address,uptr old_size,uptr new_size,int flags,void * new_address)153 uptr internal_mremap(void *old_address, uptr old_size, uptr new_size, int flags,
154 void *new_address) {
155 CHECK(false && "internal_mremap is unimplemented on Mac");
156 return 0;
157 }
158
internal_mprotect(void * addr,uptr length,int prot)159 int internal_mprotect(void *addr, uptr length, int prot) {
160 return mprotect(addr, length, prot);
161 }
162
internal_madvise(uptr addr,uptr length,int advice)163 int internal_madvise(uptr addr, uptr length, int advice) {
164 return madvise((void *)addr, length, advice);
165 }
166
internal_close(fd_t fd)167 uptr internal_close(fd_t fd) {
168 return close(fd);
169 }
170
internal_open(const char * filename,int flags)171 uptr internal_open(const char *filename, int flags) {
172 return open(filename, flags);
173 }
174
internal_open(const char * filename,int flags,u32 mode)175 uptr internal_open(const char *filename, int flags, u32 mode) {
176 return open(filename, flags, mode);
177 }
178
internal_read(fd_t fd,void * buf,uptr count)179 uptr internal_read(fd_t fd, void *buf, uptr count) {
180 return read(fd, buf, count);
181 }
182
internal_write(fd_t fd,const void * buf,uptr count)183 uptr internal_write(fd_t fd, const void *buf, uptr count) {
184 return write(fd, buf, count);
185 }
186
internal_stat(const char * path,void * buf)187 uptr internal_stat(const char *path, void *buf) {
188 return stat(path, (struct stat *)buf);
189 }
190
internal_lstat(const char * path,void * buf)191 uptr internal_lstat(const char *path, void *buf) {
192 return lstat(path, (struct stat *)buf);
193 }
194
internal_fstat(fd_t fd,void * buf)195 uptr internal_fstat(fd_t fd, void *buf) {
196 return fstat(fd, (struct stat *)buf);
197 }
198
internal_filesize(fd_t fd)199 uptr internal_filesize(fd_t fd) {
200 struct stat st;
201 if (internal_fstat(fd, &st))
202 return -1;
203 return (uptr)st.st_size;
204 }
205
internal_dup(int oldfd)206 uptr internal_dup(int oldfd) {
207 return dup(oldfd);
208 }
209
internal_dup2(int oldfd,int newfd)210 uptr internal_dup2(int oldfd, int newfd) {
211 return dup2(oldfd, newfd);
212 }
213
internal_readlink(const char * path,char * buf,uptr bufsize)214 uptr internal_readlink(const char *path, char *buf, uptr bufsize) {
215 return readlink(path, buf, bufsize);
216 }
217
internal_unlink(const char * path)218 uptr internal_unlink(const char *path) {
219 return unlink(path);
220 }
221
internal_sched_yield()222 uptr internal_sched_yield() {
223 return sched_yield();
224 }
225
internal__exit(int exitcode)226 void internal__exit(int exitcode) {
227 _exit(exitcode);
228 }
229
internal_usleep(u64 useconds)230 void internal_usleep(u64 useconds) { usleep(useconds); }
231
internal_getpid()232 uptr internal_getpid() {
233 return getpid();
234 }
235
internal_dlinfo(void * handle,int request,void * p)236 int internal_dlinfo(void *handle, int request, void *p) {
237 UNIMPLEMENTED();
238 }
239
internal_sigaction(int signum,const void * act,void * oldact)240 int internal_sigaction(int signum, const void *act, void *oldact) {
241 return sigaction(signum,
242 (const struct sigaction *)act, (struct sigaction *)oldact);
243 }
244
internal_sigfillset(__sanitizer_sigset_t * set)245 void internal_sigfillset(__sanitizer_sigset_t *set) { sigfillset(set); }
246
internal_sigprocmask(int how,__sanitizer_sigset_t * set,__sanitizer_sigset_t * oldset)247 uptr internal_sigprocmask(int how, __sanitizer_sigset_t *set,
248 __sanitizer_sigset_t *oldset) {
249 // Don't use sigprocmask here, because it affects all threads.
250 return pthread_sigmask(how, set, oldset);
251 }
252
253 // Doesn't call pthread_atfork() handlers (but not available on 10.6).
254 extern "C" pid_t __fork(void) SANITIZER_WEAK_ATTRIBUTE;
255
internal_fork()256 int internal_fork() {
257 if (&__fork)
258 return __fork();
259 return fork();
260 }
261
internal_sysctl(const int * name,unsigned int namelen,void * oldp,uptr * oldlenp,const void * newp,uptr newlen)262 int internal_sysctl(const int *name, unsigned int namelen, void *oldp,
263 uptr *oldlenp, const void *newp, uptr newlen) {
264 return sysctl(const_cast<int *>(name), namelen, oldp, (size_t *)oldlenp,
265 const_cast<void *>(newp), (size_t)newlen);
266 }
267
internal_sysctlbyname(const char * sname,void * oldp,uptr * oldlenp,const void * newp,uptr newlen)268 int internal_sysctlbyname(const char *sname, void *oldp, uptr *oldlenp,
269 const void *newp, uptr newlen) {
270 return sysctlbyname(sname, oldp, (size_t *)oldlenp, const_cast<void *>(newp),
271 (size_t)newlen);
272 }
273
internal_spawn_impl(const char * argv[],const char * envp[],pid_t * pid)274 static fd_t internal_spawn_impl(const char *argv[], const char *envp[],
275 pid_t *pid) {
276 fd_t master_fd = kInvalidFd;
277 fd_t slave_fd = kInvalidFd;
278
279 auto fd_closer = at_scope_exit([&] {
280 internal_close(master_fd);
281 internal_close(slave_fd);
282 });
283
284 // We need a new pseudoterminal to avoid buffering problems. The 'atos' tool
285 // in particular detects when it's talking to a pipe and forgets to flush the
286 // output stream after sending a response.
287 master_fd = posix_openpt(O_RDWR);
288 if (master_fd == kInvalidFd) return kInvalidFd;
289
290 int res = grantpt(master_fd) || unlockpt(master_fd);
291 if (res != 0) return kInvalidFd;
292
293 // Use TIOCPTYGNAME instead of ptsname() to avoid threading problems.
294 char slave_pty_name[128];
295 res = ioctl(master_fd, TIOCPTYGNAME, slave_pty_name);
296 if (res == -1) return kInvalidFd;
297
298 slave_fd = internal_open(slave_pty_name, O_RDWR);
299 if (slave_fd == kInvalidFd) return kInvalidFd;
300
301 // File descriptor actions
302 posix_spawn_file_actions_t acts;
303 res = posix_spawn_file_actions_init(&acts);
304 if (res != 0) return kInvalidFd;
305
306 auto acts_cleanup = at_scope_exit([&] {
307 posix_spawn_file_actions_destroy(&acts);
308 });
309
310 res = posix_spawn_file_actions_adddup2(&acts, slave_fd, STDIN_FILENO) ||
311 posix_spawn_file_actions_adddup2(&acts, slave_fd, STDOUT_FILENO) ||
312 posix_spawn_file_actions_addclose(&acts, slave_fd);
313 if (res != 0) return kInvalidFd;
314
315 // Spawn attributes
316 posix_spawnattr_t attrs;
317 res = posix_spawnattr_init(&attrs);
318 if (res != 0) return kInvalidFd;
319
320 auto attrs_cleanup = at_scope_exit([&] {
321 posix_spawnattr_destroy(&attrs);
322 });
323
324 // In the spawned process, close all file descriptors that are not explicitly
325 // described by the file actions object. This is Darwin-specific extension.
326 res = posix_spawnattr_setflags(&attrs, POSIX_SPAWN_CLOEXEC_DEFAULT);
327 if (res != 0) return kInvalidFd;
328
329 // posix_spawn
330 char **argv_casted = const_cast<char **>(argv);
331 char **envp_casted = const_cast<char **>(envp);
332 res = posix_spawn(pid, argv[0], &acts, &attrs, argv_casted, envp_casted);
333 if (res != 0) return kInvalidFd;
334
335 // Disable echo in the new terminal, disable CR.
336 struct termios termflags;
337 tcgetattr(master_fd, &termflags);
338 termflags.c_oflag &= ~ONLCR;
339 termflags.c_lflag &= ~ECHO;
340 tcsetattr(master_fd, TCSANOW, &termflags);
341
342 // On success, do not close master_fd on scope exit.
343 fd_t fd = master_fd;
344 master_fd = kInvalidFd;
345
346 return fd;
347 }
348
internal_spawn(const char * argv[],const char * envp[],pid_t * pid)349 fd_t internal_spawn(const char *argv[], const char *envp[], pid_t *pid) {
350 // The client program may close its stdin and/or stdout and/or stderr thus
351 // allowing open/posix_openpt to reuse file descriptors 0, 1 or 2. In this
352 // case the communication is broken if either the parent or the child tries to
353 // close or duplicate these descriptors. We temporarily reserve these
354 // descriptors here to prevent this.
355 fd_t low_fds[3];
356 size_t count = 0;
357
358 for (; count < 3; count++) {
359 low_fds[count] = posix_openpt(O_RDWR);
360 if (low_fds[count] >= STDERR_FILENO)
361 break;
362 }
363
364 fd_t fd = internal_spawn_impl(argv, envp, pid);
365
366 for (; count > 0; count--) {
367 internal_close(low_fds[count]);
368 }
369
370 return fd;
371 }
372
internal_rename(const char * oldpath,const char * newpath)373 uptr internal_rename(const char *oldpath, const char *newpath) {
374 return rename(oldpath, newpath);
375 }
376
internal_ftruncate(fd_t fd,uptr size)377 uptr internal_ftruncate(fd_t fd, uptr size) {
378 return ftruncate(fd, size);
379 }
380
internal_execve(const char * filename,char * const argv[],char * const envp[])381 uptr internal_execve(const char *filename, char *const argv[],
382 char *const envp[]) {
383 return execve(filename, argv, envp);
384 }
385
internal_waitpid(int pid,int * status,int options)386 uptr internal_waitpid(int pid, int *status, int options) {
387 return waitpid(pid, status, options);
388 }
389
390 // ----------------- sanitizer_common.h
FileExists(const char * filename)391 bool FileExists(const char *filename) {
392 if (ShouldMockFailureToOpen(filename))
393 return false;
394 struct stat st;
395 if (stat(filename, &st))
396 return false;
397 // Sanity check: filename is a regular file.
398 return S_ISREG(st.st_mode);
399 }
400
GetTid()401 tid_t GetTid() {
402 tid_t tid;
403 pthread_threadid_np(nullptr, &tid);
404 return tid;
405 }
406
GetThreadStackTopAndBottom(bool at_initialization,uptr * stack_top,uptr * stack_bottom)407 void GetThreadStackTopAndBottom(bool at_initialization, uptr *stack_top,
408 uptr *stack_bottom) {
409 CHECK(stack_top);
410 CHECK(stack_bottom);
411 uptr stacksize = pthread_get_stacksize_np(pthread_self());
412 // pthread_get_stacksize_np() returns an incorrect stack size for the main
413 // thread on Mavericks. See
414 // https://github.com/google/sanitizers/issues/261
415 if ((GetMacosAlignedVersion() >= MacosVersion(10, 9)) && at_initialization &&
416 stacksize == (1 << 19)) {
417 struct rlimit rl;
418 CHECK_EQ(getrlimit(RLIMIT_STACK, &rl), 0);
419 // Most often rl.rlim_cur will be the desired 8M.
420 if (rl.rlim_cur < kMaxThreadStackSize) {
421 stacksize = rl.rlim_cur;
422 } else {
423 stacksize = kMaxThreadStackSize;
424 }
425 }
426 void *stackaddr = pthread_get_stackaddr_np(pthread_self());
427 *stack_top = (uptr)stackaddr;
428 *stack_bottom = *stack_top - stacksize;
429 }
430
GetEnviron()431 char **GetEnviron() {
432 #if !SANITIZER_IOS
433 char ***env_ptr = _NSGetEnviron();
434 if (!env_ptr) {
435 Report("_NSGetEnviron() returned NULL. Please make sure __asan_init() is "
436 "called after libSystem_initializer().\n");
437 CHECK(env_ptr);
438 }
439 char **environ = *env_ptr;
440 #endif
441 CHECK(environ);
442 return environ;
443 }
444
GetEnv(const char * name)445 const char *GetEnv(const char *name) {
446 char **env = GetEnviron();
447 uptr name_len = internal_strlen(name);
448 while (*env != 0) {
449 uptr len = internal_strlen(*env);
450 if (len > name_len) {
451 const char *p = *env;
452 if (!internal_memcmp(p, name, name_len) &&
453 p[name_len] == '=') { // Match.
454 return *env + name_len + 1; // String starting after =.
455 }
456 }
457 env++;
458 }
459 return 0;
460 }
461
ReadBinaryName(char * buf,uptr buf_len)462 uptr ReadBinaryName(/*out*/char *buf, uptr buf_len) {
463 CHECK_LE(kMaxPathLength, buf_len);
464
465 // On OS X the executable path is saved to the stack by dyld. Reading it
466 // from there is much faster than calling dladdr, especially for large
467 // binaries with symbols.
468 InternalMmapVector<char> exe_path(kMaxPathLength);
469 uint32_t size = exe_path.size();
470 if (_NSGetExecutablePath(exe_path.data(), &size) == 0 &&
471 realpath(exe_path.data(), buf) != 0) {
472 return internal_strlen(buf);
473 }
474 return 0;
475 }
476
ReadLongProcessName(char * buf,uptr buf_len)477 uptr ReadLongProcessName(/*out*/char *buf, uptr buf_len) {
478 return ReadBinaryName(buf, buf_len);
479 }
480
ReExec()481 void ReExec() {
482 UNIMPLEMENTED();
483 }
484
CheckASLR()485 void CheckASLR() {
486 // Do nothing
487 }
488
CheckMPROTECT()489 void CheckMPROTECT() {
490 // Do nothing
491 }
492
GetPageSize()493 uptr GetPageSize() {
494 return sysconf(_SC_PAGESIZE);
495 }
496
497 extern "C" unsigned malloc_num_zones;
498 extern "C" malloc_zone_t **malloc_zones;
499 malloc_zone_t sanitizer_zone;
500
501 // We need to make sure that sanitizer_zone is registered as malloc_zones[0]. If
502 // libmalloc tries to set up a different zone as malloc_zones[0], it will call
503 // mprotect(malloc_zones, ..., PROT_READ). This interceptor will catch that and
504 // make sure we are still the first (default) zone.
MprotectMallocZones(void * addr,int prot)505 void MprotectMallocZones(void *addr, int prot) {
506 if (addr == malloc_zones && prot == PROT_READ) {
507 if (malloc_num_zones > 1 && malloc_zones[0] != &sanitizer_zone) {
508 for (unsigned i = 1; i < malloc_num_zones; i++) {
509 if (malloc_zones[i] == &sanitizer_zone) {
510 // Swap malloc_zones[0] and malloc_zones[i].
511 malloc_zones[i] = malloc_zones[0];
512 malloc_zones[0] = &sanitizer_zone;
513 break;
514 }
515 }
516 }
517 }
518 }
519
FutexWait(atomic_uint32_t * p,u32 cmp)520 void FutexWait(atomic_uint32_t *p, u32 cmp) {
521 // FIXME: implement actual blocking.
522 sched_yield();
523 }
524
FutexWake(atomic_uint32_t * p,u32 count)525 void FutexWake(atomic_uint32_t *p, u32 count) {}
526
NanoTime()527 u64 NanoTime() {
528 timeval tv;
529 internal_memset(&tv, 0, sizeof(tv));
530 gettimeofday(&tv, 0);
531 return (u64)tv.tv_sec * 1000*1000*1000 + tv.tv_usec * 1000;
532 }
533
534 // This needs to be called during initialization to avoid being racy.
MonotonicNanoTime()535 u64 MonotonicNanoTime() {
536 static mach_timebase_info_data_t timebase_info;
537 if (timebase_info.denom == 0) mach_timebase_info(&timebase_info);
538 return (mach_absolute_time() * timebase_info.numer) / timebase_info.denom;
539 }
540
GetTlsSize()541 uptr GetTlsSize() {
542 return 0;
543 }
544
InitTlsSize()545 void InitTlsSize() {
546 }
547
TlsBaseAddr()548 uptr TlsBaseAddr() {
549 uptr segbase = 0;
550 #if defined(__x86_64__)
551 asm("movq %%gs:0,%0" : "=r"(segbase));
552 #elif defined(__i386__)
553 asm("movl %%gs:0,%0" : "=r"(segbase));
554 #elif defined(__aarch64__)
555 asm("mrs %x0, tpidrro_el0" : "=r"(segbase));
556 segbase &= 0x07ul; // clearing lower bits, cpu id stored there
557 #endif
558 return segbase;
559 }
560
561 // The size of the tls on darwin does not appear to be well documented,
562 // however the vm memory map suggests that it is 1024 uptrs in size,
563 // with a size of 0x2000 bytes on x86_64 and 0x1000 bytes on i386.
TlsSize()564 uptr TlsSize() {
565 #if defined(__x86_64__) || defined(__i386__)
566 return 1024 * sizeof(uptr);
567 #else
568 return 0;
569 #endif
570 }
571
GetThreadStackAndTls(bool main,uptr * stk_addr,uptr * stk_size,uptr * tls_addr,uptr * tls_size)572 void GetThreadStackAndTls(bool main, uptr *stk_addr, uptr *stk_size,
573 uptr *tls_addr, uptr *tls_size) {
574 #if !SANITIZER_GO
575 uptr stack_top, stack_bottom;
576 GetThreadStackTopAndBottom(main, &stack_top, &stack_bottom);
577 *stk_addr = stack_bottom;
578 *stk_size = stack_top - stack_bottom;
579 *tls_addr = TlsBaseAddr();
580 *tls_size = TlsSize();
581 #else
582 *stk_addr = 0;
583 *stk_size = 0;
584 *tls_addr = 0;
585 *tls_size = 0;
586 #endif
587 }
588
init()589 void ListOfModules::init() {
590 clearOrInit();
591 MemoryMappingLayout memory_mapping(false);
592 memory_mapping.DumpListOfModules(&modules_);
593 }
594
fallbackInit()595 void ListOfModules::fallbackInit() { clear(); }
596
GetHandleSignalModeImpl(int signum)597 static HandleSignalMode GetHandleSignalModeImpl(int signum) {
598 switch (signum) {
599 case SIGABRT:
600 return common_flags()->handle_abort;
601 case SIGILL:
602 return common_flags()->handle_sigill;
603 case SIGTRAP:
604 return common_flags()->handle_sigtrap;
605 case SIGFPE:
606 return common_flags()->handle_sigfpe;
607 case SIGSEGV:
608 return common_flags()->handle_segv;
609 case SIGBUS:
610 return common_flags()->handle_sigbus;
611 }
612 return kHandleSignalNo;
613 }
614
GetHandleSignalMode(int signum)615 HandleSignalMode GetHandleSignalMode(int signum) {
616 // Handling fatal signals on watchOS and tvOS devices is disallowed.
617 if ((SANITIZER_WATCHOS || SANITIZER_TVOS) && !(SANITIZER_IOSSIM))
618 return kHandleSignalNo;
619 HandleSignalMode result = GetHandleSignalModeImpl(signum);
620 if (result == kHandleSignalYes && !common_flags()->allow_user_segv_handler)
621 return kHandleSignalExclusive;
622 return result;
623 }
624
625 // Offset example:
626 // XNU 17 -- macOS 10.13 -- iOS 11 -- tvOS 11 -- watchOS 4
GetOSMajorKernelOffset()627 constexpr u16 GetOSMajorKernelOffset() {
628 if (TARGET_OS_OSX) return 4;
629 if (TARGET_OS_IOS || TARGET_OS_TV) return 6;
630 if (TARGET_OS_WATCH) return 13;
631 }
632
633 using VersStr = char[64];
634
ApproximateOSVersionViaKernelVersion(VersStr vers)635 static uptr ApproximateOSVersionViaKernelVersion(VersStr vers) {
636 u16 kernel_major = GetDarwinKernelVersion().major;
637 u16 offset = GetOSMajorKernelOffset();
638 CHECK_GE(kernel_major, offset);
639 u16 os_major = kernel_major - offset;
640
641 const char *format = "%d.0";
642 if (TARGET_OS_OSX) {
643 if (os_major >= 16) { // macOS 11+
644 os_major -= 5;
645 } else { // macOS 10.15 and below
646 format = "10.%d";
647 }
648 }
649 return internal_snprintf(vers, sizeof(VersStr), format, os_major);
650 }
651
GetOSVersion(VersStr vers)652 static void GetOSVersion(VersStr vers) {
653 uptr len = sizeof(VersStr);
654 if (SANITIZER_IOSSIM) {
655 const char *vers_env = GetEnv("SIMULATOR_RUNTIME_VERSION");
656 if (!vers_env) {
657 Report("ERROR: Running in simulator but SIMULATOR_RUNTIME_VERSION env "
658 "var is not set.\n");
659 Die();
660 }
661 len = internal_strlcpy(vers, vers_env, len);
662 } else {
663 int res =
664 internal_sysctlbyname("kern.osproductversion", vers, &len, nullptr, 0);
665
666 // XNU 17 (macOS 10.13) and below do not provide the sysctl
667 // `kern.osproductversion` entry (res != 0).
668 bool no_os_version = res != 0;
669
670 // For launchd, sanitizer initialization runs before sysctl is setup
671 // (res == 0 && len != strlen(vers), vers is not a valid version). However,
672 // the kernel version `kern.osrelease` is available.
673 bool launchd = (res == 0 && internal_strlen(vers) < 3);
674 if (launchd) CHECK_EQ(internal_getpid(), 1);
675
676 if (no_os_version || launchd) {
677 len = ApproximateOSVersionViaKernelVersion(vers);
678 }
679 }
680 CHECK_LT(len, sizeof(VersStr));
681 }
682
ParseVersion(const char * vers,u16 * major,u16 * minor)683 void ParseVersion(const char *vers, u16 *major, u16 *minor) {
684 // Format: <major>.<minor>[.<patch>]\0
685 CHECK_GE(internal_strlen(vers), 3);
686 const char *p = vers;
687 *major = internal_simple_strtoll(p, &p, /*base=*/10);
688 CHECK_EQ(*p, '.');
689 p += 1;
690 *minor = internal_simple_strtoll(p, &p, /*base=*/10);
691 }
692
693 // Aligned versions example:
694 // macOS 10.15 -- iOS 13 -- tvOS 13 -- watchOS 6
MapToMacos(u16 * major,u16 * minor)695 static void MapToMacos(u16 *major, u16 *minor) {
696 if (TARGET_OS_OSX)
697 return;
698
699 if (TARGET_OS_IOS || TARGET_OS_TV)
700 *major += 2;
701 else if (TARGET_OS_WATCH)
702 *major += 9;
703 else
704 UNREACHABLE("unsupported platform");
705
706 if (*major >= 16) { // macOS 11+
707 *major -= 5;
708 } else { // macOS 10.15 and below
709 *minor = *major;
710 *major = 10;
711 }
712 }
713
GetMacosAlignedVersionInternal()714 static MacosVersion GetMacosAlignedVersionInternal() {
715 VersStr vers = {};
716 GetOSVersion(vers);
717
718 u16 major, minor;
719 ParseVersion(vers, &major, &minor);
720 MapToMacos(&major, &minor);
721
722 return MacosVersion(major, minor);
723 }
724
725 static_assert(sizeof(MacosVersion) == sizeof(atomic_uint32_t::Type),
726 "MacosVersion cache size");
727 static atomic_uint32_t cached_macos_version;
728
GetMacosAlignedVersion()729 MacosVersion GetMacosAlignedVersion() {
730 atomic_uint32_t::Type result =
731 atomic_load(&cached_macos_version, memory_order_acquire);
732 if (!result) {
733 MacosVersion version = GetMacosAlignedVersionInternal();
734 result = *reinterpret_cast<atomic_uint32_t::Type *>(&version);
735 atomic_store(&cached_macos_version, result, memory_order_release);
736 }
737 return *reinterpret_cast<MacosVersion *>(&result);
738 }
739
GetDarwinKernelVersion()740 DarwinKernelVersion GetDarwinKernelVersion() {
741 VersStr vers = {};
742 uptr len = sizeof(VersStr);
743 int res = internal_sysctlbyname("kern.osrelease", vers, &len, nullptr, 0);
744 CHECK_EQ(res, 0);
745 CHECK_LT(len, sizeof(VersStr));
746
747 u16 major, minor;
748 ParseVersion(vers, &major, &minor);
749
750 return DarwinKernelVersion(major, minor);
751 }
752
GetRSS()753 uptr GetRSS() {
754 struct task_basic_info info;
755 unsigned count = TASK_BASIC_INFO_COUNT;
756 kern_return_t result =
757 task_info(mach_task_self(), TASK_BASIC_INFO, (task_info_t)&info, &count);
758 if (UNLIKELY(result != KERN_SUCCESS)) {
759 Report("Cannot get task info. Error: %d\n", result);
760 Die();
761 }
762 return info.resident_size;
763 }
764
internal_start_thread(void * (* func)(void * arg),void * arg)765 void *internal_start_thread(void *(*func)(void *arg), void *arg) {
766 // Start the thread with signals blocked, otherwise it can steal user signals.
767 __sanitizer_sigset_t set, old;
768 internal_sigfillset(&set);
769 internal_sigprocmask(SIG_SETMASK, &set, &old);
770 pthread_t th;
771 pthread_create(&th, 0, func, arg);
772 internal_sigprocmask(SIG_SETMASK, &old, 0);
773 return th;
774 }
775
internal_join_thread(void * th)776 void internal_join_thread(void *th) { pthread_join((pthread_t)th, 0); }
777
778 #if !SANITIZER_GO
779 static Mutex syslog_lock;
780 # endif
781
WriteOneLineToSyslog(const char * s)782 void WriteOneLineToSyslog(const char *s) {
783 #if !SANITIZER_GO
784 syslog_lock.CheckLocked();
785 if (GetMacosAlignedVersion() >= MacosVersion(10, 12)) {
786 os_log_error(OS_LOG_DEFAULT, "%{public}s", s);
787 } else {
788 asl_log(nullptr, nullptr, ASL_LEVEL_ERR, "%s", s);
789 }
790 #endif
791 }
792
793 // buffer to store crash report application information
794 static char crashreporter_info_buff[__sanitizer::kErrorMessageBufferSize] = {};
795 static Mutex crashreporter_info_mutex;
796
797 extern "C" {
798 // Integrate with crash reporter libraries.
799 #if HAVE_CRASHREPORTERCLIENT_H
800 CRASH_REPORTER_CLIENT_HIDDEN
801 struct crashreporter_annotations_t gCRAnnotations
802 __attribute__((section("__DATA," CRASHREPORTER_ANNOTATIONS_SECTION))) = {
803 CRASHREPORTER_ANNOTATIONS_VERSION,
804 0,
805 0,
806 0,
807 0,
808 0,
809 0,
810 #if CRASHREPORTER_ANNOTATIONS_VERSION > 4
811 0,
812 #endif
813 };
814
815 #else
816 // fall back to old crashreporter api
817 static const char *__crashreporter_info__ __attribute__((__used__)) =
818 &crashreporter_info_buff[0];
819 asm(".desc ___crashreporter_info__, 0x10");
820 #endif
821
822 } // extern "C"
823
CRAppendCrashLogMessage(const char * msg)824 static void CRAppendCrashLogMessage(const char *msg) {
825 Lock l(&crashreporter_info_mutex);
826 internal_strlcat(crashreporter_info_buff, msg,
827 sizeof(crashreporter_info_buff));
828 #if HAVE_CRASHREPORTERCLIENT_H
829 (void)CRSetCrashLogMessage(crashreporter_info_buff);
830 #endif
831 }
832
LogMessageOnPrintf(const char * str)833 void LogMessageOnPrintf(const char *str) {
834 // Log all printf output to CrashLog.
835 if (common_flags()->abort_on_error)
836 CRAppendCrashLogMessage(str);
837 }
838
LogFullErrorReport(const char * buffer)839 void LogFullErrorReport(const char *buffer) {
840 #if !SANITIZER_GO
841 // Log with os_trace. This will make it into the crash log.
842 #if SANITIZER_OS_TRACE
843 if (GetMacosAlignedVersion() >= MacosVersion(10, 10)) {
844 // os_trace requires the message (format parameter) to be a string literal.
845 if (internal_strncmp(SanitizerToolName, "AddressSanitizer",
846 sizeof("AddressSanitizer") - 1) == 0)
847 os_trace("Address Sanitizer reported a failure.");
848 else if (internal_strncmp(SanitizerToolName, "UndefinedBehaviorSanitizer",
849 sizeof("UndefinedBehaviorSanitizer") - 1) == 0)
850 os_trace("Undefined Behavior Sanitizer reported a failure.");
851 else if (internal_strncmp(SanitizerToolName, "ThreadSanitizer",
852 sizeof("ThreadSanitizer") - 1) == 0)
853 os_trace("Thread Sanitizer reported a failure.");
854 else
855 os_trace("Sanitizer tool reported a failure.");
856
857 if (common_flags()->log_to_syslog)
858 os_trace("Consult syslog for more information.");
859 }
860 #endif
861
862 // Log to syslog.
863 // The logging on OS X may call pthread_create so we need the threading
864 // environment to be fully initialized. Also, this should never be called when
865 // holding the thread registry lock since that may result in a deadlock. If
866 // the reporting thread holds the thread registry mutex, and asl_log waits
867 // for GCD to dispatch a new thread, the process will deadlock, because the
868 // pthread_create wrapper needs to acquire the lock as well.
869 Lock l(&syslog_lock);
870 if (common_flags()->log_to_syslog)
871 WriteToSyslog(buffer);
872
873 // The report is added to CrashLog as part of logging all of Printf output.
874 #endif
875 }
876
GetWriteFlag() const877 SignalContext::WriteFlag SignalContext::GetWriteFlag() const {
878 #if defined(__x86_64__) || defined(__i386__)
879 ucontext_t *ucontext = static_cast<ucontext_t*>(context);
880 return ucontext->uc_mcontext->__es.__err & 2 /*T_PF_WRITE*/ ? WRITE : READ;
881 #else
882 return UNKNOWN;
883 #endif
884 }
885
IsTrueFaultingAddress() const886 bool SignalContext::IsTrueFaultingAddress() const {
887 auto si = static_cast<const siginfo_t *>(siginfo);
888 // "Real" SIGSEGV codes (e.g., SEGV_MAPERR, SEGV_MAPERR) are non-zero.
889 return si->si_signo == SIGSEGV && si->si_code != 0;
890 }
891
892 #if defined(__aarch64__) && defined(arm_thread_state64_get_sp)
893 #define AARCH64_GET_REG(r) \
894 (uptr)ptrauth_strip( \
895 (void *)arm_thread_state64_get_##r(ucontext->uc_mcontext->__ss), 0)
896 #else
897 #define AARCH64_GET_REG(r) ucontext->uc_mcontext->__ss.__##r
898 #endif
899
GetPcSpBp(void * context,uptr * pc,uptr * sp,uptr * bp)900 static void GetPcSpBp(void *context, uptr *pc, uptr *sp, uptr *bp) {
901 ucontext_t *ucontext = (ucontext_t*)context;
902 # if defined(__aarch64__)
903 *pc = AARCH64_GET_REG(pc);
904 # if defined(__IPHONE_8_0) && __IPHONE_OS_VERSION_MAX_ALLOWED >= __IPHONE_8_0
905 *bp = AARCH64_GET_REG(fp);
906 # else
907 *bp = AARCH64_GET_REG(lr);
908 # endif
909 *sp = AARCH64_GET_REG(sp);
910 # elif defined(__x86_64__)
911 *pc = ucontext->uc_mcontext->__ss.__rip;
912 *bp = ucontext->uc_mcontext->__ss.__rbp;
913 *sp = ucontext->uc_mcontext->__ss.__rsp;
914 # elif defined(__arm__)
915 *pc = ucontext->uc_mcontext->__ss.__pc;
916 *bp = ucontext->uc_mcontext->__ss.__r[7];
917 *sp = ucontext->uc_mcontext->__ss.__sp;
918 # elif defined(__i386__)
919 *pc = ucontext->uc_mcontext->__ss.__eip;
920 *bp = ucontext->uc_mcontext->__ss.__ebp;
921 *sp = ucontext->uc_mcontext->__ss.__esp;
922 # else
923 # error "Unknown architecture"
924 # endif
925 }
926
InitPcSpBp()927 void SignalContext::InitPcSpBp() {
928 addr = (uptr)ptrauth_strip((void *)addr, 0);
929 GetPcSpBp(context, &pc, &sp, &bp);
930 }
931
932 // ASan/TSan use mmap in a way that creates “deallocation gaps” which triggers
933 // EXC_GUARD exceptions on macOS 10.15+ (XNU 19.0+).
DisableMmapExcGuardExceptions()934 static void DisableMmapExcGuardExceptions() {
935 using task_exc_guard_behavior_t = uint32_t;
936 using task_set_exc_guard_behavior_t =
937 kern_return_t(task_t task, task_exc_guard_behavior_t behavior);
938 auto *set_behavior = (task_set_exc_guard_behavior_t *)dlsym(
939 RTLD_DEFAULT, "task_set_exc_guard_behavior");
940 if (set_behavior == nullptr) return;
941 const task_exc_guard_behavior_t task_exc_guard_none = 0;
942 set_behavior(mach_task_self(), task_exc_guard_none);
943 }
944
InitializePlatformEarly()945 void InitializePlatformEarly() {
946 // Only use xnu_fast_mmap when on x86_64 and the kernel supports it.
947 use_xnu_fast_mmap =
948 #if defined(__x86_64__)
949 GetDarwinKernelVersion() >= DarwinKernelVersion(17, 5);
950 #else
951 false;
952 #endif
953 if (GetDarwinKernelVersion() >= DarwinKernelVersion(19, 0))
954 DisableMmapExcGuardExceptions();
955 }
956
957 #if !SANITIZER_GO
958 static const char kDyldInsertLibraries[] = "DYLD_INSERT_LIBRARIES";
959 LowLevelAllocator allocator_for_env;
960
961 // Change the value of the env var |name|, leaking the original value.
962 // If |name_value| is NULL, the variable is deleted from the environment,
963 // otherwise the corresponding "NAME=value" string is replaced with
964 // |name_value|.
LeakyResetEnv(const char * name,const char * name_value)965 void LeakyResetEnv(const char *name, const char *name_value) {
966 char **env = GetEnviron();
967 uptr name_len = internal_strlen(name);
968 while (*env != 0) {
969 uptr len = internal_strlen(*env);
970 if (len > name_len) {
971 const char *p = *env;
972 if (!internal_memcmp(p, name, name_len) && p[name_len] == '=') {
973 // Match.
974 if (name_value) {
975 // Replace the old value with the new one.
976 *env = const_cast<char*>(name_value);
977 } else {
978 // Shift the subsequent pointers back.
979 char **del = env;
980 do {
981 del[0] = del[1];
982 } while (*del++);
983 }
984 }
985 }
986 env++;
987 }
988 }
989
990 SANITIZER_WEAK_CXX_DEFAULT_IMPL
ReexecDisabled()991 bool ReexecDisabled() {
992 return false;
993 }
994
DyldNeedsEnvVariable()995 static bool DyldNeedsEnvVariable() {
996 // If running on OS X 10.11+ or iOS 9.0+, dyld will interpose even if
997 // DYLD_INSERT_LIBRARIES is not set.
998 return GetMacosAlignedVersion() < MacosVersion(10, 11);
999 }
1000
MaybeReexec()1001 void MaybeReexec() {
1002 // FIXME: This should really live in some "InitializePlatform" method.
1003 MonotonicNanoTime();
1004
1005 if (ReexecDisabled()) return;
1006
1007 // Make sure the dynamic runtime library is preloaded so that the
1008 // wrappers work. If it is not, set DYLD_INSERT_LIBRARIES and re-exec
1009 // ourselves.
1010 Dl_info info;
1011 RAW_CHECK(dladdr((void*)((uptr)&__sanitizer_report_error_summary), &info));
1012 char *dyld_insert_libraries =
1013 const_cast<char*>(GetEnv(kDyldInsertLibraries));
1014 uptr old_env_len = dyld_insert_libraries ?
1015 internal_strlen(dyld_insert_libraries) : 0;
1016 uptr fname_len = internal_strlen(info.dli_fname);
1017 const char *dylib_name = StripModuleName(info.dli_fname);
1018 uptr dylib_name_len = internal_strlen(dylib_name);
1019
1020 bool lib_is_in_env = dyld_insert_libraries &&
1021 internal_strstr(dyld_insert_libraries, dylib_name);
1022 if (DyldNeedsEnvVariable() && !lib_is_in_env) {
1023 // DYLD_INSERT_LIBRARIES is not set or does not contain the runtime
1024 // library.
1025 InternalMmapVector<char> program_name(1024);
1026 uint32_t buf_size = program_name.size();
1027 _NSGetExecutablePath(program_name.data(), &buf_size);
1028 char *new_env = const_cast<char*>(info.dli_fname);
1029 if (dyld_insert_libraries) {
1030 // Append the runtime dylib name to the existing value of
1031 // DYLD_INSERT_LIBRARIES.
1032 new_env = (char*)allocator_for_env.Allocate(old_env_len + fname_len + 2);
1033 internal_strncpy(new_env, dyld_insert_libraries, old_env_len);
1034 new_env[old_env_len] = ':';
1035 // Copy fname_len and add a trailing zero.
1036 internal_strncpy(new_env + old_env_len + 1, info.dli_fname,
1037 fname_len + 1);
1038 // Ok to use setenv() since the wrappers don't depend on the value of
1039 // asan_inited.
1040 setenv(kDyldInsertLibraries, new_env, /*overwrite*/1);
1041 } else {
1042 // Set DYLD_INSERT_LIBRARIES equal to the runtime dylib name.
1043 setenv(kDyldInsertLibraries, info.dli_fname, /*overwrite*/0);
1044 }
1045 VReport(1, "exec()-ing the program with\n");
1046 VReport(1, "%s=%s\n", kDyldInsertLibraries, new_env);
1047 VReport(1, "to enable wrappers.\n");
1048 execv(program_name.data(), *_NSGetArgv());
1049
1050 // We get here only if execv() failed.
1051 Report("ERROR: The process is launched without DYLD_INSERT_LIBRARIES, "
1052 "which is required for the sanitizer to work. We tried to set the "
1053 "environment variable and re-execute itself, but execv() failed, "
1054 "possibly because of sandbox restrictions. Make sure to launch the "
1055 "executable with:\n%s=%s\n", kDyldInsertLibraries, new_env);
1056 RAW_CHECK("execv failed" && 0);
1057 }
1058
1059 // Verify that interceptors really work. We'll use dlsym to locate
1060 // "pthread_create", if interceptors are working, it should really point to
1061 // "wrap_pthread_create" within our own dylib.
1062 Dl_info info_pthread_create;
1063 void *dlopen_addr = dlsym(RTLD_DEFAULT, "pthread_create");
1064 RAW_CHECK(dladdr(dlopen_addr, &info_pthread_create));
1065 if (internal_strcmp(info.dli_fname, info_pthread_create.dli_fname) != 0) {
1066 Report(
1067 "ERROR: Interceptors are not working. This may be because %s is "
1068 "loaded too late (e.g. via dlopen). Please launch the executable "
1069 "with:\n%s=%s\n",
1070 SanitizerToolName, kDyldInsertLibraries, info.dli_fname);
1071 RAW_CHECK("interceptors not installed" && 0);
1072 }
1073
1074 if (!lib_is_in_env)
1075 return;
1076
1077 if (!common_flags()->strip_env)
1078 return;
1079
1080 // DYLD_INSERT_LIBRARIES is set and contains the runtime library. Let's remove
1081 // the dylib from the environment variable, because interceptors are installed
1082 // and we don't want our children to inherit the variable.
1083
1084 uptr env_name_len = internal_strlen(kDyldInsertLibraries);
1085 // Allocate memory to hold the previous env var name, its value, the '='
1086 // sign and the '\0' char.
1087 char *new_env = (char*)allocator_for_env.Allocate(
1088 old_env_len + 2 + env_name_len);
1089 RAW_CHECK(new_env);
1090 internal_memset(new_env, '\0', old_env_len + 2 + env_name_len);
1091 internal_strncpy(new_env, kDyldInsertLibraries, env_name_len);
1092 new_env[env_name_len] = '=';
1093 char *new_env_pos = new_env + env_name_len + 1;
1094
1095 // Iterate over colon-separated pieces of |dyld_insert_libraries|.
1096 char *piece_start = dyld_insert_libraries;
1097 char *piece_end = NULL;
1098 char *old_env_end = dyld_insert_libraries + old_env_len;
1099 do {
1100 if (piece_start[0] == ':') piece_start++;
1101 piece_end = internal_strchr(piece_start, ':');
1102 if (!piece_end) piece_end = dyld_insert_libraries + old_env_len;
1103 if ((uptr)(piece_start - dyld_insert_libraries) > old_env_len) break;
1104 uptr piece_len = piece_end - piece_start;
1105
1106 char *filename_start =
1107 (char *)internal_memrchr(piece_start, '/', piece_len);
1108 uptr filename_len = piece_len;
1109 if (filename_start) {
1110 filename_start += 1;
1111 filename_len = piece_len - (filename_start - piece_start);
1112 } else {
1113 filename_start = piece_start;
1114 }
1115
1116 // If the current piece isn't the runtime library name,
1117 // append it to new_env.
1118 if ((dylib_name_len != filename_len) ||
1119 (internal_memcmp(filename_start, dylib_name, dylib_name_len) != 0)) {
1120 if (new_env_pos != new_env + env_name_len + 1) {
1121 new_env_pos[0] = ':';
1122 new_env_pos++;
1123 }
1124 internal_strncpy(new_env_pos, piece_start, piece_len);
1125 new_env_pos += piece_len;
1126 }
1127 // Move on to the next piece.
1128 piece_start = piece_end;
1129 } while (piece_start < old_env_end);
1130
1131 // Can't use setenv() here, because it requires the allocator to be
1132 // initialized.
1133 // FIXME: instead of filtering DYLD_INSERT_LIBRARIES here, do it in
1134 // a separate function called after InitializeAllocator().
1135 if (new_env_pos == new_env + env_name_len + 1) new_env = NULL;
1136 LeakyResetEnv(kDyldInsertLibraries, new_env);
1137 }
1138 #endif // SANITIZER_GO
1139
GetArgv()1140 char **GetArgv() {
1141 return *_NSGetArgv();
1142 }
1143
1144 #if SANITIZER_IOS && !SANITIZER_IOSSIM
1145 // The task_vm_info struct is normally provided by the macOS SDK, but we need
1146 // fields only available in 10.12+. Declare the struct manually to be able to
1147 // build against older SDKs.
1148 struct __sanitizer_task_vm_info {
1149 mach_vm_size_t virtual_size;
1150 integer_t region_count;
1151 integer_t page_size;
1152 mach_vm_size_t resident_size;
1153 mach_vm_size_t resident_size_peak;
1154 mach_vm_size_t device;
1155 mach_vm_size_t device_peak;
1156 mach_vm_size_t internal;
1157 mach_vm_size_t internal_peak;
1158 mach_vm_size_t external;
1159 mach_vm_size_t external_peak;
1160 mach_vm_size_t reusable;
1161 mach_vm_size_t reusable_peak;
1162 mach_vm_size_t purgeable_volatile_pmap;
1163 mach_vm_size_t purgeable_volatile_resident;
1164 mach_vm_size_t purgeable_volatile_virtual;
1165 mach_vm_size_t compressed;
1166 mach_vm_size_t compressed_peak;
1167 mach_vm_size_t compressed_lifetime;
1168 mach_vm_size_t phys_footprint;
1169 mach_vm_address_t min_address;
1170 mach_vm_address_t max_address;
1171 };
1172 #define __SANITIZER_TASK_VM_INFO_COUNT ((mach_msg_type_number_t) \
1173 (sizeof(__sanitizer_task_vm_info) / sizeof(natural_t)))
1174
GetTaskInfoMaxAddress()1175 static uptr GetTaskInfoMaxAddress() {
1176 __sanitizer_task_vm_info vm_info = {} /* zero initialize */;
1177 mach_msg_type_number_t count = __SANITIZER_TASK_VM_INFO_COUNT;
1178 int err = task_info(mach_task_self(), TASK_VM_INFO, (int *)&vm_info, &count);
1179 return err ? 0 : vm_info.max_address;
1180 }
1181
GetMaxUserVirtualAddress()1182 uptr GetMaxUserVirtualAddress() {
1183 static uptr max_vm = GetTaskInfoMaxAddress();
1184 if (max_vm != 0) {
1185 const uptr ret_value = max_vm - 1;
1186 CHECK_LE(ret_value, SANITIZER_MMAP_RANGE_SIZE);
1187 return ret_value;
1188 }
1189
1190 // xnu cannot provide vm address limit
1191 # if SANITIZER_WORDSIZE == 32
1192 constexpr uptr fallback_max_vm = 0xffe00000 - 1;
1193 # else
1194 constexpr uptr fallback_max_vm = 0x200000000 - 1;
1195 # endif
1196 static_assert(fallback_max_vm <= SANITIZER_MMAP_RANGE_SIZE,
1197 "Max virtual address must be less than mmap range size.");
1198 return fallback_max_vm;
1199 }
1200
1201 #else // !SANITIZER_IOS
1202
GetMaxUserVirtualAddress()1203 uptr GetMaxUserVirtualAddress() {
1204 # if SANITIZER_WORDSIZE == 64
1205 constexpr uptr max_vm = (1ULL << 47) - 1; // 0x00007fffffffffffUL;
1206 # else // SANITIZER_WORDSIZE == 32
1207 static_assert(SANITIZER_WORDSIZE == 32, "Wrong wordsize");
1208 constexpr uptr max_vm = (1ULL << 32) - 1; // 0xffffffff;
1209 # endif
1210 static_assert(max_vm <= SANITIZER_MMAP_RANGE_SIZE,
1211 "Max virtual address must be less than mmap range size.");
1212 return max_vm;
1213 }
1214 #endif
1215
GetMaxVirtualAddress()1216 uptr GetMaxVirtualAddress() {
1217 return GetMaxUserVirtualAddress();
1218 }
1219
MapDynamicShadow(uptr shadow_size_bytes,uptr shadow_scale,uptr min_shadow_base_alignment,uptr & high_mem_end)1220 uptr MapDynamicShadow(uptr shadow_size_bytes, uptr shadow_scale,
1221 uptr min_shadow_base_alignment, uptr &high_mem_end) {
1222 const uptr granularity = GetMmapGranularity();
1223 const uptr alignment =
1224 Max<uptr>(granularity << shadow_scale, 1ULL << min_shadow_base_alignment);
1225 const uptr left_padding =
1226 Max<uptr>(granularity, 1ULL << min_shadow_base_alignment);
1227
1228 uptr space_size = shadow_size_bytes + left_padding;
1229
1230 uptr largest_gap_found = 0;
1231 uptr max_occupied_addr = 0;
1232 VReport(2, "FindDynamicShadowStart, space_size = %p\n", space_size);
1233 uptr shadow_start =
1234 FindAvailableMemoryRange(space_size, alignment, granularity,
1235 &largest_gap_found, &max_occupied_addr);
1236 // If the shadow doesn't fit, restrict the address space to make it fit.
1237 if (shadow_start == 0) {
1238 VReport(
1239 2,
1240 "Shadow doesn't fit, largest_gap_found = %p, max_occupied_addr = %p\n",
1241 largest_gap_found, max_occupied_addr);
1242 uptr new_max_vm = RoundDownTo(largest_gap_found << shadow_scale, alignment);
1243 if (new_max_vm < max_occupied_addr) {
1244 Report("Unable to find a memory range for dynamic shadow.\n");
1245 Report(
1246 "space_size = %p, largest_gap_found = %p, max_occupied_addr = %p, "
1247 "new_max_vm = %p\n",
1248 space_size, largest_gap_found, max_occupied_addr, new_max_vm);
1249 CHECK(0 && "cannot place shadow");
1250 }
1251 RestrictMemoryToMaxAddress(new_max_vm);
1252 high_mem_end = new_max_vm - 1;
1253 space_size = (high_mem_end >> shadow_scale) + left_padding;
1254 VReport(2, "FindDynamicShadowStart, space_size = %p\n", space_size);
1255 shadow_start = FindAvailableMemoryRange(space_size, alignment, granularity,
1256 nullptr, nullptr);
1257 if (shadow_start == 0) {
1258 Report("Unable to find a memory range after restricting VM.\n");
1259 CHECK(0 && "cannot place shadow after restricting vm");
1260 }
1261 }
1262 CHECK_NE((uptr)0, shadow_start);
1263 CHECK(IsAligned(shadow_start, alignment));
1264 return shadow_start;
1265 }
1266
MapDynamicShadowAndAliases(uptr shadow_size,uptr alias_size,uptr num_aliases,uptr ring_buffer_size)1267 uptr MapDynamicShadowAndAliases(uptr shadow_size, uptr alias_size,
1268 uptr num_aliases, uptr ring_buffer_size) {
1269 CHECK(false && "HWASan aliasing is unimplemented on Mac");
1270 return 0;
1271 }
1272
FindAvailableMemoryRange(uptr size,uptr alignment,uptr left_padding,uptr * largest_gap_found,uptr * max_occupied_addr)1273 uptr FindAvailableMemoryRange(uptr size, uptr alignment, uptr left_padding,
1274 uptr *largest_gap_found,
1275 uptr *max_occupied_addr) {
1276 typedef vm_region_submap_short_info_data_64_t RegionInfo;
1277 enum { kRegionInfoSize = VM_REGION_SUBMAP_SHORT_INFO_COUNT_64 };
1278 // Start searching for available memory region past PAGEZERO, which is
1279 // 4KB on 32-bit and 4GB on 64-bit.
1280 mach_vm_address_t start_address =
1281 (SANITIZER_WORDSIZE == 32) ? 0x000000001000 : 0x000100000000;
1282
1283 mach_vm_address_t address = start_address;
1284 mach_vm_address_t free_begin = start_address;
1285 kern_return_t kr = KERN_SUCCESS;
1286 if (largest_gap_found) *largest_gap_found = 0;
1287 if (max_occupied_addr) *max_occupied_addr = 0;
1288 while (kr == KERN_SUCCESS) {
1289 mach_vm_size_t vmsize = 0;
1290 natural_t depth = 0;
1291 RegionInfo vminfo;
1292 mach_msg_type_number_t count = kRegionInfoSize;
1293 kr = mach_vm_region_recurse(mach_task_self(), &address, &vmsize, &depth,
1294 (vm_region_info_t)&vminfo, &count);
1295 if (kr == KERN_INVALID_ADDRESS) {
1296 // No more regions beyond "address", consider the gap at the end of VM.
1297 address = GetMaxVirtualAddress() + 1;
1298 vmsize = 0;
1299 } else {
1300 if (max_occupied_addr) *max_occupied_addr = address + vmsize;
1301 }
1302 if (free_begin != address) {
1303 // We found a free region [free_begin..address-1].
1304 uptr gap_start = RoundUpTo((uptr)free_begin + left_padding, alignment);
1305 uptr gap_end = RoundDownTo((uptr)address, alignment);
1306 uptr gap_size = gap_end > gap_start ? gap_end - gap_start : 0;
1307 if (size < gap_size) {
1308 return gap_start;
1309 }
1310
1311 if (largest_gap_found && *largest_gap_found < gap_size) {
1312 *largest_gap_found = gap_size;
1313 }
1314 }
1315 // Move to the next region.
1316 address += vmsize;
1317 free_begin = address;
1318 }
1319
1320 // We looked at all free regions and could not find one large enough.
1321 return 0;
1322 }
1323
1324 // FIXME implement on this platform.
GetMemoryProfile(fill_profile_f cb,uptr * stats)1325 void GetMemoryProfile(fill_profile_f cb, uptr *stats) {}
1326
DumpAllRegisters(void * context)1327 void SignalContext::DumpAllRegisters(void *context) {
1328 Report("Register values:\n");
1329
1330 ucontext_t *ucontext = (ucontext_t*)context;
1331 # define DUMPREG64(r) \
1332 Printf("%s = 0x%016llx ", #r, ucontext->uc_mcontext->__ss.__ ## r);
1333 # define DUMPREGA64(r) \
1334 Printf(" %s = 0x%016llx ", #r, AARCH64_GET_REG(r));
1335 # define DUMPREG32(r) \
1336 Printf("%s = 0x%08x ", #r, ucontext->uc_mcontext->__ss.__ ## r);
1337 # define DUMPREG_(r) Printf(" "); DUMPREG(r);
1338 # define DUMPREG__(r) Printf(" "); DUMPREG(r);
1339 # define DUMPREG___(r) Printf(" "); DUMPREG(r);
1340
1341 # if defined(__x86_64__)
1342 # define DUMPREG(r) DUMPREG64(r)
1343 DUMPREG(rax); DUMPREG(rbx); DUMPREG(rcx); DUMPREG(rdx); Printf("\n");
1344 DUMPREG(rdi); DUMPREG(rsi); DUMPREG(rbp); DUMPREG(rsp); Printf("\n");
1345 DUMPREG_(r8); DUMPREG_(r9); DUMPREG(r10); DUMPREG(r11); Printf("\n");
1346 DUMPREG(r12); DUMPREG(r13); DUMPREG(r14); DUMPREG(r15); Printf("\n");
1347 # elif defined(__i386__)
1348 # define DUMPREG(r) DUMPREG32(r)
1349 DUMPREG(eax); DUMPREG(ebx); DUMPREG(ecx); DUMPREG(edx); Printf("\n");
1350 DUMPREG(edi); DUMPREG(esi); DUMPREG(ebp); DUMPREG(esp); Printf("\n");
1351 # elif defined(__aarch64__)
1352 # define DUMPREG(r) DUMPREG64(r)
1353 DUMPREG_(x[0]); DUMPREG_(x[1]); DUMPREG_(x[2]); DUMPREG_(x[3]); Printf("\n");
1354 DUMPREG_(x[4]); DUMPREG_(x[5]); DUMPREG_(x[6]); DUMPREG_(x[7]); Printf("\n");
1355 DUMPREG_(x[8]); DUMPREG_(x[9]); DUMPREG(x[10]); DUMPREG(x[11]); Printf("\n");
1356 DUMPREG(x[12]); DUMPREG(x[13]); DUMPREG(x[14]); DUMPREG(x[15]); Printf("\n");
1357 DUMPREG(x[16]); DUMPREG(x[17]); DUMPREG(x[18]); DUMPREG(x[19]); Printf("\n");
1358 DUMPREG(x[20]); DUMPREG(x[21]); DUMPREG(x[22]); DUMPREG(x[23]); Printf("\n");
1359 DUMPREG(x[24]); DUMPREG(x[25]); DUMPREG(x[26]); DUMPREG(x[27]); Printf("\n");
1360 DUMPREG(x[28]); DUMPREGA64(fp); DUMPREGA64(lr); DUMPREGA64(sp); Printf("\n");
1361 # elif defined(__arm__)
1362 # define DUMPREG(r) DUMPREG32(r)
1363 DUMPREG_(r[0]); DUMPREG_(r[1]); DUMPREG_(r[2]); DUMPREG_(r[3]); Printf("\n");
1364 DUMPREG_(r[4]); DUMPREG_(r[5]); DUMPREG_(r[6]); DUMPREG_(r[7]); Printf("\n");
1365 DUMPREG_(r[8]); DUMPREG_(r[9]); DUMPREG(r[10]); DUMPREG(r[11]); Printf("\n");
1366 DUMPREG(r[12]); DUMPREG___(sp); DUMPREG___(lr); DUMPREG___(pc); Printf("\n");
1367 # else
1368 # error "Unknown architecture"
1369 # endif
1370
1371 # undef DUMPREG64
1372 # undef DUMPREG32
1373 # undef DUMPREG_
1374 # undef DUMPREG__
1375 # undef DUMPREG___
1376 # undef DUMPREG
1377 }
1378
CompareBaseAddress(const LoadedModule & a,const LoadedModule & b)1379 static inline bool CompareBaseAddress(const LoadedModule &a,
1380 const LoadedModule &b) {
1381 return a.base_address() < b.base_address();
1382 }
1383
FormatUUID(char * out,uptr size,const u8 * uuid)1384 void FormatUUID(char *out, uptr size, const u8 *uuid) {
1385 internal_snprintf(out, size,
1386 "<%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-"
1387 "%02X%02X%02X%02X%02X%02X>",
1388 uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5],
1389 uuid[6], uuid[7], uuid[8], uuid[9], uuid[10], uuid[11],
1390 uuid[12], uuid[13], uuid[14], uuid[15]);
1391 }
1392
DumpProcessMap()1393 void DumpProcessMap() {
1394 Printf("Process module map:\n");
1395 MemoryMappingLayout memory_mapping(false);
1396 InternalMmapVector<LoadedModule> modules;
1397 modules.reserve(128);
1398 memory_mapping.DumpListOfModules(&modules);
1399 Sort(modules.data(), modules.size(), CompareBaseAddress);
1400 for (uptr i = 0; i < modules.size(); ++i) {
1401 char uuid_str[128];
1402 FormatUUID(uuid_str, sizeof(uuid_str), modules[i].uuid());
1403 Printf("0x%zx-0x%zx %s (%s) %s\n", modules[i].base_address(),
1404 modules[i].max_executable_address(), modules[i].full_name(),
1405 ModuleArchToString(modules[i].arch()), uuid_str);
1406 }
1407 Printf("End of module map.\n");
1408 }
1409
CheckNoDeepBind(const char * filename,int flag)1410 void CheckNoDeepBind(const char *filename, int flag) {
1411 // Do nothing.
1412 }
1413
GetRandom(void * buffer,uptr length,bool blocking)1414 bool GetRandom(void *buffer, uptr length, bool blocking) {
1415 if (!buffer || !length || length > 256)
1416 return false;
1417 // arc4random never fails.
1418 REAL(arc4random_buf)(buffer, length);
1419 return true;
1420 }
1421
GetNumberOfCPUs()1422 u32 GetNumberOfCPUs() {
1423 return (u32)sysconf(_SC_NPROCESSORS_ONLN);
1424 }
1425
InitializePlatformCommonFlags(CommonFlags * cf)1426 void InitializePlatformCommonFlags(CommonFlags *cf) {}
1427
1428 } // namespace __sanitizer
1429
1430 #endif // SANITIZER_MAC
1431