168d75effSDimitry Andric //===-- asan_errors.cpp -----------------------------------------*- C++ -*-===//
268d75effSDimitry Andric //
368d75effSDimitry Andric // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
468d75effSDimitry Andric // See https://llvm.org/LICENSE.txt for license information.
568d75effSDimitry Andric // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
668d75effSDimitry Andric //
768d75effSDimitry Andric //===----------------------------------------------------------------------===//
868d75effSDimitry Andric //
968d75effSDimitry Andric // This file is a part of AddressSanitizer, an address sanity checker.
1068d75effSDimitry Andric //
1168d75effSDimitry Andric // ASan implementation for error structures.
1268d75effSDimitry Andric //===----------------------------------------------------------------------===//
1368d75effSDimitry Andric
1468d75effSDimitry Andric #include "asan_errors.h"
1568d75effSDimitry Andric #include "asan_descriptions.h"
1668d75effSDimitry Andric #include "asan_mapping.h"
1768d75effSDimitry Andric #include "asan_report.h"
1868d75effSDimitry Andric #include "asan_stack.h"
1968d75effSDimitry Andric #include "sanitizer_common/sanitizer_stackdepot.h"
2068d75effSDimitry Andric
2168d75effSDimitry Andric namespace __asan {
2268d75effSDimitry Andric
OnStackUnwind(const SignalContext & sig,const void * callback_context,BufferedStackTrace * stack)2368d75effSDimitry Andric static void OnStackUnwind(const SignalContext &sig,
2468d75effSDimitry Andric const void *callback_context,
2568d75effSDimitry Andric BufferedStackTrace *stack) {
2668d75effSDimitry Andric bool fast = common_flags()->fast_unwind_on_fatal;
2768d75effSDimitry Andric #if SANITIZER_FREEBSD || SANITIZER_NETBSD
2868d75effSDimitry Andric // On FreeBSD the slow unwinding that leverages _Unwind_Backtrace()
2968d75effSDimitry Andric // yields the call stack of the signal's handler and not of the code
3068d75effSDimitry Andric // that raised the signal (as it does on Linux).
3168d75effSDimitry Andric fast = true;
3268d75effSDimitry Andric #endif
3368d75effSDimitry Andric // Tests and maybe some users expect that scariness is going to be printed
3468d75effSDimitry Andric // just before the stack. As only asan has scariness score we have no
3568d75effSDimitry Andric // corresponding code in the sanitizer_common and we use this callback to
3668d75effSDimitry Andric // print it.
3768d75effSDimitry Andric static_cast<const ScarinessScoreBase *>(callback_context)->Print();
3868d75effSDimitry Andric stack->Unwind(StackTrace::GetNextInstructionPc(sig.pc), sig.bp, sig.context,
3968d75effSDimitry Andric fast);
4068d75effSDimitry Andric }
4168d75effSDimitry Andric
Print()4268d75effSDimitry Andric void ErrorDeadlySignal::Print() {
4368d75effSDimitry Andric ReportDeadlySignal(signal, tid, &OnStackUnwind, &scariness);
4468d75effSDimitry Andric }
4568d75effSDimitry Andric
Print()4668d75effSDimitry Andric void ErrorDoubleFree::Print() {
4768d75effSDimitry Andric Decorator d;
4868d75effSDimitry Andric Printf("%s", d.Error());
49349cc55cSDimitry Andric Report("ERROR: AddressSanitizer: attempting %s on %p in thread %s:\n",
50349cc55cSDimitry Andric scariness.GetDescription(), (void *)addr_description.addr,
5168d75effSDimitry Andric AsanThreadIdAndName(tid).c_str());
5268d75effSDimitry Andric Printf("%s", d.Default());
5368d75effSDimitry Andric scariness.Print();
5468d75effSDimitry Andric GET_STACK_TRACE_FATAL(second_free_stack->trace[0],
5568d75effSDimitry Andric second_free_stack->top_frame_bp);
5668d75effSDimitry Andric stack.Print();
5768d75effSDimitry Andric addr_description.Print();
5868d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack);
5968d75effSDimitry Andric }
6068d75effSDimitry Andric
Print()6168d75effSDimitry Andric void ErrorNewDeleteTypeMismatch::Print() {
6268d75effSDimitry Andric Decorator d;
6368d75effSDimitry Andric Printf("%s", d.Error());
64349cc55cSDimitry Andric Report("ERROR: AddressSanitizer: %s on %p in thread %s:\n",
65349cc55cSDimitry Andric scariness.GetDescription(), (void *)addr_description.addr,
6668d75effSDimitry Andric AsanThreadIdAndName(tid).c_str());
6768d75effSDimitry Andric Printf("%s object passed to delete has wrong type:\n", d.Default());
6868d75effSDimitry Andric if (delete_size != 0) {
6968d75effSDimitry Andric Printf(
7068d75effSDimitry Andric " size of the allocated type: %zd bytes;\n"
7168d75effSDimitry Andric " size of the deallocated type: %zd bytes.\n",
7268d75effSDimitry Andric addr_description.chunk_access.chunk_size, delete_size);
7368d75effSDimitry Andric }
7468d75effSDimitry Andric const uptr user_alignment =
7568d75effSDimitry Andric addr_description.chunk_access.user_requested_alignment;
7668d75effSDimitry Andric if (delete_alignment != user_alignment) {
7768d75effSDimitry Andric char user_alignment_str[32];
7868d75effSDimitry Andric char delete_alignment_str[32];
7968d75effSDimitry Andric internal_snprintf(user_alignment_str, sizeof(user_alignment_str),
8068d75effSDimitry Andric "%zd bytes", user_alignment);
8168d75effSDimitry Andric internal_snprintf(delete_alignment_str, sizeof(delete_alignment_str),
8268d75effSDimitry Andric "%zd bytes", delete_alignment);
8368d75effSDimitry Andric static const char *kDefaultAlignment = "default-aligned";
8468d75effSDimitry Andric Printf(
8568d75effSDimitry Andric " alignment of the allocated type: %s;\n"
8668d75effSDimitry Andric " alignment of the deallocated type: %s.\n",
8768d75effSDimitry Andric user_alignment > 0 ? user_alignment_str : kDefaultAlignment,
8868d75effSDimitry Andric delete_alignment > 0 ? delete_alignment_str : kDefaultAlignment);
8968d75effSDimitry Andric }
9068d75effSDimitry Andric CHECK_GT(free_stack->size, 0);
9168d75effSDimitry Andric scariness.Print();
9268d75effSDimitry Andric GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
9368d75effSDimitry Andric stack.Print();
9468d75effSDimitry Andric addr_description.Print();
9568d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack);
9668d75effSDimitry Andric Report(
9768d75effSDimitry Andric "HINT: if you don't care about these errors you may set "
9868d75effSDimitry Andric "ASAN_OPTIONS=new_delete_type_mismatch=0\n");
9968d75effSDimitry Andric }
10068d75effSDimitry Andric
Print()10168d75effSDimitry Andric void ErrorFreeNotMalloced::Print() {
10268d75effSDimitry Andric Decorator d;
10368d75effSDimitry Andric Printf("%s", d.Error());
10468d75effSDimitry Andric Report(
10568d75effSDimitry Andric "ERROR: AddressSanitizer: attempting free on address "
10668d75effSDimitry Andric "which was not malloc()-ed: %p in thread %s\n",
107349cc55cSDimitry Andric (void *)addr_description.Address(), AsanThreadIdAndName(tid).c_str());
10868d75effSDimitry Andric Printf("%s", d.Default());
10968d75effSDimitry Andric CHECK_GT(free_stack->size, 0);
11068d75effSDimitry Andric scariness.Print();
11168d75effSDimitry Andric GET_STACK_TRACE_FATAL(free_stack->trace[0], free_stack->top_frame_bp);
11268d75effSDimitry Andric stack.Print();
11368d75effSDimitry Andric addr_description.Print();
11468d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack);
11568d75effSDimitry Andric }
11668d75effSDimitry Andric
Print()11768d75effSDimitry Andric void ErrorAllocTypeMismatch::Print() {
11868d75effSDimitry Andric static const char *alloc_names[] = {"INVALID", "malloc", "operator new",
11968d75effSDimitry Andric "operator new []"};
12068d75effSDimitry Andric static const char *dealloc_names[] = {"INVALID", "free", "operator delete",
12168d75effSDimitry Andric "operator delete []"};
12268d75effSDimitry Andric CHECK_NE(alloc_type, dealloc_type);
12368d75effSDimitry Andric Decorator d;
12468d75effSDimitry Andric Printf("%s", d.Error());
12568d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s (%s vs %s) on %p\n",
12668d75effSDimitry Andric scariness.GetDescription(), alloc_names[alloc_type],
127349cc55cSDimitry Andric dealloc_names[dealloc_type], (void *)addr_description.Address());
12868d75effSDimitry Andric Printf("%s", d.Default());
12968d75effSDimitry Andric CHECK_GT(dealloc_stack->size, 0);
13068d75effSDimitry Andric scariness.Print();
13168d75effSDimitry Andric GET_STACK_TRACE_FATAL(dealloc_stack->trace[0], dealloc_stack->top_frame_bp);
13268d75effSDimitry Andric stack.Print();
13368d75effSDimitry Andric addr_description.Print();
13468d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack);
13568d75effSDimitry Andric Report(
13668d75effSDimitry Andric "HINT: if you don't care about these errors you may set "
13768d75effSDimitry Andric "ASAN_OPTIONS=alloc_dealloc_mismatch=0\n");
13868d75effSDimitry Andric }
13968d75effSDimitry Andric
Print()14068d75effSDimitry Andric void ErrorMallocUsableSizeNotOwned::Print() {
14168d75effSDimitry Andric Decorator d;
14268d75effSDimitry Andric Printf("%s", d.Error());
14368d75effSDimitry Andric Report(
14468d75effSDimitry Andric "ERROR: AddressSanitizer: attempting to call malloc_usable_size() for "
14568d75effSDimitry Andric "pointer which is not owned: %p\n",
146349cc55cSDimitry Andric (void *)addr_description.Address());
14768d75effSDimitry Andric Printf("%s", d.Default());
14868d75effSDimitry Andric stack->Print();
14968d75effSDimitry Andric addr_description.Print();
15068d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
15168d75effSDimitry Andric }
15268d75effSDimitry Andric
Print()15368d75effSDimitry Andric void ErrorSanitizerGetAllocatedSizeNotOwned::Print() {
15468d75effSDimitry Andric Decorator d;
15568d75effSDimitry Andric Printf("%s", d.Error());
15668d75effSDimitry Andric Report(
15768d75effSDimitry Andric "ERROR: AddressSanitizer: attempting to call "
15868d75effSDimitry Andric "__sanitizer_get_allocated_size() for pointer which is not owned: %p\n",
159349cc55cSDimitry Andric (void *)addr_description.Address());
16068d75effSDimitry Andric Printf("%s", d.Default());
16168d75effSDimitry Andric stack->Print();
16268d75effSDimitry Andric addr_description.Print();
16368d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
16468d75effSDimitry Andric }
16568d75effSDimitry Andric
Print()16668d75effSDimitry Andric void ErrorCallocOverflow::Print() {
16768d75effSDimitry Andric Decorator d;
16868d75effSDimitry Andric Printf("%s", d.Error());
16968d75effSDimitry Andric Report(
17068d75effSDimitry Andric "ERROR: AddressSanitizer: calloc parameters overflow: count * size "
17168d75effSDimitry Andric "(%zd * %zd) cannot be represented in type size_t (thread %s)\n",
17268d75effSDimitry Andric count, size, AsanThreadIdAndName(tid).c_str());
17368d75effSDimitry Andric Printf("%s", d.Default());
17468d75effSDimitry Andric stack->Print();
17568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull();
17668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
17768d75effSDimitry Andric }
17868d75effSDimitry Andric
Print()17968d75effSDimitry Andric void ErrorReallocArrayOverflow::Print() {
18068d75effSDimitry Andric Decorator d;
18168d75effSDimitry Andric Printf("%s", d.Error());
18268d75effSDimitry Andric Report(
18368d75effSDimitry Andric "ERROR: AddressSanitizer: reallocarray parameters overflow: count * size "
18468d75effSDimitry Andric "(%zd * %zd) cannot be represented in type size_t (thread %s)\n",
18568d75effSDimitry Andric count, size, AsanThreadIdAndName(tid).c_str());
18668d75effSDimitry Andric Printf("%s", d.Default());
18768d75effSDimitry Andric stack->Print();
18868d75effSDimitry Andric PrintHintAllocatorCannotReturnNull();
18968d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
19068d75effSDimitry Andric }
19168d75effSDimitry Andric
Print()19268d75effSDimitry Andric void ErrorPvallocOverflow::Print() {
19368d75effSDimitry Andric Decorator d;
19468d75effSDimitry Andric Printf("%s", d.Error());
19568d75effSDimitry Andric Report(
19668d75effSDimitry Andric "ERROR: AddressSanitizer: pvalloc parameters overflow: size 0x%zx "
19768d75effSDimitry Andric "rounded up to system page size 0x%zx cannot be represented in type "
19868d75effSDimitry Andric "size_t (thread %s)\n",
19968d75effSDimitry Andric size, GetPageSizeCached(), AsanThreadIdAndName(tid).c_str());
20068d75effSDimitry Andric Printf("%s", d.Default());
20168d75effSDimitry Andric stack->Print();
20268d75effSDimitry Andric PrintHintAllocatorCannotReturnNull();
20368d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
20468d75effSDimitry Andric }
20568d75effSDimitry Andric
Print()20668d75effSDimitry Andric void ErrorInvalidAllocationAlignment::Print() {
20768d75effSDimitry Andric Decorator d;
20868d75effSDimitry Andric Printf("%s", d.Error());
20968d75effSDimitry Andric Report(
21068d75effSDimitry Andric "ERROR: AddressSanitizer: invalid allocation alignment: %zd, "
21168d75effSDimitry Andric "alignment must be a power of two (thread %s)\n",
21268d75effSDimitry Andric alignment, AsanThreadIdAndName(tid).c_str());
21368d75effSDimitry Andric Printf("%s", d.Default());
21468d75effSDimitry Andric stack->Print();
21568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull();
21668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
21768d75effSDimitry Andric }
21868d75effSDimitry Andric
Print()21968d75effSDimitry Andric void ErrorInvalidAlignedAllocAlignment::Print() {
22068d75effSDimitry Andric Decorator d;
22168d75effSDimitry Andric Printf("%s", d.Error());
22268d75effSDimitry Andric #if SANITIZER_POSIX
22368d75effSDimitry Andric Report("ERROR: AddressSanitizer: invalid alignment requested in "
22468d75effSDimitry Andric "aligned_alloc: %zd, alignment must be a power of two and the "
22568d75effSDimitry Andric "requested size 0x%zx must be a multiple of alignment "
22668d75effSDimitry Andric "(thread %s)\n", alignment, size, AsanThreadIdAndName(tid).c_str());
22768d75effSDimitry Andric #else
22868d75effSDimitry Andric Report("ERROR: AddressSanitizer: invalid alignment requested in "
22968d75effSDimitry Andric "aligned_alloc: %zd, the requested size 0x%zx must be a multiple of "
23068d75effSDimitry Andric "alignment (thread %s)\n", alignment, size,
23168d75effSDimitry Andric AsanThreadIdAndName(tid).c_str());
23268d75effSDimitry Andric #endif
23368d75effSDimitry Andric Printf("%s", d.Default());
23468d75effSDimitry Andric stack->Print();
23568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull();
23668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
23768d75effSDimitry Andric }
23868d75effSDimitry Andric
Print()23968d75effSDimitry Andric void ErrorInvalidPosixMemalignAlignment::Print() {
24068d75effSDimitry Andric Decorator d;
24168d75effSDimitry Andric Printf("%s", d.Error());
24268d75effSDimitry Andric Report(
24368d75effSDimitry Andric "ERROR: AddressSanitizer: invalid alignment requested in posix_memalign: "
24468d75effSDimitry Andric "%zd, alignment must be a power of two and a multiple of sizeof(void*) "
24568d75effSDimitry Andric "== %zd (thread %s)\n",
24668d75effSDimitry Andric alignment, sizeof(void *), AsanThreadIdAndName(tid).c_str());
24768d75effSDimitry Andric Printf("%s", d.Default());
24868d75effSDimitry Andric stack->Print();
24968d75effSDimitry Andric PrintHintAllocatorCannotReturnNull();
25068d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
25168d75effSDimitry Andric }
25268d75effSDimitry Andric
Print()25368d75effSDimitry Andric void ErrorAllocationSizeTooBig::Print() {
25468d75effSDimitry Andric Decorator d;
25568d75effSDimitry Andric Printf("%s", d.Error());
25668d75effSDimitry Andric Report(
25768d75effSDimitry Andric "ERROR: AddressSanitizer: requested allocation size 0x%zx (0x%zx after "
25868d75effSDimitry Andric "adjustments for alignment, red zones etc.) exceeds maximum supported "
25968d75effSDimitry Andric "size of 0x%zx (thread %s)\n",
26068d75effSDimitry Andric user_size, total_size, max_size, AsanThreadIdAndName(tid).c_str());
26168d75effSDimitry Andric Printf("%s", d.Default());
26268d75effSDimitry Andric stack->Print();
26368d75effSDimitry Andric PrintHintAllocatorCannotReturnNull();
26468d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
26568d75effSDimitry Andric }
26668d75effSDimitry Andric
Print()26768d75effSDimitry Andric void ErrorRssLimitExceeded::Print() {
26868d75effSDimitry Andric Decorator d;
26968d75effSDimitry Andric Printf("%s", d.Error());
27068d75effSDimitry Andric Report(
27168d75effSDimitry Andric "ERROR: AddressSanitizer: specified RSS limit exceeded, currently set to "
27268d75effSDimitry Andric "soft_rss_limit_mb=%zd\n", common_flags()->soft_rss_limit_mb);
27368d75effSDimitry Andric Printf("%s", d.Default());
27468d75effSDimitry Andric stack->Print();
27568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull();
27668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
27768d75effSDimitry Andric }
27868d75effSDimitry Andric
Print()27968d75effSDimitry Andric void ErrorOutOfMemory::Print() {
28068d75effSDimitry Andric Decorator d;
28168d75effSDimitry Andric Printf("%s", d.Error());
28281ad6265SDimitry Andric ERROR_OOM("allocator is trying to allocate 0x%zx bytes\n", requested_size);
28368d75effSDimitry Andric Printf("%s", d.Default());
28468d75effSDimitry Andric stack->Print();
28568d75effSDimitry Andric PrintHintAllocatorCannotReturnNull();
28668d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
28768d75effSDimitry Andric }
28868d75effSDimitry Andric
Print()28968d75effSDimitry Andric void ErrorStringFunctionMemoryRangesOverlap::Print() {
29068d75effSDimitry Andric Decorator d;
29168d75effSDimitry Andric char bug_type[100];
29268d75effSDimitry Andric internal_snprintf(bug_type, sizeof(bug_type), "%s-param-overlap", function);
29368d75effSDimitry Andric Printf("%s", d.Error());
29468d75effSDimitry Andric Report(
29568d75effSDimitry Andric "ERROR: AddressSanitizer: %s: memory ranges [%p,%p) and [%p, %p) "
29668d75effSDimitry Andric "overlap\n",
297349cc55cSDimitry Andric bug_type, (void *)addr1_description.Address(),
298349cc55cSDimitry Andric (void *)(addr1_description.Address() + length1),
299349cc55cSDimitry Andric (void *)addr2_description.Address(),
300349cc55cSDimitry Andric (void *)(addr2_description.Address() + length2));
30168d75effSDimitry Andric Printf("%s", d.Default());
30268d75effSDimitry Andric scariness.Print();
30368d75effSDimitry Andric stack->Print();
30468d75effSDimitry Andric addr1_description.Print();
30568d75effSDimitry Andric addr2_description.Print();
30668d75effSDimitry Andric ReportErrorSummary(bug_type, stack);
30768d75effSDimitry Andric }
30868d75effSDimitry Andric
Print()30968d75effSDimitry Andric void ErrorStringFunctionSizeOverflow::Print() {
31068d75effSDimitry Andric Decorator d;
31168d75effSDimitry Andric Printf("%s", d.Error());
31268d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s: (size=%zd)\n",
31368d75effSDimitry Andric scariness.GetDescription(), size);
31468d75effSDimitry Andric Printf("%s", d.Default());
31568d75effSDimitry Andric scariness.Print();
31668d75effSDimitry Andric stack->Print();
31768d75effSDimitry Andric addr_description.Print();
31868d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
31968d75effSDimitry Andric }
32068d75effSDimitry Andric
Print()32168d75effSDimitry Andric void ErrorBadParamsToAnnotateContiguousContainer::Print() {
32268d75effSDimitry Andric Report(
32368d75effSDimitry Andric "ERROR: AddressSanitizer: bad parameters to "
32468d75effSDimitry Andric "__sanitizer_annotate_contiguous_container:\n"
32568d75effSDimitry Andric " beg : %p\n"
32668d75effSDimitry Andric " end : %p\n"
32768d75effSDimitry Andric " old_mid : %p\n"
32868d75effSDimitry Andric " new_mid : %p\n",
329349cc55cSDimitry Andric (void *)beg, (void *)end, (void *)old_mid, (void *)new_mid);
3300eae32dcSDimitry Andric uptr granularity = ASAN_SHADOW_GRANULARITY;
33168d75effSDimitry Andric if (!IsAligned(beg, granularity))
332349cc55cSDimitry Andric Report("ERROR: beg is not aligned by %zu\n", granularity);
33368d75effSDimitry Andric stack->Print();
33468d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
33568d75effSDimitry Andric }
33668d75effSDimitry Andric
Print()337bdd1243dSDimitry Andric void ErrorBadParamsToAnnotateDoubleEndedContiguousContainer::Print() {
338bdd1243dSDimitry Andric Report(
339bdd1243dSDimitry Andric "ERROR: AddressSanitizer: bad parameters to "
340bdd1243dSDimitry Andric "__sanitizer_annotate_double_ended_contiguous_container:\n"
341bdd1243dSDimitry Andric " storage_beg : %p\n"
342bdd1243dSDimitry Andric " storage_end : %p\n"
343bdd1243dSDimitry Andric " old_container_beg : %p\n"
344bdd1243dSDimitry Andric " old_container_end : %p\n"
345bdd1243dSDimitry Andric " new_container_beg : %p\n"
346bdd1243dSDimitry Andric " new_container_end : %p\n",
347bdd1243dSDimitry Andric (void *)storage_beg, (void *)storage_end, (void *)old_container_beg,
348bdd1243dSDimitry Andric (void *)old_container_end, (void *)new_container_beg,
349bdd1243dSDimitry Andric (void *)new_container_end);
350bdd1243dSDimitry Andric uptr granularity = ASAN_SHADOW_GRANULARITY;
351bdd1243dSDimitry Andric if (!IsAligned(storage_beg, granularity))
352bdd1243dSDimitry Andric Report("ERROR: storage_beg is not aligned by %zu\n", granularity);
353bdd1243dSDimitry Andric stack->Print();
354bdd1243dSDimitry Andric ReportErrorSummary(scariness.GetDescription(), stack);
355bdd1243dSDimitry Andric }
356bdd1243dSDimitry Andric
Print()35768d75effSDimitry Andric void ErrorODRViolation::Print() {
35868d75effSDimitry Andric Decorator d;
35968d75effSDimitry Andric Printf("%s", d.Error());
36068d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s (%p):\n", scariness.GetDescription(),
361349cc55cSDimitry Andric (void *)global1.beg);
36268d75effSDimitry Andric Printf("%s", d.Default());
363fe6060f1SDimitry Andric InternalScopedString g1_loc;
364fe6060f1SDimitry Andric InternalScopedString g2_loc;
365*5f757f3fSDimitry Andric PrintGlobalLocation(&g1_loc, global1, /*print_module_name=*/true);
366*5f757f3fSDimitry Andric PrintGlobalLocation(&g2_loc, global2, /*print_module_name=*/true);
36768d75effSDimitry Andric Printf(" [1] size=%zd '%s' %s\n", global1.size,
36868d75effSDimitry Andric MaybeDemangleGlobalName(global1.name), g1_loc.data());
36968d75effSDimitry Andric Printf(" [2] size=%zd '%s' %s\n", global2.size,
37068d75effSDimitry Andric MaybeDemangleGlobalName(global2.name), g2_loc.data());
37168d75effSDimitry Andric if (stack_id1 && stack_id2) {
37268d75effSDimitry Andric Printf("These globals were registered at these points:\n");
37368d75effSDimitry Andric Printf(" [1]:\n");
37468d75effSDimitry Andric StackDepotGet(stack_id1).Print();
37568d75effSDimitry Andric Printf(" [2]:\n");
37668d75effSDimitry Andric StackDepotGet(stack_id2).Print();
37768d75effSDimitry Andric }
37868d75effSDimitry Andric Report(
37968d75effSDimitry Andric "HINT: if you don't care about these errors you may set "
38068d75effSDimitry Andric "ASAN_OPTIONS=detect_odr_violation=0\n");
381fe6060f1SDimitry Andric InternalScopedString error_msg;
382*5f757f3fSDimitry Andric error_msg.AppendF("%s: global '%s' at %s", scariness.GetDescription(),
38368d75effSDimitry Andric MaybeDemangleGlobalName(global1.name), g1_loc.data());
38468d75effSDimitry Andric ReportErrorSummary(error_msg.data());
38568d75effSDimitry Andric }
38668d75effSDimitry Andric
Print()38768d75effSDimitry Andric void ErrorInvalidPointerPair::Print() {
38868d75effSDimitry Andric Decorator d;
38968d75effSDimitry Andric Printf("%s", d.Error());
39068d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s: %p %p\n", scariness.GetDescription(),
391349cc55cSDimitry Andric (void *)addr1_description.Address(),
392349cc55cSDimitry Andric (void *)addr2_description.Address());
39368d75effSDimitry Andric Printf("%s", d.Default());
39468d75effSDimitry Andric GET_STACK_TRACE_FATAL(pc, bp);
39568d75effSDimitry Andric stack.Print();
39668d75effSDimitry Andric addr1_description.Print();
39768d75effSDimitry Andric addr2_description.Print();
39868d75effSDimitry Andric ReportErrorSummary(scariness.GetDescription(), &stack);
39968d75effSDimitry Andric }
40068d75effSDimitry Andric
AdjacentShadowValuesAreFullyPoisoned(u8 * s)40168d75effSDimitry Andric static bool AdjacentShadowValuesAreFullyPoisoned(u8 *s) {
40268d75effSDimitry Andric return s[-1] > 127 && s[1] > 127;
40368d75effSDimitry Andric }
40468d75effSDimitry Andric
ErrorGeneric(u32 tid,uptr pc_,uptr bp_,uptr sp_,uptr addr,bool is_write_,uptr access_size_)40568d75effSDimitry Andric ErrorGeneric::ErrorGeneric(u32 tid, uptr pc_, uptr bp_, uptr sp_, uptr addr,
40668d75effSDimitry Andric bool is_write_, uptr access_size_)
40768d75effSDimitry Andric : ErrorBase(tid),
40868d75effSDimitry Andric addr_description(addr, access_size_, /*shouldLockThreadRegistry=*/false),
40968d75effSDimitry Andric pc(pc_),
41068d75effSDimitry Andric bp(bp_),
41168d75effSDimitry Andric sp(sp_),
41268d75effSDimitry Andric access_size(access_size_),
41368d75effSDimitry Andric is_write(is_write_),
41468d75effSDimitry Andric shadow_val(0) {
41568d75effSDimitry Andric scariness.Clear();
41668d75effSDimitry Andric if (access_size) {
41768d75effSDimitry Andric if (access_size <= 9) {
41868d75effSDimitry Andric char desr[] = "?-byte";
41968d75effSDimitry Andric desr[0] = '0' + access_size;
42068d75effSDimitry Andric scariness.Scare(access_size + access_size / 2, desr);
42168d75effSDimitry Andric } else if (access_size >= 10) {
42268d75effSDimitry Andric scariness.Scare(15, "multi-byte");
42368d75effSDimitry Andric }
42468d75effSDimitry Andric is_write ? scariness.Scare(20, "write") : scariness.Scare(1, "read");
42568d75effSDimitry Andric
42668d75effSDimitry Andric // Determine the error type.
42768d75effSDimitry Andric bug_descr = "unknown-crash";
42868d75effSDimitry Andric if (AddrIsInMem(addr)) {
42968d75effSDimitry Andric u8 *shadow_addr = (u8 *)MemToShadow(addr);
43068d75effSDimitry Andric // If we are accessing 16 bytes, look at the second shadow byte.
4310eae32dcSDimitry Andric if (*shadow_addr == 0 && access_size > ASAN_SHADOW_GRANULARITY)
4320eae32dcSDimitry Andric shadow_addr++;
43368d75effSDimitry Andric // If we are in the partial right redzone, look at the next shadow byte.
43468d75effSDimitry Andric if (*shadow_addr > 0 && *shadow_addr < 128) shadow_addr++;
43568d75effSDimitry Andric bool far_from_bounds = false;
43668d75effSDimitry Andric shadow_val = *shadow_addr;
43768d75effSDimitry Andric int bug_type_score = 0;
43868d75effSDimitry Andric // For use-after-frees reads are almost as bad as writes.
43968d75effSDimitry Andric int read_after_free_bonus = 0;
44068d75effSDimitry Andric switch (shadow_val) {
44168d75effSDimitry Andric case kAsanHeapLeftRedzoneMagic:
44268d75effSDimitry Andric case kAsanArrayCookieMagic:
44368d75effSDimitry Andric bug_descr = "heap-buffer-overflow";
44468d75effSDimitry Andric bug_type_score = 10;
44568d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
44668d75effSDimitry Andric break;
44768d75effSDimitry Andric case kAsanHeapFreeMagic:
44868d75effSDimitry Andric bug_descr = "heap-use-after-free";
44968d75effSDimitry Andric bug_type_score = 20;
45068d75effSDimitry Andric if (!is_write) read_after_free_bonus = 18;
45168d75effSDimitry Andric break;
45268d75effSDimitry Andric case kAsanStackLeftRedzoneMagic:
45368d75effSDimitry Andric bug_descr = "stack-buffer-underflow";
45468d75effSDimitry Andric bug_type_score = 25;
45568d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
45668d75effSDimitry Andric break;
45768d75effSDimitry Andric case kAsanInitializationOrderMagic:
45868d75effSDimitry Andric bug_descr = "initialization-order-fiasco";
45968d75effSDimitry Andric bug_type_score = 1;
46068d75effSDimitry Andric break;
46168d75effSDimitry Andric case kAsanStackMidRedzoneMagic:
46268d75effSDimitry Andric case kAsanStackRightRedzoneMagic:
46368d75effSDimitry Andric bug_descr = "stack-buffer-overflow";
46468d75effSDimitry Andric bug_type_score = 25;
46568d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
46668d75effSDimitry Andric break;
46768d75effSDimitry Andric case kAsanStackAfterReturnMagic:
46868d75effSDimitry Andric bug_descr = "stack-use-after-return";
46968d75effSDimitry Andric bug_type_score = 30;
47068d75effSDimitry Andric if (!is_write) read_after_free_bonus = 18;
47168d75effSDimitry Andric break;
47268d75effSDimitry Andric case kAsanUserPoisonedMemoryMagic:
47368d75effSDimitry Andric bug_descr = "use-after-poison";
47468d75effSDimitry Andric bug_type_score = 20;
47568d75effSDimitry Andric break;
47668d75effSDimitry Andric case kAsanContiguousContainerOOBMagic:
47768d75effSDimitry Andric bug_descr = "container-overflow";
47868d75effSDimitry Andric bug_type_score = 10;
47968d75effSDimitry Andric break;
48068d75effSDimitry Andric case kAsanStackUseAfterScopeMagic:
48168d75effSDimitry Andric bug_descr = "stack-use-after-scope";
48268d75effSDimitry Andric bug_type_score = 10;
48368d75effSDimitry Andric break;
48468d75effSDimitry Andric case kAsanGlobalRedzoneMagic:
48568d75effSDimitry Andric bug_descr = "global-buffer-overflow";
48668d75effSDimitry Andric bug_type_score = 10;
48768d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
48868d75effSDimitry Andric break;
48968d75effSDimitry Andric case kAsanIntraObjectRedzone:
49068d75effSDimitry Andric bug_descr = "intra-object-overflow";
49168d75effSDimitry Andric bug_type_score = 10;
49268d75effSDimitry Andric break;
49368d75effSDimitry Andric case kAsanAllocaLeftMagic:
49468d75effSDimitry Andric case kAsanAllocaRightMagic:
49568d75effSDimitry Andric bug_descr = "dynamic-stack-buffer-overflow";
49668d75effSDimitry Andric bug_type_score = 25;
49768d75effSDimitry Andric far_from_bounds = AdjacentShadowValuesAreFullyPoisoned(shadow_addr);
49868d75effSDimitry Andric break;
49968d75effSDimitry Andric }
50068d75effSDimitry Andric scariness.Scare(bug_type_score + read_after_free_bonus, bug_descr);
50168d75effSDimitry Andric if (far_from_bounds) scariness.Scare(10, "far-from-bounds");
50268d75effSDimitry Andric }
50368d75effSDimitry Andric }
50468d75effSDimitry Andric }
50568d75effSDimitry Andric
PrintContainerOverflowHint()50668d75effSDimitry Andric static void PrintContainerOverflowHint() {
50768d75effSDimitry Andric Printf("HINT: if you don't care about these errors you may set "
50868d75effSDimitry Andric "ASAN_OPTIONS=detect_container_overflow=0.\n"
50968d75effSDimitry Andric "If you suspect a false positive see also: "
51068d75effSDimitry Andric "https://github.com/google/sanitizers/wiki/"
51168d75effSDimitry Andric "AddressSanitizerContainerOverflow.\n");
51268d75effSDimitry Andric }
51368d75effSDimitry Andric
PrintShadowByte(InternalScopedString * str,const char * before,u8 byte,const char * after="\\n")51468d75effSDimitry Andric static void PrintShadowByte(InternalScopedString *str, const char *before,
51568d75effSDimitry Andric u8 byte, const char *after = "\n") {
51668d75effSDimitry Andric PrintMemoryByte(str, before, byte, /*in_shadow*/true, after);
51768d75effSDimitry Andric }
51868d75effSDimitry Andric
PrintLegend(InternalScopedString * str)51968d75effSDimitry Andric static void PrintLegend(InternalScopedString *str) {
520*5f757f3fSDimitry Andric str->AppendF(
52168d75effSDimitry Andric "Shadow byte legend (one shadow byte represents %d "
52268d75effSDimitry Andric "application bytes):\n",
5230eae32dcSDimitry Andric (int)ASAN_SHADOW_GRANULARITY);
52468d75effSDimitry Andric PrintShadowByte(str, " Addressable: ", 0);
525*5f757f3fSDimitry Andric str->AppendF(" Partially addressable: ");
5260eae32dcSDimitry Andric for (u8 i = 1; i < ASAN_SHADOW_GRANULARITY; i++)
5270eae32dcSDimitry Andric PrintShadowByte(str, "", i, " ");
528*5f757f3fSDimitry Andric str->AppendF("\n");
52968d75effSDimitry Andric PrintShadowByte(str, " Heap left redzone: ",
53068d75effSDimitry Andric kAsanHeapLeftRedzoneMagic);
53168d75effSDimitry Andric PrintShadowByte(str, " Freed heap region: ", kAsanHeapFreeMagic);
53268d75effSDimitry Andric PrintShadowByte(str, " Stack left redzone: ",
53368d75effSDimitry Andric kAsanStackLeftRedzoneMagic);
53468d75effSDimitry Andric PrintShadowByte(str, " Stack mid redzone: ",
53568d75effSDimitry Andric kAsanStackMidRedzoneMagic);
53668d75effSDimitry Andric PrintShadowByte(str, " Stack right redzone: ",
53768d75effSDimitry Andric kAsanStackRightRedzoneMagic);
53868d75effSDimitry Andric PrintShadowByte(str, " Stack after return: ",
53968d75effSDimitry Andric kAsanStackAfterReturnMagic);
54068d75effSDimitry Andric PrintShadowByte(str, " Stack use after scope: ",
54168d75effSDimitry Andric kAsanStackUseAfterScopeMagic);
54268d75effSDimitry Andric PrintShadowByte(str, " Global redzone: ", kAsanGlobalRedzoneMagic);
54368d75effSDimitry Andric PrintShadowByte(str, " Global init order: ",
54468d75effSDimitry Andric kAsanInitializationOrderMagic);
54568d75effSDimitry Andric PrintShadowByte(str, " Poisoned by user: ",
54668d75effSDimitry Andric kAsanUserPoisonedMemoryMagic);
54768d75effSDimitry Andric PrintShadowByte(str, " Container overflow: ",
54868d75effSDimitry Andric kAsanContiguousContainerOOBMagic);
54968d75effSDimitry Andric PrintShadowByte(str, " Array cookie: ",
55068d75effSDimitry Andric kAsanArrayCookieMagic);
55168d75effSDimitry Andric PrintShadowByte(str, " Intra object redzone: ",
55268d75effSDimitry Andric kAsanIntraObjectRedzone);
55368d75effSDimitry Andric PrintShadowByte(str, " ASan internal: ", kAsanInternalHeapMagic);
55468d75effSDimitry Andric PrintShadowByte(str, " Left alloca redzone: ", kAsanAllocaLeftMagic);
55568d75effSDimitry Andric PrintShadowByte(str, " Right alloca redzone: ", kAsanAllocaRightMagic);
55668d75effSDimitry Andric }
55768d75effSDimitry Andric
PrintShadowBytes(InternalScopedString * str,const char * before,u8 * bytes,u8 * guilty,uptr n)55868d75effSDimitry Andric static void PrintShadowBytes(InternalScopedString *str, const char *before,
55968d75effSDimitry Andric u8 *bytes, u8 *guilty, uptr n) {
56068d75effSDimitry Andric Decorator d;
561349cc55cSDimitry Andric if (before)
562*5f757f3fSDimitry Andric str->AppendF("%s%p:", before,
563bdd1243dSDimitry Andric (void *)ShadowToMem(reinterpret_cast<uptr>(bytes)));
56468d75effSDimitry Andric for (uptr i = 0; i < n; i++) {
56568d75effSDimitry Andric u8 *p = bytes + i;
56668d75effSDimitry Andric const char *before =
56768d75effSDimitry Andric p == guilty ? "[" : (p - 1 == guilty && i != 0) ? "" : " ";
56868d75effSDimitry Andric const char *after = p == guilty ? "]" : "";
56968d75effSDimitry Andric PrintShadowByte(str, before, *p, after);
57068d75effSDimitry Andric }
571*5f757f3fSDimitry Andric str->AppendF("\n");
57268d75effSDimitry Andric }
57368d75effSDimitry Andric
PrintShadowMemoryForAddress(uptr addr)57468d75effSDimitry Andric static void PrintShadowMemoryForAddress(uptr addr) {
57568d75effSDimitry Andric if (!AddrIsInMem(addr)) return;
57668d75effSDimitry Andric uptr shadow_addr = MemToShadow(addr);
57768d75effSDimitry Andric const uptr n_bytes_per_row = 16;
57868d75effSDimitry Andric uptr aligned_shadow = shadow_addr & ~(n_bytes_per_row - 1);
579fe6060f1SDimitry Andric InternalScopedString str;
580*5f757f3fSDimitry Andric str.AppendF("Shadow bytes around the buggy address:\n");
58168d75effSDimitry Andric for (int i = -5; i <= 5; i++) {
58268d75effSDimitry Andric uptr row_shadow_addr = aligned_shadow + i * n_bytes_per_row;
58368d75effSDimitry Andric // Skip rows that would be outside the shadow range. This can happen when
58468d75effSDimitry Andric // the user address is near the bottom, top, or shadow gap of the address
58568d75effSDimitry Andric // space.
58668d75effSDimitry Andric if (!AddrIsInShadow(row_shadow_addr)) continue;
58768d75effSDimitry Andric const char *prefix = (i == 0) ? "=>" : " ";
58868d75effSDimitry Andric PrintShadowBytes(&str, prefix, (u8 *)row_shadow_addr, (u8 *)shadow_addr,
58968d75effSDimitry Andric n_bytes_per_row);
59068d75effSDimitry Andric }
59168d75effSDimitry Andric if (flags()->print_legend) PrintLegend(&str);
59268d75effSDimitry Andric Printf("%s", str.data());
59368d75effSDimitry Andric }
59468d75effSDimitry Andric
Print()59568d75effSDimitry Andric void ErrorGeneric::Print() {
59668d75effSDimitry Andric Decorator d;
59768d75effSDimitry Andric Printf("%s", d.Error());
59868d75effSDimitry Andric uptr addr = addr_description.Address();
59968d75effSDimitry Andric Report("ERROR: AddressSanitizer: %s on address %p at pc %p bp %p sp %p\n",
600349cc55cSDimitry Andric bug_descr, (void *)addr, (void *)pc, (void *)bp, (void *)sp);
60168d75effSDimitry Andric Printf("%s", d.Default());
60268d75effSDimitry Andric
60368d75effSDimitry Andric Printf("%s%s of size %zu at %p thread %s%s\n", d.Access(),
60468d75effSDimitry Andric access_size ? (is_write ? "WRITE" : "READ") : "ACCESS", access_size,
60568d75effSDimitry Andric (void *)addr, AsanThreadIdAndName(tid).c_str(), d.Default());
60668d75effSDimitry Andric
60768d75effSDimitry Andric scariness.Print();
60868d75effSDimitry Andric GET_STACK_TRACE_FATAL(pc, bp);
60968d75effSDimitry Andric stack.Print();
61068d75effSDimitry Andric
61168d75effSDimitry Andric // Pass bug_descr because we have a special case for
61268d75effSDimitry Andric // initialization-order-fiasco
61368d75effSDimitry Andric addr_description.Print(bug_descr);
61468d75effSDimitry Andric if (shadow_val == kAsanContiguousContainerOOBMagic)
61568d75effSDimitry Andric PrintContainerOverflowHint();
61668d75effSDimitry Andric ReportErrorSummary(bug_descr, &stack);
61768d75effSDimitry Andric PrintShadowMemoryForAddress(addr);
61868d75effSDimitry Andric }
61968d75effSDimitry Andric
62068d75effSDimitry Andric } // namespace __asan
621