168d75effSDimitry Andric //===-- asan_allocator.cpp ------------------------------------------------===// 268d75effSDimitry Andric // 368d75effSDimitry Andric // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 468d75effSDimitry Andric // See https://llvm.org/LICENSE.txt for license information. 568d75effSDimitry Andric // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 668d75effSDimitry Andric // 768d75effSDimitry Andric //===----------------------------------------------------------------------===// 868d75effSDimitry Andric // 968d75effSDimitry Andric // This file is a part of AddressSanitizer, an address sanity checker. 1068d75effSDimitry Andric // 1168d75effSDimitry Andric // Implementation of ASan's memory allocator, 2-nd version. 1268d75effSDimitry Andric // This variant uses the allocator from sanitizer_common, i.e. the one shared 1368d75effSDimitry Andric // with ThreadSanitizer and MemorySanitizer. 1468d75effSDimitry Andric // 1568d75effSDimitry Andric //===----------------------------------------------------------------------===// 1668d75effSDimitry Andric 1768d75effSDimitry Andric #include "asan_allocator.h" 18*e8d8bef9SDimitry Andric 1968d75effSDimitry Andric #include "asan_mapping.h" 2068d75effSDimitry Andric #include "asan_poisoning.h" 2168d75effSDimitry Andric #include "asan_report.h" 2268d75effSDimitry Andric #include "asan_stack.h" 2368d75effSDimitry Andric #include "asan_thread.h" 24*e8d8bef9SDimitry Andric #include "lsan/lsan_common.h" 2568d75effSDimitry Andric #include "sanitizer_common/sanitizer_allocator_checks.h" 2668d75effSDimitry Andric #include "sanitizer_common/sanitizer_allocator_interface.h" 2768d75effSDimitry Andric #include "sanitizer_common/sanitizer_errno.h" 2868d75effSDimitry Andric #include "sanitizer_common/sanitizer_flags.h" 2968d75effSDimitry Andric #include "sanitizer_common/sanitizer_internal_defs.h" 3068d75effSDimitry Andric #include "sanitizer_common/sanitizer_list.h" 3168d75effSDimitry Andric #include "sanitizer_common/sanitizer_quarantine.h" 32*e8d8bef9SDimitry Andric #include "sanitizer_common/sanitizer_stackdepot.h" 3368d75effSDimitry Andric 3468d75effSDimitry Andric namespace __asan { 3568d75effSDimitry Andric 3668d75effSDimitry Andric // Valid redzone sizes are 16, 32, 64, ... 2048, so we encode them in 3 bits. 3768d75effSDimitry Andric // We use adaptive redzones: for larger allocation larger redzones are used. 3868d75effSDimitry Andric static u32 RZLog2Size(u32 rz_log) { 3968d75effSDimitry Andric CHECK_LT(rz_log, 8); 4068d75effSDimitry Andric return 16 << rz_log; 4168d75effSDimitry Andric } 4268d75effSDimitry Andric 4368d75effSDimitry Andric static u32 RZSize2Log(u32 rz_size) { 4468d75effSDimitry Andric CHECK_GE(rz_size, 16); 4568d75effSDimitry Andric CHECK_LE(rz_size, 2048); 4668d75effSDimitry Andric CHECK(IsPowerOfTwo(rz_size)); 4768d75effSDimitry Andric u32 res = Log2(rz_size) - 4; 4868d75effSDimitry Andric CHECK_EQ(rz_size, RZLog2Size(res)); 4968d75effSDimitry Andric return res; 5068d75effSDimitry Andric } 5168d75effSDimitry Andric 5268d75effSDimitry Andric static AsanAllocator &get_allocator(); 5368d75effSDimitry Andric 54*e8d8bef9SDimitry Andric static void AtomicContextStore(volatile atomic_uint64_t *atomic_context, 55*e8d8bef9SDimitry Andric u32 tid, u32 stack) { 56*e8d8bef9SDimitry Andric u64 context = tid; 57*e8d8bef9SDimitry Andric context <<= 32; 58*e8d8bef9SDimitry Andric context += stack; 59*e8d8bef9SDimitry Andric atomic_store(atomic_context, context, memory_order_relaxed); 60*e8d8bef9SDimitry Andric } 61*e8d8bef9SDimitry Andric 62*e8d8bef9SDimitry Andric static void AtomicContextLoad(const volatile atomic_uint64_t *atomic_context, 63*e8d8bef9SDimitry Andric u32 &tid, u32 &stack) { 64*e8d8bef9SDimitry Andric u64 context = atomic_load(atomic_context, memory_order_relaxed); 65*e8d8bef9SDimitry Andric stack = context; 66*e8d8bef9SDimitry Andric context >>= 32; 67*e8d8bef9SDimitry Andric tid = context; 68*e8d8bef9SDimitry Andric } 69*e8d8bef9SDimitry Andric 7068d75effSDimitry Andric // The memory chunk allocated from the underlying allocator looks like this: 7168d75effSDimitry Andric // L L L L L L H H U U U U U U R R 7268d75effSDimitry Andric // L -- left redzone words (0 or more bytes) 7368d75effSDimitry Andric // H -- ChunkHeader (16 bytes), which is also a part of the left redzone. 7468d75effSDimitry Andric // U -- user memory. 7568d75effSDimitry Andric // R -- right redzone (0 or more bytes) 7668d75effSDimitry Andric // ChunkBase consists of ChunkHeader and other bytes that overlap with user 7768d75effSDimitry Andric // memory. 7868d75effSDimitry Andric 7968d75effSDimitry Andric // If the left redzone is greater than the ChunkHeader size we store a magic 8068d75effSDimitry Andric // value in the first uptr word of the memory block and store the address of 8168d75effSDimitry Andric // ChunkBase in the next uptr. 8268d75effSDimitry Andric // M B L L L L L L L L L H H U U U U U U 8368d75effSDimitry Andric // | ^ 8468d75effSDimitry Andric // ---------------------| 8568d75effSDimitry Andric // M -- magic value kAllocBegMagic 8668d75effSDimitry Andric // B -- address of ChunkHeader pointing to the first 'H' 8768d75effSDimitry Andric 88*e8d8bef9SDimitry Andric class ChunkHeader { 89*e8d8bef9SDimitry Andric public: 90*e8d8bef9SDimitry Andric atomic_uint8_t chunk_state; 91*e8d8bef9SDimitry Andric u8 alloc_type : 2; 92*e8d8bef9SDimitry Andric u8 lsan_tag : 2; 9368d75effSDimitry Andric 9468d75effSDimitry Andric // align < 8 -> 0 9568d75effSDimitry Andric // else -> log2(min(align, 512)) - 2 96*e8d8bef9SDimitry Andric u8 user_requested_alignment_log : 3; 97*e8d8bef9SDimitry Andric 98*e8d8bef9SDimitry Andric private: 99*e8d8bef9SDimitry Andric u16 user_requested_size_hi; 100*e8d8bef9SDimitry Andric u32 user_requested_size_lo; 101*e8d8bef9SDimitry Andric atomic_uint64_t alloc_context_id; 102*e8d8bef9SDimitry Andric 103*e8d8bef9SDimitry Andric public: 104*e8d8bef9SDimitry Andric uptr UsedSize() const { 105*e8d8bef9SDimitry Andric uptr R = user_requested_size_lo; 106*e8d8bef9SDimitry Andric if (sizeof(uptr) > sizeof(user_requested_size_lo)) 107*e8d8bef9SDimitry Andric R += (uptr)user_requested_size_hi << (8 * sizeof(user_requested_size_lo)); 108*e8d8bef9SDimitry Andric return R; 109*e8d8bef9SDimitry Andric } 110*e8d8bef9SDimitry Andric 111*e8d8bef9SDimitry Andric void SetUsedSize(uptr size) { 112*e8d8bef9SDimitry Andric user_requested_size_lo = size; 113*e8d8bef9SDimitry Andric if (sizeof(uptr) > sizeof(user_requested_size_lo)) { 114*e8d8bef9SDimitry Andric size >>= (8 * sizeof(user_requested_size_lo)); 115*e8d8bef9SDimitry Andric user_requested_size_hi = size; 116*e8d8bef9SDimitry Andric CHECK_EQ(user_requested_size_hi, size); 117*e8d8bef9SDimitry Andric } 118*e8d8bef9SDimitry Andric } 119*e8d8bef9SDimitry Andric 120*e8d8bef9SDimitry Andric void SetAllocContext(u32 tid, u32 stack) { 121*e8d8bef9SDimitry Andric AtomicContextStore(&alloc_context_id, tid, stack); 122*e8d8bef9SDimitry Andric } 123*e8d8bef9SDimitry Andric 124*e8d8bef9SDimitry Andric void GetAllocContext(u32 &tid, u32 &stack) const { 125*e8d8bef9SDimitry Andric AtomicContextLoad(&alloc_context_id, tid, stack); 126*e8d8bef9SDimitry Andric } 12768d75effSDimitry Andric }; 12868d75effSDimitry Andric 129*e8d8bef9SDimitry Andric class ChunkBase : public ChunkHeader { 130*e8d8bef9SDimitry Andric atomic_uint64_t free_context_id; 131*e8d8bef9SDimitry Andric 132*e8d8bef9SDimitry Andric public: 133*e8d8bef9SDimitry Andric void SetFreeContext(u32 tid, u32 stack) { 134*e8d8bef9SDimitry Andric AtomicContextStore(&free_context_id, tid, stack); 135*e8d8bef9SDimitry Andric } 136*e8d8bef9SDimitry Andric 137*e8d8bef9SDimitry Andric void GetFreeContext(u32 &tid, u32 &stack) const { 138*e8d8bef9SDimitry Andric AtomicContextLoad(&free_context_id, tid, stack); 139*e8d8bef9SDimitry Andric } 14068d75effSDimitry Andric }; 14168d75effSDimitry Andric 14268d75effSDimitry Andric static const uptr kChunkHeaderSize = sizeof(ChunkHeader); 14368d75effSDimitry Andric static const uptr kChunkHeader2Size = sizeof(ChunkBase) - kChunkHeaderSize; 14468d75effSDimitry Andric COMPILER_CHECK(kChunkHeaderSize == 16); 14568d75effSDimitry Andric COMPILER_CHECK(kChunkHeader2Size <= 16); 14668d75effSDimitry Andric 14768d75effSDimitry Andric enum { 148*e8d8bef9SDimitry Andric // Either just allocated by underlying allocator, but AsanChunk is not yet 149*e8d8bef9SDimitry Andric // ready, or almost returned to undelying allocator and AsanChunk is already 150*e8d8bef9SDimitry Andric // meaningless. 151*e8d8bef9SDimitry Andric CHUNK_INVALID = 0, 152*e8d8bef9SDimitry Andric // The chunk is allocated and not yet freed. 15368d75effSDimitry Andric CHUNK_ALLOCATED = 2, 154*e8d8bef9SDimitry Andric // The chunk was freed and put into quarantine zone. 155*e8d8bef9SDimitry Andric CHUNK_QUARANTINE = 3, 15668d75effSDimitry Andric }; 15768d75effSDimitry Andric 158*e8d8bef9SDimitry Andric class AsanChunk : public ChunkBase { 159*e8d8bef9SDimitry Andric public: 16068d75effSDimitry Andric uptr Beg() { return reinterpret_cast<uptr>(this) + kChunkHeaderSize; } 161*e8d8bef9SDimitry Andric bool AddrIsInside(uptr addr) { 162*e8d8bef9SDimitry Andric return (addr >= Beg()) && (addr < Beg() + UsedSize()); 16368d75effSDimitry Andric } 164*e8d8bef9SDimitry Andric }; 165*e8d8bef9SDimitry Andric 166*e8d8bef9SDimitry Andric class LargeChunkHeader { 167*e8d8bef9SDimitry Andric static constexpr uptr kAllocBegMagic = 168*e8d8bef9SDimitry Andric FIRST_32_SECOND_64(0xCC6E96B9, 0xCC6E96B9CC6E96B9ULL); 169*e8d8bef9SDimitry Andric atomic_uintptr_t magic; 170*e8d8bef9SDimitry Andric AsanChunk *chunk_header; 171*e8d8bef9SDimitry Andric 172*e8d8bef9SDimitry Andric public: 173*e8d8bef9SDimitry Andric AsanChunk *Get() const { 174*e8d8bef9SDimitry Andric return atomic_load(&magic, memory_order_acquire) == kAllocBegMagic 175*e8d8bef9SDimitry Andric ? chunk_header 176*e8d8bef9SDimitry Andric : nullptr; 17768d75effSDimitry Andric } 178*e8d8bef9SDimitry Andric 179*e8d8bef9SDimitry Andric void Set(AsanChunk *p) { 180*e8d8bef9SDimitry Andric if (p) { 181*e8d8bef9SDimitry Andric chunk_header = p; 182*e8d8bef9SDimitry Andric atomic_store(&magic, kAllocBegMagic, memory_order_release); 183*e8d8bef9SDimitry Andric return; 18468d75effSDimitry Andric } 185*e8d8bef9SDimitry Andric 186*e8d8bef9SDimitry Andric uptr old = kAllocBegMagic; 187*e8d8bef9SDimitry Andric if (!atomic_compare_exchange_strong(&magic, &old, 0, 188*e8d8bef9SDimitry Andric memory_order_release)) { 189*e8d8bef9SDimitry Andric CHECK_EQ(old, kAllocBegMagic); 190*e8d8bef9SDimitry Andric } 19168d75effSDimitry Andric } 19268d75effSDimitry Andric }; 19368d75effSDimitry Andric 19468d75effSDimitry Andric struct QuarantineCallback { 19568d75effSDimitry Andric QuarantineCallback(AllocatorCache *cache, BufferedStackTrace *stack) 19668d75effSDimitry Andric : cache_(cache), 19768d75effSDimitry Andric stack_(stack) { 19868d75effSDimitry Andric } 19968d75effSDimitry Andric 20068d75effSDimitry Andric void Recycle(AsanChunk *m) { 201*e8d8bef9SDimitry Andric void *p = get_allocator().GetBlockBegin(m); 202*e8d8bef9SDimitry Andric if (p != m) { 203*e8d8bef9SDimitry Andric // Clear the magic value, as allocator internals may overwrite the 204*e8d8bef9SDimitry Andric // contents of deallocated chunk, confusing GetAsanChunk lookup. 205*e8d8bef9SDimitry Andric reinterpret_cast<LargeChunkHeader *>(p)->Set(nullptr); 206*e8d8bef9SDimitry Andric } 207*e8d8bef9SDimitry Andric 208*e8d8bef9SDimitry Andric u8 old_chunk_state = CHUNK_QUARANTINE; 209*e8d8bef9SDimitry Andric if (!atomic_compare_exchange_strong(&m->chunk_state, &old_chunk_state, 210*e8d8bef9SDimitry Andric CHUNK_INVALID, memory_order_acquire)) { 211*e8d8bef9SDimitry Andric CHECK_EQ(old_chunk_state, CHUNK_QUARANTINE); 212*e8d8bef9SDimitry Andric } 213*e8d8bef9SDimitry Andric 21468d75effSDimitry Andric PoisonShadow(m->Beg(), 21568d75effSDimitry Andric RoundUpTo(m->UsedSize(), SHADOW_GRANULARITY), 21668d75effSDimitry Andric kAsanHeapLeftRedzoneMagic); 21768d75effSDimitry Andric 21868d75effSDimitry Andric // Statistics. 21968d75effSDimitry Andric AsanStats &thread_stats = GetCurrentThreadStats(); 22068d75effSDimitry Andric thread_stats.real_frees++; 22168d75effSDimitry Andric thread_stats.really_freed += m->UsedSize(); 22268d75effSDimitry Andric 22368d75effSDimitry Andric get_allocator().Deallocate(cache_, p); 22468d75effSDimitry Andric } 22568d75effSDimitry Andric 22668d75effSDimitry Andric void *Allocate(uptr size) { 22768d75effSDimitry Andric void *res = get_allocator().Allocate(cache_, size, 1); 22868d75effSDimitry Andric // TODO(alekseys): Consider making quarantine OOM-friendly. 22968d75effSDimitry Andric if (UNLIKELY(!res)) 23068d75effSDimitry Andric ReportOutOfMemory(size, stack_); 23168d75effSDimitry Andric return res; 23268d75effSDimitry Andric } 23368d75effSDimitry Andric 23468d75effSDimitry Andric void Deallocate(void *p) { 23568d75effSDimitry Andric get_allocator().Deallocate(cache_, p); 23668d75effSDimitry Andric } 23768d75effSDimitry Andric 23868d75effSDimitry Andric private: 23968d75effSDimitry Andric AllocatorCache* const cache_; 24068d75effSDimitry Andric BufferedStackTrace* const stack_; 24168d75effSDimitry Andric }; 24268d75effSDimitry Andric 24368d75effSDimitry Andric typedef Quarantine<QuarantineCallback, AsanChunk> AsanQuarantine; 24468d75effSDimitry Andric typedef AsanQuarantine::Cache QuarantineCache; 24568d75effSDimitry Andric 24668d75effSDimitry Andric void AsanMapUnmapCallback::OnMap(uptr p, uptr size) const { 24768d75effSDimitry Andric PoisonShadow(p, size, kAsanHeapLeftRedzoneMagic); 24868d75effSDimitry Andric // Statistics. 24968d75effSDimitry Andric AsanStats &thread_stats = GetCurrentThreadStats(); 25068d75effSDimitry Andric thread_stats.mmaps++; 25168d75effSDimitry Andric thread_stats.mmaped += size; 25268d75effSDimitry Andric } 25368d75effSDimitry Andric void AsanMapUnmapCallback::OnUnmap(uptr p, uptr size) const { 25468d75effSDimitry Andric PoisonShadow(p, size, 0); 25568d75effSDimitry Andric // We are about to unmap a chunk of user memory. 25668d75effSDimitry Andric // Mark the corresponding shadow memory as not needed. 25768d75effSDimitry Andric FlushUnneededASanShadowMemory(p, size); 25868d75effSDimitry Andric // Statistics. 25968d75effSDimitry Andric AsanStats &thread_stats = GetCurrentThreadStats(); 26068d75effSDimitry Andric thread_stats.munmaps++; 26168d75effSDimitry Andric thread_stats.munmaped += size; 26268d75effSDimitry Andric } 26368d75effSDimitry Andric 26468d75effSDimitry Andric // We can not use THREADLOCAL because it is not supported on some of the 26568d75effSDimitry Andric // platforms we care about (OSX 10.6, Android). 26668d75effSDimitry Andric // static THREADLOCAL AllocatorCache cache; 26768d75effSDimitry Andric AllocatorCache *GetAllocatorCache(AsanThreadLocalMallocStorage *ms) { 26868d75effSDimitry Andric CHECK(ms); 26968d75effSDimitry Andric return &ms->allocator_cache; 27068d75effSDimitry Andric } 27168d75effSDimitry Andric 27268d75effSDimitry Andric QuarantineCache *GetQuarantineCache(AsanThreadLocalMallocStorage *ms) { 27368d75effSDimitry Andric CHECK(ms); 27468d75effSDimitry Andric CHECK_LE(sizeof(QuarantineCache), sizeof(ms->quarantine_cache)); 27568d75effSDimitry Andric return reinterpret_cast<QuarantineCache *>(ms->quarantine_cache); 27668d75effSDimitry Andric } 27768d75effSDimitry Andric 27868d75effSDimitry Andric void AllocatorOptions::SetFrom(const Flags *f, const CommonFlags *cf) { 27968d75effSDimitry Andric quarantine_size_mb = f->quarantine_size_mb; 28068d75effSDimitry Andric thread_local_quarantine_size_kb = f->thread_local_quarantine_size_kb; 28168d75effSDimitry Andric min_redzone = f->redzone; 28268d75effSDimitry Andric max_redzone = f->max_redzone; 28368d75effSDimitry Andric may_return_null = cf->allocator_may_return_null; 28468d75effSDimitry Andric alloc_dealloc_mismatch = f->alloc_dealloc_mismatch; 28568d75effSDimitry Andric release_to_os_interval_ms = cf->allocator_release_to_os_interval_ms; 28668d75effSDimitry Andric } 28768d75effSDimitry Andric 28868d75effSDimitry Andric void AllocatorOptions::CopyTo(Flags *f, CommonFlags *cf) { 28968d75effSDimitry Andric f->quarantine_size_mb = quarantine_size_mb; 29068d75effSDimitry Andric f->thread_local_quarantine_size_kb = thread_local_quarantine_size_kb; 29168d75effSDimitry Andric f->redzone = min_redzone; 29268d75effSDimitry Andric f->max_redzone = max_redzone; 29368d75effSDimitry Andric cf->allocator_may_return_null = may_return_null; 29468d75effSDimitry Andric f->alloc_dealloc_mismatch = alloc_dealloc_mismatch; 29568d75effSDimitry Andric cf->allocator_release_to_os_interval_ms = release_to_os_interval_ms; 29668d75effSDimitry Andric } 29768d75effSDimitry Andric 29868d75effSDimitry Andric struct Allocator { 29968d75effSDimitry Andric static const uptr kMaxAllowedMallocSize = 30068d75effSDimitry Andric FIRST_32_SECOND_64(3UL << 30, 1ULL << 40); 30168d75effSDimitry Andric 30268d75effSDimitry Andric AsanAllocator allocator; 30368d75effSDimitry Andric AsanQuarantine quarantine; 30468d75effSDimitry Andric StaticSpinMutex fallback_mutex; 30568d75effSDimitry Andric AllocatorCache fallback_allocator_cache; 30668d75effSDimitry Andric QuarantineCache fallback_quarantine_cache; 30768d75effSDimitry Andric 308480093f4SDimitry Andric uptr max_user_defined_malloc_size; 30968d75effSDimitry Andric atomic_uint8_t rss_limit_exceeded; 31068d75effSDimitry Andric 31168d75effSDimitry Andric // ------------------- Options -------------------------- 31268d75effSDimitry Andric atomic_uint16_t min_redzone; 31368d75effSDimitry Andric atomic_uint16_t max_redzone; 31468d75effSDimitry Andric atomic_uint8_t alloc_dealloc_mismatch; 31568d75effSDimitry Andric 31668d75effSDimitry Andric // ------------------- Initialization ------------------------ 31768d75effSDimitry Andric explicit Allocator(LinkerInitialized) 31868d75effSDimitry Andric : quarantine(LINKER_INITIALIZED), 31968d75effSDimitry Andric fallback_quarantine_cache(LINKER_INITIALIZED) {} 32068d75effSDimitry Andric 32168d75effSDimitry Andric void CheckOptions(const AllocatorOptions &options) const { 32268d75effSDimitry Andric CHECK_GE(options.min_redzone, 16); 32368d75effSDimitry Andric CHECK_GE(options.max_redzone, options.min_redzone); 32468d75effSDimitry Andric CHECK_LE(options.max_redzone, 2048); 32568d75effSDimitry Andric CHECK(IsPowerOfTwo(options.min_redzone)); 32668d75effSDimitry Andric CHECK(IsPowerOfTwo(options.max_redzone)); 32768d75effSDimitry Andric } 32868d75effSDimitry Andric 32968d75effSDimitry Andric void SharedInitCode(const AllocatorOptions &options) { 33068d75effSDimitry Andric CheckOptions(options); 33168d75effSDimitry Andric quarantine.Init((uptr)options.quarantine_size_mb << 20, 33268d75effSDimitry Andric (uptr)options.thread_local_quarantine_size_kb << 10); 33368d75effSDimitry Andric atomic_store(&alloc_dealloc_mismatch, options.alloc_dealloc_mismatch, 33468d75effSDimitry Andric memory_order_release); 33568d75effSDimitry Andric atomic_store(&min_redzone, options.min_redzone, memory_order_release); 33668d75effSDimitry Andric atomic_store(&max_redzone, options.max_redzone, memory_order_release); 33768d75effSDimitry Andric } 33868d75effSDimitry Andric 33968d75effSDimitry Andric void InitLinkerInitialized(const AllocatorOptions &options) { 34068d75effSDimitry Andric SetAllocatorMayReturnNull(options.may_return_null); 34168d75effSDimitry Andric allocator.InitLinkerInitialized(options.release_to_os_interval_ms); 34268d75effSDimitry Andric SharedInitCode(options); 343480093f4SDimitry Andric max_user_defined_malloc_size = common_flags()->max_allocation_size_mb 344480093f4SDimitry Andric ? common_flags()->max_allocation_size_mb 345480093f4SDimitry Andric << 20 346480093f4SDimitry Andric : kMaxAllowedMallocSize; 34768d75effSDimitry Andric } 34868d75effSDimitry Andric 34968d75effSDimitry Andric bool RssLimitExceeded() { 35068d75effSDimitry Andric return atomic_load(&rss_limit_exceeded, memory_order_relaxed); 35168d75effSDimitry Andric } 35268d75effSDimitry Andric 35368d75effSDimitry Andric void SetRssLimitExceeded(bool limit_exceeded) { 35468d75effSDimitry Andric atomic_store(&rss_limit_exceeded, limit_exceeded, memory_order_relaxed); 35568d75effSDimitry Andric } 35668d75effSDimitry Andric 35768d75effSDimitry Andric void RePoisonChunk(uptr chunk) { 35868d75effSDimitry Andric // This could be a user-facing chunk (with redzones), or some internal 35968d75effSDimitry Andric // housekeeping chunk, like TransferBatch. Start by assuming the former. 36068d75effSDimitry Andric AsanChunk *ac = GetAsanChunk((void *)chunk); 361*e8d8bef9SDimitry Andric uptr allocated_size = allocator.GetActuallyAllocatedSize((void *)chunk); 362*e8d8bef9SDimitry Andric if (ac && atomic_load(&ac->chunk_state, memory_order_acquire) == 363*e8d8bef9SDimitry Andric CHUNK_ALLOCATED) { 36468d75effSDimitry Andric uptr beg = ac->Beg(); 365*e8d8bef9SDimitry Andric uptr end = ac->Beg() + ac->UsedSize(); 36668d75effSDimitry Andric uptr chunk_end = chunk + allocated_size; 367*e8d8bef9SDimitry Andric if (chunk < beg && beg < end && end <= chunk_end) { 36868d75effSDimitry Andric // Looks like a valid AsanChunk in use, poison redzones only. 36968d75effSDimitry Andric PoisonShadow(chunk, beg - chunk, kAsanHeapLeftRedzoneMagic); 37068d75effSDimitry Andric uptr end_aligned_down = RoundDownTo(end, SHADOW_GRANULARITY); 37168d75effSDimitry Andric FastPoisonShadowPartialRightRedzone( 37268d75effSDimitry Andric end_aligned_down, end - end_aligned_down, 37368d75effSDimitry Andric chunk_end - end_aligned_down, kAsanHeapLeftRedzoneMagic); 374*e8d8bef9SDimitry Andric return; 375*e8d8bef9SDimitry Andric } 376*e8d8bef9SDimitry Andric } 377*e8d8bef9SDimitry Andric 37868d75effSDimitry Andric // This is either not an AsanChunk or freed or quarantined AsanChunk. 37968d75effSDimitry Andric // In either case, poison everything. 38068d75effSDimitry Andric PoisonShadow(chunk, allocated_size, kAsanHeapLeftRedzoneMagic); 38168d75effSDimitry Andric } 38268d75effSDimitry Andric 38368d75effSDimitry Andric void ReInitialize(const AllocatorOptions &options) { 38468d75effSDimitry Andric SetAllocatorMayReturnNull(options.may_return_null); 38568d75effSDimitry Andric allocator.SetReleaseToOSIntervalMs(options.release_to_os_interval_ms); 38668d75effSDimitry Andric SharedInitCode(options); 38768d75effSDimitry Andric 38868d75effSDimitry Andric // Poison all existing allocation's redzones. 38968d75effSDimitry Andric if (CanPoisonMemory()) { 39068d75effSDimitry Andric allocator.ForceLock(); 39168d75effSDimitry Andric allocator.ForEachChunk( 39268d75effSDimitry Andric [](uptr chunk, void *alloc) { 39368d75effSDimitry Andric ((Allocator *)alloc)->RePoisonChunk(chunk); 39468d75effSDimitry Andric }, 39568d75effSDimitry Andric this); 39668d75effSDimitry Andric allocator.ForceUnlock(); 39768d75effSDimitry Andric } 39868d75effSDimitry Andric } 39968d75effSDimitry Andric 40068d75effSDimitry Andric void GetOptions(AllocatorOptions *options) const { 40168d75effSDimitry Andric options->quarantine_size_mb = quarantine.GetSize() >> 20; 40268d75effSDimitry Andric options->thread_local_quarantine_size_kb = quarantine.GetCacheSize() >> 10; 40368d75effSDimitry Andric options->min_redzone = atomic_load(&min_redzone, memory_order_acquire); 40468d75effSDimitry Andric options->max_redzone = atomic_load(&max_redzone, memory_order_acquire); 40568d75effSDimitry Andric options->may_return_null = AllocatorMayReturnNull(); 40668d75effSDimitry Andric options->alloc_dealloc_mismatch = 40768d75effSDimitry Andric atomic_load(&alloc_dealloc_mismatch, memory_order_acquire); 40868d75effSDimitry Andric options->release_to_os_interval_ms = allocator.ReleaseToOSIntervalMs(); 40968d75effSDimitry Andric } 41068d75effSDimitry Andric 41168d75effSDimitry Andric // -------------------- Helper methods. ------------------------- 41268d75effSDimitry Andric uptr ComputeRZLog(uptr user_requested_size) { 413*e8d8bef9SDimitry Andric u32 rz_log = user_requested_size <= 64 - 16 ? 0 414*e8d8bef9SDimitry Andric : user_requested_size <= 128 - 32 ? 1 415*e8d8bef9SDimitry Andric : user_requested_size <= 512 - 64 ? 2 416*e8d8bef9SDimitry Andric : user_requested_size <= 4096 - 128 ? 3 417*e8d8bef9SDimitry Andric : user_requested_size <= (1 << 14) - 256 ? 4 418*e8d8bef9SDimitry Andric : user_requested_size <= (1 << 15) - 512 ? 5 419*e8d8bef9SDimitry Andric : user_requested_size <= (1 << 16) - 1024 ? 6 420*e8d8bef9SDimitry Andric : 7; 421*e8d8bef9SDimitry Andric u32 hdr_log = RZSize2Log(RoundUpToPowerOfTwo(sizeof(ChunkHeader))); 422*e8d8bef9SDimitry Andric u32 min_log = RZSize2Log(atomic_load(&min_redzone, memory_order_acquire)); 423*e8d8bef9SDimitry Andric u32 max_log = RZSize2Log(atomic_load(&max_redzone, memory_order_acquire)); 424*e8d8bef9SDimitry Andric return Min(Max(rz_log, Max(min_log, hdr_log)), Max(max_log, hdr_log)); 42568d75effSDimitry Andric } 42668d75effSDimitry Andric 42768d75effSDimitry Andric static uptr ComputeUserRequestedAlignmentLog(uptr user_requested_alignment) { 42868d75effSDimitry Andric if (user_requested_alignment < 8) 42968d75effSDimitry Andric return 0; 43068d75effSDimitry Andric if (user_requested_alignment > 512) 43168d75effSDimitry Andric user_requested_alignment = 512; 43268d75effSDimitry Andric return Log2(user_requested_alignment) - 2; 43368d75effSDimitry Andric } 43468d75effSDimitry Andric 43568d75effSDimitry Andric static uptr ComputeUserAlignment(uptr user_requested_alignment_log) { 43668d75effSDimitry Andric if (user_requested_alignment_log == 0) 43768d75effSDimitry Andric return 0; 43868d75effSDimitry Andric return 1LL << (user_requested_alignment_log + 2); 43968d75effSDimitry Andric } 44068d75effSDimitry Andric 44168d75effSDimitry Andric // We have an address between two chunks, and we want to report just one. 44268d75effSDimitry Andric AsanChunk *ChooseChunk(uptr addr, AsanChunk *left_chunk, 44368d75effSDimitry Andric AsanChunk *right_chunk) { 444*e8d8bef9SDimitry Andric if (!left_chunk) 445*e8d8bef9SDimitry Andric return right_chunk; 446*e8d8bef9SDimitry Andric if (!right_chunk) 447*e8d8bef9SDimitry Andric return left_chunk; 44868d75effSDimitry Andric // Prefer an allocated chunk over freed chunk and freed chunk 44968d75effSDimitry Andric // over available chunk. 450*e8d8bef9SDimitry Andric u8 left_state = atomic_load(&left_chunk->chunk_state, memory_order_relaxed); 451*e8d8bef9SDimitry Andric u8 right_state = 452*e8d8bef9SDimitry Andric atomic_load(&right_chunk->chunk_state, memory_order_relaxed); 453*e8d8bef9SDimitry Andric if (left_state != right_state) { 454*e8d8bef9SDimitry Andric if (left_state == CHUNK_ALLOCATED) 45568d75effSDimitry Andric return left_chunk; 456*e8d8bef9SDimitry Andric if (right_state == CHUNK_ALLOCATED) 45768d75effSDimitry Andric return right_chunk; 458*e8d8bef9SDimitry Andric if (left_state == CHUNK_QUARANTINE) 45968d75effSDimitry Andric return left_chunk; 460*e8d8bef9SDimitry Andric if (right_state == CHUNK_QUARANTINE) 46168d75effSDimitry Andric return right_chunk; 46268d75effSDimitry Andric } 46368d75effSDimitry Andric // Same chunk_state: choose based on offset. 46468d75effSDimitry Andric sptr l_offset = 0, r_offset = 0; 46568d75effSDimitry Andric CHECK(AsanChunkView(left_chunk).AddrIsAtRight(addr, 1, &l_offset)); 46668d75effSDimitry Andric CHECK(AsanChunkView(right_chunk).AddrIsAtLeft(addr, 1, &r_offset)); 46768d75effSDimitry Andric if (l_offset < r_offset) 46868d75effSDimitry Andric return left_chunk; 46968d75effSDimitry Andric return right_chunk; 47068d75effSDimitry Andric } 47168d75effSDimitry Andric 472480093f4SDimitry Andric bool UpdateAllocationStack(uptr addr, BufferedStackTrace *stack) { 473480093f4SDimitry Andric AsanChunk *m = GetAsanChunkByAddr(addr); 474480093f4SDimitry Andric if (!m) return false; 475*e8d8bef9SDimitry Andric if (atomic_load(&m->chunk_state, memory_order_acquire) != CHUNK_ALLOCATED) 476*e8d8bef9SDimitry Andric return false; 477480093f4SDimitry Andric if (m->Beg() != addr) return false; 478*e8d8bef9SDimitry Andric AsanThread *t = GetCurrentThread(); 479*e8d8bef9SDimitry Andric m->SetAllocContext(t ? t->tid() : 0, StackDepotPut(*stack)); 480480093f4SDimitry Andric return true; 481480093f4SDimitry Andric } 482480093f4SDimitry Andric 48368d75effSDimitry Andric // -------------------- Allocation/Deallocation routines --------------- 48468d75effSDimitry Andric void *Allocate(uptr size, uptr alignment, BufferedStackTrace *stack, 48568d75effSDimitry Andric AllocType alloc_type, bool can_fill) { 48668d75effSDimitry Andric if (UNLIKELY(!asan_inited)) 48768d75effSDimitry Andric AsanInitFromRtl(); 48868d75effSDimitry Andric if (RssLimitExceeded()) { 48968d75effSDimitry Andric if (AllocatorMayReturnNull()) 49068d75effSDimitry Andric return nullptr; 49168d75effSDimitry Andric ReportRssLimitExceeded(stack); 49268d75effSDimitry Andric } 49368d75effSDimitry Andric Flags &fl = *flags(); 49468d75effSDimitry Andric CHECK(stack); 49568d75effSDimitry Andric const uptr min_alignment = SHADOW_GRANULARITY; 49668d75effSDimitry Andric const uptr user_requested_alignment_log = 49768d75effSDimitry Andric ComputeUserRequestedAlignmentLog(alignment); 49868d75effSDimitry Andric if (alignment < min_alignment) 49968d75effSDimitry Andric alignment = min_alignment; 50068d75effSDimitry Andric if (size == 0) { 50168d75effSDimitry Andric // We'd be happy to avoid allocating memory for zero-size requests, but 50268d75effSDimitry Andric // some programs/tests depend on this behavior and assume that malloc 50368d75effSDimitry Andric // would not return NULL even for zero-size allocations. Moreover, it 50468d75effSDimitry Andric // looks like operator new should never return NULL, and results of 50568d75effSDimitry Andric // consecutive "new" calls must be different even if the allocated size 50668d75effSDimitry Andric // is zero. 50768d75effSDimitry Andric size = 1; 50868d75effSDimitry Andric } 50968d75effSDimitry Andric CHECK(IsPowerOfTwo(alignment)); 51068d75effSDimitry Andric uptr rz_log = ComputeRZLog(size); 51168d75effSDimitry Andric uptr rz_size = RZLog2Size(rz_log); 51268d75effSDimitry Andric uptr rounded_size = RoundUpTo(Max(size, kChunkHeader2Size), alignment); 51368d75effSDimitry Andric uptr needed_size = rounded_size + rz_size; 51468d75effSDimitry Andric if (alignment > min_alignment) 51568d75effSDimitry Andric needed_size += alignment; 51668d75effSDimitry Andric // If we are allocating from the secondary allocator, there will be no 51768d75effSDimitry Andric // automatic right redzone, so add the right redzone manually. 518*e8d8bef9SDimitry Andric if (!PrimaryAllocator::CanAllocate(needed_size, alignment)) 51968d75effSDimitry Andric needed_size += rz_size; 52068d75effSDimitry Andric CHECK(IsAligned(needed_size, min_alignment)); 521480093f4SDimitry Andric if (size > kMaxAllowedMallocSize || needed_size > kMaxAllowedMallocSize || 522480093f4SDimitry Andric size > max_user_defined_malloc_size) { 52368d75effSDimitry Andric if (AllocatorMayReturnNull()) { 52468d75effSDimitry Andric Report("WARNING: AddressSanitizer failed to allocate 0x%zx bytes\n", 52568d75effSDimitry Andric (void*)size); 52668d75effSDimitry Andric return nullptr; 52768d75effSDimitry Andric } 528480093f4SDimitry Andric uptr malloc_limit = 529480093f4SDimitry Andric Min(kMaxAllowedMallocSize, max_user_defined_malloc_size); 530480093f4SDimitry Andric ReportAllocationSizeTooBig(size, needed_size, malloc_limit, stack); 53168d75effSDimitry Andric } 53268d75effSDimitry Andric 53368d75effSDimitry Andric AsanThread *t = GetCurrentThread(); 53468d75effSDimitry Andric void *allocated; 53568d75effSDimitry Andric if (t) { 53668d75effSDimitry Andric AllocatorCache *cache = GetAllocatorCache(&t->malloc_storage()); 53768d75effSDimitry Andric allocated = allocator.Allocate(cache, needed_size, 8); 53868d75effSDimitry Andric } else { 53968d75effSDimitry Andric SpinMutexLock l(&fallback_mutex); 54068d75effSDimitry Andric AllocatorCache *cache = &fallback_allocator_cache; 54168d75effSDimitry Andric allocated = allocator.Allocate(cache, needed_size, 8); 54268d75effSDimitry Andric } 54368d75effSDimitry Andric if (UNLIKELY(!allocated)) { 54468d75effSDimitry Andric SetAllocatorOutOfMemory(); 54568d75effSDimitry Andric if (AllocatorMayReturnNull()) 54668d75effSDimitry Andric return nullptr; 54768d75effSDimitry Andric ReportOutOfMemory(size, stack); 54868d75effSDimitry Andric } 54968d75effSDimitry Andric 55068d75effSDimitry Andric if (*(u8 *)MEM_TO_SHADOW((uptr)allocated) == 0 && CanPoisonMemory()) { 55168d75effSDimitry Andric // Heap poisoning is enabled, but the allocator provides an unpoisoned 55268d75effSDimitry Andric // chunk. This is possible if CanPoisonMemory() was false for some 55368d75effSDimitry Andric // time, for example, due to flags()->start_disabled. 55468d75effSDimitry Andric // Anyway, poison the block before using it for anything else. 55568d75effSDimitry Andric uptr allocated_size = allocator.GetActuallyAllocatedSize(allocated); 55668d75effSDimitry Andric PoisonShadow((uptr)allocated, allocated_size, kAsanHeapLeftRedzoneMagic); 55768d75effSDimitry Andric } 55868d75effSDimitry Andric 55968d75effSDimitry Andric uptr alloc_beg = reinterpret_cast<uptr>(allocated); 56068d75effSDimitry Andric uptr alloc_end = alloc_beg + needed_size; 561*e8d8bef9SDimitry Andric uptr user_beg = alloc_beg + rz_size; 56268d75effSDimitry Andric if (!IsAligned(user_beg, alignment)) 56368d75effSDimitry Andric user_beg = RoundUpTo(user_beg, alignment); 56468d75effSDimitry Andric uptr user_end = user_beg + size; 56568d75effSDimitry Andric CHECK_LE(user_end, alloc_end); 56668d75effSDimitry Andric uptr chunk_beg = user_beg - kChunkHeaderSize; 56768d75effSDimitry Andric AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 56868d75effSDimitry Andric m->alloc_type = alloc_type; 56968d75effSDimitry Andric CHECK(size); 570*e8d8bef9SDimitry Andric m->SetUsedSize(size); 57168d75effSDimitry Andric m->user_requested_alignment_log = user_requested_alignment_log; 57268d75effSDimitry Andric 573*e8d8bef9SDimitry Andric m->SetAllocContext(t ? t->tid() : 0, StackDepotPut(*stack)); 57468d75effSDimitry Andric 57568d75effSDimitry Andric uptr size_rounded_down_to_granularity = 57668d75effSDimitry Andric RoundDownTo(size, SHADOW_GRANULARITY); 57768d75effSDimitry Andric // Unpoison the bulk of the memory region. 57868d75effSDimitry Andric if (size_rounded_down_to_granularity) 57968d75effSDimitry Andric PoisonShadow(user_beg, size_rounded_down_to_granularity, 0); 58068d75effSDimitry Andric // Deal with the end of the region if size is not aligned to granularity. 58168d75effSDimitry Andric if (size != size_rounded_down_to_granularity && CanPoisonMemory()) { 58268d75effSDimitry Andric u8 *shadow = 58368d75effSDimitry Andric (u8 *)MemToShadow(user_beg + size_rounded_down_to_granularity); 58468d75effSDimitry Andric *shadow = fl.poison_partial ? (size & (SHADOW_GRANULARITY - 1)) : 0; 58568d75effSDimitry Andric } 58668d75effSDimitry Andric 58768d75effSDimitry Andric AsanStats &thread_stats = GetCurrentThreadStats(); 58868d75effSDimitry Andric thread_stats.mallocs++; 58968d75effSDimitry Andric thread_stats.malloced += size; 59068d75effSDimitry Andric thread_stats.malloced_redzones += needed_size - size; 59168d75effSDimitry Andric if (needed_size > SizeClassMap::kMaxSize) 59268d75effSDimitry Andric thread_stats.malloc_large++; 59368d75effSDimitry Andric else 59468d75effSDimitry Andric thread_stats.malloced_by_size[SizeClassMap::ClassID(needed_size)]++; 59568d75effSDimitry Andric 59668d75effSDimitry Andric void *res = reinterpret_cast<void *>(user_beg); 59768d75effSDimitry Andric if (can_fill && fl.max_malloc_fill_size) { 59868d75effSDimitry Andric uptr fill_size = Min(size, (uptr)fl.max_malloc_fill_size); 59968d75effSDimitry Andric REAL(memset)(res, fl.malloc_fill_byte, fill_size); 60068d75effSDimitry Andric } 60168d75effSDimitry Andric #if CAN_SANITIZE_LEAKS 60268d75effSDimitry Andric m->lsan_tag = __lsan::DisabledInThisThread() ? __lsan::kIgnored 60368d75effSDimitry Andric : __lsan::kDirectlyLeaked; 60468d75effSDimitry Andric #endif 60568d75effSDimitry Andric // Must be the last mutation of metadata in this function. 606*e8d8bef9SDimitry Andric atomic_store(&m->chunk_state, CHUNK_ALLOCATED, memory_order_release); 607*e8d8bef9SDimitry Andric if (alloc_beg != chunk_beg) { 608*e8d8bef9SDimitry Andric CHECK_LE(alloc_beg + sizeof(LargeChunkHeader), chunk_beg); 609*e8d8bef9SDimitry Andric reinterpret_cast<LargeChunkHeader *>(alloc_beg)->Set(m); 610*e8d8bef9SDimitry Andric } 61168d75effSDimitry Andric ASAN_MALLOC_HOOK(res, size); 61268d75effSDimitry Andric return res; 61368d75effSDimitry Andric } 61468d75effSDimitry Andric 61568d75effSDimitry Andric // Set quarantine flag if chunk is allocated, issue ASan error report on 61668d75effSDimitry Andric // available and quarantined chunks. Return true on success, false otherwise. 61768d75effSDimitry Andric bool AtomicallySetQuarantineFlagIfAllocated(AsanChunk *m, void *ptr, 61868d75effSDimitry Andric BufferedStackTrace *stack) { 61968d75effSDimitry Andric u8 old_chunk_state = CHUNK_ALLOCATED; 62068d75effSDimitry Andric // Flip the chunk_state atomically to avoid race on double-free. 621*e8d8bef9SDimitry Andric if (!atomic_compare_exchange_strong(&m->chunk_state, &old_chunk_state, 62268d75effSDimitry Andric CHUNK_QUARANTINE, 62368d75effSDimitry Andric memory_order_acquire)) { 62468d75effSDimitry Andric ReportInvalidFree(ptr, old_chunk_state, stack); 62568d75effSDimitry Andric // It's not safe to push a chunk in quarantine on invalid free. 62668d75effSDimitry Andric return false; 62768d75effSDimitry Andric } 62868d75effSDimitry Andric CHECK_EQ(CHUNK_ALLOCATED, old_chunk_state); 629*e8d8bef9SDimitry Andric // It was a user data. 630*e8d8bef9SDimitry Andric m->SetFreeContext(kInvalidTid, 0); 63168d75effSDimitry Andric return true; 63268d75effSDimitry Andric } 63368d75effSDimitry Andric 63468d75effSDimitry Andric // Expects the chunk to already be marked as quarantined by using 63568d75effSDimitry Andric // AtomicallySetQuarantineFlagIfAllocated. 63668d75effSDimitry Andric void QuarantineChunk(AsanChunk *m, void *ptr, BufferedStackTrace *stack) { 637*e8d8bef9SDimitry Andric CHECK_EQ(atomic_load(&m->chunk_state, memory_order_relaxed), 638*e8d8bef9SDimitry Andric CHUNK_QUARANTINE); 63968d75effSDimitry Andric AsanThread *t = GetCurrentThread(); 640*e8d8bef9SDimitry Andric m->SetFreeContext(t ? t->tid() : 0, StackDepotPut(*stack)); 64168d75effSDimitry Andric 64268d75effSDimitry Andric Flags &fl = *flags(); 64368d75effSDimitry Andric if (fl.max_free_fill_size > 0) { 64468d75effSDimitry Andric // We have to skip the chunk header, it contains free_context_id. 64568d75effSDimitry Andric uptr scribble_start = (uptr)m + kChunkHeaderSize + kChunkHeader2Size; 64668d75effSDimitry Andric if (m->UsedSize() >= kChunkHeader2Size) { // Skip Header2 in user area. 64768d75effSDimitry Andric uptr size_to_fill = m->UsedSize() - kChunkHeader2Size; 64868d75effSDimitry Andric size_to_fill = Min(size_to_fill, (uptr)fl.max_free_fill_size); 64968d75effSDimitry Andric REAL(memset)((void *)scribble_start, fl.free_fill_byte, size_to_fill); 65068d75effSDimitry Andric } 65168d75effSDimitry Andric } 65268d75effSDimitry Andric 65368d75effSDimitry Andric // Poison the region. 65468d75effSDimitry Andric PoisonShadow(m->Beg(), 65568d75effSDimitry Andric RoundUpTo(m->UsedSize(), SHADOW_GRANULARITY), 65668d75effSDimitry Andric kAsanHeapFreeMagic); 65768d75effSDimitry Andric 65868d75effSDimitry Andric AsanStats &thread_stats = GetCurrentThreadStats(); 65968d75effSDimitry Andric thread_stats.frees++; 66068d75effSDimitry Andric thread_stats.freed += m->UsedSize(); 66168d75effSDimitry Andric 66268d75effSDimitry Andric // Push into quarantine. 66368d75effSDimitry Andric if (t) { 66468d75effSDimitry Andric AsanThreadLocalMallocStorage *ms = &t->malloc_storage(); 66568d75effSDimitry Andric AllocatorCache *ac = GetAllocatorCache(ms); 66668d75effSDimitry Andric quarantine.Put(GetQuarantineCache(ms), QuarantineCallback(ac, stack), m, 66768d75effSDimitry Andric m->UsedSize()); 66868d75effSDimitry Andric } else { 66968d75effSDimitry Andric SpinMutexLock l(&fallback_mutex); 67068d75effSDimitry Andric AllocatorCache *ac = &fallback_allocator_cache; 67168d75effSDimitry Andric quarantine.Put(&fallback_quarantine_cache, QuarantineCallback(ac, stack), 67268d75effSDimitry Andric m, m->UsedSize()); 67368d75effSDimitry Andric } 67468d75effSDimitry Andric } 67568d75effSDimitry Andric 67668d75effSDimitry Andric void Deallocate(void *ptr, uptr delete_size, uptr delete_alignment, 67768d75effSDimitry Andric BufferedStackTrace *stack, AllocType alloc_type) { 67868d75effSDimitry Andric uptr p = reinterpret_cast<uptr>(ptr); 67968d75effSDimitry Andric if (p == 0) return; 68068d75effSDimitry Andric 68168d75effSDimitry Andric uptr chunk_beg = p - kChunkHeaderSize; 68268d75effSDimitry Andric AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 68368d75effSDimitry Andric 68468d75effSDimitry Andric // On Windows, uninstrumented DLLs may allocate memory before ASan hooks 68568d75effSDimitry Andric // malloc. Don't report an invalid free in this case. 68668d75effSDimitry Andric if (SANITIZER_WINDOWS && 68768d75effSDimitry Andric !get_allocator().PointerIsMine(ptr)) { 68868d75effSDimitry Andric if (!IsSystemHeapAddress(p)) 68968d75effSDimitry Andric ReportFreeNotMalloced(p, stack); 69068d75effSDimitry Andric return; 69168d75effSDimitry Andric } 69268d75effSDimitry Andric 69368d75effSDimitry Andric ASAN_FREE_HOOK(ptr); 69468d75effSDimitry Andric 69568d75effSDimitry Andric // Must mark the chunk as quarantined before any changes to its metadata. 69668d75effSDimitry Andric // Do not quarantine given chunk if we failed to set CHUNK_QUARANTINE flag. 69768d75effSDimitry Andric if (!AtomicallySetQuarantineFlagIfAllocated(m, ptr, stack)) return; 69868d75effSDimitry Andric 69968d75effSDimitry Andric if (m->alloc_type != alloc_type) { 70068d75effSDimitry Andric if (atomic_load(&alloc_dealloc_mismatch, memory_order_acquire)) { 70168d75effSDimitry Andric ReportAllocTypeMismatch((uptr)ptr, stack, (AllocType)m->alloc_type, 70268d75effSDimitry Andric (AllocType)alloc_type); 70368d75effSDimitry Andric } 70468d75effSDimitry Andric } else { 70568d75effSDimitry Andric if (flags()->new_delete_type_mismatch && 70668d75effSDimitry Andric (alloc_type == FROM_NEW || alloc_type == FROM_NEW_BR) && 70768d75effSDimitry Andric ((delete_size && delete_size != m->UsedSize()) || 70868d75effSDimitry Andric ComputeUserRequestedAlignmentLog(delete_alignment) != 70968d75effSDimitry Andric m->user_requested_alignment_log)) { 71068d75effSDimitry Andric ReportNewDeleteTypeMismatch(p, delete_size, delete_alignment, stack); 71168d75effSDimitry Andric } 71268d75effSDimitry Andric } 71368d75effSDimitry Andric 71468d75effSDimitry Andric QuarantineChunk(m, ptr, stack); 71568d75effSDimitry Andric } 71668d75effSDimitry Andric 71768d75effSDimitry Andric void *Reallocate(void *old_ptr, uptr new_size, BufferedStackTrace *stack) { 71868d75effSDimitry Andric CHECK(old_ptr && new_size); 71968d75effSDimitry Andric uptr p = reinterpret_cast<uptr>(old_ptr); 72068d75effSDimitry Andric uptr chunk_beg = p - kChunkHeaderSize; 72168d75effSDimitry Andric AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 72268d75effSDimitry Andric 72368d75effSDimitry Andric AsanStats &thread_stats = GetCurrentThreadStats(); 72468d75effSDimitry Andric thread_stats.reallocs++; 72568d75effSDimitry Andric thread_stats.realloced += new_size; 72668d75effSDimitry Andric 72768d75effSDimitry Andric void *new_ptr = Allocate(new_size, 8, stack, FROM_MALLOC, true); 72868d75effSDimitry Andric if (new_ptr) { 729*e8d8bef9SDimitry Andric u8 chunk_state = atomic_load(&m->chunk_state, memory_order_acquire); 73068d75effSDimitry Andric if (chunk_state != CHUNK_ALLOCATED) 73168d75effSDimitry Andric ReportInvalidFree(old_ptr, chunk_state, stack); 73268d75effSDimitry Andric CHECK_NE(REAL(memcpy), nullptr); 73368d75effSDimitry Andric uptr memcpy_size = Min(new_size, m->UsedSize()); 73468d75effSDimitry Andric // If realloc() races with free(), we may start copying freed memory. 73568d75effSDimitry Andric // However, we will report racy double-free later anyway. 73668d75effSDimitry Andric REAL(memcpy)(new_ptr, old_ptr, memcpy_size); 73768d75effSDimitry Andric Deallocate(old_ptr, 0, 0, stack, FROM_MALLOC); 73868d75effSDimitry Andric } 73968d75effSDimitry Andric return new_ptr; 74068d75effSDimitry Andric } 74168d75effSDimitry Andric 74268d75effSDimitry Andric void *Calloc(uptr nmemb, uptr size, BufferedStackTrace *stack) { 74368d75effSDimitry Andric if (UNLIKELY(CheckForCallocOverflow(size, nmemb))) { 74468d75effSDimitry Andric if (AllocatorMayReturnNull()) 74568d75effSDimitry Andric return nullptr; 74668d75effSDimitry Andric ReportCallocOverflow(nmemb, size, stack); 74768d75effSDimitry Andric } 74868d75effSDimitry Andric void *ptr = Allocate(nmemb * size, 8, stack, FROM_MALLOC, false); 74968d75effSDimitry Andric // If the memory comes from the secondary allocator no need to clear it 75068d75effSDimitry Andric // as it comes directly from mmap. 75168d75effSDimitry Andric if (ptr && allocator.FromPrimary(ptr)) 75268d75effSDimitry Andric REAL(memset)(ptr, 0, nmemb * size); 75368d75effSDimitry Andric return ptr; 75468d75effSDimitry Andric } 75568d75effSDimitry Andric 75668d75effSDimitry Andric void ReportInvalidFree(void *ptr, u8 chunk_state, BufferedStackTrace *stack) { 75768d75effSDimitry Andric if (chunk_state == CHUNK_QUARANTINE) 75868d75effSDimitry Andric ReportDoubleFree((uptr)ptr, stack); 75968d75effSDimitry Andric else 76068d75effSDimitry Andric ReportFreeNotMalloced((uptr)ptr, stack); 76168d75effSDimitry Andric } 76268d75effSDimitry Andric 76368d75effSDimitry Andric void CommitBack(AsanThreadLocalMallocStorage *ms, BufferedStackTrace *stack) { 76468d75effSDimitry Andric AllocatorCache *ac = GetAllocatorCache(ms); 76568d75effSDimitry Andric quarantine.Drain(GetQuarantineCache(ms), QuarantineCallback(ac, stack)); 76668d75effSDimitry Andric allocator.SwallowCache(ac); 76768d75effSDimitry Andric } 76868d75effSDimitry Andric 76968d75effSDimitry Andric // -------------------------- Chunk lookup ---------------------- 77068d75effSDimitry Andric 77168d75effSDimitry Andric // Assumes alloc_beg == allocator.GetBlockBegin(alloc_beg). 772*e8d8bef9SDimitry Andric // Returns nullptr if AsanChunk is not yet initialized just after 773*e8d8bef9SDimitry Andric // get_allocator().Allocate(), or is being destroyed just before 774*e8d8bef9SDimitry Andric // get_allocator().Deallocate(). 77568d75effSDimitry Andric AsanChunk *GetAsanChunk(void *alloc_beg) { 776*e8d8bef9SDimitry Andric if (!alloc_beg) 777*e8d8bef9SDimitry Andric return nullptr; 778*e8d8bef9SDimitry Andric AsanChunk *p = reinterpret_cast<LargeChunkHeader *>(alloc_beg)->Get(); 779*e8d8bef9SDimitry Andric if (!p) { 780*e8d8bef9SDimitry Andric if (!allocator.FromPrimary(alloc_beg)) 781*e8d8bef9SDimitry Andric return nullptr; 782*e8d8bef9SDimitry Andric p = reinterpret_cast<AsanChunk *>(alloc_beg); 78368d75effSDimitry Andric } 784*e8d8bef9SDimitry Andric u8 state = atomic_load(&p->chunk_state, memory_order_relaxed); 785*e8d8bef9SDimitry Andric // It does not guaranty that Chunk is initialized, but it's 786*e8d8bef9SDimitry Andric // definitely not for any other value. 787*e8d8bef9SDimitry Andric if (state == CHUNK_ALLOCATED || state == CHUNK_QUARANTINE) 788*e8d8bef9SDimitry Andric return p; 789*e8d8bef9SDimitry Andric return nullptr; 79068d75effSDimitry Andric } 79168d75effSDimitry Andric 79268d75effSDimitry Andric AsanChunk *GetAsanChunkByAddr(uptr p) { 79368d75effSDimitry Andric void *alloc_beg = allocator.GetBlockBegin(reinterpret_cast<void *>(p)); 79468d75effSDimitry Andric return GetAsanChunk(alloc_beg); 79568d75effSDimitry Andric } 79668d75effSDimitry Andric 79768d75effSDimitry Andric // Allocator must be locked when this function is called. 79868d75effSDimitry Andric AsanChunk *GetAsanChunkByAddrFastLocked(uptr p) { 79968d75effSDimitry Andric void *alloc_beg = 80068d75effSDimitry Andric allocator.GetBlockBeginFastLocked(reinterpret_cast<void *>(p)); 80168d75effSDimitry Andric return GetAsanChunk(alloc_beg); 80268d75effSDimitry Andric } 80368d75effSDimitry Andric 80468d75effSDimitry Andric uptr AllocationSize(uptr p) { 80568d75effSDimitry Andric AsanChunk *m = GetAsanChunkByAddr(p); 80668d75effSDimitry Andric if (!m) return 0; 807*e8d8bef9SDimitry Andric if (atomic_load(&m->chunk_state, memory_order_acquire) != CHUNK_ALLOCATED) 808*e8d8bef9SDimitry Andric return 0; 80968d75effSDimitry Andric if (m->Beg() != p) return 0; 81068d75effSDimitry Andric return m->UsedSize(); 81168d75effSDimitry Andric } 81268d75effSDimitry Andric 81368d75effSDimitry Andric AsanChunkView FindHeapChunkByAddress(uptr addr) { 81468d75effSDimitry Andric AsanChunk *m1 = GetAsanChunkByAddr(addr); 81568d75effSDimitry Andric sptr offset = 0; 816*e8d8bef9SDimitry Andric if (!m1 || AsanChunkView(m1).AddrIsAtLeft(addr, 1, &offset)) { 81768d75effSDimitry Andric // The address is in the chunk's left redzone, so maybe it is actually 81868d75effSDimitry Andric // a right buffer overflow from the other chunk to the left. 81968d75effSDimitry Andric // Search a bit to the left to see if there is another chunk. 82068d75effSDimitry Andric AsanChunk *m2 = nullptr; 82168d75effSDimitry Andric for (uptr l = 1; l < GetPageSizeCached(); l++) { 82268d75effSDimitry Andric m2 = GetAsanChunkByAddr(addr - l); 82368d75effSDimitry Andric if (m2 == m1) continue; // Still the same chunk. 82468d75effSDimitry Andric break; 82568d75effSDimitry Andric } 82668d75effSDimitry Andric if (m2 && AsanChunkView(m2).AddrIsAtRight(addr, 1, &offset)) 82768d75effSDimitry Andric m1 = ChooseChunk(addr, m2, m1); 82868d75effSDimitry Andric } 82968d75effSDimitry Andric return AsanChunkView(m1); 83068d75effSDimitry Andric } 83168d75effSDimitry Andric 83268d75effSDimitry Andric void Purge(BufferedStackTrace *stack) { 83368d75effSDimitry Andric AsanThread *t = GetCurrentThread(); 83468d75effSDimitry Andric if (t) { 83568d75effSDimitry Andric AsanThreadLocalMallocStorage *ms = &t->malloc_storage(); 83668d75effSDimitry Andric quarantine.DrainAndRecycle(GetQuarantineCache(ms), 83768d75effSDimitry Andric QuarantineCallback(GetAllocatorCache(ms), 83868d75effSDimitry Andric stack)); 83968d75effSDimitry Andric } 84068d75effSDimitry Andric { 84168d75effSDimitry Andric SpinMutexLock l(&fallback_mutex); 84268d75effSDimitry Andric quarantine.DrainAndRecycle(&fallback_quarantine_cache, 84368d75effSDimitry Andric QuarantineCallback(&fallback_allocator_cache, 84468d75effSDimitry Andric stack)); 84568d75effSDimitry Andric } 84668d75effSDimitry Andric 84768d75effSDimitry Andric allocator.ForceReleaseToOS(); 84868d75effSDimitry Andric } 84968d75effSDimitry Andric 85068d75effSDimitry Andric void PrintStats() { 85168d75effSDimitry Andric allocator.PrintStats(); 85268d75effSDimitry Andric quarantine.PrintStats(); 85368d75effSDimitry Andric } 85468d75effSDimitry Andric 85568d75effSDimitry Andric void ForceLock() { 85668d75effSDimitry Andric allocator.ForceLock(); 85768d75effSDimitry Andric fallback_mutex.Lock(); 85868d75effSDimitry Andric } 85968d75effSDimitry Andric 86068d75effSDimitry Andric void ForceUnlock() { 86168d75effSDimitry Andric fallback_mutex.Unlock(); 86268d75effSDimitry Andric allocator.ForceUnlock(); 86368d75effSDimitry Andric } 86468d75effSDimitry Andric }; 86568d75effSDimitry Andric 86668d75effSDimitry Andric static Allocator instance(LINKER_INITIALIZED); 86768d75effSDimitry Andric 86868d75effSDimitry Andric static AsanAllocator &get_allocator() { 86968d75effSDimitry Andric return instance.allocator; 87068d75effSDimitry Andric } 87168d75effSDimitry Andric 87268d75effSDimitry Andric bool AsanChunkView::IsValid() const { 873*e8d8bef9SDimitry Andric return chunk_ && atomic_load(&chunk_->chunk_state, memory_order_relaxed) != 874*e8d8bef9SDimitry Andric CHUNK_INVALID; 87568d75effSDimitry Andric } 87668d75effSDimitry Andric bool AsanChunkView::IsAllocated() const { 877*e8d8bef9SDimitry Andric return chunk_ && atomic_load(&chunk_->chunk_state, memory_order_relaxed) == 878*e8d8bef9SDimitry Andric CHUNK_ALLOCATED; 87968d75effSDimitry Andric } 88068d75effSDimitry Andric bool AsanChunkView::IsQuarantined() const { 881*e8d8bef9SDimitry Andric return chunk_ && atomic_load(&chunk_->chunk_state, memory_order_relaxed) == 882*e8d8bef9SDimitry Andric CHUNK_QUARANTINE; 88368d75effSDimitry Andric } 88468d75effSDimitry Andric uptr AsanChunkView::Beg() const { return chunk_->Beg(); } 88568d75effSDimitry Andric uptr AsanChunkView::End() const { return Beg() + UsedSize(); } 88668d75effSDimitry Andric uptr AsanChunkView::UsedSize() const { return chunk_->UsedSize(); } 88768d75effSDimitry Andric u32 AsanChunkView::UserRequestedAlignment() const { 88868d75effSDimitry Andric return Allocator::ComputeUserAlignment(chunk_->user_requested_alignment_log); 88968d75effSDimitry Andric } 890*e8d8bef9SDimitry Andric 891*e8d8bef9SDimitry Andric uptr AsanChunkView::AllocTid() const { 892*e8d8bef9SDimitry Andric u32 tid = 0; 893*e8d8bef9SDimitry Andric u32 stack = 0; 894*e8d8bef9SDimitry Andric chunk_->GetAllocContext(tid, stack); 895*e8d8bef9SDimitry Andric return tid; 896*e8d8bef9SDimitry Andric } 897*e8d8bef9SDimitry Andric 898*e8d8bef9SDimitry Andric uptr AsanChunkView::FreeTid() const { 899*e8d8bef9SDimitry Andric if (!IsQuarantined()) 900*e8d8bef9SDimitry Andric return kInvalidTid; 901*e8d8bef9SDimitry Andric u32 tid = 0; 902*e8d8bef9SDimitry Andric u32 stack = 0; 903*e8d8bef9SDimitry Andric chunk_->GetFreeContext(tid, stack); 904*e8d8bef9SDimitry Andric return tid; 905*e8d8bef9SDimitry Andric } 906*e8d8bef9SDimitry Andric 90768d75effSDimitry Andric AllocType AsanChunkView::GetAllocType() const { 90868d75effSDimitry Andric return (AllocType)chunk_->alloc_type; 90968d75effSDimitry Andric } 91068d75effSDimitry Andric 91168d75effSDimitry Andric static StackTrace GetStackTraceFromId(u32 id) { 91268d75effSDimitry Andric CHECK(id); 91368d75effSDimitry Andric StackTrace res = StackDepotGet(id); 91468d75effSDimitry Andric CHECK(res.trace); 91568d75effSDimitry Andric return res; 91668d75effSDimitry Andric } 91768d75effSDimitry Andric 918*e8d8bef9SDimitry Andric u32 AsanChunkView::GetAllocStackId() const { 919*e8d8bef9SDimitry Andric u32 tid = 0; 920*e8d8bef9SDimitry Andric u32 stack = 0; 921*e8d8bef9SDimitry Andric chunk_->GetAllocContext(tid, stack); 922*e8d8bef9SDimitry Andric return stack; 923*e8d8bef9SDimitry Andric } 924*e8d8bef9SDimitry Andric 925*e8d8bef9SDimitry Andric u32 AsanChunkView::GetFreeStackId() const { 926*e8d8bef9SDimitry Andric if (!IsQuarantined()) 927*e8d8bef9SDimitry Andric return 0; 928*e8d8bef9SDimitry Andric u32 tid = 0; 929*e8d8bef9SDimitry Andric u32 stack = 0; 930*e8d8bef9SDimitry Andric chunk_->GetFreeContext(tid, stack); 931*e8d8bef9SDimitry Andric return stack; 932*e8d8bef9SDimitry Andric } 93368d75effSDimitry Andric 93468d75effSDimitry Andric StackTrace AsanChunkView::GetAllocStack() const { 93568d75effSDimitry Andric return GetStackTraceFromId(GetAllocStackId()); 93668d75effSDimitry Andric } 93768d75effSDimitry Andric 93868d75effSDimitry Andric StackTrace AsanChunkView::GetFreeStack() const { 93968d75effSDimitry Andric return GetStackTraceFromId(GetFreeStackId()); 94068d75effSDimitry Andric } 94168d75effSDimitry Andric 94268d75effSDimitry Andric void InitializeAllocator(const AllocatorOptions &options) { 94368d75effSDimitry Andric instance.InitLinkerInitialized(options); 94468d75effSDimitry Andric } 94568d75effSDimitry Andric 94668d75effSDimitry Andric void ReInitializeAllocator(const AllocatorOptions &options) { 94768d75effSDimitry Andric instance.ReInitialize(options); 94868d75effSDimitry Andric } 94968d75effSDimitry Andric 95068d75effSDimitry Andric void GetAllocatorOptions(AllocatorOptions *options) { 95168d75effSDimitry Andric instance.GetOptions(options); 95268d75effSDimitry Andric } 95368d75effSDimitry Andric 95468d75effSDimitry Andric AsanChunkView FindHeapChunkByAddress(uptr addr) { 95568d75effSDimitry Andric return instance.FindHeapChunkByAddress(addr); 95668d75effSDimitry Andric } 95768d75effSDimitry Andric AsanChunkView FindHeapChunkByAllocBeg(uptr addr) { 95868d75effSDimitry Andric return AsanChunkView(instance.GetAsanChunk(reinterpret_cast<void*>(addr))); 95968d75effSDimitry Andric } 96068d75effSDimitry Andric 96168d75effSDimitry Andric void AsanThreadLocalMallocStorage::CommitBack() { 96268d75effSDimitry Andric GET_STACK_TRACE_MALLOC; 96368d75effSDimitry Andric instance.CommitBack(this, &stack); 96468d75effSDimitry Andric } 96568d75effSDimitry Andric 96668d75effSDimitry Andric void PrintInternalAllocatorStats() { 96768d75effSDimitry Andric instance.PrintStats(); 96868d75effSDimitry Andric } 96968d75effSDimitry Andric 97068d75effSDimitry Andric void asan_free(void *ptr, BufferedStackTrace *stack, AllocType alloc_type) { 97168d75effSDimitry Andric instance.Deallocate(ptr, 0, 0, stack, alloc_type); 97268d75effSDimitry Andric } 97368d75effSDimitry Andric 97468d75effSDimitry Andric void asan_delete(void *ptr, uptr size, uptr alignment, 97568d75effSDimitry Andric BufferedStackTrace *stack, AllocType alloc_type) { 97668d75effSDimitry Andric instance.Deallocate(ptr, size, alignment, stack, alloc_type); 97768d75effSDimitry Andric } 97868d75effSDimitry Andric 97968d75effSDimitry Andric void *asan_malloc(uptr size, BufferedStackTrace *stack) { 98068d75effSDimitry Andric return SetErrnoOnNull(instance.Allocate(size, 8, stack, FROM_MALLOC, true)); 98168d75effSDimitry Andric } 98268d75effSDimitry Andric 98368d75effSDimitry Andric void *asan_calloc(uptr nmemb, uptr size, BufferedStackTrace *stack) { 98468d75effSDimitry Andric return SetErrnoOnNull(instance.Calloc(nmemb, size, stack)); 98568d75effSDimitry Andric } 98668d75effSDimitry Andric 98768d75effSDimitry Andric void *asan_reallocarray(void *p, uptr nmemb, uptr size, 98868d75effSDimitry Andric BufferedStackTrace *stack) { 98968d75effSDimitry Andric if (UNLIKELY(CheckForCallocOverflow(size, nmemb))) { 99068d75effSDimitry Andric errno = errno_ENOMEM; 99168d75effSDimitry Andric if (AllocatorMayReturnNull()) 99268d75effSDimitry Andric return nullptr; 99368d75effSDimitry Andric ReportReallocArrayOverflow(nmemb, size, stack); 99468d75effSDimitry Andric } 99568d75effSDimitry Andric return asan_realloc(p, nmemb * size, stack); 99668d75effSDimitry Andric } 99768d75effSDimitry Andric 99868d75effSDimitry Andric void *asan_realloc(void *p, uptr size, BufferedStackTrace *stack) { 99968d75effSDimitry Andric if (!p) 100068d75effSDimitry Andric return SetErrnoOnNull(instance.Allocate(size, 8, stack, FROM_MALLOC, true)); 100168d75effSDimitry Andric if (size == 0) { 100268d75effSDimitry Andric if (flags()->allocator_frees_and_returns_null_on_realloc_zero) { 100368d75effSDimitry Andric instance.Deallocate(p, 0, 0, stack, FROM_MALLOC); 100468d75effSDimitry Andric return nullptr; 100568d75effSDimitry Andric } 100668d75effSDimitry Andric // Allocate a size of 1 if we shouldn't free() on Realloc to 0 100768d75effSDimitry Andric size = 1; 100868d75effSDimitry Andric } 100968d75effSDimitry Andric return SetErrnoOnNull(instance.Reallocate(p, size, stack)); 101068d75effSDimitry Andric } 101168d75effSDimitry Andric 101268d75effSDimitry Andric void *asan_valloc(uptr size, BufferedStackTrace *stack) { 101368d75effSDimitry Andric return SetErrnoOnNull( 101468d75effSDimitry Andric instance.Allocate(size, GetPageSizeCached(), stack, FROM_MALLOC, true)); 101568d75effSDimitry Andric } 101668d75effSDimitry Andric 101768d75effSDimitry Andric void *asan_pvalloc(uptr size, BufferedStackTrace *stack) { 101868d75effSDimitry Andric uptr PageSize = GetPageSizeCached(); 101968d75effSDimitry Andric if (UNLIKELY(CheckForPvallocOverflow(size, PageSize))) { 102068d75effSDimitry Andric errno = errno_ENOMEM; 102168d75effSDimitry Andric if (AllocatorMayReturnNull()) 102268d75effSDimitry Andric return nullptr; 102368d75effSDimitry Andric ReportPvallocOverflow(size, stack); 102468d75effSDimitry Andric } 102568d75effSDimitry Andric // pvalloc(0) should allocate one page. 102668d75effSDimitry Andric size = size ? RoundUpTo(size, PageSize) : PageSize; 102768d75effSDimitry Andric return SetErrnoOnNull( 102868d75effSDimitry Andric instance.Allocate(size, PageSize, stack, FROM_MALLOC, true)); 102968d75effSDimitry Andric } 103068d75effSDimitry Andric 103168d75effSDimitry Andric void *asan_memalign(uptr alignment, uptr size, BufferedStackTrace *stack, 103268d75effSDimitry Andric AllocType alloc_type) { 103368d75effSDimitry Andric if (UNLIKELY(!IsPowerOfTwo(alignment))) { 103468d75effSDimitry Andric errno = errno_EINVAL; 103568d75effSDimitry Andric if (AllocatorMayReturnNull()) 103668d75effSDimitry Andric return nullptr; 103768d75effSDimitry Andric ReportInvalidAllocationAlignment(alignment, stack); 103868d75effSDimitry Andric } 103968d75effSDimitry Andric return SetErrnoOnNull( 104068d75effSDimitry Andric instance.Allocate(size, alignment, stack, alloc_type, true)); 104168d75effSDimitry Andric } 104268d75effSDimitry Andric 104368d75effSDimitry Andric void *asan_aligned_alloc(uptr alignment, uptr size, BufferedStackTrace *stack) { 104468d75effSDimitry Andric if (UNLIKELY(!CheckAlignedAllocAlignmentAndSize(alignment, size))) { 104568d75effSDimitry Andric errno = errno_EINVAL; 104668d75effSDimitry Andric if (AllocatorMayReturnNull()) 104768d75effSDimitry Andric return nullptr; 104868d75effSDimitry Andric ReportInvalidAlignedAllocAlignment(size, alignment, stack); 104968d75effSDimitry Andric } 105068d75effSDimitry Andric return SetErrnoOnNull( 105168d75effSDimitry Andric instance.Allocate(size, alignment, stack, FROM_MALLOC, true)); 105268d75effSDimitry Andric } 105368d75effSDimitry Andric 105468d75effSDimitry Andric int asan_posix_memalign(void **memptr, uptr alignment, uptr size, 105568d75effSDimitry Andric BufferedStackTrace *stack) { 105668d75effSDimitry Andric if (UNLIKELY(!CheckPosixMemalignAlignment(alignment))) { 105768d75effSDimitry Andric if (AllocatorMayReturnNull()) 105868d75effSDimitry Andric return errno_EINVAL; 105968d75effSDimitry Andric ReportInvalidPosixMemalignAlignment(alignment, stack); 106068d75effSDimitry Andric } 106168d75effSDimitry Andric void *ptr = instance.Allocate(size, alignment, stack, FROM_MALLOC, true); 106268d75effSDimitry Andric if (UNLIKELY(!ptr)) 106368d75effSDimitry Andric // OOM error is already taken care of by Allocate. 106468d75effSDimitry Andric return errno_ENOMEM; 106568d75effSDimitry Andric CHECK(IsAligned((uptr)ptr, alignment)); 106668d75effSDimitry Andric *memptr = ptr; 106768d75effSDimitry Andric return 0; 106868d75effSDimitry Andric } 106968d75effSDimitry Andric 107068d75effSDimitry Andric uptr asan_malloc_usable_size(const void *ptr, uptr pc, uptr bp) { 107168d75effSDimitry Andric if (!ptr) return 0; 107268d75effSDimitry Andric uptr usable_size = instance.AllocationSize(reinterpret_cast<uptr>(ptr)); 107368d75effSDimitry Andric if (flags()->check_malloc_usable_size && (usable_size == 0)) { 107468d75effSDimitry Andric GET_STACK_TRACE_FATAL(pc, bp); 107568d75effSDimitry Andric ReportMallocUsableSizeNotOwned((uptr)ptr, &stack); 107668d75effSDimitry Andric } 107768d75effSDimitry Andric return usable_size; 107868d75effSDimitry Andric } 107968d75effSDimitry Andric 108068d75effSDimitry Andric uptr asan_mz_size(const void *ptr) { 108168d75effSDimitry Andric return instance.AllocationSize(reinterpret_cast<uptr>(ptr)); 108268d75effSDimitry Andric } 108368d75effSDimitry Andric 108468d75effSDimitry Andric void asan_mz_force_lock() { 108568d75effSDimitry Andric instance.ForceLock(); 108668d75effSDimitry Andric } 108768d75effSDimitry Andric 108868d75effSDimitry Andric void asan_mz_force_unlock() { 108968d75effSDimitry Andric instance.ForceUnlock(); 109068d75effSDimitry Andric } 109168d75effSDimitry Andric 109268d75effSDimitry Andric void AsanSoftRssLimitExceededCallback(bool limit_exceeded) { 109368d75effSDimitry Andric instance.SetRssLimitExceeded(limit_exceeded); 109468d75effSDimitry Andric } 109568d75effSDimitry Andric 109668d75effSDimitry Andric } // namespace __asan 109768d75effSDimitry Andric 109868d75effSDimitry Andric // --- Implementation of LSan-specific functions --- {{{1 109968d75effSDimitry Andric namespace __lsan { 110068d75effSDimitry Andric void LockAllocator() { 110168d75effSDimitry Andric __asan::get_allocator().ForceLock(); 110268d75effSDimitry Andric } 110368d75effSDimitry Andric 110468d75effSDimitry Andric void UnlockAllocator() { 110568d75effSDimitry Andric __asan::get_allocator().ForceUnlock(); 110668d75effSDimitry Andric } 110768d75effSDimitry Andric 110868d75effSDimitry Andric void GetAllocatorGlobalRange(uptr *begin, uptr *end) { 110968d75effSDimitry Andric *begin = (uptr)&__asan::get_allocator(); 111068d75effSDimitry Andric *end = *begin + sizeof(__asan::get_allocator()); 111168d75effSDimitry Andric } 111268d75effSDimitry Andric 111368d75effSDimitry Andric uptr PointsIntoChunk(void *p) { 111468d75effSDimitry Andric uptr addr = reinterpret_cast<uptr>(p); 111568d75effSDimitry Andric __asan::AsanChunk *m = __asan::instance.GetAsanChunkByAddrFastLocked(addr); 1116*e8d8bef9SDimitry Andric if (!m || atomic_load(&m->chunk_state, memory_order_acquire) != 1117*e8d8bef9SDimitry Andric __asan::CHUNK_ALLOCATED) 111868d75effSDimitry Andric return 0; 1119*e8d8bef9SDimitry Andric uptr chunk = m->Beg(); 1120*e8d8bef9SDimitry Andric if (m->AddrIsInside(addr)) 112168d75effSDimitry Andric return chunk; 1122*e8d8bef9SDimitry Andric if (IsSpecialCaseOfOperatorNew0(chunk, m->UsedSize(), addr)) 112368d75effSDimitry Andric return chunk; 112468d75effSDimitry Andric return 0; 112568d75effSDimitry Andric } 112668d75effSDimitry Andric 112768d75effSDimitry Andric uptr GetUserBegin(uptr chunk) { 112868d75effSDimitry Andric __asan::AsanChunk *m = __asan::instance.GetAsanChunkByAddrFastLocked(chunk); 1129*e8d8bef9SDimitry Andric return m ? m->Beg() : 0; 113068d75effSDimitry Andric } 113168d75effSDimitry Andric 113268d75effSDimitry Andric LsanMetadata::LsanMetadata(uptr chunk) { 1133*e8d8bef9SDimitry Andric metadata_ = chunk ? reinterpret_cast<void *>(chunk - __asan::kChunkHeaderSize) 1134*e8d8bef9SDimitry Andric : nullptr; 113568d75effSDimitry Andric } 113668d75effSDimitry Andric 113768d75effSDimitry Andric bool LsanMetadata::allocated() const { 1138*e8d8bef9SDimitry Andric if (!metadata_) 1139*e8d8bef9SDimitry Andric return false; 114068d75effSDimitry Andric __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_); 1141*e8d8bef9SDimitry Andric return atomic_load(&m->chunk_state, memory_order_relaxed) == 1142*e8d8bef9SDimitry Andric __asan::CHUNK_ALLOCATED; 114368d75effSDimitry Andric } 114468d75effSDimitry Andric 114568d75effSDimitry Andric ChunkTag LsanMetadata::tag() const { 114668d75effSDimitry Andric __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_); 114768d75effSDimitry Andric return static_cast<ChunkTag>(m->lsan_tag); 114868d75effSDimitry Andric } 114968d75effSDimitry Andric 115068d75effSDimitry Andric void LsanMetadata::set_tag(ChunkTag value) { 115168d75effSDimitry Andric __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_); 115268d75effSDimitry Andric m->lsan_tag = value; 115368d75effSDimitry Andric } 115468d75effSDimitry Andric 115568d75effSDimitry Andric uptr LsanMetadata::requested_size() const { 115668d75effSDimitry Andric __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_); 1157*e8d8bef9SDimitry Andric return m->UsedSize(); 115868d75effSDimitry Andric } 115968d75effSDimitry Andric 116068d75effSDimitry Andric u32 LsanMetadata::stack_trace_id() const { 116168d75effSDimitry Andric __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_); 1162*e8d8bef9SDimitry Andric u32 tid = 0; 1163*e8d8bef9SDimitry Andric u32 stack = 0; 1164*e8d8bef9SDimitry Andric m->GetAllocContext(tid, stack); 1165*e8d8bef9SDimitry Andric return stack; 116668d75effSDimitry Andric } 116768d75effSDimitry Andric 116868d75effSDimitry Andric void ForEachChunk(ForEachChunkCallback callback, void *arg) { 116968d75effSDimitry Andric __asan::get_allocator().ForEachChunk(callback, arg); 117068d75effSDimitry Andric } 117168d75effSDimitry Andric 117268d75effSDimitry Andric IgnoreObjectResult IgnoreObjectLocked(const void *p) { 117368d75effSDimitry Andric uptr addr = reinterpret_cast<uptr>(p); 117468d75effSDimitry Andric __asan::AsanChunk *m = __asan::instance.GetAsanChunkByAddr(addr); 1175*e8d8bef9SDimitry Andric if (!m || 1176*e8d8bef9SDimitry Andric (atomic_load(&m->chunk_state, memory_order_acquire) != 1177*e8d8bef9SDimitry Andric __asan::CHUNK_ALLOCATED) || 1178*e8d8bef9SDimitry Andric !m->AddrIsInside(addr)) { 1179*e8d8bef9SDimitry Andric return kIgnoreObjectInvalid; 1180*e8d8bef9SDimitry Andric } 118168d75effSDimitry Andric if (m->lsan_tag == kIgnored) 118268d75effSDimitry Andric return kIgnoreObjectAlreadyIgnored; 118368d75effSDimitry Andric m->lsan_tag = __lsan::kIgnored; 118468d75effSDimitry Andric return kIgnoreObjectSuccess; 118568d75effSDimitry Andric } 1186*e8d8bef9SDimitry Andric 1187*e8d8bef9SDimitry Andric void GetAdditionalThreadContextPtrs(ThreadContextBase *tctx, void *ptrs) { 1188*e8d8bef9SDimitry Andric // Look for the arg pointer of threads that have been created or are running. 1189*e8d8bef9SDimitry Andric // This is necessary to prevent false positive leaks due to the AsanThread 1190*e8d8bef9SDimitry Andric // holding the only live reference to a heap object. This can happen because 1191*e8d8bef9SDimitry Andric // the `pthread_create()` interceptor doesn't wait for the child thread to 1192*e8d8bef9SDimitry Andric // start before returning and thus loosing the the only live reference to the 1193*e8d8bef9SDimitry Andric // heap object on the stack. 1194*e8d8bef9SDimitry Andric 1195*e8d8bef9SDimitry Andric __asan::AsanThreadContext *atctx = 1196*e8d8bef9SDimitry Andric reinterpret_cast<__asan::AsanThreadContext *>(tctx); 1197*e8d8bef9SDimitry Andric __asan::AsanThread *asan_thread = atctx->thread; 1198*e8d8bef9SDimitry Andric 1199*e8d8bef9SDimitry Andric // Note ThreadStatusRunning is required because there is a small window where 1200*e8d8bef9SDimitry Andric // the thread status switches to `ThreadStatusRunning` but the `arg` pointer 1201*e8d8bef9SDimitry Andric // still isn't on the stack yet. 1202*e8d8bef9SDimitry Andric if (atctx->status != ThreadStatusCreated && 1203*e8d8bef9SDimitry Andric atctx->status != ThreadStatusRunning) 1204*e8d8bef9SDimitry Andric return; 1205*e8d8bef9SDimitry Andric 1206*e8d8bef9SDimitry Andric uptr thread_arg = reinterpret_cast<uptr>(asan_thread->get_arg()); 1207*e8d8bef9SDimitry Andric if (!thread_arg) 1208*e8d8bef9SDimitry Andric return; 1209*e8d8bef9SDimitry Andric 1210*e8d8bef9SDimitry Andric auto ptrsVec = reinterpret_cast<InternalMmapVector<uptr> *>(ptrs); 1211*e8d8bef9SDimitry Andric ptrsVec->push_back(thread_arg); 121268d75effSDimitry Andric } 1213*e8d8bef9SDimitry Andric 121468d75effSDimitry Andric } // namespace __lsan 121568d75effSDimitry Andric 121668d75effSDimitry Andric // ---------------------- Interface ---------------- {{{1 121768d75effSDimitry Andric using namespace __asan; 121868d75effSDimitry Andric 121968d75effSDimitry Andric // ASan allocator doesn't reserve extra bytes, so normally we would 122068d75effSDimitry Andric // just return "size". We don't want to expose our redzone sizes, etc here. 122168d75effSDimitry Andric uptr __sanitizer_get_estimated_allocated_size(uptr size) { 122268d75effSDimitry Andric return size; 122368d75effSDimitry Andric } 122468d75effSDimitry Andric 122568d75effSDimitry Andric int __sanitizer_get_ownership(const void *p) { 122668d75effSDimitry Andric uptr ptr = reinterpret_cast<uptr>(p); 122768d75effSDimitry Andric return instance.AllocationSize(ptr) > 0; 122868d75effSDimitry Andric } 122968d75effSDimitry Andric 123068d75effSDimitry Andric uptr __sanitizer_get_allocated_size(const void *p) { 123168d75effSDimitry Andric if (!p) return 0; 123268d75effSDimitry Andric uptr ptr = reinterpret_cast<uptr>(p); 123368d75effSDimitry Andric uptr allocated_size = instance.AllocationSize(ptr); 123468d75effSDimitry Andric // Die if p is not malloced or if it is already freed. 123568d75effSDimitry Andric if (allocated_size == 0) { 123668d75effSDimitry Andric GET_STACK_TRACE_FATAL_HERE; 123768d75effSDimitry Andric ReportSanitizerGetAllocatedSizeNotOwned(ptr, &stack); 123868d75effSDimitry Andric } 123968d75effSDimitry Andric return allocated_size; 124068d75effSDimitry Andric } 124168d75effSDimitry Andric 124268d75effSDimitry Andric void __sanitizer_purge_allocator() { 124368d75effSDimitry Andric GET_STACK_TRACE_MALLOC; 124468d75effSDimitry Andric instance.Purge(&stack); 124568d75effSDimitry Andric } 124668d75effSDimitry Andric 1247480093f4SDimitry Andric int __asan_update_allocation_context(void* addr) { 1248480093f4SDimitry Andric GET_STACK_TRACE_MALLOC; 1249480093f4SDimitry Andric return instance.UpdateAllocationStack((uptr)addr, &stack); 1250480093f4SDimitry Andric } 1251480093f4SDimitry Andric 125268d75effSDimitry Andric #if !SANITIZER_SUPPORTS_WEAK_HOOKS 125368d75effSDimitry Andric // Provide default (no-op) implementation of malloc hooks. 125468d75effSDimitry Andric SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_malloc_hook, 125568d75effSDimitry Andric void *ptr, uptr size) { 125668d75effSDimitry Andric (void)ptr; 125768d75effSDimitry Andric (void)size; 125868d75effSDimitry Andric } 125968d75effSDimitry Andric 126068d75effSDimitry Andric SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_free_hook, void *ptr) { 126168d75effSDimitry Andric (void)ptr; 126268d75effSDimitry Andric } 126368d75effSDimitry Andric #endif 1264