1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // Error logging entry points for the UBSan runtime, which are only used for C++
11 // compilations. This file is permitted to use language features which require
12 // linking against a C++ ABI library.
13 //
14 //===----------------------------------------------------------------------===//
15
16 #include "ubsan_platform.h"
17 #if CAN_SANITIZE_UB
18 #include "ubsan_handlers.h"
19 #include "ubsan_handlers_cxx.h"
20 #include "ubsan_diag.h"
21 #include "ubsan_type_hash.h"
22
23 #include "sanitizer_common/sanitizer_common.h"
24 #include "sanitizer_common/sanitizer_suppressions.h"
25
26 using namespace __sanitizer;
27 using namespace __ubsan;
28
29 namespace __ubsan {
30 extern const char *TypeCheckKinds[];
31 }
32
33 // Returns true if UBSan has printed an error report.
HandleDynamicTypeCacheMiss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash,ReportOptions Opts)34 static bool HandleDynamicTypeCacheMiss(
35 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
36 ReportOptions Opts) {
37 if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
38 // Just a cache miss. The type matches after all.
39 return false;
40
41 // Check if error report should be suppressed.
42 DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
43 if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
44 return false;
45
46 SourceLocation Loc = Data->Loc.acquire();
47 ErrorType ET = ErrorType::DynamicTypeMismatch;
48 if (ignoreReport(Loc, Opts, ET))
49 return false;
50
51 ScopedReport R(Opts, Loc, ET);
52
53 Diag(Loc, DL_Error, ET,
54 "%0 address %1 which does not point to an object of type %2")
55 << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
56
57 // If possible, say what type it actually points to.
58 if (!DTI.isValid()) {
59 if (DTI.getOffset() < -VptrMaxOffsetToTop || DTI.getOffset() > VptrMaxOffsetToTop) {
60 Diag(Pointer, DL_Note, ET,
61 "object has a possibly invalid vptr: abs(offset to top) too big")
62 << TypeName(DTI.getMostDerivedTypeName())
63 << Range(Pointer, Pointer + sizeof(uptr), "possibly invalid vptr");
64 } else {
65 Diag(Pointer, DL_Note, ET, "object has invalid vptr")
66 << TypeName(DTI.getMostDerivedTypeName())
67 << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
68 }
69 } else if (!DTI.getOffset())
70 Diag(Pointer, DL_Note, ET, "object is of type %0")
71 << TypeName(DTI.getMostDerivedTypeName())
72 << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
73 else
74 // FIXME: Find the type at the specified offset, and include that
75 // in the note.
76 Diag(Pointer - DTI.getOffset(), DL_Note, ET,
77 "object is base class subobject at offset %0 within object of type %1")
78 << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
79 << TypeName(DTI.getSubobjectTypeName())
80 << Range(Pointer, Pointer + sizeof(uptr),
81 "vptr for %2 base class of %1");
82 return true;
83 }
84
__ubsan_handle_dynamic_type_cache_miss(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)85 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
86 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
87 GET_REPORT_OPTIONS(false);
88 HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
89 }
__ubsan_handle_dynamic_type_cache_miss_abort(DynamicTypeCacheMissData * Data,ValueHandle Pointer,ValueHandle Hash)90 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
91 DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
92 // Note: -fsanitize=vptr is always recoverable.
93 GET_REPORT_OPTIONS(false);
94 if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts))
95 Die();
96 }
97
98 namespace __ubsan {
__ubsan_handle_cfi_bad_type(CFICheckFailData * Data,ValueHandle Vtable,bool ValidVtable,ReportOptions Opts)99 void __ubsan_handle_cfi_bad_type(CFICheckFailData *Data, ValueHandle Vtable,
100 bool ValidVtable, ReportOptions Opts) {
101 SourceLocation Loc = Data->Loc.acquire();
102 ErrorType ET = ErrorType::CFIBadType;
103
104 if (ignoreReport(Loc, Opts, ET))
105 return;
106
107 ScopedReport R(Opts, Loc, ET);
108 DynamicTypeInfo DTI = ValidVtable
109 ? getDynamicTypeInfoFromVtable((void *)Vtable)
110 : DynamicTypeInfo(0, 0, 0);
111
112 const char *CheckKindStr;
113 switch (Data->CheckKind) {
114 case CFITCK_VCall:
115 CheckKindStr = "virtual call";
116 break;
117 case CFITCK_NVCall:
118 CheckKindStr = "non-virtual call";
119 break;
120 case CFITCK_DerivedCast:
121 CheckKindStr = "base-to-derived cast";
122 break;
123 case CFITCK_UnrelatedCast:
124 CheckKindStr = "cast to unrelated type";
125 break;
126 case CFITCK_VMFCall:
127 CheckKindStr = "virtual pointer to member function call";
128 break;
129 case CFITCK_ICall:
130 case CFITCK_NVMFCall:
131 Die();
132 }
133
134 Diag(Loc, DL_Error, ET,
135 "control flow integrity check for type %0 failed during "
136 "%1 (vtable address %2)")
137 << Data->Type << CheckKindStr << (void *)Vtable;
138
139 // If possible, say what type it actually points to.
140 if (!DTI.isValid())
141 Diag(Vtable, DL_Note, ET, "invalid vtable");
142 else
143 Diag(Vtable, DL_Note, ET, "vtable is of type %0")
144 << TypeName(DTI.getMostDerivedTypeName());
145
146 // If the failure involved different DSOs for the check location and vtable,
147 // report the DSO names.
148 const char *DstModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Vtable);
149 if (!DstModule)
150 DstModule = "(unknown)";
151
152 const char *SrcModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Opts.pc);
153 if (!SrcModule)
154 SrcModule = "(unknown)";
155
156 if (internal_strcmp(SrcModule, DstModule))
157 Diag(Loc, DL_Note, ET, "check failed in %0, vtable located in %1")
158 << SrcModule << DstModule;
159 }
160 } // namespace __ubsan
161
162 #endif // CAN_SANITIZE_UB
163