]>
Commit | Line | Data |
---|---|---|
f35db108 WM |
1 | //===-- asan_malloc_mac.cc ------------------------------------------------===// |
2 | // | |
3 | // This file is distributed under the University of Illinois Open Source | |
4 | // License. See LICENSE.TXT for details. | |
5 | // | |
6 | //===----------------------------------------------------------------------===// | |
7 | // | |
8 | // This file is a part of AddressSanitizer, an address sanity checker. | |
9 | // | |
10 | // Mac-specific malloc interception. | |
11 | //===----------------------------------------------------------------------===// | |
12 | ||
13 | #ifdef __APPLE__ | |
14 | ||
15 | #include <AvailabilityMacros.h> | |
16 | #include <CoreFoundation/CFBase.h> | |
17 | #include <dlfcn.h> | |
18 | #include <malloc/malloc.h> | |
19 | ||
20 | #include "asan_allocator.h" | |
21 | #include "asan_interceptors.h" | |
22 | #include "asan_internal.h" | |
23 | #include "asan_mac.h" | |
24 | #include "asan_report.h" | |
25 | #include "asan_stack.h" | |
26 | #include "asan_stats.h" | |
27 | #include "asan_thread_registry.h" | |
28 | ||
29 | // Similar code is used in Google Perftools, | |
30 | // http://code.google.com/p/google-perftools. | |
31 | ||
32 | // ---------------------- Replacement functions ---------------- {{{1 | |
33 | using namespace __asan; // NOLINT | |
34 | ||
35 | // TODO(glider): do we need both zones? | |
36 | static malloc_zone_t *system_malloc_zone = 0; | |
37 | static malloc_zone_t *system_purgeable_zone = 0; | |
38 | static malloc_zone_t asan_zone; | |
39 | CFAllocatorRef cf_asan = 0; | |
40 | ||
41 | // _CFRuntimeCreateInstance() checks whether the supplied allocator is | |
42 | // kCFAllocatorSystemDefault and, if it is not, stores the allocator reference | |
43 | // at the beginning of the allocated memory and returns the pointer to the | |
44 | // allocated memory plus sizeof(CFAllocatorRef). See | |
45 | // http://www.opensource.apple.com/source/CF/CF-635.21/CFRuntime.c | |
46 | // Pointers returned by _CFRuntimeCreateInstance() can then be passed directly | |
47 | // to free() or CFAllocatorDeallocate(), which leads to false invalid free | |
48 | // reports. | |
49 | // The corresponding rdar bug is http://openradar.appspot.com/radar?id=1796404. | |
50 | void* ALWAYS_INLINE get_saved_cfallocator_ref(void *ptr) { | |
51 | if (flags()->replace_cfallocator) { | |
52 | // Make sure we're not hitting the previous page. This may be incorrect | |
53 | // if ASan's malloc returns an address ending with 0xFF8, which will be | |
54 | // then padded to a page boundary with a CFAllocatorRef. | |
55 | uptr arith_ptr = (uptr)ptr; | |
56 | if ((arith_ptr & 0xFFF) > sizeof(CFAllocatorRef)) { | |
57 | CFAllocatorRef *saved = | |
58 | (CFAllocatorRef*)(arith_ptr - sizeof(CFAllocatorRef)); | |
59 | if ((*saved == cf_asan) && asan_mz_size(saved)) ptr = (void*)saved; | |
60 | } | |
61 | } | |
62 | return ptr; | |
63 | } | |
64 | ||
65 | // The free() implementation provided by OS X calls malloc_zone_from_ptr() | |
66 | // to find the owner of |ptr|. If the result is 0, an invalid free() is | |
67 | // reported. Our implementation falls back to asan_free() in this case | |
68 | // in order to print an ASan-style report. | |
69 | // | |
70 | // For the objects created by _CFRuntimeCreateInstance a CFAllocatorRef is | |
71 | // placed at the beginning of the allocated chunk and the pointer returned by | |
72 | // our allocator is off by sizeof(CFAllocatorRef). This pointer can be then | |
73 | // passed directly to free(), which will lead to errors. | |
74 | // To overcome this we're checking whether |ptr-sizeof(CFAllocatorRef)| | |
75 | // contains a pointer to our CFAllocator (assuming no other allocator is used). | |
76 | // See http://code.google.com/p/address-sanitizer/issues/detail?id=70 for more | |
77 | // info. | |
78 | INTERCEPTOR(void, free, void *ptr) { | |
79 | malloc_zone_t *zone = malloc_zone_from_ptr(ptr); | |
80 | if (zone) { | |
81 | #if defined(MAC_OS_X_VERSION_10_6) && \ | |
82 | MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 | |
83 | if ((zone->version >= 6) && (zone->free_definite_size)) { | |
84 | zone->free_definite_size(zone, ptr, malloc_size(ptr)); | |
85 | } else { | |
86 | malloc_zone_free(zone, ptr); | |
87 | } | |
88 | #else | |
89 | malloc_zone_free(zone, ptr); | |
90 | #endif | |
91 | } else { | |
92 | if (!asan_mz_size(ptr)) ptr = get_saved_cfallocator_ref(ptr); | |
e9772e16 KS |
93 | GET_STACK_TRACE_FREE; |
94 | asan_free(ptr, &stack, FROM_MALLOC); | |
f35db108 WM |
95 | } |
96 | } | |
97 | ||
f35db108 WM |
98 | // We can't always replace the default CFAllocator with cf_asan right in |
99 | // ReplaceSystemMalloc(), because it is sometimes called before | |
100 | // __CFInitialize(), when the default allocator is invalid and replacing it may | |
101 | // crash the program. Instead we wait for the allocator to initialize and jump | |
102 | // in just after __CFInitialize(). Nobody is going to allocate memory using | |
103 | // CFAllocators before that, so we won't miss anything. | |
104 | // | |
105 | // See http://code.google.com/p/address-sanitizer/issues/detail?id=87 | |
106 | // and http://opensource.apple.com/source/CF/CF-550.43/CFRuntime.c | |
107 | INTERCEPTOR(void, __CFInitialize, void) { | |
108 | // If the runtime is built as dynamic library, __CFInitialize wrapper may be | |
109 | // called before __asan_init. | |
110 | #if !MAC_INTERPOSE_FUNCTIONS | |
111 | CHECK(flags()->replace_cfallocator); | |
112 | CHECK(asan_inited); | |
113 | #endif | |
114 | REAL(__CFInitialize)(); | |
e297eb60 | 115 | if (!cf_asan && asan_inited) MaybeReplaceCFAllocator(); |
f35db108 WM |
116 | } |
117 | ||
118 | namespace { | |
119 | ||
120 | // TODO(glider): the mz_* functions should be united with the Linux wrappers, | |
121 | // as they are basically copied from there. | |
122 | size_t mz_size(malloc_zone_t* zone, const void* ptr) { | |
123 | return asan_mz_size(ptr); | |
124 | } | |
125 | ||
126 | void *mz_malloc(malloc_zone_t *zone, size_t size) { | |
127 | if (!asan_inited) { | |
128 | CHECK(system_malloc_zone); | |
129 | return malloc_zone_malloc(system_malloc_zone, size); | |
130 | } | |
e9772e16 | 131 | GET_STACK_TRACE_MALLOC; |
f35db108 WM |
132 | return asan_malloc(size, &stack); |
133 | } | |
134 | ||
135 | void *cf_malloc(CFIndex size, CFOptionFlags hint, void *info) { | |
136 | if (!asan_inited) { | |
137 | CHECK(system_malloc_zone); | |
138 | return malloc_zone_malloc(system_malloc_zone, size); | |
139 | } | |
e9772e16 | 140 | GET_STACK_TRACE_MALLOC; |
f35db108 WM |
141 | return asan_malloc(size, &stack); |
142 | } | |
143 | ||
144 | void *mz_calloc(malloc_zone_t *zone, size_t nmemb, size_t size) { | |
145 | if (!asan_inited) { | |
146 | // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym. | |
147 | const size_t kCallocPoolSize = 1024; | |
148 | static uptr calloc_memory_for_dlsym[kCallocPoolSize]; | |
149 | static size_t allocated; | |
150 | size_t size_in_words = ((nmemb * size) + kWordSize - 1) / kWordSize; | |
151 | void *mem = (void*)&calloc_memory_for_dlsym[allocated]; | |
152 | allocated += size_in_words; | |
153 | CHECK(allocated < kCallocPoolSize); | |
154 | return mem; | |
155 | } | |
e9772e16 | 156 | GET_STACK_TRACE_MALLOC; |
f35db108 WM |
157 | return asan_calloc(nmemb, size, &stack); |
158 | } | |
159 | ||
160 | void *mz_valloc(malloc_zone_t *zone, size_t size) { | |
161 | if (!asan_inited) { | |
162 | CHECK(system_malloc_zone); | |
163 | return malloc_zone_valloc(system_malloc_zone, size); | |
164 | } | |
e9772e16 KS |
165 | GET_STACK_TRACE_MALLOC; |
166 | return asan_memalign(GetPageSizeCached(), size, &stack, FROM_MALLOC); | |
f35db108 WM |
167 | } |
168 | ||
169 | #define GET_ZONE_FOR_PTR(ptr) \ | |
170 | malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); \ | |
171 | const char *zone_name = (zone_ptr == 0) ? 0 : zone_ptr->zone_name | |
172 | ||
173 | void ALWAYS_INLINE free_common(void *context, void *ptr) { | |
174 | if (!ptr) return; | |
175 | if (asan_mz_size(ptr)) { | |
e9772e16 KS |
176 | GET_STACK_TRACE_FREE; |
177 | asan_free(ptr, &stack, FROM_MALLOC); | |
f35db108 WM |
178 | } else { |
179 | // If the pointer does not belong to any of the zones, use one of the | |
180 | // fallback methods to free memory. | |
181 | malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); | |
182 | if (zone_ptr == system_purgeable_zone) { | |
183 | // allocations from malloc_default_purgeable_zone() done before | |
184 | // __asan_init() may be occasionally freed via free_common(). | |
185 | // see http://code.google.com/p/address-sanitizer/issues/detail?id=99. | |
186 | malloc_zone_free(zone_ptr, ptr); | |
187 | } else { | |
188 | // If the memory chunk pointer was moved to store additional | |
189 | // CFAllocatorRef, fix it back. | |
190 | ptr = get_saved_cfallocator_ref(ptr); | |
e9772e16 | 191 | GET_STACK_TRACE_FREE; |
f35db108 | 192 | if (!flags()->mac_ignore_invalid_free) { |
e9772e16 | 193 | asan_free(ptr, &stack, FROM_MALLOC); |
f35db108 WM |
194 | } else { |
195 | GET_ZONE_FOR_PTR(ptr); | |
196 | WarnMacFreeUnallocated((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); | |
197 | return; | |
198 | } | |
199 | } | |
200 | } | |
201 | } | |
202 | ||
203 | // TODO(glider): the allocation callbacks need to be refactored. | |
204 | void mz_free(malloc_zone_t *zone, void *ptr) { | |
205 | free_common(zone, ptr); | |
206 | } | |
207 | ||
208 | void cf_free(void *ptr, void *info) { | |
209 | free_common(info, ptr); | |
210 | } | |
211 | ||
212 | void *mz_realloc(malloc_zone_t *zone, void *ptr, size_t size) { | |
213 | if (!ptr) { | |
e9772e16 | 214 | GET_STACK_TRACE_MALLOC; |
f35db108 WM |
215 | return asan_malloc(size, &stack); |
216 | } else { | |
217 | if (asan_mz_size(ptr)) { | |
e9772e16 | 218 | GET_STACK_TRACE_MALLOC; |
f35db108 WM |
219 | return asan_realloc(ptr, size, &stack); |
220 | } else { | |
221 | // We can't recover from reallocating an unknown address, because | |
222 | // this would require reading at most |size| bytes from | |
223 | // potentially unaccessible memory. | |
e9772e16 | 224 | GET_STACK_TRACE_FREE; |
f35db108 WM |
225 | GET_ZONE_FOR_PTR(ptr); |
226 | ReportMacMzReallocUnknown((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); | |
227 | } | |
228 | } | |
229 | } | |
230 | ||
231 | void *cf_realloc(void *ptr, CFIndex size, CFOptionFlags hint, void *info) { | |
232 | if (!ptr) { | |
e9772e16 | 233 | GET_STACK_TRACE_MALLOC; |
f35db108 WM |
234 | return asan_malloc(size, &stack); |
235 | } else { | |
236 | if (asan_mz_size(ptr)) { | |
e9772e16 | 237 | GET_STACK_TRACE_MALLOC; |
f35db108 WM |
238 | return asan_realloc(ptr, size, &stack); |
239 | } else { | |
240 | // We can't recover from reallocating an unknown address, because | |
241 | // this would require reading at most |size| bytes from | |
242 | // potentially unaccessible memory. | |
e9772e16 | 243 | GET_STACK_TRACE_FREE; |
f35db108 WM |
244 | GET_ZONE_FOR_PTR(ptr); |
245 | ReportMacCfReallocUnknown((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); | |
246 | } | |
247 | } | |
248 | } | |
249 | ||
250 | void mz_destroy(malloc_zone_t* zone) { | |
251 | // A no-op -- we will not be destroyed! | |
252 | Printf("mz_destroy() called -- ignoring\n"); | |
253 | } | |
254 | // from AvailabilityMacros.h | |
255 | #if defined(MAC_OS_X_VERSION_10_6) && \ | |
256 | MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 | |
257 | void *mz_memalign(malloc_zone_t *zone, size_t align, size_t size) { | |
258 | if (!asan_inited) { | |
259 | CHECK(system_malloc_zone); | |
260 | return malloc_zone_memalign(system_malloc_zone, align, size); | |
261 | } | |
e9772e16 KS |
262 | GET_STACK_TRACE_MALLOC; |
263 | return asan_memalign(align, size, &stack, FROM_MALLOC); | |
f35db108 WM |
264 | } |
265 | ||
266 | // This function is currently unused, and we build with -Werror. | |
267 | #if 0 | |
268 | void mz_free_definite_size(malloc_zone_t* zone, void *ptr, size_t size) { | |
269 | // TODO(glider): check that |size| is valid. | |
270 | UNIMPLEMENTED(); | |
271 | } | |
272 | #endif | |
273 | #endif | |
274 | ||
275 | kern_return_t mi_enumerator(task_t task, void *, | |
276 | unsigned type_mask, vm_address_t zone_address, | |
277 | memory_reader_t reader, | |
278 | vm_range_recorder_t recorder) { | |
279 | // Should enumerate all the pointers we have. Seems like a lot of work. | |
280 | return KERN_FAILURE; | |
281 | } | |
282 | ||
283 | size_t mi_good_size(malloc_zone_t *zone, size_t size) { | |
284 | // I think it's always safe to return size, but we maybe could do better. | |
285 | return size; | |
286 | } | |
287 | ||
288 | boolean_t mi_check(malloc_zone_t *zone) { | |
289 | UNIMPLEMENTED(); | |
f35db108 WM |
290 | } |
291 | ||
292 | void mi_print(malloc_zone_t *zone, boolean_t verbose) { | |
293 | UNIMPLEMENTED(); | |
f35db108 WM |
294 | } |
295 | ||
296 | void mi_log(malloc_zone_t *zone, void *address) { | |
297 | // I don't think we support anything like this | |
298 | } | |
299 | ||
300 | void mi_force_lock(malloc_zone_t *zone) { | |
301 | asan_mz_force_lock(); | |
302 | } | |
303 | ||
304 | void mi_force_unlock(malloc_zone_t *zone) { | |
305 | asan_mz_force_unlock(); | |
306 | } | |
307 | ||
308 | void mi_statistics(malloc_zone_t *zone, malloc_statistics_t *stats) { | |
309 | AsanMallocStats malloc_stats; | |
310 | asanThreadRegistry().FillMallocStatistics(&malloc_stats); | |
311 | CHECK(sizeof(malloc_statistics_t) == sizeof(AsanMallocStats)); | |
312 | internal_memcpy(stats, &malloc_stats, sizeof(malloc_statistics_t)); | |
313 | } | |
314 | ||
315 | #if defined(MAC_OS_X_VERSION_10_6) && \ | |
316 | MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 | |
317 | boolean_t mi_zone_locked(malloc_zone_t *zone) { | |
318 | // UNIMPLEMENTED(); | |
319 | return false; | |
320 | } | |
321 | #endif | |
322 | ||
323 | } // unnamed namespace | |
324 | ||
325 | extern int __CFRuntimeClassTableSize; | |
326 | ||
327 | namespace __asan { | |
e297eb60 | 328 | void MaybeReplaceCFAllocator() { |
f35db108 WM |
329 | static CFAllocatorContext asan_context = { |
330 | /*version*/ 0, /*info*/ &asan_zone, | |
331 | /*retain*/ 0, /*release*/ 0, | |
332 | /*copyDescription*/0, | |
333 | /*allocate*/ &cf_malloc, | |
334 | /*reallocate*/ &cf_realloc, | |
335 | /*deallocate*/ &cf_free, | |
336 | /*preferredSize*/ 0 }; | |
337 | if (!cf_asan) | |
338 | cf_asan = CFAllocatorCreate(kCFAllocatorUseContext, &asan_context); | |
e297eb60 | 339 | if (flags()->replace_cfallocator && CFAllocatorGetDefault() != cf_asan) |
f35db108 WM |
340 | CFAllocatorSetDefault(cf_asan); |
341 | } | |
342 | ||
343 | void ReplaceSystemMalloc() { | |
344 | static malloc_introspection_t asan_introspection; | |
345 | // Ok to use internal_memset, these places are not performance-critical. | |
346 | internal_memset(&asan_introspection, 0, sizeof(asan_introspection)); | |
347 | ||
348 | asan_introspection.enumerator = &mi_enumerator; | |
349 | asan_introspection.good_size = &mi_good_size; | |
350 | asan_introspection.check = &mi_check; | |
351 | asan_introspection.print = &mi_print; | |
352 | asan_introspection.log = &mi_log; | |
353 | asan_introspection.force_lock = &mi_force_lock; | |
354 | asan_introspection.force_unlock = &mi_force_unlock; | |
355 | asan_introspection.statistics = &mi_statistics; | |
356 | ||
357 | internal_memset(&asan_zone, 0, sizeof(malloc_zone_t)); | |
358 | ||
359 | // Start with a version 4 zone which is used for OS X 10.4 and 10.5. | |
360 | asan_zone.version = 4; | |
361 | asan_zone.zone_name = "asan"; | |
362 | asan_zone.size = &mz_size; | |
363 | asan_zone.malloc = &mz_malloc; | |
364 | asan_zone.calloc = &mz_calloc; | |
365 | asan_zone.valloc = &mz_valloc; | |
366 | asan_zone.free = &mz_free; | |
367 | asan_zone.realloc = &mz_realloc; | |
368 | asan_zone.destroy = &mz_destroy; | |
369 | asan_zone.batch_malloc = 0; | |
370 | asan_zone.batch_free = 0; | |
371 | asan_zone.introspect = &asan_introspection; | |
372 | ||
373 | // from AvailabilityMacros.h | |
374 | #if defined(MAC_OS_X_VERSION_10_6) && \ | |
375 | MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 | |
376 | // Switch to version 6 on OSX 10.6 to support memalign. | |
377 | asan_zone.version = 6; | |
378 | asan_zone.free_definite_size = 0; | |
379 | asan_zone.memalign = &mz_memalign; | |
380 | asan_introspection.zone_locked = &mi_zone_locked; | |
381 | ||
382 | // Request the default purgable zone to force its creation. The | |
383 | // current default zone is registered with the purgable zone for | |
384 | // doing tiny and small allocs. Sadly, it assumes that the default | |
385 | // zone is the szone implementation from OS X and will crash if it | |
386 | // isn't. By creating the zone now, this will be true and changing | |
387 | // the default zone won't cause a problem. (OS X 10.6 and higher.) | |
388 | system_purgeable_zone = malloc_default_purgeable_zone(); | |
389 | #endif | |
390 | ||
391 | // Register the ASan zone. At this point, it will not be the | |
392 | // default zone. | |
393 | malloc_zone_register(&asan_zone); | |
394 | ||
395 | // Unregister and reregister the default zone. Unregistering swaps | |
396 | // the specified zone with the last one registered which for the | |
397 | // default zone makes the more recently registered zone the default | |
398 | // zone. The default zone is then re-registered to ensure that | |
399 | // allocations made from it earlier will be handled correctly. | |
400 | // Things are not guaranteed to work that way, but it's how they work now. | |
401 | system_malloc_zone = malloc_default_zone(); | |
402 | malloc_zone_unregister(system_malloc_zone); | |
403 | malloc_zone_register(system_malloc_zone); | |
404 | // Make sure the default allocator was replaced. | |
405 | CHECK(malloc_default_zone() == &asan_zone); | |
406 | ||
e297eb60 KS |
407 | // If __CFInitialize() hasn't been called yet, cf_asan will be created and |
408 | // installed as the default allocator after __CFInitialize() finishes (see | |
409 | // the interceptor for __CFInitialize() above). Otherwise install cf_asan | |
410 | // right now. On both Snow Leopard and Lion __CFInitialize() calls | |
411 | // __CFAllocatorInitialize(), which initializes the _base._cfisa field of | |
412 | // the default allocators we check here. | |
413 | if (((CFRuntimeBase*)kCFAllocatorSystemDefault)->_cfisa) { | |
414 | MaybeReplaceCFAllocator(); | |
f35db108 WM |
415 | } |
416 | } | |
417 | } // namespace __asan | |
418 | ||
419 | #endif // __APPLE__ |