1//===-- asan_descriptions.cpp -----------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11// ASan functions for getting information about an address and/or printing it.
12//===----------------------------------------------------------------------===//
13
14#include "asan_descriptions.h"
15#include "asan_mapping.h"
16#include "asan_report.h"
17#include "asan_stack.h"
18#include "sanitizer_common/sanitizer_stackdepot.h"
19
20namespace __asan {
21
22AsanThreadIdAndName::AsanThreadIdAndName(AsanThreadContext *t) {
23  Init(t->tid, t->name);
24}
25
26AsanThreadIdAndName::AsanThreadIdAndName(u32 tid) {
27  if (tid == kInvalidTid) {
28    Init(tid, "");
29  } else {
30    asanThreadRegistry().CheckLocked();
31    AsanThreadContext *t = GetThreadContextByTidLocked(tid);
32    Init(tid, t->name);
33  }
34}
35
36void AsanThreadIdAndName::Init(u32 tid, const char *tname) {
37  int len = internal_snprintf(name, sizeof(name), "T%d", tid);
38  CHECK(((unsigned int)len) < sizeof(name));
39  if (tname[0] != '\0')
40    internal_snprintf(&name[len], sizeof(name) - len, " (%s)", tname);
41}
42
43void DescribeThread(AsanThreadContext *context) {
44  CHECK(context);
45  asanThreadRegistry().CheckLocked();
46  // No need to announce the main thread.
47  if (context->tid == 0 || context->announced) {
48    return;
49  }
50  context->announced = true;
51  InternalScopedString str(1024);
52  str.append("Thread %s", AsanThreadIdAndName(context).c_str());
53  if (context->parent_tid == kInvalidTid) {
54    str.append(" created by unknown thread\n");
55    Printf("%s", str.data());
56    return;
57  }
58  str.append(" created by %s here:\n",
59             AsanThreadIdAndName(context->parent_tid).c_str());
60  Printf("%s", str.data());
61  StackDepotGet(context->stack_id).Print();
62  // Recursively described parent thread if needed.
63  if (flags()->print_full_thread_history) {
64    AsanThreadContext *parent_context =
65        GetThreadContextByTidLocked(context->parent_tid);
66    DescribeThread(parent_context);
67  }
68}
69
70// Shadow descriptions
71static bool GetShadowKind(uptr addr, ShadowKind *shadow_kind) {
72  CHECK(!AddrIsInMem(addr));
73  if (AddrIsInShadowGap(addr)) {
74    *shadow_kind = kShadowKindGap;
75  } else if (AddrIsInHighShadow(addr)) {
76    *shadow_kind = kShadowKindHigh;
77  } else if (AddrIsInLowShadow(addr)) {
78    *shadow_kind = kShadowKindLow;
79  } else {
80    CHECK(0 && "Address is not in memory and not in shadow?");
81    return false;
82  }
83  return true;
84}
85
86bool DescribeAddressIfShadow(uptr addr) {
87  ShadowAddressDescription descr;
88  if (!GetShadowAddressInformation(addr, &descr)) return false;
89  descr.Print();
90  return true;
91}
92
93bool GetShadowAddressInformation(uptr addr, ShadowAddressDescription *descr) {
94  if (AddrIsInMem(addr)) return false;
95  ShadowKind shadow_kind;
96  if (!GetShadowKind(addr, &shadow_kind)) return false;
97  if (shadow_kind != kShadowKindGap) descr->shadow_byte = *(u8 *)addr;
98  descr->addr = addr;
99  descr->kind = shadow_kind;
100  return true;
101}
102
103// Heap descriptions
104static void GetAccessToHeapChunkInformation(ChunkAccess *descr,
105                                            AsanChunkView chunk, uptr addr,
106                                            uptr access_size) {
107  descr->bad_addr = addr;
108  if (chunk.AddrIsAtLeft(addr, access_size, &descr->offset)) {
109    descr->access_type = kAccessTypeLeft;
110  } else if (chunk.AddrIsAtRight(addr, access_size, &descr->offset)) {
111    descr->access_type = kAccessTypeRight;
112    if (descr->offset < 0) {
113      descr->bad_addr -= descr->offset;
114      descr->offset = 0;
115    }
116  } else if (chunk.AddrIsInside(addr, access_size, &descr->offset)) {
117    descr->access_type = kAccessTypeInside;
118  } else {
119    descr->access_type = kAccessTypeUnknown;
120  }
121  descr->chunk_begin = chunk.Beg();
122  descr->chunk_size = chunk.UsedSize();
123  descr->user_requested_alignment = chunk.UserRequestedAlignment();
124  descr->alloc_type = chunk.GetAllocType();
125}
126
127static void PrintHeapChunkAccess(uptr addr, const ChunkAccess &descr) {
128  Decorator d;
129  InternalScopedString str(4096);
130  str.append("%s", d.Location());
131  switch (descr.access_type) {
132    case kAccessTypeLeft:
133      str.append("%p is located %zd bytes to the left of",
134                 (void *)descr.bad_addr, descr.offset);
135      break;
136    case kAccessTypeRight:
137      str.append("%p is located %zd bytes to the right of",
138                 (void *)descr.bad_addr, descr.offset);
139      break;
140    case kAccessTypeInside:
141      str.append("%p is located %zd bytes inside of", (void *)descr.bad_addr,
142                 descr.offset);
143      break;
144    case kAccessTypeUnknown:
145      str.append(
146          "%p is located somewhere around (this is AddressSanitizer bug!)",
147          (void *)descr.bad_addr);
148  }
149  str.append(" %zu-byte region [%p,%p)\n", descr.chunk_size,
150             (void *)descr.chunk_begin,
151             (void *)(descr.chunk_begin + descr.chunk_size));
152  str.append("%s", d.Default());
153  Printf("%s", str.data());
154}
155
156bool GetHeapAddressInformation(uptr addr, uptr access_size,
157                               HeapAddressDescription *descr) {
158  AsanChunkView chunk = FindHeapChunkByAddress(addr);
159  if (!chunk.IsValid()) {
160    return false;
161  }
162  descr->addr = addr;
163  GetAccessToHeapChunkInformation(&descr->chunk_access, chunk, addr,
164                                  access_size);
165  CHECK_NE(chunk.AllocTid(), kInvalidTid);
166  descr->alloc_tid = chunk.AllocTid();
167  descr->alloc_stack_id = chunk.GetAllocStackId();
168  descr->free_tid = chunk.FreeTid();
169  if (descr->free_tid != kInvalidTid)
170    descr->free_stack_id = chunk.GetFreeStackId();
171  return true;
172}
173
174static StackTrace GetStackTraceFromId(u32 id) {
175  CHECK(id);
176  StackTrace res = StackDepotGet(id);
177  CHECK(res.trace);
178  return res;
179}
180
181bool DescribeAddressIfHeap(uptr addr, uptr access_size) {
182  HeapAddressDescription descr;
183  if (!GetHeapAddressInformation(addr, access_size, &descr)) {
184    Printf(
185        "AddressSanitizer can not describe address in more detail "
186        "(wild memory access suspected).\n");
187    return false;
188  }
189  descr.Print();
190  return true;
191}
192
193// Stack descriptions
194bool GetStackAddressInformation(uptr addr, uptr access_size,
195                                StackAddressDescription *descr) {
196  AsanThread *t = FindThreadByStackAddress(addr);
197  if (!t) return false;
198
199  descr->addr = addr;
200  descr->tid = t->tid();
201  // Try to fetch precise stack frame for this access.
202  AsanThread::StackFrameAccess access;
203  if (!t->GetStackFrameAccessByAddr(addr, &access)) {
204    descr->frame_descr = nullptr;
205    return true;
206  }
207
208  descr->offset = access.offset;
209  descr->access_size = access_size;
210  descr->frame_pc = access.frame_pc;
211  descr->frame_descr = access.frame_descr;
212
213#if SANITIZER_PPC64V1
214  // On PowerPC64 ELFv1, the address of a function actually points to a
215  // three-doubleword data structure with the first field containing
216  // the address of the function's code.
217  descr->frame_pc = *reinterpret_cast<uptr *>(descr->frame_pc);
218#endif
219  descr->frame_pc += 16;
220
221  return true;
222}
223
224static void PrintAccessAndVarIntersection(const StackVarDescr &var, uptr addr,
225                                          uptr access_size, uptr prev_var_end,
226                                          uptr next_var_beg) {
227  uptr var_end = var.beg + var.size;
228  uptr addr_end = addr + access_size;
229  const char *pos_descr = nullptr;
230  // If the variable [var.beg, var_end) is the nearest variable to the
231  // current memory access, indicate it in the log.
232  if (addr >= var.beg) {
233    if (addr_end <= var_end)
234      pos_descr = "is inside";  // May happen if this is a use-after-return.
235    else if (addr < var_end)
236      pos_descr = "partially overflows";
237    else if (addr_end <= next_var_beg &&
238             next_var_beg - addr_end >= addr - var_end)
239      pos_descr = "overflows";
240  } else {
241    if (addr_end > var.beg)
242      pos_descr = "partially underflows";
243    else if (addr >= prev_var_end && addr - prev_var_end >= var.beg - addr_end)
244      pos_descr = "underflows";
245  }
246  InternalScopedString str(1024);
247  str.append("    [%zd, %zd)", var.beg, var_end);
248  // Render variable name.
249  str.append(" '");
250  for (uptr i = 0; i < var.name_len; ++i) {
251    str.append("%c", var.name_pos[i]);
252  }
253  str.append("'");
254  if (var.line > 0) {
255    str.append(" (line %d)", var.line);
256  }
257  if (pos_descr) {
258    Decorator d;
259    // FIXME: we may want to also print the size of the access here,
260    // but in case of accesses generated by memset it may be confusing.
261    str.append("%s <== Memory access at offset %zd %s this variable%s\n",
262               d.Location(), addr, pos_descr, d.Default());
263  } else {
264    str.append("\n");
265  }
266  Printf("%s", str.data());
267}
268
269bool DescribeAddressIfStack(uptr addr, uptr access_size) {
270  StackAddressDescription descr;
271  if (!GetStackAddressInformation(addr, access_size, &descr)) return false;
272  descr.Print();
273  return true;
274}
275
276// Global descriptions
277static void DescribeAddressRelativeToGlobal(uptr addr, uptr access_size,
278                                            const __asan_global &g) {
279  InternalScopedString str(4096);
280  Decorator d;
281  str.append("%s", d.Location());
282  if (addr < g.beg) {
283    str.append("%p is located %zd bytes to the left", (void *)addr,
284               g.beg - addr);
285  } else if (addr + access_size > g.beg + g.size) {
286    if (addr < g.beg + g.size) addr = g.beg + g.size;
287    str.append("%p is located %zd bytes to the right", (void *)addr,
288               addr - (g.beg + g.size));
289  } else {
290    // Can it happen?
291    str.append("%p is located %zd bytes inside", (void *)addr, addr - g.beg);
292  }
293  str.append(" of global variable '%s' defined in '",
294             MaybeDemangleGlobalName(g.name));
295  PrintGlobalLocation(&str, g);
296  str.append("' (0x%zx) of size %zu\n", g.beg, g.size);
297  str.append("%s", d.Default());
298  PrintGlobalNameIfASCII(&str, g);
299  Printf("%s", str.data());
300}
301
302bool GetGlobalAddressInformation(uptr addr, uptr access_size,
303                                 GlobalAddressDescription *descr) {
304  descr->addr = addr;
305  int globals_num = GetGlobalsForAddress(addr, descr->globals, descr->reg_sites,
306                                         ARRAY_SIZE(descr->globals));
307  descr->size = globals_num;
308  descr->access_size = access_size;
309  return globals_num != 0;
310}
311
312bool DescribeAddressIfGlobal(uptr addr, uptr access_size,
313                             const char *bug_type) {
314  GlobalAddressDescription descr;
315  if (!GetGlobalAddressInformation(addr, access_size, &descr)) return false;
316
317  descr.Print(bug_type);
318  return true;
319}
320
321void ShadowAddressDescription::Print() const {
322  Printf("Address %p is located in the %s area.\n", addr, ShadowNames[kind]);
323}
324
325void GlobalAddressDescription::Print(const char *bug_type) const {
326  for (int i = 0; i < size; i++) {
327    DescribeAddressRelativeToGlobal(addr, access_size, globals[i]);
328    if (bug_type &&
329        0 == internal_strcmp(bug_type, "initialization-order-fiasco") &&
330        reg_sites[i]) {
331      Printf("  registered at:\n");
332      StackDepotGet(reg_sites[i]).Print();
333    }
334  }
335}
336
337bool GlobalAddressDescription::PointsInsideTheSameVariable(
338    const GlobalAddressDescription &other) const {
339  if (size == 0 || other.size == 0) return false;
340
341  for (uptr i = 0; i < size; i++) {
342    const __asan_global &a = globals[i];
343    for (uptr j = 0; j < other.size; j++) {
344      const __asan_global &b = other.globals[j];
345      if (a.beg == b.beg &&
346          a.beg <= addr &&
347          b.beg <= other.addr &&
348          (addr + access_size) < (a.beg + a.size) &&
349          (other.addr + other.access_size) < (b.beg + b.size))
350        return true;
351    }
352  }
353
354  return false;
355}
356
357void StackAddressDescription::Print() const {
358  Decorator d;
359  Printf("%s", d.Location());
360  Printf("Address %p is located in stack of thread %s", addr,
361         AsanThreadIdAndName(tid).c_str());
362
363  if (!frame_descr) {
364    Printf("%s\n", d.Default());
365    return;
366  }
367  Printf(" at offset %zu in frame%s\n", offset, d.Default());
368
369  // Now we print the frame where the alloca has happened.
370  // We print this frame as a stack trace with one element.
371  // The symbolizer may print more than one frame if inlining was involved.
372  // The frame numbers may be different than those in the stack trace printed
373  // previously. That's unfortunate, but I have no better solution,
374  // especially given that the alloca may be from entirely different place
375  // (e.g. use-after-scope, or different thread's stack).
376  Printf("%s", d.Default());
377  StackTrace alloca_stack(&frame_pc, 1);
378  alloca_stack.Print();
379
380  InternalMmapVector<StackVarDescr> vars;
381  vars.reserve(16);
382  if (!ParseFrameDescription(frame_descr, &vars)) {
383    Printf(
384        "AddressSanitizer can't parse the stack frame "
385        "descriptor: |%s|\n",
386        frame_descr);
387    // 'addr' is a stack address, so return true even if we can't parse frame
388    return;
389  }
390  uptr n_objects = vars.size();
391  // Report the number of stack objects.
392  Printf("  This frame has %zu object(s):\n", n_objects);
393
394  // Report all objects in this frame.
395  for (uptr i = 0; i < n_objects; i++) {
396    uptr prev_var_end = i ? vars[i - 1].beg + vars[i - 1].size : 0;
397    uptr next_var_beg = i + 1 < n_objects ? vars[i + 1].beg : ~(0UL);
398    PrintAccessAndVarIntersection(vars[i], offset, access_size, prev_var_end,
399                                  next_var_beg);
400  }
401  Printf(
402      "HINT: this may be a false positive if your program uses "
403      "some custom stack unwind mechanism, swapcontext or vfork\n");
404  if (SANITIZER_WINDOWS)
405    Printf("      (longjmp, SEH and C++ exceptions *are* supported)\n");
406  else
407    Printf("      (longjmp and C++ exceptions *are* supported)\n");
408
409  DescribeThread(GetThreadContextByTidLocked(tid));
410}
411
412void HeapAddressDescription::Print() const {
413  PrintHeapChunkAccess(addr, chunk_access);
414
415  asanThreadRegistry().CheckLocked();
416  AsanThreadContext *alloc_thread = GetThreadContextByTidLocked(alloc_tid);
417  StackTrace alloc_stack = GetStackTraceFromId(alloc_stack_id);
418
419  Decorator d;
420  AsanThreadContext *free_thread = nullptr;
421  if (free_tid != kInvalidTid) {
422    free_thread = GetThreadContextByTidLocked(free_tid);
423    Printf("%sfreed by thread %s here:%s\n", d.Allocation(),
424           AsanThreadIdAndName(free_thread).c_str(), d.Default());
425    StackTrace free_stack = GetStackTraceFromId(free_stack_id);
426    free_stack.Print();
427    Printf("%spreviously allocated by thread %s here:%s\n", d.Allocation(),
428           AsanThreadIdAndName(alloc_thread).c_str(), d.Default());
429  } else {
430    Printf("%sallocated by thread %s here:%s\n", d.Allocation(),
431           AsanThreadIdAndName(alloc_thread).c_str(), d.Default());
432  }
433  alloc_stack.Print();
434  DescribeThread(GetCurrentThread());
435  if (free_thread) DescribeThread(free_thread);
436  DescribeThread(alloc_thread);
437}
438
439AddressDescription::AddressDescription(uptr addr, uptr access_size,
440                                       bool shouldLockThreadRegistry) {
441  if (GetShadowAddressInformation(addr, &data.shadow)) {
442    data.kind = kAddressKindShadow;
443    return;
444  }
445  if (GetHeapAddressInformation(addr, access_size, &data.heap)) {
446    data.kind = kAddressKindHeap;
447    return;
448  }
449
450  bool isStackMemory = false;
451  if (shouldLockThreadRegistry) {
452    ThreadRegistryLock l(&asanThreadRegistry());
453    isStackMemory = GetStackAddressInformation(addr, access_size, &data.stack);
454  } else {
455    isStackMemory = GetStackAddressInformation(addr, access_size, &data.stack);
456  }
457  if (isStackMemory) {
458    data.kind = kAddressKindStack;
459    return;
460  }
461
462  if (GetGlobalAddressInformation(addr, access_size, &data.global)) {
463    data.kind = kAddressKindGlobal;
464    return;
465  }
466  data.kind = kAddressKindWild;
467  addr = 0;
468}
469
470void PrintAddressDescription(uptr addr, uptr access_size,
471                             const char *bug_type) {
472  ShadowAddressDescription shadow_descr;
473  if (GetShadowAddressInformation(addr, &shadow_descr)) {
474    shadow_descr.Print();
475    return;
476  }
477
478  GlobalAddressDescription global_descr;
479  if (GetGlobalAddressInformation(addr, access_size, &global_descr)) {
480    global_descr.Print(bug_type);
481    return;
482  }
483
484  StackAddressDescription stack_descr;
485  if (GetStackAddressInformation(addr, access_size, &stack_descr)) {
486    stack_descr.Print();
487    return;
488  }
489
490  HeapAddressDescription heap_descr;
491  if (GetHeapAddressInformation(addr, access_size, &heap_descr)) {
492    heap_descr.Print();
493    return;
494  }
495
496  // We exhausted our possibilities. Bail out.
497  Printf(
498      "AddressSanitizer can not describe address in more detail "
499      "(wild memory access suspected).\n");
500}
501}  // namespace __asan
502