1//=-- lsan_common_mac.cpp -------------------------------------------------===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file is a part of LeakSanitizer. 10// Implementation of common leak checking functionality. Darwin-specific code. 11// 12//===----------------------------------------------------------------------===// 13 14#include "sanitizer_common/sanitizer_platform.h" 15#include "sanitizer_common/sanitizer_libc.h" 16#include "lsan_common.h" 17 18#if CAN_SANITIZE_LEAKS && SANITIZER_APPLE 19 20# include <mach/mach.h> 21# include <mach/vm_statistics.h> 22# include <pthread.h> 23 24# include "lsan_allocator.h" 25# include "sanitizer_common/sanitizer_allocator_internal.h" 26namespace __lsan { 27 28class ThreadContextLsanBase; 29 30enum class SeenRegion { 31 None = 0, 32 AllocOnce = 1 << 0, 33 LibDispatch = 1 << 1, 34 Foundation = 1 << 2, 35 All = AllocOnce | LibDispatch | Foundation 36}; 37 38inline SeenRegion operator|(SeenRegion left, SeenRegion right) { 39 return static_cast<SeenRegion>(static_cast<int>(left) | 40 static_cast<int>(right)); 41} 42 43inline SeenRegion &operator|=(SeenRegion &left, const SeenRegion &right) { 44 left = left | right; 45 return left; 46} 47 48struct RegionScanState { 49 SeenRegion seen_regions = SeenRegion::None; 50 bool in_libdispatch = false; 51}; 52 53typedef struct { 54 int disable_counter; 55 ThreadContextLsanBase *current_thread; 56 AllocatorCache cache; 57} thread_local_data_t; 58 59static pthread_key_t key; 60static pthread_once_t key_once = PTHREAD_ONCE_INIT; 61 62// The main thread destructor requires the current thread, 63// so we can't destroy it until it's been used and reset. 64void restore_tid_data(void *ptr) { 65 thread_local_data_t *data = (thread_local_data_t *)ptr; 66 if (data->current_thread) 67 pthread_setspecific(key, data); 68} 69 70static void make_tls_key() { 71 CHECK_EQ(pthread_key_create(&key, restore_tid_data), 0); 72} 73 74static thread_local_data_t *get_tls_val(bool alloc) { 75 pthread_once(&key_once, make_tls_key); 76 77 thread_local_data_t *ptr = (thread_local_data_t *)pthread_getspecific(key); 78 if (ptr == NULL && alloc) { 79 ptr = (thread_local_data_t *)InternalAlloc(sizeof(*ptr)); 80 ptr->disable_counter = 0; 81 ptr->current_thread = nullptr; 82 ptr->cache = AllocatorCache(); 83 pthread_setspecific(key, ptr); 84 } 85 86 return ptr; 87} 88 89bool DisabledInThisThread() { 90 thread_local_data_t *data = get_tls_val(false); 91 return data ? data->disable_counter > 0 : false; 92} 93 94void DisableInThisThread() { ++get_tls_val(true)->disable_counter; } 95 96void EnableInThisThread() { 97 int *disable_counter = &get_tls_val(true)->disable_counter; 98 if (*disable_counter == 0) { 99 DisableCounterUnderflow(); 100 } 101 --*disable_counter; 102} 103 104ThreadContextLsanBase *GetCurrentThread() { 105 thread_local_data_t *data = get_tls_val(false); 106 return data ? data->current_thread : nullptr; 107} 108 109void SetCurrentThread(ThreadContextLsanBase *tctx) { 110 get_tls_val(true)->current_thread = tctx; 111} 112 113AllocatorCache *GetAllocatorCache() { return &get_tls_val(true)->cache; } 114 115LoadedModule *GetLinker() { return nullptr; } 116 117// Required on Linux for initialization of TLS behavior, but should not be 118// required on Darwin. 119void InitializePlatformSpecificModules() {} 120 121// Sections which can't contain contain global pointers. This list errs on the 122// side of caution to avoid false positives, at the expense of performance. 123// 124// Other potentially safe sections include: 125// __all_image_info, __crash_info, __const, __got, __interpose, __objc_msg_break 126// 127// Sections which definitely cannot be included here are: 128// __objc_data, __objc_const, __data, __bss, __common, __thread_data, 129// __thread_bss, __thread_vars, __objc_opt_rw, __objc_opt_ptrs 130static const char *kSkippedSecNames[] = { 131 "__cfstring", "__la_symbol_ptr", "__mod_init_func", 132 "__mod_term_func", "__nl_symbol_ptr", "__objc_classlist", 133 "__objc_classrefs", "__objc_imageinfo", "__objc_nlclslist", 134 "__objc_protolist", "__objc_selrefs", "__objc_superrefs"}; 135 136// Scans global variables for heap pointers. 137void ProcessGlobalRegions(Frontier *frontier) { 138 for (auto name : kSkippedSecNames) 139 CHECK(internal_strnlen(name, kMaxSegName + 1) <= kMaxSegName); 140 141 MemoryMappingLayout memory_mapping(false); 142 InternalMmapVector<LoadedModule> modules; 143 modules.reserve(128); 144 memory_mapping.DumpListOfModules(&modules); 145 for (uptr i = 0; i < modules.size(); ++i) { 146 // Even when global scanning is disabled, we still need to scan 147 // system libraries for stashed pointers 148 if (!flags()->use_globals && modules[i].instrumented()) continue; 149 150 for (const __sanitizer::LoadedModule::AddressRange &range : 151 modules[i].ranges()) { 152 // Sections storing global variables are writable and non-executable 153 if (range.executable || !range.writable) continue; 154 155 for (auto name : kSkippedSecNames) { 156 if (!internal_strcmp(range.name, name)) continue; 157 } 158 159 ScanGlobalRange(range.beg, range.end, frontier); 160 } 161 } 162} 163 164void ProcessPlatformSpecificAllocations(Frontier *frontier) { 165 vm_address_t address = 0; 166 kern_return_t err = KERN_SUCCESS; 167 168 InternalMmapVector<Region> mapped_regions; 169 bool use_root_regions = flags()->use_root_regions && HasRootRegions(); 170 171 RegionScanState scan_state; 172 while (err == KERN_SUCCESS) { 173 vm_size_t size = 0; 174 unsigned depth = 1; 175 struct vm_region_submap_info_64 info; 176 mach_msg_type_number_t count = VM_REGION_SUBMAP_INFO_COUNT_64; 177 err = vm_region_recurse_64(mach_task_self(), &address, &size, &depth, 178 (vm_region_info_t)&info, &count); 179 180 uptr end_address = address + size; 181 if (info.user_tag == VM_MEMORY_OS_ALLOC_ONCE) { 182 // libxpc stashes some pointers in the Kernel Alloc Once page, 183 // make sure not to report those as leaks. 184 scan_state.seen_regions |= SeenRegion::AllocOnce; 185 ScanRangeForPointers(address, end_address, frontier, "GLOBAL", 186 kReachable); 187 } else if (info.user_tag == VM_MEMORY_FOUNDATION) { 188 // Objective-C block trampolines use the Foundation region. 189 scan_state.seen_regions |= SeenRegion::Foundation; 190 ScanRangeForPointers(address, end_address, frontier, "GLOBAL", 191 kReachable); 192 } else if (info.user_tag == VM_MEMORY_LIBDISPATCH) { 193 // Dispatch continuations use the libdispatch region. Empirically, there 194 // can be more than one region with this tag, so we'll optimistically 195 // assume that they're continguous. Otherwise, we would need to scan every 196 // region to ensure we find them all. 197 scan_state.in_libdispatch = true; 198 ScanRangeForPointers(address, end_address, frontier, "GLOBAL", 199 kReachable); 200 } else if (scan_state.in_libdispatch) { 201 scan_state.seen_regions |= SeenRegion::LibDispatch; 202 scan_state.in_libdispatch = false; 203 } 204 205 // Recursing over the full memory map is very slow, break out 206 // early if we don't need the full iteration. 207 if (scan_state.seen_regions == SeenRegion::All && !use_root_regions) { 208 break; 209 } 210 211 // This additional root region scan is required on Darwin in order to 212 // detect root regions contained within mmap'd memory regions, because 213 // the Darwin implementation of sanitizer_procmaps traverses images 214 // as loaded by dyld, and not the complete set of all memory regions. 215 // 216 // TODO(fjricci) - remove this once sanitizer_procmaps_mac has the same 217 // behavior as sanitizer_procmaps_linux and traverses all memory regions 218 if (use_root_regions && (info.protection & kProtectionRead)) 219 mapped_regions.push_back({address, end_address}); 220 221 address = end_address; 222 } 223 ScanRootRegions(frontier, mapped_regions); 224} 225 226// On darwin, we can intercept _exit gracefully, and return a failing exit code 227// if required at that point. Calling Die() here is undefined behavior and 228// causes rare race conditions. 229void HandleLeaks() {} 230 231void LockStuffAndStopTheWorld(StopTheWorldCallback callback, 232 CheckForLeaksParam *argument) { 233 ScopedStopTheWorldLock lock; 234 StopTheWorld(callback, argument); 235} 236 237} // namespace __lsan 238 239#endif // CAN_SANITIZE_LEAKS && SANITIZER_APPLE 240