196513Sru//=-- lsan_common_mac.cc --------------------------------------------------===//
296513Sru//
351Snate//                     The LLVM Compiler Infrastructure
451Snate//
51495Srgrimes// This file is distributed under the University of Illinois Open Source
69Sjkh// License. See LICENSE.TXT for details.
751Snate//
851Snate//===----------------------------------------------------------------------===//
911894Speter//
1011894Speter// This file is a part of LeakSanitizer.
1151Snate// Implementation of common leak checking functionality. Darwin-specific code.
12136910Sru//
13113Sconklin//===----------------------------------------------------------------------===//
149Sjkh
15#include "sanitizer_common/sanitizer_platform.h"
16#include "sanitizer_common/sanitizer_libc.h"
17#include "lsan_common.h"
18
19#if CAN_SANITIZE_LEAKS && SANITIZER_MAC
20
21#include "sanitizer_common/sanitizer_allocator_internal.h"
22#include "lsan_allocator.h"
23
24#include <pthread.h>
25
26#include <mach/mach.h>
27
28// Only introduced in Mac OS X 10.9.
29#ifdef VM_MEMORY_OS_ALLOC_ONCE
30static const int kSanitizerVmMemoryOsAllocOnce = VM_MEMORY_OS_ALLOC_ONCE;
31#else
32static const int kSanitizerVmMemoryOsAllocOnce = 73;
33#endif
34
35namespace __lsan {
36
37typedef struct {
38  int disable_counter;
39  u32 current_thread_id;
40  AllocatorCache cache;
41} thread_local_data_t;
42
43static pthread_key_t key;
44static pthread_once_t key_once = PTHREAD_ONCE_INIT;
45
46// The main thread destructor requires the current thread id,
47// so we can't destroy it until it's been used and reset to invalid tid
48void restore_tid_data(void *ptr) {
49  thread_local_data_t *data = (thread_local_data_t *)ptr;
50  if (data->current_thread_id != kInvalidTid)
51    pthread_setspecific(key, data);
52}
53
54static void make_tls_key() {
55  CHECK_EQ(pthread_key_create(&key, restore_tid_data), 0);
56}
57
58static thread_local_data_t *get_tls_val(bool alloc) {
59  pthread_once(&key_once, make_tls_key);
60
61  thread_local_data_t *ptr = (thread_local_data_t *)pthread_getspecific(key);
62  if (ptr == NULL && alloc) {
63    ptr = (thread_local_data_t *)InternalAlloc(sizeof(*ptr));
64    ptr->disable_counter = 0;
65    ptr->current_thread_id = kInvalidTid;
66    ptr->cache = AllocatorCache();
67    pthread_setspecific(key, ptr);
68  }
69
70  return ptr;
71}
72
73bool DisabledInThisThread() {
74  thread_local_data_t *data = get_tls_val(false);
75  return data ? data->disable_counter > 0 : false;
76}
77
78void DisableInThisThread() { ++get_tls_val(true)->disable_counter; }
79
80void EnableInThisThread() {
81  int *disable_counter = &get_tls_val(true)->disable_counter;
82  if (*disable_counter == 0) {
83    DisableCounterUnderflow();
84  }
85  --*disable_counter;
86}
87
88u32 GetCurrentThread() {
89  thread_local_data_t *data = get_tls_val(false);
90  return data ? data->current_thread_id : kInvalidTid;
91}
92
93void SetCurrentThread(u32 tid) { get_tls_val(true)->current_thread_id = tid; }
94
95AllocatorCache *GetAllocatorCache() { return &get_tls_val(true)->cache; }
96
97LoadedModule *GetLinker() { return nullptr; }
98
99// Required on Linux for initialization of TLS behavior, but should not be
100// required on Darwin.
101void InitializePlatformSpecificModules() {}
102
103// Sections which can't contain contain global pointers. This list errs on the
104// side of caution to avoid false positives, at the expense of performance.
105//
106// Other potentially safe sections include:
107// __all_image_info, __crash_info, __const, __got, __interpose, __objc_msg_break
108//
109// Sections which definitely cannot be included here are:
110// __objc_data, __objc_const, __data, __bss, __common, __thread_data,
111// __thread_bss, __thread_vars, __objc_opt_rw, __objc_opt_ptrs
112static const char *kSkippedSecNames[] = {
113    "__cfstring",       "__la_symbol_ptr",  "__mod_init_func",
114    "__mod_term_func",  "__nl_symbol_ptr",  "__objc_classlist",
115    "__objc_classrefs", "__objc_imageinfo", "__objc_nlclslist",
116    "__objc_protolist", "__objc_selrefs",   "__objc_superrefs"};
117
118// Scans global variables for heap pointers.
119void ProcessGlobalRegions(Frontier *frontier) {
120  for (auto name : kSkippedSecNames)
121    CHECK(internal_strnlen(name, kMaxSegName + 1) <= kMaxSegName);
122
123  MemoryMappingLayout memory_mapping(false);
124  InternalMmapVector<LoadedModule> modules;
125  modules.reserve(128);
126  memory_mapping.DumpListOfModules(&modules);
127  for (uptr i = 0; i < modules.size(); ++i) {
128    // Even when global scanning is disabled, we still need to scan
129    // system libraries for stashed pointers
130    if (!flags()->use_globals && modules[i].instrumented()) continue;
131
132    for (const __sanitizer::LoadedModule::AddressRange &range :
133         modules[i].ranges()) {
134      // Sections storing global variables are writable and non-executable
135      if (range.executable || !range.writable) continue;
136
137      for (auto name : kSkippedSecNames) {
138        if (!internal_strcmp(range.name, name)) continue;
139      }
140
141      ScanGlobalRange(range.beg, range.end, frontier);
142    }
143  }
144}
145
146void ProcessPlatformSpecificAllocations(Frontier *frontier) {
147  unsigned depth = 1;
148  vm_size_t size = 0;
149  vm_address_t address = 0;
150  kern_return_t err = KERN_SUCCESS;
151  mach_msg_type_number_t count = VM_REGION_SUBMAP_INFO_COUNT_64;
152
153  InternalMmapVector<RootRegion> const *root_regions = GetRootRegions();
154
155  while (err == KERN_SUCCESS) {
156    struct vm_region_submap_info_64 info;
157    err = vm_region_recurse_64(mach_task_self(), &address, &size, &depth,
158                               (vm_region_info_t)&info, &count);
159
160    uptr end_address = address + size;
161
162    // libxpc stashes some pointers in the Kernel Alloc Once page,
163    // make sure not to report those as leaks.
164    if (info.user_tag == kSanitizerVmMemoryOsAllocOnce) {
165      ScanRangeForPointers(address, end_address, frontier, "GLOBAL",
166                           kReachable);
167
168      // Recursing over the full memory map is very slow, break out
169      // early if we don't need the full iteration.
170      if (!flags()->use_root_regions || !root_regions->size())
171        break;
172    }
173
174    // This additional root region scan is required on Darwin in order to
175    // detect root regions contained within mmap'd memory regions, because
176    // the Darwin implementation of sanitizer_procmaps traverses images
177    // as loaded by dyld, and not the complete set of all memory regions.
178    //
179    // TODO(fjricci) - remove this once sanitizer_procmaps_mac has the same
180    // behavior as sanitizer_procmaps_linux and traverses all memory regions
181    if (flags()->use_root_regions) {
182      for (uptr i = 0; i < root_regions->size(); i++) {
183        ScanRootRegion(frontier, (*root_regions)[i], address, end_address,
184                       info.protection & kProtectionRead);
185      }
186    }
187
188    address = end_address;
189  }
190}
191
192// On darwin, we can intercept _exit gracefully, and return a failing exit code
193// if required at that point. Calling Die() here is undefined behavior and
194// causes rare race conditions.
195void HandleLeaks() {}
196
197void DoStopTheWorld(StopTheWorldCallback callback, void *argument) {
198  StopTheWorld(callback, argument);
199}
200
201} // namespace __lsan
202
203#endif // CAN_SANITIZE_LEAKS && SANITIZER_MAC
204