-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathlibcrunch.c
3148 lines (2895 loc) · 113 KB
/
libcrunch.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* Libcrunch contains all the non-inline code that we need for doing run-time
* type checks on C code. */
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
#include <string.h>
#include <dlfcn.h>
#include <unistd.h>
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdarg.h>
#include <link.h>
#include <limits.h>
#include <fcntl.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <signal.h>
#include <ucontext.h>
#ifdef USE_REAL_LIBUNWIND
#include <libunwind.h>
#endif
#include <errno.h>
#include "relf.h"
#include "libcrunch.h"
#include "libcrunch_private.h"
struct cache_miss_record {
const void *caller;
unsigned long count;
};
static int compare_miss_record_by_addr(const void *vmr1, const void *vmr2)
{
struct cache_miss_record *mr1 = (void*) vmr1, *mr2 = (void*) vmr2;
if (mr1->caller == mr2->caller) return 0;
// NULL is the maximal value
if (!mr1->caller) return 1;
if (!mr2->caller) return -1;
return ((uintptr_t) mr1->caller < (uintptr_t) mr2->caller) ? -1 : 1;
}
static struct cache_miss_record *miss_vec;
static unsigned long miss_vec_nused;
static unsigned long miss_vec_n;
int __libcrunch_get_errno(void) // for debugging
{
return errno;
}
/* from libsystrap */
int enumerate_operands(unsigned const char *ins, unsigned const char *end,
void *mcontext,
void (*saw_operand)(int /*type*/, unsigned int /*bytes*/, uint32_t */*val*/,
unsigned long */*p_reg*/, int */*p_mem_seg*/, unsigned long */*p_mem_off*/,
int */*p_fromreg1*/, int */*p_fromreg2*/, void */*arg*/),
void *arg
);
void raw_exit(int) __attribute__((noreturn));
/* argh: more from libsystrap, also stolen from libdwarfpp */
enum dwarf_regs_x86_64
{
DWARF_X86_64_RAX = 0,
DWARF_X86_64_RDX = 1,
DWARF_X86_64_RCX = 2,
DWARF_X86_64_RBX = 3,
DWARF_X86_64_RSI = 4,
DWARF_X86_64_RDI = 5,
DWARF_X86_64_RBP = 6,
DWARF_X86_64_RSP = 7,
DWARF_X86_64_R8 = 8,
DWARF_X86_64_R9 = 9,
DWARF_X86_64_R10 = 10,
DWARF_X86_64_R11 = 11,
DWARF_X86_64_R12 = 12,
DWARF_X86_64_R13 = 13,
DWARF_X86_64_R14 = 14,
DWARF_X86_64_R15 = 15,
DWARF_X86_64_RIP = 16
};
#ifndef MIN
#define MIN(x, y) (((x) < (y)) ? (x) : (y))
#endif
#ifndef MAX
#define MAX(x, y) (((x) < (y)) ? (y) : (x))
#endif
/* We need our own overriding versions of these, since the _stubs.so copies
* won't be available to the preload object. */
void **__libcrunch_bounds_bases_region_00;
void **__libcrunch_bounds_bases_region_2a;
void **__libcrunch_bounds_bases_region_7a;
unsigned long *__libcrunch_bounds_sizes_region_00;
unsigned long *__libcrunch_bounds_sizes_region_2a;
unsigned long *__libcrunch_bounds_sizes_region_7a;
int __libcrunch_debug_level;
_Bool __libcrunch_is_initialized;
int __libcrunch_really_loaded; /* see shadow.c */
FILE *crunch_stream_err;// __attribute__((visibility("hidden")));
// helper
static const void *typestr_to_uniqtype_from_lib(void *handle, const char *typestr);
// HACK
void __libcrunch_preload_init(void);
/* Some data types like void* and sockaddr appear to be used to size a malloc(),
* but are only used because they have the same size as the actual thing being
* allocated (say a different type of pointer, or a family-specific sockaddr).
* We keep a list of these. The user can use the LIBCRUNCH_ABSTRACT_LVALUE_TYPES
* environment variable to add more. Note that this variable also affects how
* trumptr does the instrumentation. It permits casts to (pointers to) these
* abstract lvalue types, like (void**), but then checks *writes* to the lvalue
* (i.e. a write to a void* lvalue -- so if we do *(void**)p, it's the write
* and not the cast that gets checked). */
static unsigned abstract_lvalue_types_count;
static const char **abstract_lvalue_typenames;
static struct uniqtype **abstract_lvalue_types;
static _Bool verbose;
static const char **suppression_words;
struct suppression
{
const char *test_type_pat;
const char *testing_function_pat;
const char *alloc_type_pat;
};
struct suppression *suppressions;
static int print_type_cb(struct uniqtype *t, void *ignored)
{
fprintf(crunch_stream_err, "uniqtype addr %p, name %s, size %d bytes\n",
t, NAME_FOR_UNIQTYPE(t), t->pos_maxoff);
fflush(crunch_stream_err);
return 0;
}
static ElfW(Dyn) *get_dynamic_entry_from_section(void *dynsec, unsigned long tag)
{
ElfW(Dyn) *dynamic_section = dynsec;
while (dynamic_section->d_tag != DT_NULL
&& dynamic_section->d_tag != tag) ++dynamic_section;
if (dynamic_section->d_tag == DT_NULL) return NULL;
return dynamic_section;
}
static _Bool prefix_pattern_matches(const char *pat, const char *str)
{
if (!str) return 0;
char *star_pos = strchr(pat, '*');
return 0 == strncmp(pat, str, star_pos ? star_pos - pat : strlen(pat));
}
static _Bool test_site_matches(const char *pat /* will be saved! must not be freed */,
const void *test_site)
{
_Bool result;
Dl_info site_info = dladdr_with_cache(test_site);
if (site_info.dli_sname)
{
/* okay, we can test the pat */
result = prefix_pattern_matches(pat, site_info.dli_sname);
}
else
{
debug_println(2, "dladdr() failed to find symbol for test site address %p", test_site);
result = prefix_pattern_matches(pat, "");
}
return result;
}
static _Bool suppression_matches(struct suppression *s,
const char *test_typestr, const void *test_site, const char *alloc_typestr)
{
return prefix_pattern_matches(s->test_type_pat, test_typestr)
&& prefix_pattern_matches(s->alloc_type_pat, alloc_typestr)
&& test_site_matches(s->testing_function_pat, test_site);
}
static _Bool is_suppressed(const struct uniqtype *maybe_test_uniqtype, const void *test_site,
const struct uniqtype *maybe_alloc_uniqtype)
{
if (!suppressions) return 0;
const char *test_typestr = maybe_test_uniqtype ? NAME_FOR_UNIQTYPE(maybe_test_uniqtype) : NULL;
const char *alloc_typestr = maybe_alloc_uniqtype ? NAME_FOR_UNIQTYPE(maybe_alloc_uniqtype) : NULL;
for (struct suppression *p = &suppressions[0];
p->test_type_pat != NULL;
++p)
{
if (suppression_matches(p, test_typestr, test_site, alloc_typestr))
{
++__libcrunch_failed_and_suppressed;
return 1;
}
}
return 0;
}
static _Bool done_init;
void __libcrunch_main_init(void) __attribute__((constructor(101)));
// NOTE: runs *before* the constructor in liballocs/preload.c
void __libcrunch_main_init(void)
{
assert(!done_init);
done_init = 1;
}
/* counters */
unsigned long __libcrunch_begun;
#ifdef LIBCRUNCH_EXTENDED_COUNTS
unsigned long __libcrunch_aborted_init;
unsigned long __libcrunch_trivially_succeeded;
#endif
unsigned long __libcrunch_aborted_typestr;
unsigned long __libcrunch_succeeded_by_specialization;
unsigned long __libcrunch_failed;
unsigned long __libcrunch_failed_in_alloc;
unsigned long __libcrunch_failed_and_suppressed;
unsigned long __libcrunch_succeeded;
unsigned long __libcrunch_is_a_hit_cache;
unsigned long __libcrunch_created_invalid_pointer;
unsigned long __libcrunch_fetch_bounds_called;
unsigned long __libcrunch_fetch_bounds_missed_cache;
unsigned long __libcrunch_primary_secondary_transitions;
unsigned long __libcrunch_fault_handler_fixups;
unsigned long __libcrunch_ptr_derivations;
unsigned long __libcrunch_ptr_derefs;
unsigned long __libcrunch_ptr_stores;
/* We maintain a *separate* cache of "fake bounds" that remember ranges
* over which we've let arithmetic go ahead because we had no type info
* for the allocation. Without this, many programs will repeatedly report
* failures getting bounds. We keep it separate to avoid interference with
* the main cache. */
// FIXME: this should be thread-local but my gdb can't grok that
struct __liballocs_memrange_cache /* __thread */ __libcrunch_fake_bounds_cache = {
.max_pos = 1 + LIBALLOCS_MEMRANGE_CACHE_MAX_SIZE,
.next_victim = 1
};
static void report_repeat_failure_summary(void);
static unsigned long repeat_summarisation_count;
struct addrlist distinct_failure_sites;
/* This filter is used to avoid repeated warnings, unless
* the user has requested them (verbose mode). */
static _Bool should_report_failure_at(const void *site, const struct uniqtype *maybe_test_uniqtype,
const struct uniqtype *maybe_alloc_uniqtype)
{
if (is_suppressed(maybe_test_uniqtype, site, maybe_alloc_uniqtype)) return 0;
if (verbose) return 1;
_Bool is_unseen = !__liballocs_addrlist_contains(&distinct_failure_sites, (void*) site);
if (is_unseen)
{
__liballocs_addrlist_add(&distinct_failure_sites, (void*) site);
return 1;
}
else return 0;
}
static void print_exit_summary(void)
{
if (__libcrunch_begun == 0 && __libcrunch_ptr_derefs == 0
&& __libcrunch_fetch_bounds_called == 0 /* FIXME: replace with __fetch_bounds_internal failure counter */
&& __libcrunch_created_invalid_pointer == 0
&& !getenv("LIBCRUNCH_ALWAYS_PRINT_EXIT_SUMMARY")) return;
report_repeat_failure_summary();
fprintf(crunch_stream_err, "======================================================\n");
fprintf(crunch_stream_err, "libcrunch summary: \n");
fprintf(crunch_stream_err, "------------------------------------------------------\n");
fprintf(crunch_stream_err, "type checks begun: % 11ld\n", __libcrunch_begun);
fprintf(crunch_stream_err, "------------------------------------------------------\n");
#ifdef LIBCRUNCH_EXTENDED_COUNTS
fprintf(crunch_stream_err, " aborted due to init failure: % 11ld\n", __libcrunch_aborted_init);
#endif
fprintf(crunch_stream_err, " aborted for bad typename: % 11ld\n", __libcrunch_aborted_typestr);
#ifdef LIBCRUNCH_EXTENDED_COUNTS
fprintf(crunch_stream_err, " trivially passed: % 11ld\n", __libcrunch_trivially_succeeded);
#endif
#ifdef LIBCRUNCH_EXTENDED_COUNTS
fprintf(crunch_stream_err, " remaining % 11ld\n", __libcrunch_begun - (__libcrunch_trivially_succeeded + __liballocs_aborted_unknown_storage + __libcrunch_aborted_typestr + __libcrunch_aborted_init));
#else
fprintf(crunch_stream_err, " remaining % 11ld\n", __libcrunch_begun - (__liballocs_aborted_unknown_storage + __libcrunch_aborted_typestr));
#endif
fprintf(crunch_stream_err, "------------------------------------------------------\n");
fprintf(crunch_stream_err, " succeeded by specialization: % 11ld\n", __libcrunch_succeeded_by_specialization);
fprintf(crunch_stream_err, "------------------------------------------------------\n");
fprintf(crunch_stream_err, " failed inside allocation functions: % 11ld\n", __libcrunch_failed_in_alloc);
fprintf(crunch_stream_err, " failed otherwise: % 11ld\n", __libcrunch_failed);
fprintf(crunch_stream_err, " of which user suppressed: % 11ld\n", __libcrunch_failed_and_suppressed);
fprintf(crunch_stream_err, " nontrivially passed: % 11ld\n", __libcrunch_succeeded);
fprintf(crunch_stream_err, "------------------------------------------------------\n");
fprintf(crunch_stream_err, " of which hit liballocs memrange cache: % 11ld\n", __libcrunch_is_a_hit_cache);
#ifdef LIBCRUNCH_PROFILE_CACHE_MISSES
fprintf(crunch_stream_err, " miss profile: \n");
for (unsigned i = 0; i < miss_vec_nused; ++i)
{
fprintf(crunch_stream_err, " % 12lx % 11ld\n", (unsigned long) miss_vec[i].caller, miss_vec[i].count);
}
#endif
#ifdef LIBCRUNCH_KEEP_EXPENSIVE_COUNTS
fprintf(crunch_stream_err, "------------------------------------------------------\n");
fprintf(crunch_stream_err, "pointer dereferences: % 11ld\n", __libcrunch_ptr_derefs);
fprintf(crunch_stream_err, " of which stored shadowed pointer values:% 11ld\n", __libcrunch_ptr_stores);
fprintf(crunch_stream_err, "pointer derivations instrumented: % 11ld\n", __libcrunch_ptr_derivations);
#endif
fprintf(crunch_stream_err, "------------------------------------------------------\n");
fprintf(crunch_stream_err, "out-of-bounds pointers created: % 11ld\n", __libcrunch_created_invalid_pointer);
fprintf(crunch_stream_err, "accesses trapped and emulated: % 11ld\n", 0ul /* FIXME */);
fprintf(crunch_stream_err, "calls to __fetch_bounds: % 11ld\n", __libcrunch_fetch_bounds_called /* FIXME: remove */);
fprintf(crunch_stream_err, " of which missed cache: % 11ld\n", __libcrunch_fetch_bounds_missed_cache);
fprintf(crunch_stream_err, "calls requiring secondary checks % 11ld\n", __libcrunch_primary_secondary_transitions);
fprintf(crunch_stream_err, "trap-pointer fixups in fault handler % 11ld\n", __libcrunch_fault_handler_fixups);
fprintf(crunch_stream_err, "======================================================\n");
if (!verbose)
{
fprintf(crunch_stream_err, "re-run with LIBCRUNCH_VERBOSE=1 for repeat failures\n");
}
if (getenv("LIBCRUNCH_DUMP_SMAPS_AT_EXIT"))
{
char buffer[4096];
size_t bytes;
FILE *smaps = fopen("/proc/self/smaps", "r");
if (smaps)
{
while (0 < (bytes = fread(buffer, 1, sizeof(buffer), smaps)))
{
fwrite(buffer, 1, bytes, stream_err);
}
}
else fprintf(crunch_stream_err, "Couldn't read from smaps!\n");
}
}
static unsigned count_separated_words(const char *str, char sep)
{
unsigned count = 1;
const char *pos = str;
while ((pos = strchr(pos, sep)) != NULL) { ++count; ++pos; }
return count;
}
static void fill_separated_words(const char **out, const char *str, char sep, unsigned max)
{
unsigned n_added = 0;
if (max == 0) return;
const char *pos = str;
const char *spacepos;
do
{
spacepos = strchrnul(pos, sep);
if (spacepos - pos > 0)
{
assert(n_added < max);
out[n_added++] = __liballocs_private_strndup(pos, spacepos - pos);
}
pos = spacepos;
while (*pos == sep) ++pos;
} while (*pos != '\0' && n_added < max);
}
#define MSGLIT(s) dummy_ret = write(2, (s), sizeof (s) - 1)
#define MSGBUF(s) dummy_ret = write(2, (s), strlen((s)))
#define MSGCHAR(c) do { dummy_char = (c); dummy_ret = write(2, &dummy_char, 1); } while(0)
#define HEXCHAR(n) (((n) > 9) ? ('a' + ((n)-10)) : '0' + (n))
#define DECCHAR(n) ('0' + (n))
#define MSGADDR(a) MSGCHAR(HEXCHAR((a >> 60) % 16)); \
MSGCHAR(HEXCHAR((a >> 56) % 16)); \
MSGCHAR(HEXCHAR((a >> 52) % 16)); \
MSGCHAR(HEXCHAR((a >> 48) % 16)); \
MSGCHAR(HEXCHAR((a >> 44) % 16)); \
MSGCHAR(HEXCHAR((a >> 40) % 16)); \
MSGCHAR(HEXCHAR((a >> 36) % 16)); \
MSGCHAR(HEXCHAR((a >> 32) % 16)); \
MSGCHAR(HEXCHAR((a >> 28) % 16)); \
MSGCHAR(HEXCHAR((a >> 24) % 16)); \
MSGCHAR(HEXCHAR((a >> 20) % 16)); \
MSGCHAR(HEXCHAR((a >> 16) % 16)); \
MSGCHAR(HEXCHAR((a >> 12) % 16)); \
MSGCHAR(HEXCHAR((a >> 8) % 16)); \
MSGCHAR(HEXCHAR((a >> 4) % 16)); \
MSGCHAR(HEXCHAR((a) % 16));
#define MSGSHORT(a) MSGCHAR(DECCHAR((a / 10000) % 10)); \
MSGCHAR(DECCHAR((a / 1000) % 10)); \
MSGCHAR(DECCHAR((a / 100) % 10)); \
MSGCHAR(DECCHAR((a / 10) % 10)); \
MSGCHAR(DECCHAR((a) % 10)); \
static __thread _Bool did_fixup;
void try_register_fixup(int regnum, mcontext_t *p_mcontext)
{
const char *kindstr;
char dummy_char;
int dummy_ret;
uintptr_t *p_savedval = 0;
#define CASE(frag, FRAG) case DWARF_X86_64_ ##FRAG: \
p_savedval = (uintptr_t*) &p_mcontext->gregs[REG_ ##FRAG]; break;
switch (regnum)
{
CASE(r15, R15)
CASE(r14, R14)
CASE(r13, R13)
CASE(r12, R12)
CASE(rbp, RBP)
CASE(rbx, RBX)
CASE(r11, R11)
CASE(r10, R10)
CASE(r9, R9)
CASE(r8, R8)
CASE(rax, RAX)
CASE(rcx, RCX)
CASE(rdx, RDX)
CASE(rsi, RSI)
CASE(rdi, RDI)
CASE(rip, RIP)
case -1:
default:
MSGLIT("register mapping error");
return;
}
#undef CASE
if (!p_savedval)
{
MSGLIT("register lookup error");
return;
}
MSGLIT("register ");
MSGSHORT(regnum);
MSGLIT(" contents 0x");
MSGADDR(*p_savedval);
MSGLIT(" are ");
switch (*p_savedval >> LIBCRUNCH_TRAP_TAG_SHIFT) // FIXME: high addrs need handling
{
case 1: // one-past
kindstr = "one-past";
goto report;
case 2: // one-prev
kindstr = "one-before";
goto report;
case 3: // invalid
kindstr = "type-invalid";
goto report;
default: // not one of ours
MSGLIT("not a trap pointer\n");
return;
report:
MSGLIT(" a ");
MSGBUF(kindstr);
const int shiftamount = 8*sizeof(uintptr_t) - LIBCRUNCH_TRAP_TAG_SHIFT;
*p_savedval = (*p_savedval << shiftamount) >> shiftamount;
MSGLIT(" trap pointer\n");
MSGLIT("Attempting resume following de-trap; new value is ");
MSGADDR(*p_savedval);
MSGLIT("\n");
did_fixup = 1;
break;
}
}
static void saw_operand_cb(int type, unsigned int bytes, uint32_t *val,
unsigned long *p_reg, int *p_mem_seg, unsigned long *p_mem_off,
int *p_fromreg1, int *p_fromreg2,
void *arg)
{
mcontext_t *p_mcontext = (mcontext_t *) arg;
int dummy_ret;
char dummy_char;
if (type != 1 /* OP_mem */) return;
/* All the operands we're interested in are memory operands.
* BUT we have to know how they were encoded in the instruction! */
MSGLIT("*** memory operand was computed from ");
if (!p_fromreg1 && !p_fromreg2)
{
MSGLIT("unknown values\n");
return;
}
if (p_fromreg1)
{
if (*p_fromreg1 == -1)
{
MSGLIT("unknown register");
}
else
{
MSGLIT("register ");
MSGSHORT((short) *p_fromreg1);
}
if (p_fromreg2) MSGLIT(" and ");
}
if (p_fromreg2)
{
if (*p_fromreg2 == -1)
{
MSGLIT("unknown register\n");
}
else
{
MSGLIT("register ");
MSGSHORT((short) *p_fromreg2);
MSGLIT("\n");
}
}
if (p_fromreg1 && *p_fromreg1 != -1) try_register_fixup(*p_fromreg1, p_mcontext);
if (p_fromreg2 && *p_fromreg2 != -1) try_register_fixup(*p_fromreg2, p_mcontext);
}
static void handle_sigbus(int signum, siginfo_t *info, void *ucontext_as_void)
{
int dummy_ret;
MSGLIT("*** libcrunch caught SIGBUS; sleeping for 10 seconds");
sleep(10);
raw_exit(128 + SIGBUS);
}
static void handle_sigsegv(int signum, siginfo_t *info, void *ucontext_as_void)
{
//unsigned long *frame_base = __builtin_frame_address(0);
//struct ibcs_sigframe *p_frame = (struct ibcs_sigframe *) (frame_base + 1);
/* If we got a segfault at an address that looks like a trap pointer, then
* we have a few things to do.
*
* Firstly, if it's trapped with the invalid-type tag,
* we need to check the trap address against some kind of whitelist.
* If the whitelist says all-clear, we
* -- decode the instruction to figure out where the trapped pointer was living;
* -- clear the trap bits at that location
* -- resume the program from the trapping instruction.
* Ideally the whitelist would be an index of all memory accesses and their
* uniqtypes.
* If the whitelist says no, we probably want to print a warning and resume anyway,
* though sometimes we'll want to abort the program instead.
*
* Secondly, if it's [else] a one-past or one-prev pointer, we really
* can't allow this. So print a warning and (possibly) continue.
*/
// void *faulting_access_location = info->si_addr;
/* Unbelievably, we can't seem to get the access location on Linux (si_addr
* is zero, and is possibly not it anyway). So scan *all* operands for
* trap-pointer values. This is prone to false positives! We should really
* check the opcode that the operand really is being used as a pointer. */
ucontext_t *ucontext = (ucontext_t *) ucontext_as_void;
void *faulting_code_address = (void*) ucontext->uc_mcontext.gregs[REG_RIP];
int dummy_ret;
MSGLIT("*** libcrunch caught segmentation fault\n");
/* How do we make execution continue? Need to decode the instruction
* (to restart with a correct pointer)
* or emulate the access (no need to restart; but slower).
* We can ask libsystrap to decode the instruction operands for us. */
did_fixup = 0;
int ret = enumerate_operands((unsigned const char *) faulting_code_address,
(unsigned const char *) faulting_code_address + 16,
&ucontext->uc_mcontext,
saw_operand_cb,
&ucontext->uc_mcontext);
/* If we fixed something up, we can try resuming execution.
* Otherwise, there's no point. */
if (did_fixup)
{
/* okay, resume */
++__libcrunch_fault_handler_fixups;
did_fixup = 0;
return;
}
MSGLIT("*** libcrunch did not recover from segmentation fault, so terminating program\n");
raw_exit(128 + SIGSEGV);
}
static void install_segv_handler(void)
{
struct sigaction new_action = {
.sa_sigaction = handle_sigsegv,
.sa_flags = SA_SIGINFO
};
sigaction(SIGSEGV, &new_action, NULL);
}
static void early_init(void) __attribute__((constructor(101)));
static void early_init(void)
{
// delay start-up here if the user asked for it
if (getenv("LIBCRUNCH_DELAY_STARTUP"))
{
sleep(10);
}
// figure out where our output goes
const char *errvar = getenv("LIBCRUNCH_ERR");
if (errvar)
{
// try opening it
crunch_stream_err = fopen(errvar, "w");
if (!stream_err)
{
crunch_stream_err = stderr;
debug_println(0, "could not open %s for writing", errvar);
}
} else crunch_stream_err = stderr;
assert(crunch_stream_err);
const char *debug_level_str = getenv("LIBCRUNCH_DEBUG_LEVEL");
if (debug_level_str) __libcrunch_debug_level = atoi(debug_level_str);
verbose = __libcrunch_debug_level >= 1 || getenv("LIBCRUNCH_VERBOSE");
// print a summary when the program exits
atexit(print_exit_summary);
}
static void clear_mem_refbits(void)
{
int fd = open("/proc/self/clear_refs", O_WRONLY);
if (fd == -1) abort();
int dummy_ret __attribute__((unused)) = write(fd, "1\n", sizeof "1\n" - 1);
close(fd);
}
int __libcrunch_global_init(void) __attribute__((constructor));
int __libcrunch_global_init(void)
{
if (__libcrunch_is_initialized) return 0; // we are okay
// don't try more than once to initialize
static _Bool tried_to_initialize;
if (tried_to_initialize) return -1;
tried_to_initialize = 1;
// we must have initialized liballocs
__liballocs_ensure_init();
/* We always include "void*" in the abstract lvalue types. (FIXME: this is a
* C-specificity we'd rather not have here, but live with it for now.)
* We count the other ones. */
const char *abstract_lvalue_types_str = getenv("LIBCRUNCH_ABSTRACT_LVALUE_TYPES");
abstract_lvalue_types_count = 1;
unsigned upper_bound = 2; // signed char plus one string with zero spaces
if (abstract_lvalue_types_str)
{
unsigned count = count_separated_words(abstract_lvalue_types_str, ' ');
upper_bound += count;
abstract_lvalue_types_count += count;
}
/* Allocate and populate. */
abstract_lvalue_typenames = calloc(upper_bound, sizeof (const char *));
abstract_lvalue_types = calloc(upper_bound, sizeof (struct uniqtype *));
// the first entry is always pointer-to-void
abstract_lvalue_typenames[0] = "__PTR_void";
if (abstract_lvalue_types_str)
{
fill_separated_words(&abstract_lvalue_typenames[1], abstract_lvalue_types_str, ' ',
upper_bound - 1);
}
/* We have to look up the uniqtypes of abstract lvalue types.
* We used to walk the link map directly, like a debugger would
* (like I always knew somebody should). */
/* ... but that's slow. We just use the hash table. */
for (unsigned i = 0; i < abstract_lvalue_types_count; ++i)
{
if (abstract_lvalue_typenames[i] && !abstract_lvalue_types[i])
{
// build the uniqtype name and use the power of the symbol hash tables
char buf[4096];
char *pos = &buf[0];
strcpy(buf, "__uniqtype__"); // use the codeless version. FIXME: what if that's not enough?
strncat(buf, abstract_lvalue_typenames[i], sizeof buf - sizeof "__uniqtype__");
buf[sizeof buf - 1] = '\0';
// look up in global namespace
const void *u = dlsym(RTLD_DEFAULT, buf);
// if we found it, install it
if (u) abstract_lvalue_types[i] = (struct uniqtype *) u;
}
}
/* Load the suppression list from LIBCRUNCH_SUPPRESS. It's a space-separated
* list of triples <test-type-pat, testing-function-pat, alloc-type-pat>
* where patterns can end in "*" to indicate prefixing. */
unsigned suppressions_count = 0;
const char *suppressions_str = getenv("LIBCRUNCH_SUPPRESSIONS");
if (suppressions_str)
{
unsigned suppressions_count = count_separated_words(suppressions_str, ' ');
suppression_words = calloc(1 + suppressions_count, sizeof (char *));
assert(suppression_words);
suppressions = calloc(1 + suppressions_count, sizeof (struct suppression));
assert(suppressions);
fill_separated_words(&suppression_words[0], suppressions_str, ' ', suppressions_count);
for (const char **p_word = &suppression_words[0];
*p_word;
++p_word)
{
unsigned n_comma_sep = count_separated_words(*p_word, ',');
if (n_comma_sep != 3)
{
debug_println(1, "invalid suppression: %s", *p_word);
}
else
{
fill_separated_words(
&suppressions[p_word - &suppression_words[0]].test_type_pat,
*p_word,
',',
3);
}
}
}
// we need a segv handler to handle uses of trapped pointers
install_segv_handler();
// for sane memory usage measurement, consider referencedness to start now
clear_mem_refbits();
__libcrunch_is_initialized = 1;
debug_println(1, "libcrunch successfully initialized");
return 0;
}
enum check_kind
{
IS_A,
LIKE_A,
NAMED_A,
IS_A_FUNCTION_REFINING,
CHECK_ARGS,
LOOSELY_LIKE_A,
IS_A_POINTER_OF_DEGREE,
CAN_HOLD_POINTER,
DERIVED_PTR_VALID,
DEREFED_PTR_VALID,
CHECK_MAX = 0x255
};
static const char *check_kind_names[CHECK_MAX + 1] = {
[IS_A] = "__is_a",
[LIKE_A] = "__like_a",
[NAMED_A] = "__named_a",
[IS_A_FUNCTION_REFINING] = "__is_a_function_refining",
[CHECK_ARGS] = "__check_args",
[LOOSELY_LIKE_A] = "__loosely_like_a",
[IS_A_POINTER_OF_DEGREE] = "__is_a_pointer_of_degree",
[CAN_HOLD_POINTER] = "__can_hold_pointer",
[DERIVED_PTR_VALID] = "__check_derive_ptr",
[DEREFED_PTR_VALID] = "__check_deref_ptr"
};
static struct
{
enum check_kind kind;
const void *site;
const void *opaque_decider;
} last_failed_check;
static unsigned long repeat_failure_suppression_count;
static void report_repeat_failure_summary(void)
{
if (repeat_summarisation_count > 0)
{
debug_println(0, "Saw %ld further occurrences of the previous error",
repeat_summarisation_count);
repeat_summarisation_count = 0;
}
}
#define report_failure_if_necessary(site, kind, found_uniqtype, test_uniqtype, \
alloc_uniqtype, fmt, args...) \
do { if (should_report_failure_at(site, test_uniqtype, alloc_uniqtype)) \
report_failure(site, kind, found_uniqtype, test_uniqtype, alloc_uniqtype, fmt, ## args); \
} while (0)
static void report_failure(const void *site,
enum check_kind kind,
const struct uniqtype *found_uniqtype,
const struct uniqtype *test_uniqtype,
const struct uniqtype *alloc_uniqtype,
const char *fmt,
...)
{
va_list ap;
va_start(ap, fmt);
if (last_failed_check.site == site
&& last_failed_check.opaque_decider /* deepest_subobject_type */ == found_uniqtype)
{
++repeat_summarisation_count;
}
else
{
report_repeat_failure_summary();
debug_printf(0, "Failed check at %p (%s): %s", site,
format_symbolic_address(site), check_kind_names[kind]);
debug_vprintf_nohdr(0, fmt, ap);
debug_printf_bare(0, "\n");
last_failed_check.kind = kind;
last_failed_check.site = site;
// FIXME: the choice of decider depends on the check kind
last_failed_check.opaque_decider /* deepest_subobject_type */ = found_uniqtype;
}
va_end(ap);
}
static void cache_bounds(const void *range_base, const void *range_limit, unsigned period,
unsigned offset_to_t, const struct uniqtype *t, unsigned short depth)
{
__liballocs_cache_with_type(&__liballocs_ool_cache,
range_base, range_limit, period, offset_to_t, t, depth);
}
static void cache_is_a(const void *range_base, const void *range_limit, unsigned period,
unsigned offset_to_t, const struct uniqtype *t, unsigned short depth)
{
__liballocs_cache_with_type(&__liballocs_ool_cache,
range_base, range_limit, period, offset_to_t, t, depth);
}
static void cache_fake_bounds(const void *range_base, const void *range_limit, unsigned period,
unsigned offset_to_t, const struct uniqtype *t, unsigned short depth)
{
debug_println(1, "Creating fake bounds %p-%p", range_base, range_limit);
__liballocs_cache_with_type(&__libcrunch_fake_bounds_cache,
range_base, range_limit, period,
0, t, depth);
}
void __ensure_bounds_in_cache(unsigned long ptrval, __libcrunch_bounds_t ptr_bounds, struct uniqtype *t);
void __ensure_bounds_in_cache(unsigned long ptrval, __libcrunch_bounds_t ptr_bounds, struct uniqtype *t)
{
/* We ensure in crunchbound.ml that ptr is never trapped.
* It follows that it might be pointing one-past-the-end... FIXME: do we deal with that? */
const void *ptr = (const void *) ptrval;
/* Never cache invalid bounds or max bounds. */
if (__libcrunch_bounds_invalid(ptr_bounds, ptr)) return;
if (__libcrunch_get_limit(ptr_bounds, ptr) == (void*) -1) return;
__libcrunch_bounds_t from_cache = __fetch_bounds_from_cache(ptr, ptr, t, t->pos_maxoff);
if (__libcrunch_bounds_invalid(from_cache, ptr))
{
cache_bounds(__libcrunch_get_base(ptr_bounds, ptr), __libcrunch_get_limit(ptr_bounds, ptr),
t->pos_maxoff, 0, t, 1 /* HACK FIXME */);
}
}
#define CHECK_INIT \
/* When a check is called, we might not be initialized yet */ \
/* (recall that __libcrunch_global_init is not a constructor, */ \
/* because it's not safe to call super-early). */ \
__libcrunch_check_init();
#define DO_QUERY(obj) \
__libcrunch_check_init(); \
struct allocator *a = NULL; \
const void *alloc_start; \
unsigned long alloc_size_bytes; \
struct uniqtype *alloc_uniqtype = (struct uniqtype *)0; \
const void *alloc_site; \
\
struct liballocs_err *err = __liballocs_get_alloc_info(obj, \
&a, \
&alloc_start, \
&alloc_size_bytes, \
&alloc_uniqtype, \
&alloc_site); \
\
if (__builtin_expect(err != NULL, 0)) goto out; /* liballocs has already counted this abort */ \
#define DO_PRECISIFY(alloc_uniqtype, alloc_start, alloc_size_bytes, allocator) \
if (alloc_uniqtype && alloc_uniqtype->make_precise) \
{ \
/* HACK: special-case to avoid overheads of 1-element array type creation */ \
if (alloc_uniqtype->make_precise == __liballocs_make_array_precise_with_memory_bounds && \
1 == (alloc_size_bytes / alloc_uniqtype->pos_maxoff)) \
{ \
alloc_uniqtype = UNIQTYPE_ARRAY_ELEMENT_TYPE(alloc_uniqtype); \
} \
else \
{ \
/* FIXME: should really do a fuller treatment of make_precise, to allow e.g. */ \
/* returning a fresh uniqtype into a buffer, and (even) passing mcontext. */ \
alloc_uniqtype = alloc_uniqtype->make_precise(alloc_uniqtype, \
NULL, 0, (void*) alloc_start, (void*) alloc_start, alloc_size_bytes, \
__builtin_return_address(0), NULL); \
} \
/* Now ask the meta-alloc protocol to update that object's metadata to this type. */ \
if (allocator && allocator->set_type) allocator->set_type(NULL, (void*) alloc_start, alloc_uniqtype); \
}
#define INIT_SUBOBJ_SEARCH(obj) \
struct uniqtype *cur_obj_uniqtype = alloc_uniqtype; \
struct uniqtype *cur_containing_uniqtype = NULL; \
struct uniqtype_rel_info *cur_contained_pos = NULL; \
unsigned cumulative_offset_searched = 0; \
unsigned target_offset_within_uniqtype = (char*) obj - (char*) alloc_start;
struct starts_at_target_offset_and_has_type_nocache_args {
unsigned target_offset;
struct uniqtype *test_type;
};
static _Bool starts_at_target_offset_and_has_type_nocache(struct uniqtype *u,
struct uniqtype_containment_ctxt *ucc,
unsigned u_offset_from_search_start,
void *args_as_void)
{
struct starts_at_target_offset_and_has_type_nocache_args *args
= (struct starts_at_target_offset_and_has_type_nocache_args *) args_as_void;
return args->target_offset == u_offset_from_search_start
&& u == args->test_type;
}
struct starts_at_target_offset_and_has_type_args {
struct starts_at_target_offset_and_has_type_nocache_args nocache_args;
uintptr_t alloc_base;
struct allocator *a;
struct uniqtype *out_cur_obj_uniqtype;
unsigned out_offset_from_search_start;
};
#define MAX_TO_CACHE 1
static inline unsigned chain_cache_toplevel(
struct uniqtype *cur_u,
uintptr_t cur_u_addr,
struct uniqtype_containment_ctxt *cur_ucc,
uintptr_t initial_u_addr,
struct starts_at_target_offset_and_has_type_nocache_args *nocache_args)
{
/* First we always recurse up to the top. */
unsigned n_so_far = 0;
if (cur_ucc->next) return chain_cache_toplevel(
cur_ucc->u_container,
cur_u_addr - cur_ucc->u_offset_within_container,
cur_ucc->next,
initial_u_addr,
nocache_args
);
// we're toplevel; we definitely cache something
if (UNIQTYPE_IS_ARRAY_TYPE(cur_u))
{
/* We now have several potentially distinct types in play.
- "t" is the initial u, i.e. the test type.
- the array type cur_u
- the array element type. */
assert(UNIQTYPE_HAS_KNOWN_LENGTH(cur_u));
struct uniqtype *array_element_type = UNIQTYPE_ARRAY_ELEMENT_TYPE(cur_u);
uintptr_t array_base = cur_u_addr;
uintptr_t array_end = cur_u_addr + cur_u->pos_maxoff;
/* If our test-type instance was not found at offset zero,
* or if our array period does not equal the test type size,
* we record a containment fact in the uniqtype itself. */
if (0 != (initial_u_addr - cur_u_addr) % array_element_type->pos_maxoff
|| nocache_args->test_type->pos_maxoff != array_element_type->pos_maxoff)
{
// cache a containment fact
array_element_type->cache_word = (struct alloc_addr_info) {
.addr = (unsigned long) nocache_args->test_type,
.bits = (initial_u_addr - cur_u_addr) % array_element_type->pos_maxoff
};
}
cache_is_a((char*) array_base,
/* range_limit */ (char*) array_end,
/* period */ array_element_type->pos_maxoff,
/* we cache the fact that it contains <test_uniqtype>s, not <array element type>s! */
/* offset_to_a_t */ (initial_u_addr - cur_u_addr) % array_element_type->pos_maxoff,
/* t */ nocache_args->test_type,
/* depth */ 1 /* HACK FIXME */);
return 1;
}
// didn't find an array; or we may be a top-level object. Just cache that object
if (0 != initial_u_addr - cur_u_addr)
{
// cache a containment fact
cur_u->cache_word = (struct alloc_addr_info) {
.addr = (unsigned long) nocache_args->test_type,
.bits = (initial_u_addr - cur_u_addr)
};
}
cache_is_a(/* range_base */ (char*) cur_u_addr,
/* range_limit */ (char*) cur_u + cur_u->pos_maxoff,
/* period */ nocache_args->test_type->pos_maxoff,
/* offset_to_a_t */ initial_u_addr - cur_u_addr,
/* t */ nocache_args->test_type,
/* depth */ 1 /* HACK FIXME */);
return 1;