llvm-project

1
#include "sanitizer_common/sanitizer_atomic.h"
2

3
#include <stdlib.h>
4
#include <stdint.h>
5
#include <string.h>
6
#include <unistd.h>
7

8
#ifdef KERNEL_USE
9
extern "C" void ubsan_message(const char *msg);
10
static void message(const char *msg) { ubsan_message(msg); }
11
#else
12
static void message(const char *msg) {
13
  (void)write(2, msg, strlen(msg));
14
}
15
#endif
16

17
static const int kMaxCallerPcs = 20;
18
static __sanitizer::atomic_uintptr_t caller_pcs[kMaxCallerPcs];
19
// Number of elements in caller_pcs. A special value of kMaxCallerPcs + 1 means
20
// that "too many errors" has already been reported.
21
static __sanitizer::atomic_uint32_t caller_pcs_sz;
22

23
__attribute__((noinline)) static bool report_this_error(uintptr_t caller) {
24
  if (caller == 0)
25
    return false;
26
  while (true) {
27
    unsigned sz = __sanitizer::atomic_load_relaxed(&caller_pcs_sz);
28
    if (sz > kMaxCallerPcs) return false;  // early exit
29
    // when sz==kMaxCallerPcs print "too many errors", but only when cmpxchg
30
    // succeeds in order to not print it multiple times.
31
    if (sz > 0 && sz < kMaxCallerPcs) {
32
      uintptr_t p;
33
      for (unsigned i = 0; i < sz; ++i) {
34
        p = __sanitizer::atomic_load_relaxed(&caller_pcs[i]);
35
        if (p == 0) break;  // Concurrent update.
36
        if (p == caller) return false;
37
      }
38
      if (p == 0) continue;  // FIXME: yield?
39
    }
40

41
    if (!__sanitizer::atomic_compare_exchange_strong(
42
            &caller_pcs_sz, &sz, sz + 1, __sanitizer::memory_order_seq_cst))
43
      continue;  // Concurrent update! Try again from the start.
44

45
    if (sz == kMaxCallerPcs) {
46
      message("ubsan: too many errors\n");
47
      return false;
48
    }
49
    __sanitizer::atomic_store_relaxed(&caller_pcs[sz], caller);
50
    return true;
51
  }
52
}
53

54
__attribute__((noinline)) static void decorate_msg(char *buf,
55
                                                   uintptr_t caller) {
56
  // print the address by nibbles
57
  for (unsigned shift = sizeof(uintptr_t) * 8; shift;) {
58
    shift -= 4;
59
    unsigned nibble = (caller >> shift) & 0xf;
60
    *(buf++) = nibble < 10 ? nibble + '0' : nibble - 10 + 'a';
61
  }
62
  // finish the message
63
  buf[0] = '\n';
64
  buf[1] = '\0';
65
}
66

67
#if defined(__ANDROID__)
68
extern "C" __attribute__((weak)) void android_set_abort_message(const char *);
69
static void abort_with_message(const char *msg) {
70
  if (&android_set_abort_message) android_set_abort_message(msg);
71
  abort();
72
}
73
#else
74
static void abort_with_message(const char *) { abort(); }
75
#endif
76

77
#if SANITIZER_DEBUG
78
namespace __sanitizer {
79
// The DCHECK macro needs this symbol to be defined.
80
void NORETURN CheckFailed(const char *file, int, const char *cond, u64, u64) {
81
  message("Sanitizer CHECK failed: ");
82
  message(file);
83
  message(":?? : "); // FIXME: Show line number.
84
  message(cond);
85
  abort();
86
}
87
} // namespace __sanitizer
88
#endif
89

90
#define INTERFACE extern "C" __attribute__((visibility("default")))
91

92
// How many chars we need to reserve to print an address.
93
constexpr unsigned kAddrBuf = SANITIZER_WORDSIZE / 4;
94
#define MSG_TMPL(msg) "ubsan: " msg " by 0x"
95
#define MSG_TMPL_END(buf, msg) (buf + sizeof(MSG_TMPL(msg)) - 1)
96
// Reserve an additional byte for '\n'.
97
#define MSG_BUF_LEN(msg) (sizeof(MSG_TMPL(msg)) + kAddrBuf + 1)
98

99
#define HANDLER_RECOVER(name, msg)                               \
100
  INTERFACE void __ubsan_handle_##name##_minimal() {             \
101
    uintptr_t caller = GET_CALLER_PC();                  \
102
    if (!report_this_error(caller)) return;                      \
103
    char msg_buf[MSG_BUF_LEN(msg)] = MSG_TMPL(msg);              \
104
    decorate_msg(MSG_TMPL_END(msg_buf, msg), caller);            \
105
    message(msg_buf);                                            \
106
  }
107

108
#define HANDLER_NORECOVER(name, msg)                             \
109
  INTERFACE void __ubsan_handle_##name##_minimal_abort() {       \
110
    char msg_buf[MSG_BUF_LEN(msg)] = MSG_TMPL(msg);              \
111
    decorate_msg(MSG_TMPL_END(msg_buf, msg), GET_CALLER_PC());   \
112
    message(msg_buf);                                            \
113
    abort_with_message(msg_buf);                                 \
114
  }
115

116
#define HANDLER(name, msg)                                       \
117
  HANDLER_RECOVER(name, msg)                                     \
118
  HANDLER_NORECOVER(name, msg)
119

120
HANDLER(type_mismatch, "type-mismatch")
121
HANDLER(alignment_assumption, "alignment-assumption")
122
HANDLER(add_overflow, "add-overflow")
123
HANDLER(sub_overflow, "sub-overflow")
124
HANDLER(mul_overflow, "mul-overflow")
125
HANDLER(negate_overflow, "negate-overflow")
126
HANDLER(divrem_overflow, "divrem-overflow")
127
HANDLER(shift_out_of_bounds, "shift-out-of-bounds")
128
HANDLER(out_of_bounds, "out-of-bounds")
129
HANDLER_RECOVER(builtin_unreachable, "builtin-unreachable")
130
HANDLER_RECOVER(missing_return, "missing-return")
131
HANDLER(vla_bound_not_positive, "vla-bound-not-positive")
132
HANDLER(float_cast_overflow, "float-cast-overflow")
133
HANDLER(load_invalid_value, "load-invalid-value")
134
HANDLER(invalid_builtin, "invalid-builtin")
135
HANDLER(invalid_objc_cast, "invalid-objc-cast")
136
HANDLER(function_type_mismatch, "function-type-mismatch")
137
HANDLER(implicit_conversion, "implicit-conversion")
138
HANDLER(nonnull_arg, "nonnull-arg")
139
HANDLER(nonnull_return, "nonnull-return")
140
HANDLER(nullability_arg, "nullability-arg")
141
HANDLER(nullability_return, "nullability-return")
142
HANDLER(pointer_overflow, "pointer-overflow")
143
HANDLER(cfi_check_fail, "cfi-check-fail")
144