2019-08-14 10:47:11 +02:00
|
|
|
//===-- ubsan_type_hash_itanium.cpp ---------------------------------------===//
|
2015-10-21 09:32:45 +02:00
|
|
|
//
|
2019-08-14 10:47:11 +02:00
|
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
2015-10-21 09:32:45 +02:00
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
//
|
|
|
|
// Implementation of type hashing/lookup for Itanium C++ ABI.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
|
|
|
#include "sanitizer_common/sanitizer_platform.h"
|
|
|
|
#include "ubsan_platform.h"
|
2020-11-13 17:03:23 +01:00
|
|
|
#if CAN_SANITIZE_UB && !defined(_MSC_VER)
|
2015-10-21 09:32:45 +02:00
|
|
|
#include "ubsan_type_hash.h"
|
|
|
|
|
|
|
|
#include "sanitizer_common/sanitizer_common.h"
|
2020-06-01 21:15:18 +02:00
|
|
|
#include "sanitizer_common/sanitizer_ptrauth.h"
|
2015-10-21 09:32:45 +02:00
|
|
|
|
|
|
|
// The following are intended to be binary compatible with the definitions
|
|
|
|
// given in the Itanium ABI. We make no attempt to be ODR-compatible with
|
|
|
|
// those definitions, since existing ABI implementations aren't.
|
|
|
|
|
|
|
|
namespace std {
|
|
|
|
class type_info {
|
|
|
|
public:
|
|
|
|
virtual ~type_info();
|
|
|
|
|
|
|
|
const char *__type_name;
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
|
|
|
namespace __cxxabiv1 {
|
|
|
|
|
|
|
|
/// Type info for classes with no bases, and base class for type info for
|
|
|
|
/// classes with bases.
|
|
|
|
class __class_type_info : public std::type_info {
|
|
|
|
~__class_type_info() override;
|
|
|
|
};
|
|
|
|
|
|
|
|
/// Type info for classes with simple single public inheritance.
|
|
|
|
class __si_class_type_info : public __class_type_info {
|
|
|
|
public:
|
|
|
|
~__si_class_type_info() override;
|
|
|
|
|
|
|
|
const __class_type_info *__base_type;
|
|
|
|
};
|
|
|
|
|
|
|
|
class __base_class_type_info {
|
|
|
|
public:
|
|
|
|
const __class_type_info *__base_type;
|
|
|
|
long __offset_flags;
|
|
|
|
|
|
|
|
enum __offset_flags_masks {
|
|
|
|
__virtual_mask = 0x1,
|
|
|
|
__public_mask = 0x2,
|
|
|
|
__offset_shift = 8
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
/// Type info for classes with multiple, virtual, or non-public inheritance.
|
|
|
|
class __vmi_class_type_info : public __class_type_info {
|
|
|
|
public:
|
|
|
|
~__vmi_class_type_info() override;
|
|
|
|
|
|
|
|
unsigned int flags;
|
|
|
|
unsigned int base_count;
|
|
|
|
__base_class_type_info base_info[1];
|
|
|
|
};
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
namespace abi = __cxxabiv1;
|
|
|
|
|
2016-11-08 23:04:09 +01:00
|
|
|
using namespace __sanitizer;
|
|
|
|
|
2015-10-21 09:32:45 +02:00
|
|
|
// We implement a simple two-level cache for type-checking results. For each
|
|
|
|
// (vptr,type) pair, a hash is computed. This hash is assumed to be globally
|
|
|
|
// unique; if it collides, we will get false negatives, but:
|
|
|
|
// * such a collision would have to occur on the *first* bad access,
|
|
|
|
// * the probability of such a collision is low (and for a 64-bit target, is
|
|
|
|
// negligible), and
|
|
|
|
// * the vptr, and thus the hash, can be affected by ASLR, so multiple runs
|
|
|
|
// give better coverage.
|
|
|
|
//
|
|
|
|
// The first caching layer is a small hash table with no chaining; buckets are
|
|
|
|
// reused as needed. The second caching layer is a large hash table with open
|
|
|
|
// chaining. We can freely evict from either layer since this is just a cache.
|
|
|
|
//
|
|
|
|
// FIXME: Make these hash table accesses thread-safe. The races here are benign:
|
|
|
|
// assuming the unsequenced loads and stores don't misbehave too badly,
|
|
|
|
// the worst case is false negatives or poor cache behavior, not false
|
|
|
|
// positives or crashes.
|
|
|
|
|
|
|
|
/// Find a bucket to store the given hash value in.
|
|
|
|
static __ubsan::HashValue *getTypeCacheHashTableBucket(__ubsan::HashValue V) {
|
|
|
|
static const unsigned HashTableSize = 65537;
|
|
|
|
static __ubsan::HashValue __ubsan_vptr_hash_set[HashTableSize];
|
|
|
|
|
|
|
|
unsigned First = (V & 65535) ^ 1;
|
|
|
|
unsigned Probe = First;
|
|
|
|
for (int Tries = 5; Tries; --Tries) {
|
|
|
|
if (!__ubsan_vptr_hash_set[Probe] || __ubsan_vptr_hash_set[Probe] == V)
|
|
|
|
return &__ubsan_vptr_hash_set[Probe];
|
|
|
|
Probe += ((V >> 16) & 65535) + 1;
|
|
|
|
if (Probe >= HashTableSize)
|
|
|
|
Probe -= HashTableSize;
|
|
|
|
}
|
|
|
|
// FIXME: Pick a random entry from the probe sequence to evict rather than
|
|
|
|
// just taking the first.
|
|
|
|
return &__ubsan_vptr_hash_set[First];
|
|
|
|
}
|
|
|
|
|
|
|
|
/// \brief Determine whether \p Derived has a \p Base base class subobject at
|
|
|
|
/// offset \p Offset.
|
|
|
|
static bool isDerivedFromAtOffset(const abi::__class_type_info *Derived,
|
|
|
|
const abi::__class_type_info *Base,
|
|
|
|
sptr Offset) {
|
2016-11-08 23:04:09 +01:00
|
|
|
if (Derived->__type_name == Base->__type_name ||
|
2019-08-14 10:47:11 +02:00
|
|
|
__ubsan::checkTypeInfoEquality(Derived, Base))
|
2015-10-21 09:32:45 +02:00
|
|
|
return Offset == 0;
|
|
|
|
|
|
|
|
if (const abi::__si_class_type_info *SI =
|
|
|
|
dynamic_cast<const abi::__si_class_type_info*>(Derived))
|
|
|
|
return isDerivedFromAtOffset(SI->__base_type, Base, Offset);
|
|
|
|
|
|
|
|
const abi::__vmi_class_type_info *VTI =
|
|
|
|
dynamic_cast<const abi::__vmi_class_type_info*>(Derived);
|
|
|
|
if (!VTI)
|
|
|
|
// No base class subobjects.
|
|
|
|
return false;
|
|
|
|
|
|
|
|
// Look for a base class which is derived from \p Base at the right offset.
|
|
|
|
for (unsigned int base = 0; base != VTI->base_count; ++base) {
|
|
|
|
// FIXME: Curtail the recursion if this base can't possibly contain the
|
|
|
|
// given offset.
|
|
|
|
sptr OffsetHere = VTI->base_info[base].__offset_flags >>
|
|
|
|
abi::__base_class_type_info::__offset_shift;
|
|
|
|
if (VTI->base_info[base].__offset_flags &
|
|
|
|
abi::__base_class_type_info::__virtual_mask)
|
|
|
|
// For now, just punt on virtual bases and say 'yes'.
|
|
|
|
// FIXME: OffsetHere is the offset in the vtable of the virtual base
|
|
|
|
// offset. Read the vbase offset out of the vtable and use it.
|
|
|
|
return true;
|
|
|
|
if (isDerivedFromAtOffset(VTI->base_info[base].__base_type,
|
|
|
|
Base, Offset - OffsetHere))
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
/// \brief Find the derived-most dynamic base class of \p Derived at offset
|
|
|
|
/// \p Offset.
|
|
|
|
static const abi::__class_type_info *findBaseAtOffset(
|
|
|
|
const abi::__class_type_info *Derived, sptr Offset) {
|
|
|
|
if (!Offset)
|
|
|
|
return Derived;
|
|
|
|
|
|
|
|
if (const abi::__si_class_type_info *SI =
|
|
|
|
dynamic_cast<const abi::__si_class_type_info*>(Derived))
|
|
|
|
return findBaseAtOffset(SI->__base_type, Offset);
|
|
|
|
|
|
|
|
const abi::__vmi_class_type_info *VTI =
|
|
|
|
dynamic_cast<const abi::__vmi_class_type_info*>(Derived);
|
|
|
|
if (!VTI)
|
|
|
|
// No base class subobjects.
|
2016-11-08 23:04:09 +01:00
|
|
|
return nullptr;
|
2015-10-21 09:32:45 +02:00
|
|
|
|
|
|
|
for (unsigned int base = 0; base != VTI->base_count; ++base) {
|
|
|
|
sptr OffsetHere = VTI->base_info[base].__offset_flags >>
|
|
|
|
abi::__base_class_type_info::__offset_shift;
|
|
|
|
if (VTI->base_info[base].__offset_flags &
|
|
|
|
abi::__base_class_type_info::__virtual_mask)
|
|
|
|
// FIXME: Can't handle virtual bases yet.
|
|
|
|
continue;
|
|
|
|
if (const abi::__class_type_info *Base =
|
|
|
|
findBaseAtOffset(VTI->base_info[base].__base_type,
|
|
|
|
Offset - OffsetHere))
|
|
|
|
return Base;
|
|
|
|
}
|
|
|
|
|
2016-11-08 23:04:09 +01:00
|
|
|
return nullptr;
|
2015-10-21 09:32:45 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
namespace {
|
|
|
|
|
|
|
|
struct VtablePrefix {
|
|
|
|
/// The offset from the vptr to the start of the most-derived object.
|
|
|
|
/// This will only be greater than zero in some virtual base class vtables
|
|
|
|
/// used during object con-/destruction, and will usually be exactly zero.
|
|
|
|
sptr Offset;
|
|
|
|
/// The type_info object describing the most-derived class type.
|
|
|
|
std::type_info *TypeInfo;
|
|
|
|
};
|
|
|
|
VtablePrefix *getVtablePrefix(void *Vtable) {
|
2020-06-01 21:15:18 +02:00
|
|
|
Vtable = ptrauth_auth_data(Vtable, ptrauth_key_cxx_vtable_pointer, 0);
|
2015-10-21 09:32:45 +02:00
|
|
|
VtablePrefix *Vptr = reinterpret_cast<VtablePrefix*>(Vtable);
|
|
|
|
VtablePrefix *Prefix = Vptr - 1;
|
ubsan.c (ubsan_expand_null_ifn): Use _v1 suffixed type mismatch builtins...
* ubsan.c (ubsan_expand_null_ifn): Use _v1 suffixed type mismatch
builtins, store max (log2 (align), 0) into uchar field instead of
align into uptr field.
(ubsan_expand_objsize_ifn): Use _v1 suffixed type mismatch builtins,
store uchar 0 field instead of uptr 0 field.
(instrument_nonnull_return): Use _v1 suffixed nonnull return builtin,
instead of passing one address of struct with 2 locations pass
two addresses of structs with 1 location each.
* sanitizer.def (BUILT_IN_UBSAN_HANDLE_TYPE_MISMATCH,
BUILT_IN_UBSAN_HANDLE_TYPE_MISMATCH_ABORT,
BUILT_IN_UBSAN_HANDLE_NONNULL_RETURN,
BUILT_IN_UBSAN_HANDLE_NONNULL_RETURN_ABORT): Removed.
(BUILT_IN_UBSAN_HANDLE_TYPE_MISMATCH_V1,
BUILT_IN_UBSAN_HANDLE_TYPE_MISMATCH_V1_ABORT,
BUILT_IN_UBSAN_HANDLE_NONNULL_RETURN_V1,
BUILT_IN_UBSAN_HANDLE_NONNULL_RETURN_V1_ABORT): New builtins.
* c-c++-common/ubsan/float-cast-overflow-1.c: Drop value keyword
from expected output regexps.
* c-c++-common/ubsan/float-cast-overflow-2.c: Likewise.
* c-c++-common/ubsan/float-cast-overflow-3.c: Likewise.
* c-c++-common/ubsan/float-cast-overflow-4.c: Likewise.
* c-c++-common/ubsan/float-cast-overflow-5.c: Likewise.
* c-c++-common/ubsan/float-cast-overflow-6.c: Likewise.
* c-c++-common/ubsan/float-cast-overflow-8.c: Likewise.
* c-c++-common/ubsan/float-cast-overflow-9.c: Likewise.
* c-c++-common/ubsan/float-cast-overflow-10.c: Likewise.
* g++.dg/ubsan/float-cast-overflow-bf.C: Likewise.
* gcc.dg/ubsan/float-cast-overflow-bf.c: Likewise.
* g++.dg/asan/default-options-1.C (__asan_default_options): Add
used attribute.
* g++.dg/asan/asan_test.C: Run with ASAN_OPTIONS=handle_segv=2
in the environment.
* All source files: Merge from upstream 315899.
* asan/Makefile.am (nodist_saninclude_HEADERS): Add
include/sanitizer/tsan_interface.h.
* asan/libtool-version: Bump the libasan SONAME.
* lsan/Makefile.am (sanitizer_lsan_files): Add lsan_common_mac.cc.
(lsan_files): Add lsan_linux.cc, lsan_mac.cc and lsan_malloc_mac.cc.
* sanitizer_common/Makefile.am (sanitizer_common_files): Add
sancov_flags.cc, sanitizer_allocator_checks.cc,
sanitizer_coverage_libcdep_new.cc, sanitizer_errno.cc,
sanitizer_file.cc, sanitizer_mac_libcdep.cc and
sanitizer_stoptheworld_mac.cc. Remove sanitizer_coverage_libcdep.cc
and sanitizer_coverage_mapping_libcdep.cc.
* tsan/Makefile.am (tsan_files): Add tsan_external.cc.
* ubsan/Makefile.am (DEFS): Add -DUBSAN_CAN_USE_CXXABI=1.
(ubsan_files): Add ubsan_init_standalone.cc and
ubsan_signals_standalone.cc.
* ubsan/libtool-version: Bump the libubsan SONAME.
* asan/Makefile.in: Regenerate.
* lsan/Makefile.in: Regenerate.
* sanitizer_common/Makefile.in: Regenerate.
* tsan/Makefile.in: Regenerate.
* ubsan/Makefile.in: Regenerate.
From-SVN: r253887
2017-10-19 13:23:59 +02:00
|
|
|
if (!IsAccessibleMemoryRange((uptr)Prefix, sizeof(VtablePrefix)))
|
|
|
|
return nullptr;
|
2015-10-21 09:32:45 +02:00
|
|
|
if (!Prefix->TypeInfo)
|
|
|
|
// This can't possibly be a valid vtable.
|
2016-11-08 23:04:09 +01:00
|
|
|
return nullptr;
|
2015-10-21 09:32:45 +02:00
|
|
|
return Prefix;
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
bool __ubsan::checkDynamicType(void *Object, void *Type, HashValue Hash) {
|
|
|
|
// A crash anywhere within this function probably means the vptr is corrupted.
|
|
|
|
// FIXME: Perform these checks more cautiously.
|
|
|
|
|
|
|
|
// Check whether this is something we've evicted from the cache.
|
|
|
|
HashValue *Bucket = getTypeCacheHashTableBucket(Hash);
|
|
|
|
if (*Bucket == Hash) {
|
|
|
|
__ubsan_vptr_type_cache[Hash % VptrTypeCacheSize] = Hash;
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
void *VtablePtr = *reinterpret_cast<void **>(Object);
|
|
|
|
VtablePrefix *Vtable = getVtablePrefix(VtablePtr);
|
|
|
|
if (!Vtable)
|
|
|
|
return false;
|
2016-11-08 23:04:09 +01:00
|
|
|
if (Vtable->Offset < -VptrMaxOffsetToTop || Vtable->Offset > VptrMaxOffsetToTop) {
|
|
|
|
// Too large or too small offset are signs of Vtable corruption.
|
|
|
|
return false;
|
|
|
|
}
|
2015-10-21 09:32:45 +02:00
|
|
|
|
|
|
|
// Check that this is actually a type_info object for a class type.
|
|
|
|
abi::__class_type_info *Derived =
|
|
|
|
dynamic_cast<abi::__class_type_info*>(Vtable->TypeInfo);
|
|
|
|
if (!Derived)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
abi::__class_type_info *Base = (abi::__class_type_info*)Type;
|
|
|
|
if (!isDerivedFromAtOffset(Derived, Base, -Vtable->Offset))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
// Success. Cache this result.
|
|
|
|
__ubsan_vptr_type_cache[Hash % VptrTypeCacheSize] = Hash;
|
|
|
|
*Bucket = Hash;
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
__ubsan::DynamicTypeInfo
|
|
|
|
__ubsan::getDynamicTypeInfoFromVtable(void *VtablePtr) {
|
|
|
|
VtablePrefix *Vtable = getVtablePrefix(VtablePtr);
|
|
|
|
if (!Vtable)
|
2016-11-08 23:04:09 +01:00
|
|
|
return DynamicTypeInfo(nullptr, 0, nullptr);
|
|
|
|
if (Vtable->Offset < -VptrMaxOffsetToTop || Vtable->Offset > VptrMaxOffsetToTop)
|
|
|
|
return DynamicTypeInfo(nullptr, Vtable->Offset, nullptr);
|
2015-10-21 09:32:45 +02:00
|
|
|
const abi::__class_type_info *ObjectType = findBaseAtOffset(
|
|
|
|
static_cast<const abi::__class_type_info*>(Vtable->TypeInfo),
|
|
|
|
-Vtable->Offset);
|
|
|
|
return DynamicTypeInfo(Vtable->TypeInfo->__type_name, -Vtable->Offset,
|
|
|
|
ObjectType ? ObjectType->__type_name : "<unknown>");
|
|
|
|
}
|
|
|
|
|
2019-08-14 10:47:11 +02:00
|
|
|
bool __ubsan::checkTypeInfoEquality(const void *TypeInfo1,
|
|
|
|
const void *TypeInfo2) {
|
|
|
|
auto TI1 = static_cast<const std::type_info *>(TypeInfo1);
|
|
|
|
auto TI2 = static_cast<const std::type_info *>(TypeInfo2);
|
|
|
|
return SANITIZER_NON_UNIQUE_TYPEINFO && TI1->__type_name[0] != '*' &&
|
|
|
|
TI2->__type_name[0] != '*' &&
|
|
|
|
!internal_strcmp(TI1->__type_name, TI2->__type_name);
|
|
|
|
}
|
|
|
|
|
2015-10-21 09:32:45 +02:00
|
|
|
#endif // CAN_SANITIZE_UB && !SANITIZER_WINDOWS
|