src/compiler-rt/lib/asan/tests/asan_interface_test.cc

   1 //===-- asan_interface_test.cc --------------------------------------------===//
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 // This file is a part of AddressSanitizer, an address sanity checker.
  11 //
  12 //===----------------------------------------------------------------------===//
  13 #include "asan_test_utils.h"
  14 #include <sanitizer/allocator_interface.h>
  15 #include <sanitizer/asan_interface.h>
  16
  17 TEST(AddressSanitizerInterface, GetEstimatedAllocatedSize) {
  18   EXPECT_EQ(0U, __sanitizer_get_estimated_allocated_size(0));
  19   const size_t sizes[] = { 1, 30, 1<<30 };
  20   for (size_t i = 0; i < 3; i++) {
  21     EXPECT_EQ(sizes[i], __sanitizer_get_estimated_allocated_size(sizes[i]));
  22   }
  23 }
  24
  25 static const char* kGetAllocatedSizeErrorMsg =
  26   "attempting to call __sanitizer_get_allocated_size";
  27
  28 TEST(AddressSanitizerInterface, GetAllocatedSizeAndOwnershipTest) {
  29   const size_t kArraySize = 100;
  30   char *array = Ident((char*)malloc(kArraySize));
  31   int *int_ptr = Ident(new int);
  32
  33   // Allocated memory is owned by allocator. Allocated size should be
  34   // equal to requested size.
  35   EXPECT_EQ(true, __sanitizer_get_ownership(array));
  36   EXPECT_EQ(kArraySize, __sanitizer_get_allocated_size(array));
  37   EXPECT_EQ(true, __sanitizer_get_ownership(int_ptr));
  38   EXPECT_EQ(sizeof(int), __sanitizer_get_allocated_size(int_ptr));
  39
  40   // We cannot call GetAllocatedSize from the memory we didn't map,
  41   // and from the interior pointers (not returned by previous malloc).
  42   void *wild_addr = (void*)0x1;
  43   EXPECT_FALSE(__sanitizer_get_ownership(wild_addr));
  44   EXPECT_DEATH(__sanitizer_get_allocated_size(wild_addr),
  45                kGetAllocatedSizeErrorMsg);
  46   EXPECT_FALSE(__sanitizer_get_ownership(array + kArraySize / 2));
  47   EXPECT_DEATH(__sanitizer_get_allocated_size(array + kArraySize / 2),
  48                kGetAllocatedSizeErrorMsg);
  49
  50   // NULL is not owned, but is a valid argument for
  51   // __sanitizer_get_allocated_size().
  52   EXPECT_FALSE(__sanitizer_get_ownership(NULL));
  53   EXPECT_EQ(0U, __sanitizer_get_allocated_size(NULL));
  54
  55   // When memory is freed, it's not owned, and call to GetAllocatedSize
  56   // is forbidden.
  57   free(array);
  58   EXPECT_FALSE(__sanitizer_get_ownership(array));
  59   EXPECT_DEATH(__sanitizer_get_allocated_size(array),
  60                kGetAllocatedSizeErrorMsg);
  61   delete int_ptr;
  62
  63   void *zero_alloc = Ident(malloc(0));
  64   if (zero_alloc != 0) {
  65     // If malloc(0) is not null, this pointer is owned and should have valid
  66     // allocated size.
  67     EXPECT_TRUE(__sanitizer_get_ownership(zero_alloc));
  68     // Allocated size is 0 or 1 depending on the allocator used.
  69     EXPECT_LT(__sanitizer_get_allocated_size(zero_alloc), 2U);
  70   }
  71   free(zero_alloc);
  72 }
  73
  74 TEST(AddressSanitizerInterface, GetCurrentAllocatedBytesTest) {
  75   size_t before_malloc, after_malloc, after_free;
  76   char *array;
  77   const size_t kMallocSize = 100;
  78   before_malloc = __sanitizer_get_current_allocated_bytes();
  79
  80   array = Ident((char*)malloc(kMallocSize));
  81   after_malloc = __sanitizer_get_current_allocated_bytes();
  82   EXPECT_EQ(before_malloc + kMallocSize, after_malloc);
  83
  84   free(array);
  85   after_free = __sanitizer_get_current_allocated_bytes();
  86   EXPECT_EQ(before_malloc, after_free);
  87 }
  88
  89 TEST(AddressSanitizerInterface, GetHeapSizeTest) {
  90   // ASan allocator does not keep huge chunks in free list, but unmaps them.
  91   // The chunk should be greater than the quarantine size,
  92   // otherwise it will be stuck in quarantine instead of being unmaped.
  93   static const size_t kLargeMallocSize = (1 << 28) + 1;  // 256M
  94   free(Ident(malloc(kLargeMallocSize)));  // Drain quarantine.
  95   size_t old_heap_size = __sanitizer_get_heap_size();
  96   for (int i = 0; i < 3; i++) {
  97     // fprintf(stderr, "allocating %zu bytes:\n", kLargeMallocSize);
  98     free(Ident(malloc(kLargeMallocSize)));
  99     EXPECT_EQ(old_heap_size, __sanitizer_get_heap_size());
 100   }
 101 }
 102
 103 static const size_t kManyThreadsMallocSizes[] = {5, 1UL<<10, 1UL<<14, 357};
 104 static const size_t kManyThreadsIterations = 250;
 105 static const size_t kManyThreadsNumThreads =
 106   (SANITIZER_WORDSIZE == 32) ? 40 : 200;
 107
 108 static void *ManyThreadsWithStatsWorker(void *arg) {
 109   (void)arg;
 110   for (size_t iter = 0; iter < kManyThreadsIterations; iter++) {
 111     for (size_t size_index = 0; size_index < 4; size_index++) {
 112       free(Ident(malloc(kManyThreadsMallocSizes[size_index])));
 113     }
 114   }
 115   // Just one large allocation.
 116   free(Ident(malloc(1 << 20)));
 117   return 0;
 118 }
 119
 120 TEST(AddressSanitizerInterface, ManyThreadsWithStatsStressTest) {
 121   size_t before_test, after_test, i;
 122   pthread_t threads[kManyThreadsNumThreads];
 123   before_test = __sanitizer_get_current_allocated_bytes();
 124   for (i = 0; i < kManyThreadsNumThreads; i++) {
 125     PTHREAD_CREATE(&threads[i], 0,
 126                    (void* (*)(void *x))ManyThreadsWithStatsWorker, (void*)i);
 127   }
 128   for (i = 0; i < kManyThreadsNumThreads; i++) {
 129     PTHREAD_JOIN(threads[i], 0);
 130   }
 131   after_test = __sanitizer_get_current_allocated_bytes();
 132   // ASan stats also reflect memory usage of internal ASan RTL structs,
 133   // so we can't check for equality here.
 134   EXPECT_LT(after_test, before_test + (1UL<<20));
 135 }
 136
 137 static void DoDoubleFree() {
 138   int *x = Ident(new int);
 139   delete Ident(x);
 140   delete Ident(x);
 141 }
 142
 143 static void MyDeathCallback() {
 144   fprintf(stderr, "MyDeathCallback\n");
 145   fflush(0);  // On Windows, stderr doesn't flush on crash.
 146 }
 147
 148 TEST(AddressSanitizerInterface, DeathCallbackTest) {
 149   __asan_set_death_callback(MyDeathCallback);
 150   EXPECT_DEATH(DoDoubleFree(), "MyDeathCallback");
 151   __asan_set_death_callback(NULL);
 152 }
 153
 154 static const char* kUseAfterPoisonErrorMessage = "use-after-poison";
 155
 156 #define GOOD_ACCESS(ptr, offset)  \
 157     EXPECT_FALSE(__asan_address_is_poisoned(ptr + offset))
 158
 159 #define BAD_ACCESS(ptr, offset) \
 160     EXPECT_TRUE(__asan_address_is_poisoned(ptr + offset))
 161
 162 TEST(AddressSanitizerInterface, SimplePoisonMemoryRegionTest) {
 163   char *array = Ident((char*)malloc(120));
 164   // poison array[40..80)
 165   __asan_poison_memory_region(array + 40, 40);
 166   GOOD_ACCESS(array, 39);
 167   GOOD_ACCESS(array, 80);
 168   BAD_ACCESS(array, 40);
 169   BAD_ACCESS(array, 60);
 170   BAD_ACCESS(array, 79);
 171   char value;
 172   EXPECT_DEATH(value = Ident(array[40]), kUseAfterPoisonErrorMessage);
 173   __asan_unpoison_memory_region(array + 40, 40);
 174   // access previously poisoned memory.
 175   GOOD_ACCESS(array, 40);
 176   GOOD_ACCESS(array, 79);
 177   free(array);
 178 }
 179
 180 TEST(AddressSanitizerInterface, OverlappingPoisonMemoryRegionTest) {
 181   char *array = Ident((char*)malloc(120));
 182   // Poison [0..40) and [80..120)
 183   __asan_poison_memory_region(array, 40);
 184   __asan_poison_memory_region(array + 80, 40);
 185   BAD_ACCESS(array, 20);
 186   GOOD_ACCESS(array, 60);
 187   BAD_ACCESS(array, 100);
 188   // Poison whole array - [0..120)
 189   __asan_poison_memory_region(array, 120);
 190   BAD_ACCESS(array, 60);
 191   // Unpoison [24..96)
 192   __asan_unpoison_memory_region(array + 24, 72);
 193   BAD_ACCESS(array, 23);
 194   GOOD_ACCESS(array, 24);
 195   GOOD_ACCESS(array, 60);
 196   GOOD_ACCESS(array, 95);
 197   BAD_ACCESS(array, 96);
 198   free(array);
 199 }
 200
 201 TEST(AddressSanitizerInterface, PushAndPopWithPoisoningTest) {
 202   // Vector of capacity 20
 203   char *vec = Ident((char*)malloc(20));
 204   __asan_poison_memory_region(vec, 20);
 205   for (size_t i = 0; i < 7; i++) {
 206     // Simulate push_back.
 207     __asan_unpoison_memory_region(vec + i, 1);
 208     GOOD_ACCESS(vec, i);
 209     BAD_ACCESS(vec, i + 1);
 210   }
 211   for (size_t i = 7; i > 0; i--) {
 212     // Simulate pop_back.
 213     __asan_poison_memory_region(vec + i - 1, 1);
 214     BAD_ACCESS(vec, i - 1);
 215     if (i > 1) GOOD_ACCESS(vec, i - 2);
 216   }
 217   free(vec);
 218 }
 219
 220 // Make sure that each aligned block of size "2^granularity" doesn't have
 221 // "true" value before "false" value.
 222 static void MakeShadowValid(bool *shadow, int length, int granularity) {
 223   bool can_be_poisoned = true;
 224   for (int i = length - 1; i >= 0; i--) {
 225     if (!shadow[i])
 226       can_be_poisoned = false;
 227     if (!can_be_poisoned)
 228       shadow[i] = false;
 229     if (i % (1 << granularity) == 0) {
 230       can_be_poisoned = true;
 231     }
 232   }
 233 }
 234
 235 TEST(AddressSanitizerInterface, PoisoningStressTest) {
 236   const size_t kSize = 24;
 237   bool expected[kSize];
 238   char *arr = Ident((char*)malloc(kSize));
 239   for (size_t l1 = 0; l1 < kSize; l1++) {
 240     for (size_t s1 = 1; l1 + s1 <= kSize; s1++) {
 241       for (size_t l2 = 0; l2 < kSize; l2++) {
 242         for (size_t s2 = 1; l2 + s2 <= kSize; s2++) {
 243           // Poison [l1, l1+s1), [l2, l2+s2) and check result.
 244           __asan_unpoison_memory_region(arr, kSize);
 245           __asan_poison_memory_region(arr + l1, s1);
 246           __asan_poison_memory_region(arr + l2, s2);
 247           memset(expected, false, kSize);
 248           memset(expected + l1, true, s1);
 249           MakeShadowValid(expected, kSize, /*granularity*/ 3);
 250           memset(expected + l2, true, s2);
 251           MakeShadowValid(expected, kSize, /*granularity*/ 3);
 252           for (size_t i = 0; i < kSize; i++) {
 253             ASSERT_EQ(expected[i], __asan_address_is_poisoned(arr + i));
 254           }
 255           // Unpoison [l1, l1+s1) and [l2, l2+s2) and check result.
 256           __asan_poison_memory_region(arr, kSize);
 257           __asan_unpoison_memory_region(arr + l1, s1);
 258           __asan_unpoison_memory_region(arr + l2, s2);
 259           memset(expected, true, kSize);
 260           memset(expected + l1, false, s1);
 261           MakeShadowValid(expected, kSize, /*granularity*/ 3);
 262           memset(expected + l2, false, s2);
 263           MakeShadowValid(expected, kSize, /*granularity*/ 3);
 264           for (size_t i = 0; i < kSize; i++) {
 265             ASSERT_EQ(expected[i], __asan_address_is_poisoned(arr + i));
 266           }
 267         }
 268       }
 269     }
 270   }
 271   free(arr);
 272 }
 273
 274 TEST(AddressSanitizerInterface, GlobalRedzones) {
 275   GOOD_ACCESS(glob1, 1 - 1);
 276   GOOD_ACCESS(glob2, 2 - 1);
 277   GOOD_ACCESS(glob3, 3 - 1);
 278   GOOD_ACCESS(glob4, 4 - 1);
 279   GOOD_ACCESS(glob5, 5 - 1);
 280   GOOD_ACCESS(glob6, 6 - 1);
 281   GOOD_ACCESS(glob7, 7 - 1);
 282   GOOD_ACCESS(glob8, 8 - 1);
 283   GOOD_ACCESS(glob9, 9 - 1);
 284   GOOD_ACCESS(glob10, 10 - 1);
 285   GOOD_ACCESS(glob11, 11 - 1);
 286   GOOD_ACCESS(glob12, 12 - 1);
 287   GOOD_ACCESS(glob13, 13 - 1);
 288   GOOD_ACCESS(glob14, 14 - 1);
 289   GOOD_ACCESS(glob15, 15 - 1);
 290   GOOD_ACCESS(glob16, 16 - 1);
 291   GOOD_ACCESS(glob17, 17 - 1);
 292   GOOD_ACCESS(glob1000, 1000 - 1);
 293   GOOD_ACCESS(glob10000, 10000 - 1);
 294   GOOD_ACCESS(glob100000, 100000 - 1);
 295
 296   BAD_ACCESS(glob1, 1);
 297   BAD_ACCESS(glob2, 2);
 298   BAD_ACCESS(glob3, 3);
 299   BAD_ACCESS(glob4, 4);
 300   BAD_ACCESS(glob5, 5);
 301   BAD_ACCESS(glob6, 6);
 302   BAD_ACCESS(glob7, 7);
 303   BAD_ACCESS(glob8, 8);
 304   BAD_ACCESS(glob9, 9);
 305   BAD_ACCESS(glob10, 10);
 306   BAD_ACCESS(glob11, 11);
 307   BAD_ACCESS(glob12, 12);
 308   BAD_ACCESS(glob13, 13);
 309   BAD_ACCESS(glob14, 14);
 310   BAD_ACCESS(glob15, 15);
 311   BAD_ACCESS(glob16, 16);
 312   BAD_ACCESS(glob17, 17);
 313   BAD_ACCESS(glob1000, 1000);
 314   BAD_ACCESS(glob1000, 1100);  // Redzone is at least 101 bytes.
 315   BAD_ACCESS(glob10000, 10000);
 316   BAD_ACCESS(glob10000, 11000);  // Redzone is at least 1001 bytes.
 317   BAD_ACCESS(glob100000, 100000);
 318   BAD_ACCESS(glob100000, 110000);  // Redzone is at least 10001 bytes.
 319 }
 320
 321 TEST(AddressSanitizerInterface, PoisonedRegion) {
 322   size_t rz = 16;
 323   for (size_t size = 1; size <= 64; size++) {
 324     char *p = new char[size];
 325     for (size_t beg = 0; beg < size + rz; beg++) {
 326       for (size_t end = beg; end < size + rz; end++) {
 327         void *first_poisoned = __asan_region_is_poisoned(p + beg, end - beg);
 328         if (beg == end) {
 329           EXPECT_FALSE(first_poisoned);
 330         } else if (beg < size && end <= size) {
 331           EXPECT_FALSE(first_poisoned);
 332         } else if (beg >= size) {
 333           EXPECT_EQ(p + beg, first_poisoned);
 334         } else {
 335           EXPECT_GT(end, size);
 336           EXPECT_EQ(p + size, first_poisoned);
 337         }
 338       }
 339     }
 340     delete [] p;
 341   }
 342 }
 343
 344 // This is a performance benchmark for manual runs.
 345 // asan's memset interceptor calls mem_is_zero for the entire shadow region.
 346 // the profile should look like this:
 347 //     89.10%   [.] __memset_sse2
 348 //     10.50%   [.] __sanitizer::mem_is_zero
 349 // I.e. mem_is_zero should consume ~ SHADOW_GRANULARITY less CPU cycles
 350 // than memset itself.
 351 TEST(AddressSanitizerInterface, DISABLED_StressLargeMemset) {
 352   size_t size = 1 << 20;
 353   char *x = new char[size];
 354   for (int i = 0; i < 100000; i++)
 355     Ident(memset)(x, 0, size);
 356   delete [] x;
 357 }
 358
 359 // Same here, but we run memset with small sizes.
 360 TEST(AddressSanitizerInterface, DISABLED_StressSmallMemset) {
 361   size_t size = 32;
 362   char *x = new char[size];
 363   for (int i = 0; i < 100000000; i++)
 364     Ident(memset)(x, 0, size);
 365   delete [] x;
 366 }
 367 static const char *kInvalidPoisonMessage = "invalid-poison-memory-range";
 368 static const char *kInvalidUnpoisonMessage = "invalid-unpoison-memory-range";
 369
 370 TEST(AddressSanitizerInterface, DISABLED_InvalidPoisonAndUnpoisonCallsTest) {
 371   char *array = Ident((char*)malloc(120));
 372   __asan_unpoison_memory_region(array, 120);
 373   // Try to unpoison not owned memory
 374   EXPECT_DEATH(__asan_unpoison_memory_region(array, 121),
 375                kInvalidUnpoisonMessage);
 376   EXPECT_DEATH(__asan_unpoison_memory_region(array - 1, 120),
 377                kInvalidUnpoisonMessage);
 378
 379   __asan_poison_memory_region(array, 120);
 380   // Try to poison not owned memory.
 381   EXPECT_DEATH(__asan_poison_memory_region(array, 121), kInvalidPoisonMessage);
 382   EXPECT_DEATH(__asan_poison_memory_region(array - 1, 120),
 383                kInvalidPoisonMessage);
 384   free(array);
 385 }
 386
 387 #if !defined(_WIN32)  // FIXME: This should really be a lit test.
 388 static void ErrorReportCallbackOneToZ(const char *report) {
 389   int report_len = strlen(report);
 390   ASSERT_EQ(6, write(2, "ABCDEF", 6));
 391   ASSERT_EQ(report_len, write(2, report, report_len));
 392   ASSERT_EQ(6, write(2, "ABCDEF", 6));
 393   _exit(1);
 394 }
 395
 396 TEST(AddressSanitizerInterface, SetErrorReportCallbackTest) {
 397   __asan_set_error_report_callback(ErrorReportCallbackOneToZ);
 398   EXPECT_DEATH(__asan_report_error(0, 0, 0, 0, true, 1),
 399                ASAN_PCRE_DOTALL "ABCDEF.*AddressSanitizer.*WRITE.*ABCDEF");
 400   __asan_set_error_report_callback(NULL);
 401 }
 402 #endif
 403
 404 TEST(AddressSanitizerInterface, GetOwnershipStressTest) {
 405   std::vector<char *> pointers;
 406   std::vector<size_t> sizes;
 407   const size_t kNumMallocs = 1 << 9;
 408   for (size_t i = 0; i < kNumMallocs; i++) {
 409     size_t size = i * 100 + 1;
 410     pointers.push_back((char*)malloc(size));
 411     sizes.push_back(size);
 412   }
 413   for (size_t i = 0; i < 4000000; i++) {
 414     EXPECT_FALSE(__sanitizer_get_ownership(&pointers));
 415     EXPECT_FALSE(__sanitizer_get_ownership((void*)0x1234));
 416     size_t idx = i % kNumMallocs;
 417     EXPECT_TRUE(__sanitizer_get_ownership(pointers[idx]));
 418     EXPECT_EQ(sizes[idx], __sanitizer_get_allocated_size(pointers[idx]));
 419   }
 420   for (size_t i = 0, n = pointers.size(); i < n; i++)
 421     free(pointers[i]);
 422 }
 423