2 * Copyright (c) 2018 Apple Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
29 #include <stdatomic.h>
30 #include <kern/debug.h>
31 #include <kern/assert.h>
32 #include <libkern/libkern.h>
35 static const bool ubsan_print
= false;
36 static const uint32_t line_acquired
= 0x80000000UL
;
37 static const char *get_type_check_kind(uint8_t kind
);
40 ubsan_buf_log(struct ubsan_buf
*ub
, const char *fmt
, ...)
45 int n
= vscnprintf(ub
->ub_buf
+ ub
->ub_logged
, ub
->ub_buf_size
- ub
->ub_logged
, fmt
, ap
);
49 assert(ub
->ub_logged
<= ub
->ub_buf_size
);
53 ubsan_buf_log_loc(struct ubsan_buf
*ub
, const char *desc
, struct san_src_loc
*loc
)
55 ubsan_buf_log(ub
, "%s:{ file:\"%s\", line:%d, column:%d }",
58 loc
->line
& ~line_acquired
,
63 * return true for the first visit to this loc, false every subsequent time
66 ubsan_loc_acquire(struct san_src_loc
*loc
)
68 uint32_t line
= loc
->line
;
69 if (line
& line_acquired
) {
72 uint32_t acq
= line
| line_acquired
;
73 return atomic_compare_exchange_strong((_Atomic
uint32_t *)&loc
->line
, &line
, acq
);
76 static const char *const
88 format_overflow(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
90 struct san_type_desc
*ty
= v
->overflow
->ty
;
92 "problem:\"%s overflow\", op:\"%s\", ty:\"%s\", width:%d, lhs:0x%llx, rhs:0x%llx",
93 ty
->issigned
? "signed" : "unsigned",
94 overflow_str
[v
->ubsan_type
],
103 format_shift(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
105 struct san_type_desc
*l
= v
->shift
->lhs_t
;
106 struct san_type_desc
*r
= v
->shift
->rhs_t
;
108 ubsan_buf_log(ub
, "problem:\"bad shift\", ");
109 ubsan_buf_log(ub
, "lhs:0x%llx, lty:\"%s\", lsigned:%d, lwidth:%d, ", v
->lhs
, l
->name
, l
->issigned
, 1 << l
->width
);
110 ubsan_buf_log(ub
, "rhs:0x%llx, rty:\"%s\", rsigned:%d, rwidth:%d", v
->rhs
, r
->name
, r
->issigned
, 1 << r
->width
);
113 static const char * const
114 type_check_kinds
[] = {
115 "load of", "store to", "reference binding to", "member access within",
116 "member call on", "constructor call on", "downcast of", "downcast of",
117 "upcast of", "cast to virtual base of", "_Nonnull binding to"
121 get_type_check_kind(uint8_t kind
)
123 return (kind
< (sizeof(type_check_kinds
) / sizeof(type_check_kinds
[0])))
124 ? type_check_kinds
[kind
]
129 format_type_mismatch(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
131 size_t alignment
= 1 << v
->align
->align
;
132 void *ptr
= (void*)v
->lhs
;
133 const char *kind
= get_type_check_kind(v
->align
->kind
);
137 ubsan_buf_log(ub
, "problem:\"%s NULL pointer\", ty:\"%s\"", kind
, v
->align
->ty
->name
);
138 } else if (alignment
&& ((uintptr_t)ptr
& (alignment
- 1))) {
139 //misaligned pointer use
140 ubsan_buf_log(ub
, "problem:\"%s mis-aligned\", address:%p, ty:\"%s\", ",
141 kind
, (void*)v
->lhs
, v
->align
->ty
->name
);
142 ubsan_buf_log(ub
, "required_alignment:%d", 1 << v
->align
->align
);
144 //insufficient object size
145 ubsan_buf_log(ub
, "problem:\"%s insufficient object size\", ty:\"%s\", address:%p",
146 kind
, v
->align
->ty
->name
, ptr
);
151 format_oob(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
153 struct san_type_desc
*aty
= v
->oob
->array_ty
;
154 struct san_type_desc
*ity
= v
->oob
->index_ty
;
155 uintptr_t idx
= v
->lhs
;
157 ubsan_buf_log(ub
, "problem:\"OOB array access\", ");
158 ubsan_buf_log(ub
, "idx:%ld, ", idx
);
159 ubsan_buf_log(ub
, "aty:\"%s\", asigned:%d, awidth:%d, ", aty
->name
, aty
->issigned
, 1 << aty
->width
);
160 ubsan_buf_log(ub
, "ity:\"%s\", isigned:%d, iwidth:%d", ity
->name
, ity
->issigned
, 1 << ity
->width
);
164 format_nullability_arg(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
166 struct ubsan_nullability_arg_desc
*data
= v
->nonnull_arg
;
168 const int arg_index
= data
->arg_index
;
169 const char *attr_type
= v
->lhs
? "nonnull attribute" : "_Nonnull annotation";
171 ubsan_buf_log(ub
, "problem:\"null in argument %d declared with %s\", ", arg_index
, attr_type
);
172 ubsan_buf_log_loc(ub
, "declared", &data
->attr_loc
);
176 format_nonnull_return(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
178 struct san_src_loc
*declaration
= (struct san_src_loc
*)v
->rhs
;
179 const char *return_type
= v
->lhs
? "returns_nonnull attribute" : "_Nonnull return type annotation";
181 ubsan_buf_log(ub
, "problem:\"null returned from function declared with %s\", ", return_type
);
182 ubsan_buf_log_loc(ub
, "declared", declaration
);
186 format_load_invalid_value(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
188 ubsan_buf_log(ub
, "problem:\"invalid value load\", type:\"%s\", value:0x%llx",
189 v
->invalid
->type
->name
, v
->lhs
);
193 format_missing_return(struct ubsan_violation
*v __unused
, struct ubsan_buf
*ub
)
195 ubsan_buf_log(ub
, "problem:\"no value returned from value-returning function\"");
199 format_float_cast_overflow(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
201 struct ubsan_float_desc
*data
= v
->flt
;
203 * Cannot print out offending value (e.g. using %A, %f and so on) as kernel logging
204 * does not support float types (yet).
206 ubsan_buf_log(ub
, "problem:\"%s type value outside the range of %s\"",
207 data
->type_from
->name
, data
->type_to
->name
);
211 get_implicit_conv_type(unsigned char kind
)
213 static const char * const conv_types
[] = {
214 "integer truncation",
215 "unsigned integer truncation",
216 "signed integer truncation",
217 "integer sign change",
218 "signed integer truncation or sign change"
220 static const size_t conv_types_cnt
= sizeof(conv_types
) / sizeof(conv_types
[0]);
222 return kind
< conv_types_cnt
? conv_types
[kind
] : "unknown implicit integer conversion";
226 format_implicit_conversion(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
228 struct ubsan_implicit_conv_desc
*data
= v
->implicit
;
229 struct san_type_desc
*from
= data
->type_from
;
230 struct san_type_desc
*to
= data
->type_to
;
232 ubsan_buf_log(ub
, "problem:\"%s\", ", get_implicit_conv_type(data
->kind
));
233 ubsan_buf_log(ub
, "src value:%#llx type:\"%s\", signed:%d, width:%d, ",
234 v
->lhs
, from
->name
, from
->issigned
, 1 << from
->width
);
235 ubsan_buf_log(ub
, "dst value:%#llx type:\"%s\", signed:%d, width:%d",
236 v
->rhs
, to
->name
, to
->issigned
, 1 << to
->width
);
240 format_function_type_mismatch(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
242 struct ubsan_func_type_mismatch_desc
*data
= v
->func_mismatch
;
243 ubsan_buf_log(ub
, "problem:\"indirect function call through %p of a wrong type %s\"",
244 (void *)v
->lhs
, data
->type
->name
);
248 format_vla_bound_not_positive(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
250 struct ubsan_vla_bound_desc
*data
= v
->vla_bound
;
251 ubsan_buf_log(ub
, "problem:\"VLA %s bound %#llx not positive\"", data
->type
->name
, v
->lhs
);
255 format_invalid_builtin(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
257 ubsan_buf_log(ub
, "problem:\"passing invalid zero argument to %s\"",
258 v
->invalid_builtin
->kind
== 0 ? "ctz()" : "clz()");
262 ubsan_format(struct ubsan_violation
*v
, struct ubsan_buf
*ub
)
264 ubsan_buf_log(ub
, "{ ");
266 switch (v
->ubsan_type
) {
267 case UBSAN_OVERFLOW_add
... UBSAN_OVERFLOW_negate
:
268 format_overflow(v
, ub
);
270 case UBSAN_UNREACHABLE
:
271 ubsan_buf_log(ub
, "problem:\"unreachable\", ");
276 case UBSAN_TYPE_MISMATCH
:
277 format_type_mismatch(v
, ub
);
279 case UBSAN_POINTER_OVERFLOW
:
280 ubsan_buf_log(ub
, "problem:\"pointer overflow\", before:0x%llx, after:0x%llx", v
->lhs
, v
->rhs
);
285 case UBSAN_NULLABILITY_ARG
:
286 format_nullability_arg(v
, ub
);
288 case UBSAN_NULLABILITY_RETURN
:
289 format_nonnull_return(v
, ub
);
291 case UBSAN_MISSING_RETURN
:
292 format_missing_return(v
, ub
);
294 case UBSAN_FLOAT_CAST_OVERFLOW
:
295 format_float_cast_overflow(v
, ub
);
297 case UBSAN_IMPLICIT_CONVERSION
:
298 format_implicit_conversion(v
, ub
);
300 case UBSAN_FUNCTION_TYPE_MISMATCH
:
301 format_function_type_mismatch(v
, ub
);
303 case UBSAN_VLA_BOUND_NOT_POSITIVE
:
304 format_vla_bound_not_positive(v
, ub
);
306 case UBSAN_INVALID_BUILTIN
:
307 format_invalid_builtin(v
, ub
);
309 case UBSAN_LOAD_INVALID_VALUE
:
310 format_load_invalid_value(v
, ub
);
313 panic("unknown violation");
316 ubsan_buf_log_loc(ub
, ", found", v
->loc
);
317 ubsan_buf_log(ub
, " },\n");
320 enum UBFatality
{ Fatal
, FleshWound
};
323 ubsan_handle(struct ubsan_violation
*v
, enum UBFatality fatality
)
325 if (!ubsan_loc_acquire(v
->loc
)) {
326 /* violation site already reported */
332 if (ubsan_print
|| (fatality
== Fatal
)) {
333 static char buf
[256] = { 0 };
334 struct ubsan_buf ubsan_buf
= {
336 .ub_buf_size
= sizeof(buf
),
339 ubsan_format(v
, &ubsan_buf
);
340 printf("UBSan: %s", buf
);
345 __ubsan_handle_builtin_unreachable(struct ubsan_unreachable_desc
*desc
)
347 struct ubsan_violation v
= { UBSAN_UNREACHABLE
, 0, 0, .unreachable
= desc
, &desc
->loc
};
348 ubsan_handle(&v
, Fatal
);
352 __ubsan_handle_shift_out_of_bounds(struct ubsan_shift_desc
*desc
, uint64_t lhs
, uint64_t rhs
)
354 struct ubsan_violation v
= { UBSAN_SHIFT
, lhs
, rhs
, .shift
= desc
, &desc
->loc
};
355 ubsan_handle(&v
, FleshWound
);
359 __ubsan_handle_shift_out_of_bounds_abort(struct ubsan_shift_desc
*desc
, uint64_t lhs
, uint64_t rhs
)
361 struct ubsan_violation v
= { UBSAN_SHIFT
, lhs
, rhs
, .shift
= desc
, &desc
->loc
};
362 ubsan_handle(&v
, Fatal
);
365 #define DEFINE_OVERFLOW(op) \
366 void __ubsan_handle_##op##_overflow(struct ubsan_overflow_desc *desc, uint64_t lhs, uint64_t rhs) { \
367 struct ubsan_violation v = { UBSAN_OVERFLOW_##op, lhs, rhs, .overflow = desc, &desc->loc }; \
368 ubsan_handle(&v, FleshWound); \
370 void __ubsan_handle_##op##_overflow_abort(struct ubsan_overflow_desc *desc, uint64_t lhs, uint64_t rhs) { \
371 struct ubsan_violation v = { UBSAN_OVERFLOW_##op, lhs, rhs, .overflow = desc, &desc->loc }; \
372 ubsan_handle(&v, Fatal); \
378 DEFINE_OVERFLOW(divrem
)
379 DEFINE_OVERFLOW(negate
)
382 __ubsan_handle_type_mismatch_v1(struct ubsan_align_desc
*desc
, uint64_t val
)
384 struct ubsan_violation v
= { UBSAN_TYPE_MISMATCH
, val
, 0, .align
= desc
, &desc
->loc
};
385 ubsan_handle(&v
, FleshWound
);
389 __ubsan_handle_type_mismatch_v1_abort(struct ubsan_align_desc
*desc
, uint64_t val
)
391 struct ubsan_violation v
= { UBSAN_TYPE_MISMATCH
, val
, 0, .align
= desc
, &desc
->loc
};
392 ubsan_handle(&v
, Fatal
);
396 __ubsan_handle_pointer_overflow(struct ubsan_ptroverflow_desc
*desc
, uint64_t before
, uint64_t after
)
398 struct ubsan_violation v
= { UBSAN_POINTER_OVERFLOW
, before
, after
, .ptroverflow
= desc
, &desc
->loc
};
399 ubsan_handle(&v
, FleshWound
);
403 __ubsan_handle_pointer_overflow_abort(struct ubsan_ptroverflow_desc
*desc
, uint64_t before
, uint64_t after
)
405 struct ubsan_violation v
= { UBSAN_POINTER_OVERFLOW
, before
, after
, .ptroverflow
= desc
, &desc
->loc
};
406 ubsan_handle(&v
, Fatal
);
410 __ubsan_handle_out_of_bounds(struct ubsan_oob_desc
*desc
, uint64_t idx
)
412 struct ubsan_violation v
= { UBSAN_OOB
, idx
, 0, .oob
= desc
, &desc
->loc
};
413 ubsan_handle(&v
, FleshWound
);
417 __ubsan_handle_out_of_bounds_abort(struct ubsan_oob_desc
*desc
, uint64_t idx
)
419 struct ubsan_violation v
= { UBSAN_OOB
, idx
, 0, .oob
= desc
, &desc
->loc
};
420 ubsan_handle(&v
, Fatal
);
424 __ubsan_handle_nullability_arg(struct ubsan_nullability_arg_desc
*desc
)
426 struct ubsan_violation v
= { UBSAN_NULLABILITY_ARG
, 0, 0, .nonnull_arg
= desc
, &desc
->loc
};
427 ubsan_handle(&v
, FleshWound
);
431 __ubsan_handle_nullability_arg_abort(struct ubsan_nullability_arg_desc
*desc
)
433 struct ubsan_violation v
= { UBSAN_NULLABILITY_ARG
, 0, 0, .nonnull_arg
= desc
, &desc
->loc
};
434 ubsan_handle(&v
, Fatal
);
438 __ubsan_handle_nonnull_arg(struct ubsan_nullability_arg_desc
*desc
)
440 struct ubsan_violation v
= { UBSAN_NULLABILITY_ARG
, 1, 0, .nonnull_arg
= desc
, &desc
->loc
};
441 ubsan_handle(&v
, FleshWound
);
445 __ubsan_handle_nonnull_arg_abort(struct ubsan_nullability_arg_desc
*desc
)
447 struct ubsan_violation v
= { UBSAN_NULLABILITY_ARG
, 1, 0, .nonnull_arg
= desc
, &desc
->loc
};
448 ubsan_handle(&v
, Fatal
);
452 __ubsan_handle_nullability_return_v1(struct ubsan_nullability_ret_desc
*desc
, uint64_t declaration
)
454 struct ubsan_violation v
= { UBSAN_NULLABILITY_RETURN
, 0, (uint64_t)&desc
->loc
, .nonnull_ret
= desc
, (struct san_src_loc
*)declaration
};
455 ubsan_handle(&v
, FleshWound
);
459 __ubsan_handle_nullability_return_v1_abort(struct ubsan_nullability_ret_desc
*desc
, uint64_t declaration
)
461 struct ubsan_violation v
= { UBSAN_NULLABILITY_RETURN
, 0, (uint64_t)&desc
->loc
, .nonnull_ret
= desc
, (struct san_src_loc
*)declaration
};
462 ubsan_handle(&v
, Fatal
);
466 __ubsan_handle_nonnull_return_v1(struct ubsan_nullability_ret_desc
*desc
, uint64_t declaration
)
468 struct ubsan_violation v
= { UBSAN_NULLABILITY_RETURN
, 1, (uint64_t)&desc
->loc
, .nonnull_ret
= desc
, (struct san_src_loc
*)declaration
};
469 ubsan_handle(&v
, FleshWound
);
473 __ubsan_handle_nonnull_return_v1_abort(struct ubsan_nullability_ret_desc
*desc
, uint64_t declaration
)
475 struct ubsan_violation v
= { UBSAN_NULLABILITY_RETURN
, 1, (uint64_t)&desc
->loc
, .nonnull_ret
= desc
, (struct san_src_loc
*)declaration
};
476 ubsan_handle(&v
, Fatal
);
480 __ubsan_handle_missing_return(struct ubsan_missing_ret_desc
*desc
)
482 struct ubsan_violation v
= { UBSAN_MISSING_RETURN
, 0, 0, .missing_ret
= desc
, &desc
->loc
};
483 ubsan_handle(&v
, Fatal
);
487 __ubsan_handle_missing_return_abort(struct ubsan_missing_ret_desc
*desc
)
489 struct ubsan_violation v
= { UBSAN_MISSING_RETURN
, 0, 0, .missing_ret
= desc
, &desc
->loc
};
490 ubsan_handle(&v
, Fatal
);
494 __ubsan_handle_float_cast_overflow(struct ubsan_float_desc
*desc
, uint64_t value
)
496 struct ubsan_violation v
= { UBSAN_FLOAT_CAST_OVERFLOW
, value
, 0, .flt
= desc
, &desc
->loc
};
497 ubsan_handle(&v
, Fatal
);
501 __ubsan_handle_float_cast_overflow_abort(struct ubsan_float_desc
*desc
, uint64_t value
)
503 struct ubsan_violation v
= { UBSAN_FLOAT_CAST_OVERFLOW
, value
, 0, .flt
= desc
, &desc
->loc
};
504 ubsan_handle(&v
, Fatal
);
508 __ubsan_handle_implicit_conversion(struct ubsan_implicit_conv_desc
*desc
, uint64_t from
, uint64_t to
)
510 struct ubsan_violation v
= { UBSAN_IMPLICIT_CONVERSION
, from
, to
, .implicit
= desc
, &desc
->loc
};
511 ubsan_handle(&v
, Fatal
);
515 __ubsan_handle_implicit_conversion_abort(struct ubsan_implicit_conv_desc
*desc
, uint64_t from
, uint64_t to
)
517 struct ubsan_violation v
= { UBSAN_IMPLICIT_CONVERSION
, from
, to
, .implicit
= desc
, &desc
->loc
};
518 ubsan_handle(&v
, Fatal
);
522 __ubsan_handle_function_type_mismatch(struct ubsan_func_type_mismatch_desc
*desc
, uint64_t func
)
524 struct ubsan_violation v
= { UBSAN_FUNCTION_TYPE_MISMATCH
, func
, 0, .func_mismatch
= desc
, &desc
->loc
};
525 ubsan_handle(&v
, Fatal
);
529 __ubsan_handle_function_type_mismatch_abort(struct ubsan_func_type_mismatch_desc
*desc
, uint64_t func
)
531 struct ubsan_violation v
= { UBSAN_FUNCTION_TYPE_MISMATCH
, func
, 0, .func_mismatch
= desc
, &desc
->loc
};
532 ubsan_handle(&v
, Fatal
);
536 __ubsan_handle_vla_bound_not_positive(struct ubsan_vla_bound_desc
*desc
, uint64_t length
)
538 struct ubsan_violation v
= { UBSAN_VLA_BOUND_NOT_POSITIVE
, length
, 0, .vla_bound
= desc
, &desc
->loc
};
539 ubsan_handle(&v
, Fatal
);
543 __ubsan_handle_vla_bound_not_positive_abort(struct ubsan_vla_bound_desc
*desc
, uint64_t length
)
545 struct ubsan_violation v
= { UBSAN_VLA_BOUND_NOT_POSITIVE
, length
, 0, .vla_bound
= desc
, &desc
->loc
};
546 ubsan_handle(&v
, Fatal
);
550 __ubsan_handle_invalid_builtin(struct ubsan_invalid_builtin
*desc
)
552 struct ubsan_violation v
= { UBSAN_INVALID_BUILTIN
, 0, 0, .invalid_builtin
= desc
, &desc
->loc
};
553 ubsan_handle(&v
, Fatal
);
557 __ubsan_handle_invalid_builtin_abort(struct ubsan_invalid_builtin
*desc
)
559 struct ubsan_violation v
= { UBSAN_INVALID_BUILTIN
, 0, 0, .invalid_builtin
= desc
, &desc
->loc
};
560 ubsan_handle(&v
, Fatal
);
564 __ubsan_handle_load_invalid_value(struct ubsan_load_invalid_desc
*desc
, uint64_t invalid_value
)
566 struct ubsan_violation v
= { UBSAN_LOAD_INVALID_VALUE
, invalid_value
, 0, .invalid
= desc
, &desc
->loc
};
567 ubsan_handle(&v
, Fatal
);
571 __ubsan_handle_load_invalid_value_abort(struct ubsan_load_invalid_desc
*desc
, uint64_t invalid_value
)
573 struct ubsan_violation v
= { UBSAN_LOAD_INVALID_VALUE
, invalid_value
, 0, .invalid
= desc
, &desc
->loc
};
574 ubsan_handle(&v
, Fatal
);