Home | History | Annotate | Line # | Download | only in ubsan 
      1 //===-- ubsan_handlers_cxx.cc ---------------------------------------------===//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 // Error logging entry points for the UBSan runtime, which are only used for C++
     11 // compilations. This file is permitted to use language features which require
     12 // linking against a C++ ABI library.
     13 //
     14 //===----------------------------------------------------------------------===//
     15 
     16 #include "ubsan_platform.h"
     17 #if CAN_SANITIZE_UB
     18 #include "ubsan_handlers.h"
     19 #include "ubsan_handlers_cxx.h"
     20 #include "ubsan_diag.h"
     21 #include "ubsan_type_hash.h"
     22 
     23 #include "sanitizer_common/sanitizer_common.h"
     24 #include "sanitizer_common/sanitizer_suppressions.h"
     25 
     26 using namespace __sanitizer;
     27 using namespace __ubsan;
     28 
     29 namespace __ubsan {
     30   extern const char *TypeCheckKinds[];
     31 }
     32 
     33 // Returns true if UBSan has printed an error report.
     34 static bool HandleDynamicTypeCacheMiss(
     35     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
     36     ReportOptions Opts) {
     37   if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
     38     // Just a cache miss. The type matches after all.
     39     return false;
     40 
     41   // Check if error report should be suppressed.
     42   DynamicTypeInfo DTI = getDynamicTypeInfoFromObject((void*)Pointer);
     43   if (DTI.isValid() && IsVptrCheckSuppressed(DTI.getMostDerivedTypeName()))
     44     return false;
     45 
     46   SourceLocation Loc = Data->Loc.acquire();
     47   ErrorType ET = ErrorType::DynamicTypeMismatch;
     48   if (ignoreReport(Loc, Opts, ET))
     49     return false;
     50 
     51   ScopedReport R(Opts, Loc, ET);
     52 
     53   Diag(Loc, DL_Error, ET,
     54        "%0 address %1 which does not point to an object of type %2")
     55     << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
     56 
     57   // If possible, say what type it actually points to.
     58   if (!DTI.isValid()) {
     59     if (DTI.getOffset() < -VptrMaxOffsetToTop || DTI.getOffset() > VptrMaxOffsetToTop) {
     60       Diag(Pointer, DL_Note, ET,
     61            "object has a possibly invalid vptr: abs(offset to top) too big")
     62           << TypeName(DTI.getMostDerivedTypeName())
     63           << Range(Pointer, Pointer + sizeof(uptr), "possibly invalid vptr");
     64     } else {
     65       Diag(Pointer, DL_Note, ET, "object has invalid vptr")
     66           << TypeName(DTI.getMostDerivedTypeName())
     67           << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
     68     }
     69   } else if (!DTI.getOffset())
     70     Diag(Pointer, DL_Note, ET, "object is of type %0")
     71         << TypeName(DTI.getMostDerivedTypeName())
     72         << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
     73   else
     74     // FIXME: Find the type at the specified offset, and include that
     75     //        in the note.
     76     Diag(Pointer - DTI.getOffset(), DL_Note, ET,
     77          "object is base class subobject at offset %0 within object of type %1")
     78         << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
     79         << TypeName(DTI.getSubobjectTypeName())
     80         << Range(Pointer, Pointer + sizeof(uptr),
     81                  "vptr for %2 base class of %1");
     82   return true;
     83 }
     84 
     85 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
     86     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
     87   GET_REPORT_OPTIONS(false);
     88   HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts);
     89 }
     90 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
     91     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
     92   // Note: -fsanitize=vptr is always recoverable.
     93   GET_REPORT_OPTIONS(false);
     94   if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts))
     95     Die();
     96 }
     97 
     98 namespace __ubsan {
     99 void __ubsan_handle_cfi_bad_type(CFICheckFailData *Data, ValueHandle Vtable,
    100                                  bool ValidVtable, ReportOptions Opts) {
    101   SourceLocation Loc = Data->Loc.acquire();
    102   ErrorType ET = ErrorType::CFIBadType;
    103 
    104   if (ignoreReport(Loc, Opts, ET))
    105     return;
    106 
    107   ScopedReport R(Opts, Loc, ET);
    108   DynamicTypeInfo DTI = ValidVtable
    109                             ? getDynamicTypeInfoFromVtable((void *)Vtable)
    110                             : DynamicTypeInfo(0, 0, 0);
    111 
    112   const char *CheckKindStr;
    113   switch (Data->CheckKind) {
    114   case CFITCK_VCall:
    115     CheckKindStr = "virtual call";
    116     break;
    117   case CFITCK_NVCall:
    118     CheckKindStr = "non-virtual call";
    119     break;
    120   case CFITCK_DerivedCast:
    121     CheckKindStr = "base-to-derived cast";
    122     break;
    123   case CFITCK_UnrelatedCast:
    124     CheckKindStr = "cast to unrelated type";
    125     break;
    126   case CFITCK_VMFCall:
    127     CheckKindStr = "virtual pointer to member function call";
    128     break;
    129   case CFITCK_ICall:
    130   case CFITCK_NVMFCall:
    131     Die();
    132   }
    133 
    134   Diag(Loc, DL_Error, ET,
    135        "control flow integrity check for type %0 failed during "
    136        "%1 (vtable address %2)")
    137       << Data->Type << CheckKindStr << (void *)Vtable;
    138 
    139   // If possible, say what type it actually points to.
    140   if (!DTI.isValid())
    141     Diag(Vtable, DL_Note, ET, "invalid vtable");
    142   else
    143     Diag(Vtable, DL_Note, ET, "vtable is of type %0")
    144         << TypeName(DTI.getMostDerivedTypeName());
    145 
    146   // If the failure involved different DSOs for the check location and vtable,
    147   // report the DSO names.
    148   const char *DstModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Vtable);
    149   if (!DstModule)
    150     DstModule = "(unknown)";
    151 
    152   const char *SrcModule = Symbolizer::GetOrInit()->GetModuleNameForPc(Opts.pc);
    153   if (!SrcModule)
    154     SrcModule = "(unknown)";
    155 
    156   if (internal_strcmp(SrcModule, DstModule))
    157     Diag(Loc, DL_Note, ET, "check failed in %0, vtable located in %1")
    158         << SrcModule << DstModule;
    159 }
    160 }  // namespace __ubsan
    161 
    162 #endif // CAN_SANITIZE_UB
    163