[sanitizer] Add a 'print_module_map' flag which prints modules with UUIDs on Darwin

[kubamracek]

Summary

This patch add a new sanitizer flag, print_module_map, which enables printing a module map when the process exits, or after each report (for TSan). The output format is very similar to what Crash Reporter produces on Darwin (e.g. the format of module UUIDs). This enables users to use the existing symbol servers to offline symbolicate and aggregate reports.

[filcab]

Is it that valuable that we print after every report?

lib/sanitizer_common/sanitizer_flags.inc

79 ↗

(On Diff #80226)

You're not honouring the 2 value under ASan.

lib/sanitizer_common/sanitizer_mac.cc

862 ↗

(On Diff #80226)

Should we add 'X' format conversion to internal_snprintf?

[kubamracek]

Updating patch, addressing review comments.

Is it that valuable that we print after every report?

It is for TSan, where we just keep the process running and reporting issues. If the user kills the process abnormally, he would never see the UUID list under print_module_map=1.

[kubamracek]

Adding a testcase.

[kubamracek]

ping

[cryptoad]

FYI, produces the following warning when compiled with gcc with some stricter options:

[...]/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.h: In function ‘const char* __sanitizer::ModuleArchToString(__sanitizer::ModuleArch)’:
[...]/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.h:693:1: warning: control reaches end of non-void function [-Wreturn-type]
 }

[kubamracek]

In D27400#641390, @cryptoad wrote:

FYI, produces the following warning when compiled with gcc with some stricter options:

[...]/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.h: In function ‘const char* __sanitizer::ModuleArchToString(__sanitizer::ModuleArch)’:
[...]/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.h:693:1: warning: control reaches end of non-void function [-Wreturn-type]
 }

Should get fixed with r291639.

compiler-rt/trunk/lib/asan/asan_report.cc

~ScopedInErrorReport() {
     asanThreadRegistry().Unlock();
     // Print memory stats.
     if (flags()->print_stats)
       __asan_print_accumulated_stats();
 
     if (common_flags()->print_cmdline)
       PrintCmdline();
 
+    if (common_flags()->print_module_map == 2) PrintModuleMap();
+
     // Copy the message buffer so that we could start logging without holding a
     // lock that gets aquired during printing.
     InternalScopedBuffer<char> buffer_copy(kErrorMessageBufferSize);
     {
       BlockingMutexLock l(&error_message_buf_mutex);
       internal_memcpy(buffer_copy.data(),
                       error_message_buffer, kErrorMessageBufferSize);
     }

compiler-rt/trunk/lib/asan/asan_rtl.cc

 uptr AsanMappingProfile[kAsanMappingProfileSize];
 
 static void AsanDie() {
   static atomic_uint32_t num_calls;
   if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) {
     // Don't die twice - run a busy loop.
     while (1) { }
   }
+  if (common_flags()->print_module_map >= 1) PrintModuleMap();
   if (flags()->sleep_before_dying) {
     Report("Sleeping for %d second(s)\n", flags()->sleep_before_dying);
     SleepForSeconds(flags()->sleep_before_dying);
   }
   if (flags()->unmap_shadow_on_exit) {
     if (kMidMemBeg) {
       UnmapOrDie((void*)kLowShadowBeg, kMidMemBeg - kLowShadowBeg);
       UnmapOrDie((void*)kMidMemEnd, kHighShadowEnd - kMidMemEnd);

compiler-rt/trunk/lib/sanitizer_common/sanitizer_common.h

 uptr ReadBinaryName(/*out*/char *buf, uptr buf_len);
 uptr ReadBinaryNameCached(/*out*/char *buf, uptr buf_len);
 uptr ReadLongProcessName(/*out*/ char *buf, uptr buf_len);
 const char *GetProcessName();
 void UpdateProcessName();
 void CacheBinaryName();
 void DisableCoreDumperIfNecessary();
 void DumpProcessMap();
+void PrintModuleMap();
 bool FileExists(const char *filename);
 const char *GetEnv(const char *name);
 bool SetEnv(const char *name, const char *value);
 const char *GetPwd();
 char *FindPathToBinary(const char *name);
 bool IsPathSeparator(const char c);
 bool IsAbsolutePath(const char *path);
 // Starts a subprocess and returs its pid.
enum ModuleArch {
   kModuleArchX86_64H,
   kModuleArchARMV6,
   kModuleArchARMV7,
   kModuleArchARMV7S,
   kModuleArchARMV7K,
   kModuleArchARM64
 };
 
+// When adding a new architecture, don't forget to also update
+// script/asan_symbolize.py and sanitizer_symbolizer_libcdep.cc.
+inline const char *ModuleArchToString(ModuleArch arch) {
+  switch (arch) {
+    case kModuleArchUnknown:
+      return "";
+    case kModuleArchI386:
+      return "i386";
+    case kModuleArchX86_64:
+      return "x86_64";
+    case kModuleArchX86_64H:
+      return "x86_64h";
+    case kModuleArchARMV6:
+      return "armv6";
+    case kModuleArchARMV7:
+      return "armv7";
+    case kModuleArchARMV7S:
+      return "armv7s";
+    case kModuleArchARMV7K:
+      return "armv7k";
+    case kModuleArchARM64:
+      return "arm64";
+  }
+  CHECK(0 && "Invalid module arch");
+}
+
 const uptr kModuleUUIDSize = 16;
 
 // Represents a binary loaded into virtual memory (e.g. this can be an
 // executable or a shared object).
 class LoadedModule {
  public:
   LoadedModule()
       : full_name_(nullptr),
         base_address_(0),
+        max_executable_address_(0),
         arch_(kModuleArchUnknown),
         instrumented_(false) {
     internal_memset(uuid_, 0, kModuleUUIDSize);
     ranges_.clear();
   }
   void set(const char *module_name, uptr base_address);
   void set(const char *module_name, uptr base_address, ModuleArch arch,
            u8 uuid[kModuleUUIDSize], bool instrumented);
   void clear();
   void addAddressRange(uptr beg, uptr end, bool executable);
   bool containsAddress(uptr address) const;
 
   const char *full_name() const { return full_name_; }
   uptr base_address() const { return base_address_; }
+  uptr max_executable_address() const { return max_executable_address_; }
   ModuleArch arch() const { return arch_; }
   const u8 *uuid() const { return uuid_; }
   bool instrumented() const { return instrumented_; }
 
   struct AddressRange {
     AddressRange *next;
     uptr beg;
     uptr end;
     bool executable;
 
     AddressRange(uptr beg, uptr end, bool executable)
         : next(nullptr), beg(beg), end(end), executable(executable) {}
   };
 
   const IntrusiveList<AddressRange> &ranges() const { return ranges_; }
 
  private:
   char *full_name_;  // Owned.
   uptr base_address_;
+  uptr max_executable_address_;
   ModuleArch arch_;
   u8 uuid_[kModuleUUIDSize];
   bool instrumented_;
   IntrusiveList<AddressRange> ranges_;
 };
 
 // List of LoadedModules. OS-dependent implementation is responsible for
 // filling this information.

compiler-rt/trunk/lib/sanitizer_common/sanitizer_common.cc

void LoadedModule::set(const char *module_name, uptr base_address,
   set(module_name, base_address);
   arch_ = arch;
   internal_memcpy(uuid_, uuid, sizeof(uuid_));
   instrumented_ = instrumented;
 }
 
 void LoadedModule::clear() {
   InternalFree(full_name_);
+  base_address_ = 0;
+  max_executable_address_ = 0;
   full_name_ = nullptr;
   arch_ = kModuleArchUnknown;
   internal_memset(uuid_, 0, kModuleUUIDSize);
   instrumented_ = false;
   while (!ranges_.empty()) {
     AddressRange *r = ranges_.front();
     ranges_.pop_front();
     InternalFree(r);
   }
 }
 
 void LoadedModule::addAddressRange(uptr beg, uptr end, bool executable) {
   void *mem = InternalAlloc(sizeof(AddressRange));
   AddressRange *r = new(mem) AddressRange(beg, end, executable);
   ranges_.push_back(r);
+  if (executable && end > max_executable_address_)
+    max_executable_address_ = end;
 }
 
 bool LoadedModule::containsAddress(uptr address) const {
   for (const AddressRange &r : ranges()) {
     if (r.beg <= address && address < r.end)
       return true;
   }
   return false;

compiler-rt/trunk/lib/sanitizer_common/sanitizer_flags.inc

COMMON_FLAG(
     "detect_leaks=false, or if __lsan_do_leak_check() is called before the "
     "handler has a chance to run.")
 COMMON_FLAG(bool, allocator_may_return_null, false,
             "If false, the allocator will crash instead of returning 0 on "
             "out-of-memory.")
 COMMON_FLAG(bool, print_summary, true,
             "If false, disable printing error summaries in addition to error "
             "reports.")
+COMMON_FLAG(int, print_module_map, 0,
+            "OS X only. 0 = don't print, 1 = print only once before process "
+            "exits, 2 = print after each report.")
 COMMON_FLAG(bool, check_printf, true, "Check printf arguments.")
 COMMON_FLAG(bool, handle_segv, true,
             "If set, registers the tool's custom SIGSEGV/SIGBUS handler.")
 COMMON_FLAG(bool, handle_abort, false,
             "If set, registers the tool's custom SIGABRT handler.")
 COMMON_FLAG(bool, handle_sigill, false,
             "If set, registers the tool's custom SIGILL handler.")
 COMMON_FLAG(bool, handle_sigfpe, true,

compiler-rt/trunk/lib/sanitizer_common/sanitizer_linux.cc

 # error "Unsupported arch"
 #endif
 }
 
 void MaybeReexec() {
   // No need to re-exec on Linux.
 }
 
+void PrintModuleMap() { }
+
 uptr FindAvailableMemoryRange(uptr size, uptr alignment, uptr left_padding) {
   UNREACHABLE("FindAvailableMemoryRange is not available");
   return 0;
 }
 
 } // namespace __sanitizer
 
 #endif // SANITIZER_FREEBSD || SANITIZER_LINUX

compiler-rt/trunk/lib/sanitizer_common/sanitizer_mac.cc

 # undef DUMPREG64
 # undef DUMPREG32
 # undef DUMPREG_
 # undef DUMPREG__
 # undef DUMPREG___
 # undef DUMPREG
 }
 
+static inline bool CompareBaseAddress(const LoadedModule &a,
+                                      const LoadedModule &b) {
+  return a.base_address() < b.base_address();
+}
+
+void FormatUUID(char *out, uptr size, const u8 *uuid) {
+  internal_snprintf(out, size,
+                    "<%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-"
+                    "%02X%02X%02X%02X%02X%02X>",
+                    uuid[0], uuid[1], uuid[2], uuid[3], uuid[4], uuid[5],
+                    uuid[6], uuid[7], uuid[8], uuid[9], uuid[10], uuid[11],
+                    uuid[12], uuid[13], uuid[14], uuid[15]);
+}
+
+void PrintModuleMap() {
+  Printf("Process module map:\n");
+  MemoryMappingLayout memory_mapping(false);
+  InternalMmapVector<LoadedModule> modules(/*initial_capacity*/ 128);
+  memory_mapping.DumpListOfModules(&modules);
+  InternalSort(&modules, modules.size(), CompareBaseAddress);
+  for (uptr i = 0; i < modules.size(); ++i) {
+    char uuid_str[128];
+    FormatUUID(uuid_str, sizeof(uuid_str), modules[i].uuid());
+    Printf("0x%zx-0x%zx %s (%s) %s\n", modules[i].base_address(),
+           modules[i].max_executable_address(), modules[i].full_name(),
+           ModuleArchToString(modules[i].arch()), uuid_str);
+  }
+  Printf("End of module map.\n");
+}
+
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_MAC

compiler-rt/trunk/lib/sanitizer_common/sanitizer_printf.cc

static int AppendChar(char **buff, const char *buff_end, char c) {
   return 1;
 }
 
 // Appends number in a given base to buffer. If its length is less than
 // |minimal_num_length|, it is padded with leading zeroes or spaces, depending
 // on the value of |pad_with_zero|.
 static int AppendNumber(char **buff, const char *buff_end, u64 absolute_value,
                         u8 base, u8 minimal_num_length, bool pad_with_zero,
-                        bool negative) {
+                        bool negative, bool uppercase) {
   uptr const kMaxLen = 30;
   RAW_CHECK(base == 10 || base == 16);
   RAW_CHECK(base == 10 || !negative);
   RAW_CHECK(absolute_value || !negative);
   RAW_CHECK(minimal_num_length < kMaxLen);
   int result = 0;
   if (negative && minimal_num_length)
     --minimal_num_length;
static int AppendNumber(char **buff, const char *buff_end, u64 absolute_value,
   pos--;
   for (; pos >= 0 && num_buffer[pos] == 0; pos--) {
     char c = (pad_with_zero || pos == 0) ? '0' : ' ';
     result += AppendChar(buff, buff_end, c);
   }
   if (negative && !pad_with_zero) result += AppendChar(buff, buff_end, '-');
   for (; pos >= 0; pos--) {
     char digit = static_cast<char>(num_buffer[pos]);
-    result += AppendChar(buff, buff_end, (digit < 10) ? '0' + digit
-                                                      : 'a' + digit - 10);
+    digit = (digit < 10) ? '0' + digit : (uppercase ? 'A' : 'a') + digit - 10;
+    result += AppendChar(buff, buff_end, digit);
   }
   return result;
 }
 
 static int AppendUnsigned(char **buff, const char *buff_end, u64 num, u8 base,
-                          u8 minimal_num_length, bool pad_with_zero) {
+                          u8 minimal_num_length, bool pad_with_zero,
+                          bool uppercase) {
   return AppendNumber(buff, buff_end, num, base, minimal_num_length,
-                      pad_with_zero, false /* negative */);
+                      pad_with_zero, false /* negative */, uppercase);
 }
 
 static int AppendSignedDecimal(char **buff, const char *buff_end, s64 num,
                                u8 minimal_num_length, bool pad_with_zero) {
   bool negative = (num < 0);
   return AppendNumber(buff, buff_end, (u64)(negative ? -num : num), 10,
-                      minimal_num_length, pad_with_zero, negative);
+                      minimal_num_length, pad_with_zero, negative,
+                      false /* uppercase */);
 }
 
 static int AppendString(char **buff, const char *buff_end, int precision,
                         const char *s) {
   if (!s)
     s = "<null>";
   int result = 0;
   for (; *s; s++) {
     if (precision >= 0 && result >= precision)
       break;
     result += AppendChar(buff, buff_end, *s);
   }
   return result;
 }
 
 static int AppendPointer(char **buff, const char *buff_end, u64 ptr_value) {
   int result = 0;
   result += AppendString(buff, buff_end, -1, "0x");
   result += AppendUnsigned(buff, buff_end, ptr_value, 16,
-                           SANITIZER_POINTER_FORMAT_LENGTH, true);
+                           SANITIZER_POINTER_FORMAT_LENGTH,
+                           true /* pad_with_zero */, false /* uppercase */);
   return result;
 }
 
 int VSNPrintf(char *buff, int buff_length,
               const char *format, va_list args) {
   static const char *kPrintfFormatsHelp =
-    "Supported Printf formats: %([0-9]*)?(z|ll)?{d,u,x}; %p; %(\\.\\*)?s; %c\n";
+      "Supported Printf formats: %([0-9]*)?(z|ll)?{d,u,x,X}; %p; %(\\.\\*)?s; "
+      "%c\n";
   RAW_CHECK(format);
   RAW_CHECK(buff_length > 0);
   const char *buff_end = &buff[buff_length - 1];
   const char *cur = format;
   int result = 0;
   for (; *cur; cur++) {
     if (*cur != '%') {
       result += AppendChar(&buff, buff_end, *cur);
switch (*cur) {
         dval = have_ll ? va_arg(args, s64)
              : have_z ? va_arg(args, sptr)
              : va_arg(args, int);
         result += AppendSignedDecimal(&buff, buff_end, dval, width,
                                       pad_with_zero);
         break;
       }
       case 'u':
-      case 'x': {
+      case 'x':
+      case 'X': {
         uval = have_ll ? va_arg(args, u64)
              : have_z ? va_arg(args, uptr)
              : va_arg(args, unsigned);
-        result += AppendUnsigned(&buff, buff_end, uval,
-                                 (*cur == 'u') ? 10 : 16, width, pad_with_zero);
+        bool uppercase = (*cur == 'X');
+        result += AppendUnsigned(&buff, buff_end, uval, (*cur == 'u') ? 10 : 16,
+                                 width, pad_with_zero, uppercase);
         break;
       }
       case 'p': {
         RAW_CHECK_MSG(!have_flags, kPrintfFormatsHelp);
         result += AppendPointer(&buff, buff_end, va_arg(args, uptr));
         break;
       }
       case 's': {

compiler-rt/trunk/lib/sanitizer_common/sanitizer_win.cc

if (mi.end_address != 0) {
       Printf("\t??\?-??? %s\n", mi.filepath);
     } else {
       Printf("\t???\n");
     }
   }
 }
 #endif
 
+void PrintModuleMap() { }
+
 void DisableCoreDumperIfNecessary() {
   // Do nothing.
 }
 
 void ReExec() {
   UNIMPLEMENTED();
 }
 

compiler-rt/trunk/lib/tsan/rtl/tsan_report.cc

void PrintReport(const ReportDesc *rep) {
   if (rep->typ == ReportTypeThreadLeak && rep->count > 1)
     Printf("  And %d more similar thread leaks.\n\n", rep->count - 1);
 
   if (ReportStack *stack = ChooseSummaryStack(rep)) {
     if (SymbolizedStack *frame = SkipTsanInternalFrames(stack->frames))
       ReportErrorSummary(rep_typ_str, frame->info);
   }
 
+  if (common_flags()->print_module_map == 2) PrintModuleMap();
+
   Printf("==================\n");
 }
 
 #else  // #if !SANITIZER_GO
 
 const int kMainThreadId = 1;
 
 void PrintStack(const ReportStack *ent) {

compiler-rt/trunk/lib/tsan/rtl/tsan_rtl.cc

#endif
   }
 
   OnInitialize();
 }
 
 int Finalize(ThreadState *thr) {
   bool failed = false;
 
+  if (common_flags()->print_module_map == 1) PrintModuleMap();
+
   if (flags()->atexit_sleep_ms > 0 && ThreadCount(thr) > 1)
     SleepForMillis(flags()->atexit_sleep_ms);
 
   // Wait for pending reports.
   ctx->report_mtx.Lock();
   CommonSanitizerReportMutex.Lock();
   CommonSanitizerReportMutex.Unlock();
   ctx->report_mtx.Unlock();

compiler-rt/trunk/test/asan/TestCases/Darwin/uuid.cc

+// RUN: %clangxx_asan %s -o %t
+// RUN: %env_asan_opts=print_module_map=1                 not %run %t 2>&1 | FileCheck %s
+// RUN: %env_asan_opts=print_module_map=2                 not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan %s -o %t -fsanitize-recover=address
+// RUN: %env_asan_opts=print_module_map=2:halt_on_error=0     %run %t 2>&1 | FileCheck %s
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int main(int argc, char *argv[]) {
+  char buf[256];
+  snprintf(buf, sizeof(buf), "otool -l %s", argv[0]);
+  system(buf);
+  // CHECK: cmd LC_UUID
+  // CHECK-NEXT: cmdsize 24
+  // CHECK-NEXT: uuid [[UUID:[0-9A-F-]{36}]]
+
+  char *x = (char*)malloc(10 * sizeof(char));
+  free(x);
+  char mybuf[10];
+  memcpy(mybuf, x, 10);
+  // CHECK: {{.*ERROR: AddressSanitizer: heap-use-after-free on address}}
+  // CHECK: Process module map:
+  // CHECK: uuid.cc.tmp {{.*}} <[[UUID]]>
+
+  fprintf(stderr, "Done.\n");
+}