[compiler-rt] Add ASan debugging API to get malloc/free stack traces and shadow memory mapping info

[kubamracek]

Summary

ASan currently has only __asan_describe_address as a debugging API, which prints out a report in textual form only. This patch is part of an effort to implement a more generic debugging API, as proposed in http://lists.cs.uiuc.edu/pipermail/llvmdev/2014-July/074656.html.

It adds 1) asan_get_alloc_stack and asan_get_free_stack, which can return a stack trace and thread ID for the allocation or free of a specified heap memory address and 2) __asan_get_shadow_mapping which just returns the current scale and offset for the shadow memory mapping.

The idea is that this would allow an LLDB script (or even calling the functions manually) to query various memory addresses and get their malloc/free stack traces and relevant shadow memory addresses. We could then use LLDB's backtrace formatting to show more consistently formatted information (and use LLDB's symbolication) and even do things like "frame select". The __asan_get_shadow_mapping API can be used to create macros like MemToShadow/ShadowToMem in LLDB and we could even have something like "x --shadow 0x100000000" in LLDB to show the relevant shadow memory alongside with the memory contents.

[kcc]

include/sanitizer/asan_interface.h

69

Does your interface need top_frame_bp?

Also, maybe change it like this?

// Store up to 'size' frames into 'trace', return the number of stored frames or 0 on error.
/...
uptr __asan_get_alloc_stack(void *addr, void **trace, size_t size, int *thread)

lib/asan/asan_debugging.cc

25

This is not part of the interface, right?
So, it should be inside the __asan namespace, should be called AsanGetStack, and alloc_stack should be boolean

[kubamracek]

Removed top_frame_bp from the interface, I don't really need it. Changed the malloc/free stack API return value to be the number of frames returned. Moved the internal function into __asan namespace, fixed the signature of it.

[kubamracek]

Updated the test case to check the return value (number of frames).

[kcc]

LGTM with two small nits.

lib/asan/asan_debugging.cc

23

move this below, right before the first SANITIZER_INTERFACE_ATTRIBUTE

71

we tend to omit {} in such simple expressions

[glider]

Looks mostly good.

lib/asan/asan_debugging.cc

61

Can you please write parameter names before constants, e.g.:

AsanGetStack(addr, trace, size, thread_id, /*alloc_stack*/ true);

?

66

ditto

lib/asan/tests/asan_debugging_noinst_test.cc

14 ↗

(On Diff #11323)

Please sort the includes alphabetically.

20 ↗

(On Diff #11323)

Please move the test for __asan_get_shadow_mapping() to a separate lit test.
The _noinst tests are intended to test only the ASan internals, not the public interfaces, and your test may end up checking something completely different.

test/asan/TestCases/debug_stacks.cc

6

Please keep the includes sorted.

29

Please add a second space before "//" here and below.

39

What's the point in checking for a constant string you have just printed?

[kubamracek]

Applying the comments from review http://reviews.llvm.org/D4466.

[kubamracek]

test/asan/TestCases/debug_stacks.cc

29

Not sure if you really just wanted another space, so moving the CHECKs to separate lines as done in all other test cases.

[glider]

test/asan/TestCases/debug_stacks.cc

29

I was talking about two spaces between the code and the inline comment:

...);  // CHECK: ...

, which is used across the sanitizers codebase.
CHECKs on separate lines are also fine in this case.

[glider]

LGTM with nits.

lib/asan/asan_debugging.cc

73

Nit: spare newline.
In general it's better when more code fits on the screen, and this function is small enough to comprehend without that newline.

test/asan/TestCases/debug_mapping.cc

2

?

[kubamracek]

Landed in r213080.

include/sanitizer/asan_interface.h

   // Print the description of addr (useful when debugging in gdb).
   void __asan_describe_address(void *addr);
 
+  // Useful for calling from the debugger to get the allocation stack trace
+  // and thread ID for a heap address. Stores up to 'size' frames into 'trace',
+  // returns the number of stored frames or 0 on error.
+  size_t __asan_get_alloc_stack(void *addr, void **trace, size_t size,
+                                int *thread_id);
+
+  // Useful for calling from the debugger to get the free stack trace
+  // and thread ID for a heap address. Stores up to 'size' frames into 'trace',
+  // returns the number of stored frames or 0 on error.
+  size_t __asan_get_free_stack(void *addr, void **trace, size_t size,
+                               int *thread_id);
+
+  // Useful for calling from the debugger to get the current shadow memory
+  // mapping.
+  void __asan_get_shadow_mapping(size_t *shadow_scale, size_t *shadow_offset);
+
   // This is an internal function that is called to report an error.
   // However it is still a part of the interface because users may want to
   // set a breakpoint on this function in a debugger.

lib/asan/CMakeLists.txt

 set(ASAN_SOURCES
   asan_allocator2.cc
   asan_activation.cc
+  asan_debugging.cc
   asan_fake_stack.cc
   asan_globals.cc
   asan_interceptors.cc

lib/asan/asan_debugging.cc

+//===-- asan_debugging.cc -------------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of AddressSanitizer, an address sanity checker.
+//
+// This file contains various functions that are generally useful to call when
+// using a debugger (LLDB, GDB).
+//===----------------------------------------------------------------------===//
+
+#include "asan_allocator.h"
+#include "asan_flags.h"
+#include "asan_internal.h"
+#include "asan_mapping.h"
+#include "asan_thread.h"
+
+namespace __asan {
+
+uptr AsanGetStack(uptr addr, uptr *trace, uptr size, u32 *thread_id,
+                  bool alloc_stack) {
+  AsanChunkView chunk = FindHeapChunkByAddress(addr);
+  if (!chunk.IsValid()) return 0;
+
+  StackTrace stack;
+  if (alloc_stack) {
+    if (chunk.AllocTid() == kInvalidTid) return 0;
+    chunk.GetAllocStack(&stack);
+    if (thread_id) *thread_id = chunk.AllocTid();
+  } else {
+    if (chunk.FreeTid() == kInvalidTid) return 0;
+    chunk.GetFreeStack(&stack);
+    if (thread_id) *thread_id = chunk.FreeTid();
+  }
+
+  if (trace && size) {
+    if (size > kStackTraceMax)
+      size = kStackTraceMax;
+    if (size > stack.size)
+      size = stack.size;
+    for (uptr i = 0; i < size; i++)
+      trace[i] = StackTrace::GetPreviousInstructionPc(stack.trace[i]);
+
+    return size;
+  }
+
+  return 0;
+}
+
+}  // namespace __asan
+
+using namespace __asan;
+
+SANITIZER_INTERFACE_ATTRIBUTE
+uptr __asan_get_alloc_stack(uptr addr, uptr *trace, uptr size, u32 *thread_id) {
+  return AsanGetStack(addr, trace, size, thread_id, /* alloc_stack */ true);
+}
+
+SANITIZER_INTERFACE_ATTRIBUTE
+uptr __asan_get_free_stack(uptr addr, uptr *trace, uptr size, u32 *thread_id) {
+  return AsanGetStack(addr, trace, size, thread_id, /* alloc_stack */ false);
+}
+
+SANITIZER_INTERFACE_ATTRIBUTE
+void __asan_get_shadow_mapping(uptr *shadow_scale, uptr *shadow_offset) {
+  if (shadow_scale)
+    *shadow_scale = SHADOW_SCALE;
+  if (shadow_offset)
+    *shadow_offset = SHADOW_OFFSET;
+}

lib/asan/asan_interface_internal.h

   void __asan_describe_address(uptr addr);
 
   SANITIZER_INTERFACE_ATTRIBUTE
+  uptr __asan_get_alloc_stack(uptr addr, uptr *trace, uptr size,
+                              u32 *thread_id);
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  uptr __asan_get_free_stack(uptr addr, uptr *trace, uptr size,
+                             u32 *thread_id);
+
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_get_shadow_mapping(uptr *shadow_scale, uptr *shadow_offset);
+
+  SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_report_error(uptr pc, uptr bp, uptr sp,
                            uptr addr, int is_write, uptr access_size);
 

test/asan/TestCases/debug_mapping.cc

+// Checks that the debugging API returns correct shadow scale and offset.
+// RUN: %clangxx_asan -O %s -o %t
+// RUN: env ASAN_OPTIONS=verbosity=1 %run %t 2>&1 | FileCheck %s
+
+#include <sanitizer/asan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+// printed because of verbosity=1
+// CHECK: SHADOW_SCALE: [[SCALE:[0-9]+]]
+// CHECK: SHADOW_OFFSET: [[OFFSET:[0-9]+]]
+
+int main() {
+  size_t scale, offset;
+  __asan_get_shadow_mapping(&scale, &offset);
+
+  fprintf(stderr, "scale: %lx\n", scale);
+  fprintf(stderr, "offset: %lx\n", offset);
+
+  // CHECK: scale: [[SCALE]]
+  // CHECK: offset: [[OFFSET]]
+
+  return 0;
+}

test/asan/TestCases/debug_stacks.cc

+// Check that the stack trace debugging API works and returns correct
+// malloc and free stacks.
+// RUN: %clangxx_asan -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+#include <sanitizer/asan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+char *mem;
+void func1() {
+  mem = (char *)malloc(10);
+}
+
+void func2() {
+  free(mem);
+}
+
+int main() {
+  func1();
+  func2();
+
+  void *trace[100];
+  size_t num_frames = 100;
+  int thread_id;
+  num_frames = __asan_get_alloc_stack(mem, trace, num_frames, &thread_id);
+
+  fprintf(stderr, "alloc stack retval %s\n", (num_frames > 0 && num_frames < 10)
+          ? "ok" : "");
+  // CHECK: alloc stack retval ok
+  fprintf(stderr, "thread id = %d\n", thread_id);
+  // CHECK: thread id = 0
+  fprintf(stderr, "0x%lx\n", trace[0]);
+  // CHECK: [[ALLOC_FRAME_0:0x[0-9a-f]+]]
+  fprintf(stderr, "0x%lx\n", trace[1]);
+  // CHECK: [[ALLOC_FRAME_1:0x[0-9a-f]+]]
+
+  num_frames = 100;
+  num_frames = __asan_get_free_stack(mem, trace, num_frames, &thread_id);
+
+  fprintf(stderr, "free stack retval %s\n", (num_frames > 0 && num_frames < 10)
+          ? "ok" : "");
+  // CHECK: free stack retval ok
+  fprintf(stderr, "thread id = %d\n", thread_id);
+  // CHECK: thread id = 0
+  fprintf(stderr, "0x%lx\n", trace[0]);
+  // CHECK: [[FREE_FRAME_0:0x[0-9a-f]+]]
+  fprintf(stderr, "0x%lx\n", trace[1]);
+  // CHECK: [[FREE_FRAME_1:0x[0-9a-f]+]]
+
+  mem[0] = 'A'; // BOOM
+
+  // CHECK: ERROR: AddressSanitizer: heap-use-after-free
+  // CHECK: WRITE of size 1 at 0x{{.*}}
+  // CHECK: freed by thread T0 here:
+  // CHECK: #0 [[FREE_FRAME_0]]
+  // CHECK: #1 [[FREE_FRAME_1]]
+  // CHECK: previously allocated by thread T0 here:
+  // CHECK: #0 [[ALLOC_FRAME_0]]
+  // CHECK: #1 [[ALLOC_FRAME_1]]
+
+  return 0;
+}