cgocheck.go

Documentation: runtime

     1  // Copyright 2015 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // Code to check that pointer writes follow the cgo rules.
     6  // These functions are invoked when GOEXPERIMENT=cgocheck2 is enabled.
     7  
     8  package runtime
     9  
    10  import (
    11  	"internal/goarch"
    12  	"internal/goexperiment"
    13  	"unsafe"
    14  )
    15  
    16  const cgoWriteBarrierFail = "unpinned Go pointer stored into non-Go memory"
    17  
    18  // cgoCheckPtrWrite is called whenever a pointer is stored into memory.
    19  // It throws if the program is storing an unpinned Go pointer into non-Go
    20  // memory.
    21  //
    22  // This is called from generated code when GOEXPERIMENT=cgocheck2 is enabled.
    23  //
    24  //go:nosplit
    25  //go:nowritebarrier
    26  func cgoCheckPtrWrite(dst *unsafe.Pointer, src unsafe.Pointer) {
    27  	if !mainStarted {
    28  		// Something early in startup hates this function.
    29  		// Don't start doing any actual checking until the
    30  		// runtime has set itself up.
    31  		return
    32  	}
    33  	if !cgoIsGoPointer(src) {
    34  		return
    35  	}
    36  	if cgoIsGoPointer(unsafe.Pointer(dst)) {
    37  		return
    38  	}
    39  
    40  	// If we are running on the system stack then dst might be an
    41  	// address on the stack, which is OK.
    42  	gp := getg()
    43  	if gp == gp.m.g0 || gp == gp.m.gsignal {
    44  		return
    45  	}
    46  
    47  	// Allocating memory can write to various mfixalloc structs
    48  	// that look like they are non-Go memory.
    49  	if gp.m.mallocing != 0 {
    50  		return
    51  	}
    52  
    53  	// If the object is pinned, it's safe to store it in C memory. The GC
    54  	// ensures it will not be moved or freed.
    55  	if isPinned(src) {
    56  		return
    57  	}
    58  
    59  	// It's OK if writing to memory allocated by persistentalloc.
    60  	// Do this check last because it is more expensive and rarely true.
    61  	// If it is false the expense doesn't matter since we are crashing.
    62  	if inPersistentAlloc(uintptr(unsafe.Pointer(dst))) {
    63  		return
    64  	}
    65  
    66  	systemstack(func() {
    67  		println("write of unpinned Go pointer", hex(uintptr(src)), "to non-Go memory", hex(uintptr(unsafe.Pointer(dst))))
    68  		throw(cgoWriteBarrierFail)
    69  	})
    70  }
    71  
    72  // cgoCheckMemmove is called when moving a block of memory.
    73  // It throws if the program is copying a block that contains an unpinned Go
    74  // pointer into non-Go memory.
    75  //
    76  // This is called from generated code when GOEXPERIMENT=cgocheck2 is enabled.
    77  //
    78  //go:nosplit
    79  //go:nowritebarrier
    80  func cgoCheckMemmove(typ *_type, dst, src unsafe.Pointer) {
    81  	cgoCheckMemmove2(typ, dst, src, 0, typ.Size_)
    82  }
    83  
    84  // cgoCheckMemmove2 is called when moving a block of memory.
    85  // dst and src point off bytes into the value to copy.
    86  // size is the number of bytes to copy.
    87  // It throws if the program is copying a block that contains an unpinned Go
    88  // pointer into non-Go memory.
    89  //
    90  //go:nosplit
    91  //go:nowritebarrier
    92  func cgoCheckMemmove2(typ *_type, dst, src unsafe.Pointer, off, size uintptr) {
    93  	if typ.PtrBytes == 0 {
    94  		return
    95  	}
    96  	if !cgoIsGoPointer(src) {
    97  		return
    98  	}
    99  	if cgoIsGoPointer(dst) {
   100  		return
   101  	}
   102  	cgoCheckTypedBlock(typ, src, off, size)
   103  }
   104  
   105  // cgoCheckSliceCopy is called when copying n elements of a slice.
   106  // src and dst are pointers to the first element of the slice.
   107  // typ is the element type of the slice.
   108  // It throws if the program is copying slice elements that contain unpinned Go
   109  // pointers into non-Go memory.
   110  //
   111  //go:nosplit
   112  //go:nowritebarrier
   113  func cgoCheckSliceCopy(typ *_type, dst, src unsafe.Pointer, n int) {
   114  	if typ.PtrBytes == 0 {
   115  		return
   116  	}
   117  	if !cgoIsGoPointer(src) {
   118  		return
   119  	}
   120  	if cgoIsGoPointer(dst) {
   121  		return
   122  	}
   123  	p := src
   124  	for i := 0; i < n; i++ {
   125  		cgoCheckTypedBlock(typ, p, 0, typ.Size_)
   126  		p = add(p, typ.Size_)
   127  	}
   128  }
   129  
   130  // cgoCheckTypedBlock checks the block of memory at src, for up to size bytes,
   131  // and throws if it finds an unpinned Go pointer. The type of the memory is typ,
   132  // and src is off bytes into that type.
   133  //
   134  //go:nosplit
   135  //go:nowritebarrier
   136  func cgoCheckTypedBlock(typ *_type, src unsafe.Pointer, off, size uintptr) {
   137  	// Anything past typ.PtrBytes is not a pointer.
   138  	if typ.PtrBytes <= off {
   139  		return
   140  	}
   141  	if ptrdataSize := typ.PtrBytes - off; size > ptrdataSize {
   142  		size = ptrdataSize
   143  	}
   144  
   145  	if typ.Kind_&kindGCProg == 0 {
   146  		cgoCheckBits(src, typ.GCData, off, size)
   147  		return
   148  	}
   149  
   150  	// The type has a GC program. Try to find GC bits somewhere else.
   151  	for _, datap := range activeModules() {
   152  		if cgoInRange(src, datap.data, datap.edata) {
   153  			doff := uintptr(src) - datap.data
   154  			cgoCheckBits(add(src, -doff), datap.gcdatamask.bytedata, off+doff, size)
   155  			return
   156  		}
   157  		if cgoInRange(src, datap.bss, datap.ebss) {
   158  			boff := uintptr(src) - datap.bss
   159  			cgoCheckBits(add(src, -boff), datap.gcbssmask.bytedata, off+boff, size)
   160  			return
   161  		}
   162  	}
   163  
   164  	s := spanOfUnchecked(uintptr(src))
   165  	if s.state.get() == mSpanManual {
   166  		// There are no heap bits for value stored on the stack.
   167  		// For a channel receive src might be on the stack of some
   168  		// other goroutine, so we can't unwind the stack even if
   169  		// we wanted to.
   170  		// We can't expand the GC program without extra storage
   171  		// space we can't easily get.
   172  		// Fortunately we have the type information.
   173  		systemstack(func() {
   174  			cgoCheckUsingType(typ, src, off, size)
   175  		})
   176  		return
   177  	}
   178  
   179  	// src must be in the regular heap.
   180  	if goexperiment.AllocHeaders {
   181  		tp := s.typePointersOf(uintptr(src), size)
   182  		for {
   183  			var addr uintptr
   184  			if tp, addr = tp.next(uintptr(src) + size); addr == 0 {
   185  				break
   186  			}
   187  			v := *(*unsafe.Pointer)(unsafe.Pointer(addr))
   188  			if cgoIsGoPointer(v) && !isPinned(v) {
   189  				throw(cgoWriteBarrierFail)
   190  			}
   191  		}
   192  	} else {
   193  		hbits := heapBitsForAddr(uintptr(src), size)
   194  		for {
   195  			var addr uintptr
   196  			if hbits, addr = hbits.next(); addr == 0 {
   197  				break
   198  			}
   199  			v := *(*unsafe.Pointer)(unsafe.Pointer(addr))
   200  			if cgoIsGoPointer(v) && !isPinned(v) {
   201  				throw(cgoWriteBarrierFail)
   202  			}
   203  		}
   204  	}
   205  }
   206  
   207  // cgoCheckBits checks the block of memory at src, for up to size
   208  // bytes, and throws if it finds an unpinned Go pointer. The gcbits mark each
   209  // pointer value. The src pointer is off bytes into the gcbits.
   210  //
   211  //go:nosplit
   212  //go:nowritebarrier
   213  func cgoCheckBits(src unsafe.Pointer, gcbits *byte, off, size uintptr) {
   214  	skipMask := off / goarch.PtrSize / 8
   215  	skipBytes := skipMask * goarch.PtrSize * 8
   216  	ptrmask := addb(gcbits, skipMask)
   217  	src = add(src, skipBytes)
   218  	off -= skipBytes
   219  	size += off
   220  	var bits uint32
   221  	for i := uintptr(0); i < size; i += goarch.PtrSize {
   222  		if i&(goarch.PtrSize*8-1) == 0 {
   223  			bits = uint32(*ptrmask)
   224  			ptrmask = addb(ptrmask, 1)
   225  		} else {
   226  			bits >>= 1
   227  		}
   228  		if off > 0 {
   229  			off -= goarch.PtrSize
   230  		} else {
   231  			if bits&1 != 0 {
   232  				v := *(*unsafe.Pointer)(add(src, i))
   233  				if cgoIsGoPointer(v) && !isPinned(v) {
   234  					throw(cgoWriteBarrierFail)
   235  				}
   236  			}
   237  		}
   238  	}
   239  }
   240  
   241  // cgoCheckUsingType is like cgoCheckTypedBlock, but is a last ditch
   242  // fall back to look for pointers in src using the type information.
   243  // We only use this when looking at a value on the stack when the type
   244  // uses a GC program, because otherwise it's more efficient to use the
   245  // GC bits. This is called on the system stack.
   246  //
   247  //go:nowritebarrier
   248  //go:systemstack
   249  func cgoCheckUsingType(typ *_type, src unsafe.Pointer, off, size uintptr) {
   250  	if typ.PtrBytes == 0 {
   251  		return
   252  	}
   253  
   254  	// Anything past typ.PtrBytes is not a pointer.
   255  	if typ.PtrBytes <= off {
   256  		return
   257  	}
   258  	if ptrdataSize := typ.PtrBytes - off; size > ptrdataSize {
   259  		size = ptrdataSize
   260  	}
   261  
   262  	if typ.Kind_&kindGCProg == 0 {
   263  		cgoCheckBits(src, typ.GCData, off, size)
   264  		return
   265  	}
   266  	switch typ.Kind_ & kindMask {
   267  	default:
   268  		throw("can't happen")
   269  	case kindArray:
   270  		at := (*arraytype)(unsafe.Pointer(typ))
   271  		for i := uintptr(0); i < at.Len; i++ {
   272  			if off < at.Elem.Size_ {
   273  				cgoCheckUsingType(at.Elem, src, off, size)
   274  			}
   275  			src = add(src, at.Elem.Size_)
   276  			skipped := off
   277  			if skipped > at.Elem.Size_ {
   278  				skipped = at.Elem.Size_
   279  			}
   280  			checked := at.Elem.Size_ - skipped
   281  			off -= skipped
   282  			if size <= checked {
   283  				return
   284  			}
   285  			size -= checked
   286  		}
   287  	case kindStruct:
   288  		st := (*structtype)(unsafe.Pointer(typ))
   289  		for _, f := range st.Fields {
   290  			if off < f.Typ.Size_ {
   291  				cgoCheckUsingType(f.Typ, src, off, size)
   292  			}
   293  			src = add(src, f.Typ.Size_)
   294  			skipped := off
   295  			if skipped > f.Typ.Size_ {
   296  				skipped = f.Typ.Size_
   297  			}
   298  			checked := f.Typ.Size_ - skipped
   299  			off -= skipped
   300  			if size <= checked {
   301  				return
   302  			}
   303  			size -= checked
   304  		}
   305  	}
   306  }
   307
View as plain text