| File: | src/gnu/usr.bin/clang/libLLVM/../../../llvm/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp |
| Warning: | line 638, column 19 Called C++ object pointer is null |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
| 1 | //===- AddressSanitizer.cpp - memory error detector -----------------------===// | |||
| 2 | // | |||
| 3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. | |||
| 4 | // See https://llvm.org/LICENSE.txt for license information. | |||
| 5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception | |||
| 6 | // | |||
| 7 | //===----------------------------------------------------------------------===// | |||
| 8 | // | |||
| 9 | // This file is a part of AddressSanitizer, an address sanity checker. | |||
| 10 | // Details of the algorithm: | |||
| 11 | // https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm | |||
| 12 | // | |||
| 13 | // FIXME: This sanitizer does not yet handle scalable vectors | |||
| 14 | // | |||
| 15 | //===----------------------------------------------------------------------===// | |||
| 16 | ||||
| 17 | #include "llvm/Transforms/Instrumentation/AddressSanitizer.h" | |||
| 18 | #include "llvm/ADT/ArrayRef.h" | |||
| 19 | #include "llvm/ADT/DenseMap.h" | |||
| 20 | #include "llvm/ADT/DepthFirstIterator.h" | |||
| 21 | #include "llvm/ADT/SmallPtrSet.h" | |||
| 22 | #include "llvm/ADT/SmallVector.h" | |||
| 23 | #include "llvm/ADT/Statistic.h" | |||
| 24 | #include "llvm/ADT/StringExtras.h" | |||
| 25 | #include "llvm/ADT/StringRef.h" | |||
| 26 | #include "llvm/ADT/Triple.h" | |||
| 27 | #include "llvm/ADT/Twine.h" | |||
| 28 | #include "llvm/Analysis/MemoryBuiltins.h" | |||
| 29 | #include "llvm/Analysis/TargetLibraryInfo.h" | |||
| 30 | #include "llvm/Analysis/ValueTracking.h" | |||
| 31 | #include "llvm/BinaryFormat/MachO.h" | |||
| 32 | #include "llvm/IR/Argument.h" | |||
| 33 | #include "llvm/IR/Attributes.h" | |||
| 34 | #include "llvm/IR/BasicBlock.h" | |||
| 35 | #include "llvm/IR/Comdat.h" | |||
| 36 | #include "llvm/IR/Constant.h" | |||
| 37 | #include "llvm/IR/Constants.h" | |||
| 38 | #include "llvm/IR/DIBuilder.h" | |||
| 39 | #include "llvm/IR/DataLayout.h" | |||
| 40 | #include "llvm/IR/DebugInfoMetadata.h" | |||
| 41 | #include "llvm/IR/DebugLoc.h" | |||
| 42 | #include "llvm/IR/DerivedTypes.h" | |||
| 43 | #include "llvm/IR/Dominators.h" | |||
| 44 | #include "llvm/IR/Function.h" | |||
| 45 | #include "llvm/IR/GlobalAlias.h" | |||
| 46 | #include "llvm/IR/GlobalValue.h" | |||
| 47 | #include "llvm/IR/GlobalVariable.h" | |||
| 48 | #include "llvm/IR/IRBuilder.h" | |||
| 49 | #include "llvm/IR/InlineAsm.h" | |||
| 50 | #include "llvm/IR/InstVisitor.h" | |||
| 51 | #include "llvm/IR/InstrTypes.h" | |||
| 52 | #include "llvm/IR/Instruction.h" | |||
| 53 | #include "llvm/IR/Instructions.h" | |||
| 54 | #include "llvm/IR/IntrinsicInst.h" | |||
| 55 | #include "llvm/IR/Intrinsics.h" | |||
| 56 | #include "llvm/IR/LLVMContext.h" | |||
| 57 | #include "llvm/IR/MDBuilder.h" | |||
| 58 | #include "llvm/IR/Metadata.h" | |||
| 59 | #include "llvm/IR/Module.h" | |||
| 60 | #include "llvm/IR/Type.h" | |||
| 61 | #include "llvm/IR/Use.h" | |||
| 62 | #include "llvm/IR/Value.h" | |||
| 63 | #include "llvm/InitializePasses.h" | |||
| 64 | #include "llvm/MC/MCSectionMachO.h" | |||
| 65 | #include "llvm/Pass.h" | |||
| 66 | #include "llvm/Support/Casting.h" | |||
| 67 | #include "llvm/Support/CommandLine.h" | |||
| 68 | #include "llvm/Support/Debug.h" | |||
| 69 | #include "llvm/Support/ErrorHandling.h" | |||
| 70 | #include "llvm/Support/MathExtras.h" | |||
| 71 | #include "llvm/Support/ScopedPrinter.h" | |||
| 72 | #include "llvm/Support/raw_ostream.h" | |||
| 73 | #include "llvm/Transforms/Instrumentation.h" | |||
| 74 | #include "llvm/Transforms/Instrumentation/AddressSanitizerCommon.h" | |||
| 75 | #include "llvm/Transforms/Instrumentation/AddressSanitizerOptions.h" | |||
| 76 | #include "llvm/Transforms/Utils/ASanStackFrameLayout.h" | |||
| 77 | #include "llvm/Transforms/Utils/BasicBlockUtils.h" | |||
| 78 | #include "llvm/Transforms/Utils/Local.h" | |||
| 79 | #include "llvm/Transforms/Utils/ModuleUtils.h" | |||
| 80 | #include "llvm/Transforms/Utils/PromoteMemToReg.h" | |||
| 81 | #include <algorithm> | |||
| 82 | #include <cassert> | |||
| 83 | #include <cstddef> | |||
| 84 | #include <cstdint> | |||
| 85 | #include <iomanip> | |||
| 86 | #include <limits> | |||
| 87 | #include <memory> | |||
| 88 | #include <sstream> | |||
| 89 | #include <string> | |||
| 90 | #include <tuple> | |||
| 91 | ||||
| 92 | using namespace llvm; | |||
| 93 | ||||
| 94 | #define DEBUG_TYPE"asan" "asan" | |||
| 95 | ||||
| 96 | static const uint64_t kDefaultShadowScale = 3; | |||
| 97 | static const uint64_t kDefaultShadowOffset32 = 1ULL << 29; | |||
| 98 | static const uint64_t kDefaultShadowOffset64 = 1ULL << 44; | |||
| 99 | static const uint64_t kDynamicShadowSentinel = | |||
| 100 | std::numeric_limits<uint64_t>::max(); | |||
| 101 | static const uint64_t kSmallX86_64ShadowOffsetBase = 0x7FFFFFFF; // < 2G. | |||
| 102 | static const uint64_t kSmallX86_64ShadowOffsetAlignMask = ~0xFFFULL; | |||
| 103 | static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000; | |||
| 104 | static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 44; | |||
| 105 | static const uint64_t kSystemZ_ShadowOffset64 = 1ULL << 52; | |||
| 106 | static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000; | |||
| 107 | static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37; | |||
| 108 | static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36; | |||
| 109 | static const uint64_t kRISCV64_ShadowOffset64 = 0xd55550000; | |||
| 110 | static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30; | |||
| 111 | static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46; | |||
| 112 | static const uint64_t kFreeBSDKasan_ShadowOffset64 = 0xdffff7c000000000; | |||
| 113 | static const uint64_t kNetBSD_ShadowOffset32 = 1ULL << 30; | |||
| 114 | static const uint64_t kNetBSD_ShadowOffset64 = 1ULL << 46; | |||
| 115 | static const uint64_t kNetBSDKasan_ShadowOffset64 = 0xdfff900000000000; | |||
| 116 | static const uint64_t kPS4CPU_ShadowOffset64 = 1ULL << 40; | |||
| 117 | static const uint64_t kWindowsShadowOffset32 = 3ULL << 28; | |||
| 118 | static const uint64_t kEmscriptenShadowOffset = 0; | |||
| 119 | ||||
| 120 | // The shadow memory space is dynamically allocated. | |||
| 121 | static const uint64_t kWindowsShadowOffset64 = kDynamicShadowSentinel; | |||
| 122 | ||||
| 123 | static const size_t kMinStackMallocSize = 1 << 6; // 64B | |||
| 124 | static const size_t kMaxStackMallocSize = 1 << 16; // 64K | |||
| 125 | static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; | |||
| 126 | static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; | |||
| 127 | ||||
| 128 | const char kAsanModuleCtorName[] = "asan.module_ctor"; | |||
| 129 | const char kAsanModuleDtorName[] = "asan.module_dtor"; | |||
| 130 | static const uint64_t kAsanCtorAndDtorPriority = 1; | |||
| 131 | // On Emscripten, the system needs more than one priorities for constructors. | |||
| 132 | static const uint64_t kAsanEmscriptenCtorAndDtorPriority = 50; | |||
| 133 | const char kAsanReportErrorTemplate[] = "__asan_report_"; | |||
| 134 | const char kAsanRegisterGlobalsName[] = "__asan_register_globals"; | |||
| 135 | const char kAsanUnregisterGlobalsName[] = "__asan_unregister_globals"; | |||
| 136 | const char kAsanRegisterImageGlobalsName[] = "__asan_register_image_globals"; | |||
| 137 | const char kAsanUnregisterImageGlobalsName[] = | |||
| 138 | "__asan_unregister_image_globals"; | |||
| 139 | const char kAsanRegisterElfGlobalsName[] = "__asan_register_elf_globals"; | |||
| 140 | const char kAsanUnregisterElfGlobalsName[] = "__asan_unregister_elf_globals"; | |||
| 141 | const char kAsanPoisonGlobalsName[] = "__asan_before_dynamic_init"; | |||
| 142 | const char kAsanUnpoisonGlobalsName[] = "__asan_after_dynamic_init"; | |||
| 143 | const char kAsanInitName[] = "__asan_init"; | |||
| 144 | const char kAsanVersionCheckNamePrefix[] = "__asan_version_mismatch_check_v"; | |||
| 145 | const char kAsanPtrCmp[] = "__sanitizer_ptr_cmp"; | |||
| 146 | const char kAsanPtrSub[] = "__sanitizer_ptr_sub"; | |||
| 147 | const char kAsanHandleNoReturnName[] = "__asan_handle_no_return"; | |||
| 148 | static const int kMaxAsanStackMallocSizeClass = 10; | |||
| 149 | const char kAsanStackMallocNameTemplate[] = "__asan_stack_malloc_"; | |||
| 150 | const char kAsanStackMallocAlwaysNameTemplate[] = | |||
| 151 | "__asan_stack_malloc_always_"; | |||
| 152 | const char kAsanStackFreeNameTemplate[] = "__asan_stack_free_"; | |||
| 153 | const char kAsanGenPrefix[] = "___asan_gen_"; | |||
| 154 | const char kODRGenPrefix[] = "__odr_asan_gen_"; | |||
| 155 | const char kSanCovGenPrefix[] = "__sancov_gen_"; | |||
| 156 | const char kAsanSetShadowPrefix[] = "__asan_set_shadow_"; | |||
| 157 | const char kAsanPoisonStackMemoryName[] = "__asan_poison_stack_memory"; | |||
| 158 | const char kAsanUnpoisonStackMemoryName[] = "__asan_unpoison_stack_memory"; | |||
| 159 | ||||
| 160 | // ASan version script has __asan_* wildcard. Triple underscore prevents a | |||
| 161 | // linker (gold) warning about attempting to export a local symbol. | |||
| 162 | const char kAsanGlobalsRegisteredFlagName[] = "___asan_globals_registered"; | |||
| 163 | ||||
| 164 | const char kAsanOptionDetectUseAfterReturn[] = | |||
| 165 | "__asan_option_detect_stack_use_after_return"; | |||
| 166 | ||||
| 167 | const char kAsanShadowMemoryDynamicAddress[] = | |||
| 168 | "__asan_shadow_memory_dynamic_address"; | |||
| 169 | ||||
| 170 | const char kAsanAllocaPoison[] = "__asan_alloca_poison"; | |||
| 171 | const char kAsanAllocasUnpoison[] = "__asan_allocas_unpoison"; | |||
| 172 | ||||
| 173 | const char kAMDGPUAddressSharedName[] = "llvm.amdgcn.is.shared"; | |||
| 174 | const char kAMDGPUAddressPrivateName[] = "llvm.amdgcn.is.private"; | |||
| 175 | ||||
| 176 | // Accesses sizes are powers of two: 1, 2, 4, 8, 16. | |||
| 177 | static const size_t kNumberOfAccessSizes = 5; | |||
| 178 | ||||
| 179 | static const unsigned kAllocaRzSize = 32; | |||
| 180 | ||||
| 181 | // Command-line flags. | |||
| 182 | ||||
| 183 | static cl::opt<bool> ClEnableKasan( | |||
| 184 | "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"), | |||
| 185 | cl::Hidden, cl::init(false)); | |||
| 186 | ||||
| 187 | static cl::opt<bool> ClRecover( | |||
| 188 | "asan-recover", | |||
| 189 | cl::desc("Enable recovery mode (continue-after-error)."), | |||
| 190 | cl::Hidden, cl::init(false)); | |||
| 191 | ||||
| 192 | static cl::opt<bool> ClInsertVersionCheck( | |||
| 193 | "asan-guard-against-version-mismatch", | |||
| 194 | cl::desc("Guard against compiler/runtime version mismatch."), | |||
| 195 | cl::Hidden, cl::init(true)); | |||
| 196 | ||||
| 197 | // This flag may need to be replaced with -f[no-]asan-reads. | |||
| 198 | static cl::opt<bool> ClInstrumentReads("asan-instrument-reads", | |||
| 199 | cl::desc("instrument read instructions"), | |||
| 200 | cl::Hidden, cl::init(true)); | |||
| 201 | ||||
| 202 | static cl::opt<bool> ClInstrumentWrites( | |||
| 203 | "asan-instrument-writes", cl::desc("instrument write instructions"), | |||
| 204 | cl::Hidden, cl::init(true)); | |||
| 205 | ||||
| 206 | static cl::opt<bool> ClInstrumentAtomics( | |||
| 207 | "asan-instrument-atomics", | |||
| 208 | cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, | |||
| 209 | cl::init(true)); | |||
| 210 | ||||
| 211 | static cl::opt<bool> | |||
| 212 | ClInstrumentByval("asan-instrument-byval", | |||
| 213 | cl::desc("instrument byval call arguments"), cl::Hidden, | |||
| 214 | cl::init(true)); | |||
| 215 | ||||
| 216 | static cl::opt<bool> ClAlwaysSlowPath( | |||
| 217 | "asan-always-slow-path", | |||
| 218 | cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, | |||
| 219 | cl::init(false)); | |||
| 220 | ||||
| 221 | static cl::opt<bool> ClForceDynamicShadow( | |||
| 222 | "asan-force-dynamic-shadow", | |||
| 223 | cl::desc("Load shadow address into a local variable for each function"), | |||
| 224 | cl::Hidden, cl::init(false)); | |||
| 225 | ||||
| 226 | static cl::opt<bool> | |||
| 227 | ClWithIfunc("asan-with-ifunc", | |||
| 228 | cl::desc("Access dynamic shadow through an ifunc global on " | |||
| 229 | "platforms that support this"), | |||
| 230 | cl::Hidden, cl::init(true)); | |||
| 231 | ||||
| 232 | static cl::opt<bool> ClWithIfuncSuppressRemat( | |||
| 233 | "asan-with-ifunc-suppress-remat", | |||
| 234 | cl::desc("Suppress rematerialization of dynamic shadow address by passing " | |||
| 235 | "it through inline asm in prologue."), | |||
| 236 | cl::Hidden, cl::init(true)); | |||
| 237 | ||||
| 238 | // This flag limits the number of instructions to be instrumented | |||
| 239 | // in any given BB. Normally, this should be set to unlimited (INT_MAX), | |||
| 240 | // but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary | |||
| 241 | // set it to 10000. | |||
| 242 | static cl::opt<int> ClMaxInsnsToInstrumentPerBB( | |||
| 243 | "asan-max-ins-per-bb", cl::init(10000), | |||
| 244 | cl::desc("maximal number of instructions to instrument in any given BB"), | |||
| 245 | cl::Hidden); | |||
| 246 | ||||
| 247 | // This flag may need to be replaced with -f[no]asan-stack. | |||
| 248 | static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"), | |||
| 249 | cl::Hidden, cl::init(true)); | |||
| 250 | static cl::opt<uint32_t> ClMaxInlinePoisoningSize( | |||
| 251 | "asan-max-inline-poisoning-size", | |||
| 252 | cl::desc( | |||
| 253 | "Inline shadow poisoning for blocks up to the given size in bytes."), | |||
| 254 | cl::Hidden, cl::init(64)); | |||
| 255 | ||||
| 256 | static cl::opt<AsanDetectStackUseAfterReturnMode> ClUseAfterReturn( | |||
| 257 | "asan-use-after-return", | |||
| 258 | cl::desc("Sets the mode of detection for stack-use-after-return."), | |||
| 259 | cl::values( | |||
| 260 | clEnumValN(AsanDetectStackUseAfterReturnMode::Never, "never",llvm::cl::OptionEnumValue { "never", int(AsanDetectStackUseAfterReturnMode ::Never), "Never detect stack use after return." } | |||
| 261 | "Never detect stack use after return.")llvm::cl::OptionEnumValue { "never", int(AsanDetectStackUseAfterReturnMode ::Never), "Never detect stack use after return." }, | |||
| 262 | clEnumValN(llvm::cl::OptionEnumValue { "runtime", int(AsanDetectStackUseAfterReturnMode ::Runtime), "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set." } | |||
| 263 | AsanDetectStackUseAfterReturnMode::Runtime, "runtime",llvm::cl::OptionEnumValue { "runtime", int(AsanDetectStackUseAfterReturnMode ::Runtime), "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set." } | |||
| 264 | "Detect stack use after return if "llvm::cl::OptionEnumValue { "runtime", int(AsanDetectStackUseAfterReturnMode ::Runtime), "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set." } | |||
| 265 | "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set.")llvm::cl::OptionEnumValue { "runtime", int(AsanDetectStackUseAfterReturnMode ::Runtime), "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set." }, | |||
| 266 | clEnumValN(AsanDetectStackUseAfterReturnMode::Always, "always",llvm::cl::OptionEnumValue { "always", int(AsanDetectStackUseAfterReturnMode ::Always), "Always detect stack use after return." } | |||
| 267 | "Always detect stack use after return.")llvm::cl::OptionEnumValue { "always", int(AsanDetectStackUseAfterReturnMode ::Always), "Always detect stack use after return." }), | |||
| 268 | cl::Hidden, cl::init(AsanDetectStackUseAfterReturnMode::Runtime)); | |||
| 269 | ||||
| 270 | static cl::opt<bool> ClRedzoneByvalArgs("asan-redzone-byval-args", | |||
| 271 | cl::desc("Create redzones for byval " | |||
| 272 | "arguments (extra copy " | |||
| 273 | "required)"), cl::Hidden, | |||
| 274 | cl::init(true)); | |||
| 275 | ||||
| 276 | static cl::opt<bool> ClUseAfterScope("asan-use-after-scope", | |||
| 277 | cl::desc("Check stack-use-after-scope"), | |||
| 278 | cl::Hidden, cl::init(false)); | |||
| 279 | ||||
| 280 | // This flag may need to be replaced with -f[no]asan-globals. | |||
| 281 | static cl::opt<bool> ClGlobals("asan-globals", | |||
| 282 | cl::desc("Handle global objects"), cl::Hidden, | |||
| 283 | cl::init(true)); | |||
| 284 | ||||
| 285 | static cl::opt<bool> ClInitializers("asan-initialization-order", | |||
| 286 | cl::desc("Handle C++ initializer order"), | |||
| 287 | cl::Hidden, cl::init(true)); | |||
| 288 | ||||
| 289 | static cl::opt<bool> ClInvalidPointerPairs( | |||
| 290 | "asan-detect-invalid-pointer-pair", | |||
| 291 | cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, | |||
| 292 | cl::init(false)); | |||
| 293 | ||||
| 294 | static cl::opt<bool> ClInvalidPointerCmp( | |||
| 295 | "asan-detect-invalid-pointer-cmp", | |||
| 296 | cl::desc("Instrument <, <=, >, >= with pointer operands"), cl::Hidden, | |||
| 297 | cl::init(false)); | |||
| 298 | ||||
| 299 | static cl::opt<bool> ClInvalidPointerSub( | |||
| 300 | "asan-detect-invalid-pointer-sub", | |||
| 301 | cl::desc("Instrument - operations with pointer operands"), cl::Hidden, | |||
| 302 | cl::init(false)); | |||
| 303 | ||||
| 304 | static cl::opt<unsigned> ClRealignStack( | |||
| 305 | "asan-realign-stack", | |||
| 306 | cl::desc("Realign stack to the value of this flag (power of two)"), | |||
| 307 | cl::Hidden, cl::init(32)); | |||
| 308 | ||||
| 309 | static cl::opt<int> ClInstrumentationWithCallsThreshold( | |||
| 310 | "asan-instrumentation-with-call-threshold", | |||
| 311 | cl::desc( | |||
| 312 | "If the function being instrumented contains more than " | |||
| 313 | "this number of memory accesses, use callbacks instead of " | |||
| 314 | "inline checks (-1 means never use callbacks)."), | |||
| 315 | cl::Hidden, cl::init(7000)); | |||
| 316 | ||||
| 317 | static cl::opt<std::string> ClMemoryAccessCallbackPrefix( | |||
| 318 | "asan-memory-access-callback-prefix", | |||
| 319 | cl::desc("Prefix for memory access callbacks"), cl::Hidden, | |||
| 320 | cl::init("__asan_")); | |||
| 321 | ||||
| 322 | static cl::opt<bool> | |||
| 323 | ClInstrumentDynamicAllocas("asan-instrument-dynamic-allocas", | |||
| 324 | cl::desc("instrument dynamic allocas"), | |||
| 325 | cl::Hidden, cl::init(true)); | |||
| 326 | ||||
| 327 | static cl::opt<bool> ClSkipPromotableAllocas( | |||
| 328 | "asan-skip-promotable-allocas", | |||
| 329 | cl::desc("Do not instrument promotable allocas"), cl::Hidden, | |||
| 330 | cl::init(true)); | |||
| 331 | ||||
| 332 | // These flags allow to change the shadow mapping. | |||
| 333 | // The shadow mapping looks like | |||
| 334 | // Shadow = (Mem >> scale) + offset | |||
| 335 | ||||
| 336 | static cl::opt<int> ClMappingScale("asan-mapping-scale", | |||
| 337 | cl::desc("scale of asan shadow mapping"), | |||
| 338 | cl::Hidden, cl::init(0)); | |||
| 339 | ||||
| 340 | static cl::opt<uint64_t> | |||
| 341 | ClMappingOffset("asan-mapping-offset", | |||
| 342 | cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"), | |||
| 343 | cl::Hidden, cl::init(0)); | |||
| 344 | ||||
| 345 | // Optimization flags. Not user visible, used mostly for testing | |||
| 346 | // and benchmarking the tool. | |||
| 347 | ||||
| 348 | static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"), | |||
| 349 | cl::Hidden, cl::init(true)); | |||
| 350 | ||||
| 351 | static cl::opt<bool> ClOptSameTemp( | |||
| 352 | "asan-opt-same-temp", cl::desc("Instrument the same temp just once"), | |||
| 353 | cl::Hidden, cl::init(true)); | |||
| 354 | ||||
| 355 | static cl::opt<bool> ClOptGlobals("asan-opt-globals", | |||
| 356 | cl::desc("Don't instrument scalar globals"), | |||
| 357 | cl::Hidden, cl::init(true)); | |||
| 358 | ||||
| 359 | static cl::opt<bool> ClOptStack( | |||
| 360 | "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), | |||
| 361 | cl::Hidden, cl::init(false)); | |||
| 362 | ||||
| 363 | static cl::opt<bool> ClDynamicAllocaStack( | |||
| 364 | "asan-stack-dynamic-alloca", | |||
| 365 | cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, | |||
| 366 | cl::init(true)); | |||
| 367 | ||||
| 368 | static cl::opt<uint32_t> ClForceExperiment( | |||
| 369 | "asan-force-experiment", | |||
| 370 | cl::desc("Force optimization experiment (for testing)"), cl::Hidden, | |||
| 371 | cl::init(0)); | |||
| 372 | ||||
| 373 | static cl::opt<bool> | |||
| 374 | ClUsePrivateAlias("asan-use-private-alias", | |||
| 375 | cl::desc("Use private aliases for global variables"), | |||
| 376 | cl::Hidden, cl::init(false)); | |||
| 377 | ||||
| 378 | static cl::opt<bool> | |||
| 379 | ClUseOdrIndicator("asan-use-odr-indicator", | |||
| 380 | cl::desc("Use odr indicators to improve ODR reporting"), | |||
| 381 | cl::Hidden, cl::init(false)); | |||
| 382 | ||||
| 383 | static cl::opt<bool> | |||
| 384 | ClUseGlobalsGC("asan-globals-live-support", | |||
| 385 | cl::desc("Use linker features to support dead " | |||
| 386 | "code stripping of globals"), | |||
| 387 | cl::Hidden, cl::init(true)); | |||
| 388 | ||||
| 389 | // This is on by default even though there is a bug in gold: | |||
| 390 | // https://sourceware.org/bugzilla/show_bug.cgi?id=19002 | |||
| 391 | static cl::opt<bool> | |||
| 392 | ClWithComdat("asan-with-comdat", | |||
| 393 | cl::desc("Place ASan constructors in comdat sections"), | |||
| 394 | cl::Hidden, cl::init(true)); | |||
| 395 | ||||
| 396 | static cl::opt<AsanDtorKind> ClOverrideDestructorKind( | |||
| 397 | "asan-destructor-kind", | |||
| 398 | cl::desc("Sets the ASan destructor kind. The default is to use the value " | |||
| 399 | "provided to the pass constructor"), | |||
| 400 | cl::values(clEnumValN(AsanDtorKind::None, "none", "No destructors")llvm::cl::OptionEnumValue { "none", int(AsanDtorKind::None), "No destructors" }, | |||
| 401 | clEnumValN(AsanDtorKind::Global, "global",llvm::cl::OptionEnumValue { "global", int(AsanDtorKind::Global ), "Use global destructors" } | |||
| 402 | "Use global destructors")llvm::cl::OptionEnumValue { "global", int(AsanDtorKind::Global ), "Use global destructors" }), | |||
| 403 | cl::init(AsanDtorKind::Invalid), cl::Hidden); | |||
| 404 | ||||
| 405 | // Debug flags. | |||
| 406 | ||||
| 407 | static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, | |||
| 408 | cl::init(0)); | |||
| 409 | ||||
| 410 | static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), | |||
| 411 | cl::Hidden, cl::init(0)); | |||
| 412 | ||||
| 413 | static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden, | |||
| 414 | cl::desc("Debug func")); | |||
| 415 | ||||
| 416 | static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), | |||
| 417 | cl::Hidden, cl::init(-1)); | |||
| 418 | ||||
| 419 | static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug max inst"), | |||
| 420 | cl::Hidden, cl::init(-1)); | |||
| 421 | ||||
| 422 | STATISTIC(NumInstrumentedReads, "Number of instrumented reads")static llvm::Statistic NumInstrumentedReads = {"asan", "NumInstrumentedReads" , "Number of instrumented reads"}; | |||
| 423 | STATISTIC(NumInstrumentedWrites, "Number of instrumented writes")static llvm::Statistic NumInstrumentedWrites = {"asan", "NumInstrumentedWrites" , "Number of instrumented writes"}; | |||
| 424 | STATISTIC(NumOptimizedAccessesToGlobalVar,static llvm::Statistic NumOptimizedAccessesToGlobalVar = {"asan" , "NumOptimizedAccessesToGlobalVar", "Number of optimized accesses to global vars" } | |||
| 425 | "Number of optimized accesses to global vars")static llvm::Statistic NumOptimizedAccessesToGlobalVar = {"asan" , "NumOptimizedAccessesToGlobalVar", "Number of optimized accesses to global vars" }; | |||
| 426 | STATISTIC(NumOptimizedAccessesToStackVar,static llvm::Statistic NumOptimizedAccessesToStackVar = {"asan" , "NumOptimizedAccessesToStackVar", "Number of optimized accesses to stack vars" } | |||
| 427 | "Number of optimized accesses to stack vars")static llvm::Statistic NumOptimizedAccessesToStackVar = {"asan" , "NumOptimizedAccessesToStackVar", "Number of optimized accesses to stack vars" }; | |||
| 428 | ||||
| 429 | namespace { | |||
| 430 | ||||
| 431 | /// This struct defines the shadow mapping using the rule: | |||
| 432 | /// shadow = (mem >> Scale) ADD-or-OR Offset. | |||
| 433 | /// If InGlobal is true, then | |||
| 434 | /// extern char __asan_shadow[]; | |||
| 435 | /// shadow = (mem >> Scale) + &__asan_shadow | |||
| 436 | struct ShadowMapping { | |||
| 437 | int Scale; | |||
| 438 | uint64_t Offset; | |||
| 439 | bool OrShadowOffset; | |||
| 440 | bool InGlobal; | |||
| 441 | }; | |||
| 442 | ||||
| 443 | } // end anonymous namespace | |||
| 444 | ||||
| 445 | static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize, | |||
| 446 | bool IsKasan) { | |||
| 447 | bool IsAndroid = TargetTriple.isAndroid(); | |||
| 448 | bool IsIOS = TargetTriple.isiOS() || TargetTriple.isWatchOS(); | |||
| 449 | bool IsMacOS = TargetTriple.isMacOSX(); | |||
| 450 | bool IsFreeBSD = TargetTriple.isOSFreeBSD(); | |||
| 451 | bool IsNetBSD = TargetTriple.isOSNetBSD(); | |||
| 452 | bool IsPS4CPU = TargetTriple.isPS4CPU(); | |||
| 453 | bool IsLinux = TargetTriple.isOSLinux(); | |||
| 454 | bool IsPPC64 = TargetTriple.getArch() == Triple::ppc64 || | |||
| 455 | TargetTriple.getArch() == Triple::ppc64le; | |||
| 456 | bool IsSystemZ = TargetTriple.getArch() == Triple::systemz; | |||
| 457 | bool IsX86_64 = TargetTriple.getArch() == Triple::x86_64; | |||
| 458 | bool IsMIPS32 = TargetTriple.isMIPS32(); | |||
| 459 | bool IsMIPS64 = TargetTriple.isMIPS64(); | |||
| 460 | bool IsArmOrThumb = TargetTriple.isARM() || TargetTriple.isThumb(); | |||
| 461 | bool IsAArch64 = TargetTriple.getArch() == Triple::aarch64; | |||
| 462 | bool IsRISCV64 = TargetTriple.getArch() == Triple::riscv64; | |||
| 463 | bool IsWindows = TargetTriple.isOSWindows(); | |||
| 464 | bool IsFuchsia = TargetTriple.isOSFuchsia(); | |||
| 465 | bool IsEmscripten = TargetTriple.isOSEmscripten(); | |||
| 466 | bool IsAMDGPU = TargetTriple.isAMDGPU(); | |||
| 467 | ||||
| 468 | ShadowMapping Mapping; | |||
| 469 | ||||
| 470 | Mapping.Scale = kDefaultShadowScale; | |||
| 471 | if (ClMappingScale.getNumOccurrences() > 0) { | |||
| 472 | Mapping.Scale = ClMappingScale; | |||
| 473 | } | |||
| 474 | ||||
| 475 | if (LongSize == 32) { | |||
| 476 | if (IsAndroid) | |||
| 477 | Mapping.Offset = kDynamicShadowSentinel; | |||
| 478 | else if (IsMIPS32) | |||
| 479 | Mapping.Offset = kMIPS32_ShadowOffset32; | |||
| 480 | else if (IsFreeBSD) | |||
| 481 | Mapping.Offset = kFreeBSD_ShadowOffset32; | |||
| 482 | else if (IsNetBSD) | |||
| 483 | Mapping.Offset = kNetBSD_ShadowOffset32; | |||
| 484 | else if (IsIOS) | |||
| 485 | Mapping.Offset = kDynamicShadowSentinel; | |||
| 486 | else if (IsWindows) | |||
| 487 | Mapping.Offset = kWindowsShadowOffset32; | |||
| 488 | else if (IsEmscripten) | |||
| 489 | Mapping.Offset = kEmscriptenShadowOffset; | |||
| 490 | else | |||
| 491 | Mapping.Offset = kDefaultShadowOffset32; | |||
| 492 | } else { // LongSize == 64 | |||
| 493 | // Fuchsia is always PIE, which means that the beginning of the address | |||
| 494 | // space is always available. | |||
| 495 | if (IsFuchsia) | |||
| 496 | Mapping.Offset = 0; | |||
| 497 | else if (IsPPC64) | |||
| 498 | Mapping.Offset = kPPC64_ShadowOffset64; | |||
| 499 | else if (IsSystemZ) | |||
| 500 | Mapping.Offset = kSystemZ_ShadowOffset64; | |||
| 501 | else if (IsFreeBSD && !IsMIPS64) { | |||
| 502 | if (IsKasan) | |||
| 503 | Mapping.Offset = kFreeBSDKasan_ShadowOffset64; | |||
| 504 | else | |||
| 505 | Mapping.Offset = kFreeBSD_ShadowOffset64; | |||
| 506 | } else if (IsNetBSD) { | |||
| 507 | if (IsKasan) | |||
| 508 | Mapping.Offset = kNetBSDKasan_ShadowOffset64; | |||
| 509 | else | |||
| 510 | Mapping.Offset = kNetBSD_ShadowOffset64; | |||
| 511 | } else if (IsPS4CPU) | |||
| 512 | Mapping.Offset = kPS4CPU_ShadowOffset64; | |||
| 513 | else if (IsLinux && IsX86_64) { | |||
| 514 | if (IsKasan) | |||
| 515 | Mapping.Offset = kLinuxKasan_ShadowOffset64; | |||
| 516 | else | |||
| 517 | Mapping.Offset = (kSmallX86_64ShadowOffsetBase & | |||
| 518 | (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale)); | |||
| 519 | } else if (IsWindows && IsX86_64) { | |||
| 520 | Mapping.Offset = kWindowsShadowOffset64; | |||
| 521 | } else if (IsMIPS64) | |||
| 522 | Mapping.Offset = kMIPS64_ShadowOffset64; | |||
| 523 | else if (IsIOS) | |||
| 524 | Mapping.Offset = kDynamicShadowSentinel; | |||
| 525 | else if (IsMacOS && IsAArch64) | |||
| 526 | Mapping.Offset = kDynamicShadowSentinel; | |||
| 527 | else if (IsAArch64) | |||
| 528 | Mapping.Offset = kAArch64_ShadowOffset64; | |||
| 529 | else if (IsRISCV64) | |||
| 530 | Mapping.Offset = kRISCV64_ShadowOffset64; | |||
| 531 | else if (IsAMDGPU) | |||
| 532 | Mapping.Offset = (kSmallX86_64ShadowOffsetBase & | |||
| 533 | (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale)); | |||
| 534 | else | |||
| 535 | Mapping.Offset = kDefaultShadowOffset64; | |||
| 536 | } | |||
| 537 | ||||
| 538 | if (ClForceDynamicShadow) { | |||
| 539 | Mapping.Offset = kDynamicShadowSentinel; | |||
| 540 | } | |||
| 541 | ||||
| 542 | if (ClMappingOffset.getNumOccurrences() > 0) { | |||
| 543 | Mapping.Offset = ClMappingOffset; | |||
| 544 | } | |||
| 545 | ||||
| 546 | // OR-ing shadow offset if more efficient (at least on x86) if the offset | |||
| 547 | // is a power of two, but on ppc64 we have to use add since the shadow | |||
| 548 | // offset is not necessary 1/8-th of the address space. On SystemZ, | |||
| 549 | // we could OR the constant in a single instruction, but it's more | |||
| 550 | // efficient to load it once and use indexed addressing. | |||
| 551 | Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 && !IsSystemZ && !IsPS4CPU && | |||
| 552 | !IsRISCV64 && | |||
| 553 | !(Mapping.Offset & (Mapping.Offset - 1)) && | |||
| 554 | Mapping.Offset != kDynamicShadowSentinel; | |||
| 555 | bool IsAndroidWithIfuncSupport = | |||
| 556 | IsAndroid && !TargetTriple.isAndroidVersionLT(21); | |||
| 557 | Mapping.InGlobal = ClWithIfunc && IsAndroidWithIfuncSupport && IsArmOrThumb; | |||
| 558 | ||||
| 559 | return Mapping; | |||
| 560 | } | |||
| 561 | ||||
| 562 | static uint64_t getRedzoneSizeForScale(int MappingScale) { | |||
| 563 | // Redzone used for stack and globals is at least 32 bytes. | |||
| 564 | // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. | |||
| 565 | return std::max(32U, 1U << MappingScale); | |||
| 566 | } | |||
| 567 | ||||
| 568 | static uint64_t GetCtorAndDtorPriority(Triple &TargetTriple) { | |||
| 569 | if (TargetTriple.isOSEmscripten()) { | |||
| 570 | return kAsanEmscriptenCtorAndDtorPriority; | |||
| 571 | } else { | |||
| 572 | return kAsanCtorAndDtorPriority; | |||
| 573 | } | |||
| 574 | } | |||
| 575 | ||||
| 576 | namespace { | |||
| 577 | ||||
| 578 | /// Module analysis for getting various metadata about the module. | |||
| 579 | class ASanGlobalsMetadataWrapperPass : public ModulePass { | |||
| 580 | public: | |||
| 581 | static char ID; | |||
| 582 | ||||
| 583 | ASanGlobalsMetadataWrapperPass() : ModulePass(ID) { | |||
| 584 | initializeASanGlobalsMetadataWrapperPassPass( | |||
| 585 | *PassRegistry::getPassRegistry()); | |||
| 586 | } | |||
| 587 | ||||
| 588 | bool runOnModule(Module &M) override { | |||
| 589 | GlobalsMD = GlobalsMetadata(M); | |||
| 590 | return false; | |||
| 591 | } | |||
| 592 | ||||
| 593 | StringRef getPassName() const override { | |||
| 594 | return "ASanGlobalsMetadataWrapperPass"; | |||
| 595 | } | |||
| 596 | ||||
| 597 | void getAnalysisUsage(AnalysisUsage &AU) const override { | |||
| 598 | AU.setPreservesAll(); | |||
| 599 | } | |||
| 600 | ||||
| 601 | GlobalsMetadata &getGlobalsMD() { return GlobalsMD; } | |||
| 602 | ||||
| 603 | private: | |||
| 604 | GlobalsMetadata GlobalsMD; | |||
| 605 | }; | |||
| 606 | ||||
| 607 | char ASanGlobalsMetadataWrapperPass::ID = 0; | |||
| 608 | ||||
| 609 | /// AddressSanitizer: instrument the code in module to find memory bugs. | |||
| 610 | struct AddressSanitizer { | |||
| 611 | AddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD, | |||
| 612 | bool CompileKernel = false, bool Recover = false, | |||
| 613 | bool UseAfterScope = false, | |||
| 614 | AsanDetectStackUseAfterReturnMode UseAfterReturn = | |||
| 615 | AsanDetectStackUseAfterReturnMode::Runtime) | |||
| 616 | : CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan | |||
| 617 | : CompileKernel), | |||
| 618 | Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover), | |||
| 619 | UseAfterScope(UseAfterScope || ClUseAfterScope), | |||
| 620 | UseAfterReturn(ClUseAfterReturn.getNumOccurrences() ? ClUseAfterReturn | |||
| 621 | : UseAfterReturn), | |||
| 622 | GlobalsMD(*GlobalsMD) { | |||
| 623 | C = &(M.getContext()); | |||
| 624 | LongSize = M.getDataLayout().getPointerSizeInBits(); | |||
| 625 | IntptrTy = Type::getIntNTy(*C, LongSize); | |||
| 626 | TargetTriple = Triple(M.getTargetTriple()); | |||
| 627 | ||||
| 628 | Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel); | |||
| 629 | ||||
| 630 | assert(this->UseAfterReturn != AsanDetectStackUseAfterReturnMode::Invalid)((void)0); | |||
| 631 | } | |||
| 632 | ||||
| 633 | uint64_t getAllocaSizeInBytes(const AllocaInst &AI) const { | |||
| 634 | uint64_t ArraySize = 1; | |||
| 635 | if (AI.isArrayAllocation()) { | |||
| 636 | const ConstantInt *CI = dyn_cast<ConstantInt>(AI.getArraySize()); | |||
| 637 | assert(CI && "non-constant array size")((void)0); | |||
| 638 | ArraySize = CI->getZExtValue(); | |||
| ||||
| 639 | } | |||
| 640 | Type *Ty = AI.getAllocatedType(); | |||
| 641 | uint64_t SizeInBytes = | |||
| 642 | AI.getModule()->getDataLayout().getTypeAllocSize(Ty); | |||
| 643 | return SizeInBytes * ArraySize; | |||
| 644 | } | |||
| 645 | ||||
| 646 | /// Check if we want (and can) handle this alloca. | |||
| 647 | bool isInterestingAlloca(const AllocaInst &AI); | |||
| 648 | ||||
| 649 | bool ignoreAccess(Value *Ptr); | |||
| 650 | void getInterestingMemoryOperands( | |||
| 651 | Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting); | |||
| 652 | ||||
| 653 | void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, | |||
| 654 | InterestingMemoryOperand &O, bool UseCalls, | |||
| 655 | const DataLayout &DL); | |||
| 656 | void instrumentPointerComparisonOrSubtraction(Instruction *I); | |||
| 657 | void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore, | |||
| 658 | Value *Addr, uint32_t TypeSize, bool IsWrite, | |||
| 659 | Value *SizeArgument, bool UseCalls, uint32_t Exp); | |||
| 660 | Instruction *instrumentAMDGPUAddress(Instruction *OrigIns, | |||
| 661 | Instruction *InsertBefore, Value *Addr, | |||
| 662 | uint32_t TypeSize, bool IsWrite, | |||
| 663 | Value *SizeArgument); | |||
| 664 | void instrumentUnusualSizeOrAlignment(Instruction *I, | |||
| 665 | Instruction *InsertBefore, Value *Addr, | |||
| 666 | uint32_t TypeSize, bool IsWrite, | |||
| 667 | Value *SizeArgument, bool UseCalls, | |||
| 668 | uint32_t Exp); | |||
| 669 | Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, | |||
| 670 | Value *ShadowValue, uint32_t TypeSize); | |||
| 671 | Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr, | |||
| 672 | bool IsWrite, size_t AccessSizeIndex, | |||
| 673 | Value *SizeArgument, uint32_t Exp); | |||
| 674 | void instrumentMemIntrinsic(MemIntrinsic *MI); | |||
| 675 | Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); | |||
| 676 | bool suppressInstrumentationSiteForDebug(int &Instrumented); | |||
| 677 | bool instrumentFunction(Function &F, const TargetLibraryInfo *TLI); | |||
| 678 | bool maybeInsertAsanInitAtFunctionEntry(Function &F); | |||
| 679 | bool maybeInsertDynamicShadowAtFunctionEntry(Function &F); | |||
| 680 | void markEscapedLocalAllocas(Function &F); | |||
| 681 | ||||
| 682 | private: | |||
| 683 | friend struct FunctionStackPoisoner; | |||
| 684 | ||||
| 685 | void initializeCallbacks(Module &M); | |||
| 686 | ||||
| 687 | bool LooksLikeCodeInBug11395(Instruction *I); | |||
| 688 | bool GlobalIsLinkerInitialized(GlobalVariable *G); | |||
| 689 | bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr, | |||
| 690 | uint64_t TypeSize) const; | |||
| 691 | ||||
| 692 | /// Helper to cleanup per-function state. | |||
| 693 | struct FunctionStateRAII { | |||
| 694 | AddressSanitizer *Pass; | |||
| 695 | ||||
| 696 | FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) { | |||
| 697 | assert(Pass->ProcessedAllocas.empty() &&((void)0) | |||
| 698 | "last pass forgot to clear cache")((void)0); | |||
| 699 | assert(!Pass->LocalDynamicShadow)((void)0); | |||
| 700 | } | |||
| 701 | ||||
| 702 | ~FunctionStateRAII() { | |||
| 703 | Pass->LocalDynamicShadow = nullptr; | |||
| 704 | Pass->ProcessedAllocas.clear(); | |||
| 705 | } | |||
| 706 | }; | |||
| 707 | ||||
| 708 | LLVMContext *C; | |||
| 709 | Triple TargetTriple; | |||
| 710 | int LongSize; | |||
| 711 | bool CompileKernel; | |||
| 712 | bool Recover; | |||
| 713 | bool UseAfterScope; | |||
| 714 | AsanDetectStackUseAfterReturnMode UseAfterReturn; | |||
| 715 | Type *IntptrTy; | |||
| 716 | ShadowMapping Mapping; | |||
| 717 | FunctionCallee AsanHandleNoReturnFunc; | |||
| 718 | FunctionCallee AsanPtrCmpFunction, AsanPtrSubFunction; | |||
| 719 | Constant *AsanShadowGlobal; | |||
| 720 | ||||
| 721 | // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize). | |||
| 722 | FunctionCallee AsanErrorCallback[2][2][kNumberOfAccessSizes]; | |||
| 723 | FunctionCallee AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes]; | |||
| 724 | ||||
| 725 | // These arrays is indexed by AccessIsWrite and Experiment. | |||
| 726 | FunctionCallee AsanErrorCallbackSized[2][2]; | |||
| 727 | FunctionCallee AsanMemoryAccessCallbackSized[2][2]; | |||
| 728 | ||||
| 729 | FunctionCallee AsanMemmove, AsanMemcpy, AsanMemset; | |||
| 730 | Value *LocalDynamicShadow = nullptr; | |||
| 731 | const GlobalsMetadata &GlobalsMD; | |||
| 732 | DenseMap<const AllocaInst *, bool> ProcessedAllocas; | |||
| 733 | ||||
| 734 | FunctionCallee AMDGPUAddressShared; | |||
| 735 | FunctionCallee AMDGPUAddressPrivate; | |||
| 736 | }; | |||
| 737 | ||||
| 738 | class AddressSanitizerLegacyPass : public FunctionPass { | |||
| 739 | public: | |||
| 740 | static char ID; | |||
| 741 | ||||
| 742 | explicit AddressSanitizerLegacyPass( | |||
| 743 | bool CompileKernel = false, bool Recover = false, | |||
| 744 | bool UseAfterScope = false, | |||
| 745 | AsanDetectStackUseAfterReturnMode UseAfterReturn = | |||
| 746 | AsanDetectStackUseAfterReturnMode::Runtime) | |||
| 747 | : FunctionPass(ID), CompileKernel(CompileKernel), Recover(Recover), | |||
| 748 | UseAfterScope(UseAfterScope), UseAfterReturn(UseAfterReturn) { | |||
| 749 | initializeAddressSanitizerLegacyPassPass(*PassRegistry::getPassRegistry()); | |||
| 750 | } | |||
| 751 | ||||
| 752 | StringRef getPassName() const override { | |||
| 753 | return "AddressSanitizerFunctionPass"; | |||
| 754 | } | |||
| 755 | ||||
| 756 | void getAnalysisUsage(AnalysisUsage &AU) const override { | |||
| 757 | AU.addRequired<ASanGlobalsMetadataWrapperPass>(); | |||
| 758 | AU.addRequired<TargetLibraryInfoWrapperPass>(); | |||
| 759 | } | |||
| 760 | ||||
| 761 | bool runOnFunction(Function &F) override { | |||
| 762 | GlobalsMetadata &GlobalsMD = | |||
| 763 | getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD(); | |||
| 764 | const TargetLibraryInfo *TLI = | |||
| 765 | &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F); | |||
| 766 | AddressSanitizer ASan(*F.getParent(), &GlobalsMD, CompileKernel, Recover, | |||
| 767 | UseAfterScope, UseAfterReturn); | |||
| 768 | return ASan.instrumentFunction(F, TLI); | |||
| 769 | } | |||
| 770 | ||||
| 771 | private: | |||
| 772 | bool CompileKernel; | |||
| 773 | bool Recover; | |||
| 774 | bool UseAfterScope; | |||
| 775 | AsanDetectStackUseAfterReturnMode UseAfterReturn; | |||
| 776 | }; | |||
| 777 | ||||
| 778 | class ModuleAddressSanitizer { | |||
| 779 | public: | |||
| 780 | ModuleAddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD, | |||
| 781 | bool CompileKernel = false, bool Recover = false, | |||
| 782 | bool UseGlobalsGC = true, bool UseOdrIndicator = false, | |||
| 783 | AsanDtorKind DestructorKind = AsanDtorKind::Global) | |||
| 784 | : GlobalsMD(*GlobalsMD), | |||
| 785 | CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan | |||
| 786 | : CompileKernel), | |||
| 787 | Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover), | |||
| 788 | UseGlobalsGC(UseGlobalsGC && ClUseGlobalsGC && !this->CompileKernel), | |||
| 789 | // Enable aliases as they should have no downside with ODR indicators. | |||
| 790 | UsePrivateAlias(UseOdrIndicator || ClUsePrivateAlias), | |||
| 791 | UseOdrIndicator(UseOdrIndicator || ClUseOdrIndicator), | |||
| 792 | // Not a typo: ClWithComdat is almost completely pointless without | |||
| 793 | // ClUseGlobalsGC (because then it only works on modules without | |||
| 794 | // globals, which are rare); it is a prerequisite for ClUseGlobalsGC; | |||
| 795 | // and both suffer from gold PR19002 for which UseGlobalsGC constructor | |||
| 796 | // argument is designed as workaround. Therefore, disable both | |||
| 797 | // ClWithComdat and ClUseGlobalsGC unless the frontend says it's ok to | |||
| 798 | // do globals-gc. | |||
| 799 | UseCtorComdat(UseGlobalsGC && ClWithComdat && !this->CompileKernel), | |||
| 800 | DestructorKind(DestructorKind) { | |||
| 801 | C = &(M.getContext()); | |||
| 802 | int LongSize = M.getDataLayout().getPointerSizeInBits(); | |||
| 803 | IntptrTy = Type::getIntNTy(*C, LongSize); | |||
| 804 | TargetTriple = Triple(M.getTargetTriple()); | |||
| 805 | Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel); | |||
| 806 | ||||
| 807 | if (ClOverrideDestructorKind != AsanDtorKind::Invalid) | |||
| 808 | this->DestructorKind = ClOverrideDestructorKind; | |||
| 809 | assert(this->DestructorKind != AsanDtorKind::Invalid)((void)0); | |||
| 810 | } | |||
| 811 | ||||
| 812 | bool instrumentModule(Module &); | |||
| 813 | ||||
| 814 | private: | |||
| 815 | void initializeCallbacks(Module &M); | |||
| 816 | ||||
| 817 | bool InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat); | |||
| 818 | void InstrumentGlobalsCOFF(IRBuilder<> &IRB, Module &M, | |||
| 819 | ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
| 820 | ArrayRef<Constant *> MetadataInitializers); | |||
| 821 | void InstrumentGlobalsELF(IRBuilder<> &IRB, Module &M, | |||
| 822 | ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
| 823 | ArrayRef<Constant *> MetadataInitializers, | |||
| 824 | const std::string &UniqueModuleId); | |||
| 825 | void InstrumentGlobalsMachO(IRBuilder<> &IRB, Module &M, | |||
| 826 | ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
| 827 | ArrayRef<Constant *> MetadataInitializers); | |||
| 828 | void | |||
| 829 | InstrumentGlobalsWithMetadataArray(IRBuilder<> &IRB, Module &M, | |||
| 830 | ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
| 831 | ArrayRef<Constant *> MetadataInitializers); | |||
| 832 | ||||
| 833 | GlobalVariable *CreateMetadataGlobal(Module &M, Constant *Initializer, | |||
| 834 | StringRef OriginalName); | |||
| 835 | void SetComdatForGlobalMetadata(GlobalVariable *G, GlobalVariable *Metadata, | |||
| 836 | StringRef InternalSuffix); | |||
| 837 | Instruction *CreateAsanModuleDtor(Module &M); | |||
| 838 | ||||
| 839 | const GlobalVariable *getExcludedAliasedGlobal(const GlobalAlias &GA) const; | |||
| 840 | bool shouldInstrumentGlobal(GlobalVariable *G) const; | |||
| 841 | bool ShouldUseMachOGlobalsSection() const; | |||
| 842 | StringRef getGlobalMetadataSection() const; | |||
| 843 | void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName); | |||
| 844 | void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName); | |||
| 845 | uint64_t getMinRedzoneSizeForGlobal() const { | |||
| 846 | return getRedzoneSizeForScale(Mapping.Scale); | |||
| 847 | } | |||
| 848 | uint64_t getRedzoneSizeForGlobal(uint64_t SizeInBytes) const; | |||
| 849 | int GetAsanVersion(const Module &M) const; | |||
| 850 | ||||
| 851 | const GlobalsMetadata &GlobalsMD; | |||
| 852 | bool CompileKernel; | |||
| 853 | bool Recover; | |||
| 854 | bool UseGlobalsGC; | |||
| 855 | bool UsePrivateAlias; | |||
| 856 | bool UseOdrIndicator; | |||
| 857 | bool UseCtorComdat; | |||
| 858 | AsanDtorKind DestructorKind; | |||
| 859 | Type *IntptrTy; | |||
| 860 | LLVMContext *C; | |||
| 861 | Triple TargetTriple; | |||
| 862 | ShadowMapping Mapping; | |||
| 863 | FunctionCallee AsanPoisonGlobals; | |||
| 864 | FunctionCallee AsanUnpoisonGlobals; | |||
| 865 | FunctionCallee AsanRegisterGlobals; | |||
| 866 | FunctionCallee AsanUnregisterGlobals; | |||
| 867 | FunctionCallee AsanRegisterImageGlobals; | |||
| 868 | FunctionCallee AsanUnregisterImageGlobals; | |||
| 869 | FunctionCallee AsanRegisterElfGlobals; | |||
| 870 | FunctionCallee AsanUnregisterElfGlobals; | |||
| 871 | ||||
| 872 | Function *AsanCtorFunction = nullptr; | |||
| 873 | Function *AsanDtorFunction = nullptr; | |||
| 874 | }; | |||
| 875 | ||||
| 876 | class ModuleAddressSanitizerLegacyPass : public ModulePass { | |||
| 877 | public: | |||
| 878 | static char ID; | |||
| 879 | ||||
| 880 | explicit ModuleAddressSanitizerLegacyPass( | |||
| 881 | bool CompileKernel = false, bool Recover = false, bool UseGlobalGC = true, | |||
| 882 | bool UseOdrIndicator = false, | |||
| 883 | AsanDtorKind DestructorKind = AsanDtorKind::Global) | |||
| 884 | : ModulePass(ID), CompileKernel(CompileKernel), Recover(Recover), | |||
| 885 | UseGlobalGC(UseGlobalGC), UseOdrIndicator(UseOdrIndicator), | |||
| 886 | DestructorKind(DestructorKind) { | |||
| 887 | initializeModuleAddressSanitizerLegacyPassPass( | |||
| 888 | *PassRegistry::getPassRegistry()); | |||
| 889 | } | |||
| 890 | ||||
| 891 | StringRef getPassName() const override { return "ModuleAddressSanitizer"; } | |||
| 892 | ||||
| 893 | void getAnalysisUsage(AnalysisUsage &AU) const override { | |||
| 894 | AU.addRequired<ASanGlobalsMetadataWrapperPass>(); | |||
| 895 | } | |||
| 896 | ||||
| 897 | bool runOnModule(Module &M) override { | |||
| 898 | GlobalsMetadata &GlobalsMD = | |||
| 899 | getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD(); | |||
| 900 | ModuleAddressSanitizer ASanModule(M, &GlobalsMD, CompileKernel, Recover, | |||
| 901 | UseGlobalGC, UseOdrIndicator, | |||
| 902 | DestructorKind); | |||
| 903 | return ASanModule.instrumentModule(M); | |||
| 904 | } | |||
| 905 | ||||
| 906 | private: | |||
| 907 | bool CompileKernel; | |||
| 908 | bool Recover; | |||
| 909 | bool UseGlobalGC; | |||
| 910 | bool UseOdrIndicator; | |||
| 911 | AsanDtorKind DestructorKind; | |||
| 912 | }; | |||
| 913 | ||||
| 914 | // Stack poisoning does not play well with exception handling. | |||
| 915 | // When an exception is thrown, we essentially bypass the code | |||
| 916 | // that unpoisones the stack. This is why the run-time library has | |||
| 917 | // to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire | |||
| 918 | // stack in the interceptor. This however does not work inside the | |||
| 919 | // actual function which catches the exception. Most likely because the | |||
| 920 | // compiler hoists the load of the shadow value somewhere too high. | |||
| 921 | // This causes asan to report a non-existing bug on 453.povray. | |||
| 922 | // It sounds like an LLVM bug. | |||
| 923 | struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> { | |||
| 924 | Function &F; | |||
| 925 | AddressSanitizer &ASan; | |||
| 926 | DIBuilder DIB; | |||
| 927 | LLVMContext *C; | |||
| 928 | Type *IntptrTy; | |||
| 929 | Type *IntptrPtrTy; | |||
| 930 | ShadowMapping Mapping; | |||
| 931 | ||||
| 932 | SmallVector<AllocaInst *, 16> AllocaVec; | |||
| 933 | SmallVector<AllocaInst *, 16> StaticAllocasToMoveUp; | |||
| 934 | SmallVector<Instruction *, 8> RetVec; | |||
| 935 | ||||
| 936 | FunctionCallee AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1], | |||
| 937 | AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1]; | |||
| 938 | FunctionCallee AsanSetShadowFunc[0x100] = {}; | |||
| 939 | FunctionCallee AsanPoisonStackMemoryFunc, AsanUnpoisonStackMemoryFunc; | |||
| 940 | FunctionCallee AsanAllocaPoisonFunc, AsanAllocasUnpoisonFunc; | |||
| 941 | ||||
| 942 | // Stores a place and arguments of poisoning/unpoisoning call for alloca. | |||
| 943 | struct AllocaPoisonCall { | |||
| 944 | IntrinsicInst *InsBefore; | |||
| 945 | AllocaInst *AI; | |||
| 946 | uint64_t Size; | |||
| 947 | bool DoPoison; | |||
| 948 | }; | |||
| 949 | SmallVector<AllocaPoisonCall, 8> DynamicAllocaPoisonCallVec; | |||
| 950 | SmallVector<AllocaPoisonCall, 8> StaticAllocaPoisonCallVec; | |||
| 951 | bool HasUntracedLifetimeIntrinsic = false; | |||
| 952 | ||||
| 953 | SmallVector<AllocaInst *, 1> DynamicAllocaVec; | |||
| 954 | SmallVector<IntrinsicInst *, 1> StackRestoreVec; | |||
| 955 | AllocaInst *DynamicAllocaLayout = nullptr; | |||
| 956 | IntrinsicInst *LocalEscapeCall = nullptr; | |||
| 957 | ||||
| 958 | bool HasInlineAsm = false; | |||
| 959 | bool HasReturnsTwiceCall = false; | |||
| 960 | bool PoisonStack; | |||
| 961 | ||||
| 962 | FunctionStackPoisoner(Function &F, AddressSanitizer &ASan) | |||
| 963 | : F(F), ASan(ASan), DIB(*F.getParent(), /*AllowUnresolved*/ false), | |||
| 964 | C(ASan.C), IntptrTy(ASan.IntptrTy), | |||
| 965 | IntptrPtrTy(PointerType::get(IntptrTy, 0)), Mapping(ASan.Mapping), | |||
| 966 | PoisonStack(ClStack && | |||
| 967 | !Triple(F.getParent()->getTargetTriple()).isAMDGPU()) {} | |||
| 968 | ||||
| 969 | bool runOnFunction() { | |||
| 970 | if (!PoisonStack) | |||
| 971 | return false; | |||
| 972 | ||||
| 973 | if (ClRedzoneByvalArgs) | |||
| 974 | copyArgsPassedByValToAllocas(); | |||
| 975 | ||||
| 976 | // Collect alloca, ret, lifetime instructions etc. | |||
| 977 | for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB); | |||
| 978 | ||||
| 979 | if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false; | |||
| 980 | ||||
| 981 | initializeCallbacks(*F.getParent()); | |||
| 982 | ||||
| 983 | if (HasUntracedLifetimeIntrinsic) { | |||
| 984 | // If there are lifetime intrinsics which couldn't be traced back to an | |||
| 985 | // alloca, we may not know exactly when a variable enters scope, and | |||
| 986 | // therefore should "fail safe" by not poisoning them. | |||
| 987 | StaticAllocaPoisonCallVec.clear(); | |||
| 988 | DynamicAllocaPoisonCallVec.clear(); | |||
| 989 | } | |||
| 990 | ||||
| 991 | processDynamicAllocas(); | |||
| 992 | processStaticAllocas(); | |||
| 993 | ||||
| 994 | if (ClDebugStack) { | |||
| 995 | LLVM_DEBUG(dbgs() << F)do { } while (false); | |||
| 996 | } | |||
| 997 | return true; | |||
| 998 | } | |||
| 999 | ||||
| 1000 | // Arguments marked with the "byval" attribute are implicitly copied without | |||
| 1001 | // using an alloca instruction. To produce redzones for those arguments, we | |||
| 1002 | // copy them a second time into memory allocated with an alloca instruction. | |||
| 1003 | void copyArgsPassedByValToAllocas(); | |||
| 1004 | ||||
| 1005 | // Finds all Alloca instructions and puts | |||
| 1006 | // poisoned red zones around all of them. | |||
| 1007 | // Then unpoison everything back before the function returns. | |||
| 1008 | void processStaticAllocas(); | |||
| 1009 | void processDynamicAllocas(); | |||
| 1010 | ||||
| 1011 | void createDynamicAllocasInitStorage(); | |||
| 1012 | ||||
| 1013 | // ----------------------- Visitors. | |||
| 1014 | /// Collect all Ret instructions, or the musttail call instruction if it | |||
| 1015 | /// precedes the return instruction. | |||
| 1016 | void visitReturnInst(ReturnInst &RI) { | |||
| 1017 | if (CallInst *CI = RI.getParent()->getTerminatingMustTailCall()) | |||
| 1018 | RetVec.push_back(CI); | |||
| 1019 | else | |||
| 1020 | RetVec.push_back(&RI); | |||
| 1021 | } | |||
| 1022 | ||||
| 1023 | /// Collect all Resume instructions. | |||
| 1024 | void visitResumeInst(ResumeInst &RI) { RetVec.push_back(&RI); } | |||
| 1025 | ||||
| 1026 | /// Collect all CatchReturnInst instructions. | |||
| 1027 | void visitCleanupReturnInst(CleanupReturnInst &CRI) { RetVec.push_back(&CRI); } | |||
| 1028 | ||||
| 1029 | void unpoisonDynamicAllocasBeforeInst(Instruction *InstBefore, | |||
| 1030 | Value *SavedStack) { | |||
| 1031 | IRBuilder<> IRB(InstBefore); | |||
| 1032 | Value *DynamicAreaPtr = IRB.CreatePtrToInt(SavedStack, IntptrTy); | |||
| 1033 | // When we insert _asan_allocas_unpoison before @llvm.stackrestore, we | |||
| 1034 | // need to adjust extracted SP to compute the address of the most recent | |||
| 1035 | // alloca. We have a special @llvm.get.dynamic.area.offset intrinsic for | |||
| 1036 | // this purpose. | |||
| 1037 | if (!isa<ReturnInst>(InstBefore)) { | |||
| 1038 | Function *DynamicAreaOffsetFunc = Intrinsic::getDeclaration( | |||
| 1039 | InstBefore->getModule(), Intrinsic::get_dynamic_area_offset, | |||
| 1040 | {IntptrTy}); | |||
| 1041 | ||||
| 1042 | Value *DynamicAreaOffset = IRB.CreateCall(DynamicAreaOffsetFunc, {}); | |||
| 1043 | ||||
| 1044 | DynamicAreaPtr = IRB.CreateAdd(IRB.CreatePtrToInt(SavedStack, IntptrTy), | |||
| 1045 | DynamicAreaOffset); | |||
| 1046 | } | |||
| 1047 | ||||
| 1048 | IRB.CreateCall( | |||
| 1049 | AsanAllocasUnpoisonFunc, | |||
| 1050 | {IRB.CreateLoad(IntptrTy, DynamicAllocaLayout), DynamicAreaPtr}); | |||
| 1051 | } | |||
| 1052 | ||||
| 1053 | // Unpoison dynamic allocas redzones. | |||
| 1054 | void unpoisonDynamicAllocas() { | |||
| 1055 | for (Instruction *Ret : RetVec) | |||
| 1056 | unpoisonDynamicAllocasBeforeInst(Ret, DynamicAllocaLayout); | |||
| 1057 | ||||
| 1058 | for (Instruction *StackRestoreInst : StackRestoreVec) | |||
| 1059 | unpoisonDynamicAllocasBeforeInst(StackRestoreInst, | |||
| 1060 | StackRestoreInst->getOperand(0)); | |||
| 1061 | } | |||
| 1062 | ||||
| 1063 | // Deploy and poison redzones around dynamic alloca call. To do this, we | |||
| 1064 | // should replace this call with another one with changed parameters and | |||
| 1065 | // replace all its uses with new address, so | |||
| 1066 | // addr = alloca type, old_size, align | |||
| 1067 | // is replaced by | |||
| 1068 | // new_size = (old_size + additional_size) * sizeof(type) | |||
| 1069 | // tmp = alloca i8, new_size, max(align, 32) | |||
| 1070 | // addr = tmp + 32 (first 32 bytes are for the left redzone). | |||
| 1071 | // Additional_size is added to make new memory allocation contain not only | |||
| 1072 | // requested memory, but also left, partial and right redzones. | |||
| 1073 | void handleDynamicAllocaCall(AllocaInst *AI); | |||
| 1074 | ||||
| 1075 | /// Collect Alloca instructions we want (and can) handle. | |||
| 1076 | void visitAllocaInst(AllocaInst &AI) { | |||
| 1077 | if (!ASan.isInterestingAlloca(AI)) { | |||
| 1078 | if (AI.isStaticAlloca()) { | |||
| 1079 | // Skip over allocas that are present *before* the first instrumented | |||
| 1080 | // alloca, we don't want to move those around. | |||
| 1081 | if (AllocaVec.empty()) | |||
| 1082 | return; | |||
| 1083 | ||||
| 1084 | StaticAllocasToMoveUp.push_back(&AI); | |||
| 1085 | } | |||
| 1086 | return; | |||
| 1087 | } | |||
| 1088 | ||||
| 1089 | if (!AI.isStaticAlloca()) | |||
| 1090 | DynamicAllocaVec.push_back(&AI); | |||
| 1091 | else | |||
| 1092 | AllocaVec.push_back(&AI); | |||
| 1093 | } | |||
| 1094 | ||||
| 1095 | /// Collect lifetime intrinsic calls to check for use-after-scope | |||
| 1096 | /// errors. | |||
| 1097 | void visitIntrinsicInst(IntrinsicInst &II) { | |||
| 1098 | Intrinsic::ID ID = II.getIntrinsicID(); | |||
| 1099 | if (ID == Intrinsic::stackrestore) StackRestoreVec.push_back(&II); | |||
| ||||
| 1100 | if (ID == Intrinsic::localescape) LocalEscapeCall = &II; | |||
| 1101 | if (!ASan.UseAfterScope) | |||
| 1102 | return; | |||
| 1103 | if (!II.isLifetimeStartOrEnd()) | |||
| 1104 | return; | |||
| 1105 | // Found lifetime intrinsic, add ASan instrumentation if necessary. | |||
| 1106 | auto *Size = cast<ConstantInt>(II.getArgOperand(0)); | |||
| 1107 | // If size argument is undefined, don't do anything. | |||
| 1108 | if (Size->isMinusOne()) return; | |||
| 1109 | // Check that size doesn't saturate uint64_t and can | |||
| 1110 | // be stored in IntptrTy. | |||
| 1111 | const uint64_t SizeValue = Size->getValue().getLimitedValue(); | |||
| 1112 | if (SizeValue == ~0ULL || | |||
| 1113 | !ConstantInt::isValueValidForType(IntptrTy, SizeValue)) | |||
| 1114 | return; | |||
| 1115 | // Find alloca instruction that corresponds to llvm.lifetime argument. | |||
| 1116 | // Currently we can only handle lifetime markers pointing to the | |||
| 1117 | // beginning of the alloca. | |||
| 1118 | AllocaInst *AI = findAllocaForValue(II.getArgOperand(1), true); | |||
| 1119 | if (!AI) { | |||
| 1120 | HasUntracedLifetimeIntrinsic = true; | |||
| 1121 | return; | |||
| 1122 | } | |||
| 1123 | // We're interested only in allocas we can handle. | |||
| 1124 | if (!ASan.isInterestingAlloca(*AI)) | |||
| 1125 | return; | |||
| 1126 | bool DoPoison = (ID == Intrinsic::lifetime_end); | |||
| 1127 | AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison}; | |||
| 1128 | if (AI->isStaticAlloca()) | |||
| 1129 | StaticAllocaPoisonCallVec.push_back(APC); | |||
| 1130 | else if (ClInstrumentDynamicAllocas) | |||
| 1131 | DynamicAllocaPoisonCallVec.push_back(APC); | |||
| 1132 | } | |||
| 1133 | ||||
| 1134 | void visitCallBase(CallBase &CB) { | |||
| 1135 | if (CallInst *CI = dyn_cast<CallInst>(&CB)) { | |||
| 1136 | HasInlineAsm |= CI->isInlineAsm() && &CB != ASan.LocalDynamicShadow; | |||
| 1137 | HasReturnsTwiceCall |= CI->canReturnTwice(); | |||
| 1138 | } | |||
| 1139 | } | |||
| 1140 | ||||
| 1141 | // ---------------------- Helpers. | |||
| 1142 | void initializeCallbacks(Module &M); | |||
| 1143 | ||||
| 1144 | // Copies bytes from ShadowBytes into shadow memory for indexes where | |||
| 1145 | // ShadowMask is not zero. If ShadowMask[i] is zero, we assume that | |||
| 1146 | // ShadowBytes[i] is constantly zero and doesn't need to be overwritten. | |||
| 1147 | void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes, | |||
| 1148 | IRBuilder<> &IRB, Value *ShadowBase); | |||
| 1149 | void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes, | |||
| 1150 | size_t Begin, size_t End, IRBuilder<> &IRB, | |||
| 1151 | Value *ShadowBase); | |||
| 1152 | void copyToShadowInline(ArrayRef<uint8_t> ShadowMask, | |||
| 1153 | ArrayRef<uint8_t> ShadowBytes, size_t Begin, | |||
| 1154 | size_t End, IRBuilder<> &IRB, Value *ShadowBase); | |||
| 1155 | ||||
| 1156 | void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison); | |||
| 1157 | ||||
| 1158 | Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L, | |||
| 1159 | bool Dynamic); | |||
| 1160 | PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue, | |||
| 1161 | Instruction *ThenTerm, Value *ValueIfFalse); | |||
| 1162 | }; | |||
| 1163 | ||||
| 1164 | } // end anonymous namespace | |||
| 1165 | ||||
| 1166 | void LocationMetadata::parse(MDNode *MDN) { | |||
| 1167 | assert(MDN->getNumOperands() == 3)((void)0); | |||
| 1168 | MDString *DIFilename = cast<MDString>(MDN->getOperand(0)); | |||
| 1169 | Filename = DIFilename->getString(); | |||
| 1170 | LineNo = mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue(); | |||
| 1171 | ColumnNo = | |||
| 1172 | mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue(); | |||
| 1173 | } | |||
| 1174 | ||||
| 1175 | // FIXME: It would be cleaner to instead attach relevant metadata to the globals | |||
| 1176 | // we want to sanitize instead and reading this metadata on each pass over a | |||
| 1177 | // function instead of reading module level metadata at first. | |||
| 1178 | GlobalsMetadata::GlobalsMetadata(Module &M) { | |||
| 1179 | NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals"); | |||
| 1180 | if (!Globals) | |||
| 1181 | return; | |||
| 1182 | for (auto MDN : Globals->operands()) { | |||
| 1183 | // Metadata node contains the global and the fields of "Entry". | |||
| 1184 | assert(MDN->getNumOperands() == 5)((void)0); | |||
| 1185 | auto *V = mdconst::extract_or_null<Constant>(MDN->getOperand(0)); | |||
| 1186 | // The optimizer may optimize away a global entirely. | |||
| 1187 | if (!V) | |||
| 1188 | continue; | |||
| 1189 | auto *StrippedV = V->stripPointerCasts(); | |||
| 1190 | auto *GV = dyn_cast<GlobalVariable>(StrippedV); | |||
| 1191 | if (!GV) | |||
| 1192 | continue; | |||
| 1193 | // We can already have an entry for GV if it was merged with another | |||
| 1194 | // global. | |||
| 1195 | Entry &E = Entries[GV]; | |||
| 1196 | if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1))) | |||
| 1197 | E.SourceLoc.parse(Loc); | |||
| 1198 | if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2))) | |||
| 1199 | E.Name = Name->getString(); | |||
| 1200 | ConstantInt *IsDynInit = mdconst::extract<ConstantInt>(MDN->getOperand(3)); | |||
| 1201 | E.IsDynInit |= IsDynInit->isOne(); | |||
| 1202 | ConstantInt *IsExcluded = | |||
| 1203 | mdconst::extract<ConstantInt>(MDN->getOperand(4)); | |||
| 1204 | E.IsExcluded |= IsExcluded->isOne(); | |||
| 1205 | } | |||
| 1206 | } | |||
| 1207 | ||||
| 1208 | AnalysisKey ASanGlobalsMetadataAnalysis::Key; | |||
| 1209 | ||||
| 1210 | GlobalsMetadata ASanGlobalsMetadataAnalysis::run(Module &M, | |||
| 1211 | ModuleAnalysisManager &AM) { | |||
| 1212 | return GlobalsMetadata(M); | |||
| 1213 | } | |||
| 1214 | ||||
| 1215 | AddressSanitizerPass::AddressSanitizerPass( | |||
| 1216 | bool CompileKernel, bool Recover, bool UseAfterScope, | |||
| 1217 | AsanDetectStackUseAfterReturnMode UseAfterReturn) | |||
| 1218 | : CompileKernel(CompileKernel), Recover(Recover), | |||
| 1219 | UseAfterScope(UseAfterScope), UseAfterReturn(UseAfterReturn) {} | |||
| 1220 | ||||
| 1221 | PreservedAnalyses AddressSanitizerPass::run(Function &F, | |||
| 1222 | AnalysisManager<Function> &AM) { | |||
| 1223 | auto &MAMProxy = AM.getResult<ModuleAnalysisManagerFunctionProxy>(F); | |||
| 1224 | Module &M = *F.getParent(); | |||
| 1225 | if (auto *R = MAMProxy.getCachedResult<ASanGlobalsMetadataAnalysis>(M)) { | |||
| 1226 | const TargetLibraryInfo *TLI = &AM.getResult<TargetLibraryAnalysis>(F); | |||
| 1227 | AddressSanitizer Sanitizer(M, R, CompileKernel, Recover, UseAfterScope, | |||
| 1228 | UseAfterReturn); | |||
| 1229 | if (Sanitizer.instrumentFunction(F, TLI)) | |||
| 1230 | return PreservedAnalyses::none(); | |||
| 1231 | return PreservedAnalyses::all(); | |||
| 1232 | } | |||
| 1233 | ||||
| 1234 | report_fatal_error( | |||
| 1235 | "The ASanGlobalsMetadataAnalysis is required to run before " | |||
| 1236 | "AddressSanitizer can run"); | |||
| 1237 | return PreservedAnalyses::all(); | |||
| 1238 | } | |||
| 1239 | ||||
| 1240 | ModuleAddressSanitizerPass::ModuleAddressSanitizerPass( | |||
| 1241 | bool CompileKernel, bool Recover, bool UseGlobalGC, bool UseOdrIndicator, | |||
| 1242 | AsanDtorKind DestructorKind) | |||
| 1243 | : CompileKernel(CompileKernel), Recover(Recover), UseGlobalGC(UseGlobalGC), | |||
| 1244 | UseOdrIndicator(UseOdrIndicator), DestructorKind(DestructorKind) {} | |||
| 1245 | ||||
| 1246 | PreservedAnalyses ModuleAddressSanitizerPass::run(Module &M, | |||
| 1247 | AnalysisManager<Module> &AM) { | |||
| 1248 | GlobalsMetadata &GlobalsMD = AM.getResult<ASanGlobalsMetadataAnalysis>(M); | |||
| 1249 | ModuleAddressSanitizer Sanitizer(M, &GlobalsMD, CompileKernel, Recover, | |||
| 1250 | UseGlobalGC, UseOdrIndicator, | |||
| 1251 | DestructorKind); | |||
| 1252 | if (Sanitizer.instrumentModule(M)) | |||
| 1253 | return PreservedAnalyses::none(); | |||
| 1254 | return PreservedAnalyses::all(); | |||
| 1255 | } | |||
| 1256 | ||||
| 1257 | INITIALIZE_PASS(ASanGlobalsMetadataWrapperPass, "asan-globals-md",static void *initializeASanGlobalsMetadataWrapperPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "Read metadata to mark which globals should be instrumented " "when running ASan.", "asan-globals-md", &ASanGlobalsMetadataWrapperPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ASanGlobalsMetadataWrapperPass >), false, true); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeASanGlobalsMetadataWrapperPassPassFlag ; void llvm::initializeASanGlobalsMetadataWrapperPassPass(PassRegistry &Registry) { llvm::call_once(InitializeASanGlobalsMetadataWrapperPassPassFlag , initializeASanGlobalsMetadataWrapperPassPassOnce, std::ref( Registry)); } | |||
| 1258 | "Read metadata to mark which globals should be instrumented "static void *initializeASanGlobalsMetadataWrapperPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "Read metadata to mark which globals should be instrumented " "when running ASan.", "asan-globals-md", &ASanGlobalsMetadataWrapperPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ASanGlobalsMetadataWrapperPass >), false, true); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeASanGlobalsMetadataWrapperPassPassFlag ; void llvm::initializeASanGlobalsMetadataWrapperPassPass(PassRegistry &Registry) { llvm::call_once(InitializeASanGlobalsMetadataWrapperPassPassFlag , initializeASanGlobalsMetadataWrapperPassPassOnce, std::ref( Registry)); } | |||
| 1259 | "when running ASan.",static void *initializeASanGlobalsMetadataWrapperPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "Read metadata to mark which globals should be instrumented " "when running ASan.", "asan-globals-md", &ASanGlobalsMetadataWrapperPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ASanGlobalsMetadataWrapperPass >), false, true); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeASanGlobalsMetadataWrapperPassPassFlag ; void llvm::initializeASanGlobalsMetadataWrapperPassPass(PassRegistry &Registry) { llvm::call_once(InitializeASanGlobalsMetadataWrapperPassPassFlag , initializeASanGlobalsMetadataWrapperPassPassOnce, std::ref( Registry)); } | |||
| 1260 | false, true)static void *initializeASanGlobalsMetadataWrapperPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "Read metadata to mark which globals should be instrumented " "when running ASan.", "asan-globals-md", &ASanGlobalsMetadataWrapperPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ASanGlobalsMetadataWrapperPass >), false, true); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeASanGlobalsMetadataWrapperPassPassFlag ; void llvm::initializeASanGlobalsMetadataWrapperPassPass(PassRegistry &Registry) { llvm::call_once(InitializeASanGlobalsMetadataWrapperPassPassFlag , initializeASanGlobalsMetadataWrapperPassPassOnce, std::ref( Registry)); } | |||
| 1261 | ||||
| 1262 | char AddressSanitizerLegacyPass::ID = 0; | |||
| 1263 | ||||
| 1264 | INITIALIZE_PASS_BEGIN(static void *initializeAddressSanitizerLegacyPassPassOnce(PassRegistry &Registry) { | |||
| 1265 | AddressSanitizerLegacyPass, "asan",static void *initializeAddressSanitizerLegacyPassPassOnce(PassRegistry &Registry) { | |||
| 1266 | "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,static void *initializeAddressSanitizerLegacyPassPassOnce(PassRegistry &Registry) { | |||
| 1267 | false)static void *initializeAddressSanitizerLegacyPassPassOnce(PassRegistry &Registry) { | |||
| 1268 | INITIALIZE_PASS_DEPENDENCY(ASanGlobalsMetadataWrapperPass)initializeASanGlobalsMetadataWrapperPassPass(Registry); | |||
| 1269 | INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)initializeTargetLibraryInfoWrapperPassPass(Registry); | |||
| 1270 | INITIALIZE_PASS_END(PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." , "asan", &AddressSanitizerLegacyPass::ID, PassInfo::NormalCtor_t (callDefaultCtor<AddressSanitizerLegacyPass>), false, false ); Registry.registerPass(*PI, true); return PI; } static llvm ::once_flag InitializeAddressSanitizerLegacyPassPassFlag; void llvm::initializeAddressSanitizerLegacyPassPass(PassRegistry & Registry) { llvm::call_once(InitializeAddressSanitizerLegacyPassPassFlag , initializeAddressSanitizerLegacyPassPassOnce, std::ref(Registry )); } | |||
| 1271 | AddressSanitizerLegacyPass, "asan",PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." , "asan", &AddressSanitizerLegacyPass::ID, PassInfo::NormalCtor_t (callDefaultCtor<AddressSanitizerLegacyPass>), false, false ); Registry.registerPass(*PI, true); return PI; } static llvm ::once_flag InitializeAddressSanitizerLegacyPassPassFlag; void llvm::initializeAddressSanitizerLegacyPassPass(PassRegistry & Registry) { llvm::call_once(InitializeAddressSanitizerLegacyPassPassFlag , initializeAddressSanitizerLegacyPassPassOnce, std::ref(Registry )); } | |||
| 1272 | "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." , "asan", &AddressSanitizerLegacyPass::ID, PassInfo::NormalCtor_t (callDefaultCtor<AddressSanitizerLegacyPass>), false, false ); Registry.registerPass(*PI, true); return PI; } static llvm ::once_flag InitializeAddressSanitizerLegacyPassPassFlag; void llvm::initializeAddressSanitizerLegacyPassPass(PassRegistry & Registry) { llvm::call_once(InitializeAddressSanitizerLegacyPassPassFlag , initializeAddressSanitizerLegacyPassPassOnce, std::ref(Registry )); } | |||
| 1273 | false)PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." , "asan", &AddressSanitizerLegacyPass::ID, PassInfo::NormalCtor_t (callDefaultCtor<AddressSanitizerLegacyPass>), false, false ); Registry.registerPass(*PI, true); return PI; } static llvm ::once_flag InitializeAddressSanitizerLegacyPassPassFlag; void llvm::initializeAddressSanitizerLegacyPassPass(PassRegistry & Registry) { llvm::call_once(InitializeAddressSanitizerLegacyPassPassFlag , initializeAddressSanitizerLegacyPassPassOnce, std::ref(Registry )); } | |||
| 1274 | ||||
| 1275 | FunctionPass *llvm::createAddressSanitizerFunctionPass( | |||
| 1276 | bool CompileKernel, bool Recover, bool UseAfterScope, | |||
| 1277 | AsanDetectStackUseAfterReturnMode UseAfterReturn) { | |||
| 1278 | assert(!CompileKernel || Recover)((void)0); | |||
| 1279 | return new AddressSanitizerLegacyPass(CompileKernel, Recover, UseAfterScope, | |||
| 1280 | UseAfterReturn); | |||
| 1281 | } | |||
| 1282 | ||||
| 1283 | char ModuleAddressSanitizerLegacyPass::ID = 0; | |||
| 1284 | ||||
| 1285 | INITIALIZE_PASS(static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
| 1286 | ModuleAddressSanitizerLegacyPass, "asan-module",static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
| 1287 | "AddressSanitizer: detects use-after-free and out-of-bounds bugs."static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
| 1288 | "ModulePass",static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
| 1289 | false, false)static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
| 1290 | ||||
| 1291 | ModulePass *llvm::createModuleAddressSanitizerLegacyPassPass( | |||
| 1292 | bool CompileKernel, bool Recover, bool UseGlobalsGC, bool UseOdrIndicator, | |||
| 1293 | AsanDtorKind Destructor) { | |||
| 1294 | assert(!CompileKernel || Recover)((void)0); | |||
| 1295 | return new ModuleAddressSanitizerLegacyPass( | |||
| 1296 | CompileKernel, Recover, UseGlobalsGC, UseOdrIndicator, Destructor); | |||
| 1297 | } | |||
| 1298 | ||||
| 1299 | static size_t TypeSizeToSizeIndex(uint32_t TypeSize) { | |||
| 1300 | size_t Res = countTrailingZeros(TypeSize / 8); | |||
| 1301 | assert(Res < kNumberOfAccessSizes)((void)0); | |||
| 1302 | return Res; | |||
| 1303 | } | |||
| 1304 | ||||
| 1305 | /// Create a global describing a source location. | |||
| 1306 | static GlobalVariable *createPrivateGlobalForSourceLoc(Module &M, | |||
| 1307 | LocationMetadata MD) { | |||
| 1308 | Constant *LocData[] = { | |||
| 1309 | createPrivateGlobalForString(M, MD.Filename, true, kAsanGenPrefix), | |||
| 1310 | ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo), | |||
| 1311 | ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo), | |||
| 1312 | }; | |||
| 1313 | auto LocStruct = ConstantStruct::getAnon(LocData); | |||
| 1314 | auto GV = new GlobalVariable(M, LocStruct->getType(), true, | |||
| 1315 | GlobalValue::PrivateLinkage, LocStruct, | |||
| 1316 | kAsanGenPrefix); | |||
| 1317 | GV->setUnnamedAddr(GlobalValue::UnnamedAddr::Global); | |||
| 1318 | return GV; | |||
| 1319 | } | |||
| 1320 | ||||
| 1321 | /// Check if \p G has been created by a trusted compiler pass. | |||
| 1322 | static bool GlobalWasGeneratedByCompiler(GlobalVariable *G) { | |||
| 1323 | // Do not instrument @llvm.global_ctors, @llvm.used, etc. | |||
| 1324 | if (G->getName().startswith("llvm.")) | |||
| 1325 | return true; | |||
| 1326 | ||||
| 1327 | // Do not instrument asan globals. | |||
| 1328 | if (G->getName().startswith(kAsanGenPrefix) || | |||
| 1329 | G->getName().startswith(kSanCovGenPrefix) || | |||
| 1330 | G->getName().startswith(kODRGenPrefix)) | |||
| 1331 | return true; | |||
| 1332 | ||||
| 1333 | // Do not instrument gcov counter arrays. | |||
| 1334 | if (G->getName() == "__llvm_gcov_ctr") | |||
| 1335 | return true; | |||
| 1336 | ||||
| 1337 | return false; | |||
| 1338 | } | |||
| 1339 | ||||
| 1340 | static bool isUnsupportedAMDGPUAddrspace(Value *Addr) { | |||
| 1341 | Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType()); | |||
| 1342 | unsigned int AddrSpace = PtrTy->getPointerAddressSpace(); | |||
| 1343 | if (AddrSpace == 3 || AddrSpace == 5) | |||
| 1344 | return true; | |||
| 1345 | return false; | |||
| 1346 | } | |||
| 1347 | ||||
| 1348 | Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { | |||
| 1349 | // Shadow >> scale | |||
| 1350 | Shadow = IRB.CreateLShr(Shadow, Mapping.Scale); | |||
| 1351 | if (Mapping.Offset == 0) return Shadow; | |||
| 1352 | // (Shadow >> scale) | offset | |||
| 1353 | Value *ShadowBase; | |||
| 1354 | if (LocalDynamicShadow) | |||
| 1355 | ShadowBase = LocalDynamicShadow; | |||
| 1356 | else | |||
| 1357 | ShadowBase = ConstantInt::get(IntptrTy, Mapping.Offset); | |||
| 1358 | if (Mapping.OrShadowOffset) | |||
| 1359 | return IRB.CreateOr(Shadow, ShadowBase); | |||
| 1360 | else | |||
| 1361 | return IRB.CreateAdd(Shadow, ShadowBase); | |||
| 1362 | } | |||
| 1363 | ||||
| 1364 | // Instrument memset/memmove/memcpy | |||
| 1365 | void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { | |||
| 1366 | IRBuilder<> IRB(MI); | |||
| 1367 | if (isa<MemTransferInst>(MI)) { | |||
| 1368 | IRB.CreateCall( | |||
| 1369 | isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy, | |||
| 1370 | {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), | |||
| 1371 | IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()), | |||
| 1372 | IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); | |||
| 1373 | } else if (isa<MemSetInst>(MI)) { | |||
| 1374 | IRB.CreateCall( | |||
| 1375 | AsanMemset, | |||
| 1376 | {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), | |||
| 1377 | IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false), | |||
| 1378 | IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); | |||
| 1379 | } | |||
| 1380 | MI->eraseFromParent(); | |||
| 1381 | } | |||
| 1382 | ||||
| 1383 | /// Check if we want (and can) handle this alloca. | |||
| 1384 | bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) { | |||
| 1385 | auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI); | |||
| 1386 | ||||
| 1387 | if (PreviouslySeenAllocaInfo != ProcessedAllocas.end()) | |||
| 1388 | return PreviouslySeenAllocaInfo->getSecond(); | |||
| 1389 | ||||
| 1390 | bool IsInteresting = | |||
| 1391 | (AI.getAllocatedType()->isSized() && | |||
| 1392 | // alloca() may be called with 0 size, ignore it. | |||
| 1393 | ((!AI.isStaticAlloca()) || getAllocaSizeInBytes(AI) > 0) && | |||
| 1394 | // We are only interested in allocas not promotable to registers. | |||
| 1395 | // Promotable allocas are common under -O0. | |||
| 1396 | (!ClSkipPromotableAllocas || !isAllocaPromotable(&AI)) && | |||
| 1397 | // inalloca allocas are not treated as static, and we don't want | |||
| 1398 | // dynamic alloca instrumentation for them as well. | |||
| 1399 | !AI.isUsedWithInAlloca() && | |||
| 1400 | // swifterror allocas are register promoted by ISel | |||
| 1401 | !AI.isSwiftError()); | |||
| 1402 | ||||
| 1403 | ProcessedAllocas[&AI] = IsInteresting; | |||
| 1404 | return IsInteresting; | |||
| 1405 | } | |||
| 1406 | ||||
| 1407 | bool AddressSanitizer::ignoreAccess(Value *Ptr) { | |||
| 1408 | // Instrument acesses from different address spaces only for AMDGPU. | |||
| 1409 | Type *PtrTy = cast<PointerType>(Ptr->getType()->getScalarType()); | |||
| 1410 | if (PtrTy->getPointerAddressSpace() != 0 && | |||
| 1411 | !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(Ptr))) | |||
| 1412 | return true; | |||
| 1413 | ||||
| 1414 | // Ignore swifterror addresses. | |||
| 1415 | // swifterror memory addresses are mem2reg promoted by instruction | |||
| 1416 | // selection. As such they cannot have regular uses like an instrumentation | |||
| 1417 | // function and it makes no sense to track them as memory. | |||
| 1418 | if (Ptr->isSwiftError()) | |||
| 1419 | return true; | |||
| 1420 | ||||
| 1421 | // Treat memory accesses to promotable allocas as non-interesting since they | |||
| 1422 | // will not cause memory violations. This greatly speeds up the instrumented | |||
| 1423 | // executable at -O0. | |||
| 1424 | if (auto AI = dyn_cast_or_null<AllocaInst>(Ptr)) | |||
| 1425 | if (ClSkipPromotableAllocas && !isInterestingAlloca(*AI)) | |||
| 1426 | return true; | |||
| 1427 | ||||
| 1428 | return false; | |||
| 1429 | } | |||
| 1430 | ||||
| 1431 | void AddressSanitizer::getInterestingMemoryOperands( | |||
| 1432 | Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting) { | |||
| 1433 | // Skip memory accesses inserted by another instrumentation. | |||
| 1434 | if (I->hasMetadata("nosanitize")) | |||
| 1435 | return; | |||
| 1436 | ||||
| 1437 | // Do not instrument the load fetching the dynamic shadow address. | |||
| 1438 | if (LocalDynamicShadow == I) | |||
| 1439 | return; | |||
| 1440 | ||||
| 1441 | if (LoadInst *LI = dyn_cast<LoadInst>(I)) { | |||
| 1442 | if (!ClInstrumentReads || ignoreAccess(LI->getPointerOperand())) | |||
| 1443 | return; | |||
| 1444 | Interesting.emplace_back(I, LI->getPointerOperandIndex(), false, | |||
| 1445 | LI->getType(), LI->getAlign()); | |||
| 1446 | } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) { | |||
| 1447 | if (!ClInstrumentWrites || ignoreAccess(SI->getPointerOperand())) | |||
| 1448 | return; | |||
| 1449 | Interesting.emplace_back(I, SI->getPointerOperandIndex(), true, | |||
| 1450 | SI->getValueOperand()->getType(), SI->getAlign()); | |||
| 1451 | } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { | |||
| 1452 | if (!ClInstrumentAtomics || ignoreAccess(RMW->getPointerOperand())) | |||
| 1453 | return; | |||
| 1454 | Interesting.emplace_back(I, RMW->getPointerOperandIndex(), true, | |||
| 1455 | RMW->getValOperand()->getType(), None); | |||
| 1456 | } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { | |||
| 1457 | if (!ClInstrumentAtomics || ignoreAccess(XCHG->getPointerOperand())) | |||
| 1458 | return; | |||
| 1459 | Interesting.emplace_back(I, XCHG->getPointerOperandIndex(), true, | |||
| 1460 | XCHG->getCompareOperand()->getType(), None); | |||
| 1461 | } else if (auto CI = dyn_cast<CallInst>(I)) { | |||
| 1462 | auto *F = CI->getCalledFunction(); | |||
| 1463 | if (F && (F->getName().startswith("llvm.masked.load.") || | |||
| 1464 | F->getName().startswith("llvm.masked.store."))) { | |||
| 1465 | bool IsWrite = F->getName().startswith("llvm.masked.store."); | |||
| 1466 | // Masked store has an initial operand for the value. | |||
| 1467 | unsigned OpOffset = IsWrite ? 1 : 0; | |||
| 1468 | if (IsWrite ? !ClInstrumentWrites : !ClInstrumentReads) | |||
| 1469 | return; | |||
| 1470 | ||||
| 1471 | auto BasePtr = CI->getOperand(OpOffset); | |||
| 1472 | if (ignoreAccess(BasePtr)) | |||
| 1473 | return; | |||
| 1474 | auto Ty = cast<PointerType>(BasePtr->getType())->getElementType(); | |||
| 1475 | MaybeAlign Alignment = Align(1); | |||
| 1476 | // Otherwise no alignment guarantees. We probably got Undef. | |||
| 1477 | if (auto *Op = dyn_cast<ConstantInt>(CI->getOperand(1 + OpOffset))) | |||
| 1478 | Alignment = Op->getMaybeAlignValue(); | |||
| 1479 | Value *Mask = CI->getOperand(2 + OpOffset); | |||
| 1480 | Interesting.emplace_back(I, OpOffset, IsWrite, Ty, Alignment, Mask); | |||
| 1481 | } else { | |||
| 1482 | for (unsigned ArgNo = 0; ArgNo < CI->getNumArgOperands(); ArgNo++) { | |||
| 1483 | if (!ClInstrumentByval || !CI->isByValArgument(ArgNo) || | |||
| 1484 | ignoreAccess(CI->getArgOperand(ArgNo))) | |||
| 1485 | continue; | |||
| 1486 | Type *Ty = CI->getParamByValType(ArgNo); | |||
| 1487 | Interesting.emplace_back(I, ArgNo, false, Ty, Align(1)); | |||
| 1488 | } | |||
| 1489 | } | |||
| 1490 | } | |||
| 1491 | } | |||
| 1492 | ||||
| 1493 | static bool isPointerOperand(Value *V) { | |||
| 1494 | return V->getType()->isPointerTy() || isa<PtrToIntInst>(V); | |||
| 1495 | } | |||
| 1496 | ||||
| 1497 | // This is a rough heuristic; it may cause both false positives and | |||
| 1498 | // false negatives. The proper implementation requires cooperation with | |||
| 1499 | // the frontend. | |||
| 1500 | static bool isInterestingPointerComparison(Instruction *I) { | |||
| 1501 | if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) { | |||
| 1502 | if (!Cmp->isRelational()) | |||
| 1503 | return false; | |||
| 1504 | } else { | |||
| 1505 | return false; | |||
| 1506 | } | |||
| 1507 | return isPointerOperand(I->getOperand(0)) && | |||
| 1508 | isPointerOperand(I->getOperand(1)); | |||
| 1509 | } | |||
| 1510 | ||||
| 1511 | // This is a rough heuristic; it may cause both false positives and | |||
| 1512 | // false negatives. The proper implementation requires cooperation with | |||
| 1513 | // the frontend. | |||
| 1514 | static bool isInterestingPointerSubtraction(Instruction *I) { | |||
| 1515 | if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) { | |||
| 1516 | if (BO->getOpcode() != Instruction::Sub) | |||
| 1517 | return false; | |||
| 1518 | } else { | |||
| 1519 | return false; | |||
| 1520 | } | |||
| 1521 | return isPointerOperand(I->getOperand(0)) && | |||
| 1522 | isPointerOperand(I->getOperand(1)); | |||
| 1523 | } | |||
| 1524 | ||||
| 1525 | bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) { | |||
| 1526 | // If a global variable does not have dynamic initialization we don't | |||
| 1527 | // have to instrument it. However, if a global does not have initializer | |||
| 1528 | // at all, we assume it has dynamic initializer (in other TU). | |||
| 1529 | // | |||
| 1530 | // FIXME: Metadata should be attched directly to the global directly instead | |||
| 1531 | // of being added to llvm.asan.globals. | |||
| 1532 | return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit; | |||
| 1533 | } | |||
| 1534 | ||||
| 1535 | void AddressSanitizer::instrumentPointerComparisonOrSubtraction( | |||
| 1536 | Instruction *I) { | |||
| 1537 | IRBuilder<> IRB(I); | |||
| 1538 | FunctionCallee F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction; | |||
| 1539 | Value *Param[2] = {I->getOperand(0), I->getOperand(1)}; | |||
| 1540 | for (Value *&i : Param) { | |||
| 1541 | if (i->getType()->isPointerTy()) | |||
| 1542 | i = IRB.CreatePointerCast(i, IntptrTy); | |||
| 1543 | } | |||
| 1544 | IRB.CreateCall(F, Param); | |||
| 1545 | } | |||
| 1546 | ||||
| 1547 | static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I, | |||
| 1548 | Instruction *InsertBefore, Value *Addr, | |||
| 1549 | MaybeAlign Alignment, unsigned Granularity, | |||
| 1550 | uint32_t TypeSize, bool IsWrite, | |||
| 1551 | Value *SizeArgument, bool UseCalls, | |||
| 1552 | uint32_t Exp) { | |||
| 1553 | // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check | |||
| 1554 | // if the data is properly aligned. | |||
| 1555 | if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 || | |||
| 1556 | TypeSize == 128) && | |||
| 1557 | (!Alignment || *Alignment >= Granularity || *Alignment >= TypeSize / 8)) | |||
| 1558 | return Pass->instrumentAddress(I, InsertBefore, Addr, TypeSize, IsWrite, | |||
| 1559 | nullptr, UseCalls, Exp); | |||
| 1560 | Pass->instrumentUnusualSizeOrAlignment(I, InsertBefore, Addr, TypeSize, | |||
| 1561 | IsWrite, nullptr, UseCalls, Exp); | |||
| 1562 | } | |||
| 1563 | ||||
| 1564 | static void instrumentMaskedLoadOrStore(AddressSanitizer *Pass, | |||
| 1565 | const DataLayout &DL, Type *IntptrTy, | |||
| 1566 | Value *Mask, Instruction *I, | |||
| 1567 | Value *Addr, MaybeAlign Alignment, | |||
| 1568 | unsigned Granularity, uint32_t TypeSize, | |||
| 1569 | bool IsWrite, Value *SizeArgument, | |||
| 1570 | bool UseCalls, uint32_t Exp) { | |||
| 1571 | auto *VTy = cast<FixedVectorType>( | |||
| 1572 | cast<PointerType>(Addr->getType())->getElementType()); | |||
| 1573 | uint64_t ElemTypeSize = DL.getTypeStoreSizeInBits(VTy->getScalarType()); | |||
| 1574 | unsigned Num = VTy->getNumElements(); | |||
| 1575 | auto Zero = ConstantInt::get(IntptrTy, 0); | |||
| 1576 | for (unsigned Idx = 0; Idx < Num; ++Idx) { | |||
| 1577 | Value *InstrumentedAddress = nullptr; | |||
| 1578 | Instruction *InsertBefore = I; | |||
| 1579 | if (auto *Vector = dyn_cast<ConstantVector>(Mask)) { | |||
| 1580 | // dyn_cast as we might get UndefValue | |||
| 1581 | if (auto *Masked = dyn_cast<ConstantInt>(Vector->getOperand(Idx))) { | |||
| 1582 | if (Masked->isZero()) | |||
| 1583 | // Mask is constant false, so no instrumentation needed. | |||
| 1584 | continue; | |||
| 1585 | // If we have a true or undef value, fall through to doInstrumentAddress | |||
| 1586 | // with InsertBefore == I | |||
| 1587 | } | |||
| 1588 | } else { | |||
| 1589 | IRBuilder<> IRB(I); | |||
| 1590 | Value *MaskElem = IRB.CreateExtractElement(Mask, Idx); | |||
| 1591 | Instruction *ThenTerm = SplitBlockAndInsertIfThen(MaskElem, I, false); | |||
| 1592 | InsertBefore = ThenTerm; | |||
| 1593 | } | |||
| 1594 | ||||
| 1595 | IRBuilder<> IRB(InsertBefore); | |||
| 1596 | InstrumentedAddress = | |||
| 1597 | IRB.CreateGEP(VTy, Addr, {Zero, ConstantInt::get(IntptrTy, Idx)}); | |||
| 1598 | doInstrumentAddress(Pass, I, InsertBefore, InstrumentedAddress, Alignment, | |||
| 1599 | Granularity, ElemTypeSize, IsWrite, SizeArgument, | |||
| 1600 | UseCalls, Exp); | |||
| 1601 | } | |||
| 1602 | } | |||
| 1603 | ||||
| 1604 | void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, | |||
| 1605 | InterestingMemoryOperand &O, bool UseCalls, | |||
| 1606 | const DataLayout &DL) { | |||
| 1607 | Value *Addr = O.getPtr(); | |||
| 1608 | ||||
| 1609 | // Optimization experiments. | |||
| 1610 | // The experiments can be used to evaluate potential optimizations that remove | |||
| 1611 | // instrumentation (assess false negatives). Instead of completely removing | |||
| 1612 | // some instrumentation, you set Exp to a non-zero value (mask of optimization | |||
| 1613 | // experiments that want to remove instrumentation of this instruction). | |||
| 1614 | // If Exp is non-zero, this pass will emit special calls into runtime | |||
| 1615 | // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls | |||
| 1616 | // make runtime terminate the program in a special way (with a different | |||
| 1617 | // exit status). Then you run the new compiler on a buggy corpus, collect | |||
| 1618 | // the special terminations (ideally, you don't see them at all -- no false | |||
| 1619 | // negatives) and make the decision on the optimization. | |||
| 1620 | uint32_t Exp = ClForceExperiment; | |||
| 1621 | ||||
| 1622 | if (ClOpt && ClOptGlobals) { | |||
| 1623 | // If initialization order checking is disabled, a simple access to a | |||
| 1624 | // dynamically initialized global is always valid. | |||
| 1625 | GlobalVariable *G = dyn_cast<GlobalVariable>(getUnderlyingObject(Addr)); | |||
| 1626 | if (G && (!ClInitializers || GlobalIsLinkerInitialized(G)) && | |||
| 1627 | isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) { | |||
| 1628 | NumOptimizedAccessesToGlobalVar++; | |||
| 1629 | return; | |||
| 1630 | } | |||
| 1631 | } | |||
| 1632 | ||||
| 1633 | if (ClOpt && ClOptStack) { | |||
| 1634 | // A direct inbounds access to a stack variable is always valid. | |||
| 1635 | if (isa<AllocaInst>(getUnderlyingObject(Addr)) && | |||
| 1636 | isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) { | |||
| 1637 | NumOptimizedAccessesToStackVar++; | |||
| 1638 | return; | |||
| 1639 | } | |||
| 1640 | } | |||
| 1641 | ||||
| 1642 | if (O.IsWrite) | |||
| 1643 | NumInstrumentedWrites++; | |||
| 1644 | else | |||
| 1645 | NumInstrumentedReads++; | |||
| 1646 | ||||
| 1647 | unsigned Granularity = 1 << Mapping.Scale; | |||
| 1648 | if (O.MaybeMask) { | |||
| 1649 | instrumentMaskedLoadOrStore(this, DL, IntptrTy, O.MaybeMask, O.getInsn(), | |||
| 1650 | Addr, O.Alignment, Granularity, O.TypeSize, | |||
| 1651 | O.IsWrite, nullptr, UseCalls, Exp); | |||
| 1652 | } else { | |||
| 1653 | doInstrumentAddress(this, O.getInsn(), O.getInsn(), Addr, O.Alignment, | |||
| 1654 | Granularity, O.TypeSize, O.IsWrite, nullptr, UseCalls, | |||
| 1655 | Exp); | |||
| 1656 | } | |||
| 1657 | } | |||
| 1658 | ||||
| 1659 | Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore, | |||
| 1660 | Value *Addr, bool IsWrite, | |||
| 1661 | size_t AccessSizeIndex, | |||
| 1662 | Value *SizeArgument, | |||
| 1663 | uint32_t Exp) { | |||
| 1664 | IRBuilder<> IRB(InsertBefore); | |||
| 1665 | Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp); | |||
| 1666 | CallInst *Call = nullptr; | |||
| 1667 | if (SizeArgument) { | |||
| 1668 | if (Exp == 0) | |||
| 1669 | Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0], | |||
| 1670 | {Addr, SizeArgument}); | |||
| 1671 | else | |||
| 1672 | Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1], | |||
| 1673 | {Addr, SizeArgument, ExpVal}); | |||
| 1674 | } else { | |||
| 1675 | if (Exp == 0) | |||
| 1676 | Call = | |||
| 1677 | IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr); | |||
| 1678 | else | |||
| 1679 | Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex], | |||
| 1680 | {Addr, ExpVal}); | |||
| 1681 | } | |||
| 1682 | ||||
| 1683 | Call->setCannotMerge(); | |||
| 1684 | return Call; | |||
| 1685 | } | |||
| 1686 | ||||
| 1687 | Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, | |||
| 1688 | Value *ShadowValue, | |||
| 1689 | uint32_t TypeSize) { | |||
| 1690 | size_t Granularity = static_cast<size_t>(1) << Mapping.Scale; | |||
| 1691 | // Addr & (Granularity - 1) | |||
| 1692 | Value *LastAccessedByte = | |||
| 1693 | IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); | |||
| 1694 | // (Addr & (Granularity - 1)) + size - 1 | |||
| 1695 | if (TypeSize / 8 > 1) | |||
| 1696 | LastAccessedByte = IRB.CreateAdd( | |||
| 1697 | LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); | |||
| 1698 | // (uint8_t) ((Addr & (Granularity-1)) + size - 1) | |||
| 1699 | LastAccessedByte = | |||
| 1700 | IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false); | |||
| 1701 | // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue | |||
| 1702 | return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); | |||
| 1703 | } | |||
| 1704 | ||||
| 1705 | Instruction *AddressSanitizer::instrumentAMDGPUAddress( | |||
| 1706 | Instruction *OrigIns, Instruction *InsertBefore, Value *Addr, | |||
| 1707 | uint32_t TypeSize, bool IsWrite, Value *SizeArgument) { | |||
| 1708 | // Do not instrument unsupported addrspaces. | |||
| 1709 | if (isUnsupportedAMDGPUAddrspace(Addr)) | |||
| 1710 | return nullptr; | |||
| 1711 | Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType()); | |||
| 1712 | // Follow host instrumentation for global and constant addresses. | |||
| 1713 | if (PtrTy->getPointerAddressSpace() != 0) | |||
| 1714 | return InsertBefore; | |||
| 1715 | // Instrument generic addresses in supported addressspaces. | |||
| 1716 | IRBuilder<> IRB(InsertBefore); | |||
| 1717 | Value *AddrLong = IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy()); | |||
| 1718 | Value *IsShared = IRB.CreateCall(AMDGPUAddressShared, {AddrLong}); | |||
| 1719 | Value *IsPrivate = IRB.CreateCall(AMDGPUAddressPrivate, {AddrLong}); | |||
| 1720 | Value *IsSharedOrPrivate = IRB.CreateOr(IsShared, IsPrivate); | |||
| 1721 | Value *Cmp = IRB.CreateICmpNE(IRB.getTrue(), IsSharedOrPrivate); | |||
| 1722 | Value *AddrSpaceZeroLanding = | |||
| 1723 | SplitBlockAndInsertIfThen(Cmp, InsertBefore, false); | |||
| 1724 | InsertBefore = cast<Instruction>(AddrSpaceZeroLanding); | |||
| 1725 | return InsertBefore; | |||
| 1726 | } | |||
| 1727 | ||||
| 1728 | void AddressSanitizer::instrumentAddress(Instruction *OrigIns, | |||
| 1729 | Instruction *InsertBefore, Value *Addr, | |||
| 1730 | uint32_t TypeSize, bool IsWrite, | |||
| 1731 | Value *SizeArgument, bool UseCalls, | |||
| 1732 | uint32_t Exp) { | |||
| 1733 | if (TargetTriple.isAMDGPU()) { | |||
| 1734 | InsertBefore = instrumentAMDGPUAddress(OrigIns, InsertBefore, Addr, | |||
| 1735 | TypeSize, IsWrite, SizeArgument); | |||
| 1736 | if (!InsertBefore) | |||
| 1737 | return; | |||
| 1738 | } | |||
| 1739 | ||||
| 1740 | IRBuilder<> IRB(InsertBefore); | |||
| 1741 | Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); | |||
| 1742 | size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); | |||
| 1743 | ||||
| 1744 | if (UseCalls) { | |||
| 1745 | if (Exp == 0) | |||
| 1746 | IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex], | |||
| 1747 | AddrLong); | |||
| 1748 | else | |||
| 1749 | IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex], | |||
| 1750 | {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)}); | |||
| 1751 | return; | |||
| 1752 | } | |||
| 1753 | ||||
| 1754 | Type *ShadowTy = | |||
| 1755 | IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale)); | |||
| 1756 | Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); | |||
| 1757 | Value *ShadowPtr = memToShadow(AddrLong, IRB); | |||
| 1758 | Value *CmpVal = Constant::getNullValue(ShadowTy); | |||
| 1759 | Value *ShadowValue = | |||
| 1760 | IRB.CreateLoad(ShadowTy, IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); | |||
| 1761 | ||||
| 1762 | Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); | |||
| 1763 | size_t Granularity = 1ULL << Mapping.Scale; | |||
| 1764 | Instruction *CrashTerm = nullptr; | |||
| 1765 | ||||
| 1766 | if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) { | |||
| 1767 | // We use branch weights for the slow path check, to indicate that the slow | |||
| 1768 | // path is rarely taken. This seems to be the case for SPEC benchmarks. | |||
| 1769 | Instruction *CheckTerm = SplitBlockAndInsertIfThen( | |||
| 1770 | Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000)); | |||
| 1771 | assert(cast<BranchInst>(CheckTerm)->isUnconditional())((void)0); | |||
| 1772 | BasicBlock *NextBB = CheckTerm->getSuccessor(0); | |||
| 1773 | IRB.SetInsertPoint(CheckTerm); | |||
| 1774 | Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); | |||
| 1775 | if (Recover) { | |||
| 1776 | CrashTerm = SplitBlockAndInsertIfThen(Cmp2, CheckTerm, false); | |||
| 1777 | } else { | |||
| 1778 | BasicBlock *CrashBlock = | |||
| 1779 | BasicBlock::Create(*C, "", NextBB->getParent(), NextBB); | |||
| 1780 | CrashTerm = new UnreachableInst(*C, CrashBlock); | |||
| 1781 | BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); | |||
| 1782 | ReplaceInstWithInst(CheckTerm, NewTerm); | |||
| 1783 | } | |||
| 1784 | } else { | |||
| 1785 | CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover); | |||
| 1786 | } | |||
| 1787 | ||||
| 1788 | Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite, | |||
| 1789 | AccessSizeIndex, SizeArgument, Exp); | |||
| 1790 | Crash->setDebugLoc(OrigIns->getDebugLoc()); | |||
| 1791 | } | |||
| 1792 | ||||
| 1793 | // Instrument unusual size or unusual alignment. | |||
| 1794 | // We can not do it with a single check, so we do 1-byte check for the first | |||
| 1795 | // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able | |||
| 1796 | // to report the actual access size. | |||
| 1797 | void AddressSanitizer::instrumentUnusualSizeOrAlignment( | |||
| 1798 | Instruction *I, Instruction *InsertBefore, Value *Addr, uint32_t TypeSize, | |||
| 1799 | bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp) { | |||
| 1800 | IRBuilder<> IRB(InsertBefore); | |||
| 1801 | Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8); | |||
| 1802 | Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); | |||
| 1803 | if (UseCalls) { | |||
| 1804 | if (Exp == 0) | |||
| 1805 | IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0], | |||
| 1806 | {AddrLong, Size}); | |||
| 1807 | else | |||
| 1808 | IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1], | |||
| 1809 | {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)}); | |||
| 1810 | } else { | |||
| 1811 | Value *LastByte = IRB.CreateIntToPtr( | |||
| 1812 | IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)), | |||
| 1813 | Addr->getType()); | |||
| 1814 | instrumentAddress(I, InsertBefore, Addr, 8, IsWrite, Size, false, Exp); | |||
| 1815 | instrumentAddress(I, InsertBefore, LastByte, 8, IsWrite, Size, false, Exp); | |||
| 1816 | } | |||
| 1817 | } | |||
| 1818 | ||||
| 1819 | void ModuleAddressSanitizer::poisonOneInitializer(Function &GlobalInit, | |||
| 1820 | GlobalValue *ModuleName) { | |||
| 1821 | // Set up the arguments to our poison/unpoison functions. | |||
| 1822 | IRBuilder<> IRB(&GlobalInit.front(), | |||
| 1823 | GlobalInit.front().getFirstInsertionPt()); | |||
| 1824 | ||||
| 1825 | // Add a call to poison all external globals before the given function starts. | |||
| 1826 | Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy); | |||
| 1827 | IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr); | |||
| 1828 | ||||
| 1829 | // Add calls to unpoison all globals before each return instruction. | |||
| 1830 | for (auto &BB : GlobalInit.getBasicBlockList()) | |||
| 1831 | if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator())) | |||
| 1832 | CallInst::Create(AsanUnpoisonGlobals, "", RI); | |||
| 1833 | } | |||
| 1834 | ||||
| 1835 | void ModuleAddressSanitizer::createInitializerPoisonCalls( | |||
| 1836 | Module &M, GlobalValue *ModuleName) { | |||
| 1837 | GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors"); | |||
| 1838 | if (!GV) | |||
| 1839 | return; | |||
| 1840 | ||||
| 1841 | ConstantArray *CA = dyn_cast<ConstantArray>(GV->getInitializer()); | |||
| 1842 | if (!CA) | |||
| 1843 | return; | |||
| 1844 | ||||
| 1845 | for (Use &OP : CA->operands()) { | |||
| 1846 | if (isa<ConstantAggregateZero>(OP)) continue; | |||
| 1847 | ConstantStruct *CS = cast<ConstantStruct>(OP); | |||
| 1848 | ||||
| 1849 | // Must have a function or null ptr. | |||
| 1850 | if (Function *F = dyn_cast<Function>(CS->getOperand(1))) { | |||
| 1851 | if (F->getName() == kAsanModuleCtorName) continue; | |||
| 1852 | auto *Priority = cast<ConstantInt>(CS->getOperand(0)); | |||
| 1853 | // Don't instrument CTORs that will run before asan.module_ctor. | |||
| 1854 | if (Priority->getLimitedValue() <= GetCtorAndDtorPriority(TargetTriple)) | |||
| 1855 | continue; | |||
| 1856 | poisonOneInitializer(*F, ModuleName); | |||
| 1857 | } | |||
| 1858 | } | |||
| 1859 | } | |||
| 1860 | ||||
| 1861 | const GlobalVariable * | |||
| 1862 | ModuleAddressSanitizer::getExcludedAliasedGlobal(const GlobalAlias &GA) const { | |||
| 1863 | // In case this function should be expanded to include rules that do not just | |||
| 1864 | // apply when CompileKernel is true, either guard all existing rules with an | |||
| 1865 | // 'if (CompileKernel) { ... }' or be absolutely sure that all these rules | |||
| 1866 | // should also apply to user space. | |||
| 1867 | assert(CompileKernel && "Only expecting to be called when compiling kernel")((void)0); | |||
| 1868 | ||||
| 1869 | const Constant *C = GA.getAliasee(); | |||
| 1870 | ||||
| 1871 | // When compiling the kernel, globals that are aliased by symbols prefixed | |||
| 1872 | // by "__" are special and cannot be padded with a redzone. | |||
| 1873 | if (GA.getName().startswith("__")) | |||
| 1874 | return dyn_cast<GlobalVariable>(C->stripPointerCastsAndAliases()); | |||
| 1875 | ||||
| 1876 | return nullptr; | |||
| 1877 | } | |||
| 1878 | ||||
| 1879 | bool ModuleAddressSanitizer::shouldInstrumentGlobal(GlobalVariable *G) const { | |||
| 1880 | Type *Ty = G->getValueType(); | |||
| 1881 | LLVM_DEBUG(dbgs() << "GLOBAL: " << *G << "\n")do { } while (false); | |||
| 1882 | ||||
| 1883 | // FIXME: Metadata should be attched directly to the global directly instead | |||
| 1884 | // of being added to llvm.asan.globals. | |||
| 1885 | if (GlobalsMD.get(G).IsExcluded) return false; | |||
| 1886 | if (!Ty->isSized()) return false; | |||
| 1887 | if (!G->hasInitializer()) return false; | |||
| 1888 | // Globals in address space 1 and 4 are supported for AMDGPU. | |||
| 1889 | if (G->getAddressSpace() && | |||
| 1890 | !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(G))) | |||
| 1891 | return false; | |||
| 1892 | if (GlobalWasGeneratedByCompiler(G)) return false; // Our own globals. | |||
| 1893 | // Two problems with thread-locals: | |||
| 1894 | // - The address of the main thread's copy can't be computed at link-time. | |||
| 1895 | // - Need to poison all copies, not just the main thread's one. | |||
| 1896 | if (G->isThreadLocal()) return false; | |||
| 1897 | // For now, just ignore this Global if the alignment is large. | |||
| 1898 | if (G->getAlignment() > getMinRedzoneSizeForGlobal()) return false; | |||
| 1899 | ||||
| 1900 | // For non-COFF targets, only instrument globals known to be defined by this | |||
| 1901 | // TU. | |||
| 1902 | // FIXME: We can instrument comdat globals on ELF if we are using the | |||
| 1903 | // GC-friendly metadata scheme. | |||
| 1904 | if (!TargetTriple.isOSBinFormatCOFF()) { | |||
| 1905 | if (!G->hasExactDefinition() || G->hasComdat()) | |||
| 1906 | return false; | |||
| 1907 | } else { | |||
| 1908 | // On COFF, don't instrument non-ODR linkages. | |||
| 1909 | if (G->isInterposable()) | |||
| 1910 | return false; | |||
| 1911 | } | |||
| 1912 | ||||
| 1913 | // If a comdat is present, it must have a selection kind that implies ODR | |||
| 1914 | // semantics: no duplicates, any, or exact match. | |||
| 1915 | if (Comdat *C = G->getComdat()) { | |||
| 1916 | switch (C->getSelectionKind()) { | |||
| 1917 | case Comdat::Any: | |||
| 1918 | case Comdat::ExactMatch: | |||
| 1919 | case Comdat::NoDeduplicate: | |||
| 1920 | break; | |||
| 1921 | case Comdat::Largest: | |||
| 1922 | case Comdat::SameSize: | |||
| 1923 | return false; | |||
| 1924 | } | |||
| 1925 | } | |||
| 1926 | ||||
| 1927 | if (G->hasSection()) { | |||
| 1928 | // The kernel uses explicit sections for mostly special global variables | |||
| 1929 | // that we should not instrument. E.g. the kernel may rely on their layout | |||
| 1930 | // without redzones, or remove them at link time ("discard.*"), etc. | |||
| 1931 | if (CompileKernel) | |||
| 1932 | return false; | |||
| 1933 | ||||
| 1934 | StringRef Section = G->getSection(); | |||
| 1935 | ||||
| 1936 | // Globals from llvm.metadata aren't emitted, do not instrument them. | |||
| 1937 | if (Section == "llvm.metadata") return false; | |||
| 1938 | // Do not instrument globals from special LLVM sections. | |||
| 1939 | if (Section.find("__llvm") != StringRef::npos || Section.find("__LLVM") != StringRef::npos) return false; | |||
| 1940 | ||||
| 1941 | // Do not instrument function pointers to initialization and termination | |||
| 1942 | // routines: dynamic linker will not properly handle redzones. | |||
| 1943 | if (Section.startswith(".preinit_array") || | |||
| 1944 | Section.startswith(".init_array") || | |||
| 1945 | Section.startswith(".fini_array")) { | |||
| 1946 | return false; | |||
| 1947 | } | |||
| 1948 | ||||
| 1949 | // Do not instrument user-defined sections (with names resembling | |||
| 1950 | // valid C identifiers) | |||
| 1951 | if (TargetTriple.isOSBinFormatELF()) { | |||
| 1952 | if (llvm::all_of(Section, | |||
| 1953 | [](char c) { return llvm::isAlnum(c) || c == '_'; })) | |||
| 1954 | return false; | |||
| 1955 | } | |||
| 1956 | ||||
| 1957 | // On COFF, if the section name contains '$', it is highly likely that the | |||
| 1958 | // user is using section sorting to create an array of globals similar to | |||
| 1959 | // the way initialization callbacks are registered in .init_array and | |||
| 1960 | // .CRT$XCU. The ATL also registers things in .ATL$__[azm]. Adding redzones | |||
| 1961 | // to such globals is counterproductive, because the intent is that they | |||
| 1962 | // will form an array, and out-of-bounds accesses are expected. | |||
| 1963 | // See https://github.com/google/sanitizers/issues/305 | |||
| 1964 | // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx | |||
| 1965 | if (TargetTriple.isOSBinFormatCOFF() && Section.contains('$')) { | |||
| 1966 | LLVM_DEBUG(dbgs() << "Ignoring global in sorted section (contains '$'): "do { } while (false) | |||
| 1967 | << *G << "\n")do { } while (false); | |||
| 1968 | return false; | |||
| 1969 | } | |||
| 1970 | ||||
| 1971 | if (TargetTriple.isOSBinFormatMachO()) { | |||
| 1972 | StringRef ParsedSegment, ParsedSection; | |||
| 1973 | unsigned TAA = 0, StubSize = 0; | |||
| 1974 | bool TAAParsed; | |||
| 1975 | cantFail(MCSectionMachO::ParseSectionSpecifier( | |||
| 1976 | Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize)); | |||
| 1977 | ||||
| 1978 | // Ignore the globals from the __OBJC section. The ObjC runtime assumes | |||
| 1979 | // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to | |||
| 1980 | // them. | |||
| 1981 | if (ParsedSegment == "__OBJC" || | |||
| 1982 | (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) { | |||
| 1983 | LLVM_DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n")do { } while (false); | |||
| 1984 | return false; | |||
| 1985 | } | |||
| 1986 | // See https://github.com/google/sanitizers/issues/32 | |||
| 1987 | // Constant CFString instances are compiled in the following way: | |||
| 1988 | // -- the string buffer is emitted into | |||
| 1989 | // __TEXT,__cstring,cstring_literals | |||
| 1990 | // -- the constant NSConstantString structure referencing that buffer | |||
| 1991 | // is placed into __DATA,__cfstring | |||
| 1992 | // Therefore there's no point in placing redzones into __DATA,__cfstring. | |||
| 1993 | // Moreover, it causes the linker to crash on OS X 10.7 | |||
| 1994 | if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") { | |||
| 1995 | LLVM_DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n")do { } while (false); | |||
| 1996 | return false; | |||
| 1997 | } | |||
| 1998 | // The linker merges the contents of cstring_literals and removes the | |||
| 1999 | // trailing zeroes. | |||
| 2000 | if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) { | |||
| 2001 | LLVM_DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n")do { } while (false); | |||
| 2002 | return false; | |||
| 2003 | } | |||
| 2004 | } | |||
| 2005 | } | |||
| 2006 | ||||
| 2007 | if (CompileKernel) { | |||
| 2008 | // Globals that prefixed by "__" are special and cannot be padded with a | |||
| 2009 | // redzone. | |||
| 2010 | if (G->getName().startswith("__")) | |||
| 2011 | return false; | |||
| 2012 | } | |||
| 2013 | ||||
| 2014 | return true; | |||
| 2015 | } | |||
| 2016 | ||||
| 2017 | // On Mach-O platforms, we emit global metadata in a separate section of the | |||
| 2018 | // binary in order to allow the linker to properly dead strip. This is only | |||
| 2019 | // supported on recent versions of ld64. | |||
| 2020 | bool ModuleAddressSanitizer::ShouldUseMachOGlobalsSection() const { | |||
| 2021 | if (!TargetTriple.isOSBinFormatMachO()) | |||
| 2022 | return false; | |||
| 2023 | ||||
| 2024 | if (TargetTriple.isMacOSX() && !TargetTriple.isMacOSXVersionLT(10, 11)) | |||
| 2025 | return true; | |||
| 2026 | if (TargetTriple.isiOS() /* or tvOS */ && !TargetTriple.isOSVersionLT(9)) | |||
| 2027 | return true; | |||
| 2028 | if (TargetTriple.isWatchOS() && !TargetTriple.isOSVersionLT(2)) | |||
| 2029 | return true; | |||
| 2030 | ||||
| 2031 | return false; | |||
| 2032 | } | |||
| 2033 | ||||
| 2034 | StringRef ModuleAddressSanitizer::getGlobalMetadataSection() const { | |||
| 2035 | switch (TargetTriple.getObjectFormat()) { | |||
| 2036 | case Triple::COFF: return ".ASAN$GL"; | |||
| 2037 | case Triple::ELF: return "asan_globals"; | |||
| 2038 | case Triple::MachO: return "__DATA,__asan_globals,regular"; | |||
| 2039 | case Triple::Wasm: | |||
| 2040 | case Triple::GOFF: | |||
| 2041 | case Triple::XCOFF: | |||
| 2042 | report_fatal_error( | |||
| 2043 | "ModuleAddressSanitizer not implemented for object file format"); | |||
| 2044 | case Triple::UnknownObjectFormat: | |||
| 2045 | break; | |||
| 2046 | } | |||
| 2047 | llvm_unreachable("unsupported object format")__builtin_unreachable(); | |||
| 2048 | } | |||
| 2049 | ||||
| 2050 | void ModuleAddressSanitizer::initializeCallbacks(Module &M) { | |||
| 2051 | IRBuilder<> IRB(*C); | |||
| 2052 | ||||
| 2053 | // Declare our poisoning and unpoisoning functions. | |||
| 2054 | AsanPoisonGlobals = | |||
| 2055 | M.getOrInsertFunction(kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy); | |||
| 2056 | AsanUnpoisonGlobals = | |||
| 2057 | M.getOrInsertFunction(kAsanUnpoisonGlobalsName, IRB.getVoidTy()); | |||
| 2058 | ||||
| 2059 | // Declare functions that register/unregister globals. | |||
| 2060 | AsanRegisterGlobals = M.getOrInsertFunction( | |||
| 2061 | kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2062 | AsanUnregisterGlobals = M.getOrInsertFunction( | |||
| 2063 | kAsanUnregisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2064 | ||||
| 2065 | // Declare the functions that find globals in a shared object and then invoke | |||
| 2066 | // the (un)register function on them. | |||
| 2067 | AsanRegisterImageGlobals = M.getOrInsertFunction( | |||
| 2068 | kAsanRegisterImageGlobalsName, IRB.getVoidTy(), IntptrTy); | |||
| 2069 | AsanUnregisterImageGlobals = M.getOrInsertFunction( | |||
| 2070 | kAsanUnregisterImageGlobalsName, IRB.getVoidTy(), IntptrTy); | |||
| 2071 | ||||
| 2072 | AsanRegisterElfGlobals = | |||
| 2073 | M.getOrInsertFunction(kAsanRegisterElfGlobalsName, IRB.getVoidTy(), | |||
| 2074 | IntptrTy, IntptrTy, IntptrTy); | |||
| 2075 | AsanUnregisterElfGlobals = | |||
| 2076 | M.getOrInsertFunction(kAsanUnregisterElfGlobalsName, IRB.getVoidTy(), | |||
| 2077 | IntptrTy, IntptrTy, IntptrTy); | |||
| 2078 | } | |||
| 2079 | ||||
| 2080 | // Put the metadata and the instrumented global in the same group. This ensures | |||
| 2081 | // that the metadata is discarded if the instrumented global is discarded. | |||
| 2082 | void ModuleAddressSanitizer::SetComdatForGlobalMetadata( | |||
| 2083 | GlobalVariable *G, GlobalVariable *Metadata, StringRef InternalSuffix) { | |||
| 2084 | Module &M = *G->getParent(); | |||
| 2085 | Comdat *C = G->getComdat(); | |||
| 2086 | if (!C) { | |||
| 2087 | if (!G->hasName()) { | |||
| 2088 | // If G is unnamed, it must be internal. Give it an artificial name | |||
| 2089 | // so we can put it in a comdat. | |||
| 2090 | assert(G->hasLocalLinkage())((void)0); | |||
| 2091 | G->setName(Twine(kAsanGenPrefix) + "_anon_global"); | |||
| 2092 | } | |||
| 2093 | ||||
| 2094 | if (!InternalSuffix.empty() && G->hasLocalLinkage()) { | |||
| 2095 | std::string Name = std::string(G->getName()); | |||
| 2096 | Name += InternalSuffix; | |||
| 2097 | C = M.getOrInsertComdat(Name); | |||
| 2098 | } else { | |||
| 2099 | C = M.getOrInsertComdat(G->getName()); | |||
| 2100 | } | |||
| 2101 | ||||
| 2102 | // Make this IMAGE_COMDAT_SELECT_NODUPLICATES on COFF. Also upgrade private | |||
| 2103 | // linkage to internal linkage so that a symbol table entry is emitted. This | |||
| 2104 | // is necessary in order to create the comdat group. | |||
| 2105 | if (TargetTriple.isOSBinFormatCOFF()) { | |||
| 2106 | C->setSelectionKind(Comdat::NoDeduplicate); | |||
| 2107 | if (G->hasPrivateLinkage()) | |||
| 2108 | G->setLinkage(GlobalValue::InternalLinkage); | |||
| 2109 | } | |||
| 2110 | G->setComdat(C); | |||
| 2111 | } | |||
| 2112 | ||||
| 2113 | assert(G->hasComdat())((void)0); | |||
| 2114 | Metadata->setComdat(G->getComdat()); | |||
| 2115 | } | |||
| 2116 | ||||
| 2117 | // Create a separate metadata global and put it in the appropriate ASan | |||
| 2118 | // global registration section. | |||
| 2119 | GlobalVariable * | |||
| 2120 | ModuleAddressSanitizer::CreateMetadataGlobal(Module &M, Constant *Initializer, | |||
| 2121 | StringRef OriginalName) { | |||
| 2122 | auto Linkage = TargetTriple.isOSBinFormatMachO() | |||
| 2123 | ? GlobalVariable::InternalLinkage | |||
| 2124 | : GlobalVariable::PrivateLinkage; | |||
| 2125 | GlobalVariable *Metadata = new GlobalVariable( | |||
| 2126 | M, Initializer->getType(), false, Linkage, Initializer, | |||
| 2127 | Twine("__asan_global_") + GlobalValue::dropLLVMManglingEscape(OriginalName)); | |||
| 2128 | Metadata->setSection(getGlobalMetadataSection()); | |||
| 2129 | return Metadata; | |||
| 2130 | } | |||
| 2131 | ||||
| 2132 | Instruction *ModuleAddressSanitizer::CreateAsanModuleDtor(Module &M) { | |||
| 2133 | AsanDtorFunction = Function::createWithDefaultAttr( | |||
| 2134 | FunctionType::get(Type::getVoidTy(*C), false), | |||
| 2135 | GlobalValue::InternalLinkage, 0, kAsanModuleDtorName, &M); | |||
| 2136 | AsanDtorFunction->addAttribute(AttributeList::FunctionIndex, | |||
| 2137 | Attribute::NoUnwind); | |||
| 2138 | // Ensure Dtor cannot be discarded, even if in a comdat. | |||
| 2139 | appendToUsed(M, {AsanDtorFunction}); | |||
| 2140 | BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); | |||
| 2141 | ||||
| 2142 | return ReturnInst::Create(*C, AsanDtorBB); | |||
| 2143 | } | |||
| 2144 | ||||
| 2145 | void ModuleAddressSanitizer::InstrumentGlobalsCOFF( | |||
| 2146 | IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
| 2147 | ArrayRef<Constant *> MetadataInitializers) { | |||
| 2148 | assert(ExtendedGlobals.size() == MetadataInitializers.size())((void)0); | |||
| 2149 | auto &DL = M.getDataLayout(); | |||
| 2150 | ||||
| 2151 | SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size()); | |||
| 2152 | for (size_t i = 0; i < ExtendedGlobals.size(); i++) { | |||
| 2153 | Constant *Initializer = MetadataInitializers[i]; | |||
| 2154 | GlobalVariable *G = ExtendedGlobals[i]; | |||
| 2155 | GlobalVariable *Metadata = | |||
| 2156 | CreateMetadataGlobal(M, Initializer, G->getName()); | |||
| 2157 | MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G)); | |||
| 2158 | Metadata->setMetadata(LLVMContext::MD_associated, MD); | |||
| 2159 | MetadataGlobals[i] = Metadata; | |||
| 2160 | ||||
| 2161 | // The MSVC linker always inserts padding when linking incrementally. We | |||
| 2162 | // cope with that by aligning each struct to its size, which must be a power | |||
| 2163 | // of two. | |||
| 2164 | unsigned SizeOfGlobalStruct = DL.getTypeAllocSize(Initializer->getType()); | |||
| 2165 | assert(isPowerOf2_32(SizeOfGlobalStruct) &&((void)0) | |||
| 2166 | "global metadata will not be padded appropriately")((void)0); | |||
| 2167 | Metadata->setAlignment(assumeAligned(SizeOfGlobalStruct)); | |||
| 2168 | ||||
| 2169 | SetComdatForGlobalMetadata(G, Metadata, ""); | |||
| 2170 | } | |||
| 2171 | ||||
| 2172 | // Update llvm.compiler.used, adding the new metadata globals. This is | |||
| 2173 | // needed so that during LTO these variables stay alive. | |||
| 2174 | if (!MetadataGlobals.empty()) | |||
| 2175 | appendToCompilerUsed(M, MetadataGlobals); | |||
| 2176 | } | |||
| 2177 | ||||
| 2178 | void ModuleAddressSanitizer::InstrumentGlobalsELF( | |||
| 2179 | IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
| 2180 | ArrayRef<Constant *> MetadataInitializers, | |||
| 2181 | const std::string &UniqueModuleId) { | |||
| 2182 | assert(ExtendedGlobals.size() == MetadataInitializers.size())((void)0); | |||
| 2183 | ||||
| 2184 | // Putting globals in a comdat changes the semantic and potentially cause | |||
| 2185 | // false negative odr violations at link time. If odr indicators are used, we | |||
| 2186 | // keep the comdat sections, as link time odr violations will be dectected on | |||
| 2187 | // the odr indicator symbols. | |||
| 2188 | bool UseComdatForGlobalsGC = UseOdrIndicator; | |||
| 2189 | ||||
| 2190 | SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size()); | |||
| 2191 | for (size_t i = 0; i < ExtendedGlobals.size(); i++) { | |||
| 2192 | GlobalVariable *G = ExtendedGlobals[i]; | |||
| 2193 | GlobalVariable *Metadata = | |||
| 2194 | CreateMetadataGlobal(M, MetadataInitializers[i], G->getName()); | |||
| 2195 | MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G)); | |||
| 2196 | Metadata->setMetadata(LLVMContext::MD_associated, MD); | |||
| 2197 | MetadataGlobals[i] = Metadata; | |||
| 2198 | ||||
| 2199 | if (UseComdatForGlobalsGC) | |||
| 2200 | SetComdatForGlobalMetadata(G, Metadata, UniqueModuleId); | |||
| 2201 | } | |||
| 2202 | ||||
| 2203 | // Update llvm.compiler.used, adding the new metadata globals. This is | |||
| 2204 | // needed so that during LTO these variables stay alive. | |||
| 2205 | if (!MetadataGlobals.empty()) | |||
| 2206 | appendToCompilerUsed(M, MetadataGlobals); | |||
| 2207 | ||||
| 2208 | // RegisteredFlag serves two purposes. First, we can pass it to dladdr() | |||
| 2209 | // to look up the loaded image that contains it. Second, we can store in it | |||
| 2210 | // whether registration has already occurred, to prevent duplicate | |||
| 2211 | // registration. | |||
| 2212 | // | |||
| 2213 | // Common linkage ensures that there is only one global per shared library. | |||
| 2214 | GlobalVariable *RegisteredFlag = new GlobalVariable( | |||
| 2215 | M, IntptrTy, false, GlobalVariable::CommonLinkage, | |||
| 2216 | ConstantInt::get(IntptrTy, 0), kAsanGlobalsRegisteredFlagName); | |||
| 2217 | RegisteredFlag->setVisibility(GlobalVariable::HiddenVisibility); | |||
| 2218 | ||||
| 2219 | // Create start and stop symbols. | |||
| 2220 | GlobalVariable *StartELFMetadata = new GlobalVariable( | |||
| 2221 | M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr, | |||
| 2222 | "__start_" + getGlobalMetadataSection()); | |||
| 2223 | StartELFMetadata->setVisibility(GlobalVariable::HiddenVisibility); | |||
| 2224 | GlobalVariable *StopELFMetadata = new GlobalVariable( | |||
| 2225 | M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr, | |||
| 2226 | "__stop_" + getGlobalMetadataSection()); | |||
| 2227 | StopELFMetadata->setVisibility(GlobalVariable::HiddenVisibility); | |||
| 2228 | ||||
| 2229 | // Create a call to register the globals with the runtime. | |||
| 2230 | IRB.CreateCall(AsanRegisterElfGlobals, | |||
| 2231 | {IRB.CreatePointerCast(RegisteredFlag, IntptrTy), | |||
| 2232 | IRB.CreatePointerCast(StartELFMetadata, IntptrTy), | |||
| 2233 | IRB.CreatePointerCast(StopELFMetadata, IntptrTy)}); | |||
| 2234 | ||||
| 2235 | // We also need to unregister globals at the end, e.g., when a shared library | |||
| 2236 | // gets closed. | |||
| 2237 | if (DestructorKind != AsanDtorKind::None) { | |||
| 2238 | IRBuilder<> IrbDtor(CreateAsanModuleDtor(M)); | |||
| 2239 | IrbDtor.CreateCall(AsanUnregisterElfGlobals, | |||
| 2240 | {IRB.CreatePointerCast(RegisteredFlag, IntptrTy), | |||
| 2241 | IRB.CreatePointerCast(StartELFMetadata, IntptrTy), | |||
| 2242 | IRB.CreatePointerCast(StopELFMetadata, IntptrTy)}); | |||
| 2243 | } | |||
| 2244 | } | |||
| 2245 | ||||
| 2246 | void ModuleAddressSanitizer::InstrumentGlobalsMachO( | |||
| 2247 | IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
| 2248 | ArrayRef<Constant *> MetadataInitializers) { | |||
| 2249 | assert(ExtendedGlobals.size() == MetadataInitializers.size())((void)0); | |||
| 2250 | ||||
| 2251 | // On recent Mach-O platforms, use a structure which binds the liveness of | |||
| 2252 | // the global variable to the metadata struct. Keep the list of "Liveness" GV | |||
| 2253 | // created to be added to llvm.compiler.used | |||
| 2254 | StructType *LivenessTy = StructType::get(IntptrTy, IntptrTy); | |||
| 2255 | SmallVector<GlobalValue *, 16> LivenessGlobals(ExtendedGlobals.size()); | |||
| 2256 | ||||
| 2257 | for (size_t i = 0; i < ExtendedGlobals.size(); i++) { | |||
| 2258 | Constant *Initializer = MetadataInitializers[i]; | |||
| 2259 | GlobalVariable *G = ExtendedGlobals[i]; | |||
| 2260 | GlobalVariable *Metadata = | |||
| 2261 | CreateMetadataGlobal(M, Initializer, G->getName()); | |||
| 2262 | ||||
| 2263 | // On recent Mach-O platforms, we emit the global metadata in a way that | |||
| 2264 | // allows the linker to properly strip dead globals. | |||
| 2265 | auto LivenessBinder = | |||
| 2266 | ConstantStruct::get(LivenessTy, Initializer->getAggregateElement(0u), | |||
| 2267 | ConstantExpr::getPointerCast(Metadata, IntptrTy)); | |||
| 2268 | GlobalVariable *Liveness = new GlobalVariable( | |||
| 2269 | M, LivenessTy, false, GlobalVariable::InternalLinkage, LivenessBinder, | |||
| 2270 | Twine("__asan_binder_") + G->getName()); | |||
| 2271 | Liveness->setSection("__DATA,__asan_liveness,regular,live_support"); | |||
| 2272 | LivenessGlobals[i] = Liveness; | |||
| 2273 | } | |||
| 2274 | ||||
| 2275 | // Update llvm.compiler.used, adding the new liveness globals. This is | |||
| 2276 | // needed so that during LTO these variables stay alive. The alternative | |||
| 2277 | // would be to have the linker handling the LTO symbols, but libLTO | |||
| 2278 | // current API does not expose access to the section for each symbol. | |||
| 2279 | if (!LivenessGlobals.empty()) | |||
| 2280 | appendToCompilerUsed(M, LivenessGlobals); | |||
| 2281 | ||||
| 2282 | // RegisteredFlag serves two purposes. First, we can pass it to dladdr() | |||
| 2283 | // to look up the loaded image that contains it. Second, we can store in it | |||
| 2284 | // whether registration has already occurred, to prevent duplicate | |||
| 2285 | // registration. | |||
| 2286 | // | |||
| 2287 | // common linkage ensures that there is only one global per shared library. | |||
| 2288 | GlobalVariable *RegisteredFlag = new GlobalVariable( | |||
| 2289 | M, IntptrTy, false, GlobalVariable::CommonLinkage, | |||
| 2290 | ConstantInt::get(IntptrTy, 0), kAsanGlobalsRegisteredFlagName); | |||
| 2291 | RegisteredFlag->setVisibility(GlobalVariable::HiddenVisibility); | |||
| 2292 | ||||
| 2293 | IRB.CreateCall(AsanRegisterImageGlobals, | |||
| 2294 | {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)}); | |||
| 2295 | ||||
| 2296 | // We also need to unregister globals at the end, e.g., when a shared library | |||
| 2297 | // gets closed. | |||
| 2298 | if (DestructorKind != AsanDtorKind::None) { | |||
| 2299 | IRBuilder<> IrbDtor(CreateAsanModuleDtor(M)); | |||
| 2300 | IrbDtor.CreateCall(AsanUnregisterImageGlobals, | |||
| 2301 | {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)}); | |||
| 2302 | } | |||
| 2303 | } | |||
| 2304 | ||||
| 2305 | void ModuleAddressSanitizer::InstrumentGlobalsWithMetadataArray( | |||
| 2306 | IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
| 2307 | ArrayRef<Constant *> MetadataInitializers) { | |||
| 2308 | assert(ExtendedGlobals.size() == MetadataInitializers.size())((void)0); | |||
| 2309 | unsigned N = ExtendedGlobals.size(); | |||
| 2310 | assert(N > 0)((void)0); | |||
| 2311 | ||||
| 2312 | // On platforms that don't have a custom metadata section, we emit an array | |||
| 2313 | // of global metadata structures. | |||
| 2314 | ArrayType *ArrayOfGlobalStructTy = | |||
| 2315 | ArrayType::get(MetadataInitializers[0]->getType(), N); | |||
| 2316 | auto AllGlobals = new GlobalVariable( | |||
| 2317 | M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage, | |||
| 2318 | ConstantArray::get(ArrayOfGlobalStructTy, MetadataInitializers), ""); | |||
| 2319 | if (Mapping.Scale > 3) | |||
| 2320 | AllGlobals->setAlignment(Align(1ULL << Mapping.Scale)); | |||
| 2321 | ||||
| 2322 | IRB.CreateCall(AsanRegisterGlobals, | |||
| 2323 | {IRB.CreatePointerCast(AllGlobals, IntptrTy), | |||
| 2324 | ConstantInt::get(IntptrTy, N)}); | |||
| 2325 | ||||
| 2326 | // We also need to unregister globals at the end, e.g., when a shared library | |||
| 2327 | // gets closed. | |||
| 2328 | if (DestructorKind != AsanDtorKind::None) { | |||
| 2329 | IRBuilder<> IrbDtor(CreateAsanModuleDtor(M)); | |||
| 2330 | IrbDtor.CreateCall(AsanUnregisterGlobals, | |||
| 2331 | {IRB.CreatePointerCast(AllGlobals, IntptrTy), | |||
| 2332 | ConstantInt::get(IntptrTy, N)}); | |||
| 2333 | } | |||
| 2334 | } | |||
| 2335 | ||||
| 2336 | // This function replaces all global variables with new variables that have | |||
| 2337 | // trailing redzones. It also creates a function that poisons | |||
| 2338 | // redzones and inserts this function into llvm.global_ctors. | |||
| 2339 | // Sets *CtorComdat to true if the global registration code emitted into the | |||
| 2340 | // asan constructor is comdat-compatible. | |||
| 2341 | bool ModuleAddressSanitizer::InstrumentGlobals(IRBuilder<> &IRB, Module &M, | |||
| 2342 | bool *CtorComdat) { | |||
| 2343 | *CtorComdat = false; | |||
| 2344 | ||||
| 2345 | // Build set of globals that are aliased by some GA, where | |||
| 2346 | // getExcludedAliasedGlobal(GA) returns the relevant GlobalVariable. | |||
| 2347 | SmallPtrSet<const GlobalVariable *, 16> AliasedGlobalExclusions; | |||
| 2348 | if (CompileKernel) { | |||
| 2349 | for (auto &GA : M.aliases()) { | |||
| 2350 | if (const GlobalVariable *GV = getExcludedAliasedGlobal(GA)) | |||
| 2351 | AliasedGlobalExclusions.insert(GV); | |||
| 2352 | } | |||
| 2353 | } | |||
| 2354 | ||||
| 2355 | SmallVector<GlobalVariable *, 16> GlobalsToChange; | |||
| 2356 | for (auto &G : M.globals()) { | |||
| 2357 | if (!AliasedGlobalExclusions.count(&G) && shouldInstrumentGlobal(&G)) | |||
| 2358 | GlobalsToChange.push_back(&G); | |||
| 2359 | } | |||
| 2360 | ||||
| 2361 | size_t n = GlobalsToChange.size(); | |||
| 2362 | if (n == 0) { | |||
| 2363 | *CtorComdat = true; | |||
| 2364 | return false; | |||
| 2365 | } | |||
| 2366 | ||||
| 2367 | auto &DL = M.getDataLayout(); | |||
| 2368 | ||||
| 2369 | // A global is described by a structure | |||
| 2370 | // size_t beg; | |||
| 2371 | // size_t size; | |||
| 2372 | // size_t size_with_redzone; | |||
| 2373 | // const char *name; | |||
| 2374 | // const char *module_name; | |||
| 2375 | // size_t has_dynamic_init; | |||
| 2376 | // void *source_location; | |||
| 2377 | // size_t odr_indicator; | |||
| 2378 | // We initialize an array of such structures and pass it to a run-time call. | |||
| 2379 | StructType *GlobalStructTy = | |||
| 2380 | StructType::get(IntptrTy, IntptrTy, IntptrTy, IntptrTy, IntptrTy, | |||
| 2381 | IntptrTy, IntptrTy, IntptrTy); | |||
| 2382 | SmallVector<GlobalVariable *, 16> NewGlobals(n); | |||
| 2383 | SmallVector<Constant *, 16> Initializers(n); | |||
| 2384 | ||||
| 2385 | bool HasDynamicallyInitializedGlobals = false; | |||
| 2386 | ||||
| 2387 | // We shouldn't merge same module names, as this string serves as unique | |||
| 2388 | // module ID in runtime. | |||
| 2389 | GlobalVariable *ModuleName = createPrivateGlobalForString( | |||
| 2390 | M, M.getModuleIdentifier(), /*AllowMerging*/ false, kAsanGenPrefix); | |||
| 2391 | ||||
| 2392 | for (size_t i = 0; i < n; i++) { | |||
| 2393 | GlobalVariable *G = GlobalsToChange[i]; | |||
| 2394 | ||||
| 2395 | // FIXME: Metadata should be attched directly to the global directly instead | |||
| 2396 | // of being added to llvm.asan.globals. | |||
| 2397 | auto MD = GlobalsMD.get(G); | |||
| 2398 | StringRef NameForGlobal = G->getName(); | |||
| 2399 | // Create string holding the global name (use global name from metadata | |||
| 2400 | // if it's available, otherwise just write the name of global variable). | |||
| 2401 | GlobalVariable *Name = createPrivateGlobalForString( | |||
| 2402 | M, MD.Name.empty() ? NameForGlobal : MD.Name, | |||
| 2403 | /*AllowMerging*/ true, kAsanGenPrefix); | |||
| 2404 | ||||
| 2405 | Type *Ty = G->getValueType(); | |||
| 2406 | const uint64_t SizeInBytes = DL.getTypeAllocSize(Ty); | |||
| 2407 | const uint64_t RightRedzoneSize = getRedzoneSizeForGlobal(SizeInBytes); | |||
| 2408 | Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); | |||
| 2409 | ||||
| 2410 | StructType *NewTy = StructType::get(Ty, RightRedZoneTy); | |||
| 2411 | Constant *NewInitializer = ConstantStruct::get( | |||
| 2412 | NewTy, G->getInitializer(), Constant::getNullValue(RightRedZoneTy)); | |||
| 2413 | ||||
| 2414 | // Create a new global variable with enough space for a redzone. | |||
| 2415 | GlobalValue::LinkageTypes Linkage = G->getLinkage(); | |||
| 2416 | if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage) | |||
| 2417 | Linkage = GlobalValue::InternalLinkage; | |||
| 2418 | GlobalVariable *NewGlobal = new GlobalVariable( | |||
| 2419 | M, NewTy, G->isConstant(), Linkage, NewInitializer, "", G, | |||
| 2420 | G->getThreadLocalMode(), G->getAddressSpace()); | |||
| 2421 | NewGlobal->copyAttributesFrom(G); | |||
| 2422 | NewGlobal->setComdat(G->getComdat()); | |||
| 2423 | NewGlobal->setAlignment(MaybeAlign(getMinRedzoneSizeForGlobal())); | |||
| 2424 | // Don't fold globals with redzones. ODR violation detector and redzone | |||
| 2425 | // poisoning implicitly creates a dependence on the global's address, so it | |||
| 2426 | // is no longer valid for it to be marked unnamed_addr. | |||
| 2427 | NewGlobal->setUnnamedAddr(GlobalValue::UnnamedAddr::None); | |||
| 2428 | ||||
| 2429 | // Move null-terminated C strings to "__asan_cstring" section on Darwin. | |||
| 2430 | if (TargetTriple.isOSBinFormatMachO() && !G->hasSection() && | |||
| 2431 | G->isConstant()) { | |||
| 2432 | auto Seq = dyn_cast<ConstantDataSequential>(G->getInitializer()); | |||
| 2433 | if (Seq && Seq->isCString()) | |||
| 2434 | NewGlobal->setSection("__TEXT,__asan_cstring,regular"); | |||
| 2435 | } | |||
| 2436 | ||||
| 2437 | // Transfer the debug info and type metadata. The payload starts at offset | |||
| 2438 | // zero so we can copy the metadata over as is. | |||
| 2439 | NewGlobal->copyMetadata(G, 0); | |||
| 2440 | ||||
| 2441 | Value *Indices2[2]; | |||
| 2442 | Indices2[0] = IRB.getInt32(0); | |||
| 2443 | Indices2[1] = IRB.getInt32(0); | |||
| 2444 | ||||
| 2445 | G->replaceAllUsesWith( | |||
| 2446 | ConstantExpr::getGetElementPtr(NewTy, NewGlobal, Indices2, true)); | |||
| 2447 | NewGlobal->takeName(G); | |||
| 2448 | G->eraseFromParent(); | |||
| 2449 | NewGlobals[i] = NewGlobal; | |||
| 2450 | ||||
| 2451 | Constant *SourceLoc; | |||
| 2452 | if (!MD.SourceLoc.empty()) { | |||
| 2453 | auto SourceLocGlobal = createPrivateGlobalForSourceLoc(M, MD.SourceLoc); | |||
| 2454 | SourceLoc = ConstantExpr::getPointerCast(SourceLocGlobal, IntptrTy); | |||
| 2455 | } else { | |||
| 2456 | SourceLoc = ConstantInt::get(IntptrTy, 0); | |||
| 2457 | } | |||
| 2458 | ||||
| 2459 | Constant *ODRIndicator = ConstantExpr::getNullValue(IRB.getInt8PtrTy()); | |||
| 2460 | GlobalValue *InstrumentedGlobal = NewGlobal; | |||
| 2461 | ||||
| 2462 | bool CanUsePrivateAliases = | |||
| 2463 | TargetTriple.isOSBinFormatELF() || TargetTriple.isOSBinFormatMachO() || | |||
| 2464 | TargetTriple.isOSBinFormatWasm(); | |||
| 2465 | if (CanUsePrivateAliases && UsePrivateAlias) { | |||
| 2466 | // Create local alias for NewGlobal to avoid crash on ODR between | |||
| 2467 | // instrumented and non-instrumented libraries. | |||
| 2468 | InstrumentedGlobal = | |||
| 2469 | GlobalAlias::create(GlobalValue::PrivateLinkage, "", NewGlobal); | |||
| 2470 | } | |||
| 2471 | ||||
| 2472 | // ODR should not happen for local linkage. | |||
| 2473 | if (NewGlobal->hasLocalLinkage()) { | |||
| 2474 | ODRIndicator = ConstantExpr::getIntToPtr(ConstantInt::get(IntptrTy, -1), | |||
| 2475 | IRB.getInt8PtrTy()); | |||
| 2476 | } else if (UseOdrIndicator) { | |||
| 2477 | // With local aliases, we need to provide another externally visible | |||
| 2478 | // symbol __odr_asan_XXX to detect ODR violation. | |||
| 2479 | auto *ODRIndicatorSym = | |||
| 2480 | new GlobalVariable(M, IRB.getInt8Ty(), false, Linkage, | |||
| 2481 | Constant::getNullValue(IRB.getInt8Ty()), | |||
| 2482 | kODRGenPrefix + NameForGlobal, nullptr, | |||
| 2483 | NewGlobal->getThreadLocalMode()); | |||
| 2484 | ||||
| 2485 | // Set meaningful attributes for indicator symbol. | |||
| 2486 | ODRIndicatorSym->setVisibility(NewGlobal->getVisibility()); | |||
| 2487 | ODRIndicatorSym->setDLLStorageClass(NewGlobal->getDLLStorageClass()); | |||
| 2488 | ODRIndicatorSym->setAlignment(Align(1)); | |||
| 2489 | ODRIndicator = ODRIndicatorSym; | |||
| 2490 | } | |||
| 2491 | ||||
| 2492 | Constant *Initializer = ConstantStruct::get( | |||
| 2493 | GlobalStructTy, | |||
| 2494 | ConstantExpr::getPointerCast(InstrumentedGlobal, IntptrTy), | |||
| 2495 | ConstantInt::get(IntptrTy, SizeInBytes), | |||
| 2496 | ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), | |||
| 2497 | ConstantExpr::getPointerCast(Name, IntptrTy), | |||
| 2498 | ConstantExpr::getPointerCast(ModuleName, IntptrTy), | |||
| 2499 | ConstantInt::get(IntptrTy, MD.IsDynInit), SourceLoc, | |||
| 2500 | ConstantExpr::getPointerCast(ODRIndicator, IntptrTy)); | |||
| 2501 | ||||
| 2502 | if (ClInitializers && MD.IsDynInit) HasDynamicallyInitializedGlobals = true; | |||
| 2503 | ||||
| 2504 | LLVM_DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n")do { } while (false); | |||
| 2505 | ||||
| 2506 | Initializers[i] = Initializer; | |||
| 2507 | } | |||
| 2508 | ||||
| 2509 | // Add instrumented globals to llvm.compiler.used list to avoid LTO from | |||
| 2510 | // ConstantMerge'ing them. | |||
| 2511 | SmallVector<GlobalValue *, 16> GlobalsToAddToUsedList; | |||
| 2512 | for (size_t i = 0; i < n; i++) { | |||
| 2513 | GlobalVariable *G = NewGlobals[i]; | |||
| 2514 | if (G->getName().empty()) continue; | |||
| 2515 | GlobalsToAddToUsedList.push_back(G); | |||
| 2516 | } | |||
| 2517 | appendToCompilerUsed(M, ArrayRef<GlobalValue *>(GlobalsToAddToUsedList)); | |||
| 2518 | ||||
| 2519 | std::string ELFUniqueModuleId = | |||
| 2520 | (UseGlobalsGC && TargetTriple.isOSBinFormatELF()) ? getUniqueModuleId(&M) | |||
| 2521 | : ""; | |||
| 2522 | ||||
| 2523 | if (!ELFUniqueModuleId.empty()) { | |||
| 2524 | InstrumentGlobalsELF(IRB, M, NewGlobals, Initializers, ELFUniqueModuleId); | |||
| 2525 | *CtorComdat = true; | |||
| 2526 | } else if (UseGlobalsGC && TargetTriple.isOSBinFormatCOFF()) { | |||
| 2527 | InstrumentGlobalsCOFF(IRB, M, NewGlobals, Initializers); | |||
| 2528 | } else if (UseGlobalsGC && ShouldUseMachOGlobalsSection()) { | |||
| 2529 | InstrumentGlobalsMachO(IRB, M, NewGlobals, Initializers); | |||
| 2530 | } else { | |||
| 2531 | InstrumentGlobalsWithMetadataArray(IRB, M, NewGlobals, Initializers); | |||
| 2532 | } | |||
| 2533 | ||||
| 2534 | // Create calls for poisoning before initializers run and unpoisoning after. | |||
| 2535 | if (HasDynamicallyInitializedGlobals) | |||
| 2536 | createInitializerPoisonCalls(M, ModuleName); | |||
| 2537 | ||||
| 2538 | LLVM_DEBUG(dbgs() << M)do { } while (false); | |||
| 2539 | return true; | |||
| 2540 | } | |||
| 2541 | ||||
| 2542 | uint64_t | |||
| 2543 | ModuleAddressSanitizer::getRedzoneSizeForGlobal(uint64_t SizeInBytes) const { | |||
| 2544 | constexpr uint64_t kMaxRZ = 1 << 18; | |||
| 2545 | const uint64_t MinRZ = getMinRedzoneSizeForGlobal(); | |||
| 2546 | ||||
| 2547 | uint64_t RZ = 0; | |||
| 2548 | if (SizeInBytes <= MinRZ / 2) { | |||
| 2549 | // Reduce redzone size for small size objects, e.g. int, char[1]. MinRZ is | |||
| 2550 | // at least 32 bytes, optimize when SizeInBytes is less than or equal to | |||
| 2551 | // half of MinRZ. | |||
| 2552 | RZ = MinRZ - SizeInBytes; | |||
| 2553 | } else { | |||
| 2554 | // Calculate RZ, where MinRZ <= RZ <= MaxRZ, and RZ ~ 1/4 * SizeInBytes. | |||
| 2555 | RZ = std::max(MinRZ, std::min(kMaxRZ, (SizeInBytes / MinRZ / 4) * MinRZ)); | |||
| 2556 | ||||
| 2557 | // Round up to multiple of MinRZ. | |||
| 2558 | if (SizeInBytes % MinRZ) | |||
| 2559 | RZ += MinRZ - (SizeInBytes % MinRZ); | |||
| 2560 | } | |||
| 2561 | ||||
| 2562 | assert((RZ + SizeInBytes) % MinRZ == 0)((void)0); | |||
| 2563 | ||||
| 2564 | return RZ; | |||
| 2565 | } | |||
| 2566 | ||||
| 2567 | int ModuleAddressSanitizer::GetAsanVersion(const Module &M) const { | |||
| 2568 | int LongSize = M.getDataLayout().getPointerSizeInBits(); | |||
| 2569 | bool isAndroid = Triple(M.getTargetTriple()).isAndroid(); | |||
| 2570 | int Version = 8; | |||
| 2571 | // 32-bit Android is one version ahead because of the switch to dynamic | |||
| 2572 | // shadow. | |||
| 2573 | Version += (LongSize == 32 && isAndroid); | |||
| 2574 | return Version; | |||
| 2575 | } | |||
| 2576 | ||||
| 2577 | bool ModuleAddressSanitizer::instrumentModule(Module &M) { | |||
| 2578 | initializeCallbacks(M); | |||
| 2579 | ||||
| 2580 | // Create a module constructor. A destructor is created lazily because not all | |||
| 2581 | // platforms, and not all modules need it. | |||
| 2582 | if (CompileKernel) { | |||
| 2583 | // The kernel always builds with its own runtime, and therefore does not | |||
| 2584 | // need the init and version check calls. | |||
| 2585 | AsanCtorFunction = createSanitizerCtor(M, kAsanModuleCtorName); | |||
| 2586 | } else { | |||
| 2587 | std::string AsanVersion = std::to_string(GetAsanVersion(M)); | |||
| 2588 | std::string VersionCheckName = | |||
| 2589 | ClInsertVersionCheck ? (kAsanVersionCheckNamePrefix + AsanVersion) : ""; | |||
| 2590 | std::tie(AsanCtorFunction, std::ignore) = | |||
| 2591 | createSanitizerCtorAndInitFunctions(M, kAsanModuleCtorName, | |||
| 2592 | kAsanInitName, /*InitArgTypes=*/{}, | |||
| 2593 | /*InitArgs=*/{}, VersionCheckName); | |||
| 2594 | } | |||
| 2595 | ||||
| 2596 | bool CtorComdat = true; | |||
| 2597 | if (ClGlobals) { | |||
| 2598 | IRBuilder<> IRB(AsanCtorFunction->getEntryBlock().getTerminator()); | |||
| 2599 | InstrumentGlobals(IRB, M, &CtorComdat); | |||
| 2600 | } | |||
| 2601 | ||||
| 2602 | const uint64_t Priority = GetCtorAndDtorPriority(TargetTriple); | |||
| 2603 | ||||
| 2604 | // Put the constructor and destructor in comdat if both | |||
| 2605 | // (1) global instrumentation is not TU-specific | |||
| 2606 | // (2) target is ELF. | |||
| 2607 | if (UseCtorComdat && TargetTriple.isOSBinFormatELF() && CtorComdat) { | |||
| 2608 | AsanCtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleCtorName)); | |||
| 2609 | appendToGlobalCtors(M, AsanCtorFunction, Priority, AsanCtorFunction); | |||
| 2610 | if (AsanDtorFunction) { | |||
| 2611 | AsanDtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleDtorName)); | |||
| 2612 | appendToGlobalDtors(M, AsanDtorFunction, Priority, AsanDtorFunction); | |||
| 2613 | } | |||
| 2614 | } else { | |||
| 2615 | appendToGlobalCtors(M, AsanCtorFunction, Priority); | |||
| 2616 | if (AsanDtorFunction) | |||
| 2617 | appendToGlobalDtors(M, AsanDtorFunction, Priority); | |||
| 2618 | } | |||
| 2619 | ||||
| 2620 | return true; | |||
| 2621 | } | |||
| 2622 | ||||
| 2623 | void AddressSanitizer::initializeCallbacks(Module &M) { | |||
| 2624 | IRBuilder<> IRB(*C); | |||
| 2625 | // Create __asan_report* callbacks. | |||
| 2626 | // IsWrite, TypeSize and Exp are encoded in the function name. | |||
| 2627 | for (int Exp = 0; Exp < 2; Exp++) { | |||
| 2628 | for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { | |||
| 2629 | const std::string TypeStr = AccessIsWrite ? "store" : "load"; | |||
| 2630 | const std::string ExpStr = Exp ? "exp_" : ""; | |||
| 2631 | const std::string EndingStr = Recover ? "_noabort" : ""; | |||
| 2632 | ||||
| 2633 | SmallVector<Type *, 3> Args2 = {IntptrTy, IntptrTy}; | |||
| 2634 | SmallVector<Type *, 2> Args1{1, IntptrTy}; | |||
| 2635 | if (Exp) { | |||
| 2636 | Type *ExpType = Type::getInt32Ty(*C); | |||
| 2637 | Args2.push_back(ExpType); | |||
| 2638 | Args1.push_back(ExpType); | |||
| 2639 | } | |||
| 2640 | AsanErrorCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction( | |||
| 2641 | kAsanReportErrorTemplate + ExpStr + TypeStr + "_n" + EndingStr, | |||
| 2642 | FunctionType::get(IRB.getVoidTy(), Args2, false)); | |||
| 2643 | ||||
| 2644 | AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction( | |||
| 2645 | ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr, | |||
| 2646 | FunctionType::get(IRB.getVoidTy(), Args2, false)); | |||
| 2647 | ||||
| 2648 | for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; | |||
| 2649 | AccessSizeIndex++) { | |||
| 2650 | const std::string Suffix = TypeStr + itostr(1ULL << AccessSizeIndex); | |||
| 2651 | AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] = | |||
| 2652 | M.getOrInsertFunction( | |||
| 2653 | kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr, | |||
| 2654 | FunctionType::get(IRB.getVoidTy(), Args1, false)); | |||
| 2655 | ||||
| 2656 | AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] = | |||
| 2657 | M.getOrInsertFunction( | |||
| 2658 | ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr, | |||
| 2659 | FunctionType::get(IRB.getVoidTy(), Args1, false)); | |||
| 2660 | } | |||
| 2661 | } | |||
| 2662 | } | |||
| 2663 | ||||
| 2664 | const std::string MemIntrinCallbackPrefix = | |||
| 2665 | CompileKernel ? std::string("") : ClMemoryAccessCallbackPrefix; | |||
| 2666 | AsanMemmove = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memmove", | |||
| 2667 | IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), | |||
| 2668 | IRB.getInt8PtrTy(), IntptrTy); | |||
| 2669 | AsanMemcpy = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memcpy", | |||
| 2670 | IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), | |||
| 2671 | IRB.getInt8PtrTy(), IntptrTy); | |||
| 2672 | AsanMemset = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memset", | |||
| 2673 | IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), | |||
| 2674 | IRB.getInt32Ty(), IntptrTy); | |||
| 2675 | ||||
| 2676 | AsanHandleNoReturnFunc = | |||
| 2677 | M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy()); | |||
| 2678 | ||||
| 2679 | AsanPtrCmpFunction = | |||
| 2680 | M.getOrInsertFunction(kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2681 | AsanPtrSubFunction = | |||
| 2682 | M.getOrInsertFunction(kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2683 | if (Mapping.InGlobal) | |||
| 2684 | AsanShadowGlobal = M.getOrInsertGlobal("__asan_shadow", | |||
| 2685 | ArrayType::get(IRB.getInt8Ty(), 0)); | |||
| 2686 | ||||
| 2687 | AMDGPUAddressShared = M.getOrInsertFunction( | |||
| 2688 | kAMDGPUAddressSharedName, IRB.getInt1Ty(), IRB.getInt8PtrTy()); | |||
| 2689 | AMDGPUAddressPrivate = M.getOrInsertFunction( | |||
| 2690 | kAMDGPUAddressPrivateName, IRB.getInt1Ty(), IRB.getInt8PtrTy()); | |||
| 2691 | } | |||
| 2692 | ||||
| 2693 | bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { | |||
| 2694 | // For each NSObject descendant having a +load method, this method is invoked | |||
| 2695 | // by the ObjC runtime before any of the static constructors is called. | |||
| 2696 | // Therefore we need to instrument such methods with a call to __asan_init | |||
| 2697 | // at the beginning in order to initialize our runtime before any access to | |||
| 2698 | // the shadow memory. | |||
| 2699 | // We cannot just ignore these methods, because they may call other | |||
| 2700 | // instrumented functions. | |||
| 2701 | if (F.getName().find(" load]") != std::string::npos) { | |||
| 2702 | FunctionCallee AsanInitFunction = | |||
| 2703 | declareSanitizerInitFunction(*F.getParent(), kAsanInitName, {}); | |||
| 2704 | IRBuilder<> IRB(&F.front(), F.front().begin()); | |||
| 2705 | IRB.CreateCall(AsanInitFunction, {}); | |||
| 2706 | return true; | |||
| 2707 | } | |||
| 2708 | return false; | |||
| 2709 | } | |||
| 2710 | ||||
| 2711 | bool AddressSanitizer::maybeInsertDynamicShadowAtFunctionEntry(Function &F) { | |||
| 2712 | // Generate code only when dynamic addressing is needed. | |||
| 2713 | if (Mapping.Offset != kDynamicShadowSentinel) | |||
| 2714 | return false; | |||
| 2715 | ||||
| 2716 | IRBuilder<> IRB(&F.front().front()); | |||
| 2717 | if (Mapping.InGlobal) { | |||
| 2718 | if (ClWithIfuncSuppressRemat) { | |||
| 2719 | // An empty inline asm with input reg == output reg. | |||
| 2720 | // An opaque pointer-to-int cast, basically. | |||
| 2721 | InlineAsm *Asm = InlineAsm::get( | |||
| 2722 | FunctionType::get(IntptrTy, {AsanShadowGlobal->getType()}, false), | |||
| 2723 | StringRef(""), StringRef("=r,0"), | |||
| 2724 | /*hasSideEffects=*/false); | |||
| 2725 | LocalDynamicShadow = | |||
| 2726 | IRB.CreateCall(Asm, {AsanShadowGlobal}, ".asan.shadow"); | |||
| 2727 | } else { | |||
| 2728 | LocalDynamicShadow = | |||
| 2729 | IRB.CreatePointerCast(AsanShadowGlobal, IntptrTy, ".asan.shadow"); | |||
| 2730 | } | |||
| 2731 | } else { | |||
| 2732 | Value *GlobalDynamicAddress = F.getParent()->getOrInsertGlobal( | |||
| 2733 | kAsanShadowMemoryDynamicAddress, IntptrTy); | |||
| 2734 | LocalDynamicShadow = IRB.CreateLoad(IntptrTy, GlobalDynamicAddress); | |||
| 2735 | } | |||
| 2736 | return true; | |||
| 2737 | } | |||
| 2738 | ||||
| 2739 | void AddressSanitizer::markEscapedLocalAllocas(Function &F) { | |||
| 2740 | // Find the one possible call to llvm.localescape and pre-mark allocas passed | |||
| 2741 | // to it as uninteresting. This assumes we haven't started processing allocas | |||
| 2742 | // yet. This check is done up front because iterating the use list in | |||
| 2743 | // isInterestingAlloca would be algorithmically slower. | |||
| 2744 | assert(ProcessedAllocas.empty() && "must process localescape before allocas")((void)0); | |||
| 2745 | ||||
| 2746 | // Try to get the declaration of llvm.localescape. If it's not in the module, | |||
| 2747 | // we can exit early. | |||
| 2748 | if (!F.getParent()->getFunction("llvm.localescape")) return; | |||
| 2749 | ||||
| 2750 | // Look for a call to llvm.localescape call in the entry block. It can't be in | |||
| 2751 | // any other block. | |||
| 2752 | for (Instruction &I : F.getEntryBlock()) { | |||
| 2753 | IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I); | |||
| 2754 | if (II && II->getIntrinsicID() == Intrinsic::localescape) { | |||
| 2755 | // We found a call. Mark all the allocas passed in as uninteresting. | |||
| 2756 | for (Value *Arg : II->arg_operands()) { | |||
| 2757 | AllocaInst *AI = dyn_cast<AllocaInst>(Arg->stripPointerCasts()); | |||
| 2758 | assert(AI && AI->isStaticAlloca() &&((void)0) | |||
| 2759 | "non-static alloca arg to localescape")((void)0); | |||
| 2760 | ProcessedAllocas[AI] = false; | |||
| 2761 | } | |||
| 2762 | break; | |||
| 2763 | } | |||
| 2764 | } | |||
| 2765 | } | |||
| 2766 | ||||
| 2767 | bool AddressSanitizer::suppressInstrumentationSiteForDebug(int &Instrumented) { | |||
| 2768 | bool ShouldInstrument = | |||
| 2769 | ClDebugMin < 0 || ClDebugMax < 0 || | |||
| 2770 | (Instrumented >= ClDebugMin && Instrumented <= ClDebugMax); | |||
| 2771 | Instrumented++; | |||
| 2772 | return !ShouldInstrument; | |||
| 2773 | } | |||
| 2774 | ||||
| 2775 | bool AddressSanitizer::instrumentFunction(Function &F, | |||
| 2776 | const TargetLibraryInfo *TLI) { | |||
| 2777 | if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false; | |||
| 2778 | if (!ClDebugFunc.empty() && ClDebugFunc == F.getName()) return false; | |||
| 2779 | if (F.getName().startswith("__asan_")) return false; | |||
| 2780 | ||||
| 2781 | bool FunctionModified = false; | |||
| 2782 | ||||
| 2783 | // If needed, insert __asan_init before checking for SanitizeAddress attr. | |||
| 2784 | // This function needs to be called even if the function body is not | |||
| 2785 | // instrumented. | |||
| 2786 | if (maybeInsertAsanInitAtFunctionEntry(F)) | |||
| 2787 | FunctionModified = true; | |||
| 2788 | ||||
| 2789 | // Leave if the function doesn't need instrumentation. | |||
| 2790 | if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return FunctionModified; | |||
| 2791 | ||||
| 2792 | LLVM_DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n")do { } while (false); | |||
| 2793 | ||||
| 2794 | initializeCallbacks(*F.getParent()); | |||
| 2795 | ||||
| 2796 | FunctionStateRAII CleanupObj(this); | |||
| 2797 | ||||
| 2798 | FunctionModified |= maybeInsertDynamicShadowAtFunctionEntry(F); | |||
| 2799 | ||||
| 2800 | // We can't instrument allocas used with llvm.localescape. Only static allocas | |||
| 2801 | // can be passed to that intrinsic. | |||
| 2802 | markEscapedLocalAllocas(F); | |||
| 2803 | ||||
| 2804 | // We want to instrument every address only once per basic block (unless there | |||
| 2805 | // are calls between uses). | |||
| 2806 | SmallPtrSet<Value *, 16> TempsToInstrument; | |||
| 2807 | SmallVector<InterestingMemoryOperand, 16> OperandsToInstrument; | |||
| 2808 | SmallVector<MemIntrinsic *, 16> IntrinToInstrument; | |||
| 2809 | SmallVector<Instruction *, 8> NoReturnCalls; | |||
| 2810 | SmallVector<BasicBlock *, 16> AllBlocks; | |||
| 2811 | SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts; | |||
| 2812 | int NumAllocas = 0; | |||
| 2813 | ||||
| 2814 | // Fill the set of memory operations to instrument. | |||
| 2815 | for (auto &BB : F) { | |||
| 2816 | AllBlocks.push_back(&BB); | |||
| 2817 | TempsToInstrument.clear(); | |||
| 2818 | int NumInsnsPerBB = 0; | |||
| 2819 | for (auto &Inst : BB) { | |||
| 2820 | if (LooksLikeCodeInBug11395(&Inst)) return false; | |||
| 2821 | SmallVector<InterestingMemoryOperand, 1> InterestingOperands; | |||
| 2822 | getInterestingMemoryOperands(&Inst, InterestingOperands); | |||
| 2823 | ||||
| 2824 | if (!InterestingOperands.empty()) { | |||
| 2825 | for (auto &Operand : InterestingOperands) { | |||
| 2826 | if (ClOpt && ClOptSameTemp) { | |||
| 2827 | Value *Ptr = Operand.getPtr(); | |||
| 2828 | // If we have a mask, skip instrumentation if we've already | |||
| 2829 | // instrumented the full object. But don't add to TempsToInstrument | |||
| 2830 | // because we might get another load/store with a different mask. | |||
| 2831 | if (Operand.MaybeMask) { | |||
| 2832 | if (TempsToInstrument.count(Ptr)) | |||
| 2833 | continue; // We've seen this (whole) temp in the current BB. | |||
| 2834 | } else { | |||
| 2835 | if (!TempsToInstrument.insert(Ptr).second) | |||
| 2836 | continue; // We've seen this temp in the current BB. | |||
| 2837 | } | |||
| 2838 | } | |||
| 2839 | OperandsToInstrument.push_back(Operand); | |||
| 2840 | NumInsnsPerBB++; | |||
| 2841 | } | |||
| 2842 | } else if (((ClInvalidPointerPairs || ClInvalidPointerCmp) && | |||
| 2843 | isInterestingPointerComparison(&Inst)) || | |||
| 2844 | ((ClInvalidPointerPairs || ClInvalidPointerSub) && | |||
| 2845 | isInterestingPointerSubtraction(&Inst))) { | |||
| 2846 | PointerComparisonsOrSubtracts.push_back(&Inst); | |||
| 2847 | } else if (MemIntrinsic *MI = dyn_cast<MemIntrinsic>(&Inst)) { | |||
| 2848 | // ok, take it. | |||
| 2849 | IntrinToInstrument.push_back(MI); | |||
| 2850 | NumInsnsPerBB++; | |||
| 2851 | } else { | |||
| 2852 | if (isa<AllocaInst>(Inst)) NumAllocas++; | |||
| 2853 | if (auto *CB = dyn_cast<CallBase>(&Inst)) { | |||
| 2854 | // A call inside BB. | |||
| 2855 | TempsToInstrument.clear(); | |||
| 2856 | if (CB->doesNotReturn() && !CB->hasMetadata("nosanitize")) | |||
| 2857 | NoReturnCalls.push_back(CB); | |||
| 2858 | } | |||
| 2859 | if (CallInst *CI = dyn_cast<CallInst>(&Inst)) | |||
| 2860 | maybeMarkSanitizerLibraryCallNoBuiltin(CI, TLI); | |||
| 2861 | } | |||
| 2862 | if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break; | |||
| 2863 | } | |||
| 2864 | } | |||
| 2865 | ||||
| 2866 | bool UseCalls = (ClInstrumentationWithCallsThreshold >= 0 && | |||
| 2867 | OperandsToInstrument.size() + IntrinToInstrument.size() > | |||
| 2868 | (unsigned)ClInstrumentationWithCallsThreshold); | |||
| 2869 | const DataLayout &DL = F.getParent()->getDataLayout(); | |||
| 2870 | ObjectSizeOpts ObjSizeOpts; | |||
| 2871 | ObjSizeOpts.RoundToAlign = true; | |||
| 2872 | ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), ObjSizeOpts); | |||
| 2873 | ||||
| 2874 | // Instrument. | |||
| 2875 | int NumInstrumented = 0; | |||
| 2876 | for (auto &Operand : OperandsToInstrument) { | |||
| 2877 | if (!suppressInstrumentationSiteForDebug(NumInstrumented)) | |||
| 2878 | instrumentMop(ObjSizeVis, Operand, UseCalls, | |||
| 2879 | F.getParent()->getDataLayout()); | |||
| 2880 | FunctionModified = true; | |||
| 2881 | } | |||
| 2882 | for (auto Inst : IntrinToInstrument) { | |||
| 2883 | if (!suppressInstrumentationSiteForDebug(NumInstrumented)) | |||
| 2884 | instrumentMemIntrinsic(Inst); | |||
| 2885 | FunctionModified = true; | |||
| 2886 | } | |||
| 2887 | ||||
| 2888 | FunctionStackPoisoner FSP(F, *this); | |||
| 2889 | bool ChangedStack = FSP.runOnFunction(); | |||
| 2890 | ||||
| 2891 | // We must unpoison the stack before NoReturn calls (throw, _exit, etc). | |||
| 2892 | // See e.g. https://github.com/google/sanitizers/issues/37 | |||
| 2893 | for (auto CI : NoReturnCalls) { | |||
| 2894 | IRBuilder<> IRB(CI); | |||
| 2895 | IRB.CreateCall(AsanHandleNoReturnFunc, {}); | |||
| 2896 | } | |||
| 2897 | ||||
| 2898 | for (auto Inst : PointerComparisonsOrSubtracts) { | |||
| 2899 | instrumentPointerComparisonOrSubtraction(Inst); | |||
| 2900 | FunctionModified = true; | |||
| 2901 | } | |||
| 2902 | ||||
| 2903 | if (ChangedStack || !NoReturnCalls.empty()) | |||
| 2904 | FunctionModified = true; | |||
| 2905 | ||||
| 2906 | LLVM_DEBUG(dbgs() << "ASAN done instrumenting: " << FunctionModified << " "do { } while (false) | |||
| 2907 | << F << "\n")do { } while (false); | |||
| 2908 | ||||
| 2909 | return FunctionModified; | |||
| 2910 | } | |||
| 2911 | ||||
| 2912 | // Workaround for bug 11395: we don't want to instrument stack in functions | |||
| 2913 | // with large assembly blobs (32-bit only), otherwise reg alloc may crash. | |||
| 2914 | // FIXME: remove once the bug 11395 is fixed. | |||
| 2915 | bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { | |||
| 2916 | if (LongSize != 32) return false; | |||
| 2917 | CallInst *CI = dyn_cast<CallInst>(I); | |||
| 2918 | if (!CI || !CI->isInlineAsm()) return false; | |||
| 2919 | if (CI->getNumArgOperands() <= 5) return false; | |||
| 2920 | // We have inline assembly with quite a few arguments. | |||
| 2921 | return true; | |||
| 2922 | } | |||
| 2923 | ||||
| 2924 | void FunctionStackPoisoner::initializeCallbacks(Module &M) { | |||
| 2925 | IRBuilder<> IRB(*C); | |||
| 2926 | if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always || | |||
| 2927 | ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) { | |||
| 2928 | const char *MallocNameTemplate = | |||
| 2929 | ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always | |||
| 2930 | ? kAsanStackMallocAlwaysNameTemplate | |||
| 2931 | : kAsanStackMallocNameTemplate; | |||
| 2932 | for (int Index = 0; Index <= kMaxAsanStackMallocSizeClass; Index++) { | |||
| 2933 | std::string Suffix = itostr(Index); | |||
| 2934 | AsanStackMallocFunc[Index] = M.getOrInsertFunction( | |||
| 2935 | MallocNameTemplate + Suffix, IntptrTy, IntptrTy); | |||
| 2936 | AsanStackFreeFunc[Index] = | |||
| 2937 | M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix, | |||
| 2938 | IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2939 | } | |||
| 2940 | } | |||
| 2941 | if (ASan.UseAfterScope) { | |||
| 2942 | AsanPoisonStackMemoryFunc = M.getOrInsertFunction( | |||
| 2943 | kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2944 | AsanUnpoisonStackMemoryFunc = M.getOrInsertFunction( | |||
| 2945 | kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2946 | } | |||
| 2947 | ||||
| 2948 | for (size_t Val : {0x00, 0xf1, 0xf2, 0xf3, 0xf5, 0xf8}) { | |||
| 2949 | std::ostringstream Name; | |||
| 2950 | Name << kAsanSetShadowPrefix; | |||
| 2951 | Name << std::setw(2) << std::setfill('0') << std::hex << Val; | |||
| 2952 | AsanSetShadowFunc[Val] = | |||
| 2953 | M.getOrInsertFunction(Name.str(), IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2954 | } | |||
| 2955 | ||||
| 2956 | AsanAllocaPoisonFunc = M.getOrInsertFunction( | |||
| 2957 | kAsanAllocaPoison, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2958 | AsanAllocasUnpoisonFunc = M.getOrInsertFunction( | |||
| 2959 | kAsanAllocasUnpoison, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
| 2960 | } | |||
| 2961 | ||||
| 2962 | void FunctionStackPoisoner::copyToShadowInline(ArrayRef<uint8_t> ShadowMask, | |||
| 2963 | ArrayRef<uint8_t> ShadowBytes, | |||
| 2964 | size_t Begin, size_t End, | |||
| 2965 | IRBuilder<> &IRB, | |||
| 2966 | Value *ShadowBase) { | |||
| 2967 | if (Begin >= End) | |||
| 2968 | return; | |||
| 2969 | ||||
| 2970 | const size_t LargestStoreSizeInBytes = | |||
| 2971 | std::min<size_t>(sizeof(uint64_t), ASan.LongSize / 8); | |||
| 2972 | ||||
| 2973 | const bool IsLittleEndian = F.getParent()->getDataLayout().isLittleEndian(); | |||
| 2974 | ||||
| 2975 | // Poison given range in shadow using larges store size with out leading and | |||
| 2976 | // trailing zeros in ShadowMask. Zeros never change, so they need neither | |||
| 2977 | // poisoning nor up-poisoning. Still we don't mind if some of them get into a | |||
| 2978 | // middle of a store. | |||
| 2979 | for (size_t i = Begin; i < End;) { | |||
| 2980 | if (!ShadowMask[i]) { | |||
| 2981 | assert(!ShadowBytes[i])((void)0); | |||
| 2982 | ++i; | |||
| 2983 | continue; | |||
| 2984 | } | |||
| 2985 | ||||
| 2986 | size_t StoreSizeInBytes = LargestStoreSizeInBytes; | |||
| 2987 | // Fit store size into the range. | |||
| 2988 | while (StoreSizeInBytes > End - i) | |||
| 2989 | StoreSizeInBytes /= 2; | |||
| 2990 | ||||
| 2991 | // Minimize store size by trimming trailing zeros. | |||
| 2992 | for (size_t j = StoreSizeInBytes - 1; j && !ShadowMask[i + j]; --j) { | |||
| 2993 | while (j <= StoreSizeInBytes / 2) | |||
| 2994 | StoreSizeInBytes /= 2; | |||
| 2995 | } | |||
| 2996 | ||||
| 2997 | uint64_t Val = 0; | |||
| 2998 | for (size_t j = 0; j < StoreSizeInBytes; j++) { | |||
| 2999 | if (IsLittleEndian) | |||
| 3000 | Val |= (uint64_t)ShadowBytes[i + j] << (8 * j); | |||
| 3001 | else | |||
| 3002 | Val = (Val << 8) | ShadowBytes[i + j]; | |||
| 3003 | } | |||
| 3004 | ||||
| 3005 | Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); | |||
| 3006 | Value *Poison = IRB.getIntN(StoreSizeInBytes * 8, Val); | |||
| 3007 | IRB.CreateAlignedStore( | |||
| 3008 | Poison, IRB.CreateIntToPtr(Ptr, Poison->getType()->getPointerTo()), | |||
| 3009 | Align(1)); | |||
| 3010 | ||||
| 3011 | i += StoreSizeInBytes; | |||
| 3012 | } | |||
| 3013 | } | |||
| 3014 | ||||
| 3015 | void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask, | |||
| 3016 | ArrayRef<uint8_t> ShadowBytes, | |||
| 3017 | IRBuilder<> &IRB, Value *ShadowBase) { | |||
| 3018 | copyToShadow(ShadowMask, ShadowBytes, 0, ShadowMask.size(), IRB, ShadowBase); | |||
| 3019 | } | |||
| 3020 | ||||
| 3021 | void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask, | |||
| 3022 | ArrayRef<uint8_t> ShadowBytes, | |||
| 3023 | size_t Begin, size_t End, | |||
| 3024 | IRBuilder<> &IRB, Value *ShadowBase) { | |||
| 3025 | assert(ShadowMask.size() == ShadowBytes.size())((void)0); | |||
| 3026 | size_t Done = Begin; | |||
| 3027 | for (size_t i = Begin, j = Begin + 1; i < End; i = j++) { | |||
| 3028 | if (!ShadowMask[i]) { | |||
| 3029 | assert(!ShadowBytes[i])((void)0); | |||
| 3030 | continue; | |||
| 3031 | } | |||
| 3032 | uint8_t Val = ShadowBytes[i]; | |||
| 3033 | if (!AsanSetShadowFunc[Val]) | |||
| 3034 | continue; | |||
| 3035 | ||||
| 3036 | // Skip same values. | |||
| 3037 | for (; j < End && ShadowMask[j] && Val == ShadowBytes[j]; ++j) { | |||
| 3038 | } | |||
| 3039 | ||||
| 3040 | if (j - i >= ClMaxInlinePoisoningSize) { | |||
| 3041 | copyToShadowInline(ShadowMask, ShadowBytes, Done, i, IRB, ShadowBase); | |||
| 3042 | IRB.CreateCall(AsanSetShadowFunc[Val], | |||
| 3043 | {IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)), | |||
| 3044 | ConstantInt::get(IntptrTy, j - i)}); | |||
| 3045 | Done = j; | |||
| 3046 | } | |||
| 3047 | } | |||
| 3048 | ||||
| 3049 | copyToShadowInline(ShadowMask, ShadowBytes, Done, End, IRB, ShadowBase); | |||
| 3050 | } | |||
| 3051 | ||||
| 3052 | // Fake stack allocator (asan_fake_stack.h) has 11 size classes | |||
| 3053 | // for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass | |||
| 3054 | static int StackMallocSizeClass(uint64_t LocalStackSize) { | |||
| 3055 | assert(LocalStackSize <= kMaxStackMallocSize)((void)0); | |||
| 3056 | uint64_t MaxSize = kMinStackMallocSize; | |||
| 3057 | for (int i = 0;; i++, MaxSize *= 2) | |||
| 3058 | if (LocalStackSize <= MaxSize) return i; | |||
| 3059 | llvm_unreachable("impossible LocalStackSize")__builtin_unreachable(); | |||
| 3060 | } | |||
| 3061 | ||||
| 3062 | void FunctionStackPoisoner::copyArgsPassedByValToAllocas() { | |||
| 3063 | Instruction *CopyInsertPoint = &F.front().front(); | |||
| 3064 | if (CopyInsertPoint == ASan.LocalDynamicShadow) { | |||
| 3065 | // Insert after the dynamic shadow location is determined | |||
| 3066 | CopyInsertPoint = CopyInsertPoint->getNextNode(); | |||
| 3067 | assert(CopyInsertPoint)((void)0); | |||
| 3068 | } | |||
| 3069 | IRBuilder<> IRB(CopyInsertPoint); | |||
| 3070 | const DataLayout &DL = F.getParent()->getDataLayout(); | |||
| 3071 | for (Argument &Arg : F.args()) { | |||
| 3072 | if (Arg.hasByValAttr()) { | |||
| 3073 | Type *Ty = Arg.getParamByValType(); | |||
| 3074 | const Align Alignment = | |||
| 3075 | DL.getValueOrABITypeAlignment(Arg.getParamAlign(), Ty); | |||
| 3076 | ||||
| 3077 | AllocaInst *AI = IRB.CreateAlloca( | |||
| 3078 | Ty, nullptr, | |||
| 3079 | (Arg.hasName() ? Arg.getName() : "Arg" + Twine(Arg.getArgNo())) + | |||
| 3080 | ".byval"); | |||
| 3081 | AI->setAlignment(Alignment); | |||
| 3082 | Arg.replaceAllUsesWith(AI); | |||
| 3083 | ||||
| 3084 | uint64_t AllocSize = DL.getTypeAllocSize(Ty); | |||
| 3085 | IRB.CreateMemCpy(AI, Alignment, &Arg, Alignment, AllocSize); | |||
| 3086 | } | |||
| 3087 | } | |||
| 3088 | } | |||
| 3089 | ||||
| 3090 | PHINode *FunctionStackPoisoner::createPHI(IRBuilder<> &IRB, Value *Cond, | |||
| 3091 | Value *ValueIfTrue, | |||
| 3092 | Instruction *ThenTerm, | |||
| 3093 | Value *ValueIfFalse) { | |||
| 3094 | PHINode *PHI = IRB.CreatePHI(IntptrTy, 2); | |||
| 3095 | BasicBlock *CondBlock = cast<Instruction>(Cond)->getParent(); | |||
| 3096 | PHI->addIncoming(ValueIfFalse, CondBlock); | |||
| 3097 | BasicBlock *ThenBlock = ThenTerm->getParent(); | |||
| 3098 | PHI->addIncoming(ValueIfTrue, ThenBlock); | |||
| 3099 | return PHI; | |||
| 3100 | } | |||
| 3101 | ||||
| 3102 | Value *FunctionStackPoisoner::createAllocaForLayout( | |||
| 3103 | IRBuilder<> &IRB, const ASanStackFrameLayout &L, bool Dynamic) { | |||
| 3104 | AllocaInst *Alloca; | |||
| 3105 | if (Dynamic) { | |||
| 3106 | Alloca = IRB.CreateAlloca(IRB.getInt8Ty(), | |||
| 3107 | ConstantInt::get(IRB.getInt64Ty(), L.FrameSize), | |||
| 3108 | "MyAlloca"); | |||
| 3109 | } else { | |||
| 3110 | Alloca = IRB.CreateAlloca(ArrayType::get(IRB.getInt8Ty(), L.FrameSize), | |||
| 3111 | nullptr, "MyAlloca"); | |||
| 3112 | assert(Alloca->isStaticAlloca())((void)0); | |||
| 3113 | } | |||
| 3114 | assert((ClRealignStack & (ClRealignStack - 1)) == 0)((void)0); | |||
| 3115 | size_t FrameAlignment = std::max(L.FrameAlignment, (size_t)ClRealignStack); | |||
| 3116 | Alloca->setAlignment(Align(FrameAlignment)); | |||
| 3117 | return IRB.CreatePointerCast(Alloca, IntptrTy); | |||
| 3118 | } | |||
| 3119 | ||||
| 3120 | void FunctionStackPoisoner::createDynamicAllocasInitStorage() { | |||
| 3121 | BasicBlock &FirstBB = *F.begin(); | |||
| 3122 | IRBuilder<> IRB(dyn_cast<Instruction>(FirstBB.begin())); | |||
| 3123 | DynamicAllocaLayout = IRB.CreateAlloca(IntptrTy, nullptr); | |||
| 3124 | IRB.CreateStore(Constant::getNullValue(IntptrTy), DynamicAllocaLayout); | |||
| 3125 | DynamicAllocaLayout->setAlignment(Align(32)); | |||
| 3126 | } | |||
| 3127 | ||||
| 3128 | void FunctionStackPoisoner::processDynamicAllocas() { | |||
| 3129 | if (!ClInstrumentDynamicAllocas || DynamicAllocaVec.empty()) { | |||
| 3130 | assert(DynamicAllocaPoisonCallVec.empty())((void)0); | |||
| 3131 | return; | |||
| 3132 | } | |||
| 3133 | ||||
| 3134 | // Insert poison calls for lifetime intrinsics for dynamic allocas. | |||
| 3135 | for (const auto &APC : DynamicAllocaPoisonCallVec) { | |||
| 3136 | assert(APC.InsBefore)((void)0); | |||
| 3137 | assert(APC.AI)((void)0); | |||
| 3138 | assert(ASan.isInterestingAlloca(*APC.AI))((void)0); | |||
| 3139 | assert(!APC.AI->isStaticAlloca())((void)0); | |||
| 3140 | ||||
| 3141 | IRBuilder<> IRB(APC.InsBefore); | |||
| 3142 | poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison); | |||
| 3143 | // Dynamic allocas will be unpoisoned unconditionally below in | |||
| 3144 | // unpoisonDynamicAllocas. | |||
| 3145 | // Flag that we need unpoison static allocas. | |||
| 3146 | } | |||
| 3147 | ||||
| 3148 | // Handle dynamic allocas. | |||
| 3149 | createDynamicAllocasInitStorage(); | |||
| 3150 | for (auto &AI : DynamicAllocaVec) | |||
| 3151 | handleDynamicAllocaCall(AI); | |||
| 3152 | unpoisonDynamicAllocas(); | |||
| 3153 | } | |||
| 3154 | ||||
| 3155 | /// Collect instructions in the entry block after \p InsBefore which initialize | |||
| 3156 | /// permanent storage for a function argument. These instructions must remain in | |||
| 3157 | /// the entry block so that uninitialized values do not appear in backtraces. An | |||
| 3158 | /// added benefit is that this conserves spill slots. This does not move stores | |||
| 3159 | /// before instrumented / "interesting" allocas. | |||
| 3160 | static void findStoresToUninstrumentedArgAllocas( | |||
| 3161 | AddressSanitizer &ASan, Instruction &InsBefore, | |||
| 3162 | SmallVectorImpl<Instruction *> &InitInsts) { | |||
| 3163 | Instruction *Start = InsBefore.getNextNonDebugInstruction(); | |||
| 3164 | for (Instruction *It = Start; It; It = It->getNextNonDebugInstruction()) { | |||
| 3165 | // Argument initialization looks like: | |||
| 3166 | // 1) store <Argument>, <Alloca> OR | |||
| 3167 | // 2) <CastArgument> = cast <Argument> to ... | |||
| 3168 | // store <CastArgument> to <Alloca> | |||
| 3169 | // Do not consider any other kind of instruction. | |||
| 3170 | // | |||
| 3171 | // Note: This covers all known cases, but may not be exhaustive. An | |||
| 3172 | // alternative to pattern-matching stores is to DFS over all Argument uses: | |||
| 3173 | // this might be more general, but is probably much more complicated. | |||
| 3174 | if (isa<AllocaInst>(It) || isa<CastInst>(It)) | |||
| 3175 | continue; | |||
| 3176 | if (auto *Store = dyn_cast<StoreInst>(It)) { | |||
| 3177 | // The store destination must be an alloca that isn't interesting for | |||
| 3178 | // ASan to instrument. These are moved up before InsBefore, and they're | |||
| 3179 | // not interesting because allocas for arguments can be mem2reg'd. | |||
| 3180 | auto *Alloca = dyn_cast<AllocaInst>(Store->getPointerOperand()); | |||
| 3181 | if (!Alloca || ASan.isInterestingAlloca(*Alloca)) | |||
| 3182 | continue; | |||
| 3183 | ||||
| 3184 | Value *Val = Store->getValueOperand(); | |||
| 3185 | bool IsDirectArgInit = isa<Argument>(Val); | |||
| 3186 | bool IsArgInitViaCast = | |||
| 3187 | isa<CastInst>(Val) && | |||
| 3188 | isa<Argument>(cast<CastInst>(Val)->getOperand(0)) && | |||
| 3189 | // Check that the cast appears directly before the store. Otherwise | |||
| 3190 | // moving the cast before InsBefore may break the IR. | |||
| 3191 | Val == It->getPrevNonDebugInstruction(); | |||
| 3192 | bool IsArgInit = IsDirectArgInit || IsArgInitViaCast; | |||
| 3193 | if (!IsArgInit) | |||
| 3194 | continue; | |||
| 3195 | ||||
| 3196 | if (IsArgInitViaCast) | |||
| 3197 | InitInsts.push_back(cast<Instruction>(Val)); | |||
| 3198 | InitInsts.push_back(Store); | |||
| 3199 | continue; | |||
| 3200 | } | |||
| 3201 | ||||
| 3202 | // Do not reorder past unknown instructions: argument initialization should | |||
| 3203 | // only involve casts and stores. | |||
| 3204 | return; | |||
| 3205 | } | |||
| 3206 | } | |||
| 3207 | ||||
| 3208 | void FunctionStackPoisoner::processStaticAllocas() { | |||
| 3209 | if (AllocaVec.empty()) { | |||
| 3210 | assert(StaticAllocaPoisonCallVec.empty())((void)0); | |||
| 3211 | return; | |||
| 3212 | } | |||
| 3213 | ||||
| 3214 | int StackMallocIdx = -1; | |||
| 3215 | DebugLoc EntryDebugLocation; | |||
| 3216 | if (auto SP = F.getSubprogram()) | |||
| 3217 | EntryDebugLocation = | |||
| 3218 | DILocation::get(SP->getContext(), SP->getScopeLine(), 0, SP); | |||
| 3219 | ||||
| 3220 | Instruction *InsBefore = AllocaVec[0]; | |||
| 3221 | IRBuilder<> IRB(InsBefore); | |||
| 3222 | ||||
| 3223 | // Make sure non-instrumented allocas stay in the entry block. Otherwise, | |||
| 3224 | // debug info is broken, because only entry-block allocas are treated as | |||
| 3225 | // regular stack slots. | |||
| 3226 | auto InsBeforeB = InsBefore->getParent(); | |||
| 3227 | assert(InsBeforeB == &F.getEntryBlock())((void)0); | |||
| 3228 | for (auto *AI : StaticAllocasToMoveUp) | |||
| 3229 | if (AI->getParent() == InsBeforeB) | |||
| 3230 | AI->moveBefore(InsBefore); | |||
| 3231 | ||||
| 3232 | // Move stores of arguments into entry-block allocas as well. This prevents | |||
| 3233 | // extra stack slots from being generated (to house the argument values until | |||
| 3234 | // they can be stored into the allocas). This also prevents uninitialized | |||
| 3235 | // values from being shown in backtraces. | |||
| 3236 | SmallVector<Instruction *, 8> ArgInitInsts; | |||
| 3237 | findStoresToUninstrumentedArgAllocas(ASan, *InsBefore, ArgInitInsts); | |||
| 3238 | for (Instruction *ArgInitInst : ArgInitInsts) | |||
| 3239 | ArgInitInst->moveBefore(InsBefore); | |||
| 3240 | ||||
| 3241 | // If we have a call to llvm.localescape, keep it in the entry block. | |||
| 3242 | if (LocalEscapeCall) LocalEscapeCall->moveBefore(InsBefore); | |||
| 3243 | ||||
| 3244 | SmallVector<ASanStackVariableDescription, 16> SVD; | |||
| 3245 | SVD.reserve(AllocaVec.size()); | |||
| 3246 | for (AllocaInst *AI : AllocaVec) { | |||
| 3247 | ASanStackVariableDescription D = {AI->getName().data(), | |||
| 3248 | ASan.getAllocaSizeInBytes(*AI), | |||
| 3249 | 0, | |||
| 3250 | AI->getAlignment(), | |||
| 3251 | AI, | |||
| 3252 | 0, | |||
| 3253 | 0}; | |||
| 3254 | SVD.push_back(D); | |||
| 3255 | } | |||
| 3256 | ||||
| 3257 | // Minimal header size (left redzone) is 4 pointers, | |||
| 3258 | // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms. | |||
| 3259 | size_t Granularity = 1ULL << Mapping.Scale; | |||
| 3260 | size_t MinHeaderSize = std::max((size_t)ASan.LongSize / 2, Granularity); | |||
| 3261 | const ASanStackFrameLayout &L = | |||
| 3262 | ComputeASanStackFrameLayout(SVD, Granularity, MinHeaderSize); | |||
| 3263 | ||||
| 3264 | // Build AllocaToSVDMap for ASanStackVariableDescription lookup. | |||
| 3265 | DenseMap<const AllocaInst *, ASanStackVariableDescription *> AllocaToSVDMap; | |||
| 3266 | for (auto &Desc : SVD) | |||
| 3267 | AllocaToSVDMap[Desc.AI] = &Desc; | |||
| 3268 | ||||
| 3269 | // Update SVD with information from lifetime intrinsics. | |||
| 3270 | for (const auto &APC : StaticAllocaPoisonCallVec) { | |||
| 3271 | assert(APC.InsBefore)((void)0); | |||
| 3272 | assert(APC.AI)((void)0); | |||
| 3273 | assert(ASan.isInterestingAlloca(*APC.AI))((void)0); | |||
| 3274 | assert(APC.AI->isStaticAlloca())((void)0); | |||
| 3275 | ||||
| 3276 | ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI]; | |||
| 3277 | Desc.LifetimeSize = Desc.Size; | |||
| 3278 | if (const DILocation *FnLoc = EntryDebugLocation.get()) { | |||
| 3279 | if (const DILocation *LifetimeLoc = APC.InsBefore->getDebugLoc().get()) { | |||
| 3280 | if (LifetimeLoc->getFile() == FnLoc->getFile()) | |||
| 3281 | if (unsigned Line = LifetimeLoc->getLine()) | |||
| 3282 | Desc.Line = std::min(Desc.Line ? Desc.Line : Line, Line); | |||
| 3283 | } | |||
| 3284 | } | |||
| 3285 | } | |||
| 3286 | ||||
| 3287 | auto DescriptionString = ComputeASanStackFrameDescription(SVD); | |||
| 3288 | LLVM_DEBUG(dbgs() << DescriptionString << " --- " << L.FrameSize << "\n")do { } while (false); | |||
| 3289 | uint64_t LocalStackSize = L.FrameSize; | |||
| 3290 | bool DoStackMalloc = | |||
| 3291 | ASan.UseAfterReturn != AsanDetectStackUseAfterReturnMode::Never && | |||
| 3292 | !ASan.CompileKernel && LocalStackSize <= kMaxStackMallocSize; | |||
| 3293 | bool DoDynamicAlloca = ClDynamicAllocaStack; | |||
| 3294 | // Don't do dynamic alloca or stack malloc if: | |||
| 3295 | // 1) There is inline asm: too often it makes assumptions on which registers | |||
| 3296 | // are available. | |||
| 3297 | // 2) There is a returns_twice call (typically setjmp), which is | |||
| 3298 | // optimization-hostile, and doesn't play well with introduced indirect | |||
| 3299 | // register-relative calculation of local variable addresses. | |||
| 3300 | DoDynamicAlloca &= !HasInlineAsm && !HasReturnsTwiceCall; | |||
| 3301 | DoStackMalloc &= !HasInlineAsm && !HasReturnsTwiceCall; | |||
| 3302 | ||||
| 3303 | Value *StaticAlloca = | |||
| 3304 | DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false); | |||
| 3305 | ||||
| 3306 | Value *FakeStack; | |||
| 3307 | Value *LocalStackBase; | |||
| 3308 | Value *LocalStackBaseAlloca; | |||
| 3309 | uint8_t DIExprFlags = DIExpression::ApplyOffset; | |||
| 3310 | ||||
| 3311 | if (DoStackMalloc) { | |||
| 3312 | LocalStackBaseAlloca = | |||
| 3313 | IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base"); | |||
| 3314 | if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) { | |||
| 3315 | // void *FakeStack = __asan_option_detect_stack_use_after_return | |||
| 3316 | // ? __asan_stack_malloc_N(LocalStackSize) | |||
| 3317 | // : nullptr; | |||
| 3318 | // void *LocalStackBase = (FakeStack) ? FakeStack : | |||
| 3319 | // alloca(LocalStackSize); | |||
| 3320 | Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal( | |||
| 3321 | kAsanOptionDetectUseAfterReturn, IRB.getInt32Ty()); | |||
| 3322 | Value *UseAfterReturnIsEnabled = IRB.CreateICmpNE( | |||
| 3323 | IRB.CreateLoad(IRB.getInt32Ty(), OptionDetectUseAfterReturn), | |||
| 3324 | Constant::getNullValue(IRB.getInt32Ty())); | |||
| 3325 | Instruction *Term = | |||
| 3326 | SplitBlockAndInsertIfThen(UseAfterReturnIsEnabled, InsBefore, false); | |||
| 3327 | IRBuilder<> IRBIf(Term); | |||
| 3328 | StackMallocIdx = StackMallocSizeClass(LocalStackSize); | |||
| 3329 | assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass)((void)0); | |||
| 3330 | Value *FakeStackValue = | |||
| 3331 | IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx], | |||
| 3332 | ConstantInt::get(IntptrTy, LocalStackSize)); | |||
| 3333 | IRB.SetInsertPoint(InsBefore); | |||
| 3334 | FakeStack = createPHI(IRB, UseAfterReturnIsEnabled, FakeStackValue, Term, | |||
| 3335 | ConstantInt::get(IntptrTy, 0)); | |||
| 3336 | } else { | |||
| 3337 | // assert(ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode:Always) | |||
| 3338 | // void *FakeStack = __asan_stack_malloc_N(LocalStackSize); | |||
| 3339 | // void *LocalStackBase = (FakeStack) ? FakeStack : | |||
| 3340 | // alloca(LocalStackSize); | |||
| 3341 | StackMallocIdx = StackMallocSizeClass(LocalStackSize); | |||
| 3342 | FakeStack = IRB.CreateCall(AsanStackMallocFunc[StackMallocIdx], | |||
| 3343 | ConstantInt::get(IntptrTy, LocalStackSize)); | |||
| 3344 | } | |||
| 3345 | Value *NoFakeStack = | |||
| 3346 | IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy)); | |||
| 3347 | Instruction *Term = | |||
| 3348 | SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false); | |||
| 3349 | IRBuilder<> IRBIf(Term); | |||
| 3350 | Value *AllocaValue = | |||
| 3351 | DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca; | |||
| 3352 | ||||
| 3353 | IRB.SetInsertPoint(InsBefore); | |||
| 3354 | LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack); | |||
| 3355 | IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca); | |||
| 3356 | DIExprFlags |= DIExpression::DerefBefore; | |||
| 3357 | } else { | |||
| 3358 | // void *FakeStack = nullptr; | |||
| 3359 | // void *LocalStackBase = alloca(LocalStackSize); | |||
| 3360 | FakeStack = ConstantInt::get(IntptrTy, 0); | |||
| 3361 | LocalStackBase = | |||
| 3362 | DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca; | |||
| 3363 | LocalStackBaseAlloca = LocalStackBase; | |||
| 3364 | } | |||
| 3365 | ||||
| 3366 | // It shouldn't matter whether we pass an `alloca` or a `ptrtoint` as the | |||
| 3367 | // dbg.declare address opereand, but passing a `ptrtoint` seems to confuse | |||
| 3368 | // later passes and can result in dropped variable coverage in debug info. | |||
| 3369 | Value *LocalStackBaseAllocaPtr = | |||
| 3370 | isa<PtrToIntInst>(LocalStackBaseAlloca) | |||
| 3371 | ? cast<PtrToIntInst>(LocalStackBaseAlloca)->getPointerOperand() | |||
| 3372 | : LocalStackBaseAlloca; | |||
| 3373 | assert(isa<AllocaInst>(LocalStackBaseAllocaPtr) &&((void)0) | |||
| 3374 | "Variable descriptions relative to ASan stack base will be dropped")((void)0); | |||
| 3375 | ||||
| 3376 | // Replace Alloca instructions with base+offset. | |||
| 3377 | for (const auto &Desc : SVD) { | |||
| 3378 | AllocaInst *AI = Desc.AI; | |||
| 3379 | replaceDbgDeclare(AI, LocalStackBaseAllocaPtr, DIB, DIExprFlags, | |||
| 3380 | Desc.Offset); | |||
| 3381 | Value *NewAllocaPtr = IRB.CreateIntToPtr( | |||
| 3382 | IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)), | |||
| 3383 | AI->getType()); | |||
| 3384 | AI->replaceAllUsesWith(NewAllocaPtr); | |||
| 3385 | } | |||
| 3386 | ||||
| 3387 | // The left-most redzone has enough space for at least 4 pointers. | |||
| 3388 | // Write the Magic value to redzone[0]. | |||
| 3389 | Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); | |||
| 3390 | IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), | |||
| 3391 | BasePlus0); | |||
| 3392 | // Write the frame description constant to redzone[1]. | |||
| 3393 | Value *BasePlus1 = IRB.CreateIntToPtr( | |||
| 3394 | IRB.CreateAdd(LocalStackBase, | |||
| 3395 | ConstantInt::get(IntptrTy, ASan.LongSize / 8)), | |||
| 3396 | IntptrPtrTy); | |||
| 3397 | GlobalVariable *StackDescriptionGlobal = | |||
| 3398 | createPrivateGlobalForString(*F.getParent(), DescriptionString, | |||
| 3399 | /*AllowMerging*/ true, kAsanGenPrefix); | |||
| 3400 | Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy); | |||
| 3401 | IRB.CreateStore(Description, BasePlus1); | |||
| 3402 | // Write the PC to redzone[2]. | |||
| 3403 | Value *BasePlus2 = IRB.CreateIntToPtr( | |||
| 3404 | IRB.CreateAdd(LocalStackBase, | |||
| 3405 | ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)), | |||
| 3406 | IntptrPtrTy); | |||
| 3407 | IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2); | |||
| 3408 | ||||
| 3409 | const auto &ShadowAfterScope = GetShadowBytesAfterScope(SVD, L); | |||
| 3410 | ||||
| 3411 | // Poison the stack red zones at the entry. | |||
| 3412 | Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB); | |||
| 3413 | // As mask we must use most poisoned case: red zones and after scope. | |||
| 3414 | // As bytes we can use either the same or just red zones only. | |||
| 3415 | copyToShadow(ShadowAfterScope, ShadowAfterScope, IRB, ShadowBase); | |||
| 3416 | ||||
| 3417 | if (!StaticAllocaPoisonCallVec.empty()) { | |||
| 3418 | const auto &ShadowInScope = GetShadowBytes(SVD, L); | |||
| 3419 | ||||
| 3420 | // Poison static allocas near lifetime intrinsics. | |||
| 3421 | for (const auto &APC : StaticAllocaPoisonCallVec) { | |||
| 3422 | const ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI]; | |||
| 3423 | assert(Desc.Offset % L.Granularity == 0)((void)0); | |||
| 3424 | size_t Begin = Desc.Offset / L.Granularity; | |||
| 3425 | size_t End = Begin + (APC.Size + L.Granularity - 1) / L.Granularity; | |||
| 3426 | ||||
| 3427 | IRBuilder<> IRB(APC.InsBefore); | |||
| 3428 | copyToShadow(ShadowAfterScope, | |||
| 3429 | APC.DoPoison ? ShadowAfterScope : ShadowInScope, Begin, End, | |||
| 3430 | IRB, ShadowBase); | |||
| 3431 | } | |||
| 3432 | } | |||
| 3433 | ||||
| 3434 | SmallVector<uint8_t, 64> ShadowClean(ShadowAfterScope.size(), 0); | |||
| 3435 | SmallVector<uint8_t, 64> ShadowAfterReturn; | |||
| 3436 | ||||
| 3437 | // (Un)poison the stack before all ret instructions. | |||
| 3438 | for (Instruction *Ret : RetVec) { | |||
| 3439 | IRBuilder<> IRBRet(Ret); | |||
| 3440 | // Mark the current frame as retired. | |||
| 3441 | IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), | |||
| 3442 | BasePlus0); | |||
| 3443 | if (DoStackMalloc) { | |||
| 3444 | assert(StackMallocIdx >= 0)((void)0); | |||
| 3445 | // if FakeStack != 0 // LocalStackBase == FakeStack | |||
| 3446 | // // In use-after-return mode, poison the whole stack frame. | |||
| 3447 | // if StackMallocIdx <= 4 | |||
| 3448 | // // For small sizes inline the whole thing: | |||
| 3449 | // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize); | |||
| 3450 | // **SavedFlagPtr(FakeStack) = 0 | |||
| 3451 | // else | |||
| 3452 | // __asan_stack_free_N(FakeStack, LocalStackSize) | |||
| 3453 | // else | |||
| 3454 | // <This is not a fake stack; unpoison the redzones> | |||
| 3455 | Value *Cmp = | |||
| 3456 | IRBRet.CreateICmpNE(FakeStack, Constant::getNullValue(IntptrTy)); | |||
| 3457 | Instruction *ThenTerm, *ElseTerm; | |||
| 3458 | SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm); | |||
| 3459 | ||||
| 3460 | IRBuilder<> IRBPoison(ThenTerm); | |||
| 3461 | if (StackMallocIdx <= 4) { | |||
| 3462 | int ClassSize = kMinStackMallocSize << StackMallocIdx; | |||
| 3463 | ShadowAfterReturn.resize(ClassSize / L.Granularity, | |||
| 3464 | kAsanStackUseAfterReturnMagic); | |||
| 3465 | copyToShadow(ShadowAfterReturn, ShadowAfterReturn, IRBPoison, | |||
| 3466 | ShadowBase); | |||
| 3467 | Value *SavedFlagPtrPtr = IRBPoison.CreateAdd( | |||
| 3468 | FakeStack, | |||
| 3469 | ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8)); | |||
| 3470 | Value *SavedFlagPtr = IRBPoison.CreateLoad( | |||
| 3471 | IntptrTy, IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy)); | |||
| 3472 | IRBPoison.CreateStore( | |||
| 3473 | Constant::getNullValue(IRBPoison.getInt8Ty()), | |||
| 3474 | IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy())); | |||
| 3475 | } else { | |||
| 3476 | // For larger frames call __asan_stack_free_*. | |||
| 3477 | IRBPoison.CreateCall( | |||
| 3478 | AsanStackFreeFunc[StackMallocIdx], | |||
| 3479 | {FakeStack, ConstantInt::get(IntptrTy, LocalStackSize)}); | |||
| 3480 | } | |||
| 3481 | ||||
| 3482 | IRBuilder<> IRBElse(ElseTerm); | |||
| 3483 | copyToShadow(ShadowAfterScope, ShadowClean, IRBElse, ShadowBase); | |||
| 3484 | } else { | |||
| 3485 | copyToShadow(ShadowAfterScope, ShadowClean, IRBRet, ShadowBase); | |||
| 3486 | } | |||
| 3487 | } | |||
| 3488 | ||||
| 3489 | // We are done. Remove the old unused alloca instructions. | |||
| 3490 | for (auto AI : AllocaVec) AI->eraseFromParent(); | |||
| 3491 | } | |||
| 3492 | ||||
| 3493 | void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size, | |||
| 3494 | IRBuilder<> &IRB, bool DoPoison) { | |||
| 3495 | // For now just insert the call to ASan runtime. | |||
| 3496 | Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy); | |||
| 3497 | Value *SizeArg = ConstantInt::get(IntptrTy, Size); | |||
| 3498 | IRB.CreateCall( | |||
| 3499 | DoPoison ? AsanPoisonStackMemoryFunc : AsanUnpoisonStackMemoryFunc, | |||
| 3500 | {AddrArg, SizeArg}); | |||
| 3501 | } | |||
| 3502 | ||||
| 3503 | // Handling llvm.lifetime intrinsics for a given %alloca: | |||
| 3504 | // (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca. | |||
| 3505 | // (2) if %size is constant, poison memory for llvm.lifetime.end (to detect | |||
| 3506 | // invalid accesses) and unpoison it for llvm.lifetime.start (the memory | |||
| 3507 | // could be poisoned by previous llvm.lifetime.end instruction, as the | |||
| 3508 | // variable may go in and out of scope several times, e.g. in loops). | |||
| 3509 | // (3) if we poisoned at least one %alloca in a function, | |||
| 3510 | // unpoison the whole stack frame at function exit. | |||
| 3511 | void FunctionStackPoisoner::handleDynamicAllocaCall(AllocaInst *AI) { | |||
| 3512 | IRBuilder<> IRB(AI); | |||
| 3513 | ||||
| 3514 | const unsigned Alignment = std::max(kAllocaRzSize, AI->getAlignment()); | |||
| 3515 | const uint64_t AllocaRedzoneMask = kAllocaRzSize - 1; | |||
| 3516 | ||||
| 3517 | Value *Zero = Constant::getNullValue(IntptrTy); | |||
| 3518 | Value *AllocaRzSize = ConstantInt::get(IntptrTy, kAllocaRzSize); | |||
| 3519 | Value *AllocaRzMask = ConstantInt::get(IntptrTy, AllocaRedzoneMask); | |||
| 3520 | ||||
| 3521 | // Since we need to extend alloca with additional memory to locate | |||
| 3522 | // redzones, and OldSize is number of allocated blocks with | |||
| 3523 | // ElementSize size, get allocated memory size in bytes by | |||
| 3524 | // OldSize * ElementSize. | |||
| 3525 | const unsigned ElementSize = | |||
| 3526 | F.getParent()->getDataLayout().getTypeAllocSize(AI->getAllocatedType()); | |||
| 3527 | Value *OldSize = | |||
| 3528 | IRB.CreateMul(IRB.CreateIntCast(AI->getArraySize(), IntptrTy, false), | |||
| 3529 | ConstantInt::get(IntptrTy, ElementSize)); | |||
| 3530 | ||||
| 3531 | // PartialSize = OldSize % 32 | |||
| 3532 | Value *PartialSize = IRB.CreateAnd(OldSize, AllocaRzMask); | |||
| 3533 | ||||
| 3534 | // Misalign = kAllocaRzSize - PartialSize; | |||
| 3535 | Value *Misalign = IRB.CreateSub(AllocaRzSize, PartialSize); | |||
| 3536 | ||||
| 3537 | // PartialPadding = Misalign != kAllocaRzSize ? Misalign : 0; | |||
| 3538 | Value *Cond = IRB.CreateICmpNE(Misalign, AllocaRzSize); | |||
| 3539 | Value *PartialPadding = IRB.CreateSelect(Cond, Misalign, Zero); | |||
| 3540 | ||||
| 3541 | // AdditionalChunkSize = Alignment + PartialPadding + kAllocaRzSize | |||
| 3542 | // Alignment is added to locate left redzone, PartialPadding for possible | |||
| 3543 | // partial redzone and kAllocaRzSize for right redzone respectively. | |||
| 3544 | Value *AdditionalChunkSize = IRB.CreateAdd( | |||
| 3545 | ConstantInt::get(IntptrTy, Alignment + kAllocaRzSize), PartialPadding); | |||
| 3546 | ||||
| 3547 | Value *NewSize = IRB.CreateAdd(OldSize, AdditionalChunkSize); | |||
| 3548 | ||||
| 3549 | // Insert new alloca with new NewSize and Alignment params. | |||
| 3550 | AllocaInst *NewAlloca = IRB.CreateAlloca(IRB.getInt8Ty(), NewSize); | |||
| 3551 | NewAlloca->setAlignment(Align(Alignment)); | |||
| 3552 | ||||
| 3553 | // NewAddress = Address + Alignment | |||
| 3554 | Value *NewAddress = IRB.CreateAdd(IRB.CreatePtrToInt(NewAlloca, IntptrTy), | |||
| 3555 | ConstantInt::get(IntptrTy, Alignment)); | |||
| 3556 | ||||
| 3557 | // Insert __asan_alloca_poison call for new created alloca. | |||
| 3558 | IRB.CreateCall(AsanAllocaPoisonFunc, {NewAddress, OldSize}); | |||
| 3559 | ||||
| 3560 | // Store the last alloca's address to DynamicAllocaLayout. We'll need this | |||
| 3561 | // for unpoisoning stuff. | |||
| 3562 | IRB.CreateStore(IRB.CreatePtrToInt(NewAlloca, IntptrTy), DynamicAllocaLayout); | |||
| 3563 | ||||
| 3564 | Value *NewAddressPtr = IRB.CreateIntToPtr(NewAddress, AI->getType()); | |||
| 3565 | ||||
| 3566 | // Replace all uses of AddessReturnedByAlloca with NewAddressPtr. | |||
| 3567 | AI->replaceAllUsesWith(NewAddressPtr); | |||
| 3568 | ||||
| 3569 | // We are done. Erase old alloca from parent. | |||
| 3570 | AI->eraseFromParent(); | |||
| 3571 | } | |||
| 3572 | ||||
| 3573 | // isSafeAccess returns true if Addr is always inbounds with respect to its | |||
| 3574 | // base object. For example, it is a field access or an array access with | |||
| 3575 | // constant inbounds index. | |||
| 3576 | bool AddressSanitizer::isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, | |||
| 3577 | Value *Addr, uint64_t TypeSize) const { | |||
| 3578 | SizeOffsetType SizeOffset = ObjSizeVis.compute(Addr); | |||
| 3579 | if (!ObjSizeVis.bothKnown(SizeOffset)) return false; | |||
| 3580 | uint64_t Size = SizeOffset.first.getZExtValue(); | |||
| 3581 | int64_t Offset = SizeOffset.second.getSExtValue(); | |||
| 3582 | // Three checks are required to ensure safety: | |||
| 3583 | // . Offset >= 0 (since the offset is given from the base ptr) | |||
| 3584 | // . Size >= Offset (unsigned) | |||
| 3585 | // . Size - Offset >= NeededSize (unsigned) | |||
| 3586 | return Offset >= 0 && Size >= uint64_t(Offset) && | |||
| 3587 | Size - uint64_t(Offset) >= TypeSize / 8; | |||
| 3588 | } |