File: | src/gnu/usr.bin/clang/libLLVM/../../../llvm/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp |
Warning: | line 638, column 19 Called C++ object pointer is null |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
1 | //===- AddressSanitizer.cpp - memory error detector -----------------------===// | |||
2 | // | |||
3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. | |||
4 | // See https://llvm.org/LICENSE.txt for license information. | |||
5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception | |||
6 | // | |||
7 | //===----------------------------------------------------------------------===// | |||
8 | // | |||
9 | // This file is a part of AddressSanitizer, an address sanity checker. | |||
10 | // Details of the algorithm: | |||
11 | // https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm | |||
12 | // | |||
13 | // FIXME: This sanitizer does not yet handle scalable vectors | |||
14 | // | |||
15 | //===----------------------------------------------------------------------===// | |||
16 | ||||
17 | #include "llvm/Transforms/Instrumentation/AddressSanitizer.h" | |||
18 | #include "llvm/ADT/ArrayRef.h" | |||
19 | #include "llvm/ADT/DenseMap.h" | |||
20 | #include "llvm/ADT/DepthFirstIterator.h" | |||
21 | #include "llvm/ADT/SmallPtrSet.h" | |||
22 | #include "llvm/ADT/SmallVector.h" | |||
23 | #include "llvm/ADT/Statistic.h" | |||
24 | #include "llvm/ADT/StringExtras.h" | |||
25 | #include "llvm/ADT/StringRef.h" | |||
26 | #include "llvm/ADT/Triple.h" | |||
27 | #include "llvm/ADT/Twine.h" | |||
28 | #include "llvm/Analysis/MemoryBuiltins.h" | |||
29 | #include "llvm/Analysis/TargetLibraryInfo.h" | |||
30 | #include "llvm/Analysis/ValueTracking.h" | |||
31 | #include "llvm/BinaryFormat/MachO.h" | |||
32 | #include "llvm/IR/Argument.h" | |||
33 | #include "llvm/IR/Attributes.h" | |||
34 | #include "llvm/IR/BasicBlock.h" | |||
35 | #include "llvm/IR/Comdat.h" | |||
36 | #include "llvm/IR/Constant.h" | |||
37 | #include "llvm/IR/Constants.h" | |||
38 | #include "llvm/IR/DIBuilder.h" | |||
39 | #include "llvm/IR/DataLayout.h" | |||
40 | #include "llvm/IR/DebugInfoMetadata.h" | |||
41 | #include "llvm/IR/DebugLoc.h" | |||
42 | #include "llvm/IR/DerivedTypes.h" | |||
43 | #include "llvm/IR/Dominators.h" | |||
44 | #include "llvm/IR/Function.h" | |||
45 | #include "llvm/IR/GlobalAlias.h" | |||
46 | #include "llvm/IR/GlobalValue.h" | |||
47 | #include "llvm/IR/GlobalVariable.h" | |||
48 | #include "llvm/IR/IRBuilder.h" | |||
49 | #include "llvm/IR/InlineAsm.h" | |||
50 | #include "llvm/IR/InstVisitor.h" | |||
51 | #include "llvm/IR/InstrTypes.h" | |||
52 | #include "llvm/IR/Instruction.h" | |||
53 | #include "llvm/IR/Instructions.h" | |||
54 | #include "llvm/IR/IntrinsicInst.h" | |||
55 | #include "llvm/IR/Intrinsics.h" | |||
56 | #include "llvm/IR/LLVMContext.h" | |||
57 | #include "llvm/IR/MDBuilder.h" | |||
58 | #include "llvm/IR/Metadata.h" | |||
59 | #include "llvm/IR/Module.h" | |||
60 | #include "llvm/IR/Type.h" | |||
61 | #include "llvm/IR/Use.h" | |||
62 | #include "llvm/IR/Value.h" | |||
63 | #include "llvm/InitializePasses.h" | |||
64 | #include "llvm/MC/MCSectionMachO.h" | |||
65 | #include "llvm/Pass.h" | |||
66 | #include "llvm/Support/Casting.h" | |||
67 | #include "llvm/Support/CommandLine.h" | |||
68 | #include "llvm/Support/Debug.h" | |||
69 | #include "llvm/Support/ErrorHandling.h" | |||
70 | #include "llvm/Support/MathExtras.h" | |||
71 | #include "llvm/Support/ScopedPrinter.h" | |||
72 | #include "llvm/Support/raw_ostream.h" | |||
73 | #include "llvm/Transforms/Instrumentation.h" | |||
74 | #include "llvm/Transforms/Instrumentation/AddressSanitizerCommon.h" | |||
75 | #include "llvm/Transforms/Instrumentation/AddressSanitizerOptions.h" | |||
76 | #include "llvm/Transforms/Utils/ASanStackFrameLayout.h" | |||
77 | #include "llvm/Transforms/Utils/BasicBlockUtils.h" | |||
78 | #include "llvm/Transforms/Utils/Local.h" | |||
79 | #include "llvm/Transforms/Utils/ModuleUtils.h" | |||
80 | #include "llvm/Transforms/Utils/PromoteMemToReg.h" | |||
81 | #include <algorithm> | |||
82 | #include <cassert> | |||
83 | #include <cstddef> | |||
84 | #include <cstdint> | |||
85 | #include <iomanip> | |||
86 | #include <limits> | |||
87 | #include <memory> | |||
88 | #include <sstream> | |||
89 | #include <string> | |||
90 | #include <tuple> | |||
91 | ||||
92 | using namespace llvm; | |||
93 | ||||
94 | #define DEBUG_TYPE"asan" "asan" | |||
95 | ||||
96 | static const uint64_t kDefaultShadowScale = 3; | |||
97 | static const uint64_t kDefaultShadowOffset32 = 1ULL << 29; | |||
98 | static const uint64_t kDefaultShadowOffset64 = 1ULL << 44; | |||
99 | static const uint64_t kDynamicShadowSentinel = | |||
100 | std::numeric_limits<uint64_t>::max(); | |||
101 | static const uint64_t kSmallX86_64ShadowOffsetBase = 0x7FFFFFFF; // < 2G. | |||
102 | static const uint64_t kSmallX86_64ShadowOffsetAlignMask = ~0xFFFULL; | |||
103 | static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000; | |||
104 | static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 44; | |||
105 | static const uint64_t kSystemZ_ShadowOffset64 = 1ULL << 52; | |||
106 | static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000; | |||
107 | static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37; | |||
108 | static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36; | |||
109 | static const uint64_t kRISCV64_ShadowOffset64 = 0xd55550000; | |||
110 | static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30; | |||
111 | static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46; | |||
112 | static const uint64_t kFreeBSDKasan_ShadowOffset64 = 0xdffff7c000000000; | |||
113 | static const uint64_t kNetBSD_ShadowOffset32 = 1ULL << 30; | |||
114 | static const uint64_t kNetBSD_ShadowOffset64 = 1ULL << 46; | |||
115 | static const uint64_t kNetBSDKasan_ShadowOffset64 = 0xdfff900000000000; | |||
116 | static const uint64_t kPS4CPU_ShadowOffset64 = 1ULL << 40; | |||
117 | static const uint64_t kWindowsShadowOffset32 = 3ULL << 28; | |||
118 | static const uint64_t kEmscriptenShadowOffset = 0; | |||
119 | ||||
120 | // The shadow memory space is dynamically allocated. | |||
121 | static const uint64_t kWindowsShadowOffset64 = kDynamicShadowSentinel; | |||
122 | ||||
123 | static const size_t kMinStackMallocSize = 1 << 6; // 64B | |||
124 | static const size_t kMaxStackMallocSize = 1 << 16; // 64K | |||
125 | static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; | |||
126 | static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; | |||
127 | ||||
128 | const char kAsanModuleCtorName[] = "asan.module_ctor"; | |||
129 | const char kAsanModuleDtorName[] = "asan.module_dtor"; | |||
130 | static const uint64_t kAsanCtorAndDtorPriority = 1; | |||
131 | // On Emscripten, the system needs more than one priorities for constructors. | |||
132 | static const uint64_t kAsanEmscriptenCtorAndDtorPriority = 50; | |||
133 | const char kAsanReportErrorTemplate[] = "__asan_report_"; | |||
134 | const char kAsanRegisterGlobalsName[] = "__asan_register_globals"; | |||
135 | const char kAsanUnregisterGlobalsName[] = "__asan_unregister_globals"; | |||
136 | const char kAsanRegisterImageGlobalsName[] = "__asan_register_image_globals"; | |||
137 | const char kAsanUnregisterImageGlobalsName[] = | |||
138 | "__asan_unregister_image_globals"; | |||
139 | const char kAsanRegisterElfGlobalsName[] = "__asan_register_elf_globals"; | |||
140 | const char kAsanUnregisterElfGlobalsName[] = "__asan_unregister_elf_globals"; | |||
141 | const char kAsanPoisonGlobalsName[] = "__asan_before_dynamic_init"; | |||
142 | const char kAsanUnpoisonGlobalsName[] = "__asan_after_dynamic_init"; | |||
143 | const char kAsanInitName[] = "__asan_init"; | |||
144 | const char kAsanVersionCheckNamePrefix[] = "__asan_version_mismatch_check_v"; | |||
145 | const char kAsanPtrCmp[] = "__sanitizer_ptr_cmp"; | |||
146 | const char kAsanPtrSub[] = "__sanitizer_ptr_sub"; | |||
147 | const char kAsanHandleNoReturnName[] = "__asan_handle_no_return"; | |||
148 | static const int kMaxAsanStackMallocSizeClass = 10; | |||
149 | const char kAsanStackMallocNameTemplate[] = "__asan_stack_malloc_"; | |||
150 | const char kAsanStackMallocAlwaysNameTemplate[] = | |||
151 | "__asan_stack_malloc_always_"; | |||
152 | const char kAsanStackFreeNameTemplate[] = "__asan_stack_free_"; | |||
153 | const char kAsanGenPrefix[] = "___asan_gen_"; | |||
154 | const char kODRGenPrefix[] = "__odr_asan_gen_"; | |||
155 | const char kSanCovGenPrefix[] = "__sancov_gen_"; | |||
156 | const char kAsanSetShadowPrefix[] = "__asan_set_shadow_"; | |||
157 | const char kAsanPoisonStackMemoryName[] = "__asan_poison_stack_memory"; | |||
158 | const char kAsanUnpoisonStackMemoryName[] = "__asan_unpoison_stack_memory"; | |||
159 | ||||
160 | // ASan version script has __asan_* wildcard. Triple underscore prevents a | |||
161 | // linker (gold) warning about attempting to export a local symbol. | |||
162 | const char kAsanGlobalsRegisteredFlagName[] = "___asan_globals_registered"; | |||
163 | ||||
164 | const char kAsanOptionDetectUseAfterReturn[] = | |||
165 | "__asan_option_detect_stack_use_after_return"; | |||
166 | ||||
167 | const char kAsanShadowMemoryDynamicAddress[] = | |||
168 | "__asan_shadow_memory_dynamic_address"; | |||
169 | ||||
170 | const char kAsanAllocaPoison[] = "__asan_alloca_poison"; | |||
171 | const char kAsanAllocasUnpoison[] = "__asan_allocas_unpoison"; | |||
172 | ||||
173 | const char kAMDGPUAddressSharedName[] = "llvm.amdgcn.is.shared"; | |||
174 | const char kAMDGPUAddressPrivateName[] = "llvm.amdgcn.is.private"; | |||
175 | ||||
176 | // Accesses sizes are powers of two: 1, 2, 4, 8, 16. | |||
177 | static const size_t kNumberOfAccessSizes = 5; | |||
178 | ||||
179 | static const unsigned kAllocaRzSize = 32; | |||
180 | ||||
181 | // Command-line flags. | |||
182 | ||||
183 | static cl::opt<bool> ClEnableKasan( | |||
184 | "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"), | |||
185 | cl::Hidden, cl::init(false)); | |||
186 | ||||
187 | static cl::opt<bool> ClRecover( | |||
188 | "asan-recover", | |||
189 | cl::desc("Enable recovery mode (continue-after-error)."), | |||
190 | cl::Hidden, cl::init(false)); | |||
191 | ||||
192 | static cl::opt<bool> ClInsertVersionCheck( | |||
193 | "asan-guard-against-version-mismatch", | |||
194 | cl::desc("Guard against compiler/runtime version mismatch."), | |||
195 | cl::Hidden, cl::init(true)); | |||
196 | ||||
197 | // This flag may need to be replaced with -f[no-]asan-reads. | |||
198 | static cl::opt<bool> ClInstrumentReads("asan-instrument-reads", | |||
199 | cl::desc("instrument read instructions"), | |||
200 | cl::Hidden, cl::init(true)); | |||
201 | ||||
202 | static cl::opt<bool> ClInstrumentWrites( | |||
203 | "asan-instrument-writes", cl::desc("instrument write instructions"), | |||
204 | cl::Hidden, cl::init(true)); | |||
205 | ||||
206 | static cl::opt<bool> ClInstrumentAtomics( | |||
207 | "asan-instrument-atomics", | |||
208 | cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, | |||
209 | cl::init(true)); | |||
210 | ||||
211 | static cl::opt<bool> | |||
212 | ClInstrumentByval("asan-instrument-byval", | |||
213 | cl::desc("instrument byval call arguments"), cl::Hidden, | |||
214 | cl::init(true)); | |||
215 | ||||
216 | static cl::opt<bool> ClAlwaysSlowPath( | |||
217 | "asan-always-slow-path", | |||
218 | cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, | |||
219 | cl::init(false)); | |||
220 | ||||
221 | static cl::opt<bool> ClForceDynamicShadow( | |||
222 | "asan-force-dynamic-shadow", | |||
223 | cl::desc("Load shadow address into a local variable for each function"), | |||
224 | cl::Hidden, cl::init(false)); | |||
225 | ||||
226 | static cl::opt<bool> | |||
227 | ClWithIfunc("asan-with-ifunc", | |||
228 | cl::desc("Access dynamic shadow through an ifunc global on " | |||
229 | "platforms that support this"), | |||
230 | cl::Hidden, cl::init(true)); | |||
231 | ||||
232 | static cl::opt<bool> ClWithIfuncSuppressRemat( | |||
233 | "asan-with-ifunc-suppress-remat", | |||
234 | cl::desc("Suppress rematerialization of dynamic shadow address by passing " | |||
235 | "it through inline asm in prologue."), | |||
236 | cl::Hidden, cl::init(true)); | |||
237 | ||||
238 | // This flag limits the number of instructions to be instrumented | |||
239 | // in any given BB. Normally, this should be set to unlimited (INT_MAX), | |||
240 | // but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary | |||
241 | // set it to 10000. | |||
242 | static cl::opt<int> ClMaxInsnsToInstrumentPerBB( | |||
243 | "asan-max-ins-per-bb", cl::init(10000), | |||
244 | cl::desc("maximal number of instructions to instrument in any given BB"), | |||
245 | cl::Hidden); | |||
246 | ||||
247 | // This flag may need to be replaced with -f[no]asan-stack. | |||
248 | static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"), | |||
249 | cl::Hidden, cl::init(true)); | |||
250 | static cl::opt<uint32_t> ClMaxInlinePoisoningSize( | |||
251 | "asan-max-inline-poisoning-size", | |||
252 | cl::desc( | |||
253 | "Inline shadow poisoning for blocks up to the given size in bytes."), | |||
254 | cl::Hidden, cl::init(64)); | |||
255 | ||||
256 | static cl::opt<AsanDetectStackUseAfterReturnMode> ClUseAfterReturn( | |||
257 | "asan-use-after-return", | |||
258 | cl::desc("Sets the mode of detection for stack-use-after-return."), | |||
259 | cl::values( | |||
260 | clEnumValN(AsanDetectStackUseAfterReturnMode::Never, "never",llvm::cl::OptionEnumValue { "never", int(AsanDetectStackUseAfterReturnMode ::Never), "Never detect stack use after return." } | |||
261 | "Never detect stack use after return.")llvm::cl::OptionEnumValue { "never", int(AsanDetectStackUseAfterReturnMode ::Never), "Never detect stack use after return." }, | |||
262 | clEnumValN(llvm::cl::OptionEnumValue { "runtime", int(AsanDetectStackUseAfterReturnMode ::Runtime), "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set." } | |||
263 | AsanDetectStackUseAfterReturnMode::Runtime, "runtime",llvm::cl::OptionEnumValue { "runtime", int(AsanDetectStackUseAfterReturnMode ::Runtime), "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set." } | |||
264 | "Detect stack use after return if "llvm::cl::OptionEnumValue { "runtime", int(AsanDetectStackUseAfterReturnMode ::Runtime), "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set." } | |||
265 | "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set.")llvm::cl::OptionEnumValue { "runtime", int(AsanDetectStackUseAfterReturnMode ::Runtime), "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set." }, | |||
266 | clEnumValN(AsanDetectStackUseAfterReturnMode::Always, "always",llvm::cl::OptionEnumValue { "always", int(AsanDetectStackUseAfterReturnMode ::Always), "Always detect stack use after return." } | |||
267 | "Always detect stack use after return.")llvm::cl::OptionEnumValue { "always", int(AsanDetectStackUseAfterReturnMode ::Always), "Always detect stack use after return." }), | |||
268 | cl::Hidden, cl::init(AsanDetectStackUseAfterReturnMode::Runtime)); | |||
269 | ||||
270 | static cl::opt<bool> ClRedzoneByvalArgs("asan-redzone-byval-args", | |||
271 | cl::desc("Create redzones for byval " | |||
272 | "arguments (extra copy " | |||
273 | "required)"), cl::Hidden, | |||
274 | cl::init(true)); | |||
275 | ||||
276 | static cl::opt<bool> ClUseAfterScope("asan-use-after-scope", | |||
277 | cl::desc("Check stack-use-after-scope"), | |||
278 | cl::Hidden, cl::init(false)); | |||
279 | ||||
280 | // This flag may need to be replaced with -f[no]asan-globals. | |||
281 | static cl::opt<bool> ClGlobals("asan-globals", | |||
282 | cl::desc("Handle global objects"), cl::Hidden, | |||
283 | cl::init(true)); | |||
284 | ||||
285 | static cl::opt<bool> ClInitializers("asan-initialization-order", | |||
286 | cl::desc("Handle C++ initializer order"), | |||
287 | cl::Hidden, cl::init(true)); | |||
288 | ||||
289 | static cl::opt<bool> ClInvalidPointerPairs( | |||
290 | "asan-detect-invalid-pointer-pair", | |||
291 | cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, | |||
292 | cl::init(false)); | |||
293 | ||||
294 | static cl::opt<bool> ClInvalidPointerCmp( | |||
295 | "asan-detect-invalid-pointer-cmp", | |||
296 | cl::desc("Instrument <, <=, >, >= with pointer operands"), cl::Hidden, | |||
297 | cl::init(false)); | |||
298 | ||||
299 | static cl::opt<bool> ClInvalidPointerSub( | |||
300 | "asan-detect-invalid-pointer-sub", | |||
301 | cl::desc("Instrument - operations with pointer operands"), cl::Hidden, | |||
302 | cl::init(false)); | |||
303 | ||||
304 | static cl::opt<unsigned> ClRealignStack( | |||
305 | "asan-realign-stack", | |||
306 | cl::desc("Realign stack to the value of this flag (power of two)"), | |||
307 | cl::Hidden, cl::init(32)); | |||
308 | ||||
309 | static cl::opt<int> ClInstrumentationWithCallsThreshold( | |||
310 | "asan-instrumentation-with-call-threshold", | |||
311 | cl::desc( | |||
312 | "If the function being instrumented contains more than " | |||
313 | "this number of memory accesses, use callbacks instead of " | |||
314 | "inline checks (-1 means never use callbacks)."), | |||
315 | cl::Hidden, cl::init(7000)); | |||
316 | ||||
317 | static cl::opt<std::string> ClMemoryAccessCallbackPrefix( | |||
318 | "asan-memory-access-callback-prefix", | |||
319 | cl::desc("Prefix for memory access callbacks"), cl::Hidden, | |||
320 | cl::init("__asan_")); | |||
321 | ||||
322 | static cl::opt<bool> | |||
323 | ClInstrumentDynamicAllocas("asan-instrument-dynamic-allocas", | |||
324 | cl::desc("instrument dynamic allocas"), | |||
325 | cl::Hidden, cl::init(true)); | |||
326 | ||||
327 | static cl::opt<bool> ClSkipPromotableAllocas( | |||
328 | "asan-skip-promotable-allocas", | |||
329 | cl::desc("Do not instrument promotable allocas"), cl::Hidden, | |||
330 | cl::init(true)); | |||
331 | ||||
332 | // These flags allow to change the shadow mapping. | |||
333 | // The shadow mapping looks like | |||
334 | // Shadow = (Mem >> scale) + offset | |||
335 | ||||
336 | static cl::opt<int> ClMappingScale("asan-mapping-scale", | |||
337 | cl::desc("scale of asan shadow mapping"), | |||
338 | cl::Hidden, cl::init(0)); | |||
339 | ||||
340 | static cl::opt<uint64_t> | |||
341 | ClMappingOffset("asan-mapping-offset", | |||
342 | cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"), | |||
343 | cl::Hidden, cl::init(0)); | |||
344 | ||||
345 | // Optimization flags. Not user visible, used mostly for testing | |||
346 | // and benchmarking the tool. | |||
347 | ||||
348 | static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"), | |||
349 | cl::Hidden, cl::init(true)); | |||
350 | ||||
351 | static cl::opt<bool> ClOptSameTemp( | |||
352 | "asan-opt-same-temp", cl::desc("Instrument the same temp just once"), | |||
353 | cl::Hidden, cl::init(true)); | |||
354 | ||||
355 | static cl::opt<bool> ClOptGlobals("asan-opt-globals", | |||
356 | cl::desc("Don't instrument scalar globals"), | |||
357 | cl::Hidden, cl::init(true)); | |||
358 | ||||
359 | static cl::opt<bool> ClOptStack( | |||
360 | "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), | |||
361 | cl::Hidden, cl::init(false)); | |||
362 | ||||
363 | static cl::opt<bool> ClDynamicAllocaStack( | |||
364 | "asan-stack-dynamic-alloca", | |||
365 | cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, | |||
366 | cl::init(true)); | |||
367 | ||||
368 | static cl::opt<uint32_t> ClForceExperiment( | |||
369 | "asan-force-experiment", | |||
370 | cl::desc("Force optimization experiment (for testing)"), cl::Hidden, | |||
371 | cl::init(0)); | |||
372 | ||||
373 | static cl::opt<bool> | |||
374 | ClUsePrivateAlias("asan-use-private-alias", | |||
375 | cl::desc("Use private aliases for global variables"), | |||
376 | cl::Hidden, cl::init(false)); | |||
377 | ||||
378 | static cl::opt<bool> | |||
379 | ClUseOdrIndicator("asan-use-odr-indicator", | |||
380 | cl::desc("Use odr indicators to improve ODR reporting"), | |||
381 | cl::Hidden, cl::init(false)); | |||
382 | ||||
383 | static cl::opt<bool> | |||
384 | ClUseGlobalsGC("asan-globals-live-support", | |||
385 | cl::desc("Use linker features to support dead " | |||
386 | "code stripping of globals"), | |||
387 | cl::Hidden, cl::init(true)); | |||
388 | ||||
389 | // This is on by default even though there is a bug in gold: | |||
390 | // https://sourceware.org/bugzilla/show_bug.cgi?id=19002 | |||
391 | static cl::opt<bool> | |||
392 | ClWithComdat("asan-with-comdat", | |||
393 | cl::desc("Place ASan constructors in comdat sections"), | |||
394 | cl::Hidden, cl::init(true)); | |||
395 | ||||
396 | static cl::opt<AsanDtorKind> ClOverrideDestructorKind( | |||
397 | "asan-destructor-kind", | |||
398 | cl::desc("Sets the ASan destructor kind. The default is to use the value " | |||
399 | "provided to the pass constructor"), | |||
400 | cl::values(clEnumValN(AsanDtorKind::None, "none", "No destructors")llvm::cl::OptionEnumValue { "none", int(AsanDtorKind::None), "No destructors" }, | |||
401 | clEnumValN(AsanDtorKind::Global, "global",llvm::cl::OptionEnumValue { "global", int(AsanDtorKind::Global ), "Use global destructors" } | |||
402 | "Use global destructors")llvm::cl::OptionEnumValue { "global", int(AsanDtorKind::Global ), "Use global destructors" }), | |||
403 | cl::init(AsanDtorKind::Invalid), cl::Hidden); | |||
404 | ||||
405 | // Debug flags. | |||
406 | ||||
407 | static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, | |||
408 | cl::init(0)); | |||
409 | ||||
410 | static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), | |||
411 | cl::Hidden, cl::init(0)); | |||
412 | ||||
413 | static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden, | |||
414 | cl::desc("Debug func")); | |||
415 | ||||
416 | static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), | |||
417 | cl::Hidden, cl::init(-1)); | |||
418 | ||||
419 | static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug max inst"), | |||
420 | cl::Hidden, cl::init(-1)); | |||
421 | ||||
422 | STATISTIC(NumInstrumentedReads, "Number of instrumented reads")static llvm::Statistic NumInstrumentedReads = {"asan", "NumInstrumentedReads" , "Number of instrumented reads"}; | |||
423 | STATISTIC(NumInstrumentedWrites, "Number of instrumented writes")static llvm::Statistic NumInstrumentedWrites = {"asan", "NumInstrumentedWrites" , "Number of instrumented writes"}; | |||
424 | STATISTIC(NumOptimizedAccessesToGlobalVar,static llvm::Statistic NumOptimizedAccessesToGlobalVar = {"asan" , "NumOptimizedAccessesToGlobalVar", "Number of optimized accesses to global vars" } | |||
425 | "Number of optimized accesses to global vars")static llvm::Statistic NumOptimizedAccessesToGlobalVar = {"asan" , "NumOptimizedAccessesToGlobalVar", "Number of optimized accesses to global vars" }; | |||
426 | STATISTIC(NumOptimizedAccessesToStackVar,static llvm::Statistic NumOptimizedAccessesToStackVar = {"asan" , "NumOptimizedAccessesToStackVar", "Number of optimized accesses to stack vars" } | |||
427 | "Number of optimized accesses to stack vars")static llvm::Statistic NumOptimizedAccessesToStackVar = {"asan" , "NumOptimizedAccessesToStackVar", "Number of optimized accesses to stack vars" }; | |||
428 | ||||
429 | namespace { | |||
430 | ||||
431 | /// This struct defines the shadow mapping using the rule: | |||
432 | /// shadow = (mem >> Scale) ADD-or-OR Offset. | |||
433 | /// If InGlobal is true, then | |||
434 | /// extern char __asan_shadow[]; | |||
435 | /// shadow = (mem >> Scale) + &__asan_shadow | |||
436 | struct ShadowMapping { | |||
437 | int Scale; | |||
438 | uint64_t Offset; | |||
439 | bool OrShadowOffset; | |||
440 | bool InGlobal; | |||
441 | }; | |||
442 | ||||
443 | } // end anonymous namespace | |||
444 | ||||
445 | static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize, | |||
446 | bool IsKasan) { | |||
447 | bool IsAndroid = TargetTriple.isAndroid(); | |||
448 | bool IsIOS = TargetTriple.isiOS() || TargetTriple.isWatchOS(); | |||
449 | bool IsMacOS = TargetTriple.isMacOSX(); | |||
450 | bool IsFreeBSD = TargetTriple.isOSFreeBSD(); | |||
451 | bool IsNetBSD = TargetTriple.isOSNetBSD(); | |||
452 | bool IsPS4CPU = TargetTriple.isPS4CPU(); | |||
453 | bool IsLinux = TargetTriple.isOSLinux(); | |||
454 | bool IsPPC64 = TargetTriple.getArch() == Triple::ppc64 || | |||
455 | TargetTriple.getArch() == Triple::ppc64le; | |||
456 | bool IsSystemZ = TargetTriple.getArch() == Triple::systemz; | |||
457 | bool IsX86_64 = TargetTriple.getArch() == Triple::x86_64; | |||
458 | bool IsMIPS32 = TargetTriple.isMIPS32(); | |||
459 | bool IsMIPS64 = TargetTriple.isMIPS64(); | |||
460 | bool IsArmOrThumb = TargetTriple.isARM() || TargetTriple.isThumb(); | |||
461 | bool IsAArch64 = TargetTriple.getArch() == Triple::aarch64; | |||
462 | bool IsRISCV64 = TargetTriple.getArch() == Triple::riscv64; | |||
463 | bool IsWindows = TargetTriple.isOSWindows(); | |||
464 | bool IsFuchsia = TargetTriple.isOSFuchsia(); | |||
465 | bool IsEmscripten = TargetTriple.isOSEmscripten(); | |||
466 | bool IsAMDGPU = TargetTriple.isAMDGPU(); | |||
467 | ||||
468 | ShadowMapping Mapping; | |||
469 | ||||
470 | Mapping.Scale = kDefaultShadowScale; | |||
471 | if (ClMappingScale.getNumOccurrences() > 0) { | |||
472 | Mapping.Scale = ClMappingScale; | |||
473 | } | |||
474 | ||||
475 | if (LongSize == 32) { | |||
476 | if (IsAndroid) | |||
477 | Mapping.Offset = kDynamicShadowSentinel; | |||
478 | else if (IsMIPS32) | |||
479 | Mapping.Offset = kMIPS32_ShadowOffset32; | |||
480 | else if (IsFreeBSD) | |||
481 | Mapping.Offset = kFreeBSD_ShadowOffset32; | |||
482 | else if (IsNetBSD) | |||
483 | Mapping.Offset = kNetBSD_ShadowOffset32; | |||
484 | else if (IsIOS) | |||
485 | Mapping.Offset = kDynamicShadowSentinel; | |||
486 | else if (IsWindows) | |||
487 | Mapping.Offset = kWindowsShadowOffset32; | |||
488 | else if (IsEmscripten) | |||
489 | Mapping.Offset = kEmscriptenShadowOffset; | |||
490 | else | |||
491 | Mapping.Offset = kDefaultShadowOffset32; | |||
492 | } else { // LongSize == 64 | |||
493 | // Fuchsia is always PIE, which means that the beginning of the address | |||
494 | // space is always available. | |||
495 | if (IsFuchsia) | |||
496 | Mapping.Offset = 0; | |||
497 | else if (IsPPC64) | |||
498 | Mapping.Offset = kPPC64_ShadowOffset64; | |||
499 | else if (IsSystemZ) | |||
500 | Mapping.Offset = kSystemZ_ShadowOffset64; | |||
501 | else if (IsFreeBSD && !IsMIPS64) { | |||
502 | if (IsKasan) | |||
503 | Mapping.Offset = kFreeBSDKasan_ShadowOffset64; | |||
504 | else | |||
505 | Mapping.Offset = kFreeBSD_ShadowOffset64; | |||
506 | } else if (IsNetBSD) { | |||
507 | if (IsKasan) | |||
508 | Mapping.Offset = kNetBSDKasan_ShadowOffset64; | |||
509 | else | |||
510 | Mapping.Offset = kNetBSD_ShadowOffset64; | |||
511 | } else if (IsPS4CPU) | |||
512 | Mapping.Offset = kPS4CPU_ShadowOffset64; | |||
513 | else if (IsLinux && IsX86_64) { | |||
514 | if (IsKasan) | |||
515 | Mapping.Offset = kLinuxKasan_ShadowOffset64; | |||
516 | else | |||
517 | Mapping.Offset = (kSmallX86_64ShadowOffsetBase & | |||
518 | (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale)); | |||
519 | } else if (IsWindows && IsX86_64) { | |||
520 | Mapping.Offset = kWindowsShadowOffset64; | |||
521 | } else if (IsMIPS64) | |||
522 | Mapping.Offset = kMIPS64_ShadowOffset64; | |||
523 | else if (IsIOS) | |||
524 | Mapping.Offset = kDynamicShadowSentinel; | |||
525 | else if (IsMacOS && IsAArch64) | |||
526 | Mapping.Offset = kDynamicShadowSentinel; | |||
527 | else if (IsAArch64) | |||
528 | Mapping.Offset = kAArch64_ShadowOffset64; | |||
529 | else if (IsRISCV64) | |||
530 | Mapping.Offset = kRISCV64_ShadowOffset64; | |||
531 | else if (IsAMDGPU) | |||
532 | Mapping.Offset = (kSmallX86_64ShadowOffsetBase & | |||
533 | (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale)); | |||
534 | else | |||
535 | Mapping.Offset = kDefaultShadowOffset64; | |||
536 | } | |||
537 | ||||
538 | if (ClForceDynamicShadow) { | |||
539 | Mapping.Offset = kDynamicShadowSentinel; | |||
540 | } | |||
541 | ||||
542 | if (ClMappingOffset.getNumOccurrences() > 0) { | |||
543 | Mapping.Offset = ClMappingOffset; | |||
544 | } | |||
545 | ||||
546 | // OR-ing shadow offset if more efficient (at least on x86) if the offset | |||
547 | // is a power of two, but on ppc64 we have to use add since the shadow | |||
548 | // offset is not necessary 1/8-th of the address space. On SystemZ, | |||
549 | // we could OR the constant in a single instruction, but it's more | |||
550 | // efficient to load it once and use indexed addressing. | |||
551 | Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 && !IsSystemZ && !IsPS4CPU && | |||
552 | !IsRISCV64 && | |||
553 | !(Mapping.Offset & (Mapping.Offset - 1)) && | |||
554 | Mapping.Offset != kDynamicShadowSentinel; | |||
555 | bool IsAndroidWithIfuncSupport = | |||
556 | IsAndroid && !TargetTriple.isAndroidVersionLT(21); | |||
557 | Mapping.InGlobal = ClWithIfunc && IsAndroidWithIfuncSupport && IsArmOrThumb; | |||
558 | ||||
559 | return Mapping; | |||
560 | } | |||
561 | ||||
562 | static uint64_t getRedzoneSizeForScale(int MappingScale) { | |||
563 | // Redzone used for stack and globals is at least 32 bytes. | |||
564 | // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. | |||
565 | return std::max(32U, 1U << MappingScale); | |||
566 | } | |||
567 | ||||
568 | static uint64_t GetCtorAndDtorPriority(Triple &TargetTriple) { | |||
569 | if (TargetTriple.isOSEmscripten()) { | |||
570 | return kAsanEmscriptenCtorAndDtorPriority; | |||
571 | } else { | |||
572 | return kAsanCtorAndDtorPriority; | |||
573 | } | |||
574 | } | |||
575 | ||||
576 | namespace { | |||
577 | ||||
578 | /// Module analysis for getting various metadata about the module. | |||
579 | class ASanGlobalsMetadataWrapperPass : public ModulePass { | |||
580 | public: | |||
581 | static char ID; | |||
582 | ||||
583 | ASanGlobalsMetadataWrapperPass() : ModulePass(ID) { | |||
584 | initializeASanGlobalsMetadataWrapperPassPass( | |||
585 | *PassRegistry::getPassRegistry()); | |||
586 | } | |||
587 | ||||
588 | bool runOnModule(Module &M) override { | |||
589 | GlobalsMD = GlobalsMetadata(M); | |||
590 | return false; | |||
591 | } | |||
592 | ||||
593 | StringRef getPassName() const override { | |||
594 | return "ASanGlobalsMetadataWrapperPass"; | |||
595 | } | |||
596 | ||||
597 | void getAnalysisUsage(AnalysisUsage &AU) const override { | |||
598 | AU.setPreservesAll(); | |||
599 | } | |||
600 | ||||
601 | GlobalsMetadata &getGlobalsMD() { return GlobalsMD; } | |||
602 | ||||
603 | private: | |||
604 | GlobalsMetadata GlobalsMD; | |||
605 | }; | |||
606 | ||||
607 | char ASanGlobalsMetadataWrapperPass::ID = 0; | |||
608 | ||||
609 | /// AddressSanitizer: instrument the code in module to find memory bugs. | |||
610 | struct AddressSanitizer { | |||
611 | AddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD, | |||
612 | bool CompileKernel = false, bool Recover = false, | |||
613 | bool UseAfterScope = false, | |||
614 | AsanDetectStackUseAfterReturnMode UseAfterReturn = | |||
615 | AsanDetectStackUseAfterReturnMode::Runtime) | |||
616 | : CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan | |||
617 | : CompileKernel), | |||
618 | Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover), | |||
619 | UseAfterScope(UseAfterScope || ClUseAfterScope), | |||
620 | UseAfterReturn(ClUseAfterReturn.getNumOccurrences() ? ClUseAfterReturn | |||
621 | : UseAfterReturn), | |||
622 | GlobalsMD(*GlobalsMD) { | |||
623 | C = &(M.getContext()); | |||
624 | LongSize = M.getDataLayout().getPointerSizeInBits(); | |||
625 | IntptrTy = Type::getIntNTy(*C, LongSize); | |||
626 | TargetTriple = Triple(M.getTargetTriple()); | |||
627 | ||||
628 | Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel); | |||
629 | ||||
630 | assert(this->UseAfterReturn != AsanDetectStackUseAfterReturnMode::Invalid)((void)0); | |||
631 | } | |||
632 | ||||
633 | uint64_t getAllocaSizeInBytes(const AllocaInst &AI) const { | |||
634 | uint64_t ArraySize = 1; | |||
635 | if (AI.isArrayAllocation()) { | |||
636 | const ConstantInt *CI = dyn_cast<ConstantInt>(AI.getArraySize()); | |||
637 | assert(CI && "non-constant array size")((void)0); | |||
638 | ArraySize = CI->getZExtValue(); | |||
| ||||
639 | } | |||
640 | Type *Ty = AI.getAllocatedType(); | |||
641 | uint64_t SizeInBytes = | |||
642 | AI.getModule()->getDataLayout().getTypeAllocSize(Ty); | |||
643 | return SizeInBytes * ArraySize; | |||
644 | } | |||
645 | ||||
646 | /// Check if we want (and can) handle this alloca. | |||
647 | bool isInterestingAlloca(const AllocaInst &AI); | |||
648 | ||||
649 | bool ignoreAccess(Value *Ptr); | |||
650 | void getInterestingMemoryOperands( | |||
651 | Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting); | |||
652 | ||||
653 | void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, | |||
654 | InterestingMemoryOperand &O, bool UseCalls, | |||
655 | const DataLayout &DL); | |||
656 | void instrumentPointerComparisonOrSubtraction(Instruction *I); | |||
657 | void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore, | |||
658 | Value *Addr, uint32_t TypeSize, bool IsWrite, | |||
659 | Value *SizeArgument, bool UseCalls, uint32_t Exp); | |||
660 | Instruction *instrumentAMDGPUAddress(Instruction *OrigIns, | |||
661 | Instruction *InsertBefore, Value *Addr, | |||
662 | uint32_t TypeSize, bool IsWrite, | |||
663 | Value *SizeArgument); | |||
664 | void instrumentUnusualSizeOrAlignment(Instruction *I, | |||
665 | Instruction *InsertBefore, Value *Addr, | |||
666 | uint32_t TypeSize, bool IsWrite, | |||
667 | Value *SizeArgument, bool UseCalls, | |||
668 | uint32_t Exp); | |||
669 | Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, | |||
670 | Value *ShadowValue, uint32_t TypeSize); | |||
671 | Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr, | |||
672 | bool IsWrite, size_t AccessSizeIndex, | |||
673 | Value *SizeArgument, uint32_t Exp); | |||
674 | void instrumentMemIntrinsic(MemIntrinsic *MI); | |||
675 | Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); | |||
676 | bool suppressInstrumentationSiteForDebug(int &Instrumented); | |||
677 | bool instrumentFunction(Function &F, const TargetLibraryInfo *TLI); | |||
678 | bool maybeInsertAsanInitAtFunctionEntry(Function &F); | |||
679 | bool maybeInsertDynamicShadowAtFunctionEntry(Function &F); | |||
680 | void markEscapedLocalAllocas(Function &F); | |||
681 | ||||
682 | private: | |||
683 | friend struct FunctionStackPoisoner; | |||
684 | ||||
685 | void initializeCallbacks(Module &M); | |||
686 | ||||
687 | bool LooksLikeCodeInBug11395(Instruction *I); | |||
688 | bool GlobalIsLinkerInitialized(GlobalVariable *G); | |||
689 | bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr, | |||
690 | uint64_t TypeSize) const; | |||
691 | ||||
692 | /// Helper to cleanup per-function state. | |||
693 | struct FunctionStateRAII { | |||
694 | AddressSanitizer *Pass; | |||
695 | ||||
696 | FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) { | |||
697 | assert(Pass->ProcessedAllocas.empty() &&((void)0) | |||
698 | "last pass forgot to clear cache")((void)0); | |||
699 | assert(!Pass->LocalDynamicShadow)((void)0); | |||
700 | } | |||
701 | ||||
702 | ~FunctionStateRAII() { | |||
703 | Pass->LocalDynamicShadow = nullptr; | |||
704 | Pass->ProcessedAllocas.clear(); | |||
705 | } | |||
706 | }; | |||
707 | ||||
708 | LLVMContext *C; | |||
709 | Triple TargetTriple; | |||
710 | int LongSize; | |||
711 | bool CompileKernel; | |||
712 | bool Recover; | |||
713 | bool UseAfterScope; | |||
714 | AsanDetectStackUseAfterReturnMode UseAfterReturn; | |||
715 | Type *IntptrTy; | |||
716 | ShadowMapping Mapping; | |||
717 | FunctionCallee AsanHandleNoReturnFunc; | |||
718 | FunctionCallee AsanPtrCmpFunction, AsanPtrSubFunction; | |||
719 | Constant *AsanShadowGlobal; | |||
720 | ||||
721 | // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize). | |||
722 | FunctionCallee AsanErrorCallback[2][2][kNumberOfAccessSizes]; | |||
723 | FunctionCallee AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes]; | |||
724 | ||||
725 | // These arrays is indexed by AccessIsWrite and Experiment. | |||
726 | FunctionCallee AsanErrorCallbackSized[2][2]; | |||
727 | FunctionCallee AsanMemoryAccessCallbackSized[2][2]; | |||
728 | ||||
729 | FunctionCallee AsanMemmove, AsanMemcpy, AsanMemset; | |||
730 | Value *LocalDynamicShadow = nullptr; | |||
731 | const GlobalsMetadata &GlobalsMD; | |||
732 | DenseMap<const AllocaInst *, bool> ProcessedAllocas; | |||
733 | ||||
734 | FunctionCallee AMDGPUAddressShared; | |||
735 | FunctionCallee AMDGPUAddressPrivate; | |||
736 | }; | |||
737 | ||||
738 | class AddressSanitizerLegacyPass : public FunctionPass { | |||
739 | public: | |||
740 | static char ID; | |||
741 | ||||
742 | explicit AddressSanitizerLegacyPass( | |||
743 | bool CompileKernel = false, bool Recover = false, | |||
744 | bool UseAfterScope = false, | |||
745 | AsanDetectStackUseAfterReturnMode UseAfterReturn = | |||
746 | AsanDetectStackUseAfterReturnMode::Runtime) | |||
747 | : FunctionPass(ID), CompileKernel(CompileKernel), Recover(Recover), | |||
748 | UseAfterScope(UseAfterScope), UseAfterReturn(UseAfterReturn) { | |||
749 | initializeAddressSanitizerLegacyPassPass(*PassRegistry::getPassRegistry()); | |||
750 | } | |||
751 | ||||
752 | StringRef getPassName() const override { | |||
753 | return "AddressSanitizerFunctionPass"; | |||
754 | } | |||
755 | ||||
756 | void getAnalysisUsage(AnalysisUsage &AU) const override { | |||
757 | AU.addRequired<ASanGlobalsMetadataWrapperPass>(); | |||
758 | AU.addRequired<TargetLibraryInfoWrapperPass>(); | |||
759 | } | |||
760 | ||||
761 | bool runOnFunction(Function &F) override { | |||
762 | GlobalsMetadata &GlobalsMD = | |||
763 | getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD(); | |||
764 | const TargetLibraryInfo *TLI = | |||
765 | &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F); | |||
766 | AddressSanitizer ASan(*F.getParent(), &GlobalsMD, CompileKernel, Recover, | |||
767 | UseAfterScope, UseAfterReturn); | |||
768 | return ASan.instrumentFunction(F, TLI); | |||
769 | } | |||
770 | ||||
771 | private: | |||
772 | bool CompileKernel; | |||
773 | bool Recover; | |||
774 | bool UseAfterScope; | |||
775 | AsanDetectStackUseAfterReturnMode UseAfterReturn; | |||
776 | }; | |||
777 | ||||
778 | class ModuleAddressSanitizer { | |||
779 | public: | |||
780 | ModuleAddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD, | |||
781 | bool CompileKernel = false, bool Recover = false, | |||
782 | bool UseGlobalsGC = true, bool UseOdrIndicator = false, | |||
783 | AsanDtorKind DestructorKind = AsanDtorKind::Global) | |||
784 | : GlobalsMD(*GlobalsMD), | |||
785 | CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan | |||
786 | : CompileKernel), | |||
787 | Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover), | |||
788 | UseGlobalsGC(UseGlobalsGC && ClUseGlobalsGC && !this->CompileKernel), | |||
789 | // Enable aliases as they should have no downside with ODR indicators. | |||
790 | UsePrivateAlias(UseOdrIndicator || ClUsePrivateAlias), | |||
791 | UseOdrIndicator(UseOdrIndicator || ClUseOdrIndicator), | |||
792 | // Not a typo: ClWithComdat is almost completely pointless without | |||
793 | // ClUseGlobalsGC (because then it only works on modules without | |||
794 | // globals, which are rare); it is a prerequisite for ClUseGlobalsGC; | |||
795 | // and both suffer from gold PR19002 for which UseGlobalsGC constructor | |||
796 | // argument is designed as workaround. Therefore, disable both | |||
797 | // ClWithComdat and ClUseGlobalsGC unless the frontend says it's ok to | |||
798 | // do globals-gc. | |||
799 | UseCtorComdat(UseGlobalsGC && ClWithComdat && !this->CompileKernel), | |||
800 | DestructorKind(DestructorKind) { | |||
801 | C = &(M.getContext()); | |||
802 | int LongSize = M.getDataLayout().getPointerSizeInBits(); | |||
803 | IntptrTy = Type::getIntNTy(*C, LongSize); | |||
804 | TargetTriple = Triple(M.getTargetTriple()); | |||
805 | Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel); | |||
806 | ||||
807 | if (ClOverrideDestructorKind != AsanDtorKind::Invalid) | |||
808 | this->DestructorKind = ClOverrideDestructorKind; | |||
809 | assert(this->DestructorKind != AsanDtorKind::Invalid)((void)0); | |||
810 | } | |||
811 | ||||
812 | bool instrumentModule(Module &); | |||
813 | ||||
814 | private: | |||
815 | void initializeCallbacks(Module &M); | |||
816 | ||||
817 | bool InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat); | |||
818 | void InstrumentGlobalsCOFF(IRBuilder<> &IRB, Module &M, | |||
819 | ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
820 | ArrayRef<Constant *> MetadataInitializers); | |||
821 | void InstrumentGlobalsELF(IRBuilder<> &IRB, Module &M, | |||
822 | ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
823 | ArrayRef<Constant *> MetadataInitializers, | |||
824 | const std::string &UniqueModuleId); | |||
825 | void InstrumentGlobalsMachO(IRBuilder<> &IRB, Module &M, | |||
826 | ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
827 | ArrayRef<Constant *> MetadataInitializers); | |||
828 | void | |||
829 | InstrumentGlobalsWithMetadataArray(IRBuilder<> &IRB, Module &M, | |||
830 | ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
831 | ArrayRef<Constant *> MetadataInitializers); | |||
832 | ||||
833 | GlobalVariable *CreateMetadataGlobal(Module &M, Constant *Initializer, | |||
834 | StringRef OriginalName); | |||
835 | void SetComdatForGlobalMetadata(GlobalVariable *G, GlobalVariable *Metadata, | |||
836 | StringRef InternalSuffix); | |||
837 | Instruction *CreateAsanModuleDtor(Module &M); | |||
838 | ||||
839 | const GlobalVariable *getExcludedAliasedGlobal(const GlobalAlias &GA) const; | |||
840 | bool shouldInstrumentGlobal(GlobalVariable *G) const; | |||
841 | bool ShouldUseMachOGlobalsSection() const; | |||
842 | StringRef getGlobalMetadataSection() const; | |||
843 | void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName); | |||
844 | void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName); | |||
845 | uint64_t getMinRedzoneSizeForGlobal() const { | |||
846 | return getRedzoneSizeForScale(Mapping.Scale); | |||
847 | } | |||
848 | uint64_t getRedzoneSizeForGlobal(uint64_t SizeInBytes) const; | |||
849 | int GetAsanVersion(const Module &M) const; | |||
850 | ||||
851 | const GlobalsMetadata &GlobalsMD; | |||
852 | bool CompileKernel; | |||
853 | bool Recover; | |||
854 | bool UseGlobalsGC; | |||
855 | bool UsePrivateAlias; | |||
856 | bool UseOdrIndicator; | |||
857 | bool UseCtorComdat; | |||
858 | AsanDtorKind DestructorKind; | |||
859 | Type *IntptrTy; | |||
860 | LLVMContext *C; | |||
861 | Triple TargetTriple; | |||
862 | ShadowMapping Mapping; | |||
863 | FunctionCallee AsanPoisonGlobals; | |||
864 | FunctionCallee AsanUnpoisonGlobals; | |||
865 | FunctionCallee AsanRegisterGlobals; | |||
866 | FunctionCallee AsanUnregisterGlobals; | |||
867 | FunctionCallee AsanRegisterImageGlobals; | |||
868 | FunctionCallee AsanUnregisterImageGlobals; | |||
869 | FunctionCallee AsanRegisterElfGlobals; | |||
870 | FunctionCallee AsanUnregisterElfGlobals; | |||
871 | ||||
872 | Function *AsanCtorFunction = nullptr; | |||
873 | Function *AsanDtorFunction = nullptr; | |||
874 | }; | |||
875 | ||||
876 | class ModuleAddressSanitizerLegacyPass : public ModulePass { | |||
877 | public: | |||
878 | static char ID; | |||
879 | ||||
880 | explicit ModuleAddressSanitizerLegacyPass( | |||
881 | bool CompileKernel = false, bool Recover = false, bool UseGlobalGC = true, | |||
882 | bool UseOdrIndicator = false, | |||
883 | AsanDtorKind DestructorKind = AsanDtorKind::Global) | |||
884 | : ModulePass(ID), CompileKernel(CompileKernel), Recover(Recover), | |||
885 | UseGlobalGC(UseGlobalGC), UseOdrIndicator(UseOdrIndicator), | |||
886 | DestructorKind(DestructorKind) { | |||
887 | initializeModuleAddressSanitizerLegacyPassPass( | |||
888 | *PassRegistry::getPassRegistry()); | |||
889 | } | |||
890 | ||||
891 | StringRef getPassName() const override { return "ModuleAddressSanitizer"; } | |||
892 | ||||
893 | void getAnalysisUsage(AnalysisUsage &AU) const override { | |||
894 | AU.addRequired<ASanGlobalsMetadataWrapperPass>(); | |||
895 | } | |||
896 | ||||
897 | bool runOnModule(Module &M) override { | |||
898 | GlobalsMetadata &GlobalsMD = | |||
899 | getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD(); | |||
900 | ModuleAddressSanitizer ASanModule(M, &GlobalsMD, CompileKernel, Recover, | |||
901 | UseGlobalGC, UseOdrIndicator, | |||
902 | DestructorKind); | |||
903 | return ASanModule.instrumentModule(M); | |||
904 | } | |||
905 | ||||
906 | private: | |||
907 | bool CompileKernel; | |||
908 | bool Recover; | |||
909 | bool UseGlobalGC; | |||
910 | bool UseOdrIndicator; | |||
911 | AsanDtorKind DestructorKind; | |||
912 | }; | |||
913 | ||||
914 | // Stack poisoning does not play well with exception handling. | |||
915 | // When an exception is thrown, we essentially bypass the code | |||
916 | // that unpoisones the stack. This is why the run-time library has | |||
917 | // to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire | |||
918 | // stack in the interceptor. This however does not work inside the | |||
919 | // actual function which catches the exception. Most likely because the | |||
920 | // compiler hoists the load of the shadow value somewhere too high. | |||
921 | // This causes asan to report a non-existing bug on 453.povray. | |||
922 | // It sounds like an LLVM bug. | |||
923 | struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> { | |||
924 | Function &F; | |||
925 | AddressSanitizer &ASan; | |||
926 | DIBuilder DIB; | |||
927 | LLVMContext *C; | |||
928 | Type *IntptrTy; | |||
929 | Type *IntptrPtrTy; | |||
930 | ShadowMapping Mapping; | |||
931 | ||||
932 | SmallVector<AllocaInst *, 16> AllocaVec; | |||
933 | SmallVector<AllocaInst *, 16> StaticAllocasToMoveUp; | |||
934 | SmallVector<Instruction *, 8> RetVec; | |||
935 | ||||
936 | FunctionCallee AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1], | |||
937 | AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1]; | |||
938 | FunctionCallee AsanSetShadowFunc[0x100] = {}; | |||
939 | FunctionCallee AsanPoisonStackMemoryFunc, AsanUnpoisonStackMemoryFunc; | |||
940 | FunctionCallee AsanAllocaPoisonFunc, AsanAllocasUnpoisonFunc; | |||
941 | ||||
942 | // Stores a place and arguments of poisoning/unpoisoning call for alloca. | |||
943 | struct AllocaPoisonCall { | |||
944 | IntrinsicInst *InsBefore; | |||
945 | AllocaInst *AI; | |||
946 | uint64_t Size; | |||
947 | bool DoPoison; | |||
948 | }; | |||
949 | SmallVector<AllocaPoisonCall, 8> DynamicAllocaPoisonCallVec; | |||
950 | SmallVector<AllocaPoisonCall, 8> StaticAllocaPoisonCallVec; | |||
951 | bool HasUntracedLifetimeIntrinsic = false; | |||
952 | ||||
953 | SmallVector<AllocaInst *, 1> DynamicAllocaVec; | |||
954 | SmallVector<IntrinsicInst *, 1> StackRestoreVec; | |||
955 | AllocaInst *DynamicAllocaLayout = nullptr; | |||
956 | IntrinsicInst *LocalEscapeCall = nullptr; | |||
957 | ||||
958 | bool HasInlineAsm = false; | |||
959 | bool HasReturnsTwiceCall = false; | |||
960 | bool PoisonStack; | |||
961 | ||||
962 | FunctionStackPoisoner(Function &F, AddressSanitizer &ASan) | |||
963 | : F(F), ASan(ASan), DIB(*F.getParent(), /*AllowUnresolved*/ false), | |||
964 | C(ASan.C), IntptrTy(ASan.IntptrTy), | |||
965 | IntptrPtrTy(PointerType::get(IntptrTy, 0)), Mapping(ASan.Mapping), | |||
966 | PoisonStack(ClStack && | |||
967 | !Triple(F.getParent()->getTargetTriple()).isAMDGPU()) {} | |||
968 | ||||
969 | bool runOnFunction() { | |||
970 | if (!PoisonStack) | |||
971 | return false; | |||
972 | ||||
973 | if (ClRedzoneByvalArgs) | |||
974 | copyArgsPassedByValToAllocas(); | |||
975 | ||||
976 | // Collect alloca, ret, lifetime instructions etc. | |||
977 | for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB); | |||
978 | ||||
979 | if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false; | |||
980 | ||||
981 | initializeCallbacks(*F.getParent()); | |||
982 | ||||
983 | if (HasUntracedLifetimeIntrinsic) { | |||
984 | // If there are lifetime intrinsics which couldn't be traced back to an | |||
985 | // alloca, we may not know exactly when a variable enters scope, and | |||
986 | // therefore should "fail safe" by not poisoning them. | |||
987 | StaticAllocaPoisonCallVec.clear(); | |||
988 | DynamicAllocaPoisonCallVec.clear(); | |||
989 | } | |||
990 | ||||
991 | processDynamicAllocas(); | |||
992 | processStaticAllocas(); | |||
993 | ||||
994 | if (ClDebugStack) { | |||
995 | LLVM_DEBUG(dbgs() << F)do { } while (false); | |||
996 | } | |||
997 | return true; | |||
998 | } | |||
999 | ||||
1000 | // Arguments marked with the "byval" attribute are implicitly copied without | |||
1001 | // using an alloca instruction. To produce redzones for those arguments, we | |||
1002 | // copy them a second time into memory allocated with an alloca instruction. | |||
1003 | void copyArgsPassedByValToAllocas(); | |||
1004 | ||||
1005 | // Finds all Alloca instructions and puts | |||
1006 | // poisoned red zones around all of them. | |||
1007 | // Then unpoison everything back before the function returns. | |||
1008 | void processStaticAllocas(); | |||
1009 | void processDynamicAllocas(); | |||
1010 | ||||
1011 | void createDynamicAllocasInitStorage(); | |||
1012 | ||||
1013 | // ----------------------- Visitors. | |||
1014 | /// Collect all Ret instructions, or the musttail call instruction if it | |||
1015 | /// precedes the return instruction. | |||
1016 | void visitReturnInst(ReturnInst &RI) { | |||
1017 | if (CallInst *CI = RI.getParent()->getTerminatingMustTailCall()) | |||
1018 | RetVec.push_back(CI); | |||
1019 | else | |||
1020 | RetVec.push_back(&RI); | |||
1021 | } | |||
1022 | ||||
1023 | /// Collect all Resume instructions. | |||
1024 | void visitResumeInst(ResumeInst &RI) { RetVec.push_back(&RI); } | |||
1025 | ||||
1026 | /// Collect all CatchReturnInst instructions. | |||
1027 | void visitCleanupReturnInst(CleanupReturnInst &CRI) { RetVec.push_back(&CRI); } | |||
1028 | ||||
1029 | void unpoisonDynamicAllocasBeforeInst(Instruction *InstBefore, | |||
1030 | Value *SavedStack) { | |||
1031 | IRBuilder<> IRB(InstBefore); | |||
1032 | Value *DynamicAreaPtr = IRB.CreatePtrToInt(SavedStack, IntptrTy); | |||
1033 | // When we insert _asan_allocas_unpoison before @llvm.stackrestore, we | |||
1034 | // need to adjust extracted SP to compute the address of the most recent | |||
1035 | // alloca. We have a special @llvm.get.dynamic.area.offset intrinsic for | |||
1036 | // this purpose. | |||
1037 | if (!isa<ReturnInst>(InstBefore)) { | |||
1038 | Function *DynamicAreaOffsetFunc = Intrinsic::getDeclaration( | |||
1039 | InstBefore->getModule(), Intrinsic::get_dynamic_area_offset, | |||
1040 | {IntptrTy}); | |||
1041 | ||||
1042 | Value *DynamicAreaOffset = IRB.CreateCall(DynamicAreaOffsetFunc, {}); | |||
1043 | ||||
1044 | DynamicAreaPtr = IRB.CreateAdd(IRB.CreatePtrToInt(SavedStack, IntptrTy), | |||
1045 | DynamicAreaOffset); | |||
1046 | } | |||
1047 | ||||
1048 | IRB.CreateCall( | |||
1049 | AsanAllocasUnpoisonFunc, | |||
1050 | {IRB.CreateLoad(IntptrTy, DynamicAllocaLayout), DynamicAreaPtr}); | |||
1051 | } | |||
1052 | ||||
1053 | // Unpoison dynamic allocas redzones. | |||
1054 | void unpoisonDynamicAllocas() { | |||
1055 | for (Instruction *Ret : RetVec) | |||
1056 | unpoisonDynamicAllocasBeforeInst(Ret, DynamicAllocaLayout); | |||
1057 | ||||
1058 | for (Instruction *StackRestoreInst : StackRestoreVec) | |||
1059 | unpoisonDynamicAllocasBeforeInst(StackRestoreInst, | |||
1060 | StackRestoreInst->getOperand(0)); | |||
1061 | } | |||
1062 | ||||
1063 | // Deploy and poison redzones around dynamic alloca call. To do this, we | |||
1064 | // should replace this call with another one with changed parameters and | |||
1065 | // replace all its uses with new address, so | |||
1066 | // addr = alloca type, old_size, align | |||
1067 | // is replaced by | |||
1068 | // new_size = (old_size + additional_size) * sizeof(type) | |||
1069 | // tmp = alloca i8, new_size, max(align, 32) | |||
1070 | // addr = tmp + 32 (first 32 bytes are for the left redzone). | |||
1071 | // Additional_size is added to make new memory allocation contain not only | |||
1072 | // requested memory, but also left, partial and right redzones. | |||
1073 | void handleDynamicAllocaCall(AllocaInst *AI); | |||
1074 | ||||
1075 | /// Collect Alloca instructions we want (and can) handle. | |||
1076 | void visitAllocaInst(AllocaInst &AI) { | |||
1077 | if (!ASan.isInterestingAlloca(AI)) { | |||
1078 | if (AI.isStaticAlloca()) { | |||
1079 | // Skip over allocas that are present *before* the first instrumented | |||
1080 | // alloca, we don't want to move those around. | |||
1081 | if (AllocaVec.empty()) | |||
1082 | return; | |||
1083 | ||||
1084 | StaticAllocasToMoveUp.push_back(&AI); | |||
1085 | } | |||
1086 | return; | |||
1087 | } | |||
1088 | ||||
1089 | if (!AI.isStaticAlloca()) | |||
1090 | DynamicAllocaVec.push_back(&AI); | |||
1091 | else | |||
1092 | AllocaVec.push_back(&AI); | |||
1093 | } | |||
1094 | ||||
1095 | /// Collect lifetime intrinsic calls to check for use-after-scope | |||
1096 | /// errors. | |||
1097 | void visitIntrinsicInst(IntrinsicInst &II) { | |||
1098 | Intrinsic::ID ID = II.getIntrinsicID(); | |||
1099 | if (ID == Intrinsic::stackrestore) StackRestoreVec.push_back(&II); | |||
| ||||
1100 | if (ID == Intrinsic::localescape) LocalEscapeCall = &II; | |||
1101 | if (!ASan.UseAfterScope) | |||
1102 | return; | |||
1103 | if (!II.isLifetimeStartOrEnd()) | |||
1104 | return; | |||
1105 | // Found lifetime intrinsic, add ASan instrumentation if necessary. | |||
1106 | auto *Size = cast<ConstantInt>(II.getArgOperand(0)); | |||
1107 | // If size argument is undefined, don't do anything. | |||
1108 | if (Size->isMinusOne()) return; | |||
1109 | // Check that size doesn't saturate uint64_t and can | |||
1110 | // be stored in IntptrTy. | |||
1111 | const uint64_t SizeValue = Size->getValue().getLimitedValue(); | |||
1112 | if (SizeValue == ~0ULL || | |||
1113 | !ConstantInt::isValueValidForType(IntptrTy, SizeValue)) | |||
1114 | return; | |||
1115 | // Find alloca instruction that corresponds to llvm.lifetime argument. | |||
1116 | // Currently we can only handle lifetime markers pointing to the | |||
1117 | // beginning of the alloca. | |||
1118 | AllocaInst *AI = findAllocaForValue(II.getArgOperand(1), true); | |||
1119 | if (!AI) { | |||
1120 | HasUntracedLifetimeIntrinsic = true; | |||
1121 | return; | |||
1122 | } | |||
1123 | // We're interested only in allocas we can handle. | |||
1124 | if (!ASan.isInterestingAlloca(*AI)) | |||
1125 | return; | |||
1126 | bool DoPoison = (ID == Intrinsic::lifetime_end); | |||
1127 | AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison}; | |||
1128 | if (AI->isStaticAlloca()) | |||
1129 | StaticAllocaPoisonCallVec.push_back(APC); | |||
1130 | else if (ClInstrumentDynamicAllocas) | |||
1131 | DynamicAllocaPoisonCallVec.push_back(APC); | |||
1132 | } | |||
1133 | ||||
1134 | void visitCallBase(CallBase &CB) { | |||
1135 | if (CallInst *CI = dyn_cast<CallInst>(&CB)) { | |||
1136 | HasInlineAsm |= CI->isInlineAsm() && &CB != ASan.LocalDynamicShadow; | |||
1137 | HasReturnsTwiceCall |= CI->canReturnTwice(); | |||
1138 | } | |||
1139 | } | |||
1140 | ||||
1141 | // ---------------------- Helpers. | |||
1142 | void initializeCallbacks(Module &M); | |||
1143 | ||||
1144 | // Copies bytes from ShadowBytes into shadow memory for indexes where | |||
1145 | // ShadowMask is not zero. If ShadowMask[i] is zero, we assume that | |||
1146 | // ShadowBytes[i] is constantly zero and doesn't need to be overwritten. | |||
1147 | void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes, | |||
1148 | IRBuilder<> &IRB, Value *ShadowBase); | |||
1149 | void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes, | |||
1150 | size_t Begin, size_t End, IRBuilder<> &IRB, | |||
1151 | Value *ShadowBase); | |||
1152 | void copyToShadowInline(ArrayRef<uint8_t> ShadowMask, | |||
1153 | ArrayRef<uint8_t> ShadowBytes, size_t Begin, | |||
1154 | size_t End, IRBuilder<> &IRB, Value *ShadowBase); | |||
1155 | ||||
1156 | void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison); | |||
1157 | ||||
1158 | Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L, | |||
1159 | bool Dynamic); | |||
1160 | PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue, | |||
1161 | Instruction *ThenTerm, Value *ValueIfFalse); | |||
1162 | }; | |||
1163 | ||||
1164 | } // end anonymous namespace | |||
1165 | ||||
1166 | void LocationMetadata::parse(MDNode *MDN) { | |||
1167 | assert(MDN->getNumOperands() == 3)((void)0); | |||
1168 | MDString *DIFilename = cast<MDString>(MDN->getOperand(0)); | |||
1169 | Filename = DIFilename->getString(); | |||
1170 | LineNo = mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue(); | |||
1171 | ColumnNo = | |||
1172 | mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue(); | |||
1173 | } | |||
1174 | ||||
1175 | // FIXME: It would be cleaner to instead attach relevant metadata to the globals | |||
1176 | // we want to sanitize instead and reading this metadata on each pass over a | |||
1177 | // function instead of reading module level metadata at first. | |||
1178 | GlobalsMetadata::GlobalsMetadata(Module &M) { | |||
1179 | NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals"); | |||
1180 | if (!Globals) | |||
1181 | return; | |||
1182 | for (auto MDN : Globals->operands()) { | |||
1183 | // Metadata node contains the global and the fields of "Entry". | |||
1184 | assert(MDN->getNumOperands() == 5)((void)0); | |||
1185 | auto *V = mdconst::extract_or_null<Constant>(MDN->getOperand(0)); | |||
1186 | // The optimizer may optimize away a global entirely. | |||
1187 | if (!V) | |||
1188 | continue; | |||
1189 | auto *StrippedV = V->stripPointerCasts(); | |||
1190 | auto *GV = dyn_cast<GlobalVariable>(StrippedV); | |||
1191 | if (!GV) | |||
1192 | continue; | |||
1193 | // We can already have an entry for GV if it was merged with another | |||
1194 | // global. | |||
1195 | Entry &E = Entries[GV]; | |||
1196 | if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1))) | |||
1197 | E.SourceLoc.parse(Loc); | |||
1198 | if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2))) | |||
1199 | E.Name = Name->getString(); | |||
1200 | ConstantInt *IsDynInit = mdconst::extract<ConstantInt>(MDN->getOperand(3)); | |||
1201 | E.IsDynInit |= IsDynInit->isOne(); | |||
1202 | ConstantInt *IsExcluded = | |||
1203 | mdconst::extract<ConstantInt>(MDN->getOperand(4)); | |||
1204 | E.IsExcluded |= IsExcluded->isOne(); | |||
1205 | } | |||
1206 | } | |||
1207 | ||||
1208 | AnalysisKey ASanGlobalsMetadataAnalysis::Key; | |||
1209 | ||||
1210 | GlobalsMetadata ASanGlobalsMetadataAnalysis::run(Module &M, | |||
1211 | ModuleAnalysisManager &AM) { | |||
1212 | return GlobalsMetadata(M); | |||
1213 | } | |||
1214 | ||||
1215 | AddressSanitizerPass::AddressSanitizerPass( | |||
1216 | bool CompileKernel, bool Recover, bool UseAfterScope, | |||
1217 | AsanDetectStackUseAfterReturnMode UseAfterReturn) | |||
1218 | : CompileKernel(CompileKernel), Recover(Recover), | |||
1219 | UseAfterScope(UseAfterScope), UseAfterReturn(UseAfterReturn) {} | |||
1220 | ||||
1221 | PreservedAnalyses AddressSanitizerPass::run(Function &F, | |||
1222 | AnalysisManager<Function> &AM) { | |||
1223 | auto &MAMProxy = AM.getResult<ModuleAnalysisManagerFunctionProxy>(F); | |||
1224 | Module &M = *F.getParent(); | |||
1225 | if (auto *R = MAMProxy.getCachedResult<ASanGlobalsMetadataAnalysis>(M)) { | |||
1226 | const TargetLibraryInfo *TLI = &AM.getResult<TargetLibraryAnalysis>(F); | |||
1227 | AddressSanitizer Sanitizer(M, R, CompileKernel, Recover, UseAfterScope, | |||
1228 | UseAfterReturn); | |||
1229 | if (Sanitizer.instrumentFunction(F, TLI)) | |||
1230 | return PreservedAnalyses::none(); | |||
1231 | return PreservedAnalyses::all(); | |||
1232 | } | |||
1233 | ||||
1234 | report_fatal_error( | |||
1235 | "The ASanGlobalsMetadataAnalysis is required to run before " | |||
1236 | "AddressSanitizer can run"); | |||
1237 | return PreservedAnalyses::all(); | |||
1238 | } | |||
1239 | ||||
1240 | ModuleAddressSanitizerPass::ModuleAddressSanitizerPass( | |||
1241 | bool CompileKernel, bool Recover, bool UseGlobalGC, bool UseOdrIndicator, | |||
1242 | AsanDtorKind DestructorKind) | |||
1243 | : CompileKernel(CompileKernel), Recover(Recover), UseGlobalGC(UseGlobalGC), | |||
1244 | UseOdrIndicator(UseOdrIndicator), DestructorKind(DestructorKind) {} | |||
1245 | ||||
1246 | PreservedAnalyses ModuleAddressSanitizerPass::run(Module &M, | |||
1247 | AnalysisManager<Module> &AM) { | |||
1248 | GlobalsMetadata &GlobalsMD = AM.getResult<ASanGlobalsMetadataAnalysis>(M); | |||
1249 | ModuleAddressSanitizer Sanitizer(M, &GlobalsMD, CompileKernel, Recover, | |||
1250 | UseGlobalGC, UseOdrIndicator, | |||
1251 | DestructorKind); | |||
1252 | if (Sanitizer.instrumentModule(M)) | |||
1253 | return PreservedAnalyses::none(); | |||
1254 | return PreservedAnalyses::all(); | |||
1255 | } | |||
1256 | ||||
1257 | INITIALIZE_PASS(ASanGlobalsMetadataWrapperPass, "asan-globals-md",static void *initializeASanGlobalsMetadataWrapperPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "Read metadata to mark which globals should be instrumented " "when running ASan.", "asan-globals-md", &ASanGlobalsMetadataWrapperPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ASanGlobalsMetadataWrapperPass >), false, true); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeASanGlobalsMetadataWrapperPassPassFlag ; void llvm::initializeASanGlobalsMetadataWrapperPassPass(PassRegistry &Registry) { llvm::call_once(InitializeASanGlobalsMetadataWrapperPassPassFlag , initializeASanGlobalsMetadataWrapperPassPassOnce, std::ref( Registry)); } | |||
1258 | "Read metadata to mark which globals should be instrumented "static void *initializeASanGlobalsMetadataWrapperPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "Read metadata to mark which globals should be instrumented " "when running ASan.", "asan-globals-md", &ASanGlobalsMetadataWrapperPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ASanGlobalsMetadataWrapperPass >), false, true); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeASanGlobalsMetadataWrapperPassPassFlag ; void llvm::initializeASanGlobalsMetadataWrapperPassPass(PassRegistry &Registry) { llvm::call_once(InitializeASanGlobalsMetadataWrapperPassPassFlag , initializeASanGlobalsMetadataWrapperPassPassOnce, std::ref( Registry)); } | |||
1259 | "when running ASan.",static void *initializeASanGlobalsMetadataWrapperPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "Read metadata to mark which globals should be instrumented " "when running ASan.", "asan-globals-md", &ASanGlobalsMetadataWrapperPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ASanGlobalsMetadataWrapperPass >), false, true); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeASanGlobalsMetadataWrapperPassPassFlag ; void llvm::initializeASanGlobalsMetadataWrapperPassPass(PassRegistry &Registry) { llvm::call_once(InitializeASanGlobalsMetadataWrapperPassPassFlag , initializeASanGlobalsMetadataWrapperPassPassOnce, std::ref( Registry)); } | |||
1260 | false, true)static void *initializeASanGlobalsMetadataWrapperPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "Read metadata to mark which globals should be instrumented " "when running ASan.", "asan-globals-md", &ASanGlobalsMetadataWrapperPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ASanGlobalsMetadataWrapperPass >), false, true); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeASanGlobalsMetadataWrapperPassPassFlag ; void llvm::initializeASanGlobalsMetadataWrapperPassPass(PassRegistry &Registry) { llvm::call_once(InitializeASanGlobalsMetadataWrapperPassPassFlag , initializeASanGlobalsMetadataWrapperPassPassOnce, std::ref( Registry)); } | |||
1261 | ||||
1262 | char AddressSanitizerLegacyPass::ID = 0; | |||
1263 | ||||
1264 | INITIALIZE_PASS_BEGIN(static void *initializeAddressSanitizerLegacyPassPassOnce(PassRegistry &Registry) { | |||
1265 | AddressSanitizerLegacyPass, "asan",static void *initializeAddressSanitizerLegacyPassPassOnce(PassRegistry &Registry) { | |||
1266 | "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,static void *initializeAddressSanitizerLegacyPassPassOnce(PassRegistry &Registry) { | |||
1267 | false)static void *initializeAddressSanitizerLegacyPassPassOnce(PassRegistry &Registry) { | |||
1268 | INITIALIZE_PASS_DEPENDENCY(ASanGlobalsMetadataWrapperPass)initializeASanGlobalsMetadataWrapperPassPass(Registry); | |||
1269 | INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)initializeTargetLibraryInfoWrapperPassPass(Registry); | |||
1270 | INITIALIZE_PASS_END(PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." , "asan", &AddressSanitizerLegacyPass::ID, PassInfo::NormalCtor_t (callDefaultCtor<AddressSanitizerLegacyPass>), false, false ); Registry.registerPass(*PI, true); return PI; } static llvm ::once_flag InitializeAddressSanitizerLegacyPassPassFlag; void llvm::initializeAddressSanitizerLegacyPassPass(PassRegistry & Registry) { llvm::call_once(InitializeAddressSanitizerLegacyPassPassFlag , initializeAddressSanitizerLegacyPassPassOnce, std::ref(Registry )); } | |||
1271 | AddressSanitizerLegacyPass, "asan",PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." , "asan", &AddressSanitizerLegacyPass::ID, PassInfo::NormalCtor_t (callDefaultCtor<AddressSanitizerLegacyPass>), false, false ); Registry.registerPass(*PI, true); return PI; } static llvm ::once_flag InitializeAddressSanitizerLegacyPassPassFlag; void llvm::initializeAddressSanitizerLegacyPassPass(PassRegistry & Registry) { llvm::call_once(InitializeAddressSanitizerLegacyPassPassFlag , initializeAddressSanitizerLegacyPassPassOnce, std::ref(Registry )); } | |||
1272 | "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." , "asan", &AddressSanitizerLegacyPass::ID, PassInfo::NormalCtor_t (callDefaultCtor<AddressSanitizerLegacyPass>), false, false ); Registry.registerPass(*PI, true); return PI; } static llvm ::once_flag InitializeAddressSanitizerLegacyPassPassFlag; void llvm::initializeAddressSanitizerLegacyPassPass(PassRegistry & Registry) { llvm::call_once(InitializeAddressSanitizerLegacyPassPassFlag , initializeAddressSanitizerLegacyPassPassOnce, std::ref(Registry )); } | |||
1273 | false)PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." , "asan", &AddressSanitizerLegacyPass::ID, PassInfo::NormalCtor_t (callDefaultCtor<AddressSanitizerLegacyPass>), false, false ); Registry.registerPass(*PI, true); return PI; } static llvm ::once_flag InitializeAddressSanitizerLegacyPassPassFlag; void llvm::initializeAddressSanitizerLegacyPassPass(PassRegistry & Registry) { llvm::call_once(InitializeAddressSanitizerLegacyPassPassFlag , initializeAddressSanitizerLegacyPassPassOnce, std::ref(Registry )); } | |||
1274 | ||||
1275 | FunctionPass *llvm::createAddressSanitizerFunctionPass( | |||
1276 | bool CompileKernel, bool Recover, bool UseAfterScope, | |||
1277 | AsanDetectStackUseAfterReturnMode UseAfterReturn) { | |||
1278 | assert(!CompileKernel || Recover)((void)0); | |||
1279 | return new AddressSanitizerLegacyPass(CompileKernel, Recover, UseAfterScope, | |||
1280 | UseAfterReturn); | |||
1281 | } | |||
1282 | ||||
1283 | char ModuleAddressSanitizerLegacyPass::ID = 0; | |||
1284 | ||||
1285 | INITIALIZE_PASS(static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
1286 | ModuleAddressSanitizerLegacyPass, "asan-module",static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
1287 | "AddressSanitizer: detects use-after-free and out-of-bounds bugs."static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
1288 | "ModulePass",static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
1289 | false, false)static void *initializeModuleAddressSanitizerLegacyPassPassOnce (PassRegistry &Registry) { PassInfo *PI = new PassInfo( "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", "asan-module", &ModuleAddressSanitizerLegacyPass ::ID, PassInfo::NormalCtor_t(callDefaultCtor<ModuleAddressSanitizerLegacyPass >), false, false); Registry.registerPass(*PI, true); return PI; } static llvm::once_flag InitializeModuleAddressSanitizerLegacyPassPassFlag ; void llvm::initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &Registry) { llvm::call_once(InitializeModuleAddressSanitizerLegacyPassPassFlag , initializeModuleAddressSanitizerLegacyPassPassOnce, std::ref (Registry)); } | |||
1290 | ||||
1291 | ModulePass *llvm::createModuleAddressSanitizerLegacyPassPass( | |||
1292 | bool CompileKernel, bool Recover, bool UseGlobalsGC, bool UseOdrIndicator, | |||
1293 | AsanDtorKind Destructor) { | |||
1294 | assert(!CompileKernel || Recover)((void)0); | |||
1295 | return new ModuleAddressSanitizerLegacyPass( | |||
1296 | CompileKernel, Recover, UseGlobalsGC, UseOdrIndicator, Destructor); | |||
1297 | } | |||
1298 | ||||
1299 | static size_t TypeSizeToSizeIndex(uint32_t TypeSize) { | |||
1300 | size_t Res = countTrailingZeros(TypeSize / 8); | |||
1301 | assert(Res < kNumberOfAccessSizes)((void)0); | |||
1302 | return Res; | |||
1303 | } | |||
1304 | ||||
1305 | /// Create a global describing a source location. | |||
1306 | static GlobalVariable *createPrivateGlobalForSourceLoc(Module &M, | |||
1307 | LocationMetadata MD) { | |||
1308 | Constant *LocData[] = { | |||
1309 | createPrivateGlobalForString(M, MD.Filename, true, kAsanGenPrefix), | |||
1310 | ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo), | |||
1311 | ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo), | |||
1312 | }; | |||
1313 | auto LocStruct = ConstantStruct::getAnon(LocData); | |||
1314 | auto GV = new GlobalVariable(M, LocStruct->getType(), true, | |||
1315 | GlobalValue::PrivateLinkage, LocStruct, | |||
1316 | kAsanGenPrefix); | |||
1317 | GV->setUnnamedAddr(GlobalValue::UnnamedAddr::Global); | |||
1318 | return GV; | |||
1319 | } | |||
1320 | ||||
1321 | /// Check if \p G has been created by a trusted compiler pass. | |||
1322 | static bool GlobalWasGeneratedByCompiler(GlobalVariable *G) { | |||
1323 | // Do not instrument @llvm.global_ctors, @llvm.used, etc. | |||
1324 | if (G->getName().startswith("llvm.")) | |||
1325 | return true; | |||
1326 | ||||
1327 | // Do not instrument asan globals. | |||
1328 | if (G->getName().startswith(kAsanGenPrefix) || | |||
1329 | G->getName().startswith(kSanCovGenPrefix) || | |||
1330 | G->getName().startswith(kODRGenPrefix)) | |||
1331 | return true; | |||
1332 | ||||
1333 | // Do not instrument gcov counter arrays. | |||
1334 | if (G->getName() == "__llvm_gcov_ctr") | |||
1335 | return true; | |||
1336 | ||||
1337 | return false; | |||
1338 | } | |||
1339 | ||||
1340 | static bool isUnsupportedAMDGPUAddrspace(Value *Addr) { | |||
1341 | Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType()); | |||
1342 | unsigned int AddrSpace = PtrTy->getPointerAddressSpace(); | |||
1343 | if (AddrSpace == 3 || AddrSpace == 5) | |||
1344 | return true; | |||
1345 | return false; | |||
1346 | } | |||
1347 | ||||
1348 | Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { | |||
1349 | // Shadow >> scale | |||
1350 | Shadow = IRB.CreateLShr(Shadow, Mapping.Scale); | |||
1351 | if (Mapping.Offset == 0) return Shadow; | |||
1352 | // (Shadow >> scale) | offset | |||
1353 | Value *ShadowBase; | |||
1354 | if (LocalDynamicShadow) | |||
1355 | ShadowBase = LocalDynamicShadow; | |||
1356 | else | |||
1357 | ShadowBase = ConstantInt::get(IntptrTy, Mapping.Offset); | |||
1358 | if (Mapping.OrShadowOffset) | |||
1359 | return IRB.CreateOr(Shadow, ShadowBase); | |||
1360 | else | |||
1361 | return IRB.CreateAdd(Shadow, ShadowBase); | |||
1362 | } | |||
1363 | ||||
1364 | // Instrument memset/memmove/memcpy | |||
1365 | void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { | |||
1366 | IRBuilder<> IRB(MI); | |||
1367 | if (isa<MemTransferInst>(MI)) { | |||
1368 | IRB.CreateCall( | |||
1369 | isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy, | |||
1370 | {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), | |||
1371 | IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()), | |||
1372 | IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); | |||
1373 | } else if (isa<MemSetInst>(MI)) { | |||
1374 | IRB.CreateCall( | |||
1375 | AsanMemset, | |||
1376 | {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), | |||
1377 | IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false), | |||
1378 | IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); | |||
1379 | } | |||
1380 | MI->eraseFromParent(); | |||
1381 | } | |||
1382 | ||||
1383 | /// Check if we want (and can) handle this alloca. | |||
1384 | bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) { | |||
1385 | auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI); | |||
1386 | ||||
1387 | if (PreviouslySeenAllocaInfo != ProcessedAllocas.end()) | |||
1388 | return PreviouslySeenAllocaInfo->getSecond(); | |||
1389 | ||||
1390 | bool IsInteresting = | |||
1391 | (AI.getAllocatedType()->isSized() && | |||
1392 | // alloca() may be called with 0 size, ignore it. | |||
1393 | ((!AI.isStaticAlloca()) || getAllocaSizeInBytes(AI) > 0) && | |||
1394 | // We are only interested in allocas not promotable to registers. | |||
1395 | // Promotable allocas are common under -O0. | |||
1396 | (!ClSkipPromotableAllocas || !isAllocaPromotable(&AI)) && | |||
1397 | // inalloca allocas are not treated as static, and we don't want | |||
1398 | // dynamic alloca instrumentation for them as well. | |||
1399 | !AI.isUsedWithInAlloca() && | |||
1400 | // swifterror allocas are register promoted by ISel | |||
1401 | !AI.isSwiftError()); | |||
1402 | ||||
1403 | ProcessedAllocas[&AI] = IsInteresting; | |||
1404 | return IsInteresting; | |||
1405 | } | |||
1406 | ||||
1407 | bool AddressSanitizer::ignoreAccess(Value *Ptr) { | |||
1408 | // Instrument acesses from different address spaces only for AMDGPU. | |||
1409 | Type *PtrTy = cast<PointerType>(Ptr->getType()->getScalarType()); | |||
1410 | if (PtrTy->getPointerAddressSpace() != 0 && | |||
1411 | !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(Ptr))) | |||
1412 | return true; | |||
1413 | ||||
1414 | // Ignore swifterror addresses. | |||
1415 | // swifterror memory addresses are mem2reg promoted by instruction | |||
1416 | // selection. As such they cannot have regular uses like an instrumentation | |||
1417 | // function and it makes no sense to track them as memory. | |||
1418 | if (Ptr->isSwiftError()) | |||
1419 | return true; | |||
1420 | ||||
1421 | // Treat memory accesses to promotable allocas as non-interesting since they | |||
1422 | // will not cause memory violations. This greatly speeds up the instrumented | |||
1423 | // executable at -O0. | |||
1424 | if (auto AI = dyn_cast_or_null<AllocaInst>(Ptr)) | |||
1425 | if (ClSkipPromotableAllocas && !isInterestingAlloca(*AI)) | |||
1426 | return true; | |||
1427 | ||||
1428 | return false; | |||
1429 | } | |||
1430 | ||||
1431 | void AddressSanitizer::getInterestingMemoryOperands( | |||
1432 | Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting) { | |||
1433 | // Skip memory accesses inserted by another instrumentation. | |||
1434 | if (I->hasMetadata("nosanitize")) | |||
1435 | return; | |||
1436 | ||||
1437 | // Do not instrument the load fetching the dynamic shadow address. | |||
1438 | if (LocalDynamicShadow == I) | |||
1439 | return; | |||
1440 | ||||
1441 | if (LoadInst *LI = dyn_cast<LoadInst>(I)) { | |||
1442 | if (!ClInstrumentReads || ignoreAccess(LI->getPointerOperand())) | |||
1443 | return; | |||
1444 | Interesting.emplace_back(I, LI->getPointerOperandIndex(), false, | |||
1445 | LI->getType(), LI->getAlign()); | |||
1446 | } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) { | |||
1447 | if (!ClInstrumentWrites || ignoreAccess(SI->getPointerOperand())) | |||
1448 | return; | |||
1449 | Interesting.emplace_back(I, SI->getPointerOperandIndex(), true, | |||
1450 | SI->getValueOperand()->getType(), SI->getAlign()); | |||
1451 | } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { | |||
1452 | if (!ClInstrumentAtomics || ignoreAccess(RMW->getPointerOperand())) | |||
1453 | return; | |||
1454 | Interesting.emplace_back(I, RMW->getPointerOperandIndex(), true, | |||
1455 | RMW->getValOperand()->getType(), None); | |||
1456 | } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { | |||
1457 | if (!ClInstrumentAtomics || ignoreAccess(XCHG->getPointerOperand())) | |||
1458 | return; | |||
1459 | Interesting.emplace_back(I, XCHG->getPointerOperandIndex(), true, | |||
1460 | XCHG->getCompareOperand()->getType(), None); | |||
1461 | } else if (auto CI = dyn_cast<CallInst>(I)) { | |||
1462 | auto *F = CI->getCalledFunction(); | |||
1463 | if (F && (F->getName().startswith("llvm.masked.load.") || | |||
1464 | F->getName().startswith("llvm.masked.store."))) { | |||
1465 | bool IsWrite = F->getName().startswith("llvm.masked.store."); | |||
1466 | // Masked store has an initial operand for the value. | |||
1467 | unsigned OpOffset = IsWrite ? 1 : 0; | |||
1468 | if (IsWrite ? !ClInstrumentWrites : !ClInstrumentReads) | |||
1469 | return; | |||
1470 | ||||
1471 | auto BasePtr = CI->getOperand(OpOffset); | |||
1472 | if (ignoreAccess(BasePtr)) | |||
1473 | return; | |||
1474 | auto Ty = cast<PointerType>(BasePtr->getType())->getElementType(); | |||
1475 | MaybeAlign Alignment = Align(1); | |||
1476 | // Otherwise no alignment guarantees. We probably got Undef. | |||
1477 | if (auto *Op = dyn_cast<ConstantInt>(CI->getOperand(1 + OpOffset))) | |||
1478 | Alignment = Op->getMaybeAlignValue(); | |||
1479 | Value *Mask = CI->getOperand(2 + OpOffset); | |||
1480 | Interesting.emplace_back(I, OpOffset, IsWrite, Ty, Alignment, Mask); | |||
1481 | } else { | |||
1482 | for (unsigned ArgNo = 0; ArgNo < CI->getNumArgOperands(); ArgNo++) { | |||
1483 | if (!ClInstrumentByval || !CI->isByValArgument(ArgNo) || | |||
1484 | ignoreAccess(CI->getArgOperand(ArgNo))) | |||
1485 | continue; | |||
1486 | Type *Ty = CI->getParamByValType(ArgNo); | |||
1487 | Interesting.emplace_back(I, ArgNo, false, Ty, Align(1)); | |||
1488 | } | |||
1489 | } | |||
1490 | } | |||
1491 | } | |||
1492 | ||||
1493 | static bool isPointerOperand(Value *V) { | |||
1494 | return V->getType()->isPointerTy() || isa<PtrToIntInst>(V); | |||
1495 | } | |||
1496 | ||||
1497 | // This is a rough heuristic; it may cause both false positives and | |||
1498 | // false negatives. The proper implementation requires cooperation with | |||
1499 | // the frontend. | |||
1500 | static bool isInterestingPointerComparison(Instruction *I) { | |||
1501 | if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) { | |||
1502 | if (!Cmp->isRelational()) | |||
1503 | return false; | |||
1504 | } else { | |||
1505 | return false; | |||
1506 | } | |||
1507 | return isPointerOperand(I->getOperand(0)) && | |||
1508 | isPointerOperand(I->getOperand(1)); | |||
1509 | } | |||
1510 | ||||
1511 | // This is a rough heuristic; it may cause both false positives and | |||
1512 | // false negatives. The proper implementation requires cooperation with | |||
1513 | // the frontend. | |||
1514 | static bool isInterestingPointerSubtraction(Instruction *I) { | |||
1515 | if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) { | |||
1516 | if (BO->getOpcode() != Instruction::Sub) | |||
1517 | return false; | |||
1518 | } else { | |||
1519 | return false; | |||
1520 | } | |||
1521 | return isPointerOperand(I->getOperand(0)) && | |||
1522 | isPointerOperand(I->getOperand(1)); | |||
1523 | } | |||
1524 | ||||
1525 | bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) { | |||
1526 | // If a global variable does not have dynamic initialization we don't | |||
1527 | // have to instrument it. However, if a global does not have initializer | |||
1528 | // at all, we assume it has dynamic initializer (in other TU). | |||
1529 | // | |||
1530 | // FIXME: Metadata should be attched directly to the global directly instead | |||
1531 | // of being added to llvm.asan.globals. | |||
1532 | return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit; | |||
1533 | } | |||
1534 | ||||
1535 | void AddressSanitizer::instrumentPointerComparisonOrSubtraction( | |||
1536 | Instruction *I) { | |||
1537 | IRBuilder<> IRB(I); | |||
1538 | FunctionCallee F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction; | |||
1539 | Value *Param[2] = {I->getOperand(0), I->getOperand(1)}; | |||
1540 | for (Value *&i : Param) { | |||
1541 | if (i->getType()->isPointerTy()) | |||
1542 | i = IRB.CreatePointerCast(i, IntptrTy); | |||
1543 | } | |||
1544 | IRB.CreateCall(F, Param); | |||
1545 | } | |||
1546 | ||||
1547 | static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I, | |||
1548 | Instruction *InsertBefore, Value *Addr, | |||
1549 | MaybeAlign Alignment, unsigned Granularity, | |||
1550 | uint32_t TypeSize, bool IsWrite, | |||
1551 | Value *SizeArgument, bool UseCalls, | |||
1552 | uint32_t Exp) { | |||
1553 | // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check | |||
1554 | // if the data is properly aligned. | |||
1555 | if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 || | |||
1556 | TypeSize == 128) && | |||
1557 | (!Alignment || *Alignment >= Granularity || *Alignment >= TypeSize / 8)) | |||
1558 | return Pass->instrumentAddress(I, InsertBefore, Addr, TypeSize, IsWrite, | |||
1559 | nullptr, UseCalls, Exp); | |||
1560 | Pass->instrumentUnusualSizeOrAlignment(I, InsertBefore, Addr, TypeSize, | |||
1561 | IsWrite, nullptr, UseCalls, Exp); | |||
1562 | } | |||
1563 | ||||
1564 | static void instrumentMaskedLoadOrStore(AddressSanitizer *Pass, | |||
1565 | const DataLayout &DL, Type *IntptrTy, | |||
1566 | Value *Mask, Instruction *I, | |||
1567 | Value *Addr, MaybeAlign Alignment, | |||
1568 | unsigned Granularity, uint32_t TypeSize, | |||
1569 | bool IsWrite, Value *SizeArgument, | |||
1570 | bool UseCalls, uint32_t Exp) { | |||
1571 | auto *VTy = cast<FixedVectorType>( | |||
1572 | cast<PointerType>(Addr->getType())->getElementType()); | |||
1573 | uint64_t ElemTypeSize = DL.getTypeStoreSizeInBits(VTy->getScalarType()); | |||
1574 | unsigned Num = VTy->getNumElements(); | |||
1575 | auto Zero = ConstantInt::get(IntptrTy, 0); | |||
1576 | for (unsigned Idx = 0; Idx < Num; ++Idx) { | |||
1577 | Value *InstrumentedAddress = nullptr; | |||
1578 | Instruction *InsertBefore = I; | |||
1579 | if (auto *Vector = dyn_cast<ConstantVector>(Mask)) { | |||
1580 | // dyn_cast as we might get UndefValue | |||
1581 | if (auto *Masked = dyn_cast<ConstantInt>(Vector->getOperand(Idx))) { | |||
1582 | if (Masked->isZero()) | |||
1583 | // Mask is constant false, so no instrumentation needed. | |||
1584 | continue; | |||
1585 | // If we have a true or undef value, fall through to doInstrumentAddress | |||
1586 | // with InsertBefore == I | |||
1587 | } | |||
1588 | } else { | |||
1589 | IRBuilder<> IRB(I); | |||
1590 | Value *MaskElem = IRB.CreateExtractElement(Mask, Idx); | |||
1591 | Instruction *ThenTerm = SplitBlockAndInsertIfThen(MaskElem, I, false); | |||
1592 | InsertBefore = ThenTerm; | |||
1593 | } | |||
1594 | ||||
1595 | IRBuilder<> IRB(InsertBefore); | |||
1596 | InstrumentedAddress = | |||
1597 | IRB.CreateGEP(VTy, Addr, {Zero, ConstantInt::get(IntptrTy, Idx)}); | |||
1598 | doInstrumentAddress(Pass, I, InsertBefore, InstrumentedAddress, Alignment, | |||
1599 | Granularity, ElemTypeSize, IsWrite, SizeArgument, | |||
1600 | UseCalls, Exp); | |||
1601 | } | |||
1602 | } | |||
1603 | ||||
1604 | void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, | |||
1605 | InterestingMemoryOperand &O, bool UseCalls, | |||
1606 | const DataLayout &DL) { | |||
1607 | Value *Addr = O.getPtr(); | |||
1608 | ||||
1609 | // Optimization experiments. | |||
1610 | // The experiments can be used to evaluate potential optimizations that remove | |||
1611 | // instrumentation (assess false negatives). Instead of completely removing | |||
1612 | // some instrumentation, you set Exp to a non-zero value (mask of optimization | |||
1613 | // experiments that want to remove instrumentation of this instruction). | |||
1614 | // If Exp is non-zero, this pass will emit special calls into runtime | |||
1615 | // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls | |||
1616 | // make runtime terminate the program in a special way (with a different | |||
1617 | // exit status). Then you run the new compiler on a buggy corpus, collect | |||
1618 | // the special terminations (ideally, you don't see them at all -- no false | |||
1619 | // negatives) and make the decision on the optimization. | |||
1620 | uint32_t Exp = ClForceExperiment; | |||
1621 | ||||
1622 | if (ClOpt && ClOptGlobals) { | |||
1623 | // If initialization order checking is disabled, a simple access to a | |||
1624 | // dynamically initialized global is always valid. | |||
1625 | GlobalVariable *G = dyn_cast<GlobalVariable>(getUnderlyingObject(Addr)); | |||
1626 | if (G && (!ClInitializers || GlobalIsLinkerInitialized(G)) && | |||
1627 | isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) { | |||
1628 | NumOptimizedAccessesToGlobalVar++; | |||
1629 | return; | |||
1630 | } | |||
1631 | } | |||
1632 | ||||
1633 | if (ClOpt && ClOptStack) { | |||
1634 | // A direct inbounds access to a stack variable is always valid. | |||
1635 | if (isa<AllocaInst>(getUnderlyingObject(Addr)) && | |||
1636 | isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) { | |||
1637 | NumOptimizedAccessesToStackVar++; | |||
1638 | return; | |||
1639 | } | |||
1640 | } | |||
1641 | ||||
1642 | if (O.IsWrite) | |||
1643 | NumInstrumentedWrites++; | |||
1644 | else | |||
1645 | NumInstrumentedReads++; | |||
1646 | ||||
1647 | unsigned Granularity = 1 << Mapping.Scale; | |||
1648 | if (O.MaybeMask) { | |||
1649 | instrumentMaskedLoadOrStore(this, DL, IntptrTy, O.MaybeMask, O.getInsn(), | |||
1650 | Addr, O.Alignment, Granularity, O.TypeSize, | |||
1651 | O.IsWrite, nullptr, UseCalls, Exp); | |||
1652 | } else { | |||
1653 | doInstrumentAddress(this, O.getInsn(), O.getInsn(), Addr, O.Alignment, | |||
1654 | Granularity, O.TypeSize, O.IsWrite, nullptr, UseCalls, | |||
1655 | Exp); | |||
1656 | } | |||
1657 | } | |||
1658 | ||||
1659 | Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore, | |||
1660 | Value *Addr, bool IsWrite, | |||
1661 | size_t AccessSizeIndex, | |||
1662 | Value *SizeArgument, | |||
1663 | uint32_t Exp) { | |||
1664 | IRBuilder<> IRB(InsertBefore); | |||
1665 | Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp); | |||
1666 | CallInst *Call = nullptr; | |||
1667 | if (SizeArgument) { | |||
1668 | if (Exp == 0) | |||
1669 | Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0], | |||
1670 | {Addr, SizeArgument}); | |||
1671 | else | |||
1672 | Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1], | |||
1673 | {Addr, SizeArgument, ExpVal}); | |||
1674 | } else { | |||
1675 | if (Exp == 0) | |||
1676 | Call = | |||
1677 | IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr); | |||
1678 | else | |||
1679 | Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex], | |||
1680 | {Addr, ExpVal}); | |||
1681 | } | |||
1682 | ||||
1683 | Call->setCannotMerge(); | |||
1684 | return Call; | |||
1685 | } | |||
1686 | ||||
1687 | Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, | |||
1688 | Value *ShadowValue, | |||
1689 | uint32_t TypeSize) { | |||
1690 | size_t Granularity = static_cast<size_t>(1) << Mapping.Scale; | |||
1691 | // Addr & (Granularity - 1) | |||
1692 | Value *LastAccessedByte = | |||
1693 | IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); | |||
1694 | // (Addr & (Granularity - 1)) + size - 1 | |||
1695 | if (TypeSize / 8 > 1) | |||
1696 | LastAccessedByte = IRB.CreateAdd( | |||
1697 | LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); | |||
1698 | // (uint8_t) ((Addr & (Granularity-1)) + size - 1) | |||
1699 | LastAccessedByte = | |||
1700 | IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false); | |||
1701 | // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue | |||
1702 | return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); | |||
1703 | } | |||
1704 | ||||
1705 | Instruction *AddressSanitizer::instrumentAMDGPUAddress( | |||
1706 | Instruction *OrigIns, Instruction *InsertBefore, Value *Addr, | |||
1707 | uint32_t TypeSize, bool IsWrite, Value *SizeArgument) { | |||
1708 | // Do not instrument unsupported addrspaces. | |||
1709 | if (isUnsupportedAMDGPUAddrspace(Addr)) | |||
1710 | return nullptr; | |||
1711 | Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType()); | |||
1712 | // Follow host instrumentation for global and constant addresses. | |||
1713 | if (PtrTy->getPointerAddressSpace() != 0) | |||
1714 | return InsertBefore; | |||
1715 | // Instrument generic addresses in supported addressspaces. | |||
1716 | IRBuilder<> IRB(InsertBefore); | |||
1717 | Value *AddrLong = IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy()); | |||
1718 | Value *IsShared = IRB.CreateCall(AMDGPUAddressShared, {AddrLong}); | |||
1719 | Value *IsPrivate = IRB.CreateCall(AMDGPUAddressPrivate, {AddrLong}); | |||
1720 | Value *IsSharedOrPrivate = IRB.CreateOr(IsShared, IsPrivate); | |||
1721 | Value *Cmp = IRB.CreateICmpNE(IRB.getTrue(), IsSharedOrPrivate); | |||
1722 | Value *AddrSpaceZeroLanding = | |||
1723 | SplitBlockAndInsertIfThen(Cmp, InsertBefore, false); | |||
1724 | InsertBefore = cast<Instruction>(AddrSpaceZeroLanding); | |||
1725 | return InsertBefore; | |||
1726 | } | |||
1727 | ||||
1728 | void AddressSanitizer::instrumentAddress(Instruction *OrigIns, | |||
1729 | Instruction *InsertBefore, Value *Addr, | |||
1730 | uint32_t TypeSize, bool IsWrite, | |||
1731 | Value *SizeArgument, bool UseCalls, | |||
1732 | uint32_t Exp) { | |||
1733 | if (TargetTriple.isAMDGPU()) { | |||
1734 | InsertBefore = instrumentAMDGPUAddress(OrigIns, InsertBefore, Addr, | |||
1735 | TypeSize, IsWrite, SizeArgument); | |||
1736 | if (!InsertBefore) | |||
1737 | return; | |||
1738 | } | |||
1739 | ||||
1740 | IRBuilder<> IRB(InsertBefore); | |||
1741 | Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); | |||
1742 | size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); | |||
1743 | ||||
1744 | if (UseCalls) { | |||
1745 | if (Exp == 0) | |||
1746 | IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex], | |||
1747 | AddrLong); | |||
1748 | else | |||
1749 | IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex], | |||
1750 | {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)}); | |||
1751 | return; | |||
1752 | } | |||
1753 | ||||
1754 | Type *ShadowTy = | |||
1755 | IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale)); | |||
1756 | Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); | |||
1757 | Value *ShadowPtr = memToShadow(AddrLong, IRB); | |||
1758 | Value *CmpVal = Constant::getNullValue(ShadowTy); | |||
1759 | Value *ShadowValue = | |||
1760 | IRB.CreateLoad(ShadowTy, IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); | |||
1761 | ||||
1762 | Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); | |||
1763 | size_t Granularity = 1ULL << Mapping.Scale; | |||
1764 | Instruction *CrashTerm = nullptr; | |||
1765 | ||||
1766 | if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) { | |||
1767 | // We use branch weights for the slow path check, to indicate that the slow | |||
1768 | // path is rarely taken. This seems to be the case for SPEC benchmarks. | |||
1769 | Instruction *CheckTerm = SplitBlockAndInsertIfThen( | |||
1770 | Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000)); | |||
1771 | assert(cast<BranchInst>(CheckTerm)->isUnconditional())((void)0); | |||
1772 | BasicBlock *NextBB = CheckTerm->getSuccessor(0); | |||
1773 | IRB.SetInsertPoint(CheckTerm); | |||
1774 | Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); | |||
1775 | if (Recover) { | |||
1776 | CrashTerm = SplitBlockAndInsertIfThen(Cmp2, CheckTerm, false); | |||
1777 | } else { | |||
1778 | BasicBlock *CrashBlock = | |||
1779 | BasicBlock::Create(*C, "", NextBB->getParent(), NextBB); | |||
1780 | CrashTerm = new UnreachableInst(*C, CrashBlock); | |||
1781 | BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); | |||
1782 | ReplaceInstWithInst(CheckTerm, NewTerm); | |||
1783 | } | |||
1784 | } else { | |||
1785 | CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover); | |||
1786 | } | |||
1787 | ||||
1788 | Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite, | |||
1789 | AccessSizeIndex, SizeArgument, Exp); | |||
1790 | Crash->setDebugLoc(OrigIns->getDebugLoc()); | |||
1791 | } | |||
1792 | ||||
1793 | // Instrument unusual size or unusual alignment. | |||
1794 | // We can not do it with a single check, so we do 1-byte check for the first | |||
1795 | // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able | |||
1796 | // to report the actual access size. | |||
1797 | void AddressSanitizer::instrumentUnusualSizeOrAlignment( | |||
1798 | Instruction *I, Instruction *InsertBefore, Value *Addr, uint32_t TypeSize, | |||
1799 | bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp) { | |||
1800 | IRBuilder<> IRB(InsertBefore); | |||
1801 | Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8); | |||
1802 | Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); | |||
1803 | if (UseCalls) { | |||
1804 | if (Exp == 0) | |||
1805 | IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0], | |||
1806 | {AddrLong, Size}); | |||
1807 | else | |||
1808 | IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1], | |||
1809 | {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)}); | |||
1810 | } else { | |||
1811 | Value *LastByte = IRB.CreateIntToPtr( | |||
1812 | IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)), | |||
1813 | Addr->getType()); | |||
1814 | instrumentAddress(I, InsertBefore, Addr, 8, IsWrite, Size, false, Exp); | |||
1815 | instrumentAddress(I, InsertBefore, LastByte, 8, IsWrite, Size, false, Exp); | |||
1816 | } | |||
1817 | } | |||
1818 | ||||
1819 | void ModuleAddressSanitizer::poisonOneInitializer(Function &GlobalInit, | |||
1820 | GlobalValue *ModuleName) { | |||
1821 | // Set up the arguments to our poison/unpoison functions. | |||
1822 | IRBuilder<> IRB(&GlobalInit.front(), | |||
1823 | GlobalInit.front().getFirstInsertionPt()); | |||
1824 | ||||
1825 | // Add a call to poison all external globals before the given function starts. | |||
1826 | Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy); | |||
1827 | IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr); | |||
1828 | ||||
1829 | // Add calls to unpoison all globals before each return instruction. | |||
1830 | for (auto &BB : GlobalInit.getBasicBlockList()) | |||
1831 | if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator())) | |||
1832 | CallInst::Create(AsanUnpoisonGlobals, "", RI); | |||
1833 | } | |||
1834 | ||||
1835 | void ModuleAddressSanitizer::createInitializerPoisonCalls( | |||
1836 | Module &M, GlobalValue *ModuleName) { | |||
1837 | GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors"); | |||
1838 | if (!GV) | |||
1839 | return; | |||
1840 | ||||
1841 | ConstantArray *CA = dyn_cast<ConstantArray>(GV->getInitializer()); | |||
1842 | if (!CA) | |||
1843 | return; | |||
1844 | ||||
1845 | for (Use &OP : CA->operands()) { | |||
1846 | if (isa<ConstantAggregateZero>(OP)) continue; | |||
1847 | ConstantStruct *CS = cast<ConstantStruct>(OP); | |||
1848 | ||||
1849 | // Must have a function or null ptr. | |||
1850 | if (Function *F = dyn_cast<Function>(CS->getOperand(1))) { | |||
1851 | if (F->getName() == kAsanModuleCtorName) continue; | |||
1852 | auto *Priority = cast<ConstantInt>(CS->getOperand(0)); | |||
1853 | // Don't instrument CTORs that will run before asan.module_ctor. | |||
1854 | if (Priority->getLimitedValue() <= GetCtorAndDtorPriority(TargetTriple)) | |||
1855 | continue; | |||
1856 | poisonOneInitializer(*F, ModuleName); | |||
1857 | } | |||
1858 | } | |||
1859 | } | |||
1860 | ||||
1861 | const GlobalVariable * | |||
1862 | ModuleAddressSanitizer::getExcludedAliasedGlobal(const GlobalAlias &GA) const { | |||
1863 | // In case this function should be expanded to include rules that do not just | |||
1864 | // apply when CompileKernel is true, either guard all existing rules with an | |||
1865 | // 'if (CompileKernel) { ... }' or be absolutely sure that all these rules | |||
1866 | // should also apply to user space. | |||
1867 | assert(CompileKernel && "Only expecting to be called when compiling kernel")((void)0); | |||
1868 | ||||
1869 | const Constant *C = GA.getAliasee(); | |||
1870 | ||||
1871 | // When compiling the kernel, globals that are aliased by symbols prefixed | |||
1872 | // by "__" are special and cannot be padded with a redzone. | |||
1873 | if (GA.getName().startswith("__")) | |||
1874 | return dyn_cast<GlobalVariable>(C->stripPointerCastsAndAliases()); | |||
1875 | ||||
1876 | return nullptr; | |||
1877 | } | |||
1878 | ||||
1879 | bool ModuleAddressSanitizer::shouldInstrumentGlobal(GlobalVariable *G) const { | |||
1880 | Type *Ty = G->getValueType(); | |||
1881 | LLVM_DEBUG(dbgs() << "GLOBAL: " << *G << "\n")do { } while (false); | |||
1882 | ||||
1883 | // FIXME: Metadata should be attched directly to the global directly instead | |||
1884 | // of being added to llvm.asan.globals. | |||
1885 | if (GlobalsMD.get(G).IsExcluded) return false; | |||
1886 | if (!Ty->isSized()) return false; | |||
1887 | if (!G->hasInitializer()) return false; | |||
1888 | // Globals in address space 1 and 4 are supported for AMDGPU. | |||
1889 | if (G->getAddressSpace() && | |||
1890 | !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(G))) | |||
1891 | return false; | |||
1892 | if (GlobalWasGeneratedByCompiler(G)) return false; // Our own globals. | |||
1893 | // Two problems with thread-locals: | |||
1894 | // - The address of the main thread's copy can't be computed at link-time. | |||
1895 | // - Need to poison all copies, not just the main thread's one. | |||
1896 | if (G->isThreadLocal()) return false; | |||
1897 | // For now, just ignore this Global if the alignment is large. | |||
1898 | if (G->getAlignment() > getMinRedzoneSizeForGlobal()) return false; | |||
1899 | ||||
1900 | // For non-COFF targets, only instrument globals known to be defined by this | |||
1901 | // TU. | |||
1902 | // FIXME: We can instrument comdat globals on ELF if we are using the | |||
1903 | // GC-friendly metadata scheme. | |||
1904 | if (!TargetTriple.isOSBinFormatCOFF()) { | |||
1905 | if (!G->hasExactDefinition() || G->hasComdat()) | |||
1906 | return false; | |||
1907 | } else { | |||
1908 | // On COFF, don't instrument non-ODR linkages. | |||
1909 | if (G->isInterposable()) | |||
1910 | return false; | |||
1911 | } | |||
1912 | ||||
1913 | // If a comdat is present, it must have a selection kind that implies ODR | |||
1914 | // semantics: no duplicates, any, or exact match. | |||
1915 | if (Comdat *C = G->getComdat()) { | |||
1916 | switch (C->getSelectionKind()) { | |||
1917 | case Comdat::Any: | |||
1918 | case Comdat::ExactMatch: | |||
1919 | case Comdat::NoDeduplicate: | |||
1920 | break; | |||
1921 | case Comdat::Largest: | |||
1922 | case Comdat::SameSize: | |||
1923 | return false; | |||
1924 | } | |||
1925 | } | |||
1926 | ||||
1927 | if (G->hasSection()) { | |||
1928 | // The kernel uses explicit sections for mostly special global variables | |||
1929 | // that we should not instrument. E.g. the kernel may rely on their layout | |||
1930 | // without redzones, or remove them at link time ("discard.*"), etc. | |||
1931 | if (CompileKernel) | |||
1932 | return false; | |||
1933 | ||||
1934 | StringRef Section = G->getSection(); | |||
1935 | ||||
1936 | // Globals from llvm.metadata aren't emitted, do not instrument them. | |||
1937 | if (Section == "llvm.metadata") return false; | |||
1938 | // Do not instrument globals from special LLVM sections. | |||
1939 | if (Section.find("__llvm") != StringRef::npos || Section.find("__LLVM") != StringRef::npos) return false; | |||
1940 | ||||
1941 | // Do not instrument function pointers to initialization and termination | |||
1942 | // routines: dynamic linker will not properly handle redzones. | |||
1943 | if (Section.startswith(".preinit_array") || | |||
1944 | Section.startswith(".init_array") || | |||
1945 | Section.startswith(".fini_array")) { | |||
1946 | return false; | |||
1947 | } | |||
1948 | ||||
1949 | // Do not instrument user-defined sections (with names resembling | |||
1950 | // valid C identifiers) | |||
1951 | if (TargetTriple.isOSBinFormatELF()) { | |||
1952 | if (llvm::all_of(Section, | |||
1953 | [](char c) { return llvm::isAlnum(c) || c == '_'; })) | |||
1954 | return false; | |||
1955 | } | |||
1956 | ||||
1957 | // On COFF, if the section name contains '$', it is highly likely that the | |||
1958 | // user is using section sorting to create an array of globals similar to | |||
1959 | // the way initialization callbacks are registered in .init_array and | |||
1960 | // .CRT$XCU. The ATL also registers things in .ATL$__[azm]. Adding redzones | |||
1961 | // to such globals is counterproductive, because the intent is that they | |||
1962 | // will form an array, and out-of-bounds accesses are expected. | |||
1963 | // See https://github.com/google/sanitizers/issues/305 | |||
1964 | // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx | |||
1965 | if (TargetTriple.isOSBinFormatCOFF() && Section.contains('$')) { | |||
1966 | LLVM_DEBUG(dbgs() << "Ignoring global in sorted section (contains '$'): "do { } while (false) | |||
1967 | << *G << "\n")do { } while (false); | |||
1968 | return false; | |||
1969 | } | |||
1970 | ||||
1971 | if (TargetTriple.isOSBinFormatMachO()) { | |||
1972 | StringRef ParsedSegment, ParsedSection; | |||
1973 | unsigned TAA = 0, StubSize = 0; | |||
1974 | bool TAAParsed; | |||
1975 | cantFail(MCSectionMachO::ParseSectionSpecifier( | |||
1976 | Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize)); | |||
1977 | ||||
1978 | // Ignore the globals from the __OBJC section. The ObjC runtime assumes | |||
1979 | // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to | |||
1980 | // them. | |||
1981 | if (ParsedSegment == "__OBJC" || | |||
1982 | (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) { | |||
1983 | LLVM_DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n")do { } while (false); | |||
1984 | return false; | |||
1985 | } | |||
1986 | // See https://github.com/google/sanitizers/issues/32 | |||
1987 | // Constant CFString instances are compiled in the following way: | |||
1988 | // -- the string buffer is emitted into | |||
1989 | // __TEXT,__cstring,cstring_literals | |||
1990 | // -- the constant NSConstantString structure referencing that buffer | |||
1991 | // is placed into __DATA,__cfstring | |||
1992 | // Therefore there's no point in placing redzones into __DATA,__cfstring. | |||
1993 | // Moreover, it causes the linker to crash on OS X 10.7 | |||
1994 | if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") { | |||
1995 | LLVM_DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n")do { } while (false); | |||
1996 | return false; | |||
1997 | } | |||
1998 | // The linker merges the contents of cstring_literals and removes the | |||
1999 | // trailing zeroes. | |||
2000 | if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) { | |||
2001 | LLVM_DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n")do { } while (false); | |||
2002 | return false; | |||
2003 | } | |||
2004 | } | |||
2005 | } | |||
2006 | ||||
2007 | if (CompileKernel) { | |||
2008 | // Globals that prefixed by "__" are special and cannot be padded with a | |||
2009 | // redzone. | |||
2010 | if (G->getName().startswith("__")) | |||
2011 | return false; | |||
2012 | } | |||
2013 | ||||
2014 | return true; | |||
2015 | } | |||
2016 | ||||
2017 | // On Mach-O platforms, we emit global metadata in a separate section of the | |||
2018 | // binary in order to allow the linker to properly dead strip. This is only | |||
2019 | // supported on recent versions of ld64. | |||
2020 | bool ModuleAddressSanitizer::ShouldUseMachOGlobalsSection() const { | |||
2021 | if (!TargetTriple.isOSBinFormatMachO()) | |||
2022 | return false; | |||
2023 | ||||
2024 | if (TargetTriple.isMacOSX() && !TargetTriple.isMacOSXVersionLT(10, 11)) | |||
2025 | return true; | |||
2026 | if (TargetTriple.isiOS() /* or tvOS */ && !TargetTriple.isOSVersionLT(9)) | |||
2027 | return true; | |||
2028 | if (TargetTriple.isWatchOS() && !TargetTriple.isOSVersionLT(2)) | |||
2029 | return true; | |||
2030 | ||||
2031 | return false; | |||
2032 | } | |||
2033 | ||||
2034 | StringRef ModuleAddressSanitizer::getGlobalMetadataSection() const { | |||
2035 | switch (TargetTriple.getObjectFormat()) { | |||
2036 | case Triple::COFF: return ".ASAN$GL"; | |||
2037 | case Triple::ELF: return "asan_globals"; | |||
2038 | case Triple::MachO: return "__DATA,__asan_globals,regular"; | |||
2039 | case Triple::Wasm: | |||
2040 | case Triple::GOFF: | |||
2041 | case Triple::XCOFF: | |||
2042 | report_fatal_error( | |||
2043 | "ModuleAddressSanitizer not implemented for object file format"); | |||
2044 | case Triple::UnknownObjectFormat: | |||
2045 | break; | |||
2046 | } | |||
2047 | llvm_unreachable("unsupported object format")__builtin_unreachable(); | |||
2048 | } | |||
2049 | ||||
2050 | void ModuleAddressSanitizer::initializeCallbacks(Module &M) { | |||
2051 | IRBuilder<> IRB(*C); | |||
2052 | ||||
2053 | // Declare our poisoning and unpoisoning functions. | |||
2054 | AsanPoisonGlobals = | |||
2055 | M.getOrInsertFunction(kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy); | |||
2056 | AsanUnpoisonGlobals = | |||
2057 | M.getOrInsertFunction(kAsanUnpoisonGlobalsName, IRB.getVoidTy()); | |||
2058 | ||||
2059 | // Declare functions that register/unregister globals. | |||
2060 | AsanRegisterGlobals = M.getOrInsertFunction( | |||
2061 | kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2062 | AsanUnregisterGlobals = M.getOrInsertFunction( | |||
2063 | kAsanUnregisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2064 | ||||
2065 | // Declare the functions that find globals in a shared object and then invoke | |||
2066 | // the (un)register function on them. | |||
2067 | AsanRegisterImageGlobals = M.getOrInsertFunction( | |||
2068 | kAsanRegisterImageGlobalsName, IRB.getVoidTy(), IntptrTy); | |||
2069 | AsanUnregisterImageGlobals = M.getOrInsertFunction( | |||
2070 | kAsanUnregisterImageGlobalsName, IRB.getVoidTy(), IntptrTy); | |||
2071 | ||||
2072 | AsanRegisterElfGlobals = | |||
2073 | M.getOrInsertFunction(kAsanRegisterElfGlobalsName, IRB.getVoidTy(), | |||
2074 | IntptrTy, IntptrTy, IntptrTy); | |||
2075 | AsanUnregisterElfGlobals = | |||
2076 | M.getOrInsertFunction(kAsanUnregisterElfGlobalsName, IRB.getVoidTy(), | |||
2077 | IntptrTy, IntptrTy, IntptrTy); | |||
2078 | } | |||
2079 | ||||
2080 | // Put the metadata and the instrumented global in the same group. This ensures | |||
2081 | // that the metadata is discarded if the instrumented global is discarded. | |||
2082 | void ModuleAddressSanitizer::SetComdatForGlobalMetadata( | |||
2083 | GlobalVariable *G, GlobalVariable *Metadata, StringRef InternalSuffix) { | |||
2084 | Module &M = *G->getParent(); | |||
2085 | Comdat *C = G->getComdat(); | |||
2086 | if (!C) { | |||
2087 | if (!G->hasName()) { | |||
2088 | // If G is unnamed, it must be internal. Give it an artificial name | |||
2089 | // so we can put it in a comdat. | |||
2090 | assert(G->hasLocalLinkage())((void)0); | |||
2091 | G->setName(Twine(kAsanGenPrefix) + "_anon_global"); | |||
2092 | } | |||
2093 | ||||
2094 | if (!InternalSuffix.empty() && G->hasLocalLinkage()) { | |||
2095 | std::string Name = std::string(G->getName()); | |||
2096 | Name += InternalSuffix; | |||
2097 | C = M.getOrInsertComdat(Name); | |||
2098 | } else { | |||
2099 | C = M.getOrInsertComdat(G->getName()); | |||
2100 | } | |||
2101 | ||||
2102 | // Make this IMAGE_COMDAT_SELECT_NODUPLICATES on COFF. Also upgrade private | |||
2103 | // linkage to internal linkage so that a symbol table entry is emitted. This | |||
2104 | // is necessary in order to create the comdat group. | |||
2105 | if (TargetTriple.isOSBinFormatCOFF()) { | |||
2106 | C->setSelectionKind(Comdat::NoDeduplicate); | |||
2107 | if (G->hasPrivateLinkage()) | |||
2108 | G->setLinkage(GlobalValue::InternalLinkage); | |||
2109 | } | |||
2110 | G->setComdat(C); | |||
2111 | } | |||
2112 | ||||
2113 | assert(G->hasComdat())((void)0); | |||
2114 | Metadata->setComdat(G->getComdat()); | |||
2115 | } | |||
2116 | ||||
2117 | // Create a separate metadata global and put it in the appropriate ASan | |||
2118 | // global registration section. | |||
2119 | GlobalVariable * | |||
2120 | ModuleAddressSanitizer::CreateMetadataGlobal(Module &M, Constant *Initializer, | |||
2121 | StringRef OriginalName) { | |||
2122 | auto Linkage = TargetTriple.isOSBinFormatMachO() | |||
2123 | ? GlobalVariable::InternalLinkage | |||
2124 | : GlobalVariable::PrivateLinkage; | |||
2125 | GlobalVariable *Metadata = new GlobalVariable( | |||
2126 | M, Initializer->getType(), false, Linkage, Initializer, | |||
2127 | Twine("__asan_global_") + GlobalValue::dropLLVMManglingEscape(OriginalName)); | |||
2128 | Metadata->setSection(getGlobalMetadataSection()); | |||
2129 | return Metadata; | |||
2130 | } | |||
2131 | ||||
2132 | Instruction *ModuleAddressSanitizer::CreateAsanModuleDtor(Module &M) { | |||
2133 | AsanDtorFunction = Function::createWithDefaultAttr( | |||
2134 | FunctionType::get(Type::getVoidTy(*C), false), | |||
2135 | GlobalValue::InternalLinkage, 0, kAsanModuleDtorName, &M); | |||
2136 | AsanDtorFunction->addAttribute(AttributeList::FunctionIndex, | |||
2137 | Attribute::NoUnwind); | |||
2138 | // Ensure Dtor cannot be discarded, even if in a comdat. | |||
2139 | appendToUsed(M, {AsanDtorFunction}); | |||
2140 | BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); | |||
2141 | ||||
2142 | return ReturnInst::Create(*C, AsanDtorBB); | |||
2143 | } | |||
2144 | ||||
2145 | void ModuleAddressSanitizer::InstrumentGlobalsCOFF( | |||
2146 | IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
2147 | ArrayRef<Constant *> MetadataInitializers) { | |||
2148 | assert(ExtendedGlobals.size() == MetadataInitializers.size())((void)0); | |||
2149 | auto &DL = M.getDataLayout(); | |||
2150 | ||||
2151 | SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size()); | |||
2152 | for (size_t i = 0; i < ExtendedGlobals.size(); i++) { | |||
2153 | Constant *Initializer = MetadataInitializers[i]; | |||
2154 | GlobalVariable *G = ExtendedGlobals[i]; | |||
2155 | GlobalVariable *Metadata = | |||
2156 | CreateMetadataGlobal(M, Initializer, G->getName()); | |||
2157 | MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G)); | |||
2158 | Metadata->setMetadata(LLVMContext::MD_associated, MD); | |||
2159 | MetadataGlobals[i] = Metadata; | |||
2160 | ||||
2161 | // The MSVC linker always inserts padding when linking incrementally. We | |||
2162 | // cope with that by aligning each struct to its size, which must be a power | |||
2163 | // of two. | |||
2164 | unsigned SizeOfGlobalStruct = DL.getTypeAllocSize(Initializer->getType()); | |||
2165 | assert(isPowerOf2_32(SizeOfGlobalStruct) &&((void)0) | |||
2166 | "global metadata will not be padded appropriately")((void)0); | |||
2167 | Metadata->setAlignment(assumeAligned(SizeOfGlobalStruct)); | |||
2168 | ||||
2169 | SetComdatForGlobalMetadata(G, Metadata, ""); | |||
2170 | } | |||
2171 | ||||
2172 | // Update llvm.compiler.used, adding the new metadata globals. This is | |||
2173 | // needed so that during LTO these variables stay alive. | |||
2174 | if (!MetadataGlobals.empty()) | |||
2175 | appendToCompilerUsed(M, MetadataGlobals); | |||
2176 | } | |||
2177 | ||||
2178 | void ModuleAddressSanitizer::InstrumentGlobalsELF( | |||
2179 | IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
2180 | ArrayRef<Constant *> MetadataInitializers, | |||
2181 | const std::string &UniqueModuleId) { | |||
2182 | assert(ExtendedGlobals.size() == MetadataInitializers.size())((void)0); | |||
2183 | ||||
2184 | // Putting globals in a comdat changes the semantic and potentially cause | |||
2185 | // false negative odr violations at link time. If odr indicators are used, we | |||
2186 | // keep the comdat sections, as link time odr violations will be dectected on | |||
2187 | // the odr indicator symbols. | |||
2188 | bool UseComdatForGlobalsGC = UseOdrIndicator; | |||
2189 | ||||
2190 | SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size()); | |||
2191 | for (size_t i = 0; i < ExtendedGlobals.size(); i++) { | |||
2192 | GlobalVariable *G = ExtendedGlobals[i]; | |||
2193 | GlobalVariable *Metadata = | |||
2194 | CreateMetadataGlobal(M, MetadataInitializers[i], G->getName()); | |||
2195 | MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G)); | |||
2196 | Metadata->setMetadata(LLVMContext::MD_associated, MD); | |||
2197 | MetadataGlobals[i] = Metadata; | |||
2198 | ||||
2199 | if (UseComdatForGlobalsGC) | |||
2200 | SetComdatForGlobalMetadata(G, Metadata, UniqueModuleId); | |||
2201 | } | |||
2202 | ||||
2203 | // Update llvm.compiler.used, adding the new metadata globals. This is | |||
2204 | // needed so that during LTO these variables stay alive. | |||
2205 | if (!MetadataGlobals.empty()) | |||
2206 | appendToCompilerUsed(M, MetadataGlobals); | |||
2207 | ||||
2208 | // RegisteredFlag serves two purposes. First, we can pass it to dladdr() | |||
2209 | // to look up the loaded image that contains it. Second, we can store in it | |||
2210 | // whether registration has already occurred, to prevent duplicate | |||
2211 | // registration. | |||
2212 | // | |||
2213 | // Common linkage ensures that there is only one global per shared library. | |||
2214 | GlobalVariable *RegisteredFlag = new GlobalVariable( | |||
2215 | M, IntptrTy, false, GlobalVariable::CommonLinkage, | |||
2216 | ConstantInt::get(IntptrTy, 0), kAsanGlobalsRegisteredFlagName); | |||
2217 | RegisteredFlag->setVisibility(GlobalVariable::HiddenVisibility); | |||
2218 | ||||
2219 | // Create start and stop symbols. | |||
2220 | GlobalVariable *StartELFMetadata = new GlobalVariable( | |||
2221 | M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr, | |||
2222 | "__start_" + getGlobalMetadataSection()); | |||
2223 | StartELFMetadata->setVisibility(GlobalVariable::HiddenVisibility); | |||
2224 | GlobalVariable *StopELFMetadata = new GlobalVariable( | |||
2225 | M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr, | |||
2226 | "__stop_" + getGlobalMetadataSection()); | |||
2227 | StopELFMetadata->setVisibility(GlobalVariable::HiddenVisibility); | |||
2228 | ||||
2229 | // Create a call to register the globals with the runtime. | |||
2230 | IRB.CreateCall(AsanRegisterElfGlobals, | |||
2231 | {IRB.CreatePointerCast(RegisteredFlag, IntptrTy), | |||
2232 | IRB.CreatePointerCast(StartELFMetadata, IntptrTy), | |||
2233 | IRB.CreatePointerCast(StopELFMetadata, IntptrTy)}); | |||
2234 | ||||
2235 | // We also need to unregister globals at the end, e.g., when a shared library | |||
2236 | // gets closed. | |||
2237 | if (DestructorKind != AsanDtorKind::None) { | |||
2238 | IRBuilder<> IrbDtor(CreateAsanModuleDtor(M)); | |||
2239 | IrbDtor.CreateCall(AsanUnregisterElfGlobals, | |||
2240 | {IRB.CreatePointerCast(RegisteredFlag, IntptrTy), | |||
2241 | IRB.CreatePointerCast(StartELFMetadata, IntptrTy), | |||
2242 | IRB.CreatePointerCast(StopELFMetadata, IntptrTy)}); | |||
2243 | } | |||
2244 | } | |||
2245 | ||||
2246 | void ModuleAddressSanitizer::InstrumentGlobalsMachO( | |||
2247 | IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
2248 | ArrayRef<Constant *> MetadataInitializers) { | |||
2249 | assert(ExtendedGlobals.size() == MetadataInitializers.size())((void)0); | |||
2250 | ||||
2251 | // On recent Mach-O platforms, use a structure which binds the liveness of | |||
2252 | // the global variable to the metadata struct. Keep the list of "Liveness" GV | |||
2253 | // created to be added to llvm.compiler.used | |||
2254 | StructType *LivenessTy = StructType::get(IntptrTy, IntptrTy); | |||
2255 | SmallVector<GlobalValue *, 16> LivenessGlobals(ExtendedGlobals.size()); | |||
2256 | ||||
2257 | for (size_t i = 0; i < ExtendedGlobals.size(); i++) { | |||
2258 | Constant *Initializer = MetadataInitializers[i]; | |||
2259 | GlobalVariable *G = ExtendedGlobals[i]; | |||
2260 | GlobalVariable *Metadata = | |||
2261 | CreateMetadataGlobal(M, Initializer, G->getName()); | |||
2262 | ||||
2263 | // On recent Mach-O platforms, we emit the global metadata in a way that | |||
2264 | // allows the linker to properly strip dead globals. | |||
2265 | auto LivenessBinder = | |||
2266 | ConstantStruct::get(LivenessTy, Initializer->getAggregateElement(0u), | |||
2267 | ConstantExpr::getPointerCast(Metadata, IntptrTy)); | |||
2268 | GlobalVariable *Liveness = new GlobalVariable( | |||
2269 | M, LivenessTy, false, GlobalVariable::InternalLinkage, LivenessBinder, | |||
2270 | Twine("__asan_binder_") + G->getName()); | |||
2271 | Liveness->setSection("__DATA,__asan_liveness,regular,live_support"); | |||
2272 | LivenessGlobals[i] = Liveness; | |||
2273 | } | |||
2274 | ||||
2275 | // Update llvm.compiler.used, adding the new liveness globals. This is | |||
2276 | // needed so that during LTO these variables stay alive. The alternative | |||
2277 | // would be to have the linker handling the LTO symbols, but libLTO | |||
2278 | // current API does not expose access to the section for each symbol. | |||
2279 | if (!LivenessGlobals.empty()) | |||
2280 | appendToCompilerUsed(M, LivenessGlobals); | |||
2281 | ||||
2282 | // RegisteredFlag serves two purposes. First, we can pass it to dladdr() | |||
2283 | // to look up the loaded image that contains it. Second, we can store in it | |||
2284 | // whether registration has already occurred, to prevent duplicate | |||
2285 | // registration. | |||
2286 | // | |||
2287 | // common linkage ensures that there is only one global per shared library. | |||
2288 | GlobalVariable *RegisteredFlag = new GlobalVariable( | |||
2289 | M, IntptrTy, false, GlobalVariable::CommonLinkage, | |||
2290 | ConstantInt::get(IntptrTy, 0), kAsanGlobalsRegisteredFlagName); | |||
2291 | RegisteredFlag->setVisibility(GlobalVariable::HiddenVisibility); | |||
2292 | ||||
2293 | IRB.CreateCall(AsanRegisterImageGlobals, | |||
2294 | {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)}); | |||
2295 | ||||
2296 | // We also need to unregister globals at the end, e.g., when a shared library | |||
2297 | // gets closed. | |||
2298 | if (DestructorKind != AsanDtorKind::None) { | |||
2299 | IRBuilder<> IrbDtor(CreateAsanModuleDtor(M)); | |||
2300 | IrbDtor.CreateCall(AsanUnregisterImageGlobals, | |||
2301 | {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)}); | |||
2302 | } | |||
2303 | } | |||
2304 | ||||
2305 | void ModuleAddressSanitizer::InstrumentGlobalsWithMetadataArray( | |||
2306 | IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, | |||
2307 | ArrayRef<Constant *> MetadataInitializers) { | |||
2308 | assert(ExtendedGlobals.size() == MetadataInitializers.size())((void)0); | |||
2309 | unsigned N = ExtendedGlobals.size(); | |||
2310 | assert(N > 0)((void)0); | |||
2311 | ||||
2312 | // On platforms that don't have a custom metadata section, we emit an array | |||
2313 | // of global metadata structures. | |||
2314 | ArrayType *ArrayOfGlobalStructTy = | |||
2315 | ArrayType::get(MetadataInitializers[0]->getType(), N); | |||
2316 | auto AllGlobals = new GlobalVariable( | |||
2317 | M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage, | |||
2318 | ConstantArray::get(ArrayOfGlobalStructTy, MetadataInitializers), ""); | |||
2319 | if (Mapping.Scale > 3) | |||
2320 | AllGlobals->setAlignment(Align(1ULL << Mapping.Scale)); | |||
2321 | ||||
2322 | IRB.CreateCall(AsanRegisterGlobals, | |||
2323 | {IRB.CreatePointerCast(AllGlobals, IntptrTy), | |||
2324 | ConstantInt::get(IntptrTy, N)}); | |||
2325 | ||||
2326 | // We also need to unregister globals at the end, e.g., when a shared library | |||
2327 | // gets closed. | |||
2328 | if (DestructorKind != AsanDtorKind::None) { | |||
2329 | IRBuilder<> IrbDtor(CreateAsanModuleDtor(M)); | |||
2330 | IrbDtor.CreateCall(AsanUnregisterGlobals, | |||
2331 | {IRB.CreatePointerCast(AllGlobals, IntptrTy), | |||
2332 | ConstantInt::get(IntptrTy, N)}); | |||
2333 | } | |||
2334 | } | |||
2335 | ||||
2336 | // This function replaces all global variables with new variables that have | |||
2337 | // trailing redzones. It also creates a function that poisons | |||
2338 | // redzones and inserts this function into llvm.global_ctors. | |||
2339 | // Sets *CtorComdat to true if the global registration code emitted into the | |||
2340 | // asan constructor is comdat-compatible. | |||
2341 | bool ModuleAddressSanitizer::InstrumentGlobals(IRBuilder<> &IRB, Module &M, | |||
2342 | bool *CtorComdat) { | |||
2343 | *CtorComdat = false; | |||
2344 | ||||
2345 | // Build set of globals that are aliased by some GA, where | |||
2346 | // getExcludedAliasedGlobal(GA) returns the relevant GlobalVariable. | |||
2347 | SmallPtrSet<const GlobalVariable *, 16> AliasedGlobalExclusions; | |||
2348 | if (CompileKernel) { | |||
2349 | for (auto &GA : M.aliases()) { | |||
2350 | if (const GlobalVariable *GV = getExcludedAliasedGlobal(GA)) | |||
2351 | AliasedGlobalExclusions.insert(GV); | |||
2352 | } | |||
2353 | } | |||
2354 | ||||
2355 | SmallVector<GlobalVariable *, 16> GlobalsToChange; | |||
2356 | for (auto &G : M.globals()) { | |||
2357 | if (!AliasedGlobalExclusions.count(&G) && shouldInstrumentGlobal(&G)) | |||
2358 | GlobalsToChange.push_back(&G); | |||
2359 | } | |||
2360 | ||||
2361 | size_t n = GlobalsToChange.size(); | |||
2362 | if (n == 0) { | |||
2363 | *CtorComdat = true; | |||
2364 | return false; | |||
2365 | } | |||
2366 | ||||
2367 | auto &DL = M.getDataLayout(); | |||
2368 | ||||
2369 | // A global is described by a structure | |||
2370 | // size_t beg; | |||
2371 | // size_t size; | |||
2372 | // size_t size_with_redzone; | |||
2373 | // const char *name; | |||
2374 | // const char *module_name; | |||
2375 | // size_t has_dynamic_init; | |||
2376 | // void *source_location; | |||
2377 | // size_t odr_indicator; | |||
2378 | // We initialize an array of such structures and pass it to a run-time call. | |||
2379 | StructType *GlobalStructTy = | |||
2380 | StructType::get(IntptrTy, IntptrTy, IntptrTy, IntptrTy, IntptrTy, | |||
2381 | IntptrTy, IntptrTy, IntptrTy); | |||
2382 | SmallVector<GlobalVariable *, 16> NewGlobals(n); | |||
2383 | SmallVector<Constant *, 16> Initializers(n); | |||
2384 | ||||
2385 | bool HasDynamicallyInitializedGlobals = false; | |||
2386 | ||||
2387 | // We shouldn't merge same module names, as this string serves as unique | |||
2388 | // module ID in runtime. | |||
2389 | GlobalVariable *ModuleName = createPrivateGlobalForString( | |||
2390 | M, M.getModuleIdentifier(), /*AllowMerging*/ false, kAsanGenPrefix); | |||
2391 | ||||
2392 | for (size_t i = 0; i < n; i++) { | |||
2393 | GlobalVariable *G = GlobalsToChange[i]; | |||
2394 | ||||
2395 | // FIXME: Metadata should be attched directly to the global directly instead | |||
2396 | // of being added to llvm.asan.globals. | |||
2397 | auto MD = GlobalsMD.get(G); | |||
2398 | StringRef NameForGlobal = G->getName(); | |||
2399 | // Create string holding the global name (use global name from metadata | |||
2400 | // if it's available, otherwise just write the name of global variable). | |||
2401 | GlobalVariable *Name = createPrivateGlobalForString( | |||
2402 | M, MD.Name.empty() ? NameForGlobal : MD.Name, | |||
2403 | /*AllowMerging*/ true, kAsanGenPrefix); | |||
2404 | ||||
2405 | Type *Ty = G->getValueType(); | |||
2406 | const uint64_t SizeInBytes = DL.getTypeAllocSize(Ty); | |||
2407 | const uint64_t RightRedzoneSize = getRedzoneSizeForGlobal(SizeInBytes); | |||
2408 | Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); | |||
2409 | ||||
2410 | StructType *NewTy = StructType::get(Ty, RightRedZoneTy); | |||
2411 | Constant *NewInitializer = ConstantStruct::get( | |||
2412 | NewTy, G->getInitializer(), Constant::getNullValue(RightRedZoneTy)); | |||
2413 | ||||
2414 | // Create a new global variable with enough space for a redzone. | |||
2415 | GlobalValue::LinkageTypes Linkage = G->getLinkage(); | |||
2416 | if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage) | |||
2417 | Linkage = GlobalValue::InternalLinkage; | |||
2418 | GlobalVariable *NewGlobal = new GlobalVariable( | |||
2419 | M, NewTy, G->isConstant(), Linkage, NewInitializer, "", G, | |||
2420 | G->getThreadLocalMode(), G->getAddressSpace()); | |||
2421 | NewGlobal->copyAttributesFrom(G); | |||
2422 | NewGlobal->setComdat(G->getComdat()); | |||
2423 | NewGlobal->setAlignment(MaybeAlign(getMinRedzoneSizeForGlobal())); | |||
2424 | // Don't fold globals with redzones. ODR violation detector and redzone | |||
2425 | // poisoning implicitly creates a dependence on the global's address, so it | |||
2426 | // is no longer valid for it to be marked unnamed_addr. | |||
2427 | NewGlobal->setUnnamedAddr(GlobalValue::UnnamedAddr::None); | |||
2428 | ||||
2429 | // Move null-terminated C strings to "__asan_cstring" section on Darwin. | |||
2430 | if (TargetTriple.isOSBinFormatMachO() && !G->hasSection() && | |||
2431 | G->isConstant()) { | |||
2432 | auto Seq = dyn_cast<ConstantDataSequential>(G->getInitializer()); | |||
2433 | if (Seq && Seq->isCString()) | |||
2434 | NewGlobal->setSection("__TEXT,__asan_cstring,regular"); | |||
2435 | } | |||
2436 | ||||
2437 | // Transfer the debug info and type metadata. The payload starts at offset | |||
2438 | // zero so we can copy the metadata over as is. | |||
2439 | NewGlobal->copyMetadata(G, 0); | |||
2440 | ||||
2441 | Value *Indices2[2]; | |||
2442 | Indices2[0] = IRB.getInt32(0); | |||
2443 | Indices2[1] = IRB.getInt32(0); | |||
2444 | ||||
2445 | G->replaceAllUsesWith( | |||
2446 | ConstantExpr::getGetElementPtr(NewTy, NewGlobal, Indices2, true)); | |||
2447 | NewGlobal->takeName(G); | |||
2448 | G->eraseFromParent(); | |||
2449 | NewGlobals[i] = NewGlobal; | |||
2450 | ||||
2451 | Constant *SourceLoc; | |||
2452 | if (!MD.SourceLoc.empty()) { | |||
2453 | auto SourceLocGlobal = createPrivateGlobalForSourceLoc(M, MD.SourceLoc); | |||
2454 | SourceLoc = ConstantExpr::getPointerCast(SourceLocGlobal, IntptrTy); | |||
2455 | } else { | |||
2456 | SourceLoc = ConstantInt::get(IntptrTy, 0); | |||
2457 | } | |||
2458 | ||||
2459 | Constant *ODRIndicator = ConstantExpr::getNullValue(IRB.getInt8PtrTy()); | |||
2460 | GlobalValue *InstrumentedGlobal = NewGlobal; | |||
2461 | ||||
2462 | bool CanUsePrivateAliases = | |||
2463 | TargetTriple.isOSBinFormatELF() || TargetTriple.isOSBinFormatMachO() || | |||
2464 | TargetTriple.isOSBinFormatWasm(); | |||
2465 | if (CanUsePrivateAliases && UsePrivateAlias) { | |||
2466 | // Create local alias for NewGlobal to avoid crash on ODR between | |||
2467 | // instrumented and non-instrumented libraries. | |||
2468 | InstrumentedGlobal = | |||
2469 | GlobalAlias::create(GlobalValue::PrivateLinkage, "", NewGlobal); | |||
2470 | } | |||
2471 | ||||
2472 | // ODR should not happen for local linkage. | |||
2473 | if (NewGlobal->hasLocalLinkage()) { | |||
2474 | ODRIndicator = ConstantExpr::getIntToPtr(ConstantInt::get(IntptrTy, -1), | |||
2475 | IRB.getInt8PtrTy()); | |||
2476 | } else if (UseOdrIndicator) { | |||
2477 | // With local aliases, we need to provide another externally visible | |||
2478 | // symbol __odr_asan_XXX to detect ODR violation. | |||
2479 | auto *ODRIndicatorSym = | |||
2480 | new GlobalVariable(M, IRB.getInt8Ty(), false, Linkage, | |||
2481 | Constant::getNullValue(IRB.getInt8Ty()), | |||
2482 | kODRGenPrefix + NameForGlobal, nullptr, | |||
2483 | NewGlobal->getThreadLocalMode()); | |||
2484 | ||||
2485 | // Set meaningful attributes for indicator symbol. | |||
2486 | ODRIndicatorSym->setVisibility(NewGlobal->getVisibility()); | |||
2487 | ODRIndicatorSym->setDLLStorageClass(NewGlobal->getDLLStorageClass()); | |||
2488 | ODRIndicatorSym->setAlignment(Align(1)); | |||
2489 | ODRIndicator = ODRIndicatorSym; | |||
2490 | } | |||
2491 | ||||
2492 | Constant *Initializer = ConstantStruct::get( | |||
2493 | GlobalStructTy, | |||
2494 | ConstantExpr::getPointerCast(InstrumentedGlobal, IntptrTy), | |||
2495 | ConstantInt::get(IntptrTy, SizeInBytes), | |||
2496 | ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), | |||
2497 | ConstantExpr::getPointerCast(Name, IntptrTy), | |||
2498 | ConstantExpr::getPointerCast(ModuleName, IntptrTy), | |||
2499 | ConstantInt::get(IntptrTy, MD.IsDynInit), SourceLoc, | |||
2500 | ConstantExpr::getPointerCast(ODRIndicator, IntptrTy)); | |||
2501 | ||||
2502 | if (ClInitializers && MD.IsDynInit) HasDynamicallyInitializedGlobals = true; | |||
2503 | ||||
2504 | LLVM_DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n")do { } while (false); | |||
2505 | ||||
2506 | Initializers[i] = Initializer; | |||
2507 | } | |||
2508 | ||||
2509 | // Add instrumented globals to llvm.compiler.used list to avoid LTO from | |||
2510 | // ConstantMerge'ing them. | |||
2511 | SmallVector<GlobalValue *, 16> GlobalsToAddToUsedList; | |||
2512 | for (size_t i = 0; i < n; i++) { | |||
2513 | GlobalVariable *G = NewGlobals[i]; | |||
2514 | if (G->getName().empty()) continue; | |||
2515 | GlobalsToAddToUsedList.push_back(G); | |||
2516 | } | |||
2517 | appendToCompilerUsed(M, ArrayRef<GlobalValue *>(GlobalsToAddToUsedList)); | |||
2518 | ||||
2519 | std::string ELFUniqueModuleId = | |||
2520 | (UseGlobalsGC && TargetTriple.isOSBinFormatELF()) ? getUniqueModuleId(&M) | |||
2521 | : ""; | |||
2522 | ||||
2523 | if (!ELFUniqueModuleId.empty()) { | |||
2524 | InstrumentGlobalsELF(IRB, M, NewGlobals, Initializers, ELFUniqueModuleId); | |||
2525 | *CtorComdat = true; | |||
2526 | } else if (UseGlobalsGC && TargetTriple.isOSBinFormatCOFF()) { | |||
2527 | InstrumentGlobalsCOFF(IRB, M, NewGlobals, Initializers); | |||
2528 | } else if (UseGlobalsGC && ShouldUseMachOGlobalsSection()) { | |||
2529 | InstrumentGlobalsMachO(IRB, M, NewGlobals, Initializers); | |||
2530 | } else { | |||
2531 | InstrumentGlobalsWithMetadataArray(IRB, M, NewGlobals, Initializers); | |||
2532 | } | |||
2533 | ||||
2534 | // Create calls for poisoning before initializers run and unpoisoning after. | |||
2535 | if (HasDynamicallyInitializedGlobals) | |||
2536 | createInitializerPoisonCalls(M, ModuleName); | |||
2537 | ||||
2538 | LLVM_DEBUG(dbgs() << M)do { } while (false); | |||
2539 | return true; | |||
2540 | } | |||
2541 | ||||
2542 | uint64_t | |||
2543 | ModuleAddressSanitizer::getRedzoneSizeForGlobal(uint64_t SizeInBytes) const { | |||
2544 | constexpr uint64_t kMaxRZ = 1 << 18; | |||
2545 | const uint64_t MinRZ = getMinRedzoneSizeForGlobal(); | |||
2546 | ||||
2547 | uint64_t RZ = 0; | |||
2548 | if (SizeInBytes <= MinRZ / 2) { | |||
2549 | // Reduce redzone size for small size objects, e.g. int, char[1]. MinRZ is | |||
2550 | // at least 32 bytes, optimize when SizeInBytes is less than or equal to | |||
2551 | // half of MinRZ. | |||
2552 | RZ = MinRZ - SizeInBytes; | |||
2553 | } else { | |||
2554 | // Calculate RZ, where MinRZ <= RZ <= MaxRZ, and RZ ~ 1/4 * SizeInBytes. | |||
2555 | RZ = std::max(MinRZ, std::min(kMaxRZ, (SizeInBytes / MinRZ / 4) * MinRZ)); | |||
2556 | ||||
2557 | // Round up to multiple of MinRZ. | |||
2558 | if (SizeInBytes % MinRZ) | |||
2559 | RZ += MinRZ - (SizeInBytes % MinRZ); | |||
2560 | } | |||
2561 | ||||
2562 | assert((RZ + SizeInBytes) % MinRZ == 0)((void)0); | |||
2563 | ||||
2564 | return RZ; | |||
2565 | } | |||
2566 | ||||
2567 | int ModuleAddressSanitizer::GetAsanVersion(const Module &M) const { | |||
2568 | int LongSize = M.getDataLayout().getPointerSizeInBits(); | |||
2569 | bool isAndroid = Triple(M.getTargetTriple()).isAndroid(); | |||
2570 | int Version = 8; | |||
2571 | // 32-bit Android is one version ahead because of the switch to dynamic | |||
2572 | // shadow. | |||
2573 | Version += (LongSize == 32 && isAndroid); | |||
2574 | return Version; | |||
2575 | } | |||
2576 | ||||
2577 | bool ModuleAddressSanitizer::instrumentModule(Module &M) { | |||
2578 | initializeCallbacks(M); | |||
2579 | ||||
2580 | // Create a module constructor. A destructor is created lazily because not all | |||
2581 | // platforms, and not all modules need it. | |||
2582 | if (CompileKernel) { | |||
2583 | // The kernel always builds with its own runtime, and therefore does not | |||
2584 | // need the init and version check calls. | |||
2585 | AsanCtorFunction = createSanitizerCtor(M, kAsanModuleCtorName); | |||
2586 | } else { | |||
2587 | std::string AsanVersion = std::to_string(GetAsanVersion(M)); | |||
2588 | std::string VersionCheckName = | |||
2589 | ClInsertVersionCheck ? (kAsanVersionCheckNamePrefix + AsanVersion) : ""; | |||
2590 | std::tie(AsanCtorFunction, std::ignore) = | |||
2591 | createSanitizerCtorAndInitFunctions(M, kAsanModuleCtorName, | |||
2592 | kAsanInitName, /*InitArgTypes=*/{}, | |||
2593 | /*InitArgs=*/{}, VersionCheckName); | |||
2594 | } | |||
2595 | ||||
2596 | bool CtorComdat = true; | |||
2597 | if (ClGlobals) { | |||
2598 | IRBuilder<> IRB(AsanCtorFunction->getEntryBlock().getTerminator()); | |||
2599 | InstrumentGlobals(IRB, M, &CtorComdat); | |||
2600 | } | |||
2601 | ||||
2602 | const uint64_t Priority = GetCtorAndDtorPriority(TargetTriple); | |||
2603 | ||||
2604 | // Put the constructor and destructor in comdat if both | |||
2605 | // (1) global instrumentation is not TU-specific | |||
2606 | // (2) target is ELF. | |||
2607 | if (UseCtorComdat && TargetTriple.isOSBinFormatELF() && CtorComdat) { | |||
2608 | AsanCtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleCtorName)); | |||
2609 | appendToGlobalCtors(M, AsanCtorFunction, Priority, AsanCtorFunction); | |||
2610 | if (AsanDtorFunction) { | |||
2611 | AsanDtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleDtorName)); | |||
2612 | appendToGlobalDtors(M, AsanDtorFunction, Priority, AsanDtorFunction); | |||
2613 | } | |||
2614 | } else { | |||
2615 | appendToGlobalCtors(M, AsanCtorFunction, Priority); | |||
2616 | if (AsanDtorFunction) | |||
2617 | appendToGlobalDtors(M, AsanDtorFunction, Priority); | |||
2618 | } | |||
2619 | ||||
2620 | return true; | |||
2621 | } | |||
2622 | ||||
2623 | void AddressSanitizer::initializeCallbacks(Module &M) { | |||
2624 | IRBuilder<> IRB(*C); | |||
2625 | // Create __asan_report* callbacks. | |||
2626 | // IsWrite, TypeSize and Exp are encoded in the function name. | |||
2627 | for (int Exp = 0; Exp < 2; Exp++) { | |||
2628 | for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { | |||
2629 | const std::string TypeStr = AccessIsWrite ? "store" : "load"; | |||
2630 | const std::string ExpStr = Exp ? "exp_" : ""; | |||
2631 | const std::string EndingStr = Recover ? "_noabort" : ""; | |||
2632 | ||||
2633 | SmallVector<Type *, 3> Args2 = {IntptrTy, IntptrTy}; | |||
2634 | SmallVector<Type *, 2> Args1{1, IntptrTy}; | |||
2635 | if (Exp) { | |||
2636 | Type *ExpType = Type::getInt32Ty(*C); | |||
2637 | Args2.push_back(ExpType); | |||
2638 | Args1.push_back(ExpType); | |||
2639 | } | |||
2640 | AsanErrorCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction( | |||
2641 | kAsanReportErrorTemplate + ExpStr + TypeStr + "_n" + EndingStr, | |||
2642 | FunctionType::get(IRB.getVoidTy(), Args2, false)); | |||
2643 | ||||
2644 | AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction( | |||
2645 | ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr, | |||
2646 | FunctionType::get(IRB.getVoidTy(), Args2, false)); | |||
2647 | ||||
2648 | for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; | |||
2649 | AccessSizeIndex++) { | |||
2650 | const std::string Suffix = TypeStr + itostr(1ULL << AccessSizeIndex); | |||
2651 | AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] = | |||
2652 | M.getOrInsertFunction( | |||
2653 | kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr, | |||
2654 | FunctionType::get(IRB.getVoidTy(), Args1, false)); | |||
2655 | ||||
2656 | AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] = | |||
2657 | M.getOrInsertFunction( | |||
2658 | ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr, | |||
2659 | FunctionType::get(IRB.getVoidTy(), Args1, false)); | |||
2660 | } | |||
2661 | } | |||
2662 | } | |||
2663 | ||||
2664 | const std::string MemIntrinCallbackPrefix = | |||
2665 | CompileKernel ? std::string("") : ClMemoryAccessCallbackPrefix; | |||
2666 | AsanMemmove = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memmove", | |||
2667 | IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), | |||
2668 | IRB.getInt8PtrTy(), IntptrTy); | |||
2669 | AsanMemcpy = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memcpy", | |||
2670 | IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), | |||
2671 | IRB.getInt8PtrTy(), IntptrTy); | |||
2672 | AsanMemset = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memset", | |||
2673 | IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), | |||
2674 | IRB.getInt32Ty(), IntptrTy); | |||
2675 | ||||
2676 | AsanHandleNoReturnFunc = | |||
2677 | M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy()); | |||
2678 | ||||
2679 | AsanPtrCmpFunction = | |||
2680 | M.getOrInsertFunction(kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2681 | AsanPtrSubFunction = | |||
2682 | M.getOrInsertFunction(kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2683 | if (Mapping.InGlobal) | |||
2684 | AsanShadowGlobal = M.getOrInsertGlobal("__asan_shadow", | |||
2685 | ArrayType::get(IRB.getInt8Ty(), 0)); | |||
2686 | ||||
2687 | AMDGPUAddressShared = M.getOrInsertFunction( | |||
2688 | kAMDGPUAddressSharedName, IRB.getInt1Ty(), IRB.getInt8PtrTy()); | |||
2689 | AMDGPUAddressPrivate = M.getOrInsertFunction( | |||
2690 | kAMDGPUAddressPrivateName, IRB.getInt1Ty(), IRB.getInt8PtrTy()); | |||
2691 | } | |||
2692 | ||||
2693 | bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { | |||
2694 | // For each NSObject descendant having a +load method, this method is invoked | |||
2695 | // by the ObjC runtime before any of the static constructors is called. | |||
2696 | // Therefore we need to instrument such methods with a call to __asan_init | |||
2697 | // at the beginning in order to initialize our runtime before any access to | |||
2698 | // the shadow memory. | |||
2699 | // We cannot just ignore these methods, because they may call other | |||
2700 | // instrumented functions. | |||
2701 | if (F.getName().find(" load]") != std::string::npos) { | |||
2702 | FunctionCallee AsanInitFunction = | |||
2703 | declareSanitizerInitFunction(*F.getParent(), kAsanInitName, {}); | |||
2704 | IRBuilder<> IRB(&F.front(), F.front().begin()); | |||
2705 | IRB.CreateCall(AsanInitFunction, {}); | |||
2706 | return true; | |||
2707 | } | |||
2708 | return false; | |||
2709 | } | |||
2710 | ||||
2711 | bool AddressSanitizer::maybeInsertDynamicShadowAtFunctionEntry(Function &F) { | |||
2712 | // Generate code only when dynamic addressing is needed. | |||
2713 | if (Mapping.Offset != kDynamicShadowSentinel) | |||
2714 | return false; | |||
2715 | ||||
2716 | IRBuilder<> IRB(&F.front().front()); | |||
2717 | if (Mapping.InGlobal) { | |||
2718 | if (ClWithIfuncSuppressRemat) { | |||
2719 | // An empty inline asm with input reg == output reg. | |||
2720 | // An opaque pointer-to-int cast, basically. | |||
2721 | InlineAsm *Asm = InlineAsm::get( | |||
2722 | FunctionType::get(IntptrTy, {AsanShadowGlobal->getType()}, false), | |||
2723 | StringRef(""), StringRef("=r,0"), | |||
2724 | /*hasSideEffects=*/false); | |||
2725 | LocalDynamicShadow = | |||
2726 | IRB.CreateCall(Asm, {AsanShadowGlobal}, ".asan.shadow"); | |||
2727 | } else { | |||
2728 | LocalDynamicShadow = | |||
2729 | IRB.CreatePointerCast(AsanShadowGlobal, IntptrTy, ".asan.shadow"); | |||
2730 | } | |||
2731 | } else { | |||
2732 | Value *GlobalDynamicAddress = F.getParent()->getOrInsertGlobal( | |||
2733 | kAsanShadowMemoryDynamicAddress, IntptrTy); | |||
2734 | LocalDynamicShadow = IRB.CreateLoad(IntptrTy, GlobalDynamicAddress); | |||
2735 | } | |||
2736 | return true; | |||
2737 | } | |||
2738 | ||||
2739 | void AddressSanitizer::markEscapedLocalAllocas(Function &F) { | |||
2740 | // Find the one possible call to llvm.localescape and pre-mark allocas passed | |||
2741 | // to it as uninteresting. This assumes we haven't started processing allocas | |||
2742 | // yet. This check is done up front because iterating the use list in | |||
2743 | // isInterestingAlloca would be algorithmically slower. | |||
2744 | assert(ProcessedAllocas.empty() && "must process localescape before allocas")((void)0); | |||
2745 | ||||
2746 | // Try to get the declaration of llvm.localescape. If it's not in the module, | |||
2747 | // we can exit early. | |||
2748 | if (!F.getParent()->getFunction("llvm.localescape")) return; | |||
2749 | ||||
2750 | // Look for a call to llvm.localescape call in the entry block. It can't be in | |||
2751 | // any other block. | |||
2752 | for (Instruction &I : F.getEntryBlock()) { | |||
2753 | IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I); | |||
2754 | if (II && II->getIntrinsicID() == Intrinsic::localescape) { | |||
2755 | // We found a call. Mark all the allocas passed in as uninteresting. | |||
2756 | for (Value *Arg : II->arg_operands()) { | |||
2757 | AllocaInst *AI = dyn_cast<AllocaInst>(Arg->stripPointerCasts()); | |||
2758 | assert(AI && AI->isStaticAlloca() &&((void)0) | |||
2759 | "non-static alloca arg to localescape")((void)0); | |||
2760 | ProcessedAllocas[AI] = false; | |||
2761 | } | |||
2762 | break; | |||
2763 | } | |||
2764 | } | |||
2765 | } | |||
2766 | ||||
2767 | bool AddressSanitizer::suppressInstrumentationSiteForDebug(int &Instrumented) { | |||
2768 | bool ShouldInstrument = | |||
2769 | ClDebugMin < 0 || ClDebugMax < 0 || | |||
2770 | (Instrumented >= ClDebugMin && Instrumented <= ClDebugMax); | |||
2771 | Instrumented++; | |||
2772 | return !ShouldInstrument; | |||
2773 | } | |||
2774 | ||||
2775 | bool AddressSanitizer::instrumentFunction(Function &F, | |||
2776 | const TargetLibraryInfo *TLI) { | |||
2777 | if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false; | |||
2778 | if (!ClDebugFunc.empty() && ClDebugFunc == F.getName()) return false; | |||
2779 | if (F.getName().startswith("__asan_")) return false; | |||
2780 | ||||
2781 | bool FunctionModified = false; | |||
2782 | ||||
2783 | // If needed, insert __asan_init before checking for SanitizeAddress attr. | |||
2784 | // This function needs to be called even if the function body is not | |||
2785 | // instrumented. | |||
2786 | if (maybeInsertAsanInitAtFunctionEntry(F)) | |||
2787 | FunctionModified = true; | |||
2788 | ||||
2789 | // Leave if the function doesn't need instrumentation. | |||
2790 | if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return FunctionModified; | |||
2791 | ||||
2792 | LLVM_DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n")do { } while (false); | |||
2793 | ||||
2794 | initializeCallbacks(*F.getParent()); | |||
2795 | ||||
2796 | FunctionStateRAII CleanupObj(this); | |||
2797 | ||||
2798 | FunctionModified |= maybeInsertDynamicShadowAtFunctionEntry(F); | |||
2799 | ||||
2800 | // We can't instrument allocas used with llvm.localescape. Only static allocas | |||
2801 | // can be passed to that intrinsic. | |||
2802 | markEscapedLocalAllocas(F); | |||
2803 | ||||
2804 | // We want to instrument every address only once per basic block (unless there | |||
2805 | // are calls between uses). | |||
2806 | SmallPtrSet<Value *, 16> TempsToInstrument; | |||
2807 | SmallVector<InterestingMemoryOperand, 16> OperandsToInstrument; | |||
2808 | SmallVector<MemIntrinsic *, 16> IntrinToInstrument; | |||
2809 | SmallVector<Instruction *, 8> NoReturnCalls; | |||
2810 | SmallVector<BasicBlock *, 16> AllBlocks; | |||
2811 | SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts; | |||
2812 | int NumAllocas = 0; | |||
2813 | ||||
2814 | // Fill the set of memory operations to instrument. | |||
2815 | for (auto &BB : F) { | |||
2816 | AllBlocks.push_back(&BB); | |||
2817 | TempsToInstrument.clear(); | |||
2818 | int NumInsnsPerBB = 0; | |||
2819 | for (auto &Inst : BB) { | |||
2820 | if (LooksLikeCodeInBug11395(&Inst)) return false; | |||
2821 | SmallVector<InterestingMemoryOperand, 1> InterestingOperands; | |||
2822 | getInterestingMemoryOperands(&Inst, InterestingOperands); | |||
2823 | ||||
2824 | if (!InterestingOperands.empty()) { | |||
2825 | for (auto &Operand : InterestingOperands) { | |||
2826 | if (ClOpt && ClOptSameTemp) { | |||
2827 | Value *Ptr = Operand.getPtr(); | |||
2828 | // If we have a mask, skip instrumentation if we've already | |||
2829 | // instrumented the full object. But don't add to TempsToInstrument | |||
2830 | // because we might get another load/store with a different mask. | |||
2831 | if (Operand.MaybeMask) { | |||
2832 | if (TempsToInstrument.count(Ptr)) | |||
2833 | continue; // We've seen this (whole) temp in the current BB. | |||
2834 | } else { | |||
2835 | if (!TempsToInstrument.insert(Ptr).second) | |||
2836 | continue; // We've seen this temp in the current BB. | |||
2837 | } | |||
2838 | } | |||
2839 | OperandsToInstrument.push_back(Operand); | |||
2840 | NumInsnsPerBB++; | |||
2841 | } | |||
2842 | } else if (((ClInvalidPointerPairs || ClInvalidPointerCmp) && | |||
2843 | isInterestingPointerComparison(&Inst)) || | |||
2844 | ((ClInvalidPointerPairs || ClInvalidPointerSub) && | |||
2845 | isInterestingPointerSubtraction(&Inst))) { | |||
2846 | PointerComparisonsOrSubtracts.push_back(&Inst); | |||
2847 | } else if (MemIntrinsic *MI = dyn_cast<MemIntrinsic>(&Inst)) { | |||
2848 | // ok, take it. | |||
2849 | IntrinToInstrument.push_back(MI); | |||
2850 | NumInsnsPerBB++; | |||
2851 | } else { | |||
2852 | if (isa<AllocaInst>(Inst)) NumAllocas++; | |||
2853 | if (auto *CB = dyn_cast<CallBase>(&Inst)) { | |||
2854 | // A call inside BB. | |||
2855 | TempsToInstrument.clear(); | |||
2856 | if (CB->doesNotReturn() && !CB->hasMetadata("nosanitize")) | |||
2857 | NoReturnCalls.push_back(CB); | |||
2858 | } | |||
2859 | if (CallInst *CI = dyn_cast<CallInst>(&Inst)) | |||
2860 | maybeMarkSanitizerLibraryCallNoBuiltin(CI, TLI); | |||
2861 | } | |||
2862 | if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break; | |||
2863 | } | |||
2864 | } | |||
2865 | ||||
2866 | bool UseCalls = (ClInstrumentationWithCallsThreshold >= 0 && | |||
2867 | OperandsToInstrument.size() + IntrinToInstrument.size() > | |||
2868 | (unsigned)ClInstrumentationWithCallsThreshold); | |||
2869 | const DataLayout &DL = F.getParent()->getDataLayout(); | |||
2870 | ObjectSizeOpts ObjSizeOpts; | |||
2871 | ObjSizeOpts.RoundToAlign = true; | |||
2872 | ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), ObjSizeOpts); | |||
2873 | ||||
2874 | // Instrument. | |||
2875 | int NumInstrumented = 0; | |||
2876 | for (auto &Operand : OperandsToInstrument) { | |||
2877 | if (!suppressInstrumentationSiteForDebug(NumInstrumented)) | |||
2878 | instrumentMop(ObjSizeVis, Operand, UseCalls, | |||
2879 | F.getParent()->getDataLayout()); | |||
2880 | FunctionModified = true; | |||
2881 | } | |||
2882 | for (auto Inst : IntrinToInstrument) { | |||
2883 | if (!suppressInstrumentationSiteForDebug(NumInstrumented)) | |||
2884 | instrumentMemIntrinsic(Inst); | |||
2885 | FunctionModified = true; | |||
2886 | } | |||
2887 | ||||
2888 | FunctionStackPoisoner FSP(F, *this); | |||
2889 | bool ChangedStack = FSP.runOnFunction(); | |||
2890 | ||||
2891 | // We must unpoison the stack before NoReturn calls (throw, _exit, etc). | |||
2892 | // See e.g. https://github.com/google/sanitizers/issues/37 | |||
2893 | for (auto CI : NoReturnCalls) { | |||
2894 | IRBuilder<> IRB(CI); | |||
2895 | IRB.CreateCall(AsanHandleNoReturnFunc, {}); | |||
2896 | } | |||
2897 | ||||
2898 | for (auto Inst : PointerComparisonsOrSubtracts) { | |||
2899 | instrumentPointerComparisonOrSubtraction(Inst); | |||
2900 | FunctionModified = true; | |||
2901 | } | |||
2902 | ||||
2903 | if (ChangedStack || !NoReturnCalls.empty()) | |||
2904 | FunctionModified = true; | |||
2905 | ||||
2906 | LLVM_DEBUG(dbgs() << "ASAN done instrumenting: " << FunctionModified << " "do { } while (false) | |||
2907 | << F << "\n")do { } while (false); | |||
2908 | ||||
2909 | return FunctionModified; | |||
2910 | } | |||
2911 | ||||
2912 | // Workaround for bug 11395: we don't want to instrument stack in functions | |||
2913 | // with large assembly blobs (32-bit only), otherwise reg alloc may crash. | |||
2914 | // FIXME: remove once the bug 11395 is fixed. | |||
2915 | bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { | |||
2916 | if (LongSize != 32) return false; | |||
2917 | CallInst *CI = dyn_cast<CallInst>(I); | |||
2918 | if (!CI || !CI->isInlineAsm()) return false; | |||
2919 | if (CI->getNumArgOperands() <= 5) return false; | |||
2920 | // We have inline assembly with quite a few arguments. | |||
2921 | return true; | |||
2922 | } | |||
2923 | ||||
2924 | void FunctionStackPoisoner::initializeCallbacks(Module &M) { | |||
2925 | IRBuilder<> IRB(*C); | |||
2926 | if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always || | |||
2927 | ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) { | |||
2928 | const char *MallocNameTemplate = | |||
2929 | ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always | |||
2930 | ? kAsanStackMallocAlwaysNameTemplate | |||
2931 | : kAsanStackMallocNameTemplate; | |||
2932 | for (int Index = 0; Index <= kMaxAsanStackMallocSizeClass; Index++) { | |||
2933 | std::string Suffix = itostr(Index); | |||
2934 | AsanStackMallocFunc[Index] = M.getOrInsertFunction( | |||
2935 | MallocNameTemplate + Suffix, IntptrTy, IntptrTy); | |||
2936 | AsanStackFreeFunc[Index] = | |||
2937 | M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix, | |||
2938 | IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2939 | } | |||
2940 | } | |||
2941 | if (ASan.UseAfterScope) { | |||
2942 | AsanPoisonStackMemoryFunc = M.getOrInsertFunction( | |||
2943 | kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2944 | AsanUnpoisonStackMemoryFunc = M.getOrInsertFunction( | |||
2945 | kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2946 | } | |||
2947 | ||||
2948 | for (size_t Val : {0x00, 0xf1, 0xf2, 0xf3, 0xf5, 0xf8}) { | |||
2949 | std::ostringstream Name; | |||
2950 | Name << kAsanSetShadowPrefix; | |||
2951 | Name << std::setw(2) << std::setfill('0') << std::hex << Val; | |||
2952 | AsanSetShadowFunc[Val] = | |||
2953 | M.getOrInsertFunction(Name.str(), IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2954 | } | |||
2955 | ||||
2956 | AsanAllocaPoisonFunc = M.getOrInsertFunction( | |||
2957 | kAsanAllocaPoison, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2958 | AsanAllocasUnpoisonFunc = M.getOrInsertFunction( | |||
2959 | kAsanAllocasUnpoison, IRB.getVoidTy(), IntptrTy, IntptrTy); | |||
2960 | } | |||
2961 | ||||
2962 | void FunctionStackPoisoner::copyToShadowInline(ArrayRef<uint8_t> ShadowMask, | |||
2963 | ArrayRef<uint8_t> ShadowBytes, | |||
2964 | size_t Begin, size_t End, | |||
2965 | IRBuilder<> &IRB, | |||
2966 | Value *ShadowBase) { | |||
2967 | if (Begin >= End) | |||
2968 | return; | |||
2969 | ||||
2970 | const size_t LargestStoreSizeInBytes = | |||
2971 | std::min<size_t>(sizeof(uint64_t), ASan.LongSize / 8); | |||
2972 | ||||
2973 | const bool IsLittleEndian = F.getParent()->getDataLayout().isLittleEndian(); | |||
2974 | ||||
2975 | // Poison given range in shadow using larges store size with out leading and | |||
2976 | // trailing zeros in ShadowMask. Zeros never change, so they need neither | |||
2977 | // poisoning nor up-poisoning. Still we don't mind if some of them get into a | |||
2978 | // middle of a store. | |||
2979 | for (size_t i = Begin; i < End;) { | |||
2980 | if (!ShadowMask[i]) { | |||
2981 | assert(!ShadowBytes[i])((void)0); | |||
2982 | ++i; | |||
2983 | continue; | |||
2984 | } | |||
2985 | ||||
2986 | size_t StoreSizeInBytes = LargestStoreSizeInBytes; | |||
2987 | // Fit store size into the range. | |||
2988 | while (StoreSizeInBytes > End - i) | |||
2989 | StoreSizeInBytes /= 2; | |||
2990 | ||||
2991 | // Minimize store size by trimming trailing zeros. | |||
2992 | for (size_t j = StoreSizeInBytes - 1; j && !ShadowMask[i + j]; --j) { | |||
2993 | while (j <= StoreSizeInBytes / 2) | |||
2994 | StoreSizeInBytes /= 2; | |||
2995 | } | |||
2996 | ||||
2997 | uint64_t Val = 0; | |||
2998 | for (size_t j = 0; j < StoreSizeInBytes; j++) { | |||
2999 | if (IsLittleEndian) | |||
3000 | Val |= (uint64_t)ShadowBytes[i + j] << (8 * j); | |||
3001 | else | |||
3002 | Val = (Val << 8) | ShadowBytes[i + j]; | |||
3003 | } | |||
3004 | ||||
3005 | Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); | |||
3006 | Value *Poison = IRB.getIntN(StoreSizeInBytes * 8, Val); | |||
3007 | IRB.CreateAlignedStore( | |||
3008 | Poison, IRB.CreateIntToPtr(Ptr, Poison->getType()->getPointerTo()), | |||
3009 | Align(1)); | |||
3010 | ||||
3011 | i += StoreSizeInBytes; | |||
3012 | } | |||
3013 | } | |||
3014 | ||||
3015 | void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask, | |||
3016 | ArrayRef<uint8_t> ShadowBytes, | |||
3017 | IRBuilder<> &IRB, Value *ShadowBase) { | |||
3018 | copyToShadow(ShadowMask, ShadowBytes, 0, ShadowMask.size(), IRB, ShadowBase); | |||
3019 | } | |||
3020 | ||||
3021 | void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask, | |||
3022 | ArrayRef<uint8_t> ShadowBytes, | |||
3023 | size_t Begin, size_t End, | |||
3024 | IRBuilder<> &IRB, Value *ShadowBase) { | |||
3025 | assert(ShadowMask.size() == ShadowBytes.size())((void)0); | |||
3026 | size_t Done = Begin; | |||
3027 | for (size_t i = Begin, j = Begin + 1; i < End; i = j++) { | |||
3028 | if (!ShadowMask[i]) { | |||
3029 | assert(!ShadowBytes[i])((void)0); | |||
3030 | continue; | |||
3031 | } | |||
3032 | uint8_t Val = ShadowBytes[i]; | |||
3033 | if (!AsanSetShadowFunc[Val]) | |||
3034 | continue; | |||
3035 | ||||
3036 | // Skip same values. | |||
3037 | for (; j < End && ShadowMask[j] && Val == ShadowBytes[j]; ++j) { | |||
3038 | } | |||
3039 | ||||
3040 | if (j - i >= ClMaxInlinePoisoningSize) { | |||
3041 | copyToShadowInline(ShadowMask, ShadowBytes, Done, i, IRB, ShadowBase); | |||
3042 | IRB.CreateCall(AsanSetShadowFunc[Val], | |||
3043 | {IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)), | |||
3044 | ConstantInt::get(IntptrTy, j - i)}); | |||
3045 | Done = j; | |||
3046 | } | |||
3047 | } | |||
3048 | ||||
3049 | copyToShadowInline(ShadowMask, ShadowBytes, Done, End, IRB, ShadowBase); | |||
3050 | } | |||
3051 | ||||
3052 | // Fake stack allocator (asan_fake_stack.h) has 11 size classes | |||
3053 | // for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass | |||
3054 | static int StackMallocSizeClass(uint64_t LocalStackSize) { | |||
3055 | assert(LocalStackSize <= kMaxStackMallocSize)((void)0); | |||
3056 | uint64_t MaxSize = kMinStackMallocSize; | |||
3057 | for (int i = 0;; i++, MaxSize *= 2) | |||
3058 | if (LocalStackSize <= MaxSize) return i; | |||
3059 | llvm_unreachable("impossible LocalStackSize")__builtin_unreachable(); | |||
3060 | } | |||
3061 | ||||
3062 | void FunctionStackPoisoner::copyArgsPassedByValToAllocas() { | |||
3063 | Instruction *CopyInsertPoint = &F.front().front(); | |||
3064 | if (CopyInsertPoint == ASan.LocalDynamicShadow) { | |||
3065 | // Insert after the dynamic shadow location is determined | |||
3066 | CopyInsertPoint = CopyInsertPoint->getNextNode(); | |||
3067 | assert(CopyInsertPoint)((void)0); | |||
3068 | } | |||
3069 | IRBuilder<> IRB(CopyInsertPoint); | |||
3070 | const DataLayout &DL = F.getParent()->getDataLayout(); | |||
3071 | for (Argument &Arg : F.args()) { | |||
3072 | if (Arg.hasByValAttr()) { | |||
3073 | Type *Ty = Arg.getParamByValType(); | |||
3074 | const Align Alignment = | |||
3075 | DL.getValueOrABITypeAlignment(Arg.getParamAlign(), Ty); | |||
3076 | ||||
3077 | AllocaInst *AI = IRB.CreateAlloca( | |||
3078 | Ty, nullptr, | |||
3079 | (Arg.hasName() ? Arg.getName() : "Arg" + Twine(Arg.getArgNo())) + | |||
3080 | ".byval"); | |||
3081 | AI->setAlignment(Alignment); | |||
3082 | Arg.replaceAllUsesWith(AI); | |||
3083 | ||||
3084 | uint64_t AllocSize = DL.getTypeAllocSize(Ty); | |||
3085 | IRB.CreateMemCpy(AI, Alignment, &Arg, Alignment, AllocSize); | |||
3086 | } | |||
3087 | } | |||
3088 | } | |||
3089 | ||||
3090 | PHINode *FunctionStackPoisoner::createPHI(IRBuilder<> &IRB, Value *Cond, | |||
3091 | Value *ValueIfTrue, | |||
3092 | Instruction *ThenTerm, | |||
3093 | Value *ValueIfFalse) { | |||
3094 | PHINode *PHI = IRB.CreatePHI(IntptrTy, 2); | |||
3095 | BasicBlock *CondBlock = cast<Instruction>(Cond)->getParent(); | |||
3096 | PHI->addIncoming(ValueIfFalse, CondBlock); | |||
3097 | BasicBlock *ThenBlock = ThenTerm->getParent(); | |||
3098 | PHI->addIncoming(ValueIfTrue, ThenBlock); | |||
3099 | return PHI; | |||
3100 | } | |||
3101 | ||||
3102 | Value *FunctionStackPoisoner::createAllocaForLayout( | |||
3103 | IRBuilder<> &IRB, const ASanStackFrameLayout &L, bool Dynamic) { | |||
3104 | AllocaInst *Alloca; | |||
3105 | if (Dynamic) { | |||
3106 | Alloca = IRB.CreateAlloca(IRB.getInt8Ty(), | |||
3107 | ConstantInt::get(IRB.getInt64Ty(), L.FrameSize), | |||
3108 | "MyAlloca"); | |||
3109 | } else { | |||
3110 | Alloca = IRB.CreateAlloca(ArrayType::get(IRB.getInt8Ty(), L.FrameSize), | |||
3111 | nullptr, "MyAlloca"); | |||
3112 | assert(Alloca->isStaticAlloca())((void)0); | |||
3113 | } | |||
3114 | assert((ClRealignStack & (ClRealignStack - 1)) == 0)((void)0); | |||
3115 | size_t FrameAlignment = std::max(L.FrameAlignment, (size_t)ClRealignStack); | |||
3116 | Alloca->setAlignment(Align(FrameAlignment)); | |||
3117 | return IRB.CreatePointerCast(Alloca, IntptrTy); | |||
3118 | } | |||
3119 | ||||
3120 | void FunctionStackPoisoner::createDynamicAllocasInitStorage() { | |||
3121 | BasicBlock &FirstBB = *F.begin(); | |||
3122 | IRBuilder<> IRB(dyn_cast<Instruction>(FirstBB.begin())); | |||
3123 | DynamicAllocaLayout = IRB.CreateAlloca(IntptrTy, nullptr); | |||
3124 | IRB.CreateStore(Constant::getNullValue(IntptrTy), DynamicAllocaLayout); | |||
3125 | DynamicAllocaLayout->setAlignment(Align(32)); | |||
3126 | } | |||
3127 | ||||
3128 | void FunctionStackPoisoner::processDynamicAllocas() { | |||
3129 | if (!ClInstrumentDynamicAllocas || DynamicAllocaVec.empty()) { | |||
3130 | assert(DynamicAllocaPoisonCallVec.empty())((void)0); | |||
3131 | return; | |||
3132 | } | |||
3133 | ||||
3134 | // Insert poison calls for lifetime intrinsics for dynamic allocas. | |||
3135 | for (const auto &APC : DynamicAllocaPoisonCallVec) { | |||
3136 | assert(APC.InsBefore)((void)0); | |||
3137 | assert(APC.AI)((void)0); | |||
3138 | assert(ASan.isInterestingAlloca(*APC.AI))((void)0); | |||
3139 | assert(!APC.AI->isStaticAlloca())((void)0); | |||
3140 | ||||
3141 | IRBuilder<> IRB(APC.InsBefore); | |||
3142 | poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison); | |||
3143 | // Dynamic allocas will be unpoisoned unconditionally below in | |||
3144 | // unpoisonDynamicAllocas. | |||
3145 | // Flag that we need unpoison static allocas. | |||
3146 | } | |||
3147 | ||||
3148 | // Handle dynamic allocas. | |||
3149 | createDynamicAllocasInitStorage(); | |||
3150 | for (auto &AI : DynamicAllocaVec) | |||
3151 | handleDynamicAllocaCall(AI); | |||
3152 | unpoisonDynamicAllocas(); | |||
3153 | } | |||
3154 | ||||
3155 | /// Collect instructions in the entry block after \p InsBefore which initialize | |||
3156 | /// permanent storage for a function argument. These instructions must remain in | |||
3157 | /// the entry block so that uninitialized values do not appear in backtraces. An | |||
3158 | /// added benefit is that this conserves spill slots. This does not move stores | |||
3159 | /// before instrumented / "interesting" allocas. | |||
3160 | static void findStoresToUninstrumentedArgAllocas( | |||
3161 | AddressSanitizer &ASan, Instruction &InsBefore, | |||
3162 | SmallVectorImpl<Instruction *> &InitInsts) { | |||
3163 | Instruction *Start = InsBefore.getNextNonDebugInstruction(); | |||
3164 | for (Instruction *It = Start; It; It = It->getNextNonDebugInstruction()) { | |||
3165 | // Argument initialization looks like: | |||
3166 | // 1) store <Argument>, <Alloca> OR | |||
3167 | // 2) <CastArgument> = cast <Argument> to ... | |||
3168 | // store <CastArgument> to <Alloca> | |||
3169 | // Do not consider any other kind of instruction. | |||
3170 | // | |||
3171 | // Note: This covers all known cases, but may not be exhaustive. An | |||
3172 | // alternative to pattern-matching stores is to DFS over all Argument uses: | |||
3173 | // this might be more general, but is probably much more complicated. | |||
3174 | if (isa<AllocaInst>(It) || isa<CastInst>(It)) | |||
3175 | continue; | |||
3176 | if (auto *Store = dyn_cast<StoreInst>(It)) { | |||
3177 | // The store destination must be an alloca that isn't interesting for | |||
3178 | // ASan to instrument. These are moved up before InsBefore, and they're | |||
3179 | // not interesting because allocas for arguments can be mem2reg'd. | |||
3180 | auto *Alloca = dyn_cast<AllocaInst>(Store->getPointerOperand()); | |||
3181 | if (!Alloca || ASan.isInterestingAlloca(*Alloca)) | |||
3182 | continue; | |||
3183 | ||||
3184 | Value *Val = Store->getValueOperand(); | |||
3185 | bool IsDirectArgInit = isa<Argument>(Val); | |||
3186 | bool IsArgInitViaCast = | |||
3187 | isa<CastInst>(Val) && | |||
3188 | isa<Argument>(cast<CastInst>(Val)->getOperand(0)) && | |||
3189 | // Check that the cast appears directly before the store. Otherwise | |||
3190 | // moving the cast before InsBefore may break the IR. | |||
3191 | Val == It->getPrevNonDebugInstruction(); | |||
3192 | bool IsArgInit = IsDirectArgInit || IsArgInitViaCast; | |||
3193 | if (!IsArgInit) | |||
3194 | continue; | |||
3195 | ||||
3196 | if (IsArgInitViaCast) | |||
3197 | InitInsts.push_back(cast<Instruction>(Val)); | |||
3198 | InitInsts.push_back(Store); | |||
3199 | continue; | |||
3200 | } | |||
3201 | ||||
3202 | // Do not reorder past unknown instructions: argument initialization should | |||
3203 | // only involve casts and stores. | |||
3204 | return; | |||
3205 | } | |||
3206 | } | |||
3207 | ||||
3208 | void FunctionStackPoisoner::processStaticAllocas() { | |||
3209 | if (AllocaVec.empty()) { | |||
3210 | assert(StaticAllocaPoisonCallVec.empty())((void)0); | |||
3211 | return; | |||
3212 | } | |||
3213 | ||||
3214 | int StackMallocIdx = -1; | |||
3215 | DebugLoc EntryDebugLocation; | |||
3216 | if (auto SP = F.getSubprogram()) | |||
3217 | EntryDebugLocation = | |||
3218 | DILocation::get(SP->getContext(), SP->getScopeLine(), 0, SP); | |||
3219 | ||||
3220 | Instruction *InsBefore = AllocaVec[0]; | |||
3221 | IRBuilder<> IRB(InsBefore); | |||
3222 | ||||
3223 | // Make sure non-instrumented allocas stay in the entry block. Otherwise, | |||
3224 | // debug info is broken, because only entry-block allocas are treated as | |||
3225 | // regular stack slots. | |||
3226 | auto InsBeforeB = InsBefore->getParent(); | |||
3227 | assert(InsBeforeB == &F.getEntryBlock())((void)0); | |||
3228 | for (auto *AI : StaticAllocasToMoveUp) | |||
3229 | if (AI->getParent() == InsBeforeB) | |||
3230 | AI->moveBefore(InsBefore); | |||
3231 | ||||
3232 | // Move stores of arguments into entry-block allocas as well. This prevents | |||
3233 | // extra stack slots from being generated (to house the argument values until | |||
3234 | // they can be stored into the allocas). This also prevents uninitialized | |||
3235 | // values from being shown in backtraces. | |||
3236 | SmallVector<Instruction *, 8> ArgInitInsts; | |||
3237 | findStoresToUninstrumentedArgAllocas(ASan, *InsBefore, ArgInitInsts); | |||
3238 | for (Instruction *ArgInitInst : ArgInitInsts) | |||
3239 | ArgInitInst->moveBefore(InsBefore); | |||
3240 | ||||
3241 | // If we have a call to llvm.localescape, keep it in the entry block. | |||
3242 | if (LocalEscapeCall) LocalEscapeCall->moveBefore(InsBefore); | |||
3243 | ||||
3244 | SmallVector<ASanStackVariableDescription, 16> SVD; | |||
3245 | SVD.reserve(AllocaVec.size()); | |||
3246 | for (AllocaInst *AI : AllocaVec) { | |||
3247 | ASanStackVariableDescription D = {AI->getName().data(), | |||
3248 | ASan.getAllocaSizeInBytes(*AI), | |||
3249 | 0, | |||
3250 | AI->getAlignment(), | |||
3251 | AI, | |||
3252 | 0, | |||
3253 | 0}; | |||
3254 | SVD.push_back(D); | |||
3255 | } | |||
3256 | ||||
3257 | // Minimal header size (left redzone) is 4 pointers, | |||
3258 | // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms. | |||
3259 | size_t Granularity = 1ULL << Mapping.Scale; | |||
3260 | size_t MinHeaderSize = std::max((size_t)ASan.LongSize / 2, Granularity); | |||
3261 | const ASanStackFrameLayout &L = | |||
3262 | ComputeASanStackFrameLayout(SVD, Granularity, MinHeaderSize); | |||
3263 | ||||
3264 | // Build AllocaToSVDMap for ASanStackVariableDescription lookup. | |||
3265 | DenseMap<const AllocaInst *, ASanStackVariableDescription *> AllocaToSVDMap; | |||
3266 | for (auto &Desc : SVD) | |||
3267 | AllocaToSVDMap[Desc.AI] = &Desc; | |||
3268 | ||||
3269 | // Update SVD with information from lifetime intrinsics. | |||
3270 | for (const auto &APC : StaticAllocaPoisonCallVec) { | |||
3271 | assert(APC.InsBefore)((void)0); | |||
3272 | assert(APC.AI)((void)0); | |||
3273 | assert(ASan.isInterestingAlloca(*APC.AI))((void)0); | |||
3274 | assert(APC.AI->isStaticAlloca())((void)0); | |||
3275 | ||||
3276 | ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI]; | |||
3277 | Desc.LifetimeSize = Desc.Size; | |||
3278 | if (const DILocation *FnLoc = EntryDebugLocation.get()) { | |||
3279 | if (const DILocation *LifetimeLoc = APC.InsBefore->getDebugLoc().get()) { | |||
3280 | if (LifetimeLoc->getFile() == FnLoc->getFile()) | |||
3281 | if (unsigned Line = LifetimeLoc->getLine()) | |||
3282 | Desc.Line = std::min(Desc.Line ? Desc.Line : Line, Line); | |||
3283 | } | |||
3284 | } | |||
3285 | } | |||
3286 | ||||
3287 | auto DescriptionString = ComputeASanStackFrameDescription(SVD); | |||
3288 | LLVM_DEBUG(dbgs() << DescriptionString << " --- " << L.FrameSize << "\n")do { } while (false); | |||
3289 | uint64_t LocalStackSize = L.FrameSize; | |||
3290 | bool DoStackMalloc = | |||
3291 | ASan.UseAfterReturn != AsanDetectStackUseAfterReturnMode::Never && | |||
3292 | !ASan.CompileKernel && LocalStackSize <= kMaxStackMallocSize; | |||
3293 | bool DoDynamicAlloca = ClDynamicAllocaStack; | |||
3294 | // Don't do dynamic alloca or stack malloc if: | |||
3295 | // 1) There is inline asm: too often it makes assumptions on which registers | |||
3296 | // are available. | |||
3297 | // 2) There is a returns_twice call (typically setjmp), which is | |||
3298 | // optimization-hostile, and doesn't play well with introduced indirect | |||
3299 | // register-relative calculation of local variable addresses. | |||
3300 | DoDynamicAlloca &= !HasInlineAsm && !HasReturnsTwiceCall; | |||
3301 | DoStackMalloc &= !HasInlineAsm && !HasReturnsTwiceCall; | |||
3302 | ||||
3303 | Value *StaticAlloca = | |||
3304 | DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false); | |||
3305 | ||||
3306 | Value *FakeStack; | |||
3307 | Value *LocalStackBase; | |||
3308 | Value *LocalStackBaseAlloca; | |||
3309 | uint8_t DIExprFlags = DIExpression::ApplyOffset; | |||
3310 | ||||
3311 | if (DoStackMalloc) { | |||
3312 | LocalStackBaseAlloca = | |||
3313 | IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base"); | |||
3314 | if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) { | |||
3315 | // void *FakeStack = __asan_option_detect_stack_use_after_return | |||
3316 | // ? __asan_stack_malloc_N(LocalStackSize) | |||
3317 | // : nullptr; | |||
3318 | // void *LocalStackBase = (FakeStack) ? FakeStack : | |||
3319 | // alloca(LocalStackSize); | |||
3320 | Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal( | |||
3321 | kAsanOptionDetectUseAfterReturn, IRB.getInt32Ty()); | |||
3322 | Value *UseAfterReturnIsEnabled = IRB.CreateICmpNE( | |||
3323 | IRB.CreateLoad(IRB.getInt32Ty(), OptionDetectUseAfterReturn), | |||
3324 | Constant::getNullValue(IRB.getInt32Ty())); | |||
3325 | Instruction *Term = | |||
3326 | SplitBlockAndInsertIfThen(UseAfterReturnIsEnabled, InsBefore, false); | |||
3327 | IRBuilder<> IRBIf(Term); | |||
3328 | StackMallocIdx = StackMallocSizeClass(LocalStackSize); | |||
3329 | assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass)((void)0); | |||
3330 | Value *FakeStackValue = | |||
3331 | IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx], | |||
3332 | ConstantInt::get(IntptrTy, LocalStackSize)); | |||
3333 | IRB.SetInsertPoint(InsBefore); | |||
3334 | FakeStack = createPHI(IRB, UseAfterReturnIsEnabled, FakeStackValue, Term, | |||
3335 | ConstantInt::get(IntptrTy, 0)); | |||
3336 | } else { | |||
3337 | // assert(ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode:Always) | |||
3338 | // void *FakeStack = __asan_stack_malloc_N(LocalStackSize); | |||
3339 | // void *LocalStackBase = (FakeStack) ? FakeStack : | |||
3340 | // alloca(LocalStackSize); | |||
3341 | StackMallocIdx = StackMallocSizeClass(LocalStackSize); | |||
3342 | FakeStack = IRB.CreateCall(AsanStackMallocFunc[StackMallocIdx], | |||
3343 | ConstantInt::get(IntptrTy, LocalStackSize)); | |||
3344 | } | |||
3345 | Value *NoFakeStack = | |||
3346 | IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy)); | |||
3347 | Instruction *Term = | |||
3348 | SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false); | |||
3349 | IRBuilder<> IRBIf(Term); | |||
3350 | Value *AllocaValue = | |||
3351 | DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca; | |||
3352 | ||||
3353 | IRB.SetInsertPoint(InsBefore); | |||
3354 | LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack); | |||
3355 | IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca); | |||
3356 | DIExprFlags |= DIExpression::DerefBefore; | |||
3357 | } else { | |||
3358 | // void *FakeStack = nullptr; | |||
3359 | // void *LocalStackBase = alloca(LocalStackSize); | |||
3360 | FakeStack = ConstantInt::get(IntptrTy, 0); | |||
3361 | LocalStackBase = | |||
3362 | DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca; | |||
3363 | LocalStackBaseAlloca = LocalStackBase; | |||
3364 | } | |||
3365 | ||||
3366 | // It shouldn't matter whether we pass an `alloca` or a `ptrtoint` as the | |||
3367 | // dbg.declare address opereand, but passing a `ptrtoint` seems to confuse | |||
3368 | // later passes and can result in dropped variable coverage in debug info. | |||
3369 | Value *LocalStackBaseAllocaPtr = | |||
3370 | isa<PtrToIntInst>(LocalStackBaseAlloca) | |||
3371 | ? cast<PtrToIntInst>(LocalStackBaseAlloca)->getPointerOperand() | |||
3372 | : LocalStackBaseAlloca; | |||
3373 | assert(isa<AllocaInst>(LocalStackBaseAllocaPtr) &&((void)0) | |||
3374 | "Variable descriptions relative to ASan stack base will be dropped")((void)0); | |||
3375 | ||||
3376 | // Replace Alloca instructions with base+offset. | |||
3377 | for (const auto &Desc : SVD) { | |||
3378 | AllocaInst *AI = Desc.AI; | |||
3379 | replaceDbgDeclare(AI, LocalStackBaseAllocaPtr, DIB, DIExprFlags, | |||
3380 | Desc.Offset); | |||
3381 | Value *NewAllocaPtr = IRB.CreateIntToPtr( | |||
3382 | IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)), | |||
3383 | AI->getType()); | |||
3384 | AI->replaceAllUsesWith(NewAllocaPtr); | |||
3385 | } | |||
3386 | ||||
3387 | // The left-most redzone has enough space for at least 4 pointers. | |||
3388 | // Write the Magic value to redzone[0]. | |||
3389 | Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); | |||
3390 | IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), | |||
3391 | BasePlus0); | |||
3392 | // Write the frame description constant to redzone[1]. | |||
3393 | Value *BasePlus1 = IRB.CreateIntToPtr( | |||
3394 | IRB.CreateAdd(LocalStackBase, | |||
3395 | ConstantInt::get(IntptrTy, ASan.LongSize / 8)), | |||
3396 | IntptrPtrTy); | |||
3397 | GlobalVariable *StackDescriptionGlobal = | |||
3398 | createPrivateGlobalForString(*F.getParent(), DescriptionString, | |||
3399 | /*AllowMerging*/ true, kAsanGenPrefix); | |||
3400 | Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy); | |||
3401 | IRB.CreateStore(Description, BasePlus1); | |||
3402 | // Write the PC to redzone[2]. | |||
3403 | Value *BasePlus2 = IRB.CreateIntToPtr( | |||
3404 | IRB.CreateAdd(LocalStackBase, | |||
3405 | ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)), | |||
3406 | IntptrPtrTy); | |||
3407 | IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2); | |||
3408 | ||||
3409 | const auto &ShadowAfterScope = GetShadowBytesAfterScope(SVD, L); | |||
3410 | ||||
3411 | // Poison the stack red zones at the entry. | |||
3412 | Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB); | |||
3413 | // As mask we must use most poisoned case: red zones and after scope. | |||
3414 | // As bytes we can use either the same or just red zones only. | |||
3415 | copyToShadow(ShadowAfterScope, ShadowAfterScope, IRB, ShadowBase); | |||
3416 | ||||
3417 | if (!StaticAllocaPoisonCallVec.empty()) { | |||
3418 | const auto &ShadowInScope = GetShadowBytes(SVD, L); | |||
3419 | ||||
3420 | // Poison static allocas near lifetime intrinsics. | |||
3421 | for (const auto &APC : StaticAllocaPoisonCallVec) { | |||
3422 | const ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI]; | |||
3423 | assert(Desc.Offset % L.Granularity == 0)((void)0); | |||
3424 | size_t Begin = Desc.Offset / L.Granularity; | |||
3425 | size_t End = Begin + (APC.Size + L.Granularity - 1) / L.Granularity; | |||
3426 | ||||
3427 | IRBuilder<> IRB(APC.InsBefore); | |||
3428 | copyToShadow(ShadowAfterScope, | |||
3429 | APC.DoPoison ? ShadowAfterScope : ShadowInScope, Begin, End, | |||
3430 | IRB, ShadowBase); | |||
3431 | } | |||
3432 | } | |||
3433 | ||||
3434 | SmallVector<uint8_t, 64> ShadowClean(ShadowAfterScope.size(), 0); | |||
3435 | SmallVector<uint8_t, 64> ShadowAfterReturn; | |||
3436 | ||||
3437 | // (Un)poison the stack before all ret instructions. | |||
3438 | for (Instruction *Ret : RetVec) { | |||
3439 | IRBuilder<> IRBRet(Ret); | |||
3440 | // Mark the current frame as retired. | |||
3441 | IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), | |||
3442 | BasePlus0); | |||
3443 | if (DoStackMalloc) { | |||
3444 | assert(StackMallocIdx >= 0)((void)0); | |||
3445 | // if FakeStack != 0 // LocalStackBase == FakeStack | |||
3446 | // // In use-after-return mode, poison the whole stack frame. | |||
3447 | // if StackMallocIdx <= 4 | |||
3448 | // // For small sizes inline the whole thing: | |||
3449 | // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize); | |||
3450 | // **SavedFlagPtr(FakeStack) = 0 | |||
3451 | // else | |||
3452 | // __asan_stack_free_N(FakeStack, LocalStackSize) | |||
3453 | // else | |||
3454 | // <This is not a fake stack; unpoison the redzones> | |||
3455 | Value *Cmp = | |||
3456 | IRBRet.CreateICmpNE(FakeStack, Constant::getNullValue(IntptrTy)); | |||
3457 | Instruction *ThenTerm, *ElseTerm; | |||
3458 | SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm); | |||
3459 | ||||
3460 | IRBuilder<> IRBPoison(ThenTerm); | |||
3461 | if (StackMallocIdx <= 4) { | |||
3462 | int ClassSize = kMinStackMallocSize << StackMallocIdx; | |||
3463 | ShadowAfterReturn.resize(ClassSize / L.Granularity, | |||
3464 | kAsanStackUseAfterReturnMagic); | |||
3465 | copyToShadow(ShadowAfterReturn, ShadowAfterReturn, IRBPoison, | |||
3466 | ShadowBase); | |||
3467 | Value *SavedFlagPtrPtr = IRBPoison.CreateAdd( | |||
3468 | FakeStack, | |||
3469 | ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8)); | |||
3470 | Value *SavedFlagPtr = IRBPoison.CreateLoad( | |||
3471 | IntptrTy, IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy)); | |||
3472 | IRBPoison.CreateStore( | |||
3473 | Constant::getNullValue(IRBPoison.getInt8Ty()), | |||
3474 | IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy())); | |||
3475 | } else { | |||
3476 | // For larger frames call __asan_stack_free_*. | |||
3477 | IRBPoison.CreateCall( | |||
3478 | AsanStackFreeFunc[StackMallocIdx], | |||
3479 | {FakeStack, ConstantInt::get(IntptrTy, LocalStackSize)}); | |||
3480 | } | |||
3481 | ||||
3482 | IRBuilder<> IRBElse(ElseTerm); | |||
3483 | copyToShadow(ShadowAfterScope, ShadowClean, IRBElse, ShadowBase); | |||
3484 | } else { | |||
3485 | copyToShadow(ShadowAfterScope, ShadowClean, IRBRet, ShadowBase); | |||
3486 | } | |||
3487 | } | |||
3488 | ||||
3489 | // We are done. Remove the old unused alloca instructions. | |||
3490 | for (auto AI : AllocaVec) AI->eraseFromParent(); | |||
3491 | } | |||
3492 | ||||
3493 | void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size, | |||
3494 | IRBuilder<> &IRB, bool DoPoison) { | |||
3495 | // For now just insert the call to ASan runtime. | |||
3496 | Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy); | |||
3497 | Value *SizeArg = ConstantInt::get(IntptrTy, Size); | |||
3498 | IRB.CreateCall( | |||
3499 | DoPoison ? AsanPoisonStackMemoryFunc : AsanUnpoisonStackMemoryFunc, | |||
3500 | {AddrArg, SizeArg}); | |||
3501 | } | |||
3502 | ||||
3503 | // Handling llvm.lifetime intrinsics for a given %alloca: | |||
3504 | // (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca. | |||
3505 | // (2) if %size is constant, poison memory for llvm.lifetime.end (to detect | |||
3506 | // invalid accesses) and unpoison it for llvm.lifetime.start (the memory | |||
3507 | // could be poisoned by previous llvm.lifetime.end instruction, as the | |||
3508 | // variable may go in and out of scope several times, e.g. in loops). | |||
3509 | // (3) if we poisoned at least one %alloca in a function, | |||
3510 | // unpoison the whole stack frame at function exit. | |||
3511 | void FunctionStackPoisoner::handleDynamicAllocaCall(AllocaInst *AI) { | |||
3512 | IRBuilder<> IRB(AI); | |||
3513 | ||||
3514 | const unsigned Alignment = std::max(kAllocaRzSize, AI->getAlignment()); | |||
3515 | const uint64_t AllocaRedzoneMask = kAllocaRzSize - 1; | |||
3516 | ||||
3517 | Value *Zero = Constant::getNullValue(IntptrTy); | |||
3518 | Value *AllocaRzSize = ConstantInt::get(IntptrTy, kAllocaRzSize); | |||
3519 | Value *AllocaRzMask = ConstantInt::get(IntptrTy, AllocaRedzoneMask); | |||
3520 | ||||
3521 | // Since we need to extend alloca with additional memory to locate | |||
3522 | // redzones, and OldSize is number of allocated blocks with | |||
3523 | // ElementSize size, get allocated memory size in bytes by | |||
3524 | // OldSize * ElementSize. | |||
3525 | const unsigned ElementSize = | |||
3526 | F.getParent()->getDataLayout().getTypeAllocSize(AI->getAllocatedType()); | |||
3527 | Value *OldSize = | |||
3528 | IRB.CreateMul(IRB.CreateIntCast(AI->getArraySize(), IntptrTy, false), | |||
3529 | ConstantInt::get(IntptrTy, ElementSize)); | |||
3530 | ||||
3531 | // PartialSize = OldSize % 32 | |||
3532 | Value *PartialSize = IRB.CreateAnd(OldSize, AllocaRzMask); | |||
3533 | ||||
3534 | // Misalign = kAllocaRzSize - PartialSize; | |||
3535 | Value *Misalign = IRB.CreateSub(AllocaRzSize, PartialSize); | |||
3536 | ||||
3537 | // PartialPadding = Misalign != kAllocaRzSize ? Misalign : 0; | |||
3538 | Value *Cond = IRB.CreateICmpNE(Misalign, AllocaRzSize); | |||
3539 | Value *PartialPadding = IRB.CreateSelect(Cond, Misalign, Zero); | |||
3540 | ||||
3541 | // AdditionalChunkSize = Alignment + PartialPadding + kAllocaRzSize | |||
3542 | // Alignment is added to locate left redzone, PartialPadding for possible | |||
3543 | // partial redzone and kAllocaRzSize for right redzone respectively. | |||
3544 | Value *AdditionalChunkSize = IRB.CreateAdd( | |||
3545 | ConstantInt::get(IntptrTy, Alignment + kAllocaRzSize), PartialPadding); | |||
3546 | ||||
3547 | Value *NewSize = IRB.CreateAdd(OldSize, AdditionalChunkSize); | |||
3548 | ||||
3549 | // Insert new alloca with new NewSize and Alignment params. | |||
3550 | AllocaInst *NewAlloca = IRB.CreateAlloca(IRB.getInt8Ty(), NewSize); | |||
3551 | NewAlloca->setAlignment(Align(Alignment)); | |||
3552 | ||||
3553 | // NewAddress = Address + Alignment | |||
3554 | Value *NewAddress = IRB.CreateAdd(IRB.CreatePtrToInt(NewAlloca, IntptrTy), | |||
3555 | ConstantInt::get(IntptrTy, Alignment)); | |||
3556 | ||||
3557 | // Insert __asan_alloca_poison call for new created alloca. | |||
3558 | IRB.CreateCall(AsanAllocaPoisonFunc, {NewAddress, OldSize}); | |||
3559 | ||||
3560 | // Store the last alloca's address to DynamicAllocaLayout. We'll need this | |||
3561 | // for unpoisoning stuff. | |||
3562 | IRB.CreateStore(IRB.CreatePtrToInt(NewAlloca, IntptrTy), DynamicAllocaLayout); | |||
3563 | ||||
3564 | Value *NewAddressPtr = IRB.CreateIntToPtr(NewAddress, AI->getType()); | |||
3565 | ||||
3566 | // Replace all uses of AddessReturnedByAlloca with NewAddressPtr. | |||
3567 | AI->replaceAllUsesWith(NewAddressPtr); | |||
3568 | ||||
3569 | // We are done. Erase old alloca from parent. | |||
3570 | AI->eraseFromParent(); | |||
3571 | } | |||
3572 | ||||
3573 | // isSafeAccess returns true if Addr is always inbounds with respect to its | |||
3574 | // base object. For example, it is a field access or an array access with | |||
3575 | // constant inbounds index. | |||
3576 | bool AddressSanitizer::isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, | |||
3577 | Value *Addr, uint64_t TypeSize) const { | |||
3578 | SizeOffsetType SizeOffset = ObjSizeVis.compute(Addr); | |||
3579 | if (!ObjSizeVis.bothKnown(SizeOffset)) return false; | |||
3580 | uint64_t Size = SizeOffset.first.getZExtValue(); | |||
3581 | int64_t Offset = SizeOffset.second.getSExtValue(); | |||
3582 | // Three checks are required to ensure safety: | |||
3583 | // . Offset >= 0 (since the offset is given from the base ptr) | |||
3584 | // . Size >= Offset (unsigned) | |||
3585 | // . Size - Offset >= NeededSize (unsigned) | |||
3586 | return Offset >= 0 && Size >= uint64_t(Offset) && | |||
3587 | Size - uint64_t(Offset) >= TypeSize / 8; | |||
3588 | } |