Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 1 | ================ |
| 2 | MemorySanitizer |
| 3 | ================ |
| 4 | |
| 5 | .. contents:: |
| 6 | :local: |
| 7 | |
| 8 | Introduction |
| 9 | ============ |
| 10 | |
| 11 | MemorySanitizer is a detector of uninitialized reads. It consists of a |
| 12 | compiler instrumentation module and a run-time library. |
| 13 | |
| 14 | Typical slowdown introduced by MemorySanitizer is **3x**. |
| 15 | |
| 16 | How to build |
| 17 | ============ |
| 18 | |
Stephen Hines | 0e2c34f | 2015-03-23 12:09:02 -0700 | [diff] [blame] | 19 | Build LLVM/Clang with `CMake <http://llvm.org/docs/CMake.html>`_. |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 20 | |
| 21 | Usage |
| 22 | ===== |
| 23 | |
| 24 | Simply compile and link your program with ``-fsanitize=memory`` flag. |
| 25 | The MemorySanitizer run-time library should be linked to the final |
| 26 | executable, so make sure to use ``clang`` (not ``ld``) for the final |
| 27 | link step. When linking shared libraries, the MemorySanitizer run-time |
| 28 | is not linked, so ``-Wl,-z,defs`` may cause link errors (don't use it |
| 29 | with MemorySanitizer). To get a reasonable performance add ``-O1`` or |
| 30 | higher. To get meaninful stack traces in error messages add |
| 31 | ``-fno-omit-frame-pointer``. To get perfect stack traces you may need |
| 32 | to disable inlining (just use ``-O1``) and tail call elimination |
| 33 | (``-fno-optimize-sibling-calls``). |
| 34 | |
| 35 | .. code-block:: console |
Dmitri Gribenko | 184e1c4 | 2012-12-23 18:36:44 +0000 | [diff] [blame] | 36 | |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 37 | % cat umr.cc |
| 38 | #include <stdio.h> |
| 39 | |
| 40 | int main(int argc, char** argv) { |
| 41 | int* a = new int[10]; |
| 42 | a[5] = 0; |
| 43 | if (a[argc]) |
| 44 | printf("xx\n"); |
| 45 | return 0; |
| 46 | } |
| 47 | |
Peter Collingbourne | 52ca70d | 2013-04-09 04:35:11 +0000 | [diff] [blame] | 48 | % clang -fsanitize=memory -fno-omit-frame-pointer -g -O2 umr.cc |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 49 | |
| 50 | If a bug is detected, the program will print an error message to |
| 51 | stderr and exit with a non-zero exit code. Currently, MemorySanitizer |
| 52 | does not symbolize its output by default, so you may need to use a |
| 53 | separate script to symbolize the result offline (this will be fixed in |
| 54 | future). |
| 55 | |
| 56 | .. code-block:: console |
| 57 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 58 | % ./a.out |
| 59 | WARNING: MemorySanitizer: use-of-uninitialized-value |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 60 | #0 0x7f45944b418a in main umr.cc:6 |
| 61 | #1 0x7f45938b676c in __libc_start_main libc-start.c:226 |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 62 | |
| 63 | By default, MemorySanitizer exits on the first detected error. |
| 64 | |
| 65 | ``__has_feature(memory_sanitizer)`` |
| 66 | ------------------------------------ |
| 67 | |
| 68 | In some cases one may need to execute different code depending on |
| 69 | whether MemorySanitizer is enabled. :ref:`\_\_has\_feature |
| 70 | <langext-__has_feature-__has_extension>` can be used for this purpose. |
| 71 | |
| 72 | .. code-block:: c |
| 73 | |
| 74 | #if defined(__has_feature) |
| 75 | # if __has_feature(memory_sanitizer) |
| 76 | // code that builds only under MemorySanitizer |
| 77 | # endif |
| 78 | #endif |
| 79 | |
Kostya Serebryany | 85aee96 | 2013-02-26 06:58:27 +0000 | [diff] [blame] | 80 | ``__attribute__((no_sanitize_memory))`` |
| 81 | ----------------------------------------------- |
| 82 | |
| 83 | Some code should not be checked by MemorySanitizer. |
| 84 | One may use the function attribute |
| 85 | :ref:`no_sanitize_memory <langext-memory_sanitizer>` |
| 86 | to disable uninitialized checks in a particular function. |
| 87 | MemorySanitizer may still instrument such functions to avoid false positives. |
| 88 | This attribute may not be |
| 89 | supported by other compilers, so we suggest to use it together with |
Evgeniy Stepanov | fa203cf | 2013-08-15 13:57:11 +0000 | [diff] [blame] | 90 | ``__has_feature(memory_sanitizer)``. |
Kostya Serebryany | 85aee96 | 2013-02-26 06:58:27 +0000 | [diff] [blame] | 91 | |
Alexey Samsonov | 05654ff | 2013-08-07 08:23:32 +0000 | [diff] [blame] | 92 | Blacklist |
| 93 | --------- |
| 94 | |
| 95 | MemorySanitizer supports ``src`` and ``fun`` entity types in |
| 96 | :doc:`SanitizerSpecialCaseList`, that can be used to relax MemorySanitizer |
| 97 | checks for certain source files and functions. All "Use of uninitialized value" |
| 98 | warnings will be suppressed and all values loaded from memory will be |
| 99 | considered fully initialized. |
| 100 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 101 | Report symbolization |
| 102 | ==================== |
| 103 | |
| 104 | MemorySanitizer uses an external symbolizer to print files and line numbers in |
| 105 | reports. Make sure that ``llvm-symbolizer`` binary is in ``PATH``, |
| 106 | or set environment variable ``MSAN_SYMBOLIZER_PATH`` to point to it. |
| 107 | |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 108 | Origin Tracking |
| 109 | =============== |
| 110 | |
| 111 | MemorySanitizer can track origins of unitialized values, similar to |
| 112 | Valgrind's --track-origins option. This feature is enabled by |
Stephen Hines | 0e2c34f | 2015-03-23 12:09:02 -0700 | [diff] [blame] | 113 | ``-fsanitize-memory-track-origins=2`` (or simply |
| 114 | ``-fsanitize-memory-track-origins``) Clang option. With the code from |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 115 | the example above, |
| 116 | |
| 117 | .. code-block:: console |
| 118 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 119 | % cat umr2.cc |
| 120 | #include <stdio.h> |
| 121 | |
| 122 | int main(int argc, char** argv) { |
| 123 | int* a = new int[10]; |
| 124 | a[5] = 0; |
| 125 | volatile int b = a[argc]; |
| 126 | if (b) |
| 127 | printf("xx\n"); |
| 128 | return 0; |
| 129 | } |
| 130 | |
| 131 | % clang -fsanitize=memory -fsanitize-memory-track-origins=2 -fno-omit-frame-pointer -g -O2 umr2.cc |
| 132 | % ./a.out |
| 133 | WARNING: MemorySanitizer: use-of-uninitialized-value |
| 134 | #0 0x7f7893912f0b in main umr2.cc:7 |
| 135 | #1 0x7f789249b76c in __libc_start_main libc-start.c:226 |
| 136 | |
| 137 | Uninitialized value was stored to memory at |
| 138 | #0 0x7f78938b5c25 in __msan_chain_origin msan.cc:484 |
| 139 | #1 0x7f7893912ecd in main umr2.cc:6 |
| 140 | |
| 141 | Uninitialized value was created by a heap allocation |
| 142 | #0 0x7f7893901cbd in operator new[](unsigned long) msan_new_delete.cc:44 |
| 143 | #1 0x7f7893912e06 in main umr2.cc:4 |
| 144 | |
Stephen Hines | 0e2c34f | 2015-03-23 12:09:02 -0700 | [diff] [blame] | 145 | By default, MemorySanitizer collects both allocation points and all |
| 146 | intermediate stores the uninitialized value went through. Origin |
| 147 | tracking has proved to be very useful for debugging MemorySanitizer |
| 148 | reports. It slows down program execution by a factor of 1.5x-2x on top |
| 149 | of the usual MemorySanitizer slowdown. |
| 150 | |
| 151 | Clang option ``-fsanitize-memory-track-origins=1`` enabled a slightly |
| 152 | faster mode when MemorySanitizer collects only allocation points but |
| 153 | not intermediate stores. |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 154 | |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 155 | Handling external code |
| 156 | ============================ |
| 157 | |
| 158 | MemorySanitizer requires that all program code is instrumented. This |
| 159 | also includes any libraries that the program depends on, even libc. |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 160 | Failing to achieve this may result in false reports. |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 161 | |
| 162 | Full MemorySanitizer instrumentation is very difficult to achieve. To |
| 163 | make it easier, MemorySanitizer runtime library includes 70+ |
| 164 | interceptors for the most common libc functions. They make it possible |
| 165 | to run MemorySanitizer-instrumented programs linked with |
| 166 | uninstrumented libc. For example, the authors were able to bootstrap |
| 167 | MemorySanitizer-instrumented Clang compiler by linking it with |
Stephen Hines | 0e2c34f | 2015-03-23 12:09:02 -0700 | [diff] [blame] | 168 | self-built instrumented libc++ (as a replacement for libstdc++). |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 169 | |
| 170 | Supported Platforms |
| 171 | =================== |
| 172 | |
| 173 | MemorySanitizer is supported on |
| 174 | |
Stephen Hines | 651f13c | 2014-04-23 16:59:28 -0700 | [diff] [blame] | 175 | * Linux x86\_64 (tested on Ubuntu 12.04); |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 176 | |
| 177 | Limitations |
| 178 | =========== |
| 179 | |
| 180 | * MemorySanitizer uses 2x more real memory than a native run, 3x with |
| 181 | origin tracking. |
| 182 | * MemorySanitizer maps (but not reserves) 64 Terabytes of virtual |
| 183 | address space. This means that tools like ``ulimit`` may not work as |
| 184 | usually expected. |
| 185 | * Static linking is not supported. |
Peter Collingbourne | 52ca70d | 2013-04-09 04:35:11 +0000 | [diff] [blame] | 186 | * Non-position-independent executables are not supported. Therefore, the |
| 187 | ``fsanitize=memory`` flag will cause Clang to act as though the ``-fPIE`` |
| 188 | flag had been supplied if compiling without ``-fPIC``, and as though the |
| 189 | ``-pie`` flag had been supplied if linking an executable. |
Evgeniy Stepanov | cc603e9 | 2012-12-21 10:50:00 +0000 | [diff] [blame] | 190 | * Depending on the version of Linux kernel, running without ASLR may |
| 191 | be not supported. Note that GDB disables ASLR by default. To debug |
| 192 | instrumented programs, use "set disable-randomization off". |
| 193 | |
| 194 | Current Status |
| 195 | ============== |
| 196 | |
| 197 | MemorySanitizer is an experimental tool. It is known to work on large |
| 198 | real-world programs, like Clang/LLVM itself. |
| 199 | |
| 200 | More Information |
| 201 | ================ |
| 202 | |
| 203 | `http://code.google.com/p/memory-sanitizer <http://code.google.com/p/memory-sanitizer/>`_ |
| 204 | |