blob: ef8e60d5a1f235c7fb085d3ca54000163593c5db [file] [log] [blame]
Eugene Zelenkobff0ef02017-10-19 22:07:16 +00001//===- AddressSanitizer.cpp - memory error detector -----------------------===//
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11// Details of the algorithm:
Hans Wennborg08b34a02017-11-13 23:47:58 +000012// https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000013//
14//===----------------------------------------------------------------------===//
15
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000016#include "llvm/ADT/ArrayRef.h"
Alexey Samsonov29dd7f22012-12-27 08:50:58 +000017#include "llvm/ADT/DenseMap.h"
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +000018#include "llvm/ADT/DepthFirstIterator.h"
Florian Hahna1cc8482018-06-12 11:16:56 +000019#include "llvm/ADT/SmallPtrSet.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000020#include "llvm/ADT/SmallVector.h"
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +000021#include "llvm/ADT/Statistic.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000022#include "llvm/ADT/StringExtras.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000023#include "llvm/ADT/StringRef.h"
Evgeniy Stepanov617232f2012-05-23 11:52:12 +000024#include "llvm/ADT/Triple.h"
Vitaly Buka74443f02017-07-18 22:28:03 +000025#include "llvm/ADT/Twine.h"
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +000026#include "llvm/Analysis/MemoryBuiltins.h"
27#include "llvm/Analysis/TargetLibraryInfo.h"
Leonard Chaneebecb32018-10-26 22:51:51 +000028#include "llvm/Transforms/Utils/Local.h"
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +000029#include "llvm/Analysis/ValueTracking.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000030#include "llvm/BinaryFormat/MachO.h"
Vitaly Buka74443f02017-07-18 22:28:03 +000031#include "llvm/IR/Argument.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000032#include "llvm/IR/Attributes.h"
33#include "llvm/IR/BasicBlock.h"
Chandler Carruth219b89b2014-03-04 11:01:28 +000034#include "llvm/IR/CallSite.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000035#include "llvm/IR/Comdat.h"
36#include "llvm/IR/Constant.h"
37#include "llvm/IR/Constants.h"
Chandler Carruth12664a02014-03-06 00:22:06 +000038#include "llvm/IR/DIBuilder.h"
Chandler Carruth9fb823b2013-01-02 11:36:10 +000039#include "llvm/IR/DataLayout.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000040#include "llvm/IR/DebugInfoMetadata.h"
41#include "llvm/IR/DebugLoc.h"
42#include "llvm/IR/DerivedTypes.h"
Yury Gribov3ae427d2014-12-01 08:47:58 +000043#include "llvm/IR/Dominators.h"
Chandler Carruth9fb823b2013-01-02 11:36:10 +000044#include "llvm/IR/Function.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000045#include "llvm/IR/GlobalAlias.h"
46#include "llvm/IR/GlobalValue.h"
47#include "llvm/IR/GlobalVariable.h"
Chandler Carruth9fb823b2013-01-02 11:36:10 +000048#include "llvm/IR/IRBuilder.h"
49#include "llvm/IR/InlineAsm.h"
Chandler Carruth7da14f12014-03-06 03:23:41 +000050#include "llvm/IR/InstVisitor.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000051#include "llvm/IR/InstrTypes.h"
52#include "llvm/IR/Instruction.h"
53#include "llvm/IR/Instructions.h"
Chandler Carruth9fb823b2013-01-02 11:36:10 +000054#include "llvm/IR/IntrinsicInst.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000055#include "llvm/IR/Intrinsics.h"
Chandler Carruth9fb823b2013-01-02 11:36:10 +000056#include "llvm/IR/LLVMContext.h"
Kostya Serebryany714c67c2014-01-17 11:00:30 +000057#include "llvm/IR/MDBuilder.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000058#include "llvm/IR/Metadata.h"
Chandler Carruth9fb823b2013-01-02 11:36:10 +000059#include "llvm/IR/Module.h"
60#include "llvm/IR/Type.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000061#include "llvm/IR/Use.h"
62#include "llvm/IR/Value.h"
Kuba Brecka1001bb52014-12-05 22:19:18 +000063#include "llvm/MC/MCSectionMachO.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000064#include "llvm/Pass.h"
65#include "llvm/Support/Casting.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000066#include "llvm/Support/CommandLine.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000067#include "llvm/Support/Debug.h"
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000068#include "llvm/Support/ErrorHandling.h"
69#include "llvm/Support/MathExtras.h"
Vitaly Buka74443f02017-07-18 22:28:03 +000070#include "llvm/Support/ScopedPrinter.h"
Benjamin Kramer799003b2015-03-23 19:32:43 +000071#include "llvm/Support/raw_ostream.h"
Mehdi Aminib550cb12016-04-18 09:17:29 +000072#include "llvm/Transforms/Instrumentation.h"
Kostya Serebryany4fb78012013-12-06 09:00:17 +000073#include "llvm/Transforms/Utils/ASanStackFrameLayout.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000074#include "llvm/Transforms/Utils/BasicBlockUtils.h"
75#include "llvm/Transforms/Utils/ModuleUtils.h"
Anna Zaks8ed1d812015-02-27 03:12:36 +000076#include "llvm/Transforms/Utils/PromoteMemToReg.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000077#include <algorithm>
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000078#include <cassert>
79#include <cstddef>
80#include <cstdint>
Vitaly Buka3455b9b2016-08-20 18:34:39 +000081#include <iomanip>
Vitaly Buka793913c2016-08-29 18:17:21 +000082#include <limits>
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000083#include <memory>
Vitaly Buka3455b9b2016-08-20 18:34:39 +000084#include <sstream>
Chandler Carruthed0881b2012-12-03 16:50:05 +000085#include <string>
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000086#include <tuple>
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000087
88using namespace llvm;
89
Chandler Carruth964daaa2014-04-22 02:55:47 +000090#define DEBUG_TYPE "asan"
91
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000092static const uint64_t kDefaultShadowScale = 3;
93static const uint64_t kDefaultShadowOffset32 = 1ULL << 29;
94static const uint64_t kDefaultShadowOffset64 = 1ULL << 44;
Eugene Zelenkobff0ef02017-10-19 22:07:16 +000095static const uint64_t kDynamicShadowSentinel =
96 std::numeric_limits<uint64_t>::max();
Anna Zaks3b50e702016-02-02 22:05:07 +000097static const uint64_t kIOSShadowOffset32 = 1ULL << 30;
Anna Zaks3b50e702016-02-02 22:05:07 +000098static const uint64_t kIOSSimShadowOffset32 = 1ULL << 30;
99static const uint64_t kIOSSimShadowOffset64 = kDefaultShadowOffset64;
Walter Lee8f1545c2017-11-16 17:03:00 +0000100static const uint64_t kSmallX86_64ShadowOffsetBase = 0x7FFFFFFF; // < 2G.
101static const uint64_t kSmallX86_64ShadowOffsetAlignMask = ~0xFFFULL;
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +0000102static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000;
Bill Seurer957a0762017-12-07 22:53:33 +0000103static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 44;
Marcin Koscielnicki57290f92016-04-30 09:57:34 +0000104static const uint64_t kSystemZ_ShadowOffset64 = 1ULL << 52;
Kostya Serebryanyc5bd9812014-11-04 19:46:15 +0000105static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000;
Kumar Sukhani9559a5c2015-01-31 10:43:18 +0000106static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37;
Renato Golinaf213722015-02-03 11:20:45 +0000107static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36;
Kostya Serebryany8baa3862014-02-10 07:37:04 +0000108static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30;
109static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46;
Kamil Rytarowski02c432a2018-05-11 00:58:01 +0000110static const uint64_t kNetBSD_ShadowOffset32 = 1ULL << 30;
Kamil Rytarowskia9f404f82017-08-28 22:13:52 +0000111static const uint64_t kNetBSD_ShadowOffset64 = 1ULL << 46;
Kamil Rytarowski15ae7382018-12-15 16:32:41 +0000112static const uint64_t kNetBSDKasan_ShadowOffset64 = 0xdfff900000000000;
Filipe Cabecinhas33dd4862017-02-23 17:10:28 +0000113static const uint64_t kPS4CPU_ShadowOffset64 = 1ULL << 40;
Timur Iskhodzhanovb4b6b742015-01-22 12:24:21 +0000114static const uint64_t kWindowsShadowOffset32 = 3ULL << 28;
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000115
Walter Leecdbb2072018-05-18 04:10:38 +0000116static const uint64_t kMyriadShadowScale = 5;
117static const uint64_t kMyriadMemoryOffset32 = 0x80000000ULL;
118static const uint64_t kMyriadMemorySize32 = 0x20000000ULL;
119static const uint64_t kMyriadTagShift = 29;
120static const uint64_t kMyriadDDRTag = 4;
121static const uint64_t kMyriadCacheBitMask32 = 0x40000000ULL;
122
Etienne Bergeron0ca05682016-09-30 17:46:32 +0000123// The shadow memory space is dynamically allocated.
124static const uint64_t kWindowsShadowOffset64 = kDynamicShadowSentinel;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000125
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000126static const size_t kMinStackMallocSize = 1 << 6; // 64B
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000127static const size_t kMaxStackMallocSize = 1 << 16; // 64K
128static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3;
129static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E;
130
Craig Topperd3a34f82013-07-16 01:17:10 +0000131static const char *const kAsanModuleCtorName = "asan.module_ctor";
132static const char *const kAsanModuleDtorName = "asan.module_dtor";
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000133static const uint64_t kAsanCtorAndDtorPriority = 1;
Craig Topperd3a34f82013-07-16 01:17:10 +0000134static const char *const kAsanReportErrorTemplate = "__asan_report_";
Craig Topperd3a34f82013-07-16 01:17:10 +0000135static const char *const kAsanRegisterGlobalsName = "__asan_register_globals";
Alexey Samsonovf52b7172013-08-05 13:19:49 +0000136static const char *const kAsanUnregisterGlobalsName =
137 "__asan_unregister_globals";
Ryan Govostes653f9d02016-03-28 20:28:57 +0000138static const char *const kAsanRegisterImageGlobalsName =
139 "__asan_register_image_globals";
140static const char *const kAsanUnregisterImageGlobalsName =
141 "__asan_unregister_image_globals";
Evgeniy Stepanov964f4662017-04-27 20:27:27 +0000142static const char *const kAsanRegisterElfGlobalsName =
143 "__asan_register_elf_globals";
144static const char *const kAsanUnregisterElfGlobalsName =
145 "__asan_unregister_elf_globals";
Craig Topperd3a34f82013-07-16 01:17:10 +0000146static const char *const kAsanPoisonGlobalsName = "__asan_before_dynamic_init";
147static const char *const kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init";
Kuba Brecka45dbffd2015-07-23 10:54:06 +0000148static const char *const kAsanInitName = "__asan_init";
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +0000149static const char *const kAsanVersionCheckNamePrefix =
150 "__asan_version_mismatch_check_v";
Kostya Serebryany796f6552014-02-27 12:45:36 +0000151static const char *const kAsanPtrCmp = "__sanitizer_ptr_cmp";
152static const char *const kAsanPtrSub = "__sanitizer_ptr_sub";
Craig Topperd3a34f82013-07-16 01:17:10 +0000153static const char *const kAsanHandleNoReturnName = "__asan_handle_no_return";
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000154static const int kMaxAsanStackMallocSizeClass = 10;
Kostya Serebryany6805de52013-09-10 13:16:56 +0000155static const char *const kAsanStackMallocNameTemplate = "__asan_stack_malloc_";
156static const char *const kAsanStackFreeNameTemplate = "__asan_stack_free_";
Peter Collingbourne4a653fa2018-07-18 22:23:14 +0000157static const char *const kAsanGenPrefix = "___asan_gen_";
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +0000158static const char *const kODRGenPrefix = "__odr_asan_gen_";
Kostya Serebryanycb45b122014-11-19 00:22:58 +0000159static const char *const kSanCovGenPrefix = "__sancov_gen_";
Vitaly Buka3455b9b2016-08-20 18:34:39 +0000160static const char *const kAsanSetShadowPrefix = "__asan_set_shadow_";
Craig Topperd3a34f82013-07-16 01:17:10 +0000161static const char *const kAsanPoisonStackMemoryName =
162 "__asan_poison_stack_memory";
163static const char *const kAsanUnpoisonStackMemoryName =
Alexey Samsonov261177a2012-12-04 01:34:23 +0000164 "__asan_unpoison_stack_memory";
Evgeniy Stepanov964f4662017-04-27 20:27:27 +0000165
166// ASan version script has __asan_* wildcard. Triple underscore prevents a
167// linker (gold) warning about attempting to export a local symbol.
Ryan Govostes653f9d02016-03-28 20:28:57 +0000168static const char *const kAsanGlobalsRegisteredFlagName =
Evgeniy Stepanov964f4662017-04-27 20:27:27 +0000169 "___asan_globals_registered";
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000170
Vitaly Buka7b8ed4f2016-06-02 00:06:42 +0000171static const char *const kAsanOptionDetectUseAfterReturn =
Kostya Serebryanyf3223822013-09-18 14:07:14 +0000172 "__asan_option_detect_stack_use_after_return";
173
Etienne Bergeron0ca05682016-09-30 17:46:32 +0000174static const char *const kAsanShadowMemoryDynamicAddress =
175 "__asan_shadow_memory_dynamic_address";
176
Alexander Potapenkof90556e2015-06-12 11:27:06 +0000177static const char *const kAsanAllocaPoison = "__asan_alloca_poison";
178static const char *const kAsanAllocasUnpoison = "__asan_allocas_unpoison";
Yury Gribov98b18592015-05-28 07:51:49 +0000179
Kostya Serebryany874dae62012-07-16 16:15:40 +0000180// Accesses sizes are powers of two: 1, 2, 4, 8, 16.
181static const size_t kNumberOfAccessSizes = 5;
182
Yury Gribov55441bb2014-11-21 10:29:50 +0000183static const unsigned kAllocaRzSize = 32;
Yury Gribov55441bb2014-11-21 10:29:50 +0000184
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000185// Command-line flags.
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000186
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +0000187static cl::opt<bool> ClEnableKasan(
188 "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"),
189 cl::Hidden, cl::init(false));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000190
Yury Gribovd7731982015-11-11 10:36:49 +0000191static cl::opt<bool> ClRecover(
192 "asan-recover",
193 cl::desc("Enable recovery mode (continue-after-error)."),
194 cl::Hidden, cl::init(false));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000195
196// This flag may need to be replaced with -f[no-]asan-reads.
197static cl::opt<bool> ClInstrumentReads("asan-instrument-reads",
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000198 cl::desc("instrument read instructions"),
199 cl::Hidden, cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000200
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000201static cl::opt<bool> ClInstrumentWrites(
202 "asan-instrument-writes", cl::desc("instrument write instructions"),
203 cl::Hidden, cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000204
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000205static cl::opt<bool> ClInstrumentAtomics(
206 "asan-instrument-atomics",
207 cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden,
208 cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000209
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000210static cl::opt<bool> ClAlwaysSlowPath(
211 "asan-always-slow-path",
212 cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden,
213 cl::init(false));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000214
Etienne Bergeron0ca05682016-09-30 17:46:32 +0000215static cl::opt<bool> ClForceDynamicShadow(
216 "asan-force-dynamic-shadow",
217 cl::desc("Load shadow address into a local variable for each function"),
218 cl::Hidden, cl::init(false));
219
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +0000220static cl::opt<bool>
221 ClWithIfunc("asan-with-ifunc",
222 cl::desc("Access dynamic shadow through an ifunc global on "
223 "platforms that support this"),
224 cl::Hidden, cl::init(true));
225
226static cl::opt<bool> ClWithIfuncSuppressRemat(
227 "asan-with-ifunc-suppress-remat",
228 cl::desc("Suppress rematerialization of dynamic shadow address by passing "
229 "it through inline asm in prologue."),
230 cl::Hidden, cl::init(true));
231
Kostya Serebryany874dae62012-07-16 16:15:40 +0000232// This flag limits the number of instructions to be instrumented
Kostya Serebryanyc387ca72012-06-28 09:34:41 +0000233// in any given BB. Normally, this should be set to unlimited (INT_MAX),
234// but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary
235// set it to 10000.
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000236static cl::opt<int> ClMaxInsnsToInstrumentPerBB(
237 "asan-max-ins-per-bb", cl::init(10000),
238 cl::desc("maximal number of instructions to instrument in any given BB"),
239 cl::Hidden);
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000240
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000241// This flag may need to be replaced with -f[no]asan-stack.
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000242static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"),
243 cl::Hidden, cl::init(true));
Vitaly Buka1f9e1352016-08-20 20:23:50 +0000244static cl::opt<uint32_t> ClMaxInlinePoisoningSize(
245 "asan-max-inline-poisoning-size",
246 cl::desc(
247 "Inline shadow poisoning for blocks up to the given size in bytes."),
248 cl::Hidden, cl::init(64));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000249
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000250static cl::opt<bool> ClUseAfterReturn("asan-use-after-return",
Mike Aizatsky243b71f2016-04-21 22:00:13 +0000251 cl::desc("Check stack-use-after-return"),
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000252 cl::Hidden, cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000253
Vitaly Buka74443f02017-07-18 22:28:03 +0000254static cl::opt<bool> ClRedzoneByvalArgs("asan-redzone-byval-args",
255 cl::desc("Create redzones for byval "
256 "arguments (extra copy "
257 "required)"), cl::Hidden,
258 cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000259
Kostya Serebryanya83bfea2016-04-20 20:02:58 +0000260static cl::opt<bool> ClUseAfterScope("asan-use-after-scope",
261 cl::desc("Check stack-use-after-scope"),
262 cl::Hidden, cl::init(false));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000263
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000264// This flag may need to be replaced with -f[no]asan-globals.
265static cl::opt<bool> ClGlobals("asan-globals",
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000266 cl::desc("Handle global objects"), cl::Hidden,
267 cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000268
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000269static cl::opt<bool> ClInitializers("asan-initialization-order",
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000270 cl::desc("Handle C++ initializer order"),
271 cl::Hidden, cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000272
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000273static cl::opt<bool> ClInvalidPointerPairs(
274 "asan-detect-invalid-pointer-pair",
275 cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden,
276 cl::init(false));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000277
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000278static cl::opt<unsigned> ClRealignStack(
279 "asan-realign-stack",
280 cl::desc("Realign stack to the value of this flag (power of two)"),
281 cl::Hidden, cl::init(32));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000282
Kostya Serebryany0c02d262014-04-16 12:12:19 +0000283static cl::opt<int> ClInstrumentationWithCallsThreshold(
284 "asan-instrumentation-with-call-threshold",
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000285 cl::desc(
286 "If the function being instrumented contains more than "
287 "this number of memory accesses, use callbacks instead of "
288 "inline checks (-1 means never use callbacks)."),
289 cl::Hidden, cl::init(7000));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000290
Kostya Serebryany0c02d262014-04-16 12:12:19 +0000291static cl::opt<std::string> ClMemoryAccessCallbackPrefix(
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000292 "asan-memory-access-callback-prefix",
293 cl::desc("Prefix for memory access callbacks"), cl::Hidden,
294 cl::init("__asan_"));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000295
Vitaly Buka5b4f1212016-08-20 17:22:27 +0000296static cl::opt<bool>
297 ClInstrumentDynamicAllocas("asan-instrument-dynamic-allocas",
298 cl::desc("instrument dynamic allocas"),
299 cl::Hidden, cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000300
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000301static cl::opt<bool> ClSkipPromotableAllocas(
302 "asan-skip-promotable-allocas",
303 cl::desc("Do not instrument promotable allocas"), cl::Hidden,
304 cl::init(true));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000305
306// These flags allow to change the shadow mapping.
307// The shadow mapping looks like
Ryan Govostes3f37df02016-05-06 10:25:22 +0000308// Shadow = (Mem >> scale) + offset
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000309
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000310static cl::opt<int> ClMappingScale("asan-mapping-scale",
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000311 cl::desc("scale of asan shadow mapping"),
312 cl::Hidden, cl::init(0));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000313
Ryan Govostes6194ae62016-05-06 11:22:11 +0000314static cl::opt<unsigned long long> ClMappingOffset(
315 "asan-mapping-offset",
316 cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"), cl::Hidden,
317 cl::init(0));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000318
319// Optimization flags. Not user visible, used mostly for testing
320// and benchmarking the tool.
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000321
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000322static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"),
323 cl::Hidden, cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000324
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000325static cl::opt<bool> ClOptSameTemp(
326 "asan-opt-same-temp", cl::desc("Instrument the same temp just once"),
327 cl::Hidden, cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000328
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000329static cl::opt<bool> ClOptGlobals("asan-opt-globals",
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000330 cl::desc("Don't instrument scalar globals"),
331 cl::Hidden, cl::init(true));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000332
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000333static cl::opt<bool> ClOptStack(
334 "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"),
335 cl::Hidden, cl::init(false));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000336
Alexey Samsonov4b7f4132014-12-11 21:53:03 +0000337static cl::opt<bool> ClDynamicAllocaStack(
338 "asan-stack-dynamic-alloca",
339 cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden,
Alexey Samsonov19763c42015-02-05 19:39:20 +0000340 cl::init(true));
Alexey Samsonov4b7f4132014-12-11 21:53:03 +0000341
Dmitry Vyukov618d5802015-03-17 16:59:19 +0000342static cl::opt<uint32_t> ClForceExperiment(
343 "asan-force-experiment",
344 cl::desc("Force optimization experiment (for testing)"), cl::Hidden,
345 cl::init(0));
346
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +0000347static cl::opt<bool>
Vitaly Bukad6bab092018-12-04 23:17:41 +0000348 ClUsePrivateAlias("asan-use-private-alias",
349 cl::desc("Use private aliases for global variables"),
350 cl::Hidden, cl::init(false));
351
352static cl::opt<bool>
353 ClUseOdrIndicator("asan-use-odr-indicator",
354 cl::desc("Use odr indicators to improve ODR reporting"),
355 cl::Hidden, cl::init(false));
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +0000356
Ryan Govostese51401b2016-07-05 21:53:08 +0000357static cl::opt<bool>
Evgeniy Stepanov9e536082017-04-24 19:34:13 +0000358 ClUseGlobalsGC("asan-globals-live-support",
359 cl::desc("Use linker features to support dead "
360 "code stripping of globals"),
361 cl::Hidden, cl::init(true));
Ryan Govostese51401b2016-07-05 21:53:08 +0000362
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +0000363// This is on by default even though there is a bug in gold:
364// https://sourceware.org/bugzilla/show_bug.cgi?id=19002
365static cl::opt<bool>
366 ClWithComdat("asan-with-comdat",
367 cl::desc("Place ASan constructors in comdat sections"),
368 cl::Hidden, cl::init(true));
369
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000370// Debug flags.
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000371
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000372static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden,
373 cl::init(0));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000374
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000375static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"),
376 cl::Hidden, cl::init(0));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000377
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000378static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden,
379 cl::desc("Debug func"));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000380
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000381static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"),
382 cl::Hidden, cl::init(-1));
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000383
Etienne Bergeron7f0e3152016-09-22 14:57:24 +0000384static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug max inst"),
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000385 cl::Hidden, cl::init(-1));
386
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000387STATISTIC(NumInstrumentedReads, "Number of instrumented reads");
388STATISTIC(NumInstrumentedWrites, "Number of instrumented writes");
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000389STATISTIC(NumOptimizedAccessesToGlobalVar,
390 "Number of optimized accesses to global vars");
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000391STATISTIC(NumOptimizedAccessesToStackVar,
392 "Number of optimized accesses to stack vars");
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000393
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000394namespace {
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000395
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +0000396/// Frontend-provided metadata for source location.
397struct LocationMetadata {
398 StringRef Filename;
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000399 int LineNo = 0;
400 int ColumnNo = 0;
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +0000401
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000402 LocationMetadata() = default;
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +0000403
404 bool empty() const { return Filename.empty(); }
405
406 void parse(MDNode *MDN) {
407 assert(MDN->getNumOperands() == 3);
Duncan P. N. Exon Smitha9308c42015-04-29 16:38:44 +0000408 MDString *DIFilename = cast<MDString>(MDN->getOperand(0));
409 Filename = DIFilename->getString();
Duncan P. N. Exon Smith5bf8fef2014-12-09 18:38:53 +0000410 LineNo =
411 mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue();
412 ColumnNo =
413 mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue();
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +0000414 }
415};
416
Alexey Samsonov4f319cc2014-07-02 16:54:41 +0000417/// Frontend-provided metadata for global variables.
418class GlobalsMetadata {
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000419public:
Alexey Samsonov08f022a2014-07-11 22:36:02 +0000420 struct Entry {
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +0000421 LocationMetadata SourceLoc;
422 StringRef Name;
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000423 bool IsDynInit = false;
424 bool IsBlacklisted = false;
425
426 Entry() = default;
Alexey Samsonov08f022a2014-07-11 22:36:02 +0000427 };
428
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000429 GlobalsMetadata() = default;
Alexey Samsonov08f022a2014-07-11 22:36:02 +0000430
Keno Fischere03fae42015-12-05 14:42:34 +0000431 void reset() {
432 inited_ = false;
433 Entries.clear();
434 }
435
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000436 void init(Module &M) {
Alexey Samsonov4f319cc2014-07-02 16:54:41 +0000437 assert(!inited_);
438 inited_ = true;
439 NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals");
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000440 if (!Globals) return;
Duncan P. N. Exon Smithde36e802014-11-11 21:30:22 +0000441 for (auto MDN : Globals->operands()) {
Alexey Samsonov08f022a2014-07-11 22:36:02 +0000442 // Metadata node contains the global and the fields of "Entry".
Alexey Samsonov15c96692014-07-12 00:42:52 +0000443 assert(MDN->getNumOperands() == 5);
Kuba Mracek3760fc92018-12-18 21:20:17 +0000444 auto *V = mdconst::extract_or_null<Constant>(MDN->getOperand(0));
Alexey Samsonov4f319cc2014-07-02 16:54:41 +0000445 // The optimizer may optimize away a global entirely.
Kuba Mracek3760fc92018-12-18 21:20:17 +0000446 if (!V) continue;
447 auto *StrippedV = V->stripPointerCasts();
448 auto *GV = dyn_cast<GlobalVariable>(StrippedV);
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000449 if (!GV) continue;
Alexey Samsonov08f022a2014-07-11 22:36:02 +0000450 // We can already have an entry for GV if it was merged with another
451 // global.
452 Entry &E = Entries[GV];
Duncan P. N. Exon Smith5bf8fef2014-12-09 18:38:53 +0000453 if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1)))
454 E.SourceLoc.parse(Loc);
455 if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2)))
456 E.Name = Name->getString();
457 ConstantInt *IsDynInit =
458 mdconst::extract<ConstantInt>(MDN->getOperand(3));
Alexey Samsonov08f022a2014-07-11 22:36:02 +0000459 E.IsDynInit |= IsDynInit->isOne();
Duncan P. N. Exon Smith5bf8fef2014-12-09 18:38:53 +0000460 ConstantInt *IsBlacklisted =
461 mdconst::extract<ConstantInt>(MDN->getOperand(4));
Alexey Samsonov08f022a2014-07-11 22:36:02 +0000462 E.IsBlacklisted |= IsBlacklisted->isOne();
Kostya Serebryanyb3bd6052012-11-20 13:00:01 +0000463 }
464 }
Alexey Samsonov4f319cc2014-07-02 16:54:41 +0000465
Alexey Samsonov08f022a2014-07-11 22:36:02 +0000466 /// Returns metadata entry for a given global.
467 Entry get(GlobalVariable *G) const {
468 auto Pos = Entries.find(G);
469 return (Pos != Entries.end()) ? Pos->second : Entry();
Alexey Samsonov4f319cc2014-07-02 16:54:41 +0000470 }
471
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000472private:
473 bool inited_ = false;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000474 DenseMap<GlobalVariable *, Entry> Entries;
Kostya Serebryanyb3bd6052012-11-20 13:00:01 +0000475};
476
Alexey Samsonov1345d352013-01-16 13:23:28 +0000477/// This struct defines the shadow mapping using the rule:
Kostya Serebryany4766fe62013-01-23 12:54:55 +0000478/// shadow = (mem >> Scale) ADD-or-OR Offset.
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +0000479/// If InGlobal is true, then
480/// extern char __asan_shadow[];
481/// shadow = (mem >> Scale) + &__asan_shadow
Alexey Samsonov1345d352013-01-16 13:23:28 +0000482struct ShadowMapping {
483 int Scale;
484 uint64_t Offset;
Kostya Serebryany4766fe62013-01-23 12:54:55 +0000485 bool OrShadowOffset;
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +0000486 bool InGlobal;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000487};
488
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000489} // end anonymous namespace
490
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +0000491static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize,
492 bool IsKasan) {
Evgeniy Stepanov5fe279e2015-10-08 21:21:24 +0000493 bool IsAndroid = TargetTriple.isAndroid();
Anna Zaks3b50e702016-02-02 22:05:07 +0000494 bool IsIOS = TargetTriple.isiOS() || TargetTriple.isWatchOS();
Simon Pilgrima2794102014-11-22 19:12:10 +0000495 bool IsFreeBSD = TargetTriple.isOSFreeBSD();
Kamil Rytarowskia9f404f82017-08-28 22:13:52 +0000496 bool IsNetBSD = TargetTriple.isOSNetBSD();
Filipe Cabecinhas33dd4862017-02-23 17:10:28 +0000497 bool IsPS4CPU = TargetTriple.isPS4CPU();
Simon Pilgrima2794102014-11-22 19:12:10 +0000498 bool IsLinux = TargetTriple.isOSLinux();
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000499 bool IsPPC64 = TargetTriple.getArch() == Triple::ppc64 ||
500 TargetTriple.getArch() == Triple::ppc64le;
501 bool IsSystemZ = TargetTriple.getArch() == Triple::systemz;
502 bool IsX86 = TargetTriple.getArch() == Triple::x86;
503 bool IsX86_64 = TargetTriple.getArch() == Triple::x86_64;
Alexander Richardson85e200e2018-06-25 16:49:20 +0000504 bool IsMIPS32 = TargetTriple.isMIPS32();
505 bool IsMIPS64 = TargetTriple.isMIPS64();
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +0000506 bool IsArmOrThumb = TargetTriple.isARM() || TargetTriple.isThumb();
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000507 bool IsAArch64 = TargetTriple.getArch() == Triple::aarch64;
Timur Iskhodzhanov00ede842015-01-12 17:38:58 +0000508 bool IsWindows = TargetTriple.isOSWindows();
Petr Hosek6f168572017-02-27 22:49:37 +0000509 bool IsFuchsia = TargetTriple.isOSFuchsia();
Walter Leecdbb2072018-05-18 04:10:38 +0000510 bool IsMyriad = TargetTriple.getVendor() == llvm::Triple::Myriad;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000511
512 ShadowMapping Mapping;
513
Walter Leecdbb2072018-05-18 04:10:38 +0000514 Mapping.Scale = IsMyriad ? kMyriadShadowScale : kDefaultShadowScale;
Walter Lee8f1545c2017-11-16 17:03:00 +0000515 if (ClMappingScale.getNumOccurrences() > 0) {
516 Mapping.Scale = ClMappingScale;
517 }
518
Evgeniy Stepanov4d81f862015-07-29 18:22:25 +0000519 if (LongSize == 32) {
Evgeniy Stepanov4d81f862015-07-29 18:22:25 +0000520 if (IsAndroid)
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +0000521 Mapping.Offset = kDynamicShadowSentinel;
Evgeniy Stepanov4d81f862015-07-29 18:22:25 +0000522 else if (IsMIPS32)
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000523 Mapping.Offset = kMIPS32_ShadowOffset32;
524 else if (IsFreeBSD)
525 Mapping.Offset = kFreeBSD_ShadowOffset32;
Kamil Rytarowski02c432a2018-05-11 00:58:01 +0000526 else if (IsNetBSD)
527 Mapping.Offset = kNetBSD_ShadowOffset32;
Alexander Potapenkoa51e4832014-04-23 17:14:45 +0000528 else if (IsIOS)
Anna Zaks3b50e702016-02-02 22:05:07 +0000529 // If we're targeting iOS and x86, the binary is built for iOS simulator.
530 Mapping.Offset = IsX86 ? kIOSSimShadowOffset32 : kIOSShadowOffset32;
Timur Iskhodzhanov00ede842015-01-12 17:38:58 +0000531 else if (IsWindows)
532 Mapping.Offset = kWindowsShadowOffset32;
Walter Leecdbb2072018-05-18 04:10:38 +0000533 else if (IsMyriad) {
534 uint64_t ShadowOffset = (kMyriadMemoryOffset32 + kMyriadMemorySize32 -
535 (kMyriadMemorySize32 >> Mapping.Scale));
536 Mapping.Offset = ShadowOffset - (kMyriadMemoryOffset32 >> Mapping.Scale);
537 }
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000538 else
539 Mapping.Offset = kDefaultShadowOffset32;
540 } else { // LongSize == 64
Petr Hosek6f168572017-02-27 22:49:37 +0000541 // Fuchsia is always PIE, which means that the beginning of the address
542 // space is always available.
543 if (IsFuchsia)
544 Mapping.Offset = 0;
545 else if (IsPPC64)
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000546 Mapping.Offset = kPPC64_ShadowOffset64;
Marcin Koscielnicki57290f92016-04-30 09:57:34 +0000547 else if (IsSystemZ)
548 Mapping.Offset = kSystemZ_ShadowOffset64;
John Baldwinc5d7e042018-08-01 22:51:13 +0000549 else if (IsFreeBSD && !IsMIPS64)
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000550 Mapping.Offset = kFreeBSD_ShadowOffset64;
Kamil Rytarowski15ae7382018-12-15 16:32:41 +0000551 else if (IsNetBSD) {
552 if (IsKasan)
553 Mapping.Offset = kNetBSDKasan_ShadowOffset64;
554 else
555 Mapping.Offset = kNetBSD_ShadowOffset64;
556 } else if (IsPS4CPU)
Filipe Cabecinhas33dd4862017-02-23 17:10:28 +0000557 Mapping.Offset = kPS4CPU_ShadowOffset64;
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +0000558 else if (IsLinux && IsX86_64) {
559 if (IsKasan)
560 Mapping.Offset = kLinuxKasan_ShadowOffset64;
561 else
Walter Lee8f1545c2017-11-16 17:03:00 +0000562 Mapping.Offset = (kSmallX86_64ShadowOffsetBase &
563 (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale));
Etienne Bergeron70684f92016-06-21 15:07:29 +0000564 } else if (IsWindows && IsX86_64) {
565 Mapping.Offset = kWindowsShadowOffset64;
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +0000566 } else if (IsMIPS64)
Kostya Serebryany231bd082014-11-11 23:02:57 +0000567 Mapping.Offset = kMIPS64_ShadowOffset64;
Anna Zaks3b50e702016-02-02 22:05:07 +0000568 else if (IsIOS)
569 // If we're targeting iOS and x86, the binary is built for iOS simulator.
Anna Zaks9a6a6ef2016-10-05 20:34:13 +0000570 // We are using dynamic shadow offset on the 64-bit devices.
571 Mapping.Offset =
572 IsX86_64 ? kIOSSimShadowOffset64 : kDynamicShadowSentinel;
Renato Golinaf213722015-02-03 11:20:45 +0000573 else if (IsAArch64)
574 Mapping.Offset = kAArch64_ShadowOffset64;
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000575 else
576 Mapping.Offset = kDefaultShadowOffset64;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000577 }
578
Etienne Bergeron0ca05682016-09-30 17:46:32 +0000579 if (ClForceDynamicShadow) {
580 Mapping.Offset = kDynamicShadowSentinel;
581 }
582
Ryan Govostes3f37df02016-05-06 10:25:22 +0000583 if (ClMappingOffset.getNumOccurrences() > 0) {
584 Mapping.Offset = ClMappingOffset;
585 }
586
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000587 // OR-ing shadow offset if more efficient (at least on x86) if the offset
588 // is a power of two, but on ppc64 we have to use add since the shadow
Marcin Koscielnicki57290f92016-04-30 09:57:34 +0000589 // offset is not necessary 1/8-th of the address space. On SystemZ,
590 // we could OR the constant in a single instruction, but it's more
591 // efficient to load it once and use indexed addressing.
Filipe Cabecinhas33dd4862017-02-23 17:10:28 +0000592 Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 && !IsSystemZ && !IsPS4CPU &&
593 !(Mapping.Offset & (Mapping.Offset - 1)) &&
594 Mapping.Offset != kDynamicShadowSentinel;
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +0000595 bool IsAndroidWithIfuncSupport =
596 IsAndroid && !TargetTriple.isAndroidVersionLT(21);
597 Mapping.InGlobal = ClWithIfunc && IsAndroidWithIfuncSupport && IsArmOrThumb;
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000598
Alexey Samsonov1345d352013-01-16 13:23:28 +0000599 return Mapping;
Kostya Serebryany20a79972012-11-22 03:18:50 +0000600}
601
Alexey Samsonov1345d352013-01-16 13:23:28 +0000602static size_t RedzoneSizeForScale(int MappingScale) {
Kostya Serebryany20a79972012-11-22 03:18:50 +0000603 // Redzone used for stack and globals is at least 32 bytes.
604 // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively.
Alexey Samsonov1345d352013-01-16 13:23:28 +0000605 return std::max(32U, 1U << MappingScale);
Kostya Serebryany20a79972012-11-22 03:18:50 +0000606}
Kostya Serebryanyb3bd6052012-11-20 13:00:01 +0000607
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000608namespace {
609
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000610/// AddressSanitizer: instrument the code in module to find memory bugs.
Leonard Chaneebecb32018-10-26 22:51:51 +0000611struct AddressSanitizer : public FunctionPass {
612 // Pass identification, replacement for typeid
613 static char ID;
614
615 explicit AddressSanitizer(bool CompileKernel = false, bool Recover = false,
Vitaly Buka1e75fa42016-05-27 22:55:10 +0000616 bool UseAfterScope = false)
Leonard Chaneebecb32018-10-26 22:51:51 +0000617 : FunctionPass(ID), UseAfterScope(UseAfterScope || ClUseAfterScope) {
Andrey Konovalov1ba9d9c2018-04-13 18:05:21 +0000618 this->Recover = ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover;
619 this->CompileKernel = ClEnableKasan.getNumOccurrences() > 0 ?
620 ClEnableKasan : CompileKernel;
Leonard Chaneebecb32018-10-26 22:51:51 +0000621 initializeAddressSanitizerPass(*PassRegistry::getPassRegistry());
622 }
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000623
Leonard Chaneebecb32018-10-26 22:51:51 +0000624 StringRef getPassName() const override {
625 return "AddressSanitizerFunctionPass";
626 }
627
628 void getAnalysisUsage(AnalysisUsage &AU) const override {
629 AU.addRequired<DominatorTreeWrapperPass>();
630 AU.addRequired<TargetLibraryInfoWrapperPass>();
Yury Gribov3ae427d2014-12-01 08:47:58 +0000631 }
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000632
Vitaly Buka21a9e572016-07-28 22:50:50 +0000633 uint64_t getAllocaSizeInBytes(const AllocaInst &AI) const {
Kuba Brecka7d03ce42016-06-27 15:57:08 +0000634 uint64_t ArraySize = 1;
Vitaly Buka21a9e572016-07-28 22:50:50 +0000635 if (AI.isArrayAllocation()) {
636 const ConstantInt *CI = dyn_cast<ConstantInt>(AI.getArraySize());
Kuba Brecka7d03ce42016-06-27 15:57:08 +0000637 assert(CI && "non-constant array size");
638 ArraySize = CI->getZExtValue();
639 }
Vitaly Buka21a9e572016-07-28 22:50:50 +0000640 Type *Ty = AI.getAllocatedType();
Mehdi Aminia28d91d2015-03-10 02:37:25 +0000641 uint64_t SizeInBytes =
Vitaly Buka21a9e572016-07-28 22:50:50 +0000642 AI.getModule()->getDataLayout().getTypeAllocSize(Ty);
Kuba Brecka7d03ce42016-06-27 15:57:08 +0000643 return SizeInBytes * ArraySize;
Anna Zaks8ed1d812015-02-27 03:12:36 +0000644 }
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000645
Anna Zaks8ed1d812015-02-27 03:12:36 +0000646 /// Check if we want (and can) handle this alloca.
Vitaly Buka21a9e572016-07-28 22:50:50 +0000647 bool isInterestingAlloca(const AllocaInst &AI);
Yury Gribov98b18592015-05-28 07:51:49 +0000648
Anna Zaks8ed1d812015-02-27 03:12:36 +0000649 /// If it is an interesting memory access, return the PointerOperand
650 /// and set IsWrite/Alignment. Otherwise return nullptr.
Filipe Cabecinhasec350b72016-11-15 22:37:30 +0000651 /// MaybeMask is an output parameter for the mask Value, if we're looking at a
652 /// masked load/store.
Anna Zaks8ed1d812015-02-27 03:12:36 +0000653 Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite,
Filipe Cabecinhasec350b72016-11-15 22:37:30 +0000654 uint64_t *TypeSize, unsigned *Alignment,
655 Value **MaybeMask = nullptr);
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000656
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000657 void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, Instruction *I,
Mehdi Aminia28d91d2015-03-10 02:37:25 +0000658 bool UseCalls, const DataLayout &DL);
Kostya Serebryany796f6552014-02-27 12:45:36 +0000659 void instrumentPointerComparisonOrSubtraction(Instruction *I);
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000660 void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore,
661 Value *Addr, uint32_t TypeSize, bool IsWrite,
Dmitry Vyukov618d5802015-03-17 16:59:19 +0000662 Value *SizeArgument, bool UseCalls, uint32_t Exp);
Filipe Cabecinhas4647b742017-01-06 15:24:51 +0000663 void instrumentUnusualSizeOrAlignment(Instruction *I,
664 Instruction *InsertBefore, Value *Addr,
Dmitry Vyukov618d5802015-03-17 16:59:19 +0000665 uint32_t TypeSize, bool IsWrite,
666 Value *SizeArgument, bool UseCalls,
667 uint32_t Exp);
Kostya Serebryany874dae62012-07-16 16:15:40 +0000668 Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
669 Value *ShadowValue, uint32_t TypeSize);
Kostya Serebryanyfda7a132012-08-14 14:04:51 +0000670 Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000671 bool IsWrite, size_t AccessSizeIndex,
Dmitry Vyukov618d5802015-03-17 16:59:19 +0000672 Value *SizeArgument, uint32_t Exp);
Kostya Serebryany94c81ca2014-04-21 11:50:42 +0000673 void instrumentMemIntrinsic(MemIntrinsic *MI);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000674 Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
Leonard Chaneebecb32018-10-26 22:51:51 +0000675 bool runOnFunction(Function &F) override;
Kostya Serebryany22ddcfd2012-01-30 23:50:10 +0000676 bool maybeInsertAsanInitAtFunctionEntry(Function &F);
Etienne Bergeron0ca05682016-09-30 17:46:32 +0000677 void maybeInsertDynamicShadowAtFunctionEntry(Function &F);
Reid Kleckner2f907552015-07-21 17:40:14 +0000678 void markEscapedLocalAllocas(Function &F);
Leonard Chaneebecb32018-10-26 22:51:51 +0000679 bool doInitialization(Module &M) override;
680 bool doFinalization(Module &M) override;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000681
Yury Gribov3ae427d2014-12-01 08:47:58 +0000682 DominatorTree &getDominatorTree() const { return *DT; }
683
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000684private:
685 friend struct FunctionStackPoisoner;
686
Kostya Serebryany4b929da2012-11-29 09:54:21 +0000687 void initializeCallbacks(Module &M);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000688
Kostya Serebryany1cdc6e92011-11-18 01:41:06 +0000689 bool LooksLikeCodeInBug11395(Instruction *I);
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000690 bool GlobalIsLinkerInitialized(GlobalVariable *G);
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000691 bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr,
692 uint64_t TypeSize) const;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000693
Reid Kleckner2f907552015-07-21 17:40:14 +0000694 /// Helper to cleanup per-function state.
695 struct FunctionStateRAII {
696 AddressSanitizer *Pass;
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000697
Reid Kleckner2f907552015-07-21 17:40:14 +0000698 FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) {
699 assert(Pass->ProcessedAllocas.empty() &&
700 "last pass forgot to clear cache");
Etienne Bergeron0ca05682016-09-30 17:46:32 +0000701 assert(!Pass->LocalDynamicShadow);
Reid Kleckner2f907552015-07-21 17:40:14 +0000702 }
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000703
Etienne Bergeron0ca05682016-09-30 17:46:32 +0000704 ~FunctionStateRAII() {
705 Pass->LocalDynamicShadow = nullptr;
706 Pass->ProcessedAllocas.clear();
707 }
Reid Kleckner2f907552015-07-21 17:40:14 +0000708 };
709
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000710 LLVMContext *C;
Kuba Brecka1001bb52014-12-05 22:19:18 +0000711 Triple TargetTriple;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000712 int LongSize;
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +0000713 bool CompileKernel;
Yury Gribovd7731982015-11-11 10:36:49 +0000714 bool Recover;
Vitaly Buka1e75fa42016-05-27 22:55:10 +0000715 bool UseAfterScope;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000716 Type *IntptrTy;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000717 ShadowMapping Mapping;
Yury Gribov3ae427d2014-12-01 08:47:58 +0000718 DominatorTree *DT;
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000719 Function *AsanHandleNoReturnFunc;
Kostya Serebryany796f6552014-02-27 12:45:36 +0000720 Function *AsanPtrCmpFunction, *AsanPtrSubFunction;
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +0000721 Constant *AsanShadowGlobal;
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000722
723 // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize).
Dmitry Vyukov618d5802015-03-17 16:59:19 +0000724 Function *AsanErrorCallback[2][2][kNumberOfAccessSizes];
725 Function *AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes];
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000726
727 // These arrays is indexed by AccessIsWrite and Experiment.
Dmitry Vyukov618d5802015-03-17 16:59:19 +0000728 Function *AsanErrorCallbackSized[2][2];
729 Function *AsanMemoryAccessCallbackSized[2][2];
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000730
Kostya Serebryany94c81ca2014-04-21 11:50:42 +0000731 Function *AsanMemmove, *AsanMemcpy, *AsanMemset;
Kostya Serebryanyf02c6062012-07-20 09:54:50 +0000732 InlineAsm *EmptyAsm;
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000733 Value *LocalDynamicShadow = nullptr;
Alexey Samsonov4f319cc2014-07-02 16:54:41 +0000734 GlobalsMetadata GlobalsMD;
Vitaly Buka21a9e572016-07-28 22:50:50 +0000735 DenseMap<const AllocaInst *, bool> ProcessedAllocas;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000736};
Kostya Serebryany874dae62012-07-16 16:15:40 +0000737
Leonard Chaneebecb32018-10-26 22:51:51 +0000738class AddressSanitizerModule : public ModulePass {
Evgeniy Stepanov9e536082017-04-24 19:34:13 +0000739public:
Leonard Chaneebecb32018-10-26 22:51:51 +0000740 // Pass identification, replacement for typeid
741 static char ID;
742
Yury Gribovd7731982015-11-11 10:36:49 +0000743 explicit AddressSanitizerModule(bool CompileKernel = false,
Evgeniy Stepanov9e536082017-04-24 19:34:13 +0000744 bool Recover = false,
Vitaly Buka8076c572018-12-05 01:44:31 +0000745 bool UseGlobalsGC = true,
746 bool UseOdrIndicator = false)
747 : ModulePass(ID), UseGlobalsGC(UseGlobalsGC && ClUseGlobalsGC),
748 // Enable aliases as they should have no downside with ODR indicators.
749 UsePrivateAlias(UseOdrIndicator || ClUsePrivateAlias),
750 UseOdrIndicator(UseOdrIndicator || ClUseOdrIndicator),
Evgeniy Stepanovb56012b2017-05-15 20:43:42 +0000751 // Not a typo: ClWithComdat is almost completely pointless without
752 // ClUseGlobalsGC (because then it only works on modules without
753 // globals, which are rare); it is a prerequisite for ClUseGlobalsGC;
754 // and both suffer from gold PR19002 for which UseGlobalsGC constructor
755 // argument is designed as workaround. Therefore, disable both
756 // ClWithComdat and ClUseGlobalsGC unless the frontend says it's ok to
757 // do globals-gc.
Andrey Konovalov1ba9d9c2018-04-13 18:05:21 +0000758 UseCtorComdat(UseGlobalsGC && ClWithComdat) {
Vitaly Buka8076c572018-12-05 01:44:31 +0000759 this->Recover = ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover;
760 this->CompileKernel =
761 ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan : CompileKernel;
Vitaly Buka537cfc02018-12-04 00:36:14 +0000762 }
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000763
Leonard Chaneebecb32018-10-26 22:51:51 +0000764 bool runOnModule(Module &M) override;
765 StringRef getPassName() const override { return "AddressSanitizerModule"; }
Alexey Samsonov261177a2012-12-04 01:34:23 +0000766
Mehdi Amini117296c2016-10-01 02:56:57 +0000767private:
Alexey Samsonov788381b2012-12-25 12:28:20 +0000768 void initializeCallbacks(Module &M);
769
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +0000770 bool InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat);
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +0000771 void InstrumentGlobalsCOFF(IRBuilder<> &IRB, Module &M,
772 ArrayRef<GlobalVariable *> ExtendedGlobals,
773 ArrayRef<Constant *> MetadataInitializers);
Evgeniy Stepanov964f4662017-04-27 20:27:27 +0000774 void InstrumentGlobalsELF(IRBuilder<> &IRB, Module &M,
775 ArrayRef<GlobalVariable *> ExtendedGlobals,
776 ArrayRef<Constant *> MetadataInitializers,
777 const std::string &UniqueModuleId);
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +0000778 void InstrumentGlobalsMachO(IRBuilder<> &IRB, Module &M,
779 ArrayRef<GlobalVariable *> ExtendedGlobals,
780 ArrayRef<Constant *> MetadataInitializers);
781 void
782 InstrumentGlobalsWithMetadataArray(IRBuilder<> &IRB, Module &M,
783 ArrayRef<GlobalVariable *> ExtendedGlobals,
784 ArrayRef<Constant *> MetadataInitializers);
785
786 GlobalVariable *CreateMetadataGlobal(Module &M, Constant *Initializer,
787 StringRef OriginalName);
Evgeniy Stepanov964f4662017-04-27 20:27:27 +0000788 void SetComdatForGlobalMetadata(GlobalVariable *G, GlobalVariable *Metadata,
789 StringRef InternalSuffix);
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +0000790 IRBuilder<> CreateAsanModuleDtor(Module &M);
791
Kostya Serebryany20a79972012-11-22 03:18:50 +0000792 bool ShouldInstrumentGlobal(GlobalVariable *G);
Ryan Govostes653f9d02016-03-28 20:28:57 +0000793 bool ShouldUseMachOGlobalsSection() const;
Reid Kleckner01660a32016-11-21 20:40:37 +0000794 StringRef getGlobalMetadataSection() const;
Alexey Samsonov96e239f2014-05-29 00:51:15 +0000795 void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName);
Alexey Samsonove1e26bf2013-03-26 13:05:41 +0000796 void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName);
Kostya Serebryany4fb78012013-12-06 09:00:17 +0000797 size_t MinRedzoneSizeForGlobal() const {
Alexey Samsonov1345d352013-01-16 13:23:28 +0000798 return RedzoneSizeForScale(Mapping.Scale);
799 }
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +0000800 int GetAsanVersion(const Module &M) const;
Kostya Serebryany20a79972012-11-22 03:18:50 +0000801
Alexey Samsonov4f319cc2014-07-02 16:54:41 +0000802 GlobalsMetadata GlobalsMD;
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +0000803 bool CompileKernel;
Yury Gribovd7731982015-11-11 10:36:49 +0000804 bool Recover;
Evgeniy Stepanov9e536082017-04-24 19:34:13 +0000805 bool UseGlobalsGC;
Vitaly Buka8076c572018-12-05 01:44:31 +0000806 bool UsePrivateAlias;
807 bool UseOdrIndicator;
Evgeniy Stepanovb56012b2017-05-15 20:43:42 +0000808 bool UseCtorComdat;
Kostya Serebryany20a79972012-11-22 03:18:50 +0000809 Type *IntptrTy;
810 LLVMContext *C;
Kuba Brecka1001bb52014-12-05 22:19:18 +0000811 Triple TargetTriple;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000812 ShadowMapping Mapping;
Alexey Samsonov788381b2012-12-25 12:28:20 +0000813 Function *AsanPoisonGlobals;
814 Function *AsanUnpoisonGlobals;
815 Function *AsanRegisterGlobals;
816 Function *AsanUnregisterGlobals;
Ryan Govostes653f9d02016-03-28 20:28:57 +0000817 Function *AsanRegisterImageGlobals;
818 Function *AsanUnregisterImageGlobals;
Evgeniy Stepanov964f4662017-04-27 20:27:27 +0000819 Function *AsanRegisterElfGlobals;
820 Function *AsanUnregisterElfGlobals;
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +0000821
822 Function *AsanCtorFunction = nullptr;
823 Function *AsanDtorFunction = nullptr;
Kostya Serebryany20a79972012-11-22 03:18:50 +0000824};
825
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000826// Stack poisoning does not play well with exception handling.
827// When an exception is thrown, we essentially bypass the code
828// that unpoisones the stack. This is why the run-time library has
829// to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire
830// stack in the interceptor. This however does not work inside the
831// actual function which catches the exception. Most likely because the
832// compiler hoists the load of the shadow value somewhere too high.
833// This causes asan to report a non-existing bug on 453.povray.
834// It sounds like an LLVM bug.
835struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
836 Function &F;
837 AddressSanitizer &ASan;
838 DIBuilder DIB;
839 LLVMContext *C;
840 Type *IntptrTy;
841 Type *IntptrPtrTy;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000842 ShadowMapping Mapping;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000843
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000844 SmallVector<AllocaInst *, 16> AllocaVec;
Kuba Breckaa49dcbb2016-11-08 21:30:41 +0000845 SmallVector<AllocaInst *, 16> StaticAllocasToMoveUp;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000846 SmallVector<Instruction *, 8> RetVec;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000847 unsigned StackAlignment;
848
Kostya Serebryany6805de52013-09-10 13:16:56 +0000849 Function *AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1],
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000850 *AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1];
Vitaly Buka3455b9b2016-08-20 18:34:39 +0000851 Function *AsanSetShadowFunc[0x100] = {};
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000852 Function *AsanPoisonStackMemoryFunc, *AsanUnpoisonStackMemoryFunc;
Yury Gribov98b18592015-05-28 07:51:49 +0000853 Function *AsanAllocaPoisonFunc, *AsanAllocasUnpoisonFunc;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000854
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000855 // Stores a place and arguments of poisoning/unpoisoning call for alloca.
856 struct AllocaPoisonCall {
857 IntrinsicInst *InsBefore;
Alexey Samsonova788b942013-11-18 14:53:55 +0000858 AllocaInst *AI;
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000859 uint64_t Size;
860 bool DoPoison;
861 };
Vitaly Buka5b4f1212016-08-20 17:22:27 +0000862 SmallVector<AllocaPoisonCall, 8> DynamicAllocaPoisonCallVec;
863 SmallVector<AllocaPoisonCall, 8> StaticAllocaPoisonCallVec;
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000864
Yury Gribov98b18592015-05-28 07:51:49 +0000865 SmallVector<AllocaInst *, 1> DynamicAllocaVec;
866 SmallVector<IntrinsicInst *, 1> StackRestoreVec;
867 AllocaInst *DynamicAllocaLayout = nullptr;
Reid Kleckner2f907552015-07-21 17:40:14 +0000868 IntrinsicInst *LocalEscapeCall = nullptr;
Yury Gribov55441bb2014-11-21 10:29:50 +0000869
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000870 // Maps Value to an AllocaInst from which the Value is originated.
Eugene Zelenkobff0ef02017-10-19 22:07:16 +0000871 using AllocaForValueMapTy = DenseMap<Value *, AllocaInst *>;
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000872 AllocaForValueMapTy AllocaForValue;
873
Alexey Samsonov869a5ff2015-07-29 19:36:08 +0000874 bool HasNonEmptyInlineAsm = false;
875 bool HasReturnsTwiceCall = false;
Alexey Samsonov4b7f4132014-12-11 21:53:03 +0000876 std::unique_ptr<CallInst> EmptyInlineAsm;
877
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000878 FunctionStackPoisoner(Function &F, AddressSanitizer &ASan)
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000879 : F(F),
880 ASan(ASan),
881 DIB(*F.getParent(), /*AllowUnresolved*/ false),
882 C(ASan.C),
883 IntptrTy(ASan.IntptrTy),
884 IntptrPtrTy(PointerType::get(IntptrTy, 0)),
885 Mapping(ASan.Mapping),
886 StackAlignment(1 << Mapping.Scale),
Alexey Samsonov4b7f4132014-12-11 21:53:03 +0000887 EmptyInlineAsm(CallInst::Create(ASan.EmptyAsm)) {}
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000888
889 bool runOnFunction() {
890 if (!ClStack) return false;
Vitaly Buka74443f02017-07-18 22:28:03 +0000891
Matt Morehouse49e5aca2017-08-09 17:59:43 +0000892 if (ClRedzoneByvalArgs)
Vitaly Buka629047de2017-08-07 07:12:34 +0000893 copyArgsPassedByValToAllocas();
Vitaly Buka74443f02017-07-18 22:28:03 +0000894
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000895 // Collect alloca, ret, lifetime instructions etc.
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000896 for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB);
David Blaikieceec2bd2014-04-11 01:50:01 +0000897
Yury Gribov55441bb2014-11-21 10:29:50 +0000898 if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000899
900 initializeCallbacks(*F.getParent());
901
Vitaly Buka5b4f1212016-08-20 17:22:27 +0000902 processDynamicAllocas();
903 processStaticAllocas();
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000904
905 if (ClDebugStack) {
Nicola Zaghend34e60c2018-05-14 12:53:11 +0000906 LLVM_DEBUG(dbgs() << F);
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000907 }
908 return true;
909 }
910
Vitaly Buka74443f02017-07-18 22:28:03 +0000911 // Arguments marked with the "byval" attribute are implicitly copied without
912 // using an alloca instruction. To produce redzones for those arguments, we
913 // copy them a second time into memory allocated with an alloca instruction.
914 void copyArgsPassedByValToAllocas();
915
Yury Gribov55441bb2014-11-21 10:29:50 +0000916 // Finds all Alloca instructions and puts
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000917 // poisoned red zones around all of them.
918 // Then unpoison everything back before the function returns.
Vitaly Buka5b4f1212016-08-20 17:22:27 +0000919 void processStaticAllocas();
920 void processDynamicAllocas();
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000921
Yury Gribov98b18592015-05-28 07:51:49 +0000922 void createDynamicAllocasInitStorage();
923
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000924 // ----------------------- Visitors.
Adrian Prantl5f8f34e42018-05-01 15:54:18 +0000925 /// Collect all Ret instructions.
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +0000926 void visitReturnInst(ReturnInst &RI) { RetVec.push_back(&RI); }
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000927
Adrian Prantl5f8f34e42018-05-01 15:54:18 +0000928 /// Collect all Resume instructions.
Vitaly Bukae3a032a2016-07-22 22:04:38 +0000929 void visitResumeInst(ResumeInst &RI) { RetVec.push_back(&RI); }
930
Adrian Prantl5f8f34e42018-05-01 15:54:18 +0000931 /// Collect all CatchReturnInst instructions.
Vitaly Bukae3a032a2016-07-22 22:04:38 +0000932 void visitCleanupReturnInst(CleanupReturnInst &CRI) { RetVec.push_back(&CRI); }
933
Yury Gribov98b18592015-05-28 07:51:49 +0000934 void unpoisonDynamicAllocasBeforeInst(Instruction *InstBefore,
935 Value *SavedStack) {
936 IRBuilder<> IRB(InstBefore);
Yury Gribov6ff0a662015-12-04 09:19:14 +0000937 Value *DynamicAreaPtr = IRB.CreatePtrToInt(SavedStack, IntptrTy);
938 // When we insert _asan_allocas_unpoison before @llvm.stackrestore, we
939 // need to adjust extracted SP to compute the address of the most recent
940 // alloca. We have a special @llvm.get.dynamic.area.offset intrinsic for
941 // this purpose.
942 if (!isa<ReturnInst>(InstBefore)) {
943 Function *DynamicAreaOffsetFunc = Intrinsic::getDeclaration(
944 InstBefore->getModule(), Intrinsic::get_dynamic_area_offset,
945 {IntptrTy});
946
947 Value *DynamicAreaOffset = IRB.CreateCall(DynamicAreaOffsetFunc, {});
948
949 DynamicAreaPtr = IRB.CreateAdd(IRB.CreatePtrToInt(SavedStack, IntptrTy),
950 DynamicAreaOffset);
951 }
952
Yury Gribov781bce22015-05-28 08:03:28 +0000953 IRB.CreateCall(AsanAllocasUnpoisonFunc,
Yury Gribov6ff0a662015-12-04 09:19:14 +0000954 {IRB.CreateLoad(DynamicAllocaLayout), DynamicAreaPtr});
Yury Gribov98b18592015-05-28 07:51:49 +0000955 }
956
Yury Gribov55441bb2014-11-21 10:29:50 +0000957 // Unpoison dynamic allocas redzones.
Yury Gribov98b18592015-05-28 07:51:49 +0000958 void unpoisonDynamicAllocas() {
959 for (auto &Ret : RetVec)
960 unpoisonDynamicAllocasBeforeInst(Ret, DynamicAllocaLayout);
Yury Gribov55441bb2014-11-21 10:29:50 +0000961
Yury Gribov98b18592015-05-28 07:51:49 +0000962 for (auto &StackRestoreInst : StackRestoreVec)
963 unpoisonDynamicAllocasBeforeInst(StackRestoreInst,
964 StackRestoreInst->getOperand(0));
Yury Gribov55441bb2014-11-21 10:29:50 +0000965 }
966
Yury Gribov55441bb2014-11-21 10:29:50 +0000967 // Deploy and poison redzones around dynamic alloca call. To do this, we
968 // should replace this call with another one with changed parameters and
969 // replace all its uses with new address, so
970 // addr = alloca type, old_size, align
971 // is replaced by
972 // new_size = (old_size + additional_size) * sizeof(type)
973 // tmp = alloca i8, new_size, max(align, 32)
974 // addr = tmp + 32 (first 32 bytes are for the left redzone).
975 // Additional_size is added to make new memory allocation contain not only
976 // requested memory, but also left, partial and right redzones.
Yury Gribov98b18592015-05-28 07:51:49 +0000977 void handleDynamicAllocaCall(AllocaInst *AI);
Yury Gribov55441bb2014-11-21 10:29:50 +0000978
Adrian Prantl5f8f34e42018-05-01 15:54:18 +0000979 /// Collect Alloca instructions we want (and can) handle.
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000980 void visitAllocaInst(AllocaInst &AI) {
Kuba Brecka37a5ffa2015-07-17 06:29:57 +0000981 if (!ASan.isInterestingAlloca(AI)) {
Kuba Breckaa49dcbb2016-11-08 21:30:41 +0000982 if (AI.isStaticAlloca()) {
983 // Skip over allocas that are present *before* the first instrumented
984 // alloca, we don't want to move those around.
985 if (AllocaVec.empty())
986 return;
987
988 StaticAllocasToMoveUp.push_back(&AI);
989 }
Kuba Brecka37a5ffa2015-07-17 06:29:57 +0000990 return;
991 }
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000992
993 StackAlignment = std::max(StackAlignment, AI.getAlignment());
Kuba Brecka7d03ce42016-06-27 15:57:08 +0000994 if (!AI.isStaticAlloca())
Yury Gribov98b18592015-05-28 07:51:49 +0000995 DynamicAllocaVec.push_back(&AI);
Yury Gribov55441bb2014-11-21 10:29:50 +0000996 else
997 AllocaVec.push_back(&AI);
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000998 }
999
Adrian Prantl5f8f34e42018-05-01 15:54:18 +00001000 /// Collect lifetime intrinsic calls to check for use-after-scope
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001001 /// errors.
1002 void visitIntrinsicInst(IntrinsicInst &II) {
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001003 Intrinsic::ID ID = II.getIntrinsicID();
Yury Gribov98b18592015-05-28 07:51:49 +00001004 if (ID == Intrinsic::stackrestore) StackRestoreVec.push_back(&II);
Reid Kleckner2f907552015-07-21 17:40:14 +00001005 if (ID == Intrinsic::localescape) LocalEscapeCall = &II;
Vitaly Buka1e75fa42016-05-27 22:55:10 +00001006 if (!ASan.UseAfterScope)
1007 return;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001008 if (ID != Intrinsic::lifetime_start && ID != Intrinsic::lifetime_end)
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001009 return;
1010 // Found lifetime intrinsic, add ASan instrumentation if necessary.
1011 ConstantInt *Size = dyn_cast<ConstantInt>(II.getArgOperand(0));
1012 // If size argument is undefined, don't do anything.
1013 if (Size->isMinusOne()) return;
1014 // Check that size doesn't saturate uint64_t and can
1015 // be stored in IntptrTy.
1016 const uint64_t SizeValue = Size->getValue().getLimitedValue();
1017 if (SizeValue == ~0ULL ||
1018 !ConstantInt::isValueValidForType(IntptrTy, SizeValue))
1019 return;
1020 // Find alloca instruction that corresponds to llvm.lifetime argument.
1021 AllocaInst *AI = findAllocaForValue(II.getArgOperand(1));
Vitaly Bukab451f1b2016-06-09 23:31:59 +00001022 if (!AI || !ASan.isInterestingAlloca(*AI))
1023 return;
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001024 bool DoPoison = (ID == Intrinsic::lifetime_end);
Alexey Samsonova788b942013-11-18 14:53:55 +00001025 AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison};
Vitaly Buka5b4f1212016-08-20 17:22:27 +00001026 if (AI->isStaticAlloca())
1027 StaticAllocaPoisonCallVec.push_back(APC);
1028 else if (ClInstrumentDynamicAllocas)
1029 DynamicAllocaPoisonCallVec.push_back(APC);
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001030 }
1031
Alexey Samsonov869a5ff2015-07-29 19:36:08 +00001032 void visitCallSite(CallSite CS) {
1033 Instruction *I = CS.getInstruction();
1034 if (CallInst *CI = dyn_cast<CallInst>(I)) {
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +00001035 HasNonEmptyInlineAsm |= CI->isInlineAsm() &&
1036 !CI->isIdenticalTo(EmptyInlineAsm.get()) &&
1037 I != ASan.LocalDynamicShadow;
Alexey Samsonov869a5ff2015-07-29 19:36:08 +00001038 HasReturnsTwiceCall |= CI->canReturnTwice();
1039 }
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00001040 }
1041
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001042 // ---------------------- Helpers.
1043 void initializeCallbacks(Module &M);
1044
Yury Gribov3ae427d2014-12-01 08:47:58 +00001045 bool doesDominateAllExits(const Instruction *I) const {
1046 for (auto Ret : RetVec) {
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001047 if (!ASan.getDominatorTree().dominates(I, Ret)) return false;
Yury Gribov3ae427d2014-12-01 08:47:58 +00001048 }
1049 return true;
1050 }
1051
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001052 /// Finds alloca where the value comes from.
1053 AllocaInst *findAllocaForValue(Value *V);
Vitaly Buka793913c2016-08-29 18:17:21 +00001054
1055 // Copies bytes from ShadowBytes into shadow memory for indexes where
1056 // ShadowMask is not zero. If ShadowMask[i] is zero, we assume that
1057 // ShadowBytes[i] is constantly zero and doesn't need to be overwritten.
1058 void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes,
1059 IRBuilder<> &IRB, Value *ShadowBase);
1060 void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes,
1061 size_t Begin, size_t End, IRBuilder<> &IRB,
1062 Value *ShadowBase);
1063 void copyToShadowInline(ArrayRef<uint8_t> ShadowMask,
1064 ArrayRef<uint8_t> ShadowBytes, size_t Begin,
1065 size_t End, IRBuilder<> &IRB, Value *ShadowBase);
1066
Jakub Staszak23ec6a92013-08-09 20:53:48 +00001067 void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison);
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00001068
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00001069 Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L,
1070 bool Dynamic);
1071 PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue,
1072 Instruction *ThenTerm, Value *ValueIfFalse);
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001073};
1074
Eugene Zelenkobff0ef02017-10-19 22:07:16 +00001075} // end anonymous namespace
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001076
Leonard Chaneebecb32018-10-26 22:51:51 +00001077char AddressSanitizer::ID = 0;
Eugene Zelenkobff0ef02017-10-19 22:07:16 +00001078
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001079INITIALIZE_PASS_BEGIN(
Leonard Chaneebecb32018-10-26 22:51:51 +00001080 AddressSanitizer, "asan",
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001081 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,
1082 false)
Yury Gribov3ae427d2014-12-01 08:47:58 +00001083INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
Keno Fischera010cfa2015-10-20 10:13:55 +00001084INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001085INITIALIZE_PASS_END(
Leonard Chaneebecb32018-10-26 22:51:51 +00001086 AddressSanitizer, "asan",
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001087 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,
1088 false)
Eugene Zelenkobff0ef02017-10-19 22:07:16 +00001089
Yury Gribovd7731982015-11-11 10:36:49 +00001090FunctionPass *llvm::createAddressSanitizerFunctionPass(bool CompileKernel,
Vitaly Buka1e75fa42016-05-27 22:55:10 +00001091 bool Recover,
1092 bool UseAfterScope) {
Yury Gribovd7731982015-11-11 10:36:49 +00001093 assert(!CompileKernel || Recover);
Leonard Chaneebecb32018-10-26 22:51:51 +00001094 return new AddressSanitizer(CompileKernel, Recover, UseAfterScope);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001095}
1096
Leonard Chaneebecb32018-10-26 22:51:51 +00001097char AddressSanitizerModule::ID = 0;
Eugene Zelenkobff0ef02017-10-19 22:07:16 +00001098
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001099INITIALIZE_PASS(
Leonard Chaneebecb32018-10-26 22:51:51 +00001100 AddressSanitizerModule, "asan-module",
Kostya Serebryanydfe9e792012-11-28 10:31:36 +00001101 "AddressSanitizer: detects use-after-free and out-of-bounds bugs."
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001102 "ModulePass",
1103 false, false)
Eugene Zelenkobff0ef02017-10-19 22:07:16 +00001104
Yury Gribovd7731982015-11-11 10:36:49 +00001105ModulePass *llvm::createAddressSanitizerModulePass(bool CompileKernel,
Evgeniy Stepanov9e536082017-04-24 19:34:13 +00001106 bool Recover,
Vitaly Buka8076c572018-12-05 01:44:31 +00001107 bool UseGlobalsGC,
1108 bool UseOdrIndicator) {
Yury Gribovd7731982015-11-11 10:36:49 +00001109 assert(!CompileKernel || Recover);
Vitaly Buka8076c572018-12-05 01:44:31 +00001110 return new AddressSanitizerModule(CompileKernel, Recover, UseGlobalsGC,
1111 UseOdrIndicator);
Alexander Potapenkoc94cf8f2012-01-23 11:22:43 +00001112}
1113
Kostya Serebryanyc4ce5df2012-07-16 17:12:07 +00001114static size_t TypeSizeToSizeIndex(uint32_t TypeSize) {
Michael J. Spencerdf1ecbd72013-05-24 22:23:49 +00001115 size_t Res = countTrailingZeros(TypeSize / 8);
Kostya Serebryanyc4ce5df2012-07-16 17:12:07 +00001116 assert(Res < kNumberOfAccessSizes);
1117 return Res;
1118}
1119
Adrian Prantl5f8f34e42018-05-01 15:54:18 +00001120/// Create a global describing a source location.
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +00001121static GlobalVariable *createPrivateGlobalForSourceLoc(Module &M,
1122 LocationMetadata MD) {
1123 Constant *LocData[] = {
Kostya Serebryanyd891ac92018-10-11 23:03:27 +00001124 createPrivateGlobalForString(M, MD.Filename, true, kAsanGenPrefix),
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +00001125 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo),
1126 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo),
1127 };
1128 auto LocStruct = ConstantStruct::getAnon(LocData);
1129 auto GV = new GlobalVariable(M, LocStruct->getType(), true,
1130 GlobalValue::PrivateLinkage, LocStruct,
1131 kAsanGenPrefix);
Peter Collingbourne96efdd62016-06-14 21:01:22 +00001132 GV->setUnnamedAddr(GlobalValue::UnnamedAddr::Global);
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +00001133 return GV;
1134}
1135
Adrian Prantl5f8f34e42018-05-01 15:54:18 +00001136/// Check if \p G has been created by a trusted compiler pass.
Vedant Kumarf5ac6d42016-06-22 17:30:58 +00001137static bool GlobalWasGeneratedByCompiler(GlobalVariable *G) {
Reid Kleckner85a8c122018-08-20 23:35:45 +00001138 // Do not instrument @llvm.global_ctors, @llvm.used, etc.
1139 if (G->getName().startswith("llvm."))
1140 return true;
1141
Vedant Kumarf5ac6d42016-06-22 17:30:58 +00001142 // Do not instrument asan globals.
1143 if (G->getName().startswith(kAsanGenPrefix) ||
1144 G->getName().startswith(kSanCovGenPrefix) ||
1145 G->getName().startswith(kODRGenPrefix))
1146 return true;
1147
1148 // Do not instrument gcov counter arrays.
1149 if (G->getName() == "__llvm_gcov_ctr")
1150 return true;
1151
1152 return false;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001153}
1154
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001155Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) {
1156 // Shadow >> scale
Alexey Samsonov1345d352013-01-16 13:23:28 +00001157 Shadow = IRB.CreateLShr(Shadow, Mapping.Scale);
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001158 if (Mapping.Offset == 0) return Shadow;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001159 // (Shadow >> scale) | offset
Etienne Bergeron0ca05682016-09-30 17:46:32 +00001160 Value *ShadowBase;
1161 if (LocalDynamicShadow)
1162 ShadowBase = LocalDynamicShadow;
Etienne Bergeron6ba51762016-09-19 15:58:38 +00001163 else
Etienne Bergeron0ca05682016-09-30 17:46:32 +00001164 ShadowBase = ConstantInt::get(IntptrTy, Mapping.Offset);
1165 if (Mapping.OrShadowOffset)
1166 return IRB.CreateOr(Shadow, ShadowBase);
1167 else
1168 return IRB.CreateAdd(Shadow, ShadowBase);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001169}
1170
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001171// Instrument memset/memmove/memcpy
Kostya Serebryany94c81ca2014-04-21 11:50:42 +00001172void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) {
1173 IRBuilder<> IRB(MI);
Kostya Serebryany94c81ca2014-04-21 11:50:42 +00001174 if (isa<MemTransferInst>(MI)) {
David Blaikieff6409d2015-05-18 22:13:54 +00001175 IRB.CreateCall(
Kostya Serebryany94c81ca2014-04-21 11:50:42 +00001176 isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy,
David Blaikieff6409d2015-05-18 22:13:54 +00001177 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
1178 IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()),
1179 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
Kostya Serebryany94c81ca2014-04-21 11:50:42 +00001180 } else if (isa<MemSetInst>(MI)) {
David Blaikieff6409d2015-05-18 22:13:54 +00001181 IRB.CreateCall(
Kostya Serebryany94c81ca2014-04-21 11:50:42 +00001182 AsanMemset,
David Blaikieff6409d2015-05-18 22:13:54 +00001183 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
1184 IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false),
1185 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001186 }
Kostya Serebryany94c81ca2014-04-21 11:50:42 +00001187 MI->eraseFromParent();
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001188}
1189
Anna Zaks8ed1d812015-02-27 03:12:36 +00001190/// Check if we want (and can) handle this alloca.
Vitaly Buka21a9e572016-07-28 22:50:50 +00001191bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) {
Anna Zaksbf28d3a2015-03-27 18:52:01 +00001192 auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI);
1193
1194 if (PreviouslySeenAllocaInfo != ProcessedAllocas.end())
1195 return PreviouslySeenAllocaInfo->getSecond();
1196
Yury Gribov98b18592015-05-28 07:51:49 +00001197 bool IsInteresting =
1198 (AI.getAllocatedType()->isSized() &&
1199 // alloca() may be called with 0 size, ignore it.
Vitaly Buka21a9e572016-07-28 22:50:50 +00001200 ((!AI.isStaticAlloca()) || getAllocaSizeInBytes(AI) > 0) &&
Yury Gribov98b18592015-05-28 07:51:49 +00001201 // We are only interested in allocas not promotable to registers.
1202 // Promotable allocas are common under -O0.
Alexey Samsonov55fda1b2015-11-05 21:18:41 +00001203 (!ClSkipPromotableAllocas || !isAllocaPromotable(&AI)) &&
1204 // inalloca allocas are not treated as static, and we don't want
1205 // dynamic alloca instrumentation for them as well.
Arnold Schwaighofer8d61e002017-02-15 20:43:43 +00001206 !AI.isUsedWithInAlloca() &&
1207 // swifterror allocas are register promoted by ISel
1208 !AI.isSwiftError());
Anna Zaksbf28d3a2015-03-27 18:52:01 +00001209
1210 ProcessedAllocas[&AI] = IsInteresting;
1211 return IsInteresting;
Anna Zaks8ed1d812015-02-27 03:12:36 +00001212}
1213
Anna Zaks8ed1d812015-02-27 03:12:36 +00001214Value *AddressSanitizer::isInterestingMemoryAccess(Instruction *I,
1215 bool *IsWrite,
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001216 uint64_t *TypeSize,
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001217 unsigned *Alignment,
1218 Value **MaybeMask) {
Alexey Samsonov535b6f92014-07-17 18:48:12 +00001219 // Skip memory accesses inserted by another instrumentation.
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001220 if (I->getMetadata("nosanitize")) return nullptr;
Anna Zaks8ed1d812015-02-27 03:12:36 +00001221
Etienne Bergeron0ca05682016-09-30 17:46:32 +00001222 // Do not instrument the load fetching the dynamic shadow address.
1223 if (LocalDynamicShadow == I)
1224 return nullptr;
1225
Anna Zaks8ed1d812015-02-27 03:12:36 +00001226 Value *PtrOperand = nullptr;
Mehdi Aminia28d91d2015-03-10 02:37:25 +00001227 const DataLayout &DL = I->getModule()->getDataLayout();
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001228 if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
Craig Topperf40110f2014-04-25 05:29:35 +00001229 if (!ClInstrumentReads) return nullptr;
Kostya Serebryany90241602012-05-30 09:04:06 +00001230 *IsWrite = false;
Mehdi Aminia28d91d2015-03-10 02:37:25 +00001231 *TypeSize = DL.getTypeStoreSizeInBits(LI->getType());
Kostya Serebryanyc7895a82014-05-23 11:52:07 +00001232 *Alignment = LI->getAlignment();
Anna Zaks8ed1d812015-02-27 03:12:36 +00001233 PtrOperand = LI->getPointerOperand();
1234 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
Craig Topperf40110f2014-04-25 05:29:35 +00001235 if (!ClInstrumentWrites) return nullptr;
Kostya Serebryany90241602012-05-30 09:04:06 +00001236 *IsWrite = true;
Mehdi Aminia28d91d2015-03-10 02:37:25 +00001237 *TypeSize = DL.getTypeStoreSizeInBits(SI->getValueOperand()->getType());
Kostya Serebryanyc7895a82014-05-23 11:52:07 +00001238 *Alignment = SI->getAlignment();
Anna Zaks8ed1d812015-02-27 03:12:36 +00001239 PtrOperand = SI->getPointerOperand();
1240 } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) {
Craig Topperf40110f2014-04-25 05:29:35 +00001241 if (!ClInstrumentAtomics) return nullptr;
Kostya Serebryany90241602012-05-30 09:04:06 +00001242 *IsWrite = true;
Mehdi Aminia28d91d2015-03-10 02:37:25 +00001243 *TypeSize = DL.getTypeStoreSizeInBits(RMW->getValOperand()->getType());
Kostya Serebryanyc7895a82014-05-23 11:52:07 +00001244 *Alignment = 0;
Anna Zaks8ed1d812015-02-27 03:12:36 +00001245 PtrOperand = RMW->getPointerOperand();
1246 } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) {
Craig Topperf40110f2014-04-25 05:29:35 +00001247 if (!ClInstrumentAtomics) return nullptr;
Kostya Serebryany90241602012-05-30 09:04:06 +00001248 *IsWrite = true;
Mehdi Aminia28d91d2015-03-10 02:37:25 +00001249 *TypeSize = DL.getTypeStoreSizeInBits(XCHG->getCompareOperand()->getType());
Kostya Serebryanyc7895a82014-05-23 11:52:07 +00001250 *Alignment = 0;
Anna Zaks8ed1d812015-02-27 03:12:36 +00001251 PtrOperand = XCHG->getPointerOperand();
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001252 } else if (auto CI = dyn_cast<CallInst>(I)) {
1253 auto *F = dyn_cast<Function>(CI->getCalledValue());
1254 if (F && (F->getName().startswith("llvm.masked.load.") ||
1255 F->getName().startswith("llvm.masked.store."))) {
1256 unsigned OpOffset = 0;
1257 if (F->getName().startswith("llvm.masked.store.")) {
Filipe Cabecinhas1e690172016-12-14 21:56:59 +00001258 if (!ClInstrumentWrites)
1259 return nullptr;
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001260 // Masked store has an initial operand for the value.
1261 OpOffset = 1;
1262 *IsWrite = true;
1263 } else {
Filipe Cabecinhas1e690172016-12-14 21:56:59 +00001264 if (!ClInstrumentReads)
1265 return nullptr;
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001266 *IsWrite = false;
1267 }
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001268
1269 auto BasePtr = CI->getOperand(0 + OpOffset);
1270 auto Ty = cast<PointerType>(BasePtr->getType())->getElementType();
1271 *TypeSize = DL.getTypeStoreSizeInBits(Ty);
1272 if (auto AlignmentConstant =
1273 dyn_cast<ConstantInt>(CI->getOperand(1 + OpOffset)))
1274 *Alignment = (unsigned)AlignmentConstant->getZExtValue();
1275 else
1276 *Alignment = 1; // No alignment guarantees. We probably got Undef
1277 if (MaybeMask)
1278 *MaybeMask = CI->getOperand(2 + OpOffset);
1279 PtrOperand = BasePtr;
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001280 }
Kostya Serebryany90241602012-05-30 09:04:06 +00001281 }
Anna Zaks8ed1d812015-02-27 03:12:36 +00001282
Anna Zaks644d9d32016-06-22 00:15:52 +00001283 if (PtrOperand) {
Arnold Schwaighofer8d61e002017-02-15 20:43:43 +00001284 // Do not instrument acesses from different address spaces; we cannot deal
1285 // with them.
Anna Zaks644d9d32016-06-22 00:15:52 +00001286 Type *PtrTy = cast<PointerType>(PtrOperand->getType()->getScalarType());
1287 if (PtrTy->getPointerAddressSpace() != 0)
1288 return nullptr;
Arnold Schwaighofer8d61e002017-02-15 20:43:43 +00001289
1290 // Ignore swifterror addresses.
1291 // swifterror memory addresses are mem2reg promoted by instruction
1292 // selection. As such they cannot have regular uses like an instrumentation
1293 // function and it makes no sense to track them as memory.
1294 if (PtrOperand->isSwiftError())
1295 return nullptr;
Anna Zaks644d9d32016-06-22 00:15:52 +00001296 }
1297
Anna Zaks8ed1d812015-02-27 03:12:36 +00001298 // Treat memory accesses to promotable allocas as non-interesting since they
1299 // will not cause memory violations. This greatly speeds up the instrumented
1300 // executable at -O0.
1301 if (ClSkipPromotableAllocas)
1302 if (auto AI = dyn_cast_or_null<AllocaInst>(PtrOperand))
1303 return isInterestingAlloca(*AI) ? AI : nullptr;
1304
1305 return PtrOperand;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001306}
1307
Kostya Serebryany796f6552014-02-27 12:45:36 +00001308static bool isPointerOperand(Value *V) {
1309 return V->getType()->isPointerTy() || isa<PtrToIntInst>(V);
1310}
1311
1312// This is a rough heuristic; it may cause both false positives and
1313// false negatives. The proper implementation requires cooperation with
1314// the frontend.
1315static bool isInterestingPointerComparisonOrSubtraction(Instruction *I) {
1316 if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) {
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001317 if (!Cmp->isRelational()) return false;
Kostya Serebryany796f6552014-02-27 12:45:36 +00001318 } else if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) {
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001319 if (BO->getOpcode() != Instruction::Sub) return false;
Kostya Serebryany796f6552014-02-27 12:45:36 +00001320 } else {
1321 return false;
1322 }
Alexey Samsonov145b0fd2015-10-26 18:06:40 +00001323 return isPointerOperand(I->getOperand(0)) &&
1324 isPointerOperand(I->getOperand(1));
Kostya Serebryany796f6552014-02-27 12:45:36 +00001325}
1326
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +00001327bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) {
1328 // If a global variable does not have dynamic initialization we don't
1329 // have to instrument it. However, if a global does not have initializer
1330 // at all, we assume it has dynamic initializer (in other TU).
Alexey Samsonov08f022a2014-07-11 22:36:02 +00001331 return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit;
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +00001332}
1333
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001334void AddressSanitizer::instrumentPointerComparisonOrSubtraction(
1335 Instruction *I) {
Kostya Serebryany796f6552014-02-27 12:45:36 +00001336 IRBuilder<> IRB(I);
1337 Function *F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction;
1338 Value *Param[2] = {I->getOperand(0), I->getOperand(1)};
Benjamin Kramer135f7352016-06-26 12:28:59 +00001339 for (Value *&i : Param) {
1340 if (i->getType()->isPointerTy())
1341 i = IRB.CreatePointerCast(i, IntptrTy);
Kostya Serebryany796f6552014-02-27 12:45:36 +00001342 }
David Blaikieff6409d2015-05-18 22:13:54 +00001343 IRB.CreateCall(F, Param);
Kostya Serebryany796f6552014-02-27 12:45:36 +00001344}
1345
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001346static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I,
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001347 Instruction *InsertBefore, Value *Addr,
1348 unsigned Alignment, unsigned Granularity,
1349 uint32_t TypeSize, bool IsWrite,
1350 Value *SizeArgument, bool UseCalls,
1351 uint32_t Exp) {
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001352 // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check
1353 // if the data is properly aligned.
1354 if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 ||
1355 TypeSize == 128) &&
1356 (Alignment >= Granularity || Alignment == 0 || Alignment >= TypeSize / 8))
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001357 return Pass->instrumentAddress(I, InsertBefore, Addr, TypeSize, IsWrite,
1358 nullptr, UseCalls, Exp);
1359 Pass->instrumentUnusualSizeOrAlignment(I, InsertBefore, Addr, TypeSize,
1360 IsWrite, nullptr, UseCalls, Exp);
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001361}
1362
1363static void instrumentMaskedLoadOrStore(AddressSanitizer *Pass,
1364 const DataLayout &DL, Type *IntptrTy,
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001365 Value *Mask, Instruction *I,
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001366 Value *Addr, unsigned Alignment,
1367 unsigned Granularity, uint32_t TypeSize,
1368 bool IsWrite, Value *SizeArgument,
1369 bool UseCalls, uint32_t Exp) {
1370 auto *VTy = cast<PointerType>(Addr->getType())->getElementType();
1371 uint64_t ElemTypeSize = DL.getTypeStoreSizeInBits(VTy->getScalarType());
1372 unsigned Num = VTy->getVectorNumElements();
1373 auto Zero = ConstantInt::get(IntptrTy, 0);
1374 for (unsigned Idx = 0; Idx < Num; ++Idx) {
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001375 Value *InstrumentedAddress = nullptr;
1376 Instruction *InsertBefore = I;
1377 if (auto *Vector = dyn_cast<ConstantVector>(Mask)) {
1378 // dyn_cast as we might get UndefValue
1379 if (auto *Masked = dyn_cast<ConstantInt>(Vector->getOperand(Idx))) {
Craig Topper79ab6432017-07-06 18:39:47 +00001380 if (Masked->isZero())
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001381 // Mask is constant false, so no instrumentation needed.
1382 continue;
1383 // If we have a true or undef value, fall through to doInstrumentAddress
1384 // with InsertBefore == I
1385 }
1386 } else {
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001387 IRBuilder<> IRB(I);
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001388 Value *MaskElem = IRB.CreateExtractElement(Mask, Idx);
Chandler Carruth4a2d58e2018-10-15 09:34:05 +00001389 Instruction *ThenTerm = SplitBlockAndInsertIfThen(MaskElem, I, false);
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001390 InsertBefore = ThenTerm;
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001391 }
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001392
1393 IRBuilder<> IRB(InsertBefore);
1394 InstrumentedAddress =
1395 IRB.CreateGEP(Addr, {Zero, ConstantInt::get(IntptrTy, Idx)});
1396 doInstrumentAddress(Pass, I, InsertBefore, InstrumentedAddress, Alignment,
1397 Granularity, ElemTypeSize, IsWrite, SizeArgument,
1398 UseCalls, Exp);
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001399 }
1400}
1401
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001402void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
Mehdi Aminia28d91d2015-03-10 02:37:25 +00001403 Instruction *I, bool UseCalls,
1404 const DataLayout &DL) {
Axel Naumann4a127062012-09-17 14:20:57 +00001405 bool IsWrite = false;
Kostya Serebryanyc7895a82014-05-23 11:52:07 +00001406 unsigned Alignment = 0;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001407 uint64_t TypeSize = 0;
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001408 Value *MaybeMask = nullptr;
1409 Value *Addr =
1410 isInterestingMemoryAccess(I, &IsWrite, &TypeSize, &Alignment, &MaybeMask);
Kostya Serebryany90241602012-05-30 09:04:06 +00001411 assert(Addr);
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001412
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001413 // Optimization experiments.
1414 // The experiments can be used to evaluate potential optimizations that remove
1415 // instrumentation (assess false negatives). Instead of completely removing
1416 // some instrumentation, you set Exp to a non-zero value (mask of optimization
1417 // experiments that want to remove instrumentation of this instruction).
1418 // If Exp is non-zero, this pass will emit special calls into runtime
1419 // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls
1420 // make runtime terminate the program in a special way (with a different
1421 // exit status). Then you run the new compiler on a buggy corpus, collect
1422 // the special terminations (ideally, you don't see them at all -- no false
1423 // negatives) and make the decision on the optimization.
1424 uint32_t Exp = ClForceExperiment;
1425
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001426 if (ClOpt && ClOptGlobals) {
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001427 // If initialization order checking is disabled, a simple access to a
1428 // dynamically initialized global is always valid.
Mehdi Aminia28d91d2015-03-10 02:37:25 +00001429 GlobalVariable *G = dyn_cast<GlobalVariable>(GetUnderlyingObject(Addr, DL));
Hans Wennborg083ca9b2015-10-06 23:24:35 +00001430 if (G && (!ClInitializers || GlobalIsLinkerInitialized(G)) &&
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001431 isSafeAccess(ObjSizeVis, Addr, TypeSize)) {
1432 NumOptimizedAccessesToGlobalVar++;
1433 return;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001434 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001435 }
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001436
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001437 if (ClOpt && ClOptStack) {
1438 // A direct inbounds access to a stack variable is always valid.
Mehdi Aminia28d91d2015-03-10 02:37:25 +00001439 if (isa<AllocaInst>(GetUnderlyingObject(Addr, DL)) &&
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001440 isSafeAccess(ObjSizeVis, Addr, TypeSize)) {
1441 NumOptimizedAccessesToStackVar++;
1442 return;
1443 }
1444 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001445
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +00001446 if (IsWrite)
1447 NumInstrumentedWrites++;
1448 else
1449 NumInstrumentedReads++;
1450
Kostya Serebryanyc7895a82014-05-23 11:52:07 +00001451 unsigned Granularity = 1 << Mapping.Scale;
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001452 if (MaybeMask) {
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001453 instrumentMaskedLoadOrStore(this, DL, IntptrTy, MaybeMask, I, Addr,
1454 Alignment, Granularity, TypeSize, IsWrite,
1455 nullptr, UseCalls, Exp);
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001456 } else {
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001457 doInstrumentAddress(this, I, I, Addr, Alignment, Granularity, TypeSize,
Filipe Cabecinhasec350b72016-11-15 22:37:30 +00001458 IsWrite, nullptr, UseCalls, Exp);
1459 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001460}
1461
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001462Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore,
1463 Value *Addr, bool IsWrite,
1464 size_t AccessSizeIndex,
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001465 Value *SizeArgument,
1466 uint32_t Exp) {
Kostya Serebryanyfda7a132012-08-14 14:04:51 +00001467 IRBuilder<> IRB(InsertBefore);
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001468 Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp);
1469 CallInst *Call = nullptr;
1470 if (SizeArgument) {
1471 if (Exp == 0)
David Blaikieff6409d2015-05-18 22:13:54 +00001472 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0],
1473 {Addr, SizeArgument});
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001474 else
David Blaikieff6409d2015-05-18 22:13:54 +00001475 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1],
1476 {Addr, SizeArgument, ExpVal});
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001477 } else {
1478 if (Exp == 0)
1479 Call =
1480 IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr);
1481 else
David Blaikieff6409d2015-05-18 22:13:54 +00001482 Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex],
1483 {Addr, ExpVal});
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001484 }
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +00001485
Kostya Serebryanyf02c6062012-07-20 09:54:50 +00001486 // We don't do Call->setDoesNotReturn() because the BB already has
1487 // UnreachableInst at the end.
1488 // This EmptyAsm is required to avoid callback merge.
David Blaikieff6409d2015-05-18 22:13:54 +00001489 IRB.CreateCall(EmptyAsm, {});
Kostya Serebryany3411f2e2012-01-06 18:09:21 +00001490 return Call;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001491}
1492
Kostya Serebryanyc4ce5df2012-07-16 17:12:07 +00001493Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001494 Value *ShadowValue,
1495 uint32_t TypeSize) {
Aaron Ballmanef0fe1e2016-03-30 21:30:00 +00001496 size_t Granularity = static_cast<size_t>(1) << Mapping.Scale;
Kostya Serebryany874dae62012-07-16 16:15:40 +00001497 // Addr & (Granularity - 1)
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001498 Value *LastAccessedByte =
1499 IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1));
Kostya Serebryany874dae62012-07-16 16:15:40 +00001500 // (Addr & (Granularity - 1)) + size - 1
1501 if (TypeSize / 8 > 1)
1502 LastAccessedByte = IRB.CreateAdd(
1503 LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1));
1504 // (uint8_t) ((Addr & (Granularity-1)) + size - 1)
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001505 LastAccessedByte =
1506 IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false);
Kostya Serebryany874dae62012-07-16 16:15:40 +00001507 // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue
1508 return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue);
1509}
1510
Kostya Serebryanyb0e25062012-10-15 14:20:06 +00001511void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
Kostya Serebryany0c02d262014-04-16 12:12:19 +00001512 Instruction *InsertBefore, Value *Addr,
1513 uint32_t TypeSize, bool IsWrite,
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001514 Value *SizeArgument, bool UseCalls,
1515 uint32_t Exp) {
Walter Leecdbb2072018-05-18 04:10:38 +00001516 bool IsMyriad = TargetTriple.getVendor() == llvm::Triple::Myriad;
1517
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +00001518 IRBuilder<> IRB(InsertBefore);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001519 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
Kostya Serebryany0c02d262014-04-16 12:12:19 +00001520 size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize);
1521
1522 if (UseCalls) {
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001523 if (Exp == 0)
1524 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex],
1525 AddrLong);
1526 else
David Blaikieff6409d2015-05-18 22:13:54 +00001527 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex],
1528 {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)});
Kostya Serebryany0c02d262014-04-16 12:12:19 +00001529 return;
1530 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001531
Walter Leecdbb2072018-05-18 04:10:38 +00001532 if (IsMyriad) {
1533 // Strip the cache bit and do range check.
1534 // AddrLong &= ~kMyriadCacheBitMask32
1535 AddrLong = IRB.CreateAnd(AddrLong, ~kMyriadCacheBitMask32);
1536 // Tag = AddrLong >> kMyriadTagShift
1537 Value *Tag = IRB.CreateLShr(AddrLong, kMyriadTagShift);
1538 // Tag == kMyriadDDRTag
1539 Value *TagCheck =
1540 IRB.CreateICmpEQ(Tag, ConstantInt::get(IntptrTy, kMyriadDDRTag));
1541
Chandler Carruth4a2d58e2018-10-15 09:34:05 +00001542 Instruction *TagCheckTerm =
1543 SplitBlockAndInsertIfThen(TagCheck, InsertBefore, false,
1544 MDBuilder(*C).createBranchWeights(1, 100000));
Walter Leecdbb2072018-05-18 04:10:38 +00001545 assert(cast<BranchInst>(TagCheckTerm)->isUnconditional());
1546 IRB.SetInsertPoint(TagCheckTerm);
1547 InsertBefore = TagCheckTerm;
1548 }
1549
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001550 Type *ShadowTy =
1551 IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001552 Type *ShadowPtrTy = PointerType::get(ShadowTy, 0);
1553 Value *ShadowPtr = memToShadow(AddrLong, IRB);
1554 Value *CmpVal = Constant::getNullValue(ShadowTy);
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001555 Value *ShadowValue =
1556 IRB.CreateLoad(IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001557
1558 Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal);
Aaron Ballmanef0fe1e2016-03-30 21:30:00 +00001559 size_t Granularity = 1ULL << Mapping.Scale;
Chandler Carruth4a2d58e2018-10-15 09:34:05 +00001560 Instruction *CrashTerm = nullptr;
Kostya Serebryanyfda7a132012-08-14 14:04:51 +00001561
Kostya Serebryany1e575ab2012-08-15 08:58:58 +00001562 if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) {
Kostya Serebryanyad238522014-09-02 21:46:51 +00001563 // We use branch weights for the slow path check, to indicate that the slow
1564 // path is rarely taken. This seems to be the case for SPEC benchmarks.
Chandler Carruth4a2d58e2018-10-15 09:34:05 +00001565 Instruction *CheckTerm = SplitBlockAndInsertIfThen(
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001566 Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000));
Benjamin Kramer619c4e52015-04-10 11:24:51 +00001567 assert(cast<BranchInst>(CheckTerm)->isUnconditional());
Kostya Serebryanyf02c6062012-07-20 09:54:50 +00001568 BasicBlock *NextBB = CheckTerm->getSuccessor(0);
Kostya Serebryany874dae62012-07-16 16:15:40 +00001569 IRB.SetInsertPoint(CheckTerm);
1570 Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize);
Yury Gribovd7731982015-11-11 10:36:49 +00001571 if (Recover) {
1572 CrashTerm = SplitBlockAndInsertIfThen(Cmp2, CheckTerm, false);
1573 } else {
1574 BasicBlock *CrashBlock =
Kostya Serebryanyb0e25062012-10-15 14:20:06 +00001575 BasicBlock::Create(*C, "", NextBB->getParent(), NextBB);
Yury Gribovd7731982015-11-11 10:36:49 +00001576 CrashTerm = new UnreachableInst(*C, CrashBlock);
1577 BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2);
1578 ReplaceInstWithInst(CheckTerm, NewTerm);
1579 }
Kostya Serebryany874dae62012-07-16 16:15:40 +00001580 } else {
Yury Gribovd7731982015-11-11 10:36:49 +00001581 CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001582 }
Kostya Serebryanyfda7a132012-08-14 14:04:51 +00001583
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001584 Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite,
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001585 AccessSizeIndex, SizeArgument, Exp);
Kostya Serebryanyfda7a132012-08-14 14:04:51 +00001586 Crash->setDebugLoc(OrigIns->getDebugLoc());
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001587}
1588
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001589// Instrument unusual size or unusual alignment.
1590// We can not do it with a single check, so we do 1-byte check for the first
1591// and the last bytes. We call __asan_report_*_n(addr, real_size) to be able
1592// to report the actual access size.
1593void AddressSanitizer::instrumentUnusualSizeOrAlignment(
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001594 Instruction *I, Instruction *InsertBefore, Value *Addr, uint32_t TypeSize,
1595 bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp) {
1596 IRBuilder<> IRB(InsertBefore);
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001597 Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8);
1598 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
1599 if (UseCalls) {
1600 if (Exp == 0)
David Blaikieff6409d2015-05-18 22:13:54 +00001601 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0],
1602 {AddrLong, Size});
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001603 else
David Blaikieff6409d2015-05-18 22:13:54 +00001604 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1],
1605 {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)});
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001606 } else {
1607 Value *LastByte = IRB.CreateIntToPtr(
1608 IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)),
1609 Addr->getType());
Filipe Cabecinhas4647b742017-01-06 15:24:51 +00001610 instrumentAddress(I, InsertBefore, Addr, 8, IsWrite, Size, false, Exp);
1611 instrumentAddress(I, InsertBefore, LastByte, 8, IsWrite, Size, false, Exp);
Dmitry Vyukov618d5802015-03-17 16:59:19 +00001612 }
1613}
1614
Alexey Samsonov96e239f2014-05-29 00:51:15 +00001615void AddressSanitizerModule::poisonOneInitializer(Function &GlobalInit,
1616 GlobalValue *ModuleName) {
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001617 // Set up the arguments to our poison/unpoison functions.
Duncan P. N. Exon Smithe82c2862015-10-13 17:39:10 +00001618 IRBuilder<> IRB(&GlobalInit.front(),
1619 GlobalInit.front().getFirstInsertionPt());
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001620
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001621 // Add a call to poison all external globals before the given function starts.
Alexey Samsonove1e26bf2013-03-26 13:05:41 +00001622 Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy);
1623 IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr);
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001624
1625 // Add calls to unpoison all globals before each return instruction.
Alexey Samsonov96e239f2014-05-29 00:51:15 +00001626 for (auto &BB : GlobalInit.getBasicBlockList())
1627 if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator()))
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001628 CallInst::Create(AsanUnpoisonGlobals, "", RI);
Alexey Samsonov96e239f2014-05-29 00:51:15 +00001629}
1630
1631void AddressSanitizerModule::createInitializerPoisonCalls(
1632 Module &M, GlobalValue *ModuleName) {
1633 GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors");
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +00001634 if (!GV)
1635 return;
Alexey Samsonov96e239f2014-05-29 00:51:15 +00001636
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +00001637 ConstantArray *CA = dyn_cast<ConstantArray>(GV->getInitializer());
1638 if (!CA)
1639 return;
1640
Alexey Samsonov96e239f2014-05-29 00:51:15 +00001641 for (Use &OP : CA->operands()) {
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001642 if (isa<ConstantAggregateZero>(OP)) continue;
Alexey Samsonov96e239f2014-05-29 00:51:15 +00001643 ConstantStruct *CS = cast<ConstantStruct>(OP);
1644
1645 // Must have a function or null ptr.
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001646 if (Function *F = dyn_cast<Function>(CS->getOperand(1))) {
Kostya Serebryany34ddf872014-09-24 22:41:55 +00001647 if (F->getName() == kAsanModuleCtorName) continue;
1648 ConstantInt *Priority = dyn_cast<ConstantInt>(CS->getOperand(0));
1649 // Don't instrument CTORs that will run before asan.module_ctor.
1650 if (Priority->getLimitedValue() <= kAsanCtorAndDtorPriority) continue;
1651 poisonOneInitializer(*F, ModuleName);
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001652 }
1653 }
1654}
1655
Kostya Serebryanydfe9e792012-11-28 10:31:36 +00001656bool AddressSanitizerModule::ShouldInstrumentGlobal(GlobalVariable *G) {
Manuel Jacob5f6eaac2016-01-16 20:30:46 +00001657 Type *Ty = G->getValueType();
Nicola Zaghend34e60c2018-05-14 12:53:11 +00001658 LLVM_DEBUG(dbgs() << "GLOBAL: " << *G << "\n");
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001659
Alexey Samsonov08f022a2014-07-11 22:36:02 +00001660 if (GlobalsMD.get(G).IsBlacklisted) return false;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001661 if (!Ty->isSized()) return false;
1662 if (!G->hasInitializer()) return false;
Vedant Kumarf5ac6d42016-06-22 17:30:58 +00001663 if (GlobalWasGeneratedByCompiler(G)) return false; // Our own globals.
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001664 // Two problems with thread-locals:
1665 // - The address of the main thread's copy can't be computed at link-time.
1666 // - Need to poison all copies, not just the main thread's one.
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001667 if (G->isThreadLocal()) return false;
Kostya Serebryany4fb78012013-12-06 09:00:17 +00001668 // For now, just ignore this Global if the alignment is large.
1669 if (G->getAlignment() > MinRedzoneSizeForGlobal()) return false;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001670
Reid Kleckner85a8c122018-08-20 23:35:45 +00001671 // For non-COFF targets, only instrument globals known to be defined by this
1672 // TU.
1673 // FIXME: We can instrument comdat globals on ELF if we are using the
1674 // GC-friendly metadata scheme.
1675 if (!TargetTriple.isOSBinFormatCOFF()) {
1676 if (!G->hasExactDefinition() || G->hasComdat())
1677 return false;
1678 } else {
1679 // On COFF, don't instrument non-ODR linkages.
1680 if (G->isInterposable())
1681 return false;
1682 }
1683
1684 // If a comdat is present, it must have a selection kind that implies ODR
1685 // semantics: no duplicates, any, or exact match.
1686 if (Comdat *C = G->getComdat()) {
1687 switch (C->getSelectionKind()) {
1688 case Comdat::Any:
1689 case Comdat::ExactMatch:
1690 case Comdat::NoDuplicates:
1691 break;
1692 case Comdat::Largest:
1693 case Comdat::SameSize:
1694 return false;
1695 }
1696 }
1697
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001698 if (G->hasSection()) {
Rafael Espindola83658d62016-05-11 18:21:59 +00001699 StringRef Section = G->getSection();
Kuba Brecka086e34b2014-12-05 21:32:46 +00001700
Anna Zaks11904602015-06-09 00:58:08 +00001701 // Globals from llvm.metadata aren't emitted, do not instrument them.
1702 if (Section == "llvm.metadata") return false;
Anna Zaks785c0752015-06-25 23:35:48 +00001703 // Do not instrument globals from special LLVM sections.
Anna Zaks40148f12016-02-24 22:12:18 +00001704 if (Section.find("__llvm") != StringRef::npos || Section.find("__LLVM") != StringRef::npos) return false;
Anna Zaks11904602015-06-09 00:58:08 +00001705
Alexey Samsonovc1603b62015-09-15 23:05:48 +00001706 // Do not instrument function pointers to initialization and termination
1707 // routines: dynamic linker will not properly handle redzones.
1708 if (Section.startswith(".preinit_array") ||
1709 Section.startswith(".init_array") ||
1710 Section.startswith(".fini_array")) {
1711 return false;
1712 }
1713
Reid Kleckner12395b72018-06-13 20:47:21 +00001714 // On COFF, if the section name contains '$', it is highly likely that the
1715 // user is using section sorting to create an array of globals similar to
1716 // the way initialization callbacks are registered in .init_array and
1717 // .CRT$XCU. The ATL also registers things in .ATL$__[azm]. Adding redzones
1718 // to such globals is counterproductive, because the intent is that they
1719 // will form an array, and out-of-bounds accesses are expected.
Hans Wennborg08b34a02017-11-13 23:47:58 +00001720 // See https://github.com/google/sanitizers/issues/305
Anna Zaks11904602015-06-09 00:58:08 +00001721 // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx
Reid Kleckner12395b72018-06-13 20:47:21 +00001722 if (TargetTriple.isOSBinFormatCOFF() && Section.contains('$')) {
1723 LLVM_DEBUG(dbgs() << "Ignoring global in sorted section (contains '$'): "
1724 << *G << "\n");
Anna Zaks11904602015-06-09 00:58:08 +00001725 return false;
1726 }
1727
Kuba Brecka1001bb52014-12-05 22:19:18 +00001728 if (TargetTriple.isOSBinFormatMachO()) {
1729 StringRef ParsedSegment, ParsedSection;
1730 unsigned TAA = 0, StubSize = 0;
1731 bool TAAParsed;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00001732 std::string ErrorCode = MCSectionMachO::ParseSectionSpecifier(
1733 Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize);
Davide Italianoc807f482015-11-19 21:50:08 +00001734 assert(ErrorCode.empty() && "Invalid section specifier.");
Kuba Brecka1001bb52014-12-05 22:19:18 +00001735
1736 // Ignore the globals from the __OBJC section. The ObjC runtime assumes
1737 // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to
1738 // them.
1739 if (ParsedSegment == "__OBJC" ||
1740 (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) {
Nicola Zaghend34e60c2018-05-14 12:53:11 +00001741 LLVM_DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n");
Kuba Brecka1001bb52014-12-05 22:19:18 +00001742 return false;
1743 }
Hans Wennborg08b34a02017-11-13 23:47:58 +00001744 // See https://github.com/google/sanitizers/issues/32
Kuba Brecka1001bb52014-12-05 22:19:18 +00001745 // Constant CFString instances are compiled in the following way:
1746 // -- the string buffer is emitted into
1747 // __TEXT,__cstring,cstring_literals
1748 // -- the constant NSConstantString structure referencing that buffer
1749 // is placed into __DATA,__cfstring
1750 // Therefore there's no point in placing redzones into __DATA,__cfstring.
1751 // Moreover, it causes the linker to crash on OS X 10.7
1752 if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") {
Nicola Zaghend34e60c2018-05-14 12:53:11 +00001753 LLVM_DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n");
Kuba Brecka1001bb52014-12-05 22:19:18 +00001754 return false;
1755 }
1756 // The linker merges the contents of cstring_literals and removes the
1757 // trailing zeroes.
1758 if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) {
Nicola Zaghend34e60c2018-05-14 12:53:11 +00001759 LLVM_DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n");
Kuba Brecka1001bb52014-12-05 22:19:18 +00001760 return false;
1761 }
1762 }
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001763 }
1764
1765 return true;
1766}
1767
Ryan Govostes653f9d02016-03-28 20:28:57 +00001768// On Mach-O platforms, we emit global metadata in a separate section of the
1769// binary in order to allow the linker to properly dead strip. This is only
1770// supported on recent versions of ld64.
1771bool AddressSanitizerModule::ShouldUseMachOGlobalsSection() const {
1772 if (!TargetTriple.isOSBinFormatMachO())
1773 return false;
1774
1775 if (TargetTriple.isMacOSX() && !TargetTriple.isMacOSXVersionLT(10, 11))
1776 return true;
1777 if (TargetTriple.isiOS() /* or tvOS */ && !TargetTriple.isOSVersionLT(9))
Mike Aizatsky243b71f2016-04-21 22:00:13 +00001778 return true;
Ryan Govostes653f9d02016-03-28 20:28:57 +00001779 if (TargetTriple.isWatchOS() && !TargetTriple.isOSVersionLT(2))
1780 return true;
1781
1782 return false;
1783}
1784
Reid Kleckner01660a32016-11-21 20:40:37 +00001785StringRef AddressSanitizerModule::getGlobalMetadataSection() const {
1786 switch (TargetTriple.getObjectFormat()) {
1787 case Triple::COFF: return ".ASAN$GL";
1788 case Triple::ELF: return "asan_globals";
1789 case Triple::MachO: return "__DATA,__asan_globals,regular";
1790 default: break;
1791 }
1792 llvm_unreachable("unsupported object format");
1793}
1794
Alexey Samsonov788381b2012-12-25 12:28:20 +00001795void AddressSanitizerModule::initializeCallbacks(Module &M) {
1796 IRBuilder<> IRB(*C);
Ryan Govostes653f9d02016-03-28 20:28:57 +00001797
Alexey Samsonov788381b2012-12-25 12:28:20 +00001798 // Declare our poisoning and unpoisoning functions.
Mehdi Aminidb11fdf2017-04-06 20:23:57 +00001799 AsanPoisonGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00001800 kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy));
Alexey Samsonov788381b2012-12-25 12:28:20 +00001801 AsanPoisonGlobals->setLinkage(Function::ExternalLinkage);
Mehdi Aminidb11fdf2017-04-06 20:23:57 +00001802 AsanUnpoisonGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00001803 kAsanUnpoisonGlobalsName, IRB.getVoidTy()));
Alexey Samsonov788381b2012-12-25 12:28:20 +00001804 AsanUnpoisonGlobals->setLinkage(Function::ExternalLinkage);
Ryan Govostes653f9d02016-03-28 20:28:57 +00001805
Alexey Samsonov788381b2012-12-25 12:28:20 +00001806 // Declare functions that register/unregister globals.
Ismail Pazarbasi198d6d52015-04-06 21:09:08 +00001807 AsanRegisterGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00001808 kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy));
Alexey Samsonov788381b2012-12-25 12:28:20 +00001809 AsanRegisterGlobals->setLinkage(Function::ExternalLinkage);
Mehdi Aminidb11fdf2017-04-06 20:23:57 +00001810 AsanUnregisterGlobals = checkSanitizerInterfaceFunction(
1811 M.getOrInsertFunction(kAsanUnregisterGlobalsName, IRB.getVoidTy(),
Serge Guelton59a2d7b2017-04-11 15:01:18 +00001812 IntptrTy, IntptrTy));
Alexey Samsonov788381b2012-12-25 12:28:20 +00001813 AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage);
Ryan Govostes653f9d02016-03-28 20:28:57 +00001814
1815 // Declare the functions that find globals in a shared object and then invoke
1816 // the (un)register function on them.
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001817 AsanRegisterImageGlobals =
1818 checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00001819 kAsanRegisterImageGlobalsName, IRB.getVoidTy(), IntptrTy));
Ryan Govostes653f9d02016-03-28 20:28:57 +00001820 AsanRegisterImageGlobals->setLinkage(Function::ExternalLinkage);
Mike Aizatsky243b71f2016-04-21 22:00:13 +00001821
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001822 AsanUnregisterImageGlobals =
1823 checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00001824 kAsanUnregisterImageGlobalsName, IRB.getVoidTy(), IntptrTy));
Ryan Govostes653f9d02016-03-28 20:28:57 +00001825 AsanUnregisterImageGlobals->setLinkage(Function::ExternalLinkage);
Evgeniy Stepanov964f4662017-04-27 20:27:27 +00001826
1827 AsanRegisterElfGlobals = checkSanitizerInterfaceFunction(
1828 M.getOrInsertFunction(kAsanRegisterElfGlobalsName, IRB.getVoidTy(),
1829 IntptrTy, IntptrTy, IntptrTy));
1830 AsanRegisterElfGlobals->setLinkage(Function::ExternalLinkage);
1831
1832 AsanUnregisterElfGlobals = checkSanitizerInterfaceFunction(
1833 M.getOrInsertFunction(kAsanUnregisterElfGlobalsName, IRB.getVoidTy(),
1834 IntptrTy, IntptrTy, IntptrTy));
1835 AsanUnregisterElfGlobals->setLinkage(Function::ExternalLinkage);
Alexey Samsonov788381b2012-12-25 12:28:20 +00001836}
1837
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001838// Put the metadata and the instrumented global in the same group. This ensures
1839// that the metadata is discarded if the instrumented global is discarded.
1840void AddressSanitizerModule::SetComdatForGlobalMetadata(
Evgeniy Stepanov964f4662017-04-27 20:27:27 +00001841 GlobalVariable *G, GlobalVariable *Metadata, StringRef InternalSuffix) {
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001842 Module &M = *G->getParent();
1843 Comdat *C = G->getComdat();
1844 if (!C) {
1845 if (!G->hasName()) {
1846 // If G is unnamed, it must be internal. Give it an artificial name
1847 // so we can put it in a comdat.
1848 assert(G->hasLocalLinkage());
1849 G->setName(Twine(kAsanGenPrefix) + "_anon_global");
1850 }
Evgeniy Stepanov964f4662017-04-27 20:27:27 +00001851
1852 if (!InternalSuffix.empty() && G->hasLocalLinkage()) {
1853 std::string Name = G->getName();
1854 Name += InternalSuffix;
1855 C = M.getOrInsertComdat(Name);
1856 } else {
1857 C = M.getOrInsertComdat(G->getName());
1858 }
1859
Reid Klecknerc212cc82017-10-31 16:16:08 +00001860 // Make this IMAGE_COMDAT_SELECT_NODUPLICATES on COFF. Also upgrade private
1861 // linkage to internal linkage so that a symbol table entry is emitted. This
1862 // is necessary in order to create the comdat group.
1863 if (TargetTriple.isOSBinFormatCOFF()) {
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001864 C->setSelectionKind(Comdat::NoDuplicates);
Reid Klecknerc212cc82017-10-31 16:16:08 +00001865 if (G->hasPrivateLinkage())
1866 G->setLinkage(GlobalValue::InternalLinkage);
1867 }
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001868 G->setComdat(C);
1869 }
1870
1871 assert(G->hasComdat());
1872 Metadata->setComdat(G->getComdat());
1873}
1874
1875// Create a separate metadata global and put it in the appropriate ASan
1876// global registration section.
1877GlobalVariable *
1878AddressSanitizerModule::CreateMetadataGlobal(Module &M, Constant *Initializer,
1879 StringRef OriginalName) {
Evgeniy Stepanov90fd8732017-04-11 22:28:13 +00001880 auto Linkage = TargetTriple.isOSBinFormatMachO()
1881 ? GlobalVariable::InternalLinkage
1882 : GlobalVariable::PrivateLinkage;
1883 GlobalVariable *Metadata = new GlobalVariable(
1884 M, Initializer->getType(), false, Linkage, Initializer,
Peter Collingbourne6f0ecca2017-05-16 00:39:01 +00001885 Twine("__asan_global_") + GlobalValue::dropLLVMManglingEscape(OriginalName));
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001886 Metadata->setSection(getGlobalMetadataSection());
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001887 return Metadata;
1888}
1889
1890IRBuilder<> AddressSanitizerModule::CreateAsanModuleDtor(Module &M) {
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +00001891 AsanDtorFunction =
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001892 Function::Create(FunctionType::get(Type::getVoidTy(*C), false),
1893 GlobalValue::InternalLinkage, kAsanModuleDtorName, &M);
1894 BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction);
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001895
1896 return IRBuilder<>(ReturnInst::Create(*C, AsanDtorBB));
1897}
1898
1899void AddressSanitizerModule::InstrumentGlobalsCOFF(
1900 IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
1901 ArrayRef<Constant *> MetadataInitializers) {
1902 assert(ExtendedGlobals.size() == MetadataInitializers.size());
Evgeniy Stepanovf01c70f2017-01-12 23:26:20 +00001903 auto &DL = M.getDataLayout();
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001904
1905 for (size_t i = 0; i < ExtendedGlobals.size(); i++) {
Evgeniy Stepanovf01c70f2017-01-12 23:26:20 +00001906 Constant *Initializer = MetadataInitializers[i];
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001907 GlobalVariable *G = ExtendedGlobals[i];
1908 GlobalVariable *Metadata =
Evgeniy Stepanovf01c70f2017-01-12 23:26:20 +00001909 CreateMetadataGlobal(M, Initializer, G->getName());
1910
1911 // The MSVC linker always inserts padding when linking incrementally. We
1912 // cope with that by aligning each struct to its size, which must be a power
1913 // of two.
1914 unsigned SizeOfGlobalStruct = DL.getTypeAllocSize(Initializer->getType());
1915 assert(isPowerOf2_32(SizeOfGlobalStruct) &&
1916 "global metadata will not be padded appropriately");
1917 Metadata->setAlignment(SizeOfGlobalStruct);
1918
Evgeniy Stepanov964f4662017-04-27 20:27:27 +00001919 SetComdatForGlobalMetadata(G, Metadata, "");
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001920 }
1921}
1922
Evgeniy Stepanov964f4662017-04-27 20:27:27 +00001923void AddressSanitizerModule::InstrumentGlobalsELF(
1924 IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
1925 ArrayRef<Constant *> MetadataInitializers,
1926 const std::string &UniqueModuleId) {
1927 assert(ExtendedGlobals.size() == MetadataInitializers.size());
1928
1929 SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size());
1930 for (size_t i = 0; i < ExtendedGlobals.size(); i++) {
1931 GlobalVariable *G = ExtendedGlobals[i];
1932 GlobalVariable *Metadata =
1933 CreateMetadataGlobal(M, MetadataInitializers[i], G->getName());
1934 MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G));
1935 Metadata->setMetadata(LLVMContext::MD_associated, MD);
1936 MetadataGlobals[i] = Metadata;
1937
1938 SetComdatForGlobalMetadata(G, Metadata, UniqueModuleId);
1939 }
1940
1941 // Update llvm.compiler.used, adding the new metadata globals. This is
1942 // needed so that during LTO these variables stay alive.
1943 if (!MetadataGlobals.empty())
1944 appendToCompilerUsed(M, MetadataGlobals);
1945
1946 // RegisteredFlag serves two purposes. First, we can pass it to dladdr()
1947 // to look up the loaded image that contains it. Second, we can store in it
1948 // whether registration has already occurred, to prevent duplicate
1949 // registration.
1950 //
1951 // Common linkage ensures that there is only one global per shared library.
1952 GlobalVariable *RegisteredFlag = new GlobalVariable(
1953 M, IntptrTy, false, GlobalVariable::CommonLinkage,
1954 ConstantInt::get(IntptrTy, 0), kAsanGlobalsRegisteredFlagName);
1955 RegisteredFlag->setVisibility(GlobalVariable::HiddenVisibility);
1956
1957 // Create start and stop symbols.
1958 GlobalVariable *StartELFMetadata = new GlobalVariable(
1959 M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr,
1960 "__start_" + getGlobalMetadataSection());
1961 StartELFMetadata->setVisibility(GlobalVariable::HiddenVisibility);
1962 GlobalVariable *StopELFMetadata = new GlobalVariable(
1963 M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr,
1964 "__stop_" + getGlobalMetadataSection());
1965 StopELFMetadata->setVisibility(GlobalVariable::HiddenVisibility);
1966
1967 // Create a call to register the globals with the runtime.
1968 IRB.CreateCall(AsanRegisterElfGlobals,
1969 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy),
1970 IRB.CreatePointerCast(StartELFMetadata, IntptrTy),
1971 IRB.CreatePointerCast(StopELFMetadata, IntptrTy)});
1972
1973 // We also need to unregister globals at the end, e.g., when a shared library
1974 // gets closed.
1975 IRBuilder<> IRB_Dtor = CreateAsanModuleDtor(M);
1976 IRB_Dtor.CreateCall(AsanUnregisterElfGlobals,
1977 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy),
1978 IRB.CreatePointerCast(StartELFMetadata, IntptrTy),
1979 IRB.CreatePointerCast(StopELFMetadata, IntptrTy)});
1980}
1981
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001982void AddressSanitizerModule::InstrumentGlobalsMachO(
1983 IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
1984 ArrayRef<Constant *> MetadataInitializers) {
1985 assert(ExtendedGlobals.size() == MetadataInitializers.size());
1986
1987 // On recent Mach-O platforms, use a structure which binds the liveness of
1988 // the global variable to the metadata struct. Keep the list of "Liveness" GV
1989 // created to be added to llvm.compiler.used
Serge Gueltone38003f2017-05-09 19:31:13 +00001990 StructType *LivenessTy = StructType::get(IntptrTy, IntptrTy);
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00001991 SmallVector<GlobalValue *, 16> LivenessGlobals(ExtendedGlobals.size());
1992
1993 for (size_t i = 0; i < ExtendedGlobals.size(); i++) {
1994 Constant *Initializer = MetadataInitializers[i];
1995 GlobalVariable *G = ExtendedGlobals[i];
1996 GlobalVariable *Metadata =
1997 CreateMetadataGlobal(M, Initializer, G->getName());
1998
1999 // On recent Mach-O platforms, we emit the global metadata in a way that
2000 // allows the linker to properly strip dead globals.
Serge Gueltone38003f2017-05-09 19:31:13 +00002001 auto LivenessBinder =
2002 ConstantStruct::get(LivenessTy, Initializer->getAggregateElement(0u),
2003 ConstantExpr::getPointerCast(Metadata, IntptrTy));
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00002004 GlobalVariable *Liveness = new GlobalVariable(
2005 M, LivenessTy, false, GlobalVariable::InternalLinkage, LivenessBinder,
2006 Twine("__asan_binder_") + G->getName());
2007 Liveness->setSection("__DATA,__asan_liveness,regular,live_support");
2008 LivenessGlobals[i] = Liveness;
2009 }
2010
2011 // Update llvm.compiler.used, adding the new liveness globals. This is
2012 // needed so that during LTO these variables stay alive. The alternative
2013 // would be to have the linker handling the LTO symbols, but libLTO
2014 // current API does not expose access to the section for each symbol.
2015 if (!LivenessGlobals.empty())
2016 appendToCompilerUsed(M, LivenessGlobals);
2017
2018 // RegisteredFlag serves two purposes. First, we can pass it to dladdr()
2019 // to look up the loaded image that contains it. Second, we can store in it
2020 // whether registration has already occurred, to prevent duplicate
2021 // registration.
2022 //
2023 // common linkage ensures that there is only one global per shared library.
2024 GlobalVariable *RegisteredFlag = new GlobalVariable(
2025 M, IntptrTy, false, GlobalVariable::CommonLinkage,
2026 ConstantInt::get(IntptrTy, 0), kAsanGlobalsRegisteredFlagName);
2027 RegisteredFlag->setVisibility(GlobalVariable::HiddenVisibility);
2028
2029 IRB.CreateCall(AsanRegisterImageGlobals,
2030 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)});
2031
2032 // We also need to unregister globals at the end, e.g., when a shared library
2033 // gets closed.
2034 IRBuilder<> IRB_Dtor = CreateAsanModuleDtor(M);
2035 IRB_Dtor.CreateCall(AsanUnregisterImageGlobals,
2036 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)});
2037}
2038
2039void AddressSanitizerModule::InstrumentGlobalsWithMetadataArray(
2040 IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
2041 ArrayRef<Constant *> MetadataInitializers) {
2042 assert(ExtendedGlobals.size() == MetadataInitializers.size());
2043 unsigned N = ExtendedGlobals.size();
2044 assert(N > 0);
2045
2046 // On platforms that don't have a custom metadata section, we emit an array
2047 // of global metadata structures.
2048 ArrayType *ArrayOfGlobalStructTy =
2049 ArrayType::get(MetadataInitializers[0]->getType(), N);
2050 auto AllGlobals = new GlobalVariable(
2051 M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage,
2052 ConstantArray::get(ArrayOfGlobalStructTy, MetadataInitializers), "");
Walter Lee2a2b69e2017-11-16 12:57:19 +00002053 if (Mapping.Scale > 3)
2054 AllGlobals->setAlignment(1ULL << Mapping.Scale);
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00002055
2056 IRB.CreateCall(AsanRegisterGlobals,
2057 {IRB.CreatePointerCast(AllGlobals, IntptrTy),
2058 ConstantInt::get(IntptrTy, N)});
2059
2060 // We also need to unregister globals at the end, e.g., when a shared library
2061 // gets closed.
2062 IRBuilder<> IRB_Dtor = CreateAsanModuleDtor(M);
2063 IRB_Dtor.CreateCall(AsanUnregisterGlobals,
2064 {IRB.CreatePointerCast(AllGlobals, IntptrTy),
2065 ConstantInt::get(IntptrTy, N)});
2066}
2067
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002068// This function replaces all global variables with new variables that have
2069// trailing redzones. It also creates a function that poisons
2070// redzones and inserts this function into llvm.global_ctors.
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +00002071// Sets *CtorComdat to true if the global registration code emitted into the
2072// asan constructor is comdat-compatible.
2073bool AddressSanitizerModule::InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat) {
2074 *CtorComdat = false;
Alexey Samsonov4f319cc2014-07-02 16:54:41 +00002075 GlobalsMD.init(M);
Kostya Serebryany20a79972012-11-22 03:18:50 +00002076
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002077 SmallVector<GlobalVariable *, 16> GlobalsToChange;
2078
Alexey Samsonova02e6642014-05-29 18:40:48 +00002079 for (auto &G : M.globals()) {
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002080 if (ShouldInstrumentGlobal(&G)) GlobalsToChange.push_back(&G);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002081 }
2082
2083 size_t n = GlobalsToChange.size();
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +00002084 if (n == 0) {
2085 *CtorComdat = true;
2086 return false;
2087 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002088
Reid Kleckner78565832016-11-29 01:32:21 +00002089 auto &DL = M.getDataLayout();
Reid Kleckner01660a32016-11-21 20:40:37 +00002090
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002091 // A global is described by a structure
2092 // size_t beg;
2093 // size_t size;
2094 // size_t size_with_redzone;
2095 // const char *name;
Kostya Serebryanybd016bb2013-03-18 08:05:29 +00002096 // const char *module_name;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00002097 // size_t has_dynamic_init;
Alexey Samsonov4f319cc2014-07-02 16:54:41 +00002098 // void *source_location;
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002099 // size_t odr_indicator;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002100 // We initialize an array of such structures and pass it to a run-time call.
Alexey Samsonov4f319cc2014-07-02 16:54:41 +00002101 StructType *GlobalStructTy =
2102 StructType::get(IntptrTy, IntptrTy, IntptrTy, IntptrTy, IntptrTy,
Serge Gueltone38003f2017-05-09 19:31:13 +00002103 IntptrTy, IntptrTy, IntptrTy);
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00002104 SmallVector<GlobalVariable *, 16> NewGlobals(n);
2105 SmallVector<Constant *, 16> Initializers(n);
Kostya Serebryany20a79972012-11-22 03:18:50 +00002106
Alexey Samsonove1e26bf2013-03-26 13:05:41 +00002107 bool HasDynamicallyInitializedGlobals = false;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00002108
Alexey Samsonove1e26bf2013-03-26 13:05:41 +00002109 // We shouldn't merge same module names, as this string serves as unique
2110 // module ID in runtime.
Alexander Potapenkodaf96ae2013-12-25 14:22:15 +00002111 GlobalVariable *ModuleName = createPrivateGlobalForString(
Kostya Serebryanyd891ac92018-10-11 23:03:27 +00002112 M, M.getModuleIdentifier(), /*AllowMerging*/ false, kAsanGenPrefix);
Kostya Serebryanybd016bb2013-03-18 08:05:29 +00002113
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002114 for (size_t i = 0; i < n; i++) {
Kostya Serebryanye35d59a2013-01-24 10:43:50 +00002115 static const uint64_t kMaxGlobalRedzone = 1 << 18;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002116 GlobalVariable *G = GlobalsToChange[i];
Alexey Samsonov15c96692014-07-12 00:42:52 +00002117
2118 auto MD = GlobalsMD.get(G);
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002119 StringRef NameForGlobal = G->getName();
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +00002120 // Create string holding the global name (use global name from metadata
2121 // if it's available, otherwise just write the name of global variable).
2122 GlobalVariable *Name = createPrivateGlobalForString(
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002123 M, MD.Name.empty() ? NameForGlobal : MD.Name,
Kostya Serebryanyd891ac92018-10-11 23:03:27 +00002124 /*AllowMerging*/ true, kAsanGenPrefix);
Alexey Samsonov15c96692014-07-12 00:42:52 +00002125
Manuel Jacob5f6eaac2016-01-16 20:30:46 +00002126 Type *Ty = G->getValueType();
Mehdi Aminia28d91d2015-03-10 02:37:25 +00002127 uint64_t SizeInBytes = DL.getTypeAllocSize(Ty);
Kostya Serebryany4fb78012013-12-06 09:00:17 +00002128 uint64_t MinRZ = MinRedzoneSizeForGlobal();
Kostya Serebryany87191f62013-01-24 10:35:40 +00002129 // MinRZ <= RZ <= kMaxGlobalRedzone
2130 // and trying to make RZ to be ~ 1/4 of SizeInBytes.
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002131 uint64_t RZ = std::max(
2132 MinRZ, std::min(kMaxGlobalRedzone, (SizeInBytes / MinRZ / 4) * MinRZ));
Kostya Serebryany87191f62013-01-24 10:35:40 +00002133 uint64_t RightRedzoneSize = RZ;
2134 // Round up to MinRZ
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002135 if (SizeInBytes % MinRZ) RightRedzoneSize += MinRZ - (SizeInBytes % MinRZ);
Kostya Serebryany87191f62013-01-24 10:35:40 +00002136 assert(((RightRedzoneSize + SizeInBytes) % MinRZ) == 0);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002137 Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize);
2138
Serge Gueltone38003f2017-05-09 19:31:13 +00002139 StructType *NewTy = StructType::get(Ty, RightRedZoneTy);
2140 Constant *NewInitializer = ConstantStruct::get(
2141 NewTy, G->getInitializer(), Constant::getNullValue(RightRedZoneTy));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002142
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002143 // Create a new global variable with enough space for a redzone.
Bill Wendling58f8cef2013-08-06 22:52:42 +00002144 GlobalValue::LinkageTypes Linkage = G->getLinkage();
2145 if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage)
2146 Linkage = GlobalValue::InternalLinkage;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002147 GlobalVariable *NewGlobal =
2148 new GlobalVariable(M, NewTy, G->isConstant(), Linkage, NewInitializer,
2149 "", G, G->getThreadLocalMode());
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002150 NewGlobal->copyAttributesFrom(G);
Reid Kleckner85a8c122018-08-20 23:35:45 +00002151 NewGlobal->setComdat(G->getComdat());
Kostya Serebryany87191f62013-01-24 10:35:40 +00002152 NewGlobal->setAlignment(MinRZ);
Vitaly Bukad414e1b2018-12-20 00:30:18 +00002153 // Don't fold globals with redzones. ODR violation detector and redzone
2154 // poisoning implicitly creates a dependence on the global's address, so it
2155 // is no longer valid for it to be marked unnamed_addr.
2156 NewGlobal->setUnnamedAddr(GlobalValue::UnnamedAddr::None);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002157
Kuba Breckaa28c9e82016-10-31 18:51:58 +00002158 // Move null-terminated C strings to "__asan_cstring" section on Darwin.
2159 if (TargetTriple.isOSBinFormatMachO() && !G->hasSection() &&
2160 G->isConstant()) {
2161 auto Seq = dyn_cast<ConstantDataSequential>(G->getInitializer());
2162 if (Seq && Seq->isCString())
2163 NewGlobal->setSection("__TEXT,__asan_cstring,regular");
2164 }
2165
Adrian Prantl12fa3b32016-09-20 18:28:42 +00002166 // Transfer the debug info. The payload starts at offset zero so we can
2167 // copy the debug info over as is.
Adrian Prantlbceaaa92016-12-20 02:09:43 +00002168 SmallVector<DIGlobalVariableExpression *, 1> GVs;
Adrian Prantl12fa3b32016-09-20 18:28:42 +00002169 G->getDebugInfo(GVs);
2170 for (auto *GV : GVs)
2171 NewGlobal->addDebugInfo(GV);
2172
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002173 Value *Indices2[2];
2174 Indices2[0] = IRB.getInt32(0);
2175 Indices2[1] = IRB.getInt32(0);
2176
2177 G->replaceAllUsesWith(
David Blaikie4a2e73b2015-04-02 18:55:32 +00002178 ConstantExpr::getGetElementPtr(NewTy, NewGlobal, Indices2, true));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002179 NewGlobal->takeName(G);
2180 G->eraseFromParent();
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00002181 NewGlobals[i] = NewGlobal;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002182
Alexey Samsonovd9ad5ce2014-08-02 00:35:50 +00002183 Constant *SourceLoc;
2184 if (!MD.SourceLoc.empty()) {
2185 auto SourceLocGlobal = createPrivateGlobalForSourceLoc(M, MD.SourceLoc);
2186 SourceLoc = ConstantExpr::getPointerCast(SourceLocGlobal, IntptrTy);
2187 } else {
2188 SourceLoc = ConstantInt::get(IntptrTy, 0);
2189 }
2190
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002191 Constant *ODRIndicator = ConstantExpr::getNullValue(IRB.getInt8PtrTy());
2192 GlobalValue *InstrumentedGlobal = NewGlobal;
2193
Kuba Breckaa1ea64a2016-09-14 14:06:33 +00002194 bool CanUsePrivateAliases =
Dan Gohman1209c7a2017-01-17 20:34:09 +00002195 TargetTriple.isOSBinFormatELF() || TargetTriple.isOSBinFormatMachO() ||
2196 TargetTriple.isOSBinFormatWasm();
Vitaly Buka8076c572018-12-05 01:44:31 +00002197 if (CanUsePrivateAliases && UsePrivateAlias) {
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002198 // Create local alias for NewGlobal to avoid crash on ODR between
2199 // instrumented and non-instrumented libraries.
Vitaly Bukad6bab092018-12-04 23:17:41 +00002200 InstrumentedGlobal =
Vitaly Buka537cfc02018-12-04 00:36:14 +00002201 GlobalAlias::create(GlobalValue::PrivateLinkage, "", NewGlobal);
Vitaly Bukad6bab092018-12-04 23:17:41 +00002202 }
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002203
Vitaly Buka07a55f22018-12-20 00:30:27 +00002204 // ODR should not happen for local linkage.
2205 if (NewGlobal->hasLocalLinkage()) {
Vitaly Bukaa2576392018-12-13 09:47:39 +00002206 ODRIndicator = ConstantExpr::getIntToPtr(ConstantInt::get(IntptrTy, -1),
2207 IRB.getInt8PtrTy());
2208 } else if (UseOdrIndicator) {
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002209 // With local aliases, we need to provide another externally visible
2210 // symbol __odr_asan_XXX to detect ODR violation.
2211 auto *ODRIndicatorSym =
2212 new GlobalVariable(M, IRB.getInt8Ty(), false, Linkage,
2213 Constant::getNullValue(IRB.getInt8Ty()),
2214 kODRGenPrefix + NameForGlobal, nullptr,
2215 NewGlobal->getThreadLocalMode());
2216
2217 // Set meaningful attributes for indicator symbol.
2218 ODRIndicatorSym->setVisibility(NewGlobal->getVisibility());
2219 ODRIndicatorSym->setDLLStorageClass(NewGlobal->getDLLStorageClass());
2220 ODRIndicatorSym->setAlignment(1);
2221 ODRIndicator = ODRIndicatorSym;
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002222 }
2223
Reid Kleckner01660a32016-11-21 20:40:37 +00002224 Constant *Initializer = ConstantStruct::get(
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002225 GlobalStructTy,
2226 ConstantExpr::getPointerCast(InstrumentedGlobal, IntptrTy),
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002227 ConstantInt::get(IntptrTy, SizeInBytes),
2228 ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize),
2229 ConstantExpr::getPointerCast(Name, IntptrTy),
Kostya Serebryanybd016bb2013-03-18 08:05:29 +00002230 ConstantExpr::getPointerCast(ModuleName, IntptrTy),
Maxim Ostapenkob1e3f602016-02-08 08:30:57 +00002231 ConstantInt::get(IntptrTy, MD.IsDynInit), SourceLoc,
Serge Gueltone38003f2017-05-09 19:31:13 +00002232 ConstantExpr::getPointerCast(ODRIndicator, IntptrTy));
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00002233
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002234 if (ClInitializers && MD.IsDynInit) HasDynamicallyInitializedGlobals = true;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00002235
Nicola Zaghend34e60c2018-05-14 12:53:11 +00002236 LLVM_DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n");
Reid Kleckner01660a32016-11-21 20:40:37 +00002237
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00002238 Initializers[i] = Initializer;
2239 }
Reid Kleckner01660a32016-11-21 20:40:37 +00002240
Kuba Mracek8842da82018-03-08 21:02:18 +00002241 // Add instrumented globals to llvm.compiler.used list to avoid LTO from
2242 // ConstantMerge'ing them.
2243 SmallVector<GlobalValue *, 16> GlobalsToAddToUsedList;
2244 for (size_t i = 0; i < n; i++) {
2245 GlobalVariable *G = NewGlobals[i];
2246 if (G->getName().empty()) continue;
2247 GlobalsToAddToUsedList.push_back(G);
2248 }
2249 appendToCompilerUsed(M, ArrayRef<GlobalValue *>(GlobalsToAddToUsedList));
2250
Evgeniy Stepanov964f4662017-04-27 20:27:27 +00002251 std::string ELFUniqueModuleId =
2252 (UseGlobalsGC && TargetTriple.isOSBinFormatELF()) ? getUniqueModuleId(&M)
2253 : "";
2254
2255 if (!ELFUniqueModuleId.empty()) {
2256 InstrumentGlobalsELF(IRB, M, NewGlobals, Initializers, ELFUniqueModuleId);
2257 *CtorComdat = true;
2258 } else if (UseGlobalsGC && TargetTriple.isOSBinFormatCOFF()) {
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00002259 InstrumentGlobalsCOFF(IRB, M, NewGlobals, Initializers);
Evgeniy Stepanov9e536082017-04-24 19:34:13 +00002260 } else if (UseGlobalsGC && ShouldUseMachOGlobalsSection()) {
Evgeniy Stepanov5d31d082017-01-12 23:03:03 +00002261 InstrumentGlobalsMachO(IRB, M, NewGlobals, Initializers);
2262 } else {
2263 InstrumentGlobalsWithMetadataArray(IRB, M, NewGlobals, Initializers);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002264 }
2265
Reid Kleckner01660a32016-11-21 20:40:37 +00002266 // Create calls for poisoning before initializers run and unpoisoning after.
2267 if (HasDynamicallyInitializedGlobals)
2268 createInitializerPoisonCalls(M, ModuleName);
2269
Nicola Zaghend34e60c2018-05-14 12:53:11 +00002270 LLVM_DEBUG(dbgs() << M);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002271 return true;
2272}
2273
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +00002274int AddressSanitizerModule::GetAsanVersion(const Module &M) const {
2275 int LongSize = M.getDataLayout().getPointerSizeInBits();
2276 bool isAndroid = Triple(M.getTargetTriple()).isAndroid();
2277 int Version = 8;
2278 // 32-bit Android is one version ahead because of the switch to dynamic
2279 // shadow.
2280 Version += (LongSize == 32 && isAndroid);
2281 return Version;
2282}
2283
Leonard Chaneebecb32018-10-26 22:51:51 +00002284bool AddressSanitizerModule::runOnModule(Module &M) {
Evgeniy Stepanov19f75fc2014-06-03 14:16:00 +00002285 C = &(M.getContext());
Mehdi Aminia28d91d2015-03-10 02:37:25 +00002286 int LongSize = M.getDataLayout().getPointerSizeInBits();
Evgeniy Stepanov19f75fc2014-06-03 14:16:00 +00002287 IntptrTy = Type::getIntNTy(*C, LongSize);
Kuba Brecka1001bb52014-12-05 22:19:18 +00002288 TargetTriple = Triple(M.getTargetTriple());
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002289 Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel);
Evgeniy Stepanov19f75fc2014-06-03 14:16:00 +00002290 initializeCallbacks(M);
2291
Evgeniy Stepanov039af602017-04-06 19:55:09 +00002292 if (CompileKernel)
2293 return false;
Alex Shlyapnikovbbd5cc62017-03-27 23:11:50 +00002294
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +00002295 // Create a module constructor. A destructor is created lazily because not all
2296 // platforms, and not all modules need it.
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +00002297 std::string VersionCheckName =
2298 kAsanVersionCheckNamePrefix + std::to_string(GetAsanVersion(M));
Evgeniy Stepanov039af602017-04-06 19:55:09 +00002299 std::tie(AsanCtorFunction, std::ignore) = createSanitizerCtorAndInitFunctions(
2300 M, kAsanModuleCtorName, kAsanInitName, /*InitArgTypes=*/{},
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +00002301 /*InitArgs=*/{}, VersionCheckName);
Evgeniy Stepanov039af602017-04-06 19:55:09 +00002302
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +00002303 bool CtorComdat = true;
Evgeniy Stepanov039af602017-04-06 19:55:09 +00002304 bool Changed = false;
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002305 // TODO(glider): temporarily disabled globals instrumentation for KASan.
Evgeniy Stepanov039af602017-04-06 19:55:09 +00002306 if (ClGlobals) {
2307 IRBuilder<> IRB(AsanCtorFunction->getEntryBlock().getTerminator());
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +00002308 Changed |= InstrumentGlobals(IRB, M, &CtorComdat);
2309 }
2310
2311 // Put the constructor and destructor in comdat if both
2312 // (1) global instrumentation is not TU-specific
2313 // (2) target is ELF.
Evgeniy Stepanovb56012b2017-05-15 20:43:42 +00002314 if (UseCtorComdat && TargetTriple.isOSBinFormatELF() && CtorComdat) {
Evgeniy Stepanov716f0ff222017-04-27 20:27:23 +00002315 AsanCtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleCtorName));
2316 appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndDtorPriority,
2317 AsanCtorFunction);
2318 if (AsanDtorFunction) {
2319 AsanDtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleDtorName));
2320 appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndDtorPriority,
2321 AsanDtorFunction);
2322 }
2323 } else {
2324 appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndDtorPriority);
2325 if (AsanDtorFunction)
2326 appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndDtorPriority);
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002327 }
Evgeniy Stepanov19f75fc2014-06-03 14:16:00 +00002328
2329 return Changed;
2330}
2331
Kostya Serebryany4b929da2012-11-29 09:54:21 +00002332void AddressSanitizer::initializeCallbacks(Module &M) {
2333 IRBuilder<> IRB(*C);
Kostya Serebryany4273bb02012-07-16 14:09:42 +00002334 // Create __asan_report* callbacks.
Dmitry Vyukov618d5802015-03-17 16:59:19 +00002335 // IsWrite, TypeSize and Exp are encoded in the function name.
2336 for (int Exp = 0; Exp < 2; Exp++) {
2337 for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) {
2338 const std::string TypeStr = AccessIsWrite ? "store" : "load";
2339 const std::string ExpStr = Exp ? "exp_" : "";
Yury Gribovd7731982015-11-11 10:36:49 +00002340 const std::string EndingStr = Recover ? "_noabort" : "";
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002341
2342 SmallVector<Type *, 3> Args2 = {IntptrTy, IntptrTy};
2343 SmallVector<Type *, 2> Args1{1, IntptrTy};
2344 if (Exp) {
2345 Type *ExpType = Type::getInt32Ty(*C);
2346 Args2.push_back(ExpType);
2347 Args1.push_back(ExpType);
Dmitry Vyukov618d5802015-03-17 16:59:19 +00002348 }
NAKAMURA Takumia1e97a72017-08-28 06:47:47 +00002349 AsanErrorCallbackSized[AccessIsWrite][Exp] =
2350 checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Evgeniy Stepanov31475a02018-01-25 21:28:51 +00002351 kAsanReportErrorTemplate + ExpStr + TypeStr + "_n" + EndingStr,
NAKAMURA Takumia1e97a72017-08-28 06:47:47 +00002352 FunctionType::get(IRB.getVoidTy(), Args2, false)));
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002353
NAKAMURA Takumia1e97a72017-08-28 06:47:47 +00002354 AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] =
2355 checkSanitizerInterfaceFunction(M.getOrInsertFunction(
2356 ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr,
2357 FunctionType::get(IRB.getVoidTy(), Args2, false)));
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002358
NAKAMURA Takumia1e97a72017-08-28 06:47:47 +00002359 for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes;
2360 AccessSizeIndex++) {
2361 const std::string Suffix = TypeStr + itostr(1ULL << AccessSizeIndex);
2362 AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] =
2363 checkSanitizerInterfaceFunction(M.getOrInsertFunction(
2364 kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr,
2365 FunctionType::get(IRB.getVoidTy(), Args1, false)));
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002366
NAKAMURA Takumia1e97a72017-08-28 06:47:47 +00002367 AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] =
2368 checkSanitizerInterfaceFunction(M.getOrInsertFunction(
2369 ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr,
2370 FunctionType::get(IRB.getVoidTy(), Args1, false)));
2371 }
2372 }
Kostya Serebryany4273bb02012-07-16 14:09:42 +00002373 }
Kostya Serebryany86332c02014-04-21 07:10:43 +00002374
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002375 const std::string MemIntrinCallbackPrefix =
2376 CompileKernel ? std::string("") : ClMemoryAccessCallbackPrefix;
Ismail Pazarbasi198d6d52015-04-06 21:09:08 +00002377 AsanMemmove = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002378 MemIntrinCallbackPrefix + "memmove", IRB.getInt8PtrTy(),
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002379 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy));
Ismail Pazarbasi198d6d52015-04-06 21:09:08 +00002380 AsanMemcpy = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002381 MemIntrinCallbackPrefix + "memcpy", IRB.getInt8PtrTy(),
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002382 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy));
Ismail Pazarbasi198d6d52015-04-06 21:09:08 +00002383 AsanMemset = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002384 MemIntrinCallbackPrefix + "memset", IRB.getInt8PtrTy(),
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002385 IRB.getInt8PtrTy(), IRB.getInt32Ty(), IntptrTy));
Kostya Serebryany94c81ca2014-04-21 11:50:42 +00002386
Ismail Pazarbasi198d6d52015-04-06 21:09:08 +00002387 AsanHandleNoReturnFunc = checkSanitizerInterfaceFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002388 M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy()));
Kostya Serebryany4f8f0c52014-10-27 18:13:56 +00002389
Mehdi Aminidb11fdf2017-04-06 20:23:57 +00002390 AsanPtrCmpFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002391 kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy));
Mehdi Aminidb11fdf2017-04-06 20:23:57 +00002392 AsanPtrSubFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002393 kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy));
Kostya Serebryanyf02c6062012-07-20 09:54:50 +00002394 // We insert an empty inline asm after __asan_report* to avoid callback merge.
2395 EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
2396 StringRef(""), StringRef(""),
2397 /*hasSideEffects=*/true);
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +00002398 if (Mapping.InGlobal)
2399 AsanShadowGlobal = M.getOrInsertGlobal("__asan_shadow",
2400 ArrayType::get(IRB.getInt8Ty(), 0));
Kostya Serebryany4b929da2012-11-29 09:54:21 +00002401}
2402
Leonard Chaneebecb32018-10-26 22:51:51 +00002403// virtual
2404bool AddressSanitizer::doInitialization(Module &M) {
2405 // Initialize the private fields. No one has accessed them before.
2406 GlobalsMD.init(M);
2407
2408 C = &(M.getContext());
2409 LongSize = M.getDataLayout().getPointerSizeInBits();
2410 IntptrTy = Type::getIntNTy(*C, LongSize);
2411 TargetTriple = Triple(M.getTargetTriple());
2412
2413 Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel);
2414 return true;
2415}
2416
2417bool AddressSanitizer::doFinalization(Module &M) {
2418 GlobalsMD.reset();
2419 return false;
2420}
2421
Kostya Serebryany22ddcfd2012-01-30 23:50:10 +00002422bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) {
2423 // For each NSObject descendant having a +load method, this method is invoked
2424 // by the ObjC runtime before any of the static constructors is called.
2425 // Therefore we need to instrument such methods with a call to __asan_init
2426 // at the beginning in order to initialize our runtime before any access to
2427 // the shadow memory.
2428 // We cannot just ignore these methods, because they may call other
2429 // instrumented functions.
2430 if (F.getName().find(" load]") != std::string::npos) {
Evgeniy Stepanov039af602017-04-06 19:55:09 +00002431 Function *AsanInitFunction =
2432 declareSanitizerInitFunction(*F.getParent(), kAsanInitName, {});
Duncan P. N. Exon Smithe82c2862015-10-13 17:39:10 +00002433 IRBuilder<> IRB(&F.front(), F.front().begin());
David Blaikieff6409d2015-05-18 22:13:54 +00002434 IRB.CreateCall(AsanInitFunction, {});
Kostya Serebryany22ddcfd2012-01-30 23:50:10 +00002435 return true;
2436 }
2437 return false;
2438}
2439
Etienne Bergeron0ca05682016-09-30 17:46:32 +00002440void AddressSanitizer::maybeInsertDynamicShadowAtFunctionEntry(Function &F) {
2441 // Generate code only when dynamic addressing is needed.
Evgeniy Stepanovcff19ee2017-11-15 00:11:51 +00002442 if (Mapping.Offset != kDynamicShadowSentinel)
Etienne Bergeron0ca05682016-09-30 17:46:32 +00002443 return;
2444
2445 IRBuilder<> IRB(&F.front().front());
Evgeniy Stepanov8e7018d2017-11-20 17:41:57 +00002446 if (Mapping.InGlobal) {
2447 if (ClWithIfuncSuppressRemat) {
2448 // An empty inline asm with input reg == output reg.
2449 // An opaque pointer-to-int cast, basically.
2450 InlineAsm *Asm = InlineAsm::get(
2451 FunctionType::get(IntptrTy, {AsanShadowGlobal->getType()}, false),
2452 StringRef(""), StringRef("=r,0"),
2453 /*hasSideEffects=*/false);
2454 LocalDynamicShadow =
2455 IRB.CreateCall(Asm, {AsanShadowGlobal}, ".asan.shadow");
2456 } else {
2457 LocalDynamicShadow =
2458 IRB.CreatePointerCast(AsanShadowGlobal, IntptrTy, ".asan.shadow");
2459 }
2460 } else {
2461 Value *GlobalDynamicAddress = F.getParent()->getOrInsertGlobal(
2462 kAsanShadowMemoryDynamicAddress, IntptrTy);
2463 LocalDynamicShadow = IRB.CreateLoad(GlobalDynamicAddress);
2464 }
Etienne Bergeron0ca05682016-09-30 17:46:32 +00002465}
2466
Reid Kleckner2f907552015-07-21 17:40:14 +00002467void AddressSanitizer::markEscapedLocalAllocas(Function &F) {
2468 // Find the one possible call to llvm.localescape and pre-mark allocas passed
2469 // to it as uninteresting. This assumes we haven't started processing allocas
2470 // yet. This check is done up front because iterating the use list in
2471 // isInterestingAlloca would be algorithmically slower.
2472 assert(ProcessedAllocas.empty() && "must process localescape before allocas");
2473
2474 // Try to get the declaration of llvm.localescape. If it's not in the module,
2475 // we can exit early.
2476 if (!F.getParent()->getFunction("llvm.localescape")) return;
2477
2478 // Look for a call to llvm.localescape call in the entry block. It can't be in
2479 // any other block.
2480 for (Instruction &I : F.getEntryBlock()) {
2481 IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I);
2482 if (II && II->getIntrinsicID() == Intrinsic::localescape) {
2483 // We found a call. Mark all the allocas passed in as uninteresting.
2484 for (Value *Arg : II->arg_operands()) {
2485 AllocaInst *AI = dyn_cast<AllocaInst>(Arg->stripPointerCasts());
2486 assert(AI && AI->isStaticAlloca() &&
2487 "non-static alloca arg to localescape");
2488 ProcessedAllocas[AI] = false;
2489 }
2490 break;
2491 }
2492 }
2493}
2494
Leonard Chaneebecb32018-10-26 22:51:51 +00002495bool AddressSanitizer::runOnFunction(Function &F) {
Kostya Serebryany6b5b58d2013-03-18 07:33:49 +00002496 if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false;
Etienne Bergeron752f8832016-09-14 17:18:37 +00002497 if (!ClDebugFunc.empty() && ClDebugFunc == F.getName()) return false;
Etienne Bergeron52e47432016-09-15 15:35:59 +00002498 if (F.getName().startswith("__asan_")) return false;
Yury Gribov3ae427d2014-12-01 08:47:58 +00002499
Etienne Bergeron78582b22016-09-15 15:45:05 +00002500 bool FunctionModified = false;
2501
Kostya Serebryanycf880b92013-02-26 06:58:09 +00002502 // If needed, insert __asan_init before checking for SanitizeAddress attr.
Etienne Bergeron752f8832016-09-14 17:18:37 +00002503 // This function needs to be called even if the function body is not
Fangrui Songf78650a2018-07-30 19:41:25 +00002504 // instrumented.
Etienne Bergeron78582b22016-09-15 15:45:05 +00002505 if (maybeInsertAsanInitAtFunctionEntry(F))
2506 FunctionModified = true;
Fangrui Songf78650a2018-07-30 19:41:25 +00002507
Etienne Bergeron752f8832016-09-14 17:18:37 +00002508 // Leave if the function doesn't need instrumentation.
Etienne Bergeron78582b22016-09-15 15:45:05 +00002509 if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return FunctionModified;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002510
Nicola Zaghend34e60c2018-05-14 12:53:11 +00002511 LLVM_DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n");
Etienne Bergeron752f8832016-09-14 17:18:37 +00002512
2513 initializeCallbacks(*F.getParent());
Leonard Chaneebecb32018-10-26 22:51:51 +00002514 DT = &getAnalysis<DominatorTreeWrapperPass>().getDomTree();
Bill Wendlingc9b22d72012-10-09 07:45:08 +00002515
Reid Kleckner2f907552015-07-21 17:40:14 +00002516 FunctionStateRAII CleanupObj(this);
2517
Etienne Bergeron0ca05682016-09-30 17:46:32 +00002518 maybeInsertDynamicShadowAtFunctionEntry(F);
2519
Reid Kleckner2f907552015-07-21 17:40:14 +00002520 // We can't instrument allocas used with llvm.localescape. Only static allocas
2521 // can be passed to that intrinsic.
2522 markEscapedLocalAllocas(F);
2523
Bill Wendlingc9b22d72012-10-09 07:45:08 +00002524 // We want to instrument every address only once per basic block (unless there
2525 // are calls between uses).
Florian Hahna1cc8482018-06-12 11:16:56 +00002526 SmallPtrSet<Value *, 16> TempsToInstrument;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002527 SmallVector<Instruction *, 16> ToInstrument;
2528 SmallVector<Instruction *, 8> NoReturnCalls;
2529 SmallVector<BasicBlock *, 16> AllBlocks;
2530 SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts;
Kostya Serebryany9f5213f2013-06-26 09:18:17 +00002531 int NumAllocas = 0;
Kostya Serebryany90241602012-05-30 09:04:06 +00002532 bool IsWrite;
Kostya Serebryanyc7895a82014-05-23 11:52:07 +00002533 unsigned Alignment;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002534 uint64_t TypeSize;
Leonard Chaneebecb32018-10-26 22:51:51 +00002535 const TargetLibraryInfo *TLI =
2536 &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002537
2538 // Fill the set of memory operations to instrument.
Alexey Samsonova02e6642014-05-29 18:40:48 +00002539 for (auto &BB : F) {
2540 AllBlocks.push_back(&BB);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002541 TempsToInstrument.clear();
Kostya Serebryanyc387ca72012-06-28 09:34:41 +00002542 int NumInsnsPerBB = 0;
Alexey Samsonova02e6642014-05-29 18:40:48 +00002543 for (auto &Inst : BB) {
2544 if (LooksLikeCodeInBug11395(&Inst)) return false;
Filipe Cabecinhasdd968872016-12-14 21:57:04 +00002545 Value *MaybeMask = nullptr;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002546 if (Value *Addr = isInterestingMemoryAccess(&Inst, &IsWrite, &TypeSize,
Filipe Cabecinhasdd968872016-12-14 21:57:04 +00002547 &Alignment, &MaybeMask)) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002548 if (ClOpt && ClOptSameTemp) {
Filipe Cabecinhasdd968872016-12-14 21:57:04 +00002549 // If we have a mask, skip instrumentation if we've already
2550 // instrumented the full object. But don't add to TempsToInstrument
2551 // because we might get another load/store with a different mask.
2552 if (MaybeMask) {
2553 if (TempsToInstrument.count(Addr))
2554 continue; // We've seen this (whole) temp in the current BB.
2555 } else {
2556 if (!TempsToInstrument.insert(Addr).second)
2557 continue; // We've seen this temp in the current BB.
2558 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002559 }
Kostya Serebryanycb3f6e12014-02-27 13:13:59 +00002560 } else if (ClInvalidPointerPairs &&
Alexey Samsonova02e6642014-05-29 18:40:48 +00002561 isInterestingPointerComparisonOrSubtraction(&Inst)) {
2562 PointerComparisonsOrSubtracts.push_back(&Inst);
Kostya Serebryany796f6552014-02-27 12:45:36 +00002563 continue;
Alexey Samsonova02e6642014-05-29 18:40:48 +00002564 } else if (isa<MemIntrinsic>(Inst)) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002565 // ok, take it.
2566 } else {
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002567 if (isa<AllocaInst>(Inst)) NumAllocas++;
Alexey Samsonova02e6642014-05-29 18:40:48 +00002568 CallSite CS(&Inst);
Kostya Serebryany699ac282013-02-20 12:35:15 +00002569 if (CS) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002570 // A call inside BB.
2571 TempsToInstrument.clear();
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002572 if (CS.doesNotReturn()) NoReturnCalls.push_back(CS.getInstruction());
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002573 }
Marcin Koscielnicki3feda222016-06-18 10:10:37 +00002574 if (CallInst *CI = dyn_cast<CallInst>(&Inst))
2575 maybeMarkSanitizerLibraryCallNoBuiltin(CI, TLI);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002576 continue;
2577 }
Alexey Samsonova02e6642014-05-29 18:40:48 +00002578 ToInstrument.push_back(&Inst);
Kostya Serebryanyc387ca72012-06-28 09:34:41 +00002579 NumInsnsPerBB++;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002580 if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002581 }
2582 }
2583
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002584 bool UseCalls =
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002585 (ClInstrumentationWithCallsThreshold >= 0 &&
2586 ToInstrument.size() > (unsigned)ClInstrumentationWithCallsThreshold);
Mehdi Aminia28d91d2015-03-10 02:37:25 +00002587 const DataLayout &DL = F.getParent()->getDataLayout();
George Burgess IV56c7e882017-03-21 20:08:59 +00002588 ObjectSizeOpts ObjSizeOpts;
2589 ObjSizeOpts.RoundToAlign = true;
2590 ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), ObjSizeOpts);
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002591
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002592 // Instrument.
2593 int NumInstrumented = 0;
Alexey Samsonova02e6642014-05-29 18:40:48 +00002594 for (auto Inst : ToInstrument) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002595 if (ClDebugMin < 0 || ClDebugMax < 0 ||
2596 (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) {
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002597 if (isInterestingMemoryAccess(Inst, &IsWrite, &TypeSize, &Alignment))
Mehdi Aminia28d91d2015-03-10 02:37:25 +00002598 instrumentMop(ObjSizeVis, Inst, UseCalls,
2599 F.getParent()->getDataLayout());
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002600 else
Kostya Serebryany94c81ca2014-04-21 11:50:42 +00002601 instrumentMemIntrinsic(cast<MemIntrinsic>(Inst));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002602 }
2603 NumInstrumented++;
2604 }
2605
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00002606 FunctionStackPoisoner FSP(F, *this);
2607 bool ChangedStack = FSP.runOnFunction();
Kostya Serebryany154a54d2012-02-08 21:36:17 +00002608
2609 // We must unpoison the stack before every NoReturn call (throw, _exit, etc).
Hans Wennborg08b34a02017-11-13 23:47:58 +00002610 // See e.g. https://github.com/google/sanitizers/issues/37
Alexey Samsonova02e6642014-05-29 18:40:48 +00002611 for (auto CI : NoReturnCalls) {
Kostya Serebryany154a54d2012-02-08 21:36:17 +00002612 IRBuilder<> IRB(CI);
David Blaikieff6409d2015-05-18 22:13:54 +00002613 IRB.CreateCall(AsanHandleNoReturnFunc, {});
Kostya Serebryany154a54d2012-02-08 21:36:17 +00002614 }
2615
Alexey Samsonova02e6642014-05-29 18:40:48 +00002616 for (auto Inst : PointerComparisonsOrSubtracts) {
2617 instrumentPointerComparisonOrSubtraction(Inst);
Kostya Serebryany796f6552014-02-27 12:45:36 +00002618 NumInstrumented++;
2619 }
2620
Etienne Bergeron78582b22016-09-15 15:45:05 +00002621 if (NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty())
2622 FunctionModified = true;
Bob Wilsonda4147c2013-11-15 07:16:09 +00002623
Nicola Zaghend34e60c2018-05-14 12:53:11 +00002624 LLVM_DEBUG(dbgs() << "ASAN done instrumenting: " << FunctionModified << " "
2625 << F << "\n");
Kostya Serebryany9f5213f2013-06-26 09:18:17 +00002626
Etienne Bergeron78582b22016-09-15 15:45:05 +00002627 return FunctionModified;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002628}
2629
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00002630// Workaround for bug 11395: we don't want to instrument stack in functions
2631// with large assembly blobs (32-bit only), otherwise reg alloc may crash.
2632// FIXME: remove once the bug 11395 is fixed.
2633bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) {
2634 if (LongSize != 32) return false;
2635 CallInst *CI = dyn_cast<CallInst>(I);
2636 if (!CI || !CI->isInlineAsm()) return false;
2637 if (CI->getNumArgOperands() <= 5) return false;
2638 // We have inline assembly with quite a few arguments.
2639 return true;
2640}
2641
2642void FunctionStackPoisoner::initializeCallbacks(Module &M) {
2643 IRBuilder<> IRB(*C);
Kostya Serebryany6805de52013-09-10 13:16:56 +00002644 for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) {
2645 std::string Suffix = itostr(i);
Mehdi Aminidb11fdf2017-04-06 20:23:57 +00002646 AsanStackMallocFunc[i] = checkSanitizerInterfaceFunction(
2647 M.getOrInsertFunction(kAsanStackMallocNameTemplate + Suffix, IntptrTy,
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002648 IntptrTy));
Ismail Pazarbasi198d6d52015-04-06 21:09:08 +00002649 AsanStackFreeFunc[i] = checkSanitizerInterfaceFunction(
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00002650 M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix,
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002651 IRB.getVoidTy(), IntptrTy, IntptrTy));
Kostya Serebryany6805de52013-09-10 13:16:56 +00002652 }
Vitaly Buka79b75d32016-06-09 23:05:35 +00002653 if (ASan.UseAfterScope) {
Mehdi Aminidb11fdf2017-04-06 20:23:57 +00002654 AsanPoisonStackMemoryFunc = checkSanitizerInterfaceFunction(
2655 M.getOrInsertFunction(kAsanPoisonStackMemoryName, IRB.getVoidTy(),
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002656 IntptrTy, IntptrTy));
Mehdi Aminidb11fdf2017-04-06 20:23:57 +00002657 AsanUnpoisonStackMemoryFunc = checkSanitizerInterfaceFunction(
2658 M.getOrInsertFunction(kAsanUnpoisonStackMemoryName, IRB.getVoidTy(),
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002659 IntptrTy, IntptrTy));
Vitaly Buka79b75d32016-06-09 23:05:35 +00002660 }
2661
Vitaly Buka8e1906e2016-10-18 18:04:59 +00002662 for (size_t Val : {0x00, 0xf1, 0xf2, 0xf3, 0xf5, 0xf8}) {
2663 std::ostringstream Name;
2664 Name << kAsanSetShadowPrefix;
2665 Name << std::setw(2) << std::setfill('0') << std::hex << Val;
Mehdi Aminidb11fdf2017-04-06 20:23:57 +00002666 AsanSetShadowFunc[Val] =
2667 checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002668 Name.str(), IRB.getVoidTy(), IntptrTy, IntptrTy));
Vitaly Buka3455b9b2016-08-20 18:34:39 +00002669 }
2670
Yury Gribov98b18592015-05-28 07:51:49 +00002671 AsanAllocaPoisonFunc = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002672 kAsanAllocaPoison, IRB.getVoidTy(), IntptrTy, IntptrTy));
Yury Gribov98b18592015-05-28 07:51:49 +00002673 AsanAllocasUnpoisonFunc =
2674 checkSanitizerInterfaceFunction(M.getOrInsertFunction(
Serge Guelton59a2d7b2017-04-11 15:01:18 +00002675 kAsanAllocasUnpoison, IRB.getVoidTy(), IntptrTy, IntptrTy));
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00002676}
2677
Vitaly Buka793913c2016-08-29 18:17:21 +00002678void FunctionStackPoisoner::copyToShadowInline(ArrayRef<uint8_t> ShadowMask,
2679 ArrayRef<uint8_t> ShadowBytes,
2680 size_t Begin, size_t End,
2681 IRBuilder<> &IRB,
2682 Value *ShadowBase) {
Vitaly Buka1f9e1352016-08-20 20:23:50 +00002683 if (Begin >= End)
2684 return;
Vitaly Buka186280d2016-08-20 18:34:36 +00002685
2686 const size_t LargestStoreSizeInBytes =
2687 std::min<size_t>(sizeof(uint64_t), ASan.LongSize / 8);
2688
2689 const bool IsLittleEndian = F.getParent()->getDataLayout().isLittleEndian();
2690
2691 // Poison given range in shadow using larges store size with out leading and
Vitaly Buka793913c2016-08-29 18:17:21 +00002692 // trailing zeros in ShadowMask. Zeros never change, so they need neither
2693 // poisoning nor up-poisoning. Still we don't mind if some of them get into a
2694 // middle of a store.
Vitaly Buka1f9e1352016-08-20 20:23:50 +00002695 for (size_t i = Begin; i < End;) {
Vitaly Buka793913c2016-08-29 18:17:21 +00002696 if (!ShadowMask[i]) {
2697 assert(!ShadowBytes[i]);
Vitaly Buka186280d2016-08-20 18:34:36 +00002698 ++i;
2699 continue;
2700 }
2701
2702 size_t StoreSizeInBytes = LargestStoreSizeInBytes;
2703 // Fit store size into the range.
2704 while (StoreSizeInBytes > End - i)
2705 StoreSizeInBytes /= 2;
2706
2707 // Minimize store size by trimming trailing zeros.
Vitaly Buka793913c2016-08-29 18:17:21 +00002708 for (size_t j = StoreSizeInBytes - 1; j && !ShadowMask[i + j]; --j) {
Vitaly Buka186280d2016-08-20 18:34:36 +00002709 while (j <= StoreSizeInBytes / 2)
2710 StoreSizeInBytes /= 2;
2711 }
2712
2713 uint64_t Val = 0;
Vitaly Buka793913c2016-08-29 18:17:21 +00002714 for (size_t j = 0; j < StoreSizeInBytes; j++) {
2715 if (IsLittleEndian)
2716 Val |= (uint64_t)ShadowBytes[i + j] << (8 * j);
2717 else
2718 Val = (Val << 8) | ShadowBytes[i + j];
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002719 }
Vitaly Buka186280d2016-08-20 18:34:36 +00002720
2721 Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i));
2722 Value *Poison = IRB.getIntN(StoreSizeInBytes * 8, Val);
Vitaly Buka0672a272016-08-22 04:16:14 +00002723 IRB.CreateAlignedStore(
2724 Poison, IRB.CreateIntToPtr(Ptr, Poison->getType()->getPointerTo()), 1);
Vitaly Buka186280d2016-08-20 18:34:36 +00002725
2726 i += StoreSizeInBytes;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002727 }
2728}
2729
Vitaly Buka793913c2016-08-29 18:17:21 +00002730void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask,
2731 ArrayRef<uint8_t> ShadowBytes,
2732 IRBuilder<> &IRB, Value *ShadowBase) {
2733 copyToShadow(ShadowMask, ShadowBytes, 0, ShadowMask.size(), IRB, ShadowBase);
2734}
Vitaly Buka1f9e1352016-08-20 20:23:50 +00002735
Vitaly Buka793913c2016-08-29 18:17:21 +00002736void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask,
2737 ArrayRef<uint8_t> ShadowBytes,
2738 size_t Begin, size_t End,
2739 IRBuilder<> &IRB, Value *ShadowBase) {
2740 assert(ShadowMask.size() == ShadowBytes.size());
2741 size_t Done = Begin;
2742 for (size_t i = Begin, j = Begin + 1; i < End; i = j++) {
2743 if (!ShadowMask[i]) {
2744 assert(!ShadowBytes[i]);
Vitaly Buka1f9e1352016-08-20 20:23:50 +00002745 continue;
Vitaly Buka793913c2016-08-29 18:17:21 +00002746 }
2747 uint8_t Val = ShadowBytes[i];
Vitaly Buka1f9e1352016-08-20 20:23:50 +00002748 if (!AsanSetShadowFunc[Val])
2749 continue;
2750
2751 // Skip same values.
Vitaly Buka793913c2016-08-29 18:17:21 +00002752 for (; j < End && ShadowMask[j] && Val == ShadowBytes[j]; ++j) {
Vitaly Buka1f9e1352016-08-20 20:23:50 +00002753 }
2754
2755 if (j - i >= ClMaxInlinePoisoningSize) {
Vitaly Buka793913c2016-08-29 18:17:21 +00002756 copyToShadowInline(ShadowMask, ShadowBytes, Done, i, IRB, ShadowBase);
Vitaly Buka1f9e1352016-08-20 20:23:50 +00002757 IRB.CreateCall(AsanSetShadowFunc[Val],
2758 {IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)),
2759 ConstantInt::get(IntptrTy, j - i)});
2760 Done = j;
2761 }
2762 }
2763
Vitaly Buka793913c2016-08-29 18:17:21 +00002764 copyToShadowInline(ShadowMask, ShadowBytes, Done, End, IRB, ShadowBase);
Vitaly Buka1f9e1352016-08-20 20:23:50 +00002765}
2766
Kostya Serebryany6805de52013-09-10 13:16:56 +00002767// Fake stack allocator (asan_fake_stack.h) has 11 size classes
2768// for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass
2769static int StackMallocSizeClass(uint64_t LocalStackSize) {
2770 assert(LocalStackSize <= kMaxStackMallocSize);
2771 uint64_t MaxSize = kMinStackMallocSize;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002772 for (int i = 0;; i++, MaxSize *= 2)
2773 if (LocalStackSize <= MaxSize) return i;
Kostya Serebryany6805de52013-09-10 13:16:56 +00002774 llvm_unreachable("impossible LocalStackSize");
2775}
2776
Vitaly Buka74443f02017-07-18 22:28:03 +00002777void FunctionStackPoisoner::copyArgsPassedByValToAllocas() {
Matt Morehouse49e5aca2017-08-09 17:59:43 +00002778 Instruction *CopyInsertPoint = &F.front().front();
2779 if (CopyInsertPoint == ASan.LocalDynamicShadow) {
2780 // Insert after the dynamic shadow location is determined
2781 CopyInsertPoint = CopyInsertPoint->getNextNode();
2782 assert(CopyInsertPoint);
2783 }
2784 IRBuilder<> IRB(CopyInsertPoint);
Vitaly Buka74443f02017-07-18 22:28:03 +00002785 const DataLayout &DL = F.getParent()->getDataLayout();
2786 for (Argument &Arg : F.args()) {
2787 if (Arg.hasByValAttr()) {
2788 Type *Ty = Arg.getType()->getPointerElementType();
2789 unsigned Align = Arg.getParamAlignment();
2790 if (Align == 0) Align = DL.getABITypeAlignment(Ty);
2791
Benjamin Kramer3a13ed62017-12-28 16:58:54 +00002792 AllocaInst *AI = IRB.CreateAlloca(
2793 Ty, nullptr,
2794 (Arg.hasName() ? Arg.getName() : "Arg" + Twine(Arg.getArgNo())) +
2795 ".byval");
Vitaly Buka74443f02017-07-18 22:28:03 +00002796 AI->setAlignment(Align);
2797 Arg.replaceAllUsesWith(AI);
2798
2799 uint64_t AllocSize = DL.getTypeAllocSize(Ty);
Daniel Neilsona98d9d92018-02-08 21:26:12 +00002800 IRB.CreateMemCpy(AI, Align, &Arg, Align, AllocSize);
Vitaly Buka74443f02017-07-18 22:28:03 +00002801 }
2802 }
2803}
2804
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00002805PHINode *FunctionStackPoisoner::createPHI(IRBuilder<> &IRB, Value *Cond,
2806 Value *ValueIfTrue,
2807 Instruction *ThenTerm,
2808 Value *ValueIfFalse) {
2809 PHINode *PHI = IRB.CreatePHI(IntptrTy, 2);
2810 BasicBlock *CondBlock = cast<Instruction>(Cond)->getParent();
2811 PHI->addIncoming(ValueIfFalse, CondBlock);
2812 BasicBlock *ThenBlock = ThenTerm->getParent();
2813 PHI->addIncoming(ValueIfTrue, ThenBlock);
2814 return PHI;
2815}
2816
2817Value *FunctionStackPoisoner::createAllocaForLayout(
2818 IRBuilder<> &IRB, const ASanStackFrameLayout &L, bool Dynamic) {
2819 AllocaInst *Alloca;
2820 if (Dynamic) {
2821 Alloca = IRB.CreateAlloca(IRB.getInt8Ty(),
2822 ConstantInt::get(IRB.getInt64Ty(), L.FrameSize),
2823 "MyAlloca");
2824 } else {
2825 Alloca = IRB.CreateAlloca(ArrayType::get(IRB.getInt8Ty(), L.FrameSize),
2826 nullptr, "MyAlloca");
2827 assert(Alloca->isStaticAlloca());
2828 }
2829 assert((ClRealignStack & (ClRealignStack - 1)) == 0);
2830 size_t FrameAlignment = std::max(L.FrameAlignment, (size_t)ClRealignStack);
2831 Alloca->setAlignment(FrameAlignment);
2832 return IRB.CreatePointerCast(Alloca, IntptrTy);
2833}
2834
Yury Gribov98b18592015-05-28 07:51:49 +00002835void FunctionStackPoisoner::createDynamicAllocasInitStorage() {
2836 BasicBlock &FirstBB = *F.begin();
2837 IRBuilder<> IRB(dyn_cast<Instruction>(FirstBB.begin()));
2838 DynamicAllocaLayout = IRB.CreateAlloca(IntptrTy, nullptr);
2839 IRB.CreateStore(Constant::getNullValue(IntptrTy), DynamicAllocaLayout);
2840 DynamicAllocaLayout->setAlignment(32);
2841}
2842
Vitaly Buka5b4f1212016-08-20 17:22:27 +00002843void FunctionStackPoisoner::processDynamicAllocas() {
2844 if (!ClInstrumentDynamicAllocas || DynamicAllocaVec.empty()) {
2845 assert(DynamicAllocaPoisonCallVec.empty());
2846 return;
2847 }
Yury Gribov55441bb2014-11-21 10:29:50 +00002848
Vitaly Buka5b4f1212016-08-20 17:22:27 +00002849 // Insert poison calls for lifetime intrinsics for dynamic allocas.
2850 for (const auto &APC : DynamicAllocaPoisonCallVec) {
Alexey Samsonov8daaf8b2015-10-22 19:51:59 +00002851 assert(APC.InsBefore);
2852 assert(APC.AI);
Vitaly Bukab451f1b2016-06-09 23:31:59 +00002853 assert(ASan.isInterestingAlloca(*APC.AI));
Vitaly Buka5b4f1212016-08-20 17:22:27 +00002854 assert(!APC.AI->isStaticAlloca());
Vitaly Bukab451f1b2016-06-09 23:31:59 +00002855
Alexey Samsonov8daaf8b2015-10-22 19:51:59 +00002856 IRBuilder<> IRB(APC.InsBefore);
2857 poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison);
Vitaly Bukab451f1b2016-06-09 23:31:59 +00002858 // Dynamic allocas will be unpoisoned unconditionally below in
2859 // unpoisonDynamicAllocas.
2860 // Flag that we need unpoison static allocas.
Alexey Samsonov8daaf8b2015-10-22 19:51:59 +00002861 }
2862
Vitaly Buka5b4f1212016-08-20 17:22:27 +00002863 // Handle dynamic allocas.
2864 createDynamicAllocasInitStorage();
2865 for (auto &AI : DynamicAllocaVec)
2866 handleDynamicAllocaCall(AI);
2867 unpoisonDynamicAllocas();
2868}
Yury Gribov98b18592015-05-28 07:51:49 +00002869
Vitaly Buka5b4f1212016-08-20 17:22:27 +00002870void FunctionStackPoisoner::processStaticAllocas() {
2871 if (AllocaVec.empty()) {
2872 assert(StaticAllocaPoisonCallVec.empty());
2873 return;
Kuba Breckaf5875d32015-02-24 09:47:05 +00002874 }
Yury Gribov55441bb2014-11-21 10:29:50 +00002875
Kostya Serebryany6805de52013-09-10 13:16:56 +00002876 int StackMallocIdx = -1;
Alexey Samsonov773e8c32015-06-26 00:00:47 +00002877 DebugLoc EntryDebugLocation;
Pete Cooperadebb932016-03-11 02:14:16 +00002878 if (auto SP = F.getSubprogram())
Alexey Samsonov773e8c32015-06-26 00:00:47 +00002879 EntryDebugLocation = DebugLoc::get(SP->getScopeLine(), 0, SP);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002880
2881 Instruction *InsBefore = AllocaVec[0];
2882 IRBuilder<> IRB(InsBefore);
Evgeniy Stepanovaaf4bb22014-05-14 10:30:15 +00002883 IRB.SetCurrentDebugLocation(EntryDebugLocation);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002884
Kuba Brecka8ec94ea2015-07-22 10:25:38 +00002885 // Make sure non-instrumented allocas stay in the entry block. Otherwise,
2886 // debug info is broken, because only entry-block allocas are treated as
2887 // regular stack slots.
2888 auto InsBeforeB = InsBefore->getParent();
2889 assert(InsBeforeB == &F.getEntryBlock());
Kuba Breckaa49dcbb2016-11-08 21:30:41 +00002890 for (auto *AI : StaticAllocasToMoveUp)
2891 if (AI->getParent() == InsBeforeB)
2892 AI->moveBefore(InsBefore);
Kuba Brecka37a5ffa2015-07-17 06:29:57 +00002893
Reid Kleckner2f907552015-07-21 17:40:14 +00002894 // If we have a call to llvm.localescape, keep it in the entry block.
2895 if (LocalEscapeCall) LocalEscapeCall->moveBefore(InsBefore);
2896
Kostya Serebryany4fb78012013-12-06 09:00:17 +00002897 SmallVector<ASanStackVariableDescription, 16> SVD;
2898 SVD.reserve(AllocaVec.size());
Alexey Samsonova02e6642014-05-29 18:40:48 +00002899 for (AllocaInst *AI : AllocaVec) {
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00002900 ASanStackVariableDescription D = {AI->getName().data(),
Vitaly Buka21a9e572016-07-28 22:50:50 +00002901 ASan.getAllocaSizeInBytes(*AI),
Vitaly Bukad88e5202016-10-18 23:29:41 +00002902 0,
Vitaly Bukaf9fd63a2016-08-20 16:48:24 +00002903 AI->getAlignment(),
2904 AI,
Vitaly Bukad88e5202016-10-18 23:29:41 +00002905 0,
Vitaly Bukaf9fd63a2016-08-20 16:48:24 +00002906 0};
Kostya Serebryany4fb78012013-12-06 09:00:17 +00002907 SVD.push_back(D);
2908 }
Vitaly Buka5910a922016-10-18 23:29:52 +00002909
Kostya Serebryany4fb78012013-12-06 09:00:17 +00002910 // Minimal header size (left redzone) is 4 pointers,
2911 // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms.
Walter Lee2a2b69e2017-11-16 12:57:19 +00002912 size_t Granularity = 1ULL << Mapping.Scale;
2913 size_t MinHeaderSize = std::max((size_t)ASan.LongSize / 2, Granularity);
Vitaly Bukadb331d82016-08-29 17:41:29 +00002914 const ASanStackFrameLayout &L =
Walter Lee2a2b69e2017-11-16 12:57:19 +00002915 ComputeASanStackFrameLayout(SVD, Granularity, MinHeaderSize);
Vitaly Buka793913c2016-08-29 18:17:21 +00002916
Vitaly Buka5910a922016-10-18 23:29:52 +00002917 // Build AllocaToSVDMap for ASanStackVariableDescription lookup.
2918 DenseMap<const AllocaInst *, ASanStackVariableDescription *> AllocaToSVDMap;
2919 for (auto &Desc : SVD)
2920 AllocaToSVDMap[Desc.AI] = &Desc;
2921
2922 // Update SVD with information from lifetime intrinsics.
2923 for (const auto &APC : StaticAllocaPoisonCallVec) {
2924 assert(APC.InsBefore);
2925 assert(APC.AI);
2926 assert(ASan.isInterestingAlloca(*APC.AI));
2927 assert(APC.AI->isStaticAlloca());
2928
2929 ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI];
2930 Desc.LifetimeSize = Desc.Size;
2931 if (const DILocation *FnLoc = EntryDebugLocation.get()) {
2932 if (const DILocation *LifetimeLoc = APC.InsBefore->getDebugLoc().get()) {
2933 if (LifetimeLoc->getFile() == FnLoc->getFile())
2934 if (unsigned Line = LifetimeLoc->getLine())
2935 Desc.Line = std::min(Desc.Line ? Desc.Line : Line, Line);
2936 }
2937 }
2938 }
2939
2940 auto DescriptionString = ComputeASanStackFrameDescription(SVD);
Nicola Zaghend34e60c2018-05-14 12:53:11 +00002941 LLVM_DEBUG(dbgs() << DescriptionString << " --- " << L.FrameSize << "\n");
Kostya Serebryany4fb78012013-12-06 09:00:17 +00002942 uint64_t LocalStackSize = L.FrameSize;
Alexander Potapenkob9b73ef2015-06-19 12:19:07 +00002943 bool DoStackMalloc = ClUseAfterReturn && !ASan.CompileKernel &&
2944 LocalStackSize <= kMaxStackMallocSize;
Alexey Samsonov869a5ff2015-07-29 19:36:08 +00002945 bool DoDynamicAlloca = ClDynamicAllocaStack;
2946 // Don't do dynamic alloca or stack malloc if:
2947 // 1) There is inline asm: too often it makes assumptions on which registers
2948 // are available.
2949 // 2) There is a returns_twice call (typically setjmp), which is
2950 // optimization-hostile, and doesn't play well with introduced indirect
2951 // register-relative calculation of local variable addresses.
2952 DoDynamicAlloca &= !HasNonEmptyInlineAsm && !HasReturnsTwiceCall;
2953 DoStackMalloc &= !HasNonEmptyInlineAsm && !HasReturnsTwiceCall;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002954
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00002955 Value *StaticAlloca =
2956 DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false);
2957
2958 Value *FakeStack;
2959 Value *LocalStackBase;
Adrian Prantl3c6c14d2017-12-11 20:43:21 +00002960 Value *LocalStackBaseAlloca;
2961 bool Deref;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00002962
2963 if (DoStackMalloc) {
Adrian Prantl3c6c14d2017-12-11 20:43:21 +00002964 LocalStackBaseAlloca =
2965 IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base");
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00002966 // void *FakeStack = __asan_option_detect_stack_use_after_return
2967 // ? __asan_stack_malloc_N(LocalStackSize)
2968 // : nullptr;
2969 // void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize);
Vitaly Buka7b8ed4f2016-06-02 00:06:42 +00002970 Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal(
2971 kAsanOptionDetectUseAfterReturn, IRB.getInt32Ty());
2972 Value *UseAfterReturnIsEnabled =
2973 IRB.CreateICmpNE(IRB.CreateLoad(OptionDetectUseAfterReturn),
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00002974 Constant::getNullValue(IRB.getInt32Ty()));
2975 Instruction *Term =
Vitaly Buka7b8ed4f2016-06-02 00:06:42 +00002976 SplitBlockAndInsertIfThen(UseAfterReturnIsEnabled, InsBefore, false);
Kostya Serebryanyf3223822013-09-18 14:07:14 +00002977 IRBuilder<> IRBIf(Term);
Evgeniy Stepanovaaf4bb22014-05-14 10:30:15 +00002978 IRBIf.SetCurrentDebugLocation(EntryDebugLocation);
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00002979 StackMallocIdx = StackMallocSizeClass(LocalStackSize);
2980 assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass);
2981 Value *FakeStackValue =
2982 IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx],
2983 ConstantInt::get(IntptrTy, LocalStackSize));
Kostya Serebryanyf3223822013-09-18 14:07:14 +00002984 IRB.SetInsertPoint(InsBefore);
Evgeniy Stepanovaaf4bb22014-05-14 10:30:15 +00002985 IRB.SetCurrentDebugLocation(EntryDebugLocation);
Vitaly Buka7b8ed4f2016-06-02 00:06:42 +00002986 FakeStack = createPHI(IRB, UseAfterReturnIsEnabled, FakeStackValue, Term,
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00002987 ConstantInt::get(IntptrTy, 0));
2988
2989 Value *NoFakeStack =
2990 IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy));
2991 Term = SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false);
2992 IRBIf.SetInsertPoint(Term);
2993 IRBIf.SetCurrentDebugLocation(EntryDebugLocation);
2994 Value *AllocaValue =
2995 DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca;
Adrian Prantl3c6c14d2017-12-11 20:43:21 +00002996
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00002997 IRB.SetInsertPoint(InsBefore);
2998 IRB.SetCurrentDebugLocation(EntryDebugLocation);
2999 LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
Adrian Prantl3c6c14d2017-12-11 20:43:21 +00003000 IRB.SetCurrentDebugLocation(EntryDebugLocation);
3001 IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca);
3002 Deref = true;
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00003003 } else {
3004 // void *FakeStack = nullptr;
3005 // void *LocalStackBase = alloca(LocalStackSize);
3006 FakeStack = ConstantInt::get(IntptrTy, 0);
3007 LocalStackBase =
3008 DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca;
Adrian Prantl3c6c14d2017-12-11 20:43:21 +00003009 LocalStackBaseAlloca = LocalStackBase;
3010 Deref = false;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003011 }
3012
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003013 // Replace Alloca instructions with base+offset.
Alexey Samsonova02e6642014-05-29 18:40:48 +00003014 for (const auto &Desc : SVD) {
3015 AllocaInst *AI = Desc.AI;
Adrian Prantl3c6c14d2017-12-11 20:43:21 +00003016 replaceDbgDeclareForAlloca(AI, LocalStackBaseAlloca, DIB, Deref,
3017 Desc.Offset, DIExpression::NoDeref);
Alexey Samsonov261177a2012-12-04 01:34:23 +00003018 Value *NewAllocaPtr = IRB.CreateIntToPtr(
Alexey Samsonova02e6642014-05-29 18:40:48 +00003019 IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)),
Kostya Serebryany4fb78012013-12-06 09:00:17 +00003020 AI->getType());
Alexey Samsonov261177a2012-12-04 01:34:23 +00003021 AI->replaceAllUsesWith(NewAllocaPtr);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003022 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003023
Kostya Serebryanycdd35a92013-03-22 10:37:20 +00003024 // The left-most redzone has enough space for at least 4 pointers.
3025 // Write the Magic value to redzone[0].
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003026 Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy);
3027 IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic),
3028 BasePlus0);
Kostya Serebryanycdd35a92013-03-22 10:37:20 +00003029 // Write the frame description constant to redzone[1].
3030 Value *BasePlus1 = IRB.CreateIntToPtr(
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00003031 IRB.CreateAdd(LocalStackBase,
3032 ConstantInt::get(IntptrTy, ASan.LongSize / 8)),
3033 IntptrPtrTy);
Alexey Samsonov9bdb63a2012-11-02 12:20:34 +00003034 GlobalVariable *StackDescriptionGlobal =
Vitaly Buka5910a922016-10-18 23:29:52 +00003035 createPrivateGlobalForString(*F.getParent(), DescriptionString,
Kostya Serebryanyd891ac92018-10-11 23:03:27 +00003036 /*AllowMerging*/ true, kAsanGenPrefix);
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00003037 Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003038 IRB.CreateStore(Description, BasePlus1);
Kostya Serebryanycdd35a92013-03-22 10:37:20 +00003039 // Write the PC to redzone[2].
3040 Value *BasePlus2 = IRB.CreateIntToPtr(
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00003041 IRB.CreateAdd(LocalStackBase,
3042 ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)),
3043 IntptrPtrTy);
Kostya Serebryanycdd35a92013-03-22 10:37:20 +00003044 IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003045
Vitaly Buka793913c2016-08-29 18:17:21 +00003046 const auto &ShadowAfterScope = GetShadowBytesAfterScope(SVD, L);
3047
3048 // Poison the stack red zones at the entry.
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00003049 Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB);
Vitaly Buka793913c2016-08-29 18:17:21 +00003050 // As mask we must use most poisoned case: red zones and after scope.
3051 // As bytes we can use either the same or just red zones only.
3052 copyToShadow(ShadowAfterScope, ShadowAfterScope, IRB, ShadowBase);
3053
Vitaly Buka8e1906e2016-10-18 18:04:59 +00003054 if (!StaticAllocaPoisonCallVec.empty()) {
Vitaly Buka793913c2016-08-29 18:17:21 +00003055 const auto &ShadowInScope = GetShadowBytes(SVD, L);
3056
3057 // Poison static allocas near lifetime intrinsics.
3058 for (const auto &APC : StaticAllocaPoisonCallVec) {
Vitaly Buka5910a922016-10-18 23:29:52 +00003059 const ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI];
Vitaly Buka793913c2016-08-29 18:17:21 +00003060 assert(Desc.Offset % L.Granularity == 0);
3061 size_t Begin = Desc.Offset / L.Granularity;
3062 size_t End = Begin + (APC.Size + L.Granularity - 1) / L.Granularity;
3063
3064 IRBuilder<> IRB(APC.InsBefore);
3065 copyToShadow(ShadowAfterScope,
3066 APC.DoPoison ? ShadowAfterScope : ShadowInScope, Begin, End,
3067 IRB, ShadowBase);
3068 }
3069 }
3070
3071 SmallVector<uint8_t, 64> ShadowClean(ShadowAfterScope.size(), 0);
Vitaly Buka793913c2016-08-29 18:17:21 +00003072 SmallVector<uint8_t, 64> ShadowAfterReturn;
Vitaly Buka186280d2016-08-20 18:34:36 +00003073
Kostya Serebryany530e2072013-12-23 14:15:08 +00003074 // (Un)poison the stack before all ret instructions.
Alexey Samsonova02e6642014-05-29 18:40:48 +00003075 for (auto Ret : RetVec) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003076 IRBuilder<> IRBRet(Ret);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003077 // Mark the current frame as retired.
3078 IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic),
3079 BasePlus0);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003080 if (DoStackMalloc) {
Kostya Serebryany6805de52013-09-10 13:16:56 +00003081 assert(StackMallocIdx >= 0);
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00003082 // if FakeStack != 0 // LocalStackBase == FakeStack
Kostya Serebryany530e2072013-12-23 14:15:08 +00003083 // // In use-after-return mode, poison the whole stack frame.
3084 // if StackMallocIdx <= 4
3085 // // For small sizes inline the whole thing:
3086 // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize);
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00003087 // **SavedFlagPtr(FakeStack) = 0
Kostya Serebryany530e2072013-12-23 14:15:08 +00003088 // else
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00003089 // __asan_stack_free_N(FakeStack, LocalStackSize)
Kostya Serebryany530e2072013-12-23 14:15:08 +00003090 // else
3091 // <This is not a fake stack; unpoison the redzones>
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00003092 Value *Cmp =
3093 IRBRet.CreateICmpNE(FakeStack, Constant::getNullValue(IntptrTy));
Chandler Carruth4a2d58e2018-10-15 09:34:05 +00003094 Instruction *ThenTerm, *ElseTerm;
Kostya Serebryany530e2072013-12-23 14:15:08 +00003095 SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm);
3096
3097 IRBuilder<> IRBPoison(ThenTerm);
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00003098 if (StackMallocIdx <= 4) {
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00003099 int ClassSize = kMinStackMallocSize << StackMallocIdx;
Vitaly Buka793913c2016-08-29 18:17:21 +00003100 ShadowAfterReturn.resize(ClassSize / L.Granularity,
3101 kAsanStackUseAfterReturnMagic);
3102 copyToShadow(ShadowAfterReturn, ShadowAfterReturn, IRBPoison,
3103 ShadowBase);
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00003104 Value *SavedFlagPtrPtr = IRBPoison.CreateAdd(
Alexey Samsonov4b7f4132014-12-11 21:53:03 +00003105 FakeStack,
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00003106 ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8));
3107 Value *SavedFlagPtr = IRBPoison.CreateLoad(
3108 IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy));
3109 IRBPoison.CreateStore(
3110 Constant::getNullValue(IRBPoison.getInt8Ty()),
3111 IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy()));
3112 } else {
3113 // For larger frames call __asan_stack_free_*.
David Blaikieff6409d2015-05-18 22:13:54 +00003114 IRBPoison.CreateCall(
3115 AsanStackFreeFunc[StackMallocIdx],
3116 {FakeStack, ConstantInt::get(IntptrTy, LocalStackSize)});
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00003117 }
Kostya Serebryany530e2072013-12-23 14:15:08 +00003118
3119 IRBuilder<> IRBElse(ElseTerm);
Vitaly Buka8e1906e2016-10-18 18:04:59 +00003120 copyToShadow(ShadowAfterScope, ShadowClean, IRBElse, ShadowBase);
Kostya Serebryany530e2072013-12-23 14:15:08 +00003121 } else {
Vitaly Buka8e1906e2016-10-18 18:04:59 +00003122 copyToShadow(ShadowAfterScope, ShadowClean, IRBRet, ShadowBase);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003123 }
3124 }
3125
Kostya Serebryany09959942012-10-19 06:20:53 +00003126 // We are done. Remove the old unused alloca instructions.
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00003127 for (auto AI : AllocaVec) AI->eraseFromParent();
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00003128}
Alexey Samsonov261177a2012-12-04 01:34:23 +00003129
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00003130void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size,
Jakub Staszak23ec6a92013-08-09 20:53:48 +00003131 IRBuilder<> &IRB, bool DoPoison) {
Alexey Samsonov261177a2012-12-04 01:34:23 +00003132 // For now just insert the call to ASan runtime.
3133 Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy);
3134 Value *SizeArg = ConstantInt::get(IntptrTy, Size);
Alexander Potapenkof90556e2015-06-12 11:27:06 +00003135 IRB.CreateCall(
3136 DoPoison ? AsanPoisonStackMemoryFunc : AsanUnpoisonStackMemoryFunc,
3137 {AddrArg, SizeArg});
Alexey Samsonov261177a2012-12-04 01:34:23 +00003138}
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00003139
3140// Handling llvm.lifetime intrinsics for a given %alloca:
3141// (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca.
3142// (2) if %size is constant, poison memory for llvm.lifetime.end (to detect
3143// invalid accesses) and unpoison it for llvm.lifetime.start (the memory
3144// could be poisoned by previous llvm.lifetime.end instruction, as the
3145// variable may go in and out of scope several times, e.g. in loops).
3146// (3) if we poisoned at least one %alloca in a function,
3147// unpoison the whole stack frame at function exit.
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00003148
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00003149AllocaInst *FunctionStackPoisoner::findAllocaForValue(Value *V) {
3150 if (AllocaInst *AI = dyn_cast<AllocaInst>(V))
Etienne Bergeron9bd42812016-09-14 15:59:32 +00003151 // We're interested only in allocas we can handle.
Anna Zaks8ed1d812015-02-27 03:12:36 +00003152 return ASan.isInterestingAlloca(*AI) ? AI : nullptr;
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00003153 // See if we've already calculated (or started to calculate) alloca for a
3154 // given value.
3155 AllocaForValueMapTy::iterator I = AllocaForValue.find(V);
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00003156 if (I != AllocaForValue.end()) return I->second;
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00003157 // Store 0 while we're calculating alloca for value V to avoid
3158 // infinite recursion if the value references itself.
Craig Topperf40110f2014-04-25 05:29:35 +00003159 AllocaForValue[V] = nullptr;
3160 AllocaInst *Res = nullptr;
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00003161 if (CastInst *CI = dyn_cast<CastInst>(V))
3162 Res = findAllocaForValue(CI->getOperand(0));
3163 else if (PHINode *PN = dyn_cast<PHINode>(V)) {
Pete Cooper833f34d2015-05-12 20:05:31 +00003164 for (Value *IncValue : PN->incoming_values()) {
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00003165 // Allow self-referencing phi-nodes.
3166 if (IncValue == PN) continue;
3167 AllocaInst *IncValueAI = findAllocaForValue(IncValue);
3168 // AI for incoming values should exist and should all be equal.
Craig Topperf40110f2014-04-25 05:29:35 +00003169 if (IncValueAI == nullptr || (Res != nullptr && IncValueAI != Res))
3170 return nullptr;
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00003171 Res = IncValueAI;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00003172 }
Vitaly Buka53054a72016-07-22 00:56:17 +00003173 } else if (GetElementPtrInst *EP = dyn_cast<GetElementPtrInst>(V)) {
3174 Res = findAllocaForValue(EP->getPointerOperand());
3175 } else {
Nicola Zaghend34e60c2018-05-14 12:53:11 +00003176 LLVM_DEBUG(dbgs() << "Alloca search canceled on unknown instruction: " << *V
3177 << "\n");
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00003178 }
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00003179 if (Res) AllocaForValue[V] = Res;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00003180 return Res;
3181}
Yury Gribov55441bb2014-11-21 10:29:50 +00003182
Yury Gribov98b18592015-05-28 07:51:49 +00003183void FunctionStackPoisoner::handleDynamicAllocaCall(AllocaInst *AI) {
Yury Gribov55441bb2014-11-21 10:29:50 +00003184 IRBuilder<> IRB(AI);
3185
Yury Gribov55441bb2014-11-21 10:29:50 +00003186 const unsigned Align = std::max(kAllocaRzSize, AI->getAlignment());
3187 const uint64_t AllocaRedzoneMask = kAllocaRzSize - 1;
3188
3189 Value *Zero = Constant::getNullValue(IntptrTy);
3190 Value *AllocaRzSize = ConstantInt::get(IntptrTy, kAllocaRzSize);
3191 Value *AllocaRzMask = ConstantInt::get(IntptrTy, AllocaRedzoneMask);
Yury Gribov55441bb2014-11-21 10:29:50 +00003192
3193 // Since we need to extend alloca with additional memory to locate
3194 // redzones, and OldSize is number of allocated blocks with
3195 // ElementSize size, get allocated memory size in bytes by
3196 // OldSize * ElementSize.
Yury Gribov98b18592015-05-28 07:51:49 +00003197 const unsigned ElementSize =
Mehdi Aminia28d91d2015-03-10 02:37:25 +00003198 F.getParent()->getDataLayout().getTypeAllocSize(AI->getAllocatedType());
Yury Gribov98b18592015-05-28 07:51:49 +00003199 Value *OldSize =
3200 IRB.CreateMul(IRB.CreateIntCast(AI->getArraySize(), IntptrTy, false),
3201 ConstantInt::get(IntptrTy, ElementSize));
Yury Gribov55441bb2014-11-21 10:29:50 +00003202
3203 // PartialSize = OldSize % 32
3204 Value *PartialSize = IRB.CreateAnd(OldSize, AllocaRzMask);
3205
3206 // Misalign = kAllocaRzSize - PartialSize;
3207 Value *Misalign = IRB.CreateSub(AllocaRzSize, PartialSize);
3208
3209 // PartialPadding = Misalign != kAllocaRzSize ? Misalign : 0;
3210 Value *Cond = IRB.CreateICmpNE(Misalign, AllocaRzSize);
3211 Value *PartialPadding = IRB.CreateSelect(Cond, Misalign, Zero);
3212
3213 // AdditionalChunkSize = Align + PartialPadding + kAllocaRzSize
3214 // Align is added to locate left redzone, PartialPadding for possible
3215 // partial redzone and kAllocaRzSize for right redzone respectively.
3216 Value *AdditionalChunkSize = IRB.CreateAdd(
3217 ConstantInt::get(IntptrTy, Align + kAllocaRzSize), PartialPadding);
3218
3219 Value *NewSize = IRB.CreateAdd(OldSize, AdditionalChunkSize);
3220
3221 // Insert new alloca with new NewSize and Align params.
3222 AllocaInst *NewAlloca = IRB.CreateAlloca(IRB.getInt8Ty(), NewSize);
3223 NewAlloca->setAlignment(Align);
3224
3225 // NewAddress = Address + Align
3226 Value *NewAddress = IRB.CreateAdd(IRB.CreatePtrToInt(NewAlloca, IntptrTy),
3227 ConstantInt::get(IntptrTy, Align));
3228
Yury Gribov98b18592015-05-28 07:51:49 +00003229 // Insert __asan_alloca_poison call for new created alloca.
Yury Gribov781bce22015-05-28 08:03:28 +00003230 IRB.CreateCall(AsanAllocaPoisonFunc, {NewAddress, OldSize});
Yury Gribov98b18592015-05-28 07:51:49 +00003231
3232 // Store the last alloca's address to DynamicAllocaLayout. We'll need this
3233 // for unpoisoning stuff.
3234 IRB.CreateStore(IRB.CreatePtrToInt(NewAlloca, IntptrTy), DynamicAllocaLayout);
3235
Yury Gribov55441bb2014-11-21 10:29:50 +00003236 Value *NewAddressPtr = IRB.CreateIntToPtr(NewAddress, AI->getType());
3237
Yury Gribov98b18592015-05-28 07:51:49 +00003238 // Replace all uses of AddessReturnedByAlloca with NewAddressPtr.
Yury Gribov55441bb2014-11-21 10:29:50 +00003239 AI->replaceAllUsesWith(NewAddressPtr);
3240
Yury Gribov98b18592015-05-28 07:51:49 +00003241 // We are done. Erase old alloca from parent.
Yury Gribov55441bb2014-11-21 10:29:50 +00003242 AI->eraseFromParent();
3243}
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00003244
3245// isSafeAccess returns true if Addr is always inbounds with respect to its
3246// base object. For example, it is a field access or an array access with
3247// constant inbounds index.
3248bool AddressSanitizer::isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis,
3249 Value *Addr, uint64_t TypeSize) const {
3250 SizeOffsetType SizeOffset = ObjSizeVis.compute(Addr);
3251 if (!ObjSizeVis.bothKnown(SizeOffset)) return false;
Dmitry Vyukovee842382015-03-16 08:04:26 +00003252 uint64_t Size = SizeOffset.first.getZExtValue();
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00003253 int64_t Offset = SizeOffset.second.getSExtValue();
3254 // Three checks are required to ensure safety:
3255 // . Offset >= 0 (since the offset is given from the base ptr)
3256 // . Size >= Offset (unsigned)
3257 // . Size - Offset >= NeededSize (unsigned)
Dmitry Vyukovee842382015-03-16 08:04:26 +00003258 return Offset >= 0 && Size >= uint64_t(Offset) &&
3259 Size - uint64_t(Offset) >= TypeSize / 8;
Dmitry Vyukovb37b95e2015-03-04 13:27:53 +00003260}