1 //===--- SanitizerArgs.cpp - Arguments for sanitizer tools ---------------===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 #include "clang/Driver/SanitizerArgs.h" 10 #include "ToolChains/CommonArgs.h" 11 #include "clang/Basic/Sanitizers.h" 12 #include "clang/Driver/Driver.h" 13 #include "clang/Driver/DriverDiagnostic.h" 14 #include "clang/Driver/Options.h" 15 #include "clang/Driver/ToolChain.h" 16 #include "llvm/ADT/StringExtras.h" 17 #include "llvm/ADT/StringSwitch.h" 18 #include "llvm/Support/FileSystem.h" 19 #include "llvm/Support/Path.h" 20 #include "llvm/Support/SpecialCaseList.h" 21 #include "llvm/Support/TargetParser.h" 22 #include <memory> 23 24 using namespace clang; 25 using namespace clang::SanitizerKind; 26 using namespace clang::driver; 27 using namespace llvm::opt; 28 29 enum : SanitizerMask { 30 NeedsUbsanRt = Undefined | Integer | Nullability | CFI, 31 NeedsUbsanCxxRt = Vptr | CFI, 32 NotAllowedWithTrap = Vptr, 33 NotAllowedWithMinimalRuntime = Vptr, 34 RequiresPIE = DataFlow | HWAddress | Scudo, 35 NeedsUnwindTables = Address | HWAddress | Thread | Memory | DataFlow, 36 SupportsCoverage = Address | HWAddress | KernelAddress | KernelHWAddress | 37 Memory | Leak | Undefined | Integer | Nullability | 38 DataFlow | Fuzzer | FuzzerNoLink, 39 RecoverableByDefault = Undefined | Integer | Nullability, 40 Unrecoverable = Unreachable | Return, 41 AlwaysRecoverable = KernelAddress | KernelHWAddress, 42 LegacyFsanitizeRecoverMask = Undefined | Integer, 43 NeedsLTO = CFI, 44 TrappingSupported = (Undefined & ~Vptr) | UnsignedIntegerOverflow | 45 Nullability | LocalBounds | CFI, 46 TrappingDefault = CFI, 47 CFIClasses = CFIVCall | CFINVCall | CFIDerivedCast | CFIUnrelatedCast, 48 CompatibleWithMinimalRuntime = TrappingSupported, 49 }; 50 51 enum CoverageFeature { 52 CoverageFunc = 1 << 0, 53 CoverageBB = 1 << 1, 54 CoverageEdge = 1 << 2, 55 CoverageIndirCall = 1 << 3, 56 CoverageTraceBB = 1 << 4, // Deprecated. 57 CoverageTraceCmp = 1 << 5, 58 CoverageTraceDiv = 1 << 6, 59 CoverageTraceGep = 1 << 7, 60 Coverage8bitCounters = 1 << 8, // Deprecated. 61 CoverageTracePC = 1 << 9, 62 CoverageTracePCGuard = 1 << 10, 63 CoverageNoPrune = 1 << 11, 64 CoverageInline8bitCounters = 1 << 12, 65 CoveragePCTable = 1 << 13, 66 CoverageStackDepth = 1 << 14, 67 }; 68 69 /// Parse a -fsanitize= or -fno-sanitize= argument's values, diagnosing any 70 /// invalid components. Returns a SanitizerMask. 71 static SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A, 72 bool DiagnoseErrors); 73 74 /// Parse -f(no-)?sanitize-coverage= flag values, diagnosing any invalid 75 /// components. Returns OR of members of \c CoverageFeature enumeration. 76 static int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A); 77 78 /// Produce an argument string from ArgList \p Args, which shows how it 79 /// provides some sanitizer kind from \p Mask. For example, the argument list 80 /// "-fsanitize=thread,vptr -fsanitize=address" with mask \c NeedsUbsanRt 81 /// would produce "-fsanitize=vptr". 82 static std::string lastArgumentForMask(const Driver &D, 83 const llvm::opt::ArgList &Args, 84 SanitizerMask Mask); 85 86 /// Produce an argument string from argument \p A, which shows how it provides 87 /// a value in \p Mask. For instance, the argument 88 /// "-fsanitize=address,alignment" with mask \c NeedsUbsanRt would produce 89 /// "-fsanitize=alignment". 90 static std::string describeSanitizeArg(const llvm::opt::Arg *A, 91 SanitizerMask Mask); 92 93 /// Produce a string containing comma-separated names of sanitizers in \p 94 /// Sanitizers set. 95 static std::string toString(const clang::SanitizerSet &Sanitizers); 96 97 static void addDefaultBlacklists(const Driver &D, SanitizerMask Kinds, 98 std::vector<std::string> &BlacklistFiles) { 99 struct Blacklist { 100 const char *File; 101 SanitizerMask Mask; 102 } Blacklists[] = {{"asan_blacklist.txt", Address}, 103 {"hwasan_blacklist.txt", HWAddress}, 104 {"msan_blacklist.txt", Memory}, 105 {"tsan_blacklist.txt", Thread}, 106 {"dfsan_abilist.txt", DataFlow}, 107 {"cfi_blacklist.txt", CFI}, 108 {"ubsan_blacklist.txt", Undefined | Integer | Nullability}}; 109 110 for (auto BL : Blacklists) { 111 if (!(Kinds & BL.Mask)) 112 continue; 113 114 clang::SmallString<64> Path(D.ResourceDir); 115 llvm::sys::path::append(Path, "share", BL.File); 116 if (llvm::sys::fs::exists(Path)) 117 BlacklistFiles.push_back(Path.str()); 118 } 119 } 120 121 /// Sets group bits for every group that has at least one representative already 122 /// enabled in \p Kinds. 123 static SanitizerMask setGroupBits(SanitizerMask Kinds) { 124 #define SANITIZER(NAME, ID) 125 #define SANITIZER_GROUP(NAME, ID, ALIAS) \ 126 if (Kinds & SanitizerKind::ID) \ 127 Kinds |= SanitizerKind::ID##Group; 128 #include "clang/Basic/Sanitizers.def" 129 return Kinds; 130 } 131 132 static SanitizerMask parseSanitizeTrapArgs(const Driver &D, 133 const llvm::opt::ArgList &Args) { 134 SanitizerMask TrapRemove = 0; // During the loop below, the accumulated set of 135 // sanitizers disabled by the current sanitizer 136 // argument or any argument after it. 137 SanitizerMask TrappingKinds = 0; 138 SanitizerMask TrappingSupportedWithGroups = setGroupBits(TrappingSupported); 139 140 for (ArgList::const_reverse_iterator I = Args.rbegin(), E = Args.rend(); 141 I != E; ++I) { 142 const auto *Arg = *I; 143 if (Arg->getOption().matches(options::OPT_fsanitize_trap_EQ)) { 144 Arg->claim(); 145 SanitizerMask Add = parseArgValues(D, Arg, true); 146 Add &= ~TrapRemove; 147 if (SanitizerMask InvalidValues = Add & ~TrappingSupportedWithGroups) { 148 SanitizerSet S; 149 S.Mask = InvalidValues; 150 D.Diag(diag::err_drv_unsupported_option_argument) << "-fsanitize-trap" 151 << toString(S); 152 } 153 TrappingKinds |= expandSanitizerGroups(Add) & ~TrapRemove; 154 } else if (Arg->getOption().matches(options::OPT_fno_sanitize_trap_EQ)) { 155 Arg->claim(); 156 TrapRemove |= expandSanitizerGroups(parseArgValues(D, Arg, true)); 157 } else if (Arg->getOption().matches( 158 options::OPT_fsanitize_undefined_trap_on_error)) { 159 Arg->claim(); 160 TrappingKinds |= 161 expandSanitizerGroups(UndefinedGroup & ~TrapRemove) & ~TrapRemove; 162 } else if (Arg->getOption().matches( 163 options::OPT_fno_sanitize_undefined_trap_on_error)) { 164 Arg->claim(); 165 TrapRemove |= expandSanitizerGroups(UndefinedGroup); 166 } 167 } 168 169 // Apply default trapping behavior. 170 TrappingKinds |= TrappingDefault & ~TrapRemove; 171 172 return TrappingKinds; 173 } 174 175 bool SanitizerArgs::needsUbsanRt() const { 176 // All of these include ubsan. 177 if (needsAsanRt() || needsMsanRt() || needsHwasanRt() || needsTsanRt() || 178 needsDfsanRt() || needsLsanRt() || needsCfiDiagRt() || needsScudoRt()) 179 return false; 180 181 return (Sanitizers.Mask & NeedsUbsanRt & ~TrapSanitizers.Mask) || 182 CoverageFeatures; 183 } 184 185 bool SanitizerArgs::needsCfiRt() const { 186 return !(Sanitizers.Mask & CFI & ~TrapSanitizers.Mask) && CfiCrossDso && 187 !ImplicitCfiRuntime; 188 } 189 190 bool SanitizerArgs::needsCfiDiagRt() const { 191 return (Sanitizers.Mask & CFI & ~TrapSanitizers.Mask) && CfiCrossDso && 192 !ImplicitCfiRuntime; 193 } 194 195 bool SanitizerArgs::requiresPIE() const { 196 return NeedPIE || (Sanitizers.Mask & RequiresPIE); 197 } 198 199 bool SanitizerArgs::needsUnwindTables() const { 200 return Sanitizers.Mask & NeedsUnwindTables; 201 } 202 203 SanitizerArgs::SanitizerArgs(const ToolChain &TC, 204 const llvm::opt::ArgList &Args) { 205 SanitizerMask AllRemove = 0; // During the loop below, the accumulated set of 206 // sanitizers disabled by the current sanitizer 207 // argument or any argument after it. 208 SanitizerMask AllAddedKinds = 0; // Mask of all sanitizers ever enabled by 209 // -fsanitize= flags (directly or via group 210 // expansion), some of which may be disabled 211 // later. Used to carefully prune 212 // unused-argument diagnostics. 213 SanitizerMask DiagnosedKinds = 0; // All Kinds we have diagnosed up to now. 214 // Used to deduplicate diagnostics. 215 SanitizerMask Kinds = 0; 216 const SanitizerMask Supported = setGroupBits(TC.getSupportedSanitizers()); 217 ToolChain::RTTIMode RTTIMode = TC.getRTTIMode(); 218 219 const Driver &D = TC.getDriver(); 220 SanitizerMask TrappingKinds = parseSanitizeTrapArgs(D, Args); 221 SanitizerMask InvalidTrappingKinds = TrappingKinds & NotAllowedWithTrap; 222 223 MinimalRuntime = 224 Args.hasFlag(options::OPT_fsanitize_minimal_runtime, 225 options::OPT_fno_sanitize_minimal_runtime, MinimalRuntime); 226 227 // The object size sanitizer should not be enabled at -O0. 228 Arg *OptLevel = Args.getLastArg(options::OPT_O_Group); 229 bool RemoveObjectSizeAtO0 = 230 !OptLevel || OptLevel->getOption().matches(options::OPT_O0); 231 232 for (ArgList::const_reverse_iterator I = Args.rbegin(), E = Args.rend(); 233 I != E; ++I) { 234 const auto *Arg = *I; 235 if (Arg->getOption().matches(options::OPT_fsanitize_EQ)) { 236 Arg->claim(); 237 SanitizerMask Add = parseArgValues(D, Arg, /*AllowGroups=*/true); 238 239 if (RemoveObjectSizeAtO0) { 240 AllRemove |= SanitizerKind::ObjectSize; 241 242 // The user explicitly enabled the object size sanitizer. Warn that 243 // that this does nothing at -O0. 244 if (Add & SanitizerKind::ObjectSize) 245 D.Diag(diag::warn_drv_object_size_disabled_O0) 246 << Arg->getAsString(Args); 247 } 248 249 AllAddedKinds |= expandSanitizerGroups(Add); 250 251 // Avoid diagnosing any sanitizer which is disabled later. 252 Add &= ~AllRemove; 253 // At this point we have not expanded groups, so any unsupported 254 // sanitizers in Add are those which have been explicitly enabled. 255 // Diagnose them. 256 if (SanitizerMask KindsToDiagnose = 257 Add & InvalidTrappingKinds & ~DiagnosedKinds) { 258 std::string Desc = describeSanitizeArg(*I, KindsToDiagnose); 259 D.Diag(diag::err_drv_argument_not_allowed_with) 260 << Desc << "-fsanitize-trap=undefined"; 261 DiagnosedKinds |= KindsToDiagnose; 262 } 263 Add &= ~InvalidTrappingKinds; 264 265 if (MinimalRuntime) { 266 if (SanitizerMask KindsToDiagnose = 267 Add & NotAllowedWithMinimalRuntime & ~DiagnosedKinds) { 268 std::string Desc = describeSanitizeArg(*I, KindsToDiagnose); 269 D.Diag(diag::err_drv_argument_not_allowed_with) 270 << Desc << "-fsanitize-minimal-runtime"; 271 DiagnosedKinds |= KindsToDiagnose; 272 } 273 Add &= ~NotAllowedWithMinimalRuntime; 274 } 275 276 if (SanitizerMask KindsToDiagnose = Add & ~Supported & ~DiagnosedKinds) { 277 std::string Desc = describeSanitizeArg(*I, KindsToDiagnose); 278 D.Diag(diag::err_drv_unsupported_opt_for_target) 279 << Desc << TC.getTriple().str(); 280 DiagnosedKinds |= KindsToDiagnose; 281 } 282 Add &= Supported; 283 284 // Test for -fno-rtti + explicit -fsanitizer=vptr before expanding groups 285 // so we don't error out if -fno-rtti and -fsanitize=undefined were 286 // passed. 287 if (Add & Vptr && 288 (RTTIMode == ToolChain::RM_DisabledImplicitly || 289 RTTIMode == ToolChain::RM_DisabledExplicitly)) { 290 if (RTTIMode == ToolChain::RM_DisabledImplicitly) 291 // Warn about not having rtti enabled if the vptr sanitizer is 292 // explicitly enabled 293 D.Diag(diag::warn_drv_disabling_vptr_no_rtti_default); 294 else { 295 const llvm::opt::Arg *NoRTTIArg = TC.getRTTIArg(); 296 assert(NoRTTIArg && 297 "RTTI disabled explicitly but we have no argument!"); 298 D.Diag(diag::err_drv_argument_not_allowed_with) 299 << "-fsanitize=vptr" << NoRTTIArg->getAsString(Args); 300 } 301 302 // Take out the Vptr sanitizer from the enabled sanitizers 303 AllRemove |= Vptr; 304 } 305 306 Add = expandSanitizerGroups(Add); 307 // Group expansion may have enabled a sanitizer which is disabled later. 308 Add &= ~AllRemove; 309 // Silently discard any unsupported sanitizers implicitly enabled through 310 // group expansion. 311 Add &= ~InvalidTrappingKinds; 312 if (MinimalRuntime) { 313 Add &= ~NotAllowedWithMinimalRuntime; 314 } 315 Add &= Supported; 316 317 if (Add & Fuzzer) 318 Add |= FuzzerNoLink; 319 320 // Enable coverage if the fuzzing flag is set. 321 if (Add & FuzzerNoLink) { 322 CoverageFeatures |= CoverageInline8bitCounters | CoverageIndirCall | 323 CoverageTraceCmp | CoveragePCTable; 324 // Due to TLS differences, stack depth tracking is only enabled on Linux 325 if (TC.getTriple().isOSLinux()) 326 CoverageFeatures |= CoverageStackDepth; 327 } 328 329 Kinds |= Add; 330 } else if (Arg->getOption().matches(options::OPT_fno_sanitize_EQ)) { 331 Arg->claim(); 332 SanitizerMask Remove = parseArgValues(D, Arg, true); 333 AllRemove |= expandSanitizerGroups(Remove); 334 } 335 } 336 337 std::pair<SanitizerMask, SanitizerMask> IncompatibleGroups[] = { 338 std::make_pair(Address, Thread | Memory), 339 std::make_pair(Thread, Memory), 340 std::make_pair(Leak, Thread | Memory), 341 std::make_pair(KernelAddress, Address | Leak | Thread | Memory), 342 std::make_pair(HWAddress, Address | Thread | Memory | KernelAddress), 343 std::make_pair(Efficiency, Address | HWAddress | Leak | Thread | Memory | 344 KernelAddress), 345 std::make_pair(Scudo, Address | HWAddress | Leak | Thread | Memory | 346 KernelAddress | Efficiency), 347 std::make_pair(SafeStack, Address | HWAddress | Leak | Thread | Memory | 348 KernelAddress | Efficiency), 349 std::make_pair(ShadowCallStack, Address | HWAddress | Leak | Thread | 350 Memory | KernelAddress | Efficiency | 351 SafeStack), 352 std::make_pair(KernelHWAddress, Address | HWAddress | Leak | Thread | 353 Memory | KernelAddress | Efficiency | 354 SafeStack | ShadowCallStack)}; 355 356 // Enable toolchain specific default sanitizers if not explicitly disabled. 357 SanitizerMask Default = TC.getDefaultSanitizers() & ~AllRemove; 358 359 // Disable default sanitizers that are incompatible with explicitly requested 360 // ones. 361 for (auto G : IncompatibleGroups) { 362 SanitizerMask Group = G.first; 363 if ((Default & Group) && (Kinds & G.second)) 364 Default &= ~Group; 365 } 366 367 Kinds |= Default; 368 369 // We disable the vptr sanitizer if it was enabled by group expansion but RTTI 370 // is disabled. 371 if ((Kinds & Vptr) && 372 (RTTIMode == ToolChain::RM_DisabledImplicitly || 373 RTTIMode == ToolChain::RM_DisabledExplicitly)) { 374 Kinds &= ~Vptr; 375 } 376 377 // Check that LTO is enabled if we need it. 378 if ((Kinds & NeedsLTO) && !D.isUsingLTO()) { 379 D.Diag(diag::err_drv_argument_only_allowed_with) 380 << lastArgumentForMask(D, Args, Kinds & NeedsLTO) << "-flto"; 381 } 382 383 if ((Kinds & ShadowCallStack) && 384 TC.getTriple().getArch() == llvm::Triple::aarch64 && 385 !llvm::AArch64::isX18ReservedByDefault(TC.getTriple()) && 386 !Args.hasArg(options::OPT_ffixed_x18)) { 387 D.Diag(diag::err_drv_argument_only_allowed_with) 388 << lastArgumentForMask(D, Args, Kinds & ShadowCallStack) 389 << "-ffixed-x18"; 390 } 391 392 // Report error if there are non-trapping sanitizers that require 393 // c++abi-specific parts of UBSan runtime, and they are not provided by the 394 // toolchain. We don't have a good way to check the latter, so we just 395 // check if the toolchan supports vptr. 396 if (~Supported & Vptr) { 397 SanitizerMask KindsToDiagnose = Kinds & ~TrappingKinds & NeedsUbsanCxxRt; 398 // The runtime library supports the Microsoft C++ ABI, but only well enough 399 // for CFI. FIXME: Remove this once we support vptr on Windows. 400 if (TC.getTriple().isOSWindows()) 401 KindsToDiagnose &= ~CFI; 402 if (KindsToDiagnose) { 403 SanitizerSet S; 404 S.Mask = KindsToDiagnose; 405 D.Diag(diag::err_drv_unsupported_opt_for_target) 406 << ("-fno-sanitize-trap=" + toString(S)) << TC.getTriple().str(); 407 Kinds &= ~KindsToDiagnose; 408 } 409 } 410 411 // Warn about incompatible groups of sanitizers. 412 for (auto G : IncompatibleGroups) { 413 SanitizerMask Group = G.first; 414 if (Kinds & Group) { 415 if (SanitizerMask Incompatible = Kinds & G.second) { 416 D.Diag(clang::diag::err_drv_argument_not_allowed_with) 417 << lastArgumentForMask(D, Args, Group) 418 << lastArgumentForMask(D, Args, Incompatible); 419 Kinds &= ~Incompatible; 420 } 421 } 422 } 423 // FIXME: Currently -fsanitize=leak is silently ignored in the presence of 424 // -fsanitize=address. Perhaps it should print an error, or perhaps 425 // -f(-no)sanitize=leak should change whether leak detection is enabled by 426 // default in ASan? 427 428 // Parse -f(no-)?sanitize-recover flags. 429 SanitizerMask RecoverableKinds = RecoverableByDefault | AlwaysRecoverable; 430 SanitizerMask DiagnosedUnrecoverableKinds = 0; 431 SanitizerMask DiagnosedAlwaysRecoverableKinds = 0; 432 for (const auto *Arg : Args) { 433 const char *DeprecatedReplacement = nullptr; 434 if (Arg->getOption().matches(options::OPT_fsanitize_recover)) { 435 DeprecatedReplacement = 436 "-fsanitize-recover=undefined,integer' or '-fsanitize-recover=all"; 437 RecoverableKinds |= expandSanitizerGroups(LegacyFsanitizeRecoverMask); 438 Arg->claim(); 439 } else if (Arg->getOption().matches(options::OPT_fno_sanitize_recover)) { 440 DeprecatedReplacement = "-fno-sanitize-recover=undefined,integer' or " 441 "'-fno-sanitize-recover=all"; 442 RecoverableKinds &= ~expandSanitizerGroups(LegacyFsanitizeRecoverMask); 443 Arg->claim(); 444 } else if (Arg->getOption().matches(options::OPT_fsanitize_recover_EQ)) { 445 SanitizerMask Add = parseArgValues(D, Arg, true); 446 // Report error if user explicitly tries to recover from unrecoverable 447 // sanitizer. 448 if (SanitizerMask KindsToDiagnose = 449 Add & Unrecoverable & ~DiagnosedUnrecoverableKinds) { 450 SanitizerSet SetToDiagnose; 451 SetToDiagnose.Mask |= KindsToDiagnose; 452 D.Diag(diag::err_drv_unsupported_option_argument) 453 << Arg->getOption().getName() << toString(SetToDiagnose); 454 DiagnosedUnrecoverableKinds |= KindsToDiagnose; 455 } 456 RecoverableKinds |= expandSanitizerGroups(Add); 457 Arg->claim(); 458 } else if (Arg->getOption().matches(options::OPT_fno_sanitize_recover_EQ)) { 459 SanitizerMask Remove = parseArgValues(D, Arg, true); 460 // Report error if user explicitly tries to disable recovery from 461 // always recoverable sanitizer. 462 if (SanitizerMask KindsToDiagnose = 463 Remove & AlwaysRecoverable & ~DiagnosedAlwaysRecoverableKinds) { 464 SanitizerSet SetToDiagnose; 465 SetToDiagnose.Mask |= KindsToDiagnose; 466 D.Diag(diag::err_drv_unsupported_option_argument) 467 << Arg->getOption().getName() << toString(SetToDiagnose); 468 DiagnosedAlwaysRecoverableKinds |= KindsToDiagnose; 469 } 470 RecoverableKinds &= ~expandSanitizerGroups(Remove); 471 Arg->claim(); 472 } 473 if (DeprecatedReplacement) { 474 D.Diag(diag::warn_drv_deprecated_arg) << Arg->getAsString(Args) 475 << DeprecatedReplacement; 476 } 477 } 478 RecoverableKinds &= Kinds; 479 RecoverableKinds &= ~Unrecoverable; 480 481 TrappingKinds &= Kinds; 482 RecoverableKinds &= ~TrappingKinds; 483 484 // Setup blacklist files. 485 // Add default blacklist from resource directory. 486 addDefaultBlacklists(D, Kinds, BlacklistFiles); 487 // Parse -f(no-)sanitize-blacklist options. 488 for (const auto *Arg : Args) { 489 if (Arg->getOption().matches(options::OPT_fsanitize_blacklist)) { 490 Arg->claim(); 491 std::string BLPath = Arg->getValue(); 492 if (llvm::sys::fs::exists(BLPath)) { 493 BlacklistFiles.push_back(BLPath); 494 ExtraDeps.push_back(BLPath); 495 } else { 496 D.Diag(clang::diag::err_drv_no_such_file) << BLPath; 497 } 498 } else if (Arg->getOption().matches(options::OPT_fno_sanitize_blacklist)) { 499 Arg->claim(); 500 BlacklistFiles.clear(); 501 ExtraDeps.clear(); 502 } 503 } 504 // Validate blacklists format. 505 { 506 std::string BLError; 507 std::unique_ptr<llvm::SpecialCaseList> SCL( 508 llvm::SpecialCaseList::create(BlacklistFiles, BLError)); 509 if (!SCL.get()) 510 D.Diag(clang::diag::err_drv_malformed_sanitizer_blacklist) << BLError; 511 } 512 513 // Parse -f[no-]sanitize-memory-track-origins[=level] options. 514 if (AllAddedKinds & Memory) { 515 if (Arg *A = 516 Args.getLastArg(options::OPT_fsanitize_memory_track_origins_EQ, 517 options::OPT_fsanitize_memory_track_origins, 518 options::OPT_fno_sanitize_memory_track_origins)) { 519 if (A->getOption().matches(options::OPT_fsanitize_memory_track_origins)) { 520 MsanTrackOrigins = 2; 521 } else if (A->getOption().matches( 522 options::OPT_fno_sanitize_memory_track_origins)) { 523 MsanTrackOrigins = 0; 524 } else { 525 StringRef S = A->getValue(); 526 if (S.getAsInteger(0, MsanTrackOrigins) || MsanTrackOrigins < 0 || 527 MsanTrackOrigins > 2) { 528 D.Diag(clang::diag::err_drv_invalid_value) << A->getAsString(Args) << S; 529 } 530 } 531 } 532 MsanUseAfterDtor = 533 Args.hasFlag(options::OPT_fsanitize_memory_use_after_dtor, 534 options::OPT_fno_sanitize_memory_use_after_dtor, 535 MsanUseAfterDtor); 536 NeedPIE |= !(TC.getTriple().isOSLinux() && 537 TC.getTriple().getArch() == llvm::Triple::x86_64); 538 } else { 539 MsanUseAfterDtor = false; 540 } 541 542 if (AllAddedKinds & Thread) { 543 TsanMemoryAccess = Args.hasFlag(options::OPT_fsanitize_thread_memory_access, 544 options::OPT_fno_sanitize_thread_memory_access, 545 TsanMemoryAccess); 546 TsanFuncEntryExit = Args.hasFlag(options::OPT_fsanitize_thread_func_entry_exit, 547 options::OPT_fno_sanitize_thread_func_entry_exit, 548 TsanFuncEntryExit); 549 TsanAtomics = Args.hasFlag(options::OPT_fsanitize_thread_atomics, 550 options::OPT_fno_sanitize_thread_atomics, 551 TsanAtomics); 552 } 553 554 if (AllAddedKinds & CFI) { 555 CfiCrossDso = Args.hasFlag(options::OPT_fsanitize_cfi_cross_dso, 556 options::OPT_fno_sanitize_cfi_cross_dso, false); 557 // Without PIE, external function address may resolve to a PLT record, which 558 // can not be verified by the target module. 559 NeedPIE |= CfiCrossDso; 560 CfiICallGeneralizePointers = 561 Args.hasArg(options::OPT_fsanitize_cfi_icall_generalize_pointers); 562 563 if (CfiCrossDso && CfiICallGeneralizePointers) 564 D.Diag(diag::err_drv_argument_not_allowed_with) 565 << "-fsanitize-cfi-cross-dso" 566 << "-fsanitize-cfi-icall-generalize-pointers"; 567 } 568 569 Stats = Args.hasFlag(options::OPT_fsanitize_stats, 570 options::OPT_fno_sanitize_stats, false); 571 572 if (MinimalRuntime) { 573 SanitizerMask IncompatibleMask = 574 Kinds & ~setGroupBits(CompatibleWithMinimalRuntime); 575 if (IncompatibleMask) 576 D.Diag(clang::diag::err_drv_argument_not_allowed_with) 577 << "-fsanitize-minimal-runtime" 578 << lastArgumentForMask(D, Args, IncompatibleMask); 579 580 SanitizerMask NonTrappingCfi = Kinds & CFI & ~TrappingKinds; 581 if (NonTrappingCfi) 582 D.Diag(clang::diag::err_drv_argument_only_allowed_with) 583 << "fsanitize-minimal-runtime" 584 << "fsanitize-trap=cfi"; 585 } 586 587 // Parse -f(no-)?sanitize-coverage flags if coverage is supported by the 588 // enabled sanitizers. 589 for (const auto *Arg : Args) { 590 if (Arg->getOption().matches(options::OPT_fsanitize_coverage)) { 591 int LegacySanitizeCoverage; 592 if (Arg->getNumValues() == 1 && 593 !StringRef(Arg->getValue(0)) 594 .getAsInteger(0, LegacySanitizeCoverage)) { 595 CoverageFeatures = 0; 596 Arg->claim(); 597 if (LegacySanitizeCoverage != 0) { 598 D.Diag(diag::warn_drv_deprecated_arg) 599 << Arg->getAsString(Args) << "-fsanitize-coverage=trace-pc-guard"; 600 } 601 continue; 602 } 603 CoverageFeatures |= parseCoverageFeatures(D, Arg); 604 605 // Disable coverage and not claim the flags if there is at least one 606 // non-supporting sanitizer. 607 if (!(AllAddedKinds & ~AllRemove & ~setGroupBits(SupportsCoverage))) { 608 Arg->claim(); 609 } else { 610 CoverageFeatures = 0; 611 } 612 } else if (Arg->getOption().matches(options::OPT_fno_sanitize_coverage)) { 613 Arg->claim(); 614 CoverageFeatures &= ~parseCoverageFeatures(D, Arg); 615 } 616 } 617 // Choose at most one coverage type: function, bb, or edge. 618 if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageBB)) 619 D.Diag(clang::diag::err_drv_argument_not_allowed_with) 620 << "-fsanitize-coverage=func" 621 << "-fsanitize-coverage=bb"; 622 if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageEdge)) 623 D.Diag(clang::diag::err_drv_argument_not_allowed_with) 624 << "-fsanitize-coverage=func" 625 << "-fsanitize-coverage=edge"; 626 if ((CoverageFeatures & CoverageBB) && (CoverageFeatures & CoverageEdge)) 627 D.Diag(clang::diag::err_drv_argument_not_allowed_with) 628 << "-fsanitize-coverage=bb" 629 << "-fsanitize-coverage=edge"; 630 // Basic block tracing and 8-bit counters require some type of coverage 631 // enabled. 632 if (CoverageFeatures & CoverageTraceBB) 633 D.Diag(clang::diag::warn_drv_deprecated_arg) 634 << "-fsanitize-coverage=trace-bb" 635 << "-fsanitize-coverage=trace-pc-guard"; 636 if (CoverageFeatures & Coverage8bitCounters) 637 D.Diag(clang::diag::warn_drv_deprecated_arg) 638 << "-fsanitize-coverage=8bit-counters" 639 << "-fsanitize-coverage=trace-pc-guard"; 640 641 int InsertionPointTypes = CoverageFunc | CoverageBB | CoverageEdge; 642 int InstrumentationTypes = 643 CoverageTracePC | CoverageTracePCGuard | CoverageInline8bitCounters; 644 if ((CoverageFeatures & InsertionPointTypes) && 645 !(CoverageFeatures & InstrumentationTypes)) { 646 D.Diag(clang::diag::warn_drv_deprecated_arg) 647 << "-fsanitize-coverage=[func|bb|edge]" 648 << "-fsanitize-coverage=[func|bb|edge],[trace-pc-guard|trace-pc]"; 649 } 650 651 // trace-pc w/o func/bb/edge implies edge. 652 if (!(CoverageFeatures & InsertionPointTypes)) { 653 if (CoverageFeatures & 654 (CoverageTracePC | CoverageTracePCGuard | CoverageInline8bitCounters)) 655 CoverageFeatures |= CoverageEdge; 656 657 if (CoverageFeatures & CoverageStackDepth) 658 CoverageFeatures |= CoverageFunc; 659 } 660 661 SharedRuntime = 662 Args.hasFlag(options::OPT_shared_libsan, options::OPT_static_libsan, 663 TC.getTriple().isAndroid() || TC.getTriple().isOSFuchsia() || 664 TC.getTriple().isOSDarwin()); 665 666 ImplicitCfiRuntime = TC.getTriple().isAndroid(); 667 668 if (AllAddedKinds & Address) { 669 NeedPIE |= TC.getTriple().isOSFuchsia(); 670 if (Arg *A = 671 Args.getLastArg(options::OPT_fsanitize_address_field_padding)) { 672 StringRef S = A->getValue(); 673 // Legal values are 0 and 1, 2, but in future we may add more levels. 674 if (S.getAsInteger(0, AsanFieldPadding) || AsanFieldPadding < 0 || 675 AsanFieldPadding > 2) { 676 D.Diag(clang::diag::err_drv_invalid_value) << A->getAsString(Args) << S; 677 } 678 } 679 680 if (Arg *WindowsDebugRTArg = 681 Args.getLastArg(options::OPT__SLASH_MTd, options::OPT__SLASH_MT, 682 options::OPT__SLASH_MDd, options::OPT__SLASH_MD, 683 options::OPT__SLASH_LDd, options::OPT__SLASH_LD)) { 684 switch (WindowsDebugRTArg->getOption().getID()) { 685 case options::OPT__SLASH_MTd: 686 case options::OPT__SLASH_MDd: 687 case options::OPT__SLASH_LDd: 688 D.Diag(clang::diag::err_drv_argument_not_allowed_with) 689 << WindowsDebugRTArg->getAsString(Args) 690 << lastArgumentForMask(D, Args, Address); 691 D.Diag(clang::diag::note_drv_address_sanitizer_debug_runtime); 692 } 693 } 694 695 AsanUseAfterScope = Args.hasFlag( 696 options::OPT_fsanitize_address_use_after_scope, 697 options::OPT_fno_sanitize_address_use_after_scope, AsanUseAfterScope); 698 699 // As a workaround for a bug in gold 2.26 and earlier, dead stripping of 700 // globals in ASan is disabled by default on ELF targets. 701 // See https://sourceware.org/bugzilla/show_bug.cgi?id=19002 702 AsanGlobalsDeadStripping = 703 !TC.getTriple().isOSBinFormatELF() || TC.getTriple().isOSFuchsia() || 704 Args.hasArg(options::OPT_fsanitize_address_globals_dead_stripping); 705 } else { 706 AsanUseAfterScope = false; 707 } 708 709 if (AllAddedKinds & SafeStack) { 710 // SafeStack runtime is built into the system on Fuchsia. 711 SafeStackRuntime = !TC.getTriple().isOSFuchsia(); 712 } 713 714 // Parse -link-cxx-sanitizer flag. 715 LinkCXXRuntimes = 716 Args.hasArg(options::OPT_fsanitize_link_cxx_runtime) || D.CCCIsCXX(); 717 718 // Finally, initialize the set of available and recoverable sanitizers. 719 Sanitizers.Mask |= Kinds; 720 RecoverableSanitizers.Mask |= RecoverableKinds; 721 TrapSanitizers.Mask |= TrappingKinds; 722 assert(!(RecoverableKinds & TrappingKinds) && 723 "Overlap between recoverable and trapping sanitizers"); 724 } 725 726 static std::string toString(const clang::SanitizerSet &Sanitizers) { 727 std::string Res; 728 #define SANITIZER(NAME, ID) \ 729 if (Sanitizers.has(ID)) { \ 730 if (!Res.empty()) \ 731 Res += ","; \ 732 Res += NAME; \ 733 } 734 #include "clang/Basic/Sanitizers.def" 735 return Res; 736 } 737 738 static void addIncludeLinkerOption(const ToolChain &TC, 739 const llvm::opt::ArgList &Args, 740 llvm::opt::ArgStringList &CmdArgs, 741 StringRef SymbolName) { 742 SmallString<64> LinkerOptionFlag; 743 LinkerOptionFlag = "--linker-option=/include:"; 744 if (TC.getTriple().getArch() == llvm::Triple::x86) { 745 // Win32 mangles C function names with a '_' prefix. 746 LinkerOptionFlag += '_'; 747 } 748 LinkerOptionFlag += SymbolName; 749 CmdArgs.push_back(Args.MakeArgString(LinkerOptionFlag)); 750 } 751 752 void SanitizerArgs::addArgs(const ToolChain &TC, const llvm::opt::ArgList &Args, 753 llvm::opt::ArgStringList &CmdArgs, 754 types::ID InputType) const { 755 // NVPTX doesn't currently support sanitizers. Bailing out here means that 756 // e.g. -fsanitize=address applies only to host code, which is what we want 757 // for now. 758 if (TC.getTriple().isNVPTX()) 759 return; 760 761 // Translate available CoverageFeatures to corresponding clang-cc1 flags. 762 // Do it even if Sanitizers.empty() since some forms of coverage don't require 763 // sanitizers. 764 std::pair<int, const char *> CoverageFlags[] = { 765 std::make_pair(CoverageFunc, "-fsanitize-coverage-type=1"), 766 std::make_pair(CoverageBB, "-fsanitize-coverage-type=2"), 767 std::make_pair(CoverageEdge, "-fsanitize-coverage-type=3"), 768 std::make_pair(CoverageIndirCall, "-fsanitize-coverage-indirect-calls"), 769 std::make_pair(CoverageTraceBB, "-fsanitize-coverage-trace-bb"), 770 std::make_pair(CoverageTraceCmp, "-fsanitize-coverage-trace-cmp"), 771 std::make_pair(CoverageTraceDiv, "-fsanitize-coverage-trace-div"), 772 std::make_pair(CoverageTraceGep, "-fsanitize-coverage-trace-gep"), 773 std::make_pair(Coverage8bitCounters, "-fsanitize-coverage-8bit-counters"), 774 std::make_pair(CoverageTracePC, "-fsanitize-coverage-trace-pc"), 775 std::make_pair(CoverageTracePCGuard, "-fsanitize-coverage-trace-pc-guard"), 776 std::make_pair(CoverageInline8bitCounters, "-fsanitize-coverage-inline-8bit-counters"), 777 std::make_pair(CoveragePCTable, "-fsanitize-coverage-pc-table"), 778 std::make_pair(CoverageNoPrune, "-fsanitize-coverage-no-prune"), 779 std::make_pair(CoverageStackDepth, "-fsanitize-coverage-stack-depth")}; 780 for (auto F : CoverageFlags) { 781 if (CoverageFeatures & F.first) 782 CmdArgs.push_back(F.second); 783 } 784 785 if (TC.getTriple().isOSWindows() && needsUbsanRt()) { 786 // Instruct the code generator to embed linker directives in the object file 787 // that cause the required runtime libraries to be linked. 788 CmdArgs.push_back(Args.MakeArgString( 789 "--dependent-lib=" + TC.getCompilerRT(Args, "ubsan_standalone"))); 790 if (types::isCXX(InputType)) 791 CmdArgs.push_back(Args.MakeArgString( 792 "--dependent-lib=" + TC.getCompilerRT(Args, "ubsan_standalone_cxx"))); 793 } 794 if (TC.getTriple().isOSWindows() && needsStatsRt()) { 795 CmdArgs.push_back(Args.MakeArgString("--dependent-lib=" + 796 TC.getCompilerRT(Args, "stats_client"))); 797 798 // The main executable must export the stats runtime. 799 // FIXME: Only exporting from the main executable (e.g. based on whether the 800 // translation unit defines main()) would save a little space, but having 801 // multiple copies of the runtime shouldn't hurt. 802 CmdArgs.push_back(Args.MakeArgString("--dependent-lib=" + 803 TC.getCompilerRT(Args, "stats"))); 804 addIncludeLinkerOption(TC, Args, CmdArgs, "__sanitizer_stats_register"); 805 } 806 807 if (Sanitizers.empty()) 808 return; 809 CmdArgs.push_back(Args.MakeArgString("-fsanitize=" + toString(Sanitizers))); 810 811 if (!RecoverableSanitizers.empty()) 812 CmdArgs.push_back(Args.MakeArgString("-fsanitize-recover=" + 813 toString(RecoverableSanitizers))); 814 815 if (!TrapSanitizers.empty()) 816 CmdArgs.push_back( 817 Args.MakeArgString("-fsanitize-trap=" + toString(TrapSanitizers))); 818 819 for (const auto &BLPath : BlacklistFiles) { 820 SmallString<64> BlacklistOpt("-fsanitize-blacklist="); 821 BlacklistOpt += BLPath; 822 CmdArgs.push_back(Args.MakeArgString(BlacklistOpt)); 823 } 824 for (const auto &Dep : ExtraDeps) { 825 SmallString<64> ExtraDepOpt("-fdepfile-entry="); 826 ExtraDepOpt += Dep; 827 CmdArgs.push_back(Args.MakeArgString(ExtraDepOpt)); 828 } 829 830 if (MsanTrackOrigins) 831 CmdArgs.push_back(Args.MakeArgString("-fsanitize-memory-track-origins=" + 832 Twine(MsanTrackOrigins))); 833 834 if (MsanUseAfterDtor) 835 CmdArgs.push_back("-fsanitize-memory-use-after-dtor"); 836 837 // FIXME: Pass these parameters as function attributes, not as -llvm flags. 838 if (!TsanMemoryAccess) { 839 CmdArgs.push_back("-mllvm"); 840 CmdArgs.push_back("-tsan-instrument-memory-accesses=0"); 841 CmdArgs.push_back("-mllvm"); 842 CmdArgs.push_back("-tsan-instrument-memintrinsics=0"); 843 } 844 if (!TsanFuncEntryExit) { 845 CmdArgs.push_back("-mllvm"); 846 CmdArgs.push_back("-tsan-instrument-func-entry-exit=0"); 847 } 848 if (!TsanAtomics) { 849 CmdArgs.push_back("-mllvm"); 850 CmdArgs.push_back("-tsan-instrument-atomics=0"); 851 } 852 853 if (CfiCrossDso) 854 CmdArgs.push_back("-fsanitize-cfi-cross-dso"); 855 856 if (CfiICallGeneralizePointers) 857 CmdArgs.push_back("-fsanitize-cfi-icall-generalize-pointers"); 858 859 if (Stats) 860 CmdArgs.push_back("-fsanitize-stats"); 861 862 if (MinimalRuntime) 863 CmdArgs.push_back("-fsanitize-minimal-runtime"); 864 865 if (AsanFieldPadding) 866 CmdArgs.push_back(Args.MakeArgString("-fsanitize-address-field-padding=" + 867 Twine(AsanFieldPadding))); 868 869 if (AsanUseAfterScope) 870 CmdArgs.push_back("-fsanitize-address-use-after-scope"); 871 872 if (AsanGlobalsDeadStripping) 873 CmdArgs.push_back("-fsanitize-address-globals-dead-stripping"); 874 875 // MSan: Workaround for PR16386. 876 // ASan: This is mainly to help LSan with cases such as 877 // https://github.com/google/sanitizers/issues/373 878 // We can't make this conditional on -fsanitize=leak, as that flag shouldn't 879 // affect compilation. 880 if (Sanitizers.has(Memory) || Sanitizers.has(Address)) 881 CmdArgs.push_back("-fno-assume-sane-operator-new"); 882 883 // Require -fvisibility= flag on non-Windows when compiling if vptr CFI is 884 // enabled. 885 if (Sanitizers.hasOneOf(CFIClasses) && !TC.getTriple().isOSWindows() && 886 !Args.hasArg(options::OPT_fvisibility_EQ)) { 887 TC.getDriver().Diag(clang::diag::err_drv_argument_only_allowed_with) 888 << lastArgumentForMask(TC.getDriver(), Args, 889 Sanitizers.Mask & CFIClasses) 890 << "-fvisibility="; 891 } 892 } 893 894 SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A, 895 bool DiagnoseErrors) { 896 assert((A->getOption().matches(options::OPT_fsanitize_EQ) || 897 A->getOption().matches(options::OPT_fno_sanitize_EQ) || 898 A->getOption().matches(options::OPT_fsanitize_recover_EQ) || 899 A->getOption().matches(options::OPT_fno_sanitize_recover_EQ) || 900 A->getOption().matches(options::OPT_fsanitize_trap_EQ) || 901 A->getOption().matches(options::OPT_fno_sanitize_trap_EQ)) && 902 "Invalid argument in parseArgValues!"); 903 SanitizerMask Kinds = 0; 904 for (int i = 0, n = A->getNumValues(); i != n; ++i) { 905 const char *Value = A->getValue(i); 906 SanitizerMask Kind; 907 // Special case: don't accept -fsanitize=all. 908 if (A->getOption().matches(options::OPT_fsanitize_EQ) && 909 0 == strcmp("all", Value)) 910 Kind = 0; 911 // Similarly, don't accept -fsanitize=efficiency-all. 912 else if (A->getOption().matches(options::OPT_fsanitize_EQ) && 913 0 == strcmp("efficiency-all", Value)) 914 Kind = 0; 915 else 916 Kind = parseSanitizerValue(Value, /*AllowGroups=*/true); 917 918 if (Kind) 919 Kinds |= Kind; 920 else if (DiagnoseErrors) 921 D.Diag(clang::diag::err_drv_unsupported_option_argument) 922 << A->getOption().getName() << Value; 923 } 924 return Kinds; 925 } 926 927 int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A) { 928 assert(A->getOption().matches(options::OPT_fsanitize_coverage) || 929 A->getOption().matches(options::OPT_fno_sanitize_coverage)); 930 int Features = 0; 931 for (int i = 0, n = A->getNumValues(); i != n; ++i) { 932 const char *Value = A->getValue(i); 933 int F = llvm::StringSwitch<int>(Value) 934 .Case("func", CoverageFunc) 935 .Case("bb", CoverageBB) 936 .Case("edge", CoverageEdge) 937 .Case("indirect-calls", CoverageIndirCall) 938 .Case("trace-bb", CoverageTraceBB) 939 .Case("trace-cmp", CoverageTraceCmp) 940 .Case("trace-div", CoverageTraceDiv) 941 .Case("trace-gep", CoverageTraceGep) 942 .Case("8bit-counters", Coverage8bitCounters) 943 .Case("trace-pc", CoverageTracePC) 944 .Case("trace-pc-guard", CoverageTracePCGuard) 945 .Case("no-prune", CoverageNoPrune) 946 .Case("inline-8bit-counters", CoverageInline8bitCounters) 947 .Case("pc-table", CoveragePCTable) 948 .Case("stack-depth", CoverageStackDepth) 949 .Default(0); 950 if (F == 0) 951 D.Diag(clang::diag::err_drv_unsupported_option_argument) 952 << A->getOption().getName() << Value; 953 Features |= F; 954 } 955 return Features; 956 } 957 958 std::string lastArgumentForMask(const Driver &D, const llvm::opt::ArgList &Args, 959 SanitizerMask Mask) { 960 for (llvm::opt::ArgList::const_reverse_iterator I = Args.rbegin(), 961 E = Args.rend(); 962 I != E; ++I) { 963 const auto *Arg = *I; 964 if (Arg->getOption().matches(options::OPT_fsanitize_EQ)) { 965 SanitizerMask AddKinds = 966 expandSanitizerGroups(parseArgValues(D, Arg, false)); 967 if (AddKinds & Mask) 968 return describeSanitizeArg(Arg, Mask); 969 } else if (Arg->getOption().matches(options::OPT_fno_sanitize_EQ)) { 970 SanitizerMask RemoveKinds = 971 expandSanitizerGroups(parseArgValues(D, Arg, false)); 972 Mask &= ~RemoveKinds; 973 } 974 } 975 llvm_unreachable("arg list didn't provide expected value"); 976 } 977 978 std::string describeSanitizeArg(const llvm::opt::Arg *A, SanitizerMask Mask) { 979 assert(A->getOption().matches(options::OPT_fsanitize_EQ) 980 && "Invalid argument in describeSanitizerArg!"); 981 982 std::string Sanitizers; 983 for (int i = 0, n = A->getNumValues(); i != n; ++i) { 984 if (expandSanitizerGroups( 985 parseSanitizerValue(A->getValue(i), /*AllowGroups=*/true)) & 986 Mask) { 987 if (!Sanitizers.empty()) 988 Sanitizers += ","; 989 Sanitizers += A->getValue(i); 990 } 991 } 992 993 assert(!Sanitizers.empty() && "arg didn't provide expected value"); 994 return "-fsanitize=" + Sanitizers; 995 } 996