1 //===--- SanitizerArgs.cpp - Arguments for sanitizer tools  ---------------===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 #include "clang/Driver/SanitizerArgs.h"
10 #include "ToolChains/CommonArgs.h"
11 #include "clang/Basic/Sanitizers.h"
12 #include "clang/Driver/Driver.h"
13 #include "clang/Driver/DriverDiagnostic.h"
14 #include "clang/Driver/Options.h"
15 #include "clang/Driver/ToolChain.h"
16 #include "llvm/ADT/StringExtras.h"
17 #include "llvm/ADT/StringSwitch.h"
18 #include "llvm/Support/FileSystem.h"
19 #include "llvm/Support/Path.h"
20 #include "llvm/Support/SpecialCaseList.h"
21 #include "llvm/Support/TargetParser.h"
22 #include <memory>
23 
24 using namespace clang;
25 using namespace clang::SanitizerKind;
26 using namespace clang::driver;
27 using namespace llvm::opt;
28 
29 enum : SanitizerMask {
30   NeedsUbsanRt = Undefined | Integer | Nullability | CFI,
31   NeedsUbsanCxxRt = Vptr | CFI,
32   NotAllowedWithTrap = Vptr,
33   NotAllowedWithMinimalRuntime = Vptr,
34   RequiresPIE = DataFlow | HWAddress | Scudo,
35   NeedsUnwindTables = Address | HWAddress | Thread | Memory | DataFlow,
36   SupportsCoverage = Address | HWAddress | KernelAddress | KernelHWAddress |
37                      Memory | Leak | Undefined | Integer | Nullability |
38                      DataFlow | Fuzzer | FuzzerNoLink,
39   RecoverableByDefault = Undefined | Integer | Nullability,
40   Unrecoverable = Unreachable | Return,
41   AlwaysRecoverable = KernelAddress | KernelHWAddress,
42   LegacyFsanitizeRecoverMask = Undefined | Integer,
43   NeedsLTO = CFI,
44   TrappingSupported = (Undefined & ~Vptr) | UnsignedIntegerOverflow |
45                       Nullability | LocalBounds | CFI,
46   TrappingDefault = CFI,
47   CFIClasses = CFIVCall | CFINVCall | CFIDerivedCast | CFIUnrelatedCast,
48   CompatibleWithMinimalRuntime = TrappingSupported,
49 };
50 
51 enum CoverageFeature {
52   CoverageFunc = 1 << 0,
53   CoverageBB = 1 << 1,
54   CoverageEdge = 1 << 2,
55   CoverageIndirCall = 1 << 3,
56   CoverageTraceBB = 1 << 4,  // Deprecated.
57   CoverageTraceCmp = 1 << 5,
58   CoverageTraceDiv = 1 << 6,
59   CoverageTraceGep = 1 << 7,
60   Coverage8bitCounters = 1 << 8,  // Deprecated.
61   CoverageTracePC = 1 << 9,
62   CoverageTracePCGuard = 1 << 10,
63   CoverageNoPrune = 1 << 11,
64   CoverageInline8bitCounters = 1 << 12,
65   CoveragePCTable = 1 << 13,
66   CoverageStackDepth = 1 << 14,
67 };
68 
69 /// Parse a -fsanitize= or -fno-sanitize= argument's values, diagnosing any
70 /// invalid components. Returns a SanitizerMask.
71 static SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A,
72                                     bool DiagnoseErrors);
73 
74 /// Parse -f(no-)?sanitize-coverage= flag values, diagnosing any invalid
75 /// components. Returns OR of members of \c CoverageFeature enumeration.
76 static int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A);
77 
78 /// Produce an argument string from ArgList \p Args, which shows how it
79 /// provides some sanitizer kind from \p Mask. For example, the argument list
80 /// "-fsanitize=thread,vptr -fsanitize=address" with mask \c NeedsUbsanRt
81 /// would produce "-fsanitize=vptr".
82 static std::string lastArgumentForMask(const Driver &D,
83                                        const llvm::opt::ArgList &Args,
84                                        SanitizerMask Mask);
85 
86 /// Produce an argument string from argument \p A, which shows how it provides
87 /// a value in \p Mask. For instance, the argument
88 /// "-fsanitize=address,alignment" with mask \c NeedsUbsanRt would produce
89 /// "-fsanitize=alignment".
90 static std::string describeSanitizeArg(const llvm::opt::Arg *A,
91                                        SanitizerMask Mask);
92 
93 /// Produce a string containing comma-separated names of sanitizers in \p
94 /// Sanitizers set.
95 static std::string toString(const clang::SanitizerSet &Sanitizers);
96 
97 static void addDefaultBlacklists(const Driver &D, SanitizerMask Kinds,
98                                  std::vector<std::string> &BlacklistFiles) {
99   struct Blacklist {
100     const char *File;
101     SanitizerMask Mask;
102   } Blacklists[] = {{"asan_blacklist.txt", Address},
103                     {"hwasan_blacklist.txt", HWAddress},
104                     {"msan_blacklist.txt", Memory},
105                     {"tsan_blacklist.txt", Thread},
106                     {"dfsan_abilist.txt", DataFlow},
107                     {"cfi_blacklist.txt", CFI},
108                     {"ubsan_blacklist.txt", Undefined | Integer | Nullability}};
109 
110   for (auto BL : Blacklists) {
111     if (!(Kinds & BL.Mask))
112       continue;
113 
114     clang::SmallString<64> Path(D.ResourceDir);
115     llvm::sys::path::append(Path, "share", BL.File);
116     if (llvm::sys::fs::exists(Path))
117       BlacklistFiles.push_back(Path.str());
118   }
119 }
120 
121 /// Sets group bits for every group that has at least one representative already
122 /// enabled in \p Kinds.
123 static SanitizerMask setGroupBits(SanitizerMask Kinds) {
124 #define SANITIZER(NAME, ID)
125 #define SANITIZER_GROUP(NAME, ID, ALIAS)                                       \
126   if (Kinds & SanitizerKind::ID)                                               \
127     Kinds |= SanitizerKind::ID##Group;
128 #include "clang/Basic/Sanitizers.def"
129   return Kinds;
130 }
131 
132 static SanitizerMask parseSanitizeTrapArgs(const Driver &D,
133                                            const llvm::opt::ArgList &Args) {
134   SanitizerMask TrapRemove = 0; // During the loop below, the accumulated set of
135                                 // sanitizers disabled by the current sanitizer
136                                 // argument or any argument after it.
137   SanitizerMask TrappingKinds = 0;
138   SanitizerMask TrappingSupportedWithGroups = setGroupBits(TrappingSupported);
139 
140   for (ArgList::const_reverse_iterator I = Args.rbegin(), E = Args.rend();
141        I != E; ++I) {
142     const auto *Arg = *I;
143     if (Arg->getOption().matches(options::OPT_fsanitize_trap_EQ)) {
144       Arg->claim();
145       SanitizerMask Add = parseArgValues(D, Arg, true);
146       Add &= ~TrapRemove;
147       if (SanitizerMask InvalidValues = Add & ~TrappingSupportedWithGroups) {
148         SanitizerSet S;
149         S.Mask = InvalidValues;
150         D.Diag(diag::err_drv_unsupported_option_argument) << "-fsanitize-trap"
151                                                           << toString(S);
152       }
153       TrappingKinds |= expandSanitizerGroups(Add) & ~TrapRemove;
154     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_trap_EQ)) {
155       Arg->claim();
156       TrapRemove |= expandSanitizerGroups(parseArgValues(D, Arg, true));
157     } else if (Arg->getOption().matches(
158                    options::OPT_fsanitize_undefined_trap_on_error)) {
159       Arg->claim();
160       TrappingKinds |=
161           expandSanitizerGroups(UndefinedGroup & ~TrapRemove) & ~TrapRemove;
162     } else if (Arg->getOption().matches(
163                    options::OPT_fno_sanitize_undefined_trap_on_error)) {
164       Arg->claim();
165       TrapRemove |= expandSanitizerGroups(UndefinedGroup);
166     }
167   }
168 
169   // Apply default trapping behavior.
170   TrappingKinds |= TrappingDefault & ~TrapRemove;
171 
172   return TrappingKinds;
173 }
174 
175 bool SanitizerArgs::needsUbsanRt() const {
176   // All of these include ubsan.
177   if (needsAsanRt() || needsMsanRt() || needsHwasanRt() || needsTsanRt() ||
178       needsDfsanRt() || needsLsanRt() || needsCfiDiagRt() || needsScudoRt())
179     return false;
180 
181   return (Sanitizers.Mask & NeedsUbsanRt & ~TrapSanitizers.Mask) ||
182          CoverageFeatures;
183 }
184 
185 bool SanitizerArgs::needsCfiRt() const {
186   return !(Sanitizers.Mask & CFI & ~TrapSanitizers.Mask) && CfiCrossDso &&
187          !ImplicitCfiRuntime;
188 }
189 
190 bool SanitizerArgs::needsCfiDiagRt() const {
191   return (Sanitizers.Mask & CFI & ~TrapSanitizers.Mask) && CfiCrossDso &&
192          !ImplicitCfiRuntime;
193 }
194 
195 bool SanitizerArgs::requiresPIE() const {
196   return NeedPIE || (Sanitizers.Mask & RequiresPIE);
197 }
198 
199 bool SanitizerArgs::needsUnwindTables() const {
200   return Sanitizers.Mask & NeedsUnwindTables;
201 }
202 
203 SanitizerArgs::SanitizerArgs(const ToolChain &TC,
204                              const llvm::opt::ArgList &Args) {
205   SanitizerMask AllRemove = 0;  // During the loop below, the accumulated set of
206                                 // sanitizers disabled by the current sanitizer
207                                 // argument or any argument after it.
208   SanitizerMask AllAddedKinds = 0;  // Mask of all sanitizers ever enabled by
209                                     // -fsanitize= flags (directly or via group
210                                     // expansion), some of which may be disabled
211                                     // later. Used to carefully prune
212                                     // unused-argument diagnostics.
213   SanitizerMask DiagnosedKinds = 0;  // All Kinds we have diagnosed up to now.
214                                      // Used to deduplicate diagnostics.
215   SanitizerMask Kinds = 0;
216   const SanitizerMask Supported = setGroupBits(TC.getSupportedSanitizers());
217   ToolChain::RTTIMode RTTIMode = TC.getRTTIMode();
218 
219   const Driver &D = TC.getDriver();
220   SanitizerMask TrappingKinds = parseSanitizeTrapArgs(D, Args);
221   SanitizerMask InvalidTrappingKinds = TrappingKinds & NotAllowedWithTrap;
222 
223   MinimalRuntime =
224       Args.hasFlag(options::OPT_fsanitize_minimal_runtime,
225                    options::OPT_fno_sanitize_minimal_runtime, MinimalRuntime);
226 
227   // The object size sanitizer should not be enabled at -O0.
228   Arg *OptLevel = Args.getLastArg(options::OPT_O_Group);
229   bool RemoveObjectSizeAtO0 =
230       !OptLevel || OptLevel->getOption().matches(options::OPT_O0);
231 
232   for (ArgList::const_reverse_iterator I = Args.rbegin(), E = Args.rend();
233        I != E; ++I) {
234     const auto *Arg = *I;
235     if (Arg->getOption().matches(options::OPT_fsanitize_EQ)) {
236       Arg->claim();
237       SanitizerMask Add = parseArgValues(D, Arg, /*AllowGroups=*/true);
238 
239       if (RemoveObjectSizeAtO0) {
240         AllRemove |= SanitizerKind::ObjectSize;
241 
242         // The user explicitly enabled the object size sanitizer. Warn that
243         // that this does nothing at -O0.
244         if (Add & SanitizerKind::ObjectSize)
245           D.Diag(diag::warn_drv_object_size_disabled_O0)
246               << Arg->getAsString(Args);
247       }
248 
249       AllAddedKinds |= expandSanitizerGroups(Add);
250 
251       // Avoid diagnosing any sanitizer which is disabled later.
252       Add &= ~AllRemove;
253       // At this point we have not expanded groups, so any unsupported
254       // sanitizers in Add are those which have been explicitly enabled.
255       // Diagnose them.
256       if (SanitizerMask KindsToDiagnose =
257               Add & InvalidTrappingKinds & ~DiagnosedKinds) {
258         std::string Desc = describeSanitizeArg(*I, KindsToDiagnose);
259         D.Diag(diag::err_drv_argument_not_allowed_with)
260             << Desc << "-fsanitize-trap=undefined";
261         DiagnosedKinds |= KindsToDiagnose;
262       }
263       Add &= ~InvalidTrappingKinds;
264 
265       if (MinimalRuntime) {
266         if (SanitizerMask KindsToDiagnose =
267                 Add & NotAllowedWithMinimalRuntime & ~DiagnosedKinds) {
268           std::string Desc = describeSanitizeArg(*I, KindsToDiagnose);
269           D.Diag(diag::err_drv_argument_not_allowed_with)
270               << Desc << "-fsanitize-minimal-runtime";
271           DiagnosedKinds |= KindsToDiagnose;
272         }
273         Add &= ~NotAllowedWithMinimalRuntime;
274       }
275 
276       if (SanitizerMask KindsToDiagnose = Add & ~Supported & ~DiagnosedKinds) {
277         std::string Desc = describeSanitizeArg(*I, KindsToDiagnose);
278         D.Diag(diag::err_drv_unsupported_opt_for_target)
279             << Desc << TC.getTriple().str();
280         DiagnosedKinds |= KindsToDiagnose;
281       }
282       Add &= Supported;
283 
284       // Test for -fno-rtti + explicit -fsanitizer=vptr before expanding groups
285       // so we don't error out if -fno-rtti and -fsanitize=undefined were
286       // passed.
287       if (Add & Vptr &&
288           (RTTIMode == ToolChain::RM_DisabledImplicitly ||
289            RTTIMode == ToolChain::RM_DisabledExplicitly)) {
290         if (RTTIMode == ToolChain::RM_DisabledImplicitly)
291           // Warn about not having rtti enabled if the vptr sanitizer is
292           // explicitly enabled
293           D.Diag(diag::warn_drv_disabling_vptr_no_rtti_default);
294         else {
295           const llvm::opt::Arg *NoRTTIArg = TC.getRTTIArg();
296           assert(NoRTTIArg &&
297                  "RTTI disabled explicitly but we have no argument!");
298           D.Diag(diag::err_drv_argument_not_allowed_with)
299               << "-fsanitize=vptr" << NoRTTIArg->getAsString(Args);
300         }
301 
302         // Take out the Vptr sanitizer from the enabled sanitizers
303         AllRemove |= Vptr;
304       }
305 
306       Add = expandSanitizerGroups(Add);
307       // Group expansion may have enabled a sanitizer which is disabled later.
308       Add &= ~AllRemove;
309       // Silently discard any unsupported sanitizers implicitly enabled through
310       // group expansion.
311       Add &= ~InvalidTrappingKinds;
312       if (MinimalRuntime) {
313         Add &= ~NotAllowedWithMinimalRuntime;
314       }
315       Add &= Supported;
316 
317       if (Add & Fuzzer)
318         Add |= FuzzerNoLink;
319 
320       // Enable coverage if the fuzzing flag is set.
321       if (Add & FuzzerNoLink) {
322         CoverageFeatures |= CoverageInline8bitCounters | CoverageIndirCall |
323                             CoverageTraceCmp | CoveragePCTable;
324         // Due to TLS differences, stack depth tracking is only enabled on Linux
325         if (TC.getTriple().isOSLinux())
326           CoverageFeatures |= CoverageStackDepth;
327       }
328 
329       Kinds |= Add;
330     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_EQ)) {
331       Arg->claim();
332       SanitizerMask Remove = parseArgValues(D, Arg, true);
333       AllRemove |= expandSanitizerGroups(Remove);
334     }
335   }
336 
337   std::pair<SanitizerMask, SanitizerMask> IncompatibleGroups[] = {
338       std::make_pair(Address, Thread | Memory),
339       std::make_pair(Thread, Memory),
340       std::make_pair(Leak, Thread | Memory),
341       std::make_pair(KernelAddress, Address | Leak | Thread | Memory),
342       std::make_pair(HWAddress, Address | Thread | Memory | KernelAddress),
343       std::make_pair(Efficiency, Address | HWAddress | Leak | Thread | Memory |
344                                      KernelAddress),
345       std::make_pair(Scudo, Address | HWAddress | Leak | Thread | Memory |
346                                 KernelAddress | Efficiency),
347       std::make_pair(SafeStack, Address | HWAddress | Leak | Thread | Memory |
348                                     KernelAddress | Efficiency),
349       std::make_pair(ShadowCallStack, Address | HWAddress | Leak | Thread |
350                                           Memory | KernelAddress | Efficiency |
351                                           SafeStack),
352       std::make_pair(KernelHWAddress, Address | HWAddress | Leak | Thread |
353                                           Memory | KernelAddress | Efficiency |
354                                           SafeStack | ShadowCallStack)};
355 
356   // Enable toolchain specific default sanitizers if not explicitly disabled.
357   SanitizerMask Default = TC.getDefaultSanitizers() & ~AllRemove;
358 
359   // Disable default sanitizers that are incompatible with explicitly requested
360   // ones.
361   for (auto G : IncompatibleGroups) {
362     SanitizerMask Group = G.first;
363     if ((Default & Group) && (Kinds & G.second))
364       Default &= ~Group;
365   }
366 
367   Kinds |= Default;
368 
369   // We disable the vptr sanitizer if it was enabled by group expansion but RTTI
370   // is disabled.
371   if ((Kinds & Vptr) &&
372       (RTTIMode == ToolChain::RM_DisabledImplicitly ||
373        RTTIMode == ToolChain::RM_DisabledExplicitly)) {
374     Kinds &= ~Vptr;
375   }
376 
377   // Check that LTO is enabled if we need it.
378   if ((Kinds & NeedsLTO) && !D.isUsingLTO()) {
379     D.Diag(diag::err_drv_argument_only_allowed_with)
380         << lastArgumentForMask(D, Args, Kinds & NeedsLTO) << "-flto";
381   }
382 
383   if ((Kinds & ShadowCallStack) &&
384       TC.getTriple().getArch() == llvm::Triple::aarch64 &&
385       !llvm::AArch64::isX18ReservedByDefault(TC.getTriple()) &&
386       !Args.hasArg(options::OPT_ffixed_x18)) {
387     D.Diag(diag::err_drv_argument_only_allowed_with)
388         << lastArgumentForMask(D, Args, Kinds & ShadowCallStack)
389         << "-ffixed-x18";
390   }
391 
392   // Report error if there are non-trapping sanitizers that require
393   // c++abi-specific  parts of UBSan runtime, and they are not provided by the
394   // toolchain. We don't have a good way to check the latter, so we just
395   // check if the toolchan supports vptr.
396   if (~Supported & Vptr) {
397     SanitizerMask KindsToDiagnose = Kinds & ~TrappingKinds & NeedsUbsanCxxRt;
398     // The runtime library supports the Microsoft C++ ABI, but only well enough
399     // for CFI. FIXME: Remove this once we support vptr on Windows.
400     if (TC.getTriple().isOSWindows())
401       KindsToDiagnose &= ~CFI;
402     if (KindsToDiagnose) {
403       SanitizerSet S;
404       S.Mask = KindsToDiagnose;
405       D.Diag(diag::err_drv_unsupported_opt_for_target)
406           << ("-fno-sanitize-trap=" + toString(S)) << TC.getTriple().str();
407       Kinds &= ~KindsToDiagnose;
408     }
409   }
410 
411   // Warn about incompatible groups of sanitizers.
412   for (auto G : IncompatibleGroups) {
413     SanitizerMask Group = G.first;
414     if (Kinds & Group) {
415       if (SanitizerMask Incompatible = Kinds & G.second) {
416         D.Diag(clang::diag::err_drv_argument_not_allowed_with)
417             << lastArgumentForMask(D, Args, Group)
418             << lastArgumentForMask(D, Args, Incompatible);
419         Kinds &= ~Incompatible;
420       }
421     }
422   }
423   // FIXME: Currently -fsanitize=leak is silently ignored in the presence of
424   // -fsanitize=address. Perhaps it should print an error, or perhaps
425   // -f(-no)sanitize=leak should change whether leak detection is enabled by
426   // default in ASan?
427 
428   // Parse -f(no-)?sanitize-recover flags.
429   SanitizerMask RecoverableKinds = RecoverableByDefault | AlwaysRecoverable;
430   SanitizerMask DiagnosedUnrecoverableKinds = 0;
431   SanitizerMask DiagnosedAlwaysRecoverableKinds = 0;
432   for (const auto *Arg : Args) {
433     const char *DeprecatedReplacement = nullptr;
434     if (Arg->getOption().matches(options::OPT_fsanitize_recover)) {
435       DeprecatedReplacement =
436           "-fsanitize-recover=undefined,integer' or '-fsanitize-recover=all";
437       RecoverableKinds |= expandSanitizerGroups(LegacyFsanitizeRecoverMask);
438       Arg->claim();
439     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_recover)) {
440       DeprecatedReplacement = "-fno-sanitize-recover=undefined,integer' or "
441                               "'-fno-sanitize-recover=all";
442       RecoverableKinds &= ~expandSanitizerGroups(LegacyFsanitizeRecoverMask);
443       Arg->claim();
444     } else if (Arg->getOption().matches(options::OPT_fsanitize_recover_EQ)) {
445       SanitizerMask Add = parseArgValues(D, Arg, true);
446       // Report error if user explicitly tries to recover from unrecoverable
447       // sanitizer.
448       if (SanitizerMask KindsToDiagnose =
449               Add & Unrecoverable & ~DiagnosedUnrecoverableKinds) {
450         SanitizerSet SetToDiagnose;
451         SetToDiagnose.Mask |= KindsToDiagnose;
452         D.Diag(diag::err_drv_unsupported_option_argument)
453             << Arg->getOption().getName() << toString(SetToDiagnose);
454         DiagnosedUnrecoverableKinds |= KindsToDiagnose;
455       }
456       RecoverableKinds |= expandSanitizerGroups(Add);
457       Arg->claim();
458     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_recover_EQ)) {
459       SanitizerMask Remove = parseArgValues(D, Arg, true);
460       // Report error if user explicitly tries to disable recovery from
461       // always recoverable sanitizer.
462       if (SanitizerMask KindsToDiagnose =
463               Remove & AlwaysRecoverable & ~DiagnosedAlwaysRecoverableKinds) {
464         SanitizerSet SetToDiagnose;
465         SetToDiagnose.Mask |= KindsToDiagnose;
466         D.Diag(diag::err_drv_unsupported_option_argument)
467             << Arg->getOption().getName() << toString(SetToDiagnose);
468         DiagnosedAlwaysRecoverableKinds |= KindsToDiagnose;
469       }
470       RecoverableKinds &= ~expandSanitizerGroups(Remove);
471       Arg->claim();
472     }
473     if (DeprecatedReplacement) {
474       D.Diag(diag::warn_drv_deprecated_arg) << Arg->getAsString(Args)
475                                             << DeprecatedReplacement;
476     }
477   }
478   RecoverableKinds &= Kinds;
479   RecoverableKinds &= ~Unrecoverable;
480 
481   TrappingKinds &= Kinds;
482   RecoverableKinds &= ~TrappingKinds;
483 
484   // Setup blacklist files.
485   // Add default blacklist from resource directory.
486   addDefaultBlacklists(D, Kinds, BlacklistFiles);
487   // Parse -f(no-)sanitize-blacklist options.
488   for (const auto *Arg : Args) {
489     if (Arg->getOption().matches(options::OPT_fsanitize_blacklist)) {
490       Arg->claim();
491       std::string BLPath = Arg->getValue();
492       if (llvm::sys::fs::exists(BLPath)) {
493         BlacklistFiles.push_back(BLPath);
494         ExtraDeps.push_back(BLPath);
495       } else {
496         D.Diag(clang::diag::err_drv_no_such_file) << BLPath;
497       }
498     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_blacklist)) {
499       Arg->claim();
500       BlacklistFiles.clear();
501       ExtraDeps.clear();
502     }
503   }
504   // Validate blacklists format.
505   {
506     std::string BLError;
507     std::unique_ptr<llvm::SpecialCaseList> SCL(
508         llvm::SpecialCaseList::create(BlacklistFiles, BLError));
509     if (!SCL.get())
510       D.Diag(clang::diag::err_drv_malformed_sanitizer_blacklist) << BLError;
511   }
512 
513   // Parse -f[no-]sanitize-memory-track-origins[=level] options.
514   if (AllAddedKinds & Memory) {
515     if (Arg *A =
516             Args.getLastArg(options::OPT_fsanitize_memory_track_origins_EQ,
517                             options::OPT_fsanitize_memory_track_origins,
518                             options::OPT_fno_sanitize_memory_track_origins)) {
519       if (A->getOption().matches(options::OPT_fsanitize_memory_track_origins)) {
520         MsanTrackOrigins = 2;
521       } else if (A->getOption().matches(
522                      options::OPT_fno_sanitize_memory_track_origins)) {
523         MsanTrackOrigins = 0;
524       } else {
525         StringRef S = A->getValue();
526         if (S.getAsInteger(0, MsanTrackOrigins) || MsanTrackOrigins < 0 ||
527             MsanTrackOrigins > 2) {
528           D.Diag(clang::diag::err_drv_invalid_value) << A->getAsString(Args) << S;
529         }
530       }
531     }
532     MsanUseAfterDtor =
533         Args.hasFlag(options::OPT_fsanitize_memory_use_after_dtor,
534                      options::OPT_fno_sanitize_memory_use_after_dtor,
535                      MsanUseAfterDtor);
536     NeedPIE |= !(TC.getTriple().isOSLinux() &&
537                  TC.getTriple().getArch() == llvm::Triple::x86_64);
538   } else {
539     MsanUseAfterDtor = false;
540   }
541 
542   if (AllAddedKinds & Thread) {
543     TsanMemoryAccess = Args.hasFlag(options::OPT_fsanitize_thread_memory_access,
544                                     options::OPT_fno_sanitize_thread_memory_access,
545                                     TsanMemoryAccess);
546     TsanFuncEntryExit = Args.hasFlag(options::OPT_fsanitize_thread_func_entry_exit,
547                                      options::OPT_fno_sanitize_thread_func_entry_exit,
548                                      TsanFuncEntryExit);
549     TsanAtomics = Args.hasFlag(options::OPT_fsanitize_thread_atomics,
550                                options::OPT_fno_sanitize_thread_atomics,
551                                TsanAtomics);
552   }
553 
554   if (AllAddedKinds & CFI) {
555     CfiCrossDso = Args.hasFlag(options::OPT_fsanitize_cfi_cross_dso,
556                                options::OPT_fno_sanitize_cfi_cross_dso, false);
557     // Without PIE, external function address may resolve to a PLT record, which
558     // can not be verified by the target module.
559     NeedPIE |= CfiCrossDso;
560     CfiICallGeneralizePointers =
561         Args.hasArg(options::OPT_fsanitize_cfi_icall_generalize_pointers);
562 
563     if (CfiCrossDso && CfiICallGeneralizePointers)
564       D.Diag(diag::err_drv_argument_not_allowed_with)
565           << "-fsanitize-cfi-cross-dso"
566           << "-fsanitize-cfi-icall-generalize-pointers";
567   }
568 
569   Stats = Args.hasFlag(options::OPT_fsanitize_stats,
570                        options::OPT_fno_sanitize_stats, false);
571 
572   if (MinimalRuntime) {
573     SanitizerMask IncompatibleMask =
574         Kinds & ~setGroupBits(CompatibleWithMinimalRuntime);
575     if (IncompatibleMask)
576       D.Diag(clang::diag::err_drv_argument_not_allowed_with)
577           << "-fsanitize-minimal-runtime"
578           << lastArgumentForMask(D, Args, IncompatibleMask);
579 
580     SanitizerMask NonTrappingCfi = Kinds & CFI & ~TrappingKinds;
581     if (NonTrappingCfi)
582       D.Diag(clang::diag::err_drv_argument_only_allowed_with)
583           << "fsanitize-minimal-runtime"
584           << "fsanitize-trap=cfi";
585   }
586 
587   // Parse -f(no-)?sanitize-coverage flags if coverage is supported by the
588   // enabled sanitizers.
589   for (const auto *Arg : Args) {
590     if (Arg->getOption().matches(options::OPT_fsanitize_coverage)) {
591       int LegacySanitizeCoverage;
592       if (Arg->getNumValues() == 1 &&
593           !StringRef(Arg->getValue(0))
594                .getAsInteger(0, LegacySanitizeCoverage)) {
595         CoverageFeatures = 0;
596         Arg->claim();
597         if (LegacySanitizeCoverage != 0) {
598           D.Diag(diag::warn_drv_deprecated_arg)
599               << Arg->getAsString(Args) << "-fsanitize-coverage=trace-pc-guard";
600         }
601         continue;
602       }
603       CoverageFeatures |= parseCoverageFeatures(D, Arg);
604 
605       // Disable coverage and not claim the flags if there is at least one
606       // non-supporting sanitizer.
607       if (!(AllAddedKinds & ~AllRemove & ~setGroupBits(SupportsCoverage))) {
608         Arg->claim();
609       } else {
610         CoverageFeatures = 0;
611       }
612     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_coverage)) {
613       Arg->claim();
614       CoverageFeatures &= ~parseCoverageFeatures(D, Arg);
615     }
616   }
617   // Choose at most one coverage type: function, bb, or edge.
618   if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageBB))
619     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
620         << "-fsanitize-coverage=func"
621         << "-fsanitize-coverage=bb";
622   if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageEdge))
623     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
624         << "-fsanitize-coverage=func"
625         << "-fsanitize-coverage=edge";
626   if ((CoverageFeatures & CoverageBB) && (CoverageFeatures & CoverageEdge))
627     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
628         << "-fsanitize-coverage=bb"
629         << "-fsanitize-coverage=edge";
630   // Basic block tracing and 8-bit counters require some type of coverage
631   // enabled.
632   if (CoverageFeatures & CoverageTraceBB)
633     D.Diag(clang::diag::warn_drv_deprecated_arg)
634         << "-fsanitize-coverage=trace-bb"
635         << "-fsanitize-coverage=trace-pc-guard";
636   if (CoverageFeatures & Coverage8bitCounters)
637     D.Diag(clang::diag::warn_drv_deprecated_arg)
638         << "-fsanitize-coverage=8bit-counters"
639         << "-fsanitize-coverage=trace-pc-guard";
640 
641   int InsertionPointTypes = CoverageFunc | CoverageBB | CoverageEdge;
642   int InstrumentationTypes =
643       CoverageTracePC | CoverageTracePCGuard | CoverageInline8bitCounters;
644   if ((CoverageFeatures & InsertionPointTypes) &&
645       !(CoverageFeatures & InstrumentationTypes)) {
646     D.Diag(clang::diag::warn_drv_deprecated_arg)
647         << "-fsanitize-coverage=[func|bb|edge]"
648         << "-fsanitize-coverage=[func|bb|edge],[trace-pc-guard|trace-pc]";
649   }
650 
651   // trace-pc w/o func/bb/edge implies edge.
652   if (!(CoverageFeatures & InsertionPointTypes)) {
653     if (CoverageFeatures &
654         (CoverageTracePC | CoverageTracePCGuard | CoverageInline8bitCounters))
655       CoverageFeatures |= CoverageEdge;
656 
657     if (CoverageFeatures & CoverageStackDepth)
658       CoverageFeatures |= CoverageFunc;
659   }
660 
661   SharedRuntime =
662       Args.hasFlag(options::OPT_shared_libsan, options::OPT_static_libsan,
663                    TC.getTriple().isAndroid() || TC.getTriple().isOSFuchsia() ||
664                        TC.getTriple().isOSDarwin());
665 
666   ImplicitCfiRuntime = TC.getTriple().isAndroid();
667 
668   if (AllAddedKinds & Address) {
669     NeedPIE |= TC.getTriple().isOSFuchsia();
670     if (Arg *A =
671             Args.getLastArg(options::OPT_fsanitize_address_field_padding)) {
672         StringRef S = A->getValue();
673         // Legal values are 0 and 1, 2, but in future we may add more levels.
674         if (S.getAsInteger(0, AsanFieldPadding) || AsanFieldPadding < 0 ||
675             AsanFieldPadding > 2) {
676           D.Diag(clang::diag::err_drv_invalid_value) << A->getAsString(Args) << S;
677         }
678     }
679 
680     if (Arg *WindowsDebugRTArg =
681             Args.getLastArg(options::OPT__SLASH_MTd, options::OPT__SLASH_MT,
682                             options::OPT__SLASH_MDd, options::OPT__SLASH_MD,
683                             options::OPT__SLASH_LDd, options::OPT__SLASH_LD)) {
684       switch (WindowsDebugRTArg->getOption().getID()) {
685       case options::OPT__SLASH_MTd:
686       case options::OPT__SLASH_MDd:
687       case options::OPT__SLASH_LDd:
688         D.Diag(clang::diag::err_drv_argument_not_allowed_with)
689             << WindowsDebugRTArg->getAsString(Args)
690             << lastArgumentForMask(D, Args, Address);
691         D.Diag(clang::diag::note_drv_address_sanitizer_debug_runtime);
692       }
693     }
694 
695     AsanUseAfterScope = Args.hasFlag(
696         options::OPT_fsanitize_address_use_after_scope,
697         options::OPT_fno_sanitize_address_use_after_scope, AsanUseAfterScope);
698 
699     // As a workaround for a bug in gold 2.26 and earlier, dead stripping of
700     // globals in ASan is disabled by default on ELF targets.
701     // See https://sourceware.org/bugzilla/show_bug.cgi?id=19002
702     AsanGlobalsDeadStripping =
703         !TC.getTriple().isOSBinFormatELF() || TC.getTriple().isOSFuchsia() ||
704         Args.hasArg(options::OPT_fsanitize_address_globals_dead_stripping);
705   } else {
706     AsanUseAfterScope = false;
707   }
708 
709   if (AllAddedKinds & SafeStack) {
710     // SafeStack runtime is built into the system on Fuchsia.
711     SafeStackRuntime = !TC.getTriple().isOSFuchsia();
712   }
713 
714   // Parse -link-cxx-sanitizer flag.
715   LinkCXXRuntimes =
716       Args.hasArg(options::OPT_fsanitize_link_cxx_runtime) || D.CCCIsCXX();
717 
718   // Finally, initialize the set of available and recoverable sanitizers.
719   Sanitizers.Mask |= Kinds;
720   RecoverableSanitizers.Mask |= RecoverableKinds;
721   TrapSanitizers.Mask |= TrappingKinds;
722   assert(!(RecoverableKinds & TrappingKinds) &&
723          "Overlap between recoverable and trapping sanitizers");
724 }
725 
726 static std::string toString(const clang::SanitizerSet &Sanitizers) {
727   std::string Res;
728 #define SANITIZER(NAME, ID)                                                    \
729   if (Sanitizers.has(ID)) {                                                    \
730     if (!Res.empty())                                                          \
731       Res += ",";                                                              \
732     Res += NAME;                                                               \
733   }
734 #include "clang/Basic/Sanitizers.def"
735   return Res;
736 }
737 
738 static void addIncludeLinkerOption(const ToolChain &TC,
739                                    const llvm::opt::ArgList &Args,
740                                    llvm::opt::ArgStringList &CmdArgs,
741                                    StringRef SymbolName) {
742   SmallString<64> LinkerOptionFlag;
743   LinkerOptionFlag = "--linker-option=/include:";
744   if (TC.getTriple().getArch() == llvm::Triple::x86) {
745     // Win32 mangles C function names with a '_' prefix.
746     LinkerOptionFlag += '_';
747   }
748   LinkerOptionFlag += SymbolName;
749   CmdArgs.push_back(Args.MakeArgString(LinkerOptionFlag));
750 }
751 
752 void SanitizerArgs::addArgs(const ToolChain &TC, const llvm::opt::ArgList &Args,
753                             llvm::opt::ArgStringList &CmdArgs,
754                             types::ID InputType) const {
755   // NVPTX doesn't currently support sanitizers.  Bailing out here means that
756   // e.g. -fsanitize=address applies only to host code, which is what we want
757   // for now.
758   if (TC.getTriple().isNVPTX())
759     return;
760 
761   // Translate available CoverageFeatures to corresponding clang-cc1 flags.
762   // Do it even if Sanitizers.empty() since some forms of coverage don't require
763   // sanitizers.
764   std::pair<int, const char *> CoverageFlags[] = {
765     std::make_pair(CoverageFunc, "-fsanitize-coverage-type=1"),
766     std::make_pair(CoverageBB, "-fsanitize-coverage-type=2"),
767     std::make_pair(CoverageEdge, "-fsanitize-coverage-type=3"),
768     std::make_pair(CoverageIndirCall, "-fsanitize-coverage-indirect-calls"),
769     std::make_pair(CoverageTraceBB, "-fsanitize-coverage-trace-bb"),
770     std::make_pair(CoverageTraceCmp, "-fsanitize-coverage-trace-cmp"),
771     std::make_pair(CoverageTraceDiv, "-fsanitize-coverage-trace-div"),
772     std::make_pair(CoverageTraceGep, "-fsanitize-coverage-trace-gep"),
773     std::make_pair(Coverage8bitCounters, "-fsanitize-coverage-8bit-counters"),
774     std::make_pair(CoverageTracePC, "-fsanitize-coverage-trace-pc"),
775     std::make_pair(CoverageTracePCGuard, "-fsanitize-coverage-trace-pc-guard"),
776     std::make_pair(CoverageInline8bitCounters, "-fsanitize-coverage-inline-8bit-counters"),
777     std::make_pair(CoveragePCTable, "-fsanitize-coverage-pc-table"),
778     std::make_pair(CoverageNoPrune, "-fsanitize-coverage-no-prune"),
779     std::make_pair(CoverageStackDepth, "-fsanitize-coverage-stack-depth")};
780   for (auto F : CoverageFlags) {
781     if (CoverageFeatures & F.first)
782       CmdArgs.push_back(F.second);
783   }
784 
785   if (TC.getTriple().isOSWindows() && needsUbsanRt()) {
786     // Instruct the code generator to embed linker directives in the object file
787     // that cause the required runtime libraries to be linked.
788     CmdArgs.push_back(Args.MakeArgString(
789         "--dependent-lib=" + TC.getCompilerRT(Args, "ubsan_standalone")));
790     if (types::isCXX(InputType))
791       CmdArgs.push_back(Args.MakeArgString(
792           "--dependent-lib=" + TC.getCompilerRT(Args, "ubsan_standalone_cxx")));
793   }
794   if (TC.getTriple().isOSWindows() && needsStatsRt()) {
795     CmdArgs.push_back(Args.MakeArgString("--dependent-lib=" +
796                                          TC.getCompilerRT(Args, "stats_client")));
797 
798     // The main executable must export the stats runtime.
799     // FIXME: Only exporting from the main executable (e.g. based on whether the
800     // translation unit defines main()) would save a little space, but having
801     // multiple copies of the runtime shouldn't hurt.
802     CmdArgs.push_back(Args.MakeArgString("--dependent-lib=" +
803                                          TC.getCompilerRT(Args, "stats")));
804     addIncludeLinkerOption(TC, Args, CmdArgs, "__sanitizer_stats_register");
805   }
806 
807   if (Sanitizers.empty())
808     return;
809   CmdArgs.push_back(Args.MakeArgString("-fsanitize=" + toString(Sanitizers)));
810 
811   if (!RecoverableSanitizers.empty())
812     CmdArgs.push_back(Args.MakeArgString("-fsanitize-recover=" +
813                                          toString(RecoverableSanitizers)));
814 
815   if (!TrapSanitizers.empty())
816     CmdArgs.push_back(
817         Args.MakeArgString("-fsanitize-trap=" + toString(TrapSanitizers)));
818 
819   for (const auto &BLPath : BlacklistFiles) {
820     SmallString<64> BlacklistOpt("-fsanitize-blacklist=");
821     BlacklistOpt += BLPath;
822     CmdArgs.push_back(Args.MakeArgString(BlacklistOpt));
823   }
824   for (const auto &Dep : ExtraDeps) {
825     SmallString<64> ExtraDepOpt("-fdepfile-entry=");
826     ExtraDepOpt += Dep;
827     CmdArgs.push_back(Args.MakeArgString(ExtraDepOpt));
828   }
829 
830   if (MsanTrackOrigins)
831     CmdArgs.push_back(Args.MakeArgString("-fsanitize-memory-track-origins=" +
832                                          Twine(MsanTrackOrigins)));
833 
834   if (MsanUseAfterDtor)
835     CmdArgs.push_back("-fsanitize-memory-use-after-dtor");
836 
837   // FIXME: Pass these parameters as function attributes, not as -llvm flags.
838   if (!TsanMemoryAccess) {
839     CmdArgs.push_back("-mllvm");
840     CmdArgs.push_back("-tsan-instrument-memory-accesses=0");
841     CmdArgs.push_back("-mllvm");
842     CmdArgs.push_back("-tsan-instrument-memintrinsics=0");
843   }
844   if (!TsanFuncEntryExit) {
845     CmdArgs.push_back("-mllvm");
846     CmdArgs.push_back("-tsan-instrument-func-entry-exit=0");
847   }
848   if (!TsanAtomics) {
849     CmdArgs.push_back("-mllvm");
850     CmdArgs.push_back("-tsan-instrument-atomics=0");
851   }
852 
853   if (CfiCrossDso)
854     CmdArgs.push_back("-fsanitize-cfi-cross-dso");
855 
856   if (CfiICallGeneralizePointers)
857     CmdArgs.push_back("-fsanitize-cfi-icall-generalize-pointers");
858 
859   if (Stats)
860     CmdArgs.push_back("-fsanitize-stats");
861 
862   if (MinimalRuntime)
863     CmdArgs.push_back("-fsanitize-minimal-runtime");
864 
865   if (AsanFieldPadding)
866     CmdArgs.push_back(Args.MakeArgString("-fsanitize-address-field-padding=" +
867                                          Twine(AsanFieldPadding)));
868 
869   if (AsanUseAfterScope)
870     CmdArgs.push_back("-fsanitize-address-use-after-scope");
871 
872   if (AsanGlobalsDeadStripping)
873     CmdArgs.push_back("-fsanitize-address-globals-dead-stripping");
874 
875   // MSan: Workaround for PR16386.
876   // ASan: This is mainly to help LSan with cases such as
877   // https://github.com/google/sanitizers/issues/373
878   // We can't make this conditional on -fsanitize=leak, as that flag shouldn't
879   // affect compilation.
880   if (Sanitizers.has(Memory) || Sanitizers.has(Address))
881     CmdArgs.push_back("-fno-assume-sane-operator-new");
882 
883   // Require -fvisibility= flag on non-Windows when compiling if vptr CFI is
884   // enabled.
885   if (Sanitizers.hasOneOf(CFIClasses) && !TC.getTriple().isOSWindows() &&
886       !Args.hasArg(options::OPT_fvisibility_EQ)) {
887     TC.getDriver().Diag(clang::diag::err_drv_argument_only_allowed_with)
888         << lastArgumentForMask(TC.getDriver(), Args,
889                                Sanitizers.Mask & CFIClasses)
890         << "-fvisibility=";
891   }
892 }
893 
894 SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A,
895                              bool DiagnoseErrors) {
896   assert((A->getOption().matches(options::OPT_fsanitize_EQ) ||
897           A->getOption().matches(options::OPT_fno_sanitize_EQ) ||
898           A->getOption().matches(options::OPT_fsanitize_recover_EQ) ||
899           A->getOption().matches(options::OPT_fno_sanitize_recover_EQ) ||
900           A->getOption().matches(options::OPT_fsanitize_trap_EQ) ||
901           A->getOption().matches(options::OPT_fno_sanitize_trap_EQ)) &&
902          "Invalid argument in parseArgValues!");
903   SanitizerMask Kinds = 0;
904   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
905     const char *Value = A->getValue(i);
906     SanitizerMask Kind;
907     // Special case: don't accept -fsanitize=all.
908     if (A->getOption().matches(options::OPT_fsanitize_EQ) &&
909         0 == strcmp("all", Value))
910       Kind = 0;
911     // Similarly, don't accept -fsanitize=efficiency-all.
912     else if (A->getOption().matches(options::OPT_fsanitize_EQ) &&
913         0 == strcmp("efficiency-all", Value))
914       Kind = 0;
915     else
916       Kind = parseSanitizerValue(Value, /*AllowGroups=*/true);
917 
918     if (Kind)
919       Kinds |= Kind;
920     else if (DiagnoseErrors)
921       D.Diag(clang::diag::err_drv_unsupported_option_argument)
922           << A->getOption().getName() << Value;
923   }
924   return Kinds;
925 }
926 
927 int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A) {
928   assert(A->getOption().matches(options::OPT_fsanitize_coverage) ||
929          A->getOption().matches(options::OPT_fno_sanitize_coverage));
930   int Features = 0;
931   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
932     const char *Value = A->getValue(i);
933     int F = llvm::StringSwitch<int>(Value)
934         .Case("func", CoverageFunc)
935         .Case("bb", CoverageBB)
936         .Case("edge", CoverageEdge)
937         .Case("indirect-calls", CoverageIndirCall)
938         .Case("trace-bb", CoverageTraceBB)
939         .Case("trace-cmp", CoverageTraceCmp)
940         .Case("trace-div", CoverageTraceDiv)
941         .Case("trace-gep", CoverageTraceGep)
942         .Case("8bit-counters", Coverage8bitCounters)
943         .Case("trace-pc", CoverageTracePC)
944         .Case("trace-pc-guard", CoverageTracePCGuard)
945         .Case("no-prune", CoverageNoPrune)
946         .Case("inline-8bit-counters", CoverageInline8bitCounters)
947         .Case("pc-table", CoveragePCTable)
948         .Case("stack-depth", CoverageStackDepth)
949         .Default(0);
950     if (F == 0)
951       D.Diag(clang::diag::err_drv_unsupported_option_argument)
952           << A->getOption().getName() << Value;
953     Features |= F;
954   }
955   return Features;
956 }
957 
958 std::string lastArgumentForMask(const Driver &D, const llvm::opt::ArgList &Args,
959                                 SanitizerMask Mask) {
960   for (llvm::opt::ArgList::const_reverse_iterator I = Args.rbegin(),
961                                                   E = Args.rend();
962        I != E; ++I) {
963     const auto *Arg = *I;
964     if (Arg->getOption().matches(options::OPT_fsanitize_EQ)) {
965       SanitizerMask AddKinds =
966           expandSanitizerGroups(parseArgValues(D, Arg, false));
967       if (AddKinds & Mask)
968         return describeSanitizeArg(Arg, Mask);
969     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_EQ)) {
970       SanitizerMask RemoveKinds =
971           expandSanitizerGroups(parseArgValues(D, Arg, false));
972       Mask &= ~RemoveKinds;
973     }
974   }
975   llvm_unreachable("arg list didn't provide expected value");
976 }
977 
978 std::string describeSanitizeArg(const llvm::opt::Arg *A, SanitizerMask Mask) {
979   assert(A->getOption().matches(options::OPT_fsanitize_EQ)
980          && "Invalid argument in describeSanitizerArg!");
981 
982   std::string Sanitizers;
983   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
984     if (expandSanitizerGroups(
985             parseSanitizerValue(A->getValue(i), /*AllowGroups=*/true)) &
986         Mask) {
987       if (!Sanitizers.empty())
988         Sanitizers += ",";
989       Sanitizers += A->getValue(i);
990     }
991   }
992 
993   assert(!Sanitizers.empty() && "arg didn't provide expected value");
994   return "-fsanitize=" + Sanitizers;
995 }
996