1 //===-- AddressSanitizer.cpp - memory error detector ------------*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file is a part of AddressSanitizer, an address sanity checker. 11 // Details of the algorithm: 12 // http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm 13 // 14 //===----------------------------------------------------------------------===// 15 16 #include "llvm/ADT/ArrayRef.h" 17 #include "llvm/ADT/DenseMap.h" 18 #include "llvm/ADT/DepthFirstIterator.h" 19 #include "llvm/ADT/SetVector.h" 20 #include "llvm/ADT/SmallSet.h" 21 #include "llvm/ADT/SmallVector.h" 22 #include "llvm/ADT/Statistic.h" 23 #include "llvm/ADT/StringExtras.h" 24 #include "llvm/ADT/Triple.h" 25 #include "llvm/Analysis/MemoryBuiltins.h" 26 #include "llvm/Analysis/TargetLibraryInfo.h" 27 #include "llvm/Analysis/ValueTracking.h" 28 #include "llvm/IR/CallSite.h" 29 #include "llvm/IR/DIBuilder.h" 30 #include "llvm/IR/DataLayout.h" 31 #include "llvm/IR/Dominators.h" 32 #include "llvm/IR/Function.h" 33 #include "llvm/IR/IRBuilder.h" 34 #include "llvm/IR/InlineAsm.h" 35 #include "llvm/IR/InstVisitor.h" 36 #include "llvm/IR/IntrinsicInst.h" 37 #include "llvm/IR/LLVMContext.h" 38 #include "llvm/IR/MDBuilder.h" 39 #include "llvm/IR/Module.h" 40 #include "llvm/IR/Type.h" 41 #include "llvm/MC/MCSectionMachO.h" 42 #include "llvm/Support/CommandLine.h" 43 #include "llvm/Support/DataTypes.h" 44 #include "llvm/Support/Debug.h" 45 #include "llvm/Support/Endian.h" 46 #include "llvm/Support/SwapByteOrder.h" 47 #include "llvm/Support/raw_ostream.h" 48 #include "llvm/Transforms/Instrumentation.h" 49 #include "llvm/Transforms/Scalar.h" 50 #include "llvm/Transforms/Utils/ASanStackFrameLayout.h" 51 #include "llvm/Transforms/Utils/BasicBlockUtils.h" 52 #include "llvm/Transforms/Utils/Cloning.h" 53 #include "llvm/Transforms/Utils/Local.h" 54 #include "llvm/Transforms/Utils/ModuleUtils.h" 55 #include "llvm/Transforms/Utils/PromoteMemToReg.h" 56 #include <algorithm> 57 #include <string> 58 #include <system_error> 59 60 using namespace llvm; 61 62 #define DEBUG_TYPE "asan" 63 64 static const uint64_t kDefaultShadowScale = 3; 65 static const uint64_t kDefaultShadowOffset32 = 1ULL << 29; 66 static const uint64_t kDefaultShadowOffset64 = 1ULL << 44; 67 static const uint64_t kIOSShadowOffset32 = 1ULL << 30; 68 static const uint64_t kIOSShadowOffset64 = 0x120200000; 69 static const uint64_t kIOSSimShadowOffset32 = 1ULL << 30; 70 static const uint64_t kIOSSimShadowOffset64 = kDefaultShadowOffset64; 71 static const uint64_t kSmallX86_64ShadowOffset = 0x7FFF8000; // < 2G. 72 static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000; 73 static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 41; 74 static const uint64_t kSystemZ_ShadowOffset64 = 1ULL << 52; 75 static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000; 76 static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37; 77 static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36; 78 static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30; 79 static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46; 80 static const uint64_t kWindowsShadowOffset32 = 3ULL << 28; 81 82 static const size_t kMinStackMallocSize = 1 << 6; // 64B 83 static const size_t kMaxStackMallocSize = 1 << 16; // 64K 84 static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; 85 static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; 86 87 static const char *const kAsanModuleCtorName = "asan.module_ctor"; 88 static const char *const kAsanModuleDtorName = "asan.module_dtor"; 89 static const uint64_t kAsanCtorAndDtorPriority = 1; 90 static const char *const kAsanReportErrorTemplate = "__asan_report_"; 91 static const char *const kAsanRegisterGlobalsName = "__asan_register_globals"; 92 static const char *const kAsanUnregisterGlobalsName = 93 "__asan_unregister_globals"; 94 static const char *const kAsanRegisterImageGlobalsName = 95 "__asan_register_image_globals"; 96 static const char *const kAsanUnregisterImageGlobalsName = 97 "__asan_unregister_image_globals"; 98 static const char *const kAsanPoisonGlobalsName = "__asan_before_dynamic_init"; 99 static const char *const kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"; 100 static const char *const kAsanInitName = "__asan_init"; 101 static const char *const kAsanVersionCheckName = 102 "__asan_version_mismatch_check_v8"; 103 static const char *const kAsanPtrCmp = "__sanitizer_ptr_cmp"; 104 static const char *const kAsanPtrSub = "__sanitizer_ptr_sub"; 105 static const char *const kAsanHandleNoReturnName = "__asan_handle_no_return"; 106 static const int kMaxAsanStackMallocSizeClass = 10; 107 static const char *const kAsanStackMallocNameTemplate = "__asan_stack_malloc_"; 108 static const char *const kAsanStackFreeNameTemplate = "__asan_stack_free_"; 109 static const char *const kAsanGenPrefix = "__asan_gen_"; 110 static const char *const kODRGenPrefix = "__odr_asan_gen_"; 111 static const char *const kSanCovGenPrefix = "__sancov_gen_"; 112 static const char *const kAsanPoisonStackMemoryName = 113 "__asan_poison_stack_memory"; 114 static const char *const kAsanUnpoisonStackMemoryName = 115 "__asan_unpoison_stack_memory"; 116 static const char *const kAsanGlobalsRegisteredFlagName = 117 "__asan_globals_registered"; 118 119 static const char *const kAsanOptionDetectUAR = 120 "__asan_option_detect_stack_use_after_return"; 121 122 static const char *const kAsanAllocaPoison = "__asan_alloca_poison"; 123 static const char *const kAsanAllocasUnpoison = "__asan_allocas_unpoison"; 124 125 // Accesses sizes are powers of two: 1, 2, 4, 8, 16. 126 static const size_t kNumberOfAccessSizes = 5; 127 128 static const unsigned kAllocaRzSize = 32; 129 130 // Command-line flags. 131 static cl::opt<bool> ClEnableKasan( 132 "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"), 133 cl::Hidden, cl::init(false)); 134 static cl::opt<bool> ClRecover( 135 "asan-recover", 136 cl::desc("Enable recovery mode (continue-after-error)."), 137 cl::Hidden, cl::init(false)); 138 139 // This flag may need to be replaced with -f[no-]asan-reads. 140 static cl::opt<bool> ClInstrumentReads("asan-instrument-reads", 141 cl::desc("instrument read instructions"), 142 cl::Hidden, cl::init(true)); 143 static cl::opt<bool> ClInstrumentWrites( 144 "asan-instrument-writes", cl::desc("instrument write instructions"), 145 cl::Hidden, cl::init(true)); 146 static cl::opt<bool> ClInstrumentAtomics( 147 "asan-instrument-atomics", 148 cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, 149 cl::init(true)); 150 static cl::opt<bool> ClAlwaysSlowPath( 151 "asan-always-slow-path", 152 cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, 153 cl::init(false)); 154 // This flag limits the number of instructions to be instrumented 155 // in any given BB. Normally, this should be set to unlimited (INT_MAX), 156 // but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary 157 // set it to 10000. 158 static cl::opt<int> ClMaxInsnsToInstrumentPerBB( 159 "asan-max-ins-per-bb", cl::init(10000), 160 cl::desc("maximal number of instructions to instrument in any given BB"), 161 cl::Hidden); 162 // This flag may need to be replaced with -f[no]asan-stack. 163 static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"), 164 cl::Hidden, cl::init(true)); 165 static cl::opt<bool> ClUseAfterReturn("asan-use-after-return", 166 cl::desc("Check stack-use-after-return"), 167 cl::Hidden, cl::init(true)); 168 static cl::opt<bool> ClUseAfterScope("asan-use-after-scope", 169 cl::desc("Check stack-use-after-scope"), 170 cl::Hidden, cl::init(false)); 171 // This flag may need to be replaced with -f[no]asan-globals. 172 static cl::opt<bool> ClGlobals("asan-globals", 173 cl::desc("Handle global objects"), cl::Hidden, 174 cl::init(true)); 175 static cl::opt<bool> ClInitializers("asan-initialization-order", 176 cl::desc("Handle C++ initializer order"), 177 cl::Hidden, cl::init(true)); 178 static cl::opt<bool> ClInvalidPointerPairs( 179 "asan-detect-invalid-pointer-pair", 180 cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, 181 cl::init(false)); 182 static cl::opt<unsigned> ClRealignStack( 183 "asan-realign-stack", 184 cl::desc("Realign stack to the value of this flag (power of two)"), 185 cl::Hidden, cl::init(32)); 186 static cl::opt<int> ClInstrumentationWithCallsThreshold( 187 "asan-instrumentation-with-call-threshold", 188 cl::desc( 189 "If the function being instrumented contains more than " 190 "this number of memory accesses, use callbacks instead of " 191 "inline checks (-1 means never use callbacks)."), 192 cl::Hidden, cl::init(7000)); 193 static cl::opt<std::string> ClMemoryAccessCallbackPrefix( 194 "asan-memory-access-callback-prefix", 195 cl::desc("Prefix for memory access callbacks"), cl::Hidden, 196 cl::init("__asan_")); 197 static cl::opt<bool> ClInstrumentAllocas("asan-instrument-allocas", 198 cl::desc("instrument dynamic allocas"), 199 cl::Hidden, cl::init(true)); 200 static cl::opt<bool> ClSkipPromotableAllocas( 201 "asan-skip-promotable-allocas", 202 cl::desc("Do not instrument promotable allocas"), cl::Hidden, 203 cl::init(true)); 204 205 // These flags allow to change the shadow mapping. 206 // The shadow mapping looks like 207 // Shadow = (Mem >> scale) + offset 208 static cl::opt<int> ClMappingScale("asan-mapping-scale", 209 cl::desc("scale of asan shadow mapping"), 210 cl::Hidden, cl::init(0)); 211 static cl::opt<unsigned long long> ClMappingOffset( 212 "asan-mapping-offset", 213 cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"), cl::Hidden, 214 cl::init(0)); 215 216 // Optimization flags. Not user visible, used mostly for testing 217 // and benchmarking the tool. 218 static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"), 219 cl::Hidden, cl::init(true)); 220 static cl::opt<bool> ClOptSameTemp( 221 "asan-opt-same-temp", cl::desc("Instrument the same temp just once"), 222 cl::Hidden, cl::init(true)); 223 static cl::opt<bool> ClOptGlobals("asan-opt-globals", 224 cl::desc("Don't instrument scalar globals"), 225 cl::Hidden, cl::init(true)); 226 static cl::opt<bool> ClOptStack( 227 "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), 228 cl::Hidden, cl::init(false)); 229 230 static cl::opt<bool> ClDynamicAllocaStack( 231 "asan-stack-dynamic-alloca", 232 cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, 233 cl::init(true)); 234 235 static cl::opt<uint32_t> ClForceExperiment( 236 "asan-force-experiment", 237 cl::desc("Force optimization experiment (for testing)"), cl::Hidden, 238 cl::init(0)); 239 240 static cl::opt<bool> 241 ClUsePrivateAliasForGlobals("asan-use-private-alias", 242 cl::desc("Use private aliases for global" 243 " variables"), 244 cl::Hidden, cl::init(false)); 245 246 // Debug flags. 247 static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, 248 cl::init(0)); 249 static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), 250 cl::Hidden, cl::init(0)); 251 static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden, 252 cl::desc("Debug func")); 253 static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), 254 cl::Hidden, cl::init(-1)); 255 static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), 256 cl::Hidden, cl::init(-1)); 257 258 STATISTIC(NumInstrumentedReads, "Number of instrumented reads"); 259 STATISTIC(NumInstrumentedWrites, "Number of instrumented writes"); 260 STATISTIC(NumOptimizedAccessesToGlobalVar, 261 "Number of optimized accesses to global vars"); 262 STATISTIC(NumOptimizedAccessesToStackVar, 263 "Number of optimized accesses to stack vars"); 264 265 namespace { 266 /// Frontend-provided metadata for source location. 267 struct LocationMetadata { 268 StringRef Filename; 269 int LineNo; 270 int ColumnNo; 271 272 LocationMetadata() : Filename(), LineNo(0), ColumnNo(0) {} 273 274 bool empty() const { return Filename.empty(); } 275 276 void parse(MDNode *MDN) { 277 assert(MDN->getNumOperands() == 3); 278 MDString *DIFilename = cast<MDString>(MDN->getOperand(0)); 279 Filename = DIFilename->getString(); 280 LineNo = 281 mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue(); 282 ColumnNo = 283 mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue(); 284 } 285 }; 286 287 /// Frontend-provided metadata for global variables. 288 class GlobalsMetadata { 289 public: 290 struct Entry { 291 Entry() : SourceLoc(), Name(), IsDynInit(false), IsBlacklisted(false) {} 292 LocationMetadata SourceLoc; 293 StringRef Name; 294 bool IsDynInit; 295 bool IsBlacklisted; 296 }; 297 298 GlobalsMetadata() : inited_(false) {} 299 300 void reset() { 301 inited_ = false; 302 Entries.clear(); 303 } 304 305 void init(Module &M) { 306 assert(!inited_); 307 inited_ = true; 308 NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals"); 309 if (!Globals) return; 310 for (auto MDN : Globals->operands()) { 311 // Metadata node contains the global and the fields of "Entry". 312 assert(MDN->getNumOperands() == 5); 313 auto *GV = mdconst::extract_or_null<GlobalVariable>(MDN->getOperand(0)); 314 // The optimizer may optimize away a global entirely. 315 if (!GV) continue; 316 // We can already have an entry for GV if it was merged with another 317 // global. 318 Entry &E = Entries[GV]; 319 if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1))) 320 E.SourceLoc.parse(Loc); 321 if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2))) 322 E.Name = Name->getString(); 323 ConstantInt *IsDynInit = 324 mdconst::extract<ConstantInt>(MDN->getOperand(3)); 325 E.IsDynInit |= IsDynInit->isOne(); 326 ConstantInt *IsBlacklisted = 327 mdconst::extract<ConstantInt>(MDN->getOperand(4)); 328 E.IsBlacklisted |= IsBlacklisted->isOne(); 329 } 330 } 331 332 /// Returns metadata entry for a given global. 333 Entry get(GlobalVariable *G) const { 334 auto Pos = Entries.find(G); 335 return (Pos != Entries.end()) ? Pos->second : Entry(); 336 } 337 338 private: 339 bool inited_; 340 DenseMap<GlobalVariable *, Entry> Entries; 341 }; 342 343 /// This struct defines the shadow mapping using the rule: 344 /// shadow = (mem >> Scale) ADD-or-OR Offset. 345 struct ShadowMapping { 346 int Scale; 347 uint64_t Offset; 348 bool OrShadowOffset; 349 }; 350 351 static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize, 352 bool IsKasan) { 353 bool IsAndroid = TargetTriple.isAndroid(); 354 bool IsIOS = TargetTriple.isiOS() || TargetTriple.isWatchOS(); 355 bool IsFreeBSD = TargetTriple.isOSFreeBSD(); 356 bool IsLinux = TargetTriple.isOSLinux(); 357 bool IsPPC64 = TargetTriple.getArch() == llvm::Triple::ppc64 || 358 TargetTriple.getArch() == llvm::Triple::ppc64le; 359 bool IsSystemZ = TargetTriple.getArch() == llvm::Triple::systemz; 360 bool IsX86 = TargetTriple.getArch() == llvm::Triple::x86; 361 bool IsX86_64 = TargetTriple.getArch() == llvm::Triple::x86_64; 362 bool IsMIPS32 = TargetTriple.getArch() == llvm::Triple::mips || 363 TargetTriple.getArch() == llvm::Triple::mipsel; 364 bool IsMIPS64 = TargetTriple.getArch() == llvm::Triple::mips64 || 365 TargetTriple.getArch() == llvm::Triple::mips64el; 366 bool IsAArch64 = TargetTriple.getArch() == llvm::Triple::aarch64; 367 bool IsWindows = TargetTriple.isOSWindows(); 368 369 ShadowMapping Mapping; 370 371 if (LongSize == 32) { 372 // Android is always PIE, which means that the beginning of the address 373 // space is always available. 374 if (IsAndroid) 375 Mapping.Offset = 0; 376 else if (IsMIPS32) 377 Mapping.Offset = kMIPS32_ShadowOffset32; 378 else if (IsFreeBSD) 379 Mapping.Offset = kFreeBSD_ShadowOffset32; 380 else if (IsIOS) 381 // If we're targeting iOS and x86, the binary is built for iOS simulator. 382 Mapping.Offset = IsX86 ? kIOSSimShadowOffset32 : kIOSShadowOffset32; 383 else if (IsWindows) 384 Mapping.Offset = kWindowsShadowOffset32; 385 else 386 Mapping.Offset = kDefaultShadowOffset32; 387 } else { // LongSize == 64 388 if (IsPPC64) 389 Mapping.Offset = kPPC64_ShadowOffset64; 390 else if (IsSystemZ) 391 Mapping.Offset = kSystemZ_ShadowOffset64; 392 else if (IsFreeBSD) 393 Mapping.Offset = kFreeBSD_ShadowOffset64; 394 else if (IsLinux && IsX86_64) { 395 if (IsKasan) 396 Mapping.Offset = kLinuxKasan_ShadowOffset64; 397 else 398 Mapping.Offset = kSmallX86_64ShadowOffset; 399 } else if (IsMIPS64) 400 Mapping.Offset = kMIPS64_ShadowOffset64; 401 else if (IsIOS) 402 // If we're targeting iOS and x86, the binary is built for iOS simulator. 403 Mapping.Offset = IsX86_64 ? kIOSSimShadowOffset64 : kIOSShadowOffset64; 404 else if (IsAArch64) 405 Mapping.Offset = kAArch64_ShadowOffset64; 406 else 407 Mapping.Offset = kDefaultShadowOffset64; 408 } 409 410 Mapping.Scale = kDefaultShadowScale; 411 if (ClMappingScale.getNumOccurrences() > 0) { 412 Mapping.Scale = ClMappingScale; 413 } 414 415 if (ClMappingOffset.getNumOccurrences() > 0) { 416 Mapping.Offset = ClMappingOffset; 417 } 418 419 // OR-ing shadow offset if more efficient (at least on x86) if the offset 420 // is a power of two, but on ppc64 we have to use add since the shadow 421 // offset is not necessary 1/8-th of the address space. On SystemZ, 422 // we could OR the constant in a single instruction, but it's more 423 // efficient to load it once and use indexed addressing. 424 Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 && !IsSystemZ 425 && !(Mapping.Offset & (Mapping.Offset - 1)); 426 427 return Mapping; 428 } 429 430 static size_t RedzoneSizeForScale(int MappingScale) { 431 // Redzone used for stack and globals is at least 32 bytes. 432 // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. 433 return std::max(32U, 1U << MappingScale); 434 } 435 436 /// AddressSanitizer: instrument the code in module to find memory bugs. 437 struct AddressSanitizer : public FunctionPass { 438 explicit AddressSanitizer(bool CompileKernel = false, bool Recover = false) 439 : FunctionPass(ID), CompileKernel(CompileKernel || ClEnableKasan), 440 Recover(Recover || ClRecover) { 441 initializeAddressSanitizerPass(*PassRegistry::getPassRegistry()); 442 } 443 const char *getPassName() const override { 444 return "AddressSanitizerFunctionPass"; 445 } 446 void getAnalysisUsage(AnalysisUsage &AU) const override { 447 AU.addRequired<DominatorTreeWrapperPass>(); 448 AU.addRequired<TargetLibraryInfoWrapperPass>(); 449 } 450 uint64_t getAllocaSizeInBytes(AllocaInst *AI) const { 451 Type *Ty = AI->getAllocatedType(); 452 uint64_t SizeInBytes = 453 AI->getModule()->getDataLayout().getTypeAllocSize(Ty); 454 return SizeInBytes; 455 } 456 /// Check if we want (and can) handle this alloca. 457 bool isInterestingAlloca(AllocaInst &AI); 458 459 // Check if we have dynamic alloca. 460 bool isDynamicAlloca(AllocaInst &AI) const { 461 return AI.isArrayAllocation() || !AI.isStaticAlloca(); 462 } 463 464 /// If it is an interesting memory access, return the PointerOperand 465 /// and set IsWrite/Alignment. Otherwise return nullptr. 466 Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite, 467 uint64_t *TypeSize, unsigned *Alignment); 468 void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, Instruction *I, 469 bool UseCalls, const DataLayout &DL); 470 void instrumentPointerComparisonOrSubtraction(Instruction *I); 471 void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore, 472 Value *Addr, uint32_t TypeSize, bool IsWrite, 473 Value *SizeArgument, bool UseCalls, uint32_t Exp); 474 void instrumentUnusualSizeOrAlignment(Instruction *I, Value *Addr, 475 uint32_t TypeSize, bool IsWrite, 476 Value *SizeArgument, bool UseCalls, 477 uint32_t Exp); 478 Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 479 Value *ShadowValue, uint32_t TypeSize); 480 Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr, 481 bool IsWrite, size_t AccessSizeIndex, 482 Value *SizeArgument, uint32_t Exp); 483 void instrumentMemIntrinsic(MemIntrinsic *MI); 484 Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); 485 bool runOnFunction(Function &F) override; 486 bool maybeInsertAsanInitAtFunctionEntry(Function &F); 487 void markEscapedLocalAllocas(Function &F); 488 bool doInitialization(Module &M) override; 489 bool doFinalization(Module &M) override; 490 static char ID; // Pass identification, replacement for typeid 491 492 DominatorTree &getDominatorTree() const { return *DT; } 493 494 private: 495 void initializeCallbacks(Module &M); 496 497 bool LooksLikeCodeInBug11395(Instruction *I); 498 bool GlobalIsLinkerInitialized(GlobalVariable *G); 499 bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr, 500 uint64_t TypeSize) const; 501 502 /// Helper to cleanup per-function state. 503 struct FunctionStateRAII { 504 AddressSanitizer *Pass; 505 FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) { 506 assert(Pass->ProcessedAllocas.empty() && 507 "last pass forgot to clear cache"); 508 } 509 ~FunctionStateRAII() { Pass->ProcessedAllocas.clear(); } 510 }; 511 512 LLVMContext *C; 513 Triple TargetTriple; 514 int LongSize; 515 bool CompileKernel; 516 bool Recover; 517 Type *IntptrTy; 518 ShadowMapping Mapping; 519 DominatorTree *DT; 520 Function *AsanCtorFunction = nullptr; 521 Function *AsanInitFunction = nullptr; 522 Function *AsanHandleNoReturnFunc; 523 Function *AsanPtrCmpFunction, *AsanPtrSubFunction; 524 // This array is indexed by AccessIsWrite, Experiment and log2(AccessSize). 525 Function *AsanErrorCallback[2][2][kNumberOfAccessSizes]; 526 Function *AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes]; 527 // This array is indexed by AccessIsWrite and Experiment. 528 Function *AsanErrorCallbackSized[2][2]; 529 Function *AsanMemoryAccessCallbackSized[2][2]; 530 Function *AsanMemmove, *AsanMemcpy, *AsanMemset; 531 InlineAsm *EmptyAsm; 532 GlobalsMetadata GlobalsMD; 533 DenseMap<AllocaInst *, bool> ProcessedAllocas; 534 535 friend struct FunctionStackPoisoner; 536 }; 537 538 class AddressSanitizerModule : public ModulePass { 539 public: 540 explicit AddressSanitizerModule(bool CompileKernel = false, 541 bool Recover = false) 542 : ModulePass(ID), CompileKernel(CompileKernel || ClEnableKasan), 543 Recover(Recover || ClRecover) {} 544 bool runOnModule(Module &M) override; 545 static char ID; // Pass identification, replacement for typeid 546 const char *getPassName() const override { return "AddressSanitizerModule"; } 547 548 private: 549 void initializeCallbacks(Module &M); 550 551 bool InstrumentGlobals(IRBuilder<> &IRB, Module &M); 552 bool ShouldInstrumentGlobal(GlobalVariable *G); 553 bool ShouldUseMachOGlobalsSection() const; 554 void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName); 555 void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName); 556 size_t MinRedzoneSizeForGlobal() const { 557 return RedzoneSizeForScale(Mapping.Scale); 558 } 559 560 GlobalsMetadata GlobalsMD; 561 bool CompileKernel; 562 bool Recover; 563 Type *IntptrTy; 564 LLVMContext *C; 565 Triple TargetTriple; 566 ShadowMapping Mapping; 567 Function *AsanPoisonGlobals; 568 Function *AsanUnpoisonGlobals; 569 Function *AsanRegisterGlobals; 570 Function *AsanUnregisterGlobals; 571 Function *AsanRegisterImageGlobals; 572 Function *AsanUnregisterImageGlobals; 573 }; 574 575 // Stack poisoning does not play well with exception handling. 576 // When an exception is thrown, we essentially bypass the code 577 // that unpoisones the stack. This is why the run-time library has 578 // to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire 579 // stack in the interceptor. This however does not work inside the 580 // actual function which catches the exception. Most likely because the 581 // compiler hoists the load of the shadow value somewhere too high. 582 // This causes asan to report a non-existing bug on 453.povray. 583 // It sounds like an LLVM bug. 584 struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> { 585 Function &F; 586 AddressSanitizer &ASan; 587 DIBuilder DIB; 588 LLVMContext *C; 589 Type *IntptrTy; 590 Type *IntptrPtrTy; 591 ShadowMapping Mapping; 592 593 SmallVector<AllocaInst *, 16> AllocaVec; 594 SmallSetVector<AllocaInst *, 16> NonInstrumentedStaticAllocaVec; 595 SmallVector<Instruction *, 8> RetVec; 596 unsigned StackAlignment; 597 598 Function *AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1], 599 *AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1]; 600 Function *AsanPoisonStackMemoryFunc, *AsanUnpoisonStackMemoryFunc; 601 Function *AsanAllocaPoisonFunc, *AsanAllocasUnpoisonFunc; 602 603 // Stores a place and arguments of poisoning/unpoisoning call for alloca. 604 struct AllocaPoisonCall { 605 IntrinsicInst *InsBefore; 606 AllocaInst *AI; 607 uint64_t Size; 608 bool DoPoison; 609 }; 610 SmallVector<AllocaPoisonCall, 8> AllocaPoisonCallVec; 611 612 SmallVector<AllocaInst *, 1> DynamicAllocaVec; 613 SmallVector<IntrinsicInst *, 1> StackRestoreVec; 614 AllocaInst *DynamicAllocaLayout = nullptr; 615 IntrinsicInst *LocalEscapeCall = nullptr; 616 617 // Maps Value to an AllocaInst from which the Value is originated. 618 typedef DenseMap<Value *, AllocaInst *> AllocaForValueMapTy; 619 AllocaForValueMapTy AllocaForValue; 620 621 bool HasNonEmptyInlineAsm = false; 622 bool HasReturnsTwiceCall = false; 623 std::unique_ptr<CallInst> EmptyInlineAsm; 624 625 FunctionStackPoisoner(Function &F, AddressSanitizer &ASan) 626 : F(F), 627 ASan(ASan), 628 DIB(*F.getParent(), /*AllowUnresolved*/ false), 629 C(ASan.C), 630 IntptrTy(ASan.IntptrTy), 631 IntptrPtrTy(PointerType::get(IntptrTy, 0)), 632 Mapping(ASan.Mapping), 633 StackAlignment(1 << Mapping.Scale), 634 EmptyInlineAsm(CallInst::Create(ASan.EmptyAsm)) {} 635 636 bool runOnFunction() { 637 if (!ClStack) return false; 638 // Collect alloca, ret, lifetime instructions etc. 639 for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB); 640 641 if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false; 642 643 initializeCallbacks(*F.getParent()); 644 645 poisonStack(); 646 647 if (ClDebugStack) { 648 DEBUG(dbgs() << F); 649 } 650 return true; 651 } 652 653 // Finds all Alloca instructions and puts 654 // poisoned red zones around all of them. 655 // Then unpoison everything back before the function returns. 656 void poisonStack(); 657 658 void createDynamicAllocasInitStorage(); 659 660 // ----------------------- Visitors. 661 /// \brief Collect all Ret instructions. 662 void visitReturnInst(ReturnInst &RI) { RetVec.push_back(&RI); } 663 664 void unpoisonDynamicAllocasBeforeInst(Instruction *InstBefore, 665 Value *SavedStack) { 666 IRBuilder<> IRB(InstBefore); 667 Value *DynamicAreaPtr = IRB.CreatePtrToInt(SavedStack, IntptrTy); 668 // When we insert _asan_allocas_unpoison before @llvm.stackrestore, we 669 // need to adjust extracted SP to compute the address of the most recent 670 // alloca. We have a special @llvm.get.dynamic.area.offset intrinsic for 671 // this purpose. 672 if (!isa<ReturnInst>(InstBefore)) { 673 Function *DynamicAreaOffsetFunc = Intrinsic::getDeclaration( 674 InstBefore->getModule(), Intrinsic::get_dynamic_area_offset, 675 {IntptrTy}); 676 677 Value *DynamicAreaOffset = IRB.CreateCall(DynamicAreaOffsetFunc, {}); 678 679 DynamicAreaPtr = IRB.CreateAdd(IRB.CreatePtrToInt(SavedStack, IntptrTy), 680 DynamicAreaOffset); 681 } 682 683 IRB.CreateCall(AsanAllocasUnpoisonFunc, 684 {IRB.CreateLoad(DynamicAllocaLayout), DynamicAreaPtr}); 685 } 686 687 // Unpoison dynamic allocas redzones. 688 void unpoisonDynamicAllocas() { 689 for (auto &Ret : RetVec) 690 unpoisonDynamicAllocasBeforeInst(Ret, DynamicAllocaLayout); 691 692 for (auto &StackRestoreInst : StackRestoreVec) 693 unpoisonDynamicAllocasBeforeInst(StackRestoreInst, 694 StackRestoreInst->getOperand(0)); 695 } 696 697 // Deploy and poison redzones around dynamic alloca call. To do this, we 698 // should replace this call with another one with changed parameters and 699 // replace all its uses with new address, so 700 // addr = alloca type, old_size, align 701 // is replaced by 702 // new_size = (old_size + additional_size) * sizeof(type) 703 // tmp = alloca i8, new_size, max(align, 32) 704 // addr = tmp + 32 (first 32 bytes are for the left redzone). 705 // Additional_size is added to make new memory allocation contain not only 706 // requested memory, but also left, partial and right redzones. 707 void handleDynamicAllocaCall(AllocaInst *AI); 708 709 /// \brief Collect Alloca instructions we want (and can) handle. 710 void visitAllocaInst(AllocaInst &AI) { 711 if (!ASan.isInterestingAlloca(AI)) { 712 if (AI.isStaticAlloca()) NonInstrumentedStaticAllocaVec.insert(&AI); 713 return; 714 } 715 716 StackAlignment = std::max(StackAlignment, AI.getAlignment()); 717 if (ASan.isDynamicAlloca(AI)) 718 DynamicAllocaVec.push_back(&AI); 719 else 720 AllocaVec.push_back(&AI); 721 } 722 723 /// \brief Collect lifetime intrinsic calls to check for use-after-scope 724 /// errors. 725 void visitIntrinsicInst(IntrinsicInst &II) { 726 Intrinsic::ID ID = II.getIntrinsicID(); 727 if (ID == Intrinsic::stackrestore) StackRestoreVec.push_back(&II); 728 if (ID == Intrinsic::localescape) LocalEscapeCall = &II; 729 if (!ClUseAfterScope) return; 730 if (ID != Intrinsic::lifetime_start && ID != Intrinsic::lifetime_end) 731 return; 732 // Found lifetime intrinsic, add ASan instrumentation if necessary. 733 ConstantInt *Size = dyn_cast<ConstantInt>(II.getArgOperand(0)); 734 // If size argument is undefined, don't do anything. 735 if (Size->isMinusOne()) return; 736 // Check that size doesn't saturate uint64_t and can 737 // be stored in IntptrTy. 738 const uint64_t SizeValue = Size->getValue().getLimitedValue(); 739 if (SizeValue == ~0ULL || 740 !ConstantInt::isValueValidForType(IntptrTy, SizeValue)) 741 return; 742 // Find alloca instruction that corresponds to llvm.lifetime argument. 743 AllocaInst *AI = findAllocaForValue(II.getArgOperand(1)); 744 if (!AI) return; 745 bool DoPoison = (ID == Intrinsic::lifetime_end); 746 AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison}; 747 AllocaPoisonCallVec.push_back(APC); 748 } 749 750 void visitCallSite(CallSite CS) { 751 Instruction *I = CS.getInstruction(); 752 if (CallInst *CI = dyn_cast<CallInst>(I)) { 753 HasNonEmptyInlineAsm |= 754 CI->isInlineAsm() && !CI->isIdenticalTo(EmptyInlineAsm.get()); 755 HasReturnsTwiceCall |= CI->canReturnTwice(); 756 } 757 } 758 759 // ---------------------- Helpers. 760 void initializeCallbacks(Module &M); 761 762 bool doesDominateAllExits(const Instruction *I) const { 763 for (auto Ret : RetVec) { 764 if (!ASan.getDominatorTree().dominates(I, Ret)) return false; 765 } 766 return true; 767 } 768 769 /// Finds alloca where the value comes from. 770 AllocaInst *findAllocaForValue(Value *V); 771 void poisonRedZones(ArrayRef<uint8_t> ShadowBytes, IRBuilder<> &IRB, 772 Value *ShadowBase, bool DoPoison); 773 void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison); 774 775 void SetShadowToStackAfterReturnInlined(IRBuilder<> &IRB, Value *ShadowBase, 776 int Size); 777 Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L, 778 bool Dynamic); 779 PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue, 780 Instruction *ThenTerm, Value *ValueIfFalse); 781 }; 782 783 } // anonymous namespace 784 785 char AddressSanitizer::ID = 0; 786 INITIALIZE_PASS_BEGIN( 787 AddressSanitizer, "asan", 788 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, 789 false) 790 INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass) 791 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass) 792 INITIALIZE_PASS_END( 793 AddressSanitizer, "asan", 794 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, 795 false) 796 FunctionPass *llvm::createAddressSanitizerFunctionPass(bool CompileKernel, 797 bool Recover) { 798 assert(!CompileKernel || Recover); 799 return new AddressSanitizer(CompileKernel, Recover); 800 } 801 802 char AddressSanitizerModule::ID = 0; 803 INITIALIZE_PASS( 804 AddressSanitizerModule, "asan-module", 805 "AddressSanitizer: detects use-after-free and out-of-bounds bugs." 806 "ModulePass", 807 false, false) 808 ModulePass *llvm::createAddressSanitizerModulePass(bool CompileKernel, 809 bool Recover) { 810 assert(!CompileKernel || Recover); 811 return new AddressSanitizerModule(CompileKernel, Recover); 812 } 813 814 static size_t TypeSizeToSizeIndex(uint32_t TypeSize) { 815 size_t Res = countTrailingZeros(TypeSize / 8); 816 assert(Res < kNumberOfAccessSizes); 817 return Res; 818 } 819 820 // \brief Create a constant for Str so that we can pass it to the run-time lib. 821 static GlobalVariable *createPrivateGlobalForString(Module &M, StringRef Str, 822 bool AllowMerging) { 823 Constant *StrConst = ConstantDataArray::getString(M.getContext(), Str); 824 // We use private linkage for module-local strings. If they can be merged 825 // with another one, we set the unnamed_addr attribute. 826 GlobalVariable *GV = 827 new GlobalVariable(M, StrConst->getType(), true, 828 GlobalValue::PrivateLinkage, StrConst, kAsanGenPrefix); 829 if (AllowMerging) GV->setUnnamedAddr(true); 830 GV->setAlignment(1); // Strings may not be merged w/o setting align 1. 831 return GV; 832 } 833 834 /// \brief Create a global describing a source location. 835 static GlobalVariable *createPrivateGlobalForSourceLoc(Module &M, 836 LocationMetadata MD) { 837 Constant *LocData[] = { 838 createPrivateGlobalForString(M, MD.Filename, true), 839 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo), 840 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo), 841 }; 842 auto LocStruct = ConstantStruct::getAnon(LocData); 843 auto GV = new GlobalVariable(M, LocStruct->getType(), true, 844 GlobalValue::PrivateLinkage, LocStruct, 845 kAsanGenPrefix); 846 GV->setUnnamedAddr(true); 847 return GV; 848 } 849 850 static bool GlobalWasGeneratedByAsan(GlobalVariable *G) { 851 return G->getName().find(kAsanGenPrefix) == 0 || 852 G->getName().find(kSanCovGenPrefix) == 0 || 853 G->getName().find(kODRGenPrefix) == 0; 854 } 855 856 Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { 857 // Shadow >> scale 858 Shadow = IRB.CreateLShr(Shadow, Mapping.Scale); 859 if (Mapping.Offset == 0) return Shadow; 860 // (Shadow >> scale) | offset 861 if (Mapping.OrShadowOffset) 862 return IRB.CreateOr(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset)); 863 else 864 return IRB.CreateAdd(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset)); 865 } 866 867 // Instrument memset/memmove/memcpy 868 void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { 869 IRBuilder<> IRB(MI); 870 if (isa<MemTransferInst>(MI)) { 871 IRB.CreateCall( 872 isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy, 873 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), 874 IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()), 875 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); 876 } else if (isa<MemSetInst>(MI)) { 877 IRB.CreateCall( 878 AsanMemset, 879 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), 880 IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false), 881 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); 882 } 883 MI->eraseFromParent(); 884 } 885 886 /// Check if we want (and can) handle this alloca. 887 bool AddressSanitizer::isInterestingAlloca(AllocaInst &AI) { 888 auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI); 889 890 if (PreviouslySeenAllocaInfo != ProcessedAllocas.end()) 891 return PreviouslySeenAllocaInfo->getSecond(); 892 893 bool IsInteresting = 894 (AI.getAllocatedType()->isSized() && 895 // alloca() may be called with 0 size, ignore it. 896 getAllocaSizeInBytes(&AI) > 0 && 897 // We are only interested in allocas not promotable to registers. 898 // Promotable allocas are common under -O0. 899 (!ClSkipPromotableAllocas || !isAllocaPromotable(&AI)) && 900 // inalloca allocas are not treated as static, and we don't want 901 // dynamic alloca instrumentation for them as well. 902 !AI.isUsedWithInAlloca()); 903 904 ProcessedAllocas[&AI] = IsInteresting; 905 return IsInteresting; 906 } 907 908 /// If I is an interesting memory access, return the PointerOperand 909 /// and set IsWrite/Alignment. Otherwise return nullptr. 910 Value *AddressSanitizer::isInterestingMemoryAccess(Instruction *I, 911 bool *IsWrite, 912 uint64_t *TypeSize, 913 unsigned *Alignment) { 914 // Skip memory accesses inserted by another instrumentation. 915 if (I->getMetadata("nosanitize")) return nullptr; 916 917 Value *PtrOperand = nullptr; 918 const DataLayout &DL = I->getModule()->getDataLayout(); 919 if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 920 if (!ClInstrumentReads) return nullptr; 921 *IsWrite = false; 922 *TypeSize = DL.getTypeStoreSizeInBits(LI->getType()); 923 *Alignment = LI->getAlignment(); 924 PtrOperand = LI->getPointerOperand(); 925 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) { 926 if (!ClInstrumentWrites) return nullptr; 927 *IsWrite = true; 928 *TypeSize = DL.getTypeStoreSizeInBits(SI->getValueOperand()->getType()); 929 *Alignment = SI->getAlignment(); 930 PtrOperand = SI->getPointerOperand(); 931 } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { 932 if (!ClInstrumentAtomics) return nullptr; 933 *IsWrite = true; 934 *TypeSize = DL.getTypeStoreSizeInBits(RMW->getValOperand()->getType()); 935 *Alignment = 0; 936 PtrOperand = RMW->getPointerOperand(); 937 } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { 938 if (!ClInstrumentAtomics) return nullptr; 939 *IsWrite = true; 940 *TypeSize = DL.getTypeStoreSizeInBits(XCHG->getCompareOperand()->getType()); 941 *Alignment = 0; 942 PtrOperand = XCHG->getPointerOperand(); 943 } 944 945 // Treat memory accesses to promotable allocas as non-interesting since they 946 // will not cause memory violations. This greatly speeds up the instrumented 947 // executable at -O0. 948 if (ClSkipPromotableAllocas) 949 if (auto AI = dyn_cast_or_null<AllocaInst>(PtrOperand)) 950 return isInterestingAlloca(*AI) ? AI : nullptr; 951 952 return PtrOperand; 953 } 954 955 static bool isPointerOperand(Value *V) { 956 return V->getType()->isPointerTy() || isa<PtrToIntInst>(V); 957 } 958 959 // This is a rough heuristic; it may cause both false positives and 960 // false negatives. The proper implementation requires cooperation with 961 // the frontend. 962 static bool isInterestingPointerComparisonOrSubtraction(Instruction *I) { 963 if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) { 964 if (!Cmp->isRelational()) return false; 965 } else if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) { 966 if (BO->getOpcode() != Instruction::Sub) return false; 967 } else { 968 return false; 969 } 970 return isPointerOperand(I->getOperand(0)) && 971 isPointerOperand(I->getOperand(1)); 972 } 973 974 bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) { 975 // If a global variable does not have dynamic initialization we don't 976 // have to instrument it. However, if a global does not have initializer 977 // at all, we assume it has dynamic initializer (in other TU). 978 return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit; 979 } 980 981 void AddressSanitizer::instrumentPointerComparisonOrSubtraction( 982 Instruction *I) { 983 IRBuilder<> IRB(I); 984 Function *F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction; 985 Value *Param[2] = {I->getOperand(0), I->getOperand(1)}; 986 for (int i = 0; i < 2; i++) { 987 if (Param[i]->getType()->isPointerTy()) 988 Param[i] = IRB.CreatePointerCast(Param[i], IntptrTy); 989 } 990 IRB.CreateCall(F, Param); 991 } 992 993 void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, 994 Instruction *I, bool UseCalls, 995 const DataLayout &DL) { 996 bool IsWrite = false; 997 unsigned Alignment = 0; 998 uint64_t TypeSize = 0; 999 Value *Addr = isInterestingMemoryAccess(I, &IsWrite, &TypeSize, &Alignment); 1000 assert(Addr); 1001 1002 // Optimization experiments. 1003 // The experiments can be used to evaluate potential optimizations that remove 1004 // instrumentation (assess false negatives). Instead of completely removing 1005 // some instrumentation, you set Exp to a non-zero value (mask of optimization 1006 // experiments that want to remove instrumentation of this instruction). 1007 // If Exp is non-zero, this pass will emit special calls into runtime 1008 // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls 1009 // make runtime terminate the program in a special way (with a different 1010 // exit status). Then you run the new compiler on a buggy corpus, collect 1011 // the special terminations (ideally, you don't see them at all -- no false 1012 // negatives) and make the decision on the optimization. 1013 uint32_t Exp = ClForceExperiment; 1014 1015 if (ClOpt && ClOptGlobals) { 1016 // If initialization order checking is disabled, a simple access to a 1017 // dynamically initialized global is always valid. 1018 GlobalVariable *G = dyn_cast<GlobalVariable>(GetUnderlyingObject(Addr, DL)); 1019 if (G && (!ClInitializers || GlobalIsLinkerInitialized(G)) && 1020 isSafeAccess(ObjSizeVis, Addr, TypeSize)) { 1021 NumOptimizedAccessesToGlobalVar++; 1022 return; 1023 } 1024 } 1025 1026 if (ClOpt && ClOptStack) { 1027 // A direct inbounds access to a stack variable is always valid. 1028 if (isa<AllocaInst>(GetUnderlyingObject(Addr, DL)) && 1029 isSafeAccess(ObjSizeVis, Addr, TypeSize)) { 1030 NumOptimizedAccessesToStackVar++; 1031 return; 1032 } 1033 } 1034 1035 if (IsWrite) 1036 NumInstrumentedWrites++; 1037 else 1038 NumInstrumentedReads++; 1039 1040 unsigned Granularity = 1 << Mapping.Scale; 1041 // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check 1042 // if the data is properly aligned. 1043 if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 || 1044 TypeSize == 128) && 1045 (Alignment >= Granularity || Alignment == 0 || Alignment >= TypeSize / 8)) 1046 return instrumentAddress(I, I, Addr, TypeSize, IsWrite, nullptr, UseCalls, 1047 Exp); 1048 instrumentUnusualSizeOrAlignment(I, Addr, TypeSize, IsWrite, nullptr, 1049 UseCalls, Exp); 1050 } 1051 1052 Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore, 1053 Value *Addr, bool IsWrite, 1054 size_t AccessSizeIndex, 1055 Value *SizeArgument, 1056 uint32_t Exp) { 1057 IRBuilder<> IRB(InsertBefore); 1058 Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp); 1059 CallInst *Call = nullptr; 1060 if (SizeArgument) { 1061 if (Exp == 0) 1062 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0], 1063 {Addr, SizeArgument}); 1064 else 1065 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1], 1066 {Addr, SizeArgument, ExpVal}); 1067 } else { 1068 if (Exp == 0) 1069 Call = 1070 IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr); 1071 else 1072 Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex], 1073 {Addr, ExpVal}); 1074 } 1075 1076 // We don't do Call->setDoesNotReturn() because the BB already has 1077 // UnreachableInst at the end. 1078 // This EmptyAsm is required to avoid callback merge. 1079 IRB.CreateCall(EmptyAsm, {}); 1080 return Call; 1081 } 1082 1083 Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 1084 Value *ShadowValue, 1085 uint32_t TypeSize) { 1086 size_t Granularity = static_cast<size_t>(1) << Mapping.Scale; 1087 // Addr & (Granularity - 1) 1088 Value *LastAccessedByte = 1089 IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); 1090 // (Addr & (Granularity - 1)) + size - 1 1091 if (TypeSize / 8 > 1) 1092 LastAccessedByte = IRB.CreateAdd( 1093 LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); 1094 // (uint8_t) ((Addr & (Granularity-1)) + size - 1) 1095 LastAccessedByte = 1096 IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false); 1097 // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue 1098 return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); 1099 } 1100 1101 void AddressSanitizer::instrumentAddress(Instruction *OrigIns, 1102 Instruction *InsertBefore, Value *Addr, 1103 uint32_t TypeSize, bool IsWrite, 1104 Value *SizeArgument, bool UseCalls, 1105 uint32_t Exp) { 1106 IRBuilder<> IRB(InsertBefore); 1107 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 1108 size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); 1109 1110 if (UseCalls) { 1111 if (Exp == 0) 1112 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex], 1113 AddrLong); 1114 else 1115 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex], 1116 {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)}); 1117 return; 1118 } 1119 1120 Type *ShadowTy = 1121 IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale)); 1122 Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); 1123 Value *ShadowPtr = memToShadow(AddrLong, IRB); 1124 Value *CmpVal = Constant::getNullValue(ShadowTy); 1125 Value *ShadowValue = 1126 IRB.CreateLoad(IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); 1127 1128 Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); 1129 size_t Granularity = 1ULL << Mapping.Scale; 1130 TerminatorInst *CrashTerm = nullptr; 1131 1132 if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) { 1133 // We use branch weights for the slow path check, to indicate that the slow 1134 // path is rarely taken. This seems to be the case for SPEC benchmarks. 1135 TerminatorInst *CheckTerm = SplitBlockAndInsertIfThen( 1136 Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000)); 1137 assert(cast<BranchInst>(CheckTerm)->isUnconditional()); 1138 BasicBlock *NextBB = CheckTerm->getSuccessor(0); 1139 IRB.SetInsertPoint(CheckTerm); 1140 Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); 1141 if (Recover) { 1142 CrashTerm = SplitBlockAndInsertIfThen(Cmp2, CheckTerm, false); 1143 } else { 1144 BasicBlock *CrashBlock = 1145 BasicBlock::Create(*C, "", NextBB->getParent(), NextBB); 1146 CrashTerm = new UnreachableInst(*C, CrashBlock); 1147 BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); 1148 ReplaceInstWithInst(CheckTerm, NewTerm); 1149 } 1150 } else { 1151 CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover); 1152 } 1153 1154 Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite, 1155 AccessSizeIndex, SizeArgument, Exp); 1156 Crash->setDebugLoc(OrigIns->getDebugLoc()); 1157 } 1158 1159 // Instrument unusual size or unusual alignment. 1160 // We can not do it with a single check, so we do 1-byte check for the first 1161 // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able 1162 // to report the actual access size. 1163 void AddressSanitizer::instrumentUnusualSizeOrAlignment( 1164 Instruction *I, Value *Addr, uint32_t TypeSize, bool IsWrite, 1165 Value *SizeArgument, bool UseCalls, uint32_t Exp) { 1166 IRBuilder<> IRB(I); 1167 Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8); 1168 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 1169 if (UseCalls) { 1170 if (Exp == 0) 1171 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0], 1172 {AddrLong, Size}); 1173 else 1174 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1], 1175 {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)}); 1176 } else { 1177 Value *LastByte = IRB.CreateIntToPtr( 1178 IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)), 1179 Addr->getType()); 1180 instrumentAddress(I, I, Addr, 8, IsWrite, Size, false, Exp); 1181 instrumentAddress(I, I, LastByte, 8, IsWrite, Size, false, Exp); 1182 } 1183 } 1184 1185 void AddressSanitizerModule::poisonOneInitializer(Function &GlobalInit, 1186 GlobalValue *ModuleName) { 1187 // Set up the arguments to our poison/unpoison functions. 1188 IRBuilder<> IRB(&GlobalInit.front(), 1189 GlobalInit.front().getFirstInsertionPt()); 1190 1191 // Add a call to poison all external globals before the given function starts. 1192 Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy); 1193 IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr); 1194 1195 // Add calls to unpoison all globals before each return instruction. 1196 for (auto &BB : GlobalInit.getBasicBlockList()) 1197 if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator())) 1198 CallInst::Create(AsanUnpoisonGlobals, "", RI); 1199 } 1200 1201 void AddressSanitizerModule::createInitializerPoisonCalls( 1202 Module &M, GlobalValue *ModuleName) { 1203 GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors"); 1204 1205 ConstantArray *CA = cast<ConstantArray>(GV->getInitializer()); 1206 for (Use &OP : CA->operands()) { 1207 if (isa<ConstantAggregateZero>(OP)) continue; 1208 ConstantStruct *CS = cast<ConstantStruct>(OP); 1209 1210 // Must have a function or null ptr. 1211 if (Function *F = dyn_cast<Function>(CS->getOperand(1))) { 1212 if (F->getName() == kAsanModuleCtorName) continue; 1213 ConstantInt *Priority = dyn_cast<ConstantInt>(CS->getOperand(0)); 1214 // Don't instrument CTORs that will run before asan.module_ctor. 1215 if (Priority->getLimitedValue() <= kAsanCtorAndDtorPriority) continue; 1216 poisonOneInitializer(*F, ModuleName); 1217 } 1218 } 1219 } 1220 1221 bool AddressSanitizerModule::ShouldInstrumentGlobal(GlobalVariable *G) { 1222 Type *Ty = G->getValueType(); 1223 DEBUG(dbgs() << "GLOBAL: " << *G << "\n"); 1224 1225 if (GlobalsMD.get(G).IsBlacklisted) return false; 1226 if (!Ty->isSized()) return false; 1227 if (!G->hasInitializer()) return false; 1228 if (GlobalWasGeneratedByAsan(G)) return false; // Our own global. 1229 // Touch only those globals that will not be defined in other modules. 1230 // Don't handle ODR linkage types and COMDATs since other modules may be built 1231 // without ASan. 1232 if (G->getLinkage() != GlobalVariable::ExternalLinkage && 1233 G->getLinkage() != GlobalVariable::PrivateLinkage && 1234 G->getLinkage() != GlobalVariable::InternalLinkage) 1235 return false; 1236 if (G->hasComdat()) return false; 1237 // Two problems with thread-locals: 1238 // - The address of the main thread's copy can't be computed at link-time. 1239 // - Need to poison all copies, not just the main thread's one. 1240 if (G->isThreadLocal()) return false; 1241 // For now, just ignore this Global if the alignment is large. 1242 if (G->getAlignment() > MinRedzoneSizeForGlobal()) return false; 1243 1244 if (G->hasSection()) { 1245 StringRef Section = G->getSection(); 1246 1247 // Globals from llvm.metadata aren't emitted, do not instrument them. 1248 if (Section == "llvm.metadata") return false; 1249 // Do not instrument globals from special LLVM sections. 1250 if (Section.find("__llvm") != StringRef::npos || Section.find("__LLVM") != StringRef::npos) return false; 1251 1252 // Do not instrument function pointers to initialization and termination 1253 // routines: dynamic linker will not properly handle redzones. 1254 if (Section.startswith(".preinit_array") || 1255 Section.startswith(".init_array") || 1256 Section.startswith(".fini_array")) { 1257 return false; 1258 } 1259 1260 // Callbacks put into the CRT initializer/terminator sections 1261 // should not be instrumented. 1262 // See https://code.google.com/p/address-sanitizer/issues/detail?id=305 1263 // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx 1264 if (Section.startswith(".CRT")) { 1265 DEBUG(dbgs() << "Ignoring a global initializer callback: " << *G << "\n"); 1266 return false; 1267 } 1268 1269 if (TargetTriple.isOSBinFormatMachO()) { 1270 StringRef ParsedSegment, ParsedSection; 1271 unsigned TAA = 0, StubSize = 0; 1272 bool TAAParsed; 1273 std::string ErrorCode = MCSectionMachO::ParseSectionSpecifier( 1274 Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize); 1275 assert(ErrorCode.empty() && "Invalid section specifier."); 1276 1277 // Ignore the globals from the __OBJC section. The ObjC runtime assumes 1278 // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to 1279 // them. 1280 if (ParsedSegment == "__OBJC" || 1281 (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) { 1282 DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n"); 1283 return false; 1284 } 1285 // See http://code.google.com/p/address-sanitizer/issues/detail?id=32 1286 // Constant CFString instances are compiled in the following way: 1287 // -- the string buffer is emitted into 1288 // __TEXT,__cstring,cstring_literals 1289 // -- the constant NSConstantString structure referencing that buffer 1290 // is placed into __DATA,__cfstring 1291 // Therefore there's no point in placing redzones into __DATA,__cfstring. 1292 // Moreover, it causes the linker to crash on OS X 10.7 1293 if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") { 1294 DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n"); 1295 return false; 1296 } 1297 // The linker merges the contents of cstring_literals and removes the 1298 // trailing zeroes. 1299 if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) { 1300 DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n"); 1301 return false; 1302 } 1303 } 1304 } 1305 1306 return true; 1307 } 1308 1309 // On Mach-O platforms, we emit global metadata in a separate section of the 1310 // binary in order to allow the linker to properly dead strip. This is only 1311 // supported on recent versions of ld64. 1312 bool AddressSanitizerModule::ShouldUseMachOGlobalsSection() const { 1313 if (!TargetTriple.isOSBinFormatMachO()) 1314 return false; 1315 1316 if (TargetTriple.isMacOSX() && !TargetTriple.isMacOSXVersionLT(10, 11)) 1317 return true; 1318 if (TargetTriple.isiOS() /* or tvOS */ && !TargetTriple.isOSVersionLT(9)) 1319 return true; 1320 if (TargetTriple.isWatchOS() && !TargetTriple.isOSVersionLT(2)) 1321 return true; 1322 1323 return false; 1324 } 1325 1326 void AddressSanitizerModule::initializeCallbacks(Module &M) { 1327 IRBuilder<> IRB(*C); 1328 1329 // Declare our poisoning and unpoisoning functions. 1330 AsanPoisonGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1331 kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy, nullptr)); 1332 AsanPoisonGlobals->setLinkage(Function::ExternalLinkage); 1333 AsanUnpoisonGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1334 kAsanUnpoisonGlobalsName, IRB.getVoidTy(), nullptr)); 1335 AsanUnpoisonGlobals->setLinkage(Function::ExternalLinkage); 1336 1337 // Declare functions that register/unregister globals. 1338 AsanRegisterGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1339 kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1340 AsanRegisterGlobals->setLinkage(Function::ExternalLinkage); 1341 AsanUnregisterGlobals = checkSanitizerInterfaceFunction( 1342 M.getOrInsertFunction(kAsanUnregisterGlobalsName, IRB.getVoidTy(), 1343 IntptrTy, IntptrTy, nullptr)); 1344 AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage); 1345 1346 // Declare the functions that find globals in a shared object and then invoke 1347 // the (un)register function on them. 1348 AsanRegisterImageGlobals = checkSanitizerInterfaceFunction( 1349 M.getOrInsertFunction(kAsanRegisterImageGlobalsName, 1350 IRB.getVoidTy(), IntptrTy, nullptr)); 1351 AsanRegisterImageGlobals->setLinkage(Function::ExternalLinkage); 1352 1353 AsanUnregisterImageGlobals = checkSanitizerInterfaceFunction( 1354 M.getOrInsertFunction(kAsanUnregisterImageGlobalsName, 1355 IRB.getVoidTy(), IntptrTy, nullptr)); 1356 AsanUnregisterImageGlobals->setLinkage(Function::ExternalLinkage); 1357 } 1358 1359 // This function replaces all global variables with new variables that have 1360 // trailing redzones. It also creates a function that poisons 1361 // redzones and inserts this function into llvm.global_ctors. 1362 bool AddressSanitizerModule::InstrumentGlobals(IRBuilder<> &IRB, Module &M) { 1363 GlobalsMD.init(M); 1364 1365 SmallVector<GlobalVariable *, 16> GlobalsToChange; 1366 1367 for (auto &G : M.globals()) { 1368 if (ShouldInstrumentGlobal(&G)) GlobalsToChange.push_back(&G); 1369 } 1370 1371 size_t n = GlobalsToChange.size(); 1372 if (n == 0) return false; 1373 1374 // A global is described by a structure 1375 // size_t beg; 1376 // size_t size; 1377 // size_t size_with_redzone; 1378 // const char *name; 1379 // const char *module_name; 1380 // size_t has_dynamic_init; 1381 // void *source_location; 1382 // size_t odr_indicator; 1383 // We initialize an array of such structures and pass it to a run-time call. 1384 StructType *GlobalStructTy = 1385 StructType::get(IntptrTy, IntptrTy, IntptrTy, IntptrTy, IntptrTy, 1386 IntptrTy, IntptrTy, IntptrTy, nullptr); 1387 SmallVector<Constant *, 16> Initializers(n); 1388 1389 bool HasDynamicallyInitializedGlobals = false; 1390 1391 // We shouldn't merge same module names, as this string serves as unique 1392 // module ID in runtime. 1393 GlobalVariable *ModuleName = createPrivateGlobalForString( 1394 M, M.getModuleIdentifier(), /*AllowMerging*/ false); 1395 1396 auto &DL = M.getDataLayout(); 1397 for (size_t i = 0; i < n; i++) { 1398 static const uint64_t kMaxGlobalRedzone = 1 << 18; 1399 GlobalVariable *G = GlobalsToChange[i]; 1400 1401 auto MD = GlobalsMD.get(G); 1402 StringRef NameForGlobal = G->getName(); 1403 // Create string holding the global name (use global name from metadata 1404 // if it's available, otherwise just write the name of global variable). 1405 GlobalVariable *Name = createPrivateGlobalForString( 1406 M, MD.Name.empty() ? NameForGlobal : MD.Name, 1407 /*AllowMerging*/ true); 1408 1409 Type *Ty = G->getValueType(); 1410 uint64_t SizeInBytes = DL.getTypeAllocSize(Ty); 1411 uint64_t MinRZ = MinRedzoneSizeForGlobal(); 1412 // MinRZ <= RZ <= kMaxGlobalRedzone 1413 // and trying to make RZ to be ~ 1/4 of SizeInBytes. 1414 uint64_t RZ = std::max( 1415 MinRZ, std::min(kMaxGlobalRedzone, (SizeInBytes / MinRZ / 4) * MinRZ)); 1416 uint64_t RightRedzoneSize = RZ; 1417 // Round up to MinRZ 1418 if (SizeInBytes % MinRZ) RightRedzoneSize += MinRZ - (SizeInBytes % MinRZ); 1419 assert(((RightRedzoneSize + SizeInBytes) % MinRZ) == 0); 1420 Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); 1421 1422 StructType *NewTy = StructType::get(Ty, RightRedZoneTy, nullptr); 1423 Constant *NewInitializer = 1424 ConstantStruct::get(NewTy, G->getInitializer(), 1425 Constant::getNullValue(RightRedZoneTy), nullptr); 1426 1427 // Create a new global variable with enough space for a redzone. 1428 GlobalValue::LinkageTypes Linkage = G->getLinkage(); 1429 if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage) 1430 Linkage = GlobalValue::InternalLinkage; 1431 GlobalVariable *NewGlobal = 1432 new GlobalVariable(M, NewTy, G->isConstant(), Linkage, NewInitializer, 1433 "", G, G->getThreadLocalMode()); 1434 NewGlobal->copyAttributesFrom(G); 1435 NewGlobal->setAlignment(MinRZ); 1436 1437 Value *Indices2[2]; 1438 Indices2[0] = IRB.getInt32(0); 1439 Indices2[1] = IRB.getInt32(0); 1440 1441 G->replaceAllUsesWith( 1442 ConstantExpr::getGetElementPtr(NewTy, NewGlobal, Indices2, true)); 1443 NewGlobal->takeName(G); 1444 G->eraseFromParent(); 1445 1446 Constant *SourceLoc; 1447 if (!MD.SourceLoc.empty()) { 1448 auto SourceLocGlobal = createPrivateGlobalForSourceLoc(M, MD.SourceLoc); 1449 SourceLoc = ConstantExpr::getPointerCast(SourceLocGlobal, IntptrTy); 1450 } else { 1451 SourceLoc = ConstantInt::get(IntptrTy, 0); 1452 } 1453 1454 Constant *ODRIndicator = ConstantExpr::getNullValue(IRB.getInt8PtrTy()); 1455 GlobalValue *InstrumentedGlobal = NewGlobal; 1456 1457 bool CanUsePrivateAliases = TargetTriple.isOSBinFormatELF(); 1458 if (CanUsePrivateAliases && ClUsePrivateAliasForGlobals) { 1459 // Create local alias for NewGlobal to avoid crash on ODR between 1460 // instrumented and non-instrumented libraries. 1461 auto *GA = GlobalAlias::create(GlobalValue::InternalLinkage, 1462 NameForGlobal + M.getName(), NewGlobal); 1463 1464 // With local aliases, we need to provide another externally visible 1465 // symbol __odr_asan_XXX to detect ODR violation. 1466 auto *ODRIndicatorSym = 1467 new GlobalVariable(M, IRB.getInt8Ty(), false, Linkage, 1468 Constant::getNullValue(IRB.getInt8Ty()), 1469 kODRGenPrefix + NameForGlobal, nullptr, 1470 NewGlobal->getThreadLocalMode()); 1471 1472 // Set meaningful attributes for indicator symbol. 1473 ODRIndicatorSym->setVisibility(NewGlobal->getVisibility()); 1474 ODRIndicatorSym->setDLLStorageClass(NewGlobal->getDLLStorageClass()); 1475 ODRIndicatorSym->setAlignment(1); 1476 ODRIndicator = ODRIndicatorSym; 1477 InstrumentedGlobal = GA; 1478 } 1479 1480 Initializers[i] = ConstantStruct::get( 1481 GlobalStructTy, 1482 ConstantExpr::getPointerCast(InstrumentedGlobal, IntptrTy), 1483 ConstantInt::get(IntptrTy, SizeInBytes), 1484 ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), 1485 ConstantExpr::getPointerCast(Name, IntptrTy), 1486 ConstantExpr::getPointerCast(ModuleName, IntptrTy), 1487 ConstantInt::get(IntptrTy, MD.IsDynInit), SourceLoc, 1488 ConstantExpr::getPointerCast(ODRIndicator, IntptrTy), nullptr); 1489 1490 if (ClInitializers && MD.IsDynInit) HasDynamicallyInitializedGlobals = true; 1491 1492 DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n"); 1493 } 1494 1495 1496 GlobalVariable *AllGlobals = nullptr; 1497 GlobalVariable *RegisteredFlag = nullptr; 1498 1499 // On recent Mach-O platforms, we emit the global metadata in a way that 1500 // allows the linker to properly strip dead globals. 1501 if (ShouldUseMachOGlobalsSection()) { 1502 // RegisteredFlag serves two purposes. First, we can pass it to dladdr() 1503 // to look up the loaded image that contains it. Second, we can store in it 1504 // whether registration has already occurred, to prevent duplicate 1505 // registration. 1506 // 1507 // Common linkage allows us to coalesce needles defined in each object 1508 // file so that there's only one per shared library. 1509 RegisteredFlag = new GlobalVariable( 1510 M, IntptrTy, false, GlobalVariable::CommonLinkage, 1511 ConstantInt::get(IntptrTy, 0), kAsanGlobalsRegisteredFlagName); 1512 1513 // We also emit a structure which binds the liveness of the global 1514 // variable to the metadata struct. 1515 StructType *LivenessTy = StructType::get(IntptrTy, IntptrTy, nullptr); 1516 1517 for (size_t i = 0; i < n; i++) { 1518 GlobalVariable *Metadata = new GlobalVariable( 1519 M, GlobalStructTy, false, GlobalVariable::InternalLinkage, 1520 Initializers[i], ""); 1521 Metadata->setSection("__DATA,__asan_globals,regular"); 1522 Metadata->setAlignment(1); // don't leave padding in between 1523 1524 auto LivenessBinder = ConstantStruct::get(LivenessTy, 1525 Initializers[i]->getAggregateElement(0u), 1526 ConstantExpr::getPointerCast(Metadata, IntptrTy), 1527 nullptr); 1528 GlobalVariable *Liveness = new GlobalVariable( 1529 M, LivenessTy, false, GlobalVariable::InternalLinkage, 1530 LivenessBinder, ""); 1531 Liveness->setSection("__DATA,__asan_liveness,regular,live_support"); 1532 } 1533 } else { 1534 // On all other platfoms, we just emit an array of global metadata 1535 // structures. 1536 ArrayType *ArrayOfGlobalStructTy = ArrayType::get(GlobalStructTy, n); 1537 AllGlobals = new GlobalVariable( 1538 M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage, 1539 ConstantArray::get(ArrayOfGlobalStructTy, Initializers), ""); 1540 } 1541 1542 // Create calls for poisoning before initializers run and unpoisoning after. 1543 if (HasDynamicallyInitializedGlobals) 1544 createInitializerPoisonCalls(M, ModuleName); 1545 1546 // Create a call to register the globals with the runtime. 1547 if (ShouldUseMachOGlobalsSection()) { 1548 IRB.CreateCall(AsanRegisterImageGlobals, 1549 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)}); 1550 } else { 1551 IRB.CreateCall(AsanRegisterGlobals, 1552 {IRB.CreatePointerCast(AllGlobals, IntptrTy), 1553 ConstantInt::get(IntptrTy, n)}); 1554 } 1555 1556 // We also need to unregister globals at the end, e.g., when a shared library 1557 // gets closed. 1558 Function *AsanDtorFunction = 1559 Function::Create(FunctionType::get(Type::getVoidTy(*C), false), 1560 GlobalValue::InternalLinkage, kAsanModuleDtorName, &M); 1561 BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); 1562 IRBuilder<> IRB_Dtor(ReturnInst::Create(*C, AsanDtorBB)); 1563 1564 if (ShouldUseMachOGlobalsSection()) { 1565 IRB_Dtor.CreateCall(AsanUnregisterImageGlobals, 1566 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)}); 1567 } else { 1568 IRB_Dtor.CreateCall(AsanUnregisterGlobals, 1569 {IRB.CreatePointerCast(AllGlobals, IntptrTy), 1570 ConstantInt::get(IntptrTy, n)}); 1571 } 1572 1573 appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndDtorPriority); 1574 1575 DEBUG(dbgs() << M); 1576 return true; 1577 } 1578 1579 bool AddressSanitizerModule::runOnModule(Module &M) { 1580 C = &(M.getContext()); 1581 int LongSize = M.getDataLayout().getPointerSizeInBits(); 1582 IntptrTy = Type::getIntNTy(*C, LongSize); 1583 TargetTriple = Triple(M.getTargetTriple()); 1584 Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel); 1585 initializeCallbacks(M); 1586 1587 bool Changed = false; 1588 1589 // TODO(glider): temporarily disabled globals instrumentation for KASan. 1590 if (ClGlobals && !CompileKernel) { 1591 Function *CtorFunc = M.getFunction(kAsanModuleCtorName); 1592 assert(CtorFunc); 1593 IRBuilder<> IRB(CtorFunc->getEntryBlock().getTerminator()); 1594 Changed |= InstrumentGlobals(IRB, M); 1595 } 1596 1597 return Changed; 1598 } 1599 1600 void AddressSanitizer::initializeCallbacks(Module &M) { 1601 IRBuilder<> IRB(*C); 1602 // Create __asan_report* callbacks. 1603 // IsWrite, TypeSize and Exp are encoded in the function name. 1604 for (int Exp = 0; Exp < 2; Exp++) { 1605 for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { 1606 const std::string TypeStr = AccessIsWrite ? "store" : "load"; 1607 const std::string ExpStr = Exp ? "exp_" : ""; 1608 const std::string SuffixStr = CompileKernel ? "N" : "_n"; 1609 const std::string EndingStr = Recover ? "_noabort" : ""; 1610 Type *ExpType = Exp ? Type::getInt32Ty(*C) : nullptr; 1611 AsanErrorCallbackSized[AccessIsWrite][Exp] = 1612 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1613 kAsanReportErrorTemplate + ExpStr + TypeStr + SuffixStr + EndingStr, 1614 IRB.getVoidTy(), IntptrTy, IntptrTy, ExpType, nullptr)); 1615 AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] = 1616 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1617 ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr, 1618 IRB.getVoidTy(), IntptrTy, IntptrTy, ExpType, nullptr)); 1619 for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; 1620 AccessSizeIndex++) { 1621 const std::string Suffix = TypeStr + itostr(1ULL << AccessSizeIndex); 1622 AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] = 1623 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1624 kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr, 1625 IRB.getVoidTy(), IntptrTy, ExpType, nullptr)); 1626 AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] = 1627 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1628 ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr, 1629 IRB.getVoidTy(), IntptrTy, ExpType, nullptr)); 1630 } 1631 } 1632 } 1633 1634 const std::string MemIntrinCallbackPrefix = 1635 CompileKernel ? std::string("") : ClMemoryAccessCallbackPrefix; 1636 AsanMemmove = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1637 MemIntrinCallbackPrefix + "memmove", IRB.getInt8PtrTy(), 1638 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy, nullptr)); 1639 AsanMemcpy = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1640 MemIntrinCallbackPrefix + "memcpy", IRB.getInt8PtrTy(), 1641 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy, nullptr)); 1642 AsanMemset = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1643 MemIntrinCallbackPrefix + "memset", IRB.getInt8PtrTy(), 1644 IRB.getInt8PtrTy(), IRB.getInt32Ty(), IntptrTy, nullptr)); 1645 1646 AsanHandleNoReturnFunc = checkSanitizerInterfaceFunction( 1647 M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy(), nullptr)); 1648 1649 AsanPtrCmpFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1650 kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1651 AsanPtrSubFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1652 kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1653 // We insert an empty inline asm after __asan_report* to avoid callback merge. 1654 EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 1655 StringRef(""), StringRef(""), 1656 /*hasSideEffects=*/true); 1657 } 1658 1659 // virtual 1660 bool AddressSanitizer::doInitialization(Module &M) { 1661 // Initialize the private fields. No one has accessed them before. 1662 1663 GlobalsMD.init(M); 1664 1665 C = &(M.getContext()); 1666 LongSize = M.getDataLayout().getPointerSizeInBits(); 1667 IntptrTy = Type::getIntNTy(*C, LongSize); 1668 TargetTriple = Triple(M.getTargetTriple()); 1669 1670 if (!CompileKernel) { 1671 std::tie(AsanCtorFunction, AsanInitFunction) = 1672 createSanitizerCtorAndInitFunctions( 1673 M, kAsanModuleCtorName, kAsanInitName, 1674 /*InitArgTypes=*/{}, /*InitArgs=*/{}, kAsanVersionCheckName); 1675 appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndDtorPriority); 1676 } 1677 Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel); 1678 return true; 1679 } 1680 1681 bool AddressSanitizer::doFinalization(Module &M) { 1682 GlobalsMD.reset(); 1683 return false; 1684 } 1685 1686 bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { 1687 // For each NSObject descendant having a +load method, this method is invoked 1688 // by the ObjC runtime before any of the static constructors is called. 1689 // Therefore we need to instrument such methods with a call to __asan_init 1690 // at the beginning in order to initialize our runtime before any access to 1691 // the shadow memory. 1692 // We cannot just ignore these methods, because they may call other 1693 // instrumented functions. 1694 if (F.getName().find(" load]") != std::string::npos) { 1695 IRBuilder<> IRB(&F.front(), F.front().begin()); 1696 IRB.CreateCall(AsanInitFunction, {}); 1697 return true; 1698 } 1699 return false; 1700 } 1701 1702 void AddressSanitizer::markEscapedLocalAllocas(Function &F) { 1703 // Find the one possible call to llvm.localescape and pre-mark allocas passed 1704 // to it as uninteresting. This assumes we haven't started processing allocas 1705 // yet. This check is done up front because iterating the use list in 1706 // isInterestingAlloca would be algorithmically slower. 1707 assert(ProcessedAllocas.empty() && "must process localescape before allocas"); 1708 1709 // Try to get the declaration of llvm.localescape. If it's not in the module, 1710 // we can exit early. 1711 if (!F.getParent()->getFunction("llvm.localescape")) return; 1712 1713 // Look for a call to llvm.localescape call in the entry block. It can't be in 1714 // any other block. 1715 for (Instruction &I : F.getEntryBlock()) { 1716 IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I); 1717 if (II && II->getIntrinsicID() == Intrinsic::localescape) { 1718 // We found a call. Mark all the allocas passed in as uninteresting. 1719 for (Value *Arg : II->arg_operands()) { 1720 AllocaInst *AI = dyn_cast<AllocaInst>(Arg->stripPointerCasts()); 1721 assert(AI && AI->isStaticAlloca() && 1722 "non-static alloca arg to localescape"); 1723 ProcessedAllocas[AI] = false; 1724 } 1725 break; 1726 } 1727 } 1728 } 1729 1730 bool AddressSanitizer::runOnFunction(Function &F) { 1731 if (&F == AsanCtorFunction) return false; 1732 if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false; 1733 DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n"); 1734 initializeCallbacks(*F.getParent()); 1735 1736 DT = &getAnalysis<DominatorTreeWrapperPass>().getDomTree(); 1737 1738 // If needed, insert __asan_init before checking for SanitizeAddress attr. 1739 maybeInsertAsanInitAtFunctionEntry(F); 1740 1741 if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return false; 1742 1743 if (!ClDebugFunc.empty() && ClDebugFunc != F.getName()) return false; 1744 1745 FunctionStateRAII CleanupObj(this); 1746 1747 // We can't instrument allocas used with llvm.localescape. Only static allocas 1748 // can be passed to that intrinsic. 1749 markEscapedLocalAllocas(F); 1750 1751 // We want to instrument every address only once per basic block (unless there 1752 // are calls between uses). 1753 SmallSet<Value *, 16> TempsToInstrument; 1754 SmallVector<Instruction *, 16> ToInstrument; 1755 SmallVector<Instruction *, 8> NoReturnCalls; 1756 SmallVector<BasicBlock *, 16> AllBlocks; 1757 SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts; 1758 int NumAllocas = 0; 1759 bool IsWrite; 1760 unsigned Alignment; 1761 uint64_t TypeSize; 1762 1763 // Fill the set of memory operations to instrument. 1764 for (auto &BB : F) { 1765 AllBlocks.push_back(&BB); 1766 TempsToInstrument.clear(); 1767 int NumInsnsPerBB = 0; 1768 for (auto &Inst : BB) { 1769 if (LooksLikeCodeInBug11395(&Inst)) return false; 1770 if (Value *Addr = isInterestingMemoryAccess(&Inst, &IsWrite, &TypeSize, 1771 &Alignment)) { 1772 if (ClOpt && ClOptSameTemp) { 1773 if (!TempsToInstrument.insert(Addr).second) 1774 continue; // We've seen this temp in the current BB. 1775 } 1776 } else if (ClInvalidPointerPairs && 1777 isInterestingPointerComparisonOrSubtraction(&Inst)) { 1778 PointerComparisonsOrSubtracts.push_back(&Inst); 1779 continue; 1780 } else if (isa<MemIntrinsic>(Inst)) { 1781 // ok, take it. 1782 } else { 1783 if (isa<AllocaInst>(Inst)) NumAllocas++; 1784 CallSite CS(&Inst); 1785 if (CS) { 1786 // A call inside BB. 1787 TempsToInstrument.clear(); 1788 if (CS.doesNotReturn()) NoReturnCalls.push_back(CS.getInstruction()); 1789 } 1790 continue; 1791 } 1792 ToInstrument.push_back(&Inst); 1793 NumInsnsPerBB++; 1794 if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break; 1795 } 1796 } 1797 1798 bool UseCalls = 1799 CompileKernel || 1800 (ClInstrumentationWithCallsThreshold >= 0 && 1801 ToInstrument.size() > (unsigned)ClInstrumentationWithCallsThreshold); 1802 const TargetLibraryInfo *TLI = 1803 &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(); 1804 const DataLayout &DL = F.getParent()->getDataLayout(); 1805 ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), 1806 /*RoundToAlign=*/true); 1807 1808 // Instrument. 1809 int NumInstrumented = 0; 1810 for (auto Inst : ToInstrument) { 1811 if (ClDebugMin < 0 || ClDebugMax < 0 || 1812 (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) { 1813 if (isInterestingMemoryAccess(Inst, &IsWrite, &TypeSize, &Alignment)) 1814 instrumentMop(ObjSizeVis, Inst, UseCalls, 1815 F.getParent()->getDataLayout()); 1816 else 1817 instrumentMemIntrinsic(cast<MemIntrinsic>(Inst)); 1818 } 1819 NumInstrumented++; 1820 } 1821 1822 FunctionStackPoisoner FSP(F, *this); 1823 bool ChangedStack = FSP.runOnFunction(); 1824 1825 // We must unpoison the stack before every NoReturn call (throw, _exit, etc). 1826 // See e.g. http://code.google.com/p/address-sanitizer/issues/detail?id=37 1827 for (auto CI : NoReturnCalls) { 1828 IRBuilder<> IRB(CI); 1829 IRB.CreateCall(AsanHandleNoReturnFunc, {}); 1830 } 1831 1832 for (auto Inst : PointerComparisonsOrSubtracts) { 1833 instrumentPointerComparisonOrSubtraction(Inst); 1834 NumInstrumented++; 1835 } 1836 1837 bool res = NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty(); 1838 1839 DEBUG(dbgs() << "ASAN done instrumenting: " << res << " " << F << "\n"); 1840 1841 return res; 1842 } 1843 1844 // Workaround for bug 11395: we don't want to instrument stack in functions 1845 // with large assembly blobs (32-bit only), otherwise reg alloc may crash. 1846 // FIXME: remove once the bug 11395 is fixed. 1847 bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { 1848 if (LongSize != 32) return false; 1849 CallInst *CI = dyn_cast<CallInst>(I); 1850 if (!CI || !CI->isInlineAsm()) return false; 1851 if (CI->getNumArgOperands() <= 5) return false; 1852 // We have inline assembly with quite a few arguments. 1853 return true; 1854 } 1855 1856 void FunctionStackPoisoner::initializeCallbacks(Module &M) { 1857 IRBuilder<> IRB(*C); 1858 for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) { 1859 std::string Suffix = itostr(i); 1860 AsanStackMallocFunc[i] = checkSanitizerInterfaceFunction( 1861 M.getOrInsertFunction(kAsanStackMallocNameTemplate + Suffix, IntptrTy, 1862 IntptrTy, nullptr)); 1863 AsanStackFreeFunc[i] = checkSanitizerInterfaceFunction( 1864 M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix, 1865 IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1866 } 1867 AsanPoisonStackMemoryFunc = checkSanitizerInterfaceFunction( 1868 M.getOrInsertFunction(kAsanPoisonStackMemoryName, IRB.getVoidTy(), 1869 IntptrTy, IntptrTy, nullptr)); 1870 AsanUnpoisonStackMemoryFunc = checkSanitizerInterfaceFunction( 1871 M.getOrInsertFunction(kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), 1872 IntptrTy, IntptrTy, nullptr)); 1873 AsanAllocaPoisonFunc = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1874 kAsanAllocaPoison, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1875 AsanAllocasUnpoisonFunc = 1876 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1877 kAsanAllocasUnpoison, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1878 } 1879 1880 void FunctionStackPoisoner::poisonRedZones(ArrayRef<uint8_t> ShadowBytes, 1881 IRBuilder<> &IRB, Value *ShadowBase, 1882 bool DoPoison) { 1883 size_t n = ShadowBytes.size(); 1884 size_t i = 0; 1885 // We need to (un)poison n bytes of stack shadow. Poison as many as we can 1886 // using 64-bit stores (if we are on 64-bit arch), then poison the rest 1887 // with 32-bit stores, then with 16-byte stores, then with 8-byte stores. 1888 for (size_t LargeStoreSizeInBytes = ASan.LongSize / 8; 1889 LargeStoreSizeInBytes != 0; LargeStoreSizeInBytes /= 2) { 1890 for (; i + LargeStoreSizeInBytes - 1 < n; i += LargeStoreSizeInBytes) { 1891 uint64_t Val = 0; 1892 for (size_t j = 0; j < LargeStoreSizeInBytes; j++) { 1893 if (F.getParent()->getDataLayout().isLittleEndian()) 1894 Val |= (uint64_t)ShadowBytes[i + j] << (8 * j); 1895 else 1896 Val = (Val << 8) | ShadowBytes[i + j]; 1897 } 1898 if (!Val) continue; 1899 Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); 1900 Type *StoreTy = Type::getIntNTy(*C, LargeStoreSizeInBytes * 8); 1901 Value *Poison = ConstantInt::get(StoreTy, DoPoison ? Val : 0); 1902 IRB.CreateStore(Poison, IRB.CreateIntToPtr(Ptr, StoreTy->getPointerTo())); 1903 } 1904 } 1905 } 1906 1907 // Fake stack allocator (asan_fake_stack.h) has 11 size classes 1908 // for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass 1909 static int StackMallocSizeClass(uint64_t LocalStackSize) { 1910 assert(LocalStackSize <= kMaxStackMallocSize); 1911 uint64_t MaxSize = kMinStackMallocSize; 1912 for (int i = 0;; i++, MaxSize *= 2) 1913 if (LocalStackSize <= MaxSize) return i; 1914 llvm_unreachable("impossible LocalStackSize"); 1915 } 1916 1917 // Set Size bytes starting from ShadowBase to kAsanStackAfterReturnMagic. 1918 // We can not use MemSet intrinsic because it may end up calling the actual 1919 // memset. Size is a multiple of 8. 1920 // Currently this generates 8-byte stores on x86_64; it may be better to 1921 // generate wider stores. 1922 void FunctionStackPoisoner::SetShadowToStackAfterReturnInlined( 1923 IRBuilder<> &IRB, Value *ShadowBase, int Size) { 1924 assert(!(Size % 8)); 1925 1926 // kAsanStackAfterReturnMagic is 0xf5. 1927 const uint64_t kAsanStackAfterReturnMagic64 = 0xf5f5f5f5f5f5f5f5ULL; 1928 1929 for (int i = 0; i < Size; i += 8) { 1930 Value *p = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); 1931 IRB.CreateStore( 1932 ConstantInt::get(IRB.getInt64Ty(), kAsanStackAfterReturnMagic64), 1933 IRB.CreateIntToPtr(p, IRB.getInt64Ty()->getPointerTo())); 1934 } 1935 } 1936 1937 PHINode *FunctionStackPoisoner::createPHI(IRBuilder<> &IRB, Value *Cond, 1938 Value *ValueIfTrue, 1939 Instruction *ThenTerm, 1940 Value *ValueIfFalse) { 1941 PHINode *PHI = IRB.CreatePHI(IntptrTy, 2); 1942 BasicBlock *CondBlock = cast<Instruction>(Cond)->getParent(); 1943 PHI->addIncoming(ValueIfFalse, CondBlock); 1944 BasicBlock *ThenBlock = ThenTerm->getParent(); 1945 PHI->addIncoming(ValueIfTrue, ThenBlock); 1946 return PHI; 1947 } 1948 1949 Value *FunctionStackPoisoner::createAllocaForLayout( 1950 IRBuilder<> &IRB, const ASanStackFrameLayout &L, bool Dynamic) { 1951 AllocaInst *Alloca; 1952 if (Dynamic) { 1953 Alloca = IRB.CreateAlloca(IRB.getInt8Ty(), 1954 ConstantInt::get(IRB.getInt64Ty(), L.FrameSize), 1955 "MyAlloca"); 1956 } else { 1957 Alloca = IRB.CreateAlloca(ArrayType::get(IRB.getInt8Ty(), L.FrameSize), 1958 nullptr, "MyAlloca"); 1959 assert(Alloca->isStaticAlloca()); 1960 } 1961 assert((ClRealignStack & (ClRealignStack - 1)) == 0); 1962 size_t FrameAlignment = std::max(L.FrameAlignment, (size_t)ClRealignStack); 1963 Alloca->setAlignment(FrameAlignment); 1964 return IRB.CreatePointerCast(Alloca, IntptrTy); 1965 } 1966 1967 void FunctionStackPoisoner::createDynamicAllocasInitStorage() { 1968 BasicBlock &FirstBB = *F.begin(); 1969 IRBuilder<> IRB(dyn_cast<Instruction>(FirstBB.begin())); 1970 DynamicAllocaLayout = IRB.CreateAlloca(IntptrTy, nullptr); 1971 IRB.CreateStore(Constant::getNullValue(IntptrTy), DynamicAllocaLayout); 1972 DynamicAllocaLayout->setAlignment(32); 1973 } 1974 1975 void FunctionStackPoisoner::poisonStack() { 1976 assert(AllocaVec.size() > 0 || DynamicAllocaVec.size() > 0); 1977 1978 // Insert poison calls for lifetime intrinsics for alloca. 1979 bool HavePoisonedAllocas = false; 1980 for (const auto &APC : AllocaPoisonCallVec) { 1981 assert(APC.InsBefore); 1982 assert(APC.AI); 1983 IRBuilder<> IRB(APC.InsBefore); 1984 poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison); 1985 HavePoisonedAllocas |= APC.DoPoison; 1986 } 1987 1988 if (ClInstrumentAllocas && DynamicAllocaVec.size() > 0) { 1989 // Handle dynamic allocas. 1990 createDynamicAllocasInitStorage(); 1991 for (auto &AI : DynamicAllocaVec) handleDynamicAllocaCall(AI); 1992 1993 unpoisonDynamicAllocas(); 1994 } 1995 1996 if (AllocaVec.empty()) return; 1997 1998 int StackMallocIdx = -1; 1999 DebugLoc EntryDebugLocation; 2000 if (auto SP = F.getSubprogram()) 2001 EntryDebugLocation = DebugLoc::get(SP->getScopeLine(), 0, SP); 2002 2003 Instruction *InsBefore = AllocaVec[0]; 2004 IRBuilder<> IRB(InsBefore); 2005 IRB.SetCurrentDebugLocation(EntryDebugLocation); 2006 2007 // Make sure non-instrumented allocas stay in the entry block. Otherwise, 2008 // debug info is broken, because only entry-block allocas are treated as 2009 // regular stack slots. 2010 auto InsBeforeB = InsBefore->getParent(); 2011 assert(InsBeforeB == &F.getEntryBlock()); 2012 for (BasicBlock::iterator I(InsBefore); I != InsBeforeB->end(); ++I) 2013 if (auto *AI = dyn_cast<AllocaInst>(I)) 2014 if (NonInstrumentedStaticAllocaVec.count(AI) > 0) 2015 AI->moveBefore(InsBefore); 2016 2017 // If we have a call to llvm.localescape, keep it in the entry block. 2018 if (LocalEscapeCall) LocalEscapeCall->moveBefore(InsBefore); 2019 2020 SmallVector<ASanStackVariableDescription, 16> SVD; 2021 SVD.reserve(AllocaVec.size()); 2022 for (AllocaInst *AI : AllocaVec) { 2023 ASanStackVariableDescription D = {AI->getName().data(), 2024 ASan.getAllocaSizeInBytes(AI), 2025 AI->getAlignment(), AI, 0}; 2026 SVD.push_back(D); 2027 } 2028 // Minimal header size (left redzone) is 4 pointers, 2029 // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms. 2030 size_t MinHeaderSize = ASan.LongSize / 2; 2031 ASanStackFrameLayout L; 2032 ComputeASanStackFrameLayout(SVD, 1ULL << Mapping.Scale, MinHeaderSize, &L); 2033 DEBUG(dbgs() << L.DescriptionString << " --- " << L.FrameSize << "\n"); 2034 uint64_t LocalStackSize = L.FrameSize; 2035 bool DoStackMalloc = ClUseAfterReturn && !ASan.CompileKernel && 2036 LocalStackSize <= kMaxStackMallocSize; 2037 bool DoDynamicAlloca = ClDynamicAllocaStack; 2038 // Don't do dynamic alloca or stack malloc if: 2039 // 1) There is inline asm: too often it makes assumptions on which registers 2040 // are available. 2041 // 2) There is a returns_twice call (typically setjmp), which is 2042 // optimization-hostile, and doesn't play well with introduced indirect 2043 // register-relative calculation of local variable addresses. 2044 DoDynamicAlloca &= !HasNonEmptyInlineAsm && !HasReturnsTwiceCall; 2045 DoStackMalloc &= !HasNonEmptyInlineAsm && !HasReturnsTwiceCall; 2046 2047 Value *StaticAlloca = 2048 DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false); 2049 2050 Value *FakeStack; 2051 Value *LocalStackBase; 2052 2053 if (DoStackMalloc) { 2054 // void *FakeStack = __asan_option_detect_stack_use_after_return 2055 // ? __asan_stack_malloc_N(LocalStackSize) 2056 // : nullptr; 2057 // void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize); 2058 Constant *OptionDetectUAR = F.getParent()->getOrInsertGlobal( 2059 kAsanOptionDetectUAR, IRB.getInt32Ty()); 2060 Value *UARIsEnabled = 2061 IRB.CreateICmpNE(IRB.CreateLoad(OptionDetectUAR), 2062 Constant::getNullValue(IRB.getInt32Ty())); 2063 Instruction *Term = 2064 SplitBlockAndInsertIfThen(UARIsEnabled, InsBefore, false); 2065 IRBuilder<> IRBIf(Term); 2066 IRBIf.SetCurrentDebugLocation(EntryDebugLocation); 2067 StackMallocIdx = StackMallocSizeClass(LocalStackSize); 2068 assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass); 2069 Value *FakeStackValue = 2070 IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx], 2071 ConstantInt::get(IntptrTy, LocalStackSize)); 2072 IRB.SetInsertPoint(InsBefore); 2073 IRB.SetCurrentDebugLocation(EntryDebugLocation); 2074 FakeStack = createPHI(IRB, UARIsEnabled, FakeStackValue, Term, 2075 ConstantInt::get(IntptrTy, 0)); 2076 2077 Value *NoFakeStack = 2078 IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy)); 2079 Term = SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false); 2080 IRBIf.SetInsertPoint(Term); 2081 IRBIf.SetCurrentDebugLocation(EntryDebugLocation); 2082 Value *AllocaValue = 2083 DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca; 2084 IRB.SetInsertPoint(InsBefore); 2085 IRB.SetCurrentDebugLocation(EntryDebugLocation); 2086 LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack); 2087 } else { 2088 // void *FakeStack = nullptr; 2089 // void *LocalStackBase = alloca(LocalStackSize); 2090 FakeStack = ConstantInt::get(IntptrTy, 0); 2091 LocalStackBase = 2092 DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca; 2093 } 2094 2095 // Replace Alloca instructions with base+offset. 2096 for (const auto &Desc : SVD) { 2097 AllocaInst *AI = Desc.AI; 2098 Value *NewAllocaPtr = IRB.CreateIntToPtr( 2099 IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)), 2100 AI->getType()); 2101 replaceDbgDeclareForAlloca(AI, NewAllocaPtr, DIB, /*Deref=*/true); 2102 AI->replaceAllUsesWith(NewAllocaPtr); 2103 } 2104 2105 // The left-most redzone has enough space for at least 4 pointers. 2106 // Write the Magic value to redzone[0]. 2107 Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); 2108 IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), 2109 BasePlus0); 2110 // Write the frame description constant to redzone[1]. 2111 Value *BasePlus1 = IRB.CreateIntToPtr( 2112 IRB.CreateAdd(LocalStackBase, 2113 ConstantInt::get(IntptrTy, ASan.LongSize / 8)), 2114 IntptrPtrTy); 2115 GlobalVariable *StackDescriptionGlobal = 2116 createPrivateGlobalForString(*F.getParent(), L.DescriptionString, 2117 /*AllowMerging*/ true); 2118 Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy); 2119 IRB.CreateStore(Description, BasePlus1); 2120 // Write the PC to redzone[2]. 2121 Value *BasePlus2 = IRB.CreateIntToPtr( 2122 IRB.CreateAdd(LocalStackBase, 2123 ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)), 2124 IntptrPtrTy); 2125 IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2); 2126 2127 // Poison the stack redzones at the entry. 2128 Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB); 2129 poisonRedZones(L.ShadowBytes, IRB, ShadowBase, true); 2130 2131 // (Un)poison the stack before all ret instructions. 2132 for (auto Ret : RetVec) { 2133 IRBuilder<> IRBRet(Ret); 2134 // Mark the current frame as retired. 2135 IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), 2136 BasePlus0); 2137 if (DoStackMalloc) { 2138 assert(StackMallocIdx >= 0); 2139 // if FakeStack != 0 // LocalStackBase == FakeStack 2140 // // In use-after-return mode, poison the whole stack frame. 2141 // if StackMallocIdx <= 4 2142 // // For small sizes inline the whole thing: 2143 // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize); 2144 // **SavedFlagPtr(FakeStack) = 0 2145 // else 2146 // __asan_stack_free_N(FakeStack, LocalStackSize) 2147 // else 2148 // <This is not a fake stack; unpoison the redzones> 2149 Value *Cmp = 2150 IRBRet.CreateICmpNE(FakeStack, Constant::getNullValue(IntptrTy)); 2151 TerminatorInst *ThenTerm, *ElseTerm; 2152 SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm); 2153 2154 IRBuilder<> IRBPoison(ThenTerm); 2155 if (StackMallocIdx <= 4) { 2156 int ClassSize = kMinStackMallocSize << StackMallocIdx; 2157 SetShadowToStackAfterReturnInlined(IRBPoison, ShadowBase, 2158 ClassSize >> Mapping.Scale); 2159 Value *SavedFlagPtrPtr = IRBPoison.CreateAdd( 2160 FakeStack, 2161 ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8)); 2162 Value *SavedFlagPtr = IRBPoison.CreateLoad( 2163 IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy)); 2164 IRBPoison.CreateStore( 2165 Constant::getNullValue(IRBPoison.getInt8Ty()), 2166 IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy())); 2167 } else { 2168 // For larger frames call __asan_stack_free_*. 2169 IRBPoison.CreateCall( 2170 AsanStackFreeFunc[StackMallocIdx], 2171 {FakeStack, ConstantInt::get(IntptrTy, LocalStackSize)}); 2172 } 2173 2174 IRBuilder<> IRBElse(ElseTerm); 2175 poisonRedZones(L.ShadowBytes, IRBElse, ShadowBase, false); 2176 } else if (HavePoisonedAllocas) { 2177 // If we poisoned some allocas in llvm.lifetime analysis, 2178 // unpoison whole stack frame now. 2179 poisonAlloca(LocalStackBase, LocalStackSize, IRBRet, false); 2180 } else { 2181 poisonRedZones(L.ShadowBytes, IRBRet, ShadowBase, false); 2182 } 2183 } 2184 2185 // We are done. Remove the old unused alloca instructions. 2186 for (auto AI : AllocaVec) AI->eraseFromParent(); 2187 } 2188 2189 void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size, 2190 IRBuilder<> &IRB, bool DoPoison) { 2191 // For now just insert the call to ASan runtime. 2192 Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy); 2193 Value *SizeArg = ConstantInt::get(IntptrTy, Size); 2194 IRB.CreateCall( 2195 DoPoison ? AsanPoisonStackMemoryFunc : AsanUnpoisonStackMemoryFunc, 2196 {AddrArg, SizeArg}); 2197 } 2198 2199 // Handling llvm.lifetime intrinsics for a given %alloca: 2200 // (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca. 2201 // (2) if %size is constant, poison memory for llvm.lifetime.end (to detect 2202 // invalid accesses) and unpoison it for llvm.lifetime.start (the memory 2203 // could be poisoned by previous llvm.lifetime.end instruction, as the 2204 // variable may go in and out of scope several times, e.g. in loops). 2205 // (3) if we poisoned at least one %alloca in a function, 2206 // unpoison the whole stack frame at function exit. 2207 2208 AllocaInst *FunctionStackPoisoner::findAllocaForValue(Value *V) { 2209 if (AllocaInst *AI = dyn_cast<AllocaInst>(V)) 2210 // We're intested only in allocas we can handle. 2211 return ASan.isInterestingAlloca(*AI) ? AI : nullptr; 2212 // See if we've already calculated (or started to calculate) alloca for a 2213 // given value. 2214 AllocaForValueMapTy::iterator I = AllocaForValue.find(V); 2215 if (I != AllocaForValue.end()) return I->second; 2216 // Store 0 while we're calculating alloca for value V to avoid 2217 // infinite recursion if the value references itself. 2218 AllocaForValue[V] = nullptr; 2219 AllocaInst *Res = nullptr; 2220 if (CastInst *CI = dyn_cast<CastInst>(V)) 2221 Res = findAllocaForValue(CI->getOperand(0)); 2222 else if (PHINode *PN = dyn_cast<PHINode>(V)) { 2223 for (Value *IncValue : PN->incoming_values()) { 2224 // Allow self-referencing phi-nodes. 2225 if (IncValue == PN) continue; 2226 AllocaInst *IncValueAI = findAllocaForValue(IncValue); 2227 // AI for incoming values should exist and should all be equal. 2228 if (IncValueAI == nullptr || (Res != nullptr && IncValueAI != Res)) 2229 return nullptr; 2230 Res = IncValueAI; 2231 } 2232 } 2233 if (Res) AllocaForValue[V] = Res; 2234 return Res; 2235 } 2236 2237 void FunctionStackPoisoner::handleDynamicAllocaCall(AllocaInst *AI) { 2238 IRBuilder<> IRB(AI); 2239 2240 const unsigned Align = std::max(kAllocaRzSize, AI->getAlignment()); 2241 const uint64_t AllocaRedzoneMask = kAllocaRzSize - 1; 2242 2243 Value *Zero = Constant::getNullValue(IntptrTy); 2244 Value *AllocaRzSize = ConstantInt::get(IntptrTy, kAllocaRzSize); 2245 Value *AllocaRzMask = ConstantInt::get(IntptrTy, AllocaRedzoneMask); 2246 2247 // Since we need to extend alloca with additional memory to locate 2248 // redzones, and OldSize is number of allocated blocks with 2249 // ElementSize size, get allocated memory size in bytes by 2250 // OldSize * ElementSize. 2251 const unsigned ElementSize = 2252 F.getParent()->getDataLayout().getTypeAllocSize(AI->getAllocatedType()); 2253 Value *OldSize = 2254 IRB.CreateMul(IRB.CreateIntCast(AI->getArraySize(), IntptrTy, false), 2255 ConstantInt::get(IntptrTy, ElementSize)); 2256 2257 // PartialSize = OldSize % 32 2258 Value *PartialSize = IRB.CreateAnd(OldSize, AllocaRzMask); 2259 2260 // Misalign = kAllocaRzSize - PartialSize; 2261 Value *Misalign = IRB.CreateSub(AllocaRzSize, PartialSize); 2262 2263 // PartialPadding = Misalign != kAllocaRzSize ? Misalign : 0; 2264 Value *Cond = IRB.CreateICmpNE(Misalign, AllocaRzSize); 2265 Value *PartialPadding = IRB.CreateSelect(Cond, Misalign, Zero); 2266 2267 // AdditionalChunkSize = Align + PartialPadding + kAllocaRzSize 2268 // Align is added to locate left redzone, PartialPadding for possible 2269 // partial redzone and kAllocaRzSize for right redzone respectively. 2270 Value *AdditionalChunkSize = IRB.CreateAdd( 2271 ConstantInt::get(IntptrTy, Align + kAllocaRzSize), PartialPadding); 2272 2273 Value *NewSize = IRB.CreateAdd(OldSize, AdditionalChunkSize); 2274 2275 // Insert new alloca with new NewSize and Align params. 2276 AllocaInst *NewAlloca = IRB.CreateAlloca(IRB.getInt8Ty(), NewSize); 2277 NewAlloca->setAlignment(Align); 2278 2279 // NewAddress = Address + Align 2280 Value *NewAddress = IRB.CreateAdd(IRB.CreatePtrToInt(NewAlloca, IntptrTy), 2281 ConstantInt::get(IntptrTy, Align)); 2282 2283 // Insert __asan_alloca_poison call for new created alloca. 2284 IRB.CreateCall(AsanAllocaPoisonFunc, {NewAddress, OldSize}); 2285 2286 // Store the last alloca's address to DynamicAllocaLayout. We'll need this 2287 // for unpoisoning stuff. 2288 IRB.CreateStore(IRB.CreatePtrToInt(NewAlloca, IntptrTy), DynamicAllocaLayout); 2289 2290 Value *NewAddressPtr = IRB.CreateIntToPtr(NewAddress, AI->getType()); 2291 2292 // Replace all uses of AddessReturnedByAlloca with NewAddressPtr. 2293 AI->replaceAllUsesWith(NewAddressPtr); 2294 2295 // We are done. Erase old alloca from parent. 2296 AI->eraseFromParent(); 2297 } 2298 2299 // isSafeAccess returns true if Addr is always inbounds with respect to its 2300 // base object. For example, it is a field access or an array access with 2301 // constant inbounds index. 2302 bool AddressSanitizer::isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, 2303 Value *Addr, uint64_t TypeSize) const { 2304 SizeOffsetType SizeOffset = ObjSizeVis.compute(Addr); 2305 if (!ObjSizeVis.bothKnown(SizeOffset)) return false; 2306 uint64_t Size = SizeOffset.first.getZExtValue(); 2307 int64_t Offset = SizeOffset.second.getSExtValue(); 2308 // Three checks are required to ensure safety: 2309 // . Offset >= 0 (since the offset is given from the base ptr) 2310 // . Size >= Offset (unsigned) 2311 // . Size - Offset >= NeededSize (unsigned) 2312 return Offset >= 0 && Size >= uint64_t(Offset) && 2313 Size - uint64_t(Offset) >= TypeSize / 8; 2314 } 2315