1 //===- AddressSanitizer.cpp - memory error detector -----------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is a part of AddressSanitizer, an address sanity checker. 10 // Details of the algorithm: 11 // https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm 12 // 13 // FIXME: This sanitizer does not yet handle scalable vectors 14 // 15 //===----------------------------------------------------------------------===// 16 17 #include "llvm/Transforms/Instrumentation/AddressSanitizer.h" 18 #include "llvm/ADT/ArrayRef.h" 19 #include "llvm/ADT/DenseMap.h" 20 #include "llvm/ADT/DepthFirstIterator.h" 21 #include "llvm/ADT/SmallPtrSet.h" 22 #include "llvm/ADT/SmallVector.h" 23 #include "llvm/ADT/Statistic.h" 24 #include "llvm/ADT/StringExtras.h" 25 #include "llvm/ADT/StringRef.h" 26 #include "llvm/ADT/Triple.h" 27 #include "llvm/ADT/Twine.h" 28 #include "llvm/Analysis/MemoryBuiltins.h" 29 #include "llvm/Analysis/TargetLibraryInfo.h" 30 #include "llvm/Analysis/ValueTracking.h" 31 #include "llvm/BinaryFormat/MachO.h" 32 #include "llvm/IR/Argument.h" 33 #include "llvm/IR/Attributes.h" 34 #include "llvm/IR/BasicBlock.h" 35 #include "llvm/IR/Comdat.h" 36 #include "llvm/IR/Constant.h" 37 #include "llvm/IR/Constants.h" 38 #include "llvm/IR/DIBuilder.h" 39 #include "llvm/IR/DataLayout.h" 40 #include "llvm/IR/DebugInfoMetadata.h" 41 #include "llvm/IR/DebugLoc.h" 42 #include "llvm/IR/DerivedTypes.h" 43 #include "llvm/IR/Dominators.h" 44 #include "llvm/IR/Function.h" 45 #include "llvm/IR/GlobalAlias.h" 46 #include "llvm/IR/GlobalValue.h" 47 #include "llvm/IR/GlobalVariable.h" 48 #include "llvm/IR/IRBuilder.h" 49 #include "llvm/IR/InlineAsm.h" 50 #include "llvm/IR/InstVisitor.h" 51 #include "llvm/IR/InstrTypes.h" 52 #include "llvm/IR/Instruction.h" 53 #include "llvm/IR/Instructions.h" 54 #include "llvm/IR/IntrinsicInst.h" 55 #include "llvm/IR/Intrinsics.h" 56 #include "llvm/IR/LLVMContext.h" 57 #include "llvm/IR/MDBuilder.h" 58 #include "llvm/IR/Metadata.h" 59 #include "llvm/IR/Module.h" 60 #include "llvm/IR/Type.h" 61 #include "llvm/IR/Use.h" 62 #include "llvm/IR/Value.h" 63 #include "llvm/InitializePasses.h" 64 #include "llvm/MC/MCSectionMachO.h" 65 #include "llvm/Pass.h" 66 #include "llvm/Support/Casting.h" 67 #include "llvm/Support/CommandLine.h" 68 #include "llvm/Support/Debug.h" 69 #include "llvm/Support/ErrorHandling.h" 70 #include "llvm/Support/MathExtras.h" 71 #include "llvm/Support/ScopedPrinter.h" 72 #include "llvm/Support/raw_ostream.h" 73 #include "llvm/Transforms/Instrumentation.h" 74 #include "llvm/Transforms/Instrumentation/AddressSanitizerCommon.h" 75 #include "llvm/Transforms/Instrumentation/AddressSanitizerOptions.h" 76 #include "llvm/Transforms/Utils/ASanStackFrameLayout.h" 77 #include "llvm/Transforms/Utils/BasicBlockUtils.h" 78 #include "llvm/Transforms/Utils/Local.h" 79 #include "llvm/Transforms/Utils/ModuleUtils.h" 80 #include "llvm/Transforms/Utils/PromoteMemToReg.h" 81 #include <algorithm> 82 #include <cassert> 83 #include <cstddef> 84 #include <cstdint> 85 #include <iomanip> 86 #include <limits> 87 #include <memory> 88 #include <sstream> 89 #include <string> 90 #include <tuple> 91 92 using namespace llvm; 93 94 #define DEBUG_TYPE "asan" 95 96 static const uint64_t kDefaultShadowScale = 3; 97 static const uint64_t kDefaultShadowOffset32 = 1ULL << 29; 98 static const uint64_t kDefaultShadowOffset64 = 1ULL << 44; 99 static const uint64_t kDynamicShadowSentinel = 100 std::numeric_limits<uint64_t>::max(); 101 static const uint64_t kSmallX86_64ShadowOffsetBase = 0x7FFFFFFF; // < 2G. 102 static const uint64_t kSmallX86_64ShadowOffsetAlignMask = ~0xFFFULL; 103 static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000; 104 static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 44; 105 static const uint64_t kSystemZ_ShadowOffset64 = 1ULL << 52; 106 static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000; 107 static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37; 108 static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36; 109 static const uint64_t kRISCV64_ShadowOffset64 = 0xd55550000; 110 static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30; 111 static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46; 112 static const uint64_t kFreeBSDKasan_ShadowOffset64 = 0xdffff7c000000000; 113 static const uint64_t kNetBSD_ShadowOffset32 = 1ULL << 30; 114 static const uint64_t kNetBSD_ShadowOffset64 = 1ULL << 46; 115 static const uint64_t kNetBSDKasan_ShadowOffset64 = 0xdfff900000000000; 116 static const uint64_t kPS4CPU_ShadowOffset64 = 1ULL << 40; 117 static const uint64_t kWindowsShadowOffset32 = 3ULL << 28; 118 static const uint64_t kEmscriptenShadowOffset = 0; 119 120 // The shadow memory space is dynamically allocated. 121 static const uint64_t kWindowsShadowOffset64 = kDynamicShadowSentinel; 122 123 static const size_t kMinStackMallocSize = 1 << 6; // 64B 124 static const size_t kMaxStackMallocSize = 1 << 16; // 64K 125 static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; 126 static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; 127 128 const char kAsanModuleCtorName[] = "asan.module_ctor"; 129 const char kAsanModuleDtorName[] = "asan.module_dtor"; 130 static const uint64_t kAsanCtorAndDtorPriority = 1; 131 // On Emscripten, the system needs more than one priorities for constructors. 132 static const uint64_t kAsanEmscriptenCtorAndDtorPriority = 50; 133 const char kAsanReportErrorTemplate[] = "__asan_report_"; 134 const char kAsanRegisterGlobalsName[] = "__asan_register_globals"; 135 const char kAsanUnregisterGlobalsName[] = "__asan_unregister_globals"; 136 const char kAsanRegisterImageGlobalsName[] = "__asan_register_image_globals"; 137 const char kAsanUnregisterImageGlobalsName[] = 138 "__asan_unregister_image_globals"; 139 const char kAsanRegisterElfGlobalsName[] = "__asan_register_elf_globals"; 140 const char kAsanUnregisterElfGlobalsName[] = "__asan_unregister_elf_globals"; 141 const char kAsanPoisonGlobalsName[] = "__asan_before_dynamic_init"; 142 const char kAsanUnpoisonGlobalsName[] = "__asan_after_dynamic_init"; 143 const char kAsanInitName[] = "__asan_init"; 144 const char kAsanVersionCheckNamePrefix[] = "__asan_version_mismatch_check_v"; 145 const char kAsanPtrCmp[] = "__sanitizer_ptr_cmp"; 146 const char kAsanPtrSub[] = "__sanitizer_ptr_sub"; 147 const char kAsanHandleNoReturnName[] = "__asan_handle_no_return"; 148 static const int kMaxAsanStackMallocSizeClass = 10; 149 const char kAsanStackMallocNameTemplate[] = "__asan_stack_malloc_"; 150 const char kAsanStackMallocAlwaysNameTemplate[] = 151 "__asan_stack_malloc_always_"; 152 const char kAsanStackFreeNameTemplate[] = "__asan_stack_free_"; 153 const char kAsanGenPrefix[] = "___asan_gen_"; 154 const char kODRGenPrefix[] = "__odr_asan_gen_"; 155 const char kSanCovGenPrefix[] = "__sancov_gen_"; 156 const char kAsanSetShadowPrefix[] = "__asan_set_shadow_"; 157 const char kAsanPoisonStackMemoryName[] = "__asan_poison_stack_memory"; 158 const char kAsanUnpoisonStackMemoryName[] = "__asan_unpoison_stack_memory"; 159 160 // ASan version script has __asan_* wildcard. Triple underscore prevents a 161 // linker (gold) warning about attempting to export a local symbol. 162 const char kAsanGlobalsRegisteredFlagName[] = "___asan_globals_registered"; 163 164 const char kAsanOptionDetectUseAfterReturn[] = 165 "__asan_option_detect_stack_use_after_return"; 166 167 const char kAsanShadowMemoryDynamicAddress[] = 168 "__asan_shadow_memory_dynamic_address"; 169 170 const char kAsanAllocaPoison[] = "__asan_alloca_poison"; 171 const char kAsanAllocasUnpoison[] = "__asan_allocas_unpoison"; 172 173 const char kAMDGPUAddressSharedName[] = "llvm.amdgcn.is.shared"; 174 const char kAMDGPUAddressPrivateName[] = "llvm.amdgcn.is.private"; 175 176 // Accesses sizes are powers of two: 1, 2, 4, 8, 16. 177 static const size_t kNumberOfAccessSizes = 5; 178 179 static const unsigned kAllocaRzSize = 32; 180 181 // Command-line flags. 182 183 static cl::opt<bool> ClEnableKasan( 184 "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"), 185 cl::Hidden, cl::init(false)); 186 187 static cl::opt<bool> ClRecover( 188 "asan-recover", 189 cl::desc("Enable recovery mode (continue-after-error)."), 190 cl::Hidden, cl::init(false)); 191 192 static cl::opt<bool> ClInsertVersionCheck( 193 "asan-guard-against-version-mismatch", 194 cl::desc("Guard against compiler/runtime version mismatch."), 195 cl::Hidden, cl::init(true)); 196 197 // This flag may need to be replaced with -f[no-]asan-reads. 198 static cl::opt<bool> ClInstrumentReads("asan-instrument-reads", 199 cl::desc("instrument read instructions"), 200 cl::Hidden, cl::init(true)); 201 202 static cl::opt<bool> ClInstrumentWrites( 203 "asan-instrument-writes", cl::desc("instrument write instructions"), 204 cl::Hidden, cl::init(true)); 205 206 static cl::opt<bool> ClInstrumentAtomics( 207 "asan-instrument-atomics", 208 cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, 209 cl::init(true)); 210 211 static cl::opt<bool> 212 ClInstrumentByval("asan-instrument-byval", 213 cl::desc("instrument byval call arguments"), cl::Hidden, 214 cl::init(true)); 215 216 static cl::opt<bool> ClAlwaysSlowPath( 217 "asan-always-slow-path", 218 cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, 219 cl::init(false)); 220 221 static cl::opt<bool> ClForceDynamicShadow( 222 "asan-force-dynamic-shadow", 223 cl::desc("Load shadow address into a local variable for each function"), 224 cl::Hidden, cl::init(false)); 225 226 static cl::opt<bool> 227 ClWithIfunc("asan-with-ifunc", 228 cl::desc("Access dynamic shadow through an ifunc global on " 229 "platforms that support this"), 230 cl::Hidden, cl::init(true)); 231 232 static cl::opt<bool> ClWithIfuncSuppressRemat( 233 "asan-with-ifunc-suppress-remat", 234 cl::desc("Suppress rematerialization of dynamic shadow address by passing " 235 "it through inline asm in prologue."), 236 cl::Hidden, cl::init(true)); 237 238 // This flag limits the number of instructions to be instrumented 239 // in any given BB. Normally, this should be set to unlimited (INT_MAX), 240 // but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary 241 // set it to 10000. 242 static cl::opt<int> ClMaxInsnsToInstrumentPerBB( 243 "asan-max-ins-per-bb", cl::init(10000), 244 cl::desc("maximal number of instructions to instrument in any given BB"), 245 cl::Hidden); 246 247 // This flag may need to be replaced with -f[no]asan-stack. 248 static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"), 249 cl::Hidden, cl::init(true)); 250 static cl::opt<uint32_t> ClMaxInlinePoisoningSize( 251 "asan-max-inline-poisoning-size", 252 cl::desc( 253 "Inline shadow poisoning for blocks up to the given size in bytes."), 254 cl::Hidden, cl::init(64)); 255 256 static cl::opt<AsanDetectStackUseAfterReturnMode> ClUseAfterReturn( 257 "asan-use-after-return", 258 cl::desc("Sets the mode of detection for stack-use-after-return."), 259 cl::values( 260 clEnumValN(AsanDetectStackUseAfterReturnMode::Never, "never", 261 "Never detect stack use after return."), 262 clEnumValN( 263 AsanDetectStackUseAfterReturnMode::Runtime, "runtime", 264 "Detect stack use after return if " 265 "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set."), 266 clEnumValN(AsanDetectStackUseAfterReturnMode::Always, "always", 267 "Always detect stack use after return.")), 268 cl::Hidden, cl::init(AsanDetectStackUseAfterReturnMode::Runtime)); 269 270 static cl::opt<bool> ClRedzoneByvalArgs("asan-redzone-byval-args", 271 cl::desc("Create redzones for byval " 272 "arguments (extra copy " 273 "required)"), cl::Hidden, 274 cl::init(true)); 275 276 static cl::opt<bool> ClUseAfterScope("asan-use-after-scope", 277 cl::desc("Check stack-use-after-scope"), 278 cl::Hidden, cl::init(false)); 279 280 // This flag may need to be replaced with -f[no]asan-globals. 281 static cl::opt<bool> ClGlobals("asan-globals", 282 cl::desc("Handle global objects"), cl::Hidden, 283 cl::init(true)); 284 285 static cl::opt<bool> ClInitializers("asan-initialization-order", 286 cl::desc("Handle C++ initializer order"), 287 cl::Hidden, cl::init(true)); 288 289 static cl::opt<bool> ClInvalidPointerPairs( 290 "asan-detect-invalid-pointer-pair", 291 cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, 292 cl::init(false)); 293 294 static cl::opt<bool> ClInvalidPointerCmp( 295 "asan-detect-invalid-pointer-cmp", 296 cl::desc("Instrument <, <=, >, >= with pointer operands"), cl::Hidden, 297 cl::init(false)); 298 299 static cl::opt<bool> ClInvalidPointerSub( 300 "asan-detect-invalid-pointer-sub", 301 cl::desc("Instrument - operations with pointer operands"), cl::Hidden, 302 cl::init(false)); 303 304 static cl::opt<unsigned> ClRealignStack( 305 "asan-realign-stack", 306 cl::desc("Realign stack to the value of this flag (power of two)"), 307 cl::Hidden, cl::init(32)); 308 309 static cl::opt<int> ClInstrumentationWithCallsThreshold( 310 "asan-instrumentation-with-call-threshold", 311 cl::desc( 312 "If the function being instrumented contains more than " 313 "this number of memory accesses, use callbacks instead of " 314 "inline checks (-1 means never use callbacks)."), 315 cl::Hidden, cl::init(7000)); 316 317 static cl::opt<std::string> ClMemoryAccessCallbackPrefix( 318 "asan-memory-access-callback-prefix", 319 cl::desc("Prefix for memory access callbacks"), cl::Hidden, 320 cl::init("__asan_")); 321 322 static cl::opt<bool> 323 ClInstrumentDynamicAllocas("asan-instrument-dynamic-allocas", 324 cl::desc("instrument dynamic allocas"), 325 cl::Hidden, cl::init(true)); 326 327 static cl::opt<bool> ClSkipPromotableAllocas( 328 "asan-skip-promotable-allocas", 329 cl::desc("Do not instrument promotable allocas"), cl::Hidden, 330 cl::init(true)); 331 332 // These flags allow to change the shadow mapping. 333 // The shadow mapping looks like 334 // Shadow = (Mem >> scale) + offset 335 336 static cl::opt<int> ClMappingScale("asan-mapping-scale", 337 cl::desc("scale of asan shadow mapping"), 338 cl::Hidden, cl::init(0)); 339 340 static cl::opt<uint64_t> 341 ClMappingOffset("asan-mapping-offset", 342 cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"), 343 cl::Hidden, cl::init(0)); 344 345 // Optimization flags. Not user visible, used mostly for testing 346 // and benchmarking the tool. 347 348 static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"), 349 cl::Hidden, cl::init(true)); 350 351 static cl::opt<bool> ClOptSameTemp( 352 "asan-opt-same-temp", cl::desc("Instrument the same temp just once"), 353 cl::Hidden, cl::init(true)); 354 355 static cl::opt<bool> ClOptGlobals("asan-opt-globals", 356 cl::desc("Don't instrument scalar globals"), 357 cl::Hidden, cl::init(true)); 358 359 static cl::opt<bool> ClOptStack( 360 "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), 361 cl::Hidden, cl::init(false)); 362 363 static cl::opt<bool> ClDynamicAllocaStack( 364 "asan-stack-dynamic-alloca", 365 cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, 366 cl::init(true)); 367 368 static cl::opt<uint32_t> ClForceExperiment( 369 "asan-force-experiment", 370 cl::desc("Force optimization experiment (for testing)"), cl::Hidden, 371 cl::init(0)); 372 373 static cl::opt<bool> 374 ClUsePrivateAlias("asan-use-private-alias", 375 cl::desc("Use private aliases for global variables"), 376 cl::Hidden, cl::init(false)); 377 378 static cl::opt<bool> 379 ClUseOdrIndicator("asan-use-odr-indicator", 380 cl::desc("Use odr indicators to improve ODR reporting"), 381 cl::Hidden, cl::init(false)); 382 383 static cl::opt<bool> 384 ClUseGlobalsGC("asan-globals-live-support", 385 cl::desc("Use linker features to support dead " 386 "code stripping of globals"), 387 cl::Hidden, cl::init(true)); 388 389 // This is on by default even though there is a bug in gold: 390 // https://sourceware.org/bugzilla/show_bug.cgi?id=19002 391 static cl::opt<bool> 392 ClWithComdat("asan-with-comdat", 393 cl::desc("Place ASan constructors in comdat sections"), 394 cl::Hidden, cl::init(true)); 395 396 static cl::opt<AsanDtorKind> ClOverrideDestructorKind( 397 "asan-destructor-kind", 398 cl::desc("Sets the ASan destructor kind. The default is to use the value " 399 "provided to the pass constructor"), 400 cl::values(clEnumValN(AsanDtorKind::None, "none", "No destructors"), 401 clEnumValN(AsanDtorKind::Global, "global", 402 "Use global destructors")), 403 cl::init(AsanDtorKind::Invalid), cl::Hidden); 404 405 // Debug flags. 406 407 static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, 408 cl::init(0)); 409 410 static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), 411 cl::Hidden, cl::init(0)); 412 413 static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden, 414 cl::desc("Debug func")); 415 416 static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), 417 cl::Hidden, cl::init(-1)); 418 419 static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug max inst"), 420 cl::Hidden, cl::init(-1)); 421 422 STATISTIC(NumInstrumentedReads, "Number of instrumented reads"); 423 STATISTIC(NumInstrumentedWrites, "Number of instrumented writes"); 424 STATISTIC(NumOptimizedAccessesToGlobalVar, 425 "Number of optimized accesses to global vars"); 426 STATISTIC(NumOptimizedAccessesToStackVar, 427 "Number of optimized accesses to stack vars"); 428 429 namespace { 430 431 /// This struct defines the shadow mapping using the rule: 432 /// shadow = (mem >> Scale) ADD-or-OR Offset. 433 /// If InGlobal is true, then 434 /// extern char __asan_shadow[]; 435 /// shadow = (mem >> Scale) + &__asan_shadow 436 struct ShadowMapping { 437 int Scale; 438 uint64_t Offset; 439 bool OrShadowOffset; 440 bool InGlobal; 441 }; 442 443 } // end anonymous namespace 444 445 static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize, 446 bool IsKasan) { 447 bool IsAndroid = TargetTriple.isAndroid(); 448 bool IsIOS = TargetTriple.isiOS() || TargetTriple.isWatchOS(); 449 bool IsMacOS = TargetTriple.isMacOSX(); 450 bool IsFreeBSD = TargetTriple.isOSFreeBSD(); 451 bool IsNetBSD = TargetTriple.isOSNetBSD(); 452 bool IsPS4CPU = TargetTriple.isPS4CPU(); 453 bool IsLinux = TargetTriple.isOSLinux(); 454 bool IsPPC64 = TargetTriple.getArch() == Triple::ppc64 || 455 TargetTriple.getArch() == Triple::ppc64le; 456 bool IsSystemZ = TargetTriple.getArch() == Triple::systemz; 457 bool IsX86_64 = TargetTriple.getArch() == Triple::x86_64; 458 bool IsMIPS32 = TargetTriple.isMIPS32(); 459 bool IsMIPS64 = TargetTriple.isMIPS64(); 460 bool IsArmOrThumb = TargetTriple.isARM() || TargetTriple.isThumb(); 461 bool IsAArch64 = TargetTriple.getArch() == Triple::aarch64; 462 bool IsRISCV64 = TargetTriple.getArch() == Triple::riscv64; 463 bool IsWindows = TargetTriple.isOSWindows(); 464 bool IsFuchsia = TargetTriple.isOSFuchsia(); 465 bool IsEmscripten = TargetTriple.isOSEmscripten(); 466 bool IsAMDGPU = TargetTriple.isAMDGPU(); 467 468 ShadowMapping Mapping; 469 470 Mapping.Scale = kDefaultShadowScale; 471 if (ClMappingScale.getNumOccurrences() > 0) { 472 Mapping.Scale = ClMappingScale; 473 } 474 475 if (LongSize == 32) { 476 if (IsAndroid) 477 Mapping.Offset = kDynamicShadowSentinel; 478 else if (IsMIPS32) 479 Mapping.Offset = kMIPS32_ShadowOffset32; 480 else if (IsFreeBSD) 481 Mapping.Offset = kFreeBSD_ShadowOffset32; 482 else if (IsNetBSD) 483 Mapping.Offset = kNetBSD_ShadowOffset32; 484 else if (IsIOS) 485 Mapping.Offset = kDynamicShadowSentinel; 486 else if (IsWindows) 487 Mapping.Offset = kWindowsShadowOffset32; 488 else if (IsEmscripten) 489 Mapping.Offset = kEmscriptenShadowOffset; 490 else 491 Mapping.Offset = kDefaultShadowOffset32; 492 } else { // LongSize == 64 493 // Fuchsia is always PIE, which means that the beginning of the address 494 // space is always available. 495 if (IsFuchsia) 496 Mapping.Offset = 0; 497 else if (IsPPC64) 498 Mapping.Offset = kPPC64_ShadowOffset64; 499 else if (IsSystemZ) 500 Mapping.Offset = kSystemZ_ShadowOffset64; 501 else if (IsFreeBSD && !IsMIPS64) { 502 if (IsKasan) 503 Mapping.Offset = kFreeBSDKasan_ShadowOffset64; 504 else 505 Mapping.Offset = kFreeBSD_ShadowOffset64; 506 } else if (IsNetBSD) { 507 if (IsKasan) 508 Mapping.Offset = kNetBSDKasan_ShadowOffset64; 509 else 510 Mapping.Offset = kNetBSD_ShadowOffset64; 511 } else if (IsPS4CPU) 512 Mapping.Offset = kPS4CPU_ShadowOffset64; 513 else if (IsLinux && IsX86_64) { 514 if (IsKasan) 515 Mapping.Offset = kLinuxKasan_ShadowOffset64; 516 else 517 Mapping.Offset = (kSmallX86_64ShadowOffsetBase & 518 (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale)); 519 } else if (IsWindows && IsX86_64) { 520 Mapping.Offset = kWindowsShadowOffset64; 521 } else if (IsMIPS64) 522 Mapping.Offset = kMIPS64_ShadowOffset64; 523 else if (IsIOS) 524 Mapping.Offset = kDynamicShadowSentinel; 525 else if (IsMacOS && IsAArch64) 526 Mapping.Offset = kDynamicShadowSentinel; 527 else if (IsAArch64) 528 Mapping.Offset = kAArch64_ShadowOffset64; 529 else if (IsRISCV64) 530 Mapping.Offset = kRISCV64_ShadowOffset64; 531 else if (IsAMDGPU) 532 Mapping.Offset = (kSmallX86_64ShadowOffsetBase & 533 (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale)); 534 else 535 Mapping.Offset = kDefaultShadowOffset64; 536 } 537 538 if (ClForceDynamicShadow) { 539 Mapping.Offset = kDynamicShadowSentinel; 540 } 541 542 if (ClMappingOffset.getNumOccurrences() > 0) { 543 Mapping.Offset = ClMappingOffset; 544 } 545 546 // OR-ing shadow offset if more efficient (at least on x86) if the offset 547 // is a power of two, but on ppc64 we have to use add since the shadow 548 // offset is not necessary 1/8-th of the address space. On SystemZ, 549 // we could OR the constant in a single instruction, but it's more 550 // efficient to load it once and use indexed addressing. 551 Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 && !IsSystemZ && !IsPS4CPU && 552 !IsRISCV64 && 553 !(Mapping.Offset & (Mapping.Offset - 1)) && 554 Mapping.Offset != kDynamicShadowSentinel; 555 bool IsAndroidWithIfuncSupport = 556 IsAndroid && !TargetTriple.isAndroidVersionLT(21); 557 Mapping.InGlobal = ClWithIfunc && IsAndroidWithIfuncSupport && IsArmOrThumb; 558 559 return Mapping; 560 } 561 562 static uint64_t getRedzoneSizeForScale(int MappingScale) { 563 // Redzone used for stack and globals is at least 32 bytes. 564 // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. 565 return std::max(32U, 1U << MappingScale); 566 } 567 568 static uint64_t GetCtorAndDtorPriority(Triple &TargetTriple) { 569 if (TargetTriple.isOSEmscripten()) { 570 return kAsanEmscriptenCtorAndDtorPriority; 571 } else { 572 return kAsanCtorAndDtorPriority; 573 } 574 } 575 576 namespace { 577 578 /// Module analysis for getting various metadata about the module. 579 class ASanGlobalsMetadataWrapperPass : public ModulePass { 580 public: 581 static char ID; 582 583 ASanGlobalsMetadataWrapperPass() : ModulePass(ID) { 584 initializeASanGlobalsMetadataWrapperPassPass( 585 *PassRegistry::getPassRegistry()); 586 } 587 588 bool runOnModule(Module &M) override { 589 GlobalsMD = GlobalsMetadata(M); 590 return false; 591 } 592 593 StringRef getPassName() const override { 594 return "ASanGlobalsMetadataWrapperPass"; 595 } 596 597 void getAnalysisUsage(AnalysisUsage &AU) const override { 598 AU.setPreservesAll(); 599 } 600 601 GlobalsMetadata &getGlobalsMD() { return GlobalsMD; } 602 603 private: 604 GlobalsMetadata GlobalsMD; 605 }; 606 607 char ASanGlobalsMetadataWrapperPass::ID = 0; 608 609 /// AddressSanitizer: instrument the code in module to find memory bugs. 610 struct AddressSanitizer { 611 AddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD, 612 bool CompileKernel = false, bool Recover = false, 613 bool UseAfterScope = false, 614 AsanDetectStackUseAfterReturnMode UseAfterReturn = 615 AsanDetectStackUseAfterReturnMode::Runtime) 616 : CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan 617 : CompileKernel), 618 Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover), 619 UseAfterScope(UseAfterScope || ClUseAfterScope), 620 UseAfterReturn(ClUseAfterReturn.getNumOccurrences() ? ClUseAfterReturn 621 : UseAfterReturn), 622 GlobalsMD(*GlobalsMD) { 623 C = &(M.getContext()); 624 LongSize = M.getDataLayout().getPointerSizeInBits(); 625 IntptrTy = Type::getIntNTy(*C, LongSize); 626 TargetTriple = Triple(M.getTargetTriple()); 627 628 Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel); 629 630 assert(this->UseAfterReturn != AsanDetectStackUseAfterReturnMode::Invalid); 631 } 632 633 uint64_t getAllocaSizeInBytes(const AllocaInst &AI) const { 634 uint64_t ArraySize = 1; 635 if (AI.isArrayAllocation()) { 636 const ConstantInt *CI = dyn_cast<ConstantInt>(AI.getArraySize()); 637 assert(CI && "non-constant array size"); 638 ArraySize = CI->getZExtValue(); 639 } 640 Type *Ty = AI.getAllocatedType(); 641 uint64_t SizeInBytes = 642 AI.getModule()->getDataLayout().getTypeAllocSize(Ty); 643 return SizeInBytes * ArraySize; 644 } 645 646 /// Check if we want (and can) handle this alloca. 647 bool isInterestingAlloca(const AllocaInst &AI); 648 649 bool ignoreAccess(Value *Ptr); 650 void getInterestingMemoryOperands( 651 Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting); 652 653 void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, 654 InterestingMemoryOperand &O, bool UseCalls, 655 const DataLayout &DL); 656 void instrumentPointerComparisonOrSubtraction(Instruction *I); 657 void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore, 658 Value *Addr, uint32_t TypeSize, bool IsWrite, 659 Value *SizeArgument, bool UseCalls, uint32_t Exp); 660 Instruction *instrumentAMDGPUAddress(Instruction *OrigIns, 661 Instruction *InsertBefore, Value *Addr, 662 uint32_t TypeSize, bool IsWrite, 663 Value *SizeArgument); 664 void instrumentUnusualSizeOrAlignment(Instruction *I, 665 Instruction *InsertBefore, Value *Addr, 666 uint32_t TypeSize, bool IsWrite, 667 Value *SizeArgument, bool UseCalls, 668 uint32_t Exp); 669 Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 670 Value *ShadowValue, uint32_t TypeSize); 671 Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr, 672 bool IsWrite, size_t AccessSizeIndex, 673 Value *SizeArgument, uint32_t Exp); 674 void instrumentMemIntrinsic(MemIntrinsic *MI); 675 Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); 676 bool suppressInstrumentationSiteForDebug(int &Instrumented); 677 bool instrumentFunction(Function &F, const TargetLibraryInfo *TLI); 678 bool maybeInsertAsanInitAtFunctionEntry(Function &F); 679 bool maybeInsertDynamicShadowAtFunctionEntry(Function &F); 680 void markEscapedLocalAllocas(Function &F); 681 682 private: 683 friend struct FunctionStackPoisoner; 684 685 void initializeCallbacks(Module &M); 686 687 bool LooksLikeCodeInBug11395(Instruction *I); 688 bool GlobalIsLinkerInitialized(GlobalVariable *G); 689 bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr, 690 uint64_t TypeSize) const; 691 692 /// Helper to cleanup per-function state. 693 struct FunctionStateRAII { 694 AddressSanitizer *Pass; 695 696 FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) { 697 assert(Pass->ProcessedAllocas.empty() && 698 "last pass forgot to clear cache"); 699 assert(!Pass->LocalDynamicShadow); 700 } 701 702 ~FunctionStateRAII() { 703 Pass->LocalDynamicShadow = nullptr; 704 Pass->ProcessedAllocas.clear(); 705 } 706 }; 707 708 LLVMContext *C; 709 Triple TargetTriple; 710 int LongSize; 711 bool CompileKernel; 712 bool Recover; 713 bool UseAfterScope; 714 AsanDetectStackUseAfterReturnMode UseAfterReturn; 715 Type *IntptrTy; 716 ShadowMapping Mapping; 717 FunctionCallee AsanHandleNoReturnFunc; 718 FunctionCallee AsanPtrCmpFunction, AsanPtrSubFunction; 719 Constant *AsanShadowGlobal; 720 721 // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize). 722 FunctionCallee AsanErrorCallback[2][2][kNumberOfAccessSizes]; 723 FunctionCallee AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes]; 724 725 // These arrays is indexed by AccessIsWrite and Experiment. 726 FunctionCallee AsanErrorCallbackSized[2][2]; 727 FunctionCallee AsanMemoryAccessCallbackSized[2][2]; 728 729 FunctionCallee AsanMemmove, AsanMemcpy, AsanMemset; 730 Value *LocalDynamicShadow = nullptr; 731 const GlobalsMetadata &GlobalsMD; 732 DenseMap<const AllocaInst *, bool> ProcessedAllocas; 733 734 FunctionCallee AMDGPUAddressShared; 735 FunctionCallee AMDGPUAddressPrivate; 736 }; 737 738 class AddressSanitizerLegacyPass : public FunctionPass { 739 public: 740 static char ID; 741 742 explicit AddressSanitizerLegacyPass( 743 bool CompileKernel = false, bool Recover = false, 744 bool UseAfterScope = false, 745 AsanDetectStackUseAfterReturnMode UseAfterReturn = 746 AsanDetectStackUseAfterReturnMode::Runtime) 747 : FunctionPass(ID), CompileKernel(CompileKernel), Recover(Recover), 748 UseAfterScope(UseAfterScope), UseAfterReturn(UseAfterReturn) { 749 initializeAddressSanitizerLegacyPassPass(*PassRegistry::getPassRegistry()); 750 } 751 752 StringRef getPassName() const override { 753 return "AddressSanitizerFunctionPass"; 754 } 755 756 void getAnalysisUsage(AnalysisUsage &AU) const override { 757 AU.addRequired<ASanGlobalsMetadataWrapperPass>(); 758 AU.addRequired<TargetLibraryInfoWrapperPass>(); 759 } 760 761 bool runOnFunction(Function &F) override { 762 GlobalsMetadata &GlobalsMD = 763 getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD(); 764 const TargetLibraryInfo *TLI = 765 &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F); 766 AddressSanitizer ASan(*F.getParent(), &GlobalsMD, CompileKernel, Recover, 767 UseAfterScope, UseAfterReturn); 768 return ASan.instrumentFunction(F, TLI); 769 } 770 771 private: 772 bool CompileKernel; 773 bool Recover; 774 bool UseAfterScope; 775 AsanDetectStackUseAfterReturnMode UseAfterReturn; 776 }; 777 778 class ModuleAddressSanitizer { 779 public: 780 ModuleAddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD, 781 bool CompileKernel = false, bool Recover = false, 782 bool UseGlobalsGC = true, bool UseOdrIndicator = false, 783 AsanDtorKind DestructorKind = AsanDtorKind::Global) 784 : GlobalsMD(*GlobalsMD), 785 CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan 786 : CompileKernel), 787 Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover), 788 UseGlobalsGC(UseGlobalsGC && ClUseGlobalsGC && !this->CompileKernel), 789 // Enable aliases as they should have no downside with ODR indicators. 790 UsePrivateAlias(UseOdrIndicator || ClUsePrivateAlias), 791 UseOdrIndicator(UseOdrIndicator || ClUseOdrIndicator), 792 // Not a typo: ClWithComdat is almost completely pointless without 793 // ClUseGlobalsGC (because then it only works on modules without 794 // globals, which are rare); it is a prerequisite for ClUseGlobalsGC; 795 // and both suffer from gold PR19002 for which UseGlobalsGC constructor 796 // argument is designed as workaround. Therefore, disable both 797 // ClWithComdat and ClUseGlobalsGC unless the frontend says it's ok to 798 // do globals-gc. 799 UseCtorComdat(UseGlobalsGC && ClWithComdat && !this->CompileKernel), 800 DestructorKind(DestructorKind) { 801 C = &(M.getContext()); 802 int LongSize = M.getDataLayout().getPointerSizeInBits(); 803 IntptrTy = Type::getIntNTy(*C, LongSize); 804 TargetTriple = Triple(M.getTargetTriple()); 805 Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel); 806 807 if (ClOverrideDestructorKind != AsanDtorKind::Invalid) 808 this->DestructorKind = ClOverrideDestructorKind; 809 assert(this->DestructorKind != AsanDtorKind::Invalid); 810 } 811 812 bool instrumentModule(Module &); 813 814 private: 815 void initializeCallbacks(Module &M); 816 817 bool InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat); 818 void InstrumentGlobalsCOFF(IRBuilder<> &IRB, Module &M, 819 ArrayRef<GlobalVariable *> ExtendedGlobals, 820 ArrayRef<Constant *> MetadataInitializers); 821 void InstrumentGlobalsELF(IRBuilder<> &IRB, Module &M, 822 ArrayRef<GlobalVariable *> ExtendedGlobals, 823 ArrayRef<Constant *> MetadataInitializers, 824 const std::string &UniqueModuleId); 825 void InstrumentGlobalsMachO(IRBuilder<> &IRB, Module &M, 826 ArrayRef<GlobalVariable *> ExtendedGlobals, 827 ArrayRef<Constant *> MetadataInitializers); 828 void 829 InstrumentGlobalsWithMetadataArray(IRBuilder<> &IRB, Module &M, 830 ArrayRef<GlobalVariable *> ExtendedGlobals, 831 ArrayRef<Constant *> MetadataInitializers); 832 833 GlobalVariable *CreateMetadataGlobal(Module &M, Constant *Initializer, 834 StringRef OriginalName); 835 void SetComdatForGlobalMetadata(GlobalVariable *G, GlobalVariable *Metadata, 836 StringRef InternalSuffix); 837 Instruction *CreateAsanModuleDtor(Module &M); 838 839 const GlobalVariable *getExcludedAliasedGlobal(const GlobalAlias &GA) const; 840 bool shouldInstrumentGlobal(GlobalVariable *G) const; 841 bool ShouldUseMachOGlobalsSection() const; 842 StringRef getGlobalMetadataSection() const; 843 void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName); 844 void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName); 845 uint64_t getMinRedzoneSizeForGlobal() const { 846 return getRedzoneSizeForScale(Mapping.Scale); 847 } 848 uint64_t getRedzoneSizeForGlobal(uint64_t SizeInBytes) const; 849 int GetAsanVersion(const Module &M) const; 850 851 const GlobalsMetadata &GlobalsMD; 852 bool CompileKernel; 853 bool Recover; 854 bool UseGlobalsGC; 855 bool UsePrivateAlias; 856 bool UseOdrIndicator; 857 bool UseCtorComdat; 858 AsanDtorKind DestructorKind; 859 Type *IntptrTy; 860 LLVMContext *C; 861 Triple TargetTriple; 862 ShadowMapping Mapping; 863 FunctionCallee AsanPoisonGlobals; 864 FunctionCallee AsanUnpoisonGlobals; 865 FunctionCallee AsanRegisterGlobals; 866 FunctionCallee AsanUnregisterGlobals; 867 FunctionCallee AsanRegisterImageGlobals; 868 FunctionCallee AsanUnregisterImageGlobals; 869 FunctionCallee AsanRegisterElfGlobals; 870 FunctionCallee AsanUnregisterElfGlobals; 871 872 Function *AsanCtorFunction = nullptr; 873 Function *AsanDtorFunction = nullptr; 874 }; 875 876 class ModuleAddressSanitizerLegacyPass : public ModulePass { 877 public: 878 static char ID; 879 880 explicit ModuleAddressSanitizerLegacyPass( 881 bool CompileKernel = false, bool Recover = false, bool UseGlobalGC = true, 882 bool UseOdrIndicator = false, 883 AsanDtorKind DestructorKind = AsanDtorKind::Global) 884 : ModulePass(ID), CompileKernel(CompileKernel), Recover(Recover), 885 UseGlobalGC(UseGlobalGC), UseOdrIndicator(UseOdrIndicator), 886 DestructorKind(DestructorKind) { 887 initializeModuleAddressSanitizerLegacyPassPass( 888 *PassRegistry::getPassRegistry()); 889 } 890 891 StringRef getPassName() const override { return "ModuleAddressSanitizer"; } 892 893 void getAnalysisUsage(AnalysisUsage &AU) const override { 894 AU.addRequired<ASanGlobalsMetadataWrapperPass>(); 895 } 896 897 bool runOnModule(Module &M) override { 898 GlobalsMetadata &GlobalsMD = 899 getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD(); 900 ModuleAddressSanitizer ASanModule(M, &GlobalsMD, CompileKernel, Recover, 901 UseGlobalGC, UseOdrIndicator, 902 DestructorKind); 903 return ASanModule.instrumentModule(M); 904 } 905 906 private: 907 bool CompileKernel; 908 bool Recover; 909 bool UseGlobalGC; 910 bool UseOdrIndicator; 911 AsanDtorKind DestructorKind; 912 }; 913 914 // Stack poisoning does not play well with exception handling. 915 // When an exception is thrown, we essentially bypass the code 916 // that unpoisones the stack. This is why the run-time library has 917 // to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire 918 // stack in the interceptor. This however does not work inside the 919 // actual function which catches the exception. Most likely because the 920 // compiler hoists the load of the shadow value somewhere too high. 921 // This causes asan to report a non-existing bug on 453.povray. 922 // It sounds like an LLVM bug. 923 struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> { 924 Function &F; 925 AddressSanitizer &ASan; 926 DIBuilder DIB; 927 LLVMContext *C; 928 Type *IntptrTy; 929 Type *IntptrPtrTy; 930 ShadowMapping Mapping; 931 932 SmallVector<AllocaInst *, 16> AllocaVec; 933 SmallVector<AllocaInst *, 16> StaticAllocasToMoveUp; 934 SmallVector<Instruction *, 8> RetVec; 935 936 FunctionCallee AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1], 937 AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1]; 938 FunctionCallee AsanSetShadowFunc[0x100] = {}; 939 FunctionCallee AsanPoisonStackMemoryFunc, AsanUnpoisonStackMemoryFunc; 940 FunctionCallee AsanAllocaPoisonFunc, AsanAllocasUnpoisonFunc; 941 942 // Stores a place and arguments of poisoning/unpoisoning call for alloca. 943 struct AllocaPoisonCall { 944 IntrinsicInst *InsBefore; 945 AllocaInst *AI; 946 uint64_t Size; 947 bool DoPoison; 948 }; 949 SmallVector<AllocaPoisonCall, 8> DynamicAllocaPoisonCallVec; 950 SmallVector<AllocaPoisonCall, 8> StaticAllocaPoisonCallVec; 951 bool HasUntracedLifetimeIntrinsic = false; 952 953 SmallVector<AllocaInst *, 1> DynamicAllocaVec; 954 SmallVector<IntrinsicInst *, 1> StackRestoreVec; 955 AllocaInst *DynamicAllocaLayout = nullptr; 956 IntrinsicInst *LocalEscapeCall = nullptr; 957 958 bool HasInlineAsm = false; 959 bool HasReturnsTwiceCall = false; 960 bool PoisonStack; 961 962 FunctionStackPoisoner(Function &F, AddressSanitizer &ASan) 963 : F(F), ASan(ASan), DIB(*F.getParent(), /*AllowUnresolved*/ false), 964 C(ASan.C), IntptrTy(ASan.IntptrTy), 965 IntptrPtrTy(PointerType::get(IntptrTy, 0)), Mapping(ASan.Mapping), 966 PoisonStack(ClStack && 967 !Triple(F.getParent()->getTargetTriple()).isAMDGPU()) {} 968 969 bool runOnFunction() { 970 if (!PoisonStack) 971 return false; 972 973 if (ClRedzoneByvalArgs) 974 copyArgsPassedByValToAllocas(); 975 976 // Collect alloca, ret, lifetime instructions etc. 977 for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB); 978 979 if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false; 980 981 initializeCallbacks(*F.getParent()); 982 983 if (HasUntracedLifetimeIntrinsic) { 984 // If there are lifetime intrinsics which couldn't be traced back to an 985 // alloca, we may not know exactly when a variable enters scope, and 986 // therefore should "fail safe" by not poisoning them. 987 StaticAllocaPoisonCallVec.clear(); 988 DynamicAllocaPoisonCallVec.clear(); 989 } 990 991 processDynamicAllocas(); 992 processStaticAllocas(); 993 994 if (ClDebugStack) { 995 LLVM_DEBUG(dbgs() << F); 996 } 997 return true; 998 } 999 1000 // Arguments marked with the "byval" attribute are implicitly copied without 1001 // using an alloca instruction. To produce redzones for those arguments, we 1002 // copy them a second time into memory allocated with an alloca instruction. 1003 void copyArgsPassedByValToAllocas(); 1004 1005 // Finds all Alloca instructions and puts 1006 // poisoned red zones around all of them. 1007 // Then unpoison everything back before the function returns. 1008 void processStaticAllocas(); 1009 void processDynamicAllocas(); 1010 1011 void createDynamicAllocasInitStorage(); 1012 1013 // ----------------------- Visitors. 1014 /// Collect all Ret instructions, or the musttail call instruction if it 1015 /// precedes the return instruction. 1016 void visitReturnInst(ReturnInst &RI) { 1017 if (CallInst *CI = RI.getParent()->getTerminatingMustTailCall()) 1018 RetVec.push_back(CI); 1019 else 1020 RetVec.push_back(&RI); 1021 } 1022 1023 /// Collect all Resume instructions. 1024 void visitResumeInst(ResumeInst &RI) { RetVec.push_back(&RI); } 1025 1026 /// Collect all CatchReturnInst instructions. 1027 void visitCleanupReturnInst(CleanupReturnInst &CRI) { RetVec.push_back(&CRI); } 1028 1029 void unpoisonDynamicAllocasBeforeInst(Instruction *InstBefore, 1030 Value *SavedStack) { 1031 IRBuilder<> IRB(InstBefore); 1032 Value *DynamicAreaPtr = IRB.CreatePtrToInt(SavedStack, IntptrTy); 1033 // When we insert _asan_allocas_unpoison before @llvm.stackrestore, we 1034 // need to adjust extracted SP to compute the address of the most recent 1035 // alloca. We have a special @llvm.get.dynamic.area.offset intrinsic for 1036 // this purpose. 1037 if (!isa<ReturnInst>(InstBefore)) { 1038 Function *DynamicAreaOffsetFunc = Intrinsic::getDeclaration( 1039 InstBefore->getModule(), Intrinsic::get_dynamic_area_offset, 1040 {IntptrTy}); 1041 1042 Value *DynamicAreaOffset = IRB.CreateCall(DynamicAreaOffsetFunc, {}); 1043 1044 DynamicAreaPtr = IRB.CreateAdd(IRB.CreatePtrToInt(SavedStack, IntptrTy), 1045 DynamicAreaOffset); 1046 } 1047 1048 IRB.CreateCall( 1049 AsanAllocasUnpoisonFunc, 1050 {IRB.CreateLoad(IntptrTy, DynamicAllocaLayout), DynamicAreaPtr}); 1051 } 1052 1053 // Unpoison dynamic allocas redzones. 1054 void unpoisonDynamicAllocas() { 1055 for (Instruction *Ret : RetVec) 1056 unpoisonDynamicAllocasBeforeInst(Ret, DynamicAllocaLayout); 1057 1058 for (Instruction *StackRestoreInst : StackRestoreVec) 1059 unpoisonDynamicAllocasBeforeInst(StackRestoreInst, 1060 StackRestoreInst->getOperand(0)); 1061 } 1062 1063 // Deploy and poison redzones around dynamic alloca call. To do this, we 1064 // should replace this call with another one with changed parameters and 1065 // replace all its uses with new address, so 1066 // addr = alloca type, old_size, align 1067 // is replaced by 1068 // new_size = (old_size + additional_size) * sizeof(type) 1069 // tmp = alloca i8, new_size, max(align, 32) 1070 // addr = tmp + 32 (first 32 bytes are for the left redzone). 1071 // Additional_size is added to make new memory allocation contain not only 1072 // requested memory, but also left, partial and right redzones. 1073 void handleDynamicAllocaCall(AllocaInst *AI); 1074 1075 /// Collect Alloca instructions we want (and can) handle. 1076 void visitAllocaInst(AllocaInst &AI) { 1077 if (!ASan.isInterestingAlloca(AI)) { 1078 if (AI.isStaticAlloca()) { 1079 // Skip over allocas that are present *before* the first instrumented 1080 // alloca, we don't want to move those around. 1081 if (AllocaVec.empty()) 1082 return; 1083 1084 StaticAllocasToMoveUp.push_back(&AI); 1085 } 1086 return; 1087 } 1088 1089 if (!AI.isStaticAlloca()) 1090 DynamicAllocaVec.push_back(&AI); 1091 else 1092 AllocaVec.push_back(&AI); 1093 } 1094 1095 /// Collect lifetime intrinsic calls to check for use-after-scope 1096 /// errors. 1097 void visitIntrinsicInst(IntrinsicInst &II) { 1098 Intrinsic::ID ID = II.getIntrinsicID(); 1099 if (ID == Intrinsic::stackrestore) StackRestoreVec.push_back(&II); 1100 if (ID == Intrinsic::localescape) LocalEscapeCall = &II; 1101 if (!ASan.UseAfterScope) 1102 return; 1103 if (!II.isLifetimeStartOrEnd()) 1104 return; 1105 // Found lifetime intrinsic, add ASan instrumentation if necessary. 1106 auto *Size = cast<ConstantInt>(II.getArgOperand(0)); 1107 // If size argument is undefined, don't do anything. 1108 if (Size->isMinusOne()) return; 1109 // Check that size doesn't saturate uint64_t and can 1110 // be stored in IntptrTy. 1111 const uint64_t SizeValue = Size->getValue().getLimitedValue(); 1112 if (SizeValue == ~0ULL || 1113 !ConstantInt::isValueValidForType(IntptrTy, SizeValue)) 1114 return; 1115 // Find alloca instruction that corresponds to llvm.lifetime argument. 1116 // Currently we can only handle lifetime markers pointing to the 1117 // beginning of the alloca. 1118 AllocaInst *AI = findAllocaForValue(II.getArgOperand(1), true); 1119 if (!AI) { 1120 HasUntracedLifetimeIntrinsic = true; 1121 return; 1122 } 1123 // We're interested only in allocas we can handle. 1124 if (!ASan.isInterestingAlloca(*AI)) 1125 return; 1126 bool DoPoison = (ID == Intrinsic::lifetime_end); 1127 AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison}; 1128 if (AI->isStaticAlloca()) 1129 StaticAllocaPoisonCallVec.push_back(APC); 1130 else if (ClInstrumentDynamicAllocas) 1131 DynamicAllocaPoisonCallVec.push_back(APC); 1132 } 1133 1134 void visitCallBase(CallBase &CB) { 1135 if (CallInst *CI = dyn_cast<CallInst>(&CB)) { 1136 HasInlineAsm |= CI->isInlineAsm() && &CB != ASan.LocalDynamicShadow; 1137 HasReturnsTwiceCall |= CI->canReturnTwice(); 1138 } 1139 } 1140 1141 // ---------------------- Helpers. 1142 void initializeCallbacks(Module &M); 1143 1144 // Copies bytes from ShadowBytes into shadow memory for indexes where 1145 // ShadowMask is not zero. If ShadowMask[i] is zero, we assume that 1146 // ShadowBytes[i] is constantly zero and doesn't need to be overwritten. 1147 void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes, 1148 IRBuilder<> &IRB, Value *ShadowBase); 1149 void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes, 1150 size_t Begin, size_t End, IRBuilder<> &IRB, 1151 Value *ShadowBase); 1152 void copyToShadowInline(ArrayRef<uint8_t> ShadowMask, 1153 ArrayRef<uint8_t> ShadowBytes, size_t Begin, 1154 size_t End, IRBuilder<> &IRB, Value *ShadowBase); 1155 1156 void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison); 1157 1158 Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L, 1159 bool Dynamic); 1160 PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue, 1161 Instruction *ThenTerm, Value *ValueIfFalse); 1162 }; 1163 1164 } // end anonymous namespace 1165 1166 void LocationMetadata::parse(MDNode *MDN) { 1167 assert(MDN->getNumOperands() == 3); 1168 MDString *DIFilename = cast<MDString>(MDN->getOperand(0)); 1169 Filename = DIFilename->getString(); 1170 LineNo = mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue(); 1171 ColumnNo = 1172 mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue(); 1173 } 1174 1175 // FIXME: It would be cleaner to instead attach relevant metadata to the globals 1176 // we want to sanitize instead and reading this metadata on each pass over a 1177 // function instead of reading module level metadata at first. 1178 GlobalsMetadata::GlobalsMetadata(Module &M) { 1179 NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals"); 1180 if (!Globals) 1181 return; 1182 for (auto MDN : Globals->operands()) { 1183 // Metadata node contains the global and the fields of "Entry". 1184 assert(MDN->getNumOperands() == 5); 1185 auto *V = mdconst::extract_or_null<Constant>(MDN->getOperand(0)); 1186 // The optimizer may optimize away a global entirely. 1187 if (!V) 1188 continue; 1189 auto *StrippedV = V->stripPointerCasts(); 1190 auto *GV = dyn_cast<GlobalVariable>(StrippedV); 1191 if (!GV) 1192 continue; 1193 // We can already have an entry for GV if it was merged with another 1194 // global. 1195 Entry &E = Entries[GV]; 1196 if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1))) 1197 E.SourceLoc.parse(Loc); 1198 if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2))) 1199 E.Name = Name->getString(); 1200 ConstantInt *IsDynInit = mdconst::extract<ConstantInt>(MDN->getOperand(3)); 1201 E.IsDynInit |= IsDynInit->isOne(); 1202 ConstantInt *IsExcluded = 1203 mdconst::extract<ConstantInt>(MDN->getOperand(4)); 1204 E.IsExcluded |= IsExcluded->isOne(); 1205 } 1206 } 1207 1208 AnalysisKey ASanGlobalsMetadataAnalysis::Key; 1209 1210 GlobalsMetadata ASanGlobalsMetadataAnalysis::run(Module &M, 1211 ModuleAnalysisManager &AM) { 1212 return GlobalsMetadata(M); 1213 } 1214 1215 AddressSanitizerPass::AddressSanitizerPass( 1216 bool CompileKernel, bool Recover, bool UseAfterScope, 1217 AsanDetectStackUseAfterReturnMode UseAfterReturn) 1218 : CompileKernel(CompileKernel), Recover(Recover), 1219 UseAfterScope(UseAfterScope), UseAfterReturn(UseAfterReturn) {} 1220 1221 PreservedAnalyses AddressSanitizerPass::run(Function &F, 1222 AnalysisManager<Function> &AM) { 1223 auto &MAMProxy = AM.getResult<ModuleAnalysisManagerFunctionProxy>(F); 1224 Module &M = *F.getParent(); 1225 if (auto *R = MAMProxy.getCachedResult<ASanGlobalsMetadataAnalysis>(M)) { 1226 const TargetLibraryInfo *TLI = &AM.getResult<TargetLibraryAnalysis>(F); 1227 AddressSanitizer Sanitizer(M, R, CompileKernel, Recover, UseAfterScope, 1228 UseAfterReturn); 1229 if (Sanitizer.instrumentFunction(F, TLI)) 1230 return PreservedAnalyses::none(); 1231 return PreservedAnalyses::all(); 1232 } 1233 1234 report_fatal_error( 1235 "The ASanGlobalsMetadataAnalysis is required to run before " 1236 "AddressSanitizer can run"); 1237 return PreservedAnalyses::all(); 1238 } 1239 1240 ModuleAddressSanitizerPass::ModuleAddressSanitizerPass( 1241 bool CompileKernel, bool Recover, bool UseGlobalGC, bool UseOdrIndicator, 1242 AsanDtorKind DestructorKind) 1243 : CompileKernel(CompileKernel), Recover(Recover), UseGlobalGC(UseGlobalGC), 1244 UseOdrIndicator(UseOdrIndicator), DestructorKind(DestructorKind) {} 1245 1246 PreservedAnalyses ModuleAddressSanitizerPass::run(Module &M, 1247 AnalysisManager<Module> &AM) { 1248 GlobalsMetadata &GlobalsMD = AM.getResult<ASanGlobalsMetadataAnalysis>(M); 1249 ModuleAddressSanitizer Sanitizer(M, &GlobalsMD, CompileKernel, Recover, 1250 UseGlobalGC, UseOdrIndicator, 1251 DestructorKind); 1252 if (Sanitizer.instrumentModule(M)) 1253 return PreservedAnalyses::none(); 1254 return PreservedAnalyses::all(); 1255 } 1256 1257 INITIALIZE_PASS(ASanGlobalsMetadataWrapperPass, "asan-globals-md", 1258 "Read metadata to mark which globals should be instrumented " 1259 "when running ASan.", 1260 false, true) 1261 1262 char AddressSanitizerLegacyPass::ID = 0; 1263 1264 INITIALIZE_PASS_BEGIN( 1265 AddressSanitizerLegacyPass, "asan", 1266 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, 1267 false) 1268 INITIALIZE_PASS_DEPENDENCY(ASanGlobalsMetadataWrapperPass) 1269 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass) 1270 INITIALIZE_PASS_END( 1271 AddressSanitizerLegacyPass, "asan", 1272 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, 1273 false) 1274 1275 FunctionPass *llvm::createAddressSanitizerFunctionPass( 1276 bool CompileKernel, bool Recover, bool UseAfterScope, 1277 AsanDetectStackUseAfterReturnMode UseAfterReturn) { 1278 assert(!CompileKernel || Recover); 1279 return new AddressSanitizerLegacyPass(CompileKernel, Recover, UseAfterScope, 1280 UseAfterReturn); 1281 } 1282 1283 char ModuleAddressSanitizerLegacyPass::ID = 0; 1284 1285 INITIALIZE_PASS( 1286 ModuleAddressSanitizerLegacyPass, "asan-module", 1287 "AddressSanitizer: detects use-after-free and out-of-bounds bugs." 1288 "ModulePass", 1289 false, false) 1290 1291 ModulePass *llvm::createModuleAddressSanitizerLegacyPassPass( 1292 bool CompileKernel, bool Recover, bool UseGlobalsGC, bool UseOdrIndicator, 1293 AsanDtorKind Destructor) { 1294 assert(!CompileKernel || Recover); 1295 return new ModuleAddressSanitizerLegacyPass( 1296 CompileKernel, Recover, UseGlobalsGC, UseOdrIndicator, Destructor); 1297 } 1298 1299 static size_t TypeSizeToSizeIndex(uint32_t TypeSize) { 1300 size_t Res = countTrailingZeros(TypeSize / 8); 1301 assert(Res < kNumberOfAccessSizes); 1302 return Res; 1303 } 1304 1305 /// Create a global describing a source location. 1306 static GlobalVariable *createPrivateGlobalForSourceLoc(Module &M, 1307 LocationMetadata MD) { 1308 Constant *LocData[] = { 1309 createPrivateGlobalForString(M, MD.Filename, true, kAsanGenPrefix), 1310 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo), 1311 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo), 1312 }; 1313 auto LocStruct = ConstantStruct::getAnon(LocData); 1314 auto GV = new GlobalVariable(M, LocStruct->getType(), true, 1315 GlobalValue::PrivateLinkage, LocStruct, 1316 kAsanGenPrefix); 1317 GV->setUnnamedAddr(GlobalValue::UnnamedAddr::Global); 1318 return GV; 1319 } 1320 1321 /// Check if \p G has been created by a trusted compiler pass. 1322 static bool GlobalWasGeneratedByCompiler(GlobalVariable *G) { 1323 // Do not instrument @llvm.global_ctors, @llvm.used, etc. 1324 if (G->getName().startswith("llvm.")) 1325 return true; 1326 1327 // Do not instrument asan globals. 1328 if (G->getName().startswith(kAsanGenPrefix) || 1329 G->getName().startswith(kSanCovGenPrefix) || 1330 G->getName().startswith(kODRGenPrefix)) 1331 return true; 1332 1333 // Do not instrument gcov counter arrays. 1334 if (G->getName() == "__llvm_gcov_ctr") 1335 return true; 1336 1337 return false; 1338 } 1339 1340 static bool isUnsupportedAMDGPUAddrspace(Value *Addr) { 1341 Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType()); 1342 unsigned int AddrSpace = PtrTy->getPointerAddressSpace(); 1343 if (AddrSpace == 3 || AddrSpace == 5) 1344 return true; 1345 return false; 1346 } 1347 1348 Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { 1349 // Shadow >> scale 1350 Shadow = IRB.CreateLShr(Shadow, Mapping.Scale); 1351 if (Mapping.Offset == 0) return Shadow; 1352 // (Shadow >> scale) | offset 1353 Value *ShadowBase; 1354 if (LocalDynamicShadow) 1355 ShadowBase = LocalDynamicShadow; 1356 else 1357 ShadowBase = ConstantInt::get(IntptrTy, Mapping.Offset); 1358 if (Mapping.OrShadowOffset) 1359 return IRB.CreateOr(Shadow, ShadowBase); 1360 else 1361 return IRB.CreateAdd(Shadow, ShadowBase); 1362 } 1363 1364 // Instrument memset/memmove/memcpy 1365 void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { 1366 IRBuilder<> IRB(MI); 1367 if (isa<MemTransferInst>(MI)) { 1368 IRB.CreateCall( 1369 isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy, 1370 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), 1371 IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()), 1372 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); 1373 } else if (isa<MemSetInst>(MI)) { 1374 IRB.CreateCall( 1375 AsanMemset, 1376 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), 1377 IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false), 1378 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); 1379 } 1380 MI->eraseFromParent(); 1381 } 1382 1383 /// Check if we want (and can) handle this alloca. 1384 bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) { 1385 auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI); 1386 1387 if (PreviouslySeenAllocaInfo != ProcessedAllocas.end()) 1388 return PreviouslySeenAllocaInfo->getSecond(); 1389 1390 bool IsInteresting = 1391 (AI.getAllocatedType()->isSized() && 1392 // alloca() may be called with 0 size, ignore it. 1393 ((!AI.isStaticAlloca()) || getAllocaSizeInBytes(AI) > 0) && 1394 // We are only interested in allocas not promotable to registers. 1395 // Promotable allocas are common under -O0. 1396 (!ClSkipPromotableAllocas || !isAllocaPromotable(&AI)) && 1397 // inalloca allocas are not treated as static, and we don't want 1398 // dynamic alloca instrumentation for them as well. 1399 !AI.isUsedWithInAlloca() && 1400 // swifterror allocas are register promoted by ISel 1401 !AI.isSwiftError()); 1402 1403 ProcessedAllocas[&AI] = IsInteresting; 1404 return IsInteresting; 1405 } 1406 1407 bool AddressSanitizer::ignoreAccess(Value *Ptr) { 1408 // Instrument acesses from different address spaces only for AMDGPU. 1409 Type *PtrTy = cast<PointerType>(Ptr->getType()->getScalarType()); 1410 if (PtrTy->getPointerAddressSpace() != 0 && 1411 !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(Ptr))) 1412 return true; 1413 1414 // Ignore swifterror addresses. 1415 // swifterror memory addresses are mem2reg promoted by instruction 1416 // selection. As such they cannot have regular uses like an instrumentation 1417 // function and it makes no sense to track them as memory. 1418 if (Ptr->isSwiftError()) 1419 return true; 1420 1421 // Treat memory accesses to promotable allocas as non-interesting since they 1422 // will not cause memory violations. This greatly speeds up the instrumented 1423 // executable at -O0. 1424 if (auto AI = dyn_cast_or_null<AllocaInst>(Ptr)) 1425 if (ClSkipPromotableAllocas && !isInterestingAlloca(*AI)) 1426 return true; 1427 1428 return false; 1429 } 1430 1431 void AddressSanitizer::getInterestingMemoryOperands( 1432 Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting) { 1433 // Skip memory accesses inserted by another instrumentation. 1434 if (I->hasMetadata("nosanitize")) 1435 return; 1436 1437 // Do not instrument the load fetching the dynamic shadow address. 1438 if (LocalDynamicShadow == I) 1439 return; 1440 1441 if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 1442 if (!ClInstrumentReads || ignoreAccess(LI->getPointerOperand())) 1443 return; 1444 Interesting.emplace_back(I, LI->getPointerOperandIndex(), false, 1445 LI->getType(), LI->getAlign()); 1446 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) { 1447 if (!ClInstrumentWrites || ignoreAccess(SI->getPointerOperand())) 1448 return; 1449 Interesting.emplace_back(I, SI->getPointerOperandIndex(), true, 1450 SI->getValueOperand()->getType(), SI->getAlign()); 1451 } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { 1452 if (!ClInstrumentAtomics || ignoreAccess(RMW->getPointerOperand())) 1453 return; 1454 Interesting.emplace_back(I, RMW->getPointerOperandIndex(), true, 1455 RMW->getValOperand()->getType(), None); 1456 } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { 1457 if (!ClInstrumentAtomics || ignoreAccess(XCHG->getPointerOperand())) 1458 return; 1459 Interesting.emplace_back(I, XCHG->getPointerOperandIndex(), true, 1460 XCHG->getCompareOperand()->getType(), None); 1461 } else if (auto CI = dyn_cast<CallInst>(I)) { 1462 auto *F = CI->getCalledFunction(); 1463 if (F && (F->getName().startswith("llvm.masked.load.") || 1464 F->getName().startswith("llvm.masked.store."))) { 1465 bool IsWrite = F->getName().startswith("llvm.masked.store."); 1466 // Masked store has an initial operand for the value. 1467 unsigned OpOffset = IsWrite ? 1 : 0; 1468 if (IsWrite ? !ClInstrumentWrites : !ClInstrumentReads) 1469 return; 1470 1471 auto BasePtr = CI->getOperand(OpOffset); 1472 if (ignoreAccess(BasePtr)) 1473 return; 1474 auto Ty = cast<PointerType>(BasePtr->getType())->getElementType(); 1475 MaybeAlign Alignment = Align(1); 1476 // Otherwise no alignment guarantees. We probably got Undef. 1477 if (auto *Op = dyn_cast<ConstantInt>(CI->getOperand(1 + OpOffset))) 1478 Alignment = Op->getMaybeAlignValue(); 1479 Value *Mask = CI->getOperand(2 + OpOffset); 1480 Interesting.emplace_back(I, OpOffset, IsWrite, Ty, Alignment, Mask); 1481 } else { 1482 for (unsigned ArgNo = 0; ArgNo < CI->getNumArgOperands(); ArgNo++) { 1483 if (!ClInstrumentByval || !CI->isByValArgument(ArgNo) || 1484 ignoreAccess(CI->getArgOperand(ArgNo))) 1485 continue; 1486 Type *Ty = CI->getParamByValType(ArgNo); 1487 Interesting.emplace_back(I, ArgNo, false, Ty, Align(1)); 1488 } 1489 } 1490 } 1491 } 1492 1493 static bool isPointerOperand(Value *V) { 1494 return V->getType()->isPointerTy() || isa<PtrToIntInst>(V); 1495 } 1496 1497 // This is a rough heuristic; it may cause both false positives and 1498 // false negatives. The proper implementation requires cooperation with 1499 // the frontend. 1500 static bool isInterestingPointerComparison(Instruction *I) { 1501 if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) { 1502 if (!Cmp->isRelational()) 1503 return false; 1504 } else { 1505 return false; 1506 } 1507 return isPointerOperand(I->getOperand(0)) && 1508 isPointerOperand(I->getOperand(1)); 1509 } 1510 1511 // This is a rough heuristic; it may cause both false positives and 1512 // false negatives. The proper implementation requires cooperation with 1513 // the frontend. 1514 static bool isInterestingPointerSubtraction(Instruction *I) { 1515 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) { 1516 if (BO->getOpcode() != Instruction::Sub) 1517 return false; 1518 } else { 1519 return false; 1520 } 1521 return isPointerOperand(I->getOperand(0)) && 1522 isPointerOperand(I->getOperand(1)); 1523 } 1524 1525 bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) { 1526 // If a global variable does not have dynamic initialization we don't 1527 // have to instrument it. However, if a global does not have initializer 1528 // at all, we assume it has dynamic initializer (in other TU). 1529 // 1530 // FIXME: Metadata should be attched directly to the global directly instead 1531 // of being added to llvm.asan.globals. 1532 return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit; 1533 } 1534 1535 void AddressSanitizer::instrumentPointerComparisonOrSubtraction( 1536 Instruction *I) { 1537 IRBuilder<> IRB(I); 1538 FunctionCallee F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction; 1539 Value *Param[2] = {I->getOperand(0), I->getOperand(1)}; 1540 for (Value *&i : Param) { 1541 if (i->getType()->isPointerTy()) 1542 i = IRB.CreatePointerCast(i, IntptrTy); 1543 } 1544 IRB.CreateCall(F, Param); 1545 } 1546 1547 static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I, 1548 Instruction *InsertBefore, Value *Addr, 1549 MaybeAlign Alignment, unsigned Granularity, 1550 uint32_t TypeSize, bool IsWrite, 1551 Value *SizeArgument, bool UseCalls, 1552 uint32_t Exp) { 1553 // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check 1554 // if the data is properly aligned. 1555 if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 || 1556 TypeSize == 128) && 1557 (!Alignment || *Alignment >= Granularity || *Alignment >= TypeSize / 8)) 1558 return Pass->instrumentAddress(I, InsertBefore, Addr, TypeSize, IsWrite, 1559 nullptr, UseCalls, Exp); 1560 Pass->instrumentUnusualSizeOrAlignment(I, InsertBefore, Addr, TypeSize, 1561 IsWrite, nullptr, UseCalls, Exp); 1562 } 1563 1564 static void instrumentMaskedLoadOrStore(AddressSanitizer *Pass, 1565 const DataLayout &DL, Type *IntptrTy, 1566 Value *Mask, Instruction *I, 1567 Value *Addr, MaybeAlign Alignment, 1568 unsigned Granularity, uint32_t TypeSize, 1569 bool IsWrite, Value *SizeArgument, 1570 bool UseCalls, uint32_t Exp) { 1571 auto *VTy = cast<FixedVectorType>( 1572 cast<PointerType>(Addr->getType())->getElementType()); 1573 uint64_t ElemTypeSize = DL.getTypeStoreSizeInBits(VTy->getScalarType()); 1574 unsigned Num = VTy->getNumElements(); 1575 auto Zero = ConstantInt::get(IntptrTy, 0); 1576 for (unsigned Idx = 0; Idx < Num; ++Idx) { 1577 Value *InstrumentedAddress = nullptr; 1578 Instruction *InsertBefore = I; 1579 if (auto *Vector = dyn_cast<ConstantVector>(Mask)) { 1580 // dyn_cast as we might get UndefValue 1581 if (auto *Masked = dyn_cast<ConstantInt>(Vector->getOperand(Idx))) { 1582 if (Masked->isZero()) 1583 // Mask is constant false, so no instrumentation needed. 1584 continue; 1585 // If we have a true or undef value, fall through to doInstrumentAddress 1586 // with InsertBefore == I 1587 } 1588 } else { 1589 IRBuilder<> IRB(I); 1590 Value *MaskElem = IRB.CreateExtractElement(Mask, Idx); 1591 Instruction *ThenTerm = SplitBlockAndInsertIfThen(MaskElem, I, false); 1592 InsertBefore = ThenTerm; 1593 } 1594 1595 IRBuilder<> IRB(InsertBefore); 1596 InstrumentedAddress = 1597 IRB.CreateGEP(VTy, Addr, {Zero, ConstantInt::get(IntptrTy, Idx)}); 1598 doInstrumentAddress(Pass, I, InsertBefore, InstrumentedAddress, Alignment, 1599 Granularity, ElemTypeSize, IsWrite, SizeArgument, 1600 UseCalls, Exp); 1601 } 1602 } 1603 1604 void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, 1605 InterestingMemoryOperand &O, bool UseCalls, 1606 const DataLayout &DL) { 1607 Value *Addr = O.getPtr(); 1608 1609 // Optimization experiments. 1610 // The experiments can be used to evaluate potential optimizations that remove 1611 // instrumentation (assess false negatives). Instead of completely removing 1612 // some instrumentation, you set Exp to a non-zero value (mask of optimization 1613 // experiments that want to remove instrumentation of this instruction). 1614 // If Exp is non-zero, this pass will emit special calls into runtime 1615 // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls 1616 // make runtime terminate the program in a special way (with a different 1617 // exit status). Then you run the new compiler on a buggy corpus, collect 1618 // the special terminations (ideally, you don't see them at all -- no false 1619 // negatives) and make the decision on the optimization. 1620 uint32_t Exp = ClForceExperiment; 1621 1622 if (ClOpt && ClOptGlobals) { 1623 // If initialization order checking is disabled, a simple access to a 1624 // dynamically initialized global is always valid. 1625 GlobalVariable *G = dyn_cast<GlobalVariable>(getUnderlyingObject(Addr)); 1626 if (G && (!ClInitializers || GlobalIsLinkerInitialized(G)) && 1627 isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) { 1628 NumOptimizedAccessesToGlobalVar++; 1629 return; 1630 } 1631 } 1632 1633 if (ClOpt && ClOptStack) { 1634 // A direct inbounds access to a stack variable is always valid. 1635 if (isa<AllocaInst>(getUnderlyingObject(Addr)) && 1636 isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) { 1637 NumOptimizedAccessesToStackVar++; 1638 return; 1639 } 1640 } 1641 1642 if (O.IsWrite) 1643 NumInstrumentedWrites++; 1644 else 1645 NumInstrumentedReads++; 1646 1647 unsigned Granularity = 1 << Mapping.Scale; 1648 if (O.MaybeMask) { 1649 instrumentMaskedLoadOrStore(this, DL, IntptrTy, O.MaybeMask, O.getInsn(), 1650 Addr, O.Alignment, Granularity, O.TypeSize, 1651 O.IsWrite, nullptr, UseCalls, Exp); 1652 } else { 1653 doInstrumentAddress(this, O.getInsn(), O.getInsn(), Addr, O.Alignment, 1654 Granularity, O.TypeSize, O.IsWrite, nullptr, UseCalls, 1655 Exp); 1656 } 1657 } 1658 1659 Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore, 1660 Value *Addr, bool IsWrite, 1661 size_t AccessSizeIndex, 1662 Value *SizeArgument, 1663 uint32_t Exp) { 1664 IRBuilder<> IRB(InsertBefore); 1665 Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp); 1666 CallInst *Call = nullptr; 1667 if (SizeArgument) { 1668 if (Exp == 0) 1669 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0], 1670 {Addr, SizeArgument}); 1671 else 1672 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1], 1673 {Addr, SizeArgument, ExpVal}); 1674 } else { 1675 if (Exp == 0) 1676 Call = 1677 IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr); 1678 else 1679 Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex], 1680 {Addr, ExpVal}); 1681 } 1682 1683 Call->setCannotMerge(); 1684 return Call; 1685 } 1686 1687 Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 1688 Value *ShadowValue, 1689 uint32_t TypeSize) { 1690 size_t Granularity = static_cast<size_t>(1) << Mapping.Scale; 1691 // Addr & (Granularity - 1) 1692 Value *LastAccessedByte = 1693 IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); 1694 // (Addr & (Granularity - 1)) + size - 1 1695 if (TypeSize / 8 > 1) 1696 LastAccessedByte = IRB.CreateAdd( 1697 LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); 1698 // (uint8_t) ((Addr & (Granularity-1)) + size - 1) 1699 LastAccessedByte = 1700 IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false); 1701 // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue 1702 return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); 1703 } 1704 1705 Instruction *AddressSanitizer::instrumentAMDGPUAddress( 1706 Instruction *OrigIns, Instruction *InsertBefore, Value *Addr, 1707 uint32_t TypeSize, bool IsWrite, Value *SizeArgument) { 1708 // Do not instrument unsupported addrspaces. 1709 if (isUnsupportedAMDGPUAddrspace(Addr)) 1710 return nullptr; 1711 Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType()); 1712 // Follow host instrumentation for global and constant addresses. 1713 if (PtrTy->getPointerAddressSpace() != 0) 1714 return InsertBefore; 1715 // Instrument generic addresses in supported addressspaces. 1716 IRBuilder<> IRB(InsertBefore); 1717 Value *AddrLong = IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy()); 1718 Value *IsShared = IRB.CreateCall(AMDGPUAddressShared, {AddrLong}); 1719 Value *IsPrivate = IRB.CreateCall(AMDGPUAddressPrivate, {AddrLong}); 1720 Value *IsSharedOrPrivate = IRB.CreateOr(IsShared, IsPrivate); 1721 Value *Cmp = IRB.CreateICmpNE(IRB.getTrue(), IsSharedOrPrivate); 1722 Value *AddrSpaceZeroLanding = 1723 SplitBlockAndInsertIfThen(Cmp, InsertBefore, false); 1724 InsertBefore = cast<Instruction>(AddrSpaceZeroLanding); 1725 return InsertBefore; 1726 } 1727 1728 void AddressSanitizer::instrumentAddress(Instruction *OrigIns, 1729 Instruction *InsertBefore, Value *Addr, 1730 uint32_t TypeSize, bool IsWrite, 1731 Value *SizeArgument, bool UseCalls, 1732 uint32_t Exp) { 1733 if (TargetTriple.isAMDGPU()) { 1734 InsertBefore = instrumentAMDGPUAddress(OrigIns, InsertBefore, Addr, 1735 TypeSize, IsWrite, SizeArgument); 1736 if (!InsertBefore) 1737 return; 1738 } 1739 1740 IRBuilder<> IRB(InsertBefore); 1741 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 1742 size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); 1743 1744 if (UseCalls) { 1745 if (Exp == 0) 1746 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex], 1747 AddrLong); 1748 else 1749 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex], 1750 {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)}); 1751 return; 1752 } 1753 1754 Type *ShadowTy = 1755 IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale)); 1756 Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); 1757 Value *ShadowPtr = memToShadow(AddrLong, IRB); 1758 Value *CmpVal = Constant::getNullValue(ShadowTy); 1759 Value *ShadowValue = 1760 IRB.CreateLoad(ShadowTy, IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); 1761 1762 Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); 1763 size_t Granularity = 1ULL << Mapping.Scale; 1764 Instruction *CrashTerm = nullptr; 1765 1766 if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) { 1767 // We use branch weights for the slow path check, to indicate that the slow 1768 // path is rarely taken. This seems to be the case for SPEC benchmarks. 1769 Instruction *CheckTerm = SplitBlockAndInsertIfThen( 1770 Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000)); 1771 assert(cast<BranchInst>(CheckTerm)->isUnconditional()); 1772 BasicBlock *NextBB = CheckTerm->getSuccessor(0); 1773 IRB.SetInsertPoint(CheckTerm); 1774 Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); 1775 if (Recover) { 1776 CrashTerm = SplitBlockAndInsertIfThen(Cmp2, CheckTerm, false); 1777 } else { 1778 BasicBlock *CrashBlock = 1779 BasicBlock::Create(*C, "", NextBB->getParent(), NextBB); 1780 CrashTerm = new UnreachableInst(*C, CrashBlock); 1781 BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); 1782 ReplaceInstWithInst(CheckTerm, NewTerm); 1783 } 1784 } else { 1785 CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover); 1786 } 1787 1788 Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite, 1789 AccessSizeIndex, SizeArgument, Exp); 1790 Crash->setDebugLoc(OrigIns->getDebugLoc()); 1791 } 1792 1793 // Instrument unusual size or unusual alignment. 1794 // We can not do it with a single check, so we do 1-byte check for the first 1795 // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able 1796 // to report the actual access size. 1797 void AddressSanitizer::instrumentUnusualSizeOrAlignment( 1798 Instruction *I, Instruction *InsertBefore, Value *Addr, uint32_t TypeSize, 1799 bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp) { 1800 IRBuilder<> IRB(InsertBefore); 1801 Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8); 1802 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 1803 if (UseCalls) { 1804 if (Exp == 0) 1805 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0], 1806 {AddrLong, Size}); 1807 else 1808 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1], 1809 {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)}); 1810 } else { 1811 Value *LastByte = IRB.CreateIntToPtr( 1812 IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)), 1813 Addr->getType()); 1814 instrumentAddress(I, InsertBefore, Addr, 8, IsWrite, Size, false, Exp); 1815 instrumentAddress(I, InsertBefore, LastByte, 8, IsWrite, Size, false, Exp); 1816 } 1817 } 1818 1819 void ModuleAddressSanitizer::poisonOneInitializer(Function &GlobalInit, 1820 GlobalValue *ModuleName) { 1821 // Set up the arguments to our poison/unpoison functions. 1822 IRBuilder<> IRB(&GlobalInit.front(), 1823 GlobalInit.front().getFirstInsertionPt()); 1824 1825 // Add a call to poison all external globals before the given function starts. 1826 Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy); 1827 IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr); 1828 1829 // Add calls to unpoison all globals before each return instruction. 1830 for (auto &BB : GlobalInit.getBasicBlockList()) 1831 if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator())) 1832 CallInst::Create(AsanUnpoisonGlobals, "", RI); 1833 } 1834 1835 void ModuleAddressSanitizer::createInitializerPoisonCalls( 1836 Module &M, GlobalValue *ModuleName) { 1837 GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors"); 1838 if (!GV) 1839 return; 1840 1841 ConstantArray *CA = dyn_cast<ConstantArray>(GV->getInitializer()); 1842 if (!CA) 1843 return; 1844 1845 for (Use &OP : CA->operands()) { 1846 if (isa<ConstantAggregateZero>(OP)) continue; 1847 ConstantStruct *CS = cast<ConstantStruct>(OP); 1848 1849 // Must have a function or null ptr. 1850 if (Function *F = dyn_cast<Function>(CS->getOperand(1))) { 1851 if (F->getName() == kAsanModuleCtorName) continue; 1852 auto *Priority = cast<ConstantInt>(CS->getOperand(0)); 1853 // Don't instrument CTORs that will run before asan.module_ctor. 1854 if (Priority->getLimitedValue() <= GetCtorAndDtorPriority(TargetTriple)) 1855 continue; 1856 poisonOneInitializer(*F, ModuleName); 1857 } 1858 } 1859 } 1860 1861 const GlobalVariable * 1862 ModuleAddressSanitizer::getExcludedAliasedGlobal(const GlobalAlias &GA) const { 1863 // In case this function should be expanded to include rules that do not just 1864 // apply when CompileKernel is true, either guard all existing rules with an 1865 // 'if (CompileKernel) { ... }' or be absolutely sure that all these rules 1866 // should also apply to user space. 1867 assert(CompileKernel && "Only expecting to be called when compiling kernel"); 1868 1869 const Constant *C = GA.getAliasee(); 1870 1871 // When compiling the kernel, globals that are aliased by symbols prefixed 1872 // by "__" are special and cannot be padded with a redzone. 1873 if (GA.getName().startswith("__")) 1874 return dyn_cast<GlobalVariable>(C->stripPointerCastsAndAliases()); 1875 1876 return nullptr; 1877 } 1878 1879 bool ModuleAddressSanitizer::shouldInstrumentGlobal(GlobalVariable *G) const { 1880 Type *Ty = G->getValueType(); 1881 LLVM_DEBUG(dbgs() << "GLOBAL: " << *G << "\n"); 1882 1883 // FIXME: Metadata should be attched directly to the global directly instead 1884 // of being added to llvm.asan.globals. 1885 if (GlobalsMD.get(G).IsExcluded) return false; 1886 if (!Ty->isSized()) return false; 1887 if (!G->hasInitializer()) return false; 1888 // Globals in address space 1 and 4 are supported for AMDGPU. 1889 if (G->getAddressSpace() && 1890 !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(G))) 1891 return false; 1892 if (GlobalWasGeneratedByCompiler(G)) return false; // Our own globals. 1893 // Two problems with thread-locals: 1894 // - The address of the main thread's copy can't be computed at link-time. 1895 // - Need to poison all copies, not just the main thread's one. 1896 if (G->isThreadLocal()) return false; 1897 // For now, just ignore this Global if the alignment is large. 1898 if (G->getAlignment() > getMinRedzoneSizeForGlobal()) return false; 1899 1900 // For non-COFF targets, only instrument globals known to be defined by this 1901 // TU. 1902 // FIXME: We can instrument comdat globals on ELF if we are using the 1903 // GC-friendly metadata scheme. 1904 if (!TargetTriple.isOSBinFormatCOFF()) { 1905 if (!G->hasExactDefinition() || G->hasComdat()) 1906 return false; 1907 } else { 1908 // On COFF, don't instrument non-ODR linkages. 1909 if (G->isInterposable()) 1910 return false; 1911 } 1912 1913 // If a comdat is present, it must have a selection kind that implies ODR 1914 // semantics: no duplicates, any, or exact match. 1915 if (Comdat *C = G->getComdat()) { 1916 switch (C->getSelectionKind()) { 1917 case Comdat::Any: 1918 case Comdat::ExactMatch: 1919 case Comdat::NoDeduplicate: 1920 break; 1921 case Comdat::Largest: 1922 case Comdat::SameSize: 1923 return false; 1924 } 1925 } 1926 1927 if (G->hasSection()) { 1928 // The kernel uses explicit sections for mostly special global variables 1929 // that we should not instrument. E.g. the kernel may rely on their layout 1930 // without redzones, or remove them at link time ("discard.*"), etc. 1931 if (CompileKernel) 1932 return false; 1933 1934 StringRef Section = G->getSection(); 1935 1936 // Globals from llvm.metadata aren't emitted, do not instrument them. 1937 if (Section == "llvm.metadata") return false; 1938 // Do not instrument globals from special LLVM sections. 1939 if (Section.find("__llvm") != StringRef::npos || Section.find("__LLVM") != StringRef::npos) return false; 1940 1941 // Do not instrument function pointers to initialization and termination 1942 // routines: dynamic linker will not properly handle redzones. 1943 if (Section.startswith(".preinit_array") || 1944 Section.startswith(".init_array") || 1945 Section.startswith(".fini_array")) { 1946 return false; 1947 } 1948 1949 // Do not instrument user-defined sections (with names resembling 1950 // valid C identifiers) 1951 if (TargetTriple.isOSBinFormatELF()) { 1952 if (llvm::all_of(Section, 1953 [](char c) { return llvm::isAlnum(c) || c == '_'; })) 1954 return false; 1955 } 1956 1957 // On COFF, if the section name contains '$', it is highly likely that the 1958 // user is using section sorting to create an array of globals similar to 1959 // the way initialization callbacks are registered in .init_array and 1960 // .CRT$XCU. The ATL also registers things in .ATL$__[azm]. Adding redzones 1961 // to such globals is counterproductive, because the intent is that they 1962 // will form an array, and out-of-bounds accesses are expected. 1963 // See https://github.com/google/sanitizers/issues/305 1964 // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx 1965 if (TargetTriple.isOSBinFormatCOFF() && Section.contains('$')) { 1966 LLVM_DEBUG(dbgs() << "Ignoring global in sorted section (contains '$'): " 1967 << *G << "\n"); 1968 return false; 1969 } 1970 1971 if (TargetTriple.isOSBinFormatMachO()) { 1972 StringRef ParsedSegment, ParsedSection; 1973 unsigned TAA = 0, StubSize = 0; 1974 bool TAAParsed; 1975 cantFail(MCSectionMachO::ParseSectionSpecifier( 1976 Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize)); 1977 1978 // Ignore the globals from the __OBJC section. The ObjC runtime assumes 1979 // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to 1980 // them. 1981 if (ParsedSegment == "__OBJC" || 1982 (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) { 1983 LLVM_DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n"); 1984 return false; 1985 } 1986 // See https://github.com/google/sanitizers/issues/32 1987 // Constant CFString instances are compiled in the following way: 1988 // -- the string buffer is emitted into 1989 // __TEXT,__cstring,cstring_literals 1990 // -- the constant NSConstantString structure referencing that buffer 1991 // is placed into __DATA,__cfstring 1992 // Therefore there's no point in placing redzones into __DATA,__cfstring. 1993 // Moreover, it causes the linker to crash on OS X 10.7 1994 if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") { 1995 LLVM_DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n"); 1996 return false; 1997 } 1998 // The linker merges the contents of cstring_literals and removes the 1999 // trailing zeroes. 2000 if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) { 2001 LLVM_DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n"); 2002 return false; 2003 } 2004 } 2005 } 2006 2007 if (CompileKernel) { 2008 // Globals that prefixed by "__" are special and cannot be padded with a 2009 // redzone. 2010 if (G->getName().startswith("__")) 2011 return false; 2012 } 2013 2014 return true; 2015 } 2016 2017 // On Mach-O platforms, we emit global metadata in a separate section of the 2018 // binary in order to allow the linker to properly dead strip. This is only 2019 // supported on recent versions of ld64. 2020 bool ModuleAddressSanitizer::ShouldUseMachOGlobalsSection() const { 2021 if (!TargetTriple.isOSBinFormatMachO()) 2022 return false; 2023 2024 if (TargetTriple.isMacOSX() && !TargetTriple.isMacOSXVersionLT(10, 11)) 2025 return true; 2026 if (TargetTriple.isiOS() /* or tvOS */ && !TargetTriple.isOSVersionLT(9)) 2027 return true; 2028 if (TargetTriple.isWatchOS() && !TargetTriple.isOSVersionLT(2)) 2029 return true; 2030 2031 return false; 2032 } 2033 2034 StringRef ModuleAddressSanitizer::getGlobalMetadataSection() const { 2035 switch (TargetTriple.getObjectFormat()) { 2036 case Triple::COFF: return ".ASAN$GL"; 2037 case Triple::ELF: return "asan_globals"; 2038 case Triple::MachO: return "__DATA,__asan_globals,regular"; 2039 case Triple::Wasm: 2040 case Triple::GOFF: 2041 case Triple::XCOFF: 2042 report_fatal_error( 2043 "ModuleAddressSanitizer not implemented for object file format"); 2044 case Triple::UnknownObjectFormat: 2045 break; 2046 } 2047 llvm_unreachable("unsupported object format"); 2048 } 2049 2050 void ModuleAddressSanitizer::initializeCallbacks(Module &M) { 2051 IRBuilder<> IRB(*C); 2052 2053 // Declare our poisoning and unpoisoning functions. 2054 AsanPoisonGlobals = 2055 M.getOrInsertFunction(kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy); 2056 AsanUnpoisonGlobals = 2057 M.getOrInsertFunction(kAsanUnpoisonGlobalsName, IRB.getVoidTy()); 2058 2059 // Declare functions that register/unregister globals. 2060 AsanRegisterGlobals = M.getOrInsertFunction( 2061 kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy); 2062 AsanUnregisterGlobals = M.getOrInsertFunction( 2063 kAsanUnregisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy); 2064 2065 // Declare the functions that find globals in a shared object and then invoke 2066 // the (un)register function on them. 2067 AsanRegisterImageGlobals = M.getOrInsertFunction( 2068 kAsanRegisterImageGlobalsName, IRB.getVoidTy(), IntptrTy); 2069 AsanUnregisterImageGlobals = M.getOrInsertFunction( 2070 kAsanUnregisterImageGlobalsName, IRB.getVoidTy(), IntptrTy); 2071 2072 AsanRegisterElfGlobals = 2073 M.getOrInsertFunction(kAsanRegisterElfGlobalsName, IRB.getVoidTy(), 2074 IntptrTy, IntptrTy, IntptrTy); 2075 AsanUnregisterElfGlobals = 2076 M.getOrInsertFunction(kAsanUnregisterElfGlobalsName, IRB.getVoidTy(), 2077 IntptrTy, IntptrTy, IntptrTy); 2078 } 2079 2080 // Put the metadata and the instrumented global in the same group. This ensures 2081 // that the metadata is discarded if the instrumented global is discarded. 2082 void ModuleAddressSanitizer::SetComdatForGlobalMetadata( 2083 GlobalVariable *G, GlobalVariable *Metadata, StringRef InternalSuffix) { 2084 Module &M = *G->getParent(); 2085 Comdat *C = G->getComdat(); 2086 if (!C) { 2087 if (!G->hasName()) { 2088 // If G is unnamed, it must be internal. Give it an artificial name 2089 // so we can put it in a comdat. 2090 assert(G->hasLocalLinkage()); 2091 G->setName(Twine(kAsanGenPrefix) + "_anon_global"); 2092 } 2093 2094 if (!InternalSuffix.empty() && G->hasLocalLinkage()) { 2095 std::string Name = std::string(G->getName()); 2096 Name += InternalSuffix; 2097 C = M.getOrInsertComdat(Name); 2098 } else { 2099 C = M.getOrInsertComdat(G->getName()); 2100 } 2101 2102 // Make this IMAGE_COMDAT_SELECT_NODUPLICATES on COFF. Also upgrade private 2103 // linkage to internal linkage so that a symbol table entry is emitted. This 2104 // is necessary in order to create the comdat group. 2105 if (TargetTriple.isOSBinFormatCOFF()) { 2106 C->setSelectionKind(Comdat::NoDeduplicate); 2107 if (G->hasPrivateLinkage()) 2108 G->setLinkage(GlobalValue::InternalLinkage); 2109 } 2110 G->setComdat(C); 2111 } 2112 2113 assert(G->hasComdat()); 2114 Metadata->setComdat(G->getComdat()); 2115 } 2116 2117 // Create a separate metadata global and put it in the appropriate ASan 2118 // global registration section. 2119 GlobalVariable * 2120 ModuleAddressSanitizer::CreateMetadataGlobal(Module &M, Constant *Initializer, 2121 StringRef OriginalName) { 2122 auto Linkage = TargetTriple.isOSBinFormatMachO() 2123 ? GlobalVariable::InternalLinkage 2124 : GlobalVariable::PrivateLinkage; 2125 GlobalVariable *Metadata = new GlobalVariable( 2126 M, Initializer->getType(), false, Linkage, Initializer, 2127 Twine("__asan_global_") + GlobalValue::dropLLVMManglingEscape(OriginalName)); 2128 Metadata->setSection(getGlobalMetadataSection()); 2129 return Metadata; 2130 } 2131 2132 Instruction *ModuleAddressSanitizer::CreateAsanModuleDtor(Module &M) { 2133 AsanDtorFunction = Function::createWithDefaultAttr( 2134 FunctionType::get(Type::getVoidTy(*C), false), 2135 GlobalValue::InternalLinkage, 0, kAsanModuleDtorName, &M); 2136 AsanDtorFunction->addAttribute(AttributeList::FunctionIndex, 2137 Attribute::NoUnwind); 2138 // Ensure Dtor cannot be discarded, even if in a comdat. 2139 appendToUsed(M, {AsanDtorFunction}); 2140 BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); 2141 2142 return ReturnInst::Create(*C, AsanDtorBB); 2143 } 2144 2145 void ModuleAddressSanitizer::InstrumentGlobalsCOFF( 2146 IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, 2147 ArrayRef<Constant *> MetadataInitializers) { 2148 assert(ExtendedGlobals.size() == MetadataInitializers.size()); 2149 auto &DL = M.getDataLayout(); 2150 2151 SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size()); 2152 for (size_t i = 0; i < ExtendedGlobals.size(); i++) { 2153 Constant *Initializer = MetadataInitializers[i]; 2154 GlobalVariable *G = ExtendedGlobals[i]; 2155 GlobalVariable *Metadata = 2156 CreateMetadataGlobal(M, Initializer, G->getName()); 2157 MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G)); 2158 Metadata->setMetadata(LLVMContext::MD_associated, MD); 2159 MetadataGlobals[i] = Metadata; 2160 2161 // The MSVC linker always inserts padding when linking incrementally. We 2162 // cope with that by aligning each struct to its size, which must be a power 2163 // of two. 2164 unsigned SizeOfGlobalStruct = DL.getTypeAllocSize(Initializer->getType()); 2165 assert(isPowerOf2_32(SizeOfGlobalStruct) && 2166 "global metadata will not be padded appropriately"); 2167 Metadata->setAlignment(assumeAligned(SizeOfGlobalStruct)); 2168 2169 SetComdatForGlobalMetadata(G, Metadata, ""); 2170 } 2171 2172 // Update llvm.compiler.used, adding the new metadata globals. This is 2173 // needed so that during LTO these variables stay alive. 2174 if (!MetadataGlobals.empty()) 2175 appendToCompilerUsed(M, MetadataGlobals); 2176 } 2177 2178 void ModuleAddressSanitizer::InstrumentGlobalsELF( 2179 IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, 2180 ArrayRef<Constant *> MetadataInitializers, 2181 const std::string &UniqueModuleId) { 2182 assert(ExtendedGlobals.size() == MetadataInitializers.size()); 2183 2184 // Putting globals in a comdat changes the semantic and potentially cause 2185 // false negative odr violations at link time. If odr indicators are used, we 2186 // keep the comdat sections, as link time odr violations will be dectected on 2187 // the odr indicator symbols. 2188 bool UseComdatForGlobalsGC = UseOdrIndicator; 2189 2190 SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size()); 2191 for (size_t i = 0; i < ExtendedGlobals.size(); i++) { 2192 GlobalVariable *G = ExtendedGlobals[i]; 2193 GlobalVariable *Metadata = 2194 CreateMetadataGlobal(M, MetadataInitializers[i], G->getName()); 2195 MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G)); 2196 Metadata->setMetadata(LLVMContext::MD_associated, MD); 2197 MetadataGlobals[i] = Metadata; 2198 2199 if (UseComdatForGlobalsGC) 2200 SetComdatForGlobalMetadata(G, Metadata, UniqueModuleId); 2201 } 2202 2203 // Update llvm.compiler.used, adding the new metadata globals. This is 2204 // needed so that during LTO these variables stay alive. 2205 if (!MetadataGlobals.empty()) 2206 appendToCompilerUsed(M, MetadataGlobals); 2207 2208 // RegisteredFlag serves two purposes. First, we can pass it to dladdr() 2209 // to look up the loaded image that contains it. Second, we can store in it 2210 // whether registration has already occurred, to prevent duplicate 2211 // registration. 2212 // 2213 // Common linkage ensures that there is only one global per shared library. 2214 GlobalVariable *RegisteredFlag = new GlobalVariable( 2215 M, IntptrTy, false, GlobalVariable::CommonLinkage, 2216 ConstantInt::get(IntptrTy, 0), kAsanGlobalsRegisteredFlagName); 2217 RegisteredFlag->setVisibility(GlobalVariable::HiddenVisibility); 2218 2219 // Create start and stop symbols. 2220 GlobalVariable *StartELFMetadata = new GlobalVariable( 2221 M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr, 2222 "__start_" + getGlobalMetadataSection()); 2223 StartELFMetadata->setVisibility(GlobalVariable::HiddenVisibility); 2224 GlobalVariable *StopELFMetadata = new GlobalVariable( 2225 M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr, 2226 "__stop_" + getGlobalMetadataSection()); 2227 StopELFMetadata->setVisibility(GlobalVariable::HiddenVisibility); 2228 2229 // Create a call to register the globals with the runtime. 2230 IRB.CreateCall(AsanRegisterElfGlobals, 2231 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy), 2232 IRB.CreatePointerCast(StartELFMetadata, IntptrTy), 2233 IRB.CreatePointerCast(StopELFMetadata, IntptrTy)}); 2234 2235 // We also need to unregister globals at the end, e.g., when a shared library 2236 // gets closed. 2237 if (DestructorKind != AsanDtorKind::None) { 2238 IRBuilder<> IrbDtor(CreateAsanModuleDtor(M)); 2239 IrbDtor.CreateCall(AsanUnregisterElfGlobals, 2240 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy), 2241 IRB.CreatePointerCast(StartELFMetadata, IntptrTy), 2242 IRB.CreatePointerCast(StopELFMetadata, IntptrTy)}); 2243 } 2244 } 2245 2246 void ModuleAddressSanitizer::InstrumentGlobalsMachO( 2247 IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, 2248 ArrayRef<Constant *> MetadataInitializers) { 2249 assert(ExtendedGlobals.size() == MetadataInitializers.size()); 2250 2251 // On recent Mach-O platforms, use a structure which binds the liveness of 2252 // the global variable to the metadata struct. Keep the list of "Liveness" GV 2253 // created to be added to llvm.compiler.used 2254 StructType *LivenessTy = StructType::get(IntptrTy, IntptrTy); 2255 SmallVector<GlobalValue *, 16> LivenessGlobals(ExtendedGlobals.size()); 2256 2257 for (size_t i = 0; i < ExtendedGlobals.size(); i++) { 2258 Constant *Initializer = MetadataInitializers[i]; 2259 GlobalVariable *G = ExtendedGlobals[i]; 2260 GlobalVariable *Metadata = 2261 CreateMetadataGlobal(M, Initializer, G->getName()); 2262 2263 // On recent Mach-O platforms, we emit the global metadata in a way that 2264 // allows the linker to properly strip dead globals. 2265 auto LivenessBinder = 2266 ConstantStruct::get(LivenessTy, Initializer->getAggregateElement(0u), 2267 ConstantExpr::getPointerCast(Metadata, IntptrTy)); 2268 GlobalVariable *Liveness = new GlobalVariable( 2269 M, LivenessTy, false, GlobalVariable::InternalLinkage, LivenessBinder, 2270 Twine("__asan_binder_") + G->getName()); 2271 Liveness->setSection("__DATA,__asan_liveness,regular,live_support"); 2272 LivenessGlobals[i] = Liveness; 2273 } 2274 2275 // Update llvm.compiler.used, adding the new liveness globals. This is 2276 // needed so that during LTO these variables stay alive. The alternative 2277 // would be to have the linker handling the LTO symbols, but libLTO 2278 // current API does not expose access to the section for each symbol. 2279 if (!LivenessGlobals.empty()) 2280 appendToCompilerUsed(M, LivenessGlobals); 2281 2282 // RegisteredFlag serves two purposes. First, we can pass it to dladdr() 2283 // to look up the loaded image that contains it. Second, we can store in it 2284 // whether registration has already occurred, to prevent duplicate 2285 // registration. 2286 // 2287 // common linkage ensures that there is only one global per shared library. 2288 GlobalVariable *RegisteredFlag = new GlobalVariable( 2289 M, IntptrTy, false, GlobalVariable::CommonLinkage, 2290 ConstantInt::get(IntptrTy, 0), kAsanGlobalsRegisteredFlagName); 2291 RegisteredFlag->setVisibility(GlobalVariable::HiddenVisibility); 2292 2293 IRB.CreateCall(AsanRegisterImageGlobals, 2294 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)}); 2295 2296 // We also need to unregister globals at the end, e.g., when a shared library 2297 // gets closed. 2298 if (DestructorKind != AsanDtorKind::None) { 2299 IRBuilder<> IrbDtor(CreateAsanModuleDtor(M)); 2300 IrbDtor.CreateCall(AsanUnregisterImageGlobals, 2301 {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)}); 2302 } 2303 } 2304 2305 void ModuleAddressSanitizer::InstrumentGlobalsWithMetadataArray( 2306 IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals, 2307 ArrayRef<Constant *> MetadataInitializers) { 2308 assert(ExtendedGlobals.size() == MetadataInitializers.size()); 2309 unsigned N = ExtendedGlobals.size(); 2310 assert(N > 0); 2311 2312 // On platforms that don't have a custom metadata section, we emit an array 2313 // of global metadata structures. 2314 ArrayType *ArrayOfGlobalStructTy = 2315 ArrayType::get(MetadataInitializers[0]->getType(), N); 2316 auto AllGlobals = new GlobalVariable( 2317 M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage, 2318 ConstantArray::get(ArrayOfGlobalStructTy, MetadataInitializers), ""); 2319 if (Mapping.Scale > 3) 2320 AllGlobals->setAlignment(Align(1ULL << Mapping.Scale)); 2321 2322 IRB.CreateCall(AsanRegisterGlobals, 2323 {IRB.CreatePointerCast(AllGlobals, IntptrTy), 2324 ConstantInt::get(IntptrTy, N)}); 2325 2326 // We also need to unregister globals at the end, e.g., when a shared library 2327 // gets closed. 2328 if (DestructorKind != AsanDtorKind::None) { 2329 IRBuilder<> IrbDtor(CreateAsanModuleDtor(M)); 2330 IrbDtor.CreateCall(AsanUnregisterGlobals, 2331 {IRB.CreatePointerCast(AllGlobals, IntptrTy), 2332 ConstantInt::get(IntptrTy, N)}); 2333 } 2334 } 2335 2336 // This function replaces all global variables with new variables that have 2337 // trailing redzones. It also creates a function that poisons 2338 // redzones and inserts this function into llvm.global_ctors. 2339 // Sets *CtorComdat to true if the global registration code emitted into the 2340 // asan constructor is comdat-compatible. 2341 bool ModuleAddressSanitizer::InstrumentGlobals(IRBuilder<> &IRB, Module &M, 2342 bool *CtorComdat) { 2343 *CtorComdat = false; 2344 2345 // Build set of globals that are aliased by some GA, where 2346 // getExcludedAliasedGlobal(GA) returns the relevant GlobalVariable. 2347 SmallPtrSet<const GlobalVariable *, 16> AliasedGlobalExclusions; 2348 if (CompileKernel) { 2349 for (auto &GA : M.aliases()) { 2350 if (const GlobalVariable *GV = getExcludedAliasedGlobal(GA)) 2351 AliasedGlobalExclusions.insert(GV); 2352 } 2353 } 2354 2355 SmallVector<GlobalVariable *, 16> GlobalsToChange; 2356 for (auto &G : M.globals()) { 2357 if (!AliasedGlobalExclusions.count(&G) && shouldInstrumentGlobal(&G)) 2358 GlobalsToChange.push_back(&G); 2359 } 2360 2361 size_t n = GlobalsToChange.size(); 2362 if (n == 0) { 2363 *CtorComdat = true; 2364 return false; 2365 } 2366 2367 auto &DL = M.getDataLayout(); 2368 2369 // A global is described by a structure 2370 // size_t beg; 2371 // size_t size; 2372 // size_t size_with_redzone; 2373 // const char *name; 2374 // const char *module_name; 2375 // size_t has_dynamic_init; 2376 // void *source_location; 2377 // size_t odr_indicator; 2378 // We initialize an array of such structures and pass it to a run-time call. 2379 StructType *GlobalStructTy = 2380 StructType::get(IntptrTy, IntptrTy, IntptrTy, IntptrTy, IntptrTy, 2381 IntptrTy, IntptrTy, IntptrTy); 2382 SmallVector<GlobalVariable *, 16> NewGlobals(n); 2383 SmallVector<Constant *, 16> Initializers(n); 2384 2385 bool HasDynamicallyInitializedGlobals = false; 2386 2387 // We shouldn't merge same module names, as this string serves as unique 2388 // module ID in runtime. 2389 GlobalVariable *ModuleName = createPrivateGlobalForString( 2390 M, M.getModuleIdentifier(), /*AllowMerging*/ false, kAsanGenPrefix); 2391 2392 for (size_t i = 0; i < n; i++) { 2393 GlobalVariable *G = GlobalsToChange[i]; 2394 2395 // FIXME: Metadata should be attched directly to the global directly instead 2396 // of being added to llvm.asan.globals. 2397 auto MD = GlobalsMD.get(G); 2398 StringRef NameForGlobal = G->getName(); 2399 // Create string holding the global name (use global name from metadata 2400 // if it's available, otherwise just write the name of global variable). 2401 GlobalVariable *Name = createPrivateGlobalForString( 2402 M, MD.Name.empty() ? NameForGlobal : MD.Name, 2403 /*AllowMerging*/ true, kAsanGenPrefix); 2404 2405 Type *Ty = G->getValueType(); 2406 const uint64_t SizeInBytes = DL.getTypeAllocSize(Ty); 2407 const uint64_t RightRedzoneSize = getRedzoneSizeForGlobal(SizeInBytes); 2408 Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); 2409 2410 StructType *NewTy = StructType::get(Ty, RightRedZoneTy); 2411 Constant *NewInitializer = ConstantStruct::get( 2412 NewTy, G->getInitializer(), Constant::getNullValue(RightRedZoneTy)); 2413 2414 // Create a new global variable with enough space for a redzone. 2415 GlobalValue::LinkageTypes Linkage = G->getLinkage(); 2416 if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage) 2417 Linkage = GlobalValue::InternalLinkage; 2418 GlobalVariable *NewGlobal = new GlobalVariable( 2419 M, NewTy, G->isConstant(), Linkage, NewInitializer, "", G, 2420 G->getThreadLocalMode(), G->getAddressSpace()); 2421 NewGlobal->copyAttributesFrom(G); 2422 NewGlobal->setComdat(G->getComdat()); 2423 NewGlobal->setAlignment(MaybeAlign(getMinRedzoneSizeForGlobal())); 2424 // Don't fold globals with redzones. ODR violation detector and redzone 2425 // poisoning implicitly creates a dependence on the global's address, so it 2426 // is no longer valid for it to be marked unnamed_addr. 2427 NewGlobal->setUnnamedAddr(GlobalValue::UnnamedAddr::None); 2428 2429 // Move null-terminated C strings to "__asan_cstring" section on Darwin. 2430 if (TargetTriple.isOSBinFormatMachO() && !G->hasSection() && 2431 G->isConstant()) { 2432 auto Seq = dyn_cast<ConstantDataSequential>(G->getInitializer()); 2433 if (Seq && Seq->isCString()) 2434 NewGlobal->setSection("__TEXT,__asan_cstring,regular"); 2435 } 2436 2437 // Transfer the debug info and type metadata. The payload starts at offset 2438 // zero so we can copy the metadata over as is. 2439 NewGlobal->copyMetadata(G, 0); 2440 2441 Value *Indices2[2]; 2442 Indices2[0] = IRB.getInt32(0); 2443 Indices2[1] = IRB.getInt32(0); 2444 2445 G->replaceAllUsesWith( 2446 ConstantExpr::getGetElementPtr(NewTy, NewGlobal, Indices2, true)); 2447 NewGlobal->takeName(G); 2448 G->eraseFromParent(); 2449 NewGlobals[i] = NewGlobal; 2450 2451 Constant *SourceLoc; 2452 if (!MD.SourceLoc.empty()) { 2453 auto SourceLocGlobal = createPrivateGlobalForSourceLoc(M, MD.SourceLoc); 2454 SourceLoc = ConstantExpr::getPointerCast(SourceLocGlobal, IntptrTy); 2455 } else { 2456 SourceLoc = ConstantInt::get(IntptrTy, 0); 2457 } 2458 2459 Constant *ODRIndicator = ConstantExpr::getNullValue(IRB.getInt8PtrTy()); 2460 GlobalValue *InstrumentedGlobal = NewGlobal; 2461 2462 bool CanUsePrivateAliases = 2463 TargetTriple.isOSBinFormatELF() || TargetTriple.isOSBinFormatMachO() || 2464 TargetTriple.isOSBinFormatWasm(); 2465 if (CanUsePrivateAliases && UsePrivateAlias) { 2466 // Create local alias for NewGlobal to avoid crash on ODR between 2467 // instrumented and non-instrumented libraries. 2468 InstrumentedGlobal = 2469 GlobalAlias::create(GlobalValue::PrivateLinkage, "", NewGlobal); 2470 } 2471 2472 // ODR should not happen for local linkage. 2473 if (NewGlobal->hasLocalLinkage()) { 2474 ODRIndicator = ConstantExpr::getIntToPtr(ConstantInt::get(IntptrTy, -1), 2475 IRB.getInt8PtrTy()); 2476 } else if (UseOdrIndicator) { 2477 // With local aliases, we need to provide another externally visible 2478 // symbol __odr_asan_XXX to detect ODR violation. 2479 auto *ODRIndicatorSym = 2480 new GlobalVariable(M, IRB.getInt8Ty(), false, Linkage, 2481 Constant::getNullValue(IRB.getInt8Ty()), 2482 kODRGenPrefix + NameForGlobal, nullptr, 2483 NewGlobal->getThreadLocalMode()); 2484 2485 // Set meaningful attributes for indicator symbol. 2486 ODRIndicatorSym->setVisibility(NewGlobal->getVisibility()); 2487 ODRIndicatorSym->setDLLStorageClass(NewGlobal->getDLLStorageClass()); 2488 ODRIndicatorSym->setAlignment(Align(1)); 2489 ODRIndicator = ODRIndicatorSym; 2490 } 2491 2492 Constant *Initializer = ConstantStruct::get( 2493 GlobalStructTy, 2494 ConstantExpr::getPointerCast(InstrumentedGlobal, IntptrTy), 2495 ConstantInt::get(IntptrTy, SizeInBytes), 2496 ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), 2497 ConstantExpr::getPointerCast(Name, IntptrTy), 2498 ConstantExpr::getPointerCast(ModuleName, IntptrTy), 2499 ConstantInt::get(IntptrTy, MD.IsDynInit), SourceLoc, 2500 ConstantExpr::getPointerCast(ODRIndicator, IntptrTy)); 2501 2502 if (ClInitializers && MD.IsDynInit) HasDynamicallyInitializedGlobals = true; 2503 2504 LLVM_DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n"); 2505 2506 Initializers[i] = Initializer; 2507 } 2508 2509 // Add instrumented globals to llvm.compiler.used list to avoid LTO from 2510 // ConstantMerge'ing them. 2511 SmallVector<GlobalValue *, 16> GlobalsToAddToUsedList; 2512 for (size_t i = 0; i < n; i++) { 2513 GlobalVariable *G = NewGlobals[i]; 2514 if (G->getName().empty()) continue; 2515 GlobalsToAddToUsedList.push_back(G); 2516 } 2517 appendToCompilerUsed(M, ArrayRef<GlobalValue *>(GlobalsToAddToUsedList)); 2518 2519 std::string ELFUniqueModuleId = 2520 (UseGlobalsGC && TargetTriple.isOSBinFormatELF()) ? getUniqueModuleId(&M) 2521 : ""; 2522 2523 if (!ELFUniqueModuleId.empty()) { 2524 InstrumentGlobalsELF(IRB, M, NewGlobals, Initializers, ELFUniqueModuleId); 2525 *CtorComdat = true; 2526 } else if (UseGlobalsGC && TargetTriple.isOSBinFormatCOFF()) { 2527 InstrumentGlobalsCOFF(IRB, M, NewGlobals, Initializers); 2528 } else if (UseGlobalsGC && ShouldUseMachOGlobalsSection()) { 2529 InstrumentGlobalsMachO(IRB, M, NewGlobals, Initializers); 2530 } else { 2531 InstrumentGlobalsWithMetadataArray(IRB, M, NewGlobals, Initializers); 2532 } 2533 2534 // Create calls for poisoning before initializers run and unpoisoning after. 2535 if (HasDynamicallyInitializedGlobals) 2536 createInitializerPoisonCalls(M, ModuleName); 2537 2538 LLVM_DEBUG(dbgs() << M); 2539 return true; 2540 } 2541 2542 uint64_t 2543 ModuleAddressSanitizer::getRedzoneSizeForGlobal(uint64_t SizeInBytes) const { 2544 constexpr uint64_t kMaxRZ = 1 << 18; 2545 const uint64_t MinRZ = getMinRedzoneSizeForGlobal(); 2546 2547 uint64_t RZ = 0; 2548 if (SizeInBytes <= MinRZ / 2) { 2549 // Reduce redzone size for small size objects, e.g. int, char[1]. MinRZ is 2550 // at least 32 bytes, optimize when SizeInBytes is less than or equal to 2551 // half of MinRZ. 2552 RZ = MinRZ - SizeInBytes; 2553 } else { 2554 // Calculate RZ, where MinRZ <= RZ <= MaxRZ, and RZ ~ 1/4 * SizeInBytes. 2555 RZ = std::max(MinRZ, std::min(kMaxRZ, (SizeInBytes / MinRZ / 4) * MinRZ)); 2556 2557 // Round up to multiple of MinRZ. 2558 if (SizeInBytes % MinRZ) 2559 RZ += MinRZ - (SizeInBytes % MinRZ); 2560 } 2561 2562 assert((RZ + SizeInBytes) % MinRZ == 0); 2563 2564 return RZ; 2565 } 2566 2567 int ModuleAddressSanitizer::GetAsanVersion(const Module &M) const { 2568 int LongSize = M.getDataLayout().getPointerSizeInBits(); 2569 bool isAndroid = Triple(M.getTargetTriple()).isAndroid(); 2570 int Version = 8; 2571 // 32-bit Android is one version ahead because of the switch to dynamic 2572 // shadow. 2573 Version += (LongSize == 32 && isAndroid); 2574 return Version; 2575 } 2576 2577 bool ModuleAddressSanitizer::instrumentModule(Module &M) { 2578 initializeCallbacks(M); 2579 2580 // Create a module constructor. A destructor is created lazily because not all 2581 // platforms, and not all modules need it. 2582 if (CompileKernel) { 2583 // The kernel always builds with its own runtime, and therefore does not 2584 // need the init and version check calls. 2585 AsanCtorFunction = createSanitizerCtor(M, kAsanModuleCtorName); 2586 } else { 2587 std::string AsanVersion = std::to_string(GetAsanVersion(M)); 2588 std::string VersionCheckName = 2589 ClInsertVersionCheck ? (kAsanVersionCheckNamePrefix + AsanVersion) : ""; 2590 std::tie(AsanCtorFunction, std::ignore) = 2591 createSanitizerCtorAndInitFunctions(M, kAsanModuleCtorName, 2592 kAsanInitName, /*InitArgTypes=*/{}, 2593 /*InitArgs=*/{}, VersionCheckName); 2594 } 2595 2596 bool CtorComdat = true; 2597 if (ClGlobals) { 2598 IRBuilder<> IRB(AsanCtorFunction->getEntryBlock().getTerminator()); 2599 InstrumentGlobals(IRB, M, &CtorComdat); 2600 } 2601 2602 const uint64_t Priority = GetCtorAndDtorPriority(TargetTriple); 2603 2604 // Put the constructor and destructor in comdat if both 2605 // (1) global instrumentation is not TU-specific 2606 // (2) target is ELF. 2607 if (UseCtorComdat && TargetTriple.isOSBinFormatELF() && CtorComdat) { 2608 AsanCtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleCtorName)); 2609 appendToGlobalCtors(M, AsanCtorFunction, Priority, AsanCtorFunction); 2610 if (AsanDtorFunction) { 2611 AsanDtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleDtorName)); 2612 appendToGlobalDtors(M, AsanDtorFunction, Priority, AsanDtorFunction); 2613 } 2614 } else { 2615 appendToGlobalCtors(M, AsanCtorFunction, Priority); 2616 if (AsanDtorFunction) 2617 appendToGlobalDtors(M, AsanDtorFunction, Priority); 2618 } 2619 2620 return true; 2621 } 2622 2623 void AddressSanitizer::initializeCallbacks(Module &M) { 2624 IRBuilder<> IRB(*C); 2625 // Create __asan_report* callbacks. 2626 // IsWrite, TypeSize and Exp are encoded in the function name. 2627 for (int Exp = 0; Exp < 2; Exp++) { 2628 for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { 2629 const std::string TypeStr = AccessIsWrite ? "store" : "load"; 2630 const std::string ExpStr = Exp ? "exp_" : ""; 2631 const std::string EndingStr = Recover ? "_noabort" : ""; 2632 2633 SmallVector<Type *, 3> Args2 = {IntptrTy, IntptrTy}; 2634 SmallVector<Type *, 2> Args1{1, IntptrTy}; 2635 if (Exp) { 2636 Type *ExpType = Type::getInt32Ty(*C); 2637 Args2.push_back(ExpType); 2638 Args1.push_back(ExpType); 2639 } 2640 AsanErrorCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction( 2641 kAsanReportErrorTemplate + ExpStr + TypeStr + "_n" + EndingStr, 2642 FunctionType::get(IRB.getVoidTy(), Args2, false)); 2643 2644 AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction( 2645 ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr, 2646 FunctionType::get(IRB.getVoidTy(), Args2, false)); 2647 2648 for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; 2649 AccessSizeIndex++) { 2650 const std::string Suffix = TypeStr + itostr(1ULL << AccessSizeIndex); 2651 AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] = 2652 M.getOrInsertFunction( 2653 kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr, 2654 FunctionType::get(IRB.getVoidTy(), Args1, false)); 2655 2656 AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] = 2657 M.getOrInsertFunction( 2658 ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr, 2659 FunctionType::get(IRB.getVoidTy(), Args1, false)); 2660 } 2661 } 2662 } 2663 2664 const std::string MemIntrinCallbackPrefix = 2665 CompileKernel ? std::string("") : ClMemoryAccessCallbackPrefix; 2666 AsanMemmove = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memmove", 2667 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), 2668 IRB.getInt8PtrTy(), IntptrTy); 2669 AsanMemcpy = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memcpy", 2670 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), 2671 IRB.getInt8PtrTy(), IntptrTy); 2672 AsanMemset = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memset", 2673 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), 2674 IRB.getInt32Ty(), IntptrTy); 2675 2676 AsanHandleNoReturnFunc = 2677 M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy()); 2678 2679 AsanPtrCmpFunction = 2680 M.getOrInsertFunction(kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy); 2681 AsanPtrSubFunction = 2682 M.getOrInsertFunction(kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy); 2683 if (Mapping.InGlobal) 2684 AsanShadowGlobal = M.getOrInsertGlobal("__asan_shadow", 2685 ArrayType::get(IRB.getInt8Ty(), 0)); 2686 2687 AMDGPUAddressShared = M.getOrInsertFunction( 2688 kAMDGPUAddressSharedName, IRB.getInt1Ty(), IRB.getInt8PtrTy()); 2689 AMDGPUAddressPrivate = M.getOrInsertFunction( 2690 kAMDGPUAddressPrivateName, IRB.getInt1Ty(), IRB.getInt8PtrTy()); 2691 } 2692 2693 bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { 2694 // For each NSObject descendant having a +load method, this method is invoked 2695 // by the ObjC runtime before any of the static constructors is called. 2696 // Therefore we need to instrument such methods with a call to __asan_init 2697 // at the beginning in order to initialize our runtime before any access to 2698 // the shadow memory. 2699 // We cannot just ignore these methods, because they may call other 2700 // instrumented functions. 2701 if (F.getName().find(" load]") != std::string::npos) { 2702 FunctionCallee AsanInitFunction = 2703 declareSanitizerInitFunction(*F.getParent(), kAsanInitName, {}); 2704 IRBuilder<> IRB(&F.front(), F.front().begin()); 2705 IRB.CreateCall(AsanInitFunction, {}); 2706 return true; 2707 } 2708 return false; 2709 } 2710 2711 bool AddressSanitizer::maybeInsertDynamicShadowAtFunctionEntry(Function &F) { 2712 // Generate code only when dynamic addressing is needed. 2713 if (Mapping.Offset != kDynamicShadowSentinel) 2714 return false; 2715 2716 IRBuilder<> IRB(&F.front().front()); 2717 if (Mapping.InGlobal) { 2718 if (ClWithIfuncSuppressRemat) { 2719 // An empty inline asm with input reg == output reg. 2720 // An opaque pointer-to-int cast, basically. 2721 InlineAsm *Asm = InlineAsm::get( 2722 FunctionType::get(IntptrTy, {AsanShadowGlobal->getType()}, false), 2723 StringRef(""), StringRef("=r,0"), 2724 /*hasSideEffects=*/false); 2725 LocalDynamicShadow = 2726 IRB.CreateCall(Asm, {AsanShadowGlobal}, ".asan.shadow"); 2727 } else { 2728 LocalDynamicShadow = 2729 IRB.CreatePointerCast(AsanShadowGlobal, IntptrTy, ".asan.shadow"); 2730 } 2731 } else { 2732 Value *GlobalDynamicAddress = F.getParent()->getOrInsertGlobal( 2733 kAsanShadowMemoryDynamicAddress, IntptrTy); 2734 LocalDynamicShadow = IRB.CreateLoad(IntptrTy, GlobalDynamicAddress); 2735 } 2736 return true; 2737 } 2738 2739 void AddressSanitizer::markEscapedLocalAllocas(Function &F) { 2740 // Find the one possible call to llvm.localescape and pre-mark allocas passed 2741 // to it as uninteresting. This assumes we haven't started processing allocas 2742 // yet. This check is done up front because iterating the use list in 2743 // isInterestingAlloca would be algorithmically slower. 2744 assert(ProcessedAllocas.empty() && "must process localescape before allocas"); 2745 2746 // Try to get the declaration of llvm.localescape. If it's not in the module, 2747 // we can exit early. 2748 if (!F.getParent()->getFunction("llvm.localescape")) return; 2749 2750 // Look for a call to llvm.localescape call in the entry block. It can't be in 2751 // any other block. 2752 for (Instruction &I : F.getEntryBlock()) { 2753 IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I); 2754 if (II && II->getIntrinsicID() == Intrinsic::localescape) { 2755 // We found a call. Mark all the allocas passed in as uninteresting. 2756 for (Value *Arg : II->arg_operands()) { 2757 AllocaInst *AI = dyn_cast<AllocaInst>(Arg->stripPointerCasts()); 2758 assert(AI && AI->isStaticAlloca() && 2759 "non-static alloca arg to localescape"); 2760 ProcessedAllocas[AI] = false; 2761 } 2762 break; 2763 } 2764 } 2765 } 2766 2767 bool AddressSanitizer::suppressInstrumentationSiteForDebug(int &Instrumented) { 2768 bool ShouldInstrument = 2769 ClDebugMin < 0 || ClDebugMax < 0 || 2770 (Instrumented >= ClDebugMin && Instrumented <= ClDebugMax); 2771 Instrumented++; 2772 return !ShouldInstrument; 2773 } 2774 2775 bool AddressSanitizer::instrumentFunction(Function &F, 2776 const TargetLibraryInfo *TLI) { 2777 if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false; 2778 if (!ClDebugFunc.empty() && ClDebugFunc == F.getName()) return false; 2779 if (F.getName().startswith("__asan_")) return false; 2780 2781 bool FunctionModified = false; 2782 2783 // If needed, insert __asan_init before checking for SanitizeAddress attr. 2784 // This function needs to be called even if the function body is not 2785 // instrumented. 2786 if (maybeInsertAsanInitAtFunctionEntry(F)) 2787 FunctionModified = true; 2788 2789 // Leave if the function doesn't need instrumentation. 2790 if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return FunctionModified; 2791 2792 LLVM_DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n"); 2793 2794 initializeCallbacks(*F.getParent()); 2795 2796 FunctionStateRAII CleanupObj(this); 2797 2798 FunctionModified |= maybeInsertDynamicShadowAtFunctionEntry(F); 2799 2800 // We can't instrument allocas used with llvm.localescape. Only static allocas 2801 // can be passed to that intrinsic. 2802 markEscapedLocalAllocas(F); 2803 2804 // We want to instrument every address only once per basic block (unless there 2805 // are calls between uses). 2806 SmallPtrSet<Value *, 16> TempsToInstrument; 2807 SmallVector<InterestingMemoryOperand, 16> OperandsToInstrument; 2808 SmallVector<MemIntrinsic *, 16> IntrinToInstrument; 2809 SmallVector<Instruction *, 8> NoReturnCalls; 2810 SmallVector<BasicBlock *, 16> AllBlocks; 2811 SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts; 2812 int NumAllocas = 0; 2813 2814 // Fill the set of memory operations to instrument. 2815 for (auto &BB : F) { 2816 AllBlocks.push_back(&BB); 2817 TempsToInstrument.clear(); 2818 int NumInsnsPerBB = 0; 2819 for (auto &Inst : BB) { 2820 if (LooksLikeCodeInBug11395(&Inst)) return false; 2821 SmallVector<InterestingMemoryOperand, 1> InterestingOperands; 2822 getInterestingMemoryOperands(&Inst, InterestingOperands); 2823 2824 if (!InterestingOperands.empty()) { 2825 for (auto &Operand : InterestingOperands) { 2826 if (ClOpt && ClOptSameTemp) { 2827 Value *Ptr = Operand.getPtr(); 2828 // If we have a mask, skip instrumentation if we've already 2829 // instrumented the full object. But don't add to TempsToInstrument 2830 // because we might get another load/store with a different mask. 2831 if (Operand.MaybeMask) { 2832 if (TempsToInstrument.count(Ptr)) 2833 continue; // We've seen this (whole) temp in the current BB. 2834 } else { 2835 if (!TempsToInstrument.insert(Ptr).second) 2836 continue; // We've seen this temp in the current BB. 2837 } 2838 } 2839 OperandsToInstrument.push_back(Operand); 2840 NumInsnsPerBB++; 2841 } 2842 } else if (((ClInvalidPointerPairs || ClInvalidPointerCmp) && 2843 isInterestingPointerComparison(&Inst)) || 2844 ((ClInvalidPointerPairs || ClInvalidPointerSub) && 2845 isInterestingPointerSubtraction(&Inst))) { 2846 PointerComparisonsOrSubtracts.push_back(&Inst); 2847 } else if (MemIntrinsic *MI = dyn_cast<MemIntrinsic>(&Inst)) { 2848 // ok, take it. 2849 IntrinToInstrument.push_back(MI); 2850 NumInsnsPerBB++; 2851 } else { 2852 if (isa<AllocaInst>(Inst)) NumAllocas++; 2853 if (auto *CB = dyn_cast<CallBase>(&Inst)) { 2854 // A call inside BB. 2855 TempsToInstrument.clear(); 2856 if (CB->doesNotReturn() && !CB->hasMetadata("nosanitize")) 2857 NoReturnCalls.push_back(CB); 2858 } 2859 if (CallInst *CI = dyn_cast<CallInst>(&Inst)) 2860 maybeMarkSanitizerLibraryCallNoBuiltin(CI, TLI); 2861 } 2862 if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break; 2863 } 2864 } 2865 2866 bool UseCalls = (ClInstrumentationWithCallsThreshold >= 0 && 2867 OperandsToInstrument.size() + IntrinToInstrument.size() > 2868 (unsigned)ClInstrumentationWithCallsThreshold); 2869 const DataLayout &DL = F.getParent()->getDataLayout(); 2870 ObjectSizeOpts ObjSizeOpts; 2871 ObjSizeOpts.RoundToAlign = true; 2872 ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), ObjSizeOpts); 2873 2874 // Instrument. 2875 int NumInstrumented = 0; 2876 for (auto &Operand : OperandsToInstrument) { 2877 if (!suppressInstrumentationSiteForDebug(NumInstrumented)) 2878 instrumentMop(ObjSizeVis, Operand, UseCalls, 2879 F.getParent()->getDataLayout()); 2880 FunctionModified = true; 2881 } 2882 for (auto Inst : IntrinToInstrument) { 2883 if (!suppressInstrumentationSiteForDebug(NumInstrumented)) 2884 instrumentMemIntrinsic(Inst); 2885 FunctionModified = true; 2886 } 2887 2888 FunctionStackPoisoner FSP(F, *this); 2889 bool ChangedStack = FSP.runOnFunction(); 2890 2891 // We must unpoison the stack before NoReturn calls (throw, _exit, etc). 2892 // See e.g. https://github.com/google/sanitizers/issues/37 2893 for (auto CI : NoReturnCalls) { 2894 IRBuilder<> IRB(CI); 2895 IRB.CreateCall(AsanHandleNoReturnFunc, {}); 2896 } 2897 2898 for (auto Inst : PointerComparisonsOrSubtracts) { 2899 instrumentPointerComparisonOrSubtraction(Inst); 2900 FunctionModified = true; 2901 } 2902 2903 if (ChangedStack || !NoReturnCalls.empty()) 2904 FunctionModified = true; 2905 2906 LLVM_DEBUG(dbgs() << "ASAN done instrumenting: " << FunctionModified << " " 2907 << F << "\n"); 2908 2909 return FunctionModified; 2910 } 2911 2912 // Workaround for bug 11395: we don't want to instrument stack in functions 2913 // with large assembly blobs (32-bit only), otherwise reg alloc may crash. 2914 // FIXME: remove once the bug 11395 is fixed. 2915 bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { 2916 if (LongSize != 32) return false; 2917 CallInst *CI = dyn_cast<CallInst>(I); 2918 if (!CI || !CI->isInlineAsm()) return false; 2919 if (CI->getNumArgOperands() <= 5) return false; 2920 // We have inline assembly with quite a few arguments. 2921 return true; 2922 } 2923 2924 void FunctionStackPoisoner::initializeCallbacks(Module &M) { 2925 IRBuilder<> IRB(*C); 2926 if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always || 2927 ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) { 2928 const char *MallocNameTemplate = 2929 ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always 2930 ? kAsanStackMallocAlwaysNameTemplate 2931 : kAsanStackMallocNameTemplate; 2932 for (int Index = 0; Index <= kMaxAsanStackMallocSizeClass; Index++) { 2933 std::string Suffix = itostr(Index); 2934 AsanStackMallocFunc[Index] = M.getOrInsertFunction( 2935 MallocNameTemplate + Suffix, IntptrTy, IntptrTy); 2936 AsanStackFreeFunc[Index] = 2937 M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix, 2938 IRB.getVoidTy(), IntptrTy, IntptrTy); 2939 } 2940 } 2941 if (ASan.UseAfterScope) { 2942 AsanPoisonStackMemoryFunc = M.getOrInsertFunction( 2943 kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy); 2944 AsanUnpoisonStackMemoryFunc = M.getOrInsertFunction( 2945 kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy); 2946 } 2947 2948 for (size_t Val : {0x00, 0xf1, 0xf2, 0xf3, 0xf5, 0xf8}) { 2949 std::ostringstream Name; 2950 Name << kAsanSetShadowPrefix; 2951 Name << std::setw(2) << std::setfill('0') << std::hex << Val; 2952 AsanSetShadowFunc[Val] = 2953 M.getOrInsertFunction(Name.str(), IRB.getVoidTy(), IntptrTy, IntptrTy); 2954 } 2955 2956 AsanAllocaPoisonFunc = M.getOrInsertFunction( 2957 kAsanAllocaPoison, IRB.getVoidTy(), IntptrTy, IntptrTy); 2958 AsanAllocasUnpoisonFunc = M.getOrInsertFunction( 2959 kAsanAllocasUnpoison, IRB.getVoidTy(), IntptrTy, IntptrTy); 2960 } 2961 2962 void FunctionStackPoisoner::copyToShadowInline(ArrayRef<uint8_t> ShadowMask, 2963 ArrayRef<uint8_t> ShadowBytes, 2964 size_t Begin, size_t End, 2965 IRBuilder<> &IRB, 2966 Value *ShadowBase) { 2967 if (Begin >= End) 2968 return; 2969 2970 const size_t LargestStoreSizeInBytes = 2971 std::min<size_t>(sizeof(uint64_t), ASan.LongSize / 8); 2972 2973 const bool IsLittleEndian = F.getParent()->getDataLayout().isLittleEndian(); 2974 2975 // Poison given range in shadow using larges store size with out leading and 2976 // trailing zeros in ShadowMask. Zeros never change, so they need neither 2977 // poisoning nor up-poisoning. Still we don't mind if some of them get into a 2978 // middle of a store. 2979 for (size_t i = Begin; i < End;) { 2980 if (!ShadowMask[i]) { 2981 assert(!ShadowBytes[i]); 2982 ++i; 2983 continue; 2984 } 2985 2986 size_t StoreSizeInBytes = LargestStoreSizeInBytes; 2987 // Fit store size into the range. 2988 while (StoreSizeInBytes > End - i) 2989 StoreSizeInBytes /= 2; 2990 2991 // Minimize store size by trimming trailing zeros. 2992 for (size_t j = StoreSizeInBytes - 1; j && !ShadowMask[i + j]; --j) { 2993 while (j <= StoreSizeInBytes / 2) 2994 StoreSizeInBytes /= 2; 2995 } 2996 2997 uint64_t Val = 0; 2998 for (size_t j = 0; j < StoreSizeInBytes; j++) { 2999 if (IsLittleEndian) 3000 Val |= (uint64_t)ShadowBytes[i + j] << (8 * j); 3001 else 3002 Val = (Val << 8) | ShadowBytes[i + j]; 3003 } 3004 3005 Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); 3006 Value *Poison = IRB.getIntN(StoreSizeInBytes * 8, Val); 3007 IRB.CreateAlignedStore( 3008 Poison, IRB.CreateIntToPtr(Ptr, Poison->getType()->getPointerTo()), 3009 Align(1)); 3010 3011 i += StoreSizeInBytes; 3012 } 3013 } 3014 3015 void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask, 3016 ArrayRef<uint8_t> ShadowBytes, 3017 IRBuilder<> &IRB, Value *ShadowBase) { 3018 copyToShadow(ShadowMask, ShadowBytes, 0, ShadowMask.size(), IRB, ShadowBase); 3019 } 3020 3021 void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask, 3022 ArrayRef<uint8_t> ShadowBytes, 3023 size_t Begin, size_t End, 3024 IRBuilder<> &IRB, Value *ShadowBase) { 3025 assert(ShadowMask.size() == ShadowBytes.size()); 3026 size_t Done = Begin; 3027 for (size_t i = Begin, j = Begin + 1; i < End; i = j++) { 3028 if (!ShadowMask[i]) { 3029 assert(!ShadowBytes[i]); 3030 continue; 3031 } 3032 uint8_t Val = ShadowBytes[i]; 3033 if (!AsanSetShadowFunc[Val]) 3034 continue; 3035 3036 // Skip same values. 3037 for (; j < End && ShadowMask[j] && Val == ShadowBytes[j]; ++j) { 3038 } 3039 3040 if (j - i >= ClMaxInlinePoisoningSize) { 3041 copyToShadowInline(ShadowMask, ShadowBytes, Done, i, IRB, ShadowBase); 3042 IRB.CreateCall(AsanSetShadowFunc[Val], 3043 {IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)), 3044 ConstantInt::get(IntptrTy, j - i)}); 3045 Done = j; 3046 } 3047 } 3048 3049 copyToShadowInline(ShadowMask, ShadowBytes, Done, End, IRB, ShadowBase); 3050 } 3051 3052 // Fake stack allocator (asan_fake_stack.h) has 11 size classes 3053 // for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass 3054 static int StackMallocSizeClass(uint64_t LocalStackSize) { 3055 assert(LocalStackSize <= kMaxStackMallocSize); 3056 uint64_t MaxSize = kMinStackMallocSize; 3057 for (int i = 0;; i++, MaxSize *= 2) 3058 if (LocalStackSize <= MaxSize) return i; 3059 llvm_unreachable("impossible LocalStackSize"); 3060 } 3061 3062 void FunctionStackPoisoner::copyArgsPassedByValToAllocas() { 3063 Instruction *CopyInsertPoint = &F.front().front(); 3064 if (CopyInsertPoint == ASan.LocalDynamicShadow) { 3065 // Insert after the dynamic shadow location is determined 3066 CopyInsertPoint = CopyInsertPoint->getNextNode(); 3067 assert(CopyInsertPoint); 3068 } 3069 IRBuilder<> IRB(CopyInsertPoint); 3070 const DataLayout &DL = F.getParent()->getDataLayout(); 3071 for (Argument &Arg : F.args()) { 3072 if (Arg.hasByValAttr()) { 3073 Type *Ty = Arg.getParamByValType(); 3074 const Align Alignment = 3075 DL.getValueOrABITypeAlignment(Arg.getParamAlign(), Ty); 3076 3077 AllocaInst *AI = IRB.CreateAlloca( 3078 Ty, nullptr, 3079 (Arg.hasName() ? Arg.getName() : "Arg" + Twine(Arg.getArgNo())) + 3080 ".byval"); 3081 AI->setAlignment(Alignment); 3082 Arg.replaceAllUsesWith(AI); 3083 3084 uint64_t AllocSize = DL.getTypeAllocSize(Ty); 3085 IRB.CreateMemCpy(AI, Alignment, &Arg, Alignment, AllocSize); 3086 } 3087 } 3088 } 3089 3090 PHINode *FunctionStackPoisoner::createPHI(IRBuilder<> &IRB, Value *Cond, 3091 Value *ValueIfTrue, 3092 Instruction *ThenTerm, 3093 Value *ValueIfFalse) { 3094 PHINode *PHI = IRB.CreatePHI(IntptrTy, 2); 3095 BasicBlock *CondBlock = cast<Instruction>(Cond)->getParent(); 3096 PHI->addIncoming(ValueIfFalse, CondBlock); 3097 BasicBlock *ThenBlock = ThenTerm->getParent(); 3098 PHI->addIncoming(ValueIfTrue, ThenBlock); 3099 return PHI; 3100 } 3101 3102 Value *FunctionStackPoisoner::createAllocaForLayout( 3103 IRBuilder<> &IRB, const ASanStackFrameLayout &L, bool Dynamic) { 3104 AllocaInst *Alloca; 3105 if (Dynamic) { 3106 Alloca = IRB.CreateAlloca(IRB.getInt8Ty(), 3107 ConstantInt::get(IRB.getInt64Ty(), L.FrameSize), 3108 "MyAlloca"); 3109 } else { 3110 Alloca = IRB.CreateAlloca(ArrayType::get(IRB.getInt8Ty(), L.FrameSize), 3111 nullptr, "MyAlloca"); 3112 assert(Alloca->isStaticAlloca()); 3113 } 3114 assert((ClRealignStack & (ClRealignStack - 1)) == 0); 3115 size_t FrameAlignment = std::max(L.FrameAlignment, (size_t)ClRealignStack); 3116 Alloca->setAlignment(Align(FrameAlignment)); 3117 return IRB.CreatePointerCast(Alloca, IntptrTy); 3118 } 3119 3120 void FunctionStackPoisoner::createDynamicAllocasInitStorage() { 3121 BasicBlock &FirstBB = *F.begin(); 3122 IRBuilder<> IRB(dyn_cast<Instruction>(FirstBB.begin())); 3123 DynamicAllocaLayout = IRB.CreateAlloca(IntptrTy, nullptr); 3124 IRB.CreateStore(Constant::getNullValue(IntptrTy), DynamicAllocaLayout); 3125 DynamicAllocaLayout->setAlignment(Align(32)); 3126 } 3127 3128 void FunctionStackPoisoner::processDynamicAllocas() { 3129 if (!ClInstrumentDynamicAllocas || DynamicAllocaVec.empty()) { 3130 assert(DynamicAllocaPoisonCallVec.empty()); 3131 return; 3132 } 3133 3134 // Insert poison calls for lifetime intrinsics for dynamic allocas. 3135 for (const auto &APC : DynamicAllocaPoisonCallVec) { 3136 assert(APC.InsBefore); 3137 assert(APC.AI); 3138 assert(ASan.isInterestingAlloca(*APC.AI)); 3139 assert(!APC.AI->isStaticAlloca()); 3140 3141 IRBuilder<> IRB(APC.InsBefore); 3142 poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison); 3143 // Dynamic allocas will be unpoisoned unconditionally below in 3144 // unpoisonDynamicAllocas. 3145 // Flag that we need unpoison static allocas. 3146 } 3147 3148 // Handle dynamic allocas. 3149 createDynamicAllocasInitStorage(); 3150 for (auto &AI : DynamicAllocaVec) 3151 handleDynamicAllocaCall(AI); 3152 unpoisonDynamicAllocas(); 3153 } 3154 3155 /// Collect instructions in the entry block after \p InsBefore which initialize 3156 /// permanent storage for a function argument. These instructions must remain in 3157 /// the entry block so that uninitialized values do not appear in backtraces. An 3158 /// added benefit is that this conserves spill slots. This does not move stores 3159 /// before instrumented / "interesting" allocas. 3160 static void findStoresToUninstrumentedArgAllocas( 3161 AddressSanitizer &ASan, Instruction &InsBefore, 3162 SmallVectorImpl<Instruction *> &InitInsts) { 3163 Instruction *Start = InsBefore.getNextNonDebugInstruction(); 3164 for (Instruction *It = Start; It; It = It->getNextNonDebugInstruction()) { 3165 // Argument initialization looks like: 3166 // 1) store <Argument>, <Alloca> OR 3167 // 2) <CastArgument> = cast <Argument> to ... 3168 // store <CastArgument> to <Alloca> 3169 // Do not consider any other kind of instruction. 3170 // 3171 // Note: This covers all known cases, but may not be exhaustive. An 3172 // alternative to pattern-matching stores is to DFS over all Argument uses: 3173 // this might be more general, but is probably much more complicated. 3174 if (isa<AllocaInst>(It) || isa<CastInst>(It)) 3175 continue; 3176 if (auto *Store = dyn_cast<StoreInst>(It)) { 3177 // The store destination must be an alloca that isn't interesting for 3178 // ASan to instrument. These are moved up before InsBefore, and they're 3179 // not interesting because allocas for arguments can be mem2reg'd. 3180 auto *Alloca = dyn_cast<AllocaInst>(Store->getPointerOperand()); 3181 if (!Alloca || ASan.isInterestingAlloca(*Alloca)) 3182 continue; 3183 3184 Value *Val = Store->getValueOperand(); 3185 bool IsDirectArgInit = isa<Argument>(Val); 3186 bool IsArgInitViaCast = 3187 isa<CastInst>(Val) && 3188 isa<Argument>(cast<CastInst>(Val)->getOperand(0)) && 3189 // Check that the cast appears directly before the store. Otherwise 3190 // moving the cast before InsBefore may break the IR. 3191 Val == It->getPrevNonDebugInstruction(); 3192 bool IsArgInit = IsDirectArgInit || IsArgInitViaCast; 3193 if (!IsArgInit) 3194 continue; 3195 3196 if (IsArgInitViaCast) 3197 InitInsts.push_back(cast<Instruction>(Val)); 3198 InitInsts.push_back(Store); 3199 continue; 3200 } 3201 3202 // Do not reorder past unknown instructions: argument initialization should 3203 // only involve casts and stores. 3204 return; 3205 } 3206 } 3207 3208 void FunctionStackPoisoner::processStaticAllocas() { 3209 if (AllocaVec.empty()) { 3210 assert(StaticAllocaPoisonCallVec.empty()); 3211 return; 3212 } 3213 3214 int StackMallocIdx = -1; 3215 DebugLoc EntryDebugLocation; 3216 if (auto SP = F.getSubprogram()) 3217 EntryDebugLocation = 3218 DILocation::get(SP->getContext(), SP->getScopeLine(), 0, SP); 3219 3220 Instruction *InsBefore = AllocaVec[0]; 3221 IRBuilder<> IRB(InsBefore); 3222 3223 // Make sure non-instrumented allocas stay in the entry block. Otherwise, 3224 // debug info is broken, because only entry-block allocas are treated as 3225 // regular stack slots. 3226 auto InsBeforeB = InsBefore->getParent(); 3227 assert(InsBeforeB == &F.getEntryBlock()); 3228 for (auto *AI : StaticAllocasToMoveUp) 3229 if (AI->getParent() == InsBeforeB) 3230 AI->moveBefore(InsBefore); 3231 3232 // Move stores of arguments into entry-block allocas as well. This prevents 3233 // extra stack slots from being generated (to house the argument values until 3234 // they can be stored into the allocas). This also prevents uninitialized 3235 // values from being shown in backtraces. 3236 SmallVector<Instruction *, 8> ArgInitInsts; 3237 findStoresToUninstrumentedArgAllocas(ASan, *InsBefore, ArgInitInsts); 3238 for (Instruction *ArgInitInst : ArgInitInsts) 3239 ArgInitInst->moveBefore(InsBefore); 3240 3241 // If we have a call to llvm.localescape, keep it in the entry block. 3242 if (LocalEscapeCall) LocalEscapeCall->moveBefore(InsBefore); 3243 3244 SmallVector<ASanStackVariableDescription, 16> SVD; 3245 SVD.reserve(AllocaVec.size()); 3246 for (AllocaInst *AI : AllocaVec) { 3247 ASanStackVariableDescription D = {AI->getName().data(), 3248 ASan.getAllocaSizeInBytes(*AI), 3249 0, 3250 AI->getAlignment(), 3251 AI, 3252 0, 3253 0}; 3254 SVD.push_back(D); 3255 } 3256 3257 // Minimal header size (left redzone) is 4 pointers, 3258 // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms. 3259 size_t Granularity = 1ULL << Mapping.Scale; 3260 size_t MinHeaderSize = std::max((size_t)ASan.LongSize / 2, Granularity); 3261 const ASanStackFrameLayout &L = 3262 ComputeASanStackFrameLayout(SVD, Granularity, MinHeaderSize); 3263 3264 // Build AllocaToSVDMap for ASanStackVariableDescription lookup. 3265 DenseMap<const AllocaInst *, ASanStackVariableDescription *> AllocaToSVDMap; 3266 for (auto &Desc : SVD) 3267 AllocaToSVDMap[Desc.AI] = &Desc; 3268 3269 // Update SVD with information from lifetime intrinsics. 3270 for (const auto &APC : StaticAllocaPoisonCallVec) { 3271 assert(APC.InsBefore); 3272 assert(APC.AI); 3273 assert(ASan.isInterestingAlloca(*APC.AI)); 3274 assert(APC.AI->isStaticAlloca()); 3275 3276 ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI]; 3277 Desc.LifetimeSize = Desc.Size; 3278 if (const DILocation *FnLoc = EntryDebugLocation.get()) { 3279 if (const DILocation *LifetimeLoc = APC.InsBefore->getDebugLoc().get()) { 3280 if (LifetimeLoc->getFile() == FnLoc->getFile()) 3281 if (unsigned Line = LifetimeLoc->getLine()) 3282 Desc.Line = std::min(Desc.Line ? Desc.Line : Line, Line); 3283 } 3284 } 3285 } 3286 3287 auto DescriptionString = ComputeASanStackFrameDescription(SVD); 3288 LLVM_DEBUG(dbgs() << DescriptionString << " --- " << L.FrameSize << "\n"); 3289 uint64_t LocalStackSize = L.FrameSize; 3290 bool DoStackMalloc = 3291 ASan.UseAfterReturn != AsanDetectStackUseAfterReturnMode::Never && 3292 !ASan.CompileKernel && LocalStackSize <= kMaxStackMallocSize; 3293 bool DoDynamicAlloca = ClDynamicAllocaStack; 3294 // Don't do dynamic alloca or stack malloc if: 3295 // 1) There is inline asm: too often it makes assumptions on which registers 3296 // are available. 3297 // 2) There is a returns_twice call (typically setjmp), which is 3298 // optimization-hostile, and doesn't play well with introduced indirect 3299 // register-relative calculation of local variable addresses. 3300 DoDynamicAlloca &= !HasInlineAsm && !HasReturnsTwiceCall; 3301 DoStackMalloc &= !HasInlineAsm && !HasReturnsTwiceCall; 3302 3303 Value *StaticAlloca = 3304 DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false); 3305 3306 Value *FakeStack; 3307 Value *LocalStackBase; 3308 Value *LocalStackBaseAlloca; 3309 uint8_t DIExprFlags = DIExpression::ApplyOffset; 3310 3311 if (DoStackMalloc) { 3312 LocalStackBaseAlloca = 3313 IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base"); 3314 if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) { 3315 // void *FakeStack = __asan_option_detect_stack_use_after_return 3316 // ? __asan_stack_malloc_N(LocalStackSize) 3317 // : nullptr; 3318 // void *LocalStackBase = (FakeStack) ? FakeStack : 3319 // alloca(LocalStackSize); 3320 Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal( 3321 kAsanOptionDetectUseAfterReturn, IRB.getInt32Ty()); 3322 Value *UseAfterReturnIsEnabled = IRB.CreateICmpNE( 3323 IRB.CreateLoad(IRB.getInt32Ty(), OptionDetectUseAfterReturn), 3324 Constant::getNullValue(IRB.getInt32Ty())); 3325 Instruction *Term = 3326 SplitBlockAndInsertIfThen(UseAfterReturnIsEnabled, InsBefore, false); 3327 IRBuilder<> IRBIf(Term); 3328 StackMallocIdx = StackMallocSizeClass(LocalStackSize); 3329 assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass); 3330 Value *FakeStackValue = 3331 IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx], 3332 ConstantInt::get(IntptrTy, LocalStackSize)); 3333 IRB.SetInsertPoint(InsBefore); 3334 FakeStack = createPHI(IRB, UseAfterReturnIsEnabled, FakeStackValue, Term, 3335 ConstantInt::get(IntptrTy, 0)); 3336 } else { 3337 // assert(ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode:Always) 3338 // void *FakeStack = __asan_stack_malloc_N(LocalStackSize); 3339 // void *LocalStackBase = (FakeStack) ? FakeStack : 3340 // alloca(LocalStackSize); 3341 StackMallocIdx = StackMallocSizeClass(LocalStackSize); 3342 FakeStack = IRB.CreateCall(AsanStackMallocFunc[StackMallocIdx], 3343 ConstantInt::get(IntptrTy, LocalStackSize)); 3344 } 3345 Value *NoFakeStack = 3346 IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy)); 3347 Instruction *Term = 3348 SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false); 3349 IRBuilder<> IRBIf(Term); 3350 Value *AllocaValue = 3351 DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca; 3352 3353 IRB.SetInsertPoint(InsBefore); 3354 LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack); 3355 IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca); 3356 DIExprFlags |= DIExpression::DerefBefore; 3357 } else { 3358 // void *FakeStack = nullptr; 3359 // void *LocalStackBase = alloca(LocalStackSize); 3360 FakeStack = ConstantInt::get(IntptrTy, 0); 3361 LocalStackBase = 3362 DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca; 3363 LocalStackBaseAlloca = LocalStackBase; 3364 } 3365 3366 // It shouldn't matter whether we pass an `alloca` or a `ptrtoint` as the 3367 // dbg.declare address opereand, but passing a `ptrtoint` seems to confuse 3368 // later passes and can result in dropped variable coverage in debug info. 3369 Value *LocalStackBaseAllocaPtr = 3370 isa<PtrToIntInst>(LocalStackBaseAlloca) 3371 ? cast<PtrToIntInst>(LocalStackBaseAlloca)->getPointerOperand() 3372 : LocalStackBaseAlloca; 3373 assert(isa<AllocaInst>(LocalStackBaseAllocaPtr) && 3374 "Variable descriptions relative to ASan stack base will be dropped"); 3375 3376 // Replace Alloca instructions with base+offset. 3377 for (const auto &Desc : SVD) { 3378 AllocaInst *AI = Desc.AI; 3379 replaceDbgDeclare(AI, LocalStackBaseAllocaPtr, DIB, DIExprFlags, 3380 Desc.Offset); 3381 Value *NewAllocaPtr = IRB.CreateIntToPtr( 3382 IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)), 3383 AI->getType()); 3384 AI->replaceAllUsesWith(NewAllocaPtr); 3385 } 3386 3387 // The left-most redzone has enough space for at least 4 pointers. 3388 // Write the Magic value to redzone[0]. 3389 Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); 3390 IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), 3391 BasePlus0); 3392 // Write the frame description constant to redzone[1]. 3393 Value *BasePlus1 = IRB.CreateIntToPtr( 3394 IRB.CreateAdd(LocalStackBase, 3395 ConstantInt::get(IntptrTy, ASan.LongSize / 8)), 3396 IntptrPtrTy); 3397 GlobalVariable *StackDescriptionGlobal = 3398 createPrivateGlobalForString(*F.getParent(), DescriptionString, 3399 /*AllowMerging*/ true, kAsanGenPrefix); 3400 Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy); 3401 IRB.CreateStore(Description, BasePlus1); 3402 // Write the PC to redzone[2]. 3403 Value *BasePlus2 = IRB.CreateIntToPtr( 3404 IRB.CreateAdd(LocalStackBase, 3405 ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)), 3406 IntptrPtrTy); 3407 IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2); 3408 3409 const auto &ShadowAfterScope = GetShadowBytesAfterScope(SVD, L); 3410 3411 // Poison the stack red zones at the entry. 3412 Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB); 3413 // As mask we must use most poisoned case: red zones and after scope. 3414 // As bytes we can use either the same or just red zones only. 3415 copyToShadow(ShadowAfterScope, ShadowAfterScope, IRB, ShadowBase); 3416 3417 if (!StaticAllocaPoisonCallVec.empty()) { 3418 const auto &ShadowInScope = GetShadowBytes(SVD, L); 3419 3420 // Poison static allocas near lifetime intrinsics. 3421 for (const auto &APC : StaticAllocaPoisonCallVec) { 3422 const ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI]; 3423 assert(Desc.Offset % L.Granularity == 0); 3424 size_t Begin = Desc.Offset / L.Granularity; 3425 size_t End = Begin + (APC.Size + L.Granularity - 1) / L.Granularity; 3426 3427 IRBuilder<> IRB(APC.InsBefore); 3428 copyToShadow(ShadowAfterScope, 3429 APC.DoPoison ? ShadowAfterScope : ShadowInScope, Begin, End, 3430 IRB, ShadowBase); 3431 } 3432 } 3433 3434 SmallVector<uint8_t, 64> ShadowClean(ShadowAfterScope.size(), 0); 3435 SmallVector<uint8_t, 64> ShadowAfterReturn; 3436 3437 // (Un)poison the stack before all ret instructions. 3438 for (Instruction *Ret : RetVec) { 3439 IRBuilder<> IRBRet(Ret); 3440 // Mark the current frame as retired. 3441 IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), 3442 BasePlus0); 3443 if (DoStackMalloc) { 3444 assert(StackMallocIdx >= 0); 3445 // if FakeStack != 0 // LocalStackBase == FakeStack 3446 // // In use-after-return mode, poison the whole stack frame. 3447 // if StackMallocIdx <= 4 3448 // // For small sizes inline the whole thing: 3449 // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize); 3450 // **SavedFlagPtr(FakeStack) = 0 3451 // else 3452 // __asan_stack_free_N(FakeStack, LocalStackSize) 3453 // else 3454 // <This is not a fake stack; unpoison the redzones> 3455 Value *Cmp = 3456 IRBRet.CreateICmpNE(FakeStack, Constant::getNullValue(IntptrTy)); 3457 Instruction *ThenTerm, *ElseTerm; 3458 SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm); 3459 3460 IRBuilder<> IRBPoison(ThenTerm); 3461 if (StackMallocIdx <= 4) { 3462 int ClassSize = kMinStackMallocSize << StackMallocIdx; 3463 ShadowAfterReturn.resize(ClassSize / L.Granularity, 3464 kAsanStackUseAfterReturnMagic); 3465 copyToShadow(ShadowAfterReturn, ShadowAfterReturn, IRBPoison, 3466 ShadowBase); 3467 Value *SavedFlagPtrPtr = IRBPoison.CreateAdd( 3468 FakeStack, 3469 ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8)); 3470 Value *SavedFlagPtr = IRBPoison.CreateLoad( 3471 IntptrTy, IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy)); 3472 IRBPoison.CreateStore( 3473 Constant::getNullValue(IRBPoison.getInt8Ty()), 3474 IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy())); 3475 } else { 3476 // For larger frames call __asan_stack_free_*. 3477 IRBPoison.CreateCall( 3478 AsanStackFreeFunc[StackMallocIdx], 3479 {FakeStack, ConstantInt::get(IntptrTy, LocalStackSize)}); 3480 } 3481 3482 IRBuilder<> IRBElse(ElseTerm); 3483 copyToShadow(ShadowAfterScope, ShadowClean, IRBElse, ShadowBase); 3484 } else { 3485 copyToShadow(ShadowAfterScope, ShadowClean, IRBRet, ShadowBase); 3486 } 3487 } 3488 3489 // We are done. Remove the old unused alloca instructions. 3490 for (auto AI : AllocaVec) AI->eraseFromParent(); 3491 } 3492 3493 void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size, 3494 IRBuilder<> &IRB, bool DoPoison) { 3495 // For now just insert the call to ASan runtime. 3496 Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy); 3497 Value *SizeArg = ConstantInt::get(IntptrTy, Size); 3498 IRB.CreateCall( 3499 DoPoison ? AsanPoisonStackMemoryFunc : AsanUnpoisonStackMemoryFunc, 3500 {AddrArg, SizeArg}); 3501 } 3502 3503 // Handling llvm.lifetime intrinsics for a given %alloca: 3504 // (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca. 3505 // (2) if %size is constant, poison memory for llvm.lifetime.end (to detect 3506 // invalid accesses) and unpoison it for llvm.lifetime.start (the memory 3507 // could be poisoned by previous llvm.lifetime.end instruction, as the 3508 // variable may go in and out of scope several times, e.g. in loops). 3509 // (3) if we poisoned at least one %alloca in a function, 3510 // unpoison the whole stack frame at function exit. 3511 void FunctionStackPoisoner::handleDynamicAllocaCall(AllocaInst *AI) { 3512 IRBuilder<> IRB(AI); 3513 3514 const unsigned Alignment = std::max(kAllocaRzSize, AI->getAlignment()); 3515 const uint64_t AllocaRedzoneMask = kAllocaRzSize - 1; 3516 3517 Value *Zero = Constant::getNullValue(IntptrTy); 3518 Value *AllocaRzSize = ConstantInt::get(IntptrTy, kAllocaRzSize); 3519 Value *AllocaRzMask = ConstantInt::get(IntptrTy, AllocaRedzoneMask); 3520 3521 // Since we need to extend alloca with additional memory to locate 3522 // redzones, and OldSize is number of allocated blocks with 3523 // ElementSize size, get allocated memory size in bytes by 3524 // OldSize * ElementSize. 3525 const unsigned ElementSize = 3526 F.getParent()->getDataLayout().getTypeAllocSize(AI->getAllocatedType()); 3527 Value *OldSize = 3528 IRB.CreateMul(IRB.CreateIntCast(AI->getArraySize(), IntptrTy, false), 3529 ConstantInt::get(IntptrTy, ElementSize)); 3530 3531 // PartialSize = OldSize % 32 3532 Value *PartialSize = IRB.CreateAnd(OldSize, AllocaRzMask); 3533 3534 // Misalign = kAllocaRzSize - PartialSize; 3535 Value *Misalign = IRB.CreateSub(AllocaRzSize, PartialSize); 3536 3537 // PartialPadding = Misalign != kAllocaRzSize ? Misalign : 0; 3538 Value *Cond = IRB.CreateICmpNE(Misalign, AllocaRzSize); 3539 Value *PartialPadding = IRB.CreateSelect(Cond, Misalign, Zero); 3540 3541 // AdditionalChunkSize = Alignment + PartialPadding + kAllocaRzSize 3542 // Alignment is added to locate left redzone, PartialPadding for possible 3543 // partial redzone and kAllocaRzSize for right redzone respectively. 3544 Value *AdditionalChunkSize = IRB.CreateAdd( 3545 ConstantInt::get(IntptrTy, Alignment + kAllocaRzSize), PartialPadding); 3546 3547 Value *NewSize = IRB.CreateAdd(OldSize, AdditionalChunkSize); 3548 3549 // Insert new alloca with new NewSize and Alignment params. 3550 AllocaInst *NewAlloca = IRB.CreateAlloca(IRB.getInt8Ty(), NewSize); 3551 NewAlloca->setAlignment(Align(Alignment)); 3552 3553 // NewAddress = Address + Alignment 3554 Value *NewAddress = IRB.CreateAdd(IRB.CreatePtrToInt(NewAlloca, IntptrTy), 3555 ConstantInt::get(IntptrTy, Alignment)); 3556 3557 // Insert __asan_alloca_poison call for new created alloca. 3558 IRB.CreateCall(AsanAllocaPoisonFunc, {NewAddress, OldSize}); 3559 3560 // Store the last alloca's address to DynamicAllocaLayout. We'll need this 3561 // for unpoisoning stuff. 3562 IRB.CreateStore(IRB.CreatePtrToInt(NewAlloca, IntptrTy), DynamicAllocaLayout); 3563 3564 Value *NewAddressPtr = IRB.CreateIntToPtr(NewAddress, AI->getType()); 3565 3566 // Replace all uses of AddessReturnedByAlloca with NewAddressPtr. 3567 AI->replaceAllUsesWith(NewAddressPtr); 3568 3569 // We are done. Erase old alloca from parent. 3570 AI->eraseFromParent(); 3571 } 3572 3573 // isSafeAccess returns true if Addr is always inbounds with respect to its 3574 // base object. For example, it is a field access or an array access with 3575 // constant inbounds index. 3576 bool AddressSanitizer::isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, 3577 Value *Addr, uint64_t TypeSize) const { 3578 SizeOffsetType SizeOffset = ObjSizeVis.compute(Addr); 3579 if (!ObjSizeVis.bothKnown(SizeOffset)) return false; 3580 uint64_t Size = SizeOffset.first.getZExtValue(); 3581 int64_t Offset = SizeOffset.second.getSExtValue(); 3582 // Three checks are required to ensure safety: 3583 // . Offset >= 0 (since the offset is given from the base ptr) 3584 // . Size >= Offset (unsigned) 3585 // . Size - Offset >= NeededSize (unsigned) 3586 return Offset >= 0 && Size >= uint64_t(Offset) && 3587 Size - uint64_t(Offset) >= TypeSize / 8; 3588 } 3589