AddressSanitizer.cpp revision 64409ad8e3b360b84349042f14b57f87a5c0ca18
1800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===-- AddressSanitizer.cpp - memory error detector ------------*- C++ -*-===// 2800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 3800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The LLVM Compiler Infrastructure 4800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 5800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is distributed under the University of Illinois Open Source 6800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// License. See LICENSE.TXT for details. 7800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 8800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 9800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 10800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is a part of AddressSanitizer, an address sanity checker. 11800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Details of the algorithm: 12800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm 13800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 14800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 15800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 16800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#define DEBUG_TYPE "asan" 17800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 18d04a8d4b33ff316ca4cf961e06c9e312eff8e64fChandler Carruth#include "llvm/Transforms/Instrumentation.h" 19800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/ArrayRef.h" 201c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov#include "llvm/ADT/DenseMap.h" 2159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov#include "llvm/ADT/DepthFirstIterator.h" 22800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/OwningPtr.h" 23800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallSet.h" 24800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallString.h" 25800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallVector.h" 263386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany#include "llvm/ADT/Statistic.h" 27800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/StringExtras.h" 2806fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov#include "llvm/ADT/Triple.h" 291afbb517965e29b07cb42e2335d5eadd87de6535Alexey Samsonov#include "llvm/DIBuilder.h" 300b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/DataLayout.h" 310b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/Function.h" 320b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/IRBuilder.h" 330b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/InlineAsm.h" 340b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/IntrinsicInst.h" 350b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/LLVMContext.h" 360b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/Module.h" 370b8c9a80f20772c3793201ab5b251d3520b9cea3Chandler Carruth#include "llvm/IR/Type.h" 3859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov#include "llvm/InstVisitor.h" 391479c9bb392325688b72e5829bbb7939c4a079a4Kostya Serebryany#include "llvm/Support/CallSite.h" 40800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/CommandLine.h" 41800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/DataTypes.h" 42800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/Debug.h" 433e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryany#include "llvm/Support/Endian.h" 44800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/raw_ostream.h" 45800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/system_error.h" 46800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/BasicBlockUtils.h" 4720985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany#include "llvm/Transforms/Utils/Cloning.h" 481afbb517965e29b07cb42e2335d5eadd87de6535Alexey Samsonov#include "llvm/Transforms/Utils/Local.h" 49800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/ModuleUtils.h" 50405515d55f470d04ef75f653b7f1994329c9066bPeter Collingbourne#include "llvm/Transforms/Utils/SpecialCaseList.h" 51800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include <algorithm> 52d04a8d4b33ff316ca4cf961e06c9e312eff8e64fChandler Carruth#include <string> 53800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 54800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyusing namespace llvm; 55800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 56800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowScale = 3; 57800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset32 = 1ULL << 29; 58800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset64 = 1ULL << 44; 59117de489a0d5f4ff280fb173fe45bd5ce8514d93Kostya Serebryanystatic const uint64_t kDefaultShort64bitShadowOffset = 0x7FFF8000; // < 2G. 6048a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryanystatic const uint64_t kPPC64_ShadowOffset64 = 1ULL << 41; 613e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryanystatic const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa8000; 62800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 63f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryanystatic const size_t kMinStackMallocSize = 1 << 6; // 64B 64800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const size_t kMaxStackMallocSize = 1 << 16; // 64K 65800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; 66800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; 67800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 684172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanModuleCtorName = "asan.module_ctor"; 694172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanModuleDtorName = "asan.module_dtor"; 704172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const int kAsanCtorAndCtorPriority = 1; 714172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanReportErrorTemplate = "__asan_report_"; 724172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanReportLoadN = "__asan_report_load_n"; 734172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanReportStoreN = "__asan_report_store_n"; 744172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanRegisterGlobalsName = "__asan_register_globals"; 7548d7d1d231cde758599fa0a010c29a174907c12fAlexey Samsonovstatic const char *const kAsanUnregisterGlobalsName = 7648d7d1d231cde758599fa0a010c29a174907c12fAlexey Samsonov "__asan_unregister_globals"; 774172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanPoisonGlobalsName = "__asan_before_dynamic_init"; 784172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"; 794172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanInitName = "__asan_init_v3"; 804b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilsonstatic const char *const kAsanCovName = "__sanitizer_cov"; 814172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanHandleNoReturnName = "__asan_handle_no_return"; 824172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanMappingOffsetName = "__asan_mapping_offset"; 834172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanMappingScaleName = "__asan_mapping_scale"; 84f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryanystatic const int kMaxAsanStackMallocSizeClass = 10; 85f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryanystatic const char *const kAsanStackMallocNameTemplate = "__asan_stack_malloc_"; 86f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryanystatic const char *const kAsanStackFreeNameTemplate = "__asan_stack_free_"; 874172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanGenPrefix = "__asan_gen_"; 884172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanPoisonStackMemoryName = 894172a8abbabea2359d91bb07101166565127d798Craig Topper "__asan_poison_stack_memory"; 904172a8abbabea2359d91bb07101166565127d798Craig Topperstatic const char *const kAsanUnpoisonStackMemoryName = 91f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov "__asan_unpoison_stack_memory"; 92800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 93ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryanystatic const char *const kAsanOptionDetectUAR = 94ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany "__asan_option_detect_stack_use_after_return"; 95ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany 96671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany// These constants must match the definitions in the run-time library. 97800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackLeftRedzoneMagic = 0xf1; 98800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackMidRedzoneMagic = 0xf2; 99800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackRightRedzoneMagic = 0xf3; 100800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackPartialRedzoneMagic = 0xf4; 1010b956507cab3dc4b06b310d2674bb35c79f46dc0David Blaikie#ifndef NDEBUG 102671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryanystatic const int kAsanStackAfterReturnMagic = 0xf5; 1030b956507cab3dc4b06b310d2674bb35c79f46dc0David Blaikie#endif 104800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 105c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany// Accesses sizes are powers of two: 1, 2, 4, 8, 16. 106c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanystatic const size_t kNumberOfAccessSizes = 5; 107c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 108800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Command-line flags. 109800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 110800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no-]asan-reads. 111800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentReads("asan-instrument-reads", 112800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument read instructions"), cl::Hidden, cl::init(true)); 113800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentWrites("asan-instrument-writes", 114800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument write instructions"), cl::Hidden, cl::init(true)); 115e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryanystatic cl::opt<bool> ClInstrumentAtomics("asan-instrument-atomics", 116e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany cl::desc("instrument atomic instructions (rmw, cmpxchg)"), 117e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany cl::Hidden, cl::init(true)); 1186e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryanystatic cl::opt<bool> ClAlwaysSlowPath("asan-always-slow-path", 1196e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany cl::desc("use instrumentation with slow path for all accesses"), 1206e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany cl::Hidden, cl::init(false)); 121c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany// This flag limits the number of instructions to be instrumented 122324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// in any given BB. Normally, this should be set to unlimited (INT_MAX), 123324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary 124324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// set it to 10000. 125324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryanystatic cl::opt<int> ClMaxInsnsToInstrumentPerBB("asan-max-ins-per-bb", 126324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::init(10000), 127324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::desc("maximal number of instructions to instrument in any given BB"), 128324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::Hidden); 129800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-stack. 130800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClStack("asan-stack", 131800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle stack memory"), cl::Hidden, cl::init(true)); 132800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-use-after-return. 133800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClUseAfterReturn("asan-use-after-return", 134800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Check return-after-free"), cl::Hidden, cl::init(false)); 135800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-globals. 136800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClGlobals("asan-globals", 137800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle global objects"), cl::Hidden, cl::init(true)); 1384b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilsonstatic cl::opt<bool> ClCoverage("asan-coverage", 1394b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson cl::desc("ASan coverage"), cl::Hidden, cl::init(false)); 1409b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryanystatic cl::opt<bool> ClInitializers("asan-initialization-order", 1419b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(false)); 142800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClMemIntrin("asan-memintrin", 143800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle memset/memcpy/memmove"), cl::Hidden, cl::init(true)); 1446c55412ea4b39103a3a5764d49ddfdf50e066d56Kostya Serebryanystatic cl::opt<bool> ClRealignStack("asan-realign-stack", 1456c55412ea4b39103a3a5764d49ddfdf50e066d56Kostya Serebryany cl::desc("Realign stack to 32"), cl::Hidden, cl::init(true)); 146b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonovstatic cl::opt<std::string> ClBlacklistFile("asan-blacklist", 147b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov cl::desc("File containing the list of objects to ignore " 148800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "during instrumentation"), cl::Hidden); 149800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 15020985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany// This is an experimental feature that will allow to choose between 15120985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany// instrumented and non-instrumented code at link-time. 15220985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany// If this option is on, just before instrumenting a function we create its 15320985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany// clone; if the function is not changed by asan the clone is deleted. 15420985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany// If we end up with a clone, we put the instrumented function into a section 15520985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany// called "ASAN" and the uninstrumented function into a section called "NOASAN". 15620985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany// 15720985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany// This is still a prototype, we need to figure out a way to keep two copies of 15820985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany// a function so that the linker can easily choose one of them. 15920985711c76b8799d689a9c0e416b68896333c23Kostya Serebryanystatic cl::opt<bool> ClKeepUninstrumented("asan-keep-uninstrumented-functions", 16020985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany cl::desc("Keep uninstrumented copies of functions"), 16120985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany cl::Hidden, cl::init(false)); 16220985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany 163800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// These flags allow to change the shadow mapping. 164800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The shadow mapping looks like 165800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Shadow = (Mem >> scale) + (1 << offset_log) 166800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingScale("asan-mapping-scale", 167800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0)); 168800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingOffsetLog("asan-mapping-offset-log", 169800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("offset of asan shadow mapping"), cl::Hidden, cl::init(-1)); 170117de489a0d5f4ff280fb173fe45bd5ce8514d93Kostya Serebryanystatic cl::opt<bool> ClShort64BitOffset("asan-short-64bit-mapping-offset", 171117de489a0d5f4ff280fb173fe45bd5ce8514d93Kostya Serebryany cl::desc("Use short immediate constant as the mapping offset for 64bit"), 1720bc55d517e8e64f0f441736fba2447781c405ef4Kostya Serebryany cl::Hidden, cl::init(true)); 173800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 174800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Optimization flags. Not user visible, used mostly for testing 175800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// and benchmarking the tool. 176800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOpt("asan-opt", 177800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true)); 178800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptSameTemp("asan-opt-same-temp", 179800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Instrument the same temp just once"), cl::Hidden, 180800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(true)); 181800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptGlobals("asan-opt-globals", 182800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true)); 183800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 184ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonovstatic cl::opt<bool> ClCheckLifetime("asan-check-lifetime", 185ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov cl::desc("Use llvm.lifetime intrinsics to insert extra checks"), 186ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov cl::Hidden, cl::init(false)); 187ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov 188800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Debug flags. 189800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, 190800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(0)); 191800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), 192800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(0)); 193800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<std::string> ClDebugFunc("asan-debug-func", 194800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::desc("Debug func")); 195800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), 196800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 197800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), 198800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 199800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 2003386d252579ea00d0fc26a3ba7874bec25ce4516Kostya SerebryanySTATISTIC(NumInstrumentedReads, "Number of instrumented reads"); 2013386d252579ea00d0fc26a3ba7874bec25ce4516Kostya SerebryanySTATISTIC(NumInstrumentedWrites, "Number of instrumented writes"); 2023386d252579ea00d0fc26a3ba7874bec25ce4516Kostya SerebryanySTATISTIC(NumOptimizedAccessesToGlobalArray, 2033386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany "Number of optimized accesses to global arrays"); 2043386d252579ea00d0fc26a3ba7874bec25ce4516Kostya SerebryanySTATISTIC(NumOptimizedAccessesToGlobalVar, 2053386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany "Number of optimized accesses to global vars"); 2063386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany 207800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanynamespace { 208ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany/// A set of dynamically initialized globals extracted from metadata. 209ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryanyclass SetOfDynamicallyInitializedGlobals { 210ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany public: 211ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany void Init(Module& M) { 212ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany // Clang generates metadata identifying all dynamically initialized globals. 213ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany NamedMDNode *DynamicGlobals = 214ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany M.getNamedMetadata("llvm.asan.dynamically_initialized_globals"); 215ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany if (!DynamicGlobals) 216ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany return; 217ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany for (int i = 0, n = DynamicGlobals->getNumOperands(); i < n; ++i) { 218ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany MDNode *MDN = DynamicGlobals->getOperand(i); 219ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany assert(MDN->getNumOperands() == 1); 220ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany Value *VG = MDN->getOperand(0); 221ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany // The optimizer may optimize away a global entirely, in which case we 222ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany // cannot instrument access to it. 223ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany if (!VG) 224ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany continue; 225ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany DynInitGlobals.insert(cast<GlobalVariable>(VG)); 226ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany } 227ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany } 228ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany bool Contains(GlobalVariable *G) { return DynInitGlobals.count(G) != 0; } 229ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany private: 230ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany SmallSet<GlobalValue*, 32> DynInitGlobals; 231ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany}; 232ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany 23319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov/// This struct defines the shadow mapping using the rule: 23448a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany/// shadow = (mem >> Scale) ADD-or-OR Offset. 23519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonovstruct ShadowMapping { 23619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov int Scale; 23719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov uint64_t Offset; 23848a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany bool OrShadowOffset; 23919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov}; 24019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 24111af9a873f9e1409a422ab31e22729368805afafAlexey Samsonovstatic ShadowMapping getShadowMapping(const Module &M, int LongSize, 24211af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov bool ZeroBaseShadow) { 24311af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov llvm::Triple TargetTriple(M.getTargetTriple()); 24411af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov bool IsAndroid = TargetTriple.getEnvironment() == llvm::Triple::Android; 245c8a196ae8fad3cba7a777e2e7916fd36ebf70fe6Alexander Potapenko bool IsMacOSX = TargetTriple.getOS() == llvm::Triple::MacOSX; 246f38cc38fa647d4e72c053c39bbe0cdec1342535fBill Schmidt bool IsPPC64 = TargetTriple.getArch() == llvm::Triple::ppc64 || 247f38cc38fa647d4e72c053c39bbe0cdec1342535fBill Schmidt TargetTriple.getArch() == llvm::Triple::ppc64le; 2480bc55d517e8e64f0f441736fba2447781c405ef4Kostya Serebryany bool IsX86_64 = TargetTriple.getArch() == llvm::Triple::x86_64; 2493e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryany bool IsMIPS32 = TargetTriple.getArch() == llvm::Triple::mips || 2503e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryany TargetTriple.getArch() == llvm::Triple::mipsel; 25119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 25219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ShadowMapping Mapping; 25319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 25448a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany // OR-ing shadow offset if more efficient (at least on x86), 25548a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany // but on ppc64 we have to use add since the shadow offset is not neccesary 25648a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany // 1/8-th of the address space. 257117de489a0d5f4ff280fb173fe45bd5ce8514d93Kostya Serebryany Mapping.OrShadowOffset = !IsPPC64 && !ClShort64BitOffset; 25848a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany 25911af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov Mapping.Offset = (IsAndroid || ZeroBaseShadow) ? 0 : 2603e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryany (LongSize == 32 ? 2613e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryany (IsMIPS32 ? kMIPS32_ShadowOffset32 : kDefaultShadowOffset32) : 26248a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany IsPPC64 ? kPPC64_ShadowOffset64 : kDefaultShadowOffset64); 263c8a196ae8fad3cba7a777e2e7916fd36ebf70fe6Alexander Potapenko if (!ZeroBaseShadow && ClShort64BitOffset && IsX86_64 && !IsMacOSX) { 2640bc55d517e8e64f0f441736fba2447781c405ef4Kostya Serebryany assert(LongSize == 64); 265117de489a0d5f4ff280fb173fe45bd5ce8514d93Kostya Serebryany Mapping.Offset = kDefaultShort64bitShadowOffset; 26639f02940ba085af79011f7e9095bf9902cd0fa6fKostya Serebryany } 26739f02940ba085af79011f7e9095bf9902cd0fa6fKostya Serebryany if (!ZeroBaseShadow && ClMappingOffsetLog >= 0) { 26819cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov // Zero offset log is the special case. 26919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping.Offset = (ClMappingOffsetLog == 0) ? 0 : 1ULL << ClMappingOffsetLog; 27019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 27119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 27219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping.Scale = kDefaultShadowScale; 27319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov if (ClMappingScale) { 27419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping.Scale = ClMappingScale; 27519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 27619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 27719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov return Mapping; 278b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany} 279b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 28019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonovstatic size_t RedzoneSizeForScale(int MappingScale) { 281b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany // Redzone used for stack and globals is at least 32 bytes. 282b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. 28319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov return std::max(32U, 1U << MappingScale); 284b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany} 285ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany 286800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany/// AddressSanitizer: instrument the code in module to find memory bugs. 287ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanystruct AddressSanitizer : public FunctionPass { 288b4ba5e68e1ac00bfb93572a1f271673deefd7ea9Alexey Samsonov AddressSanitizer(bool CheckInitOrder = true, 289ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckUseAfterReturn = false, 290b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov bool CheckLifetime = false, 29111af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov StringRef BlacklistFile = StringRef(), 29211af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov bool ZeroBaseShadow = false) 293ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov : FunctionPass(ID), 294ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov CheckInitOrder(CheckInitOrder || ClInitializers), 295ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov CheckUseAfterReturn(CheckUseAfterReturn || ClUseAfterReturn), 296b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov CheckLifetime(CheckLifetime || ClCheckLifetime), 297b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov BlacklistFile(BlacklistFile.empty() ? ClBlacklistFile 29811af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov : BlacklistFile), 29911af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov ZeroBaseShadow(ZeroBaseShadow) {} 3001416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany virtual const char *getPassName() const { 3011416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany return "AddressSanitizerFunctionPass"; 3021416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany } 303ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany void instrumentMop(Instruction *I); 3046ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore, 3056ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Value *Addr, uint32_t TypeSize, bool IsWrite, 3066ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Value *SizeArgument); 307c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 308c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *ShadowValue, uint32_t TypeSize); 309ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr, 3106ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany bool IsWrite, size_t AccessSizeIndex, 3116ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Value *SizeArgument); 312ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany bool instrumentMemIntrinsic(MemIntrinsic *MI); 313ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany void instrumentMemIntrinsicParam(Instruction *OrigIns, Value *Addr, 314c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *Size, 315800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore, bool IsWrite); 316800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); 317ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany bool runOnFunction(Function &F); 318a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany bool maybeInsertAsanInitAtFunctionEntry(Function &F); 31919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov void emitShadowMapping(Module &M, IRBuilder<> &IRB) const; 320ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany virtual bool doInitialization(Module &M); 321800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany static char ID; // Pass identification, replacement for typeid 322800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 323800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany private: 3248b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany void initializeCallbacks(Module &M); 325800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 3269b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany bool ShouldInstrumentGlobal(GlobalVariable *G); 3275a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany bool LooksLikeCodeInBug11395(Instruction *I); 3289b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany void FindDynamicInitializers(Module &M); 3293386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany bool GlobalIsLinkerInitialized(GlobalVariable *G); 3304b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson bool InjectCoverage(Function &F); 331800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 332ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckInitOrder; 333ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckUseAfterReturn; 334ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckLifetime; 33511af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov SmallString<64> BlacklistFile; 33611af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov bool ZeroBaseShadow; 33711af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov 338800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LLVMContext *C; 3393574eca1b02600bac4e625297f4ecf745f4c4f32Micah Villmow DataLayout *TD; 340800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int LongSize; 341800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *IntptrTy; 34219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ShadowMapping Mapping; 343800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanCtorFunction; 344800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanInitFunction; 345ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany Function *AsanHandleNoReturnFunc; 3464b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson Function *AsanCovFunction; 347405515d55f470d04ef75f653b7f1994329c9066bPeter Collingbourne OwningPtr<SpecialCaseList> BL; 3489db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // This array is indexed by AccessIsWrite and log2(AccessSize). 3499db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany Function *AsanErrorCallback[2][kNumberOfAccessSizes]; 3506ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany // This array is indexed by AccessIsWrite. 3516ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Function *AsanErrorCallbackSized[2]; 352f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany InlineAsm *EmptyAsm; 353ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany SetOfDynamicallyInitializedGlobals DynamicallyInitializedGlobals; 35459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 35559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov friend struct FunctionStackPoisoner; 356800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany}; 357c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 3581416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanyclass AddressSanitizerModule : public ModulePass { 359b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany public: 360b4ba5e68e1ac00bfb93572a1f271673deefd7ea9Alexey Samsonov AddressSanitizerModule(bool CheckInitOrder = true, 36111af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov StringRef BlacklistFile = StringRef(), 36211af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov bool ZeroBaseShadow = false) 363ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov : ModulePass(ID), 364b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov CheckInitOrder(CheckInitOrder || ClInitializers), 365b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov BlacklistFile(BlacklistFile.empty() ? ClBlacklistFile 36611af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov : BlacklistFile), 36711af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov ZeroBaseShadow(ZeroBaseShadow) {} 3681416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany bool runOnModule(Module &M); 3691416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany static char ID; // Pass identification, replacement for typeid 3701416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany virtual const char *getPassName() const { 3711416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany return "AddressSanitizerModule"; 3721416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany } 373f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov 374b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany private: 3754684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov void initializeCallbacks(Module &M); 3764684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov 377b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany bool ShouldInstrumentGlobal(GlobalVariable *G); 378ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName); 37919cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t RedzoneSize() const { 38019cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov return RedzoneSizeForScale(Mapping.Scale); 38119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 382b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 383ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckInitOrder; 384b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov SmallString<64> BlacklistFile; 38511af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov bool ZeroBaseShadow; 38611af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov 387405515d55f470d04ef75f653b7f1994329c9066bPeter Collingbourne OwningPtr<SpecialCaseList> BL; 388b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany SetOfDynamicallyInitializedGlobals DynamicallyInitializedGlobals; 389b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Type *IntptrTy; 390b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany LLVMContext *C; 3911416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany DataLayout *TD; 39219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ShadowMapping Mapping; 3934684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov Function *AsanPoisonGlobals; 3944684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov Function *AsanUnpoisonGlobals; 3954684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov Function *AsanRegisterGlobals; 3964684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov Function *AsanUnregisterGlobals; 397b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany}; 398b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 39959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// Stack poisoning does not play well with exception handling. 40059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// When an exception is thrown, we essentially bypass the code 40159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// that unpoisones the stack. This is why the run-time library has 40259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire 40359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// stack in the interceptor. This however does not work inside the 40459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// actual function which catches the exception. Most likely because the 40559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// compiler hoists the load of the shadow value somewhere too high. 40659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// This causes asan to report a non-existing bug on 453.povray. 40759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// It sounds like an LLVM bug. 40859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovstruct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> { 40959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Function &F; 41059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AddressSanitizer &ASan; 41159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov DIBuilder DIB; 41259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov LLVMContext *C; 41359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Type *IntptrTy; 41459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Type *IntptrPtrTy; 41519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ShadowMapping Mapping; 41659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 41759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov SmallVector<AllocaInst*, 16> AllocaVec; 41859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov SmallVector<Instruction*, 8> RetVec; 41959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t TotalStackSize; 42059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov unsigned StackAlignment; 42159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 422f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany Function *AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1], 423f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany *AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1]; 42459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Function *AsanPoisonStackMemoryFunc, *AsanUnpoisonStackMemoryFunc; 42559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 4261c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Stores a place and arguments of poisoning/unpoisoning call for alloca. 4271c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov struct AllocaPoisonCall { 4281c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov IntrinsicInst *InsBefore; 42964409ad8e3b360b84349042f14b57f87a5c0ca18Alexey Samsonov AllocaInst *AI; 4301c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov uint64_t Size; 4311c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov bool DoPoison; 4321c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov }; 4331c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov SmallVector<AllocaPoisonCall, 8> AllocaPoisonCallVec; 4341c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 4351c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Maps Value to an AllocaInst from which the Value is originated. 4361c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov typedef DenseMap<Value*, AllocaInst*> AllocaForValueMapTy; 4371c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaForValueMapTy AllocaForValue; 4381c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 43959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov FunctionStackPoisoner(Function &F, AddressSanitizer &ASan) 44059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov : F(F), ASan(ASan), DIB(*F.getParent()), C(ASan.C), 44159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov IntptrTy(ASan.IntptrTy), IntptrPtrTy(PointerType::get(IntptrTy, 0)), 44219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Mapping(ASan.Mapping), 44319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov TotalStackSize(0), StackAlignment(1 << Mapping.Scale) {} 44459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 44559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov bool runOnFunction() { 44659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (!ClStack) return false; 44759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // Collect alloca, ret, lifetime instructions etc. 44859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov for (df_iterator<BasicBlock*> DI = df_begin(&F.getEntryBlock()), 44959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov DE = df_end(&F.getEntryBlock()); DI != DE; ++DI) { 45059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov BasicBlock *BB = *DI; 45159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov visit(*BB); 45259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 45359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (AllocaVec.empty()) return false; 45459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 45559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov initializeCallbacks(*F.getParent()); 45659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 45759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov poisonStack(); 45859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 45959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (ClDebugStack) { 46059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov DEBUG(dbgs() << F); 46159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 46259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return true; 46359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 46459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 46559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // Finds all static Alloca instructions and puts 46659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // poisoned red zones around all of them. 46759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // Then unpoison everything back before the function returns. 46859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void poisonStack(); 46959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 47059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // ----------------------- Visitors. 47159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov /// \brief Collect all Ret instructions. 47259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void visitReturnInst(ReturnInst &RI) { 47359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov RetVec.push_back(&RI); 47459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 47559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 47659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov /// \brief Collect Alloca instructions we want (and can) handle. 47759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void visitAllocaInst(AllocaInst &AI) { 4781c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (!isInterestingAlloca(AI)) return; 47959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 48059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov StackAlignment = std::max(StackAlignment, AI.getAlignment()); 48159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AllocaVec.push_back(&AI); 482d4429214a2dffcfd8f97956ac8b1a67c4795d242Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(&AI); 48359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov TotalStackSize += AlignedSize; 48459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 48559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 4861c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov /// \brief Collect lifetime intrinsic calls to check for use-after-scope 4871c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov /// errors. 4881c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov void visitIntrinsicInst(IntrinsicInst &II) { 4891c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (!ASan.CheckLifetime) return; 4901c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Intrinsic::ID ID = II.getIntrinsicID(); 4911c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (ID != Intrinsic::lifetime_start && 4921c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov ID != Intrinsic::lifetime_end) 4931c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return; 4941c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Found lifetime intrinsic, add ASan instrumentation if necessary. 4951c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov ConstantInt *Size = dyn_cast<ConstantInt>(II.getArgOperand(0)); 4961c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // If size argument is undefined, don't do anything. 4971c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (Size->isMinusOne()) return; 4981c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Check that size doesn't saturate uint64_t and can 4991c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // be stored in IntptrTy. 5001c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov const uint64_t SizeValue = Size->getValue().getLimitedValue(); 5011c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (SizeValue == ~0ULL || 5021c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov !ConstantInt::isValueValidForType(IntptrTy, SizeValue)) 5031c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return; 5041c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Find alloca instruction that corresponds to llvm.lifetime argument. 5051c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaInst *AI = findAllocaForValue(II.getArgOperand(1)); 5061c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (!AI) return; 5071c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov bool DoPoison = (ID == Intrinsic::lifetime_end); 50864409ad8e3b360b84349042f14b57f87a5c0ca18Alexey Samsonov AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison}; 5091c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaPoisonCallVec.push_back(APC); 5101c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov } 5111c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 51259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // ---------------------- Helpers. 51359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov void initializeCallbacks(Module &M); 51459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 5151c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Check if we want (and can) handle this alloca. 5164c71064129d1e5def34d74ee47c4f3beaa0a66dfJakub Staszak bool isInterestingAlloca(AllocaInst &AI) const { 5171c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return (!AI.isArrayAllocation() && 5181c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AI.isStaticAlloca() && 519d4429214a2dffcfd8f97956ac8b1a67c4795d242Kostya Serebryany AI.getAlignment() <= RedzoneSize() && 5201c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AI.getAllocatedType()->isSized()); 5211c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov } 5221c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 52319cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t RedzoneSize() const { 52419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov return RedzoneSizeForScale(Mapping.Scale); 52519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov } 5264c71064129d1e5def34d74ee47c4f3beaa0a66dfJakub Staszak uint64_t getAllocaSizeInBytes(AllocaInst *AI) const { 52759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Type *Ty = AI->getAllocatedType(); 52859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t SizeInBytes = ASan.TD->getTypeAllocSize(Ty); 52959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return SizeInBytes; 53059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 5314c71064129d1e5def34d74ee47c4f3beaa0a66dfJakub Staszak uint64_t getAlignedSize(uint64_t SizeInBytes) const { 53259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov size_t RZ = RedzoneSize(); 53359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return ((SizeInBytes + RZ - 1) / RZ) * RZ; 53459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 5354c71064129d1e5def34d74ee47c4f3beaa0a66dfJakub Staszak uint64_t getAlignedAllocaSize(AllocaInst *AI) const { 53659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 53759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return getAlignedSize(SizeInBytes); 53859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 5391c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov /// Finds alloca where the value comes from. 5401c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaInst *findAllocaForValue(Value *V); 5414c71064129d1e5def34d74ee47c4f3beaa0a66dfJakub Staszak void poisonRedZones(const ArrayRef<AllocaInst*> &AllocaVec, IRBuilder<> &IRB, 54259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Value *ShadowBase, bool DoPoison); 5434c71064129d1e5def34d74ee47c4f3beaa0a66dfJakub Staszak void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison); 544671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany 545671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany void SetShadowToStackAfterReturnInlined(IRBuilder<> &IRB, Value *ShadowBase, 546671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany int Size); 54759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov}; 54859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 549800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} // namespace 550800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 551800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanychar AddressSanitizer::ID = 0; 552800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyINITIALIZE_PASS(AddressSanitizer, "asan", 553800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", 554800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany false, false) 555ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey SamsonovFunctionPass *llvm::createAddressSanitizerFunctionPass( 556b0dcf61252e58715a3bea79f4c112572df361c30Alexey Samsonov bool CheckInitOrder, bool CheckUseAfterReturn, bool CheckLifetime, 55711af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov StringRef BlacklistFile, bool ZeroBaseShadow) { 558ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov return new AddressSanitizer(CheckInitOrder, CheckUseAfterReturn, 55911af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov CheckLifetime, BlacklistFile, ZeroBaseShadow); 560800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 561800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 5621416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanychar AddressSanitizerModule::ID = 0; 5631416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya SerebryanyINITIALIZE_PASS(AddressSanitizerModule, "asan-module", 5641416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany "AddressSanitizer: detects use-after-free and out-of-bounds bugs." 5651416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany "ModulePass", false, false) 566b0dcf61252e58715a3bea79f4c112572df361c30Alexey SamsonovModulePass *llvm::createAddressSanitizerModulePass( 56711af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov bool CheckInitOrder, StringRef BlacklistFile, bool ZeroBaseShadow) { 56811af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov return new AddressSanitizerModule(CheckInitOrder, BlacklistFile, 56911af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov ZeroBaseShadow); 57025878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko} 57125878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko 5722735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryanystatic size_t TypeSizeToSizeIndex(uint32_t TypeSize) { 573c6af2432c802d241c8fffbe0371c023e6c58844eMichael J. Spencer size_t Res = countTrailingZeros(TypeSize / 8); 5742735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany assert(Res < kNumberOfAccessSizes); 5752735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany return Res; 5762735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany} 5772735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany 57855a1a590bf0cadf88dfbef2aab6948ffec35c1c3Bill Wendling// \brief Create a constant for Str so that we can pass it to the run-time lib. 579800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic GlobalVariable *createPrivateGlobalForString(Module &M, StringRef Str) { 58018c7f80b3e83ab584bd8572695a3cde8bafd9d3cChris Lattner Constant *StrConst = ConstantDataArray::getString(M.getContext(), Str); 5815111627ac1b0ae8a5a9d4dc1be8b22939ba850d0Kostya Serebryany GlobalVariable *GV = new GlobalVariable(M, StrConst->getType(), true, 58255a1a590bf0cadf88dfbef2aab6948ffec35c1c3Bill Wendling GlobalValue::InternalLinkage, StrConst, 58351c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany kAsanGenPrefix); 5845111627ac1b0ae8a5a9d4dc1be8b22939ba850d0Kostya Serebryany GV->setUnnamedAddr(true); // Ok to merge these. 5855111627ac1b0ae8a5a9d4dc1be8b22939ba850d0Kostya Serebryany GV->setAlignment(1); // Strings may not be merged w/o setting align 1. 5865111627ac1b0ae8a5a9d4dc1be8b22939ba850d0Kostya Serebryany return GV; 58751c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany} 58851c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany 58951c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryanystatic bool GlobalWasGeneratedByAsan(GlobalVariable *G) { 59051c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany return G->getName().find(kAsanGenPrefix) == 0; 591800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 592800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 593800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyValue *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { 594800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Shadow >> scale 59519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov Shadow = IRB.CreateLShr(Shadow, Mapping.Scale); 59619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov if (Mapping.Offset == 0) 597800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return Shadow; 598800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // (Shadow >> scale) | offset 59948a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany if (Mapping.OrShadowOffset) 60048a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany return IRB.CreateOr(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset)); 60148a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany else 60248a615fee78c3c262c60147a65dc6fff5fd6bb3bKostya Serebryany return IRB.CreateAdd(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset)); 603800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 604800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 605c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanyvoid AddressSanitizer::instrumentMemIntrinsicParam( 606ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany Instruction *OrigIns, 607800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr, Value *Size, Instruction *InsertBefore, bool IsWrite) { 6086ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany IRBuilder<> IRB(InsertBefore); 6096ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany if (Size->getType() != IntptrTy) 6106ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Size = IRB.CreateIntCast(Size, IntptrTy, false); 611800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the first byte. 6126ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany instrumentAddress(OrigIns, InsertBefore, Addr, 8, IsWrite, Size); 613800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the last byte. 6146ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany IRB.SetInsertPoint(InsertBefore); 6156ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Value *SizeMinusOne = IRB.CreateSub(Size, ConstantInt::get(IntptrTy, 1)); 6166ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 6176ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Value *AddrLast = IRB.CreateAdd(AddrLong, SizeMinusOne); 6186ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany instrumentAddress(OrigIns, InsertBefore, AddrLast, 8, IsWrite, Size); 619800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 620800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 621800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Instrument memset/memmove/memcpy 622ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanybool AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { 623800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Dst = MI->getDest(); 624800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MemTransferInst *MemTran = dyn_cast<MemTransferInst>(MI); 6252735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany Value *Src = MemTran ? MemTran->getSource() : 0; 626800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Length = MI->getLength(); 627800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 628800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *ConstLength = dyn_cast<Constant>(Length); 629800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore = MI; 630800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength) { 631800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength->isNullValue()) return false; 632800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 633800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // The size is not a constant so it could be zero -- check at run-time. 634800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 635800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 636800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(Length, 63756139bc493790612ee6281630678e293be6b2eb2Kostya Serebryany Constant::getNullValue(Length->getType())); 6384a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov InsertBefore = SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), false); 639800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 640800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 641ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMemIntrinsicParam(MI, Dst, Length, InsertBefore, true); 642800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (Src) 643ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMemIntrinsicParam(MI, Src, Length, InsertBefore, false); 644800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 645800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 646800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 647e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany// If I is an interesting memory access, return the PointerOperand 648e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany// and set IsWrite. Otherwise return NULL. 649e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryanystatic Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite) { 650800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 651e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentReads) return NULL; 652e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = false; 653800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return LI->getPointerOperand(); 654800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 655e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (StoreInst *SI = dyn_cast<StoreInst>(I)) { 656e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentWrites) return NULL; 657e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 658e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return SI->getPointerOperand(); 659e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 660e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { 661e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentAtomics) return NULL; 662e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 663e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return RMW->getPointerOperand(); 664e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 665e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { 666e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentAtomics) return NULL; 667e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 668e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return XCHG->getPointerOperand(); 669e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 670e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return NULL; 671800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 672800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 6733386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryanybool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) { 6743386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany // If a global variable does not have dynamic initialization we don't 6753386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany // have to instrument it. However, if a global does not have initializer 6763386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany // at all, we assume it has dynamic initializer (in other TU). 6773386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany return G->hasInitializer() && !DynamicallyInitializedGlobals.Contains(G); 6783386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany} 6793386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany 680ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanyvoid AddressSanitizer::instrumentMop(Instruction *I) { 6813780ad8b998d93d7db406919c06137cdb786ef05Axel Naumann bool IsWrite = false; 682e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany Value *Addr = isInterestingMemoryAccess(I, &IsWrite); 683e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany assert(Addr); 6849b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (ClOpt && ClOptGlobals) { 6859b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (GlobalVariable *G = dyn_cast<GlobalVariable>(Addr)) { 6869b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // If initialization order checking is disabled, a simple access to a 6879b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // dynamically initialized global is always valid. 6883386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany if (!CheckInitOrder || GlobalIsLinkerInitialized(G)) { 6893386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany NumOptimizedAccessesToGlobalVar++; 6909b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return; 6913386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany } 6923386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany } 6933386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany ConstantExpr *CE = dyn_cast<ConstantExpr>(Addr); 6943386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany if (CE && CE->isGEPWithNoNotionalOverIndexing()) { 6953386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany if (GlobalVariable *G = dyn_cast<GlobalVariable>(CE->getOperand(0))) { 6963386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany if (CE->getOperand(1)->isNullValue() && GlobalIsLinkerInitialized(G)) { 6973386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany NumOptimizedAccessesToGlobalArray++; 6983386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany return; 6993386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany } 7003386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany } 7019b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 702800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 7039b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 704800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigPtrTy = Addr->getType(); 705800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigTy = cast<PointerType>(OrigPtrTy)->getElementType(); 706800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 707800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(OrigTy->isSized()); 708605ff6655b31033dde21e61416751847bd0ee201Kostya Serebryany uint32_t TypeSize = TD->getTypeStoreSizeInBits(OrigTy); 709800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 7106ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany assert((TypeSize % 8) == 0); 711800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 7123386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany if (IsWrite) 7133386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany NumInstrumentedWrites++; 7143386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany else 7153386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany NumInstrumentedReads++; 7163386d252579ea00d0fc26a3ba7874bec25ce4516Kostya Serebryany 7176ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check. 7186ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany if (TypeSize == 8 || TypeSize == 16 || 7196ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany TypeSize == 32 || TypeSize == 64 || TypeSize == 128) 7206ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany return instrumentAddress(I, I, Addr, TypeSize, IsWrite, 0); 7216ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany // Instrument unusual size (but still multiple of 8). 7226ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany // We can not do it with a single check, so we do 1-byte check for the first 7236ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able 7246ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany // to report the actual access size. 725800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(I); 7266ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Value *LastByte = IRB.CreateIntToPtr( 7276ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany IRB.CreateAdd(IRB.CreatePointerCast(Addr, IntptrTy), 7286ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany ConstantInt::get(IntptrTy, TypeSize / 8 - 1)), 7296ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany OrigPtrTy); 7306ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8); 7316ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany instrumentAddress(I, I, Addr, 8, IsWrite, Size); 7326ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany instrumentAddress(I, I, LastByte, 8, IsWrite, Size); 733800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 734800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 73555cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// Validate the result of Module::getOrInsertFunction called for an interface 73655cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// function of AddressSanitizer. If the instrumented module defines a function 73755cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// with the same name, their prototypes must match, otherwise 73855cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// getOrInsertFunction returns a bitcast. 739b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryanystatic Function *checkInterfaceFunction(Constant *FuncOrBitcast) { 74055cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko if (isa<Function>(FuncOrBitcast)) return cast<Function>(FuncOrBitcast); 74155cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko FuncOrBitcast->dump(); 74255cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko report_fatal_error("trying to redefine an AddressSanitizer " 74355cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko "interface function"); 74455cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko} 74555cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko 746800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyInstruction *AddressSanitizer::generateCrashCode( 747ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Instruction *InsertBefore, Value *Addr, 7486ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany bool IsWrite, size_t AccessSizeIndex, Value *SizeArgument) { 749ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany IRBuilder<> IRB(InsertBefore); 7506ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany CallInst *Call = SizeArgument 7516ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany ? IRB.CreateCall2(AsanErrorCallbackSized[IsWrite], Addr, SizeArgument) 7526ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany : IRB.CreateCall(AsanErrorCallback[IsWrite][AccessSizeIndex], Addr); 7536ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany 754f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // We don't do Call->setDoesNotReturn() because the BB already has 755f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // UnreachableInst at the end. 756f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // This EmptyAsm is required to avoid callback merge. 757f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany IRB.CreateCall(EmptyAsm); 7583c7faae346f548c55cad86d82a2e242443001f23Kostya Serebryany return Call; 759800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 760800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 7612735cf4aa52e31b8d2de90f836c3ad991215e04eKostya SerebryanyValue *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 762c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *ShadowValue, 763c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany uint32_t TypeSize) { 76419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t Granularity = 1 << Mapping.Scale; 765c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // Addr & (Granularity - 1) 766c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *LastAccessedByte = IRB.CreateAnd( 767c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); 768c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // (Addr & (Granularity - 1)) + size - 1 769c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany if (TypeSize / 8 > 1) 770c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte = IRB.CreateAdd( 771c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); 772c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // (uint8_t) ((Addr & (Granularity-1)) + size - 1) 773c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte = IRB.CreateIntCast( 7746e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany LastAccessedByte, ShadowValue->getType(), false); 775c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue 776c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); 777c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany} 778c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 779ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanyvoid AddressSanitizer::instrumentAddress(Instruction *OrigIns, 7806ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Instruction *InsertBefore, 7816ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Value *Addr, uint32_t TypeSize, 7826ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany bool IsWrite, Value *SizeArgument) { 7836ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany IRBuilder<> IRB(InsertBefore); 784800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 785800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 786800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowTy = IntegerType::get( 78719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov *C, std::max(8U, TypeSize >> Mapping.Scale)); 788800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); 789800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowPtr = memToShadow(AddrLong, IRB); 790800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *CmpVal = Constant::getNullValue(ShadowTy); 791800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowValue = IRB.CreateLoad( 792800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); 793800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 794800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); 79511c2a47af825a0f89d75aaa97ad873ed2acef266Kostya Serebryany size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); 79619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t Granularity = 1 << Mapping.Scale; 797ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany TerminatorInst *CrashTerm = 0; 798ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany 7996e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) { 8004a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov TerminatorInst *CheckTerm = 8014a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), false); 802ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany assert(dyn_cast<BranchInst>(CheckTerm)->isUnconditional()); 803f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany BasicBlock *NextBB = CheckTerm->getSuccessor(0); 804c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany IRB.SetInsertPoint(CheckTerm); 805c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); 806ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany BasicBlock *CrashBlock = 807ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany BasicBlock::Create(*C, "", NextBB->getParent(), NextBB); 808ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany CrashTerm = new UnreachableInst(*C, CrashBlock); 809f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); 810f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany ReplaceInstWithInst(CheckTerm, NewTerm); 811c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany } else { 8124a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov CrashTerm = SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), true); 813800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 814ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany 8156ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany Instruction *Crash = generateCrashCode( 8166ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany CrashTerm, AddrLong, IsWrite, AccessSizeIndex, SizeArgument); 817ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Crash->setDebugLoc(OrigIns->getDebugLoc()); 818800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 819800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 8201416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanyvoid AddressSanitizerModule::createInitializerPoisonCalls( 821ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov Module &M, GlobalValue *ModuleName) { 8229b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // We do all of our poisoning and unpoisoning within _GLOBAL__I_a. 8239b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Function *GlobalInit = M.getFunction("_GLOBAL__I_a"); 8249b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // If that function is not present, this TU contains no globals, or they have 8259b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // all been optimized away 8269b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (!GlobalInit) 8279b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return; 8289b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 8299b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Set up the arguments to our poison/unpoison functions. 8309b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IRBuilder<> IRB(GlobalInit->begin()->getFirstInsertionPt()); 8319b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 8329b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Add a call to poison all external globals before the given function starts. 833ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy); 834ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr); 8359b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 8369b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Add calls to unpoison all globals before each return instruction. 8379b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany for (Function::iterator I = GlobalInit->begin(), E = GlobalInit->end(); 8389b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany I != E; ++I) { 8399b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (ReturnInst *RI = dyn_cast<ReturnInst>(I->getTerminator())) { 8409b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany CallInst::Create(AsanUnpoisonGlobals, "", RI); 8419b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 8429b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 8439b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany} 8449b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 8451416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanybool AddressSanitizerModule::ShouldInstrumentGlobal(GlobalVariable *G) { 8469b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Type *Ty = cast<PointerType>(G->getType())->getElementType(); 847324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "GLOBAL: " << *G << "\n"); 8489b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 84959a4a47a7bea7cc17877c6a3954ad9f8309ff1cbKostya Serebryany if (BL->isIn(*G)) return false; 8509b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (!Ty->isSized()) return false; 8519b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (!G->hasInitializer()) return false; 85251c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany if (GlobalWasGeneratedByAsan(G)) return false; // Our own global. 8539b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Touch only those globals that will not be defined in other modules. 8549b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Don't handle ODR type linkages since other modules may be built w/o asan. 8559b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (G->getLinkage() != GlobalVariable::ExternalLinkage && 8569b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany G->getLinkage() != GlobalVariable::PrivateLinkage && 8579b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany G->getLinkage() != GlobalVariable::InternalLinkage) 8589b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 8599b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Two problems with thread-locals: 8609b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // - The address of the main thread's copy can't be computed at link-time. 8619b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // - Need to poison all copies, not just the main thread's one. 8629b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (G->isThreadLocal()) 8639b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 8649b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // For now, just ignore this Alloca if the alignment is large. 865b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany if (G->getAlignment() > RedzoneSize()) return false; 8669b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 8679b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Ignore all the globals with the names starting with "\01L_OBJC_". 8689b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Many of those are put into the .cstring section. The linker compresses 8699b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // that section by removing the spare \0s after the string terminator, so 8709b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // our redzones get broken. 8719b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if ((G->getName().find("\01L_OBJC_") == 0) || 8729b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany (G->getName().find("\01l_OBJC_") == 0)) { 8739b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany DEBUG(dbgs() << "Ignoring \\01L_OBJC_* global: " << *G); 8749b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 8759b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 8769b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 8779b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (G->hasSection()) { 8789b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany StringRef Section(G->getSection()); 8799b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Ignore the globals from the __OBJC section. The ObjC runtime assumes 8809b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to 8819b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // them. 8829b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if ((Section.find("__OBJC,") == 0) || 8839b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany (Section.find("__DATA, __objc_") == 0)) { 8849b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G); 8859b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 8869b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 8879b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // See http://code.google.com/p/address-sanitizer/issues/detail?id=32 8889b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Constant CFString instances are compiled in the following way: 8899b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // -- the string buffer is emitted into 8909b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // __TEXT,__cstring,cstring_literals 8919b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // -- the constant NSConstantString structure referencing that buffer 8929b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // is placed into __DATA,__cfstring 8939b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Therefore there's no point in placing redzones into __DATA,__cfstring. 8949b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Moreover, it causes the linker to crash on OS X 10.7 8959b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (Section.find("__DATA,__cfstring") == 0) { 8969b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany DEBUG(dbgs() << "Ignoring CFString: " << *G); 8979b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 8989b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 8999b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 9009b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 9019b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return true; 9029b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany} 9039b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 9044684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonovvoid AddressSanitizerModule::initializeCallbacks(Module &M) { 9054684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov IRBuilder<> IRB(*C); 9064684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov // Declare our poisoning and unpoisoning functions. 9074684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanPoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction( 908ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy, NULL)); 9094684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanPoisonGlobals->setLinkage(Function::ExternalLinkage); 9104684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanUnpoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction( 9114684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov kAsanUnpoisonGlobalsName, IRB.getVoidTy(), NULL)); 9124684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanUnpoisonGlobals->setLinkage(Function::ExternalLinkage); 9134684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov // Declare functions that register/unregister globals. 9144684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanRegisterGlobals = checkInterfaceFunction(M.getOrInsertFunction( 9154684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov kAsanRegisterGlobalsName, IRB.getVoidTy(), 9164684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov IntptrTy, IntptrTy, NULL)); 9174684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanRegisterGlobals->setLinkage(Function::ExternalLinkage); 9184684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanUnregisterGlobals = checkInterfaceFunction(M.getOrInsertFunction( 9194684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov kAsanUnregisterGlobalsName, 9204684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 9214684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage); 9224684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov} 9234684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov 924800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This function replaces all global variables with new variables that have 925800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// trailing redzones. It also creates a function that poisons 926800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// redzones and inserts this function into llvm.global_ctors. 9271416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanybool AddressSanitizerModule::runOnModule(Module &M) { 9281416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany if (!ClGlobals) return false; 9291416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany TD = getAnalysisIfAvailable<DataLayout>(); 9301416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany if (!TD) 9311416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany return false; 932e39e1316f034e9932cb8da535541a3e35a0e490aAlexey Samsonov BL.reset(SpecialCaseList::createOrDie(BlacklistFile)); 933d6f62c8da5aa4f3388cec1542309ffa623cac601Alexey Samsonov if (BL->isIn(M)) return false; 934b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany C = &(M.getContext()); 93519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov int LongSize = TD->getPointerSizeInBits(); 93619cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov IntptrTy = Type::getIntNTy(*C, LongSize); 93711af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov Mapping = getShadowMapping(M, LongSize, ZeroBaseShadow); 9384684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov initializeCallbacks(M); 9394684858624d7ffe82379783e9b678227d5e0b515Alexey Samsonov DynamicallyInitializedGlobals.Init(M); 940b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 941800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<GlobalVariable *, 16> GlobalsToChange; 942800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 9439b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany for (Module::GlobalListType::iterator G = M.global_begin(), 9449b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany E = M.global_end(); G != E; ++G) { 9459b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (ShouldInstrumentGlobal(G)) 9469b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany GlobalsToChange.push_back(G); 947800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 948800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 949800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t n = GlobalsToChange.size(); 950800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (n == 0) return false; 951800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 952800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A global is described by a structure 953800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t beg; 954800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size; 955800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size_with_redzone; 956800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // const char *name; 957086a472dbed9911f83add781e020cb49c89829d0Kostya Serebryany // const char *module_name; 9589b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // size_t has_dynamic_init; 959800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We initialize an array of such structures and pass it to a run-time call. 960800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *GlobalStructTy = StructType::get(IntptrTy, IntptrTy, 9619b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IntptrTy, IntptrTy, 962086a472dbed9911f83add781e020cb49c89829d0Kostya Serebryany IntptrTy, IntptrTy, NULL); 9638819c84aed10777ba91d4e862229882b8da0b272Rafael Espindola SmallVector<Constant *, 16> Initializers(n); 964b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 965b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Function *CtorFunc = M.getFunction(kAsanModuleCtorName); 966b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany assert(CtorFunc); 967b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany IRBuilder<> IRB(CtorFunc->getEntryBlock().getTerminator()); 968800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 969ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov bool HasDynamicallyInitializedGlobals = false; 9709b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 971086a472dbed9911f83add781e020cb49c89829d0Kostya Serebryany GlobalVariable *ModuleName = createPrivateGlobalForString( 972086a472dbed9911f83add781e020cb49c89829d0Kostya Serebryany M, M.getModuleIdentifier()); 973ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov // We shouldn't merge same module names, as this string serves as unique 974ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov // module ID in runtime. 975ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov ModuleName->setUnnamedAddr(false); 976086a472dbed9911f83add781e020cb49c89829d0Kostya Serebryany 977800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0; i < n; i++) { 97829f975f8ffda1f5d78cbf2530c2316abef11aa70Kostya Serebryany static const uint64_t kMaxGlobalRedzone = 1 << 18; 979800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *G = GlobalsToChange[i]; 980800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PointerType *PtrTy = cast<PointerType>(G->getType()); 981800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = PtrTy->getElementType(); 982208a4ff2b56f453910bb817540f34b8169f7702aKostya Serebryany uint64_t SizeInBytes = TD->getTypeAllocSize(Ty); 98329f975f8ffda1f5d78cbf2530c2316abef11aa70Kostya Serebryany uint64_t MinRZ = RedzoneSize(); 98463f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany // MinRZ <= RZ <= kMaxGlobalRedzone 98563f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany // and trying to make RZ to be ~ 1/4 of SizeInBytes. 98629f975f8ffda1f5d78cbf2530c2316abef11aa70Kostya Serebryany uint64_t RZ = std::max(MinRZ, 98763f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany std::min(kMaxGlobalRedzone, 98863f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany (SizeInBytes / MinRZ / 4) * MinRZ)); 98963f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany uint64_t RightRedzoneSize = RZ; 99063f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany // Round up to MinRZ 99163f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany if (SizeInBytes % MinRZ) 99263f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany RightRedzoneSize += MinRZ - (SizeInBytes % MinRZ); 99363f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany assert(((RightRedzoneSize + SizeInBytes) % MinRZ) == 0); 994800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); 9959b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Determine whether this global should be poisoned in initialization. 996ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany bool GlobalHasDynamicInitializer = 997ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany DynamicallyInitializedGlobals.Contains(G); 99859a4a47a7bea7cc17877c6a3954ad9f8309ff1cbKostya Serebryany // Don't check initialization order if this global is blacklisted. 99946e11c4c97fe1c424241e4098801456303a5c86ePeter Collingbourne GlobalHasDynamicInitializer &= !BL->isIn(*G, "init"); 1000800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1001800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *NewTy = StructType::get(Ty, RightRedZoneTy, NULL); 1002800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *NewInitializer = ConstantStruct::get( 1003800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewTy, G->getInitializer(), 1004800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant::getNullValue(RightRedZoneTy), NULL); 1005800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1006086a472dbed9911f83add781e020cb49c89829d0Kostya Serebryany GlobalVariable *Name = createPrivateGlobalForString(M, G->getName()); 1007800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1008800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Create a new global variable with enough space for a redzone. 100955a1a590bf0cadf88dfbef2aab6948ffec35c1c3Bill Wendling GlobalValue::LinkageTypes Linkage = G->getLinkage(); 101055a1a590bf0cadf88dfbef2aab6948ffec35c1c3Bill Wendling if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage) 101155a1a590bf0cadf88dfbef2aab6948ffec35c1c3Bill Wendling Linkage = GlobalValue::InternalLinkage; 1012800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *NewGlobal = new GlobalVariable( 101355a1a590bf0cadf88dfbef2aab6948ffec35c1c3Bill Wendling M, NewTy, G->isConstant(), Linkage, 1014ce718ff9f42c7da092eaa01dd0242e8d5ba84713Hans Wennborg NewInitializer, "", G, G->getThreadLocalMode()); 1015800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->copyAttributesFrom(G); 101663f0846f1eb43332a08811d332b813276b727eb6Kostya Serebryany NewGlobal->setAlignment(MinRZ); 1017800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1018800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Indices2[2]; 1019800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[0] = IRB.getInt32(0); 1020800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[1] = IRB.getInt32(0); 1021800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1022800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->replaceAllUsesWith( 1023f1639abf1aaba1448f719f595156cd0f4cd560ccKostya Serebryany ConstantExpr::getGetElementPtr(NewGlobal, Indices2, true)); 1024800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->takeName(G); 1025800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->eraseFromParent(); 1026800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1027800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Initializers[i] = ConstantStruct::get( 1028800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalStructTy, 1029800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(NewGlobal, IntptrTy), 1030800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes), 1031800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), 1032800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(Name, IntptrTy), 1033086a472dbed9911f83add781e020cb49c89829d0Kostya Serebryany ConstantExpr::getPointerCast(ModuleName, IntptrTy), 10349b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany ConstantInt::get(IntptrTy, GlobalHasDynamicInitializer), 1035800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NULL); 10369b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 10379b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Populate the first and last globals declared in this TU. 1038ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov if (CheckInitOrder && GlobalHasDynamicInitializer) 1039ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov HasDynamicallyInitializedGlobals = true; 10409b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 1041324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n"); 1042800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1043800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1044800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ArrayType *ArrayOfGlobalStructTy = ArrayType::get(GlobalStructTy, n); 1045800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *AllGlobals = new GlobalVariable( 104655a1a590bf0cadf88dfbef2aab6948ffec35c1c3Bill Wendling M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage, 1047800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantArray::get(ArrayOfGlobalStructTy, Initializers), ""); 1048800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 10499b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Create calls for poisoning before initializers run and unpoisoning after. 1050ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov if (CheckInitOrder && HasDynamicallyInitializedGlobals) 1051ca825ea24de2f3d819845ee01796dc6c7a45170dAlexey Samsonov createInitializerPoisonCalls(M, ModuleName); 1052800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateCall2(AsanRegisterGlobals, 1053800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 1054800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, n)); 1055800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 10567bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // We also need to unregister globals at the end, e.g. when a shared library 10577bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // gets closed. 10587bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany Function *AsanDtorFunction = Function::Create( 10597bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 10607bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany GlobalValue::InternalLinkage, kAsanModuleDtorName, &M); 10617bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); 10627bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRBuilder<> IRB_Dtor(ReturnInst::Create(*C, AsanDtorBB)); 10637bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB_Dtor.CreateCall2(AsanUnregisterGlobals, 10647bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 10657bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany ConstantInt::get(IntptrTy, n)); 10667bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndCtorPriority); 10677bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany 1068800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << M); 1069800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 1070800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1071800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 10728b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryanyvoid AddressSanitizer::initializeCallbacks(Module &M) { 10738b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IRBuilder<> IRB(*C); 10749db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // Create __asan_report* callbacks. 10759db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { 10769db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; 10779db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany AccessSizeIndex++) { 10789db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // IsWrite and TypeSize are encoded in the function name. 10799db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany std::string FunctionName = std::string(kAsanReportErrorTemplate) + 10809db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany (AccessIsWrite ? "store" : "load") + itostr(1 << AccessSizeIndex); 10814f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // If we are merging crash callbacks, they have two parameters. 10827846c1c851a53a8280f9d8ed57cd98d82c742551Kostya Serebryany AsanErrorCallback[AccessIsWrite][AccessSizeIndex] = 10837846c1c851a53a8280f9d8ed57cd98d82c742551Kostya Serebryany checkInterfaceFunction(M.getOrInsertFunction( 10847846c1c851a53a8280f9d8ed57cd98d82c742551Kostya Serebryany FunctionName, IRB.getVoidTy(), IntptrTy, NULL)); 10859db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany } 10869db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany } 10876ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany AsanErrorCallbackSized[0] = checkInterfaceFunction(M.getOrInsertFunction( 10886ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany kAsanReportLoadN, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 10896ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany AsanErrorCallbackSized[1] = checkInterfaceFunction(M.getOrInsertFunction( 10906ecccdbb2bf24a011b9c8ecbdd39be5a02269670Kostya Serebryany kAsanReportStoreN, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 1091ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany 1092ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany AsanHandleNoReturnFunc = checkInterfaceFunction(M.getOrInsertFunction( 1093ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany kAsanHandleNoReturnName, IRB.getVoidTy(), NULL)); 10944b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson AsanCovFunction = checkInterfaceFunction(M.getOrInsertFunction( 10954b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson kAsanCovName, IRB.getVoidTy(), IntptrTy, NULL)); 1096f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // We insert an empty inline asm after __asan_report* to avoid callback merge. 1097f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 1098f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany StringRef(""), StringRef(""), 1099f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany /*hasSideEffects=*/true); 11008b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany} 11018b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 110219cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonovvoid AddressSanitizer::emitShadowMapping(Module &M, IRBuilder<> &IRB) const { 110311af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov // Tell the values of mapping offset and scale to the run-time. 110411af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov GlobalValue *asan_mapping_offset = 110511af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 110611af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov ConstantInt::get(IntptrTy, Mapping.Offset), 110711af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov kAsanMappingOffsetName); 110811af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov // Read the global, otherwise it may be optimized away. 110911af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov IRB.CreateLoad(asan_mapping_offset, true); 111011af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov 111111af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov GlobalValue *asan_mapping_scale = 111211af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 111311af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov ConstantInt::get(IntptrTy, Mapping.Scale), 111411af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov kAsanMappingScaleName); 111511af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov // Read the global, otherwise it may be optimized away. 111611af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov IRB.CreateLoad(asan_mapping_scale, true); 111719cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov} 111819cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 11198b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany// virtual 11208b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryanybool AddressSanitizer::doInitialization(Module &M) { 11218b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany // Initialize the private fields. No one has accessed them before. 11228b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany TD = getAnalysisIfAvailable<DataLayout>(); 11238b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 11248b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany if (!TD) 11258b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany return false; 1126e39e1316f034e9932cb8da535541a3e35a0e490aAlexey Samsonov BL.reset(SpecialCaseList::createOrDie(BlacklistFile)); 11278b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany DynamicallyInitializedGlobals.Init(M); 11288b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 11298b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany C = &(M.getContext()); 11308b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany LongSize = TD->getPointerSizeInBits(); 11318b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IntptrTy = Type::getIntNTy(*C, LongSize); 11328b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 11338b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany AsanCtorFunction = Function::Create( 11348b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 11358b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany GlobalValue::InternalLinkage, kAsanModuleCtorName, &M); 11368b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany BasicBlock *AsanCtorBB = BasicBlock::Create(*C, "", AsanCtorFunction); 11378b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany // call __asan_init in the module ctor. 11388b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IRBuilder<> IRB(ReturnInst::Create(*C, AsanCtorBB)); 11398b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany AsanInitFunction = checkInterfaceFunction( 11408b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany M.getOrInsertFunction(kAsanInitName, IRB.getVoidTy(), NULL)); 11418b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany AsanInitFunction->setLinkage(Function::ExternalLinkage); 11428b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IRB.CreateCall(AsanInitFunction); 11439db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany 114411af9a873f9e1409a422ab31e22729368805afafAlexey Samsonov Mapping = getShadowMapping(M, LongSize, ZeroBaseShadow); 114519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov emitShadowMapping(M, IRB); 1146800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 11477bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndCtorPriority); 1148ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany return true; 1149ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany} 1150ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany 1151a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryanybool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { 1152a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // For each NSObject descendant having a +load method, this method is invoked 1153a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // by the ObjC runtime before any of the static constructors is called. 1154a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // Therefore we need to instrument such methods with a call to __asan_init 1155a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // at the beginning in order to initialize our runtime before any access to 1156a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // the shadow memory. 1157a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // We cannot just ignore these methods, because they may call other 1158a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // instrumented functions. 1159a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany if (F.getName().find(" load]") != std::string::npos) { 1160a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany IRBuilder<> IRB(F.begin()->begin()); 1161a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany IRB.CreateCall(AsanInitFunction); 1162a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany return true; 1163a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany } 1164a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany return false; 1165a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany} 1166a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 11674b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// Poor man's coverage that works with ASan. 11684b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// We create a Guard boolean variable with the same linkage 11694b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// as the function and inject this code into the entry block: 11704b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// if (*Guard) { 11714b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// __sanitizer_cov(&F); 11724b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// *Guard = 1; 11734b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// } 11744b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// The accesses to Guard are atomic. The rest of the logic is 11754b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// in __sanitizer_cov (it's fine to call it more than once). 11764b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// 11774b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// This coverage implementation provides very limited data: 11784b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// it only tells if a given function was ever executed. 11794b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// No counters, no per-basic-block or per-edge data. 11804b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// But for many use cases this is what we need and the added slowdown 11814b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// is negligible. This simple implementation will probably be obsoleted 11824b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// by the upcoming Clang-based coverage implementation. 11834b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// By having it here and now we hope to 11844b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// a) get the functionality to users earlier and 11854b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson// b) collect usage statistics to help improve Clang coverage design. 11864b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilsonbool AddressSanitizer::InjectCoverage(Function &F) { 11874b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson if (!ClCoverage) return false; 11884b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson IRBuilder<> IRB(F.getEntryBlock().getFirstInsertionPt()); 11894b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson Type *Int8Ty = IRB.getInt8Ty(); 11904b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson GlobalVariable *Guard = new GlobalVariable( 11918f15c6822251bbe7eb21732c46aa6d9f30ba8836Kostya Serebryany *F.getParent(), Int8Ty, false, GlobalValue::PrivateLinkage, 11924b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson Constant::getNullValue(Int8Ty), "__asan_gen_cov_" + F.getName()); 11934b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson LoadInst *Load = IRB.CreateLoad(Guard); 11944b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson Load->setAtomic(Monotonic); 11954b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson Load->setAlignment(1); 11964b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson Value *Cmp = IRB.CreateICmpEQ(Constant::getNullValue(Int8Ty), Load); 11974b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson Instruction *Ins = SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), false); 11984b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson IRB.SetInsertPoint(Ins); 11994b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson // We pass &F to __sanitizer_cov. We could avoid this and rely on 12004b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson // GET_CALLER_PC, but having the PC of the first instruction is just nice. 12014b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson IRB.CreateCall(AsanCovFunction, IRB.CreatePointerCast(&F, IntptrTy)); 12024b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson StoreInst *Store = IRB.CreateStore(ConstantInt::get(Int8Ty, 1), Guard); 12034b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson Store->setAtomic(Monotonic); 12044b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson Store->setAlignment(1); 12054b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson return true; 12064b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson} 12074b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson 1208ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanybool AddressSanitizer::runOnFunction(Function &F) { 1209800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (BL->isIn(F)) return false; 1210800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (&F == AsanCtorFunction) return false; 12113797adb94fdc6b747cb0e97a64b15b931f2533b8Kostya Serebryany if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false; 1212324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n"); 12138b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany initializeCallbacks(*F.getParent()); 1214a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 12158eec41fc778e99d42172a7f6de76faa43a6d8847Kostya Serebryany // If needed, insert __asan_init before checking for SanitizeAddress attr. 1216a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany maybeInsertAsanInitAtFunctionEntry(F); 1217a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 121820985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany if (!F.hasFnAttribute(Attribute::SanitizeAddress)) 12196765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling return false; 1220800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1221800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!ClDebugFunc.empty() && ClDebugFunc != F.getName()) 1222800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return false; 12236765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling 12246765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling // We want to instrument every address only once per basic block (unless there 12256765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling // are calls between uses). 1226800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallSet<Value*, 16> TempsToInstrument; 1227800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Instruction*, 16> ToInstrument; 122895e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany SmallVector<Instruction*, 8> NoReturnCalls; 122920985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany int NumAllocas = 0; 1230e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany bool IsWrite; 1231800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1232800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Fill the set of memory operations to instrument. 1233800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Function::iterator FI = F.begin(), FE = F.end(); 1234800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FI != FE; ++FI) { 1235800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 1236324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany int NumInsnsPerBB = 0; 1237800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (BasicBlock::iterator BI = FI->begin(), BE = FI->end(); 1238800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BI != BE; ++BI) { 1239bcb55ce3862bbbedac4e09d7099c9e0efc434e4bKostya Serebryany if (LooksLikeCodeInBug11395(BI)) return false; 1240e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (Value *Addr = isInterestingMemoryAccess(BI, &IsWrite)) { 1241800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClOpt && ClOptSameTemp) { 1242800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!TempsToInstrument.insert(Addr)) 1243800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; // We've seen this temp in the current BB. 1244800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1245800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (isa<MemIntrinsic>(BI) && ClMemIntrin) { 1246800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // ok, take it. 1247800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 124820985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany if (isa<AllocaInst>(BI)) 124920985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany NumAllocas++; 12501479c9bb392325688b72e5829bbb7939c4a079a4Kostya Serebryany CallSite CS(BI); 12511479c9bb392325688b72e5829bbb7939c4a079a4Kostya Serebryany if (CS) { 1252800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A call inside BB. 1253800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 12541479c9bb392325688b72e5829bbb7939c4a079a4Kostya Serebryany if (CS.doesNotReturn()) 12551479c9bb392325688b72e5829bbb7939c4a079a4Kostya Serebryany NoReturnCalls.push_back(CS.getInstruction()); 1256800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1257800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 1258800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1259800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ToInstrument.push_back(BI); 1260324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany NumInsnsPerBB++; 1261324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) 1262324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany break; 1263800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1264800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1265800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 126620985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany Function *UninstrumentedDuplicate = 0; 126720985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany bool LikelyToInstrument = 126820985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany !NoReturnCalls.empty() || !ToInstrument.empty() || (NumAllocas > 0); 126920985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany if (ClKeepUninstrumented && LikelyToInstrument) { 127020985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany ValueToValueMapTy VMap; 127120985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany UninstrumentedDuplicate = CloneFunction(&F, VMap, false); 127220985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany UninstrumentedDuplicate->removeFnAttr(Attribute::SanitizeAddress); 127320985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany UninstrumentedDuplicate->setName("NOASAN_" + F.getName()); 127420985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany F.getParent()->getFunctionList().push_back(UninstrumentedDuplicate); 127520985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany } 127620985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany 1277800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Instrument. 1278800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int NumInstrumented = 0; 1279800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = ToInstrument.size(); i != n; i++) { 1280800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Inst = ToInstrument[i]; 1281800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClDebugMin < 0 || ClDebugMax < 0 || 1282800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) { 1283e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (isInterestingMemoryAccess(Inst, &IsWrite)) 1284ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMop(Inst); 1285800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany else 1286ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMemIntrinsic(cast<MemIntrinsic>(Inst)); 1287800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1288800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NumInstrumented++; 1289800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1290800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 129159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov FunctionStackPoisoner FSP(F, *this); 129259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov bool ChangedStack = FSP.runOnFunction(); 129395e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany 129495e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany // We must unpoison the stack before every NoReturn call (throw, _exit, etc). 129595e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany // See e.g. http://code.google.com/p/address-sanitizer/issues/detail?id=37 129695e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany for (size_t i = 0, n = NoReturnCalls.size(); i != n; i++) { 129795e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany Instruction *CI = NoReturnCalls[i]; 129895e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany IRBuilder<> IRB(CI); 1299ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany IRB.CreateCall(AsanHandleNoReturnFunc); 130095e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany } 130195e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany 130220985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany bool res = NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty(); 13034b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson 13044b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson if (InjectCoverage(F)) 13054b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson res = true; 13064b8991424a8967dfdafc1768a9748f67e6c8b36fBob Wilson 130720985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany DEBUG(dbgs() << "ASAN done instrumenting: " << res << " " << F << "\n"); 130820985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany 130920985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany if (ClKeepUninstrumented) { 131020985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany if (!res) { 131120985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany // No instrumentation is done, no need for the duplicate. 131220985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany if (UninstrumentedDuplicate) 131320985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany UninstrumentedDuplicate->eraseFromParent(); 131420985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany } else { 131520985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany // The function was instrumented. We must have the duplicate. 131620985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany assert(UninstrumentedDuplicate); 131720985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany UninstrumentedDuplicate->setSection("NOASAN"); 131820985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany assert(!F.hasSection()); 131920985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany F.setSection("ASAN"); 132020985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany } 132120985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany } 132220985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany 132320985711c76b8799d689a9c0e416b68896333c23Kostya Serebryany return res; 1324800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1325800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1326800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic uint64_t ValueForPoison(uint64_t PoisonByte, size_t ShadowRedzoneSize) { 1327800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 1) return PoisonByte; 1328800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 2) return (PoisonByte << 8) + PoisonByte; 1329800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 4) 1330800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return (PoisonByte << 24) + (PoisonByte << 16) + 1331800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (PoisonByte << 8) + (PoisonByte); 1332858143816d43e58b17bfd11cb1b57afbd7f0f893Craig Topper llvm_unreachable("ShadowRedzoneSize is either 1, 2 or 4"); 1333800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1334800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1335800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic void PoisonShadowPartialRightRedzone(uint8_t *Shadow, 1336800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t Size, 1337b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t RZSize, 1338800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t ShadowGranularity, 1339800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint8_t Magic) { 1340b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany for (size_t i = 0; i < RZSize; 1341800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany i+= ShadowGranularity, Shadow++) { 1342800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (i + ShadowGranularity <= Size) { 1343800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = 0; // fully addressable 1344800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (i >= Size) { 1345800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Magic; // unaddressable 1346800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 1347800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Size - i; // first Size-i bytes are addressable 1348800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1349800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1350800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1351800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 135259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// Workaround for bug 11395: we don't want to instrument stack in functions 135359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// with large assembly blobs (32-bit only), otherwise reg alloc may crash. 135459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// FIXME: remove once the bug 11395 is fixed. 135559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovbool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { 135659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (LongSize != 32) return false; 135759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov CallInst *CI = dyn_cast<CallInst>(I); 135859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (!CI || !CI->isInlineAsm()) return false; 135959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (CI->getNumArgOperands() <= 5) return false; 136059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov // We have inline assembly with quite a few arguments. 136159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return true; 136259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov} 136359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 136459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovvoid FunctionStackPoisoner::initializeCallbacks(Module &M) { 136559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov IRBuilder<> IRB(*C); 1366f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) { 1367f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany std::string Suffix = itostr(i); 1368f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany AsanStackMallocFunc[i] = checkInterfaceFunction( 1369f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany M.getOrInsertFunction(kAsanStackMallocNameTemplate + Suffix, IntptrTy, 1370f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany IntptrTy, IntptrTy, NULL)); 1371f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany AsanStackFreeFunc[i] = checkInterfaceFunction(M.getOrInsertFunction( 1372f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany kAsanStackFreeNameTemplate + Suffix, IRB.getVoidTy(), IntptrTy, 1373f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany IntptrTy, IntptrTy, NULL)); 1374f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany } 137559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AsanPoisonStackMemoryFunc = checkInterfaceFunction(M.getOrInsertFunction( 137659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 137759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov AsanUnpoisonStackMemoryFunc = checkInterfaceFunction(M.getOrInsertFunction( 137859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 137959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov} 138059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 138159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovvoid FunctionStackPoisoner::poisonRedZones( 13824c71064129d1e5def34d74ee47c4f3beaa0a66dfJakub Staszak const ArrayRef<AllocaInst*> &AllocaVec, IRBuilder<> &IRB, Value *ShadowBase, 138359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov bool DoPoison) { 138419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov size_t ShadowRZSize = RedzoneSize() >> Mapping.Scale; 1385800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowRZSize >= 1 && ShadowRZSize <= 4); 1386800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZTy = Type::getIntNTy(*C, ShadowRZSize * 8); 1387800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZPtrTy = PointerType::get(RZTy, 0); 1388800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1389800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonLeft = ConstantInt::get(RZTy, 1390800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackLeftRedzoneMagic : 0LL, ShadowRZSize)); 1391800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonMid = ConstantInt::get(RZTy, 1392800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackMidRedzoneMagic : 0LL, ShadowRZSize)); 1393800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonRight = ConstantInt::get(RZTy, 1394800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackRightRedzoneMagic : 0LL, ShadowRZSize)); 1395800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1396800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison the first red zone. 1397800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PoisonLeft, IRB.CreateIntToPtr(ShadowBase, RZPtrTy)); 1398800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1399800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison all other red zones. 1400b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany uint64_t Pos = RedzoneSize(); 1401800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 1402800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 1403800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 1404800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 1405b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany assert(AlignedSize - SizeInBytes < RedzoneSize()); 1406800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Ptr = NULL; 1407800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1408800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Pos += AlignedSize; 1409800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1410800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowBase->getType() == IntptrTy); 1411800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (SizeInBytes < AlignedSize) { 1412800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the partial redzone at right 1413800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd( 1414800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ShadowBase, ConstantInt::get(IntptrTy, 141519cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov (Pos >> Mapping.Scale) - ShadowRZSize)); 1416b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t AddressableBytes = RedzoneSize() - (AlignedSize - SizeInBytes); 1417800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t Poison = 0; 1418800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoPoison) { 1419800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonShadowPartialRightRedzone((uint8_t*)&Poison, AddressableBytes, 1420b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany RedzoneSize(), 142119cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov 1ULL << Mapping.Scale, 1422800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanStackPartialRedzoneMagic); 14233e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryany Poison = 14243e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryany ASan.TD->isLittleEndian() 14253e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryany ? support::endian::byte_swap<uint32_t, support::little>(Poison) 14263e1d45bf44f882f3ee139d452dd50305d831a341Kostya Serebryany : support::endian::byte_swap<uint32_t, support::big>(Poison); 1427800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1428800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PartialPoison = ConstantInt::get(RZTy, Poison); 1429800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PartialPoison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 1430800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1431800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1432800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the full redzone at right. 1433800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd(ShadowBase, 143419cd7e9ce28ed7f3326ebcd386eec215ab3763f9Alexey Samsonov ConstantInt::get(IntptrTy, Pos >> Mapping.Scale)); 14351c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov bool LastAlloca = (i == AllocaVec.size() - 1); 14361c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Value *Poison = LastAlloca ? PoisonRight : PoisonMid; 1437800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Poison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 1438800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1439b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Pos += RedzoneSize(); 1440800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1441800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1442800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1443f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany// Fake stack allocator (asan_fake_stack.h) has 11 size classes 1444f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany// for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass 1445f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryanystatic int StackMallocSizeClass(uint64_t LocalStackSize) { 1446f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany assert(LocalStackSize <= kMaxStackMallocSize); 1447f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany uint64_t MaxSize = kMinStackMallocSize; 1448f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany for (int i = 0; ; i++, MaxSize *= 2) 1449f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany if (LocalStackSize <= MaxSize) 1450f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany return i; 1451f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany llvm_unreachable("impossible LocalStackSize"); 1452f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany} 1453f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany 1454671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany// Set Size bytes starting from ShadowBase to kAsanStackAfterReturnMagic. 1455671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany// We can not use MemSet intrinsic because it may end up calling the actual 1456671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany// memset. Size is a multiple of 8. 1457671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany// Currently this generates 8-byte stores on x86_64; it may be better to 1458671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany// generate wider stores. 1459671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryanyvoid FunctionStackPoisoner::SetShadowToStackAfterReturnInlined( 1460671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany IRBuilder<> &IRB, Value *ShadowBase, int Size) { 1461671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany assert(!(Size % 8)); 1462671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany assert(kAsanStackAfterReturnMagic == 0xf5); 1463671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany for (int i = 0; i < Size; i += 8) { 1464671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany Value *p = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); 1465671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany IRB.CreateStore(ConstantInt::get(IRB.getInt64Ty(), 0xf5f5f5f5f5f5f5f5ULL), 1466671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany IRB.CreateIntToPtr(p, IRB.getInt64Ty()->getPointerTo())); 1467671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany } 1468671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany} 1469671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany 147059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovvoid FunctionStackPoisoner::poisonStack() { 147159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov uint64_t LocalStackSize = TotalStackSize + 147259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov (AllocaVec.size() + 1) * RedzoneSize(); 1473800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 147459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov bool DoStackMalloc = ASan.CheckUseAfterReturn 1475800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany && LocalStackSize <= kMaxStackMallocSize; 1476f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany int StackMallocIdx = -1; 1477800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 14781c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov assert(AllocaVec.size() > 0); 1479800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsBefore = AllocaVec[0]; 1480800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsBefore); 1481800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1482800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1483800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ByteArrayTy = ArrayType::get(IRB.getInt8Ty(), LocalStackSize); 1484800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *MyAlloca = 1485800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany new AllocaInst(ByteArrayTy, "MyAlloca", InsBefore); 148659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov if (ClRealignStack && StackAlignment < RedzoneSize()) 148759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov StackAlignment = RedzoneSize(); 148859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov MyAlloca->setAlignment(StackAlignment); 1489800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(MyAlloca->isStaticAlloca()); 1490800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *OrigStackBase = IRB.CreatePointerCast(MyAlloca, IntptrTy); 1491800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *LocalStackBase = OrigStackBase; 1492800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1493800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 1494ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany // LocalStackBase = OrigStackBase 1495ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany // if (__asan_option_detect_stack_use_after_return) 1496ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany // LocalStackBase = __asan_stack_malloc_N(LocalStackBase, OrigStackBase); 1497f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany StackMallocIdx = StackMallocSizeClass(LocalStackSize); 1498f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass); 1499ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany Constant *OptionDetectUAR = F.getParent()->getOrInsertGlobal( 1500ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany kAsanOptionDetectUAR, IRB.getInt32Ty()); 1501ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(IRB.CreateLoad(OptionDetectUAR), 1502ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany Constant::getNullValue(IRB.getInt32Ty())); 1503ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany Instruction *Term = 1504ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), false); 1505ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany BasicBlock *CmpBlock = cast<Instruction>(Cmp)->getParent(); 1506ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany IRBuilder<> IRBIf(Term); 1507ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany LocalStackBase = IRBIf.CreateCall2( 1508ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany AsanStackMallocFunc[StackMallocIdx], 1509800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), OrigStackBase); 1510ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany BasicBlock *SetBlock = cast<Instruction>(LocalStackBase)->getParent(); 1511ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany IRB.SetInsertPoint(InsBefore); 1512ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany PHINode *Phi = IRB.CreatePHI(IntptrTy, 2); 1513ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany Phi->addIncoming(OrigStackBase, CmpBlock); 1514ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany Phi->addIncoming(LocalStackBase, SetBlock); 1515ac04abaf5a1df4c4bf48367cfbb41600289c4d78Kostya Serebryany LocalStackBase = Phi; 1516800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1517800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 15183016056769639878b4f152838f0cf16d2e482339Kostya Serebryany // This string will be parsed by the run-time (DescribeAddressIfStack). 1519800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallString<2048> StackDescriptionStorage; 1520800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany raw_svector_ostream StackDescription(StackDescriptionStorage); 15213016056769639878b4f152838f0cf16d2e482339Kostya Serebryany StackDescription << AllocaVec.size() << " "; 1522800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 15231c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Insert poison calls for lifetime intrinsics for alloca. 15241c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov bool HavePoisonedAllocas = false; 15251c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov for (size_t i = 0, n = AllocaPoisonCallVec.size(); i < n; i++) { 15261c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov const AllocaPoisonCall &APC = AllocaPoisonCallVec[i]; 152764409ad8e3b360b84349042f14b57f87a5c0ca18Alexey Samsonov assert(APC.InsBefore); 152864409ad8e3b360b84349042f14b57f87a5c0ca18Alexey Samsonov assert(APC.AI); 152964409ad8e3b360b84349042f14b57f87a5c0ca18Alexey Samsonov IRBuilder<> IRB(APC.InsBefore); 153064409ad8e3b360b84349042f14b57f87a5c0ca18Alexey Samsonov poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison); 15311c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov HavePoisonedAllocas |= APC.DoPoison; 15321c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov } 15331c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov 1534b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany uint64_t Pos = RedzoneSize(); 1535800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Replace Alloca instructions with base+offset. 1536800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 1537800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 1538800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 1539800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StringRef Name = AI->getName(); 1540800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StackDescription << Pos << " " << SizeInBytes << " " 1541800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany << Name.size() << " " << Name << " "; 1542800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 1543b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany assert((AlignedSize % RedzoneSize()) == 0); 1544f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov Value *NewAllocaPtr = IRB.CreateIntToPtr( 1545800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Pos)), 1546f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov AI->getType()); 15471afbb517965e29b07cb42e2335d5eadd87de6535Alexey Samsonov replaceDbgDeclareForAlloca(AI, NewAllocaPtr, DIB); 1548f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov AI->replaceAllUsesWith(NewAllocaPtr); 1549b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Pos += AlignedSize + RedzoneSize(); 1550800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1551800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(Pos == LocalStackSize); 1552800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 15533016056769639878b4f152838f0cf16d2e482339Kostya Serebryany // The left-most redzone has enough space for at least 4 pointers. 15543016056769639878b4f152838f0cf16d2e482339Kostya Serebryany // Write the Magic value to redzone[0]. 1555800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); 1556800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), 1557800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 15583016056769639878b4f152838f0cf16d2e482339Kostya Serebryany // Write the frame description constant to redzone[1]. 15593016056769639878b4f152838f0cf16d2e482339Kostya Serebryany Value *BasePlus1 = IRB.CreateIntToPtr( 15603016056769639878b4f152838f0cf16d2e482339Kostya Serebryany IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, ASan.LongSize/8)), 15613016056769639878b4f152838f0cf16d2e482339Kostya Serebryany IntptrPtrTy); 15629ce84c1c95c0153a2f33e188ce0db00770425f9eAlexey Samsonov GlobalVariable *StackDescriptionGlobal = 1563a5f54f14435d881b10d8eb65e19fa42af95757e9Kostya Serebryany createPrivateGlobalForString(*F.getParent(), StackDescription.str()); 156459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, 156559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov IntptrTy); 1566800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Description, BasePlus1); 15673016056769639878b4f152838f0cf16d2e482339Kostya Serebryany // Write the PC to redzone[2]. 15683016056769639878b4f152838f0cf16d2e482339Kostya Serebryany Value *BasePlus2 = IRB.CreateIntToPtr( 15693016056769639878b4f152838f0cf16d2e482339Kostya Serebryany IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, 15703016056769639878b4f152838f0cf16d2e482339Kostya Serebryany 2 * ASan.LongSize/8)), 15713016056769639878b4f152838f0cf16d2e482339Kostya Serebryany IntptrPtrTy); 15723016056769639878b4f152838f0cf16d2e482339Kostya Serebryany IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2); 1573800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1574800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the stack redzones at the entry. 157559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB); 157659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov poisonRedZones(AllocaVec, IRB, ShadowBase, true); 1577800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1578800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack before all ret instructions. 1579800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = RetVec.size(); i < n; i++) { 1580800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Ret = RetVec[i]; 1581800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRBRet(Ret); 1582800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Mark the current frame as retired. 1583800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), 1584800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 1585800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack. 158659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov poisonRedZones(AllocaVec, IRBRet, ShadowBase, false); 1587800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 1588f3d4b35f24f4e54b2cb99e06f47a958e5557d01eKostya Serebryany assert(StackMallocIdx >= 0); 1589f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov // In use-after-return mode, mark the whole stack frame unaddressable. 1590671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany if (StackMallocIdx <= 4) { 1591671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany // For small sizes inline the whole thing: 1592671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany // if LocalStackBase != OrigStackBase: 1593671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize); 1594671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany // **SavedFlagPtr(LocalStackBase) = 0 1595671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany // FIXME: if LocalStackBase != OrigStackBase don't call poisonRedZones. 1596671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany Value *Cmp = IRBRet.CreateICmpNE(LocalStackBase, OrigStackBase); 1597671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany TerminatorInst *PoisonTerm = 1598671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), false); 1599671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany IRBuilder<> IRBPoison(PoisonTerm); 1600671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany int ClassSize = kMinStackMallocSize << StackMallocIdx; 1601671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany SetShadowToStackAfterReturnInlined(IRBPoison, ShadowBase, 1602671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany ClassSize >> Mapping.Scale); 1603671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany Value *SavedFlagPtrPtr = IRBPoison.CreateAdd( 1604671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany LocalStackBase, 1605671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8)); 1606671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany Value *SavedFlagPtr = IRBPoison.CreateLoad( 1607671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy)); 1608671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany IRBPoison.CreateStore( 1609671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany Constant::getNullValue(IRBPoison.getInt8Ty()), 1610671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy())); 1611671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany } else { 1612671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany // For larger frames call __asan_stack_free_*. 1613671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany IRBRet.CreateCall3(AsanStackFreeFunc[StackMallocIdx], LocalStackBase, 1614671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), 1615671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany OrigStackBase); 1616671c3ba921d5b8271307a8caa5e29f512d2e8e82Kostya Serebryany } 1617f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov } else if (HavePoisonedAllocas) { 1618f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov // If we poisoned some allocas in llvm.lifetime analysis, 1619f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov // unpoison whole stack frame now. 1620f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov assert(LocalStackBase == OrigStackBase); 1621f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov poisonAlloca(LocalStackBase, LocalStackSize, IRBRet, false); 1622800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1623800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1624800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1625bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany // We are done. Remove the old unused alloca instructions. 1626bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) 1627bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany AllocaVec[i]->eraseFromParent(); 1628800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1629f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov 163059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonovvoid FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size, 16314c71064129d1e5def34d74ee47c4f3beaa0a66dfJakub Staszak IRBuilder<> &IRB, bool DoPoison) { 1632f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov // For now just insert the call to ASan runtime. 1633f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy); 1634f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov Value *SizeArg = ConstantInt::get(IntptrTy, Size); 1635f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov IRB.CreateCall2(DoPoison ? AsanPoisonStackMemoryFunc 1636f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov : AsanUnpoisonStackMemoryFunc, 1637f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov AddrArg, SizeArg); 1638f985f44b13681071e585acb7a5703a2c1c23b6ceAlexey Samsonov} 163959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 164059cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// Handling llvm.lifetime intrinsics for a given %alloca: 164159cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca. 164259cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// (2) if %size is constant, poison memory for llvm.lifetime.end (to detect 164359cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// invalid accesses) and unpoison it for llvm.lifetime.start (the memory 164459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// could be poisoned by previous llvm.lifetime.end instruction, as the 164559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// variable may go in and out of scope several times, e.g. in loops). 164659cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// (3) if we poisoned at least one %alloca in a function, 164759cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov// unpoison the whole stack frame at function exit. 164859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov 16491c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey SamsonovAllocaInst *FunctionStackPoisoner::findAllocaForValue(Value *V) { 16501c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (AllocaInst *AI = dyn_cast<AllocaInst>(V)) 16511c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // We're intested only in allocas we can handle. 16521c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return isInterestingAlloca(*AI) ? AI : 0; 16531c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // See if we've already calculated (or started to calculate) alloca for a 16541c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // given value. 16551c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaForValueMapTy::iterator I = AllocaForValue.find(V); 16561c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (I != AllocaForValue.end()) 16571c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return I->second; 16581c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Store 0 while we're calculating alloca for value V to avoid 16591c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // infinite recursion if the value references itself. 16601c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaForValue[V] = 0; 16611c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaInst *Res = 0; 16621c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (CastInst *CI = dyn_cast<CastInst>(V)) 16631c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Res = findAllocaForValue(CI->getOperand(0)); 16641c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov else if (PHINode *PN = dyn_cast<PHINode>(V)) { 16651c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i) { 16661c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Value *IncValue = PN->getIncomingValue(i); 16671c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // Allow self-referencing phi-nodes. 16681c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (IncValue == PN) continue; 16691c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaInst *IncValueAI = findAllocaForValue(IncValue); 16701c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov // AI for incoming values should exist and should all be equal. 16711c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (IncValueAI == 0 || (Res != 0 && IncValueAI != Res)) 16721c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov return 0; 16731c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov Res = IncValueAI; 167459cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 167559cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov } 16761c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov if (Res != 0) 16771c8b825c4396ad9cd38f713d9e9a51adae1d4c4eAlexey Samsonov AllocaForValue[V] = Res; 167859cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov return Res; 167959cca13a80ed78ccbcdaa9bf20381bd48243f2f1Alexey Samsonov} 1680