AddressSanitizer.cpp revision 7bcfc9950bac0f411f9671e8d6ce483bd219727e
1800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===-- AddressSanitizer.cpp - memory error detector ------------*- C++ -*-===// 2800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 3800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The LLVM Compiler Infrastructure 4800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 5800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is distributed under the University of Illinois Open Source 6800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// License. See LICENSE.TXT for details. 7800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 8800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 9800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 10800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is a part of AddressSanitizer, an address sanity checker. 11800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Details of the algorithm: 12800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm 13800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 14800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 15800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 16800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#define DEBUG_TYPE "asan" 17800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 18800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/ArrayRef.h" 19800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/OwningPtr.h" 20800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallSet.h" 21800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallString.h" 22800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallVector.h" 23800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/StringExtras.h" 24800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Function.h" 25800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/InlineAsm.h" 26800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/IntrinsicInst.h" 27800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/LLVMContext.h" 28800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Module.h" 29800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/CommandLine.h" 30800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/DataTypes.h" 31800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/Debug.h" 32800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/IRBuilder.h" 33800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/MemoryBuffer.h" 34800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/Regex.h" 35800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/raw_ostream.h" 36800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/system_error.h" 37800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Target/TargetData.h" 38800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Target/TargetMachine.h" 39800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Instrumentation.h" 40800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/BasicBlockUtils.h" 41800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/ModuleUtils.h" 42800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Type.h" 43800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 44800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include <string> 45800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include <algorithm> 46800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 47800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyusing namespace llvm; 48800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 49800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowScale = 3; 50800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset32 = 1ULL << 29; 51800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset64 = 1ULL << 44; 52800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 53800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const size_t kMaxStackMallocSize = 1 << 16; // 64K 54800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; 55800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; 56800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 57800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanModuleCtorName = "asan.module_ctor"; 587bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const char *kAsanModuleDtorName = "asan.module_dtor"; 597bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const int kAsanCtorAndCtorPriority = 1; 60800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanReportErrorTemplate = "__asan_report_"; 61800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanRegisterGlobalsName = "__asan_register_globals"; 627bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const char *kAsanUnregisterGlobalsName = "__asan_unregister_globals"; 63800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanInitName = "__asan_init"; 64800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanMappingOffsetName = "__asan_mapping_offset"; 65800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanMappingScaleName = "__asan_mapping_scale"; 66800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanStackMallocName = "__asan_stack_malloc"; 67800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanStackFreeName = "__asan_stack_free"; 68800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 69800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackLeftRedzoneMagic = 0xf1; 70800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackMidRedzoneMagic = 0xf2; 71800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackRightRedzoneMagic = 0xf3; 72800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackPartialRedzoneMagic = 0xf4; 73800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 74800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Command-line flags. 75800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 76800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no-]asan-reads. 77800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentReads("asan-instrument-reads", 78800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument read instructions"), cl::Hidden, cl::init(true)); 79800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentWrites("asan-instrument-writes", 80800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument write instructions"), cl::Hidden, cl::init(true)); 81800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-stack. 82800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClStack("asan-stack", 83800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle stack memory"), cl::Hidden, cl::init(true)); 84800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-use-after-return. 85800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClUseAfterReturn("asan-use-after-return", 86800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Check return-after-free"), cl::Hidden, cl::init(false)); 87800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-globals. 88800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClGlobals("asan-globals", 89800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle global objects"), cl::Hidden, cl::init(true)); 90800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClMemIntrin("asan-memintrin", 91800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle memset/memcpy/memmove"), cl::Hidden, cl::init(true)); 92800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -fasan-blacklist. 93800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<std::string> ClBlackListFile("asan-blacklist", 94800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("File containing the list of functions to ignore " 95800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "during instrumentation"), cl::Hidden); 96800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClUseCall("asan-use-call", 97800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Use function call to generate a crash"), cl::Hidden, 98800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(true)); 99800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 100800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// These flags allow to change the shadow mapping. 101800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The shadow mapping looks like 102800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Shadow = (Mem >> scale) + (1 << offset_log) 103800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingScale("asan-mapping-scale", 104800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0)); 105800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingOffsetLog("asan-mapping-offset-log", 106800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("offset of asan shadow mapping"), cl::Hidden, cl::init(-1)); 107800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 108800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Optimization flags. Not user visible, used mostly for testing 109800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// and benchmarking the tool. 110800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOpt("asan-opt", 111800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true)); 112800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptSameTemp("asan-opt-same-temp", 113800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Instrument the same temp just once"), cl::Hidden, 114800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(true)); 115800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptGlobals("asan-opt-globals", 116800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true)); 117800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 118800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Debug flags. 119800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, 120800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(0)); 121800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), 122800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(0)); 123800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<std::string> ClDebugFunc("asan-debug-func", 124800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::desc("Debug func")); 125800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), 126800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 127800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), 128800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 129800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 130800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanynamespace { 131800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 132800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Blacklisted functions are not instrumented. 133800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The blacklist file contains one or more lines like this: 134800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// --- 135800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// fun:FunctionWildCard 136800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// --- 137800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This is similar to the "ignore" feature of ThreadSanitizer. 138800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// http://code.google.com/p/data-race-test/wiki/ThreadSanitizerIgnores 139800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyclass BlackList { 140800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany public: 141800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BlackList(const std::string &Path); 142800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool isIn(const Function &F); 143800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany private: 144800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Regex *Functions; 145800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany}; 146800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 147800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany/// AddressSanitizer: instrument the code in module to find memory bugs. 148800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystruct AddressSanitizer : public ModulePass { 149800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AddressSanitizer(); 150800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany void instrumentMop(Instruction *I); 151800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany void instrumentAddress(Instruction *OrigIns, IRBuilder<> &IRB, 152800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr, uint32_t TypeSize, bool IsWrite); 153800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *generateCrashCode(IRBuilder<> &IRB, Value *Addr, 154800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool IsWrite, uint32_t TypeSize); 155800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool instrumentMemIntrinsic(MemIntrinsic *MI); 156800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany void instrumentMemIntrinsicParam(Instruction *OrigIns, Value *Addr, 157800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Size, 158800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore, bool IsWrite); 159800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); 160800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool handleFunction(Module &M, Function &F); 161800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool poisonStackInFunction(Module &M, Function &F); 162800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany virtual bool runOnModule(Module &M); 163800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool insertGlobalRedzones(Module &M); 164800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BranchInst *splitBlockAndInsertIfThen(Instruction *SplitBefore, Value *Cmp); 165800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany static char ID; // Pass identification, replacement for typeid 166800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 167800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany private: 168800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 169800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t getAllocaSizeInBytes(AllocaInst *AI) { 170800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = AI->getAllocatedType(); 171800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = TD->getTypeStoreSizeInBits(Ty) / 8; 172800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return SizeInBytes; 173800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 174800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t getAlignedSize(uint64_t SizeInBytes) { 175800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return ((SizeInBytes + RedzoneSize - 1) 176800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany / RedzoneSize) * RedzoneSize; 177800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 178800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t getAlignedAllocaSize(AllocaInst *AI) { 179800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 180800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return getAlignedSize(SizeInBytes); 181800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 182800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 183800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany void PoisonStack(const ArrayRef<AllocaInst*> &AllocaVec, IRBuilder<> IRB, 184800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowBase, bool DoPoison); 1855a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany bool LooksLikeCodeInBug11395(Instruction *I); 186800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 187800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Module *CurrentModule; 188800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LLVMContext *C; 189800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TargetData *TD; 190800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t MappingOffset; 191800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int MappingScale; 192800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t RedzoneSize; 193800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int LongSize; 194800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *IntptrTy; 195800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *IntptrPtrTy; 196800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanCtorFunction; 197800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanInitFunction; 198800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *CtorInsertBefore; 199800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany OwningPtr<BlackList> BL; 200800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany}; 201800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} // namespace 202800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 203800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanychar AddressSanitizer::ID = 0; 204800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyINITIALIZE_PASS(AddressSanitizer, "asan", 205800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", 206800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany false, false) 207800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyAddressSanitizer::AddressSanitizer() : ModulePass(ID) { } 208800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyModulePass *llvm::createAddressSanitizerPass() { 209800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return new AddressSanitizer(); 210800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 211800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 212800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Create a constant for Str so that we can pass it to the run-time lib. 213800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic GlobalVariable *createPrivateGlobalForString(Module &M, StringRef Str) { 214800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *StrConst = ConstantArray::get(M.getContext(), Str); 215800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return new GlobalVariable(M, StrConst->getType(), true, 216800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalValue::PrivateLinkage, StrConst, ""); 217800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 218800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 219800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Split the basic block and insert an if-then code. 220800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Before: 221800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Head 222800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// SplitBefore 223800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Tail 224800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// After: 225800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Head 226800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// if (Cmp) 227800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// NewBasicBlock 228800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// SplitBefore 229800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Tail 230800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 231800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Returns the NewBasicBlock's terminator. 232800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyBranchInst *AddressSanitizer::splitBlockAndInsertIfThen( 233800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *SplitBefore, Value *Cmp) { 234800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock *Head = SplitBefore->getParent(); 235800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock *Tail = Head->splitBasicBlock(SplitBefore); 236800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TerminatorInst *HeadOldTerm = Head->getTerminator(); 237800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock *NewBasicBlock = 238800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock::Create(*C, "", Head->getParent()); 239800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BranchInst *HeadNewTerm = BranchInst::Create(/*ifTrue*/NewBasicBlock, 240800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany /*ifFalse*/Tail, 241800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Cmp); 242800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ReplaceInstWithInst(HeadOldTerm, HeadNewTerm); 243800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 244800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BranchInst *CheckTerm = BranchInst::Create(Tail, NewBasicBlock); 245800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return CheckTerm; 246800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 247800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 248800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyValue *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { 249800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Shadow >> scale 250800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Shadow = IRB.CreateLShr(Shadow, MappingScale); 251800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (MappingOffset == 0) 252800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return Shadow; 253800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // (Shadow >> scale) | offset 254800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return IRB.CreateOr(Shadow, ConstantInt::get(IntptrTy, 255800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset)); 256800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 257800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 258800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyvoid AddressSanitizer::instrumentMemIntrinsicParam(Instruction *OrigIns, 259800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr, Value *Size, Instruction *InsertBefore, bool IsWrite) { 260800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the first byte. 261800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany { 262800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 263800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany instrumentAddress(OrigIns, IRB, Addr, 8, IsWrite); 264800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 265800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the last byte. 266800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany { 267800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 268800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *SizeMinusOne = IRB.CreateSub( 269800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Size, ConstantInt::get(Size->getType(), 1)); 270800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SizeMinusOne = IRB.CreateIntCast(SizeMinusOne, IntptrTy, false); 271800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 272800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrPlusSizeMinisOne = IRB.CreateAdd(AddrLong, SizeMinusOne); 273800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany instrumentAddress(OrigIns, IRB, AddrPlusSizeMinisOne, 8, IsWrite); 274800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 275800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 276800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 277800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Instrument memset/memmove/memcpy 278800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { 279800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Dst = MI->getDest(); 280800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MemTransferInst *MemTran = dyn_cast<MemTransferInst>(MI); 281800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Src = MemTran ? MemTran->getSource() : NULL; 282800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Length = MI->getLength(); 283800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 284800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *ConstLength = dyn_cast<Constant>(Length); 285800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore = MI; 286800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength) { 287800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength->isNullValue()) return false; 288800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 289800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // The size is not a constant so it could be zero -- check at run-time. 290800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 291800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 292800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(Length, 293800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant::getNullValue(Length->getType())); 294800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany InsertBefore = splitBlockAndInsertIfThen(InsertBefore, Cmp); 295800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 296800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 297800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany instrumentMemIntrinsicParam(MI, Dst, Length, InsertBefore, true); 298800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (Src) 299800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany instrumentMemIntrinsicParam(MI, Src, Length, InsertBefore, false); 300800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 301800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 302800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 303800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic Value *getLDSTOperand(Instruction *I) { 304800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 305800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return LI->getPointerOperand(); 306800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 307800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return cast<StoreInst>(*I).getPointerOperand(); 308800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 309800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 310800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyvoid AddressSanitizer::instrumentMop(Instruction *I) { 311800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int IsWrite = isa<StoreInst>(*I); 312800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr = getLDSTOperand(I); 313800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClOpt && ClOptGlobals && isa<GlobalVariable>(Addr)) { 314800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We are accessing a global scalar variable. Nothing to catch here. 315800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return; 316800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 317800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigPtrTy = Addr->getType(); 318800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigTy = cast<PointerType>(OrigPtrTy)->getElementType(); 319800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 320800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(OrigTy->isSized()); 321800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t TypeSize = TD->getTypeStoreSizeInBits(OrigTy); 322800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 323800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (TypeSize != 8 && TypeSize != 16 && 324800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TypeSize != 32 && TypeSize != 64 && TypeSize != 128) { 325800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Ignore all unusual sizes. 326800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return; 327800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 328800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 329800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(I); 330800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany instrumentAddress(I, IRB, Addr, TypeSize, IsWrite); 331800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 332800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 333800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyInstruction *AddressSanitizer::generateCrashCode( 334800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> &IRB, Value *Addr, bool IsWrite, uint32_t TypeSize) { 335800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 336800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClUseCall) { 337800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Here we use a call instead of arch-specific asm to report an error. 338800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // This is almost always slower (because the codegen needs to generate 339800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // prologue/epilogue for otherwise leaf functions) and generates more code. 340800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // This mode could be useful if we can not use SIGILL for some reason. 341800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // 342800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // IsWrite and TypeSize are encoded in the function name. 343800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany std::string FunctionName = std::string(kAsanReportErrorTemplate) + 344800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (IsWrite ? "store" : "load") + itostr(TypeSize / 8); 345800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ReportWarningFunc = CurrentModule->getOrInsertFunction( 346800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FunctionName, IRB.getVoidTy(), IntptrTy, NULL); 347800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany CallInst *Call = IRB.CreateCall(ReportWarningFunc, Addr); 348800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Call->setDoesNotReturn(); 349800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return Call; 350800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 351800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 352800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t LogOfSizeInBytes = CountTrailingZeros_32(TypeSize / 8); 353800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(8U * (1 << LogOfSizeInBytes) == TypeSize); 354800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint8_t TelltaleValue = IsWrite * 8 + LogOfSizeInBytes; 355800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(TelltaleValue < 16); 356800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 357800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Move the failing address to %rax/%eax 358800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FunctionType *Fn1Ty = FunctionType::get( 359800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.getVoidTy(), ArrayRef<Type*>(IntptrTy), false); 360800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany const char *MovStr = LongSize == 32 361800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ? "mov $0, %eax" : "mov $0, %rax"; 362800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AsmMov = InlineAsm::get( 363800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Fn1Ty, StringRef(MovStr), StringRef("r"), true); 364800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateCall(AsmMov, Addr); 365800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 366800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // crash with ud2; could use int3, but it is less friendly to gdb. 367800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // after ud2 put a 1-byte instruction that encodes the access type and size. 368800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 369800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany const char *TelltaleInsns[16] = { 370800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "push %eax", // 0x50 371800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "push %ecx", // 0x51 372800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "push %edx", // 0x52 373800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "push %ebx", // 0x53 374800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "push %esp", // 0x54 375800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "push %ebp", // 0x55 376800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "push %esi", // 0x56 377800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "push %edi", // 0x57 378800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "pop %eax", // 0x58 379800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "pop %ecx", // 0x59 380800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "pop %edx", // 0x5a 381800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "pop %ebx", // 0x5b 382800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "pop %esp", // 0x5c 383800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "pop %ebp", // 0x5d 384800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "pop %esi", // 0x5e 385800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "pop %edi" // 0x5f 386800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany }; 387800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 388800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany std::string AsmStr = "ud2;"; 389800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsmStr += TelltaleInsns[TelltaleValue]; 390800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *MyAsm = InlineAsm::get(FunctionType::get(Type::getVoidTy(*C), false), 391800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StringRef(AsmStr), StringRef(""), true); 392800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany CallInst *AsmCall = IRB.CreateCall(MyAsm); 393800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 394800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // This saves us one jump, but triggers a bug in RA (or somewhere else): 395800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // while building 483.xalancbmk the compiler goes into infinite loop in 396800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // llvm::SpillPlacement::iterate() / RAGreedy::growRegion 397800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // AsmCall->setDoesNotReturn(); 398800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return AsmCall; 399800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 400800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 401800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyvoid AddressSanitizer::instrumentAddress(Instruction *OrigIns, 402800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> &IRB, Value *Addr, 403800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t TypeSize, bool IsWrite) { 404800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 405800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 406800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowTy = IntegerType::get( 407800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *C, std::max(8U, TypeSize >> MappingScale)); 408800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); 409800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowPtr = memToShadow(AddrLong, IRB); 410800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *CmpVal = Constant::getNullValue(ShadowTy); 411800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowValue = IRB.CreateLoad( 412800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); 413800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 414800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); 415800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 416800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *CheckTerm = splitBlockAndInsertIfThen( 417800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cast<Instruction>(Cmp)->getNextNode(), Cmp); 418800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB2(CheckTerm); 419800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 420800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t Granularity = 1 << MappingScale; 421800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (TypeSize < 8 * Granularity) { 422800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Addr & (Granularity - 1) 423800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Lower3Bits = IRB2.CreateAnd( 424800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); 425800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // (Addr & (Granularity - 1)) + size - 1 426800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *LastAccessedByte = IRB2.CreateAdd( 427800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Lower3Bits, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); 428800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // (uint8_t) ((Addr & (Granularity-1)) + size - 1) 429800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LastAccessedByte = IRB2.CreateIntCast( 430800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LastAccessedByte, IRB.getInt8Ty(), false); 431800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue 432800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp2 = IRB2.CreateICmpSGE(LastAccessedByte, ShadowValue); 433800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 434800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany CheckTerm = splitBlockAndInsertIfThen(CheckTerm, Cmp2); 435800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 436800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 437800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB1(CheckTerm); 438800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Crash = generateCrashCode(IRB1, AddrLong, IsWrite, TypeSize); 439800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Crash->setDebugLoc(OrigIns->getDebugLoc()); 440cc1d856d8e8e11407b3c6c1d08768f77c3722e38Kostya Serebryany ReplaceInstWithInst(CheckTerm, new UnreachableInst(*C)); 441800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 442800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 443800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This function replaces all global variables with new variables that have 444800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// trailing redzones. It also creates a function that poisons 445800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// redzones and inserts this function into llvm.global_ctors. 446800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool AddressSanitizer::insertGlobalRedzones(Module &M) { 447800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<GlobalVariable *, 16> GlobalsToChange; 448800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 449800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Module::GlobalListType::iterator G = M.getGlobalList().begin(), 450800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany E = M.getGlobalList().end(); G != E; ++G) { 451800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = cast<PointerType>(G->getType())->getElementType(); 452800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << "GLOBAL: " << *G); 453800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 454800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!Ty->isSized()) continue; 455800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!G->hasInitializer()) continue; 4567cf2a04361e8613264498e50babe52d65c070473Kostya Serebryany // Touch only those globals that will not be defined in other modules. 4577cf2a04361e8613264498e50babe52d65c070473Kostya Serebryany // Don't handle ODR type linkages since other modules may be built w/o asan. 4582e7fb2f73641f1f1ca385fe7777075945bf4ca24Kostya Serebryany if (G->getLinkage() != GlobalVariable::ExternalLinkage && 4592e7fb2f73641f1f1ca385fe7777075945bf4ca24Kostya Serebryany G->getLinkage() != GlobalVariable::PrivateLinkage && 4602e7fb2f73641f1f1ca385fe7777075945bf4ca24Kostya Serebryany G->getLinkage() != GlobalVariable::InternalLinkage) 461800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 462d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany // Two problems with thread-locals: 463d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany // - The address of the main thread's copy can't be computed at link-time. 464d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany // - Need to poison all copies, not just the main thread's one. 465d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany if (G->isThreadLocal()) 466d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany continue; 467800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // For now, just ignore this Alloca if the alignment is large. 468800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (G->getAlignment() > RedzoneSize) continue; 469800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 470800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Ignore all the globals with the names starting with "\01L_OBJC_". 471800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Many of those are put into the .cstring section. The linker compresses 472800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // that section by removing the spare \0s after the string terminator, so 473800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // our redzones get broken. 474800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if ((G->getName().find("\01L_OBJC_") == 0) || 475800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (G->getName().find("\01l_OBJC_") == 0)) { 476800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << "Ignoring \\01L_OBJC_* global: " << *G); 477800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 478800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 479800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 480800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Ignore the globals from the __OBJC section. The ObjC runtime assumes 481800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to 482800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // them. 483800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (G->hasSection()) { 484800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StringRef Section(G->getSection()); 485800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if ((Section.find("__OBJC,") == 0) || 486800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (Section.find("__DATA, __objc_") == 0)) { 487800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G); 488800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 489800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 490800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 491800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 492800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalsToChange.push_back(G); 493800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 494800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 495800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t n = GlobalsToChange.size(); 496800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (n == 0) return false; 497800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 498800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A global is described by a structure 499800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t beg; 500800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size; 501800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size_with_redzone; 502800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // const char *name; 503800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We initialize an array of such structures and pass it to a run-time call. 504800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *GlobalStructTy = StructType::get(IntptrTy, IntptrTy, 505800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrTy, IntptrTy, NULL); 506800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Constant *, 16> Initializers(n); 507800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 508800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(CtorInsertBefore); 509800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 510800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0; i < n; i++) { 511800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *G = GlobalsToChange[i]; 512800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PointerType *PtrTy = cast<PointerType>(G->getType()); 513800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = PtrTy->getElementType(); 514800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = TD->getTypeStoreSizeInBits(Ty) / 8; 515800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t RightRedzoneSize = RedzoneSize + 516800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (RedzoneSize - (SizeInBytes % RedzoneSize)); 517800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); 518800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 519800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *NewTy = StructType::get(Ty, RightRedZoneTy, NULL); 520800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *NewInitializer = ConstantStruct::get( 521800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewTy, G->getInitializer(), 522800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant::getNullValue(RightRedZoneTy), NULL); 523800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 524800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *Name = createPrivateGlobalForString(M, G->getName()); 525800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 526800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Create a new global variable with enough space for a redzone. 527800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *NewGlobal = new GlobalVariable( 528800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M, NewTy, G->isConstant(), G->getLinkage(), 529800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewInitializer, "", G, G->isThreadLocal()); 530800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->copyAttributesFrom(G); 531800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->setAlignment(RedzoneSize); 532800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 533800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Indices2[2]; 534800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[0] = IRB.getInt32(0); 535800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[1] = IRB.getInt32(0); 536800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 537800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->replaceAllUsesWith( 538800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getGetElementPtr(NewGlobal, Indices2, 2)); 539800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->takeName(G); 540800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->eraseFromParent(); 541800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 542800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Initializers[i] = ConstantStruct::get( 543800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalStructTy, 544800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(NewGlobal, IntptrTy), 545800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes), 546800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), 547800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(Name, IntptrTy), 548800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NULL); 549800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << "NEW GLOBAL:\n" << *NewGlobal); 550800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 551800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 552800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ArrayType *ArrayOfGlobalStructTy = ArrayType::get(GlobalStructTy, n); 553800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *AllGlobals = new GlobalVariable( 554800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M, ArrayOfGlobalStructTy, false, GlobalVariable::PrivateLinkage, 555800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantArray::get(ArrayOfGlobalStructTy, Initializers), ""); 556800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 557800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanRegisterGlobals = cast<Function>(M.getOrInsertFunction( 558800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 559800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanRegisterGlobals->setLinkage(Function::ExternalLinkage); 560800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 561800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateCall2(AsanRegisterGlobals, 562800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 563800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, n)); 564800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 5657bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // We also need to unregister globals at the end, e.g. when a shared library 5667bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // gets closed. 5677bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany Function *AsanDtorFunction = Function::Create( 5687bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 5697bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany GlobalValue::InternalLinkage, kAsanModuleDtorName, &M); 5707bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); 5717bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRBuilder<> IRB_Dtor(ReturnInst::Create(*C, AsanDtorBB)); 5727bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany Function *AsanUnregisterGlobals = cast<Function>(M.getOrInsertFunction( 5737bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany kAsanUnregisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 5747bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage); 5757bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany 5767bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB_Dtor.CreateCall2(AsanUnregisterGlobals, 5777bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 5787bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany ConstantInt::get(IntptrTy, n)); 5797bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndCtorPriority); 5807bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany 581800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << M); 582800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 583800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 584800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 585800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// virtual 586800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool AddressSanitizer::runOnModule(Module &M) { 587800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Initialize the private fields. No one has accessed them before. 588800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TD = getAnalysisIfAvailable<TargetData>(); 589800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!TD) 590800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return false; 591800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BL.reset(new BlackList(ClBlackListFile)); 592800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 593800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany CurrentModule = &M; 594800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany C = &(M.getContext()); 595800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LongSize = TD->getPointerSizeInBits(); 596800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrTy = Type::getIntNTy(*C, LongSize); 597800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrPtrTy = PointerType::get(IntptrTy, 0); 598800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 599800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanCtorFunction = Function::Create( 600800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 601800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalValue::InternalLinkage, kAsanModuleCtorName, &M); 602800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock *AsanCtorBB = BasicBlock::Create(*C, "", AsanCtorFunction); 603800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany CtorInsertBefore = ReturnInst::Create(*C, AsanCtorBB); 604800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 605800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // call __asan_init in the module ctor. 606800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(CtorInsertBefore); 607800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanInitFunction = cast<Function>( 608800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M.getOrInsertFunction(kAsanInitName, IRB.getVoidTy(), NULL)); 609800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanInitFunction->setLinkage(Function::ExternalLinkage); 610800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateCall(AsanInitFunction); 611800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 612800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset = LongSize == 32 613800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ? kDefaultShadowOffset32 : kDefaultShadowOffset64; 614800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClMappingOffsetLog >= 0) { 615800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClMappingOffsetLog == 0) { 616800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // special case 617800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset = 0; 618800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 619800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset = 1ULL << ClMappingOffsetLog; 620800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 621800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 622800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingScale = kDefaultShadowScale; 623800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClMappingScale) { 624800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingScale = ClMappingScale; 625800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 626800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Redzone used for stack and globals is at least 32 bytes. 627800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. 628800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany RedzoneSize = std::max(32, (int)(1 << MappingScale)); 629800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 630800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool Res = false; 631800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 632800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClGlobals) 633800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Res |= insertGlobalRedzones(M); 634800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 635800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Tell the run-time the current values of mapping offset and scale. 636800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalValue *asan_mapping_offset = 637800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 638800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, MappingOffset), 639800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanMappingOffsetName); 640800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalValue *asan_mapping_scale = 641800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 642800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, MappingScale), 643800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanMappingScaleName); 644800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Read these globals, otherwise they may be optimized away. 645800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateLoad(asan_mapping_scale, true); 646800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateLoad(asan_mapping_offset, true); 647800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 648800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 649800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Module::iterator F = M.begin(), E = M.end(); F != E; ++F) { 650800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (F->isDeclaration()) continue; 651800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Res |= handleFunction(M, *F); 652800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 653800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 6547bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndCtorPriority); 6559b02741d2284d9516a59666c211fe1f57e8803adKostya Serebryany 656800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return Res; 657800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 658800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 659800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool AddressSanitizer::handleFunction(Module &M, Function &F) { 660800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (BL->isIn(F)) return false; 661800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (&F == AsanCtorFunction) return false; 662800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 663800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!ClDebugFunc.empty() && ClDebugFunc != F.getName()) 664800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return false; 665800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We want to instrument every address only once per basic block 666800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // (unless there are calls between uses). 667800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallSet<Value*, 16> TempsToInstrument; 668800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Instruction*, 16> ToInstrument; 669800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 670800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Fill the set of memory operations to instrument. 671800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Function::iterator FI = F.begin(), FE = F.end(); 672800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FI != FE; ++FI) { 673800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 674800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (BasicBlock::iterator BI = FI->begin(), BE = FI->end(); 675800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BI != BE; ++BI) { 676800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if ((isa<LoadInst>(BI) && ClInstrumentReads) || 677800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (isa<StoreInst>(BI) && ClInstrumentWrites)) { 678800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr = getLDSTOperand(BI); 679800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClOpt && ClOptSameTemp) { 680800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!TempsToInstrument.insert(Addr)) 681800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; // We've seen this temp in the current BB. 682800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 683800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (isa<MemIntrinsic>(BI) && ClMemIntrin) { 684800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // ok, take it. 685800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 686800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (isa<CallInst>(BI)) { 687800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A call inside BB. 688800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 689800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 690800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 691800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 692800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ToInstrument.push_back(BI); 693800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 694800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 695800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 696800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Instrument. 697800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int NumInstrumented = 0; 698800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = ToInstrument.size(); i != n; i++) { 699800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Inst = ToInstrument[i]; 700800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClDebugMin < 0 || ClDebugMax < 0 || 701800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) { 702800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (isa<StoreInst>(Inst) || isa<LoadInst>(Inst)) 703800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany instrumentMop(Inst); 704800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany else 705800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany instrumentMemIntrinsic(cast<MemIntrinsic>(Inst)); 706800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 707800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NumInstrumented++; 708800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 709800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 710800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << F); 711800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 712800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool ChangedStack = poisonStackInFunction(M, F); 713800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 714800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // For each NSObject descendant having a +load method, this method is invoked 715800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // by the ObjC runtime before any of the static constructors is called. 716800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Therefore we need to instrument such methods with a call to __asan_init 717800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // at the beginning in order to initialize our runtime before any access to 718800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // the shadow memory. 719800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We cannot just ignore these methods, because they may call other 720800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // instrumented functions. 721800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (F.getName().find(" load]") != std::string::npos) { 722800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(F.begin()->begin()); 723800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateCall(AsanInitFunction); 724800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 725800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 726800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return NumInstrumented > 0 || ChangedStack; 727800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 728800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 729800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic uint64_t ValueForPoison(uint64_t PoisonByte, size_t ShadowRedzoneSize) { 730800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 1) return PoisonByte; 731800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 2) return (PoisonByte << 8) + PoisonByte; 732800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 4) 733800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return (PoisonByte << 24) + (PoisonByte << 16) + 734800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (PoisonByte << 8) + (PoisonByte); 735800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(0 && "ShadowRedzoneSize is either 1, 2 or 4"); 736800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return 0; 737800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 738800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 739800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic void PoisonShadowPartialRightRedzone(uint8_t *Shadow, 740800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t Size, 741800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t RedzoneSize, 742800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t ShadowGranularity, 743800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint8_t Magic) { 744800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0; i < RedzoneSize; 745800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany i+= ShadowGranularity, Shadow++) { 746800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (i + ShadowGranularity <= Size) { 747800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = 0; // fully addressable 748800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (i >= Size) { 749800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Magic; // unaddressable 750800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 751800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Size - i; // first Size-i bytes are addressable 752800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 753800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 754800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 755800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 756800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyvoid AddressSanitizer::PoisonStack(const ArrayRef<AllocaInst*> &AllocaVec, 757800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB, 758800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowBase, bool DoPoison) { 759800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t ShadowRZSize = RedzoneSize >> MappingScale; 760800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowRZSize >= 1 && ShadowRZSize <= 4); 761800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZTy = Type::getIntNTy(*C, ShadowRZSize * 8); 762800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZPtrTy = PointerType::get(RZTy, 0); 763800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 764800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonLeft = ConstantInt::get(RZTy, 765800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackLeftRedzoneMagic : 0LL, ShadowRZSize)); 766800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonMid = ConstantInt::get(RZTy, 767800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackMidRedzoneMagic : 0LL, ShadowRZSize)); 768800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonRight = ConstantInt::get(RZTy, 769800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackRightRedzoneMagic : 0LL, ShadowRZSize)); 770800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 771800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison the first red zone. 772800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PoisonLeft, IRB.CreateIntToPtr(ShadowBase, RZPtrTy)); 773800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 774800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison all other red zones. 775800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t Pos = RedzoneSize; 776800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 777800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 778800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 779800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 780800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(AlignedSize - SizeInBytes < RedzoneSize); 781800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Ptr = NULL; 782800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 783800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Pos += AlignedSize; 784800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 785800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowBase->getType() == IntptrTy); 786800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (SizeInBytes < AlignedSize) { 787800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the partial redzone at right 788800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd( 789800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ShadowBase, ConstantInt::get(IntptrTy, 790800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (Pos >> MappingScale) - ShadowRZSize)); 791800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t AddressableBytes = RedzoneSize - (AlignedSize - SizeInBytes); 792800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t Poison = 0; 793800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoPoison) { 794800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonShadowPartialRightRedzone((uint8_t*)&Poison, AddressableBytes, 795800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany RedzoneSize, 796800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1ULL << MappingScale, 797800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanStackPartialRedzoneMagic); 798800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 799800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PartialPoison = ConstantInt::get(RZTy, Poison); 800800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PartialPoison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 801800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 802800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 803800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the full redzone at right. 804800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd(ShadowBase, 805800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, Pos >> MappingScale)); 806800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Poison = i == AllocaVec.size() - 1 ? PoisonRight : PoisonMid; 807800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Poison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 808800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 809800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Pos += RedzoneSize; 810800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 811800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 812800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 8135a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany// Workaround for bug 11395: we don't want to instrument stack in functions 8145a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany// with large assembly blobs (32-bit only), otherwise reg alloc may crash. 815d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany// FIXME: remove once the bug 11395 is fixed. 8165a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryanybool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { 8175a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (LongSize != 32) return false; 8185a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany CallInst *CI = dyn_cast<CallInst>(I); 8195a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (!CI || !CI->isInlineAsm()) return false; 8205a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (CI->getNumArgOperands() <= 5) return false; 8215a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany // We have inline assembly with quite a few arguments. 8225a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany return true; 8235a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany} 8245a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany 825800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Find all static Alloca instructions and put 826800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// poisoned red zones around all of them. 827800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Then unpoison everything back before the function returns. 828800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 829800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Stack poisoning does not play well with exception handling. 830800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// When an exception is thrown, we essentially bypass the code 831800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// that unpoisones the stack. This is why the run-time library has 832800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire 833800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// stack in the interceptor. This however does not work inside the 834800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// actual function which catches the exception. Most likely because the 835800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// compiler hoists the load of the shadow value somewhere too high. 836800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This causes asan to report a non-existing bug on 453.povray. 837800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// It sounds like an LLVM bug. 838800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool AddressSanitizer::poisonStackInFunction(Module &M, Function &F) { 839800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!ClStack) return false; 840800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<AllocaInst*, 16> AllocaVec; 841800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Instruction*, 8> RetVec; 842800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t TotalSize = 0; 843800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 844800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Filter out Alloca instructions we want (and can) handle. 845800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Collect Ret instructions. 846800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Function::iterator FI = F.begin(), FE = F.end(); 847800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FI != FE; ++FI) { 848800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock &BB = *FI; 849800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (BasicBlock::iterator BI = BB.begin(), BE = BB.end(); 850800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BI != BE; ++BI) { 8515a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (LooksLikeCodeInBug11395(BI)) return false; 852800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (isa<ReturnInst>(BI)) { 853800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany RetVec.push_back(BI); 854800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 855800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 856800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 857800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = dyn_cast<AllocaInst>(BI); 858800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!AI) continue; 859800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (AI->isArrayAllocation()) continue; 860800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!AI->isStaticAlloca()) continue; 861800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!AI->getAllocatedType()->isSized()) continue; 862800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (AI->getAlignment() > RedzoneSize) continue; 863800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaVec.push_back(AI); 864800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 865800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TotalSize += AlignedSize; 866800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 867800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 868800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 869800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (AllocaVec.empty()) return false; 870800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 871800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t LocalStackSize = TotalSize + (AllocaVec.size() + 1) * RedzoneSize; 872800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 873800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool DoStackMalloc = ClUseAfterReturn 874800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany && LocalStackSize <= kMaxStackMallocSize; 875800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 876800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsBefore = AllocaVec[0]; 877800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsBefore); 878800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 879800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 880800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ByteArrayTy = ArrayType::get(IRB.getInt8Ty(), LocalStackSize); 881800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *MyAlloca = 882800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany new AllocaInst(ByteArrayTy, "MyAlloca", InsBefore); 883800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MyAlloca->setAlignment(RedzoneSize); 884800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(MyAlloca->isStaticAlloca()); 885800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *OrigStackBase = IRB.CreatePointerCast(MyAlloca, IntptrTy); 886800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *LocalStackBase = OrigStackBase; 887800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 888800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 889800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AsanStackMallocFunc = M.getOrInsertFunction( 890800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanStackMallocName, IntptrTy, IntptrTy, IntptrTy, NULL); 891800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LocalStackBase = IRB.CreateCall2(AsanStackMallocFunc, 892800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), OrigStackBase); 893800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 894800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 895800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // This string will be parsed by the run-time (DescribeStackAddress). 896800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallString<2048> StackDescriptionStorage; 897800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany raw_svector_ostream StackDescription(StackDescriptionStorage); 898800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StackDescription << F.getName() << " " << AllocaVec.size() << " "; 899800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 900800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t Pos = RedzoneSize; 901800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Replace Alloca instructions with base+offset. 902800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 903800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 904800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 905800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StringRef Name = AI->getName(); 906800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StackDescription << Pos << " " << SizeInBytes << " " 907800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany << Name.size() << " " << Name << " "; 908800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 909800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert((AlignedSize % RedzoneSize) == 0); 910800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AI->replaceAllUsesWith( 911800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateIntToPtr( 912800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Pos)), 913800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AI->getType())); 914800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Pos += AlignedSize + RedzoneSize; 915800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 916800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(Pos == LocalStackSize); 917800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 918800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Write the Magic value and the frame description constant to the redzone. 919800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); 920800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), 921800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 922800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *BasePlus1 = IRB.CreateAdd(LocalStackBase, 923800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LongSize/8)); 924800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus1 = IRB.CreateIntToPtr(BasePlus1, IntptrPtrTy); 925800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Description = IRB.CreatePointerCast( 926800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany createPrivateGlobalForString(M, StackDescription.str()), 927800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrTy); 928800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Description, BasePlus1); 929800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 930800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the stack redzones at the entry. 931800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowBase = memToShadow(LocalStackBase, IRB); 932800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonStack(ArrayRef<AllocaInst*>(AllocaVec), IRB, ShadowBase, true); 933800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 934800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AsanStackFreeFunc = NULL; 935800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 936800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanStackFreeFunc = M.getOrInsertFunction( 937800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanStackFreeName, IRB.getVoidTy(), 938800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrTy, IntptrTy, IntptrTy, NULL); 939800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 940800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 941800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack before all ret instructions. 942800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = RetVec.size(); i < n; i++) { 943800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Ret = RetVec[i]; 944800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRBRet(Ret); 945800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 946800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Mark the current frame as retired. 947800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), 948800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 949800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack. 950800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonStack(ArrayRef<AllocaInst*>(AllocaVec), IRBRet, ShadowBase, false); 951800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 952800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 953800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBRet.CreateCall3(AsanStackFreeFunc, LocalStackBase, 954800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), 955800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany OrigStackBase); 956800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 957800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 958800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 959800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClDebugStack) { 960800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << F); 961800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 962800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 963800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 964800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 965800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 966800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyBlackList::BlackList(const std::string &Path) { 967800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Functions = NULL; 968800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany const char *kFunPrefix = "fun:"; 969800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!ClBlackListFile.size()) return; 970800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany std::string Fun; 971800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 972800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany OwningPtr<MemoryBuffer> File; 973800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (error_code EC = MemoryBuffer::getFile(ClBlackListFile.c_str(), File)) { 974cc1d856d8e8e11407b3c6c1d08768f77c3722e38Kostya Serebryany report_fatal_error("Can't open blacklist file " + ClBlackListFile + ": " + 975cc1d856d8e8e11407b3c6c1d08768f77c3722e38Kostya Serebryany EC.message()); 976800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 977800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MemoryBuffer *Buff = File.take(); 978800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany const char *Data = Buff->getBufferStart(); 979800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t DataLen = Buff->getBufferSize(); 980800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<StringRef, 16> Lines; 981800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SplitString(StringRef(Data, DataLen), Lines, "\n\r"); 982800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, numLines = Lines.size(); i < numLines; i++) { 983800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (Lines[i].startswith(kFunPrefix)) { 984800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany std::string ThisFunc = Lines[i].substr(strlen(kFunPrefix)); 985085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany std::string ThisFuncRE; 986800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // add ThisFunc replacing * with .* 987800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t j = 0, n = ThisFunc.size(); j < n; j++) { 988800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ThisFunc[j] == '*') 989085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany ThisFuncRE += '.'; 990085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany ThisFuncRE += ThisFunc[j]; 991800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 992085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany // Check that the regexp is valid. 993085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany Regex CheckRE(ThisFuncRE); 994085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany std::string Error; 995085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany if (!CheckRE.isValid(Error)) 996085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany report_fatal_error("malformed blacklist regex: " + ThisFunc + 997085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany ": " + Error); 998085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany // Append to the final regexp. 999085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany if (Fun.size()) 1000085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany Fun += "|"; 1001085cb8f0b957841ab667a46be0c49ce4ee8c9c79Kostya Serebryany Fun += ThisFuncRE; 1002800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1003800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1004800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (Fun.size()) { 1005800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Functions = new Regex(Fun); 1006800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1007800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1008800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1009800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool BlackList::isIn(const Function &F) { 1010800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (Functions) { 1011800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool Res = Functions->match(F.getName()); 1012800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return Res; 1013800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1014800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return false; 1015800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1016