AddressSanitizer.cpp revision f7b08226eb44458f6f38cbeaca527028803c725a
1800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===-- AddressSanitizer.cpp - memory error detector ------------*- C++ -*-===// 2800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 3800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The LLVM Compiler Infrastructure 4800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 5800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is distributed under the University of Illinois Open Source 6800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// License. See LICENSE.TXT for details. 7800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 8800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 9800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 10800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is a part of AddressSanitizer, an address sanity checker. 11800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Details of the algorithm: 12800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm 13800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 14800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 15800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 16800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#define DEBUG_TYPE "asan" 17800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 18a1c45044099cf7fb4a072f1326f164706d5bb2e2Kostya Serebryany#include "FunctionBlackList.h" 1906cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/Function.h" 2006cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/IRBuilder.h" 21f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany#include "llvm/InlineAsm.h" 2206cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/IntrinsicInst.h" 2306cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/LLVMContext.h" 2406cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/Module.h" 2506cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/Type.h" 26800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/ArrayRef.h" 27800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/OwningPtr.h" 28800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallSet.h" 29800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallString.h" 30800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallVector.h" 31800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/StringExtras.h" 3206fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov#include "llvm/ADT/Triple.h" 33800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/CommandLine.h" 34800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/DataTypes.h" 35800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/Debug.h" 36800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/raw_ostream.h" 37800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/system_error.h" 38800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Target/TargetData.h" 39800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Target/TargetMachine.h" 40800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Instrumentation.h" 41800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/BasicBlockUtils.h" 42800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/ModuleUtils.h" 43800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 44800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include <string> 45800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include <algorithm> 46800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 47800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyusing namespace llvm; 48800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 49800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowScale = 3; 50800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset32 = 1ULL << 29; 51800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset64 = 1ULL << 44; 5206fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanovstatic const uint64_t kDefaultShadowOffsetAndroid = 0; 53800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 54800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const size_t kMaxStackMallocSize = 1 << 16; // 64K 55800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; 56800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; 57800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 58800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanModuleCtorName = "asan.module_ctor"; 597bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const char *kAsanModuleDtorName = "asan.module_dtor"; 607bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const int kAsanCtorAndCtorPriority = 1; 61800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanReportErrorTemplate = "__asan_report_"; 62800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanRegisterGlobalsName = "__asan_register_globals"; 637bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const char *kAsanUnregisterGlobalsName = "__asan_unregister_globals"; 64800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanInitName = "__asan_init"; 6595e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryanystatic const char *kAsanHandleNoReturnName = "__asan_handle_no_return"; 66800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanMappingOffsetName = "__asan_mapping_offset"; 67800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanMappingScaleName = "__asan_mapping_scale"; 68800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanStackMallocName = "__asan_stack_malloc"; 69800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanStackFreeName = "__asan_stack_free"; 70800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 71800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackLeftRedzoneMagic = 0xf1; 72800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackMidRedzoneMagic = 0xf2; 73800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackRightRedzoneMagic = 0xf3; 74800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackPartialRedzoneMagic = 0xf4; 75800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 76c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany// Accesses sizes are powers of two: 1, 2, 4, 8, 16. 77c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanystatic const size_t kNumberOfAccessSizes = 5; 78c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 79800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Command-line flags. 80800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 81800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no-]asan-reads. 82800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentReads("asan-instrument-reads", 83800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument read instructions"), cl::Hidden, cl::init(true)); 84800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentWrites("asan-instrument-writes", 85800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument write instructions"), cl::Hidden, cl::init(true)); 86e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryanystatic cl::opt<bool> ClInstrumentAtomics("asan-instrument-atomics", 87e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany cl::desc("instrument atomic instructions (rmw, cmpxchg)"), 88e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany cl::Hidden, cl::init(true)); 89c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanystatic cl::opt<bool> ClMergeCallbacks("asan-merge-callbacks", 90c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany cl::desc("merge __asan_report_ callbacks to create fewer BBs"), 91c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany cl::Hidden, cl::init(false)); 92c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany// This flag limits the number of instructions to be instrumented 93324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// in any given BB. Normally, this should be set to unlimited (INT_MAX), 94324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary 95324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// set it to 10000. 96324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryanystatic cl::opt<int> ClMaxInsnsToInstrumentPerBB("asan-max-ins-per-bb", 97324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::init(10000), 98324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::desc("maximal number of instructions to instrument in any given BB"), 99324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::Hidden); 100800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-stack. 101800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClStack("asan-stack", 102800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle stack memory"), cl::Hidden, cl::init(true)); 103800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-use-after-return. 104800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClUseAfterReturn("asan-use-after-return", 105800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Check return-after-free"), cl::Hidden, cl::init(false)); 106800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-globals. 107800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClGlobals("asan-globals", 108800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle global objects"), cl::Hidden, cl::init(true)); 109800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClMemIntrin("asan-memintrin", 110800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle memset/memcpy/memmove"), cl::Hidden, cl::init(true)); 111800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -fasan-blacklist. 112800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<std::string> ClBlackListFile("asan-blacklist", 113800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("File containing the list of functions to ignore " 114800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "during instrumentation"), cl::Hidden); 115800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 116800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// These flags allow to change the shadow mapping. 117800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The shadow mapping looks like 118800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Shadow = (Mem >> scale) + (1 << offset_log) 119800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingScale("asan-mapping-scale", 120800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0)); 121800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingOffsetLog("asan-mapping-offset-log", 122800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("offset of asan shadow mapping"), cl::Hidden, cl::init(-1)); 123800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 124800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Optimization flags. Not user visible, used mostly for testing 125800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// and benchmarking the tool. 126800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOpt("asan-opt", 127800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true)); 128800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptSameTemp("asan-opt-same-temp", 129800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Instrument the same temp just once"), cl::Hidden, 130800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(true)); 131800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptGlobals("asan-opt-globals", 132800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true)); 133800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 134800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Debug flags. 135800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, 136800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(0)); 137800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), 138800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(0)); 139800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<std::string> ClDebugFunc("asan-debug-func", 140800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::desc("Debug func")); 141800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), 142800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 143800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), 144800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 145800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 146800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanynamespace { 147800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1484f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany/// When the crash callbacks are merged, they receive some amount of arguments 1494f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany/// that are merged in a PHI node. This struct represents arguments from one 1504f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany/// call site. 1514f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryanystruct CrashArg { 1524f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany Value *Arg1; 1534f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany Value *Arg2; 1544f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany}; 1554f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany 156c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany/// An object of this type is created while instrumenting every function. 157c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanystruct AsanFunctionContext { 1582735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany AsanFunctionContext(Function &Function) : F(Function), CrashBlock() { } 159c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 1602735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany Function &F; 161c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // These are initially zero. If we require at least one call to 162c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // __asan_report_{read,write}{1,2,4,8,16}, an appropriate BB is created. 163c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany BasicBlock *CrashBlock[2][kNumberOfAccessSizes]; 1644f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany typedef SmallVector<CrashArg, 8> CrashArgsVec; 1654f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany CrashArgsVec CrashArgs[2][kNumberOfAccessSizes]; 166c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany}; 167c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 168800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany/// AddressSanitizer: instrument the code in module to find memory bugs. 169800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystruct AddressSanitizer : public ModulePass { 170800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AddressSanitizer(); 17125878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko virtual const char *getPassName() const; 172c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany void instrumentMop(AsanFunctionContext &AFC, Instruction *I); 173c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany void instrumentAddress(AsanFunctionContext &AFC, 174c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Instruction *OrigIns, IRBuilder<> &IRB, 175800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr, uint32_t TypeSize, bool IsWrite); 176c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 177c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *ShadowValue, uint32_t TypeSize); 1784f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany Instruction *generateCrashCode(BasicBlock *BB, Value *Addr, Value *PC, 1792735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany bool IsWrite, size_t AccessSizeIndex); 180c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany bool instrumentMemIntrinsic(AsanFunctionContext &AFC, MemIntrinsic *MI); 181c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany void instrumentMemIntrinsicParam(AsanFunctionContext &AFC, 182c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Instruction *OrigIns, Value *Addr, 183c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *Size, 184800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore, bool IsWrite); 185800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); 186800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool handleFunction(Module &M, Function &F); 187a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany bool maybeInsertAsanInitAtFunctionEntry(Function &F); 188800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool poisonStackInFunction(Module &M, Function &F); 189800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany virtual bool runOnModule(Module &M); 190800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool insertGlobalRedzones(Module &M); 191800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany static char ID; // Pass identification, replacement for typeid 192800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 193800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany private: 194800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 195800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t getAllocaSizeInBytes(AllocaInst *AI) { 196800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = AI->getAllocatedType(); 197d8313be41031e4d768f5b38199904d4debff88cdEvgeniy Stepanov uint64_t SizeInBytes = TD->getTypeAllocSize(Ty); 198800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return SizeInBytes; 199800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 200800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t getAlignedSize(uint64_t SizeInBytes) { 201800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return ((SizeInBytes + RedzoneSize - 1) 202800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany / RedzoneSize) * RedzoneSize; 203800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 204800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t getAlignedAllocaSize(AllocaInst *AI) { 205800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 206800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return getAlignedSize(SizeInBytes); 207800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 208800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 20955cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko Function *checkInterfaceFunction(Constant *FuncOrBitcast); 210800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany void PoisonStack(const ArrayRef<AllocaInst*> &AllocaVec, IRBuilder<> IRB, 211800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowBase, bool DoPoison); 2125a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany bool LooksLikeCodeInBug11395(Instruction *I); 213800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 214800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LLVMContext *C; 215800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TargetData *TD; 216800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t MappingOffset; 217800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int MappingScale; 218800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t RedzoneSize; 219800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int LongSize; 220800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *IntptrTy; 221800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *IntptrPtrTy; 222800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanCtorFunction; 223800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanInitFunction; 224800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *CtorInsertBefore; 225a1c45044099cf7fb4a072f1326f164706d5bb2e2Kostya Serebryany OwningPtr<FunctionBlackList> BL; 2269db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // This array is indexed by AccessIsWrite and log2(AccessSize). 2279db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany Function *AsanErrorCallback[2][kNumberOfAccessSizes]; 228f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany InlineAsm *EmptyAsm; 229800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany}; 230c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 231800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} // namespace 232800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 233800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanychar AddressSanitizer::ID = 0; 234800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyINITIALIZE_PASS(AddressSanitizer, "asan", 235800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", 236800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany false, false) 237800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyAddressSanitizer::AddressSanitizer() : ModulePass(ID) { } 238800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyModulePass *llvm::createAddressSanitizerPass() { 239800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return new AddressSanitizer(); 240800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 241800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 24225878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenkoconst char *AddressSanitizer::getPassName() const { 24325878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko return "AddressSanitizer"; 24425878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko} 24525878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko 2462735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryanystatic size_t TypeSizeToSizeIndex(uint32_t TypeSize) { 2472735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany size_t Res = CountTrailingZeros_32(TypeSize / 8); 2482735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany assert(Res < kNumberOfAccessSizes); 2492735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany return Res; 2502735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany} 2512735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany 252800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Create a constant for Str so that we can pass it to the run-time lib. 253800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic GlobalVariable *createPrivateGlobalForString(Module &M, StringRef Str) { 25418c7f80b3e83ab584bd8572695a3cde8bafd9d3cChris Lattner Constant *StrConst = ConstantDataArray::getString(M.getContext(), Str); 255800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return new GlobalVariable(M, StrConst->getType(), true, 256800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalValue::PrivateLinkage, StrConst, ""); 257800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 258800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 259800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Split the basic block and insert an if-then code. 260800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Before: 261800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Head 26256139bc493790612ee6281630678e293be6b2eb2Kostya Serebryany// Cmp 263800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Tail 264800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// After: 265800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Head 266800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// if (Cmp) 26756139bc493790612ee6281630678e293be6b2eb2Kostya Serebryany// ThenBlock 268800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Tail 269800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 270c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany// If ThenBlock is zero, a new block is created and its terminator is returned. 2712735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany// Otherwize 0 is returned. 272c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanystatic BranchInst *splitBlockAndInsertIfThen(Value *Cmp, 273c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany BasicBlock *ThenBlock = 0) { 27456139bc493790612ee6281630678e293be6b2eb2Kostya Serebryany Instruction *SplitBefore = cast<Instruction>(Cmp)->getNextNode(); 275800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock *Head = SplitBefore->getParent(); 276349f14c72cbcd3c50091d20a874967aca5f2f746Chandler Carruth BasicBlock *Tail = Head->splitBasicBlock(SplitBefore); 277800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TerminatorInst *HeadOldTerm = Head->getTerminator(); 2782735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany BranchInst *CheckTerm = 0; 279c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany if (!ThenBlock) { 280c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LLVMContext &C = Head->getParent()->getParent()->getContext(); 281f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany ThenBlock = BasicBlock::Create(C, "", Head->getParent(), Tail); 282c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany CheckTerm = BranchInst::Create(Tail, ThenBlock); 283c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany } 284349f14c72cbcd3c50091d20a874967aca5f2f746Chandler Carruth BranchInst *HeadNewTerm = 285349f14c72cbcd3c50091d20a874967aca5f2f746Chandler Carruth BranchInst::Create(/*ifTrue*/ThenBlock, /*ifFalse*/Tail, Cmp); 286349f14c72cbcd3c50091d20a874967aca5f2f746Chandler Carruth ReplaceInstWithInst(HeadOldTerm, HeadNewTerm); 287349f14c72cbcd3c50091d20a874967aca5f2f746Chandler Carruth 288349f14c72cbcd3c50091d20a874967aca5f2f746Chandler Carruth return CheckTerm; 289800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 290800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 291800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyValue *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { 292800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Shadow >> scale 293800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Shadow = IRB.CreateLShr(Shadow, MappingScale); 294800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (MappingOffset == 0) 295800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return Shadow; 296800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // (Shadow >> scale) | offset 297800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return IRB.CreateOr(Shadow, ConstantInt::get(IntptrTy, 298800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset)); 299800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 300800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 301c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanyvoid AddressSanitizer::instrumentMemIntrinsicParam( 302c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany AsanFunctionContext &AFC, Instruction *OrigIns, 303800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr, Value *Size, Instruction *InsertBefore, bool IsWrite) { 304800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the first byte. 305800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany { 306800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 307c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany instrumentAddress(AFC, OrigIns, IRB, Addr, 8, IsWrite); 308800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 309800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the last byte. 310800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany { 311800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 312800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *SizeMinusOne = IRB.CreateSub( 313800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Size, ConstantInt::get(Size->getType(), 1)); 314800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SizeMinusOne = IRB.CreateIntCast(SizeMinusOne, IntptrTy, false); 315800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 316800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrPlusSizeMinisOne = IRB.CreateAdd(AddrLong, SizeMinusOne); 317c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany instrumentAddress(AFC, OrigIns, IRB, AddrPlusSizeMinisOne, 8, IsWrite); 318800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 319800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 320800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 321800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Instrument memset/memmove/memcpy 322c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanybool AddressSanitizer::instrumentMemIntrinsic(AsanFunctionContext &AFC, 323c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany MemIntrinsic *MI) { 324800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Dst = MI->getDest(); 325800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MemTransferInst *MemTran = dyn_cast<MemTransferInst>(MI); 3262735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany Value *Src = MemTran ? MemTran->getSource() : 0; 327800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Length = MI->getLength(); 328800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 329800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *ConstLength = dyn_cast<Constant>(Length); 330800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore = MI; 331800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength) { 332800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength->isNullValue()) return false; 333800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 334800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // The size is not a constant so it could be zero -- check at run-time. 335800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 336800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 337800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(Length, 33856139bc493790612ee6281630678e293be6b2eb2Kostya Serebryany Constant::getNullValue(Length->getType())); 33956139bc493790612ee6281630678e293be6b2eb2Kostya Serebryany InsertBefore = splitBlockAndInsertIfThen(Cmp); 340800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 341800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 342c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany instrumentMemIntrinsicParam(AFC, MI, Dst, Length, InsertBefore, true); 343800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (Src) 344c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany instrumentMemIntrinsicParam(AFC, MI, Src, Length, InsertBefore, false); 345800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 346800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 347800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 348e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany// If I is an interesting memory access, return the PointerOperand 349e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany// and set IsWrite. Otherwise return NULL. 350e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryanystatic Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite) { 351800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 352e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentReads) return NULL; 353e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = false; 354800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return LI->getPointerOperand(); 355800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 356e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (StoreInst *SI = dyn_cast<StoreInst>(I)) { 357e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentWrites) return NULL; 358e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 359e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return SI->getPointerOperand(); 360e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 361e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { 362e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentAtomics) return NULL; 363e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 364e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return RMW->getPointerOperand(); 365e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 366e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { 367e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentAtomics) return NULL; 368e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 369e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return XCHG->getPointerOperand(); 370e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 371e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return NULL; 372800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 373800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 374c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanyvoid AddressSanitizer::instrumentMop(AsanFunctionContext &AFC, Instruction *I) { 375e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany bool IsWrite; 376e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany Value *Addr = isInterestingMemoryAccess(I, &IsWrite); 377e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany assert(Addr); 378800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClOpt && ClOptGlobals && isa<GlobalVariable>(Addr)) { 379800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We are accessing a global scalar variable. Nothing to catch here. 380800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return; 381800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 382800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigPtrTy = Addr->getType(); 383800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigTy = cast<PointerType>(OrigPtrTy)->getElementType(); 384800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 385800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(OrigTy->isSized()); 386800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t TypeSize = TD->getTypeStoreSizeInBits(OrigTy); 387800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 388800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (TypeSize != 8 && TypeSize != 16 && 389800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TypeSize != 32 && TypeSize != 64 && TypeSize != 128) { 390800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Ignore all unusual sizes. 391800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return; 392800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 393800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 394800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(I); 395c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany instrumentAddress(AFC, I, IRB, Addr, TypeSize, IsWrite); 396800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 397800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 39855cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// Validate the result of Module::getOrInsertFunction called for an interface 39955cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// function of AddressSanitizer. If the instrumented module defines a function 40055cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// with the same name, their prototypes must match, otherwise 40155cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// getOrInsertFunction returns a bitcast. 40255cabae685991ac6bc6d96b14e2139f64a0c9967Alexander PotapenkoFunction *AddressSanitizer::checkInterfaceFunction(Constant *FuncOrBitcast) { 40355cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko if (isa<Function>(FuncOrBitcast)) return cast<Function>(FuncOrBitcast); 40455cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko FuncOrBitcast->dump(); 40555cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko report_fatal_error("trying to redefine an AddressSanitizer " 40655cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko "interface function"); 40755cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko} 40855cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko 409800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyInstruction *AddressSanitizer::generateCrashCode( 4104f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany BasicBlock *BB, Value *Addr, Value *PC, 4114f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany bool IsWrite, size_t AccessSizeIndex) { 412c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany IRBuilder<> IRB(BB->getFirstNonPHI()); 4134f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany CallInst *Call; 4144f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany if (PC) 4154f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany Call = IRB.CreateCall2(AsanErrorCallback[IsWrite][AccessSizeIndex], 4164f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany Addr, PC); 4174f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany else 4184f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany Call = IRB.CreateCall(AsanErrorCallback[IsWrite][AccessSizeIndex], Addr); 419f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // We don't do Call->setDoesNotReturn() because the BB already has 420f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // UnreachableInst at the end. 421f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // This EmptyAsm is required to avoid callback merge. 422f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany IRB.CreateCall(EmptyAsm); 4233c7faae346f548c55cad86d82a2e242443001f23Kostya Serebryany return Call; 424800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 425800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 4262735cf4aa52e31b8d2de90f836c3ad991215e04eKostya SerebryanyValue *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 427c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *ShadowValue, 428c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany uint32_t TypeSize) { 429c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany size_t Granularity = 1 << MappingScale; 430c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // Addr & (Granularity - 1) 431c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *LastAccessedByte = IRB.CreateAnd( 432c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); 433c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // (Addr & (Granularity - 1)) + size - 1 434c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany if (TypeSize / 8 > 1) 435c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte = IRB.CreateAdd( 436c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); 437c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // (uint8_t) ((Addr & (Granularity-1)) + size - 1) 438c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte = IRB.CreateIntCast( 439c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte, IRB.getInt8Ty(), false); 440c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue 441c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); 442c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany} 443c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 444c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanyvoid AddressSanitizer::instrumentAddress(AsanFunctionContext &AFC, 445c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Instruction *OrigIns, 446800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> &IRB, Value *Addr, 447800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t TypeSize, bool IsWrite) { 448800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 449800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 450800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowTy = IntegerType::get( 451800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *C, std::max(8U, TypeSize >> MappingScale)); 452800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); 453800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowPtr = memToShadow(AddrLong, IRB); 454800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *CmpVal = Constant::getNullValue(ShadowTy); 455800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowValue = IRB.CreateLoad( 456800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); 457800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 458800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); 459800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 4602735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany BasicBlock *CrashBlock = 0; 461c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany if (ClMergeCallbacks) { 4624f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); 4634f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany BasicBlock **Cached = &AFC.CrashBlock[IsWrite][AccessSizeIndex]; 4642735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany if (!*Cached) { 4654f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany std::string BBName("crash_bb-"); 4664f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany BBName += (IsWrite ? "w-" : "r-") + itostr(1 << AccessSizeIndex); 4674f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany BasicBlock *BB = BasicBlock::Create(*C, BBName, &AFC.F); 4682735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany new UnreachableInst(*C, BB); 4692735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany *Cached = BB; 4702735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany } 4712735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany CrashBlock = *Cached; 4724f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // We need to pass the PC as the second parameter to __asan_report_*. 4734f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // There are few problems: 4744f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // - Some architectures (e.g. x86_32) don't have a cheap way to get the PC. 4754f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // - LLVM doesn't have the appropriate intrinsic. 4764f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // For now, put a random number into the PC, just to allow experiments. 4774f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany Value *PC = ConstantInt::get(IntptrTy, rand()); 4784f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany CrashArg Arg = {AddrLong, PC}; 4794f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany AFC.CrashArgs[IsWrite][AccessSizeIndex].push_back(Arg); 480c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany } else { 4812735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany CrashBlock = BasicBlock::Create(*C, "crash_bb", &AFC.F); 482c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany new UnreachableInst(*C, CrashBlock); 4832735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); 484c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Instruction *Crash = 4854f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany generateCrashCode(CrashBlock, AddrLong, 0, IsWrite, AccessSizeIndex); 486c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Crash->setDebugLoc(OrigIns->getDebugLoc()); 487c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany } 488800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 489800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t Granularity = 1 << MappingScale; 490800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (TypeSize < 8 * Granularity) { 491f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany BranchInst *CheckTerm = splitBlockAndInsertIfThen(Cmp); 492f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany assert(CheckTerm->isUnconditional()); 493f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany BasicBlock *NextBB = CheckTerm->getSuccessor(0); 494c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany IRB.SetInsertPoint(CheckTerm); 495c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); 496f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); 497f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany ReplaceInstWithInst(CheckTerm, NewTerm); 498c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany } else { 499c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany splitBlockAndInsertIfThen(Cmp, CrashBlock); 500800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 501800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 502800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 503800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This function replaces all global variables with new variables that have 504800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// trailing redzones. It also creates a function that poisons 505800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// redzones and inserts this function into llvm.global_ctors. 506800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool AddressSanitizer::insertGlobalRedzones(Module &M) { 507800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<GlobalVariable *, 16> GlobalsToChange; 508800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 509800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Module::GlobalListType::iterator G = M.getGlobalList().begin(), 510800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany E = M.getGlobalList().end(); G != E; ++G) { 511800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = cast<PointerType>(G->getType())->getElementType(); 512800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << "GLOBAL: " << *G); 513800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 514800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!Ty->isSized()) continue; 515800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!G->hasInitializer()) continue; 5167cf2a04361e8613264498e50babe52d65c070473Kostya Serebryany // Touch only those globals that will not be defined in other modules. 5177cf2a04361e8613264498e50babe52d65c070473Kostya Serebryany // Don't handle ODR type linkages since other modules may be built w/o asan. 5182e7fb2f73641f1f1ca385fe7777075945bf4ca24Kostya Serebryany if (G->getLinkage() != GlobalVariable::ExternalLinkage && 5192e7fb2f73641f1f1ca385fe7777075945bf4ca24Kostya Serebryany G->getLinkage() != GlobalVariable::PrivateLinkage && 5202e7fb2f73641f1f1ca385fe7777075945bf4ca24Kostya Serebryany G->getLinkage() != GlobalVariable::InternalLinkage) 521800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 522d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany // Two problems with thread-locals: 523d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany // - The address of the main thread's copy can't be computed at link-time. 524d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany // - Need to poison all copies, not just the main thread's one. 525d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany if (G->isThreadLocal()) 526d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany continue; 527800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // For now, just ignore this Alloca if the alignment is large. 528800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (G->getAlignment() > RedzoneSize) continue; 529800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 530800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Ignore all the globals with the names starting with "\01L_OBJC_". 531800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Many of those are put into the .cstring section. The linker compresses 532800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // that section by removing the spare \0s after the string terminator, so 533800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // our redzones get broken. 534800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if ((G->getName().find("\01L_OBJC_") == 0) || 535800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (G->getName().find("\01l_OBJC_") == 0)) { 536800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << "Ignoring \\01L_OBJC_* global: " << *G); 537800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 538800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 539800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 540800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (G->hasSection()) { 541800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StringRef Section(G->getSection()); 5428375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // Ignore the globals from the __OBJC section. The ObjC runtime assumes 5438375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to 5448375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // them. 545800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if ((Section.find("__OBJC,") == 0) || 546800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (Section.find("__DATA, __objc_") == 0)) { 547800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G); 548800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 549800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 5508375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // See http://code.google.com/p/address-sanitizer/issues/detail?id=32 5518375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // Constant CFString instances are compiled in the following way: 5528375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // -- the string buffer is emitted into 5538375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // __TEXT,__cstring,cstring_literals 5548375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // -- the constant NSConstantString structure referencing that buffer 5558375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // is placed into __DATA,__cfstring 5568375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // Therefore there's no point in placing redzones into __DATA,__cfstring. 5578375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko // Moreover, it causes the linker to crash on OS X 10.7 5588375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko if (Section.find("__DATA,__cfstring") == 0) { 5598375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko DEBUG(dbgs() << "Ignoring CFString: " << *G); 5608375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko continue; 5618375bc923638299410e75e8f668524fc1aa113bdAlexander Potapenko } 562800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 563800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 564800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalsToChange.push_back(G); 565800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 566800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 567800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t n = GlobalsToChange.size(); 568800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (n == 0) return false; 569800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 570800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A global is described by a structure 571800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t beg; 572800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size; 573800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size_with_redzone; 574800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // const char *name; 575800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We initialize an array of such structures and pass it to a run-time call. 576800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *GlobalStructTy = StructType::get(IntptrTy, IntptrTy, 577800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrTy, IntptrTy, NULL); 578800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Constant *, 16> Initializers(n); 579800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 580800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(CtorInsertBefore); 581800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 582800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0; i < n; i++) { 583800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *G = GlobalsToChange[i]; 584800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PointerType *PtrTy = cast<PointerType>(G->getType()); 585800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = PtrTy->getElementType(); 586208a4ff2b56f453910bb817540f34b8169f7702aKostya Serebryany uint64_t SizeInBytes = TD->getTypeAllocSize(Ty); 587800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t RightRedzoneSize = RedzoneSize + 588800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (RedzoneSize - (SizeInBytes % RedzoneSize)); 589800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); 590800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 591800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *NewTy = StructType::get(Ty, RightRedZoneTy, NULL); 592800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *NewInitializer = ConstantStruct::get( 593800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewTy, G->getInitializer(), 594800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant::getNullValue(RightRedZoneTy), NULL); 595800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 596a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany SmallString<2048> DescriptionOfGlobal = G->getName(); 597a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany DescriptionOfGlobal += " ("; 598a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany DescriptionOfGlobal += M.getModuleIdentifier(); 599a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany DescriptionOfGlobal += ")"; 600a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany GlobalVariable *Name = createPrivateGlobalForString(M, DescriptionOfGlobal); 601800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 602800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Create a new global variable with enough space for a redzone. 603800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *NewGlobal = new GlobalVariable( 604800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M, NewTy, G->isConstant(), G->getLinkage(), 605ce718ff9f42c7da092eaa01dd0242e8d5ba84713Hans Wennborg NewInitializer, "", G, G->getThreadLocalMode()); 606800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->copyAttributesFrom(G); 607800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->setAlignment(RedzoneSize); 608800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 609800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Indices2[2]; 610800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[0] = IRB.getInt32(0); 611800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[1] = IRB.getInt32(0); 612800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 613800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->replaceAllUsesWith( 614f1639abf1aaba1448f719f595156cd0f4cd560ccKostya Serebryany ConstantExpr::getGetElementPtr(NewGlobal, Indices2, true)); 615800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->takeName(G); 616800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->eraseFromParent(); 617800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 618800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Initializers[i] = ConstantStruct::get( 619800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalStructTy, 620800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(NewGlobal, IntptrTy), 621800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes), 622800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), 623800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(Name, IntptrTy), 624800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NULL); 625800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << "NEW GLOBAL:\n" << *NewGlobal); 626800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 627800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 628800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ArrayType *ArrayOfGlobalStructTy = ArrayType::get(GlobalStructTy, n); 629800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *AllGlobals = new GlobalVariable( 630800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M, ArrayOfGlobalStructTy, false, GlobalVariable::PrivateLinkage, 631800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantArray::get(ArrayOfGlobalStructTy, Initializers), ""); 632800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 63355cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko Function *AsanRegisterGlobals = checkInterfaceFunction(M.getOrInsertFunction( 634800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 635800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanRegisterGlobals->setLinkage(Function::ExternalLinkage); 636800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 637800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateCall2(AsanRegisterGlobals, 638800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 639800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, n)); 640800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 6417bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // We also need to unregister globals at the end, e.g. when a shared library 6427bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // gets closed. 6437bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany Function *AsanDtorFunction = Function::Create( 6447bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 6457bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany GlobalValue::InternalLinkage, kAsanModuleDtorName, &M); 6467bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); 6477bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRBuilder<> IRB_Dtor(ReturnInst::Create(*C, AsanDtorBB)); 64855cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko Function *AsanUnregisterGlobals = 64955cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko checkInterfaceFunction(M.getOrInsertFunction( 65055cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko kAsanUnregisterGlobalsName, 65155cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 6527bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage); 6537bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany 6547bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB_Dtor.CreateCall2(AsanUnregisterGlobals, 6557bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 6567bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany ConstantInt::get(IntptrTy, n)); 6577bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndCtorPriority); 6587bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany 659800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << M); 660800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 661800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 662800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 663800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// virtual 664800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool AddressSanitizer::runOnModule(Module &M) { 665800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Initialize the private fields. No one has accessed them before. 666800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TD = getAnalysisIfAvailable<TargetData>(); 667800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!TD) 668800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return false; 669a1c45044099cf7fb4a072f1326f164706d5bb2e2Kostya Serebryany BL.reset(new FunctionBlackList(ClBlackListFile)); 670800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 671800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany C = &(M.getContext()); 672800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LongSize = TD->getPointerSizeInBits(); 673800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrTy = Type::getIntNTy(*C, LongSize); 674800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrPtrTy = PointerType::get(IntptrTy, 0); 675800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 676800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanCtorFunction = Function::Create( 677800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 678800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalValue::InternalLinkage, kAsanModuleCtorName, &M); 679800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock *AsanCtorBB = BasicBlock::Create(*C, "", AsanCtorFunction); 680800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany CtorInsertBefore = ReturnInst::Create(*C, AsanCtorBB); 681800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 682800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // call __asan_init in the module ctor. 683800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(CtorInsertBefore); 68455cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko AsanInitFunction = checkInterfaceFunction( 685800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M.getOrInsertFunction(kAsanInitName, IRB.getVoidTy(), NULL)); 686800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanInitFunction->setLinkage(Function::ExternalLinkage); 687800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateCall(AsanInitFunction); 688800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 6899db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // Create __asan_report* callbacks. 6909db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { 6919db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; 6929db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany AccessSizeIndex++) { 6939db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // IsWrite and TypeSize are encoded in the function name. 6949db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany std::string FunctionName = std::string(kAsanReportErrorTemplate) + 6959db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany (AccessIsWrite ? "store" : "load") + itostr(1 << AccessSizeIndex); 6964f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // If we are merging crash callbacks, they have two parameters. 6974f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany if (ClMergeCallbacks) 6984f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany AsanErrorCallback[AccessIsWrite][AccessSizeIndex] = cast<Function>( 6994f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany M.getOrInsertFunction(FunctionName, IRB.getVoidTy(), IntptrTy, 7004f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany IntptrTy, NULL)); 7014f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany else 7024f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany AsanErrorCallback[AccessIsWrite][AccessSizeIndex] = cast<Function>( 7034f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany M.getOrInsertFunction(FunctionName, IRB.getVoidTy(), IntptrTy, NULL)); 7049db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany } 7059db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany } 706f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // We insert an empty inline asm after __asan_report* to avoid callback merge. 707f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 708f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany StringRef(""), StringRef(""), 709f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany /*hasSideEffects=*/true); 7109db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany 71106fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov llvm::Triple targetTriple(M.getTargetTriple()); 71206fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov bool isAndroid = targetTriple.getEnvironment() == llvm::Triple::ANDROIDEABI; 71306fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov 71406fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov MappingOffset = isAndroid ? kDefaultShadowOffsetAndroid : 71506fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov (LongSize == 32 ? kDefaultShadowOffset32 : kDefaultShadowOffset64); 716800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClMappingOffsetLog >= 0) { 717800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClMappingOffsetLog == 0) { 718800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // special case 719800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset = 0; 720800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 721800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset = 1ULL << ClMappingOffsetLog; 722800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 723800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 724800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingScale = kDefaultShadowScale; 725800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClMappingScale) { 726800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingScale = ClMappingScale; 727800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 728800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Redzone used for stack and globals is at least 32 bytes. 729800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. 730800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany RedzoneSize = std::max(32, (int)(1 << MappingScale)); 731800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 732800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool Res = false; 733800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 734800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClGlobals) 735800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Res |= insertGlobalRedzones(M); 736800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 7378c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany if (ClMappingOffsetLog >= 0) { 7388c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany // Tell the run-time the current values of mapping offset and scale. 7398c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany GlobalValue *asan_mapping_offset = 7408c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 7418c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany ConstantInt::get(IntptrTy, MappingOffset), 7428c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany kAsanMappingOffsetName); 7438c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany // Read the global, otherwise it may be optimized away. 7448c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany IRB.CreateLoad(asan_mapping_offset, true); 7458c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany } 7468c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany if (ClMappingScale) { 7478c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany GlobalValue *asan_mapping_scale = 7488c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 7498c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany ConstantInt::get(IntptrTy, MappingScale), 7508c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany kAsanMappingScaleName); 7518c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany // Read the global, otherwise it may be optimized away. 7528c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany IRB.CreateLoad(asan_mapping_scale, true); 7538c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany } 754800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 755800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 756800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Module::iterator F = M.begin(), E = M.end(); F != E; ++F) { 757800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (F->isDeclaration()) continue; 758800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Res |= handleFunction(M, *F); 759800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 760800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 7617bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndCtorPriority); 7629b02741d2284d9516a59666c211fe1f57e8803adKostya Serebryany 763800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return Res; 764800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 765800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 766a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryanybool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { 767a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // For each NSObject descendant having a +load method, this method is invoked 768a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // by the ObjC runtime before any of the static constructors is called. 769a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // Therefore we need to instrument such methods with a call to __asan_init 770a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // at the beginning in order to initialize our runtime before any access to 771a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // the shadow memory. 772a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // We cannot just ignore these methods, because they may call other 773a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // instrumented functions. 774a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany if (F.getName().find(" load]") != std::string::npos) { 775a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany IRBuilder<> IRB(F.begin()->begin()); 776a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany IRB.CreateCall(AsanInitFunction); 777a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany return true; 778a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany } 779a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany return false; 780a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany} 781a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 782800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool AddressSanitizer::handleFunction(Module &M, Function &F) { 783800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (BL->isIn(F)) return false; 784800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (&F == AsanCtorFunction) return false; 785a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 786a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // If needed, insert __asan_init before checking for AddressSafety attr. 787a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany maybeInsertAsanInitAtFunctionEntry(F); 788a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 7890307b9a88574d7e54459181afaa656ac92971847Kostya Serebryany if (!F.hasFnAttr(Attribute::AddressSafety)) return false; 790800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 791800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!ClDebugFunc.empty() && ClDebugFunc != F.getName()) 792800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return false; 793800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We want to instrument every address only once per basic block 794800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // (unless there are calls between uses). 795800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallSet<Value*, 16> TempsToInstrument; 796800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Instruction*, 16> ToInstrument; 79795e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany SmallVector<Instruction*, 8> NoReturnCalls; 798e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany bool IsWrite; 799800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 800800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Fill the set of memory operations to instrument. 801800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Function::iterator FI = F.begin(), FE = F.end(); 802800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FI != FE; ++FI) { 803800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 804324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany int NumInsnsPerBB = 0; 805800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (BasicBlock::iterator BI = FI->begin(), BE = FI->end(); 806800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BI != BE; ++BI) { 807bcb55ce3862bbbedac4e09d7099c9e0efc434e4bKostya Serebryany if (LooksLikeCodeInBug11395(BI)) return false; 808e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (Value *Addr = isInterestingMemoryAccess(BI, &IsWrite)) { 809800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClOpt && ClOptSameTemp) { 810800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!TempsToInstrument.insert(Addr)) 811800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; // We've seen this temp in the current BB. 812800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 813800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (isa<MemIntrinsic>(BI) && ClMemIntrin) { 814800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // ok, take it. 815800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 81695e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany if (CallInst *CI = dyn_cast<CallInst>(BI)) { 817800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A call inside BB. 818800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 81995e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany if (CI->doesNotReturn()) { 82095e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany NoReturnCalls.push_back(CI); 82195e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany } 822800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 823800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 824800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 825800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ToInstrument.push_back(BI); 826324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany NumInsnsPerBB++; 827324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) 828324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany break; 829800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 830800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 831800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 8322735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany AsanFunctionContext AFC(F); 833c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 834800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Instrument. 835800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int NumInstrumented = 0; 836800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = ToInstrument.size(); i != n; i++) { 837800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Inst = ToInstrument[i]; 838800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClDebugMin < 0 || ClDebugMax < 0 || 839800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) { 840e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (isInterestingMemoryAccess(Inst, &IsWrite)) 841c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany instrumentMop(AFC, Inst); 842800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany else 843c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany instrumentMemIntrinsic(AFC, cast<MemIntrinsic>(Inst)); 844800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 845800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NumInstrumented++; 846800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 847800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 8484f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // Create PHI nodes and crash callbacks if we are merging crash callbacks. 8492735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany if (NumInstrumented) { 8502735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany for (size_t IsWrite = 0; IsWrite <= 1; IsWrite++) { 8512735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; 8522735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany AccessSizeIndex++) { 8532735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany BasicBlock *BB = AFC.CrashBlock[IsWrite][AccessSizeIndex]; 8542735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany if (!BB) continue; 8554f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany assert(ClMergeCallbacks); 8564f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany AsanFunctionContext::CrashArgsVec &Args = 8574f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany AFC.CrashArgs[IsWrite][AccessSizeIndex]; 8584f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany IRBuilder<> IRB(BB->getFirstNonPHI()); 8594f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany size_t n = Args.size(); 8604f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany PHINode *PN1 = IRB.CreatePHI(IntptrTy, n); 8614f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany PHINode *PN2 = IRB.CreatePHI(IntptrTy, n); 8624f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // We need to match crash parameters and the predecessors. 8634f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany for (pred_iterator PI = pred_begin(BB), PE = pred_end(BB); 8644f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany PI != PE; ++PI) { 8654f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany n--; 8664f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany PN1->addIncoming(Args[n].Arg1, *PI); 8674f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany PN2->addIncoming(Args[n].Arg2, *PI); 8684f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany } 8694f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany assert(n == 0); 8704f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany generateCrashCode(BB, PN1, PN2, IsWrite, AccessSizeIndex); 8712735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany } 8722735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany } 8732735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany } 8742735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany 875800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << F); 876800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 877800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool ChangedStack = poisonStackInFunction(M, F); 87895e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany 87995e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany // We must unpoison the stack before every NoReturn call (throw, _exit, etc). 88095e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany // See e.g. http://code.google.com/p/address-sanitizer/issues/detail?id=37 88195e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany for (size_t i = 0, n = NoReturnCalls.size(); i != n; i++) { 88295e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany Instruction *CI = NoReturnCalls[i]; 88395e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany IRBuilder<> IRB(CI); 88495e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany IRB.CreateCall(M.getOrInsertFunction(kAsanHandleNoReturnName, 88595e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany IRB.getVoidTy(), NULL)); 88695e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany } 88795e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany 88895e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany return NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty(); 889800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 890800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 891800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic uint64_t ValueForPoison(uint64_t PoisonByte, size_t ShadowRedzoneSize) { 892800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 1) return PoisonByte; 893800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 2) return (PoisonByte << 8) + PoisonByte; 894800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 4) 895800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return (PoisonByte << 24) + (PoisonByte << 16) + 896800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (PoisonByte << 8) + (PoisonByte); 897858143816d43e58b17bfd11cb1b57afbd7f0f893Craig Topper llvm_unreachable("ShadowRedzoneSize is either 1, 2 or 4"); 898800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 899800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 900800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic void PoisonShadowPartialRightRedzone(uint8_t *Shadow, 901800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t Size, 902800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t RedzoneSize, 903800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t ShadowGranularity, 904800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint8_t Magic) { 905800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0; i < RedzoneSize; 906800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany i+= ShadowGranularity, Shadow++) { 907800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (i + ShadowGranularity <= Size) { 908800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = 0; // fully addressable 909800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (i >= Size) { 910800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Magic; // unaddressable 911800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 912800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Size - i; // first Size-i bytes are addressable 913800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 914800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 915800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 916800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 917800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyvoid AddressSanitizer::PoisonStack(const ArrayRef<AllocaInst*> &AllocaVec, 918800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB, 919800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowBase, bool DoPoison) { 920800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t ShadowRZSize = RedzoneSize >> MappingScale; 921800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowRZSize >= 1 && ShadowRZSize <= 4); 922800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZTy = Type::getIntNTy(*C, ShadowRZSize * 8); 923800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZPtrTy = PointerType::get(RZTy, 0); 924800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 925800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonLeft = ConstantInt::get(RZTy, 926800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackLeftRedzoneMagic : 0LL, ShadowRZSize)); 927800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonMid = ConstantInt::get(RZTy, 928800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackMidRedzoneMagic : 0LL, ShadowRZSize)); 929800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonRight = ConstantInt::get(RZTy, 930800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackRightRedzoneMagic : 0LL, ShadowRZSize)); 931800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 932800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison the first red zone. 933800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PoisonLeft, IRB.CreateIntToPtr(ShadowBase, RZPtrTy)); 934800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 935800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison all other red zones. 936800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t Pos = RedzoneSize; 937800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 938800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 939800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 940800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 941800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(AlignedSize - SizeInBytes < RedzoneSize); 942800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Ptr = NULL; 943800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 944800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Pos += AlignedSize; 945800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 946800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowBase->getType() == IntptrTy); 947800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (SizeInBytes < AlignedSize) { 948800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the partial redzone at right 949800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd( 950800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ShadowBase, ConstantInt::get(IntptrTy, 951800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (Pos >> MappingScale) - ShadowRZSize)); 952800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t AddressableBytes = RedzoneSize - (AlignedSize - SizeInBytes); 953800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t Poison = 0; 954800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoPoison) { 955800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonShadowPartialRightRedzone((uint8_t*)&Poison, AddressableBytes, 956800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany RedzoneSize, 957800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1ULL << MappingScale, 958800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanStackPartialRedzoneMagic); 959800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 960800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PartialPoison = ConstantInt::get(RZTy, Poison); 961800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PartialPoison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 962800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 963800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 964800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the full redzone at right. 965800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd(ShadowBase, 966800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, Pos >> MappingScale)); 967800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Poison = i == AllocaVec.size() - 1 ? PoisonRight : PoisonMid; 968800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Poison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 969800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 970800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Pos += RedzoneSize; 971800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 972800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 973800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 9745a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany// Workaround for bug 11395: we don't want to instrument stack in functions 9755a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany// with large assembly blobs (32-bit only), otherwise reg alloc may crash. 976d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany// FIXME: remove once the bug 11395 is fixed. 9775a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryanybool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { 9785a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (LongSize != 32) return false; 9795a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany CallInst *CI = dyn_cast<CallInst>(I); 9805a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (!CI || !CI->isInlineAsm()) return false; 9815a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (CI->getNumArgOperands() <= 5) return false; 9825a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany // We have inline assembly with quite a few arguments. 9835a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany return true; 9845a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany} 9855a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany 986800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Find all static Alloca instructions and put 987800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// poisoned red zones around all of them. 988800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Then unpoison everything back before the function returns. 989800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 990800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Stack poisoning does not play well with exception handling. 991800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// When an exception is thrown, we essentially bypass the code 992800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// that unpoisones the stack. This is why the run-time library has 993800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire 994800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// stack in the interceptor. This however does not work inside the 995800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// actual function which catches the exception. Most likely because the 996800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// compiler hoists the load of the shadow value somewhere too high. 997800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This causes asan to report a non-existing bug on 453.povray. 998800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// It sounds like an LLVM bug. 999800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanybool AddressSanitizer::poisonStackInFunction(Module &M, Function &F) { 1000800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!ClStack) return false; 1001800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<AllocaInst*, 16> AllocaVec; 1002800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Instruction*, 8> RetVec; 1003800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t TotalSize = 0; 1004800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1005800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Filter out Alloca instructions we want (and can) handle. 1006800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Collect Ret instructions. 1007800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Function::iterator FI = F.begin(), FE = F.end(); 1008800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FI != FE; ++FI) { 1009800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock &BB = *FI; 1010800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (BasicBlock::iterator BI = BB.begin(), BE = BB.end(); 1011800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BI != BE; ++BI) { 1012800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (isa<ReturnInst>(BI)) { 1013800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany RetVec.push_back(BI); 1014800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 1015800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1016800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1017800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = dyn_cast<AllocaInst>(BI); 1018800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!AI) continue; 1019800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (AI->isArrayAllocation()) continue; 1020800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!AI->isStaticAlloca()) continue; 1021800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!AI->getAllocatedType()->isSized()) continue; 1022800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (AI->getAlignment() > RedzoneSize) continue; 1023800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaVec.push_back(AI); 1024800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 1025800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TotalSize += AlignedSize; 1026800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1027800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1028800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1029800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (AllocaVec.empty()) return false; 1030800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1031800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t LocalStackSize = TotalSize + (AllocaVec.size() + 1) * RedzoneSize; 1032800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1033800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany bool DoStackMalloc = ClUseAfterReturn 1034800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany && LocalStackSize <= kMaxStackMallocSize; 1035800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1036800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsBefore = AllocaVec[0]; 1037800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsBefore); 1038800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1039800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1040800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ByteArrayTy = ArrayType::get(IRB.getInt8Ty(), LocalStackSize); 1041800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *MyAlloca = 1042800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany new AllocaInst(ByteArrayTy, "MyAlloca", InsBefore); 1043800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MyAlloca->setAlignment(RedzoneSize); 1044800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(MyAlloca->isStaticAlloca()); 1045800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *OrigStackBase = IRB.CreatePointerCast(MyAlloca, IntptrTy); 1046800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *LocalStackBase = OrigStackBase; 1047800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1048800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 1049800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AsanStackMallocFunc = M.getOrInsertFunction( 1050800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanStackMallocName, IntptrTy, IntptrTy, IntptrTy, NULL); 1051800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LocalStackBase = IRB.CreateCall2(AsanStackMallocFunc, 1052800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), OrigStackBase); 1053800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1054800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1055800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // This string will be parsed by the run-time (DescribeStackAddress). 1056800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallString<2048> StackDescriptionStorage; 1057800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany raw_svector_ostream StackDescription(StackDescriptionStorage); 1058800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StackDescription << F.getName() << " " << AllocaVec.size() << " "; 1059800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1060800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t Pos = RedzoneSize; 1061800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Replace Alloca instructions with base+offset. 1062800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 1063800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 1064800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 1065800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StringRef Name = AI->getName(); 1066800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StackDescription << Pos << " " << SizeInBytes << " " 1067800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany << Name.size() << " " << Name << " "; 1068800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 1069800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert((AlignedSize % RedzoneSize) == 0); 1070800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AI->replaceAllUsesWith( 1071800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateIntToPtr( 1072800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Pos)), 1073800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AI->getType())); 1074800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Pos += AlignedSize + RedzoneSize; 1075800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1076800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(Pos == LocalStackSize); 1077800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1078800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Write the Magic value and the frame description constant to the redzone. 1079800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); 1080800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), 1081800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 1082800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *BasePlus1 = IRB.CreateAdd(LocalStackBase, 1083800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LongSize/8)); 1084800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus1 = IRB.CreateIntToPtr(BasePlus1, IntptrPtrTy); 1085800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Description = IRB.CreatePointerCast( 1086800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany createPrivateGlobalForString(M, StackDescription.str()), 1087800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrTy); 1088800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Description, BasePlus1); 1089800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1090800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the stack redzones at the entry. 1091800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowBase = memToShadow(LocalStackBase, IRB); 1092800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonStack(ArrayRef<AllocaInst*>(AllocaVec), IRB, ShadowBase, true); 1093800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1094800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AsanStackFreeFunc = NULL; 1095800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 1096800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanStackFreeFunc = M.getOrInsertFunction( 1097800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanStackFreeName, IRB.getVoidTy(), 1098800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IntptrTy, IntptrTy, IntptrTy, NULL); 1099800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1100800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1101800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack before all ret instructions. 1102800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = RetVec.size(); i < n; i++) { 1103800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Ret = RetVec[i]; 1104800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRBRet(Ret); 1105800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1106800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Mark the current frame as retired. 1107800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), 1108800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 1109800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack. 1110800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonStack(ArrayRef<AllocaInst*>(AllocaVec), IRBRet, ShadowBase, false); 1111800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1112800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 1113800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBRet.CreateCall3(AsanStackFreeFunc, LocalStackBase, 1114800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), 1115800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany OrigStackBase); 1116800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1117800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1118800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1119800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClDebugStack) { 1120800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << F); 1121800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1122800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1123800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 1124800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1125