1//===-- AddressSanitizer.cpp - memory error detector ------------*- C++ -*-===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// Details of the algorithm: 12// http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm 13// 14//===----------------------------------------------------------------------===// 15 16#include "llvm/Transforms/Instrumentation.h" 17#include "llvm/ADT/ArrayRef.h" 18#include "llvm/ADT/DenseMap.h" 19#include "llvm/ADT/DenseSet.h" 20#include "llvm/ADT/DepthFirstIterator.h" 21#include "llvm/ADT/SmallSet.h" 22#include "llvm/ADT/SmallString.h" 23#include "llvm/ADT/SmallVector.h" 24#include "llvm/ADT/Statistic.h" 25#include "llvm/ADT/StringExtras.h" 26#include "llvm/ADT/Triple.h" 27#include "llvm/Analysis/MemoryBuiltins.h" 28#include "llvm/Analysis/TargetLibraryInfo.h" 29#include "llvm/Analysis/ValueTracking.h" 30#include "llvm/IR/CallSite.h" 31#include "llvm/IR/DIBuilder.h" 32#include "llvm/IR/DataLayout.h" 33#include "llvm/IR/Dominators.h" 34#include "llvm/IR/Function.h" 35#include "llvm/IR/IRBuilder.h" 36#include "llvm/IR/InlineAsm.h" 37#include "llvm/IR/InstVisitor.h" 38#include "llvm/IR/IntrinsicInst.h" 39#include "llvm/IR/LLVMContext.h" 40#include "llvm/IR/MDBuilder.h" 41#include "llvm/IR/Module.h" 42#include "llvm/IR/Type.h" 43#include "llvm/MC/MCSectionMachO.h" 44#include "llvm/Support/CommandLine.h" 45#include "llvm/Support/DataTypes.h" 46#include "llvm/Support/Debug.h" 47#include "llvm/Support/Endian.h" 48#include "llvm/Support/SwapByteOrder.h" 49#include "llvm/Support/raw_ostream.h" 50#include "llvm/Transforms/Scalar.h" 51#include "llvm/Transforms/Utils/ASanStackFrameLayout.h" 52#include "llvm/Transforms/Utils/BasicBlockUtils.h" 53#include "llvm/Transforms/Utils/Cloning.h" 54#include "llvm/Transforms/Utils/Local.h" 55#include "llvm/Transforms/Utils/ModuleUtils.h" 56#include "llvm/Transforms/Utils/PromoteMemToReg.h" 57#include <algorithm> 58#include <string> 59#include <system_error> 60 61using namespace llvm; 62 63#define DEBUG_TYPE "asan" 64 65static const uint64_t kDefaultShadowScale = 3; 66static const uint64_t kDefaultShadowOffset32 = 1ULL << 29; 67static const uint64_t kIOSShadowOffset32 = 1ULL << 30; 68static const uint64_t kDefaultShadowOffset64 = 1ULL << 44; 69static const uint64_t kSmallX86_64ShadowOffset = 0x7FFF8000; // < 2G. 70static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 41; 71static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000; 72static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37; 73static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36; 74static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30; 75static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46; 76static const uint64_t kWindowsShadowOffset32 = 3ULL << 28; 77 78static const size_t kMinStackMallocSize = 1 << 6; // 64B 79static const size_t kMaxStackMallocSize = 1 << 16; // 64K 80static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; 81static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; 82 83static const char *const kAsanModuleCtorName = "asan.module_ctor"; 84static const char *const kAsanModuleDtorName = "asan.module_dtor"; 85static const uint64_t kAsanCtorAndDtorPriority = 1; 86static const char *const kAsanReportErrorTemplate = "__asan_report_"; 87static const char *const kAsanRegisterGlobalsName = "__asan_register_globals"; 88static const char *const kAsanUnregisterGlobalsName = 89 "__asan_unregister_globals"; 90static const char *const kAsanPoisonGlobalsName = "__asan_before_dynamic_init"; 91static const char *const kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"; 92static const char *const kAsanInitName = "__asan_init_v5"; 93static const char *const kAsanPtrCmp = "__sanitizer_ptr_cmp"; 94static const char *const kAsanPtrSub = "__sanitizer_ptr_sub"; 95static const char *const kAsanHandleNoReturnName = "__asan_handle_no_return"; 96static const int kMaxAsanStackMallocSizeClass = 10; 97static const char *const kAsanStackMallocNameTemplate = "__asan_stack_malloc_"; 98static const char *const kAsanStackFreeNameTemplate = "__asan_stack_free_"; 99static const char *const kAsanGenPrefix = "__asan_gen_"; 100static const char *const kSanCovGenPrefix = "__sancov_gen_"; 101static const char *const kAsanPoisonStackMemoryName = 102 "__asan_poison_stack_memory"; 103static const char *const kAsanUnpoisonStackMemoryName = 104 "__asan_unpoison_stack_memory"; 105 106static const char *const kAsanOptionDetectUAR = 107 "__asan_option_detect_stack_use_after_return"; 108 109// Accesses sizes are powers of two: 1, 2, 4, 8, 16. 110static const size_t kNumberOfAccessSizes = 5; 111 112static const unsigned kAllocaRzSize = 32; 113static const unsigned kAsanAllocaLeftMagic = 0xcacacacaU; 114static const unsigned kAsanAllocaRightMagic = 0xcbcbcbcbU; 115static const unsigned kAsanAllocaPartialVal1 = 0xcbcbcb00U; 116static const unsigned kAsanAllocaPartialVal2 = 0x000000cbU; 117 118// Command-line flags. 119 120// This flag may need to be replaced with -f[no-]asan-reads. 121static cl::opt<bool> ClInstrumentReads("asan-instrument-reads", 122 cl::desc("instrument read instructions"), 123 cl::Hidden, cl::init(true)); 124static cl::opt<bool> ClInstrumentWrites( 125 "asan-instrument-writes", cl::desc("instrument write instructions"), 126 cl::Hidden, cl::init(true)); 127static cl::opt<bool> ClInstrumentAtomics( 128 "asan-instrument-atomics", 129 cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, 130 cl::init(true)); 131static cl::opt<bool> ClAlwaysSlowPath( 132 "asan-always-slow-path", 133 cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, 134 cl::init(false)); 135// This flag limits the number of instructions to be instrumented 136// in any given BB. Normally, this should be set to unlimited (INT_MAX), 137// but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary 138// set it to 10000. 139static cl::opt<int> ClMaxInsnsToInstrumentPerBB( 140 "asan-max-ins-per-bb", cl::init(10000), 141 cl::desc("maximal number of instructions to instrument in any given BB"), 142 cl::Hidden); 143// This flag may need to be replaced with -f[no]asan-stack. 144static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"), 145 cl::Hidden, cl::init(true)); 146static cl::opt<bool> ClUseAfterReturn("asan-use-after-return", 147 cl::desc("Check return-after-free"), 148 cl::Hidden, cl::init(true)); 149// This flag may need to be replaced with -f[no]asan-globals. 150static cl::opt<bool> ClGlobals("asan-globals", 151 cl::desc("Handle global objects"), cl::Hidden, 152 cl::init(true)); 153static cl::opt<bool> ClInitializers("asan-initialization-order", 154 cl::desc("Handle C++ initializer order"), 155 cl::Hidden, cl::init(true)); 156static cl::opt<bool> ClInvalidPointerPairs( 157 "asan-detect-invalid-pointer-pair", 158 cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, 159 cl::init(false)); 160static cl::opt<unsigned> ClRealignStack( 161 "asan-realign-stack", 162 cl::desc("Realign stack to the value of this flag (power of two)"), 163 cl::Hidden, cl::init(32)); 164static cl::opt<int> ClInstrumentationWithCallsThreshold( 165 "asan-instrumentation-with-call-threshold", 166 cl::desc( 167 "If the function being instrumented contains more than " 168 "this number of memory accesses, use callbacks instead of " 169 "inline checks (-1 means never use callbacks)."), 170 cl::Hidden, cl::init(7000)); 171static cl::opt<std::string> ClMemoryAccessCallbackPrefix( 172 "asan-memory-access-callback-prefix", 173 cl::desc("Prefix for memory access callbacks"), cl::Hidden, 174 cl::init("__asan_")); 175static cl::opt<bool> ClInstrumentAllocas("asan-instrument-allocas", 176 cl::desc("instrument dynamic allocas"), 177 cl::Hidden, cl::init(false)); 178static cl::opt<bool> ClSkipPromotableAllocas( 179 "asan-skip-promotable-allocas", 180 cl::desc("Do not instrument promotable allocas"), cl::Hidden, 181 cl::init(true)); 182 183// These flags allow to change the shadow mapping. 184// The shadow mapping looks like 185// Shadow = (Mem >> scale) + (1 << offset_log) 186static cl::opt<int> ClMappingScale("asan-mapping-scale", 187 cl::desc("scale of asan shadow mapping"), 188 cl::Hidden, cl::init(0)); 189 190// Optimization flags. Not user visible, used mostly for testing 191// and benchmarking the tool. 192static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"), 193 cl::Hidden, cl::init(true)); 194static cl::opt<bool> ClOptSameTemp( 195 "asan-opt-same-temp", cl::desc("Instrument the same temp just once"), 196 cl::Hidden, cl::init(true)); 197static cl::opt<bool> ClOptGlobals("asan-opt-globals", 198 cl::desc("Don't instrument scalar globals"), 199 cl::Hidden, cl::init(true)); 200static cl::opt<bool> ClOptStack( 201 "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), 202 cl::Hidden, cl::init(false)); 203 204static cl::opt<bool> ClCheckLifetime( 205 "asan-check-lifetime", 206 cl::desc("Use llvm.lifetime intrinsics to insert extra checks"), cl::Hidden, 207 cl::init(false)); 208 209static cl::opt<bool> ClDynamicAllocaStack( 210 "asan-stack-dynamic-alloca", 211 cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, 212 cl::init(true)); 213 214static cl::opt<uint32_t> ClForceExperiment( 215 "asan-force-experiment", 216 cl::desc("Force optimization experiment (for testing)"), cl::Hidden, 217 cl::init(0)); 218 219// Debug flags. 220static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, 221 cl::init(0)); 222static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), 223 cl::Hidden, cl::init(0)); 224static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden, 225 cl::desc("Debug func")); 226static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), 227 cl::Hidden, cl::init(-1)); 228static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), 229 cl::Hidden, cl::init(-1)); 230 231STATISTIC(NumInstrumentedReads, "Number of instrumented reads"); 232STATISTIC(NumInstrumentedWrites, "Number of instrumented writes"); 233STATISTIC(NumInstrumentedDynamicAllocas, 234 "Number of instrumented dynamic allocas"); 235STATISTIC(NumOptimizedAccessesToGlobalVar, 236 "Number of optimized accesses to global vars"); 237STATISTIC(NumOptimizedAccessesToStackVar, 238 "Number of optimized accesses to stack vars"); 239 240namespace { 241/// Frontend-provided metadata for source location. 242struct LocationMetadata { 243 StringRef Filename; 244 int LineNo; 245 int ColumnNo; 246 247 LocationMetadata() : Filename(), LineNo(0), ColumnNo(0) {} 248 249 bool empty() const { return Filename.empty(); } 250 251 void parse(MDNode *MDN) { 252 assert(MDN->getNumOperands() == 3); 253 MDString *MDFilename = cast<MDString>(MDN->getOperand(0)); 254 Filename = MDFilename->getString(); 255 LineNo = 256 mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue(); 257 ColumnNo = 258 mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue(); 259 } 260}; 261 262/// Frontend-provided metadata for global variables. 263class GlobalsMetadata { 264 public: 265 struct Entry { 266 Entry() : SourceLoc(), Name(), IsDynInit(false), IsBlacklisted(false) {} 267 LocationMetadata SourceLoc; 268 StringRef Name; 269 bool IsDynInit; 270 bool IsBlacklisted; 271 }; 272 273 GlobalsMetadata() : inited_(false) {} 274 275 void init(Module &M) { 276 assert(!inited_); 277 inited_ = true; 278 NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals"); 279 if (!Globals) return; 280 for (auto MDN : Globals->operands()) { 281 // Metadata node contains the global and the fields of "Entry". 282 assert(MDN->getNumOperands() == 5); 283 auto *GV = mdconst::extract_or_null<GlobalVariable>(MDN->getOperand(0)); 284 // The optimizer may optimize away a global entirely. 285 if (!GV) continue; 286 // We can already have an entry for GV if it was merged with another 287 // global. 288 Entry &E = Entries[GV]; 289 if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1))) 290 E.SourceLoc.parse(Loc); 291 if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2))) 292 E.Name = Name->getString(); 293 ConstantInt *IsDynInit = 294 mdconst::extract<ConstantInt>(MDN->getOperand(3)); 295 E.IsDynInit |= IsDynInit->isOne(); 296 ConstantInt *IsBlacklisted = 297 mdconst::extract<ConstantInt>(MDN->getOperand(4)); 298 E.IsBlacklisted |= IsBlacklisted->isOne(); 299 } 300 } 301 302 /// Returns metadata entry for a given global. 303 Entry get(GlobalVariable *G) const { 304 auto Pos = Entries.find(G); 305 return (Pos != Entries.end()) ? Pos->second : Entry(); 306 } 307 308 private: 309 bool inited_; 310 DenseMap<GlobalVariable *, Entry> Entries; 311}; 312 313/// This struct defines the shadow mapping using the rule: 314/// shadow = (mem >> Scale) ADD-or-OR Offset. 315struct ShadowMapping { 316 int Scale; 317 uint64_t Offset; 318 bool OrShadowOffset; 319}; 320 321static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize) { 322 bool IsAndroid = TargetTriple.getEnvironment() == llvm::Triple::Android; 323 bool IsIOS = TargetTriple.isiOS(); 324 bool IsFreeBSD = TargetTriple.isOSFreeBSD(); 325 bool IsLinux = TargetTriple.isOSLinux(); 326 bool IsPPC64 = TargetTriple.getArch() == llvm::Triple::ppc64 || 327 TargetTriple.getArch() == llvm::Triple::ppc64le; 328 bool IsX86_64 = TargetTriple.getArch() == llvm::Triple::x86_64; 329 bool IsMIPS32 = TargetTriple.getArch() == llvm::Triple::mips || 330 TargetTriple.getArch() == llvm::Triple::mipsel; 331 bool IsMIPS64 = TargetTriple.getArch() == llvm::Triple::mips64 || 332 TargetTriple.getArch() == llvm::Triple::mips64el; 333 bool IsAArch64 = TargetTriple.getArch() == llvm::Triple::aarch64; 334 bool IsWindows = TargetTriple.isOSWindows(); 335 336 ShadowMapping Mapping; 337 338 if (LongSize == 32) { 339 if (IsAndroid) 340 Mapping.Offset = 0; 341 else if (IsMIPS32) 342 Mapping.Offset = kMIPS32_ShadowOffset32; 343 else if (IsFreeBSD) 344 Mapping.Offset = kFreeBSD_ShadowOffset32; 345 else if (IsIOS) 346 Mapping.Offset = kIOSShadowOffset32; 347 else if (IsWindows) 348 Mapping.Offset = kWindowsShadowOffset32; 349 else 350 Mapping.Offset = kDefaultShadowOffset32; 351 } else { // LongSize == 64 352 if (IsPPC64) 353 Mapping.Offset = kPPC64_ShadowOffset64; 354 else if (IsFreeBSD) 355 Mapping.Offset = kFreeBSD_ShadowOffset64; 356 else if (IsLinux && IsX86_64) 357 Mapping.Offset = kSmallX86_64ShadowOffset; 358 else if (IsMIPS64) 359 Mapping.Offset = kMIPS64_ShadowOffset64; 360 else if (IsAArch64) 361 Mapping.Offset = kAArch64_ShadowOffset64; 362 else 363 Mapping.Offset = kDefaultShadowOffset64; 364 } 365 366 Mapping.Scale = kDefaultShadowScale; 367 if (ClMappingScale) { 368 Mapping.Scale = ClMappingScale; 369 } 370 371 // OR-ing shadow offset if more efficient (at least on x86) if the offset 372 // is a power of two, but on ppc64 we have to use add since the shadow 373 // offset is not necessary 1/8-th of the address space. 374 Mapping.OrShadowOffset = !IsPPC64 && !(Mapping.Offset & (Mapping.Offset - 1)); 375 376 return Mapping; 377} 378 379static size_t RedzoneSizeForScale(int MappingScale) { 380 // Redzone used for stack and globals is at least 32 bytes. 381 // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. 382 return std::max(32U, 1U << MappingScale); 383} 384 385/// AddressSanitizer: instrument the code in module to find memory bugs. 386struct AddressSanitizer : public FunctionPass { 387 AddressSanitizer() : FunctionPass(ID) { 388 initializeAddressSanitizerPass(*PassRegistry::getPassRegistry()); 389 } 390 const char *getPassName() const override { 391 return "AddressSanitizerFunctionPass"; 392 } 393 void getAnalysisUsage(AnalysisUsage &AU) const override { 394 AU.addRequired<DominatorTreeWrapperPass>(); 395 AU.addRequired<TargetLibraryInfoWrapperPass>(); 396 } 397 uint64_t getAllocaSizeInBytes(AllocaInst *AI) const { 398 Type *Ty = AI->getAllocatedType(); 399 uint64_t SizeInBytes = 400 AI->getModule()->getDataLayout().getTypeAllocSize(Ty); 401 return SizeInBytes; 402 } 403 /// Check if we want (and can) handle this alloca. 404 bool isInterestingAlloca(AllocaInst &AI); 405 /// If it is an interesting memory access, return the PointerOperand 406 /// and set IsWrite/Alignment. Otherwise return nullptr. 407 Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite, 408 uint64_t *TypeSize, 409 unsigned *Alignment); 410 void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, Instruction *I, 411 bool UseCalls, const DataLayout &DL); 412 void instrumentPointerComparisonOrSubtraction(Instruction *I); 413 void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore, 414 Value *Addr, uint32_t TypeSize, bool IsWrite, 415 Value *SizeArgument, bool UseCalls, uint32_t Exp); 416 void instrumentUnusualSizeOrAlignment(Instruction *I, Value *Addr, 417 uint32_t TypeSize, bool IsWrite, 418 Value *SizeArgument, bool UseCalls, 419 uint32_t Exp); 420 Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 421 Value *ShadowValue, uint32_t TypeSize); 422 Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr, 423 bool IsWrite, size_t AccessSizeIndex, 424 Value *SizeArgument, uint32_t Exp); 425 void instrumentMemIntrinsic(MemIntrinsic *MI); 426 Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); 427 bool runOnFunction(Function &F) override; 428 bool maybeInsertAsanInitAtFunctionEntry(Function &F); 429 bool doInitialization(Module &M) override; 430 static char ID; // Pass identification, replacement for typeid 431 432 DominatorTree &getDominatorTree() const { return *DT; } 433 434 private: 435 void initializeCallbacks(Module &M); 436 437 bool LooksLikeCodeInBug11395(Instruction *I); 438 bool GlobalIsLinkerInitialized(GlobalVariable *G); 439 bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr, 440 uint64_t TypeSize) const; 441 442 LLVMContext *C; 443 Triple TargetTriple; 444 int LongSize; 445 Type *IntptrTy; 446 ShadowMapping Mapping; 447 DominatorTree *DT; 448 Function *AsanCtorFunction; 449 Function *AsanInitFunction; 450 Function *AsanHandleNoReturnFunc; 451 Function *AsanPtrCmpFunction, *AsanPtrSubFunction; 452 // This array is indexed by AccessIsWrite, Experiment and log2(AccessSize). 453 Function *AsanErrorCallback[2][2][kNumberOfAccessSizes]; 454 Function *AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes]; 455 // This array is indexed by AccessIsWrite and Experiment. 456 Function *AsanErrorCallbackSized[2][2]; 457 Function *AsanMemoryAccessCallbackSized[2][2]; 458 Function *AsanMemmove, *AsanMemcpy, *AsanMemset; 459 InlineAsm *EmptyAsm; 460 GlobalsMetadata GlobalsMD; 461 DenseMap<AllocaInst *, bool> ProcessedAllocas; 462 463 friend struct FunctionStackPoisoner; 464}; 465 466class AddressSanitizerModule : public ModulePass { 467 public: 468 AddressSanitizerModule() : ModulePass(ID) {} 469 bool runOnModule(Module &M) override; 470 static char ID; // Pass identification, replacement for typeid 471 const char *getPassName() const override { return "AddressSanitizerModule"; } 472 473 private: 474 void initializeCallbacks(Module &M); 475 476 bool InstrumentGlobals(IRBuilder<> &IRB, Module &M); 477 bool ShouldInstrumentGlobal(GlobalVariable *G); 478 void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName); 479 void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName); 480 size_t MinRedzoneSizeForGlobal() const { 481 return RedzoneSizeForScale(Mapping.Scale); 482 } 483 484 GlobalsMetadata GlobalsMD; 485 Type *IntptrTy; 486 LLVMContext *C; 487 Triple TargetTriple; 488 ShadowMapping Mapping; 489 Function *AsanPoisonGlobals; 490 Function *AsanUnpoisonGlobals; 491 Function *AsanRegisterGlobals; 492 Function *AsanUnregisterGlobals; 493}; 494 495// Stack poisoning does not play well with exception handling. 496// When an exception is thrown, we essentially bypass the code 497// that unpoisones the stack. This is why the run-time library has 498// to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire 499// stack in the interceptor. This however does not work inside the 500// actual function which catches the exception. Most likely because the 501// compiler hoists the load of the shadow value somewhere too high. 502// This causes asan to report a non-existing bug on 453.povray. 503// It sounds like an LLVM bug. 504struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> { 505 Function &F; 506 AddressSanitizer &ASan; 507 DIBuilder DIB; 508 LLVMContext *C; 509 Type *IntptrTy; 510 Type *IntptrPtrTy; 511 ShadowMapping Mapping; 512 513 SmallVector<AllocaInst *, 16> AllocaVec; 514 SmallVector<Instruction *, 8> RetVec; 515 unsigned StackAlignment; 516 517 Function *AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1], 518 *AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1]; 519 Function *AsanPoisonStackMemoryFunc, *AsanUnpoisonStackMemoryFunc; 520 521 // Stores a place and arguments of poisoning/unpoisoning call for alloca. 522 struct AllocaPoisonCall { 523 IntrinsicInst *InsBefore; 524 AllocaInst *AI; 525 uint64_t Size; 526 bool DoPoison; 527 }; 528 SmallVector<AllocaPoisonCall, 8> AllocaPoisonCallVec; 529 530 // Stores left and right redzone shadow addresses for dynamic alloca 531 // and pointer to alloca instruction itself. 532 // LeftRzAddr is a shadow address for alloca left redzone. 533 // RightRzAddr is a shadow address for alloca right redzone. 534 struct DynamicAllocaCall { 535 AllocaInst *AI; 536 Value *LeftRzAddr; 537 Value *RightRzAddr; 538 bool Poison; 539 explicit DynamicAllocaCall(AllocaInst *AI, Value *LeftRzAddr = nullptr, 540 Value *RightRzAddr = nullptr) 541 : AI(AI), 542 LeftRzAddr(LeftRzAddr), 543 RightRzAddr(RightRzAddr), 544 Poison(true) {} 545 }; 546 SmallVector<DynamicAllocaCall, 1> DynamicAllocaVec; 547 548 // Maps Value to an AllocaInst from which the Value is originated. 549 typedef DenseMap<Value *, AllocaInst *> AllocaForValueMapTy; 550 AllocaForValueMapTy AllocaForValue; 551 552 bool HasNonEmptyInlineAsm; 553 std::unique_ptr<CallInst> EmptyInlineAsm; 554 555 FunctionStackPoisoner(Function &F, AddressSanitizer &ASan) 556 : F(F), 557 ASan(ASan), 558 DIB(*F.getParent(), /*AllowUnresolved*/ false), 559 C(ASan.C), 560 IntptrTy(ASan.IntptrTy), 561 IntptrPtrTy(PointerType::get(IntptrTy, 0)), 562 Mapping(ASan.Mapping), 563 StackAlignment(1 << Mapping.Scale), 564 HasNonEmptyInlineAsm(false), 565 EmptyInlineAsm(CallInst::Create(ASan.EmptyAsm)) {} 566 567 bool runOnFunction() { 568 if (!ClStack) return false; 569 // Collect alloca, ret, lifetime instructions etc. 570 for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB); 571 572 if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false; 573 574 initializeCallbacks(*F.getParent()); 575 576 poisonStack(); 577 578 if (ClDebugStack) { 579 DEBUG(dbgs() << F); 580 } 581 return true; 582 } 583 584 // Finds all Alloca instructions and puts 585 // poisoned red zones around all of them. 586 // Then unpoison everything back before the function returns. 587 void poisonStack(); 588 589 // ----------------------- Visitors. 590 /// \brief Collect all Ret instructions. 591 void visitReturnInst(ReturnInst &RI) { RetVec.push_back(&RI); } 592 593 // Unpoison dynamic allocas redzones. 594 void unpoisonDynamicAlloca(DynamicAllocaCall &AllocaCall) { 595 if (!AllocaCall.Poison) return; 596 for (auto Ret : RetVec) { 597 IRBuilder<> IRBRet(Ret); 598 PointerType *Int32PtrTy = PointerType::getUnqual(IRBRet.getInt32Ty()); 599 Value *Zero = Constant::getNullValue(IRBRet.getInt32Ty()); 600 Value *PartialRzAddr = IRBRet.CreateSub(AllocaCall.RightRzAddr, 601 ConstantInt::get(IntptrTy, 4)); 602 IRBRet.CreateStore( 603 Zero, IRBRet.CreateIntToPtr(AllocaCall.LeftRzAddr, Int32PtrTy)); 604 IRBRet.CreateStore(Zero, 605 IRBRet.CreateIntToPtr(PartialRzAddr, Int32PtrTy)); 606 IRBRet.CreateStore( 607 Zero, IRBRet.CreateIntToPtr(AllocaCall.RightRzAddr, Int32PtrTy)); 608 } 609 } 610 611 // Right shift for BigEndian and left shift for LittleEndian. 612 Value *shiftAllocaMagic(Value *Val, IRBuilder<> &IRB, Value *Shift) { 613 auto &DL = F.getParent()->getDataLayout(); 614 return DL.isLittleEndian() ? IRB.CreateShl(Val, Shift) 615 : IRB.CreateLShr(Val, Shift); 616 } 617 618 // Compute PartialRzMagic for dynamic alloca call. Since we don't know the 619 // size of requested memory until runtime, we should compute it dynamically. 620 // If PartialSize is 0, PartialRzMagic would contain kAsanAllocaRightMagic, 621 // otherwise it would contain the value that we will use to poison the 622 // partial redzone for alloca call. 623 Value *computePartialRzMagic(Value *PartialSize, IRBuilder<> &IRB); 624 625 // Deploy and poison redzones around dynamic alloca call. To do this, we 626 // should replace this call with another one with changed parameters and 627 // replace all its uses with new address, so 628 // addr = alloca type, old_size, align 629 // is replaced by 630 // new_size = (old_size + additional_size) * sizeof(type) 631 // tmp = alloca i8, new_size, max(align, 32) 632 // addr = tmp + 32 (first 32 bytes are for the left redzone). 633 // Additional_size is added to make new memory allocation contain not only 634 // requested memory, but also left, partial and right redzones. 635 // After that, we should poison redzones: 636 // (1) Left redzone with kAsanAllocaLeftMagic. 637 // (2) Partial redzone with the value, computed in runtime by 638 // computePartialRzMagic function. 639 // (3) Right redzone with kAsanAllocaRightMagic. 640 void handleDynamicAllocaCall(DynamicAllocaCall &AllocaCall); 641 642 /// \brief Collect Alloca instructions we want (and can) handle. 643 void visitAllocaInst(AllocaInst &AI) { 644 if (!ASan.isInterestingAlloca(AI)) return; 645 646 StackAlignment = std::max(StackAlignment, AI.getAlignment()); 647 if (isDynamicAlloca(AI)) 648 DynamicAllocaVec.push_back(DynamicAllocaCall(&AI)); 649 else 650 AllocaVec.push_back(&AI); 651 } 652 653 /// \brief Collect lifetime intrinsic calls to check for use-after-scope 654 /// errors. 655 void visitIntrinsicInst(IntrinsicInst &II) { 656 if (!ClCheckLifetime) return; 657 Intrinsic::ID ID = II.getIntrinsicID(); 658 if (ID != Intrinsic::lifetime_start && ID != Intrinsic::lifetime_end) 659 return; 660 // Found lifetime intrinsic, add ASan instrumentation if necessary. 661 ConstantInt *Size = dyn_cast<ConstantInt>(II.getArgOperand(0)); 662 // If size argument is undefined, don't do anything. 663 if (Size->isMinusOne()) return; 664 // Check that size doesn't saturate uint64_t and can 665 // be stored in IntptrTy. 666 const uint64_t SizeValue = Size->getValue().getLimitedValue(); 667 if (SizeValue == ~0ULL || 668 !ConstantInt::isValueValidForType(IntptrTy, SizeValue)) 669 return; 670 // Find alloca instruction that corresponds to llvm.lifetime argument. 671 AllocaInst *AI = findAllocaForValue(II.getArgOperand(1)); 672 if (!AI) return; 673 bool DoPoison = (ID == Intrinsic::lifetime_end); 674 AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison}; 675 AllocaPoisonCallVec.push_back(APC); 676 } 677 678 void visitCallInst(CallInst &CI) { 679 HasNonEmptyInlineAsm |= 680 CI.isInlineAsm() && !CI.isIdenticalTo(EmptyInlineAsm.get()); 681 } 682 683 // ---------------------- Helpers. 684 void initializeCallbacks(Module &M); 685 686 bool doesDominateAllExits(const Instruction *I) const { 687 for (auto Ret : RetVec) { 688 if (!ASan.getDominatorTree().dominates(I, Ret)) return false; 689 } 690 return true; 691 } 692 693 bool isDynamicAlloca(AllocaInst &AI) const { 694 return AI.isArrayAllocation() || !AI.isStaticAlloca(); 695 } 696 /// Finds alloca where the value comes from. 697 AllocaInst *findAllocaForValue(Value *V); 698 void poisonRedZones(ArrayRef<uint8_t> ShadowBytes, IRBuilder<> &IRB, 699 Value *ShadowBase, bool DoPoison); 700 void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison); 701 702 void SetShadowToStackAfterReturnInlined(IRBuilder<> &IRB, Value *ShadowBase, 703 int Size); 704 Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L, 705 bool Dynamic); 706 PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue, 707 Instruction *ThenTerm, Value *ValueIfFalse); 708}; 709 710} // namespace 711 712char AddressSanitizer::ID = 0; 713INITIALIZE_PASS_BEGIN( 714 AddressSanitizer, "asan", 715 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, 716 false) 717INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass) 718INITIALIZE_PASS_END( 719 AddressSanitizer, "asan", 720 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, 721 false) 722FunctionPass *llvm::createAddressSanitizerFunctionPass() { 723 return new AddressSanitizer(); 724} 725 726char AddressSanitizerModule::ID = 0; 727INITIALIZE_PASS( 728 AddressSanitizerModule, "asan-module", 729 "AddressSanitizer: detects use-after-free and out-of-bounds bugs." 730 "ModulePass", 731 false, false) 732ModulePass *llvm::createAddressSanitizerModulePass() { 733 return new AddressSanitizerModule(); 734} 735 736static size_t TypeSizeToSizeIndex(uint32_t TypeSize) { 737 size_t Res = countTrailingZeros(TypeSize / 8); 738 assert(Res < kNumberOfAccessSizes); 739 return Res; 740} 741 742// \brief Create a constant for Str so that we can pass it to the run-time lib. 743static GlobalVariable *createPrivateGlobalForString(Module &M, StringRef Str, 744 bool AllowMerging) { 745 Constant *StrConst = ConstantDataArray::getString(M.getContext(), Str); 746 // We use private linkage for module-local strings. If they can be merged 747 // with another one, we set the unnamed_addr attribute. 748 GlobalVariable *GV = 749 new GlobalVariable(M, StrConst->getType(), true, 750 GlobalValue::PrivateLinkage, StrConst, kAsanGenPrefix); 751 if (AllowMerging) GV->setUnnamedAddr(true); 752 GV->setAlignment(1); // Strings may not be merged w/o setting align 1. 753 return GV; 754} 755 756/// \brief Create a global describing a source location. 757static GlobalVariable *createPrivateGlobalForSourceLoc(Module &M, 758 LocationMetadata MD) { 759 Constant *LocData[] = { 760 createPrivateGlobalForString(M, MD.Filename, true), 761 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo), 762 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo), 763 }; 764 auto LocStruct = ConstantStruct::getAnon(LocData); 765 auto GV = new GlobalVariable(M, LocStruct->getType(), true, 766 GlobalValue::PrivateLinkage, LocStruct, 767 kAsanGenPrefix); 768 GV->setUnnamedAddr(true); 769 return GV; 770} 771 772static bool GlobalWasGeneratedByAsan(GlobalVariable *G) { 773 return G->getName().find(kAsanGenPrefix) == 0 || 774 G->getName().find(kSanCovGenPrefix) == 0; 775} 776 777Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { 778 // Shadow >> scale 779 Shadow = IRB.CreateLShr(Shadow, Mapping.Scale); 780 if (Mapping.Offset == 0) return Shadow; 781 // (Shadow >> scale) | offset 782 if (Mapping.OrShadowOffset) 783 return IRB.CreateOr(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset)); 784 else 785 return IRB.CreateAdd(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset)); 786} 787 788// Instrument memset/memmove/memcpy 789void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { 790 IRBuilder<> IRB(MI); 791 if (isa<MemTransferInst>(MI)) { 792 IRB.CreateCall3( 793 isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy, 794 IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), 795 IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()), 796 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)); 797 } else if (isa<MemSetInst>(MI)) { 798 IRB.CreateCall3( 799 AsanMemset, 800 IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), 801 IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false), 802 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)); 803 } 804 MI->eraseFromParent(); 805} 806 807/// Check if we want (and can) handle this alloca. 808bool AddressSanitizer::isInterestingAlloca(AllocaInst &AI) { 809 auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI); 810 811 if (PreviouslySeenAllocaInfo != ProcessedAllocas.end()) 812 return PreviouslySeenAllocaInfo->getSecond(); 813 814 bool IsInteresting = (AI.getAllocatedType()->isSized() && 815 // alloca() may be called with 0 size, ignore it. 816 getAllocaSizeInBytes(&AI) > 0 && 817 // We are only interested in allocas not promotable to registers. 818 // Promotable allocas are common under -O0. 819 (!ClSkipPromotableAllocas || !isAllocaPromotable(&AI))); 820 821 ProcessedAllocas[&AI] = IsInteresting; 822 return IsInteresting; 823} 824 825/// If I is an interesting memory access, return the PointerOperand 826/// and set IsWrite/Alignment. Otherwise return nullptr. 827Value *AddressSanitizer::isInterestingMemoryAccess(Instruction *I, 828 bool *IsWrite, 829 uint64_t *TypeSize, 830 unsigned *Alignment) { 831 // Skip memory accesses inserted by another instrumentation. 832 if (I->getMetadata("nosanitize")) return nullptr; 833 834 Value *PtrOperand = nullptr; 835 const DataLayout &DL = I->getModule()->getDataLayout(); 836 if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 837 if (!ClInstrumentReads) return nullptr; 838 *IsWrite = false; 839 *TypeSize = DL.getTypeStoreSizeInBits(LI->getType()); 840 *Alignment = LI->getAlignment(); 841 PtrOperand = LI->getPointerOperand(); 842 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) { 843 if (!ClInstrumentWrites) return nullptr; 844 *IsWrite = true; 845 *TypeSize = DL.getTypeStoreSizeInBits(SI->getValueOperand()->getType()); 846 *Alignment = SI->getAlignment(); 847 PtrOperand = SI->getPointerOperand(); 848 } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { 849 if (!ClInstrumentAtomics) return nullptr; 850 *IsWrite = true; 851 *TypeSize = DL.getTypeStoreSizeInBits(RMW->getValOperand()->getType()); 852 *Alignment = 0; 853 PtrOperand = RMW->getPointerOperand(); 854 } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { 855 if (!ClInstrumentAtomics) return nullptr; 856 *IsWrite = true; 857 *TypeSize = DL.getTypeStoreSizeInBits(XCHG->getCompareOperand()->getType()); 858 *Alignment = 0; 859 PtrOperand = XCHG->getPointerOperand(); 860 } 861 862 // Treat memory accesses to promotable allocas as non-interesting since they 863 // will not cause memory violations. This greatly speeds up the instrumented 864 // executable at -O0. 865 if (ClSkipPromotableAllocas) 866 if (auto AI = dyn_cast_or_null<AllocaInst>(PtrOperand)) 867 return isInterestingAlloca(*AI) ? AI : nullptr; 868 869 return PtrOperand; 870} 871 872static bool isPointerOperand(Value *V) { 873 return V->getType()->isPointerTy() || isa<PtrToIntInst>(V); 874} 875 876// This is a rough heuristic; it may cause both false positives and 877// false negatives. The proper implementation requires cooperation with 878// the frontend. 879static bool isInterestingPointerComparisonOrSubtraction(Instruction *I) { 880 if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) { 881 if (!Cmp->isRelational()) return false; 882 } else if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) { 883 if (BO->getOpcode() != Instruction::Sub) return false; 884 } else { 885 return false; 886 } 887 if (!isPointerOperand(I->getOperand(0)) || 888 !isPointerOperand(I->getOperand(1))) 889 return false; 890 return true; 891} 892 893bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) { 894 // If a global variable does not have dynamic initialization we don't 895 // have to instrument it. However, if a global does not have initializer 896 // at all, we assume it has dynamic initializer (in other TU). 897 return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit; 898} 899 900void AddressSanitizer::instrumentPointerComparisonOrSubtraction( 901 Instruction *I) { 902 IRBuilder<> IRB(I); 903 Function *F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction; 904 Value *Param[2] = {I->getOperand(0), I->getOperand(1)}; 905 for (int i = 0; i < 2; i++) { 906 if (Param[i]->getType()->isPointerTy()) 907 Param[i] = IRB.CreatePointerCast(Param[i], IntptrTy); 908 } 909 IRB.CreateCall2(F, Param[0], Param[1]); 910} 911 912void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, 913 Instruction *I, bool UseCalls, 914 const DataLayout &DL) { 915 bool IsWrite = false; 916 unsigned Alignment = 0; 917 uint64_t TypeSize = 0; 918 Value *Addr = isInterestingMemoryAccess(I, &IsWrite, &TypeSize, &Alignment); 919 assert(Addr); 920 921 // Optimization experiments. 922 // The experiments can be used to evaluate potential optimizations that remove 923 // instrumentation (assess false negatives). Instead of completely removing 924 // some instrumentation, you set Exp to a non-zero value (mask of optimization 925 // experiments that want to remove instrumentation of this instruction). 926 // If Exp is non-zero, this pass will emit special calls into runtime 927 // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls 928 // make runtime terminate the program in a special way (with a different 929 // exit status). Then you run the new compiler on a buggy corpus, collect 930 // the special terminations (ideally, you don't see them at all -- no false 931 // negatives) and make the decision on the optimization. 932 uint32_t Exp = ClForceExperiment; 933 934 if (ClOpt && ClOptGlobals) { 935 // If initialization order checking is disabled, a simple access to a 936 // dynamically initialized global is always valid. 937 GlobalVariable *G = dyn_cast<GlobalVariable>(GetUnderlyingObject(Addr, DL)); 938 if (G != NULL && (!ClInitializers || GlobalIsLinkerInitialized(G)) && 939 isSafeAccess(ObjSizeVis, Addr, TypeSize)) { 940 NumOptimizedAccessesToGlobalVar++; 941 return; 942 } 943 } 944 945 if (ClOpt && ClOptStack) { 946 // A direct inbounds access to a stack variable is always valid. 947 if (isa<AllocaInst>(GetUnderlyingObject(Addr, DL)) && 948 isSafeAccess(ObjSizeVis, Addr, TypeSize)) { 949 NumOptimizedAccessesToStackVar++; 950 return; 951 } 952 } 953 954 if (IsWrite) 955 NumInstrumentedWrites++; 956 else 957 NumInstrumentedReads++; 958 959 unsigned Granularity = 1 << Mapping.Scale; 960 // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check 961 // if the data is properly aligned. 962 if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 || 963 TypeSize == 128) && 964 (Alignment >= Granularity || Alignment == 0 || Alignment >= TypeSize / 8)) 965 return instrumentAddress(I, I, Addr, TypeSize, IsWrite, nullptr, UseCalls, 966 Exp); 967 instrumentUnusualSizeOrAlignment(I, Addr, TypeSize, IsWrite, nullptr, 968 UseCalls, Exp); 969} 970 971Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore, 972 Value *Addr, bool IsWrite, 973 size_t AccessSizeIndex, 974 Value *SizeArgument, 975 uint32_t Exp) { 976 IRBuilder<> IRB(InsertBefore); 977 Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp); 978 CallInst *Call = nullptr; 979 if (SizeArgument) { 980 if (Exp == 0) 981 Call = IRB.CreateCall2(AsanErrorCallbackSized[IsWrite][0], Addr, 982 SizeArgument); 983 else 984 Call = IRB.CreateCall3(AsanErrorCallbackSized[IsWrite][1], Addr, 985 SizeArgument, ExpVal); 986 } else { 987 if (Exp == 0) 988 Call = 989 IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr); 990 else 991 Call = IRB.CreateCall2(AsanErrorCallback[IsWrite][1][AccessSizeIndex], 992 Addr, ExpVal); 993 } 994 995 // We don't do Call->setDoesNotReturn() because the BB already has 996 // UnreachableInst at the end. 997 // This EmptyAsm is required to avoid callback merge. 998 IRB.CreateCall(EmptyAsm); 999 return Call; 1000} 1001 1002Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 1003 Value *ShadowValue, 1004 uint32_t TypeSize) { 1005 size_t Granularity = 1 << Mapping.Scale; 1006 // Addr & (Granularity - 1) 1007 Value *LastAccessedByte = 1008 IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); 1009 // (Addr & (Granularity - 1)) + size - 1 1010 if (TypeSize / 8 > 1) 1011 LastAccessedByte = IRB.CreateAdd( 1012 LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); 1013 // (uint8_t) ((Addr & (Granularity-1)) + size - 1) 1014 LastAccessedByte = 1015 IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false); 1016 // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue 1017 return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); 1018} 1019 1020void AddressSanitizer::instrumentAddress(Instruction *OrigIns, 1021 Instruction *InsertBefore, Value *Addr, 1022 uint32_t TypeSize, bool IsWrite, 1023 Value *SizeArgument, bool UseCalls, 1024 uint32_t Exp) { 1025 IRBuilder<> IRB(InsertBefore); 1026 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 1027 size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); 1028 1029 if (UseCalls) { 1030 if (Exp == 0) 1031 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex], 1032 AddrLong); 1033 else 1034 IRB.CreateCall2(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex], 1035 AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)); 1036 return; 1037 } 1038 1039 Type *ShadowTy = 1040 IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale)); 1041 Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); 1042 Value *ShadowPtr = memToShadow(AddrLong, IRB); 1043 Value *CmpVal = Constant::getNullValue(ShadowTy); 1044 Value *ShadowValue = 1045 IRB.CreateLoad(IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); 1046 1047 Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); 1048 size_t Granularity = 1 << Mapping.Scale; 1049 TerminatorInst *CrashTerm = nullptr; 1050 1051 if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) { 1052 // We use branch weights for the slow path check, to indicate that the slow 1053 // path is rarely taken. This seems to be the case for SPEC benchmarks. 1054 TerminatorInst *CheckTerm = SplitBlockAndInsertIfThen( 1055 Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000)); 1056 assert(cast<BranchInst>(CheckTerm)->isUnconditional()); 1057 BasicBlock *NextBB = CheckTerm->getSuccessor(0); 1058 IRB.SetInsertPoint(CheckTerm); 1059 Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); 1060 BasicBlock *CrashBlock = 1061 BasicBlock::Create(*C, "", NextBB->getParent(), NextBB); 1062 CrashTerm = new UnreachableInst(*C, CrashBlock); 1063 BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); 1064 ReplaceInstWithInst(CheckTerm, NewTerm); 1065 } else { 1066 CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, true); 1067 } 1068 1069 Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite, 1070 AccessSizeIndex, SizeArgument, Exp); 1071 Crash->setDebugLoc(OrigIns->getDebugLoc()); 1072} 1073 1074// Instrument unusual size or unusual alignment. 1075// We can not do it with a single check, so we do 1-byte check for the first 1076// and the last bytes. We call __asan_report_*_n(addr, real_size) to be able 1077// to report the actual access size. 1078void AddressSanitizer::instrumentUnusualSizeOrAlignment( 1079 Instruction *I, Value *Addr, uint32_t TypeSize, bool IsWrite, 1080 Value *SizeArgument, bool UseCalls, uint32_t Exp) { 1081 IRBuilder<> IRB(I); 1082 Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8); 1083 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 1084 if (UseCalls) { 1085 if (Exp == 0) 1086 IRB.CreateCall2(AsanMemoryAccessCallbackSized[IsWrite][0], AddrLong, 1087 Size); 1088 else 1089 IRB.CreateCall3(AsanMemoryAccessCallbackSized[IsWrite][1], AddrLong, Size, 1090 ConstantInt::get(IRB.getInt32Ty(), Exp)); 1091 } else { 1092 Value *LastByte = IRB.CreateIntToPtr( 1093 IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)), 1094 Addr->getType()); 1095 instrumentAddress(I, I, Addr, 8, IsWrite, Size, false, Exp); 1096 instrumentAddress(I, I, LastByte, 8, IsWrite, Size, false, Exp); 1097 } 1098} 1099 1100void AddressSanitizerModule::poisonOneInitializer(Function &GlobalInit, 1101 GlobalValue *ModuleName) { 1102 // Set up the arguments to our poison/unpoison functions. 1103 IRBuilder<> IRB(GlobalInit.begin()->getFirstInsertionPt()); 1104 1105 // Add a call to poison all external globals before the given function starts. 1106 Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy); 1107 IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr); 1108 1109 // Add calls to unpoison all globals before each return instruction. 1110 for (auto &BB : GlobalInit.getBasicBlockList()) 1111 if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator())) 1112 CallInst::Create(AsanUnpoisonGlobals, "", RI); 1113} 1114 1115void AddressSanitizerModule::createInitializerPoisonCalls( 1116 Module &M, GlobalValue *ModuleName) { 1117 GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors"); 1118 1119 ConstantArray *CA = cast<ConstantArray>(GV->getInitializer()); 1120 for (Use &OP : CA->operands()) { 1121 if (isa<ConstantAggregateZero>(OP)) continue; 1122 ConstantStruct *CS = cast<ConstantStruct>(OP); 1123 1124 // Must have a function or null ptr. 1125 if (Function *F = dyn_cast<Function>(CS->getOperand(1))) { 1126 if (F->getName() == kAsanModuleCtorName) continue; 1127 ConstantInt *Priority = dyn_cast<ConstantInt>(CS->getOperand(0)); 1128 // Don't instrument CTORs that will run before asan.module_ctor. 1129 if (Priority->getLimitedValue() <= kAsanCtorAndDtorPriority) continue; 1130 poisonOneInitializer(*F, ModuleName); 1131 } 1132 } 1133} 1134 1135bool AddressSanitizerModule::ShouldInstrumentGlobal(GlobalVariable *G) { 1136 Type *Ty = cast<PointerType>(G->getType())->getElementType(); 1137 DEBUG(dbgs() << "GLOBAL: " << *G << "\n"); 1138 1139 if (GlobalsMD.get(G).IsBlacklisted) return false; 1140 if (!Ty->isSized()) return false; 1141 if (!G->hasInitializer()) return false; 1142 if (GlobalWasGeneratedByAsan(G)) return false; // Our own global. 1143 // Touch only those globals that will not be defined in other modules. 1144 // Don't handle ODR linkage types and COMDATs since other modules may be built 1145 // without ASan. 1146 if (G->getLinkage() != GlobalVariable::ExternalLinkage && 1147 G->getLinkage() != GlobalVariable::PrivateLinkage && 1148 G->getLinkage() != GlobalVariable::InternalLinkage) 1149 return false; 1150 if (G->hasComdat()) return false; 1151 // Two problems with thread-locals: 1152 // - The address of the main thread's copy can't be computed at link-time. 1153 // - Need to poison all copies, not just the main thread's one. 1154 if (G->isThreadLocal()) return false; 1155 // For now, just ignore this Global if the alignment is large. 1156 if (G->getAlignment() > MinRedzoneSizeForGlobal()) return false; 1157 1158 if (G->hasSection()) { 1159 StringRef Section(G->getSection()); 1160 1161 if (TargetTriple.isOSBinFormatMachO()) { 1162 StringRef ParsedSegment, ParsedSection; 1163 unsigned TAA = 0, StubSize = 0; 1164 bool TAAParsed; 1165 std::string ErrorCode = MCSectionMachO::ParseSectionSpecifier( 1166 Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize); 1167 if (!ErrorCode.empty()) { 1168 report_fatal_error("Invalid section specifier '" + ParsedSection + 1169 "': " + ErrorCode + "."); 1170 } 1171 1172 // Ignore the globals from the __OBJC section. The ObjC runtime assumes 1173 // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to 1174 // them. 1175 if (ParsedSegment == "__OBJC" || 1176 (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) { 1177 DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n"); 1178 return false; 1179 } 1180 // See http://code.google.com/p/address-sanitizer/issues/detail?id=32 1181 // Constant CFString instances are compiled in the following way: 1182 // -- the string buffer is emitted into 1183 // __TEXT,__cstring,cstring_literals 1184 // -- the constant NSConstantString structure referencing that buffer 1185 // is placed into __DATA,__cfstring 1186 // Therefore there's no point in placing redzones into __DATA,__cfstring. 1187 // Moreover, it causes the linker to crash on OS X 10.7 1188 if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") { 1189 DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n"); 1190 return false; 1191 } 1192 // The linker merges the contents of cstring_literals and removes the 1193 // trailing zeroes. 1194 if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) { 1195 DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n"); 1196 return false; 1197 } 1198 } 1199 1200 // Callbacks put into the CRT initializer/terminator sections 1201 // should not be instrumented. 1202 // See https://code.google.com/p/address-sanitizer/issues/detail?id=305 1203 // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx 1204 if (Section.startswith(".CRT")) { 1205 DEBUG(dbgs() << "Ignoring a global initializer callback: " << *G << "\n"); 1206 return false; 1207 } 1208 1209 // Globals from llvm.metadata aren't emitted, do not instrument them. 1210 if (Section == "llvm.metadata") return false; 1211 } 1212 1213 return true; 1214} 1215 1216void AddressSanitizerModule::initializeCallbacks(Module &M) { 1217 IRBuilder<> IRB(*C); 1218 // Declare our poisoning and unpoisoning functions. 1219 AsanPoisonGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1220 kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy, nullptr)); 1221 AsanPoisonGlobals->setLinkage(Function::ExternalLinkage); 1222 AsanUnpoisonGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1223 kAsanUnpoisonGlobalsName, IRB.getVoidTy(), nullptr)); 1224 AsanUnpoisonGlobals->setLinkage(Function::ExternalLinkage); 1225 // Declare functions that register/unregister globals. 1226 AsanRegisterGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1227 kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1228 AsanRegisterGlobals->setLinkage(Function::ExternalLinkage); 1229 AsanUnregisterGlobals = checkSanitizerInterfaceFunction( 1230 M.getOrInsertFunction(kAsanUnregisterGlobalsName, IRB.getVoidTy(), 1231 IntptrTy, IntptrTy, nullptr)); 1232 AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage); 1233} 1234 1235// This function replaces all global variables with new variables that have 1236// trailing redzones. It also creates a function that poisons 1237// redzones and inserts this function into llvm.global_ctors. 1238bool AddressSanitizerModule::InstrumentGlobals(IRBuilder<> &IRB, Module &M) { 1239 GlobalsMD.init(M); 1240 1241 SmallVector<GlobalVariable *, 16> GlobalsToChange; 1242 1243 for (auto &G : M.globals()) { 1244 if (ShouldInstrumentGlobal(&G)) GlobalsToChange.push_back(&G); 1245 } 1246 1247 size_t n = GlobalsToChange.size(); 1248 if (n == 0) return false; 1249 1250 // A global is described by a structure 1251 // size_t beg; 1252 // size_t size; 1253 // size_t size_with_redzone; 1254 // const char *name; 1255 // const char *module_name; 1256 // size_t has_dynamic_init; 1257 // void *source_location; 1258 // We initialize an array of such structures and pass it to a run-time call. 1259 StructType *GlobalStructTy = 1260 StructType::get(IntptrTy, IntptrTy, IntptrTy, IntptrTy, IntptrTy, 1261 IntptrTy, IntptrTy, nullptr); 1262 SmallVector<Constant *, 16> Initializers(n); 1263 1264 bool HasDynamicallyInitializedGlobals = false; 1265 1266 // We shouldn't merge same module names, as this string serves as unique 1267 // module ID in runtime. 1268 GlobalVariable *ModuleName = createPrivateGlobalForString( 1269 M, M.getModuleIdentifier(), /*AllowMerging*/ false); 1270 1271 auto &DL = M.getDataLayout(); 1272 for (size_t i = 0; i < n; i++) { 1273 static const uint64_t kMaxGlobalRedzone = 1 << 18; 1274 GlobalVariable *G = GlobalsToChange[i]; 1275 1276 auto MD = GlobalsMD.get(G); 1277 // Create string holding the global name (use global name from metadata 1278 // if it's available, otherwise just write the name of global variable). 1279 GlobalVariable *Name = createPrivateGlobalForString( 1280 M, MD.Name.empty() ? G->getName() : MD.Name, 1281 /*AllowMerging*/ true); 1282 1283 PointerType *PtrTy = cast<PointerType>(G->getType()); 1284 Type *Ty = PtrTy->getElementType(); 1285 uint64_t SizeInBytes = DL.getTypeAllocSize(Ty); 1286 uint64_t MinRZ = MinRedzoneSizeForGlobal(); 1287 // MinRZ <= RZ <= kMaxGlobalRedzone 1288 // and trying to make RZ to be ~ 1/4 of SizeInBytes. 1289 uint64_t RZ = std::max( 1290 MinRZ, std::min(kMaxGlobalRedzone, (SizeInBytes / MinRZ / 4) * MinRZ)); 1291 uint64_t RightRedzoneSize = RZ; 1292 // Round up to MinRZ 1293 if (SizeInBytes % MinRZ) RightRedzoneSize += MinRZ - (SizeInBytes % MinRZ); 1294 assert(((RightRedzoneSize + SizeInBytes) % MinRZ) == 0); 1295 Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); 1296 1297 StructType *NewTy = StructType::get(Ty, RightRedZoneTy, nullptr); 1298 Constant *NewInitializer = 1299 ConstantStruct::get(NewTy, G->getInitializer(), 1300 Constant::getNullValue(RightRedZoneTy), nullptr); 1301 1302 // Create a new global variable with enough space for a redzone. 1303 GlobalValue::LinkageTypes Linkage = G->getLinkage(); 1304 if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage) 1305 Linkage = GlobalValue::InternalLinkage; 1306 GlobalVariable *NewGlobal = 1307 new GlobalVariable(M, NewTy, G->isConstant(), Linkage, NewInitializer, 1308 "", G, G->getThreadLocalMode()); 1309 NewGlobal->copyAttributesFrom(G); 1310 NewGlobal->setAlignment(MinRZ); 1311 1312 Value *Indices2[2]; 1313 Indices2[0] = IRB.getInt32(0); 1314 Indices2[1] = IRB.getInt32(0); 1315 1316 G->replaceAllUsesWith( 1317 ConstantExpr::getGetElementPtr(NewTy, NewGlobal, Indices2, true)); 1318 NewGlobal->takeName(G); 1319 G->eraseFromParent(); 1320 1321 Constant *SourceLoc; 1322 if (!MD.SourceLoc.empty()) { 1323 auto SourceLocGlobal = createPrivateGlobalForSourceLoc(M, MD.SourceLoc); 1324 SourceLoc = ConstantExpr::getPointerCast(SourceLocGlobal, IntptrTy); 1325 } else { 1326 SourceLoc = ConstantInt::get(IntptrTy, 0); 1327 } 1328 1329 Initializers[i] = ConstantStruct::get( 1330 GlobalStructTy, ConstantExpr::getPointerCast(NewGlobal, IntptrTy), 1331 ConstantInt::get(IntptrTy, SizeInBytes), 1332 ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), 1333 ConstantExpr::getPointerCast(Name, IntptrTy), 1334 ConstantExpr::getPointerCast(ModuleName, IntptrTy), 1335 ConstantInt::get(IntptrTy, MD.IsDynInit), SourceLoc, nullptr); 1336 1337 if (ClInitializers && MD.IsDynInit) HasDynamicallyInitializedGlobals = true; 1338 1339 DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n"); 1340 } 1341 1342 ArrayType *ArrayOfGlobalStructTy = ArrayType::get(GlobalStructTy, n); 1343 GlobalVariable *AllGlobals = new GlobalVariable( 1344 M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage, 1345 ConstantArray::get(ArrayOfGlobalStructTy, Initializers), ""); 1346 1347 // Create calls for poisoning before initializers run and unpoisoning after. 1348 if (HasDynamicallyInitializedGlobals) 1349 createInitializerPoisonCalls(M, ModuleName); 1350 IRB.CreateCall2(AsanRegisterGlobals, 1351 IRB.CreatePointerCast(AllGlobals, IntptrTy), 1352 ConstantInt::get(IntptrTy, n)); 1353 1354 // We also need to unregister globals at the end, e.g. when a shared library 1355 // gets closed. 1356 Function *AsanDtorFunction = 1357 Function::Create(FunctionType::get(Type::getVoidTy(*C), false), 1358 GlobalValue::InternalLinkage, kAsanModuleDtorName, &M); 1359 BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); 1360 IRBuilder<> IRB_Dtor(ReturnInst::Create(*C, AsanDtorBB)); 1361 IRB_Dtor.CreateCall2(AsanUnregisterGlobals, 1362 IRB.CreatePointerCast(AllGlobals, IntptrTy), 1363 ConstantInt::get(IntptrTy, n)); 1364 appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndDtorPriority); 1365 1366 DEBUG(dbgs() << M); 1367 return true; 1368} 1369 1370bool AddressSanitizerModule::runOnModule(Module &M) { 1371 C = &(M.getContext()); 1372 int LongSize = M.getDataLayout().getPointerSizeInBits(); 1373 IntptrTy = Type::getIntNTy(*C, LongSize); 1374 TargetTriple = Triple(M.getTargetTriple()); 1375 Mapping = getShadowMapping(TargetTriple, LongSize); 1376 initializeCallbacks(M); 1377 1378 bool Changed = false; 1379 1380 Function *CtorFunc = M.getFunction(kAsanModuleCtorName); 1381 assert(CtorFunc); 1382 IRBuilder<> IRB(CtorFunc->getEntryBlock().getTerminator()); 1383 1384 if (ClGlobals) Changed |= InstrumentGlobals(IRB, M); 1385 1386 return Changed; 1387} 1388 1389void AddressSanitizer::initializeCallbacks(Module &M) { 1390 IRBuilder<> IRB(*C); 1391 // Create __asan_report* callbacks. 1392 // IsWrite, TypeSize and Exp are encoded in the function name. 1393 for (int Exp = 0; Exp < 2; Exp++) { 1394 for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { 1395 const std::string TypeStr = AccessIsWrite ? "store" : "load"; 1396 const std::string ExpStr = Exp ? "exp_" : ""; 1397 const Type *ExpType = Exp ? Type::getInt32Ty(*C) : nullptr; 1398 AsanErrorCallbackSized[AccessIsWrite][Exp] = 1399 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1400 kAsanReportErrorTemplate + ExpStr + TypeStr + "_n", 1401 IRB.getVoidTy(), IntptrTy, IntptrTy, ExpType, nullptr)); 1402 AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] = 1403 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1404 ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N", 1405 IRB.getVoidTy(), IntptrTy, IntptrTy, ExpType, nullptr)); 1406 for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; 1407 AccessSizeIndex++) { 1408 const std::string Suffix = TypeStr + itostr(1 << AccessSizeIndex); 1409 AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] = 1410 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1411 kAsanReportErrorTemplate + ExpStr + Suffix, IRB.getVoidTy(), 1412 IntptrTy, ExpType, nullptr)); 1413 AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] = 1414 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1415 ClMemoryAccessCallbackPrefix + ExpStr + Suffix, IRB.getVoidTy(), 1416 IntptrTy, ExpType, nullptr)); 1417 } 1418 } 1419 } 1420 1421 AsanMemmove = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1422 ClMemoryAccessCallbackPrefix + "memmove", IRB.getInt8PtrTy(), 1423 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy, nullptr)); 1424 AsanMemcpy = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1425 ClMemoryAccessCallbackPrefix + "memcpy", IRB.getInt8PtrTy(), 1426 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy, nullptr)); 1427 AsanMemset = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1428 ClMemoryAccessCallbackPrefix + "memset", IRB.getInt8PtrTy(), 1429 IRB.getInt8PtrTy(), IRB.getInt32Ty(), IntptrTy, nullptr)); 1430 1431 AsanHandleNoReturnFunc = checkSanitizerInterfaceFunction( 1432 M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy(), nullptr)); 1433 1434 AsanPtrCmpFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1435 kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1436 AsanPtrSubFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1437 kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1438 // We insert an empty inline asm after __asan_report* to avoid callback merge. 1439 EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 1440 StringRef(""), StringRef(""), 1441 /*hasSideEffects=*/true); 1442} 1443 1444// virtual 1445bool AddressSanitizer::doInitialization(Module &M) { 1446 // Initialize the private fields. No one has accessed them before. 1447 1448 GlobalsMD.init(M); 1449 1450 C = &(M.getContext()); 1451 LongSize = M.getDataLayout().getPointerSizeInBits(); 1452 IntptrTy = Type::getIntNTy(*C, LongSize); 1453 TargetTriple = Triple(M.getTargetTriple()); 1454 1455 AsanCtorFunction = 1456 Function::Create(FunctionType::get(Type::getVoidTy(*C), false), 1457 GlobalValue::InternalLinkage, kAsanModuleCtorName, &M); 1458 BasicBlock *AsanCtorBB = BasicBlock::Create(*C, "", AsanCtorFunction); 1459 // call __asan_init in the module ctor. 1460 IRBuilder<> IRB(ReturnInst::Create(*C, AsanCtorBB)); 1461 AsanInitFunction = checkSanitizerInterfaceFunction( 1462 M.getOrInsertFunction(kAsanInitName, IRB.getVoidTy(), nullptr)); 1463 AsanInitFunction->setLinkage(Function::ExternalLinkage); 1464 IRB.CreateCall(AsanInitFunction); 1465 1466 Mapping = getShadowMapping(TargetTriple, LongSize); 1467 1468 appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndDtorPriority); 1469 return true; 1470} 1471 1472bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { 1473 // For each NSObject descendant having a +load method, this method is invoked 1474 // by the ObjC runtime before any of the static constructors is called. 1475 // Therefore we need to instrument such methods with a call to __asan_init 1476 // at the beginning in order to initialize our runtime before any access to 1477 // the shadow memory. 1478 // We cannot just ignore these methods, because they may call other 1479 // instrumented functions. 1480 if (F.getName().find(" load]") != std::string::npos) { 1481 IRBuilder<> IRB(F.begin()->begin()); 1482 IRB.CreateCall(AsanInitFunction); 1483 return true; 1484 } 1485 return false; 1486} 1487 1488bool AddressSanitizer::runOnFunction(Function &F) { 1489 if (&F == AsanCtorFunction) return false; 1490 if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false; 1491 DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n"); 1492 initializeCallbacks(*F.getParent()); 1493 1494 DT = &getAnalysis<DominatorTreeWrapperPass>().getDomTree(); 1495 1496 // If needed, insert __asan_init before checking for SanitizeAddress attr. 1497 maybeInsertAsanInitAtFunctionEntry(F); 1498 1499 if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return false; 1500 1501 if (!ClDebugFunc.empty() && ClDebugFunc != F.getName()) return false; 1502 1503 // We want to instrument every address only once per basic block (unless there 1504 // are calls between uses). 1505 SmallSet<Value *, 16> TempsToInstrument; 1506 SmallVector<Instruction *, 16> ToInstrument; 1507 SmallVector<Instruction *, 8> NoReturnCalls; 1508 SmallVector<BasicBlock *, 16> AllBlocks; 1509 SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts; 1510 int NumAllocas = 0; 1511 bool IsWrite; 1512 unsigned Alignment; 1513 uint64_t TypeSize; 1514 1515 // Fill the set of memory operations to instrument. 1516 for (auto &BB : F) { 1517 AllBlocks.push_back(&BB); 1518 TempsToInstrument.clear(); 1519 int NumInsnsPerBB = 0; 1520 for (auto &Inst : BB) { 1521 if (LooksLikeCodeInBug11395(&Inst)) return false; 1522 if (Value *Addr = isInterestingMemoryAccess(&Inst, &IsWrite, &TypeSize, 1523 &Alignment)) { 1524 if (ClOpt && ClOptSameTemp) { 1525 if (!TempsToInstrument.insert(Addr).second) 1526 continue; // We've seen this temp in the current BB. 1527 } 1528 } else if (ClInvalidPointerPairs && 1529 isInterestingPointerComparisonOrSubtraction(&Inst)) { 1530 PointerComparisonsOrSubtracts.push_back(&Inst); 1531 continue; 1532 } else if (isa<MemIntrinsic>(Inst)) { 1533 // ok, take it. 1534 } else { 1535 if (isa<AllocaInst>(Inst)) NumAllocas++; 1536 CallSite CS(&Inst); 1537 if (CS) { 1538 // A call inside BB. 1539 TempsToInstrument.clear(); 1540 if (CS.doesNotReturn()) NoReturnCalls.push_back(CS.getInstruction()); 1541 } 1542 continue; 1543 } 1544 ToInstrument.push_back(&Inst); 1545 NumInsnsPerBB++; 1546 if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break; 1547 } 1548 } 1549 1550 bool UseCalls = false; 1551 if (ClInstrumentationWithCallsThreshold >= 0 && 1552 ToInstrument.size() > (unsigned)ClInstrumentationWithCallsThreshold) 1553 UseCalls = true; 1554 1555 const TargetLibraryInfo *TLI = 1556 &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(); 1557 const DataLayout &DL = F.getParent()->getDataLayout(); 1558 ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), 1559 /*RoundToAlign=*/true); 1560 1561 // Instrument. 1562 int NumInstrumented = 0; 1563 for (auto Inst : ToInstrument) { 1564 if (ClDebugMin < 0 || ClDebugMax < 0 || 1565 (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) { 1566 if (isInterestingMemoryAccess(Inst, &IsWrite, &TypeSize, &Alignment)) 1567 instrumentMop(ObjSizeVis, Inst, UseCalls, 1568 F.getParent()->getDataLayout()); 1569 else 1570 instrumentMemIntrinsic(cast<MemIntrinsic>(Inst)); 1571 } 1572 NumInstrumented++; 1573 } 1574 1575 FunctionStackPoisoner FSP(F, *this); 1576 bool ChangedStack = FSP.runOnFunction(); 1577 1578 // We must unpoison the stack before every NoReturn call (throw, _exit, etc). 1579 // See e.g. http://code.google.com/p/address-sanitizer/issues/detail?id=37 1580 for (auto CI : NoReturnCalls) { 1581 IRBuilder<> IRB(CI); 1582 IRB.CreateCall(AsanHandleNoReturnFunc); 1583 } 1584 1585 for (auto Inst : PointerComparisonsOrSubtracts) { 1586 instrumentPointerComparisonOrSubtraction(Inst); 1587 NumInstrumented++; 1588 } 1589 1590 bool res = NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty(); 1591 1592 DEBUG(dbgs() << "ASAN done instrumenting: " << res << " " << F << "\n"); 1593 1594 return res; 1595} 1596 1597// Workaround for bug 11395: we don't want to instrument stack in functions 1598// with large assembly blobs (32-bit only), otherwise reg alloc may crash. 1599// FIXME: remove once the bug 11395 is fixed. 1600bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { 1601 if (LongSize != 32) return false; 1602 CallInst *CI = dyn_cast<CallInst>(I); 1603 if (!CI || !CI->isInlineAsm()) return false; 1604 if (CI->getNumArgOperands() <= 5) return false; 1605 // We have inline assembly with quite a few arguments. 1606 return true; 1607} 1608 1609void FunctionStackPoisoner::initializeCallbacks(Module &M) { 1610 IRBuilder<> IRB(*C); 1611 for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) { 1612 std::string Suffix = itostr(i); 1613 AsanStackMallocFunc[i] = checkSanitizerInterfaceFunction( 1614 M.getOrInsertFunction(kAsanStackMallocNameTemplate + Suffix, IntptrTy, 1615 IntptrTy, nullptr)); 1616 AsanStackFreeFunc[i] = checkSanitizerInterfaceFunction( 1617 M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix, 1618 IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1619 } 1620 AsanPoisonStackMemoryFunc = checkSanitizerInterfaceFunction( 1621 M.getOrInsertFunction(kAsanPoisonStackMemoryName, IRB.getVoidTy(), 1622 IntptrTy, IntptrTy, nullptr)); 1623 AsanUnpoisonStackMemoryFunc = checkSanitizerInterfaceFunction( 1624 M.getOrInsertFunction(kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), 1625 IntptrTy, IntptrTy, nullptr)); 1626} 1627 1628void FunctionStackPoisoner::poisonRedZones(ArrayRef<uint8_t> ShadowBytes, 1629 IRBuilder<> &IRB, Value *ShadowBase, 1630 bool DoPoison) { 1631 size_t n = ShadowBytes.size(); 1632 size_t i = 0; 1633 // We need to (un)poison n bytes of stack shadow. Poison as many as we can 1634 // using 64-bit stores (if we are on 64-bit arch), then poison the rest 1635 // with 32-bit stores, then with 16-byte stores, then with 8-byte stores. 1636 for (size_t LargeStoreSizeInBytes = ASan.LongSize / 8; 1637 LargeStoreSizeInBytes != 0; LargeStoreSizeInBytes /= 2) { 1638 for (; i + LargeStoreSizeInBytes - 1 < n; i += LargeStoreSizeInBytes) { 1639 uint64_t Val = 0; 1640 for (size_t j = 0; j < LargeStoreSizeInBytes; j++) { 1641 if (F.getParent()->getDataLayout().isLittleEndian()) 1642 Val |= (uint64_t)ShadowBytes[i + j] << (8 * j); 1643 else 1644 Val = (Val << 8) | ShadowBytes[i + j]; 1645 } 1646 if (!Val) continue; 1647 Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); 1648 Type *StoreTy = Type::getIntNTy(*C, LargeStoreSizeInBytes * 8); 1649 Value *Poison = ConstantInt::get(StoreTy, DoPoison ? Val : 0); 1650 IRB.CreateStore(Poison, IRB.CreateIntToPtr(Ptr, StoreTy->getPointerTo())); 1651 } 1652 } 1653} 1654 1655// Fake stack allocator (asan_fake_stack.h) has 11 size classes 1656// for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass 1657static int StackMallocSizeClass(uint64_t LocalStackSize) { 1658 assert(LocalStackSize <= kMaxStackMallocSize); 1659 uint64_t MaxSize = kMinStackMallocSize; 1660 for (int i = 0;; i++, MaxSize *= 2) 1661 if (LocalStackSize <= MaxSize) return i; 1662 llvm_unreachable("impossible LocalStackSize"); 1663} 1664 1665// Set Size bytes starting from ShadowBase to kAsanStackAfterReturnMagic. 1666// We can not use MemSet intrinsic because it may end up calling the actual 1667// memset. Size is a multiple of 8. 1668// Currently this generates 8-byte stores on x86_64; it may be better to 1669// generate wider stores. 1670void FunctionStackPoisoner::SetShadowToStackAfterReturnInlined( 1671 IRBuilder<> &IRB, Value *ShadowBase, int Size) { 1672 assert(!(Size % 8)); 1673 1674 // kAsanStackAfterReturnMagic is 0xf5. 1675 const uint64_t kAsanStackAfterReturnMagic64 = 0xf5f5f5f5f5f5f5f5ULL; 1676 1677 for (int i = 0; i < Size; i += 8) { 1678 Value *p = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); 1679 IRB.CreateStore( 1680 ConstantInt::get(IRB.getInt64Ty(), kAsanStackAfterReturnMagic64), 1681 IRB.CreateIntToPtr(p, IRB.getInt64Ty()->getPointerTo())); 1682 } 1683} 1684 1685static DebugLoc getFunctionEntryDebugLocation(Function &F) { 1686 for (const auto &Inst : F.getEntryBlock()) 1687 if (!isa<AllocaInst>(Inst)) return Inst.getDebugLoc(); 1688 return DebugLoc(); 1689} 1690 1691PHINode *FunctionStackPoisoner::createPHI(IRBuilder<> &IRB, Value *Cond, 1692 Value *ValueIfTrue, 1693 Instruction *ThenTerm, 1694 Value *ValueIfFalse) { 1695 PHINode *PHI = IRB.CreatePHI(IntptrTy, 2); 1696 BasicBlock *CondBlock = cast<Instruction>(Cond)->getParent(); 1697 PHI->addIncoming(ValueIfFalse, CondBlock); 1698 BasicBlock *ThenBlock = ThenTerm->getParent(); 1699 PHI->addIncoming(ValueIfTrue, ThenBlock); 1700 return PHI; 1701} 1702 1703Value *FunctionStackPoisoner::createAllocaForLayout( 1704 IRBuilder<> &IRB, const ASanStackFrameLayout &L, bool Dynamic) { 1705 AllocaInst *Alloca; 1706 if (Dynamic) { 1707 Alloca = IRB.CreateAlloca(IRB.getInt8Ty(), 1708 ConstantInt::get(IRB.getInt64Ty(), L.FrameSize), 1709 "MyAlloca"); 1710 } else { 1711 Alloca = IRB.CreateAlloca(ArrayType::get(IRB.getInt8Ty(), L.FrameSize), 1712 nullptr, "MyAlloca"); 1713 assert(Alloca->isStaticAlloca()); 1714 } 1715 assert((ClRealignStack & (ClRealignStack - 1)) == 0); 1716 size_t FrameAlignment = std::max(L.FrameAlignment, (size_t)ClRealignStack); 1717 Alloca->setAlignment(FrameAlignment); 1718 return IRB.CreatePointerCast(Alloca, IntptrTy); 1719} 1720 1721void FunctionStackPoisoner::poisonStack() { 1722 assert(AllocaVec.size() > 0 || DynamicAllocaVec.size() > 0); 1723 1724 if (ClInstrumentAllocas) { 1725 // Handle dynamic allocas. 1726 for (auto &AllocaCall : DynamicAllocaVec) { 1727 handleDynamicAllocaCall(AllocaCall); 1728 unpoisonDynamicAlloca(AllocaCall); 1729 } 1730 } 1731 1732 if (AllocaVec.size() == 0) return; 1733 1734 int StackMallocIdx = -1; 1735 DebugLoc EntryDebugLocation = getFunctionEntryDebugLocation(F); 1736 1737 Instruction *InsBefore = AllocaVec[0]; 1738 IRBuilder<> IRB(InsBefore); 1739 IRB.SetCurrentDebugLocation(EntryDebugLocation); 1740 1741 SmallVector<ASanStackVariableDescription, 16> SVD; 1742 SVD.reserve(AllocaVec.size()); 1743 for (AllocaInst *AI : AllocaVec) { 1744 ASanStackVariableDescription D = {AI->getName().data(), 1745 ASan.getAllocaSizeInBytes(AI), 1746 AI->getAlignment(), AI, 0}; 1747 SVD.push_back(D); 1748 } 1749 // Minimal header size (left redzone) is 4 pointers, 1750 // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms. 1751 size_t MinHeaderSize = ASan.LongSize / 2; 1752 ASanStackFrameLayout L; 1753 ComputeASanStackFrameLayout(SVD, 1UL << Mapping.Scale, MinHeaderSize, &L); 1754 DEBUG(dbgs() << L.DescriptionString << " --- " << L.FrameSize << "\n"); 1755 uint64_t LocalStackSize = L.FrameSize; 1756 bool DoStackMalloc = 1757 ClUseAfterReturn && LocalStackSize <= kMaxStackMallocSize; 1758 // Don't do dynamic alloca in presence of inline asm: too often it makes 1759 // assumptions on which registers are available. Don't do stack malloc in the 1760 // presence of inline asm on 32-bit platforms for the same reason. 1761 bool DoDynamicAlloca = ClDynamicAllocaStack && !HasNonEmptyInlineAsm; 1762 DoStackMalloc &= !HasNonEmptyInlineAsm || ASan.LongSize != 32; 1763 1764 Value *StaticAlloca = 1765 DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false); 1766 1767 Value *FakeStack; 1768 Value *LocalStackBase; 1769 1770 if (DoStackMalloc) { 1771 // void *FakeStack = __asan_option_detect_stack_use_after_return 1772 // ? __asan_stack_malloc_N(LocalStackSize) 1773 // : nullptr; 1774 // void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize); 1775 Constant *OptionDetectUAR = F.getParent()->getOrInsertGlobal( 1776 kAsanOptionDetectUAR, IRB.getInt32Ty()); 1777 Value *UARIsEnabled = 1778 IRB.CreateICmpNE(IRB.CreateLoad(OptionDetectUAR), 1779 Constant::getNullValue(IRB.getInt32Ty())); 1780 Instruction *Term = 1781 SplitBlockAndInsertIfThen(UARIsEnabled, InsBefore, false); 1782 IRBuilder<> IRBIf(Term); 1783 IRBIf.SetCurrentDebugLocation(EntryDebugLocation); 1784 StackMallocIdx = StackMallocSizeClass(LocalStackSize); 1785 assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass); 1786 Value *FakeStackValue = 1787 IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx], 1788 ConstantInt::get(IntptrTy, LocalStackSize)); 1789 IRB.SetInsertPoint(InsBefore); 1790 IRB.SetCurrentDebugLocation(EntryDebugLocation); 1791 FakeStack = createPHI(IRB, UARIsEnabled, FakeStackValue, Term, 1792 ConstantInt::get(IntptrTy, 0)); 1793 1794 Value *NoFakeStack = 1795 IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy)); 1796 Term = SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false); 1797 IRBIf.SetInsertPoint(Term); 1798 IRBIf.SetCurrentDebugLocation(EntryDebugLocation); 1799 Value *AllocaValue = 1800 DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca; 1801 IRB.SetInsertPoint(InsBefore); 1802 IRB.SetCurrentDebugLocation(EntryDebugLocation); 1803 LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack); 1804 } else { 1805 // void *FakeStack = nullptr; 1806 // void *LocalStackBase = alloca(LocalStackSize); 1807 FakeStack = ConstantInt::get(IntptrTy, 0); 1808 LocalStackBase = 1809 DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca; 1810 } 1811 1812 // Insert poison calls for lifetime intrinsics for alloca. 1813 bool HavePoisonedAllocas = false; 1814 for (const auto &APC : AllocaPoisonCallVec) { 1815 assert(APC.InsBefore); 1816 assert(APC.AI); 1817 IRBuilder<> IRB(APC.InsBefore); 1818 poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison); 1819 HavePoisonedAllocas |= APC.DoPoison; 1820 } 1821 1822 // Replace Alloca instructions with base+offset. 1823 for (const auto &Desc : SVD) { 1824 AllocaInst *AI = Desc.AI; 1825 Value *NewAllocaPtr = IRB.CreateIntToPtr( 1826 IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)), 1827 AI->getType()); 1828 replaceDbgDeclareForAlloca(AI, NewAllocaPtr, DIB, /*Deref=*/true); 1829 AI->replaceAllUsesWith(NewAllocaPtr); 1830 } 1831 1832 // The left-most redzone has enough space for at least 4 pointers. 1833 // Write the Magic value to redzone[0]. 1834 Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); 1835 IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), 1836 BasePlus0); 1837 // Write the frame description constant to redzone[1]. 1838 Value *BasePlus1 = IRB.CreateIntToPtr( 1839 IRB.CreateAdd(LocalStackBase, 1840 ConstantInt::get(IntptrTy, ASan.LongSize / 8)), 1841 IntptrPtrTy); 1842 GlobalVariable *StackDescriptionGlobal = 1843 createPrivateGlobalForString(*F.getParent(), L.DescriptionString, 1844 /*AllowMerging*/ true); 1845 Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy); 1846 IRB.CreateStore(Description, BasePlus1); 1847 // Write the PC to redzone[2]. 1848 Value *BasePlus2 = IRB.CreateIntToPtr( 1849 IRB.CreateAdd(LocalStackBase, 1850 ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)), 1851 IntptrPtrTy); 1852 IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2); 1853 1854 // Poison the stack redzones at the entry. 1855 Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB); 1856 poisonRedZones(L.ShadowBytes, IRB, ShadowBase, true); 1857 1858 // (Un)poison the stack before all ret instructions. 1859 for (auto Ret : RetVec) { 1860 IRBuilder<> IRBRet(Ret); 1861 // Mark the current frame as retired. 1862 IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), 1863 BasePlus0); 1864 if (DoStackMalloc) { 1865 assert(StackMallocIdx >= 0); 1866 // if FakeStack != 0 // LocalStackBase == FakeStack 1867 // // In use-after-return mode, poison the whole stack frame. 1868 // if StackMallocIdx <= 4 1869 // // For small sizes inline the whole thing: 1870 // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize); 1871 // **SavedFlagPtr(FakeStack) = 0 1872 // else 1873 // __asan_stack_free_N(FakeStack, LocalStackSize) 1874 // else 1875 // <This is not a fake stack; unpoison the redzones> 1876 Value *Cmp = 1877 IRBRet.CreateICmpNE(FakeStack, Constant::getNullValue(IntptrTy)); 1878 TerminatorInst *ThenTerm, *ElseTerm; 1879 SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm); 1880 1881 IRBuilder<> IRBPoison(ThenTerm); 1882 if (StackMallocIdx <= 4) { 1883 int ClassSize = kMinStackMallocSize << StackMallocIdx; 1884 SetShadowToStackAfterReturnInlined(IRBPoison, ShadowBase, 1885 ClassSize >> Mapping.Scale); 1886 Value *SavedFlagPtrPtr = IRBPoison.CreateAdd( 1887 FakeStack, 1888 ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8)); 1889 Value *SavedFlagPtr = IRBPoison.CreateLoad( 1890 IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy)); 1891 IRBPoison.CreateStore( 1892 Constant::getNullValue(IRBPoison.getInt8Ty()), 1893 IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy())); 1894 } else { 1895 // For larger frames call __asan_stack_free_*. 1896 IRBPoison.CreateCall2(AsanStackFreeFunc[StackMallocIdx], FakeStack, 1897 ConstantInt::get(IntptrTy, LocalStackSize)); 1898 } 1899 1900 IRBuilder<> IRBElse(ElseTerm); 1901 poisonRedZones(L.ShadowBytes, IRBElse, ShadowBase, false); 1902 } else if (HavePoisonedAllocas) { 1903 // If we poisoned some allocas in llvm.lifetime analysis, 1904 // unpoison whole stack frame now. 1905 poisonAlloca(LocalStackBase, LocalStackSize, IRBRet, false); 1906 } else { 1907 poisonRedZones(L.ShadowBytes, IRBRet, ShadowBase, false); 1908 } 1909 } 1910 1911 // We are done. Remove the old unused alloca instructions. 1912 for (auto AI : AllocaVec) AI->eraseFromParent(); 1913} 1914 1915void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size, 1916 IRBuilder<> &IRB, bool DoPoison) { 1917 // For now just insert the call to ASan runtime. 1918 Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy); 1919 Value *SizeArg = ConstantInt::get(IntptrTy, Size); 1920 IRB.CreateCall2( 1921 DoPoison ? AsanPoisonStackMemoryFunc : AsanUnpoisonStackMemoryFunc, 1922 AddrArg, SizeArg); 1923} 1924 1925// Handling llvm.lifetime intrinsics for a given %alloca: 1926// (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca. 1927// (2) if %size is constant, poison memory for llvm.lifetime.end (to detect 1928// invalid accesses) and unpoison it for llvm.lifetime.start (the memory 1929// could be poisoned by previous llvm.lifetime.end instruction, as the 1930// variable may go in and out of scope several times, e.g. in loops). 1931// (3) if we poisoned at least one %alloca in a function, 1932// unpoison the whole stack frame at function exit. 1933 1934AllocaInst *FunctionStackPoisoner::findAllocaForValue(Value *V) { 1935 if (AllocaInst *AI = dyn_cast<AllocaInst>(V)) 1936 // We're intested only in allocas we can handle. 1937 return ASan.isInterestingAlloca(*AI) ? AI : nullptr; 1938 // See if we've already calculated (or started to calculate) alloca for a 1939 // given value. 1940 AllocaForValueMapTy::iterator I = AllocaForValue.find(V); 1941 if (I != AllocaForValue.end()) return I->second; 1942 // Store 0 while we're calculating alloca for value V to avoid 1943 // infinite recursion if the value references itself. 1944 AllocaForValue[V] = nullptr; 1945 AllocaInst *Res = nullptr; 1946 if (CastInst *CI = dyn_cast<CastInst>(V)) 1947 Res = findAllocaForValue(CI->getOperand(0)); 1948 else if (PHINode *PN = dyn_cast<PHINode>(V)) { 1949 for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i) { 1950 Value *IncValue = PN->getIncomingValue(i); 1951 // Allow self-referencing phi-nodes. 1952 if (IncValue == PN) continue; 1953 AllocaInst *IncValueAI = findAllocaForValue(IncValue); 1954 // AI for incoming values should exist and should all be equal. 1955 if (IncValueAI == nullptr || (Res != nullptr && IncValueAI != Res)) 1956 return nullptr; 1957 Res = IncValueAI; 1958 } 1959 } 1960 if (Res) AllocaForValue[V] = Res; 1961 return Res; 1962} 1963 1964// Compute PartialRzMagic for dynamic alloca call. PartialRzMagic is 1965// constructed from two separate 32-bit numbers: PartialRzMagic = Val1 | Val2. 1966// (1) Val1 is resposible for forming base value for PartialRzMagic, containing 1967// only 00 for fully addressable and 0xcb for fully poisoned bytes for each 1968// 8-byte chunk of user memory respectively. 1969// (2) Val2 forms the value for marking first poisoned byte in shadow memory 1970// with appropriate value (0x01 - 0x07 or 0xcb if Padding % 8 == 0). 1971 1972// Shift = Padding & ~7; // the number of bits we need to shift to access first 1973// chunk in shadow memory, containing nonzero bytes. 1974// Example: 1975// Padding = 21 Padding = 16 1976// Shadow: |00|00|05|cb| Shadow: |00|00|cb|cb| 1977// ^ ^ 1978// | | 1979// Shift = 21 & ~7 = 16 Shift = 16 & ~7 = 16 1980// 1981// Val1 = 0xcbcbcbcb << Shift; 1982// PartialBits = Padding ? Padding & 7 : 0xcb; 1983// Val2 = PartialBits << Shift; 1984// Result = Val1 | Val2; 1985Value *FunctionStackPoisoner::computePartialRzMagic(Value *PartialSize, 1986 IRBuilder<> &IRB) { 1987 PartialSize = IRB.CreateIntCast(PartialSize, IRB.getInt32Ty(), false); 1988 Value *Shift = IRB.CreateAnd(PartialSize, IRB.getInt32(~7)); 1989 unsigned Val1Int = kAsanAllocaPartialVal1; 1990 unsigned Val2Int = kAsanAllocaPartialVal2; 1991 if (!F.getParent()->getDataLayout().isLittleEndian()) { 1992 Val1Int = sys::getSwappedBytes(Val1Int); 1993 Val2Int = sys::getSwappedBytes(Val2Int); 1994 } 1995 Value *Val1 = shiftAllocaMagic(IRB.getInt32(Val1Int), IRB, Shift); 1996 Value *PartialBits = IRB.CreateAnd(PartialSize, IRB.getInt32(7)); 1997 // For BigEndian get 0x000000YZ -> 0xYZ000000. 1998 if (F.getParent()->getDataLayout().isBigEndian()) 1999 PartialBits = IRB.CreateShl(PartialBits, IRB.getInt32(24)); 2000 Value *Val2 = IRB.getInt32(Val2Int); 2001 Value *Cond = 2002 IRB.CreateICmpNE(PartialBits, Constant::getNullValue(IRB.getInt32Ty())); 2003 Val2 = IRB.CreateSelect(Cond, shiftAllocaMagic(PartialBits, IRB, Shift), 2004 shiftAllocaMagic(Val2, IRB, Shift)); 2005 return IRB.CreateOr(Val1, Val2); 2006} 2007 2008void FunctionStackPoisoner::handleDynamicAllocaCall( 2009 DynamicAllocaCall &AllocaCall) { 2010 AllocaInst *AI = AllocaCall.AI; 2011 if (!doesDominateAllExits(AI)) { 2012 // We do not yet handle complex allocas 2013 AllocaCall.Poison = false; 2014 return; 2015 } 2016 2017 IRBuilder<> IRB(AI); 2018 2019 PointerType *Int32PtrTy = PointerType::getUnqual(IRB.getInt32Ty()); 2020 const unsigned Align = std::max(kAllocaRzSize, AI->getAlignment()); 2021 const uint64_t AllocaRedzoneMask = kAllocaRzSize - 1; 2022 2023 Value *Zero = Constant::getNullValue(IntptrTy); 2024 Value *AllocaRzSize = ConstantInt::get(IntptrTy, kAllocaRzSize); 2025 Value *AllocaRzMask = ConstantInt::get(IntptrTy, AllocaRedzoneMask); 2026 Value *NotAllocaRzMask = ConstantInt::get(IntptrTy, ~AllocaRedzoneMask); 2027 2028 // Since we need to extend alloca with additional memory to locate 2029 // redzones, and OldSize is number of allocated blocks with 2030 // ElementSize size, get allocated memory size in bytes by 2031 // OldSize * ElementSize. 2032 unsigned ElementSize = 2033 F.getParent()->getDataLayout().getTypeAllocSize(AI->getAllocatedType()); 2034 Value *OldSize = IRB.CreateMul(AI->getArraySize(), 2035 ConstantInt::get(IntptrTy, ElementSize)); 2036 2037 // PartialSize = OldSize % 32 2038 Value *PartialSize = IRB.CreateAnd(OldSize, AllocaRzMask); 2039 2040 // Misalign = kAllocaRzSize - PartialSize; 2041 Value *Misalign = IRB.CreateSub(AllocaRzSize, PartialSize); 2042 2043 // PartialPadding = Misalign != kAllocaRzSize ? Misalign : 0; 2044 Value *Cond = IRB.CreateICmpNE(Misalign, AllocaRzSize); 2045 Value *PartialPadding = IRB.CreateSelect(Cond, Misalign, Zero); 2046 2047 // AdditionalChunkSize = Align + PartialPadding + kAllocaRzSize 2048 // Align is added to locate left redzone, PartialPadding for possible 2049 // partial redzone and kAllocaRzSize for right redzone respectively. 2050 Value *AdditionalChunkSize = IRB.CreateAdd( 2051 ConstantInt::get(IntptrTy, Align + kAllocaRzSize), PartialPadding); 2052 2053 Value *NewSize = IRB.CreateAdd(OldSize, AdditionalChunkSize); 2054 2055 // Insert new alloca with new NewSize and Align params. 2056 AllocaInst *NewAlloca = IRB.CreateAlloca(IRB.getInt8Ty(), NewSize); 2057 NewAlloca->setAlignment(Align); 2058 2059 // NewAddress = Address + Align 2060 Value *NewAddress = IRB.CreateAdd(IRB.CreatePtrToInt(NewAlloca, IntptrTy), 2061 ConstantInt::get(IntptrTy, Align)); 2062 2063 Value *NewAddressPtr = IRB.CreateIntToPtr(NewAddress, AI->getType()); 2064 2065 // LeftRzAddress = NewAddress - kAllocaRzSize 2066 Value *LeftRzAddress = IRB.CreateSub(NewAddress, AllocaRzSize); 2067 2068 // Poisoning left redzone. 2069 AllocaCall.LeftRzAddr = ASan.memToShadow(LeftRzAddress, IRB); 2070 IRB.CreateStore(ConstantInt::get(IRB.getInt32Ty(), kAsanAllocaLeftMagic), 2071 IRB.CreateIntToPtr(AllocaCall.LeftRzAddr, Int32PtrTy)); 2072 2073 // PartialRzAligned = PartialRzAddr & ~AllocaRzMask 2074 Value *PartialRzAddr = IRB.CreateAdd(NewAddress, OldSize); 2075 Value *PartialRzAligned = IRB.CreateAnd(PartialRzAddr, NotAllocaRzMask); 2076 2077 // Poisoning partial redzone. 2078 Value *PartialRzMagic = computePartialRzMagic(PartialSize, IRB); 2079 Value *PartialRzShadowAddr = ASan.memToShadow(PartialRzAligned, IRB); 2080 IRB.CreateStore(PartialRzMagic, 2081 IRB.CreateIntToPtr(PartialRzShadowAddr, Int32PtrTy)); 2082 2083 // RightRzAddress 2084 // = (PartialRzAddr + AllocaRzMask) & ~AllocaRzMask 2085 Value *RightRzAddress = IRB.CreateAnd( 2086 IRB.CreateAdd(PartialRzAddr, AllocaRzMask), NotAllocaRzMask); 2087 2088 // Poisoning right redzone. 2089 AllocaCall.RightRzAddr = ASan.memToShadow(RightRzAddress, IRB); 2090 IRB.CreateStore(ConstantInt::get(IRB.getInt32Ty(), kAsanAllocaRightMagic), 2091 IRB.CreateIntToPtr(AllocaCall.RightRzAddr, Int32PtrTy)); 2092 2093 // Replace all uses of AddessReturnedByAlloca with NewAddress. 2094 AI->replaceAllUsesWith(NewAddressPtr); 2095 2096 // We are done. Erase old alloca and store left, partial and right redzones 2097 // shadow addresses for future unpoisoning. 2098 AI->eraseFromParent(); 2099 NumInstrumentedDynamicAllocas++; 2100} 2101 2102// isSafeAccess returns true if Addr is always inbounds with respect to its 2103// base object. For example, it is a field access or an array access with 2104// constant inbounds index. 2105bool AddressSanitizer::isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, 2106 Value *Addr, uint64_t TypeSize) const { 2107 SizeOffsetType SizeOffset = ObjSizeVis.compute(Addr); 2108 if (!ObjSizeVis.bothKnown(SizeOffset)) return false; 2109 uint64_t Size = SizeOffset.first.getZExtValue(); 2110 int64_t Offset = SizeOffset.second.getSExtValue(); 2111 // Three checks are required to ensure safety: 2112 // . Offset >= 0 (since the offset is given from the base ptr) 2113 // . Size >= Offset (unsigned) 2114 // . Size - Offset >= NeededSize (unsigned) 2115 return Offset >= 0 && Size >= uint64_t(Offset) && 2116 Size - uint64_t(Offset) >= TypeSize / 8; 2117} 2118