AddressSanitizer.cpp revision d6f62c8da5aa4f3388cec1542309ffa623cac601
1800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===-- AddressSanitizer.cpp - memory error detector ------------*- C++ -*-===// 2800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 3800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The LLVM Compiler Infrastructure 4800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 5800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is distributed under the University of Illinois Open Source 6800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// License. See LICENSE.TXT for details. 7800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 8800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 9800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 10800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This file is a part of AddressSanitizer, an address sanity checker. 11800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Details of the algorithm: 12800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm 13800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 14800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany//===----------------------------------------------------------------------===// 15800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 16800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#define DEBUG_TYPE "asan" 17800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 18b5b86d263a651566cb25c0f406f75ceffb771029Kostya Serebryany#include "BlackList.h" 1906cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/Function.h" 2006cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/IRBuilder.h" 21f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany#include "llvm/InlineAsm.h" 2206cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/IntrinsicInst.h" 2306cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/LLVMContext.h" 2406cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/Module.h" 2506cb8ed00696eb14d1b831921452e50ec0568ea2Chandler Carruth#include "llvm/Type.h" 26800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/ArrayRef.h" 27800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/OwningPtr.h" 28800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallSet.h" 29800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallString.h" 30800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/SmallVector.h" 31800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/ADT/StringExtras.h" 3206fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov#include "llvm/ADT/Triple.h" 33800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/CommandLine.h" 34800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/DataTypes.h" 35800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/Debug.h" 36800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/raw_ostream.h" 37800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Support/system_error.h" 383574eca1b02600bac4e625297f4ecf745f4c4f32Micah Villmow#include "llvm/DataLayout.h" 39800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Target/TargetMachine.h" 40800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Instrumentation.h" 41800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/BasicBlockUtils.h" 42800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include "llvm/Transforms/Utils/ModuleUtils.h" 43800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 44800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include <string> 45800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany#include <algorithm> 46800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 47800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyusing namespace llvm; 48800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 49800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowScale = 3; 50800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset32 = 1ULL << 29; 51800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uint64_t kDefaultShadowOffset64 = 1ULL << 44; 5206fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanovstatic const uint64_t kDefaultShadowOffsetAndroid = 0; 53800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 54800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const size_t kMaxStackMallocSize = 1 << 16; // 64K 55800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; 56800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; 57800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 58800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanModuleCtorName = "asan.module_ctor"; 597bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const char *kAsanModuleDtorName = "asan.module_dtor"; 607bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const int kAsanCtorAndCtorPriority = 1; 61800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanReportErrorTemplate = "__asan_report_"; 62800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanRegisterGlobalsName = "__asan_register_globals"; 637bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryanystatic const char *kAsanUnregisterGlobalsName = "__asan_unregister_globals"; 649b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryanystatic const char *kAsanPoisonGlobalsName = "__asan_before_dynamic_init"; 659b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryanystatic const char *kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"; 66800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanInitName = "__asan_init"; 6795e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryanystatic const char *kAsanHandleNoReturnName = "__asan_handle_no_return"; 68800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanMappingOffsetName = "__asan_mapping_offset"; 69800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanMappingScaleName = "__asan_mapping_scale"; 70800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanStackMallocName = "__asan_stack_malloc"; 71800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const char *kAsanStackFreeName = "__asan_stack_free"; 7251c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryanystatic const char *kAsanGenPrefix = "__asan_gen_"; 73800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 74800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackLeftRedzoneMagic = 0xf1; 75800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackMidRedzoneMagic = 0xf2; 76800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackRightRedzoneMagic = 0xf3; 77800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic const int kAsanStackPartialRedzoneMagic = 0xf4; 78800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 79c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany// Accesses sizes are powers of two: 1, 2, 4, 8, 16. 80c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanystatic const size_t kNumberOfAccessSizes = 5; 81c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 82800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Command-line flags. 83800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 84800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no-]asan-reads. 85800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentReads("asan-instrument-reads", 86800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument read instructions"), cl::Hidden, cl::init(true)); 87800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClInstrumentWrites("asan-instrument-writes", 88800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("instrument write instructions"), cl::Hidden, cl::init(true)); 89e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryanystatic cl::opt<bool> ClInstrumentAtomics("asan-instrument-atomics", 90e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany cl::desc("instrument atomic instructions (rmw, cmpxchg)"), 91e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany cl::Hidden, cl::init(true)); 926e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryanystatic cl::opt<bool> ClAlwaysSlowPath("asan-always-slow-path", 936e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany cl::desc("use instrumentation with slow path for all accesses"), 946e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany cl::Hidden, cl::init(false)); 95c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany// This flag limits the number of instructions to be instrumented 96324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// in any given BB. Normally, this should be set to unlimited (INT_MAX), 97324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary 98324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany// set it to 10000. 99324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryanystatic cl::opt<int> ClMaxInsnsToInstrumentPerBB("asan-max-ins-per-bb", 100324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::init(10000), 101324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::desc("maximal number of instructions to instrument in any given BB"), 102324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany cl::Hidden); 103800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-stack. 104800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClStack("asan-stack", 105800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle stack memory"), cl::Hidden, cl::init(true)); 106800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-use-after-return. 107800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClUseAfterReturn("asan-use-after-return", 108800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Check return-after-free"), cl::Hidden, cl::init(false)); 109800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -f[no]asan-globals. 110800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClGlobals("asan-globals", 111800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle global objects"), cl::Hidden, cl::init(true)); 1129b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryanystatic cl::opt<bool> ClInitializers("asan-initialization-order", 1139b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(false)); 114800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClMemIntrin("asan-memintrin", 115800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Handle memset/memcpy/memmove"), cl::Hidden, cl::init(true)); 116800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This flag may need to be replaced with -fasan-blacklist. 117800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<std::string> ClBlackListFile("asan-blacklist", 118800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("File containing the list of functions to ignore " 119800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "during instrumentation"), cl::Hidden); 120800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 121800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// These flags allow to change the shadow mapping. 122800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// The shadow mapping looks like 123800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Shadow = (Mem >> scale) + (1 << offset_log) 124800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingScale("asan-mapping-scale", 125800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0)); 126800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClMappingOffsetLog("asan-mapping-offset-log", 127800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("offset of asan shadow mapping"), cl::Hidden, cl::init(-1)); 128800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 129800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Optimization flags. Not user visible, used mostly for testing 130800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// and benchmarking the tool. 131800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOpt("asan-opt", 132800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true)); 133800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptSameTemp("asan-opt-same-temp", 134800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Instrument the same temp just once"), cl::Hidden, 135800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(true)); 136800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<bool> ClOptGlobals("asan-opt-globals", 137800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true)); 138800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 139ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonovstatic cl::opt<bool> ClCheckLifetime("asan-check-lifetime", 140ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov cl::desc("Use llvm.lifetime intrinsics to insert extra checks"), 141ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov cl::Hidden, cl::init(false)); 142ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov 143800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Debug flags. 144800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, 145800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::init(0)); 146800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), 147800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(0)); 148800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<std::string> ClDebugFunc("asan-debug-func", 149800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::desc("Debug func")); 150800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), 151800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 152800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), 153800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany cl::Hidden, cl::init(-1)); 154800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 155800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanynamespace { 156ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany/// A set of dynamically initialized globals extracted from metadata. 157ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryanyclass SetOfDynamicallyInitializedGlobals { 158ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany public: 159ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany void Init(Module& M) { 160ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany // Clang generates metadata identifying all dynamically initialized globals. 161ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany NamedMDNode *DynamicGlobals = 162ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany M.getNamedMetadata("llvm.asan.dynamically_initialized_globals"); 163ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany if (!DynamicGlobals) 164ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany return; 165ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany for (int i = 0, n = DynamicGlobals->getNumOperands(); i < n; ++i) { 166ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany MDNode *MDN = DynamicGlobals->getOperand(i); 167ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany assert(MDN->getNumOperands() == 1); 168ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany Value *VG = MDN->getOperand(0); 169ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany // The optimizer may optimize away a global entirely, in which case we 170ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany // cannot instrument access to it. 171ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany if (!VG) 172ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany continue; 173ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany DynInitGlobals.insert(cast<GlobalVariable>(VG)); 174ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany } 175ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany } 176ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany bool Contains(GlobalVariable *G) { return DynInitGlobals.count(G) != 0; } 177ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany private: 178ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany SmallSet<GlobalValue*, 32> DynInitGlobals; 179ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany}; 180ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany 181b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryanystatic int MappingScale() { 182b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany return ClMappingScale ? ClMappingScale : kDefaultShadowScale; 183b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany} 184b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 185b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryanystatic size_t RedzoneSize() { 186b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany // Redzone used for stack and globals is at least 32 bytes. 187b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. 188b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany return std::max(32U, 1U << MappingScale()); 189b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany} 190ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany 191800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany/// AddressSanitizer: instrument the code in module to find memory bugs. 192ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanystruct AddressSanitizer : public FunctionPass { 193ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov AddressSanitizer(bool CheckInitOrder = false, 194ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckUseAfterReturn = false, 195ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckLifetime = false) 196ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov : FunctionPass(ID), 197ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov CheckInitOrder(CheckInitOrder || ClInitializers), 198ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov CheckUseAfterReturn(CheckUseAfterReturn || ClUseAfterReturn), 199ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov CheckLifetime(CheckLifetime || ClCheckLifetime) {} 2001416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany virtual const char *getPassName() const { 2011416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany return "AddressSanitizerFunctionPass"; 2021416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany } 203ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany void instrumentMop(Instruction *I); 204ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany void instrumentAddress(Instruction *OrigIns, IRBuilder<> &IRB, 205800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr, uint32_t TypeSize, bool IsWrite); 206c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 207c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *ShadowValue, uint32_t TypeSize); 208ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr, 2092735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany bool IsWrite, size_t AccessSizeIndex); 210ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany bool instrumentMemIntrinsic(MemIntrinsic *MI); 211ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany void instrumentMemIntrinsicParam(Instruction *OrigIns, Value *Addr, 212c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *Size, 213800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore, bool IsWrite); 214800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); 215ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany bool runOnFunction(Function &F); 2169b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany void createInitializerPoisonCalls(Module &M, 2179b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Value *FirstAddr, Value *LastAddr); 218a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany bool maybeInsertAsanInitAtFunctionEntry(Function &F); 219ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany bool poisonStackInFunction(Function &F); 220ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany virtual bool doInitialization(Module &M); 221800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany static char ID; // Pass identification, replacement for typeid 222800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 223800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany private: 2248b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany void initializeCallbacks(Module &M); 225800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t getAllocaSizeInBytes(AllocaInst *AI) { 226800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = AI->getAllocatedType(); 227d8313be41031e4d768f5b38199904d4debff88cdEvgeniy Stepanov uint64_t SizeInBytes = TD->getTypeAllocSize(Ty); 228800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return SizeInBytes; 229800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 230800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t getAlignedSize(uint64_t SizeInBytes) { 231b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t RZ = RedzoneSize(); 232b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany return ((SizeInBytes + RZ - 1) / RZ) * RZ; 233800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 234800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t getAlignedAllocaSize(AllocaInst *AI) { 235800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 236800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return getAlignedSize(SizeInBytes); 237800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 238800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 2399b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany bool ShouldInstrumentGlobal(GlobalVariable *G); 240800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany void PoisonStack(const ArrayRef<AllocaInst*> &AllocaVec, IRBuilder<> IRB, 241800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowBase, bool DoPoison); 2425a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany bool LooksLikeCodeInBug11395(Instruction *I); 2439b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany void FindDynamicInitializers(Module &M); 244800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 245ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckInitOrder; 246ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckUseAfterReturn; 247ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckLifetime; 248800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LLVMContext *C; 2493574eca1b02600bac4e625297f4ecf745f4c4f32Micah Villmow DataLayout *TD; 250800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t MappingOffset; 251800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int LongSize; 252800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *IntptrTy; 253800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *IntptrPtrTy; 254800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanCtorFunction; 255800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Function *AsanInitFunction; 256ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany Function *AsanStackMallocFunc, *AsanStackFreeFunc; 257ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany Function *AsanHandleNoReturnFunc; 258b5b86d263a651566cb25c0f406f75ceffb771029Kostya Serebryany OwningPtr<BlackList> BL; 2599db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // This array is indexed by AccessIsWrite and log2(AccessSize). 2609db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany Function *AsanErrorCallback[2][kNumberOfAccessSizes]; 261f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany InlineAsm *EmptyAsm; 262ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany SetOfDynamicallyInitializedGlobals DynamicallyInitializedGlobals; 263800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany}; 264c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 2651416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanyclass AddressSanitizerModule : public ModulePass { 266b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany public: 267ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov AddressSanitizerModule(bool CheckInitOrder = false) 268ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov : ModulePass(ID), 269ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov CheckInitOrder(CheckInitOrder || ClInitializers) {} 2701416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany bool runOnModule(Module &M); 2711416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany static char ID; // Pass identification, replacement for typeid 2721416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany virtual const char *getPassName() const { 2731416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany return "AddressSanitizerModule"; 2741416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany } 275b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany private: 276b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany bool ShouldInstrumentGlobal(GlobalVariable *G); 277b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany void createInitializerPoisonCalls(Module &M, Value *FirstAddr, 278b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Value *LastAddr); 279b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 280ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckInitOrder; 281b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany OwningPtr<BlackList> BL; 282b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany SetOfDynamicallyInitializedGlobals DynamicallyInitializedGlobals; 283b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Type *IntptrTy; 284b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany LLVMContext *C; 2851416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany DataLayout *TD; 286b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany}; 287b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 288800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} // namespace 289800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 290800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanychar AddressSanitizer::ID = 0; 291800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyINITIALIZE_PASS(AddressSanitizer, "asan", 292800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", 293800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany false, false) 294ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey SamsonovFunctionPass *llvm::createAddressSanitizerFunctionPass( 295ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool CheckInitOrder, bool CheckUseAfterReturn, bool CheckLifetime) { 296ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov return new AddressSanitizer(CheckInitOrder, CheckUseAfterReturn, 297ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov CheckLifetime); 298800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 299800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 3001416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanychar AddressSanitizerModule::ID = 0; 3011416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya SerebryanyINITIALIZE_PASS(AddressSanitizerModule, "asan-module", 3021416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany "AddressSanitizer: detects use-after-free and out-of-bounds bugs." 3031416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany "ModulePass", false, false) 304ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey SamsonovModulePass *llvm::createAddressSanitizerModulePass(bool CheckInitOrder) { 305ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov return new AddressSanitizerModule(CheckInitOrder); 30625878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko} 30725878042030e85c244b41bfcdfad27c32360e2ecAlexander Potapenko 3082735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryanystatic size_t TypeSizeToSizeIndex(uint32_t TypeSize) { 3092735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany size_t Res = CountTrailingZeros_32(TypeSize / 8); 3102735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany assert(Res < kNumberOfAccessSizes); 3112735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany return Res; 3122735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany} 3132735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany 314800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Create a constant for Str so that we can pass it to the run-time lib. 315800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic GlobalVariable *createPrivateGlobalForString(Module &M, StringRef Str) { 31618c7f80b3e83ab584bd8572695a3cde8bafd9d3cChris Lattner Constant *StrConst = ConstantDataArray::getString(M.getContext(), Str); 317800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return new GlobalVariable(M, StrConst->getType(), true, 31851c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany GlobalValue::PrivateLinkage, StrConst, 31951c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany kAsanGenPrefix); 32051c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany} 32151c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany 32251c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryanystatic bool GlobalWasGeneratedByAsan(GlobalVariable *G) { 32351c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany return G->getName().find(kAsanGenPrefix) == 0; 324800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 325800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 326800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyValue *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { 327800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Shadow >> scale 328b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Shadow = IRB.CreateLShr(Shadow, MappingScale()); 329800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (MappingOffset == 0) 330800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return Shadow; 331800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // (Shadow >> scale) | offset 332800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return IRB.CreateOr(Shadow, ConstantInt::get(IntptrTy, 333800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset)); 334800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 335800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 336c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryanyvoid AddressSanitizer::instrumentMemIntrinsicParam( 337ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany Instruction *OrigIns, 338800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Addr, Value *Size, Instruction *InsertBefore, bool IsWrite) { 339800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the first byte. 340800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany { 341800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 342ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentAddress(OrigIns, IRB, Addr, 8, IsWrite); 343800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 344800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Check the last byte. 345800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany { 346800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 347800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *SizeMinusOne = IRB.CreateSub( 348800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Size, ConstantInt::get(Size->getType(), 1)); 349800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SizeMinusOne = IRB.CreateIntCast(SizeMinusOne, IntptrTy, false); 350800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 351800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrPlusSizeMinisOne = IRB.CreateAdd(AddrLong, SizeMinusOne); 352ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentAddress(OrigIns, IRB, AddrPlusSizeMinisOne, 8, IsWrite); 353800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 354800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 355800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 356800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Instrument memset/memmove/memcpy 357ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanybool AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { 358800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Dst = MI->getDest(); 359800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MemTransferInst *MemTran = dyn_cast<MemTransferInst>(MI); 3602735cf4aa52e31b8d2de90f836c3ad991215e04eKostya Serebryany Value *Src = MemTran ? MemTran->getSource() : 0; 361800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Length = MI->getLength(); 362800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 363800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *ConstLength = dyn_cast<Constant>(Length); 364800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsertBefore = MI; 365800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength) { 366800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ConstLength->isNullValue()) return false; 367800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 368800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // The size is not a constant so it could be zero -- check at run-time. 369800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsertBefore); 370800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 371800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(Length, 37256139bc493790612ee6281630678e293be6b2eb2Kostya Serebryany Constant::getNullValue(Length->getType())); 3734a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov InsertBefore = SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), false); 374800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 375800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 376ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMemIntrinsicParam(MI, Dst, Length, InsertBefore, true); 377800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (Src) 378ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMemIntrinsicParam(MI, Src, Length, InsertBefore, false); 379800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 380800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 381800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 382e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany// If I is an interesting memory access, return the PointerOperand 383e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany// and set IsWrite. Otherwise return NULL. 384e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryanystatic Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite) { 385800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 386e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentReads) return NULL; 387e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = false; 388800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return LI->getPointerOperand(); 389800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 390e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (StoreInst *SI = dyn_cast<StoreInst>(I)) { 391e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentWrites) return NULL; 392e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 393e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return SI->getPointerOperand(); 394e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 395e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { 396e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentAtomics) return NULL; 397e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 398e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return RMW->getPointerOperand(); 399e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 400e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { 401e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (!ClInstrumentAtomics) return NULL; 402e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany *IsWrite = true; 403e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return XCHG->getPointerOperand(); 404e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany } 405e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany return NULL; 406800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 407800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 408ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanyvoid AddressSanitizer::instrumentMop(Instruction *I) { 4093780ad8b998d93d7db406919c06137cdb786ef05Axel Naumann bool IsWrite = false; 410e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany Value *Addr = isInterestingMemoryAccess(I, &IsWrite); 411e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany assert(Addr); 4129b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (ClOpt && ClOptGlobals) { 4139b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (GlobalVariable *G = dyn_cast<GlobalVariable>(Addr)) { 4149b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // If initialization order checking is disabled, a simple access to a 4159b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // dynamically initialized global is always valid. 416ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov if (!CheckInitOrder) 4179b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return; 4189b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // If a global variable does not have dynamic initialization we don't 419407790604b8f71f7172bbdfb76c27e1799d241c2Kostya Serebryany // have to instrument it. However, if a global does not have initailizer 420407790604b8f71f7172bbdfb76c27e1799d241c2Kostya Serebryany // at all, we assume it has dynamic initializer (in other TU). 421407790604b8f71f7172bbdfb76c27e1799d241c2Kostya Serebryany if (G->hasInitializer() && !DynamicallyInitializedGlobals.Contains(G)) 4229b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return; 4239b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 424800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 4259b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 426800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigPtrTy = Addr->getType(); 427800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *OrigTy = cast<PointerType>(OrigPtrTy)->getElementType(); 428800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 429800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(OrigTy->isSized()); 430800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t TypeSize = TD->getTypeStoreSizeInBits(OrigTy); 431800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 432800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (TypeSize != 8 && TypeSize != 16 && 433800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TypeSize != 32 && TypeSize != 64 && TypeSize != 128) { 434800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Ignore all unusual sizes. 435800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return; 436800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 437800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 438800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(I); 439ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentAddress(I, IRB, Addr, TypeSize, IsWrite); 440800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 441800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 44255cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// Validate the result of Module::getOrInsertFunction called for an interface 44355cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// function of AddressSanitizer. If the instrumented module defines a function 44455cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// with the same name, their prototypes must match, otherwise 44555cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko// getOrInsertFunction returns a bitcast. 446b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryanystatic Function *checkInterfaceFunction(Constant *FuncOrBitcast) { 44755cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko if (isa<Function>(FuncOrBitcast)) return cast<Function>(FuncOrBitcast); 44855cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko FuncOrBitcast->dump(); 44955cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko report_fatal_error("trying to redefine an AddressSanitizer " 45055cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko "interface function"); 45155cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko} 45255cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko 453800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya SerebryanyInstruction *AddressSanitizer::generateCrashCode( 454ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Instruction *InsertBefore, Value *Addr, 4554f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany bool IsWrite, size_t AccessSizeIndex) { 456ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany IRBuilder<> IRB(InsertBefore); 457ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany CallInst *Call = IRB.CreateCall(AsanErrorCallback[IsWrite][AccessSizeIndex], 458ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Addr); 459f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // We don't do Call->setDoesNotReturn() because the BB already has 460f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // UnreachableInst at the end. 461f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // This EmptyAsm is required to avoid callback merge. 462f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany IRB.CreateCall(EmptyAsm); 4633c7faae346f548c55cad86d82a2e242443001f23Kostya Serebryany return Call; 464800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 465800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 4662735cf4aa52e31b8d2de90f836c3ad991215e04eKostya SerebryanyValue *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 467c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *ShadowValue, 468c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany uint32_t TypeSize) { 469b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t Granularity = 1 << MappingScale(); 470c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // Addr & (Granularity - 1) 471c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *LastAccessedByte = IRB.CreateAnd( 472c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); 473c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // (Addr & (Granularity - 1)) + size - 1 474c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany if (TypeSize / 8 > 1) 475c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte = IRB.CreateAdd( 476c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); 477c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // (uint8_t) ((Addr & (Granularity-1)) + size - 1) 478c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany LastAccessedByte = IRB.CreateIntCast( 4796e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany LastAccessedByte, ShadowValue->getType(), false); 480c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue 481c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); 482c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany} 483c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany 484ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanyvoid AddressSanitizer::instrumentAddress(Instruction *OrigIns, 485800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> &IRB, Value *Addr, 486800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t TypeSize, bool IsWrite) { 487800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 488800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 489800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowTy = IntegerType::get( 490b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany *C, std::max(8U, TypeSize >> MappingScale())); 491800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); 492800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowPtr = memToShadow(AddrLong, IRB); 493800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *CmpVal = Constant::getNullValue(ShadowTy); 494800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowValue = IRB.CreateLoad( 495800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); 496800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 497800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); 49811c2a47af825a0f89d75aaa97ad873ed2acef266Kostya Serebryany size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); 499b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t Granularity = 1 << MappingScale(); 500ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany TerminatorInst *CrashTerm = 0; 501ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany 5026e2d506dc962873a0e05092bbb034f9a615d1084Kostya Serebryany if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) { 5034a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov TerminatorInst *CheckTerm = 5044a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), false); 505ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany assert(dyn_cast<BranchInst>(CheckTerm)->isUnconditional()); 506f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany BasicBlock *NextBB = CheckTerm->getSuccessor(0); 507c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany IRB.SetInsertPoint(CheckTerm); 508c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); 509ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany BasicBlock *CrashBlock = 510ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany BasicBlock::Create(*C, "", NextBB->getParent(), NextBB); 511ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany CrashTerm = new UnreachableInst(*C, CrashBlock); 512f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); 513f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany ReplaceInstWithInst(CheckTerm, NewTerm); 514c0ed3e548c6f688e22685de04e210c7b59ac3433Kostya Serebryany } else { 5154a2dec05cef5882b745dd248d79e42a42cdbc87bEvgeniy Stepanov CrashTerm = SplitBlockAndInsertIfThen(cast<Instruction>(Cmp), true); 516800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 517ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany 518ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Instruction *Crash = 519ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany generateCrashCode(CrashTerm, AddrLong, IsWrite, AccessSizeIndex); 520ebd6454929f2ba3b92f61c151eccde0b8b0a8dedKostya Serebryany Crash->setDebugLoc(OrigIns->getDebugLoc()); 521800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 522800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 5231416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanyvoid AddressSanitizerModule::createInitializerPoisonCalls( 524b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Module &M, Value *FirstAddr, Value *LastAddr) { 5259b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // We do all of our poisoning and unpoisoning within _GLOBAL__I_a. 5269b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Function *GlobalInit = M.getFunction("_GLOBAL__I_a"); 5279b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // If that function is not present, this TU contains no globals, or they have 5289b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // all been optimized away 5299b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (!GlobalInit) 5309b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return; 5319b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 5329b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Set up the arguments to our poison/unpoison functions. 5339b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IRBuilder<> IRB(GlobalInit->begin()->getFirstInsertionPt()); 5349b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 5359b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Declare our poisoning and unpoisoning functions. 5369b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Function *AsanPoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction( 5379b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 5389b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany AsanPoisonGlobals->setLinkage(Function::ExternalLinkage); 5399b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Function *AsanUnpoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction( 5409b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany kAsanUnpoisonGlobalsName, IRB.getVoidTy(), NULL)); 5419b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany AsanUnpoisonGlobals->setLinkage(Function::ExternalLinkage); 5429b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 5439b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Add a call to poison all external globals before the given function starts. 5449b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IRB.CreateCall2(AsanPoisonGlobals, FirstAddr, LastAddr); 5459b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 5469b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Add calls to unpoison all globals before each return instruction. 5479b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany for (Function::iterator I = GlobalInit->begin(), E = GlobalInit->end(); 5489b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany I != E; ++I) { 5499b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (ReturnInst *RI = dyn_cast<ReturnInst>(I->getTerminator())) { 5509b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany CallInst::Create(AsanUnpoisonGlobals, "", RI); 5519b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 5529b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 5539b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany} 5549b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 5551416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanybool AddressSanitizerModule::ShouldInstrumentGlobal(GlobalVariable *G) { 5569b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Type *Ty = cast<PointerType>(G->getType())->getElementType(); 557324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "GLOBAL: " << *G << "\n"); 5589b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 55959a4a47a7bea7cc17877c6a3954ad9f8309ff1cbKostya Serebryany if (BL->isIn(*G)) return false; 5609b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (!Ty->isSized()) return false; 5619b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (!G->hasInitializer()) return false; 56251c7c65e32f76ec5a50cdecfe2b4c287c57da127Kostya Serebryany if (GlobalWasGeneratedByAsan(G)) return false; // Our own global. 5639b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Touch only those globals that will not be defined in other modules. 5649b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Don't handle ODR type linkages since other modules may be built w/o asan. 5659b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (G->getLinkage() != GlobalVariable::ExternalLinkage && 5669b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany G->getLinkage() != GlobalVariable::PrivateLinkage && 5679b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany G->getLinkage() != GlobalVariable::InternalLinkage) 5689b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 5699b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Two problems with thread-locals: 5709b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // - The address of the main thread's copy can't be computed at link-time. 5719b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // - Need to poison all copies, not just the main thread's one. 5729b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (G->isThreadLocal()) 5739b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 5749b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // For now, just ignore this Alloca if the alignment is large. 575b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany if (G->getAlignment() > RedzoneSize()) return false; 5769b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 5779b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Ignore all the globals with the names starting with "\01L_OBJC_". 5789b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Many of those are put into the .cstring section. The linker compresses 5799b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // that section by removing the spare \0s after the string terminator, so 5809b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // our redzones get broken. 5819b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if ((G->getName().find("\01L_OBJC_") == 0) || 5829b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany (G->getName().find("\01l_OBJC_") == 0)) { 5839b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany DEBUG(dbgs() << "Ignoring \\01L_OBJC_* global: " << *G); 5849b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 5859b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 5869b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 5879b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (G->hasSection()) { 5889b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany StringRef Section(G->getSection()); 5899b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Ignore the globals from the __OBJC section. The ObjC runtime assumes 5909b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to 5919b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // them. 5929b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if ((Section.find("__OBJC,") == 0) || 5939b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany (Section.find("__DATA, __objc_") == 0)) { 5949b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G); 5959b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 5969b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 5979b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // See http://code.google.com/p/address-sanitizer/issues/detail?id=32 5989b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Constant CFString instances are compiled in the following way: 5999b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // -- the string buffer is emitted into 6009b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // __TEXT,__cstring,cstring_literals 6019b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // -- the constant NSConstantString structure referencing that buffer 6029b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // is placed into __DATA,__cfstring 6039b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Therefore there's no point in placing redzones into __DATA,__cfstring. 6049b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Moreover, it causes the linker to crash on OS X 10.7 6059b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (Section.find("__DATA,__cfstring") == 0) { 6069b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany DEBUG(dbgs() << "Ignoring CFString: " << *G); 6079b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return false; 6089b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 6099b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 6109b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 6119b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany return true; 6129b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany} 6139b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 614800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This function replaces all global variables with new variables that have 615800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// trailing redzones. It also creates a function that poisons 616800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// redzones and inserts this function into llvm.global_ctors. 6171416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryanybool AddressSanitizerModule::runOnModule(Module &M) { 6181416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany if (!ClGlobals) return false; 6191416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany TD = getAnalysisIfAvailable<DataLayout>(); 6201416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany if (!TD) 6211416edc30adbd53b2be863f7f3de56de4a4c9d0aKostya Serebryany return false; 622b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany BL.reset(new BlackList(ClBlackListFile)); 623d6f62c8da5aa4f3388cec1542309ffa623cac601Alexey Samsonov if (BL->isIn(M)) return false; 624b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany DynamicallyInitializedGlobals.Init(M); 625b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany C = &(M.getContext()); 626b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany IntptrTy = Type::getIntNTy(*C, TD->getPointerSizeInBits()); 627b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 628800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<GlobalVariable *, 16> GlobalsToChange; 629800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 6309b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany for (Module::GlobalListType::iterator G = M.global_begin(), 6319b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany E = M.global_end(); G != E; ++G) { 6329b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (ShouldInstrumentGlobal(G)) 6339b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany GlobalsToChange.push_back(G); 634800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 635800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 636800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t n = GlobalsToChange.size(); 637800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (n == 0) return false; 638800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 639800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A global is described by a structure 640800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t beg; 641800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size; 642800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // size_t size_with_redzone; 643800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // const char *name; 6449b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // size_t has_dynamic_init; 645800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // We initialize an array of such structures and pass it to a run-time call. 646800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *GlobalStructTy = StructType::get(IntptrTy, IntptrTy, 6479b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IntptrTy, IntptrTy, 6489b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IntptrTy, NULL); 6499b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany SmallVector<Constant *, 16> Initializers(n), DynamicInit; 650800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 651b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 652b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Function *CtorFunc = M.getFunction(kAsanModuleCtorName); 653b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany assert(CtorFunc); 654b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany IRBuilder<> IRB(CtorFunc->getEntryBlock().getTerminator()); 655800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 6569b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // The addresses of the first and last dynamically initialized globals in 6579b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // this TU. Used in initialization order checking. 6589b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany Value *FirstDynamic = 0, *LastDynamic = 0; 6599b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 660800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0; i < n; i++) { 661800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *G = GlobalsToChange[i]; 662800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PointerType *PtrTy = cast<PointerType>(G->getType()); 663800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *Ty = PtrTy->getElementType(); 664208a4ff2b56f453910bb817540f34b8169f7702aKostya Serebryany uint64_t SizeInBytes = TD->getTypeAllocSize(Ty); 665b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t RZ = RedzoneSize(); 666b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany uint64_t RightRedzoneSize = RZ + (RZ - (SizeInBytes % RZ)); 667800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); 6689b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Determine whether this global should be poisoned in initialization. 669ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany bool GlobalHasDynamicInitializer = 670ca23d43084c45a7d6f4371d62f45be044650ce38Kostya Serebryany DynamicallyInitializedGlobals.Contains(G); 67159a4a47a7bea7cc17877c6a3954ad9f8309ff1cbKostya Serebryany // Don't check initialization order if this global is blacklisted. 6727dadac65d375ff21b7a36bfb7642578d2f467525Kostya Serebryany GlobalHasDynamicInitializer &= !BL->isInInit(*G); 673800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 674800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StructType *NewTy = StructType::get(Ty, RightRedZoneTy, NULL); 675800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant *NewInitializer = ConstantStruct::get( 676800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewTy, G->getInitializer(), 677800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Constant::getNullValue(RightRedZoneTy), NULL); 678800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 679a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany SmallString<2048> DescriptionOfGlobal = G->getName(); 680a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany DescriptionOfGlobal += " ("; 681a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany DescriptionOfGlobal += M.getModuleIdentifier(); 682a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany DescriptionOfGlobal += ")"; 683a4b2b1d8fbb84b0b6fac5abce21a2a5c5e907282Kostya Serebryany GlobalVariable *Name = createPrivateGlobalForString(M, DescriptionOfGlobal); 684800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 685800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Create a new global variable with enough space for a redzone. 686800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *NewGlobal = new GlobalVariable( 687800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M, NewTy, G->isConstant(), G->getLinkage(), 688ce718ff9f42c7da092eaa01dd0242e8d5ba84713Hans Wennborg NewInitializer, "", G, G->getThreadLocalMode()); 689800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->copyAttributesFrom(G); 690b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany NewGlobal->setAlignment(RZ); 691800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 692800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Indices2[2]; 693800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[0] = IRB.getInt32(0); 694800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Indices2[1] = IRB.getInt32(0); 695800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 696800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->replaceAllUsesWith( 697f1639abf1aaba1448f719f595156cd0f4cd560ccKostya Serebryany ConstantExpr::getGetElementPtr(NewGlobal, Indices2, true)); 698800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NewGlobal->takeName(G); 699800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany G->eraseFromParent(); 700800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 701800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Initializers[i] = ConstantStruct::get( 702800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalStructTy, 703800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(NewGlobal, IntptrTy), 704800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes), 705800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), 706800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantExpr::getPointerCast(Name, IntptrTy), 7079b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany ConstantInt::get(IntptrTy, GlobalHasDynamicInitializer), 708800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NULL); 7099b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 7109b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Populate the first and last globals declared in this TU. 711ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov if (CheckInitOrder && GlobalHasDynamicInitializer) { 7129b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany LastDynamic = ConstantExpr::getPointerCast(NewGlobal, IntptrTy); 7139b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany if (FirstDynamic == 0) 7149b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany FirstDynamic = LastDynamic; 7159b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany } 7169b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 717324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n"); 718800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 719800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 720800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ArrayType *ArrayOfGlobalStructTy = ArrayType::get(GlobalStructTy, n); 721800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany GlobalVariable *AllGlobals = new GlobalVariable( 722800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany M, ArrayOfGlobalStructTy, false, GlobalVariable::PrivateLinkage, 723800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantArray::get(ArrayOfGlobalStructTy, Initializers), ""); 724800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 7259b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany // Create calls for poisoning before initializers run and unpoisoning after. 726ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov if (CheckInitOrder && FirstDynamic && LastDynamic) 7279b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany createInitializerPoisonCalls(M, FirstDynamic, LastDynamic); 7289b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany 72955cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko Function *AsanRegisterGlobals = checkInterfaceFunction(M.getOrInsertFunction( 7309b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany kAsanRegisterGlobalsName, IRB.getVoidTy(), 7319b9f87a87ac1b373c4c6a70904315bebbd01c50cKostya Serebryany IntptrTy, IntptrTy, NULL)); 732800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AsanRegisterGlobals->setLinkage(Function::ExternalLinkage); 733800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 734800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateCall2(AsanRegisterGlobals, 735800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 736800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, n)); 737800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 7387bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // We also need to unregister globals at the end, e.g. when a shared library 7397bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany // gets closed. 7407bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany Function *AsanDtorFunction = Function::Create( 7417bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 7427bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany GlobalValue::InternalLinkage, kAsanModuleDtorName, &M); 7437bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); 7447bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRBuilder<> IRB_Dtor(ReturnInst::Create(*C, AsanDtorBB)); 74555cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko Function *AsanUnregisterGlobals = 74655cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko checkInterfaceFunction(M.getOrInsertFunction( 74755cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko kAsanUnregisterGlobalsName, 74855cabae685991ac6bc6d96b14e2139f64a0c9967Alexander Potapenko IRB.getVoidTy(), IntptrTy, IntptrTy, NULL)); 7497bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage); 7507bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany 7517bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB_Dtor.CreateCall2(AsanUnregisterGlobals, 7527bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany IRB.CreatePointerCast(AllGlobals, IntptrTy), 7537bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany ConstantInt::get(IntptrTy, n)); 7547bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndCtorPriority); 7557bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany 756800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << M); 757800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 758800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 759800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 7608b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryanyvoid AddressSanitizer::initializeCallbacks(Module &M) { 7618b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IRBuilder<> IRB(*C); 7629db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // Create __asan_report* callbacks. 7639db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { 7649db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; 7659db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany AccessSizeIndex++) { 7669db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany // IsWrite and TypeSize are encoded in the function name. 7679db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany std::string FunctionName = std::string(kAsanReportErrorTemplate) + 7689db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany (AccessIsWrite ? "store" : "load") + itostr(1 << AccessSizeIndex); 7694f0c69623c10a3a49f6926fd53694ee532e06a85Kostya Serebryany // If we are merging crash callbacks, they have two parameters. 7707846c1c851a53a8280f9d8ed57cd98d82c742551Kostya Serebryany AsanErrorCallback[AccessIsWrite][AccessSizeIndex] = 7717846c1c851a53a8280f9d8ed57cd98d82c742551Kostya Serebryany checkInterfaceFunction(M.getOrInsertFunction( 7727846c1c851a53a8280f9d8ed57cd98d82c742551Kostya Serebryany FunctionName, IRB.getVoidTy(), IntptrTy, NULL)); 7739db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany } 7749db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany } 775ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany 776ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany AsanStackMallocFunc = checkInterfaceFunction(M.getOrInsertFunction( 777ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany kAsanStackMallocName, IntptrTy, IntptrTy, IntptrTy, NULL)); 778ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany AsanStackFreeFunc = checkInterfaceFunction(M.getOrInsertFunction( 779ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany kAsanStackFreeName, IRB.getVoidTy(), 780ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany IntptrTy, IntptrTy, IntptrTy, NULL)); 781ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany AsanHandleNoReturnFunc = checkInterfaceFunction(M.getOrInsertFunction( 782ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany kAsanHandleNoReturnName, IRB.getVoidTy(), NULL)); 783ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany 784f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany // We insert an empty inline asm after __asan_report* to avoid callback merge. 785f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 786f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany StringRef(""), StringRef(""), 787f7b08226eb44458f6f38cbeaca527028803c725aKostya Serebryany /*hasSideEffects=*/true); 7888b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany} 7898b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 7908b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany// virtual 7918b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryanybool AddressSanitizer::doInitialization(Module &M) { 7928b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany // Initialize the private fields. No one has accessed them before. 7938b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany TD = getAnalysisIfAvailable<DataLayout>(); 7948b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 7958b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany if (!TD) 7968b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany return false; 7978b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany BL.reset(new BlackList(ClBlackListFile)); 7988b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany DynamicallyInitializedGlobals.Init(M); 7998b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 8008b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany C = &(M.getContext()); 8018b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany LongSize = TD->getPointerSizeInBits(); 8028b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IntptrTy = Type::getIntNTy(*C, LongSize); 8038b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IntptrPtrTy = PointerType::get(IntptrTy, 0); 8048b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany 8058b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany AsanCtorFunction = Function::Create( 8068b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany FunctionType::get(Type::getVoidTy(*C), false), 8078b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany GlobalValue::InternalLinkage, kAsanModuleCtorName, &M); 8088b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany BasicBlock *AsanCtorBB = BasicBlock::Create(*C, "", AsanCtorFunction); 8098b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany // call __asan_init in the module ctor. 8108b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IRBuilder<> IRB(ReturnInst::Create(*C, AsanCtorBB)); 8118b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany AsanInitFunction = checkInterfaceFunction( 8128b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany M.getOrInsertFunction(kAsanInitName, IRB.getVoidTy(), NULL)); 8138b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany AsanInitFunction->setLinkage(Function::ExternalLinkage); 8148b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany IRB.CreateCall(AsanInitFunction); 8159db5b5ffa9fccd5c7f1f39a3e9aa66cc4a5eedc1Kostya Serebryany 81606fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov llvm::Triple targetTriple(M.getTargetTriple()); 81743bf70986bb13c812e87ca959dd8f2dd9edf802cLogan Chien bool isAndroid = targetTriple.getEnvironment() == llvm::Triple::Android; 81806fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov 81906fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov MappingOffset = isAndroid ? kDefaultShadowOffsetAndroid : 82006fdbaa9145f01a291d4981ca5120b7bdcad44c6Evgeniy Stepanov (LongSize == 32 ? kDefaultShadowOffset32 : kDefaultShadowOffset64); 821800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClMappingOffsetLog >= 0) { 822800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClMappingOffsetLog == 0) { 823800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // special case 824800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset = 0; 825800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 826800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany MappingOffset = 1ULL << ClMappingOffsetLog; 827800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 828800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 829800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 830800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 8318c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany if (ClMappingOffsetLog >= 0) { 8328c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany // Tell the run-time the current values of mapping offset and scale. 8338c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany GlobalValue *asan_mapping_offset = 8348c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 8358c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany ConstantInt::get(IntptrTy, MappingOffset), 8368c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany kAsanMappingOffsetName); 8378c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany // Read the global, otherwise it may be optimized away. 8388c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany IRB.CreateLoad(asan_mapping_offset, true); 8398c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany } 8408c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany if (ClMappingScale) { 8418c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany GlobalValue *asan_mapping_scale = 8428c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany new GlobalVariable(M, IntptrTy, true, GlobalValue::LinkOnceODRLinkage, 843b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany ConstantInt::get(IntptrTy, MappingScale()), 8448c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany kAsanMappingScaleName); 8458c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany // Read the global, otherwise it may be optimized away. 8468c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany IRB.CreateLoad(asan_mapping_scale, true); 8478c0134a77615b66f57250f0662bc899e4574551eKostya Serebryany } 848800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 8497bcfc9950bac0f411f9671e8d6ce483bd219727eKostya Serebryany appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndCtorPriority); 8509b02741d2284d9516a59666c211fe1f57e8803adKostya Serebryany 851ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany return true; 852ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany} 853ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany 854a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryanybool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { 855a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // For each NSObject descendant having a +load method, this method is invoked 856a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // by the ObjC runtime before any of the static constructors is called. 857a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // Therefore we need to instrument such methods with a call to __asan_init 858a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // at the beginning in order to initialize our runtime before any access to 859a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // the shadow memory. 860a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // We cannot just ignore these methods, because they may call other 861a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // instrumented functions. 862a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany if (F.getName().find(" load]") != std::string::npos) { 863a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany IRBuilder<> IRB(F.begin()->begin()); 864a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany IRB.CreateCall(AsanInitFunction); 865a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany return true; 866a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany } 867a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany return false; 868a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany} 869a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 8705085eb80abe29320fa8922c10b36249f5163f45dKostya Serebryany// Check both the call and the callee for doesNotReturn(). 8715085eb80abe29320fa8922c10b36249f5163f45dKostya Serebryanystatic bool isNoReturnCall(CallInst *CI) { 8725085eb80abe29320fa8922c10b36249f5163f45dKostya Serebryany if (CI->doesNotReturn()) return true; 8735085eb80abe29320fa8922c10b36249f5163f45dKostya Serebryany Function *F = CI->getCalledFunction(); 874d6f62c8da5aa4f3388cec1542309ffa623cac601Alexey Samsonov return (F && F->doesNotReturn()); 8755085eb80abe29320fa8922c10b36249f5163f45dKostya Serebryany} 8765085eb80abe29320fa8922c10b36249f5163f45dKostya Serebryany 877ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanybool AddressSanitizer::runOnFunction(Function &F) { 878800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (BL->isIn(F)) return false; 879800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (&F == AsanCtorFunction) return false; 880324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n"); 8818b390ffbfdd52a23a45a21de99aa1c31f3ce623fKostya Serebryany initializeCallbacks(*F.getParent()); 882a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 883a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany // If needed, insert __asan_init before checking for AddressSafety attr. 884a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany maybeInsertAsanInitAtFunctionEntry(F); 885a1a8a323f43a95620fc4c6b5aad8d5ff5e5eb590Kostya Serebryany 8866765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling if (!F.getFnAttributes().hasAttribute(Attributes::AddressSafety)) 8876765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling return false; 888800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 889800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!ClDebugFunc.empty() && ClDebugFunc != F.getName()) 890800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return false; 8916765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling 8926765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling // We want to instrument every address only once per basic block (unless there 8936765834754cbb3cb0f15b4b15e98c5e73fa50066Bill Wendling // are calls between uses). 894800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallSet<Value*, 16> TempsToInstrument; 895800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Instruction*, 16> ToInstrument; 89695e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany SmallVector<Instruction*, 8> NoReturnCalls; 897e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany bool IsWrite; 898800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 899800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Fill the set of memory operations to instrument. 900800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Function::iterator FI = F.begin(), FE = F.end(); 901800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FI != FE; ++FI) { 902800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 903324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany int NumInsnsPerBB = 0; 904800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (BasicBlock::iterator BI = FI->begin(), BE = FI->end(); 905800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BI != BE; ++BI) { 906bcb55ce3862bbbedac4e09d7099c9e0efc434e4bKostya Serebryany if (LooksLikeCodeInBug11395(BI)) return false; 907e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (Value *Addr = isInterestingMemoryAccess(BI, &IsWrite)) { 908800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClOpt && ClOptSameTemp) { 909800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!TempsToInstrument.insert(Addr)) 910800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; // We've seen this temp in the current BB. 911800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 912800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (isa<MemIntrinsic>(BI) && ClMemIntrin) { 913800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // ok, take it. 914800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 91595e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany if (CallInst *CI = dyn_cast<CallInst>(BI)) { 916800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // A call inside BB. 917800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TempsToInstrument.clear(); 9185085eb80abe29320fa8922c10b36249f5163f45dKostya Serebryany if (isNoReturnCall(CI)) { 91995e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany NoReturnCalls.push_back(CI); 92095e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany } 921800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 922800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 923800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 924800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ToInstrument.push_back(BI); 925324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany NumInsnsPerBB++; 926324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) 927324cbb89f2759fb9ad347bd2af4631e50c39c8f3Kostya Serebryany break; 928800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 929800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 930800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 931800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Instrument. 932800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany int NumInstrumented = 0; 933800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = ToInstrument.size(); i != n; i++) { 934800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Inst = ToInstrument[i]; 935800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClDebugMin < 0 || ClDebugMax < 0 || 936800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) { 937e6cf2e0bd09544eeb69665deb908d264e62a71c2Kostya Serebryany if (isInterestingMemoryAccess(Inst, &IsWrite)) 938ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMop(Inst); 939800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany else 940ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany instrumentMemIntrinsic(cast<MemIntrinsic>(Inst)); 941800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 942800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany NumInstrumented++; 943800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 944800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 945ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany bool ChangedStack = poisonStackInFunction(F); 94695e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany 94795e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany // We must unpoison the stack before every NoReturn call (throw, _exit, etc). 94895e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany // See e.g. http://code.google.com/p/address-sanitizer/issues/detail?id=37 94995e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany for (size_t i = 0, n = NoReturnCalls.size(); i != n; i++) { 95095e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany Instruction *CI = NoReturnCalls[i]; 95195e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany IRBuilder<> IRB(CI); 952ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryany IRB.CreateCall(AsanHandleNoReturnFunc); 95395e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany } 954324d96b9e265b0fd8bf63a28340910def64e2164Kostya Serebryany DEBUG(dbgs() << "ASAN done instrumenting:\n" << F << "\n"); 95595e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany 95695e3cf44a9d4672655dee3bd558bfeefa631dd55Kostya Serebryany return NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty(); 957800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 958800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 959800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic uint64_t ValueForPoison(uint64_t PoisonByte, size_t ShadowRedzoneSize) { 960800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 1) return PoisonByte; 961800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 2) return (PoisonByte << 8) + PoisonByte; 962800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ShadowRedzoneSize == 4) 963800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return (PoisonByte << 24) + (PoisonByte << 16) + 964800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany (PoisonByte << 8) + (PoisonByte); 965858143816d43e58b17bfd11cb1b57afbd7f0f893Craig Topper llvm_unreachable("ShadowRedzoneSize is either 1, 2 or 4"); 966800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 967800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 968800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanystatic void PoisonShadowPartialRightRedzone(uint8_t *Shadow, 969800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t Size, 970b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t RZSize, 971800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany size_t ShadowGranularity, 972800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint8_t Magic) { 973b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany for (size_t i = 0; i < RZSize; 974800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany i+= ShadowGranularity, Shadow++) { 975800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (i + ShadowGranularity <= Size) { 976800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = 0; // fully addressable 977800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else if (i >= Size) { 978800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Magic; // unaddressable 979800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } else { 980800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany *Shadow = Size - i; // first Size-i bytes are addressable 981800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 982800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 983800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 984800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 985800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryanyvoid AddressSanitizer::PoisonStack(const ArrayRef<AllocaInst*> &AllocaVec, 986800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB, 987800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowBase, bool DoPoison) { 988b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t ShadowRZSize = RedzoneSize() >> MappingScale(); 989800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowRZSize >= 1 && ShadowRZSize <= 4); 990800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZTy = Type::getIntNTy(*C, ShadowRZSize * 8); 991800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *RZPtrTy = PointerType::get(RZTy, 0); 992800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 993800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonLeft = ConstantInt::get(RZTy, 994800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackLeftRedzoneMagic : 0LL, ShadowRZSize)); 995800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonMid = ConstantInt::get(RZTy, 996800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackMidRedzoneMagic : 0LL, ShadowRZSize)); 997800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PoisonRight = ConstantInt::get(RZTy, 998800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ValueForPoison(DoPoison ? kAsanStackRightRedzoneMagic : 0LL, ShadowRZSize)); 999800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1000800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison the first red zone. 1001800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PoisonLeft, IRB.CreateIntToPtr(ShadowBase, RZPtrTy)); 1002800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1003800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // poison all other red zones. 1004b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany uint64_t Pos = RedzoneSize(); 1005800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 1006800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 1007800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 1008800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 1009b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany assert(AlignedSize - SizeInBytes < RedzoneSize()); 1010800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Ptr = NULL; 1011800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1012800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Pos += AlignedSize; 1013800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1014800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(ShadowBase->getType() == IntptrTy); 1015800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (SizeInBytes < AlignedSize) { 1016800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the partial redzone at right 1017800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd( 1018800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ShadowBase, ConstantInt::get(IntptrTy, 1019b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany (Pos >> MappingScale()) - ShadowRZSize)); 1020b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany size_t AddressableBytes = RedzoneSize() - (AlignedSize - SizeInBytes); 1021800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint32_t Poison = 0; 1022800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoPoison) { 1023800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonShadowPartialRightRedzone((uint8_t*)&Poison, AddressableBytes, 1024b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany RedzoneSize(), 1025b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany 1ULL << MappingScale(), 1026800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany kAsanStackPartialRedzoneMagic); 1027800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1028800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *PartialPoison = ConstantInt::get(RZTy, Poison); 1029800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(PartialPoison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 1030800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1031800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1032800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the full redzone at right. 1033800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Ptr = IRB.CreateAdd(ShadowBase, 1034b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany ConstantInt::get(IntptrTy, Pos >> MappingScale())); 1035800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *Poison = i == AllocaVec.size() - 1 ? PoisonRight : PoisonMid; 1036800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Poison, IRB.CreateIntToPtr(Ptr, RZPtrTy)); 1037800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1038b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Pos += RedzoneSize(); 1039800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1040800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1041800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 10425a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany// Workaround for bug 11395: we don't want to instrument stack in functions 10435a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany// with large assembly blobs (32-bit only), otherwise reg alloc may crash. 1044d2703dec271d82c8c9d22afb835c07730fd25d47Kostya Serebryany// FIXME: remove once the bug 11395 is fixed. 10455a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryanybool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { 10465a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (LongSize != 32) return false; 10475a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany CallInst *CI = dyn_cast<CallInst>(I); 10485a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (!CI || !CI->isInlineAsm()) return false; 10495a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany if (CI->getNumArgOperands() <= 5) return false; 10505a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany // We have inline assembly with quite a few arguments. 10515a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany return true; 10525a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany} 10535a3a9c937198084498a196dae856ac5a5a005bccKostya Serebryany 1054800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Find all static Alloca instructions and put 1055800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// poisoned red zones around all of them. 1056800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Then unpoison everything back before the function returns. 1057800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// 1058800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// Stack poisoning does not play well with exception handling. 1059800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// When an exception is thrown, we essentially bypass the code 1060800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// that unpoisones the stack. This is why the run-time library has 1061800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire 1062800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// stack in the interceptor. This however does not work inside the 1063800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// actual function which catches the exception. Most likely because the 1064800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// compiler hoists the load of the shadow value somewhere too high. 1065800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// This causes asan to report a non-existing bug on 453.povray. 1066800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany// It sounds like an LLVM bug. 1067ee4edeccabe1854ee895f52d4ac5588bd5f40c80Kostya Serebryanybool AddressSanitizer::poisonStackInFunction(Function &F) { 1068800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!ClStack) return false; 1069800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<AllocaInst*, 16> AllocaVec; 1070800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallVector<Instruction*, 8> RetVec; 1071800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t TotalSize = 0; 1072800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1073800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Filter out Alloca instructions we want (and can) handle. 1074800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Collect Ret instructions. 1075800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (Function::iterator FI = F.begin(), FE = F.end(); 1076800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany FI != FE; ++FI) { 1077800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasicBlock &BB = *FI; 1078800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (BasicBlock::iterator BI = BB.begin(), BE = BB.end(); 1079800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BI != BE; ++BI) { 1080800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (isa<ReturnInst>(BI)) { 1081800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany RetVec.push_back(BI); 1082800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany continue; 1083800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1084800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1085800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = dyn_cast<AllocaInst>(BI); 1086800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!AI) continue; 1087800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (AI->isArrayAllocation()) continue; 1088800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!AI->isStaticAlloca()) continue; 1089800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (!AI->getAllocatedType()->isSized()) continue; 1090b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany if (AI->getAlignment() > RedzoneSize()) continue; 1091800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaVec.push_back(AI); 1092800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 1093800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany TotalSize += AlignedSize; 1094800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1095800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1096800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1097800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (AllocaVec.empty()) return false; 1098800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1099b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany uint64_t LocalStackSize = TotalSize + (AllocaVec.size() + 1) * RedzoneSize(); 1100800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1101ee548275c63a1eeffda9d3edd2bea04e1dadcc67Alexey Samsonov bool DoStackMalloc = CheckUseAfterReturn 1102800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany && LocalStackSize <= kMaxStackMallocSize; 1103800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1104800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *InsBefore = AllocaVec[0]; 1105800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRB(InsBefore); 1106800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1107800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1108800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Type *ByteArrayTy = ArrayType::get(IRB.getInt8Ty(), LocalStackSize); 1109800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *MyAlloca = 1110800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany new AllocaInst(ByteArrayTy, "MyAlloca", InsBefore); 1111b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany MyAlloca->setAlignment(RedzoneSize()); 1112800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(MyAlloca->isStaticAlloca()); 1113800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *OrigStackBase = IRB.CreatePointerCast(MyAlloca, IntptrTy); 1114800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *LocalStackBase = OrigStackBase; 1115800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1116800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 1117800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany LocalStackBase = IRB.CreateCall2(AsanStackMallocFunc, 1118800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), OrigStackBase); 1119800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1120800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1121800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // This string will be parsed by the run-time (DescribeStackAddress). 1122800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany SmallString<2048> StackDescriptionStorage; 1123800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany raw_svector_ostream StackDescription(StackDescriptionStorage); 1124800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StackDescription << F.getName() << " " << AllocaVec.size() << " "; 1125800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1126b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany uint64_t Pos = RedzoneSize(); 1127800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Replace Alloca instructions with base+offset. 1128800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) { 1129800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AllocaInst *AI = AllocaVec[i]; 1130800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t SizeInBytes = getAllocaSizeInBytes(AI); 1131800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StringRef Name = AI->getName(); 1132800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany StackDescription << Pos << " " << SizeInBytes << " " 1133800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany << Name.size() << " " << Name << " "; 1134800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany uint64_t AlignedSize = getAlignedAllocaSize(AI); 1135b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany assert((AlignedSize % RedzoneSize()) == 0); 1136800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AI->replaceAllUsesWith( 1137800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateIntToPtr( 1138800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Pos)), 1139800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany AI->getType())); 1140b9a12ea0fd92bfdb4c6eb5af333648a618f68686Kostya Serebryany Pos += AlignedSize + RedzoneSize(); 1141800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1142800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany assert(Pos == LocalStackSize); 1143800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1144800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Write the Magic value and the frame description constant to the redzone. 1145800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); 1146800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), 1147800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 1148800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *BasePlus1 = IRB.CreateAdd(LocalStackBase, 1149800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LongSize/8)); 1150800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus1 = IRB.CreateIntToPtr(BasePlus1, IntptrPtrTy); 11519ce84c1c95c0153a2f33e188ce0db00770425f9eAlexey Samsonov GlobalVariable *StackDescriptionGlobal = 1152a5f54f14435d881b10d8eb65e19fa42af95757e9Kostya Serebryany createPrivateGlobalForString(*F.getParent(), StackDescription.str()); 1153a5f54f14435d881b10d8eb65e19fa42af95757e9Kostya Serebryany Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy); 1154800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRB.CreateStore(Description, BasePlus1); 1155800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1156800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Poison the stack redzones at the entry. 1157800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Value *ShadowBase = memToShadow(LocalStackBase, IRB); 1158800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonStack(ArrayRef<AllocaInst*>(AllocaVec), IRB, ShadowBase, true); 1159800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1160800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack before all ret instructions. 1161800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany for (size_t i = 0, n = RetVec.size(); i < n; i++) { 1162800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany Instruction *Ret = RetVec[i]; 1163800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBuilder<> IRBRet(Ret); 1164800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1165800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Mark the current frame as retired. 1166800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), 1167800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany BasePlus0); 1168800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany // Unpoison the stack. 1169800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany PoisonStack(ArrayRef<AllocaInst*>(AllocaVec), IRBRet, ShadowBase, false); 1170800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1171800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (DoStackMalloc) { 1172800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany IRBRet.CreateCall3(AsanStackFreeFunc, LocalStackBase, 1173800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany ConstantInt::get(IntptrTy, LocalStackSize), 1174800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany OrigStackBase); 1175800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1176800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1177800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1178bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany // We are done. Remove the old unused alloca instructions. 1179bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany for (size_t i = 0, n = AllocaVec.size(); i < n; i++) 1180bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany AllocaVec[i]->eraseFromParent(); 1181bd0052a0f26f04b8fcf59e8f645e5e33751e1f6eKostya Serebryany 1182800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany if (ClDebugStack) { 1183800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany DEBUG(dbgs() << F); 1184800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany } 1185800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany 1186800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany return true; 1187800e03f59896ef4b26d988f1878370bb5aeec0d8Kostya Serebryany} 1188