1 //===-- AddressSanitizer.cpp - memory error detector ------------*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // This file is a part of AddressSanitizer, an address sanity checker. 11 // Details of the algorithm: 12 // http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm 13 // 14 //===----------------------------------------------------------------------===// 15 16 #include "llvm/Transforms/Instrumentation.h" 17 #include "llvm/ADT/ArrayRef.h" 18 #include "llvm/ADT/DenseMap.h" 19 #include "llvm/ADT/DenseSet.h" 20 #include "llvm/ADT/DepthFirstIterator.h" 21 #include "llvm/ADT/SetVector.h" 22 #include "llvm/ADT/SmallSet.h" 23 #include "llvm/ADT/SmallString.h" 24 #include "llvm/ADT/SmallVector.h" 25 #include "llvm/ADT/Statistic.h" 26 #include "llvm/ADT/StringExtras.h" 27 #include "llvm/ADT/Triple.h" 28 #include "llvm/Analysis/MemoryBuiltins.h" 29 #include "llvm/Analysis/TargetLibraryInfo.h" 30 #include "llvm/Analysis/ValueTracking.h" 31 #include "llvm/IR/CallSite.h" 32 #include "llvm/IR/DIBuilder.h" 33 #include "llvm/IR/DataLayout.h" 34 #include "llvm/IR/Dominators.h" 35 #include "llvm/IR/Function.h" 36 #include "llvm/IR/IRBuilder.h" 37 #include "llvm/IR/InlineAsm.h" 38 #include "llvm/IR/InstVisitor.h" 39 #include "llvm/IR/IntrinsicInst.h" 40 #include "llvm/IR/LLVMContext.h" 41 #include "llvm/IR/MDBuilder.h" 42 #include "llvm/IR/Module.h" 43 #include "llvm/IR/Type.h" 44 #include "llvm/MC/MCSectionMachO.h" 45 #include "llvm/Support/CommandLine.h" 46 #include "llvm/Support/DataTypes.h" 47 #include "llvm/Support/Debug.h" 48 #include "llvm/Support/Endian.h" 49 #include "llvm/Support/SwapByteOrder.h" 50 #include "llvm/Support/raw_ostream.h" 51 #include "llvm/Transforms/Scalar.h" 52 #include "llvm/Transforms/Utils/ASanStackFrameLayout.h" 53 #include "llvm/Transforms/Utils/BasicBlockUtils.h" 54 #include "llvm/Transforms/Utils/Cloning.h" 55 #include "llvm/Transforms/Utils/Local.h" 56 #include "llvm/Transforms/Utils/ModuleUtils.h" 57 #include "llvm/Transforms/Utils/PromoteMemToReg.h" 58 #include <algorithm> 59 #include <string> 60 #include <system_error> 61 62 using namespace llvm; 63 64 #define DEBUG_TYPE "asan" 65 66 static const uint64_t kDefaultShadowScale = 3; 67 static const uint64_t kDefaultShadowOffset32 = 1ULL << 29; 68 static const uint64_t kIOSShadowOffset32 = 1ULL << 30; 69 static const uint64_t kDefaultShadowOffset64 = 1ULL << 44; 70 static const uint64_t kSmallX86_64ShadowOffset = 0x7FFF8000; // < 2G. 71 static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000; 72 static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 41; 73 static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000; 74 static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37; 75 static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36; 76 static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30; 77 static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46; 78 static const uint64_t kWindowsShadowOffset32 = 3ULL << 28; 79 80 static const size_t kMinStackMallocSize = 1 << 6; // 64B 81 static const size_t kMaxStackMallocSize = 1 << 16; // 64K 82 static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3; 83 static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E; 84 85 static const char *const kAsanModuleCtorName = "asan.module_ctor"; 86 static const char *const kAsanModuleDtorName = "asan.module_dtor"; 87 static const uint64_t kAsanCtorAndDtorPriority = 1; 88 static const char *const kAsanReportErrorTemplate = "__asan_report_"; 89 static const char *const kAsanRegisterGlobalsName = "__asan_register_globals"; 90 static const char *const kAsanUnregisterGlobalsName = 91 "__asan_unregister_globals"; 92 static const char *const kAsanPoisonGlobalsName = "__asan_before_dynamic_init"; 93 static const char *const kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"; 94 static const char *const kAsanInitName = "__asan_init"; 95 static const char *const kAsanVersionCheckName = 96 "__asan_version_mismatch_check_v6"; 97 static const char *const kAsanPtrCmp = "__sanitizer_ptr_cmp"; 98 static const char *const kAsanPtrSub = "__sanitizer_ptr_sub"; 99 static const char *const kAsanHandleNoReturnName = "__asan_handle_no_return"; 100 static const int kMaxAsanStackMallocSizeClass = 10; 101 static const char *const kAsanStackMallocNameTemplate = "__asan_stack_malloc_"; 102 static const char *const kAsanStackFreeNameTemplate = "__asan_stack_free_"; 103 static const char *const kAsanGenPrefix = "__asan_gen_"; 104 static const char *const kSanCovGenPrefix = "__sancov_gen_"; 105 static const char *const kAsanPoisonStackMemoryName = 106 "__asan_poison_stack_memory"; 107 static const char *const kAsanUnpoisonStackMemoryName = 108 "__asan_unpoison_stack_memory"; 109 110 static const char *const kAsanOptionDetectUAR = 111 "__asan_option_detect_stack_use_after_return"; 112 113 static const char *const kAsanAllocaPoison = "__asan_alloca_poison"; 114 static const char *const kAsanAllocasUnpoison = "__asan_allocas_unpoison"; 115 116 // Accesses sizes are powers of two: 1, 2, 4, 8, 16. 117 static const size_t kNumberOfAccessSizes = 5; 118 119 static const unsigned kAllocaRzSize = 32; 120 121 // Command-line flags. 122 static cl::opt<bool> ClEnableKasan( 123 "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"), 124 cl::Hidden, cl::init(false)); 125 static cl::opt<bool> ClRecover( 126 "asan-recover", 127 cl::desc("Enable recovery mode (continue-after-error)."), 128 cl::Hidden, cl::init(false)); 129 130 // This flag may need to be replaced with -f[no-]asan-reads. 131 static cl::opt<bool> ClInstrumentReads("asan-instrument-reads", 132 cl::desc("instrument read instructions"), 133 cl::Hidden, cl::init(true)); 134 static cl::opt<bool> ClInstrumentWrites( 135 "asan-instrument-writes", cl::desc("instrument write instructions"), 136 cl::Hidden, cl::init(true)); 137 static cl::opt<bool> ClInstrumentAtomics( 138 "asan-instrument-atomics", 139 cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, 140 cl::init(true)); 141 static cl::opt<bool> ClAlwaysSlowPath( 142 "asan-always-slow-path", 143 cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, 144 cl::init(false)); 145 // This flag limits the number of instructions to be instrumented 146 // in any given BB. Normally, this should be set to unlimited (INT_MAX), 147 // but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary 148 // set it to 10000. 149 static cl::opt<int> ClMaxInsnsToInstrumentPerBB( 150 "asan-max-ins-per-bb", cl::init(10000), 151 cl::desc("maximal number of instructions to instrument in any given BB"), 152 cl::Hidden); 153 // This flag may need to be replaced with -f[no]asan-stack. 154 static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"), 155 cl::Hidden, cl::init(true)); 156 static cl::opt<bool> ClUseAfterReturn("asan-use-after-return", 157 cl::desc("Check return-after-free"), 158 cl::Hidden, cl::init(true)); 159 // This flag may need to be replaced with -f[no]asan-globals. 160 static cl::opt<bool> ClGlobals("asan-globals", 161 cl::desc("Handle global objects"), cl::Hidden, 162 cl::init(true)); 163 static cl::opt<bool> ClInitializers("asan-initialization-order", 164 cl::desc("Handle C++ initializer order"), 165 cl::Hidden, cl::init(true)); 166 static cl::opt<bool> ClInvalidPointerPairs( 167 "asan-detect-invalid-pointer-pair", 168 cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, 169 cl::init(false)); 170 static cl::opt<unsigned> ClRealignStack( 171 "asan-realign-stack", 172 cl::desc("Realign stack to the value of this flag (power of two)"), 173 cl::Hidden, cl::init(32)); 174 static cl::opt<int> ClInstrumentationWithCallsThreshold( 175 "asan-instrumentation-with-call-threshold", 176 cl::desc( 177 "If the function being instrumented contains more than " 178 "this number of memory accesses, use callbacks instead of " 179 "inline checks (-1 means never use callbacks)."), 180 cl::Hidden, cl::init(7000)); 181 static cl::opt<std::string> ClMemoryAccessCallbackPrefix( 182 "asan-memory-access-callback-prefix", 183 cl::desc("Prefix for memory access callbacks"), cl::Hidden, 184 cl::init("__asan_")); 185 static cl::opt<bool> ClInstrumentAllocas("asan-instrument-allocas", 186 cl::desc("instrument dynamic allocas"), 187 cl::Hidden, cl::init(true)); 188 static cl::opt<bool> ClSkipPromotableAllocas( 189 "asan-skip-promotable-allocas", 190 cl::desc("Do not instrument promotable allocas"), cl::Hidden, 191 cl::init(true)); 192 193 // These flags allow to change the shadow mapping. 194 // The shadow mapping looks like 195 // Shadow = (Mem >> scale) + (1 << offset_log) 196 static cl::opt<int> ClMappingScale("asan-mapping-scale", 197 cl::desc("scale of asan shadow mapping"), 198 cl::Hidden, cl::init(0)); 199 200 // Optimization flags. Not user visible, used mostly for testing 201 // and benchmarking the tool. 202 static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"), 203 cl::Hidden, cl::init(true)); 204 static cl::opt<bool> ClOptSameTemp( 205 "asan-opt-same-temp", cl::desc("Instrument the same temp just once"), 206 cl::Hidden, cl::init(true)); 207 static cl::opt<bool> ClOptGlobals("asan-opt-globals", 208 cl::desc("Don't instrument scalar globals"), 209 cl::Hidden, cl::init(true)); 210 static cl::opt<bool> ClOptStack( 211 "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), 212 cl::Hidden, cl::init(false)); 213 214 static cl::opt<bool> ClCheckLifetime( 215 "asan-check-lifetime", 216 cl::desc("Use llvm.lifetime intrinsics to insert extra checks"), cl::Hidden, 217 cl::init(false)); 218 219 static cl::opt<bool> ClDynamicAllocaStack( 220 "asan-stack-dynamic-alloca", 221 cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, 222 cl::init(true)); 223 224 static cl::opt<uint32_t> ClForceExperiment( 225 "asan-force-experiment", 226 cl::desc("Force optimization experiment (for testing)"), cl::Hidden, 227 cl::init(0)); 228 229 // Debug flags. 230 static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, 231 cl::init(0)); 232 static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), 233 cl::Hidden, cl::init(0)); 234 static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden, 235 cl::desc("Debug func")); 236 static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), 237 cl::Hidden, cl::init(-1)); 238 static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), 239 cl::Hidden, cl::init(-1)); 240 241 STATISTIC(NumInstrumentedReads, "Number of instrumented reads"); 242 STATISTIC(NumInstrumentedWrites, "Number of instrumented writes"); 243 STATISTIC(NumOptimizedAccessesToGlobalVar, 244 "Number of optimized accesses to global vars"); 245 STATISTIC(NumOptimizedAccessesToStackVar, 246 "Number of optimized accesses to stack vars"); 247 248 namespace { 249 /// Frontend-provided metadata for source location. 250 struct LocationMetadata { 251 StringRef Filename; 252 int LineNo; 253 int ColumnNo; 254 255 LocationMetadata() : Filename(), LineNo(0), ColumnNo(0) {} 256 257 bool empty() const { return Filename.empty(); } 258 259 void parse(MDNode *MDN) { 260 assert(MDN->getNumOperands() == 3); 261 MDString *DIFilename = cast<MDString>(MDN->getOperand(0)); 262 Filename = DIFilename->getString(); 263 LineNo = 264 mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue(); 265 ColumnNo = 266 mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue(); 267 } 268 }; 269 270 /// Frontend-provided metadata for global variables. 271 class GlobalsMetadata { 272 public: 273 struct Entry { 274 Entry() : SourceLoc(), Name(), IsDynInit(false), IsBlacklisted(false) {} 275 LocationMetadata SourceLoc; 276 StringRef Name; 277 bool IsDynInit; 278 bool IsBlacklisted; 279 }; 280 281 GlobalsMetadata() : inited_(false) {} 282 283 void reset() { 284 inited_ = false; 285 Entries.clear(); 286 } 287 288 void init(Module &M) { 289 assert(!inited_); 290 inited_ = true; 291 NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals"); 292 if (!Globals) return; 293 for (auto MDN : Globals->operands()) { 294 // Metadata node contains the global and the fields of "Entry". 295 assert(MDN->getNumOperands() == 5); 296 auto *GV = mdconst::extract_or_null<GlobalVariable>(MDN->getOperand(0)); 297 // The optimizer may optimize away a global entirely. 298 if (!GV) continue; 299 // We can already have an entry for GV if it was merged with another 300 // global. 301 Entry &E = Entries[GV]; 302 if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1))) 303 E.SourceLoc.parse(Loc); 304 if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2))) 305 E.Name = Name->getString(); 306 ConstantInt *IsDynInit = 307 mdconst::extract<ConstantInt>(MDN->getOperand(3)); 308 E.IsDynInit |= IsDynInit->isOne(); 309 ConstantInt *IsBlacklisted = 310 mdconst::extract<ConstantInt>(MDN->getOperand(4)); 311 E.IsBlacklisted |= IsBlacklisted->isOne(); 312 } 313 } 314 315 /// Returns metadata entry for a given global. 316 Entry get(GlobalVariable *G) const { 317 auto Pos = Entries.find(G); 318 return (Pos != Entries.end()) ? Pos->second : Entry(); 319 } 320 321 private: 322 bool inited_; 323 DenseMap<GlobalVariable *, Entry> Entries; 324 }; 325 326 /// This struct defines the shadow mapping using the rule: 327 /// shadow = (mem >> Scale) ADD-or-OR Offset. 328 struct ShadowMapping { 329 int Scale; 330 uint64_t Offset; 331 bool OrShadowOffset; 332 }; 333 334 static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize, 335 bool IsKasan) { 336 bool IsAndroid = TargetTriple.isAndroid(); 337 bool IsIOS = TargetTriple.isiOS(); 338 bool IsFreeBSD = TargetTriple.isOSFreeBSD(); 339 bool IsLinux = TargetTriple.isOSLinux(); 340 bool IsPPC64 = TargetTriple.getArch() == llvm::Triple::ppc64 || 341 TargetTriple.getArch() == llvm::Triple::ppc64le; 342 bool IsX86_64 = TargetTriple.getArch() == llvm::Triple::x86_64; 343 bool IsMIPS32 = TargetTriple.getArch() == llvm::Triple::mips || 344 TargetTriple.getArch() == llvm::Triple::mipsel; 345 bool IsMIPS64 = TargetTriple.getArch() == llvm::Triple::mips64 || 346 TargetTriple.getArch() == llvm::Triple::mips64el; 347 bool IsAArch64 = TargetTriple.getArch() == llvm::Triple::aarch64; 348 bool IsWindows = TargetTriple.isOSWindows(); 349 350 ShadowMapping Mapping; 351 352 if (LongSize == 32) { 353 // Android is always PIE, which means that the beginning of the address 354 // space is always available. 355 if (IsAndroid) 356 Mapping.Offset = 0; 357 else if (IsMIPS32) 358 Mapping.Offset = kMIPS32_ShadowOffset32; 359 else if (IsFreeBSD) 360 Mapping.Offset = kFreeBSD_ShadowOffset32; 361 else if (IsIOS) 362 Mapping.Offset = kIOSShadowOffset32; 363 else if (IsWindows) 364 Mapping.Offset = kWindowsShadowOffset32; 365 else 366 Mapping.Offset = kDefaultShadowOffset32; 367 } else { // LongSize == 64 368 if (IsPPC64) 369 Mapping.Offset = kPPC64_ShadowOffset64; 370 else if (IsFreeBSD) 371 Mapping.Offset = kFreeBSD_ShadowOffset64; 372 else if (IsLinux && IsX86_64) { 373 if (IsKasan) 374 Mapping.Offset = kLinuxKasan_ShadowOffset64; 375 else 376 Mapping.Offset = kSmallX86_64ShadowOffset; 377 } else if (IsMIPS64) 378 Mapping.Offset = kMIPS64_ShadowOffset64; 379 else if (IsAArch64) 380 Mapping.Offset = kAArch64_ShadowOffset64; 381 else 382 Mapping.Offset = kDefaultShadowOffset64; 383 } 384 385 Mapping.Scale = kDefaultShadowScale; 386 if (ClMappingScale) { 387 Mapping.Scale = ClMappingScale; 388 } 389 390 // OR-ing shadow offset if more efficient (at least on x86) if the offset 391 // is a power of two, but on ppc64 we have to use add since the shadow 392 // offset is not necessary 1/8-th of the address space. 393 Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 394 && !(Mapping.Offset & (Mapping.Offset - 1)); 395 396 return Mapping; 397 } 398 399 static size_t RedzoneSizeForScale(int MappingScale) { 400 // Redzone used for stack and globals is at least 32 bytes. 401 // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively. 402 return std::max(32U, 1U << MappingScale); 403 } 404 405 /// AddressSanitizer: instrument the code in module to find memory bugs. 406 struct AddressSanitizer : public FunctionPass { 407 explicit AddressSanitizer(bool CompileKernel = false, bool Recover = false) 408 : FunctionPass(ID), CompileKernel(CompileKernel || ClEnableKasan), 409 Recover(Recover || ClRecover) { 410 initializeAddressSanitizerPass(*PassRegistry::getPassRegistry()); 411 } 412 const char *getPassName() const override { 413 return "AddressSanitizerFunctionPass"; 414 } 415 void getAnalysisUsage(AnalysisUsage &AU) const override { 416 AU.addRequired<DominatorTreeWrapperPass>(); 417 AU.addRequired<TargetLibraryInfoWrapperPass>(); 418 } 419 uint64_t getAllocaSizeInBytes(AllocaInst *AI) const { 420 Type *Ty = AI->getAllocatedType(); 421 uint64_t SizeInBytes = 422 AI->getModule()->getDataLayout().getTypeAllocSize(Ty); 423 return SizeInBytes; 424 } 425 /// Check if we want (and can) handle this alloca. 426 bool isInterestingAlloca(AllocaInst &AI); 427 428 // Check if we have dynamic alloca. 429 bool isDynamicAlloca(AllocaInst &AI) const { 430 return AI.isArrayAllocation() || !AI.isStaticAlloca(); 431 } 432 433 /// If it is an interesting memory access, return the PointerOperand 434 /// and set IsWrite/Alignment. Otherwise return nullptr. 435 Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite, 436 uint64_t *TypeSize, unsigned *Alignment); 437 void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, Instruction *I, 438 bool UseCalls, const DataLayout &DL); 439 void instrumentPointerComparisonOrSubtraction(Instruction *I); 440 void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore, 441 Value *Addr, uint32_t TypeSize, bool IsWrite, 442 Value *SizeArgument, bool UseCalls, uint32_t Exp); 443 void instrumentUnusualSizeOrAlignment(Instruction *I, Value *Addr, 444 uint32_t TypeSize, bool IsWrite, 445 Value *SizeArgument, bool UseCalls, 446 uint32_t Exp); 447 Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 448 Value *ShadowValue, uint32_t TypeSize); 449 Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr, 450 bool IsWrite, size_t AccessSizeIndex, 451 Value *SizeArgument, uint32_t Exp); 452 void instrumentMemIntrinsic(MemIntrinsic *MI); 453 Value *memToShadow(Value *Shadow, IRBuilder<> &IRB); 454 bool runOnFunction(Function &F) override; 455 bool maybeInsertAsanInitAtFunctionEntry(Function &F); 456 void markEscapedLocalAllocas(Function &F); 457 bool doInitialization(Module &M) override; 458 bool doFinalization(Module &M) override; 459 static char ID; // Pass identification, replacement for typeid 460 461 DominatorTree &getDominatorTree() const { return *DT; } 462 463 private: 464 void initializeCallbacks(Module &M); 465 466 bool LooksLikeCodeInBug11395(Instruction *I); 467 bool GlobalIsLinkerInitialized(GlobalVariable *G); 468 bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr, 469 uint64_t TypeSize) const; 470 471 /// Helper to cleanup per-function state. 472 struct FunctionStateRAII { 473 AddressSanitizer *Pass; 474 FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) { 475 assert(Pass->ProcessedAllocas.empty() && 476 "last pass forgot to clear cache"); 477 } 478 ~FunctionStateRAII() { Pass->ProcessedAllocas.clear(); } 479 }; 480 481 LLVMContext *C; 482 Triple TargetTriple; 483 int LongSize; 484 bool CompileKernel; 485 bool Recover; 486 Type *IntptrTy; 487 ShadowMapping Mapping; 488 DominatorTree *DT; 489 Function *AsanCtorFunction = nullptr; 490 Function *AsanInitFunction = nullptr; 491 Function *AsanHandleNoReturnFunc; 492 Function *AsanPtrCmpFunction, *AsanPtrSubFunction; 493 // This array is indexed by AccessIsWrite, Experiment and log2(AccessSize). 494 Function *AsanErrorCallback[2][2][kNumberOfAccessSizes]; 495 Function *AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes]; 496 // This array is indexed by AccessIsWrite and Experiment. 497 Function *AsanErrorCallbackSized[2][2]; 498 Function *AsanMemoryAccessCallbackSized[2][2]; 499 Function *AsanMemmove, *AsanMemcpy, *AsanMemset; 500 InlineAsm *EmptyAsm; 501 GlobalsMetadata GlobalsMD; 502 DenseMap<AllocaInst *, bool> ProcessedAllocas; 503 504 friend struct FunctionStackPoisoner; 505 }; 506 507 class AddressSanitizerModule : public ModulePass { 508 public: 509 explicit AddressSanitizerModule(bool CompileKernel = false, 510 bool Recover = false) 511 : ModulePass(ID), CompileKernel(CompileKernel || ClEnableKasan), 512 Recover(Recover || ClRecover) {} 513 bool runOnModule(Module &M) override; 514 static char ID; // Pass identification, replacement for typeid 515 const char *getPassName() const override { return "AddressSanitizerModule"; } 516 517 private: 518 void initializeCallbacks(Module &M); 519 520 bool InstrumentGlobals(IRBuilder<> &IRB, Module &M); 521 bool ShouldInstrumentGlobal(GlobalVariable *G); 522 void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName); 523 void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName); 524 size_t MinRedzoneSizeForGlobal() const { 525 return RedzoneSizeForScale(Mapping.Scale); 526 } 527 528 GlobalsMetadata GlobalsMD; 529 bool CompileKernel; 530 bool Recover; 531 Type *IntptrTy; 532 LLVMContext *C; 533 Triple TargetTriple; 534 ShadowMapping Mapping; 535 Function *AsanPoisonGlobals; 536 Function *AsanUnpoisonGlobals; 537 Function *AsanRegisterGlobals; 538 Function *AsanUnregisterGlobals; 539 }; 540 541 // Stack poisoning does not play well with exception handling. 542 // When an exception is thrown, we essentially bypass the code 543 // that unpoisones the stack. This is why the run-time library has 544 // to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire 545 // stack in the interceptor. This however does not work inside the 546 // actual function which catches the exception. Most likely because the 547 // compiler hoists the load of the shadow value somewhere too high. 548 // This causes asan to report a non-existing bug on 453.povray. 549 // It sounds like an LLVM bug. 550 struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> { 551 Function &F; 552 AddressSanitizer &ASan; 553 DIBuilder DIB; 554 LLVMContext *C; 555 Type *IntptrTy; 556 Type *IntptrPtrTy; 557 ShadowMapping Mapping; 558 559 SmallVector<AllocaInst *, 16> AllocaVec; 560 SmallSetVector<AllocaInst *, 16> NonInstrumentedStaticAllocaVec; 561 SmallVector<Instruction *, 8> RetVec; 562 unsigned StackAlignment; 563 564 Function *AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1], 565 *AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1]; 566 Function *AsanPoisonStackMemoryFunc, *AsanUnpoisonStackMemoryFunc; 567 Function *AsanAllocaPoisonFunc, *AsanAllocasUnpoisonFunc; 568 569 // Stores a place and arguments of poisoning/unpoisoning call for alloca. 570 struct AllocaPoisonCall { 571 IntrinsicInst *InsBefore; 572 AllocaInst *AI; 573 uint64_t Size; 574 bool DoPoison; 575 }; 576 SmallVector<AllocaPoisonCall, 8> AllocaPoisonCallVec; 577 578 SmallVector<AllocaInst *, 1> DynamicAllocaVec; 579 SmallVector<IntrinsicInst *, 1> StackRestoreVec; 580 AllocaInst *DynamicAllocaLayout = nullptr; 581 IntrinsicInst *LocalEscapeCall = nullptr; 582 583 // Maps Value to an AllocaInst from which the Value is originated. 584 typedef DenseMap<Value *, AllocaInst *> AllocaForValueMapTy; 585 AllocaForValueMapTy AllocaForValue; 586 587 bool HasNonEmptyInlineAsm = false; 588 bool HasReturnsTwiceCall = false; 589 std::unique_ptr<CallInst> EmptyInlineAsm; 590 591 FunctionStackPoisoner(Function &F, AddressSanitizer &ASan) 592 : F(F), 593 ASan(ASan), 594 DIB(*F.getParent(), /*AllowUnresolved*/ false), 595 C(ASan.C), 596 IntptrTy(ASan.IntptrTy), 597 IntptrPtrTy(PointerType::get(IntptrTy, 0)), 598 Mapping(ASan.Mapping), 599 StackAlignment(1 << Mapping.Scale), 600 EmptyInlineAsm(CallInst::Create(ASan.EmptyAsm)) {} 601 602 bool runOnFunction() { 603 if (!ClStack) return false; 604 // Collect alloca, ret, lifetime instructions etc. 605 for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB); 606 607 if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false; 608 609 initializeCallbacks(*F.getParent()); 610 611 poisonStack(); 612 613 if (ClDebugStack) { 614 DEBUG(dbgs() << F); 615 } 616 return true; 617 } 618 619 // Finds all Alloca instructions and puts 620 // poisoned red zones around all of them. 621 // Then unpoison everything back before the function returns. 622 void poisonStack(); 623 624 void createDynamicAllocasInitStorage(); 625 626 // ----------------------- Visitors. 627 /// \brief Collect all Ret instructions. 628 void visitReturnInst(ReturnInst &RI) { RetVec.push_back(&RI); } 629 630 void unpoisonDynamicAllocasBeforeInst(Instruction *InstBefore, 631 Value *SavedStack) { 632 IRBuilder<> IRB(InstBefore); 633 Value *DynamicAreaPtr = IRB.CreatePtrToInt(SavedStack, IntptrTy); 634 // When we insert _asan_allocas_unpoison before @llvm.stackrestore, we 635 // need to adjust extracted SP to compute the address of the most recent 636 // alloca. We have a special @llvm.get.dynamic.area.offset intrinsic for 637 // this purpose. 638 if (!isa<ReturnInst>(InstBefore)) { 639 Function *DynamicAreaOffsetFunc = Intrinsic::getDeclaration( 640 InstBefore->getModule(), Intrinsic::get_dynamic_area_offset, 641 {IntptrTy}); 642 643 Value *DynamicAreaOffset = IRB.CreateCall(DynamicAreaOffsetFunc, {}); 644 645 DynamicAreaPtr = IRB.CreateAdd(IRB.CreatePtrToInt(SavedStack, IntptrTy), 646 DynamicAreaOffset); 647 } 648 649 IRB.CreateCall(AsanAllocasUnpoisonFunc, 650 {IRB.CreateLoad(DynamicAllocaLayout), DynamicAreaPtr}); 651 } 652 653 // Unpoison dynamic allocas redzones. 654 void unpoisonDynamicAllocas() { 655 for (auto &Ret : RetVec) 656 unpoisonDynamicAllocasBeforeInst(Ret, DynamicAllocaLayout); 657 658 for (auto &StackRestoreInst : StackRestoreVec) 659 unpoisonDynamicAllocasBeforeInst(StackRestoreInst, 660 StackRestoreInst->getOperand(0)); 661 } 662 663 // Deploy and poison redzones around dynamic alloca call. To do this, we 664 // should replace this call with another one with changed parameters and 665 // replace all its uses with new address, so 666 // addr = alloca type, old_size, align 667 // is replaced by 668 // new_size = (old_size + additional_size) * sizeof(type) 669 // tmp = alloca i8, new_size, max(align, 32) 670 // addr = tmp + 32 (first 32 bytes are for the left redzone). 671 // Additional_size is added to make new memory allocation contain not only 672 // requested memory, but also left, partial and right redzones. 673 void handleDynamicAllocaCall(AllocaInst *AI); 674 675 /// \brief Collect Alloca instructions we want (and can) handle. 676 void visitAllocaInst(AllocaInst &AI) { 677 if (!ASan.isInterestingAlloca(AI)) { 678 if (AI.isStaticAlloca()) NonInstrumentedStaticAllocaVec.insert(&AI); 679 return; 680 } 681 682 StackAlignment = std::max(StackAlignment, AI.getAlignment()); 683 if (ASan.isDynamicAlloca(AI)) 684 DynamicAllocaVec.push_back(&AI); 685 else 686 AllocaVec.push_back(&AI); 687 } 688 689 /// \brief Collect lifetime intrinsic calls to check for use-after-scope 690 /// errors. 691 void visitIntrinsicInst(IntrinsicInst &II) { 692 Intrinsic::ID ID = II.getIntrinsicID(); 693 if (ID == Intrinsic::stackrestore) StackRestoreVec.push_back(&II); 694 if (ID == Intrinsic::localescape) LocalEscapeCall = &II; 695 if (!ClCheckLifetime) return; 696 if (ID != Intrinsic::lifetime_start && ID != Intrinsic::lifetime_end) 697 return; 698 // Found lifetime intrinsic, add ASan instrumentation if necessary. 699 ConstantInt *Size = dyn_cast<ConstantInt>(II.getArgOperand(0)); 700 // If size argument is undefined, don't do anything. 701 if (Size->isMinusOne()) return; 702 // Check that size doesn't saturate uint64_t and can 703 // be stored in IntptrTy. 704 const uint64_t SizeValue = Size->getValue().getLimitedValue(); 705 if (SizeValue == ~0ULL || 706 !ConstantInt::isValueValidForType(IntptrTy, SizeValue)) 707 return; 708 // Find alloca instruction that corresponds to llvm.lifetime argument. 709 AllocaInst *AI = findAllocaForValue(II.getArgOperand(1)); 710 if (!AI) return; 711 bool DoPoison = (ID == Intrinsic::lifetime_end); 712 AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison}; 713 AllocaPoisonCallVec.push_back(APC); 714 } 715 716 void visitCallSite(CallSite CS) { 717 Instruction *I = CS.getInstruction(); 718 if (CallInst *CI = dyn_cast<CallInst>(I)) { 719 HasNonEmptyInlineAsm |= 720 CI->isInlineAsm() && !CI->isIdenticalTo(EmptyInlineAsm.get()); 721 HasReturnsTwiceCall |= CI->canReturnTwice(); 722 } 723 } 724 725 // ---------------------- Helpers. 726 void initializeCallbacks(Module &M); 727 728 bool doesDominateAllExits(const Instruction *I) const { 729 for (auto Ret : RetVec) { 730 if (!ASan.getDominatorTree().dominates(I, Ret)) return false; 731 } 732 return true; 733 } 734 735 /// Finds alloca where the value comes from. 736 AllocaInst *findAllocaForValue(Value *V); 737 void poisonRedZones(ArrayRef<uint8_t> ShadowBytes, IRBuilder<> &IRB, 738 Value *ShadowBase, bool DoPoison); 739 void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison); 740 741 void SetShadowToStackAfterReturnInlined(IRBuilder<> &IRB, Value *ShadowBase, 742 int Size); 743 Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L, 744 bool Dynamic); 745 PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue, 746 Instruction *ThenTerm, Value *ValueIfFalse); 747 }; 748 749 } // anonymous namespace 750 751 char AddressSanitizer::ID = 0; 752 INITIALIZE_PASS_BEGIN( 753 AddressSanitizer, "asan", 754 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, 755 false) 756 INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass) 757 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass) 758 INITIALIZE_PASS_END( 759 AddressSanitizer, "asan", 760 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, 761 false) 762 FunctionPass *llvm::createAddressSanitizerFunctionPass(bool CompileKernel, 763 bool Recover) { 764 assert(!CompileKernel || Recover); 765 return new AddressSanitizer(CompileKernel, Recover); 766 } 767 768 char AddressSanitizerModule::ID = 0; 769 INITIALIZE_PASS( 770 AddressSanitizerModule, "asan-module", 771 "AddressSanitizer: detects use-after-free and out-of-bounds bugs." 772 "ModulePass", 773 false, false) 774 ModulePass *llvm::createAddressSanitizerModulePass(bool CompileKernel, 775 bool Recover) { 776 assert(!CompileKernel || Recover); 777 return new AddressSanitizerModule(CompileKernel, Recover); 778 } 779 780 static size_t TypeSizeToSizeIndex(uint32_t TypeSize) { 781 size_t Res = countTrailingZeros(TypeSize / 8); 782 assert(Res < kNumberOfAccessSizes); 783 return Res; 784 } 785 786 // \brief Create a constant for Str so that we can pass it to the run-time lib. 787 static GlobalVariable *createPrivateGlobalForString(Module &M, StringRef Str, 788 bool AllowMerging) { 789 Constant *StrConst = ConstantDataArray::getString(M.getContext(), Str); 790 // We use private linkage for module-local strings. If they can be merged 791 // with another one, we set the unnamed_addr attribute. 792 GlobalVariable *GV = 793 new GlobalVariable(M, StrConst->getType(), true, 794 GlobalValue::PrivateLinkage, StrConst, kAsanGenPrefix); 795 if (AllowMerging) GV->setUnnamedAddr(true); 796 GV->setAlignment(1); // Strings may not be merged w/o setting align 1. 797 return GV; 798 } 799 800 /// \brief Create a global describing a source location. 801 static GlobalVariable *createPrivateGlobalForSourceLoc(Module &M, 802 LocationMetadata MD) { 803 Constant *LocData[] = { 804 createPrivateGlobalForString(M, MD.Filename, true), 805 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo), 806 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo), 807 }; 808 auto LocStruct = ConstantStruct::getAnon(LocData); 809 auto GV = new GlobalVariable(M, LocStruct->getType(), true, 810 GlobalValue::PrivateLinkage, LocStruct, 811 kAsanGenPrefix); 812 GV->setUnnamedAddr(true); 813 return GV; 814 } 815 816 static bool GlobalWasGeneratedByAsan(GlobalVariable *G) { 817 return G->getName().find(kAsanGenPrefix) == 0 || 818 G->getName().find(kSanCovGenPrefix) == 0; 819 } 820 821 Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) { 822 // Shadow >> scale 823 Shadow = IRB.CreateLShr(Shadow, Mapping.Scale); 824 if (Mapping.Offset == 0) return Shadow; 825 // (Shadow >> scale) | offset 826 if (Mapping.OrShadowOffset) 827 return IRB.CreateOr(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset)); 828 else 829 return IRB.CreateAdd(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset)); 830 } 831 832 // Instrument memset/memmove/memcpy 833 void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) { 834 IRBuilder<> IRB(MI); 835 if (isa<MemTransferInst>(MI)) { 836 IRB.CreateCall( 837 isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy, 838 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), 839 IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()), 840 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); 841 } else if (isa<MemSetInst>(MI)) { 842 IRB.CreateCall( 843 AsanMemset, 844 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()), 845 IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false), 846 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)}); 847 } 848 MI->eraseFromParent(); 849 } 850 851 /// Check if we want (and can) handle this alloca. 852 bool AddressSanitizer::isInterestingAlloca(AllocaInst &AI) { 853 auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI); 854 855 if (PreviouslySeenAllocaInfo != ProcessedAllocas.end()) 856 return PreviouslySeenAllocaInfo->getSecond(); 857 858 bool IsInteresting = 859 (AI.getAllocatedType()->isSized() && 860 // alloca() may be called with 0 size, ignore it. 861 getAllocaSizeInBytes(&AI) > 0 && 862 // We are only interested in allocas not promotable to registers. 863 // Promotable allocas are common under -O0. 864 (!ClSkipPromotableAllocas || !isAllocaPromotable(&AI)) && 865 // inalloca allocas are not treated as static, and we don't want 866 // dynamic alloca instrumentation for them as well. 867 !AI.isUsedWithInAlloca()); 868 869 ProcessedAllocas[&AI] = IsInteresting; 870 return IsInteresting; 871 } 872 873 /// If I is an interesting memory access, return the PointerOperand 874 /// and set IsWrite/Alignment. Otherwise return nullptr. 875 Value *AddressSanitizer::isInterestingMemoryAccess(Instruction *I, 876 bool *IsWrite, 877 uint64_t *TypeSize, 878 unsigned *Alignment) { 879 // Skip memory accesses inserted by another instrumentation. 880 if (I->getMetadata("nosanitize")) return nullptr; 881 882 Value *PtrOperand = nullptr; 883 const DataLayout &DL = I->getModule()->getDataLayout(); 884 if (LoadInst *LI = dyn_cast<LoadInst>(I)) { 885 if (!ClInstrumentReads) return nullptr; 886 *IsWrite = false; 887 *TypeSize = DL.getTypeStoreSizeInBits(LI->getType()); 888 *Alignment = LI->getAlignment(); 889 PtrOperand = LI->getPointerOperand(); 890 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) { 891 if (!ClInstrumentWrites) return nullptr; 892 *IsWrite = true; 893 *TypeSize = DL.getTypeStoreSizeInBits(SI->getValueOperand()->getType()); 894 *Alignment = SI->getAlignment(); 895 PtrOperand = SI->getPointerOperand(); 896 } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) { 897 if (!ClInstrumentAtomics) return nullptr; 898 *IsWrite = true; 899 *TypeSize = DL.getTypeStoreSizeInBits(RMW->getValOperand()->getType()); 900 *Alignment = 0; 901 PtrOperand = RMW->getPointerOperand(); 902 } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) { 903 if (!ClInstrumentAtomics) return nullptr; 904 *IsWrite = true; 905 *TypeSize = DL.getTypeStoreSizeInBits(XCHG->getCompareOperand()->getType()); 906 *Alignment = 0; 907 PtrOperand = XCHG->getPointerOperand(); 908 } 909 910 // Treat memory accesses to promotable allocas as non-interesting since they 911 // will not cause memory violations. This greatly speeds up the instrumented 912 // executable at -O0. 913 if (ClSkipPromotableAllocas) 914 if (auto AI = dyn_cast_or_null<AllocaInst>(PtrOperand)) 915 return isInterestingAlloca(*AI) ? AI : nullptr; 916 917 return PtrOperand; 918 } 919 920 static bool isPointerOperand(Value *V) { 921 return V->getType()->isPointerTy() || isa<PtrToIntInst>(V); 922 } 923 924 // This is a rough heuristic; it may cause both false positives and 925 // false negatives. The proper implementation requires cooperation with 926 // the frontend. 927 static bool isInterestingPointerComparisonOrSubtraction(Instruction *I) { 928 if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) { 929 if (!Cmp->isRelational()) return false; 930 } else if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) { 931 if (BO->getOpcode() != Instruction::Sub) return false; 932 } else { 933 return false; 934 } 935 return isPointerOperand(I->getOperand(0)) && 936 isPointerOperand(I->getOperand(1)); 937 } 938 939 bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) { 940 // If a global variable does not have dynamic initialization we don't 941 // have to instrument it. However, if a global does not have initializer 942 // at all, we assume it has dynamic initializer (in other TU). 943 return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit; 944 } 945 946 void AddressSanitizer::instrumentPointerComparisonOrSubtraction( 947 Instruction *I) { 948 IRBuilder<> IRB(I); 949 Function *F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction; 950 Value *Param[2] = {I->getOperand(0), I->getOperand(1)}; 951 for (int i = 0; i < 2; i++) { 952 if (Param[i]->getType()->isPointerTy()) 953 Param[i] = IRB.CreatePointerCast(Param[i], IntptrTy); 954 } 955 IRB.CreateCall(F, Param); 956 } 957 958 void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, 959 Instruction *I, bool UseCalls, 960 const DataLayout &DL) { 961 bool IsWrite = false; 962 unsigned Alignment = 0; 963 uint64_t TypeSize = 0; 964 Value *Addr = isInterestingMemoryAccess(I, &IsWrite, &TypeSize, &Alignment); 965 assert(Addr); 966 967 // Optimization experiments. 968 // The experiments can be used to evaluate potential optimizations that remove 969 // instrumentation (assess false negatives). Instead of completely removing 970 // some instrumentation, you set Exp to a non-zero value (mask of optimization 971 // experiments that want to remove instrumentation of this instruction). 972 // If Exp is non-zero, this pass will emit special calls into runtime 973 // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls 974 // make runtime terminate the program in a special way (with a different 975 // exit status). Then you run the new compiler on a buggy corpus, collect 976 // the special terminations (ideally, you don't see them at all -- no false 977 // negatives) and make the decision on the optimization. 978 uint32_t Exp = ClForceExperiment; 979 980 if (ClOpt && ClOptGlobals) { 981 // If initialization order checking is disabled, a simple access to a 982 // dynamically initialized global is always valid. 983 GlobalVariable *G = dyn_cast<GlobalVariable>(GetUnderlyingObject(Addr, DL)); 984 if (G && (!ClInitializers || GlobalIsLinkerInitialized(G)) && 985 isSafeAccess(ObjSizeVis, Addr, TypeSize)) { 986 NumOptimizedAccessesToGlobalVar++; 987 return; 988 } 989 } 990 991 if (ClOpt && ClOptStack) { 992 // A direct inbounds access to a stack variable is always valid. 993 if (isa<AllocaInst>(GetUnderlyingObject(Addr, DL)) && 994 isSafeAccess(ObjSizeVis, Addr, TypeSize)) { 995 NumOptimizedAccessesToStackVar++; 996 return; 997 } 998 } 999 1000 if (IsWrite) 1001 NumInstrumentedWrites++; 1002 else 1003 NumInstrumentedReads++; 1004 1005 unsigned Granularity = 1 << Mapping.Scale; 1006 // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check 1007 // if the data is properly aligned. 1008 if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 || 1009 TypeSize == 128) && 1010 (Alignment >= Granularity || Alignment == 0 || Alignment >= TypeSize / 8)) 1011 return instrumentAddress(I, I, Addr, TypeSize, IsWrite, nullptr, UseCalls, 1012 Exp); 1013 instrumentUnusualSizeOrAlignment(I, Addr, TypeSize, IsWrite, nullptr, 1014 UseCalls, Exp); 1015 } 1016 1017 Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore, 1018 Value *Addr, bool IsWrite, 1019 size_t AccessSizeIndex, 1020 Value *SizeArgument, 1021 uint32_t Exp) { 1022 IRBuilder<> IRB(InsertBefore); 1023 Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp); 1024 CallInst *Call = nullptr; 1025 if (SizeArgument) { 1026 if (Exp == 0) 1027 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0], 1028 {Addr, SizeArgument}); 1029 else 1030 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1], 1031 {Addr, SizeArgument, ExpVal}); 1032 } else { 1033 if (Exp == 0) 1034 Call = 1035 IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr); 1036 else 1037 Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex], 1038 {Addr, ExpVal}); 1039 } 1040 1041 // We don't do Call->setDoesNotReturn() because the BB already has 1042 // UnreachableInst at the end. 1043 // This EmptyAsm is required to avoid callback merge. 1044 IRB.CreateCall(EmptyAsm, {}); 1045 return Call; 1046 } 1047 1048 Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong, 1049 Value *ShadowValue, 1050 uint32_t TypeSize) { 1051 size_t Granularity = 1 << Mapping.Scale; 1052 // Addr & (Granularity - 1) 1053 Value *LastAccessedByte = 1054 IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1)); 1055 // (Addr & (Granularity - 1)) + size - 1 1056 if (TypeSize / 8 > 1) 1057 LastAccessedByte = IRB.CreateAdd( 1058 LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)); 1059 // (uint8_t) ((Addr & (Granularity-1)) + size - 1) 1060 LastAccessedByte = 1061 IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false); 1062 // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue 1063 return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue); 1064 } 1065 1066 void AddressSanitizer::instrumentAddress(Instruction *OrigIns, 1067 Instruction *InsertBefore, Value *Addr, 1068 uint32_t TypeSize, bool IsWrite, 1069 Value *SizeArgument, bool UseCalls, 1070 uint32_t Exp) { 1071 IRBuilder<> IRB(InsertBefore); 1072 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 1073 size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize); 1074 1075 if (UseCalls) { 1076 if (Exp == 0) 1077 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex], 1078 AddrLong); 1079 else 1080 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex], 1081 {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)}); 1082 return; 1083 } 1084 1085 Type *ShadowTy = 1086 IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale)); 1087 Type *ShadowPtrTy = PointerType::get(ShadowTy, 0); 1088 Value *ShadowPtr = memToShadow(AddrLong, IRB); 1089 Value *CmpVal = Constant::getNullValue(ShadowTy); 1090 Value *ShadowValue = 1091 IRB.CreateLoad(IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy)); 1092 1093 Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal); 1094 size_t Granularity = 1 << Mapping.Scale; 1095 TerminatorInst *CrashTerm = nullptr; 1096 1097 if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) { 1098 // We use branch weights for the slow path check, to indicate that the slow 1099 // path is rarely taken. This seems to be the case for SPEC benchmarks. 1100 TerminatorInst *CheckTerm = SplitBlockAndInsertIfThen( 1101 Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000)); 1102 assert(cast<BranchInst>(CheckTerm)->isUnconditional()); 1103 BasicBlock *NextBB = CheckTerm->getSuccessor(0); 1104 IRB.SetInsertPoint(CheckTerm); 1105 Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize); 1106 if (Recover) { 1107 CrashTerm = SplitBlockAndInsertIfThen(Cmp2, CheckTerm, false); 1108 } else { 1109 BasicBlock *CrashBlock = 1110 BasicBlock::Create(*C, "", NextBB->getParent(), NextBB); 1111 CrashTerm = new UnreachableInst(*C, CrashBlock); 1112 BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2); 1113 ReplaceInstWithInst(CheckTerm, NewTerm); 1114 } 1115 } else { 1116 CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover); 1117 } 1118 1119 Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite, 1120 AccessSizeIndex, SizeArgument, Exp); 1121 Crash->setDebugLoc(OrigIns->getDebugLoc()); 1122 } 1123 1124 // Instrument unusual size or unusual alignment. 1125 // We can not do it with a single check, so we do 1-byte check for the first 1126 // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able 1127 // to report the actual access size. 1128 void AddressSanitizer::instrumentUnusualSizeOrAlignment( 1129 Instruction *I, Value *Addr, uint32_t TypeSize, bool IsWrite, 1130 Value *SizeArgument, bool UseCalls, uint32_t Exp) { 1131 IRBuilder<> IRB(I); 1132 Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8); 1133 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy); 1134 if (UseCalls) { 1135 if (Exp == 0) 1136 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0], 1137 {AddrLong, Size}); 1138 else 1139 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1], 1140 {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)}); 1141 } else { 1142 Value *LastByte = IRB.CreateIntToPtr( 1143 IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)), 1144 Addr->getType()); 1145 instrumentAddress(I, I, Addr, 8, IsWrite, Size, false, Exp); 1146 instrumentAddress(I, I, LastByte, 8, IsWrite, Size, false, Exp); 1147 } 1148 } 1149 1150 void AddressSanitizerModule::poisonOneInitializer(Function &GlobalInit, 1151 GlobalValue *ModuleName) { 1152 // Set up the arguments to our poison/unpoison functions. 1153 IRBuilder<> IRB(&GlobalInit.front(), 1154 GlobalInit.front().getFirstInsertionPt()); 1155 1156 // Add a call to poison all external globals before the given function starts. 1157 Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy); 1158 IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr); 1159 1160 // Add calls to unpoison all globals before each return instruction. 1161 for (auto &BB : GlobalInit.getBasicBlockList()) 1162 if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator())) 1163 CallInst::Create(AsanUnpoisonGlobals, "", RI); 1164 } 1165 1166 void AddressSanitizerModule::createInitializerPoisonCalls( 1167 Module &M, GlobalValue *ModuleName) { 1168 GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors"); 1169 1170 ConstantArray *CA = cast<ConstantArray>(GV->getInitializer()); 1171 for (Use &OP : CA->operands()) { 1172 if (isa<ConstantAggregateZero>(OP)) continue; 1173 ConstantStruct *CS = cast<ConstantStruct>(OP); 1174 1175 // Must have a function or null ptr. 1176 if (Function *F = dyn_cast<Function>(CS->getOperand(1))) { 1177 if (F->getName() == kAsanModuleCtorName) continue; 1178 ConstantInt *Priority = dyn_cast<ConstantInt>(CS->getOperand(0)); 1179 // Don't instrument CTORs that will run before asan.module_ctor. 1180 if (Priority->getLimitedValue() <= kAsanCtorAndDtorPriority) continue; 1181 poisonOneInitializer(*F, ModuleName); 1182 } 1183 } 1184 } 1185 1186 bool AddressSanitizerModule::ShouldInstrumentGlobal(GlobalVariable *G) { 1187 Type *Ty = cast<PointerType>(G->getType())->getElementType(); 1188 DEBUG(dbgs() << "GLOBAL: " << *G << "\n"); 1189 1190 if (GlobalsMD.get(G).IsBlacklisted) return false; 1191 if (!Ty->isSized()) return false; 1192 if (!G->hasInitializer()) return false; 1193 if (GlobalWasGeneratedByAsan(G)) return false; // Our own global. 1194 // Touch only those globals that will not be defined in other modules. 1195 // Don't handle ODR linkage types and COMDATs since other modules may be built 1196 // without ASan. 1197 if (G->getLinkage() != GlobalVariable::ExternalLinkage && 1198 G->getLinkage() != GlobalVariable::PrivateLinkage && 1199 G->getLinkage() != GlobalVariable::InternalLinkage) 1200 return false; 1201 if (G->hasComdat()) return false; 1202 // Two problems with thread-locals: 1203 // - The address of the main thread's copy can't be computed at link-time. 1204 // - Need to poison all copies, not just the main thread's one. 1205 if (G->isThreadLocal()) return false; 1206 // For now, just ignore this Global if the alignment is large. 1207 if (G->getAlignment() > MinRedzoneSizeForGlobal()) return false; 1208 1209 if (G->hasSection()) { 1210 StringRef Section(G->getSection()); 1211 1212 // Globals from llvm.metadata aren't emitted, do not instrument them. 1213 if (Section == "llvm.metadata") return false; 1214 // Do not instrument globals from special LLVM sections. 1215 if (Section.find("__llvm") != StringRef::npos) return false; 1216 1217 // Do not instrument function pointers to initialization and termination 1218 // routines: dynamic linker will not properly handle redzones. 1219 if (Section.startswith(".preinit_array") || 1220 Section.startswith(".init_array") || 1221 Section.startswith(".fini_array")) { 1222 return false; 1223 } 1224 1225 // Callbacks put into the CRT initializer/terminator sections 1226 // should not be instrumented. 1227 // See https://code.google.com/p/address-sanitizer/issues/detail?id=305 1228 // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx 1229 if (Section.startswith(".CRT")) { 1230 DEBUG(dbgs() << "Ignoring a global initializer callback: " << *G << "\n"); 1231 return false; 1232 } 1233 1234 if (TargetTriple.isOSBinFormatMachO()) { 1235 StringRef ParsedSegment, ParsedSection; 1236 unsigned TAA = 0, StubSize = 0; 1237 bool TAAParsed; 1238 std::string ErrorCode = MCSectionMachO::ParseSectionSpecifier( 1239 Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize); 1240 assert(ErrorCode.empty() && "Invalid section specifier."); 1241 1242 // Ignore the globals from the __OBJC section. The ObjC runtime assumes 1243 // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to 1244 // them. 1245 if (ParsedSegment == "__OBJC" || 1246 (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) { 1247 DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n"); 1248 return false; 1249 } 1250 // See http://code.google.com/p/address-sanitizer/issues/detail?id=32 1251 // Constant CFString instances are compiled in the following way: 1252 // -- the string buffer is emitted into 1253 // __TEXT,__cstring,cstring_literals 1254 // -- the constant NSConstantString structure referencing that buffer 1255 // is placed into __DATA,__cfstring 1256 // Therefore there's no point in placing redzones into __DATA,__cfstring. 1257 // Moreover, it causes the linker to crash on OS X 10.7 1258 if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") { 1259 DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n"); 1260 return false; 1261 } 1262 // The linker merges the contents of cstring_literals and removes the 1263 // trailing zeroes. 1264 if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) { 1265 DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n"); 1266 return false; 1267 } 1268 } 1269 } 1270 1271 return true; 1272 } 1273 1274 void AddressSanitizerModule::initializeCallbacks(Module &M) { 1275 IRBuilder<> IRB(*C); 1276 // Declare our poisoning and unpoisoning functions. 1277 AsanPoisonGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1278 kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy, nullptr)); 1279 AsanPoisonGlobals->setLinkage(Function::ExternalLinkage); 1280 AsanUnpoisonGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1281 kAsanUnpoisonGlobalsName, IRB.getVoidTy(), nullptr)); 1282 AsanUnpoisonGlobals->setLinkage(Function::ExternalLinkage); 1283 // Declare functions that register/unregister globals. 1284 AsanRegisterGlobals = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1285 kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1286 AsanRegisterGlobals->setLinkage(Function::ExternalLinkage); 1287 AsanUnregisterGlobals = checkSanitizerInterfaceFunction( 1288 M.getOrInsertFunction(kAsanUnregisterGlobalsName, IRB.getVoidTy(), 1289 IntptrTy, IntptrTy, nullptr)); 1290 AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage); 1291 } 1292 1293 // This function replaces all global variables with new variables that have 1294 // trailing redzones. It also creates a function that poisons 1295 // redzones and inserts this function into llvm.global_ctors. 1296 bool AddressSanitizerModule::InstrumentGlobals(IRBuilder<> &IRB, Module &M) { 1297 GlobalsMD.init(M); 1298 1299 SmallVector<GlobalVariable *, 16> GlobalsToChange; 1300 1301 for (auto &G : M.globals()) { 1302 if (ShouldInstrumentGlobal(&G)) GlobalsToChange.push_back(&G); 1303 } 1304 1305 size_t n = GlobalsToChange.size(); 1306 if (n == 0) return false; 1307 1308 // A global is described by a structure 1309 // size_t beg; 1310 // size_t size; 1311 // size_t size_with_redzone; 1312 // const char *name; 1313 // const char *module_name; 1314 // size_t has_dynamic_init; 1315 // void *source_location; 1316 // We initialize an array of such structures and pass it to a run-time call. 1317 StructType *GlobalStructTy = 1318 StructType::get(IntptrTy, IntptrTy, IntptrTy, IntptrTy, IntptrTy, 1319 IntptrTy, IntptrTy, nullptr); 1320 SmallVector<Constant *, 16> Initializers(n); 1321 1322 bool HasDynamicallyInitializedGlobals = false; 1323 1324 // We shouldn't merge same module names, as this string serves as unique 1325 // module ID in runtime. 1326 GlobalVariable *ModuleName = createPrivateGlobalForString( 1327 M, M.getModuleIdentifier(), /*AllowMerging*/ false); 1328 1329 auto &DL = M.getDataLayout(); 1330 for (size_t i = 0; i < n; i++) { 1331 static const uint64_t kMaxGlobalRedzone = 1 << 18; 1332 GlobalVariable *G = GlobalsToChange[i]; 1333 1334 auto MD = GlobalsMD.get(G); 1335 // Create string holding the global name (use global name from metadata 1336 // if it's available, otherwise just write the name of global variable). 1337 GlobalVariable *Name = createPrivateGlobalForString( 1338 M, MD.Name.empty() ? G->getName() : MD.Name, 1339 /*AllowMerging*/ true); 1340 1341 PointerType *PtrTy = cast<PointerType>(G->getType()); 1342 Type *Ty = PtrTy->getElementType(); 1343 uint64_t SizeInBytes = DL.getTypeAllocSize(Ty); 1344 uint64_t MinRZ = MinRedzoneSizeForGlobal(); 1345 // MinRZ <= RZ <= kMaxGlobalRedzone 1346 // and trying to make RZ to be ~ 1/4 of SizeInBytes. 1347 uint64_t RZ = std::max( 1348 MinRZ, std::min(kMaxGlobalRedzone, (SizeInBytes / MinRZ / 4) * MinRZ)); 1349 uint64_t RightRedzoneSize = RZ; 1350 // Round up to MinRZ 1351 if (SizeInBytes % MinRZ) RightRedzoneSize += MinRZ - (SizeInBytes % MinRZ); 1352 assert(((RightRedzoneSize + SizeInBytes) % MinRZ) == 0); 1353 Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize); 1354 1355 StructType *NewTy = StructType::get(Ty, RightRedZoneTy, nullptr); 1356 Constant *NewInitializer = 1357 ConstantStruct::get(NewTy, G->getInitializer(), 1358 Constant::getNullValue(RightRedZoneTy), nullptr); 1359 1360 // Create a new global variable with enough space for a redzone. 1361 GlobalValue::LinkageTypes Linkage = G->getLinkage(); 1362 if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage) 1363 Linkage = GlobalValue::InternalLinkage; 1364 GlobalVariable *NewGlobal = 1365 new GlobalVariable(M, NewTy, G->isConstant(), Linkage, NewInitializer, 1366 "", G, G->getThreadLocalMode()); 1367 NewGlobal->copyAttributesFrom(G); 1368 NewGlobal->setAlignment(MinRZ); 1369 1370 Value *Indices2[2]; 1371 Indices2[0] = IRB.getInt32(0); 1372 Indices2[1] = IRB.getInt32(0); 1373 1374 G->replaceAllUsesWith( 1375 ConstantExpr::getGetElementPtr(NewTy, NewGlobal, Indices2, true)); 1376 NewGlobal->takeName(G); 1377 G->eraseFromParent(); 1378 1379 Constant *SourceLoc; 1380 if (!MD.SourceLoc.empty()) { 1381 auto SourceLocGlobal = createPrivateGlobalForSourceLoc(M, MD.SourceLoc); 1382 SourceLoc = ConstantExpr::getPointerCast(SourceLocGlobal, IntptrTy); 1383 } else { 1384 SourceLoc = ConstantInt::get(IntptrTy, 0); 1385 } 1386 1387 Initializers[i] = ConstantStruct::get( 1388 GlobalStructTy, ConstantExpr::getPointerCast(NewGlobal, IntptrTy), 1389 ConstantInt::get(IntptrTy, SizeInBytes), 1390 ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize), 1391 ConstantExpr::getPointerCast(Name, IntptrTy), 1392 ConstantExpr::getPointerCast(ModuleName, IntptrTy), 1393 ConstantInt::get(IntptrTy, MD.IsDynInit), SourceLoc, nullptr); 1394 1395 if (ClInitializers && MD.IsDynInit) HasDynamicallyInitializedGlobals = true; 1396 1397 DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n"); 1398 } 1399 1400 ArrayType *ArrayOfGlobalStructTy = ArrayType::get(GlobalStructTy, n); 1401 GlobalVariable *AllGlobals = new GlobalVariable( 1402 M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage, 1403 ConstantArray::get(ArrayOfGlobalStructTy, Initializers), ""); 1404 1405 // Create calls for poisoning before initializers run and unpoisoning after. 1406 if (HasDynamicallyInitializedGlobals) 1407 createInitializerPoisonCalls(M, ModuleName); 1408 IRB.CreateCall(AsanRegisterGlobals, 1409 {IRB.CreatePointerCast(AllGlobals, IntptrTy), 1410 ConstantInt::get(IntptrTy, n)}); 1411 1412 // We also need to unregister globals at the end, e.g. when a shared library 1413 // gets closed. 1414 Function *AsanDtorFunction = 1415 Function::Create(FunctionType::get(Type::getVoidTy(*C), false), 1416 GlobalValue::InternalLinkage, kAsanModuleDtorName, &M); 1417 BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction); 1418 IRBuilder<> IRB_Dtor(ReturnInst::Create(*C, AsanDtorBB)); 1419 IRB_Dtor.CreateCall(AsanUnregisterGlobals, 1420 {IRB.CreatePointerCast(AllGlobals, IntptrTy), 1421 ConstantInt::get(IntptrTy, n)}); 1422 appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndDtorPriority); 1423 1424 DEBUG(dbgs() << M); 1425 return true; 1426 } 1427 1428 bool AddressSanitizerModule::runOnModule(Module &M) { 1429 C = &(M.getContext()); 1430 int LongSize = M.getDataLayout().getPointerSizeInBits(); 1431 IntptrTy = Type::getIntNTy(*C, LongSize); 1432 TargetTriple = Triple(M.getTargetTriple()); 1433 Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel); 1434 initializeCallbacks(M); 1435 1436 bool Changed = false; 1437 1438 // TODO(glider): temporarily disabled globals instrumentation for KASan. 1439 if (ClGlobals && !CompileKernel) { 1440 Function *CtorFunc = M.getFunction(kAsanModuleCtorName); 1441 assert(CtorFunc); 1442 IRBuilder<> IRB(CtorFunc->getEntryBlock().getTerminator()); 1443 Changed |= InstrumentGlobals(IRB, M); 1444 } 1445 1446 return Changed; 1447 } 1448 1449 void AddressSanitizer::initializeCallbacks(Module &M) { 1450 IRBuilder<> IRB(*C); 1451 // Create __asan_report* callbacks. 1452 // IsWrite, TypeSize and Exp are encoded in the function name. 1453 for (int Exp = 0; Exp < 2; Exp++) { 1454 for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) { 1455 const std::string TypeStr = AccessIsWrite ? "store" : "load"; 1456 const std::string ExpStr = Exp ? "exp_" : ""; 1457 const std::string SuffixStr = CompileKernel ? "N" : "_n"; 1458 const std::string EndingStr = Recover ? "_noabort" : ""; 1459 Type *ExpType = Exp ? Type::getInt32Ty(*C) : nullptr; 1460 AsanErrorCallbackSized[AccessIsWrite][Exp] = 1461 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1462 kAsanReportErrorTemplate + ExpStr + TypeStr + SuffixStr + EndingStr, 1463 IRB.getVoidTy(), IntptrTy, IntptrTy, ExpType, nullptr)); 1464 AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] = 1465 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1466 ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr, 1467 IRB.getVoidTy(), IntptrTy, IntptrTy, ExpType, nullptr)); 1468 for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes; 1469 AccessSizeIndex++) { 1470 const std::string Suffix = TypeStr + itostr(1 << AccessSizeIndex); 1471 AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] = 1472 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1473 kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr, 1474 IRB.getVoidTy(), IntptrTy, ExpType, nullptr)); 1475 AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] = 1476 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1477 ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr, 1478 IRB.getVoidTy(), IntptrTy, ExpType, nullptr)); 1479 } 1480 } 1481 } 1482 1483 const std::string MemIntrinCallbackPrefix = 1484 CompileKernel ? std::string("") : ClMemoryAccessCallbackPrefix; 1485 AsanMemmove = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1486 MemIntrinCallbackPrefix + "memmove", IRB.getInt8PtrTy(), 1487 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy, nullptr)); 1488 AsanMemcpy = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1489 MemIntrinCallbackPrefix + "memcpy", IRB.getInt8PtrTy(), 1490 IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy, nullptr)); 1491 AsanMemset = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1492 MemIntrinCallbackPrefix + "memset", IRB.getInt8PtrTy(), 1493 IRB.getInt8PtrTy(), IRB.getInt32Ty(), IntptrTy, nullptr)); 1494 1495 AsanHandleNoReturnFunc = checkSanitizerInterfaceFunction( 1496 M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy(), nullptr)); 1497 1498 AsanPtrCmpFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1499 kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1500 AsanPtrSubFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1501 kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1502 // We insert an empty inline asm after __asan_report* to avoid callback merge. 1503 EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 1504 StringRef(""), StringRef(""), 1505 /*hasSideEffects=*/true); 1506 } 1507 1508 // virtual 1509 bool AddressSanitizer::doInitialization(Module &M) { 1510 // Initialize the private fields. No one has accessed them before. 1511 1512 GlobalsMD.init(M); 1513 1514 C = &(M.getContext()); 1515 LongSize = M.getDataLayout().getPointerSizeInBits(); 1516 IntptrTy = Type::getIntNTy(*C, LongSize); 1517 TargetTriple = Triple(M.getTargetTriple()); 1518 1519 if (!CompileKernel) { 1520 std::tie(AsanCtorFunction, AsanInitFunction) = 1521 createSanitizerCtorAndInitFunctions( 1522 M, kAsanModuleCtorName, kAsanInitName, 1523 /*InitArgTypes=*/{}, /*InitArgs=*/{}, kAsanVersionCheckName); 1524 appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndDtorPriority); 1525 } 1526 Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel); 1527 return true; 1528 } 1529 1530 bool AddressSanitizer::doFinalization(Module &M) { 1531 GlobalsMD.reset(); 1532 return false; 1533 } 1534 1535 bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { 1536 // For each NSObject descendant having a +load method, this method is invoked 1537 // by the ObjC runtime before any of the static constructors is called. 1538 // Therefore we need to instrument such methods with a call to __asan_init 1539 // at the beginning in order to initialize our runtime before any access to 1540 // the shadow memory. 1541 // We cannot just ignore these methods, because they may call other 1542 // instrumented functions. 1543 if (F.getName().find(" load]") != std::string::npos) { 1544 IRBuilder<> IRB(&F.front(), F.front().begin()); 1545 IRB.CreateCall(AsanInitFunction, {}); 1546 return true; 1547 } 1548 return false; 1549 } 1550 1551 void AddressSanitizer::markEscapedLocalAllocas(Function &F) { 1552 // Find the one possible call to llvm.localescape and pre-mark allocas passed 1553 // to it as uninteresting. This assumes we haven't started processing allocas 1554 // yet. This check is done up front because iterating the use list in 1555 // isInterestingAlloca would be algorithmically slower. 1556 assert(ProcessedAllocas.empty() && "must process localescape before allocas"); 1557 1558 // Try to get the declaration of llvm.localescape. If it's not in the module, 1559 // we can exit early. 1560 if (!F.getParent()->getFunction("llvm.localescape")) return; 1561 1562 // Look for a call to llvm.localescape call in the entry block. It can't be in 1563 // any other block. 1564 for (Instruction &I : F.getEntryBlock()) { 1565 IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I); 1566 if (II && II->getIntrinsicID() == Intrinsic::localescape) { 1567 // We found a call. Mark all the allocas passed in as uninteresting. 1568 for (Value *Arg : II->arg_operands()) { 1569 AllocaInst *AI = dyn_cast<AllocaInst>(Arg->stripPointerCasts()); 1570 assert(AI && AI->isStaticAlloca() && 1571 "non-static alloca arg to localescape"); 1572 ProcessedAllocas[AI] = false; 1573 } 1574 break; 1575 } 1576 } 1577 } 1578 1579 bool AddressSanitizer::runOnFunction(Function &F) { 1580 if (&F == AsanCtorFunction) return false; 1581 if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false; 1582 DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n"); 1583 initializeCallbacks(*F.getParent()); 1584 1585 DT = &getAnalysis<DominatorTreeWrapperPass>().getDomTree(); 1586 1587 // If needed, insert __asan_init before checking for SanitizeAddress attr. 1588 maybeInsertAsanInitAtFunctionEntry(F); 1589 1590 if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return false; 1591 1592 if (!ClDebugFunc.empty() && ClDebugFunc != F.getName()) return false; 1593 1594 FunctionStateRAII CleanupObj(this); 1595 1596 // We can't instrument allocas used with llvm.localescape. Only static allocas 1597 // can be passed to that intrinsic. 1598 markEscapedLocalAllocas(F); 1599 1600 // We want to instrument every address only once per basic block (unless there 1601 // are calls between uses). 1602 SmallSet<Value *, 16> TempsToInstrument; 1603 SmallVector<Instruction *, 16> ToInstrument; 1604 SmallVector<Instruction *, 8> NoReturnCalls; 1605 SmallVector<BasicBlock *, 16> AllBlocks; 1606 SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts; 1607 int NumAllocas = 0; 1608 bool IsWrite; 1609 unsigned Alignment; 1610 uint64_t TypeSize; 1611 1612 // Fill the set of memory operations to instrument. 1613 for (auto &BB : F) { 1614 AllBlocks.push_back(&BB); 1615 TempsToInstrument.clear(); 1616 int NumInsnsPerBB = 0; 1617 for (auto &Inst : BB) { 1618 if (LooksLikeCodeInBug11395(&Inst)) return false; 1619 if (Value *Addr = isInterestingMemoryAccess(&Inst, &IsWrite, &TypeSize, 1620 &Alignment)) { 1621 if (ClOpt && ClOptSameTemp) { 1622 if (!TempsToInstrument.insert(Addr).second) 1623 continue; // We've seen this temp in the current BB. 1624 } 1625 } else if (ClInvalidPointerPairs && 1626 isInterestingPointerComparisonOrSubtraction(&Inst)) { 1627 PointerComparisonsOrSubtracts.push_back(&Inst); 1628 continue; 1629 } else if (isa<MemIntrinsic>(Inst)) { 1630 // ok, take it. 1631 } else { 1632 if (isa<AllocaInst>(Inst)) NumAllocas++; 1633 CallSite CS(&Inst); 1634 if (CS) { 1635 // A call inside BB. 1636 TempsToInstrument.clear(); 1637 if (CS.doesNotReturn()) NoReturnCalls.push_back(CS.getInstruction()); 1638 } 1639 continue; 1640 } 1641 ToInstrument.push_back(&Inst); 1642 NumInsnsPerBB++; 1643 if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break; 1644 } 1645 } 1646 1647 bool UseCalls = 1648 CompileKernel || 1649 (ClInstrumentationWithCallsThreshold >= 0 && 1650 ToInstrument.size() > (unsigned)ClInstrumentationWithCallsThreshold); 1651 const TargetLibraryInfo *TLI = 1652 &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(); 1653 const DataLayout &DL = F.getParent()->getDataLayout(); 1654 ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), 1655 /*RoundToAlign=*/true); 1656 1657 // Instrument. 1658 int NumInstrumented = 0; 1659 for (auto Inst : ToInstrument) { 1660 if (ClDebugMin < 0 || ClDebugMax < 0 || 1661 (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) { 1662 if (isInterestingMemoryAccess(Inst, &IsWrite, &TypeSize, &Alignment)) 1663 instrumentMop(ObjSizeVis, Inst, UseCalls, 1664 F.getParent()->getDataLayout()); 1665 else 1666 instrumentMemIntrinsic(cast<MemIntrinsic>(Inst)); 1667 } 1668 NumInstrumented++; 1669 } 1670 1671 FunctionStackPoisoner FSP(F, *this); 1672 bool ChangedStack = FSP.runOnFunction(); 1673 1674 // We must unpoison the stack before every NoReturn call (throw, _exit, etc). 1675 // See e.g. http://code.google.com/p/address-sanitizer/issues/detail?id=37 1676 for (auto CI : NoReturnCalls) { 1677 IRBuilder<> IRB(CI); 1678 IRB.CreateCall(AsanHandleNoReturnFunc, {}); 1679 } 1680 1681 for (auto Inst : PointerComparisonsOrSubtracts) { 1682 instrumentPointerComparisonOrSubtraction(Inst); 1683 NumInstrumented++; 1684 } 1685 1686 bool res = NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty(); 1687 1688 DEBUG(dbgs() << "ASAN done instrumenting: " << res << " " << F << "\n"); 1689 1690 return res; 1691 } 1692 1693 // Workaround for bug 11395: we don't want to instrument stack in functions 1694 // with large assembly blobs (32-bit only), otherwise reg alloc may crash. 1695 // FIXME: remove once the bug 11395 is fixed. 1696 bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) { 1697 if (LongSize != 32) return false; 1698 CallInst *CI = dyn_cast<CallInst>(I); 1699 if (!CI || !CI->isInlineAsm()) return false; 1700 if (CI->getNumArgOperands() <= 5) return false; 1701 // We have inline assembly with quite a few arguments. 1702 return true; 1703 } 1704 1705 void FunctionStackPoisoner::initializeCallbacks(Module &M) { 1706 IRBuilder<> IRB(*C); 1707 for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) { 1708 std::string Suffix = itostr(i); 1709 AsanStackMallocFunc[i] = checkSanitizerInterfaceFunction( 1710 M.getOrInsertFunction(kAsanStackMallocNameTemplate + Suffix, IntptrTy, 1711 IntptrTy, nullptr)); 1712 AsanStackFreeFunc[i] = checkSanitizerInterfaceFunction( 1713 M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix, 1714 IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1715 } 1716 AsanPoisonStackMemoryFunc = checkSanitizerInterfaceFunction( 1717 M.getOrInsertFunction(kAsanPoisonStackMemoryName, IRB.getVoidTy(), 1718 IntptrTy, IntptrTy, nullptr)); 1719 AsanUnpoisonStackMemoryFunc = checkSanitizerInterfaceFunction( 1720 M.getOrInsertFunction(kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), 1721 IntptrTy, IntptrTy, nullptr)); 1722 AsanAllocaPoisonFunc = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1723 kAsanAllocaPoison, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1724 AsanAllocasUnpoisonFunc = 1725 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 1726 kAsanAllocasUnpoison, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr)); 1727 } 1728 1729 void FunctionStackPoisoner::poisonRedZones(ArrayRef<uint8_t> ShadowBytes, 1730 IRBuilder<> &IRB, Value *ShadowBase, 1731 bool DoPoison) { 1732 size_t n = ShadowBytes.size(); 1733 size_t i = 0; 1734 // We need to (un)poison n bytes of stack shadow. Poison as many as we can 1735 // using 64-bit stores (if we are on 64-bit arch), then poison the rest 1736 // with 32-bit stores, then with 16-byte stores, then with 8-byte stores. 1737 for (size_t LargeStoreSizeInBytes = ASan.LongSize / 8; 1738 LargeStoreSizeInBytes != 0; LargeStoreSizeInBytes /= 2) { 1739 for (; i + LargeStoreSizeInBytes - 1 < n; i += LargeStoreSizeInBytes) { 1740 uint64_t Val = 0; 1741 for (size_t j = 0; j < LargeStoreSizeInBytes; j++) { 1742 if (F.getParent()->getDataLayout().isLittleEndian()) 1743 Val |= (uint64_t)ShadowBytes[i + j] << (8 * j); 1744 else 1745 Val = (Val << 8) | ShadowBytes[i + j]; 1746 } 1747 if (!Val) continue; 1748 Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); 1749 Type *StoreTy = Type::getIntNTy(*C, LargeStoreSizeInBytes * 8); 1750 Value *Poison = ConstantInt::get(StoreTy, DoPoison ? Val : 0); 1751 IRB.CreateStore(Poison, IRB.CreateIntToPtr(Ptr, StoreTy->getPointerTo())); 1752 } 1753 } 1754 } 1755 1756 // Fake stack allocator (asan_fake_stack.h) has 11 size classes 1757 // for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass 1758 static int StackMallocSizeClass(uint64_t LocalStackSize) { 1759 assert(LocalStackSize <= kMaxStackMallocSize); 1760 uint64_t MaxSize = kMinStackMallocSize; 1761 for (int i = 0;; i++, MaxSize *= 2) 1762 if (LocalStackSize <= MaxSize) return i; 1763 llvm_unreachable("impossible LocalStackSize"); 1764 } 1765 1766 // Set Size bytes starting from ShadowBase to kAsanStackAfterReturnMagic. 1767 // We can not use MemSet intrinsic because it may end up calling the actual 1768 // memset. Size is a multiple of 8. 1769 // Currently this generates 8-byte stores on x86_64; it may be better to 1770 // generate wider stores. 1771 void FunctionStackPoisoner::SetShadowToStackAfterReturnInlined( 1772 IRBuilder<> &IRB, Value *ShadowBase, int Size) { 1773 assert(!(Size % 8)); 1774 1775 // kAsanStackAfterReturnMagic is 0xf5. 1776 const uint64_t kAsanStackAfterReturnMagic64 = 0xf5f5f5f5f5f5f5f5ULL; 1777 1778 for (int i = 0; i < Size; i += 8) { 1779 Value *p = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)); 1780 IRB.CreateStore( 1781 ConstantInt::get(IRB.getInt64Ty(), kAsanStackAfterReturnMagic64), 1782 IRB.CreateIntToPtr(p, IRB.getInt64Ty()->getPointerTo())); 1783 } 1784 } 1785 1786 PHINode *FunctionStackPoisoner::createPHI(IRBuilder<> &IRB, Value *Cond, 1787 Value *ValueIfTrue, 1788 Instruction *ThenTerm, 1789 Value *ValueIfFalse) { 1790 PHINode *PHI = IRB.CreatePHI(IntptrTy, 2); 1791 BasicBlock *CondBlock = cast<Instruction>(Cond)->getParent(); 1792 PHI->addIncoming(ValueIfFalse, CondBlock); 1793 BasicBlock *ThenBlock = ThenTerm->getParent(); 1794 PHI->addIncoming(ValueIfTrue, ThenBlock); 1795 return PHI; 1796 } 1797 1798 Value *FunctionStackPoisoner::createAllocaForLayout( 1799 IRBuilder<> &IRB, const ASanStackFrameLayout &L, bool Dynamic) { 1800 AllocaInst *Alloca; 1801 if (Dynamic) { 1802 Alloca = IRB.CreateAlloca(IRB.getInt8Ty(), 1803 ConstantInt::get(IRB.getInt64Ty(), L.FrameSize), 1804 "MyAlloca"); 1805 } else { 1806 Alloca = IRB.CreateAlloca(ArrayType::get(IRB.getInt8Ty(), L.FrameSize), 1807 nullptr, "MyAlloca"); 1808 assert(Alloca->isStaticAlloca()); 1809 } 1810 assert((ClRealignStack & (ClRealignStack - 1)) == 0); 1811 size_t FrameAlignment = std::max(L.FrameAlignment, (size_t)ClRealignStack); 1812 Alloca->setAlignment(FrameAlignment); 1813 return IRB.CreatePointerCast(Alloca, IntptrTy); 1814 } 1815 1816 void FunctionStackPoisoner::createDynamicAllocasInitStorage() { 1817 BasicBlock &FirstBB = *F.begin(); 1818 IRBuilder<> IRB(dyn_cast<Instruction>(FirstBB.begin())); 1819 DynamicAllocaLayout = IRB.CreateAlloca(IntptrTy, nullptr); 1820 IRB.CreateStore(Constant::getNullValue(IntptrTy), DynamicAllocaLayout); 1821 DynamicAllocaLayout->setAlignment(32); 1822 } 1823 1824 void FunctionStackPoisoner::poisonStack() { 1825 assert(AllocaVec.size() > 0 || DynamicAllocaVec.size() > 0); 1826 1827 // Insert poison calls for lifetime intrinsics for alloca. 1828 bool HavePoisonedAllocas = false; 1829 for (const auto &APC : AllocaPoisonCallVec) { 1830 assert(APC.InsBefore); 1831 assert(APC.AI); 1832 IRBuilder<> IRB(APC.InsBefore); 1833 poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison); 1834 HavePoisonedAllocas |= APC.DoPoison; 1835 } 1836 1837 if (ClInstrumentAllocas && DynamicAllocaVec.size() > 0) { 1838 // Handle dynamic allocas. 1839 createDynamicAllocasInitStorage(); 1840 for (auto &AI : DynamicAllocaVec) handleDynamicAllocaCall(AI); 1841 1842 unpoisonDynamicAllocas(); 1843 } 1844 1845 if (AllocaVec.empty()) return; 1846 1847 int StackMallocIdx = -1; 1848 DebugLoc EntryDebugLocation; 1849 if (auto SP = getDISubprogram(&F)) 1850 EntryDebugLocation = DebugLoc::get(SP->getScopeLine(), 0, SP); 1851 1852 Instruction *InsBefore = AllocaVec[0]; 1853 IRBuilder<> IRB(InsBefore); 1854 IRB.SetCurrentDebugLocation(EntryDebugLocation); 1855 1856 // Make sure non-instrumented allocas stay in the entry block. Otherwise, 1857 // debug info is broken, because only entry-block allocas are treated as 1858 // regular stack slots. 1859 auto InsBeforeB = InsBefore->getParent(); 1860 assert(InsBeforeB == &F.getEntryBlock()); 1861 for (BasicBlock::iterator I(InsBefore); I != InsBeforeB->end(); ++I) 1862 if (auto *AI = dyn_cast<AllocaInst>(I)) 1863 if (NonInstrumentedStaticAllocaVec.count(AI) > 0) 1864 AI->moveBefore(InsBefore); 1865 1866 // If we have a call to llvm.localescape, keep it in the entry block. 1867 if (LocalEscapeCall) LocalEscapeCall->moveBefore(InsBefore); 1868 1869 SmallVector<ASanStackVariableDescription, 16> SVD; 1870 SVD.reserve(AllocaVec.size()); 1871 for (AllocaInst *AI : AllocaVec) { 1872 ASanStackVariableDescription D = {AI->getName().data(), 1873 ASan.getAllocaSizeInBytes(AI), 1874 AI->getAlignment(), AI, 0}; 1875 SVD.push_back(D); 1876 } 1877 // Minimal header size (left redzone) is 4 pointers, 1878 // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms. 1879 size_t MinHeaderSize = ASan.LongSize / 2; 1880 ASanStackFrameLayout L; 1881 ComputeASanStackFrameLayout(SVD, 1UL << Mapping.Scale, MinHeaderSize, &L); 1882 DEBUG(dbgs() << L.DescriptionString << " --- " << L.FrameSize << "\n"); 1883 uint64_t LocalStackSize = L.FrameSize; 1884 bool DoStackMalloc = ClUseAfterReturn && !ASan.CompileKernel && 1885 LocalStackSize <= kMaxStackMallocSize; 1886 bool DoDynamicAlloca = ClDynamicAllocaStack; 1887 // Don't do dynamic alloca or stack malloc if: 1888 // 1) There is inline asm: too often it makes assumptions on which registers 1889 // are available. 1890 // 2) There is a returns_twice call (typically setjmp), which is 1891 // optimization-hostile, and doesn't play well with introduced indirect 1892 // register-relative calculation of local variable addresses. 1893 DoDynamicAlloca &= !HasNonEmptyInlineAsm && !HasReturnsTwiceCall; 1894 DoStackMalloc &= !HasNonEmptyInlineAsm && !HasReturnsTwiceCall; 1895 1896 Value *StaticAlloca = 1897 DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false); 1898 1899 Value *FakeStack; 1900 Value *LocalStackBase; 1901 1902 if (DoStackMalloc) { 1903 // void *FakeStack = __asan_option_detect_stack_use_after_return 1904 // ? __asan_stack_malloc_N(LocalStackSize) 1905 // : nullptr; 1906 // void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize); 1907 Constant *OptionDetectUAR = F.getParent()->getOrInsertGlobal( 1908 kAsanOptionDetectUAR, IRB.getInt32Ty()); 1909 Value *UARIsEnabled = 1910 IRB.CreateICmpNE(IRB.CreateLoad(OptionDetectUAR), 1911 Constant::getNullValue(IRB.getInt32Ty())); 1912 Instruction *Term = 1913 SplitBlockAndInsertIfThen(UARIsEnabled, InsBefore, false); 1914 IRBuilder<> IRBIf(Term); 1915 IRBIf.SetCurrentDebugLocation(EntryDebugLocation); 1916 StackMallocIdx = StackMallocSizeClass(LocalStackSize); 1917 assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass); 1918 Value *FakeStackValue = 1919 IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx], 1920 ConstantInt::get(IntptrTy, LocalStackSize)); 1921 IRB.SetInsertPoint(InsBefore); 1922 IRB.SetCurrentDebugLocation(EntryDebugLocation); 1923 FakeStack = createPHI(IRB, UARIsEnabled, FakeStackValue, Term, 1924 ConstantInt::get(IntptrTy, 0)); 1925 1926 Value *NoFakeStack = 1927 IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy)); 1928 Term = SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false); 1929 IRBIf.SetInsertPoint(Term); 1930 IRBIf.SetCurrentDebugLocation(EntryDebugLocation); 1931 Value *AllocaValue = 1932 DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca; 1933 IRB.SetInsertPoint(InsBefore); 1934 IRB.SetCurrentDebugLocation(EntryDebugLocation); 1935 LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack); 1936 } else { 1937 // void *FakeStack = nullptr; 1938 // void *LocalStackBase = alloca(LocalStackSize); 1939 FakeStack = ConstantInt::get(IntptrTy, 0); 1940 LocalStackBase = 1941 DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca; 1942 } 1943 1944 // Replace Alloca instructions with base+offset. 1945 for (const auto &Desc : SVD) { 1946 AllocaInst *AI = Desc.AI; 1947 Value *NewAllocaPtr = IRB.CreateIntToPtr( 1948 IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)), 1949 AI->getType()); 1950 replaceDbgDeclareForAlloca(AI, NewAllocaPtr, DIB, /*Deref=*/true); 1951 AI->replaceAllUsesWith(NewAllocaPtr); 1952 } 1953 1954 // The left-most redzone has enough space for at least 4 pointers. 1955 // Write the Magic value to redzone[0]. 1956 Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy); 1957 IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic), 1958 BasePlus0); 1959 // Write the frame description constant to redzone[1]. 1960 Value *BasePlus1 = IRB.CreateIntToPtr( 1961 IRB.CreateAdd(LocalStackBase, 1962 ConstantInt::get(IntptrTy, ASan.LongSize / 8)), 1963 IntptrPtrTy); 1964 GlobalVariable *StackDescriptionGlobal = 1965 createPrivateGlobalForString(*F.getParent(), L.DescriptionString, 1966 /*AllowMerging*/ true); 1967 Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy); 1968 IRB.CreateStore(Description, BasePlus1); 1969 // Write the PC to redzone[2]. 1970 Value *BasePlus2 = IRB.CreateIntToPtr( 1971 IRB.CreateAdd(LocalStackBase, 1972 ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)), 1973 IntptrPtrTy); 1974 IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2); 1975 1976 // Poison the stack redzones at the entry. 1977 Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB); 1978 poisonRedZones(L.ShadowBytes, IRB, ShadowBase, true); 1979 1980 // (Un)poison the stack before all ret instructions. 1981 for (auto Ret : RetVec) { 1982 IRBuilder<> IRBRet(Ret); 1983 // Mark the current frame as retired. 1984 IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic), 1985 BasePlus0); 1986 if (DoStackMalloc) { 1987 assert(StackMallocIdx >= 0); 1988 // if FakeStack != 0 // LocalStackBase == FakeStack 1989 // // In use-after-return mode, poison the whole stack frame. 1990 // if StackMallocIdx <= 4 1991 // // For small sizes inline the whole thing: 1992 // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize); 1993 // **SavedFlagPtr(FakeStack) = 0 1994 // else 1995 // __asan_stack_free_N(FakeStack, LocalStackSize) 1996 // else 1997 // <This is not a fake stack; unpoison the redzones> 1998 Value *Cmp = 1999 IRBRet.CreateICmpNE(FakeStack, Constant::getNullValue(IntptrTy)); 2000 TerminatorInst *ThenTerm, *ElseTerm; 2001 SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm); 2002 2003 IRBuilder<> IRBPoison(ThenTerm); 2004 if (StackMallocIdx <= 4) { 2005 int ClassSize = kMinStackMallocSize << StackMallocIdx; 2006 SetShadowToStackAfterReturnInlined(IRBPoison, ShadowBase, 2007 ClassSize >> Mapping.Scale); 2008 Value *SavedFlagPtrPtr = IRBPoison.CreateAdd( 2009 FakeStack, 2010 ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8)); 2011 Value *SavedFlagPtr = IRBPoison.CreateLoad( 2012 IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy)); 2013 IRBPoison.CreateStore( 2014 Constant::getNullValue(IRBPoison.getInt8Ty()), 2015 IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy())); 2016 } else { 2017 // For larger frames call __asan_stack_free_*. 2018 IRBPoison.CreateCall( 2019 AsanStackFreeFunc[StackMallocIdx], 2020 {FakeStack, ConstantInt::get(IntptrTy, LocalStackSize)}); 2021 } 2022 2023 IRBuilder<> IRBElse(ElseTerm); 2024 poisonRedZones(L.ShadowBytes, IRBElse, ShadowBase, false); 2025 } else if (HavePoisonedAllocas) { 2026 // If we poisoned some allocas in llvm.lifetime analysis, 2027 // unpoison whole stack frame now. 2028 poisonAlloca(LocalStackBase, LocalStackSize, IRBRet, false); 2029 } else { 2030 poisonRedZones(L.ShadowBytes, IRBRet, ShadowBase, false); 2031 } 2032 } 2033 2034 // We are done. Remove the old unused alloca instructions. 2035 for (auto AI : AllocaVec) AI->eraseFromParent(); 2036 } 2037 2038 void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size, 2039 IRBuilder<> &IRB, bool DoPoison) { 2040 // For now just insert the call to ASan runtime. 2041 Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy); 2042 Value *SizeArg = ConstantInt::get(IntptrTy, Size); 2043 IRB.CreateCall( 2044 DoPoison ? AsanPoisonStackMemoryFunc : AsanUnpoisonStackMemoryFunc, 2045 {AddrArg, SizeArg}); 2046 } 2047 2048 // Handling llvm.lifetime intrinsics for a given %alloca: 2049 // (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca. 2050 // (2) if %size is constant, poison memory for llvm.lifetime.end (to detect 2051 // invalid accesses) and unpoison it for llvm.lifetime.start (the memory 2052 // could be poisoned by previous llvm.lifetime.end instruction, as the 2053 // variable may go in and out of scope several times, e.g. in loops). 2054 // (3) if we poisoned at least one %alloca in a function, 2055 // unpoison the whole stack frame at function exit. 2056 2057 AllocaInst *FunctionStackPoisoner::findAllocaForValue(Value *V) { 2058 if (AllocaInst *AI = dyn_cast<AllocaInst>(V)) 2059 // We're intested only in allocas we can handle. 2060 return ASan.isInterestingAlloca(*AI) ? AI : nullptr; 2061 // See if we've already calculated (or started to calculate) alloca for a 2062 // given value. 2063 AllocaForValueMapTy::iterator I = AllocaForValue.find(V); 2064 if (I != AllocaForValue.end()) return I->second; 2065 // Store 0 while we're calculating alloca for value V to avoid 2066 // infinite recursion if the value references itself. 2067 AllocaForValue[V] = nullptr; 2068 AllocaInst *Res = nullptr; 2069 if (CastInst *CI = dyn_cast<CastInst>(V)) 2070 Res = findAllocaForValue(CI->getOperand(0)); 2071 else if (PHINode *PN = dyn_cast<PHINode>(V)) { 2072 for (Value *IncValue : PN->incoming_values()) { 2073 // Allow self-referencing phi-nodes. 2074 if (IncValue == PN) continue; 2075 AllocaInst *IncValueAI = findAllocaForValue(IncValue); 2076 // AI for incoming values should exist and should all be equal. 2077 if (IncValueAI == nullptr || (Res != nullptr && IncValueAI != Res)) 2078 return nullptr; 2079 Res = IncValueAI; 2080 } 2081 } 2082 if (Res) AllocaForValue[V] = Res; 2083 return Res; 2084 } 2085 2086 void FunctionStackPoisoner::handleDynamicAllocaCall(AllocaInst *AI) { 2087 IRBuilder<> IRB(AI); 2088 2089 const unsigned Align = std::max(kAllocaRzSize, AI->getAlignment()); 2090 const uint64_t AllocaRedzoneMask = kAllocaRzSize - 1; 2091 2092 Value *Zero = Constant::getNullValue(IntptrTy); 2093 Value *AllocaRzSize = ConstantInt::get(IntptrTy, kAllocaRzSize); 2094 Value *AllocaRzMask = ConstantInt::get(IntptrTy, AllocaRedzoneMask); 2095 2096 // Since we need to extend alloca with additional memory to locate 2097 // redzones, and OldSize is number of allocated blocks with 2098 // ElementSize size, get allocated memory size in bytes by 2099 // OldSize * ElementSize. 2100 const unsigned ElementSize = 2101 F.getParent()->getDataLayout().getTypeAllocSize(AI->getAllocatedType()); 2102 Value *OldSize = 2103 IRB.CreateMul(IRB.CreateIntCast(AI->getArraySize(), IntptrTy, false), 2104 ConstantInt::get(IntptrTy, ElementSize)); 2105 2106 // PartialSize = OldSize % 32 2107 Value *PartialSize = IRB.CreateAnd(OldSize, AllocaRzMask); 2108 2109 // Misalign = kAllocaRzSize - PartialSize; 2110 Value *Misalign = IRB.CreateSub(AllocaRzSize, PartialSize); 2111 2112 // PartialPadding = Misalign != kAllocaRzSize ? Misalign : 0; 2113 Value *Cond = IRB.CreateICmpNE(Misalign, AllocaRzSize); 2114 Value *PartialPadding = IRB.CreateSelect(Cond, Misalign, Zero); 2115 2116 // AdditionalChunkSize = Align + PartialPadding + kAllocaRzSize 2117 // Align is added to locate left redzone, PartialPadding for possible 2118 // partial redzone and kAllocaRzSize for right redzone respectively. 2119 Value *AdditionalChunkSize = IRB.CreateAdd( 2120 ConstantInt::get(IntptrTy, Align + kAllocaRzSize), PartialPadding); 2121 2122 Value *NewSize = IRB.CreateAdd(OldSize, AdditionalChunkSize); 2123 2124 // Insert new alloca with new NewSize and Align params. 2125 AllocaInst *NewAlloca = IRB.CreateAlloca(IRB.getInt8Ty(), NewSize); 2126 NewAlloca->setAlignment(Align); 2127 2128 // NewAddress = Address + Align 2129 Value *NewAddress = IRB.CreateAdd(IRB.CreatePtrToInt(NewAlloca, IntptrTy), 2130 ConstantInt::get(IntptrTy, Align)); 2131 2132 // Insert __asan_alloca_poison call for new created alloca. 2133 IRB.CreateCall(AsanAllocaPoisonFunc, {NewAddress, OldSize}); 2134 2135 // Store the last alloca's address to DynamicAllocaLayout. We'll need this 2136 // for unpoisoning stuff. 2137 IRB.CreateStore(IRB.CreatePtrToInt(NewAlloca, IntptrTy), DynamicAllocaLayout); 2138 2139 Value *NewAddressPtr = IRB.CreateIntToPtr(NewAddress, AI->getType()); 2140 2141 // Replace all uses of AddessReturnedByAlloca with NewAddressPtr. 2142 AI->replaceAllUsesWith(NewAddressPtr); 2143 2144 // We are done. Erase old alloca from parent. 2145 AI->eraseFromParent(); 2146 } 2147 2148 // isSafeAccess returns true if Addr is always inbounds with respect to its 2149 // base object. For example, it is a field access or an array access with 2150 // constant inbounds index. 2151 bool AddressSanitizer::isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, 2152 Value *Addr, uint64_t TypeSize) const { 2153 SizeOffsetType SizeOffset = ObjSizeVis.compute(Addr); 2154 if (!ObjSizeVis.bothKnown(SizeOffset)) return false; 2155 uint64_t Size = SizeOffset.first.getZExtValue(); 2156 int64_t Offset = SizeOffset.second.getSExtValue(); 2157 // Three checks are required to ensure safety: 2158 // . Offset >= 0 (since the offset is given from the base ptr) 2159 // . Size >= Offset (unsigned) 2160 // . Size - Offset >= NeededSize (unsigned) 2161 return Offset >= 0 && Size >= uint64_t(Offset) && 2162 Size - uint64_t(Offset) >= TypeSize / 8; 2163 } 2164
