1/* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2017 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
4
5This file is part of GCC.
6
7GCC is free software; you can redistribute it and/or modify it under
8the terms of the GNU General Public License as published by the Free
9Software Foundation; either version 3, or (at your option) any later
10version.
11
12GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13WARRANTY; without even the implied warranty of MERCHANTABILITY or
14FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15for more details.
16
17You should have received a copy of the GNU General Public License
18along with GCC; see the file COPYING3. If not see
19<http://www.gnu.org/licenses/>. */
20
21
22#include "config.h"
23#include "system.h"
24#include "coretypes.h"
25#include "backend.h"
26#include "target.h"
27#include "rtl.h"
28#include "tree.h"
29#include "gimple.h"
30#include "cfghooks.h"
31#include "alloc-pool.h"
32#include "tree-pass.h"
33#include "memmodel.h"
34#include "tm_p.h"
35#include "ssa.h"
36#include "stringpool.h"
37#include "tree-ssanames.h"
38#include "optabs.h"
39#include "emit-rtl.h"
40#include "cgraph.h"
41#include "gimple-pretty-print.h"
42#include "alias.h"
43#include "fold-const.h"
44#include "cfganal.h"
45#include "gimplify.h"
46#include "gimple-iterator.h"
47#include "varasm.h"
48#include "stor-layout.h"
49#include "tree-iterator.h"
50#include "stringpool.h"
51#include "attribs.h"
52#include "asan.h"
53#include "dojump.h"
54#include "explow.h"
55#include "expr.h"
56#include "output.h"
57#include "langhooks.h"
58#include "cfgloop.h"
59#include "gimple-builder.h"
60#include "gimple-fold.h"
61#include "ubsan.h"
62#include "params.h"
63#include "builtins.h"
64#include "fnmatch.h"
65#include "tree-inline.h"
66
67/* AddressSanitizer finds out-of-bounds and use-after-free bugs
68 with <2x slowdown on average.
69
70 The tool consists of two parts:
71 instrumentation module (this file) and a run-time library.
72 The instrumentation module adds a run-time check before every memory insn.
73 For a 8- or 16- byte load accessing address X:
74 ShadowAddr = (X >> 3) + Offset
75 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
76 if (ShadowValue)
77 __asan_report_load8(X);
78 For a load of N bytes (N=1, 2 or 4) from address X:
79 ShadowAddr = (X >> 3) + Offset
80 ShadowValue = *(char*)ShadowAddr;
81 if (ShadowValue)
82 if ((X & 7) + N - 1 > ShadowValue)
83 __asan_report_loadN(X);
84 Stores are instrumented similarly, but using __asan_report_storeN functions.
85 A call too __asan_init_vN() is inserted to the list of module CTORs.
86 N is the version number of the AddressSanitizer API. The changes between the
87 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
88
89 The run-time library redefines malloc (so that redzone are inserted around
90 the allocated memory) and free (so that reuse of free-ed memory is delayed),
91 provides __asan_report* and __asan_init_vN functions.
92
93 Read more:
94 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
95
96 The current implementation supports detection of out-of-bounds and
97 use-after-free in the heap, on the stack and for global variables.
98
99 [Protection of stack variables]
100
101 To understand how detection of out-of-bounds and use-after-free works
102 for stack variables, lets look at this example on x86_64 where the
103 stack grows downward:
104
105 int
106 foo ()
107 {
108 char a[23] = {0};
109 int b[2] = {0};
110
111 a[5] = 1;
112 b[1] = 2;
113
114 return a[5] + b[1];
115 }
116
117 For this function, the stack protected by asan will be organized as
118 follows, from the top of the stack to the bottom:
119
120 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
121
122 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
123 the next slot be 32 bytes aligned; this one is called Partial
124 Redzone; this 32 bytes alignment is an asan constraint]
125
126 Slot 3/ [24 bytes for variable 'a']
127
128 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
129
130 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
131
132 Slot 6/ [8 bytes for variable 'b']
133
134 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
135 'LEFT RedZone']
136
137 The 32 bytes of LEFT red zone at the bottom of the stack can be
138 decomposed as such:
139
140 1/ The first 8 bytes contain a magical asan number that is always
141 0x41B58AB3.
142
143 2/ The following 8 bytes contains a pointer to a string (to be
144 parsed at runtime by the runtime asan library), which format is
145 the following:
146
147 "<function-name> <space> <num-of-variables-on-the-stack>
148 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
149 <length-of-var-in-bytes> ){n} "
150
151 where '(...){n}' means the content inside the parenthesis occurs 'n'
152 times, with 'n' being the number of variables on the stack.
153
154 3/ The following 8 bytes contain the PC of the current function which
155 will be used by the run-time library to print an error message.
156
157 4/ The following 8 bytes are reserved for internal use by the run-time.
158
159 The shadow memory for that stack layout is going to look like this:
160
161 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
162 The F1 byte pattern is a magic number called
163 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
164 the memory for that shadow byte is part of a the LEFT red zone
165 intended to seat at the bottom of the variables on the stack.
166
167 - content of shadow memory 8 bytes for slots 6 and 5:
168 0xF4F4F400. The F4 byte pattern is a magic number
169 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
170 memory region for this shadow byte is a PARTIAL red zone
171 intended to pad a variable A, so that the slot following
172 {A,padding} is 32 bytes aligned.
173
174 Note that the fact that the least significant byte of this
175 shadow memory content is 00 means that 8 bytes of its
176 corresponding memory (which corresponds to the memory of
177 variable 'b') is addressable.
178
179 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
180 The F2 byte pattern is a magic number called
181 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
182 region for this shadow byte is a MIDDLE red zone intended to
183 seat between two 32 aligned slots of {variable,padding}.
184
185 - content of shadow memory 8 bytes for slot 3 and 2:
186 0xF4000000. This represents is the concatenation of
187 variable 'a' and the partial red zone following it, like what we
188 had for variable 'b'. The least significant 3 bytes being 00
189 means that the 3 bytes of variable 'a' are addressable.
190
191 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
192 The F3 byte pattern is a magic number called
193 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
194 region for this shadow byte is a RIGHT red zone intended to seat
195 at the top of the variables of the stack.
196
197 Note that the real variable layout is done in expand_used_vars in
198 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
199 stack variables as well as the different red zones, emits some
200 prologue code to populate the shadow memory as to poison (mark as
201 non-accessible) the regions of the red zones and mark the regions of
202 stack variables as accessible, and emit some epilogue code to
203 un-poison (mark as accessible) the regions of red zones right before
204 the function exits.
205
206 [Protection of global variables]
207
208 The basic idea is to insert a red zone between two global variables
209 and install a constructor function that calls the asan runtime to do
210 the populating of the relevant shadow memory regions at load time.
211
212 So the global variables are laid out as to insert a red zone between
213 them. The size of the red zones is so that each variable starts on a
214 32 bytes boundary.
215
216 Then a constructor function is installed so that, for each global
217 variable, it calls the runtime asan library function
218 __asan_register_globals_with an instance of this type:
219
220 struct __asan_global
221 {
222 // Address of the beginning of the global variable.
223 const void *__beg;
224
225 // Initial size of the global variable.
226 uptr __size;
227
228 // Size of the global variable + size of the red zone. This
229 // size is 32 bytes aligned.
230 uptr __size_with_redzone;
231
232 // Name of the global variable.
233 const void *__name;
234
235 // Name of the module where the global variable is declared.
236 const void *__module_name;
237
238 // 1 if it has dynamic initialization, 0 otherwise.
239 uptr __has_dynamic_init;
240
241 // A pointer to struct that contains source location, could be NULL.
242 __asan_global_source_location *__location;
243 }
244
245 A destructor function that calls the runtime asan library function
246 _asan_unregister_globals is also installed. */
247
248static unsigned HOST_WIDE_INT asan_shadow_offset_value;
249static bool asan_shadow_offset_computed;
250static vec<char *> sanitized_sections;
251static tree last_alloca_addr;
252
253/* Set of variable declarations that are going to be guarded by
254 use-after-scope sanitizer. */
255
256static hash_set<tree> *asan_handled_variables = NULL;
257
258hash_set <tree> *asan_used_labels = NULL;
259
260/* Sets shadow offset to value in string VAL. */
261
262bool
263set_asan_shadow_offset (const char *val)
264{
265 char *endp;
266
267 errno = 0;
268#ifdef HAVE_LONG_LONG
269 asan_shadow_offset_value = strtoull (val, &endp, 0);
270#else
271 asan_shadow_offset_value = strtoul (val, &endp, 0);
272#endif
273 if (!(*val != '\0' && *endp == '\0' && errno == 0))
274 return false;
275
276 asan_shadow_offset_computed = true;
277
278 return true;
279}
280
281/* Set list of user-defined sections that need to be sanitized. */
282
283void
284set_sanitized_sections (const char *sections)
285{
286 char *pat;
287 unsigned i;
288 FOR_EACH_VEC_ELT (sanitized_sections, i, pat)
289 free (pat);
290 sanitized_sections.truncate (0);
291
292 for (const char *s = sections; *s; )
293 {
294 const char *end;
295 for (end = s; *end && *end != ','; ++end);
296 size_t len = end - s;
297 sanitized_sections.safe_push (xstrndup (s, len));
298 s = *end ? end + 1 : end;
299 }
300}
301
302bool
303asan_mark_p (gimple *stmt, enum asan_mark_flags flag)
304{
305 return (gimple_call_internal_p (stmt, IFN_ASAN_MARK)
306 && tree_to_uhwi (gimple_call_arg (stmt, 0)) == flag);
307}
308
309bool
310asan_sanitize_stack_p (void)
311{
312 return (sanitize_flags_p (SANITIZE_ADDRESS) && ASAN_STACK);
313}
314
315bool
316asan_sanitize_allocas_p (void)
317{
318 return (asan_sanitize_stack_p () && ASAN_PROTECT_ALLOCAS);
319}
320
321/* Checks whether section SEC should be sanitized. */
322
323static bool
324section_sanitized_p (const char *sec)
325{
326 char *pat;
327 unsigned i;
328 FOR_EACH_VEC_ELT (sanitized_sections, i, pat)
329 if (fnmatch (pat, sec, FNM_PERIOD) == 0)
330 return true;
331 return false;
332}
333
334/* Returns Asan shadow offset. */
335
336static unsigned HOST_WIDE_INT
337asan_shadow_offset ()
338{
339 if (!asan_shadow_offset_computed)
340 {
341 asan_shadow_offset_computed = true;
342 asan_shadow_offset_value = targetm.asan_shadow_offset ();
343 }
344 return asan_shadow_offset_value;
345}
346
347alias_set_type asan_shadow_set = -1;
348
349/* Pointer types to 1, 2 or 4 byte integers in shadow memory. A separate
350 alias set is used for all shadow memory accesses. */
351static GTY(()) tree shadow_ptr_types[3];
352
353/* Decl for __asan_option_detect_stack_use_after_return. */
354static GTY(()) tree asan_detect_stack_use_after_return;
355
356/* Hashtable support for memory references used by gimple
357 statements. */
358
359/* This type represents a reference to a memory region. */
360struct asan_mem_ref
361{
362 /* The expression of the beginning of the memory region. */
363 tree start;
364
365 /* The size of the access. */
366 HOST_WIDE_INT access_size;
367};
368
369object_allocator <asan_mem_ref> asan_mem_ref_pool ("asan_mem_ref");
370
371/* Initializes an instance of asan_mem_ref. */
372
373static void
374asan_mem_ref_init (asan_mem_ref *ref, tree start, HOST_WIDE_INT access_size)
375{
376 ref->start = start;
377 ref->access_size = access_size;
378}
379
380/* Allocates memory for an instance of asan_mem_ref into the memory
381 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
382 START is the address of (or the expression pointing to) the
383 beginning of memory reference. ACCESS_SIZE is the size of the
384 access to the referenced memory. */
385
386static asan_mem_ref*
387asan_mem_ref_new (tree start, HOST_WIDE_INT access_size)
388{
389 asan_mem_ref *ref = asan_mem_ref_pool.allocate ();
390
391 asan_mem_ref_init (ref, start, access_size);
392 return ref;
393}
394
395/* This builds and returns a pointer to the end of the memory region
396 that starts at START and of length LEN. */
397
398tree
399asan_mem_ref_get_end (tree start, tree len)
400{
401 if (len == NULL_TREE || integer_zerop (len))
402 return start;
403
404 if (!ptrofftype_p (len))
405 len = convert_to_ptrofftype (len);
406
407 return fold_build2 (POINTER_PLUS_EXPR, TREE_TYPE (start), start, len);
408}
409
410/* Return a tree expression that represents the end of the referenced
411 memory region. Beware that this function can actually build a new
412 tree expression. */
413
414tree
415asan_mem_ref_get_end (const asan_mem_ref *ref, tree len)
416{
417 return asan_mem_ref_get_end (ref->start, len);
418}
419
420struct asan_mem_ref_hasher : nofree_ptr_hash <asan_mem_ref>
421{
422 static inline hashval_t hash (const asan_mem_ref *);
423 static inline bool equal (const asan_mem_ref *, const asan_mem_ref *);
424};
425
426/* Hash a memory reference. */
427
428inline hashval_t
429asan_mem_ref_hasher::hash (const asan_mem_ref *mem_ref)
430{
431 return iterative_hash_expr (mem_ref->start, 0);
432}
433
434/* Compare two memory references. We accept the length of either
435 memory references to be NULL_TREE. */
436
437inline bool
438asan_mem_ref_hasher::equal (const asan_mem_ref *m1,
439 const asan_mem_ref *m2)
440{
441 return operand_equal_p (m1->start, m2->start, 0);
442}
443
444static hash_table<asan_mem_ref_hasher> *asan_mem_ref_ht;
445
446/* Returns a reference to the hash table containing memory references.
447 This function ensures that the hash table is created. Note that
448 this hash table is updated by the function
449 update_mem_ref_hash_table. */
450
451static hash_table<asan_mem_ref_hasher> *
452get_mem_ref_hash_table ()
453{
454 if (!asan_mem_ref_ht)
455 asan_mem_ref_ht = new hash_table<asan_mem_ref_hasher> (10);
456
457 return asan_mem_ref_ht;
458}
459
460/* Clear all entries from the memory references hash table. */
461
462static void
463empty_mem_ref_hash_table ()
464{
465 if (asan_mem_ref_ht)
466 asan_mem_ref_ht->empty ();
467}
468
469/* Free the memory references hash table. */
470
471static void
472free_mem_ref_resources ()
473{
474 delete asan_mem_ref_ht;
475 asan_mem_ref_ht = NULL;
476
477 asan_mem_ref_pool.release ();
478}
479
480/* Return true iff the memory reference REF has been instrumented. */
481
482static bool
483has_mem_ref_been_instrumented (tree ref, HOST_WIDE_INT access_size)
484{
485 asan_mem_ref r;
486 asan_mem_ref_init (&r, ref, access_size);
487
488 asan_mem_ref *saved_ref = get_mem_ref_hash_table ()->find (&r);
489 return saved_ref && saved_ref->access_size >= access_size;
490}
491
492/* Return true iff the memory reference REF has been instrumented. */
493
494static bool
495has_mem_ref_been_instrumented (const asan_mem_ref *ref)
496{
497 return has_mem_ref_been_instrumented (ref->start, ref->access_size);
498}
499
500/* Return true iff access to memory region starting at REF and of
501 length LEN has been instrumented. */
502
503static bool
504has_mem_ref_been_instrumented (const asan_mem_ref *ref, tree len)
505{
506 HOST_WIDE_INT size_in_bytes
507 = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
508
509 return size_in_bytes != -1
510 && has_mem_ref_been_instrumented (ref->start, size_in_bytes);
511}
512
513/* Set REF to the memory reference present in a gimple assignment
514 ASSIGNMENT. Return true upon successful completion, false
515 otherwise. */
516
517static bool
518get_mem_ref_of_assignment (const gassign *assignment,
519 asan_mem_ref *ref,
520 bool *ref_is_store)
521{
522 gcc_assert (gimple_assign_single_p (assignment));
523
524 if (gimple_store_p (assignment)
525 && !gimple_clobber_p (assignment))
526 {
527 ref->start = gimple_assign_lhs (assignment);
528 *ref_is_store = true;
529 }
530 else if (gimple_assign_load_p (assignment))
531 {
532 ref->start = gimple_assign_rhs1 (assignment);
533 *ref_is_store = false;
534 }
535 else
536 return false;
537
538 ref->access_size = int_size_in_bytes (TREE_TYPE (ref->start));
539 return true;
540}
541
542/* Return address of last allocated dynamic alloca. */
543
544static tree
545get_last_alloca_addr ()
546{
547 if (last_alloca_addr)
548 return last_alloca_addr;
549
550 last_alloca_addr = create_tmp_reg (ptr_type_node, "last_alloca_addr");
551 gassign *g = gimple_build_assign (last_alloca_addr, null_pointer_node);
552 edge e = single_succ_edge (ENTRY_BLOCK_PTR_FOR_FN (cfun));
553 gsi_insert_on_edge_immediate (e, g);
554 return last_alloca_addr;
555}
556
557/* Insert __asan_allocas_unpoison (top, bottom) call after
558 __builtin_stack_restore (new_sp) call.
559 The pseudocode of this routine should look like this:
560 __builtin_stack_restore (new_sp);
561 top = last_alloca_addr;
562 bot = new_sp;
563 __asan_allocas_unpoison (top, bot);
564 last_alloca_addr = new_sp;
565 In general, we can't use new_sp as bot parameter because on some
566 architectures SP has non zero offset from dynamic stack area. Moreover, on
567 some architectures this offset (STACK_DYNAMIC_OFFSET) becomes known for each
568 particular function only after all callees were expanded to rtl.
569 The most noticeable example is PowerPC{,64}, see
570 http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html#DYNAM-STACK.
571 To overcome the issue we use following trick: pass new_sp as a second
572 parameter to __asan_allocas_unpoison and rewrite it during expansion with
573 virtual_dynamic_stack_rtx later in expand_asan_emit_allocas_unpoison
574 function.
575*/
576
577static void
578handle_builtin_stack_restore (gcall *call, gimple_stmt_iterator *iter)
579{
580 if (!iter || !asan_sanitize_allocas_p ())
581 return;
582
583 tree last_alloca = get_last_alloca_addr ();
584 tree restored_stack = gimple_call_arg (call, 0);
585 tree fn = builtin_decl_implicit (BUILT_IN_ASAN_ALLOCAS_UNPOISON);
586 gimple *g = gimple_build_call (fn, 2, last_alloca, restored_stack);
587 gsi_insert_after (iter, g, GSI_NEW_STMT);
588 g = gimple_build_assign (last_alloca, restored_stack);
589 gsi_insert_after (iter, g, GSI_NEW_STMT);
590}
591
592/* Deploy and poison redzones around __builtin_alloca call. To do this, we
593 should replace this call with another one with changed parameters and
594 replace all its uses with new address, so
595 addr = __builtin_alloca (old_size, align);
596 is replaced by
597 left_redzone_size = max (align, ASAN_RED_ZONE_SIZE);
598 Following two statements are optimized out if we know that
599 old_size & (ASAN_RED_ZONE_SIZE - 1) == 0, i.e. alloca doesn't need partial
600 redzone.
601 misalign = old_size & (ASAN_RED_ZONE_SIZE - 1);
602 partial_redzone_size = ASAN_RED_ZONE_SIZE - misalign;
603 right_redzone_size = ASAN_RED_ZONE_SIZE;
604 additional_size = left_redzone_size + partial_redzone_size +
605 right_redzone_size;
606 new_size = old_size + additional_size;
607 new_alloca = __builtin_alloca (new_size, max (align, 32))
608 __asan_alloca_poison (new_alloca, old_size)
609 addr = new_alloca + max (align, ASAN_RED_ZONE_SIZE);
610 last_alloca_addr = new_alloca;
611 ADDITIONAL_SIZE is added to make new memory allocation contain not only
612 requested memory, but also left, partial and right redzones as well as some
613 additional space, required by alignment. */
614
615static void
616handle_builtin_alloca (gcall *call, gimple_stmt_iterator *iter)
617{
618 if (!iter || !asan_sanitize_allocas_p ())
619 return;
620
621 gassign *g;
622 gcall *gg;
623 const HOST_WIDE_INT redzone_mask = ASAN_RED_ZONE_SIZE - 1;
624
625 tree last_alloca = get_last_alloca_addr ();
626 tree callee = gimple_call_fndecl (call);
627 tree old_size = gimple_call_arg (call, 0);
628 tree ptr_type = gimple_call_lhs (call) ? TREE_TYPE (gimple_call_lhs (call))
629 : ptr_type_node;
630 tree partial_size = NULL_TREE;
631 unsigned int align
632 = DECL_FUNCTION_CODE (callee) == BUILT_IN_ALLOCA
633 ? 0 : tree_to_uhwi (gimple_call_arg (call, 1));
634
635 /* If ALIGN > ASAN_RED_ZONE_SIZE, we embed left redzone into first ALIGN
636 bytes of allocated space. Otherwise, align alloca to ASAN_RED_ZONE_SIZE
637 manually. */
638 align = MAX (align, ASAN_RED_ZONE_SIZE * BITS_PER_UNIT);
639
640 tree alloca_rz_mask = build_int_cst (size_type_node, redzone_mask);
641 tree redzone_size = build_int_cst (size_type_node, ASAN_RED_ZONE_SIZE);
642
643 /* Extract lower bits from old_size. */
644 wide_int size_nonzero_bits = get_nonzero_bits (old_size);
645 wide_int rz_mask
646 = wi::uhwi (redzone_mask, wi::get_precision (size_nonzero_bits));
647 wide_int old_size_lower_bits = wi::bit_and (size_nonzero_bits, rz_mask);
648
649 /* If alloca size is aligned to ASAN_RED_ZONE_SIZE, we don't need partial
650 redzone. Otherwise, compute its size here. */
651 if (wi::ne_p (old_size_lower_bits, 0))
652 {
653 /* misalign = size & (ASAN_RED_ZONE_SIZE - 1)
654 partial_size = ASAN_RED_ZONE_SIZE - misalign. */
655 g = gimple_build_assign (make_ssa_name (size_type_node, NULL),
656 BIT_AND_EXPR, old_size, alloca_rz_mask);
657 gsi_insert_before (iter, g, GSI_SAME_STMT);
658 tree misalign = gimple_assign_lhs (g);
659 g = gimple_build_assign (make_ssa_name (size_type_node, NULL), MINUS_EXPR,
660 redzone_size, misalign);
661 gsi_insert_before (iter, g, GSI_SAME_STMT);
662 partial_size = gimple_assign_lhs (g);
663 }
664
665 /* additional_size = align + ASAN_RED_ZONE_SIZE. */
666 tree additional_size = build_int_cst (size_type_node, align / BITS_PER_UNIT
667 + ASAN_RED_ZONE_SIZE);
668 /* If alloca has partial redzone, include it to additional_size too. */
669 if (partial_size)
670 {
671 /* additional_size += partial_size. */
672 g = gimple_build_assign (make_ssa_name (size_type_node), PLUS_EXPR,
673 partial_size, additional_size);
674 gsi_insert_before (iter, g, GSI_SAME_STMT);
675 additional_size = gimple_assign_lhs (g);
676 }
677
678 /* new_size = old_size + additional_size. */
679 g = gimple_build_assign (make_ssa_name (size_type_node), PLUS_EXPR, old_size,
680 additional_size);
681 gsi_insert_before (iter, g, GSI_SAME_STMT);
682 tree new_size = gimple_assign_lhs (g);
683
684 /* Build new __builtin_alloca call:
685 new_alloca_with_rz = __builtin_alloca (new_size, align). */
686 tree fn = builtin_decl_implicit (BUILT_IN_ALLOCA_WITH_ALIGN);
687 gg = gimple_build_call (fn, 2, new_size,
688 build_int_cst (size_type_node, align));
689 tree new_alloca_with_rz = make_ssa_name (ptr_type, gg);
690 gimple_call_set_lhs (gg, new_alloca_with_rz);
691 gsi_insert_before (iter, gg, GSI_SAME_STMT);
692
693 /* new_alloca = new_alloca_with_rz + align. */
694 g = gimple_build_assign (make_ssa_name (ptr_type), POINTER_PLUS_EXPR,
695 new_alloca_with_rz,
696 build_int_cst (size_type_node,
697 align / BITS_PER_UNIT));
698 gsi_insert_before (iter, g, GSI_SAME_STMT);
699 tree new_alloca = gimple_assign_lhs (g);
700
701 /* Poison newly created alloca redzones:
702 __asan_alloca_poison (new_alloca, old_size). */
703 fn = builtin_decl_implicit (BUILT_IN_ASAN_ALLOCA_POISON);
704 gg = gimple_build_call (fn, 2, new_alloca, old_size);
705 gsi_insert_before (iter, gg, GSI_SAME_STMT);
706
707 /* Save new_alloca_with_rz value into last_alloca to use it during
708 allocas unpoisoning. */
709 g = gimple_build_assign (last_alloca, new_alloca_with_rz);
710 gsi_insert_before (iter, g, GSI_SAME_STMT);
711
712 /* Finally, replace old alloca ptr with NEW_ALLOCA. */
713 replace_call_with_value (iter, new_alloca);
714}
715
716/* Return the memory references contained in a gimple statement
717 representing a builtin call that has to do with memory access. */
718
719static bool
720get_mem_refs_of_builtin_call (gcall *call,
721 asan_mem_ref *src0,
722 tree *src0_len,
723 bool *src0_is_store,
724 asan_mem_ref *src1,
725 tree *src1_len,
726 bool *src1_is_store,
727 asan_mem_ref *dst,
728 tree *dst_len,
729 bool *dst_is_store,
730 bool *dest_is_deref,
731 bool *intercepted_p,
732 gimple_stmt_iterator *iter = NULL)
733{
734 gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL));
735
736 tree callee = gimple_call_fndecl (call);
737 tree source0 = NULL_TREE, source1 = NULL_TREE,
738 dest = NULL_TREE, len = NULL_TREE;
739 bool is_store = true, got_reference_p = false;
740 HOST_WIDE_INT access_size = 1;
741
742 *intercepted_p = asan_intercepted_p ((DECL_FUNCTION_CODE (callee)));
743
744 switch (DECL_FUNCTION_CODE (callee))
745 {
746 /* (s, s, n) style memops. */
747 case BUILT_IN_BCMP:
748 case BUILT_IN_MEMCMP:
749 source0 = gimple_call_arg (call, 0);
750 source1 = gimple_call_arg (call, 1);
751 len = gimple_call_arg (call, 2);
752 break;
753
754 /* (src, dest, n) style memops. */
755 case BUILT_IN_BCOPY:
756 source0 = gimple_call_arg (call, 0);
757 dest = gimple_call_arg (call, 1);
758 len = gimple_call_arg (call, 2);
759 break;
760
761 /* (dest, src, n) style memops. */
762 case BUILT_IN_MEMCPY:
763 case BUILT_IN_MEMCPY_CHK:
764 case BUILT_IN_MEMMOVE:
765 case BUILT_IN_MEMMOVE_CHK:
766 case BUILT_IN_MEMPCPY:
767 case BUILT_IN_MEMPCPY_CHK:
768 dest = gimple_call_arg (call, 0);
769 source0 = gimple_call_arg (call, 1);
770 len = gimple_call_arg (call, 2);
771 break;
772
773 /* (dest, n) style memops. */
774 case BUILT_IN_BZERO:
775 dest = gimple_call_arg (call, 0);
776 len = gimple_call_arg (call, 1);
777 break;
778
779 /* (dest, x, n) style memops*/
780 case BUILT_IN_MEMSET:
781 case BUILT_IN_MEMSET_CHK:
782 dest = gimple_call_arg (call, 0);
783 len = gimple_call_arg (call, 2);
784 break;
785
786 case BUILT_IN_STRLEN:
787 source0 = gimple_call_arg (call, 0);
788 len = gimple_call_lhs (call);
789 break;
790
791 case BUILT_IN_STACK_RESTORE:
792 handle_builtin_stack_restore (call, iter);
793 break;
794
795 CASE_BUILT_IN_ALLOCA:
796 handle_builtin_alloca (call, iter);
797 break;
798 /* And now the __atomic* and __sync builtins.
799 These are handled differently from the classical memory memory
800 access builtins above. */
801
802 case BUILT_IN_ATOMIC_LOAD_1:
803 is_store = false;
804 /* FALLTHRU */
805 case BUILT_IN_SYNC_FETCH_AND_ADD_1:
806 case BUILT_IN_SYNC_FETCH_AND_SUB_1:
807 case BUILT_IN_SYNC_FETCH_AND_OR_1:
808 case BUILT_IN_SYNC_FETCH_AND_AND_1:
809 case BUILT_IN_SYNC_FETCH_AND_XOR_1:
810 case BUILT_IN_SYNC_FETCH_AND_NAND_1:
811 case BUILT_IN_SYNC_ADD_AND_FETCH_1:
812 case BUILT_IN_SYNC_SUB_AND_FETCH_1:
813 case BUILT_IN_SYNC_OR_AND_FETCH_1:
814 case BUILT_IN_SYNC_AND_AND_FETCH_1:
815 case BUILT_IN_SYNC_XOR_AND_FETCH_1:
816 case BUILT_IN_SYNC_NAND_AND_FETCH_1:
817 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1:
818 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1:
819 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1:
820 case BUILT_IN_SYNC_LOCK_RELEASE_1:
821 case BUILT_IN_ATOMIC_EXCHANGE_1:
822 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1:
823 case BUILT_IN_ATOMIC_STORE_1:
824 case BUILT_IN_ATOMIC_ADD_FETCH_1:
825 case BUILT_IN_ATOMIC_SUB_FETCH_1:
826 case BUILT_IN_ATOMIC_AND_FETCH_1:
827 case BUILT_IN_ATOMIC_NAND_FETCH_1:
828 case BUILT_IN_ATOMIC_XOR_FETCH_1:
829 case BUILT_IN_ATOMIC_OR_FETCH_1:
830 case BUILT_IN_ATOMIC_FETCH_ADD_1:
831 case BUILT_IN_ATOMIC_FETCH_SUB_1:
832 case BUILT_IN_ATOMIC_FETCH_AND_1:
833 case BUILT_IN_ATOMIC_FETCH_NAND_1:
834 case BUILT_IN_ATOMIC_FETCH_XOR_1:
835 case BUILT_IN_ATOMIC_FETCH_OR_1:
836 access_size = 1;
837 goto do_atomic;
838
839 case BUILT_IN_ATOMIC_LOAD_2:
840 is_store = false;
841 /* FALLTHRU */
842 case BUILT_IN_SYNC_FETCH_AND_ADD_2:
843 case BUILT_IN_SYNC_FETCH_AND_SUB_2:
844 case BUILT_IN_SYNC_FETCH_AND_OR_2:
845 case BUILT_IN_SYNC_FETCH_AND_AND_2:
846 case BUILT_IN_SYNC_FETCH_AND_XOR_2:
847 case BUILT_IN_SYNC_FETCH_AND_NAND_2:
848 case BUILT_IN_SYNC_ADD_AND_FETCH_2:
849 case BUILT_IN_SYNC_SUB_AND_FETCH_2:
850 case BUILT_IN_SYNC_OR_AND_FETCH_2:
851 case BUILT_IN_SYNC_AND_AND_FETCH_2:
852 case BUILT_IN_SYNC_XOR_AND_FETCH_2:
853 case BUILT_IN_SYNC_NAND_AND_FETCH_2:
854 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2:
855 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2:
856 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2:
857 case BUILT_IN_SYNC_LOCK_RELEASE_2:
858 case BUILT_IN_ATOMIC_EXCHANGE_2:
859 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2:
860 case BUILT_IN_ATOMIC_STORE_2:
861 case BUILT_IN_ATOMIC_ADD_FETCH_2:
862 case BUILT_IN_ATOMIC_SUB_FETCH_2:
863 case BUILT_IN_ATOMIC_AND_FETCH_2:
864 case BUILT_IN_ATOMIC_NAND_FETCH_2:
865 case BUILT_IN_ATOMIC_XOR_FETCH_2:
866 case BUILT_IN_ATOMIC_OR_FETCH_2:
867 case BUILT_IN_ATOMIC_FETCH_ADD_2:
868 case BUILT_IN_ATOMIC_FETCH_SUB_2:
869 case BUILT_IN_ATOMIC_FETCH_AND_2:
870 case BUILT_IN_ATOMIC_FETCH_NAND_2:
871 case BUILT_IN_ATOMIC_FETCH_XOR_2:
872 case BUILT_IN_ATOMIC_FETCH_OR_2:
873 access_size = 2;
874 goto do_atomic;
875
876 case BUILT_IN_ATOMIC_LOAD_4:
877 is_store = false;
878 /* FALLTHRU */
879 case BUILT_IN_SYNC_FETCH_AND_ADD_4:
880 case BUILT_IN_SYNC_FETCH_AND_SUB_4:
881 case BUILT_IN_SYNC_FETCH_AND_OR_4:
882 case BUILT_IN_SYNC_FETCH_AND_AND_4:
883 case BUILT_IN_SYNC_FETCH_AND_XOR_4:
884 case BUILT_IN_SYNC_FETCH_AND_NAND_4:
885 case BUILT_IN_SYNC_ADD_AND_FETCH_4:
886 case BUILT_IN_SYNC_SUB_AND_FETCH_4:
887 case BUILT_IN_SYNC_OR_AND_FETCH_4:
888 case BUILT_IN_SYNC_AND_AND_FETCH_4:
889 case BUILT_IN_SYNC_XOR_AND_FETCH_4:
890 case BUILT_IN_SYNC_NAND_AND_FETCH_4:
891 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4:
892 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4:
893 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4:
894 case BUILT_IN_SYNC_LOCK_RELEASE_4:
895 case BUILT_IN_ATOMIC_EXCHANGE_4:
896 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4:
897 case BUILT_IN_ATOMIC_STORE_4:
898 case BUILT_IN_ATOMIC_ADD_FETCH_4:
899 case BUILT_IN_ATOMIC_SUB_FETCH_4:
900 case BUILT_IN_ATOMIC_AND_FETCH_4:
901 case BUILT_IN_ATOMIC_NAND_FETCH_4:
902 case BUILT_IN_ATOMIC_XOR_FETCH_4:
903 case BUILT_IN_ATOMIC_OR_FETCH_4:
904 case BUILT_IN_ATOMIC_FETCH_ADD_4:
905 case BUILT_IN_ATOMIC_FETCH_SUB_4:
906 case BUILT_IN_ATOMIC_FETCH_AND_4:
907 case BUILT_IN_ATOMIC_FETCH_NAND_4:
908 case BUILT_IN_ATOMIC_FETCH_XOR_4:
909 case BUILT_IN_ATOMIC_FETCH_OR_4:
910 access_size = 4;
911 goto do_atomic;
912
913 case BUILT_IN_ATOMIC_LOAD_8:
914 is_store = false;
915 /* FALLTHRU */
916 case BUILT_IN_SYNC_FETCH_AND_ADD_8:
917 case BUILT_IN_SYNC_FETCH_AND_SUB_8:
918 case BUILT_IN_SYNC_FETCH_AND_OR_8:
919 case BUILT_IN_SYNC_FETCH_AND_AND_8:
920 case BUILT_IN_SYNC_FETCH_AND_XOR_8:
921 case BUILT_IN_SYNC_FETCH_AND_NAND_8:
922 case BUILT_IN_SYNC_ADD_AND_FETCH_8:
923 case BUILT_IN_SYNC_SUB_AND_FETCH_8:
924 case BUILT_IN_SYNC_OR_AND_FETCH_8:
925 case BUILT_IN_SYNC_AND_AND_FETCH_8:
926 case BUILT_IN_SYNC_XOR_AND_FETCH_8:
927 case BUILT_IN_SYNC_NAND_AND_FETCH_8:
928 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8:
929 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8:
930 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8:
931 case BUILT_IN_SYNC_LOCK_RELEASE_8:
932 case BUILT_IN_ATOMIC_EXCHANGE_8:
933 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8:
934 case BUILT_IN_ATOMIC_STORE_8:
935 case BUILT_IN_ATOMIC_ADD_FETCH_8:
936 case BUILT_IN_ATOMIC_SUB_FETCH_8:
937 case BUILT_IN_ATOMIC_AND_FETCH_8:
938 case BUILT_IN_ATOMIC_NAND_FETCH_8:
939 case BUILT_IN_ATOMIC_XOR_FETCH_8:
940 case BUILT_IN_ATOMIC_OR_FETCH_8:
941 case BUILT_IN_ATOMIC_FETCH_ADD_8:
942 case BUILT_IN_ATOMIC_FETCH_SUB_8:
943 case BUILT_IN_ATOMIC_FETCH_AND_8:
944 case BUILT_IN_ATOMIC_FETCH_NAND_8:
945 case BUILT_IN_ATOMIC_FETCH_XOR_8:
946 case BUILT_IN_ATOMIC_FETCH_OR_8:
947 access_size = 8;
948 goto do_atomic;
949
950 case BUILT_IN_ATOMIC_LOAD_16:
951 is_store = false;
952 /* FALLTHRU */
953 case BUILT_IN_SYNC_FETCH_AND_ADD_16:
954 case BUILT_IN_SYNC_FETCH_AND_SUB_16:
955 case BUILT_IN_SYNC_FETCH_AND_OR_16:
956 case BUILT_IN_SYNC_FETCH_AND_AND_16:
957 case BUILT_IN_SYNC_FETCH_AND_XOR_16:
958 case BUILT_IN_SYNC_FETCH_AND_NAND_16:
959 case BUILT_IN_SYNC_ADD_AND_FETCH_16:
960 case BUILT_IN_SYNC_SUB_AND_FETCH_16:
961 case BUILT_IN_SYNC_OR_AND_FETCH_16:
962 case BUILT_IN_SYNC_AND_AND_FETCH_16:
963 case BUILT_IN_SYNC_XOR_AND_FETCH_16:
964 case BUILT_IN_SYNC_NAND_AND_FETCH_16:
965 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16:
966 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16:
967 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16:
968 case BUILT_IN_SYNC_LOCK_RELEASE_16:
969 case BUILT_IN_ATOMIC_EXCHANGE_16:
970 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16:
971 case BUILT_IN_ATOMIC_STORE_16:
972 case BUILT_IN_ATOMIC_ADD_FETCH_16:
973 case BUILT_IN_ATOMIC_SUB_FETCH_16:
974 case BUILT_IN_ATOMIC_AND_FETCH_16:
975 case BUILT_IN_ATOMIC_NAND_FETCH_16:
976 case BUILT_IN_ATOMIC_XOR_FETCH_16:
977 case BUILT_IN_ATOMIC_OR_FETCH_16:
978 case BUILT_IN_ATOMIC_FETCH_ADD_16:
979 case BUILT_IN_ATOMIC_FETCH_SUB_16:
980 case BUILT_IN_ATOMIC_FETCH_AND_16:
981 case BUILT_IN_ATOMIC_FETCH_NAND_16:
982 case BUILT_IN_ATOMIC_FETCH_XOR_16:
983 case BUILT_IN_ATOMIC_FETCH_OR_16:
984 access_size = 16;
985 /* FALLTHRU */
986 do_atomic:
987 {
988 dest = gimple_call_arg (call, 0);
989 /* DEST represents the address of a memory location.
990 instrument_derefs wants the memory location, so lets
991 dereference the address DEST before handing it to
992 instrument_derefs. */
993 tree type = build_nonstandard_integer_type (access_size
994 * BITS_PER_UNIT, 1);
995 dest = build2 (MEM_REF, type, dest,
996 build_int_cst (build_pointer_type (char_type_node), 0));
997 break;
998 }
999
1000 default:
1001 /* The other builtins memory access are not instrumented in this
1002 function because they either don't have any length parameter,
1003 or their length parameter is just a limit. */
1004 break;
1005 }
1006
1007 if (len != NULL_TREE)
1008 {
1009 if (source0 != NULL_TREE)
1010 {
1011 src0->start = source0;
1012 src0->access_size = access_size;
1013 *src0_len = len;
1014 *src0_is_store = false;
1015 }
1016
1017 if (source1 != NULL_TREE)
1018 {
1019 src1->start = source1;
1020 src1->access_size = access_size;
1021 *src1_len = len;
1022 *src1_is_store = false;
1023 }
1024
1025 if (dest != NULL_TREE)
1026 {
1027 dst->start = dest;
1028 dst->access_size = access_size;
1029 *dst_len = len;
1030 *dst_is_store = true;
1031 }
1032
1033 got_reference_p = true;
1034 }
1035 else if (dest)
1036 {
1037 dst->start = dest;
1038 dst->access_size = access_size;
1039 *dst_len = NULL_TREE;
1040 *dst_is_store = is_store;
1041 *dest_is_deref = true;
1042 got_reference_p = true;
1043 }
1044
1045 return got_reference_p;
1046}
1047
1048/* Return true iff a given gimple statement has been instrumented.
1049 Note that the statement is "defined" by the memory references it
1050 contains. */
1051
1052static bool
1053has_stmt_been_instrumented_p (gimple *stmt)
1054{
1055 if (gimple_assign_single_p (stmt))
1056 {
1057 bool r_is_store;
1058 asan_mem_ref r;
1059 asan_mem_ref_init (&r, NULL, 1);
1060
1061 if (get_mem_ref_of_assignment (as_a <gassign *> (stmt), &r,
1062 &r_is_store))
1063 return has_mem_ref_been_instrumented (&r);
1064 }
1065 else if (gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
1066 {
1067 asan_mem_ref src0, src1, dest;
1068 asan_mem_ref_init (&src0, NULL, 1);
1069 asan_mem_ref_init (&src1, NULL, 1);
1070 asan_mem_ref_init (&dest, NULL, 1);
1071
1072 tree src0_len = NULL_TREE, src1_len = NULL_TREE, dest_len = NULL_TREE;
1073 bool src0_is_store = false, src1_is_store = false,
1074 dest_is_store = false, dest_is_deref = false, intercepted_p = true;
1075 if (get_mem_refs_of_builtin_call (as_a <gcall *> (stmt),
1076 &src0, &src0_len, &src0_is_store,
1077 &src1, &src1_len, &src1_is_store,
1078 &dest, &dest_len, &dest_is_store,
1079 &dest_is_deref, &intercepted_p))
1080 {
1081 if (src0.start != NULL_TREE
1082 && !has_mem_ref_been_instrumented (&src0, src0_len))
1083 return false;
1084
1085 if (src1.start != NULL_TREE
1086 && !has_mem_ref_been_instrumented (&src1, src1_len))
1087 return false;
1088
1089 if (dest.start != NULL_TREE
1090 && !has_mem_ref_been_instrumented (&dest, dest_len))
1091 return false;
1092
1093 return true;
1094 }
1095 }
1096 else if (is_gimple_call (stmt) && gimple_store_p (stmt))
1097 {
1098 asan_mem_ref r;
1099 asan_mem_ref_init (&r, NULL, 1);
1100
1101 r.start = gimple_call_lhs (stmt);
1102 r.access_size = int_size_in_bytes (TREE_TYPE (r.start));
1103 return has_mem_ref_been_instrumented (&r);
1104 }
1105
1106 return false;
1107}
1108
1109/* Insert a memory reference into the hash table. */
1110
1111static void
1112update_mem_ref_hash_table (tree ref, HOST_WIDE_INT access_size)
1113{
1114 hash_table<asan_mem_ref_hasher> *ht = get_mem_ref_hash_table ();
1115
1116 asan_mem_ref r;
1117 asan_mem_ref_init (&r, ref, access_size);
1118
1119 asan_mem_ref **slot = ht->find_slot (&r, INSERT);
1120 if (*slot == NULL || (*slot)->access_size < access_size)
1121 *slot = asan_mem_ref_new (ref, access_size);
1122}
1123
1124/* Initialize shadow_ptr_types array. */
1125
1126static void
1127asan_init_shadow_ptr_types (void)
1128{
1129 asan_shadow_set = new_alias_set ();
1130 tree types[3] = { signed_char_type_node, short_integer_type_node,
1131 integer_type_node };
1132
1133 for (unsigned i = 0; i < 3; i++)
1134 {
1135 shadow_ptr_types[i] = build_distinct_type_copy (types[i]);
1136 TYPE_ALIAS_SET (shadow_ptr_types[i]) = asan_shadow_set;
1137 shadow_ptr_types[i] = build_pointer_type (shadow_ptr_types[i]);
1138 }
1139
1140 initialize_sanitizer_builtins ();
1141}
1142
1143/* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
1144
1145static tree
1146asan_pp_string (pretty_printer *pp)
1147{
1148 const char *buf = pp_formatted_text (pp);
1149 size_t len = strlen (buf);
1150 tree ret = build_string (len + 1, buf);
1151 TREE_TYPE (ret)
1152 = build_array_type (TREE_TYPE (shadow_ptr_types[0]),
1153 build_index_type (size_int (len)));
1154 TREE_READONLY (ret) = 1;
1155 TREE_STATIC (ret) = 1;
1156 return build1 (ADDR_EXPR, shadow_ptr_types[0], ret);
1157}
1158
1159/* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
1160
1161static rtx
1162asan_shadow_cst (unsigned char shadow_bytes[4])
1163{
1164 int i;
1165 unsigned HOST_WIDE_INT val = 0;
1166 gcc_assert (WORDS_BIG_ENDIAN == BYTES_BIG_ENDIAN);
1167 for (i = 0; i < 4; i++)
1168 val |= (unsigned HOST_WIDE_INT) shadow_bytes[BYTES_BIG_ENDIAN ? 3 - i : i]
1169 << (BITS_PER_UNIT * i);
1170 return gen_int_mode (val, SImode);
1171}
1172
1173/* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
1174 though. */
1175
1176static void
1177asan_clear_shadow (rtx shadow_mem, HOST_WIDE_INT len)
1178{
1179 rtx_insn *insn, *insns, *jump;
1180 rtx_code_label *top_label;
1181 rtx end, addr, tmp;
1182
1183 start_sequence ();
1184 clear_storage (shadow_mem, GEN_INT (len), BLOCK_OP_NORMAL);
1185 insns = get_insns ();
1186 end_sequence ();
1187 for (insn = insns; insn; insn = NEXT_INSN (insn))
1188 if (CALL_P (insn))
1189 break;
1190 if (insn == NULL_RTX)
1191 {
1192 emit_insn (insns);
1193 return;
1194 }
1195
1196 gcc_assert ((len & 3) == 0);
1197 top_label = gen_label_rtx ();
1198 addr = copy_to_mode_reg (Pmode, XEXP (shadow_mem, 0));
1199 shadow_mem = adjust_automodify_address (shadow_mem, SImode, addr, 0);
1200 end = force_reg (Pmode, plus_constant (Pmode, addr, len));
1201 emit_label (top_label);
1202
1203 emit_move_insn (shadow_mem, const0_rtx);
1204 tmp = expand_simple_binop (Pmode, PLUS, addr, gen_int_mode (4, Pmode), addr,
1205 true, OPTAB_LIB_WIDEN);
1206 if (tmp != addr)
1207 emit_move_insn (addr, tmp);
1208 emit_cmp_and_jump_insns (addr, end, LT, NULL_RTX, Pmode, true, top_label);
1209 jump = get_last_insn ();
1210 gcc_assert (JUMP_P (jump));
1211 add_reg_br_prob_note (jump,
1212 profile_probability::guessed_always ()
1213 .apply_scale (80, 100));
1214}
1215
1216void
1217asan_function_start (void)
1218{
1219 section *fnsec = function_section (current_function_decl);
1220 switch_to_section (fnsec);
1221 ASM_OUTPUT_DEBUG_LABEL (asm_out_file, "LASANPC",
1222 current_function_funcdef_no);
1223}
1224
1225/* Return number of shadow bytes that are occupied by a local variable
1226 of SIZE bytes. */
1227
1228static unsigned HOST_WIDE_INT
1229shadow_mem_size (unsigned HOST_WIDE_INT size)
1230{
1231 return ROUND_UP (size, ASAN_SHADOW_GRANULARITY) / ASAN_SHADOW_GRANULARITY;
1232}
1233
1234/* Insert code to protect stack vars. The prologue sequence should be emitted
1235 directly, epilogue sequence returned. BASE is the register holding the
1236 stack base, against which OFFSETS array offsets are relative to, OFFSETS
1237 array contains pairs of offsets in reverse order, always the end offset
1238 of some gap that needs protection followed by starting offset,
1239 and DECLS is an array of representative decls for each var partition.
1240 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
1241 elements long (OFFSETS include gap before the first variable as well
1242 as gaps after each stack variable). PBASE is, if non-NULL, some pseudo
1243 register which stack vars DECL_RTLs are based on. Either BASE should be
1244 assigned to PBASE, when not doing use after return protection, or
1245 corresponding address based on __asan_stack_malloc* return value. */
1246
1247rtx_insn *
1248asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
1249 HOST_WIDE_INT *offsets, tree *decls, int length)
1250{
1251 rtx shadow_base, shadow_mem, ret, mem, orig_base;
1252 rtx_code_label *lab;
1253 rtx_insn *insns;
1254 char buf[32];
1255 unsigned char shadow_bytes[4];
1256 HOST_WIDE_INT base_offset = offsets[length - 1];
1257 HOST_WIDE_INT base_align_bias = 0, offset, prev_offset;
1258 HOST_WIDE_INT asan_frame_size = offsets[0] - base_offset;
1259 HOST_WIDE_INT last_offset, last_size;
1260 int l;
1261 unsigned char cur_shadow_byte = ASAN_STACK_MAGIC_LEFT;
1262 tree str_cst, decl, id;
1263 int use_after_return_class = -1;
1264
1265 if (shadow_ptr_types[0] == NULL_TREE)
1266 asan_init_shadow_ptr_types ();
1267
1268 /* First of all, prepare the description string. */
1269 pretty_printer asan_pp;
1270
1271 pp_decimal_int (&asan_pp, length / 2 - 1);
1272 pp_space (&asan_pp);
1273 for (l = length - 2; l; l -= 2)
1274 {
1275 tree decl = decls[l / 2 - 1];
1276 pp_wide_integer (&asan_pp, offsets[l] - base_offset);
1277 pp_space (&asan_pp);
1278 pp_wide_integer (&asan_pp, offsets[l - 1] - offsets[l]);
1279 pp_space (&asan_pp);
1280 if (DECL_P (decl) && DECL_NAME (decl))
1281 {
1282 pp_decimal_int (&asan_pp, IDENTIFIER_LENGTH (DECL_NAME (decl)));
1283 pp_space (&asan_pp);
1284 pp_tree_identifier (&asan_pp, DECL_NAME (decl));
1285 }
1286 else
1287 pp_string (&asan_pp, "9 <unknown>");
1288 pp_space (&asan_pp);
1289 }
1290 str_cst = asan_pp_string (&asan_pp);
1291
1292 /* Emit the prologue sequence. */
1293 if (asan_frame_size > 32 && asan_frame_size <= 65536 && pbase
1294 && ASAN_USE_AFTER_RETURN)
1295 {
1296 use_after_return_class = floor_log2 (asan_frame_size - 1) - 5;
1297 /* __asan_stack_malloc_N guarantees alignment
1298 N < 6 ? (64 << N) : 4096 bytes. */
1299 if (alignb > (use_after_return_class < 6
1300 ? (64U << use_after_return_class) : 4096U))
1301 use_after_return_class = -1;
1302 else if (alignb > ASAN_RED_ZONE_SIZE && (asan_frame_size & (alignb - 1)))
1303 base_align_bias = ((asan_frame_size + alignb - 1)
1304 & ~(alignb - HOST_WIDE_INT_1)) - asan_frame_size;
1305 }
1306 /* Align base if target is STRICT_ALIGNMENT. */
1307 if (STRICT_ALIGNMENT)
1308 base = expand_binop (Pmode, and_optab, base,
1309 gen_int_mode (-((GET_MODE_ALIGNMENT (SImode)
1310 << ASAN_SHADOW_SHIFT)
1311 / BITS_PER_UNIT), Pmode), NULL_RTX,
1312 1, OPTAB_DIRECT);
1313
1314 if (use_after_return_class == -1 && pbase)
1315 emit_move_insn (pbase, base);
1316
1317 base = expand_binop (Pmode, add_optab, base,
1318 gen_int_mode (base_offset - base_align_bias, Pmode),
1319 NULL_RTX, 1, OPTAB_DIRECT);
1320 orig_base = NULL_RTX;
1321 if (use_after_return_class != -1)
1322 {
1323 if (asan_detect_stack_use_after_return == NULL_TREE)
1324 {
1325 id = get_identifier ("__asan_option_detect_stack_use_after_return");
1326 decl = build_decl (BUILTINS_LOCATION, VAR_DECL, id,
1327 integer_type_node);
1328 SET_DECL_ASSEMBLER_NAME (decl, id);
1329 TREE_ADDRESSABLE (decl) = 1;
1330 DECL_ARTIFICIAL (decl) = 1;
1331 DECL_IGNORED_P (decl) = 1;
1332 DECL_EXTERNAL (decl) = 1;
1333 TREE_STATIC (decl) = 1;
1334 TREE_PUBLIC (decl) = 1;
1335 TREE_USED (decl) = 1;
1336 asan_detect_stack_use_after_return = decl;
1337 }
1338 orig_base = gen_reg_rtx (Pmode);
1339 emit_move_insn (orig_base, base);
1340 ret = expand_normal (asan_detect_stack_use_after_return);
1341 lab = gen_label_rtx ();
1342 emit_cmp_and_jump_insns (ret, const0_rtx, EQ, NULL_RTX,
1343 VOIDmode, 0, lab,
1344 profile_probability::very_likely ());
1345 snprintf (buf, sizeof buf, "__asan_stack_malloc_%d",
1346 use_after_return_class);
1347 ret = init_one_libfunc (buf);
1348 ret = emit_library_call_value (ret, NULL_RTX, LCT_NORMAL, ptr_mode,
1349 GEN_INT (asan_frame_size
1350 + base_align_bias),
1351 TYPE_MODE (pointer_sized_int_node));
1352 /* __asan_stack_malloc_[n] returns a pointer to fake stack if succeeded
1353 and NULL otherwise. Check RET value is NULL here and jump over the
1354 BASE reassignment in this case. Otherwise, reassign BASE to RET. */
1355 emit_cmp_and_jump_insns (ret, const0_rtx, EQ, NULL_RTX,
1356 VOIDmode, 0, lab,
1357 profile_probability:: very_unlikely ());
1358 ret = convert_memory_address (Pmode, ret);
1359 emit_move_insn (base, ret);
1360 emit_label (lab);
1361 emit_move_insn (pbase, expand_binop (Pmode, add_optab, base,
1362 gen_int_mode (base_align_bias
1363 - base_offset, Pmode),
1364 NULL_RTX, 1, OPTAB_DIRECT));
1365 }
1366 mem = gen_rtx_MEM (ptr_mode, base);
1367 mem = adjust_address (mem, VOIDmode, base_align_bias);
1368 emit_move_insn (mem, gen_int_mode (ASAN_STACK_FRAME_MAGIC, ptr_mode));
1369 mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode));
1370 emit_move_insn (mem, expand_normal (str_cst));
1371 mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode));
1372 ASM_GENERATE_INTERNAL_LABEL (buf, "LASANPC", current_function_funcdef_no);
1373 id = get_identifier (buf);
1374 decl = build_decl (DECL_SOURCE_LOCATION (current_function_decl),
1375 VAR_DECL, id, char_type_node);
1376 SET_DECL_ASSEMBLER_NAME (decl, id);
1377 TREE_ADDRESSABLE (decl) = 1;
1378 TREE_READONLY (decl) = 1;
1379 DECL_ARTIFICIAL (decl) = 1;
1380 DECL_IGNORED_P (decl) = 1;
1381 TREE_STATIC (decl) = 1;
1382 TREE_PUBLIC (decl) = 0;
1383 TREE_USED (decl) = 1;
1384 DECL_INITIAL (decl) = decl;
1385 TREE_ASM_WRITTEN (decl) = 1;
1386 TREE_ASM_WRITTEN (id) = 1;
1387 emit_move_insn (mem, expand_normal (build_fold_addr_expr (decl)));
1388 shadow_base = expand_binop (Pmode, lshr_optab, base,
1389 GEN_INT (ASAN_SHADOW_SHIFT),
1390 NULL_RTX, 1, OPTAB_DIRECT);
1391 shadow_base
1392 = plus_constant (Pmode, shadow_base,
1393 asan_shadow_offset ()
1394 + (base_align_bias >> ASAN_SHADOW_SHIFT));
1395 gcc_assert (asan_shadow_set != -1
1396 && (ASAN_RED_ZONE_SIZE >> ASAN_SHADOW_SHIFT) == 4);
1397 shadow_mem = gen_rtx_MEM (SImode, shadow_base);
1398 set_mem_alias_set (shadow_mem, asan_shadow_set);
1399 if (STRICT_ALIGNMENT)
1400 set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)));
1401 prev_offset = base_offset;
1402 for (l = length; l; l -= 2)
1403 {
1404 if (l == 2)
1405 cur_shadow_byte = ASAN_STACK_MAGIC_RIGHT;
1406 offset = offsets[l - 1];
1407 if ((offset - base_offset) & (ASAN_RED_ZONE_SIZE - 1))
1408 {
1409 int i;
1410 HOST_WIDE_INT aoff
1411 = base_offset + ((offset - base_offset)
1412 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
1413 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1414 (aoff - prev_offset)
1415 >> ASAN_SHADOW_SHIFT);
1416 prev_offset = aoff;
1417 for (i = 0; i < 4; i++, aoff += ASAN_SHADOW_GRANULARITY)
1418 if (aoff < offset)
1419 {
1420 if (aoff < offset - (HOST_WIDE_INT)ASAN_SHADOW_GRANULARITY + 1)
1421 shadow_bytes[i] = 0;
1422 else
1423 shadow_bytes[i] = offset - aoff;
1424 }
1425 else
1426 shadow_bytes[i] = ASAN_STACK_MAGIC_MIDDLE;
1427 emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
1428 offset = aoff;
1429 }
1430 while (offset <= offsets[l - 2] - ASAN_RED_ZONE_SIZE)
1431 {
1432 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1433 (offset - prev_offset)
1434 >> ASAN_SHADOW_SHIFT);
1435 prev_offset = offset;
1436 memset (shadow_bytes, cur_shadow_byte, 4);
1437 emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
1438 offset += ASAN_RED_ZONE_SIZE;
1439 }
1440 cur_shadow_byte = ASAN_STACK_MAGIC_MIDDLE;
1441 }
1442 do_pending_stack_adjust ();
1443
1444 /* Construct epilogue sequence. */
1445 start_sequence ();
1446
1447 lab = NULL;
1448 if (use_after_return_class != -1)
1449 {
1450 rtx_code_label *lab2 = gen_label_rtx ();
1451 char c = (char) ASAN_STACK_MAGIC_USE_AFTER_RET;
1452 emit_cmp_and_jump_insns (orig_base, base, EQ, NULL_RTX,
1453 VOIDmode, 0, lab2,
1454 profile_probability::very_likely ());
1455 shadow_mem = gen_rtx_MEM (BLKmode, shadow_base);
1456 set_mem_alias_set (shadow_mem, asan_shadow_set);
1457 mem = gen_rtx_MEM (ptr_mode, base);
1458 mem = adjust_address (mem, VOIDmode, base_align_bias);
1459 emit_move_insn (mem, gen_int_mode (ASAN_STACK_RETIRED_MAGIC, ptr_mode));
1460 unsigned HOST_WIDE_INT sz = asan_frame_size >> ASAN_SHADOW_SHIFT;
1461 if (use_after_return_class < 5
1462 && can_store_by_pieces (sz, builtin_memset_read_str, &c,
1463 BITS_PER_UNIT, true))
1464 store_by_pieces (shadow_mem, sz, builtin_memset_read_str, &c,
1465 BITS_PER_UNIT, true, 0);
1466 else if (use_after_return_class >= 5
1467 || !set_storage_via_setmem (shadow_mem,
1468 GEN_INT (sz),
1469 gen_int_mode (c, QImode),
1470 BITS_PER_UNIT, BITS_PER_UNIT,
1471 -1, sz, sz, sz))
1472 {
1473 snprintf (buf, sizeof buf, "__asan_stack_free_%d",
1474 use_after_return_class);
1475 ret = init_one_libfunc (buf);
1476 rtx addr = convert_memory_address (ptr_mode, base);
1477 rtx orig_addr = convert_memory_address (ptr_mode, orig_base);
1478 emit_library_call (ret, LCT_NORMAL, ptr_mode, addr, ptr_mode,
1479 GEN_INT (asan_frame_size + base_align_bias),
1480 TYPE_MODE (pointer_sized_int_node),
1481 orig_addr, ptr_mode);
1482 }
1483 lab = gen_label_rtx ();
1484 emit_jump (lab);
1485 emit_label (lab2);
1486 }
1487
1488 shadow_mem = gen_rtx_MEM (BLKmode, shadow_base);
1489 set_mem_alias_set (shadow_mem, asan_shadow_set);
1490
1491 if (STRICT_ALIGNMENT)
1492 set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)));
1493
1494 prev_offset = base_offset;
1495 last_offset = base_offset;
1496 last_size = 0;
1497 for (l = length; l; l -= 2)
1498 {
1499 offset = base_offset + ((offsets[l - 1] - base_offset)
1500 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
1501 if (last_offset + last_size != offset)
1502 {
1503 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1504 (last_offset - prev_offset)
1505 >> ASAN_SHADOW_SHIFT);
1506 prev_offset = last_offset;
1507 asan_clear_shadow (shadow_mem, last_size >> ASAN_SHADOW_SHIFT);
1508 last_offset = offset;
1509 last_size = 0;
1510 }
1511 last_size += base_offset + ((offsets[l - 2] - base_offset)
1512 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1))
1513 - offset;
1514
1515 /* Unpoison shadow memory that corresponds to a variable that is
1516 is subject of use-after-return sanitization. */
1517 if (l > 2)
1518 {
1519 decl = decls[l / 2 - 2];
1520 if (asan_handled_variables != NULL
1521 && asan_handled_variables->contains (decl))
1522 {
1523 HOST_WIDE_INT size = offsets[l - 3] - offsets[l - 2];
1524 if (dump_file && (dump_flags & TDF_DETAILS))
1525 {
1526 const char *n = (DECL_NAME (decl)
1527 ? IDENTIFIER_POINTER (DECL_NAME (decl))
1528 : "<unknown>");
1529 fprintf (dump_file, "Unpoisoning shadow stack for variable: "
1530 "%s (%" PRId64 " B)\n", n, size);
1531 }
1532
1533 last_size += size & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1);
1534 }
1535 }
1536 }
1537 if (last_size)
1538 {
1539 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1540 (last_offset - prev_offset)
1541 >> ASAN_SHADOW_SHIFT);
1542 asan_clear_shadow (shadow_mem, last_size >> ASAN_SHADOW_SHIFT);
1543 }
1544
1545 /* Clean-up set with instrumented stack variables. */
1546 delete asan_handled_variables;
1547 asan_handled_variables = NULL;
1548 delete asan_used_labels;
1549 asan_used_labels = NULL;
1550
1551 do_pending_stack_adjust ();
1552 if (lab)
1553 emit_label (lab);
1554
1555 insns = get_insns ();
1556 end_sequence ();
1557 return insns;
1558}
1559
1560/* Emit __asan_allocas_unpoison (top, bot) call. The BASE parameter corresponds
1561 to BOT argument, for TOP virtual_stack_dynamic_rtx is used. NEW_SEQUENCE
1562 indicates whether we're emitting new instructions sequence or not. */
1563
1564rtx_insn *
1565asan_emit_allocas_unpoison (rtx top, rtx bot, rtx_insn *before)
1566{
1567 if (before)
1568 push_to_sequence (before);
1569 else
1570 start_sequence ();
1571 rtx ret = init_one_libfunc ("__asan_allocas_unpoison");
1572 top = convert_memory_address (ptr_mode, top);
1573 bot = convert_memory_address (ptr_mode, bot);
1574 ret = emit_library_call_value (ret, NULL_RTX, LCT_NORMAL, ptr_mode,
1575 top, ptr_mode, bot, ptr_mode);
1576
1577 do_pending_stack_adjust ();
1578 rtx_insn *insns = get_insns ();
1579 end_sequence ();
1580 return insns;
1581}
1582
1583/* Return true if DECL, a global var, might be overridden and needs
1584 therefore a local alias. */
1585
1586static bool
1587asan_needs_local_alias (tree decl)
1588{
1589 return DECL_WEAK (decl) || !targetm.binds_local_p (decl);
1590}
1591
1592/* Return true if DECL, a global var, is an artificial ODR indicator symbol
1593 therefore doesn't need protection. */
1594
1595static bool
1596is_odr_indicator (tree decl)
1597{
1598 return (DECL_ARTIFICIAL (decl)
1599 && lookup_attribute ("asan odr indicator", DECL_ATTRIBUTES (decl)));
1600}
1601
1602/* Return true if DECL is a VAR_DECL that should be protected
1603 by Address Sanitizer, by appending a red zone with protected
1604 shadow memory after it and aligning it to at least
1605 ASAN_RED_ZONE_SIZE bytes. */
1606
1607bool
1608asan_protect_global (tree decl, bool ignore_decl_rtl_set_p)
1609{
1610 if (!ASAN_GLOBALS)
1611 return false;
1612
1613 rtx rtl, symbol;
1614
1615 if (TREE_CODE (decl) == STRING_CST)
1616 {
1617 /* Instrument all STRING_CSTs except those created
1618 by asan_pp_string here. */
1619 if (shadow_ptr_types[0] != NULL_TREE
1620 && TREE_CODE (TREE_TYPE (decl)) == ARRAY_TYPE
1621 && TREE_TYPE (TREE_TYPE (decl)) == TREE_TYPE (shadow_ptr_types[0]))
1622 return false;
1623 return true;
1624 }
1625 if (!VAR_P (decl)
1626 /* TLS vars aren't statically protectable. */
1627 || DECL_THREAD_LOCAL_P (decl)
1628 /* Externs will be protected elsewhere. */
1629 || DECL_EXTERNAL (decl)
1630 /* PR sanitizer/81697: For architectures that use section anchors first
1631 call to asan_protect_global may occur before DECL_RTL (decl) is set.
1632 We should ignore DECL_RTL_SET_P then, because otherwise the first call
1633 to asan_protect_global will return FALSE and the following calls on the
1634 same decl after setting DECL_RTL (decl) will return TRUE and we'll end
1635 up with inconsistency at runtime. */
1636 || (!DECL_RTL_SET_P (decl) && !ignore_decl_rtl_set_p)
1637 /* Comdat vars pose an ABI problem, we can't know if
1638 the var that is selected by the linker will have
1639 padding or not. */
1640 || DECL_ONE_ONLY (decl)
1641 /* Similarly for common vars. People can use -fno-common.
1642 Note: Linux kernel is built with -fno-common, so we do instrument
1643 globals there even if it is C. */
1644 || (DECL_COMMON (decl) && TREE_PUBLIC (decl))
1645 /* Don't protect if using user section, often vars placed
1646 into user section from multiple TUs are then assumed
1647 to be an array of such vars, putting padding in there
1648 breaks this assumption. */
1649 || (DECL_SECTION_NAME (decl) != NULL
1650 && !symtab_node::get (decl)->implicit_section
1651 && !section_sanitized_p (DECL_SECTION_NAME (decl)))
1652 || DECL_SIZE (decl) == 0
1653 || ASAN_RED_ZONE_SIZE * BITS_PER_UNIT > MAX_OFILE_ALIGNMENT
1654 || !valid_constant_size_p (DECL_SIZE_UNIT (decl))
1655 || DECL_ALIGN_UNIT (decl) > 2 * ASAN_RED_ZONE_SIZE
1656 || TREE_TYPE (decl) == ubsan_get_source_location_type ()
1657 || is_odr_indicator (decl))
1658 return false;
1659
1660 if (!ignore_decl_rtl_set_p || DECL_RTL_SET_P (decl))
1661 {
1662
1663 rtl = DECL_RTL (decl);
1664 if (!MEM_P (rtl) || GET_CODE (XEXP (rtl, 0)) != SYMBOL_REF)
1665 return false;
1666 symbol = XEXP (rtl, 0);
1667
1668 if (CONSTANT_POOL_ADDRESS_P (symbol)
1669 || TREE_CONSTANT_POOL_ADDRESS_P (symbol))
1670 return false;
1671 }
1672
1673 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl)))
1674 return false;
1675
1676 if (!TARGET_SUPPORTS_ALIASES && asan_needs_local_alias (decl))
1677 return false;
1678
1679 return true;
1680}
1681
1682/* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16,_n}.
1683 IS_STORE is either 1 (for a store) or 0 (for a load). */
1684
1685static tree
1686report_error_func (bool is_store, bool recover_p, HOST_WIDE_INT size_in_bytes,
1687 int *nargs)
1688{
1689 static enum built_in_function report[2][2][6]
1690 = { { { BUILT_IN_ASAN_REPORT_LOAD1, BUILT_IN_ASAN_REPORT_LOAD2,
1691 BUILT_IN_ASAN_REPORT_LOAD4, BUILT_IN_ASAN_REPORT_LOAD8,
1692 BUILT_IN_ASAN_REPORT_LOAD16, BUILT_IN_ASAN_REPORT_LOAD_N },
1693 { BUILT_IN_ASAN_REPORT_STORE1, BUILT_IN_ASAN_REPORT_STORE2,
1694 BUILT_IN_ASAN_REPORT_STORE4, BUILT_IN_ASAN_REPORT_STORE8,
1695 BUILT_IN_ASAN_REPORT_STORE16, BUILT_IN_ASAN_REPORT_STORE_N } },
1696 { { BUILT_IN_ASAN_REPORT_LOAD1_NOABORT,
1697 BUILT_IN_ASAN_REPORT_LOAD2_NOABORT,
1698 BUILT_IN_ASAN_REPORT_LOAD4_NOABORT,
1699 BUILT_IN_ASAN_REPORT_LOAD8_NOABORT,
1700 BUILT_IN_ASAN_REPORT_LOAD16_NOABORT,
1701 BUILT_IN_ASAN_REPORT_LOAD_N_NOABORT },
1702 { BUILT_IN_ASAN_REPORT_STORE1_NOABORT,
1703 BUILT_IN_ASAN_REPORT_STORE2_NOABORT,
1704 BUILT_IN_ASAN_REPORT_STORE4_NOABORT,
1705 BUILT_IN_ASAN_REPORT_STORE8_NOABORT,
1706 BUILT_IN_ASAN_REPORT_STORE16_NOABORT,
1707 BUILT_IN_ASAN_REPORT_STORE_N_NOABORT } } };
1708 if (size_in_bytes == -1)
1709 {
1710 *nargs = 2;
1711 return builtin_decl_implicit (report[recover_p][is_store][5]);
1712 }
1713 *nargs = 1;
1714 int size_log2 = exact_log2 (size_in_bytes);
1715 return builtin_decl_implicit (report[recover_p][is_store][size_log2]);
1716}
1717
1718/* Construct a function tree for __asan_{load,store}{1,2,4,8,16,_n}.
1719 IS_STORE is either 1 (for a store) or 0 (for a load). */
1720
1721static tree
1722check_func (bool is_store, bool recover_p, HOST_WIDE_INT size_in_bytes,
1723 int *nargs)
1724{
1725 static enum built_in_function check[2][2][6]
1726 = { { { BUILT_IN_ASAN_LOAD1, BUILT_IN_ASAN_LOAD2,
1727 BUILT_IN_ASAN_LOAD4, BUILT_IN_ASAN_LOAD8,
1728 BUILT_IN_ASAN_LOAD16, BUILT_IN_ASAN_LOADN },
1729 { BUILT_IN_ASAN_STORE1, BUILT_IN_ASAN_STORE2,
1730 BUILT_IN_ASAN_STORE4, BUILT_IN_ASAN_STORE8,
1731 BUILT_IN_ASAN_STORE16, BUILT_IN_ASAN_STOREN } },
1732 { { BUILT_IN_ASAN_LOAD1_NOABORT,
1733 BUILT_IN_ASAN_LOAD2_NOABORT,
1734 BUILT_IN_ASAN_LOAD4_NOABORT,
1735 BUILT_IN_ASAN_LOAD8_NOABORT,
1736 BUILT_IN_ASAN_LOAD16_NOABORT,
1737 BUILT_IN_ASAN_LOADN_NOABORT },
1738 { BUILT_IN_ASAN_STORE1_NOABORT,
1739 BUILT_IN_ASAN_STORE2_NOABORT,
1740 BUILT_IN_ASAN_STORE4_NOABORT,
1741 BUILT_IN_ASAN_STORE8_NOABORT,
1742 BUILT_IN_ASAN_STORE16_NOABORT,
1743 BUILT_IN_ASAN_STOREN_NOABORT } } };
1744 if (size_in_bytes == -1)
1745 {
1746 *nargs = 2;
1747 return builtin_decl_implicit (check[recover_p][is_store][5]);
1748 }
1749 *nargs = 1;
1750 int size_log2 = exact_log2 (size_in_bytes);
1751 return builtin_decl_implicit (check[recover_p][is_store][size_log2]);
1752}
1753
1754/* Split the current basic block and create a condition statement
1755 insertion point right before or after the statement pointed to by
1756 ITER. Return an iterator to the point at which the caller might
1757 safely insert the condition statement.
1758
1759 THEN_BLOCK must be set to the address of an uninitialized instance
1760 of basic_block. The function will then set *THEN_BLOCK to the
1761 'then block' of the condition statement to be inserted by the
1762 caller.
1763
1764 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1765 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1766
1767 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1768 block' of the condition statement to be inserted by the caller.
1769
1770 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1771 statements starting from *ITER, and *THEN_BLOCK is a new empty
1772 block.
1773
1774 *ITER is adjusted to point to always point to the first statement
1775 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1776 same as what ITER was pointing to prior to calling this function,
1777 if BEFORE_P is true; otherwise, it is its following statement. */
1778
1779gimple_stmt_iterator
1780create_cond_insert_point (gimple_stmt_iterator *iter,
1781 bool before_p,
1782 bool then_more_likely_p,
1783 bool create_then_fallthru_edge,
1784 basic_block *then_block,
1785 basic_block *fallthrough_block)
1786{
1787 gimple_stmt_iterator gsi = *iter;
1788
1789 if (!gsi_end_p (gsi) && before_p)
1790 gsi_prev (&gsi);
1791
1792 basic_block cur_bb = gsi_bb (*iter);
1793
1794 edge e = split_block (cur_bb, gsi_stmt (gsi));
1795
1796 /* Get a hold on the 'condition block', the 'then block' and the
1797 'else block'. */
1798 basic_block cond_bb = e->src;
1799 basic_block fallthru_bb = e->dest;
1800 basic_block then_bb = create_empty_bb (cond_bb);
1801 if (current_loops)
1802 {
1803 add_bb_to_loop (then_bb, cond_bb->loop_father);
1804 loops_state_set (LOOPS_NEED_FIXUP);
1805 }
1806
1807 /* Set up the newly created 'then block'. */
1808 e = make_edge (cond_bb, then_bb, EDGE_TRUE_VALUE);
1809 profile_probability fallthrough_probability
1810 = then_more_likely_p
1811 ? profile_probability::very_unlikely ()
1812 : profile_probability::very_likely ();
1813 e->probability = fallthrough_probability.invert ();
1814 then_bb->count = e->count ();
1815 if (create_then_fallthru_edge)
1816 make_single_succ_edge (then_bb, fallthru_bb, EDGE_FALLTHRU);
1817
1818 /* Set up the fallthrough basic block. */
1819 e = find_edge (cond_bb, fallthru_bb);
1820 e->flags = EDGE_FALSE_VALUE;
1821 e->probability = fallthrough_probability;
1822
1823 /* Update dominance info for the newly created then_bb; note that
1824 fallthru_bb's dominance info has already been updated by
1825 split_bock. */
1826 if (dom_info_available_p (CDI_DOMINATORS))
1827 set_immediate_dominator (CDI_DOMINATORS, then_bb, cond_bb);
1828
1829 *then_block = then_bb;
1830 *fallthrough_block = fallthru_bb;
1831 *iter = gsi_start_bb (fallthru_bb);
1832
1833 return gsi_last_bb (cond_bb);
1834}
1835
1836/* Insert an if condition followed by a 'then block' right before the
1837 statement pointed to by ITER. The fallthrough block -- which is the
1838 else block of the condition as well as the destination of the
1839 outcoming edge of the 'then block' -- starts with the statement
1840 pointed to by ITER.
1841
1842 COND is the condition of the if.
1843
1844 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1845 'then block' is higher than the probability of the edge to the
1846 fallthrough block.
1847
1848 Upon completion of the function, *THEN_BB is set to the newly
1849 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1850 fallthrough block.
1851
1852 *ITER is adjusted to still point to the same statement it was
1853 pointing to initially. */
1854
1855static void
1856insert_if_then_before_iter (gcond *cond,
1857 gimple_stmt_iterator *iter,
1858 bool then_more_likely_p,
1859 basic_block *then_bb,
1860 basic_block *fallthrough_bb)
1861{
1862 gimple_stmt_iterator cond_insert_point =
1863 create_cond_insert_point (iter,
1864 /*before_p=*/true,
1865 then_more_likely_p,
1866 /*create_then_fallthru_edge=*/true,
1867 then_bb,
1868 fallthrough_bb);
1869 gsi_insert_after (&cond_insert_point, cond, GSI_NEW_STMT);
1870}
1871
1872/* Build (base_addr >> ASAN_SHADOW_SHIFT) + asan_shadow_offset ().
1873 If RETURN_ADDRESS is set to true, return memory location instread
1874 of a value in the shadow memory. */
1875
1876static tree
1877build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
1878 tree base_addr, tree shadow_ptr_type,
1879 bool return_address = false)
1880{
1881 tree t, uintptr_type = TREE_TYPE (base_addr);
1882 tree shadow_type = TREE_TYPE (shadow_ptr_type);
1883 gimple *g;
1884
1885 t = build_int_cst (uintptr_type, ASAN_SHADOW_SHIFT);
1886 g = gimple_build_assign (make_ssa_name (uintptr_type), RSHIFT_EXPR,
1887 base_addr, t);
1888 gimple_set_location (g, location);
1889 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1890
1891 t = build_int_cst (uintptr_type, asan_shadow_offset ());
1892 g = gimple_build_assign (make_ssa_name (uintptr_type), PLUS_EXPR,
1893 gimple_assign_lhs (g), t);
1894 gimple_set_location (g, location);
1895 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1896
1897 g = gimple_build_assign (make_ssa_name (shadow_ptr_type), NOP_EXPR,
1898 gimple_assign_lhs (g));
1899 gimple_set_location (g, location);
1900 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1901
1902 if (!return_address)
1903 {
1904 t = build2 (MEM_REF, shadow_type, gimple_assign_lhs (g),
1905 build_int_cst (shadow_ptr_type, 0));
1906 g = gimple_build_assign (make_ssa_name (shadow_type), MEM_REF, t);
1907 gimple_set_location (g, location);
1908 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1909 }
1910
1911 return gimple_assign_lhs (g);
1912}
1913
1914/* BASE can already be an SSA_NAME; in that case, do not create a
1915 new SSA_NAME for it. */
1916
1917static tree
1918maybe_create_ssa_name (location_t loc, tree base, gimple_stmt_iterator *iter,
1919 bool before_p)
1920{
1921 if (TREE_CODE (base) == SSA_NAME)
1922 return base;
1923 gimple *g = gimple_build_assign (make_ssa_name (TREE_TYPE (base)),
1924 TREE_CODE (base), base);
1925 gimple_set_location (g, loc);
1926 if (before_p)
1927 gsi_insert_before (iter, g, GSI_SAME_STMT);
1928 else
1929 gsi_insert_after (iter, g, GSI_NEW_STMT);
1930 return gimple_assign_lhs (g);
1931}
1932
1933/* LEN can already have necessary size and precision;
1934 in that case, do not create a new variable. */
1935
1936tree
1937maybe_cast_to_ptrmode (location_t loc, tree len, gimple_stmt_iterator *iter,
1938 bool before_p)
1939{
1940 if (ptrofftype_p (len))
1941 return len;
1942 gimple *g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
1943 NOP_EXPR, len);
1944 gimple_set_location (g, loc);
1945 if (before_p)
1946 gsi_insert_before (iter, g, GSI_SAME_STMT);
1947 else
1948 gsi_insert_after (iter, g, GSI_NEW_STMT);
1949 return gimple_assign_lhs (g);
1950}
1951
1952/* Instrument the memory access instruction BASE. Insert new
1953 statements before or after ITER.
1954
1955 Note that the memory access represented by BASE can be either an
1956 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1957 location. IS_STORE is TRUE for a store, FALSE for a load.
1958 BEFORE_P is TRUE for inserting the instrumentation code before
1959 ITER, FALSE for inserting it after ITER. IS_SCALAR_ACCESS is TRUE
1960 for a scalar memory access and FALSE for memory region access.
1961 NON_ZERO_P is TRUE if memory region is guaranteed to have non-zero
1962 length. ALIGN tells alignment of accessed memory object.
1963
1964 START_INSTRUMENTED and END_INSTRUMENTED are TRUE if start/end of
1965 memory region have already been instrumented.
1966
1967 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1968 statement it was pointing to prior to calling this function,
1969 otherwise, it points to the statement logically following it. */
1970
1971static void
1972build_check_stmt (location_t loc, tree base, tree len,
1973 HOST_WIDE_INT size_in_bytes, gimple_stmt_iterator *iter,
1974 bool is_non_zero_len, bool before_p, bool is_store,
1975 bool is_scalar_access, unsigned int align = 0)
1976{
1977 gimple_stmt_iterator gsi = *iter;
1978 gimple *g;
1979
1980 gcc_assert (!(size_in_bytes > 0 && !is_non_zero_len));
1981
1982 gsi = *iter;
1983
1984 base = unshare_expr (base);
1985 base = maybe_create_ssa_name (loc, base, &gsi, before_p);
1986
1987 if (len)
1988 {
1989 len = unshare_expr (len);
1990 len = maybe_cast_to_ptrmode (loc, len, iter, before_p);
1991 }
1992 else
1993 {
1994 gcc_assert (size_in_bytes != -1);
1995 len = build_int_cst (pointer_sized_int_node, size_in_bytes);
1996 }
1997
1998 if (size_in_bytes > 1)
1999 {
2000 if ((size_in_bytes & (size_in_bytes - 1)) != 0
2001 || size_in_bytes > 16)
2002 is_scalar_access = false;
2003 else if (align && align < size_in_bytes * BITS_PER_UNIT)
2004 {
2005 /* On non-strict alignment targets, if
2006 16-byte access is just 8-byte aligned,
2007 this will result in misaligned shadow
2008 memory 2 byte load, but otherwise can
2009 be handled using one read. */
2010 if (size_in_bytes != 16
2011 || STRICT_ALIGNMENT
2012 || align < 8 * BITS_PER_UNIT)
2013 is_scalar_access = false;
2014 }
2015 }
2016
2017 HOST_WIDE_INT flags = 0;
2018 if (is_store)
2019 flags |= ASAN_CHECK_STORE;
2020 if (is_non_zero_len)
2021 flags |= ASAN_CHECK_NON_ZERO_LEN;
2022 if (is_scalar_access)
2023 flags |= ASAN_CHECK_SCALAR_ACCESS;
2024
2025 g = gimple_build_call_internal (IFN_ASAN_CHECK, 4,
2026 build_int_cst (integer_type_node, flags),
2027 base, len,
2028 build_int_cst (integer_type_node,
2029 align / BITS_PER_UNIT));
2030 gimple_set_location (g, loc);
2031 if (before_p)
2032 gsi_insert_before (&gsi, g, GSI_SAME_STMT);
2033 else
2034 {
2035 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2036 gsi_next (&gsi);
2037 *iter = gsi;
2038 }
2039}
2040
2041/* If T represents a memory access, add instrumentation code before ITER.
2042 LOCATION is source code location.
2043 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
2044
2045static void
2046instrument_derefs (gimple_stmt_iterator *iter, tree t,
2047 location_t location, bool is_store)
2048{
2049 if (is_store && !ASAN_INSTRUMENT_WRITES)
2050 return;
2051 if (!is_store && !ASAN_INSTRUMENT_READS)
2052 return;
2053
2054 tree type, base;
2055 HOST_WIDE_INT size_in_bytes;
2056 if (location == UNKNOWN_LOCATION)
2057 location = EXPR_LOCATION (t);
2058
2059 type = TREE_TYPE (t);
2060 switch (TREE_CODE (t))
2061 {
2062 case ARRAY_REF:
2063 case COMPONENT_REF:
2064 case INDIRECT_REF:
2065 case MEM_REF:
2066 case VAR_DECL:
2067 case BIT_FIELD_REF:
2068 break;
2069 /* FALLTHRU */
2070 default:
2071 return;
2072 }
2073
2074 size_in_bytes = int_size_in_bytes (type);
2075 if (size_in_bytes <= 0)
2076 return;
2077
2078 HOST_WIDE_INT bitsize, bitpos;
2079 tree offset;
2080 machine_mode mode;
2081 int unsignedp, reversep, volatilep = 0;
2082 tree inner = get_inner_reference (t, &bitsize, &bitpos, &offset, &mode,
2083 &unsignedp, &reversep, &volatilep);
2084
2085 if (TREE_CODE (t) == COMPONENT_REF
2086 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1)) != NULL_TREE)
2087 {
2088 tree repr = DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1));
2089 instrument_derefs (iter, build3 (COMPONENT_REF, TREE_TYPE (repr),
2090 TREE_OPERAND (t, 0), repr,
2091 TREE_OPERAND (t, 2)),
2092 location, is_store);
2093 return;
2094 }
2095
2096 if (bitpos % BITS_PER_UNIT
2097 || bitsize != size_in_bytes * BITS_PER_UNIT)
2098 return;
2099
2100 if (VAR_P (inner) && DECL_HARD_REGISTER (inner))
2101 return;
2102
2103 if (VAR_P (inner)
2104 && offset == NULL_TREE
2105 && bitpos >= 0
2106 && DECL_SIZE (inner)
2107 && tree_fits_shwi_p (DECL_SIZE (inner))
2108 && bitpos + bitsize <= tree_to_shwi (DECL_SIZE (inner)))
2109 {
2110 if (DECL_THREAD_LOCAL_P (inner))
2111 return;
2112 if (!ASAN_GLOBALS && is_global_var (inner))
2113 return;
2114 if (!TREE_STATIC (inner))
2115 {
2116 /* Automatic vars in the current function will be always
2117 accessible. */
2118 if (decl_function_context (inner) == current_function_decl
2119 && (!asan_sanitize_use_after_scope ()
2120 || !TREE_ADDRESSABLE (inner)))
2121 return;
2122 }
2123 /* Always instrument external vars, they might be dynamically
2124 initialized. */
2125 else if (!DECL_EXTERNAL (inner))
2126 {
2127 /* For static vars if they are known not to be dynamically
2128 initialized, they will be always accessible. */
2129 varpool_node *vnode = varpool_node::get (inner);
2130 if (vnode && !vnode->dynamically_initialized)
2131 return;
2132 }
2133 }
2134
2135 base = build_fold_addr_expr (t);
2136 if (!has_mem_ref_been_instrumented (base, size_in_bytes))
2137 {
2138 unsigned int align = get_object_alignment (t);
2139 build_check_stmt (location, base, NULL_TREE, size_in_bytes, iter,
2140 /*is_non_zero_len*/size_in_bytes > 0, /*before_p=*/true,
2141 is_store, /*is_scalar_access*/true, align);
2142 update_mem_ref_hash_table (base, size_in_bytes);
2143 update_mem_ref_hash_table (t, size_in_bytes);
2144 }
2145
2146}
2147
2148/* Insert a memory reference into the hash table if access length
2149 can be determined in compile time. */
2150
2151static void
2152maybe_update_mem_ref_hash_table (tree base, tree len)
2153{
2154 if (!POINTER_TYPE_P (TREE_TYPE (base))
2155 || !INTEGRAL_TYPE_P (TREE_TYPE (len)))
2156 return;
2157
2158 HOST_WIDE_INT size_in_bytes = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
2159
2160 if (size_in_bytes != -1)
2161 update_mem_ref_hash_table (base, size_in_bytes);
2162}
2163
2164/* Instrument an access to a contiguous memory region that starts at
2165 the address pointed to by BASE, over a length of LEN (expressed in
2166 the sizeof (*BASE) bytes). ITER points to the instruction before
2167 which the instrumentation instructions must be inserted. LOCATION
2168 is the source location that the instrumentation instructions must
2169 have. If IS_STORE is true, then the memory access is a store;
2170 otherwise, it's a load. */
2171
2172static void
2173instrument_mem_region_access (tree base, tree len,
2174 gimple_stmt_iterator *iter,
2175 location_t location, bool is_store)
2176{
2177 if (!POINTER_TYPE_P (TREE_TYPE (base))
2178 || !INTEGRAL_TYPE_P (TREE_TYPE (len))
2179 || integer_zerop (len))
2180 return;
2181
2182 HOST_WIDE_INT size_in_bytes = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
2183
2184 if ((size_in_bytes == -1)
2185 || !has_mem_ref_been_instrumented (base, size_in_bytes))
2186 {
2187 build_check_stmt (location, base, len, size_in_bytes, iter,
2188 /*is_non_zero_len*/size_in_bytes > 0, /*before_p*/true,
2189 is_store, /*is_scalar_access*/false, /*align*/0);
2190 }
2191
2192 maybe_update_mem_ref_hash_table (base, len);
2193 *iter = gsi_for_stmt (gsi_stmt (*iter));
2194}
2195
2196/* Instrument the call to a built-in memory access function that is
2197 pointed to by the iterator ITER.
2198
2199 Upon completion, return TRUE iff *ITER has been advanced to the
2200 statement following the one it was originally pointing to. */
2201
2202static bool
2203instrument_builtin_call (gimple_stmt_iterator *iter)
2204{
2205 if (!ASAN_MEMINTRIN)
2206 return false;
2207
2208 bool iter_advanced_p = false;
2209 gcall *call = as_a <gcall *> (gsi_stmt (*iter));
2210
2211 gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL));
2212
2213 location_t loc = gimple_location (call);
2214
2215 asan_mem_ref src0, src1, dest;
2216 asan_mem_ref_init (&src0, NULL, 1);
2217 asan_mem_ref_init (&src1, NULL, 1);
2218 asan_mem_ref_init (&dest, NULL, 1);
2219
2220 tree src0_len = NULL_TREE, src1_len = NULL_TREE, dest_len = NULL_TREE;
2221 bool src0_is_store = false, src1_is_store = false, dest_is_store = false,
2222 dest_is_deref = false, intercepted_p = true;
2223
2224 if (get_mem_refs_of_builtin_call (call,
2225 &src0, &src0_len, &src0_is_store,
2226 &src1, &src1_len, &src1_is_store,
2227 &dest, &dest_len, &dest_is_store,
2228 &dest_is_deref, &intercepted_p, iter))
2229 {
2230 if (dest_is_deref)
2231 {
2232 instrument_derefs (iter, dest.start, loc, dest_is_store);
2233 gsi_next (iter);
2234 iter_advanced_p = true;
2235 }
2236 else if (!intercepted_p
2237 && (src0_len || src1_len || dest_len))
2238 {
2239 if (src0.start != NULL_TREE)
2240 instrument_mem_region_access (src0.start, src0_len,
2241 iter, loc, /*is_store=*/false);
2242 if (src1.start != NULL_TREE)
2243 instrument_mem_region_access (src1.start, src1_len,
2244 iter, loc, /*is_store=*/false);
2245 if (dest.start != NULL_TREE)
2246 instrument_mem_region_access (dest.start, dest_len,
2247 iter, loc, /*is_store=*/true);
2248
2249 *iter = gsi_for_stmt (call);
2250 gsi_next (iter);
2251 iter_advanced_p = true;
2252 }
2253 else
2254 {
2255 if (src0.start != NULL_TREE)
2256 maybe_update_mem_ref_hash_table (src0.start, src0_len);
2257 if (src1.start != NULL_TREE)
2258 maybe_update_mem_ref_hash_table (src1.start, src1_len);
2259 if (dest.start != NULL_TREE)
2260 maybe_update_mem_ref_hash_table (dest.start, dest_len);
2261 }
2262 }
2263 return iter_advanced_p;
2264}
2265
2266/* Instrument the assignment statement ITER if it is subject to
2267 instrumentation. Return TRUE iff instrumentation actually
2268 happened. In that case, the iterator ITER is advanced to the next
2269 logical expression following the one initially pointed to by ITER,
2270 and the relevant memory reference that which access has been
2271 instrumented is added to the memory references hash table. */
2272
2273static bool
2274maybe_instrument_assignment (gimple_stmt_iterator *iter)
2275{
2276 gimple *s = gsi_stmt (*iter);
2277
2278 gcc_assert (gimple_assign_single_p (s));
2279
2280 tree ref_expr = NULL_TREE;
2281 bool is_store, is_instrumented = false;
2282
2283 if (gimple_store_p (s))
2284 {
2285 ref_expr = gimple_assign_lhs (s);
2286 is_store = true;
2287 instrument_derefs (iter, ref_expr,
2288 gimple_location (s),
2289 is_store);
2290 is_instrumented = true;
2291 }
2292
2293 if (gimple_assign_load_p (s))
2294 {
2295 ref_expr = gimple_assign_rhs1 (s);
2296 is_store = false;
2297 instrument_derefs (iter, ref_expr,
2298 gimple_location (s),
2299 is_store);
2300 is_instrumented = true;
2301 }
2302
2303 if (is_instrumented)
2304 gsi_next (iter);
2305
2306 return is_instrumented;
2307}
2308
2309/* Instrument the function call pointed to by the iterator ITER, if it
2310 is subject to instrumentation. At the moment, the only function
2311 calls that are instrumented are some built-in functions that access
2312 memory. Look at instrument_builtin_call to learn more.
2313
2314 Upon completion return TRUE iff *ITER was advanced to the statement
2315 following the one it was originally pointing to. */
2316
2317static bool
2318maybe_instrument_call (gimple_stmt_iterator *iter)
2319{
2320 gimple *stmt = gsi_stmt (*iter);
2321 bool is_builtin = gimple_call_builtin_p (stmt, BUILT_IN_NORMAL);
2322
2323 if (is_builtin && instrument_builtin_call (iter))
2324 return true;
2325
2326 if (gimple_call_noreturn_p (stmt))
2327 {
2328 if (is_builtin)
2329 {
2330 tree callee = gimple_call_fndecl (stmt);
2331 switch (DECL_FUNCTION_CODE (callee))
2332 {
2333 case BUILT_IN_UNREACHABLE:
2334 case BUILT_IN_TRAP:
2335 /* Don't instrument these. */
2336 return false;
2337 default:
2338 break;
2339 }
2340 }
2341 tree decl = builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN);
2342 gimple *g = gimple_build_call (decl, 0);
2343 gimple_set_location (g, gimple_location (stmt));
2344 gsi_insert_before (iter, g, GSI_SAME_STMT);
2345 }
2346
2347 bool instrumented = false;
2348 if (gimple_store_p (stmt))
2349 {
2350 tree ref_expr = gimple_call_lhs (stmt);
2351 instrument_derefs (iter, ref_expr,
2352 gimple_location (stmt),
2353 /*is_store=*/true);
2354
2355 instrumented = true;
2356 }
2357
2358 /* Walk through gimple_call arguments and check them id needed. */
2359 unsigned args_num = gimple_call_num_args (stmt);
2360 for (unsigned i = 0; i < args_num; ++i)
2361 {
2362 tree arg = gimple_call_arg (stmt, i);
2363 /* If ARG is not a non-aggregate register variable, compiler in general
2364 creates temporary for it and pass it as argument to gimple call.
2365 But in some cases, e.g. when we pass by value a small structure that
2366 fits to register, compiler can avoid extra overhead by pulling out
2367 these temporaries. In this case, we should check the argument. */
2368 if (!is_gimple_reg (arg) && !is_gimple_min_invariant (arg))
2369 {
2370 instrument_derefs (iter, arg,
2371 gimple_location (stmt),
2372 /*is_store=*/false);
2373 instrumented = true;
2374 }
2375 }
2376 if (instrumented)
2377 gsi_next (iter);
2378 return instrumented;
2379}
2380
2381/* Walk each instruction of all basic block and instrument those that
2382 represent memory references: loads, stores, or function calls.
2383 In a given basic block, this function avoids instrumenting memory
2384 references that have already been instrumented. */
2385
2386static void
2387transform_statements (void)
2388{
2389 basic_block bb, last_bb = NULL;
2390 gimple_stmt_iterator i;
2391 int saved_last_basic_block = last_basic_block_for_fn (cfun);
2392
2393 FOR_EACH_BB_FN (bb, cfun)
2394 {
2395 basic_block prev_bb = bb;
2396
2397 if (bb->index >= saved_last_basic_block) continue;
2398
2399 /* Flush the mem ref hash table, if current bb doesn't have
2400 exactly one predecessor, or if that predecessor (skipping
2401 over asan created basic blocks) isn't the last processed
2402 basic block. Thus we effectively flush on extended basic
2403 block boundaries. */
2404 while (single_pred_p (prev_bb))
2405 {
2406 prev_bb = single_pred (prev_bb);
2407 if (prev_bb->index < saved_last_basic_block)
2408 break;
2409 }
2410 if (prev_bb != last_bb)
2411 empty_mem_ref_hash_table ();
2412 last_bb = bb;
2413
2414 for (i = gsi_start_bb (bb); !gsi_end_p (i);)
2415 {
2416 gimple *s = gsi_stmt (i);
2417
2418 if (has_stmt_been_instrumented_p (s))
2419 gsi_next (&i);
2420 else if (gimple_assign_single_p (s)
2421 && !gimple_clobber_p (s)
2422 && maybe_instrument_assignment (&i))
2423 /* Nothing to do as maybe_instrument_assignment advanced
2424 the iterator I. */;
2425 else if (is_gimple_call (s) && maybe_instrument_call (&i))
2426 /* Nothing to do as maybe_instrument_call
2427 advanced the iterator I. */;
2428 else
2429 {
2430 /* No instrumentation happened.
2431
2432 If the current instruction is a function call that
2433 might free something, let's forget about the memory
2434 references that got instrumented. Otherwise we might
2435 miss some instrumentation opportunities. Do the same
2436 for a ASAN_MARK poisoning internal function. */
2437 if (is_gimple_call (s)
2438 && (!nonfreeing_call_p (s)
2439 || asan_mark_p (s, ASAN_MARK_POISON)))
2440 empty_mem_ref_hash_table ();
2441
2442 gsi_next (&i);
2443 }
2444 }
2445 }
2446 free_mem_ref_resources ();
2447}
2448
2449/* Build
2450 __asan_before_dynamic_init (module_name)
2451 or
2452 __asan_after_dynamic_init ()
2453 call. */
2454
2455tree
2456asan_dynamic_init_call (bool after_p)
2457{
2458 if (shadow_ptr_types[0] == NULL_TREE)
2459 asan_init_shadow_ptr_types ();
2460
2461 tree fn = builtin_decl_implicit (after_p
2462 ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
2463 : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT);
2464 tree module_name_cst = NULL_TREE;
2465 if (!after_p)
2466 {
2467 pretty_printer module_name_pp;
2468 pp_string (&module_name_pp, main_input_filename);
2469
2470 module_name_cst = asan_pp_string (&module_name_pp);
2471 module_name_cst = fold_convert (const_ptr_type_node,
2472 module_name_cst);
2473 }
2474
2475 return build_call_expr (fn, after_p ? 0 : 1, module_name_cst);
2476}
2477
2478/* Build
2479 struct __asan_global
2480 {
2481 const void *__beg;
2482 uptr __size;
2483 uptr __size_with_redzone;
2484 const void *__name;
2485 const void *__module_name;
2486 uptr __has_dynamic_init;
2487 __asan_global_source_location *__location;
2488 char *__odr_indicator;
2489 } type. */
2490
2491static tree
2492asan_global_struct (void)
2493{
2494 static const char *field_names[]
2495 = { "__beg", "__size", "__size_with_redzone",
2496 "__name", "__module_name", "__has_dynamic_init", "__location",
2497 "__odr_indicator" };
2498 tree fields[ARRAY_SIZE (field_names)], ret;
2499 unsigned i;
2500
2501 ret = make_node (RECORD_TYPE);
2502 for (i = 0; i < ARRAY_SIZE (field_names); i++)
2503 {
2504 fields[i]
2505 = build_decl (UNKNOWN_LOCATION, FIELD_DECL,
2506 get_identifier (field_names[i]),
2507 (i == 0 || i == 3) ? const_ptr_type_node
2508 : pointer_sized_int_node);
2509 DECL_CONTEXT (fields[i]) = ret;
2510 if (i)
2511 DECL_CHAIN (fields[i - 1]) = fields[i];
2512 }
2513 tree type_decl = build_decl (input_location, TYPE_DECL,
2514 get_identifier ("__asan_global"), ret);
2515 DECL_IGNORED_P (type_decl) = 1;
2516 DECL_ARTIFICIAL (type_decl) = 1;
2517 TYPE_FIELDS (ret) = fields[0];
2518 TYPE_NAME (ret) = type_decl;
2519 TYPE_STUB_DECL (ret) = type_decl;
2520 layout_type (ret);
2521 return ret;
2522}
2523
2524/* Create and return odr indicator symbol for DECL.
2525 TYPE is __asan_global struct type as returned by asan_global_struct. */
2526
2527static tree
2528create_odr_indicator (tree decl, tree type)
2529{
2530 char *name;
2531 tree uptr = TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type)));
2532 tree decl_name
2533 = (HAS_DECL_ASSEMBLER_NAME_P (decl) ? DECL_ASSEMBLER_NAME (decl)
2534 : DECL_NAME (decl));
2535 /* DECL_NAME theoretically might be NULL. Bail out with 0 in this case. */
2536 if (decl_name == NULL_TREE)
2537 return build_int_cst (uptr, 0);
2538 const char *dname = IDENTIFIER_POINTER (decl_name);
2539 if (HAS_DECL_ASSEMBLER_NAME_P (decl))
2540 dname = targetm.strip_name_encoding (dname);
2541 size_t len = strlen (dname) + sizeof ("__odr_asan_");
2542 name = XALLOCAVEC (char, len);
2543 snprintf (name, len, "__odr_asan_%s", dname);
2544#ifndef NO_DOT_IN_LABEL
2545 name[sizeof ("__odr_asan") - 1] = '.';
2546#elif !defined(NO_DOLLAR_IN_LABEL)
2547 name[sizeof ("__odr_asan") - 1] = '$';
2548#endif
2549 tree var = build_decl (UNKNOWN_LOCATION, VAR_DECL, get_identifier (name),
2550 char_type_node);
2551 TREE_ADDRESSABLE (var) = 1;
2552 TREE_READONLY (var) = 0;
2553 TREE_THIS_VOLATILE (var) = 1;
2554 DECL_GIMPLE_REG_P (var) = 0;
2555 DECL_ARTIFICIAL (var) = 1;
2556 DECL_IGNORED_P (var) = 1;
2557 TREE_STATIC (var) = 1;
2558 TREE_PUBLIC (var) = 1;
2559 DECL_VISIBILITY (var) = DECL_VISIBILITY (decl);
2560 DECL_VISIBILITY_SPECIFIED (var) = DECL_VISIBILITY_SPECIFIED (decl);
2561
2562 TREE_USED (var) = 1;
2563 tree ctor = build_constructor_va (TREE_TYPE (var), 1, NULL_TREE,
2564 build_int_cst (unsigned_type_node, 0));
2565 TREE_CONSTANT (ctor) = 1;
2566 TREE_STATIC (ctor) = 1;
2567 DECL_INITIAL (var) = ctor;
2568 DECL_ATTRIBUTES (var) = tree_cons (get_identifier ("asan odr indicator"),
2569 NULL, DECL_ATTRIBUTES (var));
2570 make_decl_rtl (var);
2571 varpool_node::finalize_decl (var);
2572 return fold_convert (uptr, build_fold_addr_expr (var));
2573}
2574
2575/* Return true if DECL, a global var, might be overridden and needs
2576 an additional odr indicator symbol. */
2577
2578static bool
2579asan_needs_odr_indicator_p (tree decl)
2580{
2581 /* Don't emit ODR indicators for kernel because:
2582 a) Kernel is written in C thus doesn't need ODR indicators.
2583 b) Some kernel code may have assumptions about symbols containing specific
2584 patterns in their names. Since ODR indicators contain original names
2585 of symbols they are emitted for, these assumptions would be broken for
2586 ODR indicator symbols. */
2587 return (!(flag_sanitize & SANITIZE_KERNEL_ADDRESS)
2588 && !DECL_ARTIFICIAL (decl)
2589 && !DECL_WEAK (decl)
2590 && TREE_PUBLIC (decl));
2591}
2592
2593/* Append description of a single global DECL into vector V.
2594 TYPE is __asan_global struct type as returned by asan_global_struct. */
2595
2596static void
2597asan_add_global (tree decl, tree type, vec<constructor_elt, va_gc> *v)
2598{
2599 tree init, uptr = TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type)));
2600 unsigned HOST_WIDE_INT size;
2601 tree str_cst, module_name_cst, refdecl = decl;
2602 vec<constructor_elt, va_gc> *vinner = NULL;
2603
2604 pretty_printer asan_pp, module_name_pp;
2605
2606 if (DECL_NAME (decl))
2607 pp_tree_identifier (&asan_pp, DECL_NAME (decl));
2608 else
2609 pp_string (&asan_pp, "<unknown>");
2610 str_cst = asan_pp_string (&asan_pp);
2611
2612 pp_string (&module_name_pp, main_input_filename);
2613 module_name_cst = asan_pp_string (&module_name_pp);
2614
2615 if (asan_needs_local_alias (decl))
2616 {
2617 char buf[20];
2618 ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", vec_safe_length (v) + 1);
2619 refdecl = build_decl (DECL_SOURCE_LOCATION (decl),
2620 VAR_DECL, get_identifier (buf), TREE_TYPE (decl));
2621 TREE_ADDRESSABLE (refdecl) = TREE_ADDRESSABLE (decl);
2622 TREE_READONLY (refdecl) = TREE_READONLY (decl);
2623 TREE_THIS_VOLATILE (refdecl) = TREE_THIS_VOLATILE (decl);
2624 DECL_GIMPLE_REG_P (refdecl) = DECL_GIMPLE_REG_P (decl);
2625 DECL_ARTIFICIAL (refdecl) = DECL_ARTIFICIAL (decl);
2626 DECL_IGNORED_P (refdecl) = DECL_IGNORED_P (decl);
2627 TREE_STATIC (refdecl) = 1;
2628 TREE_PUBLIC (refdecl) = 0;
2629 TREE_USED (refdecl) = 1;
2630 assemble_alias (refdecl, DECL_ASSEMBLER_NAME (decl));
2631 }
2632
2633 tree odr_indicator_ptr
2634 = (asan_needs_odr_indicator_p (decl) ? create_odr_indicator (decl, type)
2635 : build_int_cst (uptr, 0));
2636 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2637 fold_convert (const_ptr_type_node,
2638 build_fold_addr_expr (refdecl)));
2639 size = tree_to_uhwi (DECL_SIZE_UNIT (decl));
2640 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size));
2641 size += asan_red_zone_size (size);
2642 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size));
2643 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2644 fold_convert (const_ptr_type_node, str_cst));
2645 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2646 fold_convert (const_ptr_type_node, module_name_cst));
2647 varpool_node *vnode = varpool_node::get (decl);
2648 int has_dynamic_init = 0;
2649 /* FIXME: Enable initialization order fiasco detection in LTO mode once
2650 proper fix for PR 79061 will be applied. */
2651 if (!in_lto_p)
2652 has_dynamic_init = vnode ? vnode->dynamically_initialized : 0;
2653 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2654 build_int_cst (uptr, has_dynamic_init));
2655 tree locptr = NULL_TREE;
2656 location_t loc = DECL_SOURCE_LOCATION (decl);
2657 expanded_location xloc = expand_location (loc);
2658 if (xloc.file != NULL)
2659 {
2660 static int lasanloccnt = 0;
2661 char buf[25];
2662 ASM_GENERATE_INTERNAL_LABEL (buf, "LASANLOC", ++lasanloccnt);
2663 tree var = build_decl (UNKNOWN_LOCATION, VAR_DECL, get_identifier (buf),
2664 ubsan_get_source_location_type ());
2665 TREE_STATIC (var) = 1;
2666 TREE_PUBLIC (var) = 0;
2667 DECL_ARTIFICIAL (var) = 1;
2668 DECL_IGNORED_P (var) = 1;
2669 pretty_printer filename_pp;
2670 pp_string (&filename_pp, xloc.file);
2671 tree str = asan_pp_string (&filename_pp);
2672 tree ctor = build_constructor_va (TREE_TYPE (var), 3,
2673 NULL_TREE, str, NULL_TREE,
2674 build_int_cst (unsigned_type_node,
2675 xloc.line), NULL_TREE,
2676 build_int_cst (unsigned_type_node,
2677 xloc.column));
2678 TREE_CONSTANT (ctor) = 1;
2679 TREE_STATIC (ctor) = 1;
2680 DECL_INITIAL (var) = ctor;
2681 varpool_node::finalize_decl (var);
2682 locptr = fold_convert (uptr, build_fold_addr_expr (var));
2683 }
2684 else
2685 locptr = build_int_cst (uptr, 0);
2686 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, locptr);
2687 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, odr_indicator_ptr);
2688 init = build_constructor (type, vinner);
2689 CONSTRUCTOR_APPEND_ELT (v, NULL_TREE, init);
2690}
2691
2692/* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2693void
2694initialize_sanitizer_builtins (void)
2695{
2696 tree decl;
2697
2698 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT))
2699 return;
2700
2701 tree BT_FN_VOID = build_function_type_list (void_type_node, NULL_TREE);
2702 tree BT_FN_VOID_PTR
2703 = build_function_type_list (void_type_node, ptr_type_node, NULL_TREE);
2704 tree BT_FN_VOID_CONST_PTR
2705 = build_function_type_list (void_type_node, const_ptr_type_node, NULL_TREE);
2706 tree BT_FN_VOID_PTR_PTR
2707 = build_function_type_list (void_type_node, ptr_type_node,
2708 ptr_type_node, NULL_TREE);
2709 tree BT_FN_VOID_PTR_PTR_PTR
2710 = build_function_type_list (void_type_node, ptr_type_node,
2711 ptr_type_node, ptr_type_node, NULL_TREE);
2712 tree BT_FN_VOID_PTR_PTRMODE
2713 = build_function_type_list (void_type_node, ptr_type_node,
2714 pointer_sized_int_node, NULL_TREE);
2715 tree BT_FN_VOID_INT
2716 = build_function_type_list (void_type_node, integer_type_node, NULL_TREE);
2717 tree BT_FN_SIZE_CONST_PTR_INT
2718 = build_function_type_list (size_type_node, const_ptr_type_node,
2719 integer_type_node, NULL_TREE);
2720
2721 tree BT_FN_VOID_UINT8_UINT8
2722 = build_function_type_list (void_type_node, unsigned_char_type_node,
2723 unsigned_char_type_node, NULL_TREE);
2724 tree BT_FN_VOID_UINT16_UINT16
2725 = build_function_type_list (void_type_node, uint16_type_node,
2726 uint16_type_node, NULL_TREE);
2727 tree BT_FN_VOID_UINT32_UINT32
2728 = build_function_type_list (void_type_node, uint32_type_node,
2729 uint32_type_node, NULL_TREE);
2730 tree BT_FN_VOID_UINT64_UINT64
2731 = build_function_type_list (void_type_node, uint64_type_node,
2732 uint64_type_node, NULL_TREE);
2733 tree BT_FN_VOID_FLOAT_FLOAT
2734 = build_function_type_list (void_type_node, float_type_node,
2735 float_type_node, NULL_TREE);
2736 tree BT_FN_VOID_DOUBLE_DOUBLE
2737 = build_function_type_list (void_type_node, double_type_node,
2738 double_type_node, NULL_TREE);
2739 tree BT_FN_VOID_UINT64_PTR
2740 = build_function_type_list (void_type_node, uint64_type_node,
2741 ptr_type_node, NULL_TREE);
2742
2743 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT[5];
2744 tree BT_FN_IX_CONST_VPTR_INT[5];
2745 tree BT_FN_IX_VPTR_IX_INT[5];
2746 tree BT_FN_VOID_VPTR_IX_INT[5];
2747 tree vptr
2748 = build_pointer_type (build_qualified_type (void_type_node,
2749 TYPE_QUAL_VOLATILE));
2750 tree cvptr
2751 = build_pointer_type (build_qualified_type (void_type_node,
2752 TYPE_QUAL_VOLATILE
2753 |TYPE_QUAL_CONST));
2754 tree boolt
2755 = lang_hooks.types.type_for_size (BOOL_TYPE_SIZE, 1);
2756 int i;
2757 for (i = 0; i < 5; i++)
2758 {
2759 tree ix = build_nonstandard_integer_type (BITS_PER_UNIT * (1 << i), 1);
2760 BT_FN_BOOL_VPTR_PTR_IX_INT_INT[i]
2761 = build_function_type_list (boolt, vptr, ptr_type_node, ix,
2762 integer_type_node, integer_type_node,
2763 NULL_TREE);
2764 BT_FN_IX_CONST_VPTR_INT[i]
2765 = build_function_type_list (ix, cvptr, integer_type_node, NULL_TREE);
2766 BT_FN_IX_VPTR_IX_INT[i]
2767 = build_function_type_list (ix, vptr, ix, integer_type_node,
2768 NULL_TREE);
2769 BT_FN_VOID_VPTR_IX_INT[i]
2770 = build_function_type_list (void_type_node, vptr, ix,
2771 integer_type_node, NULL_TREE);
2772 }
2773#define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2774#define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2775#define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2776#define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2777#define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2778#define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2779#define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2780#define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2781#define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2782#define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2783#define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2784#define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2785#define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2786#define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2787#define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2788#define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2789#define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2790#define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2791#define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2792#define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2793#undef ATTR_NOTHROW_LEAF_LIST
2794#define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2795#undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2796#define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2797#undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2798#define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2799#undef ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2800#define ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST \
2801 ECF_CONST | ATTR_NORETURN_NOTHROW_LEAF_LIST
2802#undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2803#define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2804 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2805#undef ATTR_COLD_NOTHROW_LEAF_LIST
2806#define ATTR_COLD_NOTHROW_LEAF_LIST \
2807 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2808#undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2809#define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2810 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2811#undef ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST
2812#define ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST \
2813 /* ECF_COLD missing */ ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2814#undef ATTR_PURE_NOTHROW_LEAF_LIST
2815#define ATTR_PURE_NOTHROW_LEAF_LIST ECF_PURE | ATTR_NOTHROW_LEAF_LIST
2816#undef DEF_BUILTIN_STUB
2817#define DEF_BUILTIN_STUB(ENUM, NAME)
2818#undef DEF_SANITIZER_BUILTIN_1
2819#define DEF_SANITIZER_BUILTIN_1(ENUM, NAME, TYPE, ATTRS) \
2820 do { \
2821 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2822 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2823 set_call_expr_flags (decl, ATTRS); \
2824 set_builtin_decl (ENUM, decl, true); \
2825 } while (0)
2826#undef DEF_SANITIZER_BUILTIN
2827#define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2828 DEF_SANITIZER_BUILTIN_1 (ENUM, NAME, TYPE, ATTRS);
2829
2830#include "sanitizer.def"
2831
2832 /* -fsanitize=object-size uses __builtin_object_size, but that might
2833 not be available for e.g. Fortran at this point. We use
2834 DEF_SANITIZER_BUILTIN here only as a convenience macro. */
2835 if ((flag_sanitize & SANITIZE_OBJECT_SIZE)
2836 && !builtin_decl_implicit_p (BUILT_IN_OBJECT_SIZE))
2837 DEF_SANITIZER_BUILTIN_1 (BUILT_IN_OBJECT_SIZE, "object_size",
2838 BT_FN_SIZE_CONST_PTR_INT,
2839 ATTR_PURE_NOTHROW_LEAF_LIST);
2840
2841#undef DEF_SANITIZER_BUILTIN_1
2842#undef DEF_SANITIZER_BUILTIN
2843#undef DEF_BUILTIN_STUB
2844}
2845
2846/* Called via htab_traverse. Count number of emitted
2847 STRING_CSTs in the constant hash table. */
2848
2849int
2850count_string_csts (constant_descriptor_tree **slot,
2851 unsigned HOST_WIDE_INT *data)
2852{
2853 struct constant_descriptor_tree *desc = *slot;
2854 if (TREE_CODE (desc->value) == STRING_CST
2855 && TREE_ASM_WRITTEN (desc->value)
2856 && asan_protect_global (desc->value))
2857 ++*data;
2858 return 1;
2859}
2860
2861/* Helper structure to pass two parameters to
2862 add_string_csts. */
2863
2864struct asan_add_string_csts_data
2865{
2866 tree type;
2867 vec<constructor_elt, va_gc> *v;
2868};
2869
2870/* Called via hash_table::traverse. Call asan_add_global
2871 on emitted STRING_CSTs from the constant hash table. */
2872
2873int
2874add_string_csts (constant_descriptor_tree **slot,
2875 asan_add_string_csts_data *aascd)
2876{
2877 struct constant_descriptor_tree *desc = *slot;
2878 if (TREE_CODE (desc->value) == STRING_CST
2879 && TREE_ASM_WRITTEN (desc->value)
2880 && asan_protect_global (desc->value))
2881 {
2882 asan_add_global (SYMBOL_REF_DECL (XEXP (desc->rtl, 0)),
2883 aascd->type, aascd->v);
2884 }
2885 return 1;
2886}
2887
2888/* Needs to be GTY(()), because cgraph_build_static_cdtor may
2889 invoke ggc_collect. */
2890static GTY(()) tree asan_ctor_statements;
2891
2892/* Module-level instrumentation.
2893 - Insert __asan_init_vN() into the list of CTORs.
2894 - TODO: insert redzones around globals.
2895 */
2896
2897void
2898asan_finish_file (void)
2899{
2900 varpool_node *vnode;
2901 unsigned HOST_WIDE_INT gcount = 0;
2902
2903 if (shadow_ptr_types[0] == NULL_TREE)
2904 asan_init_shadow_ptr_types ();
2905 /* Avoid instrumenting code in the asan ctors/dtors.
2906 We don't need to insert padding after the description strings,
2907 nor after .LASAN* array. */
2908 flag_sanitize &= ~SANITIZE_ADDRESS;
2909
2910 /* For user-space we want asan constructors to run first.
2911 Linux kernel does not support priorities other than default, and the only
2912 other user of constructors is coverage. So we run with the default
2913 priority. */
2914 int priority = flag_sanitize & SANITIZE_USER_ADDRESS
2915 ? MAX_RESERVED_INIT_PRIORITY - 1 : DEFAULT_INIT_PRIORITY;
2916
2917 if (flag_sanitize & SANITIZE_USER_ADDRESS)
2918 {
2919 tree fn = builtin_decl_implicit (BUILT_IN_ASAN_INIT);
2920 append_to_statement_list (build_call_expr (fn, 0), &asan_ctor_statements);
2921 fn = builtin_decl_implicit (BUILT_IN_ASAN_VERSION_MISMATCH_CHECK);
2922 append_to_statement_list (build_call_expr (fn, 0), &asan_ctor_statements);
2923 }
2924 FOR_EACH_DEFINED_VARIABLE (vnode)
2925 if (TREE_ASM_WRITTEN (vnode->decl)
2926 && asan_protect_global (vnode->decl))
2927 ++gcount;
2928 hash_table<tree_descriptor_hasher> *const_desc_htab = constant_pool_htab ();
2929 const_desc_htab->traverse<unsigned HOST_WIDE_INT *, count_string_csts>
2930 (&gcount);
2931 if (gcount)
2932 {
2933 tree type = asan_global_struct (), var, ctor;
2934 tree dtor_statements = NULL_TREE;
2935 vec<constructor_elt, va_gc> *v;
2936 char buf[20];
2937
2938 type = build_array_type_nelts (type, gcount);
2939 ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", 0);
2940 var = build_decl (UNKNOWN_LOCATION, VAR_DECL, get_identifier (buf),
2941 type);
2942 TREE_STATIC (var) = 1;
2943 TREE_PUBLIC (var) = 0;
2944 DECL_ARTIFICIAL (var) = 1;
2945 DECL_IGNORED_P (var) = 1;
2946 vec_alloc (v, gcount);
2947 FOR_EACH_DEFINED_VARIABLE (vnode)
2948 if (TREE_ASM_WRITTEN (vnode->decl)
2949 && asan_protect_global (vnode->decl))
2950 asan_add_global (vnode->decl, TREE_TYPE (type), v);
2951 struct asan_add_string_csts_data aascd;
2952 aascd.type = TREE_TYPE (type);
2953 aascd.v = v;
2954 const_desc_htab->traverse<asan_add_string_csts_data *, add_string_csts>
2955 (&aascd);
2956 ctor = build_constructor (type, v);
2957 TREE_CONSTANT (ctor) = 1;
2958 TREE_STATIC (ctor) = 1;
2959 DECL_INITIAL (var) = ctor;
2960 SET_DECL_ALIGN (var, MAX (DECL_ALIGN (var),
2961 ASAN_SHADOW_GRANULARITY * BITS_PER_UNIT));
2962
2963 varpool_node::finalize_decl (var);
2964
2965 tree fn = builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS);
2966 tree gcount_tree = build_int_cst (pointer_sized_int_node, gcount);
2967 append_to_statement_list (build_call_expr (fn, 2,
2968 build_fold_addr_expr (var),
2969 gcount_tree),
2970 &asan_ctor_statements);
2971
2972 fn = builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS);
2973 append_to_statement_list (build_call_expr (fn, 2,
2974 build_fold_addr_expr (var),
2975 gcount_tree),
2976 &dtor_statements);
2977 cgraph_build_static_cdtor ('D', dtor_statements, priority);
2978 }
2979 if (asan_ctor_statements)
2980 cgraph_build_static_cdtor ('I', asan_ctor_statements, priority);
2981 flag_sanitize |= SANITIZE_ADDRESS;
2982}
2983
2984/* Poison or unpoison (depending on IS_CLOBBER variable) shadow memory based
2985 on SHADOW address. Newly added statements will be added to ITER with
2986 given location LOC. We mark SIZE bytes in shadow memory, where
2987 LAST_CHUNK_SIZE is greater than zero in situation where we are at the
2988 end of a variable. */
2989
2990static void
2991asan_store_shadow_bytes (gimple_stmt_iterator *iter, location_t loc,
2992 tree shadow,
2993 unsigned HOST_WIDE_INT base_addr_offset,
2994 bool is_clobber, unsigned size,
2995 unsigned last_chunk_size)
2996{
2997 tree shadow_ptr_type;
2998
2999 switch (size)
3000 {
3001 case 1:
3002 shadow_ptr_type = shadow_ptr_types[0];
3003 break;
3004 case 2:
3005 shadow_ptr_type = shadow_ptr_types[1];
3006 break;
3007 case 4:
3008 shadow_ptr_type = shadow_ptr_types[2];
3009 break;
3010 default:
3011 gcc_unreachable ();
3012 }
3013
3014 unsigned char c = (char) is_clobber ? ASAN_STACK_MAGIC_USE_AFTER_SCOPE : 0;
3015 unsigned HOST_WIDE_INT val = 0;
3016 unsigned last_pos = size;
3017 if (last_chunk_size && !is_clobber)
3018 last_pos = BYTES_BIG_ENDIAN ? 0 : size - 1;
3019 for (unsigned i = 0; i < size; ++i)
3020 {
3021 unsigned char shadow_c = c;
3022 if (i == last_pos)
3023 shadow_c = last_chunk_size;
3024 val |= (unsigned HOST_WIDE_INT) shadow_c << (BITS_PER_UNIT * i);
3025 }
3026
3027 /* Handle last chunk in unpoisoning. */
3028 tree magic = build_int_cst (TREE_TYPE (shadow_ptr_type), val);
3029
3030 tree dest = build2 (MEM_REF, TREE_TYPE (shadow_ptr_type), shadow,
3031 build_int_cst (shadow_ptr_type, base_addr_offset));
3032
3033 gimple *g = gimple_build_assign (dest, magic);
3034 gimple_set_location (g, loc);
3035 gsi_insert_after (iter, g, GSI_NEW_STMT);
3036}
3037
3038/* Expand the ASAN_MARK builtins. */
3039
3040bool
3041asan_expand_mark_ifn (gimple_stmt_iterator *iter)
3042{
3043 gimple *g = gsi_stmt (*iter);
3044 location_t loc = gimple_location (g);
3045 HOST_WIDE_INT flag = tree_to_shwi (gimple_call_arg (g, 0));
3046 bool is_poison = ((asan_mark_flags)flag) == ASAN_MARK_POISON;
3047
3048 tree base = gimple_call_arg (g, 1);
3049 gcc_checking_assert (TREE_CODE (base) == ADDR_EXPR);
3050 tree decl = TREE_OPERAND (base, 0);
3051
3052 /* For a nested function, we can have: ASAN_MARK (2, &FRAME.2.fp_input, 4) */
3053 if (TREE_CODE (decl) == COMPONENT_REF
3054 && DECL_NONLOCAL_FRAME (TREE_OPERAND (decl, 0)))
3055 decl = TREE_OPERAND (decl, 0);
3056
3057 gcc_checking_assert (TREE_CODE (decl) == VAR_DECL);
3058
3059 if (is_poison)
3060 {
3061 if (asan_handled_variables == NULL)
3062 asan_handled_variables = new hash_set<tree> (16);
3063 asan_handled_variables->add (decl);
3064 }
3065 tree len = gimple_call_arg (g, 2);
3066
3067 gcc_assert (tree_fits_shwi_p (len));
3068 unsigned HOST_WIDE_INT size_in_bytes = tree_to_shwi (len);
3069 gcc_assert (size_in_bytes);
3070
3071 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3072 NOP_EXPR, base);
3073 gimple_set_location (g, loc);
3074 gsi_replace (iter, g, false);
3075 tree base_addr = gimple_assign_lhs (g);
3076
3077 /* Generate direct emission if size_in_bytes is small. */
3078 if (size_in_bytes <= ASAN_PARAM_USE_AFTER_SCOPE_DIRECT_EMISSION_THRESHOLD)
3079 {
3080 unsigned HOST_WIDE_INT shadow_size = shadow_mem_size (size_in_bytes);
3081
3082 tree shadow = build_shadow_mem_access (iter, loc, base_addr,
3083 shadow_ptr_types[0], true);
3084
3085 for (unsigned HOST_WIDE_INT offset = 0; offset < shadow_size;)
3086 {
3087 unsigned size = 1;
3088 if (shadow_size - offset >= 4)
3089 size = 4;
3090 else if (shadow_size - offset >= 2)
3091 size = 2;
3092
3093 unsigned HOST_WIDE_INT last_chunk_size = 0;
3094 unsigned HOST_WIDE_INT s = (offset + size) * ASAN_SHADOW_GRANULARITY;
3095 if (s > size_in_bytes)
3096 last_chunk_size = ASAN_SHADOW_GRANULARITY - (s - size_in_bytes);
3097
3098 asan_store_shadow_bytes (iter, loc, shadow, offset, is_poison,
3099 size, last_chunk_size);
3100 offset += size;
3101 }
3102 }
3103 else
3104 {
3105 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3106 NOP_EXPR, len);
3107 gimple_set_location (g, loc);
3108 gsi_insert_before (iter, g, GSI_SAME_STMT);
3109 tree sz_arg = gimple_assign_lhs (g);
3110
3111 tree fun
3112 = builtin_decl_implicit (is_poison ? BUILT_IN_ASAN_POISON_STACK_MEMORY
3113 : BUILT_IN_ASAN_UNPOISON_STACK_MEMORY);
3114 g = gimple_build_call (fun, 2, base_addr, sz_arg);
3115 gimple_set_location (g, loc);
3116 gsi_insert_after (iter, g, GSI_NEW_STMT);
3117 }
3118
3119 return false;
3120}
3121
3122/* Expand the ASAN_{LOAD,STORE} builtins. */
3123
3124bool
3125asan_expand_check_ifn (gimple_stmt_iterator *iter, bool use_calls)
3126{
3127 gimple *g = gsi_stmt (*iter);
3128 location_t loc = gimple_location (g);
3129 bool recover_p;
3130 if (flag_sanitize & SANITIZE_USER_ADDRESS)
3131 recover_p = (flag_sanitize_recover & SANITIZE_USER_ADDRESS) != 0;
3132 else
3133 recover_p = (flag_sanitize_recover & SANITIZE_KERNEL_ADDRESS) != 0;
3134
3135 HOST_WIDE_INT flags = tree_to_shwi (gimple_call_arg (g, 0));
3136 gcc_assert (flags < ASAN_CHECK_LAST);
3137 bool is_scalar_access = (flags & ASAN_CHECK_SCALAR_ACCESS) != 0;
3138 bool is_store = (flags & ASAN_CHECK_STORE) != 0;
3139 bool is_non_zero_len = (flags & ASAN_CHECK_NON_ZERO_LEN) != 0;
3140
3141 tree base = gimple_call_arg (g, 1);
3142 tree len = gimple_call_arg (g, 2);
3143 HOST_WIDE_INT align = tree_to_shwi (gimple_call_arg (g, 3));
3144
3145 HOST_WIDE_INT size_in_bytes
3146 = is_scalar_access && tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
3147
3148 if (use_calls)
3149 {
3150 /* Instrument using callbacks. */
3151 gimple *g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3152 NOP_EXPR, base);
3153 gimple_set_location (g, loc);
3154 gsi_insert_before (iter, g, GSI_SAME_STMT);
3155 tree base_addr = gimple_assign_lhs (g);
3156
3157 int nargs;
3158 tree fun = check_func (is_store, recover_p, size_in_bytes, &nargs);
3159 if (nargs == 1)
3160 g = gimple_build_call (fun, 1, base_addr);
3161 else
3162 {
3163 gcc_assert (nargs == 2);
3164 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3165 NOP_EXPR, len);
3166 gimple_set_location (g, loc);
3167 gsi_insert_before (iter, g, GSI_SAME_STMT);
3168 tree sz_arg = gimple_assign_lhs (g);
3169 g = gimple_build_call (fun, nargs, base_addr, sz_arg);
3170 }
3171 gimple_set_location (g, loc);
3172 gsi_replace (iter, g, false);
3173 return false;
3174 }
3175
3176 HOST_WIDE_INT real_size_in_bytes = size_in_bytes == -1 ? 1 : size_in_bytes;
3177
3178 tree shadow_ptr_type = shadow_ptr_types[real_size_in_bytes == 16 ? 1 : 0];
3179 tree shadow_type = TREE_TYPE (shadow_ptr_type);
3180
3181 gimple_stmt_iterator gsi = *iter;
3182
3183 if (!is_non_zero_len)
3184 {
3185 /* So, the length of the memory area to asan-protect is
3186 non-constant. Let's guard the generated instrumentation code
3187 like:
3188
3189 if (len != 0)
3190 {
3191 //asan instrumentation code goes here.
3192 }
3193 // falltrough instructions, starting with *ITER. */
3194
3195 g = gimple_build_cond (NE_EXPR,
3196 len,
3197 build_int_cst (TREE_TYPE (len), 0),
3198 NULL_TREE, NULL_TREE);
3199 gimple_set_location (g, loc);
3200
3201 basic_block then_bb, fallthrough_bb;
3202 insert_if_then_before_iter (as_a <gcond *> (g), iter,
3203 /*then_more_likely_p=*/true,
3204 &then_bb, &fallthrough_bb);
3205 /* Note that fallthrough_bb starts with the statement that was
3206 pointed to by ITER. */
3207
3208 /* The 'then block' of the 'if (len != 0) condition is where
3209 we'll generate the asan instrumentation code now. */
3210 gsi = gsi_last_bb (then_bb);
3211 }
3212
3213 /* Get an iterator on the point where we can add the condition
3214 statement for the instrumentation. */
3215 basic_block then_bb, else_bb;
3216 gsi = create_cond_insert_point (&gsi, /*before_p*/false,
3217 /*then_more_likely_p=*/false,
3218 /*create_then_fallthru_edge*/recover_p,
3219 &then_bb,
3220 &else_bb);
3221
3222 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3223 NOP_EXPR, base);
3224 gimple_set_location (g, loc);
3225 gsi_insert_before (&gsi, g, GSI_NEW_STMT);
3226 tree base_addr = gimple_assign_lhs (g);
3227
3228 tree t = NULL_TREE;
3229 if (real_size_in_bytes >= 8)
3230 {
3231 tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
3232 shadow_ptr_type);
3233 t = shadow;
3234 }
3235 else
3236 {
3237 /* Slow path for 1, 2 and 4 byte accesses. */
3238 /* Test (shadow != 0)
3239 & ((base_addr & 7) + (real_size_in_bytes - 1)) >= shadow). */
3240 tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
3241 shadow_ptr_type);
3242 gimple *shadow_test = build_assign (NE_EXPR, shadow, 0);
3243 gimple_seq seq = NULL;
3244 gimple_seq_add_stmt (&seq, shadow_test);
3245 /* Aligned (>= 8 bytes) can test just
3246 (real_size_in_bytes - 1 >= shadow), as base_addr & 7 is known
3247 to be 0. */
3248 if (align < 8)
3249 {
3250 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR,
3251 base_addr, 7));
3252 gimple_seq_add_stmt (&seq,
3253 build_type_cast (shadow_type,
3254 gimple_seq_last (seq)));
3255 if (real_size_in_bytes > 1)
3256 gimple_seq_add_stmt (&seq,
3257 build_assign (PLUS_EXPR,
3258 gimple_seq_last (seq),
3259 real_size_in_bytes - 1));
3260 t = gimple_assign_lhs (gimple_seq_last_stmt (seq));
3261 }
3262 else
3263 t = build_int_cst (shadow_type, real_size_in_bytes - 1);
3264 gimple_seq_add_stmt (&seq, build_assign (GE_EXPR, t, shadow));
3265 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
3266 gimple_seq_last (seq)));
3267 t = gimple_assign_lhs (gimple_seq_last (seq));
3268 gimple_seq_set_location (seq, loc);
3269 gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);
3270
3271 /* For non-constant, misaligned or otherwise weird access sizes,
3272 check first and last byte. */
3273 if (size_in_bytes == -1)
3274 {
3275 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3276 MINUS_EXPR, len,
3277 build_int_cst (pointer_sized_int_node, 1));
3278 gimple_set_location (g, loc);
3279 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
3280 tree last = gimple_assign_lhs (g);
3281 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3282 PLUS_EXPR, base_addr, last);
3283 gimple_set_location (g, loc);
3284 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
3285 tree base_end_addr = gimple_assign_lhs (g);
3286
3287 tree shadow = build_shadow_mem_access (&gsi, loc, base_end_addr,
3288 shadow_ptr_type);
3289 gimple *shadow_test = build_assign (NE_EXPR, shadow, 0);
3290 gimple_seq seq = NULL;
3291 gimple_seq_add_stmt (&seq, shadow_test);
3292 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR,
3293 base_end_addr, 7));
3294 gimple_seq_add_stmt (&seq, build_type_cast (shadow_type,
3295 gimple_seq_last (seq)));
3296 gimple_seq_add_stmt (&seq, build_assign (GE_EXPR,
3297 gimple_seq_last (seq),
3298 shadow));
3299 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
3300 gimple_seq_last (seq)));
3301 gimple_seq_add_stmt (&seq, build_assign (BIT_IOR_EXPR, t,
3302 gimple_seq_last (seq)));
3303 t = gimple_assign_lhs (gimple_seq_last (seq));
3304 gimple_seq_set_location (seq, loc);
3305 gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);
3306 }
3307 }
3308
3309 g = gimple_build_cond (NE_EXPR, t, build_int_cst (TREE_TYPE (t), 0),
3310 NULL_TREE, NULL_TREE);
3311 gimple_set_location (g, loc);
3312 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
3313
3314 /* Generate call to the run-time library (e.g. __asan_report_load8). */
3315 gsi = gsi_start_bb (then_bb);
3316 int nargs;
3317 tree fun = report_error_func (is_store, recover_p, size_in_bytes, &nargs);
3318 g = gimple_build_call (fun, nargs, base_addr, len);
3319 gimple_set_location (g, loc);
3320 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
3321
3322 gsi_remove (iter, true);
3323 *iter = gsi_start_bb (else_bb);
3324
3325 return true;
3326}
3327
3328/* Create ASAN shadow variable for a VAR_DECL which has been rewritten
3329 into SSA. Already seen VAR_DECLs are stored in SHADOW_VARS_MAPPING. */
3330
3331static tree
3332create_asan_shadow_var (tree var_decl,
3333 hash_map<tree, tree> &shadow_vars_mapping)
3334{
3335 tree *slot = shadow_vars_mapping.get (var_decl);
3336 if (slot == NULL)
3337 {
3338 tree shadow_var = copy_node (var_decl);
3339
3340 copy_body_data id;
3341 memset (&id, 0, sizeof (copy_body_data));
3342 id.src_fn = id.dst_fn = current_function_decl;
3343 copy_decl_for_dup_finish (&id, var_decl, shadow_var);
3344
3345 DECL_ARTIFICIAL (shadow_var) = 1;
3346 DECL_IGNORED_P (shadow_var) = 1;
3347 DECL_SEEN_IN_BIND_EXPR_P (shadow_var) = 0;
3348 gimple_add_tmp_var (shadow_var);
3349
3350 shadow_vars_mapping.put (var_decl, shadow_var);
3351 return shadow_var;
3352 }
3353 else
3354 return *slot;
3355}
3356
3357/* Expand ASAN_POISON ifn. */
3358
3359bool
3360asan_expand_poison_ifn (gimple_stmt_iterator *iter,
3361 bool *need_commit_edge_insert,
3362 hash_map<tree, tree> &shadow_vars_mapping)
3363{
3364 gimple *g = gsi_stmt (*iter);
3365 tree poisoned_var = gimple_call_lhs (g);
3366 if (!poisoned_var || has_zero_uses (poisoned_var))
3367 {
3368 gsi_remove (iter, true);
3369 return true;
3370 }
3371
3372 if (SSA_NAME_VAR (poisoned_var) == NULL_TREE)
3373 SET_SSA_NAME_VAR_OR_IDENTIFIER (poisoned_var,
3374 create_tmp_var (TREE_TYPE (poisoned_var)));
3375
3376 tree shadow_var = create_asan_shadow_var (SSA_NAME_VAR (poisoned_var),
3377 shadow_vars_mapping);
3378
3379 bool recover_p;
3380 if (flag_sanitize & SANITIZE_USER_ADDRESS)
3381 recover_p = (flag_sanitize_recover & SANITIZE_USER_ADDRESS) != 0;
3382 else
3383 recover_p = (flag_sanitize_recover & SANITIZE_KERNEL_ADDRESS) != 0;
3384 tree size = DECL_SIZE_UNIT (shadow_var);
3385 gimple *poison_call
3386 = gimple_build_call_internal (IFN_ASAN_MARK, 3,
3387 build_int_cst (integer_type_node,
3388 ASAN_MARK_POISON),
3389 build_fold_addr_expr (shadow_var), size);
3390
3391 gimple *use;
3392 imm_use_iterator imm_iter;
3393 FOR_EACH_IMM_USE_STMT (use, imm_iter, poisoned_var)
3394 {
3395 if (is_gimple_debug (use))
3396 continue;
3397
3398 int nargs;
3399 bool store_p = gimple_call_internal_p (use, IFN_ASAN_POISON_USE);
3400 tree fun = report_error_func (store_p, recover_p, tree_to_uhwi (size),
3401 &nargs);
3402
3403 gcall *call = gimple_build_call (fun, 1,
3404 build_fold_addr_expr (shadow_var));
3405 gimple_set_location (call, gimple_location (use));
3406 gimple *call_to_insert = call;
3407
3408 /* The USE can be a gimple PHI node. If so, insert the call on
3409 all edges leading to the PHI node. */
3410 if (is_a <gphi *> (use))
3411 {
3412 gphi *phi = dyn_cast<gphi *> (use);
3413 for (unsigned i = 0; i < gimple_phi_num_args (phi); ++i)
3414 if (gimple_phi_arg_def (phi, i) == poisoned_var)
3415 {
3416 edge e = gimple_phi_arg_edge (phi, i);
3417
3418 /* Do not insert on an edge we can't split. */
3419 if (e->flags & EDGE_ABNORMAL)
3420 continue;
3421
3422 if (call_to_insert == NULL)
3423 call_to_insert = gimple_copy (call);
3424
3425 gsi_insert_seq_on_edge (e, call_to_insert);
3426 *need_commit_edge_insert = true;
3427 call_to_insert = NULL;
3428 }
3429 }
3430 else
3431 {
3432 gimple_stmt_iterator gsi = gsi_for_stmt (use);
3433 if (store_p)
3434 gsi_replace (&gsi, call, true);
3435 else
3436 gsi_insert_before (&gsi, call, GSI_NEW_STMT);
3437 }
3438 }
3439
3440 SSA_NAME_IS_DEFAULT_DEF (poisoned_var) = true;
3441 SSA_NAME_DEF_STMT (poisoned_var) = gimple_build_nop ();
3442 gsi_replace (iter, poison_call, false);
3443
3444 return true;
3445}
3446
3447/* Instrument the current function. */
3448
3449static unsigned int
3450asan_instrument (void)
3451{
3452 if (shadow_ptr_types[0] == NULL_TREE)
3453 asan_init_shadow_ptr_types ();
3454 transform_statements ();
3455 last_alloca_addr = NULL_TREE;
3456 return 0;
3457}
3458
3459static bool
3460gate_asan (void)
3461{
3462 return sanitize_flags_p (SANITIZE_ADDRESS);
3463}
3464
3465namespace {
3466
3467const pass_data pass_data_asan =
3468{
3469 GIMPLE_PASS, /* type */
3470 "asan", /* name */
3471 OPTGROUP_NONE, /* optinfo_flags */
3472 TV_NONE, /* tv_id */
3473 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
3474 0, /* properties_provided */
3475 0, /* properties_destroyed */
3476 0, /* todo_flags_start */
3477 TODO_update_ssa, /* todo_flags_finish */
3478};
3479
3480class pass_asan : public gimple_opt_pass
3481{
3482public:
3483 pass_asan (gcc::context *ctxt)
3484 : gimple_opt_pass (pass_data_asan, ctxt)
3485 {}
3486
3487 /* opt_pass methods: */
3488 opt_pass * clone () { return new pass_asan (m_ctxt); }
3489 virtual bool gate (function *) { return gate_asan (); }
3490 virtual unsigned int execute (function *) { return asan_instrument (); }
3491
3492}; // class pass_asan
3493
3494} // anon namespace
3495
3496gimple_opt_pass *
3497make_pass_asan (gcc::context *ctxt)
3498{
3499 return new pass_asan (ctxt);
3500}
3501
3502namespace {
3503
3504const pass_data pass_data_asan_O0 =
3505{
3506 GIMPLE_PASS, /* type */
3507 "asan0", /* name */
3508 OPTGROUP_NONE, /* optinfo_flags */
3509 TV_NONE, /* tv_id */
3510 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
3511 0, /* properties_provided */
3512 0, /* properties_destroyed */
3513 0, /* todo_flags_start */
3514 TODO_update_ssa, /* todo_flags_finish */
3515};
3516
3517class pass_asan_O0 : public gimple_opt_pass
3518{
3519public:
3520 pass_asan_O0 (gcc::context *ctxt)
3521 : gimple_opt_pass (pass_data_asan_O0, ctxt)
3522 {}
3523
3524 /* opt_pass methods: */
3525 virtual bool gate (function *) { return !optimize && gate_asan (); }
3526 virtual unsigned int execute (function *) { return asan_instrument (); }
3527
3528}; // class pass_asan_O0
3529
3530} // anon namespace
3531
3532gimple_opt_pass *
3533make_pass_asan_O0 (gcc::context *ctxt)
3534{
3535 return new pass_asan_O0 (ctxt);
3536}
3537
3538#include "gt-asan.h"
3539