1//===- AddressSanitizer.cpp - memory error detector -----------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10// Details of the algorithm:
11// https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm
12//
13// FIXME: This sanitizer does not yet handle scalable vectors
14//
15//===----------------------------------------------------------------------===//
16
17#include "llvm/Transforms/Instrumentation/AddressSanitizer.h"
18#include "llvm/ADT/ArrayRef.h"
19#include "llvm/ADT/DenseMap.h"
20#include "llvm/ADT/DepthFirstIterator.h"
21#include "llvm/ADT/SmallPtrSet.h"
22#include "llvm/ADT/SmallVector.h"
23#include "llvm/ADT/Statistic.h"
24#include "llvm/ADT/StringExtras.h"
25#include "llvm/ADT/StringRef.h"
26#include "llvm/ADT/Triple.h"
27#include "llvm/ADT/Twine.h"
28#include "llvm/Analysis/MemoryBuiltins.h"
29#include "llvm/Analysis/TargetLibraryInfo.h"
30#include "llvm/Analysis/ValueTracking.h"
31#include "llvm/BinaryFormat/MachO.h"
32#include "llvm/IR/Argument.h"
33#include "llvm/IR/Attributes.h"
34#include "llvm/IR/BasicBlock.h"
35#include "llvm/IR/Comdat.h"
36#include "llvm/IR/Constant.h"
37#include "llvm/IR/Constants.h"
38#include "llvm/IR/DIBuilder.h"
39#include "llvm/IR/DataLayout.h"
40#include "llvm/IR/DebugInfoMetadata.h"
41#include "llvm/IR/DebugLoc.h"
42#include "llvm/IR/DerivedTypes.h"
43#include "llvm/IR/Dominators.h"
44#include "llvm/IR/Function.h"
45#include "llvm/IR/GlobalAlias.h"
46#include "llvm/IR/GlobalValue.h"
47#include "llvm/IR/GlobalVariable.h"
48#include "llvm/IR/IRBuilder.h"
49#include "llvm/IR/InlineAsm.h"
50#include "llvm/IR/InstVisitor.h"
51#include "llvm/IR/InstrTypes.h"
52#include "llvm/IR/Instruction.h"
53#include "llvm/IR/Instructions.h"
54#include "llvm/IR/IntrinsicInst.h"
55#include "llvm/IR/Intrinsics.h"
56#include "llvm/IR/LLVMContext.h"
57#include "llvm/IR/MDBuilder.h"
58#include "llvm/IR/Metadata.h"
59#include "llvm/IR/Module.h"
60#include "llvm/IR/Type.h"
61#include "llvm/IR/Use.h"
62#include "llvm/IR/Value.h"
63#include "llvm/InitializePasses.h"
64#include "llvm/MC/MCSectionMachO.h"
65#include "llvm/Pass.h"
66#include "llvm/Support/Casting.h"
67#include "llvm/Support/CommandLine.h"
68#include "llvm/Support/Debug.h"
69#include "llvm/Support/ErrorHandling.h"
70#include "llvm/Support/MathExtras.h"
71#include "llvm/Support/ScopedPrinter.h"
72#include "llvm/Support/raw_ostream.h"
73#include "llvm/Transforms/Instrumentation.h"
74#include "llvm/Transforms/Instrumentation/AddressSanitizerCommon.h"
75#include "llvm/Transforms/Utils/ASanStackFrameLayout.h"
76#include "llvm/Transforms/Utils/BasicBlockUtils.h"
77#include "llvm/Transforms/Utils/Local.h"
78#include "llvm/Transforms/Utils/ModuleUtils.h"
79#include "llvm/Transforms/Utils/PromoteMemToReg.h"
80#include <algorithm>
81#include <cassert>
82#include <cstddef>
83#include <cstdint>
84#include <iomanip>
85#include <limits>
86#include <memory>
87#include <sstream>
88#include <string>
89#include <tuple>
90
91using namespace llvm;
92
93#define DEBUG_TYPE "asan"
94
95static const uint64_t kDefaultShadowScale = 3;
96static const uint64_t kDefaultShadowOffset32 = 1ULL << 29;
97static const uint64_t kDefaultShadowOffset64 = 1ULL << 44;
98static const uint64_t kDynamicShadowSentinel =
99 std::numeric_limits<uint64_t>::max();
100static const uint64_t kSmallX86_64ShadowOffsetBase = 0x7FFFFFFF; // < 2G.
101static const uint64_t kSmallX86_64ShadowOffsetAlignMask = ~0xFFFULL;
102static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000;
103static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 44;
104static const uint64_t kSystemZ_ShadowOffset64 = 1ULL << 52;
105static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000;
106static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37;
107static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36;
108static const uint64_t kRISCV64_ShadowOffset64 = 0xd55550000;
109static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30;
110static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46;
111static const uint64_t kFreeBSDKasan_ShadowOffset64 = 0xdffff7c000000000;
112static const uint64_t kNetBSD_ShadowOffset32 = 1ULL << 30;
113static const uint64_t kNetBSD_ShadowOffset64 = 1ULL << 46;
114static const uint64_t kNetBSDKasan_ShadowOffset64 = 0xdfff900000000000;
115static const uint64_t kPS4CPU_ShadowOffset64 = 1ULL << 40;
116static const uint64_t kWindowsShadowOffset32 = 3ULL << 28;
117static const uint64_t kEmscriptenShadowOffset = 0;
118
119static const uint64_t kMyriadShadowScale = 5;
120static const uint64_t kMyriadMemoryOffset32 = 0x80000000ULL;
121static const uint64_t kMyriadMemorySize32 = 0x20000000ULL;
122static const uint64_t kMyriadTagShift = 29;
123static const uint64_t kMyriadDDRTag = 4;
124static const uint64_t kMyriadCacheBitMask32 = 0x40000000ULL;
125
126// The shadow memory space is dynamically allocated.
127static const uint64_t kWindowsShadowOffset64 = kDynamicShadowSentinel;
128
129static const size_t kMinStackMallocSize = 1 << 6; // 64B
130static const size_t kMaxStackMallocSize = 1 << 16; // 64K
131static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3;
132static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E;
133
134const char kAsanModuleCtorName[] = "asan.module_ctor";
135const char kAsanModuleDtorName[] = "asan.module_dtor";
136static const uint64_t kAsanCtorAndDtorPriority = 1;
137// On Emscripten, the system needs more than one priorities for constructors.
138static const uint64_t kAsanEmscriptenCtorAndDtorPriority = 50;
139const char kAsanReportErrorTemplate[] = "__asan_report_";
140const char kAsanRegisterGlobalsName[] = "__asan_register_globals";
141const char kAsanUnregisterGlobalsName[] = "__asan_unregister_globals";
142const char kAsanRegisterImageGlobalsName[] = "__asan_register_image_globals";
143const char kAsanUnregisterImageGlobalsName[] =
144 "__asan_unregister_image_globals";
145const char kAsanRegisterElfGlobalsName[] = "__asan_register_elf_globals";
146const char kAsanUnregisterElfGlobalsName[] = "__asan_unregister_elf_globals";
147const char kAsanPoisonGlobalsName[] = "__asan_before_dynamic_init";
148const char kAsanUnpoisonGlobalsName[] = "__asan_after_dynamic_init";
149const char kAsanInitName[] = "__asan_init";
150const char kAsanVersionCheckNamePrefix[] = "__asan_version_mismatch_check_v";
151const char kAsanPtrCmp[] = "__sanitizer_ptr_cmp";
152const char kAsanPtrSub[] = "__sanitizer_ptr_sub";
153const char kAsanHandleNoReturnName[] = "__asan_handle_no_return";
154static const int kMaxAsanStackMallocSizeClass = 10;
155const char kAsanStackMallocNameTemplate[] = "__asan_stack_malloc_";
156const char kAsanStackFreeNameTemplate[] = "__asan_stack_free_";
157const char kAsanGenPrefix[] = "___asan_gen_";
158const char kODRGenPrefix[] = "__odr_asan_gen_";
159const char kSanCovGenPrefix[] = "__sancov_gen_";
160const char kAsanSetShadowPrefix[] = "__asan_set_shadow_";
161const char kAsanPoisonStackMemoryName[] = "__asan_poison_stack_memory";
162const char kAsanUnpoisonStackMemoryName[] = "__asan_unpoison_stack_memory";
163
164// ASan version script has __asan_* wildcard. Triple underscore prevents a
165// linker (gold) warning about attempting to export a local symbol.
166const char kAsanGlobalsRegisteredFlagName[] = "___asan_globals_registered";
167
168const char kAsanOptionDetectUseAfterReturn[] =
169 "__asan_option_detect_stack_use_after_return";
170
171const char kAsanShadowMemoryDynamicAddress[] =
172 "__asan_shadow_memory_dynamic_address";
173
174const char kAsanAllocaPoison[] = "__asan_alloca_poison";
175const char kAsanAllocasUnpoison[] = "__asan_allocas_unpoison";
176
177const char kAMDGPUAddressSharedName[] = "llvm.amdgcn.is.shared";
178const char kAMDGPUAddressPrivateName[] = "llvm.amdgcn.is.private";
179
180// Accesses sizes are powers of two: 1, 2, 4, 8, 16.
181static const size_t kNumberOfAccessSizes = 5;
182
183static const unsigned kAllocaRzSize = 32;
184
185// Command-line flags.
186
187static cl::opt<bool> ClEnableKasan(
188 "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"),
189 cl::Hidden, cl::init(false));
190
191static cl::opt<bool> ClRecover(
192 "asan-recover",
193 cl::desc("Enable recovery mode (continue-after-error)."),
194 cl::Hidden, cl::init(false));
195
196static cl::opt<bool> ClInsertVersionCheck(
197 "asan-guard-against-version-mismatch",
198 cl::desc("Guard against compiler/runtime version mismatch."),
199 cl::Hidden, cl::init(true));
200
201// This flag may need to be replaced with -f[no-]asan-reads.
202static cl::opt<bool> ClInstrumentReads("asan-instrument-reads",
203 cl::desc("instrument read instructions"),
204 cl::Hidden, cl::init(true));
205
206static cl::opt<bool> ClInstrumentWrites(
207 "asan-instrument-writes", cl::desc("instrument write instructions"),
208 cl::Hidden, cl::init(true));
209
210static cl::opt<bool> ClInstrumentAtomics(
211 "asan-instrument-atomics",
212 cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden,
213 cl::init(true));
214
215static cl::opt<bool>
216 ClInstrumentByval("asan-instrument-byval",
217 cl::desc("instrument byval call arguments"), cl::Hidden,
218 cl::init(true));
219
220static cl::opt<bool> ClAlwaysSlowPath(
221 "asan-always-slow-path",
222 cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden,
223 cl::init(false));
224
225static cl::opt<bool> ClForceDynamicShadow(
226 "asan-force-dynamic-shadow",
227 cl::desc("Load shadow address into a local variable for each function"),
228 cl::Hidden, cl::init(false));
229
230static cl::opt<bool>
231 ClWithIfunc("asan-with-ifunc",
232 cl::desc("Access dynamic shadow through an ifunc global on "
233 "platforms that support this"),
234 cl::Hidden, cl::init(true));
235
236static cl::opt<bool> ClWithIfuncSuppressRemat(
237 "asan-with-ifunc-suppress-remat",
238 cl::desc("Suppress rematerialization of dynamic shadow address by passing "
239 "it through inline asm in prologue."),
240 cl::Hidden, cl::init(true));
241
242// This flag limits the number of instructions to be instrumented
243// in any given BB. Normally, this should be set to unlimited (INT_MAX),
244// but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary
245// set it to 10000.
246static cl::opt<int> ClMaxInsnsToInstrumentPerBB(
247 "asan-max-ins-per-bb", cl::init(10000),
248 cl::desc("maximal number of instructions to instrument in any given BB"),
249 cl::Hidden);
250
251// This flag may need to be replaced with -f[no]asan-stack.
252static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"),
253 cl::Hidden, cl::init(true));
254static cl::opt<uint32_t> ClMaxInlinePoisoningSize(
255 "asan-max-inline-poisoning-size",
256 cl::desc(
257 "Inline shadow poisoning for blocks up to the given size in bytes."),
258 cl::Hidden, cl::init(64));
259
260static cl::opt<bool> ClUseAfterReturn("asan-use-after-return",
261 cl::desc("Check stack-use-after-return"),
262 cl::Hidden, cl::init(true));
263
264static cl::opt<bool> ClRedzoneByvalArgs("asan-redzone-byval-args",
265 cl::desc("Create redzones for byval "
266 "arguments (extra copy "
267 "required)"), cl::Hidden,
268 cl::init(true));
269
270static cl::opt<bool> ClUseAfterScope("asan-use-after-scope",
271 cl::desc("Check stack-use-after-scope"),
272 cl::Hidden, cl::init(false));
273
274// This flag may need to be replaced with -f[no]asan-globals.
275static cl::opt<bool> ClGlobals("asan-globals",
276 cl::desc("Handle global objects"), cl::Hidden,
277 cl::init(true));
278
279static cl::opt<bool> ClInitializers("asan-initialization-order",
280 cl::desc("Handle C++ initializer order"),
281 cl::Hidden, cl::init(true));
282
283static cl::opt<bool> ClInvalidPointerPairs(
284 "asan-detect-invalid-pointer-pair",
285 cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden,
286 cl::init(false));
287
288static cl::opt<bool> ClInvalidPointerCmp(
289 "asan-detect-invalid-pointer-cmp",
290 cl::desc("Instrument <, <=, >, >= with pointer operands"), cl::Hidden,
291 cl::init(false));
292
293static cl::opt<bool> ClInvalidPointerSub(
294 "asan-detect-invalid-pointer-sub",
295 cl::desc("Instrument - operations with pointer operands"), cl::Hidden,
296 cl::init(false));
297
298static cl::opt<unsigned> ClRealignStack(
299 "asan-realign-stack",
300 cl::desc("Realign stack to the value of this flag (power of two)"),
301 cl::Hidden, cl::init(32));
302
303static cl::opt<int> ClInstrumentationWithCallsThreshold(
304 "asan-instrumentation-with-call-threshold",
305 cl::desc(
306 "If the function being instrumented contains more than "
307 "this number of memory accesses, use callbacks instead of "
308 "inline checks (-1 means never use callbacks)."),
309 cl::Hidden, cl::init(7000));
310
311static cl::opt<std::string> ClMemoryAccessCallbackPrefix(
312 "asan-memory-access-callback-prefix",
313 cl::desc("Prefix for memory access callbacks"), cl::Hidden,
314 cl::init("__asan_"));
315
316static cl::opt<bool>
317 ClInstrumentDynamicAllocas("asan-instrument-dynamic-allocas",
318 cl::desc("instrument dynamic allocas"),
319 cl::Hidden, cl::init(true));
320
321static cl::opt<bool> ClSkipPromotableAllocas(
322 "asan-skip-promotable-allocas",
323 cl::desc("Do not instrument promotable allocas"), cl::Hidden,
324 cl::init(true));
325
326// These flags allow to change the shadow mapping.
327// The shadow mapping looks like
328// Shadow = (Mem >> scale) + offset
329
330static cl::opt<int> ClMappingScale("asan-mapping-scale",
331 cl::desc("scale of asan shadow mapping"),
332 cl::Hidden, cl::init(0));
333
334static cl::opt<uint64_t>
335 ClMappingOffset("asan-mapping-offset",
336 cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"),
337 cl::Hidden, cl::init(0));
338
339// Optimization flags. Not user visible, used mostly for testing
340// and benchmarking the tool.
341
342static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"),
343 cl::Hidden, cl::init(true));
344
345static cl::opt<bool> ClOptSameTemp(
346 "asan-opt-same-temp", cl::desc("Instrument the same temp just once"),
347 cl::Hidden, cl::init(true));
348
349static cl::opt<bool> ClOptGlobals("asan-opt-globals",
350 cl::desc("Don't instrument scalar globals"),
351 cl::Hidden, cl::init(true));
352
353static cl::opt<bool> ClOptStack(
354 "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"),
355 cl::Hidden, cl::init(false));
356
357static cl::opt<bool> ClDynamicAllocaStack(
358 "asan-stack-dynamic-alloca",
359 cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden,
360 cl::init(true));
361
362static cl::opt<uint32_t> ClForceExperiment(
363 "asan-force-experiment",
364 cl::desc("Force optimization experiment (for testing)"), cl::Hidden,
365 cl::init(0));
366
367static cl::opt<bool>
368 ClUsePrivateAlias("asan-use-private-alias",
369 cl::desc("Use private aliases for global variables"),
370 cl::Hidden, cl::init(false));
371
372static cl::opt<bool>
373 ClUseOdrIndicator("asan-use-odr-indicator",
374 cl::desc("Use odr indicators to improve ODR reporting"),
375 cl::Hidden, cl::init(false));
376
377static cl::opt<bool>
378 ClUseGlobalsGC("asan-globals-live-support",
379 cl::desc("Use linker features to support dead "
380 "code stripping of globals"),
381 cl::Hidden, cl::init(true));
382
383// This is on by default even though there is a bug in gold:
384// https://sourceware.org/bugzilla/show_bug.cgi?id=19002
385static cl::opt<bool>
386 ClWithComdat("asan-with-comdat",
387 cl::desc("Place ASan constructors in comdat sections"),
388 cl::Hidden, cl::init(true));
389
390static cl::opt<AsanDtorKind> ClOverrideDestructorKind(
391 "asan-destructor-kind",
392 cl::desc("Sets the ASan destructor kind. The default is to use the value "
393 "provided to the pass constructor"),
394 cl::values(clEnumValN(AsanDtorKind::None, "none", "No destructors"),
395 clEnumValN(AsanDtorKind::Global, "global",
396 "Use global destructors")),
397 cl::init(AsanDtorKind::Invalid), cl::Hidden);
398
399// Debug flags.
400
401static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden,
402 cl::init(0));
403
404static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"),
405 cl::Hidden, cl::init(0));
406
407static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden,
408 cl::desc("Debug func"));
409
410static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"),
411 cl::Hidden, cl::init(-1));
412
413static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug max inst"),
414 cl::Hidden, cl::init(-1));
415
416STATISTIC(NumInstrumentedReads, "Number of instrumented reads");
417STATISTIC(NumInstrumentedWrites, "Number of instrumented writes");
418STATISTIC(NumOptimizedAccessesToGlobalVar,
419 "Number of optimized accesses to global vars");
420STATISTIC(NumOptimizedAccessesToStackVar,
421 "Number of optimized accesses to stack vars");
422
423namespace {
424
425/// This struct defines the shadow mapping using the rule:
426/// shadow = (mem >> Scale) ADD-or-OR Offset.
427/// If InGlobal is true, then
428/// extern char __asan_shadow[];
429/// shadow = (mem >> Scale) + &__asan_shadow
430struct ShadowMapping {
431 int Scale;
432 uint64_t Offset;
433 bool OrShadowOffset;
434 bool InGlobal;
435};
436
437} // end anonymous namespace
438
439static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize,
440 bool IsKasan) {
441 bool IsAndroid = TargetTriple.isAndroid();
442 bool IsIOS = TargetTriple.isiOS() || TargetTriple.isWatchOS();
443 bool IsMacOS = TargetTriple.isMacOSX();
444 bool IsFreeBSD = TargetTriple.isOSFreeBSD();
445 bool IsNetBSD = TargetTriple.isOSNetBSD();
446 bool IsPS4CPU = TargetTriple.isPS4CPU();
447 bool IsLinux = TargetTriple.isOSLinux();
448 bool IsPPC64 = TargetTriple.getArch() == Triple::ppc64 ||
449 TargetTriple.getArch() == Triple::ppc64le;
450 bool IsSystemZ = TargetTriple.getArch() == Triple::systemz;
451 bool IsX86_64 = TargetTriple.getArch() == Triple::x86_64;
452 bool IsMIPS32 = TargetTriple.isMIPS32();
453 bool IsMIPS64 = TargetTriple.isMIPS64();
454 bool IsArmOrThumb = TargetTriple.isARM() || TargetTriple.isThumb();
455 bool IsAArch64 = TargetTriple.getArch() == Triple::aarch64;
456 bool IsRISCV64 = TargetTriple.getArch() == Triple::riscv64;
457 bool IsWindows = TargetTriple.isOSWindows();
458 bool IsFuchsia = TargetTriple.isOSFuchsia();
459 bool IsMyriad = TargetTriple.getVendor() == llvm::Triple::Myriad;
460 bool IsEmscripten = TargetTriple.isOSEmscripten();
461 bool IsAMDGPU = TargetTriple.isAMDGPU();
462
463 // Asan support for AMDGPU assumes X86 as the host right now.
464 if (IsAMDGPU)
465 IsX86_64 = true;
466
467 ShadowMapping Mapping;
468
469 Mapping.Scale = IsMyriad ? kMyriadShadowScale : kDefaultShadowScale;
470 if (ClMappingScale.getNumOccurrences() > 0) {
471 Mapping.Scale = ClMappingScale;
472 }
473
474 if (LongSize == 32) {
475 if (IsAndroid)
476 Mapping.Offset = kDynamicShadowSentinel;
477 else if (IsMIPS32)
478 Mapping.Offset = kMIPS32_ShadowOffset32;
479 else if (IsFreeBSD)
480 Mapping.Offset = kFreeBSD_ShadowOffset32;
481 else if (IsNetBSD)
482 Mapping.Offset = kNetBSD_ShadowOffset32;
483 else if (IsIOS)
484 Mapping.Offset = kDynamicShadowSentinel;
485 else if (IsWindows)
486 Mapping.Offset = kWindowsShadowOffset32;
487 else if (IsEmscripten)
488 Mapping.Offset = kEmscriptenShadowOffset;
489 else if (IsMyriad) {
490 uint64_t ShadowOffset = (kMyriadMemoryOffset32 + kMyriadMemorySize32 -
491 (kMyriadMemorySize32 >> Mapping.Scale));
492 Mapping.Offset = ShadowOffset - (kMyriadMemoryOffset32 >> Mapping.Scale);
493 }
494 else
495 Mapping.Offset = kDefaultShadowOffset32;
496 } else { // LongSize == 64
497 // Fuchsia is always PIE, which means that the beginning of the address
498 // space is always available.
499 if (IsFuchsia)
500 Mapping.Offset = 0;
501 else if (IsPPC64)
502 Mapping.Offset = kPPC64_ShadowOffset64;
503 else if (IsSystemZ)
504 Mapping.Offset = kSystemZ_ShadowOffset64;
505 else if (IsFreeBSD && !IsMIPS64) {
506 if (IsKasan)
507 Mapping.Offset = kFreeBSDKasan_ShadowOffset64;
508 else
509 Mapping.Offset = kFreeBSD_ShadowOffset64;
510 } else if (IsNetBSD) {
511 if (IsKasan)
512 Mapping.Offset = kNetBSDKasan_ShadowOffset64;
513 else
514 Mapping.Offset = kNetBSD_ShadowOffset64;
515 } else if (IsPS4CPU)
516 Mapping.Offset = kPS4CPU_ShadowOffset64;
517 else if (IsLinux && IsX86_64) {
518 if (IsKasan)
519 Mapping.Offset = kLinuxKasan_ShadowOffset64;
520 else
521 Mapping.Offset = (kSmallX86_64ShadowOffsetBase &
522 (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale));
523 } else if (IsWindows && IsX86_64) {
524 Mapping.Offset = kWindowsShadowOffset64;
525 } else if (IsMIPS64)
526 Mapping.Offset = kMIPS64_ShadowOffset64;
527 else if (IsIOS)
528 Mapping.Offset = kDynamicShadowSentinel;
529 else if (IsMacOS && IsAArch64)
530 Mapping.Offset = kDynamicShadowSentinel;
531 else if (IsAArch64)
532 Mapping.Offset = kAArch64_ShadowOffset64;
533 else if (IsRISCV64)
534 Mapping.Offset = kRISCV64_ShadowOffset64;
535 else
536 Mapping.Offset = kDefaultShadowOffset64;
537 }
538
539 if (ClForceDynamicShadow) {
540 Mapping.Offset = kDynamicShadowSentinel;
541 }
542
543 if (ClMappingOffset.getNumOccurrences() > 0) {
544 Mapping.Offset = ClMappingOffset;
545 }
546
547 // OR-ing shadow offset if more efficient (at least on x86) if the offset
548 // is a power of two, but on ppc64 we have to use add since the shadow
549 // offset is not necessary 1/8-th of the address space. On SystemZ,
550 // we could OR the constant in a single instruction, but it's more
551 // efficient to load it once and use indexed addressing.
552 Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 && !IsSystemZ && !IsPS4CPU &&
553 !IsRISCV64 &&
554 !(Mapping.Offset & (Mapping.Offset - 1)) &&
555 Mapping.Offset != kDynamicShadowSentinel;
556 bool IsAndroidWithIfuncSupport =
557 IsAndroid && !TargetTriple.isAndroidVersionLT(21);
558 Mapping.InGlobal = ClWithIfunc && IsAndroidWithIfuncSupport && IsArmOrThumb;
559
560 return Mapping;
561}
562
563static uint64_t getRedzoneSizeForScale(int MappingScale) {
564 // Redzone used for stack and globals is at least 32 bytes.
565 // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively.
566 return std::max(32U, 1U << MappingScale);
567}
568
569static uint64_t GetCtorAndDtorPriority(Triple &TargetTriple) {
570 if (TargetTriple.isOSEmscripten()) {
571 return kAsanEmscriptenCtorAndDtorPriority;
572 } else {
573 return kAsanCtorAndDtorPriority;
574 }
575}
576
577namespace {
578
579/// Module analysis for getting various metadata about the module.
580class ASanGlobalsMetadataWrapperPass : public ModulePass {
581public:
582 static char ID;
583
584 ASanGlobalsMetadataWrapperPass() : ModulePass(ID) {
585 initializeASanGlobalsMetadataWrapperPassPass(
586 *PassRegistry::getPassRegistry());
587 }
588
589 bool runOnModule(Module &M) override {
590 GlobalsMD = GlobalsMetadata(M);
591 return false;
592 }
593
594 StringRef getPassName() const override {
595 return "ASanGlobalsMetadataWrapperPass";
596 }
597
598 void getAnalysisUsage(AnalysisUsage &AU) const override {
599 AU.setPreservesAll();
600 }
601
602 GlobalsMetadata &getGlobalsMD() { return GlobalsMD; }
603
604private:
605 GlobalsMetadata GlobalsMD;
606};
607
608char ASanGlobalsMetadataWrapperPass::ID = 0;
609
610/// AddressSanitizer: instrument the code in module to find memory bugs.
611struct AddressSanitizer {
612 AddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD,
613 bool CompileKernel = false, bool Recover = false,
614 bool UseAfterScope = false)
615 : CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan
616 : CompileKernel),
617 Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover),
618 UseAfterScope(UseAfterScope || ClUseAfterScope), GlobalsMD(*GlobalsMD) {
619 C = &(M.getContext());
620 LongSize = M.getDataLayout().getPointerSizeInBits();
621 IntptrTy = Type::getIntNTy(*C, LongSize);
622 TargetTriple = Triple(M.getTargetTriple());
623
624 Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel);
625 }
626
627 uint64_t getAllocaSizeInBytes(const AllocaInst &AI) const {
628 uint64_t ArraySize = 1;
629 if (AI.isArrayAllocation()) {
630 const ConstantInt *CI = dyn_cast<ConstantInt>(AI.getArraySize());
631 assert(CI && "non-constant array size");
632 ArraySize = CI->getZExtValue();
633 }
634 Type *Ty = AI.getAllocatedType();
635 uint64_t SizeInBytes =
636 AI.getModule()->getDataLayout().getTypeAllocSize(Ty);
637 return SizeInBytes * ArraySize;
638 }
639
640 /// Check if we want (and can) handle this alloca.
641 bool isInterestingAlloca(const AllocaInst &AI);
642
643 bool ignoreAccess(Value *Ptr);
644 void getInterestingMemoryOperands(
645 Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting);
646
647 void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
648 InterestingMemoryOperand &O, bool UseCalls,
649 const DataLayout &DL);
650 void instrumentPointerComparisonOrSubtraction(Instruction *I);
651 void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore,
652 Value *Addr, uint32_t TypeSize, bool IsWrite,
653 Value *SizeArgument, bool UseCalls, uint32_t Exp);
654 Instruction *instrumentAMDGPUAddress(Instruction *OrigIns,
655 Instruction *InsertBefore, Value *Addr,
656 uint32_t TypeSize, bool IsWrite,
657 Value *SizeArgument);
658 void instrumentUnusualSizeOrAlignment(Instruction *I,
659 Instruction *InsertBefore, Value *Addr,
660 uint32_t TypeSize, bool IsWrite,
661 Value *SizeArgument, bool UseCalls,
662 uint32_t Exp);
663 Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
664 Value *ShadowValue, uint32_t TypeSize);
665 Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
666 bool IsWrite, size_t AccessSizeIndex,
667 Value *SizeArgument, uint32_t Exp);
668 void instrumentMemIntrinsic(MemIntrinsic *MI);
669 Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
670 bool suppressInstrumentationSiteForDebug(int &Instrumented);
671 bool instrumentFunction(Function &F, const TargetLibraryInfo *TLI);
672 bool maybeInsertAsanInitAtFunctionEntry(Function &F);
673 bool maybeInsertDynamicShadowAtFunctionEntry(Function &F);
674 void markEscapedLocalAllocas(Function &F);
675
676private:
677 friend struct FunctionStackPoisoner;
678
679 void initializeCallbacks(Module &M);
680
681 bool LooksLikeCodeInBug11395(Instruction *I);
682 bool GlobalIsLinkerInitialized(GlobalVariable *G);
683 bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr,
684 uint64_t TypeSize) const;
685
686 /// Helper to cleanup per-function state.
687 struct FunctionStateRAII {
688 AddressSanitizer *Pass;
689
690 FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) {
691 assert(Pass->ProcessedAllocas.empty() &&
692 "last pass forgot to clear cache");
693 assert(!Pass->LocalDynamicShadow);
694 }
695
696 ~FunctionStateRAII() {
697 Pass->LocalDynamicShadow = nullptr;
698 Pass->ProcessedAllocas.clear();
699 }
700 };
701
702 LLVMContext *C;
703 Triple TargetTriple;
704 int LongSize;
705 bool CompileKernel;
706 bool Recover;
707 bool UseAfterScope;
708 Type *IntptrTy;
709 ShadowMapping Mapping;
710 FunctionCallee AsanHandleNoReturnFunc;
711 FunctionCallee AsanPtrCmpFunction, AsanPtrSubFunction;
712 Constant *AsanShadowGlobal;
713
714 // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize).
715 FunctionCallee AsanErrorCallback[2][2][kNumberOfAccessSizes];
716 FunctionCallee AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes];
717
718 // These arrays is indexed by AccessIsWrite and Experiment.
719 FunctionCallee AsanErrorCallbackSized[2][2];
720 FunctionCallee AsanMemoryAccessCallbackSized[2][2];
721
722 FunctionCallee AsanMemmove, AsanMemcpy, AsanMemset;
723 Value *LocalDynamicShadow = nullptr;
724 const GlobalsMetadata &GlobalsMD;
725 DenseMap<const AllocaInst *, bool> ProcessedAllocas;
726
727 FunctionCallee AMDGPUAddressShared;
728 FunctionCallee AMDGPUAddressPrivate;
729};
730
731class AddressSanitizerLegacyPass : public FunctionPass {
732public:
733 static char ID;
734
735 explicit AddressSanitizerLegacyPass(bool CompileKernel = false,
736 bool Recover = false,
737 bool UseAfterScope = false)
738 : FunctionPass(ID), CompileKernel(CompileKernel), Recover(Recover),
739 UseAfterScope(UseAfterScope) {
740 initializeAddressSanitizerLegacyPassPass(*PassRegistry::getPassRegistry());
741 }
742
743 StringRef getPassName() const override {
744 return "AddressSanitizerFunctionPass";
745 }
746
747 void getAnalysisUsage(AnalysisUsage &AU) const override {
748 AU.addRequired<ASanGlobalsMetadataWrapperPass>();
749 AU.addRequired<TargetLibraryInfoWrapperPass>();
750 }
751
752 bool runOnFunction(Function &F) override {
753 GlobalsMetadata &GlobalsMD =
754 getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD();
755 const TargetLibraryInfo *TLI =
756 &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
757 AddressSanitizer ASan(*F.getParent(), &GlobalsMD, CompileKernel, Recover,
758 UseAfterScope);
759 return ASan.instrumentFunction(F, TLI);
760 }
761
762private:
763 bool CompileKernel;
764 bool Recover;
765 bool UseAfterScope;
766};
767
768class ModuleAddressSanitizer {
769public:
770 ModuleAddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD,
771 bool CompileKernel = false, bool Recover = false,
772 bool UseGlobalsGC = true, bool UseOdrIndicator = false,
773 AsanDtorKind DestructorKind = AsanDtorKind::Global)
774 : GlobalsMD(*GlobalsMD),
775 CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan
776 : CompileKernel),
777 Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover),
778 UseGlobalsGC(UseGlobalsGC && ClUseGlobalsGC && !this->CompileKernel),
779 // Enable aliases as they should have no downside with ODR indicators.
780 UsePrivateAlias(UseOdrIndicator || ClUsePrivateAlias),
781 UseOdrIndicator(UseOdrIndicator || ClUseOdrIndicator),
782 // Not a typo: ClWithComdat is almost completely pointless without
783 // ClUseGlobalsGC (because then it only works on modules without
784 // globals, which are rare); it is a prerequisite for ClUseGlobalsGC;
785 // and both suffer from gold PR19002 for which UseGlobalsGC constructor
786 // argument is designed as workaround. Therefore, disable both
787 // ClWithComdat and ClUseGlobalsGC unless the frontend says it's ok to
788 // do globals-gc.
789 UseCtorComdat(UseGlobalsGC && ClWithComdat && !this->CompileKernel),
790 DestructorKind(DestructorKind) {
791 C = &(M.getContext());
792 int LongSize = M.getDataLayout().getPointerSizeInBits();
793 IntptrTy = Type::getIntNTy(*C, LongSize);
794 TargetTriple = Triple(M.getTargetTriple());
795 Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel);
796
797 if (ClOverrideDestructorKind != AsanDtorKind::Invalid)
798 this->DestructorKind = ClOverrideDestructorKind;
799 assert(this->DestructorKind != AsanDtorKind::Invalid);
800 }
801
802 bool instrumentModule(Module &);
803
804private:
805 void initializeCallbacks(Module &M);
806
807 bool InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat);
808 void InstrumentGlobalsCOFF(IRBuilder<> &IRB, Module &M,
809 ArrayRef<GlobalVariable *> ExtendedGlobals,
810 ArrayRef<Constant *> MetadataInitializers);
811 void InstrumentGlobalsELF(IRBuilder<> &IRB, Module &M,
812 ArrayRef<GlobalVariable *> ExtendedGlobals,
813 ArrayRef<Constant *> MetadataInitializers,
814 const std::string &UniqueModuleId);
815 void InstrumentGlobalsMachO(IRBuilder<> &IRB, Module &M,
816 ArrayRef<GlobalVariable *> ExtendedGlobals,
817 ArrayRef<Constant *> MetadataInitializers);
818 void
819 InstrumentGlobalsWithMetadataArray(IRBuilder<> &IRB, Module &M,
820 ArrayRef<GlobalVariable *> ExtendedGlobals,
821 ArrayRef<Constant *> MetadataInitializers);
822
823 GlobalVariable *CreateMetadataGlobal(Module &M, Constant *Initializer,
824 StringRef OriginalName);
825 void SetComdatForGlobalMetadata(GlobalVariable *G, GlobalVariable *Metadata,
826 StringRef InternalSuffix);
827 Instruction *CreateAsanModuleDtor(Module &M);
828
829 const GlobalVariable *getExcludedAliasedGlobal(const GlobalAlias &GA) const;
830 bool shouldInstrumentGlobal(GlobalVariable *G) const;
831 bool ShouldUseMachOGlobalsSection() const;
832 StringRef getGlobalMetadataSection() const;
833 void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName);
834 void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName);
835 uint64_t getMinRedzoneSizeForGlobal() const {
836 return getRedzoneSizeForScale(Mapping.Scale);
837 }
838 uint64_t getRedzoneSizeForGlobal(uint64_t SizeInBytes) const;
839 int GetAsanVersion(const Module &M) const;
840
841 const GlobalsMetadata &GlobalsMD;
842 bool CompileKernel;
843 bool Recover;
844 bool UseGlobalsGC;
845 bool UsePrivateAlias;
846 bool UseOdrIndicator;
847 bool UseCtorComdat;
848 AsanDtorKind DestructorKind;
849 Type *IntptrTy;
850 LLVMContext *C;
851 Triple TargetTriple;
852 ShadowMapping Mapping;
853 FunctionCallee AsanPoisonGlobals;
854 FunctionCallee AsanUnpoisonGlobals;
855 FunctionCallee AsanRegisterGlobals;
856 FunctionCallee AsanUnregisterGlobals;
857 FunctionCallee AsanRegisterImageGlobals;
858 FunctionCallee AsanUnregisterImageGlobals;
859 FunctionCallee AsanRegisterElfGlobals;
860 FunctionCallee AsanUnregisterElfGlobals;
861
862 Function *AsanCtorFunction = nullptr;
863 Function *AsanDtorFunction = nullptr;
864};
865
866class ModuleAddressSanitizerLegacyPass : public ModulePass {
867public:
868 static char ID;
869
870 explicit ModuleAddressSanitizerLegacyPass(
871 bool CompileKernel = false, bool Recover = false, bool UseGlobalGC = true,
872 bool UseOdrIndicator = false,
873 AsanDtorKind DestructorKind = AsanDtorKind::Global)
874 : ModulePass(ID), CompileKernel(CompileKernel), Recover(Recover),
875 UseGlobalGC(UseGlobalGC), UseOdrIndicator(UseOdrIndicator),
876 DestructorKind(DestructorKind) {
877 initializeModuleAddressSanitizerLegacyPassPass(
878 *PassRegistry::getPassRegistry());
879 }
880
881 StringRef getPassName() const override { return "ModuleAddressSanitizer"; }
882
883 void getAnalysisUsage(AnalysisUsage &AU) const override {
884 AU.addRequired<ASanGlobalsMetadataWrapperPass>();
885 }
886
887 bool runOnModule(Module &M) override {
888 GlobalsMetadata &GlobalsMD =
889 getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD();
890 ModuleAddressSanitizer ASanModule(M, &GlobalsMD, CompileKernel, Recover,
891 UseGlobalGC, UseOdrIndicator,
892 DestructorKind);
893 return ASanModule.instrumentModule(M);
894 }
895
896private:
897 bool CompileKernel;
898 bool Recover;
899 bool UseGlobalGC;
900 bool UseOdrIndicator;
901 AsanDtorKind DestructorKind;
902};
903
904// Stack poisoning does not play well with exception handling.
905// When an exception is thrown, we essentially bypass the code
906// that unpoisones the stack. This is why the run-time library has
907// to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire
908// stack in the interceptor. This however does not work inside the
909// actual function which catches the exception. Most likely because the
910// compiler hoists the load of the shadow value somewhere too high.
911// This causes asan to report a non-existing bug on 453.povray.
912// It sounds like an LLVM bug.
913struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
914 Function &F;
915 AddressSanitizer &ASan;
916 DIBuilder DIB;
917 LLVMContext *C;
918 Type *IntptrTy;
919 Type *IntptrPtrTy;
920 ShadowMapping Mapping;
921
922 SmallVector<AllocaInst *, 16> AllocaVec;
923 SmallVector<AllocaInst *, 16> StaticAllocasToMoveUp;
924 SmallVector<Instruction *, 8> RetVec;
925 unsigned StackAlignment;
926
927 FunctionCallee AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1],
928 AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1];
929 FunctionCallee AsanSetShadowFunc[0x100] = {};
930 FunctionCallee AsanPoisonStackMemoryFunc, AsanUnpoisonStackMemoryFunc;
931 FunctionCallee AsanAllocaPoisonFunc, AsanAllocasUnpoisonFunc;
932
933 // Stores a place and arguments of poisoning/unpoisoning call for alloca.
934 struct AllocaPoisonCall {
935 IntrinsicInst *InsBefore;
936 AllocaInst *AI;
937 uint64_t Size;
938 bool DoPoison;
939 };
940 SmallVector<AllocaPoisonCall, 8> DynamicAllocaPoisonCallVec;
941 SmallVector<AllocaPoisonCall, 8> StaticAllocaPoisonCallVec;
942 bool HasUntracedLifetimeIntrinsic = false;
943
944 SmallVector<AllocaInst *, 1> DynamicAllocaVec;
945 SmallVector<IntrinsicInst *, 1> StackRestoreVec;
946 AllocaInst *DynamicAllocaLayout = nullptr;
947 IntrinsicInst *LocalEscapeCall = nullptr;
948
949 bool HasInlineAsm = false;
950 bool HasReturnsTwiceCall = false;
951 bool PoisonStack;
952
953 FunctionStackPoisoner(Function &F, AddressSanitizer &ASan)
954 : F(F), ASan(ASan), DIB(*F.getParent(), /*AllowUnresolved*/ false),
955 C(ASan.C), IntptrTy(ASan.IntptrTy),
956 IntptrPtrTy(PointerType::get(IntptrTy, 0)), Mapping(ASan.Mapping),
957 StackAlignment(1 << Mapping.Scale),
958 PoisonStack(ClStack &&
959 !Triple(F.getParent()->getTargetTriple()).isAMDGPU()) {}
960
961 bool runOnFunction() {
962 if (!PoisonStack)
963 return false;
964
965 if (ClRedzoneByvalArgs)
966 copyArgsPassedByValToAllocas();
967
968 // Collect alloca, ret, lifetime instructions etc.
969 for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB);
970
971 if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false;
972
973 initializeCallbacks(*F.getParent());
974
975 if (HasUntracedLifetimeIntrinsic) {
976 // If there are lifetime intrinsics which couldn't be traced back to an
977 // alloca, we may not know exactly when a variable enters scope, and
978 // therefore should "fail safe" by not poisoning them.
979 StaticAllocaPoisonCallVec.clear();
980 DynamicAllocaPoisonCallVec.clear();
981 }
982
983 processDynamicAllocas();
984 processStaticAllocas();
985
986 if (ClDebugStack) {
987 LLVM_DEBUG(dbgs() << F);
988 }
989 return true;
990 }
991
992 // Arguments marked with the "byval" attribute are implicitly copied without
993 // using an alloca instruction. To produce redzones for those arguments, we
994 // copy them a second time into memory allocated with an alloca instruction.
995 void copyArgsPassedByValToAllocas();
996
997 // Finds all Alloca instructions and puts
998 // poisoned red zones around all of them.
999 // Then unpoison everything back before the function returns.
1000 void processStaticAllocas();
1001 void processDynamicAllocas();
1002
1003 void createDynamicAllocasInitStorage();
1004
1005 // ----------------------- Visitors.
1006 /// Collect all Ret instructions, or the musttail call instruction if it
1007 /// precedes the return instruction.
1008 void visitReturnInst(ReturnInst &RI) {
1009 if (CallInst *CI = RI.getParent()->getTerminatingMustTailCall())
1010 RetVec.push_back(CI);
1011 else
1012 RetVec.push_back(&RI);
1013 }
1014
1015 /// Collect all Resume instructions.
1016 void visitResumeInst(ResumeInst &RI) { RetVec.push_back(&RI); }
1017
1018 /// Collect all CatchReturnInst instructions.
1019 void visitCleanupReturnInst(CleanupReturnInst &CRI) { RetVec.push_back(&CRI); }
1020
1021 void unpoisonDynamicAllocasBeforeInst(Instruction *InstBefore,
1022 Value *SavedStack) {
1023 IRBuilder<> IRB(InstBefore);
1024 Value *DynamicAreaPtr = IRB.CreatePtrToInt(SavedStack, IntptrTy);
1025 // When we insert _asan_allocas_unpoison before @llvm.stackrestore, we
1026 // need to adjust extracted SP to compute the address of the most recent
1027 // alloca. We have a special @llvm.get.dynamic.area.offset intrinsic for
1028 // this purpose.
1029 if (!isa<ReturnInst>(InstBefore)) {
1030 Function *DynamicAreaOffsetFunc = Intrinsic::getDeclaration(
1031 InstBefore->getModule(), Intrinsic::get_dynamic_area_offset,
1032 {IntptrTy});
1033
1034 Value *DynamicAreaOffset = IRB.CreateCall(DynamicAreaOffsetFunc, {});
1035
1036 DynamicAreaPtr = IRB.CreateAdd(IRB.CreatePtrToInt(SavedStack, IntptrTy),
1037 DynamicAreaOffset);
1038 }
1039
1040 IRB.CreateCall(
1041 AsanAllocasUnpoisonFunc,
1042 {IRB.CreateLoad(IntptrTy, DynamicAllocaLayout), DynamicAreaPtr});
1043 }
1044
1045 // Unpoison dynamic allocas redzones.
1046 void unpoisonDynamicAllocas() {
1047 for (Instruction *Ret : RetVec)
1048 unpoisonDynamicAllocasBeforeInst(Ret, DynamicAllocaLayout);
1049
1050 for (Instruction *StackRestoreInst : StackRestoreVec)
1051 unpoisonDynamicAllocasBeforeInst(StackRestoreInst,
1052 StackRestoreInst->getOperand(0));
1053 }
1054
1055 // Deploy and poison redzones around dynamic alloca call. To do this, we
1056 // should replace this call with another one with changed parameters and
1057 // replace all its uses with new address, so
1058 // addr = alloca type, old_size, align
1059 // is replaced by
1060 // new_size = (old_size + additional_size) * sizeof(type)
1061 // tmp = alloca i8, new_size, max(align, 32)
1062 // addr = tmp + 32 (first 32 bytes are for the left redzone).
1063 // Additional_size is added to make new memory allocation contain not only
1064 // requested memory, but also left, partial and right redzones.
1065 void handleDynamicAllocaCall(AllocaInst *AI);
1066
1067 /// Collect Alloca instructions we want (and can) handle.
1068 void visitAllocaInst(AllocaInst &AI) {
1069 if (!ASan.isInterestingAlloca(AI)) {
1070 if (AI.isStaticAlloca()) {
1071 // Skip over allocas that are present *before* the first instrumented
1072 // alloca, we don't want to move those around.
1073 if (AllocaVec.empty())
1074 return;
1075
1076 StaticAllocasToMoveUp.push_back(&AI);
1077 }
1078 return;
1079 }
1080
1081 StackAlignment = std::max(StackAlignment, AI.getAlignment());
1082 if (!AI.isStaticAlloca())
1083 DynamicAllocaVec.push_back(&AI);
1084 else
1085 AllocaVec.push_back(&AI);
1086 }
1087
1088 /// Collect lifetime intrinsic calls to check for use-after-scope
1089 /// errors.
1090 void visitIntrinsicInst(IntrinsicInst &II) {
1091 Intrinsic::ID ID = II.getIntrinsicID();
1092 if (ID == Intrinsic::stackrestore) StackRestoreVec.push_back(&II);
1093 if (ID == Intrinsic::localescape) LocalEscapeCall = &II;
1094 if (!ASan.UseAfterScope)
1095 return;
1096 if (!II.isLifetimeStartOrEnd())
1097 return;
1098 // Found lifetime intrinsic, add ASan instrumentation if necessary.
1099 auto *Size = cast<ConstantInt>(II.getArgOperand(0));
1100 // If size argument is undefined, don't do anything.
1101 if (Size->isMinusOne()) return;
1102 // Check that size doesn't saturate uint64_t and can
1103 // be stored in IntptrTy.
1104 const uint64_t SizeValue = Size->getValue().getLimitedValue();
1105 if (SizeValue == ~0ULL ||
1106 !ConstantInt::isValueValidForType(IntptrTy, SizeValue))
1107 return;
1108 // Find alloca instruction that corresponds to llvm.lifetime argument.
1109 // Currently we can only handle lifetime markers pointing to the
1110 // beginning of the alloca.
1111 AllocaInst *AI = findAllocaForValue(II.getArgOperand(1), true);
1112 if (!AI) {
1113 HasUntracedLifetimeIntrinsic = true;
1114 return;
1115 }
1116 // We're interested only in allocas we can handle.
1117 if (!ASan.isInterestingAlloca(*AI))
1118 return;
1119 bool DoPoison = (ID == Intrinsic::lifetime_end);
1120 AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison};
1121 if (AI->isStaticAlloca())
1122 StaticAllocaPoisonCallVec.push_back(APC);
1123 else if (ClInstrumentDynamicAllocas)
1124 DynamicAllocaPoisonCallVec.push_back(APC);
1125 }
1126
1127 void visitCallBase(CallBase &CB) {
1128 if (CallInst *CI = dyn_cast<CallInst>(&CB)) {
1129 HasInlineAsm |= CI->isInlineAsm() && &CB != ASan.LocalDynamicShadow;
1130 HasReturnsTwiceCall |= CI->canReturnTwice();
1131 }
1132 }
1133
1134 // ---------------------- Helpers.
1135 void initializeCallbacks(Module &M);
1136
1137 // Copies bytes from ShadowBytes into shadow memory for indexes where
1138 // ShadowMask is not zero. If ShadowMask[i] is zero, we assume that
1139 // ShadowBytes[i] is constantly zero and doesn't need to be overwritten.
1140 void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes,
1141 IRBuilder<> &IRB, Value *ShadowBase);
1142 void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes,
1143 size_t Begin, size_t End, IRBuilder<> &IRB,
1144 Value *ShadowBase);
1145 void copyToShadowInline(ArrayRef<uint8_t> ShadowMask,
1146 ArrayRef<uint8_t> ShadowBytes, size_t Begin,
1147 size_t End, IRBuilder<> &IRB, Value *ShadowBase);
1148
1149 void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison);
1150
1151 Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L,
1152 bool Dynamic);
1153 PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue,
1154 Instruction *ThenTerm, Value *ValueIfFalse);
1155};
1156
1157} // end anonymous namespace
1158
1159void LocationMetadata::parse(MDNode *MDN) {
1160 assert(MDN->getNumOperands() == 3);
1161 MDString *DIFilename = cast<MDString>(MDN->getOperand(0));
1162 Filename = DIFilename->getString();
1163 LineNo = mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue();
1164 ColumnNo =
1165 mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue();
1166}
1167
1168// FIXME: It would be cleaner to instead attach relevant metadata to the globals
1169// we want to sanitize instead and reading this metadata on each pass over a
1170// function instead of reading module level metadata at first.
1171GlobalsMetadata::GlobalsMetadata(Module &M) {
1172 NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals");
1173 if (!Globals)
1174 return;
1175 for (auto MDN : Globals->operands()) {
1176 // Metadata node contains the global and the fields of "Entry".
1177 assert(MDN->getNumOperands() == 5);
1178 auto *V = mdconst::extract_or_null<Constant>(MDN->getOperand(0));
1179 // The optimizer may optimize away a global entirely.
1180 if (!V)
1181 continue;
1182 auto *StrippedV = V->stripPointerCasts();
1183 auto *GV = dyn_cast<GlobalVariable>(StrippedV);
1184 if (!GV)
1185 continue;
1186 // We can already have an entry for GV if it was merged with another
1187 // global.
1188 Entry &E = Entries[GV];
1189 if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1)))
1190 E.SourceLoc.parse(Loc);
1191 if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2)))
1192 E.Name = Name->getString();
1193 ConstantInt *IsDynInit = mdconst::extract<ConstantInt>(MDN->getOperand(3));
1194 E.IsDynInit |= IsDynInit->isOne();
1195 ConstantInt *IsExcluded =
1196 mdconst::extract<ConstantInt>(MDN->getOperand(4));
1197 E.IsExcluded |= IsExcluded->isOne();
1198 }
1199}
1200
1201AnalysisKey ASanGlobalsMetadataAnalysis::Key;
1202
1203GlobalsMetadata ASanGlobalsMetadataAnalysis::run(Module &M,
1204 ModuleAnalysisManager &AM) {
1205 return GlobalsMetadata(M);
1206}
1207
1208AddressSanitizerPass::AddressSanitizerPass(bool CompileKernel, bool Recover,
1209 bool UseAfterScope)
1210 : CompileKernel(CompileKernel), Recover(Recover),
1211 UseAfterScope(UseAfterScope) {}
1212
1213PreservedAnalyses AddressSanitizerPass::run(Function &F,
1214 AnalysisManager<Function> &AM) {
1215 auto &MAMProxy = AM.getResult<ModuleAnalysisManagerFunctionProxy>(F);
1216 Module &M = *F.getParent();
1217 if (auto *R = MAMProxy.getCachedResult<ASanGlobalsMetadataAnalysis>(M)) {
1218 const TargetLibraryInfo *TLI = &AM.getResult<TargetLibraryAnalysis>(F);
1219 AddressSanitizer Sanitizer(M, R, CompileKernel, Recover, UseAfterScope);
1220 if (Sanitizer.instrumentFunction(F, TLI))
1221 return PreservedAnalyses::none();
1222 return PreservedAnalyses::all();
1223 }
1224
1225 report_fatal_error(
1226 "The ASanGlobalsMetadataAnalysis is required to run before "
1227 "AddressSanitizer can run");
1228 return PreservedAnalyses::all();
1229}
1230
1231ModuleAddressSanitizerPass::ModuleAddressSanitizerPass(
1232 bool CompileKernel, bool Recover, bool UseGlobalGC, bool UseOdrIndicator,
1233 AsanDtorKind DestructorKind)
1234 : CompileKernel(CompileKernel), Recover(Recover), UseGlobalGC(UseGlobalGC),
1235 UseOdrIndicator(UseOdrIndicator), DestructorKind(DestructorKind) {}
1236
1237PreservedAnalyses ModuleAddressSanitizerPass::run(Module &M,
1238 AnalysisManager<Module> &AM) {
1239 GlobalsMetadata &GlobalsMD = AM.getResult<ASanGlobalsMetadataAnalysis>(M);
1240 ModuleAddressSanitizer Sanitizer(M, &GlobalsMD, CompileKernel, Recover,
1241 UseGlobalGC, UseOdrIndicator,
1242 DestructorKind);
1243 if (Sanitizer.instrumentModule(M))
1244 return PreservedAnalyses::none();
1245 return PreservedAnalyses::all();
1246}
1247
1248INITIALIZE_PASS(ASanGlobalsMetadataWrapperPass, "asan-globals-md",
1249 "Read metadata to mark which globals should be instrumented "
1250 "when running ASan.",
1251 false, true)
1252
1253char AddressSanitizerLegacyPass::ID = 0;
1254
1255INITIALIZE_PASS_BEGIN(
1256 AddressSanitizerLegacyPass, "asan",
1257 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,
1258 false)
1259INITIALIZE_PASS_DEPENDENCY(ASanGlobalsMetadataWrapperPass)
1260INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
1261INITIALIZE_PASS_END(
1262 AddressSanitizerLegacyPass, "asan",
1263 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,
1264 false)
1265
1266FunctionPass *llvm::createAddressSanitizerFunctionPass(bool CompileKernel,
1267 bool Recover,
1268 bool UseAfterScope) {
1269 assert(!CompileKernel || Recover);
1270 return new AddressSanitizerLegacyPass(CompileKernel, Recover, UseAfterScope);
1271}
1272
1273char ModuleAddressSanitizerLegacyPass::ID = 0;
1274
1275INITIALIZE_PASS(
1276 ModuleAddressSanitizerLegacyPass, "asan-module",
1277 "AddressSanitizer: detects use-after-free and out-of-bounds bugs."
1278 "ModulePass",
1279 false, false)
1280
1281ModulePass *llvm::createModuleAddressSanitizerLegacyPassPass(
1282 bool CompileKernel, bool Recover, bool UseGlobalsGC, bool UseOdrIndicator,
1283 AsanDtorKind Destructor) {
1284 assert(!CompileKernel || Recover);
1285 return new ModuleAddressSanitizerLegacyPass(
1286 CompileKernel, Recover, UseGlobalsGC, UseOdrIndicator, Destructor);
1287}
1288
1289static size_t TypeSizeToSizeIndex(uint32_t TypeSize) {
1290 size_t Res = countTrailingZeros(TypeSize / 8);
1291 assert(Res < kNumberOfAccessSizes);
1292 return Res;
1293}
1294
1295/// Create a global describing a source location.
1296static GlobalVariable *createPrivateGlobalForSourceLoc(Module &M,
1297 LocationMetadata MD) {
1298 Constant *LocData[] = {
1299 createPrivateGlobalForString(M, MD.Filename, true, kAsanGenPrefix),
1300 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo),
1301 ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo),
1302 };
1303 auto LocStruct = ConstantStruct::getAnon(LocData);
1304 auto GV = new GlobalVariable(M, LocStruct->getType(), true,
1305 GlobalValue::PrivateLinkage, LocStruct,
1306 kAsanGenPrefix);
1307 GV->setUnnamedAddr(GlobalValue::UnnamedAddr::Global);
1308 return GV;
1309}
1310
1311/// Check if \p G has been created by a trusted compiler pass.
1312static bool GlobalWasGeneratedByCompiler(GlobalVariable *G) {
1313 // Do not instrument @llvm.global_ctors, @llvm.used, etc.
1314 if (G->getName().startswith("llvm."))
1315 return true;
1316
1317 // Do not instrument asan globals.
1318 if (G->getName().startswith(kAsanGenPrefix) ||
1319 G->getName().startswith(kSanCovGenPrefix) ||
1320 G->getName().startswith(kODRGenPrefix))
1321 return true;
1322
1323 // Do not instrument gcov counter arrays.
1324 if (G->getName() == "__llvm_gcov_ctr")
1325 return true;
1326
1327 return false;
1328}
1329
1330static bool isUnsupportedAMDGPUAddrspace(Value *Addr) {
1331 Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType());
1332 unsigned int AddrSpace = PtrTy->getPointerAddressSpace();
1333 if (AddrSpace == 3 || AddrSpace == 5)
1334 return true;
1335 return false;
1336}
1337
1338Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) {
1339 // Shadow >> scale
1340 Shadow = IRB.CreateLShr(Shadow, Mapping.Scale);
1341 if (Mapping.Offset == 0) return Shadow;
1342 // (Shadow >> scale) | offset
1343 Value *ShadowBase;
1344 if (LocalDynamicShadow)
1345 ShadowBase = LocalDynamicShadow;
1346 else
1347 ShadowBase = ConstantInt::get(IntptrTy, Mapping.Offset);
1348 if (Mapping.OrShadowOffset)
1349 return IRB.CreateOr(Shadow, ShadowBase);
1350 else
1351 return IRB.CreateAdd(Shadow, ShadowBase);
1352}
1353
1354// Instrument memset/memmove/memcpy
1355void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) {
1356 IRBuilder<> IRB(MI);
1357 if (isa<MemTransferInst>(MI)) {
1358 IRB.CreateCall(
1359 isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy,
1360 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
1361 IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()),
1362 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
1363 } else if (isa<MemSetInst>(MI)) {
1364 IRB.CreateCall(
1365 AsanMemset,
1366 {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
1367 IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false),
1368 IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
1369 }
1370 MI->eraseFromParent();
1371}
1372
1373/// Check if we want (and can) handle this alloca.
1374bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) {
1375 auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI);
1376
1377 if (PreviouslySeenAllocaInfo != ProcessedAllocas.end())
1378 return PreviouslySeenAllocaInfo->getSecond();
1379
1380 bool IsInteresting =
1381 (AI.getAllocatedType()->isSized() &&
1382 // alloca() may be called with 0 size, ignore it.
1383 ((!AI.isStaticAlloca()) || getAllocaSizeInBytes(AI) > 0) &&
1384 // We are only interested in allocas not promotable to registers.
1385 // Promotable allocas are common under -O0.
1386 (!ClSkipPromotableAllocas || !isAllocaPromotable(&AI)) &&
1387 // inalloca allocas are not treated as static, and we don't want
1388 // dynamic alloca instrumentation for them as well.
1389 !AI.isUsedWithInAlloca() &&
1390 // swifterror allocas are register promoted by ISel
1391 !AI.isSwiftError());
1392
1393 ProcessedAllocas[&AI] = IsInteresting;
1394 return IsInteresting;
1395}
1396
1397bool AddressSanitizer::ignoreAccess(Value *Ptr) {
1398 // Instrument acesses from different address spaces only for AMDGPU.
1399 Type *PtrTy = cast<PointerType>(Ptr->getType()->getScalarType());
1400 if (PtrTy->getPointerAddressSpace() != 0 &&
1401 !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(Ptr)))
1402 return true;
1403
1404 // Ignore swifterror addresses.
1405 // swifterror memory addresses are mem2reg promoted by instruction
1406 // selection. As such they cannot have regular uses like an instrumentation
1407 // function and it makes no sense to track them as memory.
1408 if (Ptr->isSwiftError())
1409 return true;
1410
1411 // Treat memory accesses to promotable allocas as non-interesting since they
1412 // will not cause memory violations. This greatly speeds up the instrumented
1413 // executable at -O0.
1414 if (auto AI = dyn_cast_or_null<AllocaInst>(Ptr))
1415 if (ClSkipPromotableAllocas && !isInterestingAlloca(*AI))
1416 return true;
1417
1418 return false;
1419}
1420
1421void AddressSanitizer::getInterestingMemoryOperands(
1422 Instruction *I, SmallVectorImpl<InterestingMemoryOperand> &Interesting) {
1423 // Skip memory accesses inserted by another instrumentation.
1424 if (I->hasMetadata("nosanitize"))
1425 return;
1426
1427 // Do not instrument the load fetching the dynamic shadow address.
1428 if (LocalDynamicShadow == I)
1429 return;
1430
1431 if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
1432 if (!ClInstrumentReads || ignoreAccess(LI->getPointerOperand()))
1433 return;
1434 Interesting.emplace_back(I, LI->getPointerOperandIndex(), false,
1435 LI->getType(), LI->getAlign());
1436 } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
1437 if (!ClInstrumentWrites || ignoreAccess(SI->getPointerOperand()))
1438 return;
1439 Interesting.emplace_back(I, SI->getPointerOperandIndex(), true,
1440 SI->getValueOperand()->getType(), SI->getAlign());
1441 } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) {
1442 if (!ClInstrumentAtomics || ignoreAccess(RMW->getPointerOperand()))
1443 return;
1444 Interesting.emplace_back(I, RMW->getPointerOperandIndex(), true,
1445 RMW->getValOperand()->getType(), None);
1446 } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) {
1447 if (!ClInstrumentAtomics || ignoreAccess(XCHG->getPointerOperand()))
1448 return;
1449 Interesting.emplace_back(I, XCHG->getPointerOperandIndex(), true,
1450 XCHG->getCompareOperand()->getType(), None);
1451 } else if (auto CI = dyn_cast<CallInst>(I)) {
1452 auto *F = CI->getCalledFunction();
1453 if (F && (F->getName().startswith("llvm.masked.load.") ||
1454 F->getName().startswith("llvm.masked.store."))) {
1455 bool IsWrite = F->getName().startswith("llvm.masked.store.");
1456 // Masked store has an initial operand for the value.
1457 unsigned OpOffset = IsWrite ? 1 : 0;
1458 if (IsWrite ? !ClInstrumentWrites : !ClInstrumentReads)
1459 return;
1460
1461 auto BasePtr = CI->getOperand(OpOffset);
1462 if (ignoreAccess(BasePtr))
1463 return;
1464 auto Ty = cast<PointerType>(BasePtr->getType())->getElementType();
1465 MaybeAlign Alignment = Align(1);
1466 // Otherwise no alignment guarantees. We probably got Undef.
1467 if (auto *Op = dyn_cast<ConstantInt>(CI->getOperand(1 + OpOffset)))
1468 Alignment = Op->getMaybeAlignValue();
1469 Value *Mask = CI->getOperand(2 + OpOffset);
1470 Interesting.emplace_back(I, OpOffset, IsWrite, Ty, Alignment, Mask);
1471 } else {
1472 for (unsigned ArgNo = 0; ArgNo < CI->getNumArgOperands(); ArgNo++) {
1473 if (!ClInstrumentByval || !CI->isByValArgument(ArgNo) ||
1474 ignoreAccess(CI->getArgOperand(ArgNo)))
1475 continue;
1476 Type *Ty = CI->getParamByValType(ArgNo);
1477 Interesting.emplace_back(I, ArgNo, false, Ty, Align(1));
1478 }
1479 }
1480 }
1481}
1482
1483static bool isPointerOperand(Value *V) {
1484 return V->getType()->isPointerTy() || isa<PtrToIntInst>(V);
1485}
1486
1487// This is a rough heuristic; it may cause both false positives and
1488// false negatives. The proper implementation requires cooperation with
1489// the frontend.
1490static bool isInterestingPointerComparison(Instruction *I) {
1491 if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) {
1492 if (!Cmp->isRelational())
1493 return false;
1494 } else {
1495 return false;
1496 }
1497 return isPointerOperand(I->getOperand(0)) &&
1498 isPointerOperand(I->getOperand(1));
1499}
1500
1501// This is a rough heuristic; it may cause both false positives and
1502// false negatives. The proper implementation requires cooperation with
1503// the frontend.
1504static bool isInterestingPointerSubtraction(Instruction *I) {
1505 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) {
1506 if (BO->getOpcode() != Instruction::Sub)
1507 return false;
1508 } else {
1509 return false;
1510 }
1511 return isPointerOperand(I->getOperand(0)) &&
1512 isPointerOperand(I->getOperand(1));
1513}
1514
1515bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) {
1516 // If a global variable does not have dynamic initialization we don't
1517 // have to instrument it. However, if a global does not have initializer
1518 // at all, we assume it has dynamic initializer (in other TU).
1519 //
1520 // FIXME: Metadata should be attched directly to the global directly instead
1521 // of being added to llvm.asan.globals.
1522 return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit;
1523}
1524
1525void AddressSanitizer::instrumentPointerComparisonOrSubtraction(
1526 Instruction *I) {
1527 IRBuilder<> IRB(I);
1528 FunctionCallee F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction;
1529 Value *Param[2] = {I->getOperand(0), I->getOperand(1)};
1530 for (Value *&i : Param) {
1531 if (i->getType()->isPointerTy())
1532 i = IRB.CreatePointerCast(i, IntptrTy);
1533 }
1534 IRB.CreateCall(F, Param);
1535}
1536
1537static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I,
1538 Instruction *InsertBefore, Value *Addr,
1539 MaybeAlign Alignment, unsigned Granularity,
1540 uint32_t TypeSize, bool IsWrite,
1541 Value *SizeArgument, bool UseCalls,
1542 uint32_t Exp) {
1543 // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check
1544 // if the data is properly aligned.
1545 if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 ||
1546 TypeSize == 128) &&
1547 (!Alignment || *Alignment >= Granularity || *Alignment >= TypeSize / 8))
1548 return Pass->instrumentAddress(I, InsertBefore, Addr, TypeSize, IsWrite,
1549 nullptr, UseCalls, Exp);
1550 Pass->instrumentUnusualSizeOrAlignment(I, InsertBefore, Addr, TypeSize,
1551 IsWrite, nullptr, UseCalls, Exp);
1552}
1553
1554static void instrumentMaskedLoadOrStore(AddressSanitizer *Pass,
1555 const DataLayout &DL, Type *IntptrTy,
1556 Value *Mask, Instruction *I,
1557 Value *Addr, MaybeAlign Alignment,
1558 unsigned Granularity, uint32_t TypeSize,
1559 bool IsWrite, Value *SizeArgument,
1560 bool UseCalls, uint32_t Exp) {
1561 auto *VTy = cast<FixedVectorType>(
1562 cast<PointerType>(Addr->getType())->getElementType());
1563 uint64_t ElemTypeSize = DL.getTypeStoreSizeInBits(VTy->getScalarType());
1564 unsigned Num = VTy->getNumElements();
1565 auto Zero = ConstantInt::get(IntptrTy, 0);
1566 for (unsigned Idx = 0; Idx < Num; ++Idx) {
1567 Value *InstrumentedAddress = nullptr;
1568 Instruction *InsertBefore = I;
1569 if (auto *Vector = dyn_cast<ConstantVector>(Mask)) {
1570 // dyn_cast as we might get UndefValue
1571 if (auto *Masked = dyn_cast<ConstantInt>(Vector->getOperand(Idx))) {
1572 if (Masked->isZero())
1573 // Mask is constant false, so no instrumentation needed.
1574 continue;
1575 // If we have a true or undef value, fall through to doInstrumentAddress
1576 // with InsertBefore == I
1577 }
1578 } else {
1579 IRBuilder<> IRB(I);
1580 Value *MaskElem = IRB.CreateExtractElement(Mask, Idx);
1581 Instruction *ThenTerm = SplitBlockAndInsertIfThen(MaskElem, I, false);
1582 InsertBefore = ThenTerm;
1583 }
1584
1585 IRBuilder<> IRB(InsertBefore);
1586 InstrumentedAddress =
1587 IRB.CreateGEP(VTy, Addr, {Zero, ConstantInt::get(IntptrTy, Idx)});
1588 doInstrumentAddress(Pass, I, InsertBefore, InstrumentedAddress, Alignment,
1589 Granularity, ElemTypeSize, IsWrite, SizeArgument,
1590 UseCalls, Exp);
1591 }
1592}
1593
1594void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
1595 InterestingMemoryOperand &O, bool UseCalls,
1596 const DataLayout &DL) {
1597 Value *Addr = O.getPtr();
1598
1599 // Optimization experiments.
1600 // The experiments can be used to evaluate potential optimizations that remove
1601 // instrumentation (assess false negatives). Instead of completely removing
1602 // some instrumentation, you set Exp to a non-zero value (mask of optimization
1603 // experiments that want to remove instrumentation of this instruction).
1604 // If Exp is non-zero, this pass will emit special calls into runtime
1605 // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls
1606 // make runtime terminate the program in a special way (with a different
1607 // exit status). Then you run the new compiler on a buggy corpus, collect
1608 // the special terminations (ideally, you don't see them at all -- no false
1609 // negatives) and make the decision on the optimization.
1610 uint32_t Exp = ClForceExperiment;
1611
1612 if (ClOpt && ClOptGlobals) {
1613 // If initialization order checking is disabled, a simple access to a
1614 // dynamically initialized global is always valid.
1615 GlobalVariable *G = dyn_cast<GlobalVariable>(getUnderlyingObject(Addr));
1616 if (G && (!ClInitializers || GlobalIsLinkerInitialized(G)) &&
1617 isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) {
1618 NumOptimizedAccessesToGlobalVar++;
1619 return;
1620 }
1621 }
1622
1623 if (ClOpt && ClOptStack) {
1624 // A direct inbounds access to a stack variable is always valid.
1625 if (isa<AllocaInst>(getUnderlyingObject(Addr)) &&
1626 isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) {
1627 NumOptimizedAccessesToStackVar++;
1628 return;
1629 }
1630 }
1631
1632 if (O.IsWrite)
1633 NumInstrumentedWrites++;
1634 else
1635 NumInstrumentedReads++;
1636
1637 unsigned Granularity = 1 << Mapping.Scale;
1638 if (O.MaybeMask) {
1639 instrumentMaskedLoadOrStore(this, DL, IntptrTy, O.MaybeMask, O.getInsn(),
1640 Addr, O.Alignment, Granularity, O.TypeSize,
1641 O.IsWrite, nullptr, UseCalls, Exp);
1642 } else {
1643 doInstrumentAddress(this, O.getInsn(), O.getInsn(), Addr, O.Alignment,
1644 Granularity, O.TypeSize, O.IsWrite, nullptr, UseCalls,
1645 Exp);
1646 }
1647}
1648
1649Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore,
1650 Value *Addr, bool IsWrite,
1651 size_t AccessSizeIndex,
1652 Value *SizeArgument,
1653 uint32_t Exp) {
1654 IRBuilder<> IRB(InsertBefore);
1655 Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp);
1656 CallInst *Call = nullptr;
1657 if (SizeArgument) {
1658 if (Exp == 0)
1659 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0],
1660 {Addr, SizeArgument});
1661 else
1662 Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1],
1663 {Addr, SizeArgument, ExpVal});
1664 } else {
1665 if (Exp == 0)
1666 Call =
1667 IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr);
1668 else
1669 Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex],
1670 {Addr, ExpVal});
1671 }
1672
1673 Call->setCannotMerge();
1674 return Call;
1675}
1676
1677Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
1678 Value *ShadowValue,
1679 uint32_t TypeSize) {
1680 size_t Granularity = static_cast<size_t>(1) << Mapping.Scale;
1681 // Addr & (Granularity - 1)
1682 Value *LastAccessedByte =
1683 IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1));
1684 // (Addr & (Granularity - 1)) + size - 1
1685 if (TypeSize / 8 > 1)
1686 LastAccessedByte = IRB.CreateAdd(
1687 LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1));
1688 // (uint8_t) ((Addr & (Granularity-1)) + size - 1)
1689 LastAccessedByte =
1690 IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false);
1691 // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue
1692 return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue);
1693}
1694
1695Instruction *AddressSanitizer::instrumentAMDGPUAddress(
1696 Instruction *OrigIns, Instruction *InsertBefore, Value *Addr,
1697 uint32_t TypeSize, bool IsWrite, Value *SizeArgument) {
1698 // Do not instrument unsupported addrspaces.
1699 if (isUnsupportedAMDGPUAddrspace(Addr))
1700 return nullptr;
1701 Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType());
1702 // Follow host instrumentation for global and constant addresses.
1703 if (PtrTy->getPointerAddressSpace() != 0)
1704 return InsertBefore;
1705 // Instrument generic addresses in supported addressspaces.
1706 IRBuilder<> IRB(InsertBefore);
1707 Value *AddrLong = IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy());
1708 Value *IsShared = IRB.CreateCall(AMDGPUAddressShared, {AddrLong});
1709 Value *IsPrivate = IRB.CreateCall(AMDGPUAddressPrivate, {AddrLong});
1710 Value *IsSharedOrPrivate = IRB.CreateOr(IsShared, IsPrivate);
1711 Value *Cmp = IRB.CreateICmpNE(IRB.getTrue(), IsSharedOrPrivate);
1712 Value *AddrSpaceZeroLanding =
1713 SplitBlockAndInsertIfThen(Cmp, InsertBefore, false);
1714 InsertBefore = cast<Instruction>(AddrSpaceZeroLanding);
1715 return InsertBefore;
1716}
1717
1718void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
1719 Instruction *InsertBefore, Value *Addr,
1720 uint32_t TypeSize, bool IsWrite,
1721 Value *SizeArgument, bool UseCalls,
1722 uint32_t Exp) {
1723 bool IsMyriad = TargetTriple.getVendor() == llvm::Triple::Myriad;
1724
1725 if (TargetTriple.isAMDGPU()) {
1726 InsertBefore = instrumentAMDGPUAddress(OrigIns, InsertBefore, Addr,
1727 TypeSize, IsWrite, SizeArgument);
1728 if (!InsertBefore)
1729 return;
1730 }
1731
1732 IRBuilder<> IRB(InsertBefore);
1733 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
1734 size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize);
1735
1736 if (UseCalls) {
1737 if (Exp == 0)
1738 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex],
1739 AddrLong);
1740 else
1741 IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex],
1742 {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)});
1743 return;
1744 }
1745
1746 if (IsMyriad) {
1747 // Strip the cache bit and do range check.
1748 // AddrLong &= ~kMyriadCacheBitMask32
1749 AddrLong = IRB.CreateAnd(AddrLong, ~kMyriadCacheBitMask32);
1750 // Tag = AddrLong >> kMyriadTagShift
1751 Value *Tag = IRB.CreateLShr(AddrLong, kMyriadTagShift);
1752 // Tag == kMyriadDDRTag
1753 Value *TagCheck =
1754 IRB.CreateICmpEQ(Tag, ConstantInt::get(IntptrTy, kMyriadDDRTag));
1755
1756 Instruction *TagCheckTerm =
1757 SplitBlockAndInsertIfThen(TagCheck, InsertBefore, false,
1758 MDBuilder(*C).createBranchWeights(1, 100000));
1759 assert(cast<BranchInst>(TagCheckTerm)->isUnconditional());
1760 IRB.SetInsertPoint(TagCheckTerm);
1761 InsertBefore = TagCheckTerm;
1762 }
1763
1764 Type *ShadowTy =
1765 IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale));
1766 Type *ShadowPtrTy = PointerType::get(ShadowTy, 0);
1767 Value *ShadowPtr = memToShadow(AddrLong, IRB);
1768 Value *CmpVal = Constant::getNullValue(ShadowTy);
1769 Value *ShadowValue =
1770 IRB.CreateLoad(ShadowTy, IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy));
1771
1772 Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal);
1773 size_t Granularity = 1ULL << Mapping.Scale;
1774 Instruction *CrashTerm = nullptr;
1775
1776 if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) {
1777 // We use branch weights for the slow path check, to indicate that the slow
1778 // path is rarely taken. This seems to be the case for SPEC benchmarks.
1779 Instruction *CheckTerm = SplitBlockAndInsertIfThen(
1780 Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000));
1781 assert(cast<BranchInst>(CheckTerm)->isUnconditional());
1782 BasicBlock *NextBB = CheckTerm->getSuccessor(0);
1783 IRB.SetInsertPoint(CheckTerm);
1784 Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize);
1785 if (Recover) {
1786 CrashTerm = SplitBlockAndInsertIfThen(Cmp2, CheckTerm, false);
1787 } else {
1788 BasicBlock *CrashBlock =
1789 BasicBlock::Create(*C, "", NextBB->getParent(), NextBB);
1790 CrashTerm = new UnreachableInst(*C, CrashBlock);
1791 BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2);
1792 ReplaceInstWithInst(CheckTerm, NewTerm);
1793 }
1794 } else {
1795 CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover);
1796 }
1797
1798 Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite,
1799 AccessSizeIndex, SizeArgument, Exp);
1800 Crash->setDebugLoc(OrigIns->getDebugLoc());
1801}
1802
1803// Instrument unusual size or unusual alignment.
1804// We can not do it with a single check, so we do 1-byte check for the first
1805// and the last bytes. We call __asan_report_*_n(addr, real_size) to be able
1806// to report the actual access size.
1807void AddressSanitizer::instrumentUnusualSizeOrAlignment(
1808 Instruction *I, Instruction *InsertBefore, Value *Addr, uint32_t TypeSize,
1809 bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp) {
1810 IRBuilder<> IRB(InsertBefore);
1811 Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8);
1812 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
1813 if (UseCalls) {
1814 if (Exp == 0)
1815 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0],
1816 {AddrLong, Size});
1817 else
1818 IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1],
1819 {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)});
1820 } else {
1821 Value *LastByte = IRB.CreateIntToPtr(
1822 IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)),
1823 Addr->getType());
1824 instrumentAddress(I, InsertBefore, Addr, 8, IsWrite, Size, false, Exp);
1825 instrumentAddress(I, InsertBefore, LastByte, 8, IsWrite, Size, false, Exp);
1826 }
1827}
1828
1829void ModuleAddressSanitizer::poisonOneInitializer(Function &GlobalInit,
1830 GlobalValue *ModuleName) {
1831 // Set up the arguments to our poison/unpoison functions.
1832 IRBuilder<> IRB(&GlobalInit.front(),
1833 GlobalInit.front().getFirstInsertionPt());
1834
1835 // Add a call to poison all external globals before the given function starts.
1836 Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy);
1837 IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr);
1838
1839 // Add calls to unpoison all globals before each return instruction.
1840 for (auto &BB : GlobalInit.getBasicBlockList())
1841 if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator()))
1842 CallInst::Create(AsanUnpoisonGlobals, "", RI);
1843}
1844
1845void ModuleAddressSanitizer::createInitializerPoisonCalls(
1846 Module &M, GlobalValue *ModuleName) {
1847 GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors");
1848 if (!GV)
1849 return;
1850
1851 ConstantArray *CA = dyn_cast<ConstantArray>(GV->getInitializer());
1852 if (!CA)
1853 return;
1854
1855 for (Use &OP : CA->operands()) {
1856 if (isa<ConstantAggregateZero>(OP)) continue;
1857 ConstantStruct *CS = cast<ConstantStruct>(OP);
1858
1859 // Must have a function or null ptr.
1860 if (Function *F = dyn_cast<Function>(CS->getOperand(1))) {
1861 if (F->getName() == kAsanModuleCtorName) continue;
1862 auto *Priority = cast<ConstantInt>(CS->getOperand(0));
1863 // Don't instrument CTORs that will run before asan.module_ctor.
1864 if (Priority->getLimitedValue() <= GetCtorAndDtorPriority(TargetTriple))
1865 continue;
1866 poisonOneInitializer(*F, ModuleName);
1867 }
1868 }
1869}
1870
1871const GlobalVariable *
1872ModuleAddressSanitizer::getExcludedAliasedGlobal(const GlobalAlias &GA) const {
1873 // In case this function should be expanded to include rules that do not just
1874 // apply when CompileKernel is true, either guard all existing rules with an
1875 // 'if (CompileKernel) { ... }' or be absolutely sure that all these rules
1876 // should also apply to user space.
1877 assert(CompileKernel && "Only expecting to be called when compiling kernel");
1878
1879 const Constant *C = GA.getAliasee();
1880
1881 // When compiling the kernel, globals that are aliased by symbols prefixed
1882 // by "__" are special and cannot be padded with a redzone.
1883 if (GA.getName().startswith("__"))
1884 return dyn_cast<GlobalVariable>(C->stripPointerCastsAndAliases());
1885
1886 return nullptr;
1887}
1888
1889bool ModuleAddressSanitizer::shouldInstrumentGlobal(GlobalVariable *G) const {
1890 Type *Ty = G->getValueType();
1891 LLVM_DEBUG(dbgs() << "GLOBAL: " << *G << "\n");
1892
1893 // FIXME: Metadata should be attched directly to the global directly instead
1894 // of being added to llvm.asan.globals.
1895 if (GlobalsMD.get(G).IsExcluded) return false;
1896 if (!Ty->isSized()) return false;
1897 if (!G->hasInitializer()) return false;
1898 // Globals in address space 1 and 4 are supported for AMDGPU.
1899 if (G->getAddressSpace() &&
1900 !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(G)))
1901 return false;
1902 if (GlobalWasGeneratedByCompiler(G)) return false; // Our own globals.
1903 // Two problems with thread-locals:
1904 // - The address of the main thread's copy can't be computed at link-time.
1905 // - Need to poison all copies, not just the main thread's one.
1906 if (G->isThreadLocal()) return false;
1907 // For now, just ignore this Global if the alignment is large.
1908 if (G->getAlignment() > getMinRedzoneSizeForGlobal()) return false;
1909
1910 // For non-COFF targets, only instrument globals known to be defined by this
1911 // TU.
1912 // FIXME: We can instrument comdat globals on ELF if we are using the
1913 // GC-friendly metadata scheme.
1914 if (!TargetTriple.isOSBinFormatCOFF()) {
1915 if (!G->hasExactDefinition() || G->hasComdat())
1916 return false;
1917 } else {
1918 // On COFF, don't instrument non-ODR linkages.
1919 if (G->isInterposable())
1920 return false;
1921 }
1922
1923 // If a comdat is present, it must have a selection kind that implies ODR
1924 // semantics: no duplicates, any, or exact match.
1925 if (Comdat *C = G->getComdat()) {
1926 switch (C->getSelectionKind()) {
1927 case Comdat::Any:
1928 case Comdat::ExactMatch:
1929 case Comdat::NoDuplicates:
1930 break;
1931 case Comdat::Largest:
1932 case Comdat::SameSize:
1933 return false;
1934 }
1935 }
1936
1937 if (G->hasSection()) {
1938 // The kernel uses explicit sections for mostly special global variables
1939 // that we should not instrument. E.g. the kernel may rely on their layout
1940 // without redzones, or remove them at link time ("discard.*"), etc.
1941 if (CompileKernel)
1942 return false;
1943
1944 StringRef Section = G->getSection();
1945
1946 // Globals from llvm.metadata aren't emitted, do not instrument them.
1947 if (Section == "llvm.metadata") return false;
1948 // Do not instrument globals from special LLVM sections.
1949 if (Section.find("__llvm") != StringRef::npos || Section.find("__LLVM") != StringRef::npos) return false;
1950
1951 // Do not instrument function pointers to initialization and termination
1952 // routines: dynamic linker will not properly handle redzones.
1953 if (Section.startswith(".preinit_array") ||
1954 Section.startswith(".init_array") ||
1955 Section.startswith(".fini_array")) {
1956 return false;
1957 }
1958
1959 // Do not instrument user-defined sections (with names resembling
1960 // valid C identifiers)
1961 if (TargetTriple.isOSBinFormatELF()) {
1962 if (llvm::all_of(Section,
1963 [](char c) { return llvm::isAlnum(c) || c == '_'; }))
1964 return false;
1965 }
1966
1967 // On COFF, if the section name contains '$', it is highly likely that the
1968 // user is using section sorting to create an array of globals similar to
1969 // the way initialization callbacks are registered in .init_array and
1970 // .CRT$XCU. The ATL also registers things in .ATL$__[azm]. Adding redzones
1971 // to such globals is counterproductive, because the intent is that they
1972 // will form an array, and out-of-bounds accesses are expected.
1973 // See https://github.com/google/sanitizers/issues/305
1974 // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx
1975 if (TargetTriple.isOSBinFormatCOFF() && Section.contains('$')) {
1976 LLVM_DEBUG(dbgs() << "Ignoring global in sorted section (contains '$'): "
1977 << *G << "\n");
1978 return false;
1979 }
1980
1981 if (TargetTriple.isOSBinFormatMachO()) {
1982 StringRef ParsedSegment, ParsedSection;
1983 unsigned TAA = 0, StubSize = 0;
1984 bool TAAParsed;
1985 cantFail(MCSectionMachO::ParseSectionSpecifier(
1986 Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize));
1987
1988 // Ignore the globals from the __OBJC section. The ObjC runtime assumes
1989 // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to
1990 // them.
1991 if (ParsedSegment == "__OBJC" ||
1992 (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) {
1993 LLVM_DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n");
1994 return false;
1995 }
1996 // See https://github.com/google/sanitizers/issues/32
1997 // Constant CFString instances are compiled in the following way:
1998 // -- the string buffer is emitted into
1999 // __TEXT,__cstring,cstring_literals
2000 // -- the constant NSConstantString structure referencing that buffer
2001 // is placed into __DATA,__cfstring
2002 // Therefore there's no point in placing redzones into __DATA,__cfstring.
2003 // Moreover, it causes the linker to crash on OS X 10.7
2004 if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") {
2005 LLVM_DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n");
2006 return false;
2007 }
2008 // The linker merges the contents of cstring_literals and removes the
2009 // trailing zeroes.
2010 if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) {
2011 LLVM_DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n");
2012 return false;
2013 }
2014 }
2015 }
2016
2017 if (CompileKernel) {
2018 // Globals that prefixed by "__" are special and cannot be padded with a
2019 // redzone.
2020 if (G->getName().startswith("__"))
2021 return false;
2022 }
2023
2024 return true;
2025}
2026
2027// On Mach-O platforms, we emit global metadata in a separate section of the
2028// binary in order to allow the linker to properly dead strip. This is only
2029// supported on recent versions of ld64.
2030bool ModuleAddressSanitizer::ShouldUseMachOGlobalsSection() const {
2031 if (!TargetTriple.isOSBinFormatMachO())
2032 return false;
2033
2034 if (TargetTriple.isMacOSX() && !TargetTriple.isMacOSXVersionLT(10, 11))
2035 return true;
2036 if (TargetTriple.isiOS() /* or tvOS */ && !TargetTriple.isOSVersionLT(9))
2037 return true;
2038 if (TargetTriple.isWatchOS() && !TargetTriple.isOSVersionLT(2))
2039 return true;
2040
2041 return false;
2042}
2043
2044StringRef ModuleAddressSanitizer::getGlobalMetadataSection() const {
2045 switch (TargetTriple.getObjectFormat()) {
2046 case Triple::COFF: return ".ASAN$GL";
2047 case Triple::ELF: return "asan_globals";
2048 case Triple::MachO: return "__DATA,__asan_globals,regular";
2049 case Triple::Wasm:
2050 case Triple::GOFF:
2051 case Triple::XCOFF:
2052 report_fatal_error(
2053 "ModuleAddressSanitizer not implemented for object file format");
2054 case Triple::UnknownObjectFormat:
2055 break;
2056 }
2057 llvm_unreachable("unsupported object format");
2058}
2059
2060void ModuleAddressSanitizer::initializeCallbacks(Module &M) {
2061 IRBuilder<> IRB(*C);
2062
2063 // Declare our poisoning and unpoisoning functions.
2064 AsanPoisonGlobals =
2065 M.getOrInsertFunction(kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy);
2066 AsanUnpoisonGlobals =
2067 M.getOrInsertFunction(kAsanUnpoisonGlobalsName, IRB.getVoidTy());
2068
2069 // Declare functions that register/unregister globals.
2070 AsanRegisterGlobals = M.getOrInsertFunction(
2071 kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy);
2072 AsanUnregisterGlobals = M.getOrInsertFunction(
2073 kAsanUnregisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy);
2074
2075 // Declare the functions that find globals in a shared object and then invoke
2076 // the (un)register function on them.
2077 AsanRegisterImageGlobals = M.getOrInsertFunction(
2078 kAsanRegisterImageGlobalsName, IRB.getVoidTy(), IntptrTy);
2079 AsanUnregisterImageGlobals = M.getOrInsertFunction(
2080 kAsanUnregisterImageGlobalsName, IRB.getVoidTy(), IntptrTy);
2081
2082 AsanRegisterElfGlobals =
2083 M.getOrInsertFunction(kAsanRegisterElfGlobalsName, IRB.getVoidTy(),
2084 IntptrTy, IntptrTy, IntptrTy);
2085 AsanUnregisterElfGlobals =
2086 M.getOrInsertFunction(kAsanUnregisterElfGlobalsName, IRB.getVoidTy(),
2087 IntptrTy, IntptrTy, IntptrTy);
2088}
2089
2090// Put the metadata and the instrumented global in the same group. This ensures
2091// that the metadata is discarded if the instrumented global is discarded.
2092void ModuleAddressSanitizer::SetComdatForGlobalMetadata(
2093 GlobalVariable *G, GlobalVariable *Metadata, StringRef InternalSuffix) {
2094 Module &M = *G->getParent();
2095 Comdat *C = G->getComdat();
2096 if (!C) {
2097 if (!G->hasName()) {
2098 // If G is unnamed, it must be internal. Give it an artificial name
2099 // so we can put it in a comdat.
2100 assert(G->hasLocalLinkage());
2101 G->setName(Twine(kAsanGenPrefix) + "_anon_global");
2102 }
2103
2104 if (!InternalSuffix.empty() && G->hasLocalLinkage()) {
2105 std::string Name = std::string(G->getName());
2106 Name += InternalSuffix;
2107 C = M.getOrInsertComdat(Name);
2108 } else {
2109 C = M.getOrInsertComdat(G->getName());
2110 }
2111
2112 // Make this IMAGE_COMDAT_SELECT_NODUPLICATES on COFF. Also upgrade private
2113 // linkage to internal linkage so that a symbol table entry is emitted. This
2114 // is necessary in order to create the comdat group.
2115 if (TargetTriple.isOSBinFormatCOFF()) {
2116 C->setSelectionKind(Comdat::NoDuplicates);
2117 if (G->hasPrivateLinkage())
2118 G->setLinkage(GlobalValue::InternalLinkage);
2119 }
2120 G->setComdat(C);
2121 }
2122
2123 assert(G->hasComdat());
2124 Metadata->setComdat(G->getComdat());
2125}
2126
2127// Create a separate metadata global and put it in the appropriate ASan
2128// global registration section.
2129GlobalVariable *
2130ModuleAddressSanitizer::CreateMetadataGlobal(Module &M, Constant *Initializer,
2131 StringRef OriginalName) {
2132 auto Linkage = TargetTriple.isOSBinFormatMachO()
2133 ? GlobalVariable::InternalLinkage
2134 : GlobalVariable::PrivateLinkage;
2135 GlobalVariable *Metadata = new GlobalVariable(
2136 M, Initializer->getType(), false, Linkage, Initializer,
2137 Twine("__asan_global_") + GlobalValue::dropLLVMManglingEscape(OriginalName));
2138 Metadata->setSection(getGlobalMetadataSection());
2139 return Metadata;
2140}
2141
2142Instruction *