summaryrefslogtreecommitdiffstats
path: root/compiler-rt/lib
Commit message (Collapse)AuthorAgeFilesLines
...
* [hwasan] formatting change, NFCKostya Serebryany2018-08-299-10/+13
| | | | llvm-svn: 340980
* [hwasan] rename some variables and functions for better readability, NFCKostya Serebryany2018-08-294-51/+54
| | | | llvm-svn: 340979
* [libFuzzer] Remove mutation stats and weighted mutation selection.Max Moroz2018-08-296-99/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: This was an experimental feature. After evaluating it with: 1) https://github.com/google/fuzzer-test-suite/tree/master/engine-comparison 2) enabling on real world fuzz targets running at ClusterFuzz and OSS-Fuzz The following conclusions were made: 1) With fuzz targets that have reached a code coverage plateau, the feature does not improve libFuzzer's ability to discover new coverage and may actually negatively impact it. 2) With fuzz targets that have not yet reached a code coverage plateau, the feature might speed up new units discovery in some cases, but it is quite rare and hard to confirm with a high level on confidence. Revert of https://reviews.llvm.org/D48054 and https://reviews.llvm.org/D49621. Reviewers: metzman, morehouse Reviewed By: metzman, morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Differential Revision: https://reviews.llvm.org/D51455 llvm-svn: 340976
* [hwasan] simplify the realloc implementation: always allocate/deallocate on ↵Kostya Serebryany2018-08-292-28/+7
| | | | | | realloc. This may slowdown some realloc-heavy code, but at least at this point a want simpler code. Also added a test llvm-svn: 340973
* Add a thread-local ring buffer of heap allocationsKostya Serebryany2018-08-296-4/+60
| | | | | | | | | | | | | | | | | | Summary: We need this in order to properly report heap-use-after-free, since we don't have a quarantine. This is a first part of the code, more like a proof of concept. But I'd like to commit at as is and proceed with refactoring, adding a ThreadRegistry, and extending the functionality. Reviewers: eugenis Subscribers: kubamracek, delcypher, #sanitizers, llvm-commits Differential Revision: https://reviews.llvm.org/D51394 llvm-svn: 340971
* [sanitizer] reapply r340884 'Add a RingBuffer class to sanitizer_common', ↵Kostya Serebryany2018-08-294-0/+159
| | | | | | with fixes for Windows llvm-svn: 340969
* [sanitizer] Revert D50940Kostya Kortchinsky2018-08-297-14/+11
| | | | | | | | | | | | | | | | | Summary: The previous version of the patch makes some code unable to distinguish failure to map address 0 and error. Revert to turn the bots back to green while figuring out a new approach. Reviewers: eugenis Reviewed By: eugenis Subscribers: kubamracek, delcypher, #sanitizers, llvm-commits Differential Revision: https://reviews.llvm.org/D51451 llvm-svn: 340957
* Revert "[libFuzzer] Port to Windows"Matt Morehouse2018-08-2910-95/+18
| | | | | | This reverts r340949 due to bot breakage again. llvm-svn: 340954
* [libFuzzer] Port to WindowsMatt Morehouse2018-08-2910-18/+95
| | | | | | | | | | | | | | | | | | Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: #sanitizers, delcypher, morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 340949
* Revert r340884 "Add a RingBuffer class to sanitizer_common"Hans Wennborg2018-08-294-166/+0
| | | | | | | | | | | | | | | | | | | The test doesn't pass on Windows, where sizeof(long) == 4 also on 64-bit, and so it isn't a multiple of sizeof(void*). This also reverts the follow-up r340886. > Summary: a constrained RingBuffer optimized for fast push > > Reviewers: eugenis > > Reviewed By: eugenis > > Subscribers: kubamracek, mgorny, delcypher, #sanitizers, llvm-commits > > Differential Revision: https://reviews.llvm.org/D51196 llvm-svn: 340924
* Introduce new type for inteceptors UINTMAX_TKamil Rytarowski2018-08-292-2/+3
| | | | | | | | | | | | | | | | | | | | | Summary: The UINTMAX_T type will be used in new interceptors. While there, correct the type of strtoumax(3) from INTMAX_T to UINTMAX_T. Original patch from Yang Zheng. Reviewers: vitalybuka, kcc, joerg Reviewed By: vitalybuka Subscribers: kubamracek, llvm-commits, tomsun.0.7, #sanitizers Tags: #sanitizers Differential Revision: https://reviews.llvm.org/D51106 llvm-svn: 340907
* [sanitizer] fix a testKostya Serebryany2018-08-281-19/+20
| | | | llvm-svn: 340886
* Add a RingBuffer class to sanitizer_commonKostya Serebryany2018-08-284-0/+165
| | | | | | | | | | | | | | Summary: a constrained RingBuffer optimized for fast push Reviewers: eugenis Reviewed By: eugenis Subscribers: kubamracek, mgorny, delcypher, #sanitizers, llvm-commits Differential Revision: https://reviews.llvm.org/D51196 llvm-svn: 340884
* Revert "[libFuzzer] Port to Windows"Matt Morehouse2018-08-2810-95/+18
| | | | | | This reverts commit r340860 due to failing tests. llvm-svn: 340867
* [libFuzzer] Port to WindowsMatt Morehouse2018-08-2810-18/+95
| | | | | | | | | | | | | | | | | | | | Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Patch By: metzman Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 340860
* SafeStack: Fix thread liveness check on *BSDVlad Tsyrklevich2018-08-281-1/+4
| | | | | | | | | | | | | | | | Summary: The Linux/BSD system call interfaces report errors differently, use the internal_iserror() function to correctly check errors on either. Reviewers: eugenis Reviewed By: eugenis Subscribers: delcypher, llvm-commits, #sanitizers, krytarowski, kcc, devnexen Differential Revision: https://reviews.llvm.org/D51368 llvm-svn: 340856
* [XRay][compiler-rt] Remove uses of internal allocator in profiling modeDean Michael Berris2018-08-281-24/+30
| | | | | | | | | | | | | | | | | | Summary: This change removes further cases where the profiling mode implementation relied on dynamic memory allocation. We're using thread-local aligned (uninitialized) memory instead, which we initialize appropriately with placement new. Addresses llvm.org/PR38577. Reviewers: eizan, kpw Subscribers: jfb, llvm-commits Differential Revision: https://reviews.llvm.org/D51278 llvm-svn: 340814
* [XRay][compiler-rt] Stash flags as well in x86_64 trampolineDean Michael Berris2018-08-281-0/+2
| | | | | | | | | | | | | | | | Summary: This change saves and restores the full flags register in x86_64 mode. This makes running instrumented signal handlers safer, and avoids flags set during the execution of the event handlers from polluting the instrumented call's flags state. Reviewers: kpw, eizan, jfb Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D51277 llvm-svn: 340812
* [sanitizer][fuzzer] Transition back to ZX_TIME_INFINITEPetr Hosek2018-08-272-11/+5
| | | | | | | | | | Now that all Zircon calls have been transitioned to take time as signed value, we can transition back to ZX_TIME_INFINITE, undoing the change made in r337802. Differential Revision: https://reviews.llvm.org/D51266 llvm-svn: 340764
* Revert "[lsan] Do not check for leaks in the forked process"Vitaly Buka2018-08-271-9/+0
| | | | | | | | Users need leak reports in forks. This reverts commit r334036. llvm-svn: 340758
* [scudo] Replace eraseHeader with compareExchangeHeader for Quarantined chunksKostya Kortchinsky2018-08-241-10/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: The reason for the existence of `eraseHeader` was that it was deemed faster to null-out a chunk header, effectively making it invalid, rather than marking it as available, which incurred a checksum computation and a cmpxchg. A previous use of `eraseHeader` was removed with D50655 due to a race. Now we remove the second use of it in the Quarantine deallocation path and replace is with a `compareExchangeHeader`. The reason for this is that greatly helps debugging some heap bugs as the chunk header is now valid and the chunk marked available, as opposed to the header being invalid. Eg: we get an invalid state error, instead of an invalid header error, which reduces the possibilities. The computational penalty is negligible. Reviewers: alekseyshl, flowerhack, eugenis Reviewed By: eugenis Subscribers: delcypher, jfb, #sanitizers, llvm-commits Differential Revision: https://reviews.llvm.org/D51224 llvm-svn: 340633
* [Sanitizer] implementing remaining function under OSXDavid Carlier2018-08-242-5/+8
| | | | | | | | | | | | | - GetRandom and GetnumberOfCPUs using sys call for the former. - enabling unit tests for the other oses. Reviewers: kubamracek Reviewed By: kubamracek Differential Revision: https://reviews.llvm.org/D50937 llvm-svn: 340621
* [hwasan] implement detection of realloc-after-freeKostya Serebryany2018-08-241-1/+5
| | | | llvm-svn: 340593
* [hwasan] implement detection of double-free (invalid-free)Kostya Serebryany2018-08-243-21/+64
| | | | llvm-svn: 340591
* [sanitizer] Don't call task_for_pid(mach_task_self). NFC.Kuba Mracek2018-08-232-14/+2
| | | | | | | | | | Calling task_for_pid with mach_task_self is just returning mach_task_self anyway, but it also triggers system warnings (task_for_pid is only supposed to be used by high-privileged executables). NFC. rdar://problem/39198248 Differential Revision: https://reviews.llvm.org/D51119 llvm-svn: 340587
* [sanitizer] Change Mmap*NoAccess to return nullptr on errorKostya Kortchinsky2018-08-237-11/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: `MmapNoAccess` & `MmapFixedNoAccess` return directly the result of `internal_mmap`, as opposed to other Mmap functions that return nullptr. This inconsistency leads to some confusion for the callers, as some check for `~(uptr)0` (`MAP_FAILED`) for failure (while it can fail with `-ENOMEM` for example). Two potential solutions: change the callers, or make the functions return `nullptr` on failure to follow the precedent set by the other functions. The second option looked more appropriate to me. Correct the callers that were wrongly checking for `~(uptr)0` or `MAP_FAILED`. TODO for follow up CLs: - There are a couple of `internal_mmap` calls in XRay that check for MMAP_FAILED as a result as well (cc: @dberris); they should use `internal_iserror`; Reviewers: eugenis, alekseyshl, dberris, kubamracek Reviewed By: alekseyshl Subscribers: kristina, kubamracek, delcypher, #sanitizers, dberris, llvm-commits Differential Revision: https://reviews.llvm.org/D50940 llvm-svn: 340576
* [hwasan] make error reporting look more like in asan, print the memory tag ↵Kostya Serebryany2018-08-221-6/+32
| | | | | | around the buggy access, simplify one test llvm-svn: 340470
* [hwasan] remove stale data fieldKostya Serebryany2018-08-221-1/+0
| | | | llvm-svn: 340442
* [tsan] Adjust setjmp/longjmp handling on Darwin for macOS MojaveKuba Mracek2018-08-216-4/+30
| | | | | | | | | | On macOS Mojave, the OS started using the XOR-by-a-secret-key scheme (same as glibc is alread doing) for storing the SP value in setjmp environment. We need to adjust for that to keep supporting setjmp/longjmp on latest Darwin. The patch is basically doing the same what we're already doing for glibc. rdar://problem/43542596 Differential Revision: https://reviews.llvm.org/D51064 llvm-svn: 340350
* Fixup for r340342: Avoid Block_release'ing the block since we're no longer ↵Kuba Mracek2018-08-211-1/+1
| | | | | | | | making a copy. rdar://problem/42242579 llvm-svn: 340347
* [tsan] Avoid calling Block_copy in the "sync" GCD interceptorsKuba Mracek2018-08-211-4/+1
| | | | | | | | | | The synchronous dispatch functions in GCD (dispatch_sync, dispatch_barrier_sync), don't make a copy of the passed block. To maintain binary compatibility, we should avoid doing that as well in TSan, as there's no reason to do that. The synchronous dispatch functions will not return before the block is actually executed. rdar://problem/42242579 Differential Revision: https://reviews.llvm.org/D50920 llvm-svn: 340342
* SafeStack: Use correct unsafe stack sizesVlad Tsyrklevich2018-08-211-1/+3
| | | | | | | | | | | | | | | | | Summary: When deallocating thread stacks, we use one thread's unsafe stack size to deallocate another thread's unsafe stack; however, the two sizes may differ. Record an unsafe stack's size in the thread stack linked list. Reviewers: pcc, eugenis Reviewed By: eugenis Subscribers: delcypher, llvm-commits, #sanitizers, kcc Differential Revision: https://reviews.llvm.org/D51016 llvm-svn: 340308
* [hwasan] Add a (almost) no-interceptor mode.Evgeniy Stepanov2018-08-208-183/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | Summary: The idea behind this change is to allow sanitization of libc. We are prototyping on Bionic, but the tool interface will be general enough (or at least generalizable) to support any other libc. When libc depends on libclang_rt.hwasan, the latter can not interpose libc functions. In fact, majority of interceptors become unnecessary when libc code is instrumented. This change gets rid of most hwasan interceptors and provides interface for libc to notify hwasan about thread creation and destruction events. Some interceptors (pthread_create) are kept under #ifdef to enable testing with uninstrumented libc. They are expressed in terms of the new libc interface. The new cmake switch, COMPILER_RT_HWASAN_WITH_INTERCEPTORS, ON by default, builds testing version of the library with the aforementioned pthread_create interceptor. With the OFF setting, the library becomes more of a libc plugin. Reviewers: vitalybuka, kcc, jfb Subscribers: srhines, kubamracek, mgorny, jfb, llvm-commits Differential Revision: https://reviews.llvm.org/D50922 llvm-svn: 340216
* [sanitizer] Use private futex operations for BlockingMutexKostya Kortchinsky2018-08-201-2/+6
| | | | | | | | | | | | | | | | | | Summary: Use `FUTEX_PRIVATE_FLAG` in conjunction with the wait & wake operations employed by `BlockingMutex`. As far as I can tell, the mutexes are process-private, and there is an actual performance benefit at employing the private operations. There should be no downside to switching to it. Reviewers: eugenis, alekseyshl, dvyukov Reviewed By: dvyukov Subscribers: kubamracek, delcypher, #sanitizers, llvm-commits Differential Revision: https://reviews.llvm.org/D50910 llvm-svn: 340178
* [sanitizer] When setting up shadow memory on iOS, fix handling the return ↵Kuba Mracek2018-08-171-2/+2
| | | | | | | | | | value of task_info on older OS versions task_vm_info is a "revisioned" structure, new OS versions add fields to the end, and compatibility is based on the reported size. On older OS versions, min_address/max_address is not filled back. Let's handle that case. Unfortunately, we can't really write a test (as the failure only happens when on a specific OS version). Differential Revision: https://reviews.llvm.org/D50275 llvm-svn: 340058
* [XRay][compiler-rt] Avoid InternalAlloc(...) in Profiling ModeDean Michael Berris2018-08-172-102/+112
| | | | | | | | | | | | | | | | | | | | | | | | Summary: We avoid using dynamic memory allocated with the internal allocator in the profile collection service used by profiling mode. We use aligned storage for globals and in-struct storage of objects we dynamically initialize. We also remove the dependency on `Vector<...>` which also internally uses the dynamic allocator in sanitizer_common (InternalAlloc) in favour of the XRay allocator and segmented array implementation. This change addresses llvm.org/PR38577. Reviewers: eizan Reviewed By: eizan Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D50782 llvm-svn: 339978
* Revert "[libFuzzer] Use std::discrete_distribution for input selection."Matt Morehouse2018-08-171-4/+7
| | | | | | | This reverts r339973 due to msan.test failing on sanitizer-x86_64-linux-fuzzer bot. llvm-svn: 339976
* [libFuzzer] Use std::discrete_distribution for input selection.Matt Morehouse2018-08-171-7/+4
| | | | | | | | | | | | | | | | | Summary: Since we're casting from double to size_t during input selection, we really want a discrete distribution over size_t rather than a piecewise distribution over doubles. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D50356 llvm-svn: 339973
* Revert "Revert "[hwasan] Add __hwasan_handle_longjmp.""Evgeniy Stepanov2018-08-163-7/+41
| | | | | | | | | | | This reapplies commit r339935 with the following changes: * make longjmp test C, not C++, to avoid dependency on libc++/libstdc++ * untag pointer in memset interceptor x86_64 does not have TBI, so hwasan barely works there. Tests must be carefully written in a way that does not leak tagged pointer to system libraries. llvm-svn: 339963
* Revert "[hwasan] Add __hwasan_handle_longjmp."Evgeniy Stepanov2018-08-162-21/+0
| | | | | | This reverts commit 339935 which breaks hwasan tests on x86_64. llvm-svn: 339957
* [hwasan] Enable Android logging.Evgeniy Stepanov2018-08-161-0/+3
| | | | | | | | | | | | Summary: Enable syslog as soon as the shadow is mapped. Reviewers: vitalybuka, kcc Subscribers: srhines, kubamracek, llvm-commits Differential Revision: https://reviews.llvm.org/D50865 llvm-svn: 339950
* [hwasan] Add __hwasan_handle_longjmp.Evgeniy Stepanov2018-08-162-0/+21
| | | | | | | | | | | | | | | | | Summary: A callback to annotate longjmp-like code. Unlike __asan_handle_no_return, in hwasan we can not conservatively "unpoison" the entire thread stack, because there is no such thing as unpoisoned memory. Pointer and memory tags must always match. Reviewers: vitalybuka, kcc Subscribers: kubamracek, llvm-commits Differential Revision: https://reviews.llvm.org/D50752 llvm-svn: 339935
* [hwasan] Add malloc_fill_byte and free_fill_byte flags.Evgeniy Stepanov2018-08-162-1/+22
| | | | | | | | | | Reviewers: vitalybuka, kcc Subscribers: kubamracek, llvm-commits Differential Revision: https://reviews.llvm.org/D50753 llvm-svn: 339932
* [Sanitizer] Fix build openbsdDavid Carlier2018-08-161-1/+10
| | | | | | | | | | | | | | - The alternative syscall exists only on FreeBSD. - Adding OpenBSD's equivalent and while at it other remaining oses ones. Reviewers: vitalybuka, krytarowsky, hiraditya Reviewed By: hiraditya Differential Revision: https://reviews.llvm.org/D50760 llvm-svn: 339886
* [XRay][compiler-rt] Remove MAP_NORESERVE from XRay allocationsDean Michael Berris2018-08-162-27/+3
| | | | | | | | | | | | | | | | | | | Summary: This reverses an earlier decision to allow seg-faulting from the XRay-allocated memory if it turns out that the system cannot provide physical memory backing that cannot be swapped in/out on Linux. This addresses http://llvm.org/PR38588. Reviewers: eizan Reviewed By: eizan Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D50831 llvm-svn: 339869
* cfi: Remove blacklist entries for libc++.Peter Collingbourne2018-08-151-4/+2
| | | | | | | These functions have had no-CFI annotations in the source code for a while now. llvm-svn: 339800
* [hwasan] Add a basic API.Evgeniy Stepanov2018-08-152-3/+15
| | | | | | | | | | | | | | | | Summary: Add user tag manipulation functions: __hwasan_tag_memory __hwasan_tag_pointer __hwasan_print_shadow (very simple and ugly, for now) Reviewers: vitalybuka, kcc Subscribers: kubamracek, hiraditya, llvm-commits Differential Revision: https://reviews.llvm.org/D50746 llvm-svn: 339746
* Reland "SafeStack: Delay thread stack clean-up""Vlad Tsyrklevich2018-08-143-21/+66
| | | | | | | | | | This relands commit r339405 (reverted in commit r339408.) The original revert was due to tests failing on a darwin buildbot; however, after looking at the affected code more I realized that the Darwin safestack support has always been broken and disabled it in r339719. This relands the original commit. llvm-svn: 339723
* SafeStack: Disable Darwin supportVlad Tsyrklevich2018-08-141-21/+6
| | | | | | | | | | | | | | | | | Summary: Darwin support does not appear to be used as evidenced by the fact that the pthread interceptors have never worked and there is no support for other common threading mechanisms like GCD. Reviewers: pcc, eugenis, kubamracek Reviewed By: pcc, kubamracek Subscribers: kubamracek, mgorny, delcypher, llvm-commits, #sanitizers, kcc Differential Revision: https://reviews.llvm.org/D50718 llvm-svn: 339719
* [scudo] Fix race condition in deallocation path when Quarantine is bypassedKostya Kortchinsky2018-08-141-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: There is a race window in the deallocation path when the Quarantine is bypassed. Initially we would just erase the header of a chunk if we were not to use the Quarantine, as opposed to using a compare-exchange primitive, to make things faster. It turned out to be a poor decision, as 2 threads (or more) could simultaneously deallocate the same pointer, and if the checks were to done before the header got erased, this would result in the pointer being added twice (or more) to distinct thread caches, and eventually be reused. Winning the race is not trivial but can happen with enough control over the allocation primitives. The repro added attempts to trigger the bug, with a moderate success rate, but it should be enough to notice if the bug ever make its way back into the code. Since I am changing things in this file, there are 2 smaller changes tagging along, marking a variable `const`, and improving the Quarantine bypass test at runtime. Reviewers: alekseyshl, eugenis, kcc, vitalybuka Reviewed By: eugenis, vitalybuka Subscribers: delcypher, #sanitizers, llvm-commits Differential Revision: https://reviews.llvm.org/D50655 llvm-svn: 339705
OpenPOWER on IntegriCloud