summaryrefslogtreecommitdiffstats
path: root/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
Commit message (Collapse)AuthorAgeFilesLines
* [ASan] Move the shadow on Windows 32-bit from 0x20000000 to 0x40000000Timur Iskhodzhanov2015-01-121-0/+4
| | | | llvm-svn: 225641
* [ASan] Change fake stack and local variables handling.Alexey Samsonov2014-12-111-44/+104
| | | | | | | | | | | | | | | | | | | | | | | | | This commit changes the way we get fake stack from ASan runtime (to find use-after-return errors) and the way we represent local variables: - __asan_stack_malloc function now returns pointer to newly allocated fake stack frame, or NULL if frame cannot be allocated. It doesn't take pointer to real stack as an input argument, it is calculated inside the runtime. - __asan_stack_free function doesn't take pointer to real stack as an input argument. Now this function is never called if fake stack frame wasn't allocated. - __asan_init version is bumped to reflect changes in the ABI. - new flag "-asan-stack-dynamic-alloca" allows to store all the function local variables in a dynamic alloca, instead of the static one. It reduces the stack space usage in use-after-return mode (dynamic alloca will not be called if the local variables are stored in a fake stack), and improves the debug info quality for local variables (they will not be described relatively to %rbp/%rsp, which are assumed to be clobbered by function calls). This flag is turned off by default for now, but I plan to turn it on after more testing. llvm-svn: 224062
* IR: Split Metadata from ValueDuncan P. N. Exon Smith2014-12-091-16/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Split `Metadata` away from the `Value` class hierarchy, as part of PR21532. Assembly and bitcode changes are in the wings, but this is the bulk of the change for the IR C++ API. I have a follow-up patch prepared for `clang`. If this breaks other sub-projects, I apologize in advance :(. Help me compile it on Darwin I'll try to fix it. FWIW, the errors should be easy to fix, so it may be simpler to just fix it yourself. This breaks the build for all metadata-related code that's out-of-tree. Rest assured the transition is mechanical and the compiler should catch almost all of the problems. Here's a quick guide for updating your code: - `Metadata` is the root of a class hierarchy with three main classes: `MDNode`, `MDString`, and `ValueAsMetadata`. It is distinct from the `Value` class hierarchy. It is typeless -- i.e., instances do *not* have a `Type`. - `MDNode`'s operands are all `Metadata *` (instead of `Value *`). - `TrackingVH<MDNode>` and `WeakVH` referring to metadata can be replaced with `TrackingMDNodeRef` and `TrackingMDRef`, respectively. If you're referring solely to resolved `MDNode`s -- post graph construction -- just use `MDNode*`. - `MDNode` (and the rest of `Metadata`) have only limited support for `replaceAllUsesWith()`. As long as an `MDNode` is pointing at a forward declaration -- the result of `MDNode::getTemporary()` -- it maintains a side map of its uses and can RAUW itself. Once the forward declarations are fully resolved RAUW support is dropped on the ground. This means that uniquing collisions on changing operands cause nodes to become "distinct". (This already happened fairly commonly, whenever an operand went to null.) If you're constructing complex (non self-reference) `MDNode` cycles, you need to call `MDNode::resolveCycles()` on each node (or on a top-level node that somehow references all of the nodes). Also, don't do that. Metadata cycles (and the RAUW machinery needed to construct them) are expensive. - An `MDNode` can only refer to a `Constant` through a bridge called `ConstantAsMetadata` (one of the subclasses of `ValueAsMetadata`). As a side effect, accessing an operand of an `MDNode` that is known to be, e.g., `ConstantInt`, takes three steps: first, cast from `Metadata` to `ConstantAsMetadata`; second, extract the `Constant`; third, cast down to `ConstantInt`. The eventual goal is to introduce `MDInt`/`MDFloat`/etc. and have metadata schema owners transition away from using `Constant`s when the type isn't important (and they don't care about referring to `GlobalValue`s). In the meantime, I've added transitional API to the `mdconst` namespace that matches semantics with the old code, in order to avoid adding the error-prone three-step equivalent to every call site. If your old code was: MDNode *N = foo(); bar(isa <ConstantInt>(N->getOperand(0))); baz(cast <ConstantInt>(N->getOperand(1))); bak(cast_or_null <ConstantInt>(N->getOperand(2))); bat(dyn_cast <ConstantInt>(N->getOperand(3))); bay(dyn_cast_or_null<ConstantInt>(N->getOperand(4))); you can trivially match its semantics with: MDNode *N = foo(); bar(mdconst::hasa <ConstantInt>(N->getOperand(0))); baz(mdconst::extract <ConstantInt>(N->getOperand(1))); bak(mdconst::extract_or_null <ConstantInt>(N->getOperand(2))); bat(mdconst::dyn_extract <ConstantInt>(N->getOperand(3))); bay(mdconst::dyn_extract_or_null<ConstantInt>(N->getOperand(4))); and when you transition your metadata schema to `MDInt`: MDNode *N = foo(); bar(isa <MDInt>(N->getOperand(0))); baz(cast <MDInt>(N->getOperand(1))); bak(cast_or_null <MDInt>(N->getOperand(2))); bat(dyn_cast <MDInt>(N->getOperand(3))); bay(dyn_cast_or_null<MDInt>(N->getOperand(4))); - A `CallInst` -- specifically, intrinsic instructions -- can refer to metadata through a bridge called `MetadataAsValue`. This is a subclass of `Value` where `getType()->isMetadataTy()`. `MetadataAsValue` is the *only* class that can legally refer to a `LocalAsMetadata`, which is a bridged form of non-`Constant` values like `Argument` and `Instruction`. It can also refer to any other `Metadata` subclass. (I'll break all your testcases in a follow-up commit, when I propagate this change to assembly.) llvm-svn: 223802
* Recommit of r223513 and r223514.Kuba Brecka2014-12-051-34/+48
| | | | | | Reviewed at http://reviews.llvm.org/D6488 llvm-svn: 223532
* Reverting r223513 and r223514.Kuba Brecka2014-12-051-48/+34
| | | | llvm-svn: 223520
* AddressSanitizer - Don't instrument globals from cstring_literals sections. ↵Kuba Brecka2014-12-051-34/+48
| | | | | | | | (llvm part) Reviewed at http://reviews.llvm.org/D6488 llvm-svn: 223513
* [asan] Change dynamic alloca instrumentation to only consider allocas that ↵Yury Gribov2014-12-011-3/+35
| | | | | | | | are dominating all exits from function. Reviewed in http://reviews.llvm.org/D6412 llvm-svn: 222991
* Tidied up target triple OS detection. NFCSimon Pilgrim2014-11-221-2/+2
| | | | | | Use Triple::isOS*() helper functions where possible. llvm-svn: 222622
* [asan] remove old experimental codeKostya Serebryany2014-11-211-38/+0
| | | | llvm-svn: 222586
* [asan] add statistic counter to dynamic alloca instrumentationKostya Serebryany2014-11-211-0/+3
| | | | llvm-svn: 222573
* [asan] Add new hidden compile-time flag asan-instrument-allocas to sanitize ↵Yury Gribov2014-11-211-6/+227
| | | | | | | | variable-sized dynamic allocas. Patch by Max Ostapenko. Reviewed at http://reviews.llvm.org/D6055 llvm-svn: 222519
* Update SetVector to rely on the underlying set's insert to return a ↵David Blaikie2014-11-191-1/+1
| | | | | | | | | | | | | pair<iterator, bool> This is to be consistent with StringSet and ultimately with the standard library's associative container insert function. This lead to updating SmallSet::insert to return pair<iterator, bool>, and then to update SmallPtrSet::insert to return pair<iterator, bool>, and then to update all the existing users of those functions... llvm-svn: 222334
* [asan] add experimental basic-block tracing to asan-coverage; also fix ↵Kostya Serebryany2014-11-191-1/+3
| | | | | | -fsanitize-coverage=3 which was broken by r221718 llvm-svn: 222290
* Fix 80 cols caught by the linter...David Blaikie2014-11-141-4/+6
| | | | | | We have a linter running in our build now? llvm-svn: 221957
* Use nullptr instead of NULL for variadic sentinelsReid Kleckner2014-11-131-26/+26
| | | | | | | | | | Windows defines NULL to 0, which when used as an argument to a variadic function, is not a null pointer constant. As a result, Clang's -Wsentinel fires on this code. Using '0' would be wrong on most 64-bit platforms, but both MSVC and Clang make it work on Windows. Sidestep the issue with nullptr. llvm-svn: 221940
* [asan] adding ShadowOffset64 for mips64, patch by Kumar SukhaniKostya Serebryany2014-11-111-0/+5
| | | | llvm-svn: 221725
* Move asan-coverage into a separate phase.Kostya Serebryany2014-11-111-148/+1
| | | | | | | | | | | | | | | | | | | | | | | | Summary: This change moves asan-coverage instrumentation into a separate Module pass. The other part of the change in clang introduces a new flag -fsanitize-coverage=N. Another small patch will update tests in compiler-rt. With this patch no functionality change is expected except for the flag name. The following changes will make the coverage instrumentation work with tsan/msan Test Plan: Run regression tests, chromium. Reviewers: nlewycky, samsonov Reviewed By: nlewycky, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D6152 llvm-svn: 221718
* Revert "IR: MDNode => Value"Duncan P. N. Exon Smith2014-11-111-3/+1
| | | | | | | | | | | | | | | | | Instead, we're going to separate metadata from the Value hierarchy. See PR21532. This reverts commit r221375. This reverts commit r221373. This reverts commit r221359. This reverts commit r221167. This reverts commit r221027. This reverts commit r221024. This reverts commit r221023. This reverts commit r220995. This reverts commit r220994. llvm-svn: 221711
* Base check on the section name, not the variable name.Rafael Espindola2014-11-061-10/+5
| | | | | | | | The variable is private, so the name should not be relied on. Also, the linker uses the sections, so asan should too when trying to avoid causing the linker problems. llvm-svn: 221480
* IR: MDNode => Value: NamedMDNode::getOperator()Duncan P. N. Exon Smith2014-11-051-1/+3
| | | | | | | | | | | | | Change `NamedMDNode::getOperator()` from returning `MDNode *` to returning `Value *`. To reduce boilerplate at some call sites, add a `getOperatorAsMDNode()` for named metadata that's expected to only return `MDNode` -- for now, that's everything, but debug node named metadata (such as llvm.dbg.cu and llvm.dbg.sp) will soon change. This is part of PR21433. Note that there's a follow-up patch to clang for the API change. llvm-svn: 221375
* [asan] [mips] changed ShadowOffset32 for systems having 16kb PageSize; patch ↵Kostya Serebryany2014-11-041-1/+1
| | | | | | by Kumar Sukhani llvm-svn: 221288
* [asan] do not treat inline asm calls as indirect callsKostya Serebryany2014-10-311-1/+3
| | | | llvm-svn: 220985
* [asan] fix caller-calee instrumentation to emit new cache for every call siteKostya Serebryany2014-10-311-4/+4
| | | | llvm-svn: 220973
* [asan] experimental tracing for indirect calls, llvm part.Kostya Serebryany2014-10-271-4/+44
| | | | llvm-svn: 220699
* Use triple's isiOS() and isOSDarwin() methods.Bob Wilson2014-10-091-1/+1
| | | | | | | These methods are already used in lots of places. This makes things more consistent. NFC. llvm-svn: 219386
* [asan] don't instrument module CTORs that may be run before ↵Kostya Serebryany2014-09-241-4/+6
| | | | | | asan.module_ctor. This fixes asan running together -coverage llvm-svn: 218421
* [asan] fix debug info produced for asan-coverage=2Kostya Serebryany2014-09-031-1/+3
| | | | llvm-svn: 217106
* [asan] add -asan-coverage=3: instrument all blocks and critical edges. Kostya Serebryany2014-09-031-2/+11
| | | | llvm-svn: 217098
* [asan] Assign a low branch weight to ASan's slow path, patch by Jonas ↵Kostya Serebryany2014-09-021-1/+4
| | | | | | Wagner. This speeds up asan (at least on SPEC) by 1%-5% or more. Also fix lint in dfsan. llvm-svn: 216972
* Fix some cases were ArrayRefs were being passed by reference. Also remove ↵Craig Topper2014-08-271-4/+4
| | | | | | 'const' from some other ArrayRef uses since its implicitly const already. llvm-svn: 216524
* [ASan] Use metadata to pass source-level information from Clang to ASan.Alexey Samsonov2014-08-021-43/+56
| | | | | | | | | | | | | | | | | Instead of creating global variables for source locations and global names, just create metadata nodes and strings. They will be transformed into actual globals in the instrumentation pass (if necessary). This approach is more flexible: 1) we don't have to ensure that our custom globals survive all the optimizations 2) if globals are discarded for some reason, we will simply ignore metadata for them and won't have to erase corresponding globals 3) metadata for source locations can be reused for other purposes: e.g. we may attach source location metadata to alloca instructions and provide better descriptions for stack variables in ASan error reports. No functionality change. llvm-svn: 214604
* [ASan] Fix comments about __sanitizer_cov functionAlexey Samsonov2014-07-221-3/+2
| | | | llvm-svn: 213673
* [ASan] Don't instrument load/stores with !nosanitize metadata.Alexey Samsonov2014-07-171-0/+3
| | | | | | | | | This is used to avoid instrumentation of instructions added by UBSan in Clang frontend (see r213291). This fixes PR20085. Reviewed in http://reviews.llvm.org/D4544. llvm-svn: 213292
* [ASan] Collect unmangled names of global variables in Clang to print them in ↵Alexey Samsonov2014-07-121-9/+20
| | | | | | | | | | | | | | | | | error reports. Currently ASan instrumentation pass creates a string with global name for each instrumented global (to include global names in the error report). Global name is already mangled at this point, and we may not be able to demangle it at runtime (e.g. there is no __cxa_demangle on Android). Instead, create a string with fully qualified global name in Clang, and pass it to ASan instrumentation pass in llvm.asan.globals metadata. If there is no metadata for some global, ASan will use the original algorithm. This fixes https://code.google.com/p/address-sanitizer/issues/detail?id=264. llvm-svn: 212872
* [ASan] Introduce a struct representing the layout of metadata entry in ↵Alexey Samsonov2014-07-111-47/+37
| | | | | | | | llvm.asan.globals. No functionality change. llvm-svn: 212850
* [ASan/Win] Don't instrument COMDAT globals. Properly fixes PR20244.Timur Iskhodzhanov2014-07-091-8/+4
| | | | llvm-svn: 212596
* [ASan/Win] Don't instrument private COMDAT globals until PR20244 is properly ↵Timur Iskhodzhanov2014-07-081-0/+7
| | | | | | fixed llvm-svn: 212530
* [ASan] Completely remove sanitizer blacklist file from instrumentation pass.Alexey Samsonov2014-07-081-17/+5
| | | | | | | | | | | | | | | | | | | | All blacklisting logic is now moved to the frontend (Clang). If a function (or source file it is in) is blacklisted, it doesn't get sanitize_address attribute and is therefore not instrumented. If a global variable (or source file it is in) is blacklisted, it is reported to be blacklisted by the entry in llvm.asan.globals metadata, and is not modified by the instrumentation. The latter may lead to certain false positives - not all the globals created by Clang are described in llvm.asan.globals metadata (e.g, RTTI descriptors are not), so we may start reporting errors on them even if "module" they appear in is blacklisted. We assume it's fine to take such risk: 1) errors on these globals are rare and usually indicate wild memory access 2) we can lazily add descriptors for these globals into llvm.asan.globals lazily. llvm-svn: 212505
* Remove non-static field initializer to appease MSVCAlexey Samsonov2014-07-021-1/+2
| | | | llvm-svn: 212212
* [ASan] Print exact source location of global variables in error reports.Alexey Samsonov2014-07-021-31/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | See https://code.google.com/p/address-sanitizer/issues/detail?id=299 for the original feature request. Introduce llvm.asan.globals metadata, which Clang (or any other frontend) may use to report extra information about global variables to ASan instrumentation pass in the backend. This metadata replaces llvm.asan.dynamically_initialized_globals that was used to detect init-order bugs. llvm.asan.globals contains the following data for each global: 1) source location (file/line/column info); 2) whether it is dynamically initialized; 3) whether it is blacklisted (shouldn't be instrumented). Source location data is then emitted in the binary and can be picked up by ASan runtime in case it needs to print error report involving some global. For example: 0x... is located 4 bytes to the right of global variable 'C::array' defined in '/path/to/file:17:8' (0x...) of size 40 These source locations are printed even if the binary doesn't have any debug info. This is an ABI-breaking change. ASan initialization is renamed to __asan_init_v4(). Pre-built libraries compiled with older Clang will not work with the fresh runtime. llvm-svn: 212188
* Remove top-level Clang -fsanitize= flags for optional ASan features.Alexey Samsonov2014-06-131-33/+15
| | | | | | | | | | | | | Init-order and use-after-return modes can currently be enabled by runtime flags. use-after-scope mode is not really working at the moment. The only problem I see is that users won't be able to disable extra instrumentation for init-order and use-after-scope by a top-level Clang flag. But this instrumentation was implicitly enabled for quite a while and we didn't hear from users hurt by it. llvm-svn: 210924
* Remove system_error.h.Rafael Espindola2014-06-121-1/+1
| | | | | | | This is a minimal change to remove the header. I will remove the occurrences of "using std::error_code" in a followup patch. llvm-svn: 210803
* [asancov] Fix coverage line info some more.Evgeniy Stepanov2014-06-051-2/+4
| | | | | | | Now it should always point to the opening brace of the function (in -asan-coverage=1 mode). llvm-svn: 210266
* [asan] Fix coverage instrumentation with -asan-globals=0.Evgeniy Stepanov2014-06-031-25/+32
| | | | llvm-svn: 210103
* Remove sanitizer blacklist from ASan/TSan/MSan function passes.Alexey Samsonov2014-06-021-12/+5
| | | | | | | | | | | | | | | | | Instrumentation passes now use attributes address_safety/thread_safety/memory_safety which are added by Clang frontend. Clang parses the blacklist file and adds the attributes accordingly. Currently blacklist is still used in ASan module pass to disable instrumentation for certain global variables. We should fix this as well by collecting the set of globals we're going to instrument in Clang and passing it to ASan in metadata (as we already do for dynamically-initialized globals and init-order checking). This change also removes -tsan-blacklist and -msan-blacklist LLVM commandline flags in favor of -fsanitize-blacklist= Clang flag. llvm-svn: 210038
* [ASan] Behave the same for functions w/o sanitize_address attribute and ↵Alexey Samsonov2014-05-311-2/+1
| | | | | | blacklisted functions llvm-svn: 209946
* Use range-based for loops in ASan, TSan and MSanAlexey Samsonov2014-05-291-45/+34
| | | | llvm-svn: 209834
* [ASan] Hoist blacklisting globals from init-order checking to Clang.Alexey Samsonov2014-05-291-2/+0
| | | | | | | | | Clang knows about the sanitizer blacklist and it makes no sense to add global to the list of llvm.asan.dynamically_initialized_globals if it will be blacklisted in the instrumentation pass anyway. Instead, we should do as much blacklisting as possible (if not all) in the frontend. llvm-svn: 209790
* Fix typo in variable nameAlexey Samsonov2014-05-291-3/+3
| | | | llvm-svn: 209784
* [ASan] Use llvm.global_ctors to insert init-order checking calls into ASan ↵Alexey Samsonov2014-05-291-34/+23
| | | | | | | | | | | | runtime. Don't assume that dynamically initialized globals are all initialized from _GLOBAL__<module_name>I_ function. Instead, scan the llvm.global_ctors and insert poison/unpoison calls to each function there. Patch by Nico Weber! llvm-svn: 209780
OpenPOWER on IntegriCloud