summaryrefslogtreecommitdiffstats
path: root/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
Commit message (Collapse)AuthorAgeFilesLines
* [asan] Introduce new hidden -asan-use-private-alias option.Maxim Ostapenko2016-02-081-6/+44
| | | | | | | | | | | | | | | | As discussed in https://github.com/google/sanitizers/issues/398, with current implementation of poisoning globals we can have some CHECK failures or false positives in case of mixing instrumented and non-instrumented code due to ASan poisons innocent globals from non-sanitized binary/library. We can use private aliases to avoid such errors. In addition, to preserve ODR violation detection, we introduce new __odr_asan_gen_XXX symbol for each instrumented global that indicates if this global was already registered. To detect ODR violation in runtime, we should only check the value of indicator and report an error if it isn't equal to zero. Differential Revision: http://reviews.llvm.org/D15642 llvm-svn: 260075
* [asan] Add iOS support to AddressSanitzierAnna Zaks2016-02-021-3/+11
| | | | | | Differential Revision: http://reviews.llvm.org/D15625 llvm-svn: 259586
* GlobalValue: use getValueType() instead of getType()->getPointerElementType().Manuel Jacob2016-01-161-3/+2
| | | | | | | | | | | | Reviewers: mjacob Subscribers: jholewinski, arsenm, dsanders, dblaikie Patch by Eduard Burtescu. Differential Revision: http://reviews.llvm.org/D16260 llvm-svn: 257999
* [ASAN] Add doFinalization to reset stateKeno Fischer2015-12-051-0/+11
| | | | | | | | | | | | | | | Summary: If the same pass manager is used for multiple modules ASAN complains about GlobalsMD being initialized twice. Fix this by resetting GlobalsMD in a new doFinalization method to allow this use case. Reviewers: kcc Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D14962 llvm-svn: 254851
* [asan] Fix dynamic allocas unpoisoning on PowerPC64.Yury Gribov2015-12-041-2/+17
| | | | | | | | | | | | | | | For PowerPC64 we cannot just pass SP extracted from @llvm.stackrestore to _asan_allocas_unpoison due to specific ABI requirements (http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html#DYNAM-STACK). This patch adds the value returned by @llvm.get.dynamic.area.offset to extracted from @llvm.stackrestore stack pointer, so dynamic allocas unpoisoning stuff would work correctly on PowerPC64. Patch by Max Ostapenko. Differential Revision: http://reviews.llvm.org/D15108 llvm-svn: 254707
* Follow up to r253591. Turn into an assertion.Davide Italiano2015-11-191-2/+1
| | | | | | Reported by: David Blaikie. llvm-svn: 253605
* [AddressSanitizer] assert(false) -> llvm_unreachable and remove return.Davide Italiano2015-11-191-4/+2
| | | | llvm-svn: 253591
* [ASan] Enable optional ASan recovery.Yury Gribov2015-11-111-18/+33
| | | | | | Differential Revision: http://reviews.llvm.org/D14242 llvm-svn: 252719
* [sanitizer] Use same shadow offset for ASAN on aarch64Adhemerval Zanella2015-11-091-15/+2
| | | | | | | | | This patch makes ASAN for aarch64 use the same shadow offset for all currently supported VMAs (39 and 42 bits). The shadow offset is the same for 39-bit (36). Similar to ppc64 port, aarch64 transformation also requires to use an add instead of 'or' for 42-bit VMA. llvm-svn: 252495
* [ASan] Disable instrumentation for inalloca variables.Alexey Samsonov2015-11-051-1/+4
| | | | | | | | inalloca variables were not treated as static allocas, therefore didn't participate in regular stack instrumentation. We don't want them to participate in dynamic alloca instrumentation as well. llvm-svn: 252213
* Refactor: Simplify boolean conditional return statements in ↵Alexey Samsonov2015-10-261-4/+2
| | | | | | | | | | | | lib/Transforms/Instrumentation Summary: Use clang-tidy to simplify boolean conditional return statements. Differential Revision: http://reviews.llvm.org/D9996 Patch by Richard (legalize@xmission.com)! llvm-svn: 251318
* [ASan] Enable instrumentation of dynamic allocas by default.Alexey Samsonov2015-10-221-1/+1
| | | | llvm-svn: 251056
* [ASan] Minor fixes to dynamic allocas handling:Alexey Samsonov2015-10-221-12/+11
| | | | | | | | | | | | | | | * Don't instrument promotable dynamic allocas: We already have a test that checks that promotable dynamic allocas are ignored, as well as static promotable allocas. Make sure this test will still pass if/when we enable dynamic alloca instrumentation by default. * Handle lifetime intrinsics before handling dynamic allocas: lifetime intrinsics may refer to dynamic allocas, so we need to emit instrumentation before these dynamic allocas would be replaced. Differential Revision: http://reviews.llvm.org/D12704 llvm-svn: 251045
* Fix missing INITIALIZE_PASS_DEPENDENCY for AddressSanitizerKeno Fischer2015-10-201-0/+1
| | | | | | | | | | | | | | Summary: In r231241, TargetLibraryInfoWrapperPass was added to `getAnalysisUsage` for `AddressSanitizer`, but the corresponding `INITIALIZE_PASS_DEPENDENCY` was not added. Reviewers: dvyukov, chandlerc, kcc Subscribers: kcc, llvm-commits Differential Revision: http://reviews.llvm.org/D13629 llvm-svn: 250813
* Instrumentation: Remove ilist iterator implicit conversions, NFCDuncan P. N. Exon Smith2015-10-131-4/+5
| | | | llvm-svn: 250186
* Add Triple::isAndroid().Evgeniy Stepanov2015-10-081-1/+1
| | | | | | | This is a simple refactoring that replaces Triple.getEnvironment() checks for Android with Triple.isAndroid(). llvm-svn: 249750
* Fix Clang-tidy modernize-use-nullptr warnings in source directories and ↵Hans Wennborg2015-10-061-3/+3
| | | | | | | | | | generated files; other minor cleanups. Patch by Eugene Zelenko! Differential Revision: http://reviews.llvm.org/D13321 llvm-svn: 249482
* [ASan] Don't instrument globals in .preinit_array/.init_array/.fini_arrayAlexey Samsonov2015-09-151-0/+8
| | | | | | | | | | | | These sections contain pointers to function that should be invoked during startup/shutdown by __libc_csu_init and __libc_csu_fini. Instrumenting these globals will append redzone to them, which will be filled with zeroes. This will cause null pointer dereference at runtime. Merge ASan regression tests for globals that should be ignored by instrumentation pass. llvm-svn: 247734
* [asan] Add ASAN support for AArch64 42-bit VMAAdhemerval Zanella2015-08-201-0/+14
| | | | | | | | | This patch adds support for asan on aarch64-linux with 42-bit VMA (current default config for 64K pagesize kernels). The support is enabled by defining the SANITIZER_AARCH64_VMA to 42 at build time for both clang/llvm and compiler-rt. The default VMA is 39 bits. llvm-svn: 245594
* De-constify pointers to Type since they can't be modified. NFCCraig Topper2015-08-011-1/+1
| | | | | | This was already done in most places a while ago. This just fixes the ones that crept in over time. llvm-svn: 243842
* [ASan] Disable dynamic alloca and UAR detection in presence of returns_twice ↵Alexey Samsonov2015-07-291-9/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | calls. Summary: returns_twice (most importantly, setjmp) functions are optimization-hostile: if local variable is promoted to register, and is changed between setjmp() and longjmp() calls, this update will be undone. This is the reason why "man setjmp" advises to mark all these locals as "volatile". This can not be enough for ASan, though: when it replaces static alloca with dynamic one, optionally called if UAR mode is enabled, it adds a whole lot of SSA values, and computations of local variable addresses, that can involve virtual registers, and cause unexpected behavior, when these registers are restored from buffer saved in setjmp. To fix this, just disable dynamic alloca and UAR tricks whenever we see a returns_twice call in the function. Reviewers: rnk Subscribers: llvm-commits, kcc Differential Revision: http://reviews.llvm.org/D11495 llvm-svn: 243561
* [asan] Remove special case mapping on Android/AArch64.Evgeniy Stepanov2015-07-291-4/+4
| | | | | | | | | | | | | | ASan shadow on Android starts at address 0 for both historic and performance reasons. This is possible because the platform mandates -pie, which makes lower memory region always available. This is not such a good idea on 64-bit platforms because of MAP_32BIT incompatibility. This patch changes Android/AArch64 mapping to be the same as that of Linux/AAarch64. llvm-svn: 243548
* [asan] Rename the ABI versioning symbol to '__asan_version_mismatch_check' ↵Kuba Brecka2015-07-231-4/+6
| | | | | | | | | | instead of abusing '__asan_init' We currently version `__asan_init` and when the ABI version doesn't match, the linker gives a `undefined reference to '__asan_init_v5'` message. From this, it might not be obvious that it's actually a version mismatch error. This patch makes the error message much clearer by changing the name of the undefined symbol to be `__asan_version_mismatch_check_xxx` (followed by the version string). We obviously don't want the initializer to be named like that, so it's a separate symbol that is used only for the purpose of version checking. Reviewed at http://reviews.llvm.org/D11004 llvm-svn: 243003
* [asan] Improve moving of non-instrumented allocasKuba Brecka2015-07-221-6/+12
| | | | | | | | In r242510, non-instrumented allocas are now moved into the first basic block. This patch limits that to only move allocas that are present *after* the first instrumented one (i.e. only move allocas up). A testcase was updated to show behavior in these two cases. Without the patch, an alloca could be moved down, and could cause an invalid IR. Differential Revision: http://reviews.llvm.org/D11339 llvm-svn: 242883
* Re-land 242726 to use RAII to do cleanupReid Kleckner2015-07-211-0/+50
| | | | | | | The LooksLikeCodeInBug11395() codepath was returning without clearing the ProcessedAllocas cache. llvm-svn: 242809
* Revert 242726, it broke ASan on OS X.Nico Weber2015-07-211-40/+0
| | | | llvm-svn: 242792
* Don't try to instrument allocas used by outlined SEH funcletsReid Kleckner2015-07-201-0/+40
| | | | | | | | | | | | | | | | | | | Summary: Arguments to llvm.localescape must be static allocas. They must be at some statically known offset from the frame or stack pointer so that other functions can access them with localrecover. If we ever want to instrument these, we can use more indirection to recover the addresses of these local variables. We can do it during clang irgen or with the asan module pass. Reviewers: eugenis Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D11307 llvm-svn: 242726
* [asan] Fix shadow mapping on Android/AArch64.Evgeniy Stepanov2015-07-171-4/+6
| | | | | | | | | Instrumentation and the runtime library were in disagreement about ASan shadow offset on Android/AArch64. This fixes a large number of existing tests on Android/AArch64. llvm-svn: 242595
* [asan] Add a comment explaining why non-instrumented allocas are moved.Kuba Brecka2015-07-171-0/+3
| | | | | | Addition to r242510. llvm-svn: 242561
* [asan] Fix invalid debug info for promotable allocasKuba Brecka2015-07-171-1/+7
| | | | | | | | | | Since r230724 ("Skip promotable allocas to improve performance at -O0"), there is a regression in the generated debug info for those non-instrumented variables. When inspecting such a variable's value in LLDB, you often get garbage instead of the actual value. ASan instrumentation is inserted before the creation of the non-instrumented alloca. The only allocas that are considered standard stack variables are the ones declared in the first basic-block, but the initial instrumentation setup in the function breaks that invariant. This patch makes sure uninstrumented allocas stay in the first BB. Differential Revision: http://reviews.llvm.org/D11179 llvm-svn: 242510
* [ASan] Use llvm::getDISubprogram() to get function entry debug location.Alexey Samsonov2015-06-261-7/+3
| | | | | | | | It can be more robust than copying debug info from first non-alloca instruction in the entry basic block. We use the same strategy in coverage instrumentation. llvm-svn: 240738
* [asan] Do not instrument special purpose LLVM sections.Anna Zaks2015-06-251-0/+2
| | | | | | | | | | | | | | Do not instrument globals that are placed in sections containing "__llvm" in their name. This fixes a bug in ASan / PGO interoperability. ASan interferes with LLVM's PGO, which places its globals into a special section, which is memcpy-ed by the linker as a whole. When those goals are instrumented, ASan's memcpy wrapper reports an issue. http://reviews.llvm.org/D10541 llvm-svn: 240723
* [asan] Don't run stack malloc on functions containing inline assembly.Anna Zaks2015-06-251-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | It makes LLVM run out of registers even on 64-bit platforms. For example, the following test case fails on darwin. clang -cc1 -O0 -triple x86_64-apple-macosx10.10.0 -emit-obj -fsanitize=address -mstackrealign -o ~/tmp/ex.o -x c ex.c error: inline assembly requires more registers than available void TestInlineAssembly(const unsigned char *S, unsigned int pS, unsigned char *D, unsigned int pD, unsigned int h) { unsigned int sr = 4, pDiffD = pD - 5; unsigned int pDiffS = (pS << 1) - 5; char flagSA = ((pS & 15) == 0), flagDA = ((pD & 15) == 0); asm volatile ( "mov %0, %%"PTR_REG("si")"\n" "mov %2, %%"PTR_REG("cx")"\n" "mov %1, %%"PTR_REG("di")"\n" "mov %8, %%"PTR_REG("ax")"\n" : : "m" (S), "m" (D), "m" (pS), "m" (pDiffS), "m" (pDiffD), "m" (sr), "m" (flagSA), "m" (flagDA), "m" (h) : "%"PTR_REG("si"), "%"PTR_REG("di"), "%"PTR_REG("ax"), "%"PTR_REG("cx"), "%"PTR_REG("dx"), "memory" ); } http://reviews.llvm.org/D10719 llvm-svn: 240722
* [ASan] Initial support for Kernel AddressSanitizerAlexander Potapenko2015-06-191-42/+61
| | | | | | | | | This patch adds initial support for the -fsanitize=kernel-address flag to Clang. Right now it's quite restricted: only out-of-line instrumentation is supported, globals are not instrumented, some GCC kasan flags are not supported. Using this patch I am able to build and boot the KASan tree with LLVMLinux patches from github.com/ramosian-glider/kasan/tree/kasan_llvmlinux. To disable KASan instrumentation for a certain function attribute((no_sanitize("kernel-address"))) can be used. llvm-svn: 240131
* [ASan] format AddressSanitizer.cpp with `clang-format -style=Google`, NFCAlexander Potapenko2015-06-121-12/+8
| | | | llvm-svn: 239601
* [asan] Prevent __attribute__((annotate)) triggering errors on DarwinAnna Zaks2015-06-091-14/+14
| | | | | | | | | | | | | | | | | The following code triggers a fatal error in the compiler instrumentation of ASan on Darwin because we place the attribute into llvm.metadata section, which does not have the proper MachO section name. void foo() __attribute__((annotate("custom"))); void foo() {;} This commit reorders the checks so that we skip everything in llvm.metadata first. It also removes the hard failure in case the section name does not parse. That check will be done lower in the compilation pipeline anyway. (Reviewed in http://reviews.llvm.org/D9093.) llvm-svn: 239379
* [ASan] Fix previous commit. Patch by Max Ostapenko!Yury Gribov2015-05-281-4/+4
| | | | llvm-svn: 238403
* [ASan] New approach to dynamic allocas unpoisoning. Patch by Max Ostapenko!Yury Gribov2015-05-281-163/+76
| | | | | | Differential Revision: http://reviews.llvm.org/D7098 llvm-svn: 238402
* Simplify IRBuilder::CreateCall* by using ArrayRef+initializer_list/braced ↵David Blaikie2015-05-181-35/+36
| | | | | | init only llvm-svn: 237624
* Convert PHI getIncomingValue() to foreach over incoming_values(). NFC.Pete Cooper2015-05-121-2/+1
| | | | | | | | We already had a method to iterate over all the incoming values of a PHI. This just changes all eligible code to use it. Ineligible code included anything which cared about the index, or was also trying to get the i'th incoming BB. llvm-svn: 237169
* ASan: Use `createSanitizerCtor` to create ctor, and call `__asan_init`Ismail Pazarbasi2015-05-071-10/+4
| | | | | | | | | | Reviewers: kcc, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D8778 llvm-svn: 236777
* IR: Give 'DI' prefix to debug info metadataDuncan P. N. Exon Smith2015-04-291-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Finish off PR23080 by renaming the debug info IR constructs from `MD*` to `DI*`. The last of the `DIDescriptor` classes were deleted in r235356, and the last of the related typedefs removed in r235413, so this has all baked for about a week. Note: If you have out-of-tree code (like a frontend), I recommend that you get everything compiling and tests passing with the *previous* commit before updating to this one. It'll be easier to keep track of what code is using the `DIDescriptor` hierarchy and what you've already updated, and I think you're extremely unlikely to insert bugs. YMMV of course. Back to *this* commit: I did this using the rename-md-di-nodes.sh upgrade script I've attached to PR23080 (both code and testcases) and filtered through clang-format-diff.py. I edited the tests for test/Assembler/invalid-generic-debug-node-*.ll by hand since the columns were off-by-three. It should work on your out-of-tree testcases (and code, if you've followed the advice in the previous paragraph). Some of the tests are in badly named files now (e.g., test/Assembler/invalid-mdcompositetype-missing-tag.ll should be 'dicompositetype'); I'll come back and move the files in a follow-up commit. llvm-svn: 236120
* Reduce dyn_cast<> to isa<> or cast<> where possible.Benjamin Kramer2015-04-101-1/+1
| | | | | | No functional change intended. llvm-svn: 234586
* Move `checkInterfaceFunction` to ModuleUtilsIsmail Pazarbasi2015-04-061-32/+21
| | | | | | | | | | | | | | Summary: Instead of making a local copy of `checkInterfaceFunction` for each sanitizer, move the function in a common place. Reviewers: kcc, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D8775 llvm-svn: 234220
* [ASan] Don't use stack malloc for 32-bit functions using inline asmReid Kleckner2015-04-021-2/+4
| | | | | | | | | | | | | | | | | | This prevents us from running out of registers in the backend. Introducing stack malloc calls prevents the backend from recognizing the inline asm operands as stack objects. When the backend recognizes a stack object, it doesn't need to materialize the address of the memory in a physical register. Instead it generates a simple SP-based memory operand. Introducing a stack malloc forces the backend to find a free register for every memory operand. 32-bit x86 simply doesn't have enough registers for this to succeed in most cases. Reviewers: kcc, samsonov Differential Revision: http://reviews.llvm.org/D8790 llvm-svn: 233979
* [opaque pointer type] API migration for GEP constant factoriesDavid Blaikie2015-04-021-1/+1
| | | | | | | | | | | | | Require the pointee type to be passed explicitly and assert that it is correct. For now it's possible to pass nullptr here (and I've done so in a few places in this patch) but eventually that will be disallowed once all clients have been updated or removed. It'll be a long road to get all the way there... but if you have the cahnce to update your callers to pass the type explicitly without depending on a pointer's element type, that would be a good thing to do soon and a necessary thing to do eventually. llvm-svn: 233938
* [asan] Speed up isInterestingAlloca checkAnna Zaks2015-03-271-10/+19
| | | | | | | | | | | | We make many redundant calls to isInterestingAlloca in the AddressSanitzier pass. This is especially inefficient for allocas that have many uses. Let's cache the results to speed up compilation. The compile time improvements depend on the input. I did not see much difference on benchmarks; however, I have a test case where compile time goes from minutes to under a second. llvm-svn: 233397
* Re-sort includes with sort-includes.py and insert raw_ostream.h where it's used.Benjamin Kramer2015-03-231-0/+1
| | | | llvm-svn: 232998
* [asan] remove redundant ifndefs. NFCKostya Serebryany2015-03-171-9/+5
| | | | llvm-svn: 232521
* asan: optimization experimentsDmitry Vyukov2015-03-171-60/+114
| | | | | | | | | | | | | | | | | | | | The experiments can be used to evaluate potential optimizations that remove instrumentation (assess false negatives). Instead of completely removing some instrumentation, you set Exp to a non-zero value (mask of optimization experiments that want to remove instrumentation of this instruction). If Exp is non-zero, this pass will emit special calls into runtime (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls make runtime terminate the program in a special way (with a different exit status). Then you run the new compiler on a buggy corpus, collect the special terminations (ideally, you don't see them at all -- no false negatives) and make the decision on the optimization. The exact reaction to experiments in runtime is not implemented in this patch. It will be defined and implemented in a subsequent patch. http://reviews.llvm.org/D8198 llvm-svn: 232502
OpenPOWER on IntegriCloud