LLVM  15.0.0git
AddressSanitizer.cpp
Go to the documentation of this file.
1 //===- AddressSanitizer.cpp - memory error detector -----------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file is a part of AddressSanitizer, an address basic correctness
10 // checker.
11 // Details of the algorithm:
12 // https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm
13 //
14 // FIXME: This sanitizer does not yet handle scalable vectors
15 //
16 //===----------------------------------------------------------------------===//
17 
19 #include "llvm/ADT/ArrayRef.h"
20 #include "llvm/ADT/DenseMap.h"
22 #include "llvm/ADT/SmallPtrSet.h"
23 #include "llvm/ADT/SmallVector.h"
24 #include "llvm/ADT/Statistic.h"
25 #include "llvm/ADT/StringExtras.h"
26 #include "llvm/ADT/StringRef.h"
27 #include "llvm/ADT/Triple.h"
28 #include "llvm/ADT/Twine.h"
34 #include "llvm/IR/Argument.h"
35 #include "llvm/IR/Attributes.h"
36 #include "llvm/IR/BasicBlock.h"
37 #include "llvm/IR/Comdat.h"
38 #include "llvm/IR/Constant.h"
39 #include "llvm/IR/Constants.h"
40 #include "llvm/IR/DIBuilder.h"
41 #include "llvm/IR/DataLayout.h"
43 #include "llvm/IR/DebugLoc.h"
44 #include "llvm/IR/DerivedTypes.h"
45 #include "llvm/IR/Function.h"
46 #include "llvm/IR/GlobalAlias.h"
47 #include "llvm/IR/GlobalValue.h"
48 #include "llvm/IR/GlobalVariable.h"
49 #include "llvm/IR/IRBuilder.h"
50 #include "llvm/IR/InlineAsm.h"
51 #include "llvm/IR/InstVisitor.h"
52 #include "llvm/IR/InstrTypes.h"
53 #include "llvm/IR/Instruction.h"
54 #include "llvm/IR/Instructions.h"
55 #include "llvm/IR/IntrinsicInst.h"
56 #include "llvm/IR/Intrinsics.h"
57 #include "llvm/IR/LLVMContext.h"
58 #include "llvm/IR/MDBuilder.h"
59 #include "llvm/IR/Metadata.h"
60 #include "llvm/IR/Module.h"
61 #include "llvm/IR/Type.h"
62 #include "llvm/IR/Use.h"
63 #include "llvm/IR/Value.h"
64 #include "llvm/MC/MCSectionMachO.h"
65 #include "llvm/Support/Casting.h"
67 #include "llvm/Support/Debug.h"
79 #include <algorithm>
80 #include <cassert>
81 #include <cstddef>
82 #include <cstdint>
83 #include <iomanip>
84 #include <limits>
85 #include <sstream>
86 #include <string>
87 #include <tuple>
88 
89 using namespace llvm;
90 
91 #define DEBUG_TYPE "asan"
92 
93 static const uint64_t kDefaultShadowScale = 3;
94 static const uint64_t kDefaultShadowOffset32 = 1ULL << 29;
95 static const uint64_t kDefaultShadowOffset64 = 1ULL << 44;
98 static const uint64_t kSmallX86_64ShadowOffsetBase = 0x7FFFFFFF; // < 2G.
100 static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000;
101 static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 44;
102 static const uint64_t kSystemZ_ShadowOffset64 = 1ULL << 52;
103 static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000;
104 static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37;
105 static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36;
106 static const uint64_t kRISCV64_ShadowOffset64 = 0xd55550000;
107 static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30;
108 static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46;
109 static const uint64_t kFreeBSDKasan_ShadowOffset64 = 0xdffff7c000000000;
110 static const uint64_t kNetBSD_ShadowOffset32 = 1ULL << 30;
111 static const uint64_t kNetBSD_ShadowOffset64 = 1ULL << 46;
112 static const uint64_t kNetBSDKasan_ShadowOffset64 = 0xdfff900000000000;
113 static const uint64_t kPS4_ShadowOffset64 = 1ULL << 40;
114 static const uint64_t kWindowsShadowOffset32 = 3ULL << 28;
116 
117 // The shadow memory space is dynamically allocated.
119 
120 static const size_t kMinStackMallocSize = 1 << 6; // 64B
121 static const size_t kMaxStackMallocSize = 1 << 16; // 64K
122 static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3;
123 static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E;
124 
125 const char kAsanModuleCtorName[] = "asan.module_ctor";
126 const char kAsanModuleDtorName[] = "asan.module_dtor";
128 // On Emscripten, the system needs more than one priorities for constructors.
130 const char kAsanReportErrorTemplate[] = "__asan_report_";
131 const char kAsanRegisterGlobalsName[] = "__asan_register_globals";
132 const char kAsanUnregisterGlobalsName[] = "__asan_unregister_globals";
133 const char kAsanRegisterImageGlobalsName[] = "__asan_register_image_globals";
135  "__asan_unregister_image_globals";
136 const char kAsanRegisterElfGlobalsName[] = "__asan_register_elf_globals";
137 const char kAsanUnregisterElfGlobalsName[] = "__asan_unregister_elf_globals";
138 const char kAsanPoisonGlobalsName[] = "__asan_before_dynamic_init";
139 const char kAsanUnpoisonGlobalsName[] = "__asan_after_dynamic_init";
140 const char kAsanInitName[] = "__asan_init";
141 const char kAsanVersionCheckNamePrefix[] = "__asan_version_mismatch_check_v";
142 const char kAsanPtrCmp[] = "__sanitizer_ptr_cmp";
143 const char kAsanPtrSub[] = "__sanitizer_ptr_sub";
144 const char kAsanHandleNoReturnName[] = "__asan_handle_no_return";
145 static const int kMaxAsanStackMallocSizeClass = 10;
146 const char kAsanStackMallocNameTemplate[] = "__asan_stack_malloc_";
148  "__asan_stack_malloc_always_";
149 const char kAsanStackFreeNameTemplate[] = "__asan_stack_free_";
150 const char kAsanGenPrefix[] = "___asan_gen_";
151 const char kODRGenPrefix[] = "__odr_asan_gen_";
152 const char kSanCovGenPrefix[] = "__sancov_gen_";
153 const char kAsanSetShadowPrefix[] = "__asan_set_shadow_";
154 const char kAsanPoisonStackMemoryName[] = "__asan_poison_stack_memory";
155 const char kAsanUnpoisonStackMemoryName[] = "__asan_unpoison_stack_memory";
156 
157 // ASan version script has __asan_* wildcard. Triple underscore prevents a
158 // linker (gold) warning about attempting to export a local symbol.
159 const char kAsanGlobalsRegisteredFlagName[] = "___asan_globals_registered";
160 
162  "__asan_option_detect_stack_use_after_return";
163 
165  "__asan_shadow_memory_dynamic_address";
166 
167 const char kAsanAllocaPoison[] = "__asan_alloca_poison";
168 const char kAsanAllocasUnpoison[] = "__asan_allocas_unpoison";
169 
170 const char kAMDGPUAddressSharedName[] = "llvm.amdgcn.is.shared";
171 const char kAMDGPUAddressPrivateName[] = "llvm.amdgcn.is.private";
172 
173 // Accesses sizes are powers of two: 1, 2, 4, 8, 16.
174 static const size_t kNumberOfAccessSizes = 5;
175 
176 static const uint64_t kAllocaRzSize = 32;
177 
178 // ASanAccessInfo implementation constants.
179 constexpr size_t kCompileKernelShift = 0;
180 constexpr size_t kCompileKernelMask = 0x1;
181 constexpr size_t kAccessSizeIndexShift = 1;
182 constexpr size_t kAccessSizeIndexMask = 0xf;
183 constexpr size_t kIsWriteShift = 5;
184 constexpr size_t kIsWriteMask = 0x1;
185 
186 // Command-line flags.
187 
189  "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"),
190  cl::Hidden, cl::init(false));
191 
192 static cl::opt<bool> ClRecover(
193  "asan-recover",
194  cl::desc("Enable recovery mode (continue-after-error)."),
195  cl::Hidden, cl::init(false));
196 
198  "asan-guard-against-version-mismatch",
199  cl::desc("Guard against compiler/runtime version mismatch."),
200  cl::Hidden, cl::init(true));
201 
202 // This flag may need to be replaced with -f[no-]asan-reads.
203 static cl::opt<bool> ClInstrumentReads("asan-instrument-reads",
204  cl::desc("instrument read instructions"),
205  cl::Hidden, cl::init(true));
206 
208  "asan-instrument-writes", cl::desc("instrument write instructions"),
209  cl::Hidden, cl::init(true));
210 
211 static cl::opt<bool>
212  ClUseStackSafety("asan-use-stack-safety", cl::Hidden, cl::init(false),
213  cl::Hidden, cl::desc("Use Stack Safety analysis results"),
214  cl::Optional);
215 
217  "asan-instrument-atomics",
218  cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden,
219  cl::init(true));
220 
221 static cl::opt<bool>
222  ClInstrumentByval("asan-instrument-byval",
223  cl::desc("instrument byval call arguments"), cl::Hidden,
224  cl::init(true));
225 
227  "asan-always-slow-path",
228  cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden,
229  cl::init(false));
230 
232  "asan-force-dynamic-shadow",
233  cl::desc("Load shadow address into a local variable for each function"),
234  cl::Hidden, cl::init(false));
235 
236 static cl::opt<bool>
237  ClWithIfunc("asan-with-ifunc",
238  cl::desc("Access dynamic shadow through an ifunc global on "
239  "platforms that support this"),
240  cl::Hidden, cl::init(true));
241 
243  "asan-with-ifunc-suppress-remat",
244  cl::desc("Suppress rematerialization of dynamic shadow address by passing "
245  "it through inline asm in prologue."),
246  cl::Hidden, cl::init(true));
247 
248 // This flag limits the number of instructions to be instrumented
249 // in any given BB. Normally, this should be set to unlimited (INT_MAX),
250 // but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary
251 // set it to 10000.
253  "asan-max-ins-per-bb", cl::init(10000),
254  cl::desc("maximal number of instructions to instrument in any given BB"),
255  cl::Hidden);
256 
257 // This flag may need to be replaced with -f[no]asan-stack.
258 static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"),
259  cl::Hidden, cl::init(true));
261  "asan-max-inline-poisoning-size",
262  cl::desc(
263  "Inline shadow poisoning for blocks up to the given size in bytes."),
264  cl::Hidden, cl::init(64));
265 
267  "asan-use-after-return",
268  cl::desc("Sets the mode of detection for stack-use-after-return."),
269  cl::values(
271  "Never detect stack use after return."),
272  clEnumValN(
274  "Detect stack use after return if "
275  "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set."),
277  "Always detect stack use after return.")),
279 
280 static cl::opt<bool> ClRedzoneByvalArgs("asan-redzone-byval-args",
281  cl::desc("Create redzones for byval "
282  "arguments (extra copy "
283  "required)"), cl::Hidden,
284  cl::init(true));
285 
286 static cl::opt<bool> ClUseAfterScope("asan-use-after-scope",
287  cl::desc("Check stack-use-after-scope"),
288  cl::Hidden, cl::init(false));
289 
290 // This flag may need to be replaced with -f[no]asan-globals.
291 static cl::opt<bool> ClGlobals("asan-globals",
292  cl::desc("Handle global objects"), cl::Hidden,
293  cl::init(true));
294 
295 static cl::opt<bool> ClInitializers("asan-initialization-order",
296  cl::desc("Handle C++ initializer order"),
297  cl::Hidden, cl::init(true));
298 
300  "asan-detect-invalid-pointer-pair",
301  cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden,
302  cl::init(false));
303 
305  "asan-detect-invalid-pointer-cmp",
306  cl::desc("Instrument <, <=, >, >= with pointer operands"), cl::Hidden,
307  cl::init(false));
308 
310  "asan-detect-invalid-pointer-sub",
311  cl::desc("Instrument - operations with pointer operands"), cl::Hidden,
312  cl::init(false));
313 
315  "asan-realign-stack",
316  cl::desc("Realign stack to the value of this flag (power of two)"),
317  cl::Hidden, cl::init(32));
318 
320  "asan-instrumentation-with-call-threshold",
321  cl::desc(
322  "If the function being instrumented contains more than "
323  "this number of memory accesses, use callbacks instead of "
324  "inline checks (-1 means never use callbacks)."),
325  cl::Hidden, cl::init(7000));
326 
328  "asan-memory-access-callback-prefix",
329  cl::desc("Prefix for memory access callbacks"), cl::Hidden,
330  cl::init("__asan_"));
331 
333  "asan-kernel-mem-intrinsic-prefix",
334  cl::desc("Use prefix for memory intrinsics in KASAN mode"), cl::Hidden,
335  cl::init(false));
336 
337 static cl::opt<bool>
338  ClInstrumentDynamicAllocas("asan-instrument-dynamic-allocas",
339  cl::desc("instrument dynamic allocas"),
340  cl::Hidden, cl::init(true));
341 
343  "asan-skip-promotable-allocas",
344  cl::desc("Do not instrument promotable allocas"), cl::Hidden,
345  cl::init(true));
346 
347 // These flags allow to change the shadow mapping.
348 // The shadow mapping looks like
349 // Shadow = (Mem >> scale) + offset
350 
351 static cl::opt<int> ClMappingScale("asan-mapping-scale",
352  cl::desc("scale of asan shadow mapping"),
353  cl::Hidden, cl::init(0));
354 
355 static cl::opt<uint64_t>
356  ClMappingOffset("asan-mapping-offset",
357  cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"),
358  cl::Hidden, cl::init(0));
359 
360 // Optimization flags. Not user visible, used mostly for testing
361 // and benchmarking the tool.
362 
363 static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"),
364  cl::Hidden, cl::init(true));
365 
366 static cl::opt<bool> ClOptimizeCallbacks("asan-optimize-callbacks",
367  cl::desc("Optimize callbacks"),
368  cl::Hidden, cl::init(false));
369 
371  "asan-opt-same-temp", cl::desc("Instrument the same temp just once"),
372  cl::Hidden, cl::init(true));
373 
374 static cl::opt<bool> ClOptGlobals("asan-opt-globals",
375  cl::desc("Don't instrument scalar globals"),
376  cl::Hidden, cl::init(true));
377 
379  "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"),
380  cl::Hidden, cl::init(false));
381 
383  "asan-stack-dynamic-alloca",
384  cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden,
385  cl::init(true));
386 
388  "asan-force-experiment",
389  cl::desc("Force optimization experiment (for testing)"), cl::Hidden,
390  cl::init(0));
391 
392 static cl::opt<bool>
393  ClUsePrivateAlias("asan-use-private-alias",
394  cl::desc("Use private aliases for global variables"),
395  cl::Hidden, cl::init(false));
396 
397 static cl::opt<bool>
398  ClUseOdrIndicator("asan-use-odr-indicator",
399  cl::desc("Use odr indicators to improve ODR reporting"),
400  cl::Hidden, cl::init(false));
401 
402 static cl::opt<bool>
403  ClUseGlobalsGC("asan-globals-live-support",
404  cl::desc("Use linker features to support dead "
405  "code stripping of globals"),
406  cl::Hidden, cl::init(true));
407 
408 // This is on by default even though there is a bug in gold:
409 // https://sourceware.org/bugzilla/show_bug.cgi?id=19002
410 static cl::opt<bool>
411  ClWithComdat("asan-with-comdat",
412  cl::desc("Place ASan constructors in comdat sections"),
413  cl::Hidden, cl::init(true));
414 
416  "asan-destructor-kind",
417  cl::desc("Sets the ASan destructor kind. The default is to use the value "
418  "provided to the pass constructor"),
419  cl::values(clEnumValN(AsanDtorKind::None, "none", "No destructors"),
421  "Use global destructors")),
423 
424 // Debug flags.
425 
426 static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden,
427  cl::init(0));
428 
429 static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"),
430  cl::Hidden, cl::init(0));
431 
432 static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden,
433  cl::desc("Debug func"));
434 
435 static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"),
436  cl::Hidden, cl::init(-1));
437 
438 static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug max inst"),
439  cl::Hidden, cl::init(-1));
440 
441 STATISTIC(NumInstrumentedReads, "Number of instrumented reads");
442 STATISTIC(NumInstrumentedWrites, "Number of instrumented writes");
443 STATISTIC(NumOptimizedAccessesToGlobalVar,
444  "Number of optimized accesses to global vars");
445 STATISTIC(NumOptimizedAccessesToStackVar,
446  "Number of optimized accesses to stack vars");
447 
448 namespace {
449 
450 /// This struct defines the shadow mapping using the rule:
451 /// shadow = (mem >> Scale) ADD-or-OR Offset.
452 /// If InGlobal is true, then
453 /// extern char __asan_shadow[];
454 /// shadow = (mem >> Scale) + &__asan_shadow
455 struct ShadowMapping {
456  int Scale;
457  uint64_t Offset;
458  bool OrShadowOffset;
459  bool InGlobal;
460 };
461 
462 } // end anonymous namespace
463 
464 static ShadowMapping getShadowMapping(const Triple &TargetTriple, int LongSize,
465  bool IsKasan) {
466  bool IsAndroid = TargetTriple.isAndroid();
467  bool IsIOS = TargetTriple.isiOS() || TargetTriple.isWatchOS() ||
468  TargetTriple.isDriverKit();
469  bool IsMacOS = TargetTriple.isMacOSX();
470  bool IsFreeBSD = TargetTriple.isOSFreeBSD();
471  bool IsNetBSD = TargetTriple.isOSNetBSD();
472  bool IsPS4 = TargetTriple.isPS4();
473  bool IsLinux = TargetTriple.isOSLinux();
474  bool IsPPC64 = TargetTriple.getArch() == Triple::ppc64 ||
475  TargetTriple.getArch() == Triple::ppc64le;
476  bool IsSystemZ = TargetTriple.getArch() == Triple::systemz;
477  bool IsX86_64 = TargetTriple.getArch() == Triple::x86_64;
478  bool IsMIPS32 = TargetTriple.isMIPS32();
479  bool IsMIPS64 = TargetTriple.isMIPS64();
480  bool IsArmOrThumb = TargetTriple.isARM() || TargetTriple.isThumb();
481  bool IsAArch64 = TargetTriple.getArch() == Triple::aarch64;
482  bool IsRISCV64 = TargetTriple.getArch() == Triple::riscv64;
483  bool IsWindows = TargetTriple.isOSWindows();
484  bool IsFuchsia = TargetTriple.isOSFuchsia();
485  bool IsEmscripten = TargetTriple.isOSEmscripten();
486  bool IsAMDGPU = TargetTriple.isAMDGPU();
487 
488  ShadowMapping Mapping;
489 
490  Mapping.Scale = kDefaultShadowScale;
491  if (ClMappingScale.getNumOccurrences() > 0) {
492  Mapping.Scale = ClMappingScale;
493  }
494 
495  if (LongSize == 32) {
496  if (IsAndroid)
497  Mapping.Offset = kDynamicShadowSentinel;
498  else if (IsMIPS32)
499  Mapping.Offset = kMIPS32_ShadowOffset32;
500  else if (IsFreeBSD)
501  Mapping.Offset = kFreeBSD_ShadowOffset32;
502  else if (IsNetBSD)
503  Mapping.Offset = kNetBSD_ShadowOffset32;
504  else if (IsIOS)
505  Mapping.Offset = kDynamicShadowSentinel;
506  else if (IsWindows)
507  Mapping.Offset = kWindowsShadowOffset32;
508  else if (IsEmscripten)
509  Mapping.Offset = kEmscriptenShadowOffset;
510  else
511  Mapping.Offset = kDefaultShadowOffset32;
512  } else { // LongSize == 64
513  // Fuchsia is always PIE, which means that the beginning of the address
514  // space is always available.
515  if (IsFuchsia)
516  Mapping.Offset = 0;
517  else if (IsPPC64)
518  Mapping.Offset = kPPC64_ShadowOffset64;
519  else if (IsSystemZ)
520  Mapping.Offset = kSystemZ_ShadowOffset64;
521  else if (IsFreeBSD && !IsMIPS64) {
522  if (IsKasan)
523  Mapping.Offset = kFreeBSDKasan_ShadowOffset64;
524  else
525  Mapping.Offset = kFreeBSD_ShadowOffset64;
526  } else if (IsNetBSD) {
527  if (IsKasan)
528  Mapping.Offset = kNetBSDKasan_ShadowOffset64;
529  else
530  Mapping.Offset = kNetBSD_ShadowOffset64;
531  } else if (IsPS4)
532  Mapping.Offset = kPS4_ShadowOffset64;
533  else if (IsLinux && IsX86_64) {
534  if (IsKasan)
535  Mapping.Offset = kLinuxKasan_ShadowOffset64;
536  else
537  Mapping.Offset = (kSmallX86_64ShadowOffsetBase &
538  (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale));
539  } else if (IsWindows && IsX86_64) {
540  Mapping.Offset = kWindowsShadowOffset64;
541  } else if (IsMIPS64)
542  Mapping.Offset = kMIPS64_ShadowOffset64;
543  else if (IsIOS)
544  Mapping.Offset = kDynamicShadowSentinel;
545  else if (IsMacOS && IsAArch64)
546  Mapping.Offset = kDynamicShadowSentinel;
547  else if (IsAArch64)
548  Mapping.Offset = kAArch64_ShadowOffset64;
549  else if (IsRISCV64)
550  Mapping.Offset = kRISCV64_ShadowOffset64;
551  else if (IsAMDGPU)
552  Mapping.Offset = (kSmallX86_64ShadowOffsetBase &
553  (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale));
554  else
555  Mapping.Offset = kDefaultShadowOffset64;
556  }
557 
558  if (ClForceDynamicShadow) {
559  Mapping.Offset = kDynamicShadowSentinel;
560  }
561 
562  if (ClMappingOffset.getNumOccurrences() > 0) {
563  Mapping.Offset = ClMappingOffset;
564  }
565 
566  // OR-ing shadow offset if more efficient (at least on x86) if the offset
567  // is a power of two, but on ppc64 we have to use add since the shadow
568  // offset is not necessary 1/8-th of the address space. On SystemZ,
569  // we could OR the constant in a single instruction, but it's more
570  // efficient to load it once and use indexed addressing.
571  Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 && !IsSystemZ && !IsPS4 &&
572  !IsRISCV64 &&
573  !(Mapping.Offset & (Mapping.Offset - 1)) &&
574  Mapping.Offset != kDynamicShadowSentinel;
575  bool IsAndroidWithIfuncSupport =
576  IsAndroid && !TargetTriple.isAndroidVersionLT(21);
577  Mapping.InGlobal = ClWithIfunc && IsAndroidWithIfuncSupport && IsArmOrThumb;
578 
579  return Mapping;
580 }
581 
582 namespace llvm {
583 void getAddressSanitizerParams(const Triple &TargetTriple, int LongSize,
584  bool IsKasan, uint64_t *ShadowBase,
585  int *MappingScale, bool *OrShadowOffset) {
586  auto Mapping = getShadowMapping(TargetTriple, LongSize, IsKasan);
587  *ShadowBase = Mapping.Offset;
588  *MappingScale = Mapping.Scale;
589  *OrShadowOffset = Mapping.OrShadowOffset;
590 }
591 
593  : Packed(Packed),
594  AccessSizeIndex((Packed >> kAccessSizeIndexShift) & kAccessSizeIndexMask),
595  IsWrite((Packed >> kIsWriteShift) & kIsWriteMask),
596  CompileKernel((Packed >> kCompileKernelShift) & kCompileKernelMask) {}
597 
598 ASanAccessInfo::ASanAccessInfo(bool IsWrite, bool CompileKernel,
599  uint8_t AccessSizeIndex)
600  : Packed((IsWrite << kIsWriteShift) +
601  (CompileKernel << kCompileKernelShift) +
602  (AccessSizeIndex << kAccessSizeIndexShift)),
603  AccessSizeIndex(AccessSizeIndex), IsWrite(IsWrite),
604  CompileKernel(CompileKernel) {}
605 
606 } // namespace llvm
607 
608 static uint64_t getRedzoneSizeForScale(int MappingScale) {
609  // Redzone used for stack and globals is at least 32 bytes.
610  // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively.
611  return std::max(32U, 1U << MappingScale);
612 }
613 
614 static uint64_t GetCtorAndDtorPriority(Triple &TargetTriple) {
615  if (TargetTriple.isOSEmscripten()) {
617  } else {
619  }
620 }
621 
622 namespace {
623 
624 /// AddressSanitizer: instrument the code in module to find memory bugs.
625 struct AddressSanitizer {
626  AddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD,
627  const StackSafetyGlobalInfo *SSGI,
628  bool CompileKernel = false, bool Recover = false,
629  bool UseAfterScope = false,
630  AsanDetectStackUseAfterReturnMode UseAfterReturn =
631  AsanDetectStackUseAfterReturnMode::Runtime)
632  : CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan
633  : CompileKernel),
634  Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover),
635  UseAfterScope(UseAfterScope || ClUseAfterScope),
636  UseAfterReturn(ClUseAfterReturn.getNumOccurrences() ? ClUseAfterReturn
637  : UseAfterReturn),
638  GlobalsMD(*GlobalsMD), SSGI(SSGI) {
639  C = &(M.getContext());
640  LongSize = M.getDataLayout().getPointerSizeInBits();
641  IntptrTy = Type::getIntNTy(*C, LongSize);
642  Int8PtrTy = Type::getInt8PtrTy(*C);
643  Int32Ty = Type::getInt32Ty(*C);
644  TargetTriple = Triple(M.getTargetTriple());
645 
646  Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel);
647 
648  assert(this->UseAfterReturn != AsanDetectStackUseAfterReturnMode::Invalid);
649  }
650 
651  uint64_t getAllocaSizeInBytes(const AllocaInst &AI) const {
652  uint64_t ArraySize = 1;
653  if (AI.isArrayAllocation()) {
654  const ConstantInt *CI = dyn_cast<ConstantInt>(AI.getArraySize());
655  assert(CI && "non-constant array size");
656  ArraySize = CI->getZExtValue();
657  }
658  Type *Ty = AI.getAllocatedType();
659  uint64_t SizeInBytes =
661  return SizeInBytes * ArraySize;
662  }
663 
664  /// Check if we want (and can) handle this alloca.
665  bool isInterestingAlloca(const AllocaInst &AI);
666 
667  bool ignoreAccess(Instruction *Inst, Value *Ptr);
668  void getInterestingMemoryOperands(
670 
671  void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
672  InterestingMemoryOperand &O, bool UseCalls,
673  const DataLayout &DL);
674  void instrumentPointerComparisonOrSubtraction(Instruction *I);
675  void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore,
676  Value *Addr, uint32_t TypeSize, bool IsWrite,
677  Value *SizeArgument, bool UseCalls, uint32_t Exp);
678  Instruction *instrumentAMDGPUAddress(Instruction *OrigIns,
679  Instruction *InsertBefore, Value *Addr,
680  uint32_t TypeSize, bool IsWrite,
681  Value *SizeArgument);
682  void instrumentUnusualSizeOrAlignment(Instruction *I,
683  Instruction *InsertBefore, Value *Addr,
684  uint32_t TypeSize, bool IsWrite,
685  Value *SizeArgument, bool UseCalls,
686  uint32_t Exp);
687  Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
688  Value *ShadowValue, uint32_t TypeSize);
689  Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
690  bool IsWrite, size_t AccessSizeIndex,
691  Value *SizeArgument, uint32_t Exp);
692  void instrumentMemIntrinsic(MemIntrinsic *MI);
693  Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
694  bool suppressInstrumentationSiteForDebug(int &Instrumented);
695  bool instrumentFunction(Function &F, const TargetLibraryInfo *TLI);
696  bool maybeInsertAsanInitAtFunctionEntry(Function &F);
697  bool maybeInsertDynamicShadowAtFunctionEntry(Function &F);
698  void markEscapedLocalAllocas(Function &F);
699 
700 private:
701  friend struct FunctionStackPoisoner;
702 
703  void initializeCallbacks(Module &M);
704 
705  bool LooksLikeCodeInBug11395(Instruction *I);
706  bool GlobalIsLinkerInitialized(GlobalVariable *G);
707  bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr,
708  uint64_t TypeSize) const;
709 
710  /// Helper to cleanup per-function state.
711  struct FunctionStateRAII {
712  AddressSanitizer *Pass;
713 
714  FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) {
715  assert(Pass->ProcessedAllocas.empty() &&
716  "last pass forgot to clear cache");
717  assert(!Pass->LocalDynamicShadow);
718  }
719 
720  ~FunctionStateRAII() {
721  Pass->LocalDynamicShadow = nullptr;
722  Pass->ProcessedAllocas.clear();
723  }
724  };
725 
726  LLVMContext *C;
727  Triple TargetTriple;
728  int LongSize;
729  bool CompileKernel;
730  bool Recover;
731  bool UseAfterScope;
732  AsanDetectStackUseAfterReturnMode UseAfterReturn;
733  Type *IntptrTy;
734  Type *Int8PtrTy;
735  Type *Int32Ty;
736  ShadowMapping Mapping;
737  FunctionCallee AsanHandleNoReturnFunc;
738  FunctionCallee AsanPtrCmpFunction, AsanPtrSubFunction;
739  Constant *AsanShadowGlobal;
740 
741  // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize).
742  FunctionCallee AsanErrorCallback[2][2][kNumberOfAccessSizes];
743  FunctionCallee AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes];
744 
745  // These arrays is indexed by AccessIsWrite and Experiment.
746  FunctionCallee AsanErrorCallbackSized[2][2];
747  FunctionCallee AsanMemoryAccessCallbackSized[2][2];
748 
749  FunctionCallee AsanMemmove, AsanMemcpy, AsanMemset;
750  Value *LocalDynamicShadow = nullptr;
751  const GlobalsMetadata &GlobalsMD;
752  const StackSafetyGlobalInfo *SSGI;
753  DenseMap<const AllocaInst *, bool> ProcessedAllocas;
754 
755  FunctionCallee AMDGPUAddressShared;
756  FunctionCallee AMDGPUAddressPrivate;
757 };
758 
759 class ModuleAddressSanitizer {
760 public:
761  ModuleAddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD,
762  bool CompileKernel = false, bool Recover = false,
763  bool UseGlobalsGC = true, bool UseOdrIndicator = false,
764  AsanDtorKind DestructorKind = AsanDtorKind::Global)
765  : GlobalsMD(*GlobalsMD),
766  CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan
767  : CompileKernel),
768  Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover),
769  UseGlobalsGC(UseGlobalsGC && ClUseGlobalsGC && !this->CompileKernel),
770  // Enable aliases as they should have no downside with ODR indicators.
771  UsePrivateAlias(UseOdrIndicator || ClUsePrivateAlias),
772  UseOdrIndicator(UseOdrIndicator || ClUseOdrIndicator),
773  // Not a typo: ClWithComdat is almost completely pointless without
774  // ClUseGlobalsGC (because then it only works on modules without
775  // globals, which are rare); it is a prerequisite for ClUseGlobalsGC;
776  // and both suffer from gold PR19002 for which UseGlobalsGC constructor
777  // argument is designed as workaround. Therefore, disable both
778  // ClWithComdat and ClUseGlobalsGC unless the frontend says it's ok to
779  // do globals-gc.
780  UseCtorComdat(UseGlobalsGC && ClWithComdat && !this->CompileKernel),
781  DestructorKind(DestructorKind) {
782  C = &(M.getContext());
783  int LongSize = M.getDataLayout().getPointerSizeInBits();
784  IntptrTy = Type::getIntNTy(*C, LongSize);
785  TargetTriple = Triple(M.getTargetTriple());
786  Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel);
787 
789  this->DestructorKind = ClOverrideDestructorKind;
790  assert(this->DestructorKind != AsanDtorKind::Invalid);
791  }
792 
793  bool instrumentModule(Module &);
794 
795 private:
796  void initializeCallbacks(Module &M);
797 
798  bool InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat);
799  void InstrumentGlobalsCOFF(IRBuilder<> &IRB, Module &M,
800  ArrayRef<GlobalVariable *> ExtendedGlobals,
801  ArrayRef<Constant *> MetadataInitializers);
802  void InstrumentGlobalsELF(IRBuilder<> &IRB, Module &M,
803  ArrayRef<GlobalVariable *> ExtendedGlobals,
804  ArrayRef<Constant *> MetadataInitializers,
805  const std::string &UniqueModuleId);
806  void InstrumentGlobalsMachO(IRBuilder<> &IRB, Module &M,
807  ArrayRef<GlobalVariable *> ExtendedGlobals,
808  ArrayRef<Constant *> MetadataInitializers);
809  void
810  InstrumentGlobalsWithMetadataArray(IRBuilder<> &IRB, Module &M,
811  ArrayRef<GlobalVariable *> ExtendedGlobals,
812  ArrayRef<Constant *> MetadataInitializers);
813 
814  GlobalVariable *CreateMetadataGlobal(Module &M, Constant *Initializer,
815  StringRef OriginalName);
816  void SetComdatForGlobalMetadata(GlobalVariable *G, GlobalVariable *Metadata,
817  StringRef InternalSuffix);
818  Instruction *CreateAsanModuleDtor(Module &M);
819 
820  const GlobalVariable *getExcludedAliasedGlobal(const GlobalAlias &GA) const;
821  bool shouldInstrumentGlobal(GlobalVariable *G) const;
822  bool ShouldUseMachOGlobalsSection() const;
823  StringRef getGlobalMetadataSection() const;
824  void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName);
825  void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName);
826  uint64_t getMinRedzoneSizeForGlobal() const {
827  return getRedzoneSizeForScale(Mapping.Scale);
828  }
829  uint64_t getRedzoneSizeForGlobal(uint64_t SizeInBytes) const;
830  int GetAsanVersion(const Module &M) const;
831 
832  const GlobalsMetadata &GlobalsMD;
833  bool CompileKernel;
834  bool Recover;
835  bool UseGlobalsGC;
836  bool UsePrivateAlias;
837  bool UseOdrIndicator;
838  bool UseCtorComdat;
839  AsanDtorKind DestructorKind;
840  Type *IntptrTy;
841  LLVMContext *C;
842  Triple TargetTriple;
843  ShadowMapping Mapping;
844  FunctionCallee AsanPoisonGlobals;
845  FunctionCallee AsanUnpoisonGlobals;
846  FunctionCallee AsanRegisterGlobals;
847  FunctionCallee AsanUnregisterGlobals;
848  FunctionCallee AsanRegisterImageGlobals;
849  FunctionCallee AsanUnregisterImageGlobals;
850  FunctionCallee AsanRegisterElfGlobals;
851  FunctionCallee AsanUnregisterElfGlobals;
852 
853  Function *AsanCtorFunction = nullptr;
854  Function *AsanDtorFunction = nullptr;
855 };
856 
857 // Stack poisoning does not play well with exception handling.
858 // When an exception is thrown, we essentially bypass the code
859 // that unpoisones the stack. This is why the run-time library has
860 // to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire
861 // stack in the interceptor. This however does not work inside the
862 // actual function which catches the exception. Most likely because the
863 // compiler hoists the load of the shadow value somewhere too high.
864 // This causes asan to report a non-existing bug on 453.povray.
865 // It sounds like an LLVM bug.
866 struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
867  Function &F;
868  AddressSanitizer &ASan;
869  DIBuilder DIB;
870  LLVMContext *C;
871  Type *IntptrTy;
872  Type *IntptrPtrTy;
873  ShadowMapping Mapping;
874 
876  SmallVector<AllocaInst *, 16> StaticAllocasToMoveUp;
878 
879  FunctionCallee AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1],
880  AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1];
881  FunctionCallee AsanSetShadowFunc[0x100] = {};
882  FunctionCallee AsanPoisonStackMemoryFunc, AsanUnpoisonStackMemoryFunc;
883  FunctionCallee AsanAllocaPoisonFunc, AsanAllocasUnpoisonFunc;
884 
885  // Stores a place and arguments of poisoning/unpoisoning call for alloca.
886  struct AllocaPoisonCall {
887  IntrinsicInst *InsBefore;
888  AllocaInst *AI;
889  uint64_t Size;
890  bool DoPoison;
891  };
892  SmallVector<AllocaPoisonCall, 8> DynamicAllocaPoisonCallVec;
893  SmallVector<AllocaPoisonCall, 8> StaticAllocaPoisonCallVec;
894  bool HasUntracedLifetimeIntrinsic = false;
895 
896  SmallVector<AllocaInst *, 1> DynamicAllocaVec;
897  SmallVector<IntrinsicInst *, 1> StackRestoreVec;
898  AllocaInst *DynamicAllocaLayout = nullptr;
899  IntrinsicInst *LocalEscapeCall = nullptr;
900 
901  bool HasInlineAsm = false;
902  bool HasReturnsTwiceCall = false;
903  bool PoisonStack;
904 
905  FunctionStackPoisoner(Function &F, AddressSanitizer &ASan)
906  : F(F), ASan(ASan), DIB(*F.getParent(), /*AllowUnresolved*/ false),
907  C(ASan.C), IntptrTy(ASan.IntptrTy),
908  IntptrPtrTy(PointerType::get(IntptrTy, 0)), Mapping(ASan.Mapping),
909  PoisonStack(ClStack &&
910  !Triple(F.getParent()->getTargetTriple()).isAMDGPU()) {}
911 
912  bool runOnFunction() {
913  if (!PoisonStack)
914  return false;
915 
916  if (ClRedzoneByvalArgs)
917  copyArgsPassedByValToAllocas();
918 
919  // Collect alloca, ret, lifetime instructions etc.
920  for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB);
921 
922  if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false;
923 
924  initializeCallbacks(*F.getParent());
925 
926  if (HasUntracedLifetimeIntrinsic) {
927  // If there are lifetime intrinsics which couldn't be traced back to an
928  // alloca, we may not know exactly when a variable enters scope, and
929  // therefore should "fail safe" by not poisoning them.
930  StaticAllocaPoisonCallVec.clear();
931  DynamicAllocaPoisonCallVec.clear();
932  }
933 
934  processDynamicAllocas();
935  processStaticAllocas();
936 
937  if (ClDebugStack) {
938  LLVM_DEBUG(dbgs() << F);
939  }
940  return true;
941  }
942 
943  // Arguments marked with the "byval" attribute are implicitly copied without
944  // using an alloca instruction. To produce redzones for those arguments, we
945  // copy them a second time into memory allocated with an alloca instruction.
946  void copyArgsPassedByValToAllocas();
947 
948  // Finds all Alloca instructions and puts
949  // poisoned red zones around all of them.
950  // Then unpoison everything back before the function returns.
951  void processStaticAllocas();
952  void processDynamicAllocas();
953 
954  void createDynamicAllocasInitStorage();
955 
956  // ----------------------- Visitors.
957  /// Collect all Ret instructions, or the musttail call instruction if it
958  /// precedes the return instruction.
959  void visitReturnInst(ReturnInst &RI) {
961  RetVec.push_back(CI);
962  else
963  RetVec.push_back(&RI);
964  }
965 
966  /// Collect all Resume instructions.
967  void visitResumeInst(ResumeInst &RI) { RetVec.push_back(&RI); }
968 
969  /// Collect all CatchReturnInst instructions.
970  void visitCleanupReturnInst(CleanupReturnInst &CRI) { RetVec.push_back(&CRI); }
971 
972  void unpoisonDynamicAllocasBeforeInst(Instruction *InstBefore,
973  Value *SavedStack) {
974  IRBuilder<> IRB(InstBefore);
975  Value *DynamicAreaPtr = IRB.CreatePtrToInt(SavedStack, IntptrTy);
976  // When we insert _asan_allocas_unpoison before @llvm.stackrestore, we
977  // need to adjust extracted SP to compute the address of the most recent
978  // alloca. We have a special @llvm.get.dynamic.area.offset intrinsic for
979  // this purpose.
980  if (!isa<ReturnInst>(InstBefore)) {
981  Function *DynamicAreaOffsetFunc = Intrinsic::getDeclaration(
982  InstBefore->getModule(), Intrinsic::get_dynamic_area_offset,
983  {IntptrTy});
984 
985  Value *DynamicAreaOffset = IRB.CreateCall(DynamicAreaOffsetFunc, {});
986 
987  DynamicAreaPtr = IRB.CreateAdd(IRB.CreatePtrToInt(SavedStack, IntptrTy),
988  DynamicAreaOffset);
989  }
990 
991  IRB.CreateCall(
992  AsanAllocasUnpoisonFunc,
993  {IRB.CreateLoad(IntptrTy, DynamicAllocaLayout), DynamicAreaPtr});
994  }
995 
996  // Unpoison dynamic allocas redzones.
997  void unpoisonDynamicAllocas() {
998  for (Instruction *Ret : RetVec)
999  unpoisonDynamicAllocasBeforeInst(Ret, DynamicAllocaLayout);
1000 
1001  for (Instruction *StackRestoreInst : StackRestoreVec)
1002  unpoisonDynamicAllocasBeforeInst(StackRestoreInst,
1003  StackRestoreInst->getOperand(0));
1004  }
1005 
1006  // Deploy and poison redzones around dynamic alloca call. To do this, we
1007  // should replace this call with another one with changed parameters and
1008  // replace all its uses with new address, so
1009  // addr = alloca type, old_size, align
1010  // is replaced by
1011  // new_size = (old_size + additional_size) * sizeof(type)
1012  // tmp = alloca i8, new_size, max(align, 32)
1013  // addr = tmp + 32 (first 32 bytes are for the left redzone).
1014  // Additional_size is added to make new memory allocation contain not only
1015  // requested memory, but also left, partial and right redzones.
1016  void handleDynamicAllocaCall(AllocaInst *AI);
1017 
1018  /// Collect Alloca instructions we want (and can) handle.
1019  void visitAllocaInst(AllocaInst &AI) {
1020  if (!ASan.isInterestingAlloca(AI)) {
1021  if (AI.isStaticAlloca()) {
1022  // Skip over allocas that are present *before* the first instrumented
1023  // alloca, we don't want to move those around.
1024  if (AllocaVec.empty())
1025  return;
1026 
1027  StaticAllocasToMoveUp.push_back(&AI);
1028  }
1029  return;
1030  }
1031 
1032  if (!AI.isStaticAlloca())
1033  DynamicAllocaVec.push_back(&AI);
1034  else
1035  AllocaVec.push_back(&AI);
1036  }
1037 
1038  /// Collect lifetime intrinsic calls to check for use-after-scope
1039  /// errors.
1040  void visitIntrinsicInst(IntrinsicInst &II) {
1042  if (ID == Intrinsic::stackrestore) StackRestoreVec.push_back(&II);
1043  if (ID == Intrinsic::localescape) LocalEscapeCall = &II;
1044  if (!ASan.UseAfterScope)
1045  return;
1046  if (!II.isLifetimeStartOrEnd())
1047  return;
1048  // Found lifetime intrinsic, add ASan instrumentation if necessary.
1049  auto *Size = cast<ConstantInt>(II.getArgOperand(0));
1050  // If size argument is undefined, don't do anything.
1051  if (Size->isMinusOne()) return;
1052  // Check that size doesn't saturate uint64_t and can
1053  // be stored in IntptrTy.
1054  const uint64_t SizeValue = Size->getValue().getLimitedValue();
1055  if (SizeValue == ~0ULL ||
1056  !ConstantInt::isValueValidForType(IntptrTy, SizeValue))
1057  return;
1058  // Find alloca instruction that corresponds to llvm.lifetime argument.
1059  // Currently we can only handle lifetime markers pointing to the
1060  // beginning of the alloca.
1061  AllocaInst *AI = findAllocaForValue(II.getArgOperand(1), true);
1062  if (!AI) {
1063  HasUntracedLifetimeIntrinsic = true;
1064  return;
1065  }
1066  // We're interested only in allocas we can handle.
1067  if (!ASan.isInterestingAlloca(*AI))
1068  return;
1069  bool DoPoison = (ID == Intrinsic::lifetime_end);
1070  AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison};
1071  if (AI->isStaticAlloca())
1072  StaticAllocaPoisonCallVec.push_back(APC);
1073  else if (ClInstrumentDynamicAllocas)
1074  DynamicAllocaPoisonCallVec.push_back(APC);
1075  }
1076 
1077  void visitCallBase(CallBase &CB) {
1078  if (CallInst *CI = dyn_cast<CallInst>(&CB)) {
1079  HasInlineAsm |= CI->isInlineAsm() && &CB != ASan.LocalDynamicShadow;
1080  HasReturnsTwiceCall |= CI->canReturnTwice();
1081  }
1082  }
1083 
1084  // ---------------------- Helpers.
1085  void initializeCallbacks(Module &M);
1086 
1087  // Copies bytes from ShadowBytes into shadow memory for indexes where
1088  // ShadowMask is not zero. If ShadowMask[i] is zero, we assume that
1089  // ShadowBytes[i] is constantly zero and doesn't need to be overwritten.
1090  void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes,
1091  IRBuilder<> &IRB, Value *ShadowBase);
1092  void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes,
1093  size_t Begin, size_t End, IRBuilder<> &IRB,
1094  Value *ShadowBase);
1095  void copyToShadowInline(ArrayRef<uint8_t> ShadowMask,
1096  ArrayRef<uint8_t> ShadowBytes, size_t Begin,
1097  size_t End, IRBuilder<> &IRB, Value *ShadowBase);
1098 
1099  void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison);
1100 
1101  Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L,
1102  bool Dynamic);
1103  PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue,
1104  Instruction *ThenTerm, Value *ValueIfFalse);
1105 };
1106 
1107 } // end anonymous namespace
1108 
1110  assert(MDN->getNumOperands() == 3);
1111  MDString *DIFilename = cast<MDString>(MDN->getOperand(0));
1112  Filename = DIFilename->getString();
1113  LineNo = mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue();
1114  ColumnNo =
1115  mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue();
1116 }
1117 
1118 // FIXME: It would be cleaner to instead attach relevant metadata to the globals
1119 // we want to sanitize instead and reading this metadata on each pass over a
1120 // function instead of reading module level metadata at first.
1122  NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals");
1123  if (!Globals)
1124  return;
1125  for (auto MDN : Globals->operands()) {
1126  // Metadata node contains the global and the fields of "Entry".
1127  assert(MDN->getNumOperands() == 5);
1128  auto *V = mdconst::extract_or_null<Constant>(MDN->getOperand(0));
1129  // The optimizer may optimize away a global entirely.
1130  if (!V)
1131  continue;
1132  auto *StrippedV = V->stripPointerCasts();
1133  auto *GV = dyn_cast<GlobalVariable>(StrippedV);
1134  if (!GV)
1135  continue;
1136  // We can already have an entry for GV if it was merged with another
1137  // global.
1138  Entry &E = Entries[GV];
1139  if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1)))
1140  E.SourceLoc.parse(Loc);
1141  if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2)))
1142  E.Name = Name->getString();
1143  ConstantInt *IsDynInit = mdconst::extract<ConstantInt>(MDN->getOperand(3));
1144  E.IsDynInit |= IsDynInit->isOne();
1145  ConstantInt *IsExcluded =
1146  mdconst::extract<ConstantInt>(MDN->getOperand(4));
1147  E.IsExcluded |= IsExcluded->isOne();
1148  }
1149 }
1150 
1151 AnalysisKey ASanGlobalsMetadataAnalysis::Key;
1152 
1154  ModuleAnalysisManager &AM) {
1155  return GlobalsMetadata(M);
1156 }
1157 
1159  raw_ostream &OS, function_ref<StringRef(StringRef)> MapClassName2PassName) {
1161  OS, MapClassName2PassName);
1162  OS << "<";
1163  if (Options.CompileKernel)
1164  OS << "kernel";
1165  OS << ">";
1166 }
1167 
1169  const AddressSanitizerOptions &Options, bool UseGlobalGC,
1170  bool UseOdrIndicator, AsanDtorKind DestructorKind)
1171  : Options(Options), UseGlobalGC(UseGlobalGC),
1172  UseOdrIndicator(UseOdrIndicator), DestructorKind(DestructorKind) {}
1173 
1177  ModuleAddressSanitizer ModuleSanitizer(M, &GlobalsMD, Options.CompileKernel,
1178  Options.Recover, UseGlobalGC,
1179  UseOdrIndicator, DestructorKind);
1180  bool Modified = false;
1181  auto &FAM = MAM.getResult<FunctionAnalysisManagerModuleProxy>(M).getManager();
1182  const StackSafetyGlobalInfo *const SSGI =
1184  for (Function &F : M) {
1185  AddressSanitizer FunctionSanitizer(
1186  M, &GlobalsMD, SSGI, Options.CompileKernel, Options.Recover,
1187  Options.UseAfterScope, Options.UseAfterReturn);
1189  Modified |= FunctionSanitizer.instrumentFunction(F, &TLI);
1190  }
1191  Modified |= ModuleSanitizer.instrumentModule(M);
1193 }
1194 
1196  size_t Res = countTrailingZeros(TypeSize / 8);
1198  return Res;
1199 }
1200 
1201 /// Create a global describing a source location.
1203  LocationMetadata MD) {
1204  Constant *LocData[] = {
1206  ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo),
1207  ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo),
1208  };
1209  auto LocStruct = ConstantStruct::getAnon(LocData);
1210  auto GV = new GlobalVariable(M, LocStruct->getType(), true,
1211  GlobalValue::PrivateLinkage, LocStruct,
1212  kAsanGenPrefix);
1213  GV->setUnnamedAddr(GlobalValue::UnnamedAddr::Global);
1214  return GV;
1215 }
1216 
1217 /// Check if \p G has been created by a trusted compiler pass.
1219  // Do not instrument @llvm.global_ctors, @llvm.used, etc.
1220  if (G->getName().startswith("llvm."))
1221  return true;
1222 
1223  // Do not instrument asan globals.
1224  if (G->getName().startswith(kAsanGenPrefix) ||
1225  G->getName().startswith(kSanCovGenPrefix) ||
1226  G->getName().startswith(kODRGenPrefix))
1227  return true;
1228 
1229  // Do not instrument gcov counter arrays.
1230  if (G->getName() == "__llvm_gcov_ctr")
1231  return true;
1232 
1233  return false;
1234 }
1235 
1237  Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType());
1238  unsigned int AddrSpace = PtrTy->getPointerAddressSpace();
1239  if (AddrSpace == 3 || AddrSpace == 5)
1240  return true;
1241  return false;
1242 }
1243 
1244 Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) {
1245  // Shadow >> scale
1246  Shadow = IRB.CreateLShr(Shadow, Mapping.Scale);
1247  if (Mapping.Offset == 0) return Shadow;
1248  // (Shadow >> scale) | offset
1249  Value *ShadowBase;
1250  if (LocalDynamicShadow)
1251  ShadowBase = LocalDynamicShadow;
1252  else
1253  ShadowBase = ConstantInt::get(IntptrTy, Mapping.Offset);
1254  if (Mapping.OrShadowOffset)
1255  return IRB.CreateOr(Shadow, ShadowBase);
1256  else
1257  return IRB.CreateAdd(Shadow, ShadowBase);
1258 }
1259 
1260 // Instrument memset/memmove/memcpy
1261 void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) {
1262  IRBuilder<> IRB(MI);
1263  if (isa<MemTransferInst>(MI)) {
1264  IRB.CreateCall(
1265  isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy,
1266  {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
1267  IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()),
1268  IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
1269  } else if (isa<MemSetInst>(MI)) {
1270  IRB.CreateCall(
1271  AsanMemset,
1272  {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
1273  IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false),
1274  IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
1275  }
1276  MI->eraseFromParent();
1277 }
1278 
1279 /// Check if we want (and can) handle this alloca.
1280 bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) {
1281  auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI);
1282 
1283  if (PreviouslySeenAllocaInfo != ProcessedAllocas.end())
1284  return PreviouslySeenAllocaInfo->getSecond();
1285 
1286  bool IsInteresting =
1287  (AI.getAllocatedType()->isSized() &&
1288  // alloca() may be called with 0 size, ignore it.
1289  ((!AI.isStaticAlloca()) || getAllocaSizeInBytes(AI) > 0) &&
1290  // We are only interested in allocas not promotable to registers.
1291  // Promotable allocas are common under -O0.
1293  // inalloca allocas are not treated as static, and we don't want
1294  // dynamic alloca instrumentation for them as well.
1295  !AI.isUsedWithInAlloca() &&
1296  // swifterror allocas are register promoted by ISel
1297  !AI.isSwiftError());
1298 
1299  ProcessedAllocas[&AI] = IsInteresting;
1300  return IsInteresting;
1301 }
1302 
1303 bool AddressSanitizer::ignoreAccess(Instruction *Inst, Value *Ptr) {
1304  // Instrument acesses from different address spaces only for AMDGPU.
1305  Type *PtrTy = cast<PointerType>(Ptr->getType()->getScalarType());
1306  if (PtrTy->getPointerAddressSpace() != 0 &&
1307  !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(Ptr)))
1308  return true;
1309 
1310  // Ignore swifterror addresses.
1311  // swifterror memory addresses are mem2reg promoted by instruction
1312  // selection. As such they cannot have regular uses like an instrumentation
1313  // function and it makes no sense to track them as memory.
1314  if (Ptr->isSwiftError())
1315  return true;
1316 
1317  // Treat memory accesses to promotable allocas as non-interesting since they
1318  // will not cause memory violations. This greatly speeds up the instrumented
1319  // executable at -O0.
1320  if (auto AI = dyn_cast_or_null<AllocaInst>(Ptr))
1321  if (ClSkipPromotableAllocas && !isInterestingAlloca(*AI))
1322  return true;
1323 
1324  if (SSGI != nullptr && SSGI->stackAccessIsSafe(*Inst) &&
1325  findAllocaForValue(Ptr))
1326  return true;
1327 
1328  return false;
1329 }
1330 
1331 void AddressSanitizer::getInterestingMemoryOperands(
1333  // Skip memory accesses inserted by another instrumentation.
1334  if (I->hasMetadata(LLVMContext::MD_nosanitize))
1335  return;
1336 
1337  // Do not instrument the load fetching the dynamic shadow address.
1338  if (LocalDynamicShadow == I)
1339  return;
1340 
1341  if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
1342  if (!ClInstrumentReads || ignoreAccess(I, LI->getPointerOperand()))
1343  return;
1344  Interesting.emplace_back(I, LI->getPointerOperandIndex(), false,
1345  LI->getType(), LI->getAlign());
1346  } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
1347  if (!ClInstrumentWrites || ignoreAccess(I, SI->getPointerOperand()))
1348  return;
1349  Interesting.emplace_back(I, SI->getPointerOperandIndex(), true,
1350  SI->getValueOperand()->getType(), SI->getAlign());
1351  } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) {
1352  if (!ClInstrumentAtomics || ignoreAccess(I, RMW->getPointerOperand()))
1353  return;
1354  Interesting.emplace_back(I, RMW->getPointerOperandIndex(), true,
1355  RMW->getValOperand()->getType(), None);
1356  } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) {
1357  if (!ClInstrumentAtomics || ignoreAccess(I, XCHG->getPointerOperand()))
1358  return;
1359  Interesting.emplace_back(I, XCHG->getPointerOperandIndex(), true,
1360  XCHG->getCompareOperand()->getType(), None);
1361  } else if (auto CI = dyn_cast<CallInst>(I)) {
1362  if (CI->getIntrinsicID() == Intrinsic::masked_load ||
1363  CI->getIntrinsicID() == Intrinsic::masked_store) {
1364  bool IsWrite = CI->getIntrinsicID() == Intrinsic::masked_store;
1365  // Masked store has an initial operand for the value.
1366  unsigned OpOffset = IsWrite ? 1 : 0;
1367  if (IsWrite ? !ClInstrumentWrites : !ClInstrumentReads)
1368  return;
1369 
1370  auto BasePtr = CI->getOperand(OpOffset);
1371  if (ignoreAccess(I, BasePtr))
1372  return;
1373  Type *Ty = IsWrite ? CI->getArgOperand(0)->getType() : CI->getType();
1374  MaybeAlign Alignment = Align(1);
1375  // Otherwise no alignment guarantees. We probably got Undef.
1376  if (auto *Op = dyn_cast<ConstantInt>(CI->getOperand(1 + OpOffset)))
1377  Alignment = Op->getMaybeAlignValue();
1378  Value *Mask = CI->getOperand(2 + OpOffset);
1379  Interesting.emplace_back(I, OpOffset, IsWrite, Ty, Alignment, Mask);
1380  } else {
1381  for (unsigned ArgNo = 0; ArgNo < CI->arg_size(); ArgNo++) {
1382  if (!ClInstrumentByval || !CI->isByValArgument(ArgNo) ||
1383  ignoreAccess(I, CI->getArgOperand(ArgNo)))
1384  continue;
1385  Type *Ty = CI->getParamByValType(ArgNo);
1386  Interesting.emplace_back(I, ArgNo, false, Ty, Align(1));
1387  }
1388  }
1389  }
1390 }
1391 
1392 static bool isPointerOperand(Value *V) {
1393  return V->getType()->isPointerTy() || isa<PtrToIntInst>(V);
1394 }
1395 
1396 // This is a rough heuristic; it may cause both false positives and
1397 // false negatives. The proper implementation requires cooperation with
1398 // the frontend.
1400  if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) {
1401  if (!Cmp->isRelational())
1402  return false;
1403  } else {
1404  return false;
1405  }
1406  return isPointerOperand(I->getOperand(0)) &&
1407  isPointerOperand(I->getOperand(1));
1408 }
1409 
1410 // This is a rough heuristic; it may cause both false positives and
1411 // false negatives. The proper implementation requires cooperation with
1412 // the frontend.
1414  if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) {
1415  if (BO->getOpcode() != Instruction::Sub)
1416  return false;
1417  } else {
1418  return false;
1419  }
1420  return isPointerOperand(I->getOperand(0)) &&
1421  isPointerOperand(I->getOperand(1));
1422 }
1423 
1424 bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) {
1425  // If a global variable does not have dynamic initialization we don't
1426  // have to instrument it. However, if a global does not have initializer
1427  // at all, we assume it has dynamic initializer (in other TU).
1428  //
1429  // FIXME: Metadata should be attched directly to the global directly instead
1430  // of being added to llvm.asan.globals.
1431  return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit;
1432 }
1433 
1434 void AddressSanitizer::instrumentPointerComparisonOrSubtraction(
1435  Instruction *I) {
1436  IRBuilder<> IRB(I);
1437  FunctionCallee F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction;
1438  Value *Param[2] = {I->getOperand(0), I->getOperand(1)};
1439  for (Value *&i : Param) {
1440  if (i->getType()->isPointerTy())
1441  i = IRB.CreatePointerCast(i, IntptrTy);
1442  }
1443  IRB.CreateCall(F, Param);
1444 }
1445 
1446 static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I,
1447  Instruction *InsertBefore, Value *Addr,
1448  MaybeAlign Alignment, unsigned Granularity,
1449  uint32_t TypeSize, bool IsWrite,
1450  Value *SizeArgument, bool UseCalls,
1451  uint32_t Exp) {
1452  // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check
1453  // if the data is properly aligned.
1454  if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 ||
1455  TypeSize == 128) &&
1456  (!Alignment || *Alignment >= Granularity || *Alignment >= TypeSize / 8))
1457  return Pass->instrumentAddress(I, InsertBefore, Addr, TypeSize, IsWrite,
1458  nullptr, UseCalls, Exp);
1459  Pass->instrumentUnusualSizeOrAlignment(I, InsertBefore, Addr, TypeSize,
1460  IsWrite, nullptr, UseCalls, Exp);
1461 }
1462 
1463 static void instrumentMaskedLoadOrStore(AddressSanitizer *Pass,
1464  const DataLayout &DL, Type *IntptrTy,
1465  Value *Mask, Instruction *I,
1466  Value *Addr, MaybeAlign Alignment,
1467  unsigned Granularity, Type *OpType,
1468  bool IsWrite, Value *SizeArgument,
1469  bool UseCalls, uint32_t Exp) {
1470  auto *VTy = cast<FixedVectorType>(OpType);
1471  uint64_t ElemTypeSize = DL.getTypeStoreSizeInBits(VTy->getScalarType());
1472  unsigned Num = VTy->getNumElements();
1473  auto Zero = ConstantInt::get(IntptrTy, 0);
1474  for (unsigned Idx = 0; Idx < Num; ++Idx) {
1475  Value *InstrumentedAddress = nullptr;
1476  Instruction *InsertBefore = I;
1477  if (auto *Vector = dyn_cast<ConstantVector>(Mask)) {
1478  // dyn_cast as we might get UndefValue
1479  if (auto *Masked = dyn_cast<ConstantInt>(Vector->getOperand(Idx))) {
1480  if (Masked->isZero())
1481  // Mask is constant false, so no instrumentation needed.
1482  continue;
1483  // If we have a true or undef value, fall through to doInstrumentAddress
1484  // with InsertBefore == I
1485  }
1486  } else {
1487  IRBuilder<> IRB(I);
1488  Value *MaskElem = IRB.CreateExtractElement(Mask, Idx);
1489  Instruction *ThenTerm = SplitBlockAndInsertIfThen(MaskElem, I, false);
1490  InsertBefore = ThenTerm;
1491  }
1492 
1493  IRBuilder<> IRB(InsertBefore);
1494  InstrumentedAddress =
1495  IRB.CreateGEP(VTy, Addr, {Zero, ConstantInt::get(IntptrTy, Idx)});
1496  doInstrumentAddress(Pass, I, InsertBefore, InstrumentedAddress, Alignment,
1497  Granularity, ElemTypeSize, IsWrite, SizeArgument,
1498  UseCalls, Exp);
1499  }
1500 }
1501 
1502 void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
1503  InterestingMemoryOperand &O, bool UseCalls,
1504  const DataLayout &DL) {
1505  Value *Addr = O.getPtr();
1506 
1507  // Optimization experiments.
1508  // The experiments can be used to evaluate potential optimizations that remove
1509  // instrumentation (assess false negatives). Instead of completely removing
1510  // some instrumentation, you set Exp to a non-zero value (mask of optimization
1511  // experiments that want to remove instrumentation of this instruction).
1512  // If Exp is non-zero, this pass will emit special calls into runtime
1513  // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls
1514  // make runtime terminate the program in a special way (with a different
1515  // exit status). Then you run the new compiler on a buggy corpus, collect
1516  // the special terminations (ideally, you don't see them at all -- no false
1517  // negatives) and make the decision on the optimization.
1519 
1520  if (ClOpt && ClOptGlobals) {
1521  // If initialization order checking is disabled, a simple access to a
1522  // dynamically initialized global is always valid.
1523  GlobalVariable *G = dyn_cast<GlobalVariable>(getUnderlyingObject(Addr));
1524  if (G && (!ClInitializers || GlobalIsLinkerInitialized(G)) &&
1525  isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) {
1526  NumOptimizedAccessesToGlobalVar++;
1527  return;
1528  }
1529  }
1530 
1531  if (ClOpt && ClOptStack) {
1532  // A direct inbounds access to a stack variable is always valid.
1533  if (isa<AllocaInst>(getUnderlyingObject(Addr)) &&
1534  isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) {
1535  NumOptimizedAccessesToStackVar++;
1536  return;
1537  }
1538  }
1539 
1540  if (O.IsWrite)
1541  NumInstrumentedWrites++;
1542  else
1543  NumInstrumentedReads++;
1544 
1545  unsigned Granularity = 1 << Mapping.Scale;
1546  if (O.MaybeMask) {
1547  instrumentMaskedLoadOrStore(this, DL, IntptrTy, O.MaybeMask, O.getInsn(),
1548  Addr, O.Alignment, Granularity, O.OpType,
1549  O.IsWrite, nullptr, UseCalls, Exp);
1550  } else {
1551  doInstrumentAddress(this, O.getInsn(), O.getInsn(), Addr, O.Alignment,
1552  Granularity, O.TypeSize, O.IsWrite, nullptr, UseCalls,
1553  Exp);
1554  }
1555 }
1556 
1557 Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore,
1558  Value *Addr, bool IsWrite,
1559  size_t AccessSizeIndex,
1560  Value *SizeArgument,
1561  uint32_t Exp) {
1562  IRBuilder<> IRB(InsertBefore);
1563  Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp);
1564  CallInst *Call = nullptr;
1565  if (SizeArgument) {
1566  if (Exp == 0)
1567  Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0],
1568  {Addr, SizeArgument});
1569  else
1570  Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1],
1571  {Addr, SizeArgument, ExpVal});
1572  } else {
1573  if (Exp == 0)
1574  Call =
1575  IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr);
1576  else
1577  Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex],
1578  {Addr, ExpVal});
1579  }
1580 
1581  Call->setCannotMerge();
1582  return Call;
1583 }
1584 
1585 Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
1586  Value *ShadowValue,
1587  uint32_t TypeSize) {
1588  size_t Granularity = static_cast<size_t>(1) << Mapping.Scale;
1589  // Addr & (Granularity - 1)
1590  Value *LastAccessedByte =
1591  IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1));
1592  // (Addr & (Granularity - 1)) + size - 1
1593  if (TypeSize / 8 > 1)
1594  LastAccessedByte = IRB.CreateAdd(
1595  LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1));
1596  // (uint8_t) ((Addr & (Granularity-1)) + size - 1)
1597  LastAccessedByte =
1598  IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false);
1599  // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue
1600  return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue);
1601 }
1602 
1603 Instruction *AddressSanitizer::instrumentAMDGPUAddress(
1604  Instruction *OrigIns, Instruction *InsertBefore, Value *Addr,
1605  uint32_t TypeSize, bool IsWrite, Value *SizeArgument) {
1606  // Do not instrument unsupported addrspaces.
1608  return nullptr;
1609  Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType());
1610  // Follow host instrumentation for global and constant addresses.
1611  if (PtrTy->getPointerAddressSpace() != 0)
1612  return InsertBefore;
1613  // Instrument generic addresses in supported addressspaces.
1614  IRBuilder<> IRB(InsertBefore);
1615  Value *AddrLong = IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy());
1616  Value *IsShared = IRB.CreateCall(AMDGPUAddressShared, {AddrLong});
1617  Value *IsPrivate = IRB.CreateCall(AMDGPUAddressPrivate, {AddrLong});
1618  Value *IsSharedOrPrivate = IRB.CreateOr(IsShared, IsPrivate);
1619  Value *Cmp = IRB.CreateICmpNE(IRB.getTrue(), IsSharedOrPrivate);
1620  Value *AddrSpaceZeroLanding =
1621  SplitBlockAndInsertIfThen(Cmp, InsertBefore, false);
1622  InsertBefore = cast<Instruction>(AddrSpaceZeroLanding);
1623  return InsertBefore;
1624 }
1625 
1626 void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
1627  Instruction *InsertBefore, Value *Addr,
1628  uint32_t TypeSize, bool IsWrite,
1629  Value *SizeArgument, bool UseCalls,
1630  uint32_t Exp) {
1631  if (TargetTriple.isAMDGPU()) {
1632  InsertBefore = instrumentAMDGPUAddress(OrigIns, InsertBefore, Addr,
1633  TypeSize, IsWrite, SizeArgument);
1634  if (!InsertBefore)
1635  return;
1636  }
1637 
1638  IRBuilder<> IRB(InsertBefore);
1639  size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize);
1640  const ASanAccessInfo AccessInfo(IsWrite, CompileKernel, AccessSizeIndex);
1641 
1642  if (UseCalls && ClOptimizeCallbacks) {
1643  const ASanAccessInfo AccessInfo(IsWrite, CompileKernel, AccessSizeIndex);
1644  Module *M = IRB.GetInsertBlock()->getParent()->getParent();
1645  IRB.CreateCall(
1646  Intrinsic::getDeclaration(M, Intrinsic::asan_check_memaccess),
1647  {IRB.CreatePointerCast(Addr, Int8PtrTy),
1648  ConstantInt::get(Int32Ty, AccessInfo.Packed)});
1649  return;
1650  }
1651 
1652  Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
1653  if (UseCalls) {
1654  if (Exp == 0)
1655  IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex],
1656  AddrLong);
1657  else
1658  IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex],
1659  {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)});
1660  return;
1661  }
1662 
1663  Type *ShadowTy =
1664  IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale));
1665  Type *ShadowPtrTy = PointerType::get(ShadowTy, 0);
1666  Value *ShadowPtr = memToShadow(AddrLong, IRB);
1667  Value *CmpVal = Constant::getNullValue(ShadowTy);
1668  Value *ShadowValue =
1669  IRB.CreateLoad(ShadowTy, IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy));
1670 
1671  Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal);
1672  size_t Granularity = 1ULL << Mapping.Scale;
1673  Instruction *CrashTerm = nullptr;
1674 
1675  if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) {
1676  // We use branch weights for the slow path check, to indicate that the slow
1677  // path is rarely taken. This seems to be the case for SPEC benchmarks.
1679  Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000));
1680  assert(cast<BranchInst>(CheckTerm)->isUnconditional());
1681  BasicBlock *NextBB = CheckTerm->getSuccessor(0);
1682  IRB.SetInsertPoint(CheckTerm);
1683  Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize);
1684  if (Recover) {
1685  CrashTerm = SplitBlockAndInsertIfThen(Cmp2, CheckTerm, false);
1686  } else {
1687  BasicBlock *CrashBlock =
1688  BasicBlock::Create(*C, "", NextBB->getParent(), NextBB);
1689  CrashTerm = new UnreachableInst(*C, CrashBlock);
1690  BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2);
1691  ReplaceInstWithInst(CheckTerm, NewTerm);
1692  }
1693  } else {
1694  CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover);
1695  }
1696 
1697  Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite,
1698  AccessSizeIndex, SizeArgument, Exp);
1699  Crash->setDebugLoc(OrigIns->getDebugLoc());
1700 }
1701 
1702 // Instrument unusual size or unusual alignment.
1703 // We can not do it with a single check, so we do 1-byte check for the first
1704 // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able
1705 // to report the actual access size.
1706 void AddressSanitizer::instrumentUnusualSizeOrAlignment(
1707  Instruction *I, Instruction *InsertBefore, Value *Addr, uint32_t TypeSize,
1708  bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp) {
1709  IRBuilder<> IRB(InsertBefore);
1710  Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8);
1711  Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
1712  if (UseCalls) {
1713  if (Exp == 0)
1714  IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0],
1715  {AddrLong, Size});
1716  else
1717  IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1],
1718  {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)});
1719  } else {
1720  Value *LastByte = IRB.CreateIntToPtr(
1721  IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)),
1722  Addr->getType());
1723  instrumentAddress(I, InsertBefore, Addr, 8, IsWrite, Size, false, Exp);
1724  instrumentAddress(I, InsertBefore, LastByte, 8, IsWrite, Size, false, Exp);
1725  }
1726 }
1727 
1728 void ModuleAddressSanitizer::poisonOneInitializer(Function &GlobalInit,
1730  // Set up the arguments to our poison/unpoison functions.
1731  IRBuilder<> IRB(&GlobalInit.front(),
1732  GlobalInit.front().getFirstInsertionPt());
1733 
1734  // Add a call to poison all external globals before the given function starts.
1735  Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy);
1736  IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr);
1737 
1738  // Add calls to unpoison all globals before each return instruction.
1739  for (auto &BB : GlobalInit.getBasicBlockList())
1740  if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator()))
1741  CallInst::Create(AsanUnpoisonGlobals, "", RI);
1742 }
1743 
1744 void ModuleAddressSanitizer::createInitializerPoisonCalls(
1745  Module &M, GlobalValue *ModuleName) {
1746  GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors");
1747  if (!GV)
1748  return;
1749 
1750  ConstantArray *CA = dyn_cast<ConstantArray>(GV->getInitializer());
1751  if (!CA)
1752  return;
1753 
1754  for (Use &OP : CA->operands()) {
1755  if (isa<ConstantAggregateZero>(OP)) continue;
1756  ConstantStruct *CS = cast<ConstantStruct>(OP);
1757 
1758  // Must have a function or null ptr.
1759  if (Function *F = dyn_cast<Function>(CS->getOperand(1))) {
1760  if (F->getName() == kAsanModuleCtorName) continue;
1761  auto *Priority = cast<ConstantInt>(CS->getOperand(0));
1762  // Don't instrument CTORs that will run before asan.module_ctor.
1763  if (Priority->getLimitedValue() <= GetCtorAndDtorPriority(TargetTriple))
1764  continue;
1765  poisonOneInitializer(*F, ModuleName);
1766  }
1767  }
1768 }
1769 
1770 const GlobalVariable *
1771 ModuleAddressSanitizer::getExcludedAliasedGlobal(const GlobalAlias &GA) const {
1772  // In case this function should be expanded to include rules that do not just
1773  // apply when CompileKernel is true, either guard all existing rules with an
1774  // 'if (CompileKernel) { ... }' or be absolutely sure that all these rules
1775  // should also apply to user space.
1776  assert(CompileKernel && "Only expecting to be called when compiling kernel");
1777 
1778  const Constant *C = GA.getAliasee();
1779 
1780  // When compiling the kernel, globals that are aliased by symbols prefixed
1781  // by "__" are special and cannot be padded with a redzone.
1782  if (GA.getName().startswith("__"))
1783  return dyn_cast<GlobalVariable>(C->stripPointerCastsAndAliases());
1784 
1785  return nullptr;
1786 }
1787 
1788 bool ModuleAddressSanitizer::shouldInstrumentGlobal(GlobalVariable *G) const {
1789  Type *Ty = G->getValueType();
1790  LLVM_DEBUG(dbgs() << "GLOBAL: " << *G << "\n");
1791 
1792  // FIXME: Metadata should be attched directly to the global directly instead
1793  // of being added to llvm.asan.globals.
1794  if (GlobalsMD.get(G).IsExcluded) return false;
1795  if (!Ty->isSized()) return false;
1796  if (!G->hasInitializer()) return false;
1797  // Globals in address space 1 and 4 are supported for AMDGPU.
1798  if (G->getAddressSpace() &&
1799  !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(G)))
1800  return false;
1801  if (GlobalWasGeneratedByCompiler(G)) return false; // Our own globals.
1802  // Two problems with thread-locals:
1803  // - The address of the main thread's copy can't be computed at link-time.
1804  // - Need to poison all copies, not just the main thread's one.
1805  if (G->isThreadLocal()) return false;
1806  // For now, just ignore this Global if the alignment is large.
1807  if (G->getAlignment() > getMinRedzoneSizeForGlobal()) return false;
1808 
1809  // For non-COFF targets, only instrument globals known to be defined by this
1810  // TU.
1811  // FIXME: We can instrument comdat globals on ELF if we are using the
1812  // GC-friendly metadata scheme.
1813  if (!TargetTriple.isOSBinFormatCOFF()) {
1814  if (!G->hasExactDefinition() || G->hasComdat())
1815  return false;
1816  } else {
1817  // On COFF, don't instrument non-ODR linkages.
1818  if (G->isInterposable())
1819  return false;
1820  }
1821 
1822  // If a comdat is present, it must have a selection kind that implies ODR
1823  // semantics: no duplicates, any, or exact match.
1824  if (Comdat *C = G->getComdat()) {
1825  switch (C->getSelectionKind()) {
1826  case Comdat::Any:
1827  case Comdat::ExactMatch:
1828  case Comdat::NoDeduplicate:
1829  break;
1830  case Comdat::Largest:
1831  case Comdat::SameSize:
1832  return false;
1833  }
1834  }
1835 
1836  if (G->hasSection()) {
1837  // The kernel uses explicit sections for mostly special global variables
1838  // that we should not instrument. E.g. the kernel may rely on their layout
1839  // without redzones, or remove them at link time ("discard.*"), etc.
1840  if (CompileKernel)
1841  return false;
1842 
1843  StringRef Section = G->getSection();
1844 
1845  // Globals from llvm.metadata aren't emitted, do not instrument them.
1846  if (Section == "llvm.metadata") return false;
1847  // Do not instrument globals from special LLVM sections.
1848  if (Section.contains("__llvm") || Section.contains("__LLVM"))
1849  return false;
1850 
1851  // Do not instrument function pointers to initialization and termination
1852  // routines: dynamic linker will not properly handle redzones.
1853  if (Section.startswith(".preinit_array") ||
1854  Section.startswith(".init_array") ||
1855  Section.startswith(".fini_array")) {
1856  return false;
1857  }
1858 
1859  // Do not instrument user-defined sections (with names resembling
1860  // valid C identifiers)
1861  if (TargetTriple.isOSBinFormatELF()) {
1862  if (llvm::all_of(Section,
1863  [](char c) { return llvm::isAlnum(c) || c == '_'; }))
1864  return false;
1865  }
1866 
1867  // On COFF, if the section name contains '$', it is highly likely that the
1868  // user is using section sorting to create an array of globals similar to
1869  // the way initialization callbacks are registered in .init_array and
1870  // .CRT$XCU. The ATL also registers things in .ATL$__[azm]. Adding redzones
1871  // to such globals is counterproductive, because the intent is that they
1872  // will form an array, and out-of-bounds accesses are expected.
1873  // See https://github.com/google/sanitizers/issues/305
1874  // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx
1875  if (TargetTriple.isOSBinFormatCOFF() && Section.contains('$')) {
1876  LLVM_DEBUG(dbgs() << "Ignoring global in sorted section (contains '$'): "
1877  << *G << "\n");
1878  return false;
1879  }
1880 
1881  if (TargetTriple.isOSBinFormatMachO()) {
1882  StringRef ParsedSegment, ParsedSection;
1883  unsigned TAA = 0, StubSize = 0;
1884  bool TAAParsed;
1886  Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize));
1887 
1888  // Ignore the globals from the __OBJC section. The ObjC runtime assumes
1889  // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to
1890  // them.
1891  if (ParsedSegment == "__OBJC" ||
1892  (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) {
1893  LLVM_DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n");
1894  return false;
1895  }
1896  // See https://github.com/google/sanitizers/issues/32
1897  // Constant CFString instances are compiled in the following way:
1898  // -- the string buffer is emitted into
1899  // __TEXT,__cstring,cstring_literals
1900  // -- the constant NSConstantString structure referencing that buffer
1901  // is placed into __DATA,__cfstring
1902  // Therefore there's no point in placing redzones into __DATA,__cfstring.
1903  // Moreover, it causes the linker to crash on OS X 10.7
1904  if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") {
1905  LLVM_DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n");
1906  return false;
1907  }
1908  // The linker merges the contents of cstring_literals and removes the
1909  // trailing zeroes.
1910  if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) {
1911  LLVM_DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n");
1912  return false;
1913  }
1914  }
1915  }
1916 
1917  if (CompileKernel) {
1918  // Globals that prefixed by "__" are special and cannot be padded with a
1919  // redzone.
1920  if (G->getName().startswith("__"))
1921  return false;
1922  }
1923 
1924  return true;
1925 }
1926 
1927 // On Mach-O platforms, we emit global metadata in a separate section of the
1928 // binary in order to allow the linker to properly dead strip. This is only
1929 // supported on recent versions of ld64.
1930 bool ModuleAddressSanitizer::ShouldUseMachOGlobalsSection() const {
1931  if (!TargetTriple.isOSBinFormatMachO())
1932  return false;
1933 
1934  if (TargetTriple.isMacOSX() && !TargetTriple.isMacOSXVersionLT(10, 11))
1935  return true;
1936  if (TargetTriple.isiOS() /* or tvOS */ && !TargetTriple.isOSVersionLT(9))
1937  return true;
1938  if (TargetTriple.isWatchOS() && !TargetTriple.isOSVersionLT(2))
1939  return true;
1940  if (TargetTriple.isDriverKit())
1941  return true;
1942 
1943  return false;
1944 }
1945 
1946 StringRef ModuleAddressSanitizer::getGlobalMetadataSection() const {
1947  switch (TargetTriple.getObjectFormat()) {
1948  case Triple::COFF: return ".ASAN$GL";
1949  case Triple::ELF: return "asan_globals";
1950  case Triple::MachO: return "__DATA,__asan_globals,regular";
1951  case Triple::Wasm:
1952  case Triple::GOFF:
1953  case Triple::SPIRV:
1954  case Triple::XCOFF:
1955  case Triple::DXContainer:
1957  "ModuleAddressSanitizer not implemented for object file format");
1959  break;
1960  }
1961  llvm_unreachable("unsupported object format");
1962 }
1963 
1964 void ModuleAddressSanitizer::initializeCallbacks(Module &M) {
1965  IRBuilder<> IRB(*C);
1966 
1967  // Declare our poisoning and unpoisoning functions.
1968  AsanPoisonGlobals =
1969  M.getOrInsertFunction(kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy);
1970  AsanUnpoisonGlobals =
1971  M.getOrInsertFunction(kAsanUnpoisonGlobalsName, IRB.getVoidTy());
1972 
1973  // Declare functions that register/unregister globals.
1974  AsanRegisterGlobals = M.getOrInsertFunction(
1975  kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy);
1976  AsanUnregisterGlobals = M.getOrInsertFunction(
1977  kAsanUnregisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy);
1978 
1979  // Declare the functions that find globals in a shared object and then invoke
1980  // the (un)register function on them.
1981  AsanRegisterImageGlobals = M.getOrInsertFunction(
1982  kAsanRegisterImageGlobalsName, IRB.getVoidTy(), IntptrTy);
1983  AsanUnregisterImageGlobals = M.getOrInsertFunction(
1984  kAsanUnregisterImageGlobalsName, IRB.getVoidTy(), IntptrTy);
1985 
1986  AsanRegisterElfGlobals =
1987  M.getOrInsertFunction(kAsanRegisterElfGlobalsName, IRB.getVoidTy(),
1988  IntptrTy, IntptrTy, IntptrTy);
1989  AsanUnregisterElfGlobals =
1990  M.getOrInsertFunction(kAsanUnregisterElfGlobalsName, IRB.getVoidTy(),
1991  IntptrTy, IntptrTy, IntptrTy);
1992 }
1993 
1994 // Put the metadata and the instrumented global in the same group. This ensures
1995 // that the metadata is discarded if the instrumented global is discarded.
1996 void ModuleAddressSanitizer::SetComdatForGlobalMetadata(
1997  GlobalVariable *G, GlobalVariable *Metadata, StringRef InternalSuffix) {
1998  Module &M = *G->getParent();
1999  Comdat *C = G->getComdat();
2000  if (!C) {
2001  if (!G->hasName()) {
2002  // If G is unnamed, it must be internal. Give it an artificial name
2003  // so we can put it in a comdat.
2004  assert(G->hasLocalLinkage());
2005  G->setName(Twine(kAsanGenPrefix) + "_anon_global");
2006  }
2007 
2008  if (!InternalSuffix.empty() && G->hasLocalLinkage()) {
2009  std::string Name = std::string(G->getName());
2010  Name += InternalSuffix;
2011  C = M.getOrInsertComdat(Name);
2012  } else {
2013  C = M.getOrInsertComdat(G->getName());
2014  }
2015 
2016  // Make this IMAGE_COMDAT_SELECT_NODUPLICATES on COFF. Also upgrade private
2017  // linkage to internal linkage so that a symbol table entry is emitted. This
2018  // is necessary in order to create the comdat group.
2019  if (TargetTriple.isOSBinFormatCOFF()) {
2020  C->setSelectionKind(Comdat::NoDeduplicate);
2021  if (G->hasPrivateLinkage())
2022  G->setLinkage(GlobalValue::InternalLinkage);
2023  }
2024  G->setComdat(C);
2025  }
2026 
2027  assert(G->hasComdat());
2028  Metadata->setComdat(G->getComdat());
2029 }
2030 
2031 // Create a separate metadata global and put it in the appropriate ASan
2032 // global registration section.
2034 ModuleAddressSanitizer::CreateMetadataGlobal(Module &M, Constant *Initializer,
2035  StringRef OriginalName) {
2036  auto Linkage = TargetTriple.isOSBinFormatMachO()
2040  M, Initializer->getType(), false, Linkage, Initializer,
2041  Twine("__asan_global_") + GlobalValue::dropLLVMManglingEscape(OriginalName));
2042  Metadata->setSection(getGlobalMetadataSection());
2043  return Metadata;
2044 }
2045 
2046 Instruction *ModuleAddressSanitizer::CreateAsanModuleDtor(Module &M) {
2047  AsanDtorFunction = Function::createWithDefaultAttr(
2050  AsanDtorFunction->addFnAttr(Attribute::NoUnwind);
2051  // Ensure Dtor cannot be discarded, even if in a comdat.
2052  appendToUsed(M, {AsanDtorFunction});
2053  BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction);
2054 
2055  return ReturnInst::Create(*C, AsanDtorBB);
2056 }
2057 
2058 void ModuleAddressSanitizer::InstrumentGlobalsCOFF(
2059  IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
2060  ArrayRef<Constant *> MetadataInitializers) {
2061  assert(ExtendedGlobals.size() == MetadataInitializers.size());
2062  auto &DL = M.getDataLayout();
2063 
2064  SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size());
2065  for (size_t i = 0; i < ExtendedGlobals.size(); i++) {
2066  Constant *Initializer = MetadataInitializers[i];
2067  GlobalVariable *G = ExtendedGlobals[i];
2069  CreateMetadataGlobal(M, Initializer, G->getName());
2070  MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G));
2071  Metadata->setMetadata(LLVMContext::MD_associated, MD);
2072  MetadataGlobals[i] = Metadata;
2073 
2074  // The MSVC linker always inserts padding when linking incrementally. We
2075  // cope with that by aligning each struct to its size, which must be a power
2076  // of two.
2077  unsigned SizeOfGlobalStruct = DL.getTypeAllocSize(Initializer->getType());
2078  assert(isPowerOf2_32(SizeOfGlobalStruct) &&
2079  "global metadata will not be padded appropriately");
2080  Metadata->setAlignment(assumeAligned(SizeOfGlobalStruct));
2081 
2082  SetComdatForGlobalMetadata(G, Metadata, "");
2083  }
2084 
2085  // Update llvm.compiler.used, adding the new metadata globals. This is
2086  // needed so that during LTO these variables stay alive.
2087  if (!MetadataGlobals.empty())
2088  appendToCompilerUsed(M, MetadataGlobals);
2089 }
2090 
2091 void ModuleAddressSanitizer::InstrumentGlobalsELF(
2092  IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
2093  ArrayRef<Constant *> MetadataInitializers,
2094  const std::string &UniqueModuleId) {
2095  assert(ExtendedGlobals.size() == MetadataInitializers.size());
2096 
2097  // Putting globals in a comdat changes the semantic and potentially cause
2098  // false negative odr violations at link time. If odr indicators are used, we
2099  // keep the comdat sections, as link time odr violations will be dectected on
2100  // the odr indicator symbols.
2101  bool UseComdatForGlobalsGC = UseOdrIndicator;
2102 
2103  SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size());
2104  for (size_t i = 0; i < ExtendedGlobals.size(); i++) {
2105  GlobalVariable *G = ExtendedGlobals[i];
2107  CreateMetadataGlobal(M, MetadataInitializers[i], G->getName());
2108  MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G));
2109  Metadata->setMetadata(LLVMContext::MD_associated, MD);
2110  MetadataGlobals[i] = Metadata;
2111 
2112  if (UseComdatForGlobalsGC)
2113  SetComdatForGlobalMetadata(G, Metadata, UniqueModuleId);
2114  }
2115 
2116  // Update llvm.compiler.used, adding the new metadata globals. This is
2117  // needed so that during LTO these variables stay alive.
2118  if (!MetadataGlobals.empty())
2119  appendToCompilerUsed(M, MetadataGlobals);
2120 
2121  // RegisteredFlag serves two purposes. First, we can pass it to dladdr()
2122  // to look up the loaded image that contains it. Second, we can store in it
2123  // whether registration has already occurred, to prevent duplicate
2124  // registration.
2125  //
2126  // Common linkage ensures that there is only one global per shared library.
2127  GlobalVariable *RegisteredFlag = new GlobalVariable(
2128  M, IntptrTy, false, GlobalVariable::CommonLinkage,
2131 
2132  // Create start and stop symbols.
2133  GlobalVariable *StartELFMetadata = new GlobalVariable(
2134  M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr,
2135  "__start_" + getGlobalMetadataSection());
2137  GlobalVariable *StopELFMetadata = new GlobalVariable(
2138  M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr,
2139  "__stop_" + getGlobalMetadataSection());
2141 
2142  // Create a call to register the globals with the runtime.
2143  IRB.CreateCall(AsanRegisterElfGlobals,
2144  {IRB.CreatePointerCast(RegisteredFlag, IntptrTy),
2145  IRB.CreatePointerCast(StartELFMetadata, IntptrTy),
2146  IRB.CreatePointerCast(StopELFMetadata, IntptrTy)});
2147 
2148  // We also need to unregister globals at the end, e.g., when a shared library
2149  // gets closed.
2150  if (DestructorKind != AsanDtorKind::None) {
2151  IRBuilder<> IrbDtor(CreateAsanModuleDtor(M));
2152  IrbDtor.CreateCall(AsanUnregisterElfGlobals,
2153  {IRB.CreatePointerCast(RegisteredFlag, IntptrTy),
2154  IRB.CreatePointerCast(StartELFMetadata, IntptrTy),
2155  IRB.CreatePointerCast(StopELFMetadata, IntptrTy)});
2156  }
2157 }
2158 
2159 void ModuleAddressSanitizer::InstrumentGlobalsMachO(
2160  IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
2161  ArrayRef<Constant *> MetadataInitializers) {
2162  assert(ExtendedGlobals.size() == MetadataInitializers.size());
2163 
2164  // On recent Mach-O platforms, use a structure which binds the liveness of
2165  // the global variable to the metadata struct. Keep the list of "Liveness" GV
2166  // created to be added to llvm.compiler.used
2167  StructType *LivenessTy = StructType::get(IntptrTy, IntptrTy);
2168  SmallVector<GlobalValue *, 16> LivenessGlobals(ExtendedGlobals.size());
2169 
2170  for (size_t i = 0; i < ExtendedGlobals.size(); i++) {
2171  Constant *Initializer = MetadataInitializers[i];
2172  GlobalVariable *G = ExtendedGlobals[i];
2174  CreateMetadataGlobal(M, Initializer, G->getName());
2175 
2176  // On recent Mach-O platforms, we emit the global metadata in a way that
2177  // allows the linker to properly strip dead globals.
2178  auto LivenessBinder =
2179  ConstantStruct::get(LivenessTy, Initializer->getAggregateElement(0u),
2181  GlobalVariable *Liveness = new GlobalVariable(
2182  M, LivenessTy, false, GlobalVariable::InternalLinkage, LivenessBinder,
2183  Twine("__asan_binder_") + G->getName());
2184  Liveness->setSection("__DATA,__asan_liveness,regular,live_support");
2185  LivenessGlobals[i] = Liveness;
2186  }
2187 
2188  // Update llvm.compiler.used, adding the new liveness globals. This is
2189  // needed so that during LTO these variables stay alive. The alternative
2190  // would be to have the linker handling the LTO symbols, but libLTO
2191  // current API does not expose access to the section for each symbol.
2192  if (!LivenessGlobals.empty())
2193  appendToCompilerUsed(M, LivenessGlobals);
2194 
2195  // RegisteredFlag serves two purposes. First, we can pass it to dladdr()
2196  // to look up the loaded image that contains it. Second, we can store in it
2197  // whether registration has already occurred, to prevent duplicate
2198  // registration.
2199  //
2200  // common linkage ensures that there is only one global per shared library.
2201  GlobalVariable *RegisteredFlag = new GlobalVariable(
2202  M, IntptrTy, false, GlobalVariable::CommonLinkage,
2205 
2206  IRB.CreateCall(AsanRegisterImageGlobals,
2207  {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)});
2208 
2209  // We also need to unregister globals at the end, e.g., when a shared library
2210  // gets closed.
2211  if (DestructorKind != AsanDtorKind::None) {
2212  IRBuilder<> IrbDtor(CreateAsanModuleDtor(M));
2213  IrbDtor.CreateCall(AsanUnregisterImageGlobals,
2214  {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)});
2215  }
2216 }
2217 
2218 void ModuleAddressSanitizer::InstrumentGlobalsWithMetadataArray(
2219  IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
2220  ArrayRef<Constant *> MetadataInitializers) {
2221  assert(ExtendedGlobals.size() == MetadataInitializers.size());
2222  unsigned N = ExtendedGlobals.size();
2223  assert(N > 0);
2224 
2225  // On platforms that don't have a custom metadata section, we emit an array
2226  // of global metadata structures.
2227  ArrayType *ArrayOfGlobalStructTy =
2228  ArrayType::get(MetadataInitializers[0]->getType(), N);
2229  auto AllGlobals = new GlobalVariable(
2230  M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage,
2231  ConstantArray::get(ArrayOfGlobalStructTy, MetadataInitializers), "");
2232  if (Mapping.Scale > 3)
2233  AllGlobals->setAlignment(Align(1ULL << Mapping.Scale));
2234 
2235  IRB.CreateCall(AsanRegisterGlobals,
2236  {IRB.CreatePointerCast(AllGlobals, IntptrTy),
2237  ConstantInt::get(IntptrTy, N)});
2238 
2239  // We also need to unregister globals at the end, e.g., when a shared library
2240  // gets closed.
2241  if (DestructorKind != AsanDtorKind::None) {
2242  IRBuilder<> IrbDtor(CreateAsanModuleDtor(M));
2243  IrbDtor.CreateCall(AsanUnregisterGlobals,
2244  {IRB.CreatePointerCast(AllGlobals, IntptrTy),
2245  ConstantInt::get(IntptrTy, N)});
2246  }
2247 }
2248 
2249 // This function replaces all global variables with new variables that have
2250 // trailing redzones. It also creates a function that poisons
2251 // redzones and inserts this function into llvm.global_ctors.
2252 // Sets *CtorComdat to true if the global registration code emitted into the
2253 // asan constructor is comdat-compatible.
2254 bool ModuleAddressSanitizer::InstrumentGlobals(IRBuilder<> &IRB, Module &M,
2255  bool *CtorComdat) {
2256  *CtorComdat = false;
2257 
2258  // Build set of globals that are aliased by some GA, where
2259  // getExcludedAliasedGlobal(GA) returns the relevant GlobalVariable.
2260  SmallPtrSet<const GlobalVariable *, 16> AliasedGlobalExclusions;
2261  if (CompileKernel) {
2262  for (auto &GA : M.aliases()) {
2263  if (const GlobalVariable *GV = getExcludedAliasedGlobal(GA))
2264  AliasedGlobalExclusions.insert(GV);
2265  }
2266  }
2267 
2268  SmallVector<GlobalVariable *, 16> GlobalsToChange;
2269  for (auto &G : M.globals()) {
2270  if (!AliasedGlobalExclusions.count(&G) && shouldInstrumentGlobal(&G))
2271  GlobalsToChange.push_back(&G);
2272  }
2273 
2274  size_t n = GlobalsToChange.size();
2275  if (n == 0) {
2276  *CtorComdat = true;
2277  return false;
2278  }
2279 
2280  auto &DL = M.getDataLayout();
2281 
2282  // A global is described by a structure
2283  // size_t beg;
2284  // size_t size;
2285  // size_t size_with_redzone;
2286  // const char *name;
2287  // const char *module_name;
2288  // size_t has_dynamic_init;
2289  // void *source_location;
2290  // size_t odr_indicator;
2291  // We initialize an array of such structures and pass it to a run-time call.
2292  StructType *GlobalStructTy =
2293  StructType::get(IntptrTy, IntptrTy, IntptrTy, IntptrTy, IntptrTy,
2294  IntptrTy, IntptrTy, IntptrTy);
2296  SmallVector<Constant *, 16> Initializers(n);
2297 
2298  bool HasDynamicallyInitializedGlobals = false;
2299 
2300  // We shouldn't merge same module names, as this string serves as unique
2301  // module ID in runtime.
2303  M, M.getModuleIdentifier(), /*AllowMerging*/ false, kAsanGenPrefix);
2304 
2305  for (size_t i = 0; i < n; i++) {
2306  GlobalVariable *G = GlobalsToChange[i];
2307 
2308  // FIXME: Metadata should be attched directly to the global directly instead
2309  // of being added to llvm.asan.globals.
2310  auto MD = GlobalsMD.get(G);
2311  StringRef NameForGlobal = G->getName();
2312  // Create string holding the global name (use global name from metadata
2313  // if it's available, otherwise just write the name of global variable).
2315  M, MD.Name.empty() ? NameForGlobal : MD.Name,
2316  /*AllowMerging*/ true, kAsanGenPrefix);
2317 
2318  Type *Ty = G->getValueType();
2319  const uint64_t SizeInBytes = DL.getTypeAllocSize(Ty);
2320  const uint64_t RightRedzoneSize = getRedzoneSizeForGlobal(SizeInBytes);
2321  Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize);
2322 
2323  StructType *NewTy = StructType::get(Ty, RightRedZoneTy);
2324  Constant *NewInitializer = ConstantStruct::get(
2325  NewTy, G->getInitializer(), Constant::getNullValue(RightRedZoneTy));
2326 
2327  // Create a new global variable with enough space for a redzone.
2328  GlobalValue::LinkageTypes Linkage = G->getLinkage();
2329  if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage)
2331  GlobalVariable *NewGlobal = new GlobalVariable(
2332  M, NewTy, G->isConstant(), Linkage, NewInitializer, "", G,
2333  G->getThreadLocalMode(), G->getAddressSpace());
2334  NewGlobal->copyAttributesFrom(G);
2335  NewGlobal->setComdat(G->getComdat());
2336  NewGlobal->setAlignment(MaybeAlign(getMinRedzoneSizeForGlobal()));
2337  // Don't fold globals with redzones. ODR violation detector and redzone
2338  // poisoning implicitly creates a dependence on the global's address, so it
2339  // is no longer valid for it to be marked unnamed_addr.
2341 
2342  // Move null-terminated C strings to "__asan_cstring" section on Darwin.
2343  if (TargetTriple.isOSBinFormatMachO() && !G->hasSection() &&
2344  G->isConstant()) {
2345  auto Seq = dyn_cast<ConstantDataSequential>(G->getInitializer());
2346  if (Seq && Seq->isCString())
2347  NewGlobal->setSection("__TEXT,__asan_cstring,regular");
2348  }
2349 
2350  // Transfer the debug info and type metadata. The payload starts at offset
2351  // zero so we can copy the metadata over as is.
2352  NewGlobal->copyMetadata(G, 0);
2353 
2354  Value *Indices2[2];
2355  Indices2[0] = IRB.getInt32(0);
2356  Indices2[1] = IRB.getInt32(0);
2357 
2358  G->replaceAllUsesWith(
2359  ConstantExpr::getGetElementPtr(NewTy, NewGlobal, Indices2, true));
2360  NewGlobal->takeName(G);
2361  G->eraseFromParent();
2362  NewGlobals[i] = NewGlobal;
2363 
2364  Constant *SourceLoc;
2365  if (!MD.SourceLoc.empty()) {
2366  auto SourceLocGlobal = createPrivateGlobalForSourceLoc(M, MD.SourceLoc);
2367  SourceLoc = ConstantExpr::getPointerCast(SourceLocGlobal, IntptrTy);
2368  } else {
2369  SourceLoc = ConstantInt::get(IntptrTy, 0);
2370  }
2371 
2372  Constant *ODRIndicator = ConstantExpr::getNullValue(IRB.getInt8PtrTy());
2373  GlobalValue *InstrumentedGlobal = NewGlobal;
2374 
2375  bool CanUsePrivateAliases =
2376  TargetTriple.isOSBinFormatELF() || TargetTriple.isOSBinFormatMachO() ||
2377  TargetTriple.isOSBinFormatWasm();
2378  if (CanUsePrivateAliases && UsePrivateAlias) {
2379  // Create local alias for NewGlobal to avoid crash on ODR between
2380  // instrumented and non-instrumented libraries.
2381  InstrumentedGlobal =
2383  }
2384 
2385  // ODR should not happen for local linkage.
2386  if (NewGlobal->hasLocalLinkage()) {
2387  ODRIndicator = ConstantExpr::getIntToPtr(ConstantInt::get(IntptrTy, -1),
2388  IRB.getInt8PtrTy());
2389  } else if (UseOdrIndicator) {
2390  // With local aliases, we need to provide another externally visible
2391  // symbol __odr_asan_XXX to detect ODR violation.
2392  auto *ODRIndicatorSym =
2393  new GlobalVariable(M, IRB.getInt8Ty(), false, Linkage,
2395  kODRGenPrefix + NameForGlobal, nullptr,
2396  NewGlobal->getThreadLocalMode());
2397 
2398  // Set meaningful attributes for indicator symbol.
2399  ODRIndicatorSym->setVisibility(NewGlobal->getVisibility());
2400  ODRIndicatorSym->setDLLStorageClass(NewGlobal->getDLLStorageClass());
2401  ODRIndicatorSym->setAlignment(Align(1));
2402  ODRIndicator = ODRIndicatorSym;
2403  }
2404 
2406  GlobalStructTy,
2407  ConstantExpr::getPointerCast(InstrumentedGlobal, IntptrTy),
2408  ConstantInt::get(IntptrTy, SizeInBytes),
2409  ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize),
2412  ConstantInt::get(IntptrTy, MD.IsDynInit), SourceLoc,
2413  ConstantExpr::getPointerCast(ODRIndicator, IntptrTy));
2414 
2415  if (ClInitializers && MD.IsDynInit) HasDynamicallyInitializedGlobals = true;
2416 
2417  LLVM_DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n");
2418 
2419  Initializers[i] = Initializer;
2420  }
2421 
2422  // Add instrumented globals to llvm.compiler.used list to avoid LTO from
2423  // ConstantMerge'ing them.
2424  SmallVector<GlobalValue *, 16> GlobalsToAddToUsedList;
2425  for (size_t i = 0; i < n; i++) {
2426  GlobalVariable *G = NewGlobals[i];
2427  if (G->getName().empty()) continue;
2428  GlobalsToAddToUsedList.push_back(G);
2429  }
2430  appendToCompilerUsed(M, ArrayRef<GlobalValue *>(GlobalsToAddToUsedList));
2431 
2432  std::string ELFUniqueModuleId =
2433  (UseGlobalsGC && TargetTriple.isOSBinFormatELF()) ? getUniqueModuleId(&M)
2434  : "";
2435 
2436  if (!ELFUniqueModuleId.empty()) {
2437  InstrumentGlobalsELF(IRB, M, NewGlobals, Initializers, ELFUniqueModuleId);
2438  *CtorComdat = true;
2439  } else if (UseGlobalsGC && TargetTriple.isOSBinFormatCOFF()) {
2440  InstrumentGlobalsCOFF(IRB, M, NewGlobals, Initializers);
2441  } else if (UseGlobalsGC && ShouldUseMachOGlobalsSection()) {
2442  InstrumentGlobalsMachO(IRB, M, NewGlobals, Initializers);
2443  } else {
2444  InstrumentGlobalsWithMetadataArray(IRB, M, NewGlobals, Initializers);
2445  }
2446 
2447  // Create calls for poisoning before initializers run and unpoisoning after.
2448  if (HasDynamicallyInitializedGlobals)
2449  createInitializerPoisonCalls(M, ModuleName);
2450 
2451  LLVM_DEBUG(dbgs() << M);
2452  return true;
2453 }
2454 
2455 uint64_t
2456 ModuleAddressSanitizer::getRedzoneSizeForGlobal(uint64_t SizeInBytes) const {
2457  constexpr uint64_t kMaxRZ = 1 << 18;
2458  const uint64_t MinRZ = getMinRedzoneSizeForGlobal();
2459 
2460  uint64_t RZ = 0;
2461  if (SizeInBytes <= MinRZ / 2) {
2462  // Reduce redzone size for small size objects, e.g. int, char[1]. MinRZ is
2463  // at least 32 bytes, optimize when SizeInBytes is less than or equal to
2464  // half of MinRZ.
2465  RZ = MinRZ - SizeInBytes;
2466  } else {
2467  // Calculate RZ, where MinRZ <= RZ <= MaxRZ, and RZ ~ 1/4 * SizeInBytes.
2468  RZ = std::max(MinRZ, std::min(kMaxRZ, (SizeInBytes / MinRZ / 4) * MinRZ));
2469 
2470  // Round up to multiple of MinRZ.
2471  if (SizeInBytes % MinRZ)
2472  RZ += MinRZ - (SizeInBytes % MinRZ);
2473  }
2474 
2475  assert((RZ + SizeInBytes) % MinRZ == 0);
2476 
2477  return RZ;
2478 }
2479 
2480 int ModuleAddressSanitizer::GetAsanVersion(const Module &M) const {
2481  int LongSize = M.getDataLayout().getPointerSizeInBits();
2482  bool isAndroid = Triple(M.getTargetTriple()).isAndroid();
2483  int Version = 8;
2484  // 32-bit Android is one version ahead because of the switch to dynamic
2485  // shadow.
2486  Version += (LongSize == 32 && isAndroid);
2487  return Version;
2488 }
2489 
2490 bool ModuleAddressSanitizer::instrumentModule(Module &M) {
2491  initializeCallbacks(M);
2492 
2493  // Create a module constructor. A destructor is created lazily because not all
2494  // platforms, and not all modules need it.
2495  if (CompileKernel) {
2496  // The kernel always builds with its own runtime, and therefore does not
2497  // need the init and version check calls.
2498  AsanCtorFunction = createSanitizerCtor(M, kAsanModuleCtorName);
2499  } else {
2500  std::string AsanVersion = std::to_string(GetAsanVersion(M));
2501  std::string VersionCheckName =
2502  ClInsertVersionCheck ? (kAsanVersionCheckNamePrefix + AsanVersion) : "";
2503  std::tie(AsanCtorFunction, std::ignore) =
2505  kAsanInitName, /*InitArgTypes=*/{},
2506  /*InitArgs=*/{}, VersionCheckName);
2507  }
2508 
2509  bool CtorComdat = true;
2510  if (ClGlobals) {
2511  IRBuilder<> IRB(AsanCtorFunction->getEntryBlock().getTerminator());
2512  InstrumentGlobals(IRB, M, &CtorComdat);
2513  }
2514 
2515  const uint64_t Priority = GetCtorAndDtorPriority(TargetTriple);
2516 
2517  // Put the constructor and destructor in comdat if both
2518  // (1) global instrumentation is not TU-specific
2519  // (2) target is ELF.
2520  if (UseCtorComdat && TargetTriple.isOSBinFormatELF() && CtorComdat) {
2521  AsanCtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleCtorName));
2522  appendToGlobalCtors(M, AsanCtorFunction, Priority, AsanCtorFunction);
2523  if (AsanDtorFunction) {
2524  AsanDtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleDtorName));
2525  appendToGlobalDtors(M, AsanDtorFunction, Priority, AsanDtorFunction);
2526  }
2527  } else {
2528  appendToGlobalCtors(M, AsanCtorFunction, Priority);
2529  if (AsanDtorFunction)
2530  appendToGlobalDtors(M, AsanDtorFunction, Priority);
2531  }
2532 
2533  return true;
2534 }
2535 
2536 void AddressSanitizer::initializeCallbacks(Module &M) {
2537  IRBuilder<> IRB(*C);
2538  // Create __asan_report* callbacks.
2539  // IsWrite, TypeSize and Exp are encoded in the function name.
2540  for (int Exp = 0; Exp < 2; Exp++) {
2541  for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) {
2542  const std::string TypeStr = AccessIsWrite ? "store" : "load";
2543  const std::string ExpStr = Exp ? "exp_" : "";
2544  const std::string EndingStr = Recover ? "_noabort" : "";
2545 
2546  SmallVector<Type *, 3> Args2 = {IntptrTy, IntptrTy};
2547  SmallVector<Type *, 2> Args1{1, IntptrTy};
2548  if (Exp) {
2549  Type *ExpType = Type::getInt32Ty(*C);
2550  Args2.push_back(ExpType);
2551  Args1.push_back(ExpType);
2552  }
2553  AsanErrorCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction(
2554  kAsanReportErrorTemplate + ExpStr + TypeStr + "_n" + EndingStr,
2555  FunctionType::get(IRB.getVoidTy(), Args2, false));
2556 
2557  AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction(
2558  ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr,
2559  FunctionType::get(IRB.getVoidTy(), Args2, false));
2560 
2561  for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes;
2562  AccessSizeIndex++) {
2563  const std::string Suffix = TypeStr + itostr(1ULL << AccessSizeIndex);
2564  AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] =
2565  M.getOrInsertFunction(
2566  kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr,
2567  FunctionType::get(IRB.getVoidTy(), Args1, false));
2568 
2569  AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] =
2570  M.getOrInsertFunction(
2571  ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr,
2572  FunctionType::get(IRB.getVoidTy(), Args1, false));
2573  }
2574  }
2575  }
2576 
2577  const std::string MemIntrinCallbackPrefix =
2578  (CompileKernel && !ClKasanMemIntrinCallbackPrefix)
2579  ? std::string("")
2581  AsanMemmove = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memmove",
2582  IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
2583  IRB.getInt8PtrTy(), IntptrTy);
2584  AsanMemcpy = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memcpy",
2585  IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
2586  IRB.getInt8PtrTy(), IntptrTy);
2587  AsanMemset = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memset",
2588  IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
2589  IRB.getInt32Ty(), IntptrTy);
2590 
2591  AsanHandleNoReturnFunc =
2592  M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy());
2593 
2594  AsanPtrCmpFunction =
2595  M.getOrInsertFunction(kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy);
2596  AsanPtrSubFunction =
2597  M.getOrInsertFunction(kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy);
2598  if (Mapping.InGlobal)
2599  AsanShadowGlobal = M.getOrInsertGlobal("__asan_shadow",
2600  ArrayType::get(IRB.getInt8Ty(), 0));
2601 
2602  AMDGPUAddressShared = M.getOrInsertFunction(
2604  AMDGPUAddressPrivate = M.getOrInsertFunction(
2606 }
2607 
2608 bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) {
2609  // For each NSObject descendant having a +load method, this method is invoked
2610  // by the ObjC runtime before any of the static constructors is called.
2611  // Therefore we need to instrument such methods with a call to __asan_init
2612  // at the beginning in order to initialize our runtime before any access to
2613  // the shadow memory.
2614  // We cannot just ignore these methods, because they may call other
2615  // instrumented functions.
2616  if (F.getName().find(" load]") != std::string::npos) {
2617  FunctionCallee AsanInitFunction =
2618  declareSanitizerInitFunction(*F.getParent(), kAsanInitName, {});
2619  IRBuilder<> IRB(&F.front(), F.front().begin());
2620  IRB.CreateCall(AsanInitFunction, {});
2621  return true;
2622  }
2623  return false;
2624 }
2625 
2626 bool AddressSanitizer::maybeInsertDynamicShadowAtFunctionEntry(Function &F) {
2627  // Generate code only when dynamic addressing is needed.
2628  if (Mapping.Offset != kDynamicShadowSentinel)
2629  return false;
2630 
2631  IRBuilder<> IRB(&F.front().front());
2632  if (Mapping.InGlobal) {
2634  // An empty inline asm with input reg == output reg.
2635  // An opaque pointer-to-int cast, basically.
2637  FunctionType::get(IntptrTy, {AsanShadowGlobal->getType()}, false),
2638  StringRef(""), StringRef("=r,0"),
2639  /*hasSideEffects=*/false);
2640  LocalDynamicShadow =
2641  IRB.CreateCall(Asm, {AsanShadowGlobal}, ".asan.shadow");
2642  } else {
2643  LocalDynamicShadow =
2644  IRB.CreatePointerCast(AsanShadowGlobal, IntptrTy, ".asan.shadow");
2645  }
2646  } else {
2647  Value *GlobalDynamicAddress = F.getParent()->getOrInsertGlobal(
2649  LocalDynamicShadow = IRB.CreateLoad(IntptrTy, GlobalDynamicAddress);
2650  }
2651  return true;
2652 }
2653 
2654 void AddressSanitizer::markEscapedLocalAllocas(Function &F) {
2655  // Find the one possible call to llvm.localescape and pre-mark allocas passed
2656  // to it as uninteresting. This assumes we haven't started processing allocas
2657  // yet. This check is done up front because iterating the use list in
2658  // isInterestingAlloca would be algorithmically slower.
2659  assert(ProcessedAllocas.empty() && "must process localescape before allocas");
2660 
2661  // Try to get the declaration of llvm.localescape. If it's not in the module,
2662  // we can exit early.
2663  if (!F.getParent()->getFunction("llvm.localescape")) return;
2664 
2665  // Look for a call to llvm.localescape call in the entry block. It can't be in
2666  // any other block.
2667  for (Instruction &I : F.getEntryBlock()) {
2668  IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I);
2669  if (II && II->getIntrinsicID() == Intrinsic::localescape) {
2670  // We found a call. Mark all the allocas passed in as uninteresting.
2671  for (Value *Arg : II->args()) {
2672  AllocaInst *AI = dyn_cast<AllocaInst>(Arg->stripPointerCasts());
2673  assert(AI && AI->isStaticAlloca() &&
2674  "non-static alloca arg to localescape");
2675  ProcessedAllocas[AI] = false;
2676  }
2677  break;
2678  }
2679  }
2680 }
2681 
2682 bool AddressSanitizer::suppressInstrumentationSiteForDebug(int &Instrumented) {
2683  bool ShouldInstrument =
2684  ClDebugMin < 0 || ClDebugMax < 0 ||
2685  (Instrumented >= ClDebugMin && Instrumented <= ClDebugMax);
2686  Instrumented++;
2687  return !ShouldInstrument;
2688 }
2689 
2690 bool AddressSanitizer::instrumentFunction(Function &F,
2691  const TargetLibraryInfo *TLI) {
2692  if (F.empty())
2693  return false;
2694  if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false;
2695  if (!ClDebugFunc.empty() && ClDebugFunc == F.getName()) return false;
2696  if (F.getName().startswith("__asan_")) return false;
2697 
2698  bool FunctionModified = false;
2699 
2700  // If needed, insert __asan_init before checking for SanitizeAddress attr.
2701  // This function needs to be called even if the function body is not
2702  // instrumented.
2703  if (maybeInsertAsanInitAtFunctionEntry(F))
2704  FunctionModified = true;
2705 
2706  // Leave if the function doesn't need instrumentation.
2707  if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return FunctionModified;
2708 
2709  if (F.hasFnAttribute(Attribute::DisableSanitizerInstrumentation))
2710  return FunctionModified;
2711 
2712  LLVM_DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n");
2713 
2714  initializeCallbacks(*F.getParent());
2715 
2716  FunctionStateRAII CleanupObj(this);
2717 
2718  FunctionModified |= maybeInsertDynamicShadowAtFunctionEntry(F);
2719 
2720  // We can't instrument allocas used with llvm.localescape. Only static allocas
2721  // can be passed to that intrinsic.
2722  markEscapedLocalAllocas(F);
2723 
2724  // We want to instrument every address only once per basic block (unless there
2725  // are calls between uses).
2726  SmallPtrSet<Value *, 16> TempsToInstrument;
2727  SmallVector<InterestingMemoryOperand, 16> OperandsToInstrument;
2728  SmallVector<MemIntrinsic *, 16> IntrinToInstrument;
2729  SmallVector<Instruction *, 8> NoReturnCalls;
2731  SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts;
2732 
2733  // Fill the set of memory operations to instrument.
2734  for (auto &BB : F) {
2735  AllBlocks.push_back(&BB);
2736  TempsToInstrument.clear();
2737  int NumInsnsPerBB = 0;
2738  for (auto &Inst : BB) {
2739  if (LooksLikeCodeInBug11395(&Inst)) return false;
2740  SmallVector<InterestingMemoryOperand, 1> InterestingOperands;
2741  getInterestingMemoryOperands(&Inst, InterestingOperands);
2742 
2743  if (!InterestingOperands.empty()) {
2744  for (auto &Operand : InterestingOperands) {
2745  if (ClOpt && ClOptSameTemp) {
2746  Value *Ptr = Operand.getPtr();
2747  // If we have a mask, skip instrumentation if we've already
2748  // instrumented the full object. But don't add to TempsToInstrument
2749  // because we might get another load/store with a different mask.
2750  if (Operand.MaybeMask) {
2751  if (TempsToInstrument.count(Ptr))
2752  continue; // We've seen this (whole) temp in the current BB.
2753  } else {
2754  if (!TempsToInstrument.insert(Ptr).second)
2755  continue; // We've seen this temp in the current BB.
2756  }
2757  }
2758  OperandsToInstrument.push_back(Operand);
2759  NumInsnsPerBB++;
2760  }
2761  } else if (((ClInvalidPointerPairs || ClInvalidPointerCmp) &&
2765  PointerComparisonsOrSubtracts.push_back(&Inst);
2766  } else if (MemIntrinsic *MI = dyn_cast<MemIntrinsic>(&Inst)) {
2767  // ok, take it.
2768  IntrinToInstrument.push_back(MI);
2769  NumInsnsPerBB++;
2770  } else {
2771  if (auto *CB = dyn_cast<CallBase>(&Inst)) {
2772  // A call inside BB.
2773  TempsToInstrument.clear();
2774  if (CB->doesNotReturn() &&
2775  !CB->hasMetadata(LLVMContext::MD_nosanitize))
2776  NoReturnCalls.push_back(CB);
2777  }
2778  if (CallInst *CI = dyn_cast<CallInst>(&Inst))
2780  }
2781  if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break;
2782  }
2783  }
2784 
2785  bool UseCalls = (ClInstrumentationWithCallsThreshold >= 0 &&
2786  OperandsToInstrument.size() + IntrinToInstrument.size() >
2788  const DataLayout &DL = F.getParent()->getDataLayout();
2789  ObjectSizeOpts ObjSizeOpts;
2790  ObjSizeOpts.RoundToAlign = true;
2791  ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), ObjSizeOpts);
2792 
2793  // Instrument.
2794  int NumInstrumented = 0;
2795  for (auto &Operand : OperandsToInstrument) {
2796  if (!suppressInstrumentationSiteForDebug(NumInstrumented))
2797  instrumentMop(ObjSizeVis, Operand, UseCalls,
2798  F.getParent()->getDataLayout());
2799  FunctionModified = true;
2800  }
2801  for (auto Inst : IntrinToInstrument) {
2802  if (!suppressInstrumentationSiteForDebug(NumInstrumented))
2803  instrumentMemIntrinsic(Inst);
2804  FunctionModified = true;
2805  }
2806 
2807  FunctionStackPoisoner FSP(F, *this);
2808  bool ChangedStack = FSP.runOnFunction();
2809 
2810  // We must unpoison the stack before NoReturn calls (throw, _exit, etc).
2811  // See e.g. https://github.com/google/sanitizers/issues/37
2812  for (auto CI : NoReturnCalls) {
2813  IRBuilder<> IRB(CI);
2814  IRB.CreateCall(AsanHandleNoReturnFunc, {});
2815  }
2816 
2817  for (auto Inst : PointerComparisonsOrSubtracts) {
2818  instrumentPointerComparisonOrSubtraction(Inst);
2819  FunctionModified = true;
2820  }
2821 
2822  if (ChangedStack || !NoReturnCalls.empty())
2823  FunctionModified = true;
2824 
2825  LLVM_DEBUG(dbgs() << "ASAN done instrumenting: " << FunctionModified << " "
2826  << F << "\n");
2827 
2828  return FunctionModified;
2829 }
2830 
2831 // Workaround for bug 11395: we don't want to instrument stack in functions
2832 // with large assembly blobs (32-bit only), otherwise reg alloc may crash.
2833 // FIXME: remove once the bug 11395 is fixed.
2834 bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) {
2835  if (LongSize != 32) return false;
2836  CallInst *CI = dyn_cast<CallInst>(I);
2837  if (!CI || !CI->isInlineAsm()) return false;
2838  if (CI->arg_size() <= 5)
2839  return false;
2840  // We have inline assembly with quite a few arguments.
2841  return true;
2842 }
2843 
2844 void FunctionStackPoisoner::initializeCallbacks(Module &M) {
2845  IRBuilder<> IRB(*C);
2846  if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always ||
2847  ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) {
2848  const char *MallocNameTemplate =
2849  ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always
2852  for (int Index = 0; Index <= kMaxAsanStackMallocSizeClass; Index++) {
2853  std::string Suffix = itostr(Index);
2854  AsanStackMallocFunc[Index] = M.getOrInsertFunction(
2855  MallocNameTemplate + Suffix, IntptrTy, IntptrTy);
2856  AsanStackFreeFunc[Index] =
2857  M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix,
2858  IRB.getVoidTy(), IntptrTy, IntptrTy);
2859  }
2860  }
2861  if (ASan.UseAfterScope) {
2862  AsanPoisonStackMemoryFunc = M.getOrInsertFunction(
2863  kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy);
2864  AsanUnpoisonStackMemoryFunc = M.getOrInsertFunction(
2865  kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy);
2866  }
2867 
2868  for (size_t Val : {0x00, 0xf1, 0xf2, 0xf3, 0xf5, 0xf8}) {
2869  std::ostringstream Name;
2871  Name << std::setw(2) << std::setfill('0') << std::hex << Val;
2872  AsanSetShadowFunc[Val] =
2873  M.getOrInsertFunction(Name.str(), IRB.getVoidTy(), IntptrTy, IntptrTy);
2874  }
2875 
2876  AsanAllocaPoisonFunc = M.getOrInsertFunction(
2877  kAsanAllocaPoison, IRB.getVoidTy(), IntptrTy, IntptrTy);
2878  AsanAllocasUnpoisonFunc = M.getOrInsertFunction(
2879  kAsanAllocasUnpoison, IRB.getVoidTy(), IntptrTy, IntptrTy);
2880 }
2881 
2882 void FunctionStackPoisoner::copyToShadowInline(ArrayRef<uint8_t> ShadowMask,
2883  ArrayRef<uint8_t> ShadowBytes,
2884  size_t Begin, size_t End,
2885  IRBuilder<> &IRB,
2886  Value *ShadowBase) {
2887  if (Begin >= End)
2888  return;
2889 
2890  const size_t LargestStoreSizeInBytes =
2891  std::min<size_t>(sizeof(uint64_t), ASan.LongSize / 8);
2892 
2893  const bool IsLittleEndian = F.getParent()->getDataLayout().isLittleEndian();
2894 
2895  // Poison given range in shadow using larges store size with out leading and
2896  // trailing zeros in ShadowMask. Zeros never change, so they need neither
2897  // poisoning nor up-poisoning. Still we don't mind if some of them get into a
2898  // middle of a store.
2899  for (size_t i = Begin; i < End;) {
2900  if (!ShadowMask[i]) {
2901  assert(!ShadowBytes[i]);
2902  ++i;
2903  continue;
2904  }
2905 
2906  size_t StoreSizeInBytes = LargestStoreSizeInBytes;
2907  // Fit store size into the range.
2908  while (StoreSizeInBytes > End - i)
2909  StoreSizeInBytes /= 2;
2910 
2911  // Minimize store size by trimming trailing zeros.
2912  for (size_t j = StoreSizeInBytes - 1; j && !ShadowMask[i + j]; --j) {
2913  while (j <= StoreSizeInBytes / 2)
2914  StoreSizeInBytes /= 2;
2915  }
2916 
2917  uint64_t Val = 0;
2918  for (size_t j = 0; j < StoreSizeInBytes; j++) {
2919  if (IsLittleEndian)
2920  Val |= (uint64_t)ShadowBytes[i + j] << (8 * j);
2921  else
2922  Val = (Val << 8) | ShadowBytes[i + j];
2923  }
2924 
2925  Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i));
2926  Value *Poison = IRB.getIntN(StoreSizeInBytes * 8, Val);
2927  IRB.CreateAlignedStore(
2928  Poison, IRB.CreateIntToPtr(Ptr, Poison->getType()->getPointerTo()),
2929  Align(1));
2930 
2931  i += StoreSizeInBytes;
2932  }
2933 }
2934 
2935 void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask,
2936  ArrayRef<uint8_t> ShadowBytes,
2937  IRBuilder<> &IRB, Value *ShadowBase) {
2938  copyToShadow(ShadowMask, ShadowBytes, 0, ShadowMask.size(), IRB, ShadowBase);
2939 }
2940 
2941 void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask,
2942  ArrayRef<uint8_t> ShadowBytes,
2943  size_t Begin, size_t End,
2944  IRBuilder<> &IRB, Value *ShadowBase) {
2945  assert(ShadowMask.size() == ShadowBytes.size());
2946  size_t Done = Begin;
2947  for (size_t i = Begin, j = Begin + 1; i < End; i = j++) {
2948  if (!ShadowMask[i]) {
2949  assert(!ShadowBytes[i]);
2950  continue;
2951  }
2952  uint8_t Val = ShadowBytes[i];
2953  if (!AsanSetShadowFunc[Val])
2954  continue;
2955 
2956  // Skip same values.
2957  for (; j < End && ShadowMask[j] && Val == ShadowBytes[j]; ++j) {
2958  }
2959 
2960  if (j - i >= ClMaxInlinePoisoningSize) {
2961  copyToShadowInline(ShadowMask, ShadowBytes, Done, i, IRB, ShadowBase);
2962  IRB.CreateCall(AsanSetShadowFunc[Val],
2963  {IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)),
2964  ConstantInt::get(IntptrTy, j - i)});
2965  Done = j;
2966  }
2967  }
2968 
2969  copyToShadowInline(ShadowMask, ShadowBytes, Done, End, IRB, ShadowBase);
2970 }
2971 
2972 // Fake stack allocator (asan_fake_stack.h) has 11 size classes
2973 // for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass
2974 static int StackMallocSizeClass(uint64_t LocalStackSize) {
2975  assert(LocalStackSize <= kMaxStackMallocSize);
2976  uint64_t MaxSize = kMinStackMallocSize;
2977  for (int i = 0;; i++, MaxSize *= 2)
2978  if (LocalStackSize <= MaxSize) return i;
2979  llvm_unreachable("impossible LocalStackSize");
2980 }
2981 
2982 void FunctionStackPoisoner::copyArgsPassedByValToAllocas() {
2983  Instruction *CopyInsertPoint = &F.front().front();
2984  if (CopyInsertPoint == ASan.LocalDynamicShadow) {
2985  // Insert after the dynamic shadow location is determined
2986  CopyInsertPoint = CopyInsertPoint->getNextNode();
2987  assert(CopyInsertPoint);
2988  }
2989  IRBuilder<> IRB(CopyInsertPoint);
2990  const DataLayout &DL = F.getParent()->getDataLayout();
2991  for (Argument &Arg : F.args()) {
2992  if (Arg.hasByValAttr()) {
2993  Type *Ty = Arg.getParamByValType();
2994  const Align Alignment =
2995  DL.getValueOrABITypeAlignment(Arg.getParamAlign(), Ty);
2996 
2997  AllocaInst *AI = IRB.CreateAlloca(
2998  Ty, nullptr,
2999  (Arg.hasName() ? Arg.getName() : "Arg" + Twine(Arg.getArgNo())) +
3000  ".byval");
3001  AI->setAlignment(Alignment);
3002  Arg.replaceAllUsesWith(AI);
3003 
3004  uint64_t AllocSize = DL.getTypeAllocSize(Ty);
3005  IRB.CreateMemCpy(AI, Alignment, &Arg, Alignment, AllocSize);
3006  }
3007  }
3008 }
3009 
3010 PHINode *FunctionStackPoisoner::createPHI(IRBuilder<> &IRB, Value *Cond,
3011  Value *ValueIfTrue,
3012  Instruction *ThenTerm,
3013  Value *ValueIfFalse) {
3014  PHINode *PHI = IRB.CreatePHI(IntptrTy, 2);
3015  BasicBlock *CondBlock = cast<Instruction>(Cond)->getParent();
3016  PHI->addIncoming(ValueIfFalse, CondBlock);
3017  BasicBlock *ThenBlock = ThenTerm->getParent();
3018  PHI->addIncoming(ValueIfTrue, ThenBlock);
3019  return PHI;
3020 }
3021 
3022 Value *FunctionStackPoisoner::createAllocaForLayout(
3023  IRBuilder<> &IRB, const ASanStackFrameLayout &L, bool Dynamic) {
3024  AllocaInst *Alloca;
3025  if (Dynamic) {
3026  Alloca = IRB.CreateAlloca(IRB.getInt8Ty(),
3028  "MyAlloca");
3029  } else {
3030  Alloca = IRB.CreateAlloca(ArrayType::get(IRB.getInt8Ty(), L.FrameSize),
3031  nullptr, "MyAlloca");
3032  assert(Alloca->isStaticAlloca());
3033  }
3034  assert((ClRealignStack & (ClRealignStack - 1)) == 0);
3035  uint64_t FrameAlignment = std::max(L.FrameAlignment, uint64_t(ClRealignStack));
3036  Alloca->setAlignment(Align(FrameAlignment));
3037  return IRB.CreatePointerCast(Alloca, IntptrTy);
3038 }
3039 
3040 void FunctionStackPoisoner::createDynamicAllocasInitStorage() {
3041  BasicBlock &FirstBB = *F.begin();
3042  IRBuilder<> IRB(dyn_cast<Instruction>(FirstBB.begin()));
3043  DynamicAllocaLayout = IRB.CreateAlloca(IntptrTy, nullptr);
3044  IRB.CreateStore(Constant::getNullValue(IntptrTy), DynamicAllocaLayout);
3045  DynamicAllocaLayout->setAlignment(Align(32));
3046 }
3047 
3048 void FunctionStackPoisoner::processDynamicAllocas() {
3049  if (!ClInstrumentDynamicAllocas || DynamicAllocaVec.empty()) {
3050  assert(DynamicAllocaPoisonCallVec.empty());
3051  return;
3052  }
3053 
3054  // Insert poison calls for lifetime intrinsics for dynamic allocas.
3055  for (const auto &APC : DynamicAllocaPoisonCallVec) {
3056  assert(APC.InsBefore);
3057  assert(APC.AI);
3058  assert(ASan.isInterestingAlloca(*APC.AI));
3059  assert(!APC.AI->isStaticAlloca());
3060 
3061  IRBuilder<> IRB(APC.InsBefore);
3062  poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison);
3063  // Dynamic allocas will be unpoisoned unconditionally below in
3064  // unpoisonDynamicAllocas.
3065  // Flag that we need unpoison static allocas.
3066  }
3067 
3068  // Handle dynamic allocas.
3069  createDynamicAllocasInitStorage();
3070  for (auto &AI : DynamicAllocaVec)
3071  handleDynamicAllocaCall(AI);
3072  unpoisonDynamicAllocas();
3073 }
3074 
3075 /// Collect instructions in the entry block after \p InsBefore which initialize
3076 /// permanent storage for a function argument. These instructions must remain in
3077 /// the entry block so that uninitialized values do not appear in backtraces. An
3078 /// added benefit is that this conserves spill slots. This does not move stores
3079 /// before instrumented / "interesting" allocas.
3081  AddressSanitizer &ASan, Instruction &InsBefore,
3082  SmallVectorImpl<Instruction *> &InitInsts) {
3083  Instruction *Start = InsBefore.getNextNonDebugInstruction();
3084  for (Instruction *It = Start; It; It = It->getNextNonDebugInstruction()) {
3085  // Argument initialization looks like:
3086  // 1) store <Argument>, <Alloca> OR
3087  // 2) <CastArgument> = cast <Argument> to ...
3088  // store <CastArgument> to <Alloca>
3089  // Do not consider any other kind of instruction.
3090  //
3091  // Note: This covers all known cases, but may not be exhaustive. An
3092  // alternative to pattern-matching stores is to DFS over all Argument uses:
3093  // this might be more general, but is probably much more complicated.
3094  if (isa<AllocaInst>(It) || isa<CastInst>(It))
3095  continue;
3096  if (auto *Store = dyn_cast<StoreInst>(It)) {
3097  // The store destination must be an alloca that isn't interesting for
3098  // ASan to instrument. These are moved up before InsBefore, and they're
3099  // not interesting because allocas for arguments can be mem2reg'd.
3100  auto *Alloca = dyn_cast<AllocaInst>(Store->getPointerOperand());
3101  if (!Alloca || ASan.isInterestingAlloca(*Alloca))
3102  continue;
3103 
3104  Value *Val = Store->getValueOperand();
3105  bool IsDirectArgInit = isa<Argument>(Val);
3106  bool IsArgInitViaCast =
3107  isa<CastInst>(Val) &&
3108  isa<Argument>(cast<CastInst>(Val)->getOperand(0)) &&
3109  // Check that the cast appears directly before the store. Otherwise
3110  // moving the cast before InsBefore may break the IR.
3111  Val == It->getPrevNonDebugInstruction();
3112  bool IsArgInit = IsDirectArgInit || IsArgInitViaCast;
3113  if (!IsArgInit)
3114  continue;
3115 
3116  if (IsArgInitViaCast)
3117  InitInsts.push_back(cast<Instruction>(Val));
3118  InitInsts.push_back(Store);
3119  continue;
3120  }
3121 
3122  // Do not reorder past unknown instructions: argument initialization should
3123  // only involve casts and stores.
3124  return;
3125  }
3126 }
3127 
3128 void FunctionStackPoisoner::processStaticAllocas() {
3129  if (AllocaVec.empty()) {
3130  assert(StaticAllocaPoisonCallVec.empty());
3131  return;
3132  }
3133 
3134  int StackMallocIdx = -1;
3135  DebugLoc EntryDebugLocation;
3136  if (auto SP = F.getSubprogram())
3137  EntryDebugLocation =
3138  DILocation::get(SP->getContext(), SP->getScopeLine(), 0, SP);
3139 
3140  Instruction *InsBefore = AllocaVec[0];
3141  IRBuilder<> IRB(InsBefore);
3142 
3143  // Make sure non-instrumented allocas stay in the entry block. Otherwise,
3144  // debug info is broken, because only entry-block allocas are treated as
3145  // regular stack slots.
3146  auto InsBeforeB = InsBefore->getParent();
3147  assert(InsBeforeB == &F.getEntryBlock());
3148  for (auto *AI : StaticAllocasToMoveUp)
3149  if (AI->getParent() == InsBeforeB)
3150  AI->moveBefore(InsBefore);
3151 
3152  // Move stores of arguments into entry-block allocas as well. This prevents
3153  // extra stack slots from being generated (to house the argument values until
3154  // they can be stored into the allocas). This also prevents uninitialized
3155  // values from being shown in backtraces.
3156  SmallVector<Instruction *, 8> ArgInitInsts;
3157  findStoresToUninstrumentedArgAllocas(ASan, *InsBefore, ArgInitInsts);
3158  for (Instruction *ArgInitInst : ArgInitInsts)
3159  ArgInitInst->moveBefore(InsBefore);
3160 
3161  // If we have a call to llvm.localescape, keep it in the entry block.
3162  if (LocalEscapeCall) LocalEscapeCall->moveBefore(InsBefore);
3163 
3165  SVD.reserve(AllocaVec.size());
3166  for (AllocaInst *AI : AllocaVec) {
3168  ASan.getAllocaSizeInBytes(*AI),
3169  0,
3170  AI->getAlignment(),
3171  AI,
3172  0,
3173  0};
3174  SVD.push_back(D);
3175  }
3176 
3177  // Minimal header size (left redzone) is 4 pointers,
3178  // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms.
3179  uint64_t Granularity = 1ULL << Mapping.Scale;
3180  uint64_t MinHeaderSize = std::max((uint64_t)ASan.LongSize / 2, Granularity);
3181  const ASanStackFrameLayout &L =
3182  ComputeASanStackFrameLayout(SVD, Granularity, MinHeaderSize);
3183 
3184  // Build AllocaToSVDMap for ASanStackVariableDescription lookup.
3186  for (auto &Desc : SVD)
3187  AllocaToSVDMap[Desc.AI] = &Desc;
3188 
3189  // Update SVD with information from lifetime intrinsics.
3190  for (const auto &APC : StaticAllocaPoisonCallVec) {
3191  assert(APC.InsBefore);
3192  assert(APC.AI);
3193  assert(ASan.isInterestingAlloca(*APC.AI));
3194  assert(APC.AI->isStaticAlloca());
3195 
3196  ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI];
3197  Desc.LifetimeSize = Desc.Size;
3198  if (const DILocation *FnLoc = EntryDebugLocation.get()) {
3199  if (const DILocation *LifetimeLoc = APC.InsBefore->getDebugLoc().get()) {
3200  if (LifetimeLoc->getFile() == FnLoc->getFile())
3201  if (unsigned Line = LifetimeLoc->getLine())
3202  Desc.Line = std::min(Desc.Line ? Desc.Line : Line, Line);
3203  }
3204  }
3205  }
3206 
3207  auto DescriptionString = ComputeASanStackFrameDescription(SVD);
3208  LLVM_DEBUG(dbgs() << DescriptionString << " --- " << L.FrameSize << "\n");
3209  uint64_t LocalStackSize = L.FrameSize;
3210  bool DoStackMalloc =
3211  ASan.UseAfterReturn != AsanDetectStackUseAfterReturnMode::Never &&
3212  !ASan.CompileKernel && LocalStackSize <= kMaxStackMallocSize;
3213  bool DoDynamicAlloca = ClDynamicAllocaStack;
3214  // Don't do dynamic alloca or stack malloc if:
3215  // 1) There is inline asm: too often it makes assumptions on which registers
3216  // are available.
3217  // 2) There is a returns_twice call (typically setjmp), which is
3218  // optimization-hostile, and doesn't play well with introduced indirect
3219  // register-relative calculation of local variable addresses.
3220  DoDynamicAlloca &= !HasInlineAsm && !HasReturnsTwiceCall;
3221  DoStackMalloc &= !HasInlineAsm && !HasReturnsTwiceCall;
3222 
3223  Value *StaticAlloca =
3224  DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false);
3225 
3226  Value *FakeStack;
3227  Value *LocalStackBase;
3228  Value *LocalStackBaseAlloca;
3229  uint8_t DIExprFlags = DIExpression::ApplyOffset;
3230 
3231  if (DoStackMalloc) {
3232  LocalStackBaseAlloca =
3233  IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base");
3234  if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) {
3235  // void *FakeStack = __asan_option_detect_stack_use_after_return
3236  // ? __asan_stack_malloc_N(LocalStackSize)
3237  // : nullptr;
3238  // void *LocalStackBase = (FakeStack) ? FakeStack :
3239  // alloca(LocalStackSize);
3240  Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal(
3242  Value *UseAfterReturnIsEnabled = IRB.CreateICmpNE(
3243  IRB.CreateLoad(IRB.getInt32Ty(), OptionDetectUseAfterReturn),
3245  Instruction *Term =
3246  SplitBlockAndInsertIfThen(UseAfterReturnIsEnabled, InsBefore, false);
3247  IRBuilder<> IRBIf(Term);
3248  StackMallocIdx = StackMallocSizeClass(LocalStackSize);
3249  assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass);
3250  Value *FakeStackValue =
3251  IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx],
3252  ConstantInt::get(IntptrTy, LocalStackSize));
3253  IRB.SetInsertPoint(InsBefore);
3254  FakeStack = createPHI(IRB, UseAfterReturnIsEnabled, FakeStackValue, Term,
3255  ConstantInt::get(IntptrTy, 0));
3256  } else {
3257  // assert(ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode:Always)
3258  // void *FakeStack = __asan_stack_malloc_N(LocalStackSize);
3259  // void *LocalStackBase = (FakeStack) ? FakeStack :
3260  // alloca(LocalStackSize);
3261  StackMallocIdx = StackMallocSizeClass(LocalStackSize);
3262  FakeStack = IRB.CreateCall(AsanStackMallocFunc[StackMallocIdx],
3263  ConstantInt::get(IntptrTy, LocalStackSize));
3264  }
3265  Value *NoFakeStack =
3266  IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy));
3267  Instruction *Term =
3268  SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false);
3269  IRBuilder<> IRBIf(Term);
3270  Value *AllocaValue =
3271  DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca;
3272 
3273  IRB.SetInsertPoint(InsBefore);
3274  LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
3275  IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca);
3276  DIExprFlags |= DIExpression::DerefBefore;
3277  } else {
3278  // void *FakeStack = nullptr;
3279  // void *LocalStackBase = alloca(LocalStackSize);
3280  FakeStack = ConstantInt::get(IntptrTy, 0);
3281  LocalStackBase =
3282  DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca;
3283  LocalStackBaseAlloca = LocalStackBase;
3284  }
3285 
3286  // It shouldn't matter whether we pass an `alloca` or a `ptrtoint` as the
3287  // dbg.declare address opereand, but passing a `ptrtoint` seems to confuse
3288  // later passes and can result in dropped variable coverage in debug info.
3289  Value *LocalStackBaseAllocaPtr =
3290  isa<PtrToIntInst>(LocalStackBaseAlloca)
3291  ? cast<PtrToIntInst>(LocalStackBaseAlloca)->getPointerOperand()
3292  : LocalStackBaseAlloca;
3293  assert(isa<AllocaInst>(LocalStackBaseAllocaPtr) &&
3294  "Variable descriptions relative to ASan stack base will be dropped");
3295 
3296  // Replace Alloca instructions with base+offset.
3297  for (const auto &Desc : SVD) {
3298  AllocaInst *AI = Desc.AI;
3299  replaceDbgDeclare(AI, LocalStackBaseAllocaPtr, DIB, DIExprFlags,
3300  Desc.Offset);
3301  Value *NewAllocaPtr = IRB.CreateIntToPtr(
3302  IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)),
3303  AI->getType());
3304  AI->replaceAllUsesWith(NewAllocaPtr);
3305  }
3306 
3307  // The left-most redzone has enough space for at least 4 pointers.
3308  // Write the Magic value to redzone[0].
3309  Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy);
3311  BasePlus0);
3312  // Write the frame description constant to redzone[1].
3313  Value *BasePlus1 = IRB.CreateIntToPtr(
3314  IRB.CreateAdd(LocalStackBase,
3315  ConstantInt::get(IntptrTy, ASan.LongSize / 8)),
3316  IntptrPtrTy);
3317  GlobalVariable *StackDescriptionGlobal =
3318  createPrivateGlobalForString(*F.getParent(), DescriptionString,
3319  /*AllowMerging*/ true, kAsanGenPrefix);
3320  Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy);
3321  IRB.CreateStore(Description, BasePlus1);
3322  // Write the PC to redzone[2].
3323  Value *BasePlus2 = IRB.CreateIntToPtr(
3324  IRB.CreateAdd(LocalStackBase,
3325  ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)),
3326  IntptrPtrTy);
3327  IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2);
3328 
3329  const auto &ShadowAfterScope = GetShadowBytesAfterScope(SVD, L);
3330 
3331  // Poison the stack red zones at the entry.
3332  Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB);
3333  // As mask we must use most poisoned case: red zones and after scope.
3334  // As bytes we can use either the same or just red zones only.
3335  copyToShadow(ShadowAfterScope, ShadowAfterScope, IRB, ShadowBase);
3336 
3337  if (!StaticAllocaPoisonCallVec.empty()) {
3338  const auto &ShadowInScope = GetShadowBytes(SVD, L);
3339 
3340  // Poison static allocas near lifetime intrinsics.
3341  for (const auto &APC : StaticAllocaPoisonCallVec) {
3342  const ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI];
3343  assert(Desc.Offset % L.Granularity == 0);
3344  size_t Begin = Desc.Offset / L.Granularity;
3345  size_t End = Begin + (APC.Size + L.Granularity - 1) / L.Granularity;
3346 
3347  IRBuilder<> IRB(APC.InsBefore);
3348  copyToShadow(ShadowAfterScope,
3349  APC.DoPoison ? ShadowAfterScope : ShadowInScope, Begin, End,
3350  IRB, ShadowBase);
3351  }
3352  }
3353 
3354  SmallVector<uint8_t, 64> ShadowClean(ShadowAfterScope.size(), 0);
3355  SmallVector<uint8_t, 64> ShadowAfterReturn;
3356 
3357  // (Un)poison the stack before all ret instructions.
3358  for (Instruction *Ret : RetVec) {
3359  IRBuilder<> IRBRet(Ret);
3360  // Mark the current frame as retired.
3361  IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic),
3362  BasePlus0);
3363  if (DoStackMalloc) {
3364  assert(StackMallocIdx >= 0);
3365  // if FakeStack != 0 // LocalStackBase == FakeStack
3366  // // In use-after-return mode, poison the whole stack frame.
3367  // if StackMallocIdx <= 4
3368  // // For small sizes inline the whole thing:
3369  // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize);
3370  // **SavedFlagPtr(FakeStack) = 0
3371  // else
3372  // __asan_stack_free_N(FakeStack, LocalStackSize)
3373  // else
3374  // <This is not a fake stack; unpoison the redzones>
3375  Value *Cmp =
3376  IRBRet.CreateICmpNE(FakeStack, Constant::getNullValue(IntptrTy));
3377  Instruction *ThenTerm, *ElseTerm;
3378  SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm);
3379 
3380  IRBuilder<> IRBPoison(ThenTerm);
3381  if (StackMallocIdx <= 4) {
3382  int ClassSize = kMinStackMallocSize << StackMallocIdx;
3383  ShadowAfterReturn.resize(ClassSize / L.Granularity,
3385  copyToShadow(ShadowAfterReturn, ShadowAfterReturn, IRBPoison,
3386  ShadowBase);
3387  Value *SavedFlagPtrPtr = IRBPoison.CreateAdd(
3388  FakeStack,
3389  ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8));
3390  Value *SavedFlagPtr = IRBPoison.CreateLoad(
3391  IntptrTy, IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy));
3392  IRBPoison.CreateStore(
3393  Constant::getNullValue(IRBPoison.getInt8Ty()),
3394  IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy()));
3395  } else {
3396  // For larger frames call __asan_stack_free_*.
3397  IRBPoison.CreateCall(
3398  AsanStackFreeFunc[StackMallocIdx],
3399  {FakeStack, ConstantInt::get(IntptrTy, LocalStackSize)});
3400  }
3401 
3402  IRBuilder<> IRBElse(ElseTerm);
3403  copyToShadow(ShadowAfterScope, ShadowClean, IRBElse, ShadowBase);
3404  } else {
3405  copyToShadow(ShadowAfterScope, ShadowClean, IRBRet, ShadowBase);
3406  }
3407  }
3408 
3409  // We are done. Remove the old unused alloca instructions.
3410  for (auto AI : AllocaVec) AI->eraseFromParent();
3411 }
3412 
3413 void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size,
3414  IRBuilder<> &IRB, bool DoPoison) {
3415  // For now just insert the call to ASan runtime.
3416  Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy);
3417  Value *SizeArg = ConstantInt::get(IntptrTy, Size);
3418  IRB.CreateCall(
3419  DoPoison ? AsanPoisonStackMemoryFunc : AsanUnpoisonStackMemoryFunc,
3420  {AddrArg, SizeArg});
3421 }
3422 
3423 // Handling llvm.lifetime intrinsics for a given %alloca:
3424 // (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca.
3425 // (2) if %size is constant, poison memory for llvm.lifetime.end (to detect
3426 // invalid accesses) and unpoison it for llvm.lifetime.start (the memory
3427 // could be poisoned by previous llvm.lifetime.end instruction, as the
3428 // variable may go in and out of scope several times, e.g. in loops).
3429 // (3) if we poisoned at least one %alloca in a function,
3430 // unpoison the whole stack frame at function exit.
3431 void FunctionStackPoisoner::handleDynamicAllocaCall(AllocaInst *AI) {
3432  IRBuilder<> IRB(AI);
3433 
3435  const uint64_t AllocaRedzoneMask = kAllocaRzSize - 1;
3436 
3437  Value *Zero = Constant::getNullValue(IntptrTy);
3438  Value *AllocaRzSize = ConstantInt::get(IntptrTy, kAllocaRzSize);
3439  Value *AllocaRzMask = ConstantInt::get(IntptrTy, AllocaRedzoneMask);
3440 
3441  // Since we need to extend alloca with additional memory to locate
3442  // redzones, and OldSize is number of allocated blocks with
3443  // ElementSize size, get allocated memory size in bytes by
3444  // OldSize * ElementSize.
3445  const unsigned ElementSize =
3446  F.getParent()->getDataLayout().getTypeAllocSize(AI->getAllocatedType());
3447  Value *OldSize =
3448  IRB.CreateMul(IRB.CreateIntCast(AI->getArraySize(), IntptrTy, false),
3449  ConstantInt::get(IntptrTy, ElementSize));
3450 
3451  // PartialSize = OldSize % 32
3452  Value *PartialSize = IRB.CreateAnd(OldSize, AllocaRzMask);
3453 
3454  // Misalign = kAllocaRzSize - PartialSize;
3455  Value *Misalign = IRB.CreateSub(AllocaRzSize, PartialSize);
3456 
3457  // PartialPadding = Misalign != kAllocaRzSize ? Misalign : 0;
3458  Value *Cond = IRB.CreateICmpNE(Misalign, AllocaRzSize);
3459  Value *PartialPadding = IRB.CreateSelect(Cond, Misalign, Zero);
3460 
3461  // AdditionalChunkSize = Alignment + PartialPadding + kAllocaRzSize
3462  // Alignment is added to locate left redzone, PartialPadding for possible
3463  // partial redzone and kAllocaRzSize for right redzone respectively.
3464  Value *AdditionalChunkSize = IRB.CreateAdd(
3465  ConstantInt::get(IntptrTy, Alignment + kAllocaRzSize), PartialPadding);
3466 
3467  Value *NewSize = IRB.CreateAdd(OldSize, AdditionalChunkSize);
3468 
3469  // Insert new alloca with new NewSize and Alignment params.
3470  AllocaInst *NewAlloca = IRB.CreateAlloca(IRB.getInt8Ty(), NewSize);
3471  NewAlloca->setAlignment(Align(Alignment));
3472 
3473  // NewAddress = Address + Alignment
3474  Value *NewAddress = IRB.CreateAdd(IRB.CreatePtrToInt(NewAlloca, IntptrTy),
3475  ConstantInt::get(IntptrTy, Alignment));
3476 
3477  // Insert __asan_alloca_poison call for new created alloca.
3478  IRB.CreateCall(AsanAllocaPoisonFunc, {NewAddress, OldSize});
3479 
3480  // Store the last alloca's address to DynamicAllocaLayout. We'll need this
3481  // for unpoisoning stuff.
3482  IRB.CreateStore(IRB.CreatePtrToInt(NewAlloca, IntptrTy), DynamicAllocaLayout);
3483 
3484  Value *NewAddressPtr = IRB.CreateIntToPtr(NewAddress, AI->getType());
3485 
3486  // Replace all uses of AddessReturnedByAlloca with NewAddressPtr.
3487  AI->replaceAllUsesWith(NewAddressPtr);
3488 
3489  // We are done. Erase old alloca from parent.
3490  AI->eraseFromParent();
3491 }
3492 
3493 // isSafeAccess returns true if Addr is always inbounds with respect to its
3494 // base object. For example, it is a field access or an array access with
3495 // constant inbounds index.
3496 bool AddressSanitizer::isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis,
3497  Value *Addr, uint64_t TypeSize) const {
3498  SizeOffsetType SizeOffset = ObjSizeVis.compute(Addr);
3499  if (!ObjSizeVis.bothKnown(SizeOffset)) return false;
3500  uint64_t Size = SizeOffset.first.getZExtValue();
3501  int64_t Offset = SizeOffset.second.getSExtValue();
3502  // Three checks are required to ensure safety:
3503  // . Offset >= 0 (since the offset is given from the base ptr)
3504  // . Size >= Offset (unsigned)
3505  // . Size - Offset >= NeededSize (unsigned)
3506  return Offset >= 0 && Size >= uint64_t(Offset) &&
3507  Size - uint64_t(Offset) >= TypeSize / 8;
3508 }
llvm::Check::Size
@ Size
Definition: FileCheck.h:77
llvm::MachO::S_CSTRING_LITERALS
@ S_CSTRING_LITERALS
S_CSTRING_LITERALS - Section with literal C strings.
Definition: MachO.h:129
llvm::Triple::DXContainer
@ DXContainer
Definition: Triple.h:273
i
i
Definition: README.txt:29
AddressSanitizer.h
llvm::PreservedAnalyses
A set of analyses that are preserved following a run of a transformation pass.
Definition: PassManager.h:152
Instrumentation.h
llvm::Triple::riscv64
@ riscv64
Definition: Triple.h:76
llvm::SizeOffsetType
std::pair< APInt, APInt > SizeOffsetType
Definition: MemoryBuiltins.h:181
Int32Ty
IntegerType * Int32Ty
Definition: NVVMIntrRange.cpp:67
kRetiredStackFrameMagic
static const uintptr_t kRetiredStackFrameMagic
Definition: AddressSanitizer.cpp:123
llvm::Triple::Wasm
@ Wasm
Definition: Triple.h:278
ClInvalidPointerCmp
static cl::opt< bool > ClInvalidPointerCmp("asan-detect-invalid-pointer-cmp", cl::desc("Instrument <, <=, >, >= with pointer operands"), cl::Hidden, cl::init(false))
llvm::Argument
This class represents an incoming formal argument to a Function.
Definition: Argument.h:28
StackSafetyAnalysis.h
llvm::IRBuilderBase::CreateIntCast
Value * CreateIntCast(Value *V, Type *DestTy, bool isSigned, const Twine &Name="")
Definition: IRBuilder.h:2021
llvm::StringRef::startswith
LLVM_NODISCARD bool startswith(StringRef Prefix) const
Check if this string starts with the given Prefix.
Definition: StringRef.h:286
llvm::Type::isSized
bool isSized(SmallPtrSetImpl< Type * > *Visited=nullptr) const
Return true if it makes sense to take the size of this type.
Definition: Type.h:264
llvm::createPrivateGlobalForString
GlobalVariable * createPrivateGlobalForString(Module &M, StringRef Str, bool AllowMerging, const char *NamePrefix="")
Definition: Instrumentation.cpp:60
llvm::IRBuilderBase::getInt32Ty
IntegerType * getInt32Ty()
Fetch the type representing a 32-bit integer.
Definition: IRBuilder.h:501
llvm::IRBuilderBase::CreateStore
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1662
llvm::IRBuilderBase::CreateICmpSGE
Value * CreateICmpSGE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2094
MI
IRTranslator LLVM IR MI
Definition: IRTranslator.cpp:104
MathExtras.h
kDefaultShadowOffset64
static const uint64_t kDefaultShadowOffset64
Definition: AddressSanitizer.cpp:95
llvm::IRBuilderBase::SetInsertPoint
void SetInsertPoint(BasicBlock *TheBB)
This specifies that created instructions should be appended to the end of the specified block.
Definition: IRBuilder.h:179
llvm::GlobalObject::setComdat
void setComdat(Comdat *C)
Definition: Globals.cpp:190
llvm
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:17
ClMemoryAccessCallbackPrefix
static cl::opt< std::string > ClMemoryAccessCallbackPrefix("asan-memory-access-callback-prefix", cl::desc("Prefix for memory access callbacks"), cl::Hidden, cl::init("__asan_"))
ClDebugMin
static cl::opt< int > ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), cl::Hidden, cl::init(-1))
M
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
Definition: README.txt:252
llvm::Instruction::getModule
const Module * getModule() const
Return the module owning the function this instruction belongs to or nullptr it the function does not...
Definition: Instruction.cpp:65
Pass
print lazy value Lazy Value Info Printer Pass
Definition: LazyValueInfo.cpp:1978
llvm::IRBuilderBase::getInt64Ty
IntegerType * getInt64Ty()
Fetch the type representing a 64-bit integer.
Definition: IRBuilder.h:506
Comdat.h
ClWithComdat
static cl::opt< bool > ClWithComdat("asan-with-comdat", cl::desc("Place ASan constructors in comdat sections"), cl::Hidden, cl::init(true))
llvm::NamedMDNode
A tuple of MDNodes.
Definition: Metadata.h:1488
llvm::ReturnInst
Return a value (possibly void), from a function.
Definition: Instructions.h:3017
ClInvalidPointerPairs
static cl::opt< bool > ClInvalidPointerPairs("asan-detect-invalid-pointer-pair", cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, cl::init(false))
llvm::IRBuilderBase::CreateAlignedStore
StoreInst * CreateAlignedStore(Value *Val, Value *Ptr, MaybeAlign Align, bool isVolatile=false)
Definition: IRBuilder.h:1685
llvm::GlobalsMetadata::Entry
Definition: AddressSanitizer.h:43
llvm::StructType::get
static StructType * get(LLVMContext &Context, ArrayRef< Type * > Elements, bool isPacked=false)
This static method is the primary way to create a literal StructType.
Definition: Type.cpp:406
llvm::Triple::isMIPS32
bool isMIPS32() const
Tests whether the target is MIPS 32-bit (little and big endian).
Definition: Triple.h:832
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:113
llvm::Intrinsic::getDeclaration
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=None)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1410
Metadata.h
llvm::User::operands
op_range operands()
Definition: User.h:242
llvm::Comdat::ExactMatch
@ ExactMatch
The data referenced by the COMDAT must be the same.
Definition: Comdat.h:37
llvm::ConstantInt::getType
IntegerType * getType() const
getType - Specialize the getType() method to always return an IntegerType, which reduces the amount o...
Definition: Constants.h:173
llvm::Triple::isPS4
bool isPS4() const
Tests whether the target is the PS4 platform.
Definition: Triple.h:684
llvm::CallBase::doesNotReturn
bool doesNotReturn() const
Determine if the call cannot return.
Definition: InstrTypes.h:1892
kAsanOptionDetectUseAfterReturn
const char kAsanOptionDetectUseAfterReturn[]
Definition: AddressSanitizer.cpp:161
llvm::BasicBlock::getParent
const Function * getParent() const
Return the enclosing method, or null if none.
Definition: BasicBlock.h:104
IntrinsicInst.h
llvm::Type::isPointerTy
bool isPointerTy() const
True if this is an instance of PointerType.
Definition: Type.h:218
kDefaultShadowScale
static const uint64_t kDefaultShadowScale
Definition: AddressSanitizer.cpp:93
llvm::DIBuilder
Definition: DIBuilder.h:41
llvm::AnalysisManager::getResult
PassT::Result & getResult(IRUnitT &IR, ExtraArgTs... ExtraArgs)
Get the result of an analysis pass for a given IR unit.
Definition: PassManager.h:780
DebugInfoMetadata.h
isUnsupportedAMDGPUAddrspace
static bool isUnsupportedAMDGPUAddrspace(Value *Addr)
Definition: AddressSanitizer.cpp:1236
llvm::GlobalVariable::copyAttributesFrom
void copyAttributesFrom(const GlobalVariable *Src)
copyAttributesFrom - copy all additional attributes (those not needed to create a GlobalVariable) fro...
Definition: Globals.cpp:455
llvm::Function::getBasicBlockList
const BasicBlockListType & getBasicBlockList() const
Get the underlying elements of the Function...
Definition: Function.h:702
llvm::PassInfoMixin< ModuleAddressSanitizerPass >
llvm::Instruction::getNextNonDebugInstruction
const Instruction * getNextNonDebugInstruction(bool SkipPseudoOp=false) const
Return a pointer to the next non-debug instruction in the same basic block as 'this',...
Definition: Instruction.cpp:740
llvm::GlobalValue::dropLLVMManglingEscape
static StringRef dropLLVMManglingEscape(StringRef Name)
If the given string begins with the GlobalValue name mangling escape character '\1',...
Definition: GlobalValue.h:487
llvm::GlobalValue::HiddenVisibility
@ HiddenVisibility
The GV is hidden.
Definition: GlobalValue.h:64
kAsanStackMallocAlwaysNameTemplate
const char kAsanStackMallocAlwaysNameTemplate[]
Definition: AddressSanitizer.cpp:147
llvm::Function
Definition: Function.h:60
llvm::IRBuilderBase::CreatePtrToInt
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1942
kNumberOfAccessSizes
static const size_t kNumberOfAccessSizes
Definition: AddressSanitizer.cpp:174
StringRef.h
llvm::ConstantStruct::get
static Constant * get(StructType *T, ArrayRef< Constant * > V)
Definition: Constants.cpp:1347
ClEnableKasan
static cl::opt< bool > ClEnableKasan("asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"), cl::Hidden, cl::init(false))
kAsanCtorAndDtorPriority
static const uint64_t kAsanCtorAndDtorPriority
Definition: AddressSanitizer.cpp:127
llvm::ASanGlobalsMetadataAnalysis::run
Result run(Module &, ModuleAnalysisManager &)
Definition: AddressSanitizer.cpp:1153
llvm::IntrinsicInst::getIntrinsicID
Intrinsic::ID getIntrinsicID() const
Return the intrinsic ID of this intrinsic.
Definition: IntrinsicInst.h:53
llvm::kAsanStackUseAfterReturnMagic
static const int kAsanStackUseAfterReturnMagic
Definition: ASanStackFrameLayout.h:26
kNetBSDKasan_ShadowOffset64
static const uint64_t kNetBSDKasan_ShadowOffset64
Definition: AddressSanitizer.cpp:112
llvm::PointerType::get
static PointerType * get(Type *ElementType, unsigned AddressSpace)
This constructs a pointer to an object of the specified type in a numbered address space.
Definition: Type.cpp:727
llvm::Type::getScalarType
Type * getScalarType() const
If this is a vector type, return the element type, otherwise return 'this'.
Definition: Type.h:309
llvm::GetShadowBytesAfterScope
SmallVector< uint8_t, 64 > GetShadowBytesAfterScope(const SmallVectorImpl< ASanStackVariableDescription > &Vars, const ASanStackFrameLayout &Layout)
Definition: ASanStackFrameLayout.cpp:133
llvm::Comdat::NoDeduplicate
@ NoDeduplicate
No deduplication is performed.
Definition: Comdat.h:39
llvm::AllocaInst::getType
PointerType * getType() const
Overload to return most specific pointer type.
Definition: Instructions.h:100
kMinStackMallocSize
static const size_t kMinStackMallocSize
Definition: AddressSanitizer.cpp:120
llvm::ilist_node_with_parent::getNextNode
NodeTy * getNextNode()
Get the next node, or nullptr for the list tail.
Definition: ilist_node.h:289
ClMaxInsnsToInstrumentPerBB
static cl::opt< int > ClMaxInsnsToInstrumentPerBB("asan-max-ins-per-bb", cl::init(10000), cl::desc("maximal number of instructions to instrument in any given BB"), cl::Hidden)
llvm::SmallVector
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1185
Statistic.h
TypeSizeToSizeIndex
static size_t TypeSizeToSizeIndex(uint32_t TypeSize)
Definition: AddressSanitizer.cpp:1195
InlineAsm.h
llvm::CallBase::isInlineAsm
bool isInlineAsm() const
Check if this call is an inline asm statement.
Definition: InstrTypes.h:1464
llvm::InstVisitor::visitIntrinsicInst
RetTy visitIntrinsicInst(IntrinsicInst &I)
Definition: InstVisitor.h:220
llvm::GetShadowBytes
SmallVector< uint8_t, 64 > GetShadowBytes(const SmallVectorImpl< ASanStackVariableDescription > &Vars, const ASanStackFrameLayout &Layout)
Definition: ASanStackFrameLayout.cpp:115
llvm::createSanitizerCtor
Function * createSanitizerCtor(Module &M, StringRef CtorName)
Creates sanitizer constructor function.
Definition: ModuleUtils.cpp:123
ErrorHandling.h
llvm::GlobalValue::UnnamedAddr::None
@ None
ClDebugStack
static cl::opt< int > ClDebugStack("asan-debug-stack", cl::desc("debug stack"), cl::Hidden, cl::init(0))
llvm::Type::getPointerAddressSpace
unsigned getPointerAddressSpace() const
Get the address space of this pointer or pointer vector type.
Definition: DerivedTypes.h:729
llvm::IRBuilder<>
llvm::GlobalVariable
Definition: GlobalVariable.h:39
kNetBSD_ShadowOffset32
static const uint64_t kNetBSD_ShadowOffset32
Definition: AddressSanitizer.cpp:110
kMIPS64_ShadowOffset64
static const uint64_t kMIPS64_ShadowOffset64
Definition: AddressSanitizer.cpp:104
llvm::FunctionType::get
static FunctionType * get(Type *Result, ArrayRef< Type * > Params, bool isVarArg)
This static method is the primary way of constructing a FunctionType.
Definition: Type.cpp:361
llvm::GlobalAlias
Definition: GlobalAlias.h:28
ValueTracking.h
Local.h
kAsanRegisterElfGlobalsName
const char kAsanRegisterElfGlobalsName[]
Definition: AddressSanitizer.cpp:136
isInterestingPointerSubtraction
static bool isInterestingPointerSubtraction(Instruction *I)
Definition: AddressSanitizer.cpp:1413
llvm::InstVisitor::visitCallBase
RetTy visitCallBase(CallBase &I)
Definition: InstVisitor.h:268
llvm::IRBuilderBase::CreateOr
Value * CreateOr(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1372
ClRedzoneByvalArgs
static cl::opt< bool > ClRedzoneByvalArgs("asan-redzone-byval-args", cl::desc("Create redzones for byval " "arguments (extra copy " "required)"), cl::Hidden, cl::init(true))
llvm::Triple
Triple - Helper class for working with autoconf configuration names.
Definition: Triple.h:44
llvm::InterestingMemoryOperand
Definition: AddressSanitizerCommon.h:25
FAM
FunctionAnalysisManager FAM
Definition: PassBuilderBindings.cpp:59
ClForceExperiment
static cl::opt< uint32_t > ClForceExperiment("asan-force-experiment", cl::desc("Force optimization experiment (for testing)"), cl::Hidden, cl::init(0))
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:139
kAMDGPUAddressSharedName
const char kAMDGPUAddressSharedName[]
Definition: AddressSanitizer.cpp:170
ClDynamicAllocaStack
static cl::opt< bool > ClDynamicAllocaStack("asan-stack-dynamic-alloca", cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, cl::init(true))
kDynamicShadowSentinel
static const uint64_t kDynamicShadowSentinel
Definition: AddressSanitizer.cpp:96
llvm::Triple::isDriverKit
bool isDriverKit() const
Is this an Apple DriverKit triple.
Definition: Triple.h:503
llvm::DILocation
Debug location.
Definition: DebugInfoMetadata.h:1551
llvm::PreservedAnalyses::none
static PreservedAnalyses none()
Convenience factory function for the empty preserved set.
Definition: PassManager.h:155
ClInstrumentReads
static cl::opt< bool > ClInstrumentReads("asan-instrument-reads", cl::desc("instrument read instructions"), cl::Hidden, cl::init(true))
llvm::AsanDetectStackUseAfterReturnMode::Runtime
@ Runtime
Detect stack use after return if not disabled runtime with (ASAN_OPTIONS=detect_stack_use_after_retur...
llvm::Type
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
DenseMap.h
GetCtorAndDtorPriority
static uint64_t GetCtorAndDtorPriority(Triple &TargetTriple)
Definition: AddressSanitizer.cpp:614
Module.h
llvm::Triple::x86_64
@ x86_64
Definition: Triple.h:86
MemoryBuiltins.h
ClDebugMax
static cl::opt< int > ClDebugMax("asan-debug-max", cl::desc("Debug max inst"), cl::Hidden, cl::init(-1))
createPrivateGlobalForSourceLoc
static GlobalVariable * createPrivateGlobalForSourceLoc(Module &M, LocationMetadata MD)
Create a global describing a source location.
Definition: AddressSanitizer.cpp:1202
isInterestingPointerComparison
static bool isInterestingPointerComparison(Instruction *I)
Definition: AddressSanitizer.cpp:1399
llvm::ASanStackVariableDescription::AI
AllocaInst * AI
Definition: ASanStackFrameLayout.h:37
llvm::Triple::SPIRV
@ SPIRV
Definition: Triple.h:277
llvm::GlobalValue::UnnamedAddr::Global
@ Global
ClOptGlobals
static cl::opt< bool > ClOptGlobals("asan-opt-globals", cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true))
llvm::MemIntrinsic
This is the common base class for memset/memcpy/memmove.
Definition: IntrinsicInst.h:962
ClRealignStack
static cl::opt< unsigned > ClRealignStack("asan-realign-stack", cl::desc("Realign stack to the value of this flag (power of two)"), cl::Hidden, cl::init(32))
Vector
So we should use XX3Form_Rcr to implement intrinsic Convert DP outs ins xscvdpsp No builtin are required Round &Convert QP DP(dword[1] is set to zero) No builtin are required Round to Quad Precision because you need to assign rounding mode in instruction Provide builtin(set f128:$vT,(int_ppc_vsx_xsrqpi f128:$vB))(set f128 yields< n x< ty > >< result > yields< ty >< result > No builtin are required Load Store Vector
Definition: README_P9.txt:497
kAsanAllocaPoison
const char kAsanAllocaPoison[]
Definition: AddressSanitizer.cpp:167
llvm::IRBuilderBase::getIntN
ConstantInt * getIntN(unsigned N, uint64_t C)
Get a constant N-bit value, zero extended or truncated from a 64-bit value.
Definition: IRBuilder.h:472
llvm::Triple::XCOFF
@ XCOFF
Definition: Triple.h:279
llvm::SmallPtrSet
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
Definition: SmallPtrSet.h:450
llvm::Triple::isOSLinux
bool isOSLinux() const
Tests whether the OS is Linux.
Definition: Triple.h:619
llvm::ObjectSizeOpts::RoundToAlign
bool RoundToAlign
Whether to round the result up to the alignment of allocas, byval arguments, and global variables.
Definition: MemoryBuiltins.h:151
llvm::Comdat::Largest
@ Largest
The linker will choose the largest COMDAT.
Definition: Comdat.h:38
kIsWriteMask
constexpr size_t kIsWriteMask
Definition: AddressSanitizer.cpp:184
llvm::Triple::isAMDGPU
bool isAMDGPU() const
Definition: Triple.h:746
llvm::ValueAsMetadata::get
static ValueAsMetadata * get(Value *V)
Definition: Metadata.cpp:394
llvm::MipsISD::Ret
@ Ret
Definition: MipsISelLowering.h:119
kAsanPoisonStackMemoryName
const char kAsanPoisonStackMemoryName[]
Definition: AddressSanitizer.cpp:154
llvm::ASanStackFrameLayout::Granularity
uint64_t Granularity
Definition: ASanStackFrameLayout.h:45
llvm::GlobalValue::setUnnamedAddr
void setUnnamedAddr(UnnamedAddr Val)
Definition: GlobalValue.h:211
llvm::GlobalValue::LinkageTypes
LinkageTypes
An enumeration for the kinds of linkage for global values.
Definition: GlobalValue.h:47
llvm::ArrayType
Class to represent array types.
Definition: DerivedTypes.h:357
llvm::isPowerOf2_32
constexpr bool isPowerOf2_32(uint32_t Value)
Return true if the argument is a power of two > 0.
Definition: MathExtras.h:491
llvm::GlobalsMetadata::Entry::IsExcluded
bool IsExcluded
Definition: AddressSanitizer.h:47
llvm::Triple::isOSEmscripten
bool isOSEmscripten() const
Tests whether the OS is Emscripten.
Definition: Triple.h:639
ASanStackFrameLayout.h
kPPC64_ShadowOffset64
static const uint64_t kPPC64_ShadowOffset64
Definition: AddressSanitizer.cpp:101
llvm::IRBuilderBase::CreateAlloca
AllocaInst * CreateAlloca(Type *Ty, unsigned AddrSpace, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:1632
Use.h
llvm::Type::getInt32Ty
static IntegerType * getInt32Ty(LLVMContext &C)
Definition: Type.cpp:239
llvm::IRBuilderBase::CreateIntToPtr
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1947
LLVM_DEBUG
#define LLVM_DEBUG(X)
Definition: Debug.h:101
DepthFirstIterator.h
llvm::MDNode::get
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1300
F
#define F(x, y, z)
Definition: MD5.cpp:55
kAsanAllocasUnpoison
const char kAsanAllocasUnpoison[]
Definition: AddressSanitizer.cpp:168
llvm::ConstantExpr::getPointerCast
static Constant * getPointerCast(Constant *C, Type *Ty)
Create a BitCast, AddrSpaceCast, or a PtrToInt cast constant expression.
Definition: Constants.cpp:2070
llvm::BasicBlock
LLVM Basic Block Representation.
Definition: BasicBlock.h:55
llvm::MDNode::getNumOperands
unsigned getNumOperands() const
Return number of MDNode operands.
Definition: Metadata.h:1210
llvm::Value::isSwiftError
bool isSwiftError() const
Return true if this value is a swifterror value.
Definition: Value.cpp:1012
llvm::appendToGlobalDtors
void appendToGlobalDtors(Module &M, Function *F, int Priority, Constant *Data=nullptr)
Same as appendToGlobalCtors(), but for global dtors.
Definition: ModuleUtils.cpp:69
llvm::dbgs
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
llvm::ASanStackVariableDescription::Size
uint64_t Size
Definition: ASanStackFrameLayout.h:33
llvm::ARMBuildAttrs::Section
@ Section
Legacy Tags.
Definition: ARMBuildAttributes.h:82
Arg
amdgpu Simplify well known AMD library false FunctionCallee Value * Arg
Definition: AMDGPULibCalls.cpp:186
llvm::Triple::isMacOSX
bool isMacOSX() const
Is this a Mac OS X triple.
Definition: Triple.h:475
llvm::BitmaskEnumDetail::Mask
constexpr std::underlying_type_t< E > Mask()
Get a bitmask with 1s in all places up to the high-order bit of E's largest value.
Definition: BitmaskEnum.h:80
Instruction.h
kNetBSD_ShadowOffset64
static const uint64_t kNetBSD_ShadowOffset64
Definition: AddressSanitizer.cpp:111
CommandLine.h
llvm::LocationMetadata::Filename
StringRef Filename
Definition: AddressSanitizer.h:30
llvm::ConstantInt
This is the shared class of boolean and integer constants.
Definition: Constants.h:79
llvm::AllocaInst::isStaticAlloca
bool isStaticAlloca() const
Return true if this alloca is in the entry block of the function and is a constant size.
Definition: Instructions.cpp:1419
llvm::Intrinsic::getType
FunctionType * getType(LLVMContext &Context, ID id, ArrayRef< Type * > Tys=None)
Return the function type for an intrinsic.
Definition: Function.cpp:1366
kAsanUnregisterElfGlobalsName
const char kAsanUnregisterElfGlobalsName[]
Definition: AddressSanitizer.cpp:137
llvm::all_of
bool all_of(R &&range, UnaryPredicate P)
Provide wrappers to std::all_of which take ranges instead of having to pass begin/end explicitly.
Definition: STLExtras.h:1607
ClOverrideDestructorKind
static cl::opt< AsanDtorKind > ClOverrideDestructorKind("asan-destructor-kind", cl::desc("Sets the ASan destructor kind. The default is to use the value " "provided to the pass constructor"), cl::values(clEnumValN(AsanDtorKind::None, "none", "No destructors"), clEnumValN(AsanDtorKind::Global, "global", "Use global destructors")), cl::init(AsanDtorKind::Invalid), cl::Hidden)
llvm::ObjectSizeOffsetVisitor::bothKnown
static bool bothKnown(const SizeOffsetType &SizeOffset)
Definition: MemoryBuiltins.h:214
llvm::Triple::isAndroid
bool isAndroid() const
Tests whether the target is Android.
Definition: Triple.h:701
llvm::IRBuilderBase::CreateMul
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1234
ClForceDynamicShadow
static cl::opt< bool > ClForceDynamicShadow("asan-force-dynamic-shadow", cl::desc("Load shadow address into a local variable for each function"), cl::Hidden, cl::init(false))
llvm::ModuleAddressSanitizerPass::printPipeline
void printPipeline(raw_ostream &OS, function_ref< StringRef(StringRef)> MapClassName2PassName)
Definition: AddressSanitizer.cpp:1158
GlobalValue.h
kAsanHandleNoReturnName
const char kAsanHandleNoReturnName[]
Definition: AddressSanitizer.cpp:144
Constants.h
kAsanStackFreeNameTemplate
const char kAsanStackFreeNameTemplate[]
Definition: AddressSanitizer.cpp:149
llvm::AllocaInst::getAllocatedType
Type * getAllocatedType() const
Return the type that is being allocated by the instruction.
Definition: Instructions.h:114
E
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
llvm::GlobalObject::setSection
void setSection(StringRef S)
Change the section for this global.
Definition: Globals.cpp:225
llvm::IRBuilderBase::CreateGEP
Value * CreateGEP(Type *Ty, Value *Ptr, ArrayRef< Value * > IdxList, const Twine &Name="", bool IsInBounds=false)
Definition: IRBuilder.h:1725
llvm::DIExpression::ApplyOffset
@ ApplyOffset
Definition: DebugInfoMetadata.h:2753
Intrinsics.h
C
(vector float) vec_cmpeq(*A, *B) C
Definition: README_ALTIVEC.txt:86
isPointerOperand
static bool isPointerOperand(Value *V)
Definition: AddressSanitizer.cpp:1392
llvm::ConstantExpr::getIntToPtr
static Constant * getIntToPtr(Constant *C, Type *Ty, bool OnlyIfReduced=false)
Definition: Constants.cpp:2244
llvm::GlobalValue::getThreadLocalMode
ThreadLocalMode getThreadLocalMode() const
Definition: GlobalValue.h:251
Twine.h
ClInstrumentationWithCallsThreshold
static cl::opt< int > ClInstrumentationWithCallsThreshold("asan-instrumentation-with-call-threshold", cl::desc("If the function being instrumented contains more than " "this number of memory accesses, use callbacks instead of " "inline checks (-1 means never use callbacks)."), cl::Hidden, cl::init(7000))
InstrTypes.h
doInstrumentAddress
static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I, Instruction *InsertBefore, Value *Addr, MaybeAlign Alignment, unsigned Granularity, uint32_t TypeSize, bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp)
Definition: AddressSanitizer.cpp:1446
llvm::IRBuilderBase::CreateLoad
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1649
llvm::BasicBlock::begin
iterator begin()
Instruction iterator methods.
Definition: BasicBlock.h:297
MAM
ModuleAnalysisManager MAM
Definition: PassBuilderBindings.cpp:61
llvm::AsanDtorKind::None
@ None
Do not emit any destructors for ASan.
llvm::MDBuilder::createBranchWeights
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
llvm::MCSectionMachO::ParseSectionSpecifier
static Error ParseSectionSpecifier(StringRef Spec, StringRef &Segment, StringRef &Section, unsigned &TAA, bool &TAAParsed, unsigned &StubSize)
Parse the section specifier indicated by "Spec".
Definition: MCSectionMachO.cpp:184
MCSectionMachO.h
llvm::CallInst::Create
static CallInst * Create(FunctionType *Ty, Value *F, const Twine &NameStr="", Instruction *InsertBefore=nullptr)
Definition: Instructions.h:1517
Param
Value * Param
Definition: NVPTXLowerArgs.cpp:164
llvm::ReplaceInstWithInst
void ReplaceInstWithInst(BasicBlock::InstListType &BIL, BasicBlock::iterator &BI, Instruction *I)
Replace the instruction specified by BI with the instruction specified by I.
Definition: BasicBlockUtils.cpp:477
TargetLibraryInfo.h
AddressSanitizerCommon.h
llvm::Comdat::Any
@ Any
The linker may choose any COMDAT.
Definition: Comdat.h:36
llvm::BasicBlock::getFirstInsertionPt
const_iterator getFirstInsertionPt() const
Returns an iterator to the first instruction in this block that is suitable for inserting a non-PHI i...
Definition: BasicBlock.cpp:246
false
Definition: StackSlotColoring.cpp:141
llvm::dwarf::Index
Index
Definition: Dwarf.h:472
llvm::MaybeAlign
This struct is a compact representation of a valid (power of two) or undefined (0) alignment.
Definition: Alignment.h:109
llvm::Triple::ppc64
@ ppc64
Definition: Triple.h:71
llvm::ConstantArray
ConstantArray - Constant Array Declarations.
Definition: Constants.h:409
ClInsertVersionCheck
static cl::opt< bool > ClInsertVersionCheck("asan-guard-against-version-mismatch", cl::desc("Guard against compiler/runtime version mismatch."), cl::Hidden, cl::init(true))
llvm::AsanDetectStackUseAfterReturnMode::Always
@ Always
Always detect stack use after return.
llvm::Instruction
Definition: Instruction.h:42
MDBuilder.h
llvm::AllocaInst::getArraySize
const Value * getArraySize() const
Get the number of elements allocated.
Definition: Instructions.h:96
llvm::IRBuilderBase::getInt8Ty
IntegerType * getInt8Ty()
Fetch the type representing an 8-bit integer.
Definition: IRBuilder.h:491
llvm::appendToCompilerUsed
void appendToCompilerUsed(Module &M, ArrayRef< GlobalValue * > Values)
Adds global values to the llvm.compiler.used list.
Definition: ModuleUtils.cpp:109
llvm::report_fatal_error
void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:143
Options
const char LLVMTargetMachineRef LLVMPassBuilderOptionsRef Options
Definition: PassBuilderBindings.cpp:48
llvm::STATISTIC
STATISTIC(NumFunctions, "Total number of functions")
GlobalWasGeneratedByCompiler
static bool GlobalWasGeneratedByCompiler(GlobalVariable *G)
Check if G has been created by a trusted compiler pass.
Definition: AddressSanitizer.cpp:1218
llvm::raw_ostream
This class implements an extremely fast bulk output stream that can only output to a stream.
Definition: raw_ostream.h:54
LoopDeletionResult::Modified
@ Modified
kAsanVersionCheckNamePrefix
const char kAsanVersionCheckNamePrefix[]
Definition: AddressSanitizer.cpp:141
llvm::SmallVectorImpl::resize
void resize(size_type N)
Definition: SmallVector.h:619
llvm::codeview::EncodedFramePtrReg::BasePtr
@ BasePtr
llvm::Comdat::SameSize
@ SameSize
The data referenced by the COMDAT must be the same size.
Definition: Comdat.h:40
llvm::ConstantInt::get
static Constant * get(Type *Ty, uint64_t V, bool IsSigned=false)
If Ty is a vector type, return a Constant with a splat of the given value.
Definition: Constants.cpp:919
kAsanRegisterImageGlobalsName
const char kAsanRegisterImageGlobalsName[]
Definition: AddressSanitizer.cpp:133
llvm::getUnderlyingObject
const Value * getUnderlyingObject(const Value *V, unsigned MaxLookup=6)
This method strips off any GEP address adjustments and pointer casts from the specified value,...
Definition: ValueTracking.cpp:4362
ClMaxInlinePoisoningSize
static cl::opt< uint32_t > ClMaxInlinePoisoningSize("asan-max-inline-poisoning-size", cl::desc("Inline shadow poisoning for blocks up to the given size in bytes."), cl::Hidden, cl::init(64))
DebugLoc.h
SmallPtrSet.h
llvm::Instruction::getSuccessor
BasicBlock * getSuccessor(unsigned Idx) const
Return the specified successor. This instruction must be a terminator.
Definition: Instruction.cpp:789
ClGlobals
static cl::opt< bool > ClGlobals("asan-globals", cl::desc("Handle global objects"), cl::Hidden, cl::init(true))
ClUseAfterScope
static cl::opt< bool > ClUseAfterScope("asan-use-after-scope", cl::desc("Check stack-use-after-scope"), cl::Hidden, cl::init(false))
Align
uint64_t Align
Definition: ELFObjHandler.cpp:81
llvm::GlobalValue::InternalLinkage
@ InternalLinkage
Rename collisions when linking (static functions).
Definition: GlobalValue.h:55
llvm::Align
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
llvm::Comdat
Definition: Comdat.h:33
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:155
llvm::Metadata
Root of the metadata hierarchy.
Definition: Metadata.h:62
llvm::Triple::getArch
ArchType getArch() const
Get the parsed architecture type of this triple.
Definition: Triple.h:345
llvm::SPII::Store
@ Store
Definition: SparcInstrInfo.h:33
c
the resulting code requires compare and branches when and if the revised code is with conditional branches instead of More there is a byte word extend before each where there should be only and the condition codes are not remembered when the same two values are compared twice More LSR enhancements i8 and i32 load store addressing modes are identical int int c
Definition: README.txt:418
llvm::LocationMetadata
Frontend-provided metadata for source location.
Definition: AddressSanitizer.h:29
llvm::Triple::GOFF
@ GOFF
Definition: Triple.h:275
llvm::GlobalsMetadata::get
Entry get(GlobalVariable *G) const
Returns metadata entry for a given global.
Definition: AddressSanitizer.h:59
llvm::Instruction::isLifetimeStartOrEnd
bool isLifetimeStartOrEnd() const
Return true if the instruction is a llvm.lifetime.start or llvm.lifetime.end marker.
Definition: Instruction.cpp:718
kAllocaRzSize
static const uint64_t kAllocaRzSize
Definition: AddressSanitizer.cpp:176
llvm::None
const NoneType None
Definition: None.h:24
instrumentMaskedLoadOrStore
static void instrumentMaskedLoadOrStore(AddressSanitizer *Pass, const DataLayout &DL, Type *IntptrTy, Value *Mask, Instruction *I, Value *Addr, MaybeAlign Alignment, unsigned Granularity, Type *OpType, bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp)
Definition: AddressSanitizer.cpp:1463
llvm::InlineAsm::get
static InlineAsm * get(FunctionType *Ty, StringRef AsmString, StringRef Constraints, bool hasSideEffects, bool isAlignStack=false, AsmDialect asmDialect=AD_ATT, bool canThrow=false)
InlineAsm::get - Return the specified uniqued inline asm string.
Definition: InlineAsm.cpp:41
llvm::CallingConv::ID
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
ClInstrumentAtomics
static cl::opt< bool > ClInstrumentAtomics("asan-instrument-atomics", cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, cl::init(true))
Type.h
llvm::IRBuilderBase::CreateAnd
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1350
llvm::IRBuilderBase::CreatePointerCast
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1998
llvm::AllocaInst::isSwiftError
bool isSwiftError() const
Return true if this alloca is used as a swifterror argument to a call.
Definition: Instructions.h:149
kSystemZ_ShadowOffset64
static const uint64_t kSystemZ_ShadowOffset64
Definition: AddressSanitizer.cpp:102
llvm::Triple::isOSFuchsia
bool isOSFuchsia() const
Definition: Triple.h:538
kCompileKernelShift
constexpr size_t kCompileKernelShift
Definition: AddressSanitizer.cpp:179
llvm::InstVisitor::visitCleanupReturnInst
RetTy visitCleanupReturnInst(CleanupReturnInst &I)
Definition: InstVisitor.h:245
llvm::function_ref
An efficient, type-erasing, non-owning reference to a callable.
Definition: STLFunctionalExtras.h:36
llvm::MDNode::getOperand
const MDOperand & getOperand(unsigned I) const
Definition: Metadata.h:1204
llvm::InlineAsm
Definition: InlineAsm.h:31
llvm::GlobalsMetadata::Entry::IsDynInit
bool IsDynInit
Definition: AddressSanitizer.h:46
G
const DataFlowGraph & G
Definition: RDFGraph.cpp:200
llvm::GlobalsMetadata
Frontend-provided metadata for global variables.
Definition: AddressSanitizer.h:41
llvm::Triple::ppc64le
@ ppc64le
Definition: Triple.h:72
ClUsePrivateAlias
static cl::opt< bool > ClUsePrivateAlias("asan-use-private-alias", cl::desc("Use private aliases for global variables"), cl::Hidden, cl::init(false))
llvm::SPIRV::Decoration::Alignment
@ Alignment
BasicBlock.h
llvm::cl::opt< bool >
kODRGenPrefix
const char kODRGenPrefix[]
Definition: AddressSanitizer.cpp:151
llvm::Triple::isThumb
bool isThumb() const
Tests whether the target is Thumb (little and big endian).
Definition: Triple.h:751
llvm::Triple::ELF
@ ELF
Definition: Triple.h:274
llvm::RISCVFenceField::O
@ O
Definition: RISCVBaseInfo.h:239
ClInitializers
static cl::opt< bool > ClInitializers("asan-initialization-order", cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(true))
llvm::StoreInst
An instruction for storing to memory.
Definition: Instructions.h:305
llvm::GlobalValue
Definition: GlobalValue.h:44
kSmallX86_64ShadowOffsetAlignMask
static const uint64_t kSmallX86_64ShadowOffsetAlignMask
Definition: AddressSanitizer.cpp:99
llvm::GlobalVariable::getInitializer
const Constant * getInitializer() const
getInitializer - Return the initializer for this global variable.
Definition: GlobalVariable.h:135
llvm::Constant
This is an important base class in LLVM.
Definition: Constant.h:41
llvm::cl::values
ValuesClass values(OptsTy... Options)
Helper to build a ValuesClass by forwarding a variable number of arguments as an initializer list to ...
Definition: CommandLine.h:685
llvm::Instruction::eraseFromParent
SymbolTableList< Instruction >::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
Definition: Instruction.cpp:77
llvm::AMDGPU::Hwreg::Offset
Offset
Definition: SIDefines.h:412
llvm::Triple::isARM
bool isARM() const
Tests whether the target is ARM (little and big endian).
Definition: Triple.h:756
kAsanRegisterGlobalsName
const char kAsanRegisterGlobalsName[]
Definition: AddressSanitizer.cpp:131
llvm::StringRef::empty
constexpr LLVM_NODISCARD bool empty() const
empty - Check if the string is empty.
Definition: StringRef.h:153
llvm::createSanitizerCtorAndInitFunctions
std::pair< Function *, FunctionCallee > createSanitizerCtorAndInitFunctions(Module &M, StringRef CtorName, StringRef InitName, ArrayRef< Type * > InitArgTypes, ArrayRef< Value * > InitArgs, StringRef VersionCheckName=StringRef())
Creates sanitizer constructor function, and calls sanitizer's init function from it.
Definition: ModuleUtils.cpp:135
llvm::ICmpInst
This instruction compares its operands according to the predicate given to the constructor.
Definition: Instructions.h:1186
llvm::GlobalsMetadata::GlobalsMetadata
GlobalsMetadata()=default
Create a default uninitialized GlobalsMetadata instance.
uint64_t
llvm::Triple::isMIPS64
bool isMIPS64() const
Tests whether the target is MIPS 64-bit (little and big endian).
Definition: Triple.h:837
ClInstrumentByval
static cl::opt< bool > ClInstrumentByval("asan-instrument-byval", cl::desc("instrument byval call arguments"), cl::Hidden, cl::init(true))
llvm::GlobalValue::getVisibility
VisibilityTypes getVisibility() const
Definition: GlobalValue.h:228
D
static GCRegistry::Add< StatepointGC > D("statepoint-example", "an example strategy for statepoint")
llvm::StackSafetyGlobalAnalysis
This pass performs the global (interprocedural) stack safety analysis (new pass manager).
Definition: StackSafetyAnalysis.h:128
llvm::GlobalValue::getParent
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:577
kLinuxKasan_ShadowOffset64
static const uint64_t kLinuxKasan_ShadowOffset64
Definition: AddressSanitizer.cpp:100
Addr
uint64_t Addr
Definition: ELFObjHandler.cpp:78
kPS4_ShadowOffset64
static const uint64_t kPS4_ShadowOffset64
Definition: AddressSanitizer.cpp:113
llvm::Triple::isOSFreeBSD
bool isOSFreeBSD() const
Definition: Triple.h:534
kAsanInitName
const char kAsanInitName[]
Definition: AddressSanitizer.cpp:140
kRISCV64_ShadowOffset64
static const uint64_t kRISCV64_ShadowOffset64
Definition: AddressSanitizer.cpp:106
llvm::IRBuilderBase::getInt32
ConstantInt * getInt32(uint32_t C)
Get a constant 32-bit value.
Definition: IRBuilder.h:461
llvm::PHINode::addIncoming
void addIncoming(Value *V, BasicBlock *BB)
Add an incoming value to the end of the PHI list.
Definition: Instructions.h:2814
llvm::GlobalObject::copyMetadata
void copyMetadata(const GlobalObject *Src, unsigned Offset)
Copy metadata from Src, adjusting offsets by Offset.
Definition: Metadata.cpp:1498
llvm::LLVMContext
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:68
PromoteMemToReg.h
llvm::declareSanitizerInitFunction
FunctionCallee declareSanitizerInitFunction(Module &M, StringRef InitName, ArrayRef< Type * > InitArgTypes)
Definition: ModuleUtils.cpp:114
llvm::BranchInst::Create
static BranchInst * Create(BasicBlock *IfTrue, Instruction *InsertBefore=nullptr)
Definition: Instructions.h:3155
llvm::assumeAligned
Align assumeAligned(uint64_t Value)
Treats the value 0 as a 1, so Align is always at least 1.
Definition: Alignment.h:103
llvm::DenseMap
Definition: DenseMap.h:716
llvm::AnalysisKey
A special type used by analysis passes to provide an address that identifies that particular analysis...
Definition: PassManager.h:69
ClDebugFunc
static cl::opt< std::string > ClDebugFunc("asan-debug-func", cl::Hidden, cl::desc("Debug func"))
llvm::GlobalValue::getDLLStorageClass
DLLStorageClassTypes getDLLStorageClass() const
Definition: GlobalValue.h:255
I
#define I(x, y, z)
Definition: MD5.cpp:58
llvm::DebugLoc::get
DILocation * get() const
Get the underlying DILocation.
Definition: DebugLoc.cpp:20
llvm::IRBuilderBase::getInt8PtrTy
PointerType * getInt8PtrTy(unsigned AddrSpace=0)
Fetch the type representing a pointer to an 8-bit integer value.
Definition: IRBuilder.h:549
llvm::M68kBeads::Term
@ Term
Definition: M68kBaseInfo.h:71
StringExtras.h
llvm::ObjectSizeOffsetVisitor
Evaluate the size and offset of an object pointed to by a Value* statically.
Definition: MemoryBuiltins.h:185
llvm::ASanStackFrameLayout::FrameSize
uint64_t FrameSize
Definition: ASanStackFrameLayout.h:47
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:432
llvm::appendToUsed
void appendToUsed(Module &M, ArrayRef< GlobalValue * > Values)
Adds global values to the llvm.used list.
Definition: ModuleUtils.cpp:105
llvm::IRBuilderBase::CreateSelect
Value * CreateSelect(Value *C, Value *True, Value *False, const Twine &Name="", Instruction *MDFrom=nullptr)
Definition: IRBuilder.cpp:991
kMaxStackMallocSize
static const size_t kMaxStackMallocSize
Definition: AddressSanitizer.cpp:121
DIBuilder.h
ClAlwaysSlowPath
static cl::opt< bool > ClAlwaysSlowPath("asan-always-slow-path", cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, cl::init(false))
llvm::PointerType
Class to represent pointers.
Definition: DerivedTypes.h:632
llvm::AsanDetectStackUseAfterReturnMode
AsanDetectStackUseAfterReturnMode
Mode of ASan detect stack use after return.
Definition: AddressSanitizerOptions.h:23
ClWithIfuncSuppressRemat
static cl::opt< bool > ClWithIfuncSuppressRemat("asan-with-ifunc-suppress-remat", cl::desc("Suppress rematerialization of dynamic shadow address by passing " "it through inline asm in prologue."), cl::Hidden, cl::init(true))
kDefaultShadowOffset32
static const uint64_t kDefaultShadowOffset32
Definition: AddressSanitizer.cpp:94
llvm::InstVisitor::visit
void visit(Iterator Start, Iterator End)
Definition: InstVisitor.h:87
ArrayRef.h
llvm::Instruction::setDebugLoc
void setDebugLoc(DebugLoc Loc)
Set the debug location information for this instruction.
Definition: Instruction.h:364
llvm::IRBuilderBase::CreateAdd
Value * CreateAdd(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1201
ClSkipPromotableAllocas
static cl::opt< bool > ClSkipPromotableAllocas("asan-skip-promotable-allocas", cl::desc("Do not instrument promotable allocas"), cl::Hidden, cl::init(true))
llvm::ConstantStruct::getAnon
static Constant * getAnon(ArrayRef< Constant * > V, bool Packed=false)
Return an anonymous struct that has the specified elements.
Definition: Constants.h:462
kAsanEmscriptenCtorAndDtorPriority
static const uint64_t kAsanEmscriptenCtorAndDtorPriority
Definition: AddressSanitizer.cpp:129
IRBuilder.h
ClUseAfterReturn
static cl::opt< AsanDetectStackUseAfterReturnMode > ClUseAfterReturn("asan-use-after-return", cl::desc("Sets the mode of detection for stack-use-after-return."), cl::values(clEnumValN(AsanDetectStackUseAfterReturnMode::Never, "never", "Never detect stack use after return."), clEnumValN(AsanDetectStackUseAfterReturnMode::Runtime, "runtime", "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set."), clEnumValN(AsanDetectStackUseAfterReturnMode::Always, "always", "Always detect stack use after return.")), cl::Hidden, cl::init(AsanDetectStackUseAfterReturnMode::Runtime))
kAsanUnregisterGlobalsName
const char kAsanUnregisterGlobalsName[]
Definition: AddressSanitizer.cpp:132
llvm::DIExpression::DerefBefore
@ DerefBefore
Definition: DebugInfoMetadata.h:2754
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::Instruction::hasMetadata
bool hasMetadata() const
Return true if this instruction has any metadata attached to it.
Definition: Instruction.h:261
ClInstrumentWrites
static cl::opt< bool > ClInstrumentWrites("asan-instrument-writes", cl::desc("instrument write instructions"), cl::Hidden, cl::init(true))
SI
StandardInstrumentations SI(Debug, VerifyEach)
ModuleName
Definition: ItaniumDemangle.h:989
kAsanPoisonGlobalsName
const char kAsanPoisonGlobalsName[]
Definition: AddressSanitizer.cpp:138
llvm::GlobalValue::hasLocalLinkage
bool hasLocalLinkage() const
Definition: GlobalValue.h:450
llvm::AllocaInst::getAlignment
uint64_t getAlignment() const
Definition: Instructions.h:130
ClMappingScale
static cl::opt< int > ClMappingScale("asan-mapping-scale", cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0))
llvm::IRBuilderBase::CreateExtractElement
Value * CreateExtractElement(Value *Vec, Value *Idx, const Twine &Name="")
Definition: IRBuilder.h:2276
llvm::ASanStackVariableDescription
Definition: ASanStackFrameLayout.h:30
kAccessSizeIndexMask
constexpr size_t kAccessSizeIndexMask
Definition: AddressSanitizer.cpp:182
ClMappingOffset
static cl::opt< uint64_t > ClMappingOffset("asan-mapping-offset", cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"), cl::Hidden, cl::init(0))
llvm::ArrayType::get
static ArrayType * get(Type *ElementType, uint64_t NumElements)
This static method is the primary way to construct an ArrayType.
Definition: Type.cpp:638
kEmscriptenShadowOffset
static const uint64_t kEmscriptenShadowOffset
Definition: AddressSanitizer.cpp:115
llvm::IRBuilderBase::getTrue
ConstantInt * getTrue()
Get the constant value for i1 true.
Definition: IRBuilder.h:441
kAsanGenPrefix
const char kAsanGenPrefix[]
Definition: AddressSanitizer.cpp:150
llvm::AsanDetectStackUseAfterReturnMode::Never
@ Never
Never detect stack use after return.
kSanCovGenPrefix
const char kSanCovGenPrefix[]
Definition: AddressSanitizer.cpp:152
llvm::Module
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
llvm::MDNode
Metadata node.
Definition: Metadata.h:937
OP
#define OP(n)
Definition: regex2.h:73
llvm::SplitBlockAndInsertIfThenElse
void SplitBlockAndInsertIfThenElse(Value *Cond, Instruction *SplitBefore, Instruction **ThenTerm, Instruction **ElseTerm, MDNode *BranchWeights=nullptr)
SplitBlockAndInsertIfThenElse is similar to SplitBlockAndInsertIfThen, but also creates the ElseBlock...
Definition: BasicBlockUtils.cpp:1467
kAsanModuleCtorName
const char kAsanModuleCtorName[]
Definition: AddressSanitizer.cpp:125
llvm::ConstantStruct
Definition: Constants.h:441
llvm::SmallPtrSetImpl::count
size_type count(ConstPtrType Ptr) const
count - Return 1 if the specified pointer is in the set, 0 otherwise.
Definition: SmallPtrSet.h:383
ClOptSameTemp
static cl::opt< bool > ClOptSameTemp("asan-opt-same-temp", cl::desc("Instrument the same temp just once"), cl::Hidden, cl::init(true))
Triple.h
llvm::InstVisitor::visitReturnInst
RetTy visitReturnInst(ReturnInst &I)
Definition: InstVisitor.h:227
llvm::Function::createWithDefaultAttr
static Function * createWithDefaultAttr(FunctionType *Ty, LinkageTypes Linkage, unsigned AddrSpace, const Twine &N="", Module *M=nullptr)
Creates a function with some attributes recorded in llvm.module.flags applied.
Definition: Function.cpp:336
llvm::IRBuilderBase::CreatePHI
PHINode * CreatePHI(Type *Ty, unsigned NumReservedValues, const Twine &Name="")
Definition: IRBuilder.h:2221
kWindowsShadowOffset64
static const uint64_t kWindowsShadowOffset64
Definition: AddressSanitizer.cpp:118
kAsanGlobalsRegisteredFlagName
const char kAsanGlobalsRegisteredFlagName[]
Definition: AddressSanitizer.cpp:159
llvm::SmallPtrSetImplBase::clear
void clear()
Definition: SmallPtrSet.h:95
llvm::ASanStackFrameLayout::FrameAlignment
uint64_t FrameAlignment
Definition: ASanStackFrameLayout.h:46
llvm::ArrayRef
ArrayRef - Represent a constant reference to an array (0 or more elements consecutively in memory),...
Definition: APInt.h:32
kMIPS32_ShadowOffset32
static const uint64_t kMIPS32_ShadowOffset32
Definition: AddressSanitizer.cpp:103
llvm::BinaryOperator
Definition: InstrTypes.h:188
findStoresToUninstrumentedArgAllocas
static void findStoresToUninstrumentedArgAllocas(AddressSanitizer &ASan, Instruction &InsBefore, SmallVectorImpl< Instruction * > &InitInsts)
Collect instructions in the entry block after InsBefore which initialize permanent storage for a func...
Definition: AddressSanitizer.cpp:3080
llvm::min
Expected< ExpressionValue > min(const ExpressionValue &Lhs, const ExpressionValue &Rhs)
Definition: FileCheck.cpp:357
DataLayout.h
llvm::AddressSanitizerOptions::Recover
bool Recover
Definition: AddressSanitizer.h:99
llvm::codeview::ExportFlags::IsPrivate
@ IsPrivate
llvm::StructType
Class to represent struct types.
Definition: DerivedTypes.h:213
llvm::countTrailingZeros
unsigned countTrailingZeros(T Val, ZeroBehavior ZB=ZB_Width)
Count number of 0's from the least significant bit to the most stopping at the first 1.
Definition: MathExtras.h:156
Cond
SmallVector< MachineOperand, 4 > Cond
Definition: BasicBlockSections.cpp:137
kAsanUnregisterImageGlobalsName
const char kAsanUnregisterImageGlobalsName[]
Definition: AddressSanitizer.cpp:134
llvm::StringRef
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:58
this
Analysis the ScalarEvolution expression for r is this
Definition: README.txt:8
InstVisitor.h
llvm_unreachable
#define llvm_unreachable(msg)
Marks that the current location is not supposed to be reachable.
Definition: ErrorHandling.h:143
llvm::Value::getType
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:255
ClOptStack
static cl::opt< bool > ClOptStack("asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), cl::Hidden, cl::init(false))
llvm::IRBuilderBase::CreateICmpEQ
Value * CreateICmpEQ(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2066
llvm::cantFail
void cantFail(Error Err, const char *Msg=nullptr)
Report a fatal error if Err is a failure value.
Definition: Error.h:745
llvm::Value::replaceAllUsesWith
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:529
llvm::BasicBlock::Create
static BasicBlock * Create(LLVMContext &Context, const Twine &Name="", Function *Parent=nullptr, BasicBlock *InsertBefore=nullptr)
Creates a new BasicBlock.
Definition: BasicBlock.h:97
getParent
static const Function * getParent(const Value *V)
Definition: BasicAliasAnalysis.cpp:868
uint32_t
parse
static llvm::Error parse(DataExtractor &Data, uint64_t BaseAddr, LineEntryCallback const &Callback)
Definition: LineTable.cpp:54
llvm::AllocaInst::isArrayAllocation
bool isArrayAllocation() const
Return true if there is an allocation size parameter to the allocation instruction that is not 1.
Definition: Instructions.cpp:1410
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
clEnumValN
#define clEnumValN(ENUMVAL, FLAGNAME, DESC)
Definition: CommandLine.h:660
llvm::InstVisitor
Base class for instruction visitors.
Definition: InstVisitor.h:78
llvm::ASanAccessInfo::ASanAccessInfo
ASanAccessInfo(int32_t Packed)
Definition: AddressSanitizer.cpp:592
llvm::ObjectSizeOpts
Various options to control the behavior of getObjectSize.
Definition: MemoryBuiltins.h:135
llvm::Triple::isiOS
bool isiOS() const
Is this an iOS triple.
Definition: Triple.h:484
llvm::maybeMarkSanitizerLibraryCallNoBuiltin
void maybeMarkSanitizerLibraryCallNoBuiltin(CallInst *CI, const TargetLibraryInfo *TLI)
Given a CallInst, check if it calls a string function known to CodeGen, and mark it with NoBuiltin if...
Definition: Local.cpp:3257
llvm::GlobalValue::AvailableExternallyLinkage
@ AvailableExternallyLinkage
Available for inspection, not emission.
Definition: GlobalValue.h:49
ClWithIfunc
static cl::opt< bool > ClWithIfunc("asan-with-ifunc", cl::desc("Access dynamic shadow through an ifunc global on " "platforms that support this"), cl::Hidden, cl::init(true))
llvm::ASanStackVariableDescription::Offset
size_t Offset
Definition: ASanStackFrameLayout.h:38
llvm::GlobalAlias::getAliasee
const Constant * getAliasee() const
Definition: GlobalAlias.h:84
llvm::Value::getName
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:305
llvm::LoadInst
An instruction for reading from memory.
Definition: Instructions.h:176
llvm::GlobalValue::CommonLinkage
@ CommonLinkage
Tentative definitions.
Definition: GlobalValue.h:58
llvm::InstVisitor::visitAllocaInst
RetTy visitAllocaInst(AllocaInst &I)
Definition: InstVisitor.h:168
llvm::Triple::isWatchOS
bool isWatchOS() const
Is this an Apple watchOS triple.
Definition: Triple.h:494
ClInstrumentDynamicAllocas
static cl::opt< bool > ClInstrumentDynamicAllocas("asan-instrument-dynamic-allocas", cl::desc("instrument dynamic allocas"), cl::Hidden, cl::init(true))
llvm::NamedMDNode::operands
iterator_range< op_iterator > operands()
Definition: Metadata.h:1584
llvm::AtomicRMWInst
an instruction that atomically reads a memory location, combines it with another value,...
Definition: Instructions.h:727
llvm::cl::Optional
@ Optional
Definition: CommandLine.h:115
llvm::ASanGlobalsMetadataAnalysis
The ASanGlobalsMetadataAnalysis initializes and returns a GlobalsMetadata object.
Definition: AddressSanitizer.h:85
Argument.h
llvm::ConstantInt::getZExtValue
uint64_t getZExtValue() const
Return the constant as a 64-bit unsigned integer value after it has been zero extended as appropriate...
Definition: Constants.h:142
kAsanSetShadowPrefix
const char kAsanSetShadowPrefix[]
Definition: AddressSanitizer.cpp:153
kSmallX86_64ShadowOffsetBase
static const uint64_t kSmallX86_64ShadowOffsetBase
Definition: AddressSanitizer.cpp:98
llvm::Triple::isOSWindows
bool isOSWindows() const
Tests whether the OS is Windows.
Definition: Triple.h:571
llvm::depth_first
iterator_range< df_iterator< T > > depth_first(const T &G)
Definition: DepthFirstIterator.h:230
Attributes.h
runOnFunction
static bool runOnFunction(Function &F, bool PostInlining)
Definition: EntryExitInstrumenter.cpp:69
getShadowMapping
static ShadowMapping getShadowMapping(const Triple &TargetTriple, int LongSize, bool IsKasan)
Definition: AddressSanitizer.cpp:464
j
return j(j<< 16)
Constant.h
llvm::ASanStackVariableDescription::Line
unsigned Line
Definition: ASanStackFrameLayout.h:40
llvm::ResumeInst
Resume the propagation of an exception.
Definition: Instructions.h:4224
llvm::Twine
Twine - A lightweight data structure for efficiently representing the concatenation of temporary valu...
Definition: Twine.h:83
kWindowsShadowOffset32
static const uint64_t kWindowsShadowOffset32
Definition: AddressSanitizer.cpp:114
llvm::ASanAccessInfo
Definition: AddressSanitizer.h:129
llvm::GraphProgram::Name
Name
Definition: GraphWriter.h:50
ClStack
static cl::opt< bool > ClStack("asan-stack", cl::desc("Handle stack memory"), cl::Hidden, cl::init(true))
llvm::Constant::getNullValue
static Constant * getNullValue(Type *Ty)
Constructor to create a '0' constant of arbitrary type.
Definition: Constants.cpp:350
llvm::AArch64::RZ
@ RZ
Definition: AArch64ISelLowering.h:482
llvm::GlobalAlias::create
static GlobalAlias * create(Type *Ty, unsigned AddressSpace, LinkageTypes Linkage, const Twine &Name, Constant *Aliasee, Module *Parent)
If a parent module is specified, the alias is automatically inserted into the end of the specified mo...
Definition: Globals.cpp:480
kCompileKernelMask
constexpr size_t kCompileKernelMask
Definition: AddressSanitizer.cpp:180
get
Should compile to something r4 addze r3 instead we get
Definition: README.txt:24
kAMDGPUAddressPrivateName
const char kAMDGPUAddressPrivateName[]
Definition: AddressSanitizer.cpp:171
kAsanUnpoisonStackMemoryName
const char kAsanUnpoisonStackMemoryName[]
Definition: AddressSanitizer.cpp:155
llvm::AsanDtorKind
AsanDtorKind
Types of ASan module destructors supported.
Definition: AddressSanitizerOptions.h:16
llvm::IRBuilderBase::CreateMemCpy
CallInst * CreateMemCpy(Value *Dst, MaybeAlign DstAlign, Value *Src, MaybeAlign SrcAlign, uint64_t Size, bool isVolatile=false, MDNode *TBAATag=nullptr, MDNode *TBAAStructTag=nullptr, MDNode *ScopeTag=nullptr, MDNode *NoAliasTag=nullptr)
Create and insert a memcpy between the specified pointers.
Definition: IRBuilder.h:610
llvm::AMDGPU::SendMsg::Op
Op
Definition: SIDefines.h:344
llvm::PreservedAnalyses::all
static PreservedAnalyses all()
Construct a special preserved set that preserves all passes.
Definition: PassManager.h:158
llvm::X86::FirstMacroFusionInstKind::Cmp
@ Cmp
llvm::ASanStackVariableDescription::LifetimeSize
size_t LifetimeSize
Definition: ASanStackFrameLayout.h:34
llvm::CallBase::arg_size
unsigned arg_size() const
Definition: InstrTypes.h:1339
GlobalVariable.h
llvm::InstVisitor::visitResumeInst
RetTy visitResumeInst(ResumeInst &I)
Definition: InstVisitor.h:239
kFreeBSD_ShadowOffset64
static const uint64_t kFreeBSD_ShadowOffset64
Definition: AddressSanitizer.cpp:108
llvm::IRBuilderBase::GetInsertBlock
BasicBlock * GetInsertBlock() const
Definition: IRBuilder.h:173
llvm::TypeSize
Definition: TypeSize.h:421
kAArch64_ShadowOffset64
static const uint64_t kAArch64_ShadowOffset64
Definition: AddressSanitizer.cpp:105
Casting.h
llvm::Triple::MachO
@ MachO
Definition: Triple.h:276
Function.h
llvm::AsanDtorKind::Global
@ Global
Append to llvm.global_dtors.
llvm::Type::getPointerTo
PointerType * getPointerTo(unsigned AddrSpace=0) const
Return a pointer to the current type.
Definition: Type.cpp:774
llvm::TargetLibraryInfo
Provides information about what library functions are available for the current target.
Definition: TargetLibraryInfo.h:222
ClOptimizeCallbacks
static cl::opt< bool > ClOptimizeCallbacks("asan-optimize-callbacks", cl::desc("Optimize callbacks"), cl::Hidden, cl::init(false))
llvm::ReturnInst::Create
static ReturnInst * Create(LLVMContext &C, Value *retVal=nullptr, Instruction *InsertBefore=nullptr)
Definition: Instructions.h:3044
llvm::getUniqueModuleId
std::string getUniqueModuleId(Module *M)
Produce a unique identifier for this module by taking the MD5 sum of the names of the module's strong...
Definition: ModuleUtils.cpp:207
llvm::ConstantArray::get
static Constant * get(ArrayType *T, ArrayRef< Constant * > V)
Definition: Constants.cpp:1282
llvm::ConstantExpr::getGetElementPtr
static Constant * getGetElementPtr(Type *Ty, Constant *C, ArrayRef< Constant * > IdxList, bool InBounds=false, Optional< unsigned > InRangeIndex=None, Type *OnlyIfReducedTy=nullptr)
Getelementptr form.
Definition: Constants.h:1243
llvm::SmallVectorImpl::clear
void clear()
Definition: SmallVector.h:591
llvm::Triple::systemz
@ systemz
Definition: Triple.h:80
kFreeBSDKasan_ShadowOffset64
static const uint64_t kFreeBSDKasan_ShadowOffset64
Definition: AddressSanitizer.cpp:109
kMaxAsanStackMallocSizeClass
static const int kMaxAsanStackMallocSizeClass
Definition: AddressSanitizer.cpp:145
llvm::CleanupReturnInst
Definition: Instructions.h:4632
ClUseOdrIndicator
static cl::opt< bool > ClUseOdrIndicator("asan-use-odr-indicator", cl::desc("Use odr indicators to improve ODR reporting"), cl::Hidden, cl::init(false))
kIsWriteShift
constexpr size_t kIsWriteShift
Definition: AddressSanitizer.cpp:183
ClOpt
static cl::opt< bool > ClOpt("asan-opt", cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true))
GlobalAlias.h
llvm::IntrinsicInst
A wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:46
ClInvalidPointerSub
static cl::opt< bool > ClInvalidPointerSub("asan-detect-invalid-pointer-sub", cl::desc("Instrument - operations with pointer operands"), cl::Hidden, cl::init(false))
llvm::MDBuilder
Definition: MDBuilder.h:35
llvm::ComputeASanStackFrameDescription
SmallString< 64 > ComputeASanStackFrameDescription(const SmallVectorImpl< ASanStackVariableDescription > &Vars)
Definition: ASanStackFrameLayout.cpp:96
llvm::Function::front
const BasicBlock & front() const
Definition: Function.h:732
kAccessSizeIndexShift
constexpr size_t kAccessSizeIndexShift
Definition: AddressSanitizer.cpp:181
llvm::AllocaInst::setAlignment
void setAlignment(Align Align)
Definition: Instructions.h:125
llvm::ObjectSizeOffsetVisitor::compute
SizeOffsetType compute(Value *V)
Definition: MemoryBuiltins.cpp:664
llvm::SPIRV::ExecutionMode::Initializer
@ Initializer
llvm::Triple::isAndroidVersionLT
bool isAndroidVersionLT(unsigned Major) const
Definition: Triple.h:703
llvm::Type::getVoidTy
static Type * getVoidTy(LLVMContext &C)
Definition: Type.cpp:222
llvm::IRBuilderBase::getInt1Ty
IntegerType * getInt1Ty()
Fetch the type representing a single bit.
Definition: IRBuilder.h:486
getRedzoneSizeForScale
static uint64_t getRedzoneSizeForScale(int MappingScale)
Definition: AddressSanitizer.cpp:608
AddressSanitizerOptions.h
llvm::Pass
Pass interface - Implemented by all 'passes'.
Definition: Pass.h:91
llvm::StackSafetyGlobalInfo::stackAccessIsSafe
bool stackAccessIsSafe(const Instruction &I) const
Definition: StackSafetyAnalysis.cpp:971
llvm::Triple::COFF
@ COFF
Definition: Triple.h:272
llvm::GlobalValue::PrivateLinkage
@ PrivateLinkage
Like Internal, but omit from symbol table.
Definition: GlobalValue.h:56
Instructions.h
Invalid
@ Invalid
Definition: AArch64ISelLowering.cpp:8744
llvm::getAddressSanitizerParams
void getAddressSanitizerParams(const Triple &TargetTriple, int LongSize, bool IsKasan, uint64_t *ShadowBase, int *MappingScale, bool *OrShadowOffset)
Definition: AddressSanitizer.cpp:583
llvm::AllocaInst::isUsedWithInAlloca
bool isUsedWithInAlloca() const
Return true if this alloca is used as an inalloca argument to a call.
Definition: Instructions.h:139
kAsanUnpoisonGlobalsName
const char kAsanUnpoisonGlobalsName[]
Definition: AddressSanitizer.cpp:139
Version
uint64_t Version
Definition: RawMemProfReader.cpp:41
SmallVector.h
llvm::ModuleAddressSanitizerPass::run
PreservedAnalyses run(Module &M, ModuleAnalysisManager &AM)
Definition: AddressSanitizer.cpp:1174
llvm::Instruction::getDebugLoc
const DebugLoc & getDebugLoc() const
Return the debug location for this node as a DebugLoc.
Definition: Instruction.h:367
llvm::Triple::isOSNetBSD
bool isOSNetBSD() const
Definition: Triple.h:526
llvm::IRBuilderBase::CreateLShr
Value * CreateLShr(Value *LHS, Value *RHS, const Twine &Name="", bool isExact=false)
Definition: IRBuilder.h:1310
ModuleUtils.h
llvm::CallBase::getArgOperand
Value * getArgOperand(unsigned i) const
Definition: InstrTypes.h:1341
llvm::AddressSanitizerOptions::UseAfterScope
bool UseAfterScope
Definition: AddressSanitizer.h:100
N
#define N
kCurrentStackFrameMagic
static const uintptr_t kCurrentStackFrameMagic
Definition: AddressSanitizer.cpp:122
llvm::Instruction::getParent
const BasicBlock * getParent() const
Definition: Instruction.h:91
kFreeBSD_ShadowOffset32
static const uint64_t kFreeBSD_ShadowOffset32
Definition: AddressSanitizer.cpp:107
kAsanShadowMemoryDynamicAddress
const char kAsanShadowMemoryDynamicAddress[]
Definition: AddressSanitizer.cpp:164
llvm::to_string
std::string to_string(const T &Value)
Definition: ScopedPrinter.h:86
kAsanStackMallocNameTemplate
const char kAsanStackMallocNameTemplate[]
Definition: AddressSanitizer.cpp:146
llvm::ArrayRef::size
size_t size() const
size - Get the array size.
Definition: ArrayRef.h:164
llvm::max
Align max(MaybeAlign Lhs, Align Rhs)
Definition: Alignment.h:340
llvm::memtag::getAllocaSizeInBytes
uint64_t getAllocaSizeInBytes(const AllocaInst &AI)
Definition: MemoryTaggingSupport.cpp:145
llvm::FunctionCallee
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:165
llvm::codeview::CompileSym3Flags::Exp
@ Exp
llvm::PHINode
Definition: Instructions.h:2664
ClRecover
static cl::opt< bool > ClRecover("asan-recover", cl::desc("Enable recovery mode (continue-after-error)."), cl::Hidden, cl::init(false))
llvm::StringRef::data
const LLVM_NODISCARD char * data() const
data - Get a pointer to the start of the string (which may not be null terminated).
Definition: StringRef.h:149
llvm::SmallVectorImpl
This class consists of common code factored out of the SmallVector class to reduce code duplication b...
Definition: APFloat.h:42
kAsanReportErrorTemplate
const char kAsanReportErrorTemplate[]
Definition: AddressSanitizer.cpp:130
llvm::CallBase
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1174
llvm::LocationMetadata::LineNo
int LineNo
Definition: AddressSanitizer.h:31
llvm::Module::getDataLayout
const DataLayout & getDataLayout() const
Get the data layout for the module's target platform.
Definition: Module.cpp:398
DerivedTypes.h
llvm::StackSafetyGlobalInfo
Definition: StackSafetyAnalysis.h:58
llvm::AnalysisManager
A container for analyses that lazily runs them and caches their results.
Definition: InstructionSimplify.h:42
llvm::HexStyle::Asm
@ Asm
0ffh
Definition: MCInstPrinter.h:34
llvm::InnerAnalysisManagerProxy
An analysis over an "outer" IR unit that provides access to an analysis manager over an "inner" IR un...
Definition: PassManager.h:937
llvm::IntegerType::get
static IntegerType * get(LLVMContext &C, unsigned NumBits)
This static method is the primary way of constructing an IntegerType.
Definition: Type.cpp:311
llvm::ComputeASanStackFrameLayout
ASanStackFrameLayout ComputeASanStackFrameLayout(SmallVectorImpl< ASanStackVariableDescription > &Vars, uint64_t Granularity, uint64_t MinHeaderSize)
Definition: ASanStackFrameLayout.cpp:53
llvm::CallInst
This class represents a function call, abstracting a target machine's calling convention.
Definition: Instructions.h:1474
llvm::ConstantInt::isOne
bool isOne() const
This is just a convenience method to make client code smaller for a common case.
Definition: Constants.h:200
BB
Common register allocation spilling lr str ldr sxth r3 ldr mla r4 can lr mov lr str ldr sxth r3 mla r4 and then merge mul and lr str ldr sxth r3 mla r4 It also increase the likelihood the store may become dead bb27 Successors according to LLVM BB
Definition: README.txt:39
llvm::IRBuilderBase::getVoidTy
Type * getVoidTy()
Fetch the type representing void.
Definition: IRBuilder.h:539
llvm::UnreachableInst
This function has undefined behavior.
Definition: Instructions.h:4740
MachO.h
llvm::IRBuilderBase::CreateICmpNE
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2070
LLVMContext.h
kAsanPtrSub
const char kAsanPtrSub[]
Definition: AddressSanitizer.cpp:143
llvm::IRBuilderBase::CreateSub
Value * CreateSub(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1217
llvm::Value::takeName
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:378
llvm::DebugLoc
A debug info location.
Definition: DebugLoc.h:33
llvm::SplitBlockAndInsertIfThen
Instruction * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights, DominatorTree *DT, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
Definition: BasicBlockUtils.cpp:1446
kAsanPtrCmp
const char kAsanPtrCmp[]
Definition: AddressSanitizer.cpp:142
llvm::AllocaInst
an instruction to allocate memory on the stack
Definition: Instructions.h:58
llvm::appendToGlobalCtors
void appendToGlobalCtors(Module &M, Function *F, int Priority, Constant *Data=nullptr)
Append F to the list of global ctors of module M with the given Priority.
Definition: ModuleUtils.cpp:65
llvm::User::getOperand
Value * getOperand(unsigned i) const
Definition: User.h:169
llvm::BasicBlock::getTerminatingMustTailCall
const CallInst * getTerminatingMustTailCall() const
Returns the call instruction marked 'musttail' prior to the terminating return instruction of this ba...
Definition: BasicBlock.cpp:151
llvm::cl::desc
Definition: CommandLine.h:405
llvm::GlobalObject::setAlignment
void setAlignment(MaybeAlign Align)
Definition: Globals.cpp:122
llvm::GlobalValue::ExternalWeakLinkage
@ ExternalWeakLinkage
ExternalWeak linkage description.
Definition: GlobalValue.h:57
llvm::MDString::getString
StringRef getString() const
Definition: Metadata.cpp:509
llvm::BranchInst
Conditional or Unconditional Branch instruction.
Definition: Instructions.h:3099
raw_ostream.h
n
The same transformation can work with an even modulo with the addition of a and shrink the compare RHS by the same amount Unless the target supports that transformation probably isn t worthwhile The transformation can also easily be made to work with non zero equality for n
Definition: README.txt:685
llvm::AddressSanitizerOptions::UseAfterReturn
AsanDetectStackUseAfterReturnMode UseAfterReturn
Definition: AddressSanitizer.h:101
llvm::ModuleAddressSanitizerPass::ModuleAddressSanitizerPass
ModuleAddressSanitizerPass(const AddressSanitizerOptions &Options, bool UseGlobalGC=true, bool UseOdrIndicator=false, AsanDtorKind DestructorKind=AsanDtorKind::Global)
Definition: AddressSanitizer.cpp:1168
llvm::SmallVectorImpl::reserve
void reserve(size_type N)
Definition: SmallVector.h:644
llvm::AddressSanitizerOptions::CompileKernel
bool CompileKernel
Definition: AddressSanitizer.h:98
BasicBlockUtils.h
llvm::MDString
A single uniqued string.
Definition: Metadata.h:612
llvm::replaceDbgDeclare
bool replaceDbgDeclare(Value *Address, Value *NewAddress, DIBuilder &Builder, uint8_t DIExprFlags, int Offset)
Replaces llvm.dbg.declare instruction when the address it describes is replaced with a new value.
Definition: Local.cpp:1687
Value.h
ClUseStackSafety
static cl::opt< bool > ClUseStackSafety("asan-use-stack-safety", cl::Hidden, cl::init(false), cl::Hidden, cl::desc("Use Stack Safety analysis results"), cl::Optional)
llvm::GlobalValue::setVisibility
void setVisibility(VisibilityTypes V)
Definition: GlobalValue.h:234
StackMallocSizeClass
static int StackMallocSizeClass(uint64_t LocalStackSize)
Definition: AddressSanitizer.cpp:2974
llvm::Value
LLVM Value Representation.
Definition: Value.h:74
llvm::AtomicCmpXchgInst
An instruction that atomically checks whether a specified value is in a memory location,...
Definition: Instructions.h:522
Debug.h
llvm::TargetLibraryAnalysis
Analysis pass providing the TargetLibraryInfo.
Definition: TargetLibraryInfo.h:443
llvm::ASanStackFrameLayout
Definition: ASanStackFrameLayout.h:44
llvm::AddressSanitizerOptions
Definition: AddressSanitizer.h:97
kAsanModuleDtorName
const char kAsanModuleDtorName[]
Definition: AddressSanitizer.cpp:126
llvm::Triple::aarch64
@ aarch64
Definition: Triple.h:51
llvm::LocationMetadata::ColumnNo
int ColumnNo
Definition: AddressSanitizer.h:32
llvm::IRBuilderBase::CreateCall
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=None, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2229
llvm::isAllocaPromotable
bool isAllocaPromotable(const AllocaInst *AI)
Return true if this alloca is legal for promotion.
Definition: PromoteMemoryToRegister.cpp:63
llvm::CallBase::args
iterator_range< User::op_iterator > args()
Iteration adapter for range-for loops.
Definition: InstrTypes.h:1332
llvm::AsanDtorKind::Invalid
@ Invalid
Not a valid destructor Kind.
llvm::findAllocaForValue
AllocaInst * findAllocaForValue(Value *V, bool OffsetZero=false)
Returns unique alloca where the value comes from, or nullptr.
Definition: ValueTracking.cpp:4511
ClKasanMemIntrinCallbackPrefix
static cl::opt< bool > ClKasanMemIntrinCallbackPrefix("asan-kernel-mem-intrinsic-prefix", cl::desc("Use prefix for memory intrinsics in KASAN mode"), cl::Hidden, cl::init(false))
llvm::Instruction::moveBefore
void moveBefore(Instruction *MovePos)
Unlink this instruction from its current basic block and insert it into the basic block that MovePos ...
Definition: Instruction.cpp:96
llvm::Use
A Use represents the edge between a Value definition and its users.
Definition: Use.h:43
llvm::SmallVectorImpl::emplace_back
reference emplace_back(ArgTypes &&... Args)
Definition: SmallVector.h:927
llvm::SmallPtrSetImpl::insert
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:365
llvm::Intrinsic::ID
unsigned ID
Definition: TargetTransformInfo.h:37
llvm::DataLayout::getTypeAllocSize
TypeSize getTypeAllocSize(Type *Ty) const
Returns the offset in bytes between successive objects of the specified type, including alignment pad...
Definition: DataLayout.h:506
ClUseGlobalsGC
static cl::opt< bool > ClUseGlobalsGC("asan-globals-live-support", cl::desc("Use linker features to support dead " "code stripping of globals"), cl::Hidden, cl::init(true))
llvm::Triple::UnknownObjectFormat
@ UnknownObjectFormat
Definition: Triple.h:270
ClDebug
static cl::opt< int > ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, cl::init(0))