LLVM  14.0.0git
AddressSanitizer.cpp
Go to the documentation of this file.
1 //===- AddressSanitizer.cpp - memory error detector -----------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file is a part of AddressSanitizer, an address sanity checker.
10 // Details of the algorithm:
11 // https://github.com/google/sanitizers/wiki/AddressSanitizerAlgorithm
12 //
13 // FIXME: This sanitizer does not yet handle scalable vectors
14 //
15 //===----------------------------------------------------------------------===//
16 
18 #include "llvm/ADT/ArrayRef.h"
19 #include "llvm/ADT/DenseMap.h"
21 #include "llvm/ADT/SmallPtrSet.h"
22 #include "llvm/ADT/SmallVector.h"
23 #include "llvm/ADT/Statistic.h"
24 #include "llvm/ADT/StringExtras.h"
25 #include "llvm/ADT/StringRef.h"
26 #include "llvm/ADT/Triple.h"
27 #include "llvm/ADT/Twine.h"
32 #include "llvm/IR/Argument.h"
33 #include "llvm/IR/Attributes.h"
34 #include "llvm/IR/BasicBlock.h"
35 #include "llvm/IR/Comdat.h"
36 #include "llvm/IR/Constant.h"
37 #include "llvm/IR/Constants.h"
38 #include "llvm/IR/DIBuilder.h"
39 #include "llvm/IR/DataLayout.h"
41 #include "llvm/IR/DebugLoc.h"
42 #include "llvm/IR/DerivedTypes.h"
43 #include "llvm/IR/Dominators.h"
44 #include "llvm/IR/Function.h"
45 #include "llvm/IR/GlobalAlias.h"
46 #include "llvm/IR/GlobalValue.h"
47 #include "llvm/IR/GlobalVariable.h"
48 #include "llvm/IR/IRBuilder.h"
49 #include "llvm/IR/InlineAsm.h"
50 #include "llvm/IR/InstVisitor.h"
51 #include "llvm/IR/InstrTypes.h"
52 #include "llvm/IR/Instruction.h"
53 #include "llvm/IR/Instructions.h"
54 #include "llvm/IR/IntrinsicInst.h"
55 #include "llvm/IR/Intrinsics.h"
56 #include "llvm/IR/LLVMContext.h"
57 #include "llvm/IR/MDBuilder.h"
58 #include "llvm/IR/Metadata.h"
59 #include "llvm/IR/Module.h"
60 #include "llvm/IR/Type.h"
61 #include "llvm/IR/Use.h"
62 #include "llvm/IR/Value.h"
63 #include "llvm/InitializePasses.h"
64 #include "llvm/MC/MCSectionMachO.h"
65 #include "llvm/Pass.h"
66 #include "llvm/Support/Casting.h"
68 #include "llvm/Support/Debug.h"
81 #include <algorithm>
82 #include <cassert>
83 #include <cstddef>
84 #include <cstdint>
85 #include <iomanip>
86 #include <limits>
87 #include <memory>
88 #include <sstream>
89 #include <string>
90 #include <tuple>
91 
92 using namespace llvm;
93 
94 #define DEBUG_TYPE "asan"
95 
96 static const uint64_t kDefaultShadowScale = 3;
97 static const uint64_t kDefaultShadowOffset32 = 1ULL << 29;
98 static const uint64_t kDefaultShadowOffset64 = 1ULL << 44;
99 static const uint64_t kDynamicShadowSentinel =
101 static const uint64_t kSmallX86_64ShadowOffsetBase = 0x7FFFFFFF; // < 2G.
102 static const uint64_t kSmallX86_64ShadowOffsetAlignMask = ~0xFFFULL;
103 static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000;
104 static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 44;
105 static const uint64_t kSystemZ_ShadowOffset64 = 1ULL << 52;
106 static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000;
107 static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37;
108 static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36;
109 static const uint64_t kRISCV64_ShadowOffset64 = 0xd55550000;
110 static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30;
111 static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46;
112 static const uint64_t kFreeBSDKasan_ShadowOffset64 = 0xdffff7c000000000;
113 static const uint64_t kNetBSD_ShadowOffset32 = 1ULL << 30;
114 static const uint64_t kNetBSD_ShadowOffset64 = 1ULL << 46;
115 static const uint64_t kNetBSDKasan_ShadowOffset64 = 0xdfff900000000000;
116 static const uint64_t kPS4CPU_ShadowOffset64 = 1ULL << 40;
117 static const uint64_t kWindowsShadowOffset32 = 3ULL << 28;
118 static const uint64_t kEmscriptenShadowOffset = 0;
119 
120 // The shadow memory space is dynamically allocated.
122 
123 static const size_t kMinStackMallocSize = 1 << 6; // 64B
124 static const size_t kMaxStackMallocSize = 1 << 16; // 64K
125 static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3;
126 static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E;
127 
128 const char kAsanModuleCtorName[] = "asan.module_ctor";
129 const char kAsanModuleDtorName[] = "asan.module_dtor";
130 static const uint64_t kAsanCtorAndDtorPriority = 1;
131 // On Emscripten, the system needs more than one priorities for constructors.
132 static const uint64_t kAsanEmscriptenCtorAndDtorPriority = 50;
133 const char kAsanReportErrorTemplate[] = "__asan_report_";
134 const char kAsanRegisterGlobalsName[] = "__asan_register_globals";
135 const char kAsanUnregisterGlobalsName[] = "__asan_unregister_globals";
136 const char kAsanRegisterImageGlobalsName[] = "__asan_register_image_globals";
138  "__asan_unregister_image_globals";
139 const char kAsanRegisterElfGlobalsName[] = "__asan_register_elf_globals";
140 const char kAsanUnregisterElfGlobalsName[] = "__asan_unregister_elf_globals";
141 const char kAsanPoisonGlobalsName[] = "__asan_before_dynamic_init";
142 const char kAsanUnpoisonGlobalsName[] = "__asan_after_dynamic_init";
143 const char kAsanInitName[] = "__asan_init";
144 const char kAsanVersionCheckNamePrefix[] = "__asan_version_mismatch_check_v";
145 const char kAsanPtrCmp[] = "__sanitizer_ptr_cmp";
146 const char kAsanPtrSub[] = "__sanitizer_ptr_sub";
147 const char kAsanHandleNoReturnName[] = "__asan_handle_no_return";
148 static const int kMaxAsanStackMallocSizeClass = 10;
149 const char kAsanStackMallocNameTemplate[] = "__asan_stack_malloc_";
151  "__asan_stack_malloc_always_";
152 const char kAsanStackFreeNameTemplate[] = "__asan_stack_free_";
153 const char kAsanGenPrefix[] = "___asan_gen_";
154 const char kODRGenPrefix[] = "__odr_asan_gen_";
155 const char kSanCovGenPrefix[] = "__sancov_gen_";
156 const char kAsanSetShadowPrefix[] = "__asan_set_shadow_";
157 const char kAsanPoisonStackMemoryName[] = "__asan_poison_stack_memory";
158 const char kAsanUnpoisonStackMemoryName[] = "__asan_unpoison_stack_memory";
159 
160 // ASan version script has __asan_* wildcard. Triple underscore prevents a
161 // linker (gold) warning about attempting to export a local symbol.
162 const char kAsanGlobalsRegisteredFlagName[] = "___asan_globals_registered";
163 
165  "__asan_option_detect_stack_use_after_return";
166 
168  "__asan_shadow_memory_dynamic_address";
169 
170 const char kAsanAllocaPoison[] = "__asan_alloca_poison";
171 const char kAsanAllocasUnpoison[] = "__asan_allocas_unpoison";
172 
173 const char kAMDGPUAddressSharedName[] = "llvm.amdgcn.is.shared";
174 const char kAMDGPUAddressPrivateName[] = "llvm.amdgcn.is.private";
175 
176 // Accesses sizes are powers of two: 1, 2, 4, 8, 16.
177 static const size_t kNumberOfAccessSizes = 5;
178 
179 static const unsigned kAllocaRzSize = 32;
180 
181 // Command-line flags.
182 
184  "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"),
185  cl::Hidden, cl::init(false));
186 
187 static cl::opt<bool> ClRecover(
188  "asan-recover",
189  cl::desc("Enable recovery mode (continue-after-error)."),
190  cl::Hidden, cl::init(false));
191 
193  "asan-guard-against-version-mismatch",
194  cl::desc("Guard against compiler/runtime version mismatch."),
195  cl::Hidden, cl::init(true));
196 
197 // This flag may need to be replaced with -f[no-]asan-reads.
198 static cl::opt<bool> ClInstrumentReads("asan-instrument-reads",
199  cl::desc("instrument read instructions"),
200  cl::Hidden, cl::init(true));
201 
203  "asan-instrument-writes", cl::desc("instrument write instructions"),
204  cl::Hidden, cl::init(true));
205 
207  "asan-instrument-atomics",
208  cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden,
209  cl::init(true));
210 
211 static cl::opt<bool>
212  ClInstrumentByval("asan-instrument-byval",
213  cl::desc("instrument byval call arguments"), cl::Hidden,
214  cl::init(true));
215 
217  "asan-always-slow-path",
218  cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden,
219  cl::init(false));
220 
222  "asan-force-dynamic-shadow",
223  cl::desc("Load shadow address into a local variable for each function"),
224  cl::Hidden, cl::init(false));
225 
226 static cl::opt<bool>
227  ClWithIfunc("asan-with-ifunc",
228  cl::desc("Access dynamic shadow through an ifunc global on "
229  "platforms that support this"),
230  cl::Hidden, cl::init(true));
231 
233  "asan-with-ifunc-suppress-remat",
234  cl::desc("Suppress rematerialization of dynamic shadow address by passing "
235  "it through inline asm in prologue."),
236  cl::Hidden, cl::init(true));
237 
238 // This flag limits the number of instructions to be instrumented
239 // in any given BB. Normally, this should be set to unlimited (INT_MAX),
240 // but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary
241 // set it to 10000.
243  "asan-max-ins-per-bb", cl::init(10000),
244  cl::desc("maximal number of instructions to instrument in any given BB"),
245  cl::Hidden);
246 
247 // This flag may need to be replaced with -f[no]asan-stack.
248 static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"),
249  cl::Hidden, cl::init(true));
251  "asan-max-inline-poisoning-size",
252  cl::desc(
253  "Inline shadow poisoning for blocks up to the given size in bytes."),
254  cl::Hidden, cl::init(64));
255 
257  "asan-use-after-return",
258  cl::desc("Sets the mode of detection for stack-use-after-return."),
259  cl::values(
261  "Never detect stack use after return."),
262  clEnumValN(
264  "Detect stack use after return if "
265  "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set."),
267  "Always detect stack use after return.")),
269 
270 static cl::opt<bool> ClRedzoneByvalArgs("asan-redzone-byval-args",
271  cl::desc("Create redzones for byval "
272  "arguments (extra copy "
273  "required)"), cl::Hidden,
274  cl::init(true));
275 
276 static cl::opt<bool> ClUseAfterScope("asan-use-after-scope",
277  cl::desc("Check stack-use-after-scope"),
278  cl::Hidden, cl::init(false));
279 
280 // This flag may need to be replaced with -f[no]asan-globals.
281 static cl::opt<bool> ClGlobals("asan-globals",
282  cl::desc("Handle global objects"), cl::Hidden,
283  cl::init(true));
284 
285 static cl::opt<bool> ClInitializers("asan-initialization-order",
286  cl::desc("Handle C++ initializer order"),
287  cl::Hidden, cl::init(true));
288 
290  "asan-detect-invalid-pointer-pair",
291  cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden,
292  cl::init(false));
293 
295  "asan-detect-invalid-pointer-cmp",
296  cl::desc("Instrument <, <=, >, >= with pointer operands"), cl::Hidden,
297  cl::init(false));
298 
300  "asan-detect-invalid-pointer-sub",
301  cl::desc("Instrument - operations with pointer operands"), cl::Hidden,
302  cl::init(false));
303 
305  "asan-realign-stack",
306  cl::desc("Realign stack to the value of this flag (power of two)"),
307  cl::Hidden, cl::init(32));
308 
310  "asan-instrumentation-with-call-threshold",
311  cl::desc(
312  "If the function being instrumented contains more than "
313  "this number of memory accesses, use callbacks instead of "
314  "inline checks (-1 means never use callbacks)."),
315  cl::Hidden, cl::init(7000));
316 
318  "asan-memory-access-callback-prefix",
319  cl::desc("Prefix for memory access callbacks"), cl::Hidden,
320  cl::init("__asan_"));
321 
322 static cl::opt<bool>
323  ClInstrumentDynamicAllocas("asan-instrument-dynamic-allocas",
324  cl::desc("instrument dynamic allocas"),
325  cl::Hidden, cl::init(true));
326 
328  "asan-skip-promotable-allocas",
329  cl::desc("Do not instrument promotable allocas"), cl::Hidden,
330  cl::init(true));
331 
332 // These flags allow to change the shadow mapping.
333 // The shadow mapping looks like
334 // Shadow = (Mem >> scale) + offset
335 
336 static cl::opt<int> ClMappingScale("asan-mapping-scale",
337  cl::desc("scale of asan shadow mapping"),
338  cl::Hidden, cl::init(0));
339 
340 static cl::opt<uint64_t>
341  ClMappingOffset("asan-mapping-offset",
342  cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"),
343  cl::Hidden, cl::init(0));
344 
345 // Optimization flags. Not user visible, used mostly for testing
346 // and benchmarking the tool.
347 
348 static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"),
349  cl::Hidden, cl::init(true));
350 
352  "asan-opt-same-temp", cl::desc("Instrument the same temp just once"),
353  cl::Hidden, cl::init(true));
354 
355 static cl::opt<bool> ClOptGlobals("asan-opt-globals",
356  cl::desc("Don't instrument scalar globals"),
357  cl::Hidden, cl::init(true));
358 
360  "asan-opt-stack", cl::desc("Don't instrument scalar stack variables"),
361  cl::Hidden, cl::init(false));
362 
364  "asan-stack-dynamic-alloca",
365  cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden,
366  cl::init(true));
367 
369  "asan-force-experiment",
370  cl::desc("Force optimization experiment (for testing)"), cl::Hidden,
371  cl::init(0));
372 
373 static cl::opt<bool>
374  ClUsePrivateAlias("asan-use-private-alias",
375  cl::desc("Use private aliases for global variables"),
376  cl::Hidden, cl::init(false));
377 
378 static cl::opt<bool>
379  ClUseOdrIndicator("asan-use-odr-indicator",
380  cl::desc("Use odr indicators to improve ODR reporting"),
381  cl::Hidden, cl::init(false));
382 
383 static cl::opt<bool>
384  ClUseGlobalsGC("asan-globals-live-support",
385  cl::desc("Use linker features to support dead "
386  "code stripping of globals"),
387  cl::Hidden, cl::init(true));
388 
389 // This is on by default even though there is a bug in gold:
390 // https://sourceware.org/bugzilla/show_bug.cgi?id=19002
391 static cl::opt<bool>
392  ClWithComdat("asan-with-comdat",
393  cl::desc("Place ASan constructors in comdat sections"),
394  cl::Hidden, cl::init(true));
395 
397  "asan-destructor-kind",
398  cl::desc("Sets the ASan destructor kind. The default is to use the value "
399  "provided to the pass constructor"),
400  cl::values(clEnumValN(AsanDtorKind::None, "none", "No destructors"),
402  "Use global destructors")),
404 
405 // Debug flags.
406 
407 static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden,
408  cl::init(0));
409 
410 static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"),
411  cl::Hidden, cl::init(0));
412 
413 static cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden,
414  cl::desc("Debug func"));
415 
416 static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"),
417  cl::Hidden, cl::init(-1));
418 
419 static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug max inst"),
420  cl::Hidden, cl::init(-1));
421 
422 STATISTIC(NumInstrumentedReads, "Number of instrumented reads");
423 STATISTIC(NumInstrumentedWrites, "Number of instrumented writes");
424 STATISTIC(NumOptimizedAccessesToGlobalVar,
425  "Number of optimized accesses to global vars");
426 STATISTIC(NumOptimizedAccessesToStackVar,
427  "Number of optimized accesses to stack vars");
428 
429 namespace {
430 
431 /// This struct defines the shadow mapping using the rule:
432 /// shadow = (mem >> Scale) ADD-or-OR Offset.
433 /// If InGlobal is true, then
434 /// extern char __asan_shadow[];
435 /// shadow = (mem >> Scale) + &__asan_shadow
436 struct ShadowMapping {
437  int Scale;
438  uint64_t Offset;
439  bool OrShadowOffset;
440  bool InGlobal;
441 };
442 
443 } // end anonymous namespace
444 
445 static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize,
446  bool IsKasan) {
447  bool IsAndroid = TargetTriple.isAndroid();
448  bool IsIOS = TargetTriple.isiOS() || TargetTriple.isWatchOS();
449  bool IsMacOS = TargetTriple.isMacOSX();
450  bool IsFreeBSD = TargetTriple.isOSFreeBSD();
451  bool IsNetBSD = TargetTriple.isOSNetBSD();
452  bool IsPS4CPU = TargetTriple.isPS4CPU();
453  bool IsLinux = TargetTriple.isOSLinux();
454  bool IsPPC64 = TargetTriple.getArch() == Triple::ppc64 ||
455  TargetTriple.getArch() == Triple::ppc64le;
456  bool IsSystemZ = TargetTriple.getArch() == Triple::systemz;
457  bool IsX86_64 = TargetTriple.getArch() == Triple::x86_64;
458  bool IsMIPS32 = TargetTriple.isMIPS32();
459  bool IsMIPS64 = TargetTriple.isMIPS64();
460  bool IsArmOrThumb = TargetTriple.isARM() || TargetTriple.isThumb();
461  bool IsAArch64 = TargetTriple.getArch() == Triple::aarch64;
462  bool IsRISCV64 = TargetTriple.getArch() == Triple::riscv64;
463  bool IsWindows = TargetTriple.isOSWindows();
464  bool IsFuchsia = TargetTriple.isOSFuchsia();
465  bool IsEmscripten = TargetTriple.isOSEmscripten();
466  bool IsAMDGPU = TargetTriple.isAMDGPU();
467 
468  ShadowMapping Mapping;
469 
470  Mapping.Scale = kDefaultShadowScale;
471  if (ClMappingScale.getNumOccurrences() > 0) {
472  Mapping.Scale = ClMappingScale;
473  }
474 
475  if (LongSize == 32) {
476  if (IsAndroid)
477  Mapping.Offset = kDynamicShadowSentinel;
478  else if (IsMIPS32)
479  Mapping.Offset = kMIPS32_ShadowOffset32;
480  else if (IsFreeBSD)
481  Mapping.Offset = kFreeBSD_ShadowOffset32;
482  else if (IsNetBSD)
483  Mapping.Offset = kNetBSD_ShadowOffset32;
484  else if (IsIOS)
485  Mapping.Offset = kDynamicShadowSentinel;
486  else if (IsWindows)
487  Mapping.Offset = kWindowsShadowOffset32;
488  else if (IsEmscripten)
489  Mapping.Offset = kEmscriptenShadowOffset;
490  else
491  Mapping.Offset = kDefaultShadowOffset32;
492  } else { // LongSize == 64
493  // Fuchsia is always PIE, which means that the beginning of the address
494  // space is always available.
495  if (IsFuchsia)
496  Mapping.Offset = 0;
497  else if (IsPPC64)
498  Mapping.Offset = kPPC64_ShadowOffset64;
499  else if (IsSystemZ)
500  Mapping.Offset = kSystemZ_ShadowOffset64;
501  else if (IsFreeBSD && !IsMIPS64) {
502  if (IsKasan)
503  Mapping.Offset = kFreeBSDKasan_ShadowOffset64;
504  else
505  Mapping.Offset = kFreeBSD_ShadowOffset64;
506  } else if (IsNetBSD) {
507  if (IsKasan)
508  Mapping.Offset = kNetBSDKasan_ShadowOffset64;
509  else
510  Mapping.Offset = kNetBSD_ShadowOffset64;
511  } else if (IsPS4CPU)
512  Mapping.Offset = kPS4CPU_ShadowOffset64;
513  else if (IsLinux && IsX86_64) {
514  if (IsKasan)
515  Mapping.Offset = kLinuxKasan_ShadowOffset64;
516  else
517  Mapping.Offset = (kSmallX86_64ShadowOffsetBase &
518  (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale));
519  } else if (IsWindows && IsX86_64) {
520  Mapping.Offset = kWindowsShadowOffset64;
521  } else if (IsMIPS64)
522  Mapping.Offset = kMIPS64_ShadowOffset64;
523  else if (IsIOS)
524  Mapping.Offset = kDynamicShadowSentinel;
525  else if (IsMacOS && IsAArch64)
526  Mapping.Offset = kDynamicShadowSentinel;
527  else if (IsAArch64)
528  Mapping.Offset = kAArch64_ShadowOffset64;
529  else if (IsRISCV64)
530  Mapping.Offset = kRISCV64_ShadowOffset64;
531  else if (IsAMDGPU)
532  Mapping.Offset = (kSmallX86_64ShadowOffsetBase &
533  (kSmallX86_64ShadowOffsetAlignMask << Mapping.Scale));
534  else
535  Mapping.Offset = kDefaultShadowOffset64;
536  }
537 
538  if (ClForceDynamicShadow) {
539  Mapping.Offset = kDynamicShadowSentinel;
540  }
541 
542  if (ClMappingOffset.getNumOccurrences() > 0) {
543  Mapping.Offset = ClMappingOffset;
544  }
545 
546  // OR-ing shadow offset if more efficient (at least on x86) if the offset
547  // is a power of two, but on ppc64 we have to use add since the shadow
548  // offset is not necessary 1/8-th of the address space. On SystemZ,
549  // we could OR the constant in a single instruction, but it's more
550  // efficient to load it once and use indexed addressing.
551  Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 && !IsSystemZ && !IsPS4CPU &&
552  !IsRISCV64 &&
553  !(Mapping.Offset & (Mapping.Offset - 1)) &&
554  Mapping.Offset != kDynamicShadowSentinel;
555  bool IsAndroidWithIfuncSupport =
556  IsAndroid && !TargetTriple.isAndroidVersionLT(21);
557  Mapping.InGlobal = ClWithIfunc && IsAndroidWithIfuncSupport && IsArmOrThumb;
558 
559  return Mapping;
560 }
561 
562 static uint64_t getRedzoneSizeForScale(int MappingScale) {
563  // Redzone used for stack and globals is at least 32 bytes.
564  // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively.
565  return std::max(32U, 1U << MappingScale);
566 }
567 
568 static uint64_t GetCtorAndDtorPriority(Triple &TargetTriple) {
569  if (TargetTriple.isOSEmscripten()) {
571  } else {
573  }
574 }
575 
576 namespace {
577 
578 /// Module analysis for getting various metadata about the module.
579 class ASanGlobalsMetadataWrapperPass : public ModulePass {
580 public:
581  static char ID;
582 
583  ASanGlobalsMetadataWrapperPass() : ModulePass(ID) {
586  }
587 
588  bool runOnModule(Module &M) override {
589  GlobalsMD = GlobalsMetadata(M);
590  return false;
591  }
592 
593  StringRef getPassName() const override {
594  return "ASanGlobalsMetadataWrapperPass";
595  }
596 
597  void getAnalysisUsage(AnalysisUsage &AU) const override {
598  AU.setPreservesAll();
599  }
600 
601  GlobalsMetadata &getGlobalsMD() { return GlobalsMD; }
602 
603 private:
604  GlobalsMetadata GlobalsMD;
605 };
606 
608 
609 /// AddressSanitizer: instrument the code in module to find memory bugs.
610 struct AddressSanitizer {
611  AddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD,
612  bool CompileKernel = false, bool Recover = false,
613  bool UseAfterScope = false,
614  AsanDetectStackUseAfterReturnMode UseAfterReturn =
616  : CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan
617  : CompileKernel),
618  Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover),
619  UseAfterScope(UseAfterScope || ClUseAfterScope),
620  UseAfterReturn(ClUseAfterReturn.getNumOccurrences() ? ClUseAfterReturn
621  : UseAfterReturn),
622  GlobalsMD(*GlobalsMD) {
623  C = &(M.getContext());
624  LongSize = M.getDataLayout().getPointerSizeInBits();
625  IntptrTy = Type::getIntNTy(*C, LongSize);
626  TargetTriple = Triple(M.getTargetTriple());
627 
628  Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel);
629 
630  assert(this->UseAfterReturn != AsanDetectStackUseAfterReturnMode::Invalid);
631  }
632 
633  uint64_t getAllocaSizeInBytes(const AllocaInst &AI) const {
634  uint64_t ArraySize = 1;
635  if (AI.isArrayAllocation()) {
636  const ConstantInt *CI = dyn_cast<ConstantInt>(AI.getArraySize());
637  assert(CI && "non-constant array size");
638  ArraySize = CI->getZExtValue();
639  }
640  Type *Ty = AI.getAllocatedType();
641  uint64_t SizeInBytes =
643  return SizeInBytes * ArraySize;
644  }
645 
646  /// Check if we want (and can) handle this alloca.
647  bool isInterestingAlloca(const AllocaInst &AI);
648 
649  bool ignoreAccess(Value *Ptr);
650  void getInterestingMemoryOperands(
652 
653  void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
654  InterestingMemoryOperand &O, bool UseCalls,
655  const DataLayout &DL);
656  void instrumentPointerComparisonOrSubtraction(Instruction *I);
657  void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore,
658  Value *Addr, uint32_t TypeSize, bool IsWrite,
659  Value *SizeArgument, bool UseCalls, uint32_t Exp);
660  Instruction *instrumentAMDGPUAddress(Instruction *OrigIns,
661  Instruction *InsertBefore, Value *Addr,
662  uint32_t TypeSize, bool IsWrite,
663  Value *SizeArgument);
664  void instrumentUnusualSizeOrAlignment(Instruction *I,
665  Instruction *InsertBefore, Value *Addr,
666  uint32_t TypeSize, bool IsWrite,
667  Value *SizeArgument, bool UseCalls,
668  uint32_t Exp);
669  Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
670  Value *ShadowValue, uint32_t TypeSize);
671  Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
672  bool IsWrite, size_t AccessSizeIndex,
673  Value *SizeArgument, uint32_t Exp);
674  void instrumentMemIntrinsic(MemIntrinsic *MI);
675  Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
676  bool suppressInstrumentationSiteForDebug(int &Instrumented);
677  bool instrumentFunction(Function &F, const TargetLibraryInfo *TLI);
678  bool maybeInsertAsanInitAtFunctionEntry(Function &F);
679  bool maybeInsertDynamicShadowAtFunctionEntry(Function &F);
680  void markEscapedLocalAllocas(Function &F);
681 
682 private:
683  friend struct FunctionStackPoisoner;
684 
685  void initializeCallbacks(Module &M);
686 
687  bool LooksLikeCodeInBug11395(Instruction *I);
688  bool GlobalIsLinkerInitialized(GlobalVariable *G);
689  bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr,
690  uint64_t TypeSize) const;
691 
692  /// Helper to cleanup per-function state.
693  struct FunctionStateRAII {
695 
696  FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) {
697  assert(Pass->ProcessedAllocas.empty() &&
698  "last pass forgot to clear cache");
699  assert(!Pass->LocalDynamicShadow);
700  }
701 
702  ~FunctionStateRAII() {
703  Pass->LocalDynamicShadow = nullptr;
704  Pass->ProcessedAllocas.clear();
705  }
706  };
707 
708  LLVMContext *C;
709  Triple TargetTriple;
710  int LongSize;
711  bool CompileKernel;
712  bool Recover;
713  bool UseAfterScope;
714  AsanDetectStackUseAfterReturnMode UseAfterReturn;
715  Type *IntptrTy;
716  ShadowMapping Mapping;
717  FunctionCallee AsanHandleNoReturnFunc;
718  FunctionCallee AsanPtrCmpFunction, AsanPtrSubFunction;
719  Constant *AsanShadowGlobal;
720 
721  // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize).
722  FunctionCallee AsanErrorCallback[2][2][kNumberOfAccessSizes];
723  FunctionCallee AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes];
724 
725  // These arrays is indexed by AccessIsWrite and Experiment.
726  FunctionCallee AsanErrorCallbackSized[2][2];
727  FunctionCallee AsanMemoryAccessCallbackSized[2][2];
728 
729  FunctionCallee AsanMemmove, AsanMemcpy, AsanMemset;
730  Value *LocalDynamicShadow = nullptr;
731  const GlobalsMetadata &GlobalsMD;
732  DenseMap<const AllocaInst *, bool> ProcessedAllocas;
733 
734  FunctionCallee AMDGPUAddressShared;
735  FunctionCallee AMDGPUAddressPrivate;
736 };
737 
738 class AddressSanitizerLegacyPass : public FunctionPass {
739 public:
740  static char ID;
741 
742  explicit AddressSanitizerLegacyPass(
743  bool CompileKernel = false, bool Recover = false,
744  bool UseAfterScope = false,
745  AsanDetectStackUseAfterReturnMode UseAfterReturn =
747  : FunctionPass(ID), CompileKernel(CompileKernel), Recover(Recover),
748  UseAfterScope(UseAfterScope), UseAfterReturn(UseAfterReturn) {
750  }
751 
752  StringRef getPassName() const override {
753  return "AddressSanitizerFunctionPass";
754  }
755 
756  void getAnalysisUsage(AnalysisUsage &AU) const override {
757  AU.addRequired<ASanGlobalsMetadataWrapperPass>();
759  }
760 
761  bool runOnFunction(Function &F) override {
762  GlobalsMetadata &GlobalsMD =
763  getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD();
764  const TargetLibraryInfo *TLI =
765  &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
766  AddressSanitizer ASan(*F.getParent(), &GlobalsMD, CompileKernel, Recover,
767  UseAfterScope, UseAfterReturn);
768  return ASan.instrumentFunction(F, TLI);
769  }
770 
771 private:
772  bool CompileKernel;
773  bool Recover;
774  bool UseAfterScope;
775  AsanDetectStackUseAfterReturnMode UseAfterReturn;
776 };
777 
778 class ModuleAddressSanitizer {
779 public:
780  ModuleAddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD,
781  bool CompileKernel = false, bool Recover = false,
782  bool UseGlobalsGC = true, bool UseOdrIndicator = false,
783  AsanDtorKind DestructorKind = AsanDtorKind::Global)
784  : GlobalsMD(*GlobalsMD),
785  CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan
786  : CompileKernel),
787  Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover),
788  UseGlobalsGC(UseGlobalsGC && ClUseGlobalsGC && !this->CompileKernel),
789  // Enable aliases as they should have no downside with ODR indicators.
790  UsePrivateAlias(UseOdrIndicator || ClUsePrivateAlias),
791  UseOdrIndicator(UseOdrIndicator || ClUseOdrIndicator),
792  // Not a typo: ClWithComdat is almost completely pointless without
793  // ClUseGlobalsGC (because then it only works on modules without
794  // globals, which are rare); it is a prerequisite for ClUseGlobalsGC;
795  // and both suffer from gold PR19002 for which UseGlobalsGC constructor
796  // argument is designed as workaround. Therefore, disable both
797  // ClWithComdat and ClUseGlobalsGC unless the frontend says it's ok to
798  // do globals-gc.
799  UseCtorComdat(UseGlobalsGC && ClWithComdat && !this->CompileKernel),
800  DestructorKind(DestructorKind) {
801  C = &(M.getContext());
802  int LongSize = M.getDataLayout().getPointerSizeInBits();
803  IntptrTy = Type::getIntNTy(*C, LongSize);
804  TargetTriple = Triple(M.getTargetTriple());
805  Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel);
806 
808  this->DestructorKind = ClOverrideDestructorKind;
809  assert(this->DestructorKind != AsanDtorKind::Invalid);
810  }
811 
812  bool instrumentModule(Module &);
813 
814 private:
815  void initializeCallbacks(Module &M);
816 
817  bool InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat);
818  void InstrumentGlobalsCOFF(IRBuilder<> &IRB, Module &M,
819  ArrayRef<GlobalVariable *> ExtendedGlobals,
820  ArrayRef<Constant *> MetadataInitializers);
821  void InstrumentGlobalsELF(IRBuilder<> &IRB, Module &M,
822  ArrayRef<GlobalVariable *> ExtendedGlobals,
823  ArrayRef<Constant *> MetadataInitializers,
824  const std::string &UniqueModuleId);
825  void InstrumentGlobalsMachO(IRBuilder<> &IRB, Module &M,
826  ArrayRef<GlobalVariable *> ExtendedGlobals,
827  ArrayRef<Constant *> MetadataInitializers);
828  void
829  InstrumentGlobalsWithMetadataArray(IRBuilder<> &IRB, Module &M,
830  ArrayRef<GlobalVariable *> ExtendedGlobals,
831  ArrayRef<Constant *> MetadataInitializers);
832 
833  GlobalVariable *CreateMetadataGlobal(Module &M, Constant *Initializer,
834  StringRef OriginalName);
835  void SetComdatForGlobalMetadata(GlobalVariable *G, GlobalVariable *Metadata,
836  StringRef InternalSuffix);
837  Instruction *CreateAsanModuleDtor(Module &M);
838 
839  const GlobalVariable *getExcludedAliasedGlobal(const GlobalAlias &GA) const;
840  bool shouldInstrumentGlobal(GlobalVariable *G) const;
841  bool ShouldUseMachOGlobalsSection() const;
842  StringRef getGlobalMetadataSection() const;
843  void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName);
844  void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName);
845  uint64_t getMinRedzoneSizeForGlobal() const {
846  return getRedzoneSizeForScale(Mapping.Scale);
847  }
848  uint64_t getRedzoneSizeForGlobal(uint64_t SizeInBytes) const;
849  int GetAsanVersion(const Module &M) const;
850 
851  const GlobalsMetadata &GlobalsMD;
852  bool CompileKernel;
853  bool Recover;
854  bool UseGlobalsGC;
855  bool UsePrivateAlias;
856  bool UseOdrIndicator;
857  bool UseCtorComdat;
858  AsanDtorKind DestructorKind;
859  Type *IntptrTy;
860  LLVMContext *C;
861  Triple TargetTriple;
862  ShadowMapping Mapping;
863  FunctionCallee AsanPoisonGlobals;
864  FunctionCallee AsanUnpoisonGlobals;
865  FunctionCallee AsanRegisterGlobals;
866  FunctionCallee AsanUnregisterGlobals;
867  FunctionCallee AsanRegisterImageGlobals;
868  FunctionCallee AsanUnregisterImageGlobals;
869  FunctionCallee AsanRegisterElfGlobals;
870  FunctionCallee AsanUnregisterElfGlobals;
871 
872  Function *AsanCtorFunction = nullptr;
873  Function *AsanDtorFunction = nullptr;
874 };
875 
876 class ModuleAddressSanitizerLegacyPass : public ModulePass {
877 public:
878  static char ID;
879 
880  explicit ModuleAddressSanitizerLegacyPass(
881  bool CompileKernel = false, bool Recover = false, bool UseGlobalGC = true,
882  bool UseOdrIndicator = false,
883  AsanDtorKind DestructorKind = AsanDtorKind::Global)
884  : ModulePass(ID), CompileKernel(CompileKernel), Recover(Recover),
885  UseGlobalGC(UseGlobalGC), UseOdrIndicator(UseOdrIndicator),
886  DestructorKind(DestructorKind) {
889  }
890 
891  StringRef getPassName() const override { return "ModuleAddressSanitizer"; }
892 
893  void getAnalysisUsage(AnalysisUsage &AU) const override {
894  AU.addRequired<ASanGlobalsMetadataWrapperPass>();
895  }
896 
897  bool runOnModule(Module &M) override {
898  GlobalsMetadata &GlobalsMD =
899  getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD();
900  ModuleAddressSanitizer ASanModule(M, &GlobalsMD, CompileKernel, Recover,
901  UseGlobalGC, UseOdrIndicator,
902  DestructorKind);
903  return ASanModule.instrumentModule(M);
904  }
905 
906 private:
907  bool CompileKernel;
908  bool Recover;
909  bool UseGlobalGC;
910  bool UseOdrIndicator;
911  AsanDtorKind DestructorKind;
912 };
913 
914 // Stack poisoning does not play well with exception handling.
915 // When an exception is thrown, we essentially bypass the code
916 // that unpoisones the stack. This is why the run-time library has
917 // to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire
918 // stack in the interceptor. This however does not work inside the
919 // actual function which catches the exception. Most likely because the
920 // compiler hoists the load of the shadow value somewhere too high.
921 // This causes asan to report a non-existing bug on 453.povray.
922 // It sounds like an LLVM bug.
923 struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
924  Function &F;
925  AddressSanitizer &ASan;
926  DIBuilder DIB;
927  LLVMContext *C;
928  Type *IntptrTy;
929  Type *IntptrPtrTy;
930  ShadowMapping Mapping;
931 
933  SmallVector<AllocaInst *, 16> StaticAllocasToMoveUp;
935 
936  FunctionCallee AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1],
937  AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1];
938  FunctionCallee AsanSetShadowFunc[0x100] = {};
939  FunctionCallee AsanPoisonStackMemoryFunc, AsanUnpoisonStackMemoryFunc;
940  FunctionCallee AsanAllocaPoisonFunc, AsanAllocasUnpoisonFunc;
941 
942  // Stores a place and arguments of poisoning/unpoisoning call for alloca.
943  struct AllocaPoisonCall {
944  IntrinsicInst *InsBefore;
945  AllocaInst *AI;
946  uint64_t Size;
947  bool DoPoison;
948  };
949  SmallVector<AllocaPoisonCall, 8> DynamicAllocaPoisonCallVec;
950  SmallVector<AllocaPoisonCall, 8> StaticAllocaPoisonCallVec;
951  bool HasUntracedLifetimeIntrinsic = false;
952 
953  SmallVector<AllocaInst *, 1> DynamicAllocaVec;
954  SmallVector<IntrinsicInst *, 1> StackRestoreVec;
955  AllocaInst *DynamicAllocaLayout = nullptr;
956  IntrinsicInst *LocalEscapeCall = nullptr;
957 
958  bool HasInlineAsm = false;
959  bool HasReturnsTwiceCall = false;
960  bool PoisonStack;
961 
962  FunctionStackPoisoner(Function &F, AddressSanitizer &ASan)
963  : F(F), ASan(ASan), DIB(*F.getParent(), /*AllowUnresolved*/ false),
964  C(ASan.C), IntptrTy(ASan.IntptrTy),
965  IntptrPtrTy(PointerType::get(IntptrTy, 0)), Mapping(ASan.Mapping),
966  PoisonStack(ClStack &&
967  !Triple(F.getParent()->getTargetTriple()).isAMDGPU()) {}
968 
969  bool runOnFunction() {
970  if (!PoisonStack)
971  return false;
972 
973  if (ClRedzoneByvalArgs)
974  copyArgsPassedByValToAllocas();
975 
976  // Collect alloca, ret, lifetime instructions etc.
977  for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB);
978 
979  if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false;
980 
981  initializeCallbacks(*F.getParent());
982 
983  if (HasUntracedLifetimeIntrinsic) {
984  // If there are lifetime intrinsics which couldn't be traced back to an
985  // alloca, we may not know exactly when a variable enters scope, and
986  // therefore should "fail safe" by not poisoning them.
987  StaticAllocaPoisonCallVec.clear();
988  DynamicAllocaPoisonCallVec.clear();
989  }
990 
991  processDynamicAllocas();
992  processStaticAllocas();
993 
994  if (ClDebugStack) {
995  LLVM_DEBUG(dbgs() << F);
996  }
997  return true;
998  }
999 
1000  // Arguments marked with the "byval" attribute are implicitly copied without
1001  // using an alloca instruction. To produce redzones for those arguments, we
1002  // copy them a second time into memory allocated with an alloca instruction.
1003  void copyArgsPassedByValToAllocas();
1004 
1005  // Finds all Alloca instructions and puts
1006  // poisoned red zones around all of them.
1007  // Then unpoison everything back before the function returns.
1008  void processStaticAllocas();
1009  void processDynamicAllocas();
1010 
1011  void createDynamicAllocasInitStorage();
1012 
1013  // ----------------------- Visitors.
1014  /// Collect all Ret instructions, or the musttail call instruction if it
1015  /// precedes the return instruction.
1016  void visitReturnInst(ReturnInst &RI) {
1017  if (CallInst *CI = RI.getParent()->getTerminatingMustTailCall())
1018  RetVec.push_back(CI);
1019  else
1020  RetVec.push_back(&RI);
1021  }
1022 
1023  /// Collect all Resume instructions.
1024  void visitResumeInst(ResumeInst &RI) { RetVec.push_back(&RI); }
1025 
1026  /// Collect all CatchReturnInst instructions.
1027  void visitCleanupReturnInst(CleanupReturnInst &CRI) { RetVec.push_back(&CRI); }
1028 
1029  void unpoisonDynamicAllocasBeforeInst(Instruction *InstBefore,
1030  Value *SavedStack) {
1031  IRBuilder<> IRB(InstBefore);
1032  Value *DynamicAreaPtr = IRB.CreatePtrToInt(SavedStack, IntptrTy);
1033  // When we insert _asan_allocas_unpoison before @llvm.stackrestore, we
1034  // need to adjust extracted SP to compute the address of the most recent
1035  // alloca. We have a special @llvm.get.dynamic.area.offset intrinsic for
1036  // this purpose.
1037  if (!isa<ReturnInst>(InstBefore)) {
1038  Function *DynamicAreaOffsetFunc = Intrinsic::getDeclaration(
1039  InstBefore->getModule(), Intrinsic::get_dynamic_area_offset,
1040  {IntptrTy});
1041 
1042  Value *DynamicAreaOffset = IRB.CreateCall(DynamicAreaOffsetFunc, {});
1043 
1044  DynamicAreaPtr = IRB.CreateAdd(IRB.CreatePtrToInt(SavedStack, IntptrTy),
1045  DynamicAreaOffset);
1046  }
1047 
1048  IRB.CreateCall(
1049  AsanAllocasUnpoisonFunc,
1050  {IRB.CreateLoad(IntptrTy, DynamicAllocaLayout), DynamicAreaPtr});
1051  }
1052 
1053  // Unpoison dynamic allocas redzones.
1054  void unpoisonDynamicAllocas() {
1055  for (Instruction *Ret : RetVec)
1056  unpoisonDynamicAllocasBeforeInst(Ret, DynamicAllocaLayout);
1057 
1058  for (Instruction *StackRestoreInst : StackRestoreVec)
1059  unpoisonDynamicAllocasBeforeInst(StackRestoreInst,
1060  StackRestoreInst->getOperand(0));
1061  }
1062 
1063  // Deploy and poison redzones around dynamic alloca call. To do this, we
1064  // should replace this call with another one with changed parameters and
1065  // replace all its uses with new address, so
1066  // addr = alloca type, old_size, align
1067  // is replaced by
1068  // new_size = (old_size + additional_size) * sizeof(type)
1069  // tmp = alloca i8, new_size, max(align, 32)
1070  // addr = tmp + 32 (first 32 bytes are for the left redzone).
1071  // Additional_size is added to make new memory allocation contain not only
1072  // requested memory, but also left, partial and right redzones.
1073  void handleDynamicAllocaCall(AllocaInst *AI);
1074 
1075  /// Collect Alloca instructions we want (and can) handle.
1076  void visitAllocaInst(AllocaInst &AI) {
1077  if (!ASan.isInterestingAlloca(AI)) {
1078  if (AI.isStaticAlloca()) {
1079  // Skip over allocas that are present *before* the first instrumented
1080  // alloca, we don't want to move those around.
1081  if (AllocaVec.empty())
1082  return;
1083 
1084  StaticAllocasToMoveUp.push_back(&AI);
1085  }
1086  return;
1087  }
1088 
1089  if (!AI.isStaticAlloca())
1090  DynamicAllocaVec.push_back(&AI);
1091  else
1092  AllocaVec.push_back(&AI);
1093  }
1094 
1095  /// Collect lifetime intrinsic calls to check for use-after-scope
1096  /// errors.
1097  void visitIntrinsicInst(IntrinsicInst &II) {
1099  if (ID == Intrinsic::stackrestore) StackRestoreVec.push_back(&II);
1100  if (ID == Intrinsic::localescape) LocalEscapeCall = &II;
1101  if (!ASan.UseAfterScope)
1102  return;
1103  if (!II.isLifetimeStartOrEnd())
1104  return;
1105  // Found lifetime intrinsic, add ASan instrumentation if necessary.
1106  auto *Size = cast<ConstantInt>(II.getArgOperand(0));
1107  // If size argument is undefined, don't do anything.
1108  if (Size->isMinusOne()) return;
1109  // Check that size doesn't saturate uint64_t and can
1110  // be stored in IntptrTy.
1111  const uint64_t SizeValue = Size->getValue().getLimitedValue();
1112  if (SizeValue == ~0ULL ||
1113  !ConstantInt::isValueValidForType(IntptrTy, SizeValue))
1114  return;
1115  // Find alloca instruction that corresponds to llvm.lifetime argument.
1116  // Currently we can only handle lifetime markers pointing to the
1117  // beginning of the alloca.
1118  AllocaInst *AI = findAllocaForValue(II.getArgOperand(1), true);
1119  if (!AI) {
1120  HasUntracedLifetimeIntrinsic = true;
1121  return;
1122  }
1123  // We're interested only in allocas we can handle.
1124  if (!ASan.isInterestingAlloca(*AI))
1125  return;
1126  bool DoPoison = (ID == Intrinsic::lifetime_end);
1127  AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison};
1128  if (AI->isStaticAlloca())
1129  StaticAllocaPoisonCallVec.push_back(APC);
1130  else if (ClInstrumentDynamicAllocas)
1131  DynamicAllocaPoisonCallVec.push_back(APC);
1132  }
1133 
1134  void visitCallBase(CallBase &CB) {
1135  if (CallInst *CI = dyn_cast<CallInst>(&CB)) {
1136  HasInlineAsm |= CI->isInlineAsm() && &CB != ASan.LocalDynamicShadow;
1137  HasReturnsTwiceCall |= CI->canReturnTwice();
1138  }
1139  }
1140 
1141  // ---------------------- Helpers.
1142  void initializeCallbacks(Module &M);
1143 
1144  // Copies bytes from ShadowBytes into shadow memory for indexes where
1145  // ShadowMask is not zero. If ShadowMask[i] is zero, we assume that
1146  // ShadowBytes[i] is constantly zero and doesn't need to be overwritten.
1147  void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes,
1148  IRBuilder<> &IRB, Value *ShadowBase);
1149  void copyToShadow(ArrayRef<uint8_t> ShadowMask, ArrayRef<uint8_t> ShadowBytes,
1150  size_t Begin, size_t End, IRBuilder<> &IRB,
1151  Value *ShadowBase);
1152  void copyToShadowInline(ArrayRef<uint8_t> ShadowMask,
1153  ArrayRef<uint8_t> ShadowBytes, size_t Begin,
1154  size_t End, IRBuilder<> &IRB, Value *ShadowBase);
1155 
1156  void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison);
1157 
1158  Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L,
1159  bool Dynamic);
1160  PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue,
1161  Instruction *ThenTerm, Value *ValueIfFalse);
1162 };
1163 
1164 } // end anonymous namespace
1165 
1167  assert(MDN->getNumOperands() == 3);
1168  MDString *DIFilename = cast<MDString>(MDN->getOperand(0));
1169  Filename = DIFilename->getString();
1170  LineNo = mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue();
1171  ColumnNo =
1172  mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue();
1173 }
1174 
1175 // FIXME: It would be cleaner to instead attach relevant metadata to the globals
1176 // we want to sanitize instead and reading this metadata on each pass over a
1177 // function instead of reading module level metadata at first.
1179  NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals");
1180  if (!Globals)
1181  return;
1182  for (auto MDN : Globals->operands()) {
1183  // Metadata node contains the global and the fields of "Entry".
1184  assert(MDN->getNumOperands() == 5);
1185  auto *V = mdconst::extract_or_null<Constant>(MDN->getOperand(0));
1186  // The optimizer may optimize away a global entirely.
1187  if (!V)
1188  continue;
1189  auto *StrippedV = V->stripPointerCasts();
1190  auto *GV = dyn_cast<GlobalVariable>(StrippedV);
1191  if (!GV)
1192  continue;
1193  // We can already have an entry for GV if it was merged with another
1194  // global.
1195  Entry &E = Entries[GV];
1196  if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1)))
1197  E.SourceLoc.parse(Loc);
1198  if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2)))
1199  E.Name = Name->getString();
1200  ConstantInt *IsDynInit = mdconst::extract<ConstantInt>(MDN->getOperand(3));
1201  E.IsDynInit |= IsDynInit->isOne();
1202  ConstantInt *IsExcluded =
1203  mdconst::extract<ConstantInt>(MDN->getOperand(4));
1204  E.IsExcluded |= IsExcluded->isOne();
1205  }
1206 }
1207 
1208 AnalysisKey ASanGlobalsMetadataAnalysis::Key;
1209 
1211  ModuleAnalysisManager &AM) {
1212  return GlobalsMetadata(M);
1213 }
1214 
1216  bool CompileKernel, bool Recover, bool UseAfterScope,
1217  AsanDetectStackUseAfterReturnMode UseAfterReturn)
1218  : CompileKernel(CompileKernel), Recover(Recover),
1219  UseAfterScope(UseAfterScope), UseAfterReturn(UseAfterReturn) {}
1220 
1223  auto &MAMProxy = AM.getResult<ModuleAnalysisManagerFunctionProxy>(F);
1224  Module &M = *F.getParent();
1225  if (auto *R = MAMProxy.getCachedResult<ASanGlobalsMetadataAnalysis>(M)) {
1227  AddressSanitizer Sanitizer(M, R, CompileKernel, Recover, UseAfterScope,
1228  UseAfterReturn);
1229  if (Sanitizer.instrumentFunction(F, TLI))
1230  return PreservedAnalyses::none();
1231  return PreservedAnalyses::all();
1232  }
1233 
1235  "The ASanGlobalsMetadataAnalysis is required to run before "
1236  "AddressSanitizer can run");
1237  return PreservedAnalyses::all();
1238 }
1239 
1241  bool CompileKernel, bool Recover, bool UseGlobalGC, bool UseOdrIndicator,
1242  AsanDtorKind DestructorKind)
1243  : CompileKernel(CompileKernel), Recover(Recover), UseGlobalGC(UseGlobalGC),
1244  UseOdrIndicator(UseOdrIndicator), DestructorKind(DestructorKind) {}
1245 
1249  ModuleAddressSanitizer Sanitizer(M, &GlobalsMD, CompileKernel, Recover,
1250  UseGlobalGC, UseOdrIndicator,
1251  DestructorKind);
1252  if (Sanitizer.instrumentModule(M))
1253  return PreservedAnalyses::none();
1254  return PreservedAnalyses::all();
1255 }
1256 
1257 INITIALIZE_PASS(ASanGlobalsMetadataWrapperPass, "asan-globals-md",
1258  "Read metadata to mark which globals should be instrumented "
1259  "when running ASan.",
1260  false, true)
1261 
1262 char AddressSanitizerLegacyPass::ID = 0;
1263 
1265  AddressSanitizerLegacyPass, "asan",
1266  "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,
1267  false)
1268 INITIALIZE_PASS_DEPENDENCY(ASanGlobalsMetadataWrapperPass)
1271  AddressSanitizerLegacyPass, "asan",
1272  "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,
1273  false)
1274 
1276  bool CompileKernel, bool Recover, bool UseAfterScope,
1277  AsanDetectStackUseAfterReturnMode UseAfterReturn) {
1278  assert(!CompileKernel || Recover);
1279  return new AddressSanitizerLegacyPass(CompileKernel, Recover, UseAfterScope,
1280  UseAfterReturn);
1281 }
1282 
1284 
1286  ModuleAddressSanitizerLegacyPass, "asan-module",
1287  "AddressSanitizer: detects use-after-free and out-of-bounds bugs."
1288  "ModulePass",
1289  false, false)
1290 
1292  bool CompileKernel, bool Recover, bool UseGlobalsGC, bool UseOdrIndicator,
1293  AsanDtorKind Destructor) {
1294  assert(!CompileKernel || Recover);
1295  return new ModuleAddressSanitizerLegacyPass(
1296  CompileKernel, Recover, UseGlobalsGC, UseOdrIndicator, Destructor);
1297 }
1298 
1300  size_t Res = countTrailingZeros(TypeSize / 8);
1302  return Res;
1303 }
1304 
1305 /// Create a global describing a source location.
1307  LocationMetadata MD) {
1308  Constant *LocData[] = {
1310  ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.LineNo),
1311  ConstantInt::get(Type::getInt32Ty(M.getContext()), MD.ColumnNo),
1312  };
1313  auto LocStruct = ConstantStruct::getAnon(LocData);
1314  auto GV = new GlobalVariable(M, LocStruct->getType(), true,
1315  GlobalValue::PrivateLinkage, LocStruct,
1316  kAsanGenPrefix);
1317  GV->setUnnamedAddr(GlobalValue::UnnamedAddr::Global);
1318  return GV;
1319 }
1320 
1321 /// Check if \p G has been created by a trusted compiler pass.
1323  // Do not instrument @llvm.global_ctors, @llvm.used, etc.
1324  if (G->getName().startswith("llvm."))
1325  return true;
1326 
1327  // Do not instrument asan globals.
1328  if (G->getName().startswith(kAsanGenPrefix) ||
1329  G->getName().startswith(kSanCovGenPrefix) ||
1330  G->getName().startswith(kODRGenPrefix))
1331  return true;
1332 
1333  // Do not instrument gcov counter arrays.
1334  if (G->getName() == "__llvm_gcov_ctr")
1335  return true;
1336 
1337  return false;
1338 }
1339 
1341  Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType());
1342  unsigned int AddrSpace = PtrTy->getPointerAddressSpace();
1343  if (AddrSpace == 3 || AddrSpace == 5)
1344  return true;
1345  return false;
1346 }
1347 
1348 Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) {
1349  // Shadow >> scale
1350  Shadow = IRB.CreateLShr(Shadow, Mapping.Scale);
1351  if (Mapping.Offset == 0) return Shadow;
1352  // (Shadow >> scale) | offset
1353  Value *ShadowBase;
1354  if (LocalDynamicShadow)
1355  ShadowBase = LocalDynamicShadow;
1356  else
1357  ShadowBase = ConstantInt::get(IntptrTy, Mapping.Offset);
1358  if (Mapping.OrShadowOffset)
1359  return IRB.CreateOr(Shadow, ShadowBase);
1360  else
1361  return IRB.CreateAdd(Shadow, ShadowBase);
1362 }
1363 
1364 // Instrument memset/memmove/memcpy
1365 void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) {
1366  IRBuilder<> IRB(MI);
1367  if (isa<MemTransferInst>(MI)) {
1368  IRB.CreateCall(
1369  isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy,
1370  {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
1371  IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()),
1372  IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
1373  } else if (isa<MemSetInst>(MI)) {
1374  IRB.CreateCall(
1375  AsanMemset,
1376  {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
1377  IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false),
1378  IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
1379  }
1380  MI->eraseFromParent();
1381 }
1382 
1383 /// Check if we want (and can) handle this alloca.
1384 bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) {
1385  auto PreviouslySeenAllocaInfo = ProcessedAllocas.find(&AI);
1386 
1387  if (PreviouslySeenAllocaInfo != ProcessedAllocas.end())
1388  return PreviouslySeenAllocaInfo->getSecond();
1389 
1390  bool IsInteresting =
1391  (AI.getAllocatedType()->isSized() &&
1392  // alloca() may be called with 0 size, ignore it.
1393  ((!AI.isStaticAlloca()) || getAllocaSizeInBytes(AI) > 0) &&
1394  // We are only interested in allocas not promotable to registers.
1395  // Promotable allocas are common under -O0.
1397  // inalloca allocas are not treated as static, and we don't want
1398  // dynamic alloca instrumentation for them as well.
1399  !AI.isUsedWithInAlloca() &&
1400  // swifterror allocas are register promoted by ISel
1401  !AI.isSwiftError());
1402 
1403  ProcessedAllocas[&AI] = IsInteresting;
1404  return IsInteresting;
1405 }
1406 
1407 bool AddressSanitizer::ignoreAccess(Value *Ptr) {
1408  // Instrument acesses from different address spaces only for AMDGPU.
1409  Type *PtrTy = cast<PointerType>(Ptr->getType()->getScalarType());
1410  if (PtrTy->getPointerAddressSpace() != 0 &&
1411  !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(Ptr)))
1412  return true;
1413 
1414  // Ignore swifterror addresses.
1415  // swifterror memory addresses are mem2reg promoted by instruction
1416  // selection. As such they cannot have regular uses like an instrumentation
1417  // function and it makes no sense to track them as memory.
1418  if (Ptr->isSwiftError())
1419  return true;
1420 
1421  // Treat memory accesses to promotable allocas as non-interesting since they
1422  // will not cause memory violations. This greatly speeds up the instrumented
1423  // executable at -O0.
1424  if (auto AI = dyn_cast_or_null<AllocaInst>(Ptr))
1425  if (ClSkipPromotableAllocas && !isInterestingAlloca(*AI))
1426  return true;
1427 
1428  return false;
1429 }
1430 
1431 void AddressSanitizer::getInterestingMemoryOperands(
1433  // Skip memory accesses inserted by another instrumentation.
1434  if (I->hasMetadata("nosanitize"))
1435  return;
1436 
1437  // Do not instrument the load fetching the dynamic shadow address.
1438  if (LocalDynamicShadow == I)
1439  return;
1440 
1441  if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
1442  if (!ClInstrumentReads || ignoreAccess(LI->getPointerOperand()))
1443  return;
1444  Interesting.emplace_back(I, LI->getPointerOperandIndex(), false,
1445  LI->getType(), LI->getAlign());
1446  } else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
1447  if (!ClInstrumentWrites || ignoreAccess(SI->getPointerOperand()))
1448  return;
1449  Interesting.emplace_back(I, SI->getPointerOperandIndex(), true,
1450  SI->getValueOperand()->getType(), SI->getAlign());
1451  } else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) {
1452  if (!ClInstrumentAtomics || ignoreAccess(RMW->getPointerOperand()))
1453  return;
1454  Interesting.emplace_back(I, RMW->getPointerOperandIndex(), true,
1455  RMW->getValOperand()->getType(), None);
1456  } else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) {
1457  if (!ClInstrumentAtomics || ignoreAccess(XCHG->getPointerOperand()))
1458  return;
1459  Interesting.emplace_back(I, XCHG->getPointerOperandIndex(), true,
1460  XCHG->getCompareOperand()->getType(), None);
1461  } else if (auto CI = dyn_cast<CallInst>(I)) {
1462  auto *F = CI->getCalledFunction();
1463  if (F && (F->getName().startswith("llvm.masked.load.") ||
1464  F->getName().startswith("llvm.masked.store."))) {
1465  bool IsWrite = F->getName().startswith("llvm.masked.store.");
1466  // Masked store has an initial operand for the value.
1467  unsigned OpOffset = IsWrite ? 1 : 0;
1468  if (IsWrite ? !ClInstrumentWrites : !ClInstrumentReads)
1469  return;
1470 
1471  auto BasePtr = CI->getOperand(OpOffset);
1472  if (ignoreAccess(BasePtr))
1473  return;
1474  auto Ty = cast<PointerType>(BasePtr->getType())->getElementType();
1475  MaybeAlign Alignment = Align(1);
1476  // Otherwise no alignment guarantees. We probably got Undef.
1477  if (auto *Op = dyn_cast<ConstantInt>(CI->getOperand(1 + OpOffset)))
1478  Alignment = Op->getMaybeAlignValue();
1479  Value *Mask = CI->getOperand(2 + OpOffset);
1480  Interesting.emplace_back(I, OpOffset, IsWrite, Ty, Alignment, Mask);
1481  } else {
1482  for (unsigned ArgNo = 0; ArgNo < CI->getNumArgOperands(); ArgNo++) {
1483  if (!ClInstrumentByval || !CI->isByValArgument(ArgNo) ||
1484  ignoreAccess(CI->getArgOperand(ArgNo)))
1485  continue;
1486  Type *Ty = CI->getParamByValType(ArgNo);
1487  Interesting.emplace_back(I, ArgNo, false, Ty, Align(1));
1488  }
1489  }
1490  }
1491 }
1492 
1493 static bool isPointerOperand(Value *V) {
1494  return V->getType()->isPointerTy() || isa<PtrToIntInst>(V);
1495 }
1496 
1497 // This is a rough heuristic; it may cause both false positives and
1498 // false negatives. The proper implementation requires cooperation with
1499 // the frontend.
1501  if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) {
1502  if (!Cmp->isRelational())
1503  return false;
1504  } else {
1505  return false;
1506  }
1507  return isPointerOperand(I->getOperand(0)) &&
1508  isPointerOperand(I->getOperand(1));
1509 }
1510 
1511 // This is a rough heuristic; it may cause both false positives and
1512 // false negatives. The proper implementation requires cooperation with
1513 // the frontend.
1515  if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) {
1516  if (BO->getOpcode() != Instruction::Sub)
1517  return false;
1518  } else {
1519  return false;
1520  }
1521  return isPointerOperand(I->getOperand(0)) &&
1522  isPointerOperand(I->getOperand(1));
1523 }
1524 
1525 bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) {
1526  // If a global variable does not have dynamic initialization we don't
1527  // have to instrument it. However, if a global does not have initializer
1528  // at all, we assume it has dynamic initializer (in other TU).
1529  //
1530  // FIXME: Metadata should be attched directly to the global directly instead
1531  // of being added to llvm.asan.globals.
1532  return G->hasInitializer() && !GlobalsMD.get(G).IsDynInit;
1533 }
1534 
1535 void AddressSanitizer::instrumentPointerComparisonOrSubtraction(
1536  Instruction *I) {
1537  IRBuilder<> IRB(I);
1538  FunctionCallee F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction;
1539  Value *Param[2] = {I->getOperand(0), I->getOperand(1)};
1540  for (Value *&i : Param) {
1541  if (i->getType()->isPointerTy())
1542  i = IRB.CreatePointerCast(i, IntptrTy);
1543  }
1544  IRB.CreateCall(F, Param);
1545 }
1546 
1548  Instruction *InsertBefore, Value *Addr,
1549  MaybeAlign Alignment, unsigned Granularity,
1550  uint32_t TypeSize, bool IsWrite,
1551  Value *SizeArgument, bool UseCalls,
1552  uint32_t Exp) {
1553  // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check
1554  // if the data is properly aligned.
1555  if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 ||
1556  TypeSize == 128) &&
1557  (!Alignment || *Alignment >= Granularity || *Alignment >= TypeSize / 8))
1558  return Pass->instrumentAddress(I, InsertBefore, Addr, TypeSize, IsWrite,
1559  nullptr, UseCalls, Exp);
1560  Pass->instrumentUnusualSizeOrAlignment(I, InsertBefore, Addr, TypeSize,
1561  IsWrite, nullptr, UseCalls, Exp);
1562 }
1563 
1565  const DataLayout &DL, Type *IntptrTy,
1566  Value *Mask, Instruction *I,
1567  Value *Addr, MaybeAlign Alignment,
1568  unsigned Granularity, uint32_t TypeSize,
1569  bool IsWrite, Value *SizeArgument,
1570  bool UseCalls, uint32_t Exp) {
1571  auto *VTy = cast<FixedVectorType>(
1572  cast<PointerType>(Addr->getType())->getElementType());
1573  uint64_t ElemTypeSize = DL.getTypeStoreSizeInBits(VTy->getScalarType());
1574  unsigned Num = VTy->getNumElements();
1575  auto Zero = ConstantInt::get(IntptrTy, 0);
1576  for (unsigned Idx = 0; Idx < Num; ++Idx) {
1577  Value *InstrumentedAddress = nullptr;
1578  Instruction *InsertBefore = I;
1579  if (auto *Vector = dyn_cast<ConstantVector>(Mask)) {
1580  // dyn_cast as we might get UndefValue
1581  if (auto *Masked = dyn_cast<ConstantInt>(Vector->getOperand(Idx))) {
1582  if (Masked->isZero())
1583  // Mask is constant false, so no instrumentation needed.
1584  continue;
1585  // If we have a true or undef value, fall through to doInstrumentAddress
1586  // with InsertBefore == I
1587  }
1588  } else {
1589  IRBuilder<> IRB(I);
1590  Value *MaskElem = IRB.CreateExtractElement(Mask, Idx);
1591  Instruction *ThenTerm = SplitBlockAndInsertIfThen(MaskElem, I, false);
1592  InsertBefore = ThenTerm;
1593  }
1594 
1595  IRBuilder<> IRB(InsertBefore);
1596  InstrumentedAddress =
1597  IRB.CreateGEP(VTy, Addr, {Zero, ConstantInt::get(IntptrTy, Idx)});
1598  doInstrumentAddress(Pass, I, InsertBefore, InstrumentedAddress, Alignment,
1599  Granularity, ElemTypeSize, IsWrite, SizeArgument,
1600  UseCalls, Exp);
1601  }
1602 }
1603 
1604 void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
1605  InterestingMemoryOperand &O, bool UseCalls,
1606  const DataLayout &DL) {
1607  Value *Addr = O.getPtr();
1608 
1609  // Optimization experiments.
1610  // The experiments can be used to evaluate potential optimizations that remove
1611  // instrumentation (assess false negatives). Instead of completely removing
1612  // some instrumentation, you set Exp to a non-zero value (mask of optimization
1613  // experiments that want to remove instrumentation of this instruction).
1614  // If Exp is non-zero, this pass will emit special calls into runtime
1615  // (e.g. __asan_report_exp_load1 instead of __asan_report_load1). These calls
1616  // make runtime terminate the program in a special way (with a different
1617  // exit status). Then you run the new compiler on a buggy corpus, collect
1618  // the special terminations (ideally, you don't see them at all -- no false
1619  // negatives) and make the decision on the optimization.
1621 
1622  if (ClOpt && ClOptGlobals) {
1623  // If initialization order checking is disabled, a simple access to a
1624  // dynamically initialized global is always valid.
1625  GlobalVariable *G = dyn_cast<GlobalVariable>(getUnderlyingObject(Addr));
1626  if (G && (!ClInitializers || GlobalIsLinkerInitialized(G)) &&
1627  isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) {
1628  NumOptimizedAccessesToGlobalVar++;
1629  return;
1630  }
1631  }
1632 
1633  if (ClOpt && ClOptStack) {
1634  // A direct inbounds access to a stack variable is always valid.
1635  if (isa<AllocaInst>(getUnderlyingObject(Addr)) &&
1636  isSafeAccess(ObjSizeVis, Addr, O.TypeSize)) {
1637  NumOptimizedAccessesToStackVar++;
1638  return;
1639  }
1640  }
1641 
1642  if (O.IsWrite)
1643  NumInstrumentedWrites++;
1644  else
1645  NumInstrumentedReads++;
1646 
1647  unsigned Granularity = 1 << Mapping.Scale;
1648  if (O.MaybeMask) {
1649  instrumentMaskedLoadOrStore(this, DL, IntptrTy, O.MaybeMask, O.getInsn(),
1650  Addr, O.Alignment, Granularity, O.TypeSize,
1651  O.IsWrite, nullptr, UseCalls, Exp);
1652  } else {
1653  doInstrumentAddress(this, O.getInsn(), O.getInsn(), Addr, O.Alignment,
1654  Granularity, O.TypeSize, O.IsWrite, nullptr, UseCalls,
1655  Exp);
1656  }
1657 }
1658 
1659 Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore,
1660  Value *Addr, bool IsWrite,
1661  size_t AccessSizeIndex,
1662  Value *SizeArgument,
1663  uint32_t Exp) {
1664  IRBuilder<> IRB(InsertBefore);
1665  Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp);
1666  CallInst *Call = nullptr;
1667  if (SizeArgument) {
1668  if (Exp == 0)
1669  Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0],
1670  {Addr, SizeArgument});
1671  else
1672  Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1],
1673  {Addr, SizeArgument, ExpVal});
1674  } else {
1675  if (Exp == 0)
1676  Call =
1677  IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr);
1678  else
1679  Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex],
1680  {Addr, ExpVal});
1681  }
1682 
1683  Call->setCannotMerge();
1684  return Call;
1685 }
1686 
1687 Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
1688  Value *ShadowValue,
1689  uint32_t TypeSize) {
1690  size_t Granularity = static_cast<size_t>(1) << Mapping.Scale;
1691  // Addr & (Granularity - 1)
1692  Value *LastAccessedByte =
1693  IRB.CreateAnd(AddrLong, ConstantInt::get(IntptrTy, Granularity - 1));
1694  // (Addr & (Granularity - 1)) + size - 1
1695  if (TypeSize / 8 > 1)
1696  LastAccessedByte = IRB.CreateAdd(
1697  LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1));
1698  // (uint8_t) ((Addr & (Granularity-1)) + size - 1)
1699  LastAccessedByte =
1700  IRB.CreateIntCast(LastAccessedByte, ShadowValue->getType(), false);
1701  // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue
1702  return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue);
1703 }
1704 
1705 Instruction *AddressSanitizer::instrumentAMDGPUAddress(
1706  Instruction *OrigIns, Instruction *InsertBefore, Value *Addr,
1707  uint32_t TypeSize, bool IsWrite, Value *SizeArgument) {
1708  // Do not instrument unsupported addrspaces.
1710  return nullptr;
1711  Type *PtrTy = cast<PointerType>(Addr->getType()->getScalarType());
1712  // Follow host instrumentation for global and constant addresses.
1713  if (PtrTy->getPointerAddressSpace() != 0)
1714  return InsertBefore;
1715  // Instrument generic addresses in supported addressspaces.
1716  IRBuilder<> IRB(InsertBefore);
1717  Value *AddrLong = IRB.CreatePointerCast(Addr, IRB.getInt8PtrTy());
1718  Value *IsShared = IRB.CreateCall(AMDGPUAddressShared, {AddrLong});
1719  Value *IsPrivate = IRB.CreateCall(AMDGPUAddressPrivate, {AddrLong});
1720  Value *IsSharedOrPrivate = IRB.CreateOr(IsShared, IsPrivate);
1721  Value *Cmp = IRB.CreateICmpNE(IRB.getTrue(), IsSharedOrPrivate);
1722  Value *AddrSpaceZeroLanding =
1723  SplitBlockAndInsertIfThen(Cmp, InsertBefore, false);
1724  InsertBefore = cast<Instruction>(AddrSpaceZeroLanding);
1725  return InsertBefore;
1726 }
1727 
1728 void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
1729  Instruction *InsertBefore, Value *Addr,
1730  uint32_t TypeSize, bool IsWrite,
1731  Value *SizeArgument, bool UseCalls,
1732  uint32_t Exp) {
1733  if (TargetTriple.isAMDGPU()) {
1734  InsertBefore = instrumentAMDGPUAddress(OrigIns, InsertBefore, Addr,
1735  TypeSize, IsWrite, SizeArgument);
1736  if (!InsertBefore)
1737  return;
1738  }
1739 
1740  IRBuilder<> IRB(InsertBefore);
1741  Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
1742  size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize);
1743 
1744  if (UseCalls) {
1745  if (Exp == 0)
1746  IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex],
1747  AddrLong);
1748  else
1749  IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex],
1750  {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)});
1751  return;
1752  }
1753 
1754  Type *ShadowTy =
1755  IntegerType::get(*C, std::max(8U, TypeSize >> Mapping.Scale));
1756  Type *ShadowPtrTy = PointerType::get(ShadowTy, 0);
1757  Value *ShadowPtr = memToShadow(AddrLong, IRB);
1758  Value *CmpVal = Constant::getNullValue(ShadowTy);
1759  Value *ShadowValue =
1760  IRB.CreateLoad(ShadowTy, IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy));
1761 
1762  Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal);
1763  size_t Granularity = 1ULL << Mapping.Scale;
1764  Instruction *CrashTerm = nullptr;
1765 
1766  if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) {
1767  // We use branch weights for the slow path check, to indicate that the slow
1768  // path is rarely taken. This seems to be the case for SPEC benchmarks.
1770  Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000));
1771  assert(cast<BranchInst>(CheckTerm)->isUnconditional());
1772  BasicBlock *NextBB = CheckTerm->getSuccessor(0);
1773  IRB.SetInsertPoint(CheckTerm);
1774  Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize);
1775  if (Recover) {
1776  CrashTerm = SplitBlockAndInsertIfThen(Cmp2, CheckTerm, false);
1777  } else {
1778  BasicBlock *CrashBlock =
1779  BasicBlock::Create(*C, "", NextBB->getParent(), NextBB);
1780  CrashTerm = new UnreachableInst(*C, CrashBlock);
1781  BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2);
1782  ReplaceInstWithInst(CheckTerm, NewTerm);
1783  }
1784  } else {
1785  CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover);
1786  }
1787 
1788  Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite,
1789  AccessSizeIndex, SizeArgument, Exp);
1790  Crash->setDebugLoc(OrigIns->getDebugLoc());
1791 }
1792 
1793 // Instrument unusual size or unusual alignment.
1794 // We can not do it with a single check, so we do 1-byte check for the first
1795 // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able
1796 // to report the actual access size.
1797 void AddressSanitizer::instrumentUnusualSizeOrAlignment(
1798  Instruction *I, Instruction *InsertBefore, Value *Addr, uint32_t TypeSize,
1799  bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp) {
1800  IRBuilder<> IRB(InsertBefore);
1801  Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8);
1802  Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
1803  if (UseCalls) {
1804  if (Exp == 0)
1805  IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0],
1806  {AddrLong, Size});
1807  else
1808  IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1],
1809  {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)});
1810  } else {
1811  Value *LastByte = IRB.CreateIntToPtr(
1812  IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)),
1813  Addr->getType());
1814  instrumentAddress(I, InsertBefore, Addr, 8, IsWrite, Size, false, Exp);
1815  instrumentAddress(I, InsertBefore, LastByte, 8, IsWrite, Size, false, Exp);
1816  }
1817 }
1818 
1819 void ModuleAddressSanitizer::poisonOneInitializer(Function &GlobalInit,
1820  GlobalValue *ModuleName) {
1821  // Set up the arguments to our poison/unpoison functions.
1822  IRBuilder<> IRB(&GlobalInit.front(),
1823  GlobalInit.front().getFirstInsertionPt());
1824 
1825  // Add a call to poison all external globals before the given function starts.
1826  Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy);
1827  IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr);
1828 
1829  // Add calls to unpoison all globals before each return instruction.
1830  for (auto &BB : GlobalInit.getBasicBlockList())
1831  if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator()))
1832  CallInst::Create(AsanUnpoisonGlobals, "", RI);
1833 }
1834 
1835 void ModuleAddressSanitizer::createInitializerPoisonCalls(
1836  Module &M, GlobalValue *ModuleName) {
1837  GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors");
1838  if (!GV)
1839  return;
1840 
1841  ConstantArray *CA = dyn_cast<ConstantArray>(GV->getInitializer());
1842  if (!CA)
1843  return;
1844 
1845  for (Use &OP : CA->operands()) {
1846  if (isa<ConstantAggregateZero>(OP)) continue;
1847  ConstantStruct *CS = cast<ConstantStruct>(OP);
1848 
1849  // Must have a function or null ptr.
1850  if (Function *F = dyn_cast<Function>(CS->getOperand(1))) {
1851  if (F->getName() == kAsanModuleCtorName) continue;
1852  auto *Priority = cast<ConstantInt>(CS->getOperand(0));
1853  // Don't instrument CTORs that will run before asan.module_ctor.
1854  if (Priority->getLimitedValue() <= GetCtorAndDtorPriority(TargetTriple))
1855  continue;
1856  poisonOneInitializer(*F, ModuleName);
1857  }
1858  }
1859 }
1860 
1861 const GlobalVariable *
1862 ModuleAddressSanitizer::getExcludedAliasedGlobal(const GlobalAlias &GA) const {
1863  // In case this function should be expanded to include rules that do not just
1864  // apply when CompileKernel is true, either guard all existing rules with an
1865  // 'if (CompileKernel) { ... }' or be absolutely sure that all these rules
1866  // should also apply to user space.
1867  assert(CompileKernel && "Only expecting to be called when compiling kernel");
1868 
1869  const Constant *C = GA.getAliasee();
1870 
1871  // When compiling the kernel, globals that are aliased by symbols prefixed
1872  // by "__" are special and cannot be padded with a redzone.
1873  if (GA.getName().startswith("__"))
1874  return dyn_cast<GlobalVariable>(C->stripPointerCastsAndAliases());
1875 
1876  return nullptr;
1877 }
1878 
1879 bool ModuleAddressSanitizer::shouldInstrumentGlobal(GlobalVariable *G) const {
1880  Type *Ty = G->getValueType();
1881  LLVM_DEBUG(dbgs() << "GLOBAL: " << *G << "\n");
1882 
1883  // FIXME: Metadata should be attched directly to the global directly instead
1884  // of being added to llvm.asan.globals.
1885  if (GlobalsMD.get(G).IsExcluded) return false;
1886  if (!Ty->isSized()) return false;
1887  if (!G->hasInitializer()) return false;
1888  // Globals in address space 1 and 4 are supported for AMDGPU.
1889  if (G->getAddressSpace() &&
1890  !(TargetTriple.isAMDGPU() && !isUnsupportedAMDGPUAddrspace(G)))
1891  return false;
1892  if (GlobalWasGeneratedByCompiler(G)) return false; // Our own globals.
1893  // Two problems with thread-locals:
1894  // - The address of the main thread's copy can't be computed at link-time.
1895  // - Need to poison all copies, not just the main thread's one.
1896  if (G->isThreadLocal()) return false;
1897  // For now, just ignore this Global if the alignment is large.
1898  if (G->getAlignment() > getMinRedzoneSizeForGlobal()) return false;
1899 
1900  // For non-COFF targets, only instrument globals known to be defined by this
1901  // TU.
1902  // FIXME: We can instrument comdat globals on ELF if we are using the
1903  // GC-friendly metadata scheme.
1904  if (!TargetTriple.isOSBinFormatCOFF()) {
1905  if (!G->hasExactDefinition() || G->hasComdat())
1906  return false;
1907  } else {
1908  // On COFF, don't instrument non-ODR linkages.
1909  if (G->isInterposable())
1910  return false;
1911  }
1912 
1913  // If a comdat is present, it must have a selection kind that implies ODR
1914  // semantics: no duplicates, any, or exact match.
1915  if (Comdat *C = G->getComdat()) {
1916  switch (C->getSelectionKind()) {
1917  case Comdat::Any:
1918  case Comdat::ExactMatch:
1919  case Comdat::NoDeduplicate:
1920  break;
1921  case Comdat::Largest:
1922  case Comdat::SameSize:
1923  return false;
1924  }
1925  }
1926 
1927  if (G->hasSection()) {
1928  // The kernel uses explicit sections for mostly special global variables
1929  // that we should not instrument. E.g. the kernel may rely on their layout
1930  // without redzones, or remove them at link time ("discard.*"), etc.
1931  if (CompileKernel)
1932  return false;
1933 
1934  StringRef Section = G->getSection();
1935 
1936  // Globals from llvm.metadata aren't emitted, do not instrument them.
1937  if (Section == "llvm.metadata") return false;
1938  // Do not instrument globals from special LLVM sections.
1939  if (Section.find("__llvm") != StringRef::npos || Section.find("__LLVM") != StringRef::npos) return false;
1940 
1941  // Do not instrument function pointers to initialization and termination
1942  // routines: dynamic linker will not properly handle redzones.
1943  if (Section.startswith(".preinit_array") ||
1944  Section.startswith(".init_array") ||
1945  Section.startswith(".fini_array")) {
1946  return false;
1947  }
1948 
1949  // Do not instrument user-defined sections (with names resembling
1950  // valid C identifiers)
1951  if (TargetTriple.isOSBinFormatELF()) {
1952  if (llvm::all_of(Section,
1953  [](char c) { return llvm::isAlnum(c) || c == '_'; }))
1954  return false;
1955  }
1956 
1957  // On COFF, if the section name contains '$', it is highly likely that the
1958  // user is using section sorting to create an array of globals similar to
1959  // the way initialization callbacks are registered in .init_array and
1960  // .CRT$XCU. The ATL also registers things in .ATL$__[azm]. Adding redzones
1961  // to such globals is counterproductive, because the intent is that they
1962  // will form an array, and out-of-bounds accesses are expected.
1963  // See https://github.com/google/sanitizers/issues/305
1964  // and http://msdn.microsoft.com/en-US/en-en/library/bb918180(v=vs.120).aspx
1965  if (TargetTriple.isOSBinFormatCOFF() && Section.contains('$')) {
1966  LLVM_DEBUG(dbgs() << "Ignoring global in sorted section (contains '$'): "
1967  << *G << "\n");
1968  return false;
1969  }
1970 
1971  if (TargetTriple.isOSBinFormatMachO()) {
1972  StringRef ParsedSegment, ParsedSection;
1973  unsigned TAA = 0, StubSize = 0;
1974  bool TAAParsed;
1976  Section, ParsedSegment, ParsedSection, TAA, TAAParsed, StubSize));
1977 
1978  // Ignore the globals from the __OBJC section. The ObjC runtime assumes
1979  // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to
1980  // them.
1981  if (ParsedSegment == "__OBJC" ||
1982  (ParsedSegment == "__DATA" && ParsedSection.startswith("__objc_"))) {
1983  LLVM_DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n");
1984  return false;
1985  }
1986  // See https://github.com/google/sanitizers/issues/32
1987  // Constant CFString instances are compiled in the following way:
1988  // -- the string buffer is emitted into
1989  // __TEXT,__cstring,cstring_literals
1990  // -- the constant NSConstantString structure referencing that buffer
1991  // is placed into __DATA,__cfstring
1992  // Therefore there's no point in placing redzones into __DATA,__cfstring.
1993  // Moreover, it causes the linker to crash on OS X 10.7
1994  if (ParsedSegment == "__DATA" && ParsedSection == "__cfstring") {
1995  LLVM_DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n");
1996  return false;
1997  }
1998  // The linker merges the contents of cstring_literals and removes the
1999  // trailing zeroes.
2000  if (ParsedSegment == "__TEXT" && (TAA & MachO::S_CSTRING_LITERALS)) {
2001  LLVM_DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n");
2002  return false;
2003  }
2004  }
2005  }
2006 
2007  if (CompileKernel) {
2008  // Globals that prefixed by "__" are special and cannot be padded with a
2009  // redzone.
2010  if (G->getName().startswith("__"))
2011  return false;
2012  }
2013 
2014  return true;
2015 }
2016 
2017 // On Mach-O platforms, we emit global metadata in a separate section of the
2018 // binary in order to allow the linker to properly dead strip. This is only
2019 // supported on recent versions of ld64.
2020 bool ModuleAddressSanitizer::ShouldUseMachOGlobalsSection() const {
2021  if (!TargetTriple.isOSBinFormatMachO())
2022  return false;
2023 
2024  if (TargetTriple.isMacOSX() && !TargetTriple.isMacOSXVersionLT(10, 11))
2025  return true;
2026  if (TargetTriple.isiOS() /* or tvOS */ && !TargetTriple.isOSVersionLT(9))
2027  return true;
2028  if (TargetTriple.isWatchOS() && !TargetTriple.isOSVersionLT(2))
2029  return true;
2030 
2031  return false;
2032 }
2033 
2034 StringRef ModuleAddressSanitizer::getGlobalMetadataSection() const {
2035  switch (TargetTriple.getObjectFormat()) {
2036  case Triple::COFF: return ".ASAN$GL";
2037  case Triple::ELF: return "asan_globals";
2038  case Triple::MachO: return "__DATA,__asan_globals,regular";
2039  case Triple::Wasm:
2040  case Triple::GOFF:
2041  case Triple::XCOFF:
2043  "ModuleAddressSanitizer not implemented for object file format");
2045  break;
2046  }
2047  llvm_unreachable("unsupported object format");
2048 }
2049 
2050 void ModuleAddressSanitizer::initializeCallbacks(Module &M) {
2051  IRBuilder<> IRB(*C);
2052 
2053  // Declare our poisoning and unpoisoning functions.
2054  AsanPoisonGlobals =
2055  M.getOrInsertFunction(kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy);
2056  AsanUnpoisonGlobals =
2057  M.getOrInsertFunction(kAsanUnpoisonGlobalsName, IRB.getVoidTy());
2058 
2059  // Declare functions that register/unregister globals.
2060  AsanRegisterGlobals = M.getOrInsertFunction(
2061  kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy);
2062  AsanUnregisterGlobals = M.getOrInsertFunction(
2063  kAsanUnregisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy);
2064 
2065  // Declare the functions that find globals in a shared object and then invoke
2066  // the (un)register function on them.
2067  AsanRegisterImageGlobals = M.getOrInsertFunction(
2068  kAsanRegisterImageGlobalsName, IRB.getVoidTy(), IntptrTy);
2069  AsanUnregisterImageGlobals = M.getOrInsertFunction(
2070  kAsanUnregisterImageGlobalsName, IRB.getVoidTy(), IntptrTy);
2071 
2072  AsanRegisterElfGlobals =
2073  M.getOrInsertFunction(kAsanRegisterElfGlobalsName, IRB.getVoidTy(),
2074  IntptrTy, IntptrTy, IntptrTy);
2075  AsanUnregisterElfGlobals =
2076  M.getOrInsertFunction(kAsanUnregisterElfGlobalsName, IRB.getVoidTy(),
2077  IntptrTy, IntptrTy, IntptrTy);
2078 }
2079 
2080 // Put the metadata and the instrumented global in the same group. This ensures
2081 // that the metadata is discarded if the instrumented global is discarded.
2082 void ModuleAddressSanitizer::SetComdatForGlobalMetadata(
2083  GlobalVariable *G, GlobalVariable *Metadata, StringRef InternalSuffix) {
2084  Module &M = *G->getParent();
2085  Comdat *C = G->getComdat();
2086  if (!C) {
2087  if (!G->hasName()) {
2088  // If G is unnamed, it must be internal. Give it an artificial name
2089  // so we can put it in a comdat.
2090  assert(G->hasLocalLinkage());
2091  G->setName(Twine(kAsanGenPrefix) + "_anon_global");
2092  }
2093 
2094  if (!InternalSuffix.empty() && G->hasLocalLinkage()) {
2095  std::string Name = std::string(G->getName());
2096  Name += InternalSuffix;
2097  C = M.getOrInsertComdat(Name);
2098  } else {
2099  C = M.getOrInsertComdat(G->getName());
2100  }
2101 
2102  // Make this IMAGE_COMDAT_SELECT_NODUPLICATES on COFF. Also upgrade private
2103  // linkage to internal linkage so that a symbol table entry is emitted. This
2104  // is necessary in order to create the comdat group.
2105  if (TargetTriple.isOSBinFormatCOFF()) {
2106  C->setSelectionKind(Comdat::NoDeduplicate);
2107  if (G->hasPrivateLinkage())
2108  G->setLinkage(GlobalValue::InternalLinkage);
2109  }
2110  G->setComdat(C);
2111  }
2112 
2113  assert(G->hasComdat());
2114  Metadata->setComdat(G->getComdat());
2115 }
2116 
2117 // Create a separate metadata global and put it in the appropriate ASan
2118 // global registration section.
2120 ModuleAddressSanitizer::CreateMetadataGlobal(Module &M, Constant *Initializer,
2121  StringRef OriginalName) {
2122  auto Linkage = TargetTriple.isOSBinFormatMachO()
2126  M, Initializer->getType(), false, Linkage, Initializer,
2127  Twine("__asan_global_") + GlobalValue::dropLLVMManglingEscape(OriginalName));
2128  Metadata->setSection(getGlobalMetadataSection());
2129  return Metadata;
2130 }
2131 
2132 Instruction *ModuleAddressSanitizer::CreateAsanModuleDtor(Module &M) {
2133  AsanDtorFunction = Function::createWithDefaultAttr(
2136  AsanDtorFunction->addAttribute(AttributeList::FunctionIndex,
2137  Attribute::NoUnwind);
2138  // Ensure Dtor cannot be discarded, even if in a comdat.
2139  appendToUsed(M, {AsanDtorFunction});
2140  BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction);
2141 
2142  return ReturnInst::Create(*C, AsanDtorBB);
2143 }
2144 
2145 void ModuleAddressSanitizer::InstrumentGlobalsCOFF(
2146  IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
2147  ArrayRef<Constant *> MetadataInitializers) {
2148  assert(ExtendedGlobals.size() == MetadataInitializers.size());
2149  auto &DL = M.getDataLayout();
2150 
2151  SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size());
2152  for (size_t i = 0; i < ExtendedGlobals.size(); i++) {
2153  Constant *Initializer = MetadataInitializers[i];
2154  GlobalVariable *G = ExtendedGlobals[i];
2156  CreateMetadataGlobal(M, Initializer, G->getName());
2157  MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G));
2158  Metadata->setMetadata(LLVMContext::MD_associated, MD);
2159  MetadataGlobals[i] = Metadata;
2160 
2161  // The MSVC linker always inserts padding when linking incrementally. We
2162  // cope with that by aligning each struct to its size, which must be a power
2163  // of two.
2164  unsigned SizeOfGlobalStruct = DL.getTypeAllocSize(Initializer->getType());
2165  assert(isPowerOf2_32(SizeOfGlobalStruct) &&
2166  "global metadata will not be padded appropriately");
2167  Metadata->setAlignment(assumeAligned(SizeOfGlobalStruct));
2168 
2169  SetComdatForGlobalMetadata(G, Metadata, "");
2170  }
2171 
2172  // Update llvm.compiler.used, adding the new metadata globals. This is
2173  // needed so that during LTO these variables stay alive.
2174  if (!MetadataGlobals.empty())
2175  appendToCompilerUsed(M, MetadataGlobals);
2176 }
2177 
2178 void ModuleAddressSanitizer::InstrumentGlobalsELF(
2179  IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
2180  ArrayRef<Constant *> MetadataInitializers,
2181  const std::string &UniqueModuleId) {
2182  assert(ExtendedGlobals.size() == MetadataInitializers.size());
2183 
2184  // Putting globals in a comdat changes the semantic and potentially cause
2185  // false negative odr violations at link time. If odr indicators are used, we
2186  // keep the comdat sections, as link time odr violations will be dectected on
2187  // the odr indicator symbols.
2188  bool UseComdatForGlobalsGC = UseOdrIndicator;
2189 
2190  SmallVector<GlobalValue *, 16> MetadataGlobals(ExtendedGlobals.size());
2191  for (size_t i = 0; i < ExtendedGlobals.size(); i++) {
2192  GlobalVariable *G = ExtendedGlobals[i];
2194  CreateMetadataGlobal(M, MetadataInitializers[i], G->getName());
2195  MDNode *MD = MDNode::get(M.getContext(), ValueAsMetadata::get(G));
2196  Metadata->setMetadata(LLVMContext::MD_associated, MD);
2197  MetadataGlobals[i] = Metadata;
2198 
2199  if (UseComdatForGlobalsGC)
2200  SetComdatForGlobalMetadata(G, Metadata, UniqueModuleId);
2201  }
2202 
2203  // Update llvm.compiler.used, adding the new metadata globals. This is
2204  // needed so that during LTO these variables stay alive.
2205  if (!MetadataGlobals.empty())
2206  appendToCompilerUsed(M, MetadataGlobals);
2207 
2208  // RegisteredFlag serves two purposes. First, we can pass it to dladdr()
2209  // to look up the loaded image that contains it. Second, we can store in it
2210  // whether registration has already occurred, to prevent duplicate
2211  // registration.
2212  //
2213  // Common linkage ensures that there is only one global per shared library.
2214  GlobalVariable *RegisteredFlag = new GlobalVariable(
2215  M, IntptrTy, false, GlobalVariable::CommonLinkage,
2218 
2219  // Create start and stop symbols.
2220  GlobalVariable *StartELFMetadata = new GlobalVariable(
2221  M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr,
2222  "__start_" + getGlobalMetadataSection());
2224  GlobalVariable *StopELFMetadata = new GlobalVariable(
2225  M, IntptrTy, false, GlobalVariable::ExternalWeakLinkage, nullptr,
2226  "__stop_" + getGlobalMetadataSection());
2228 
2229  // Create a call to register the globals with the runtime.
2230  IRB.CreateCall(AsanRegisterElfGlobals,
2231  {IRB.CreatePointerCast(RegisteredFlag, IntptrTy),
2232  IRB.CreatePointerCast(StartELFMetadata, IntptrTy),
2233  IRB.CreatePointerCast(StopELFMetadata, IntptrTy)});
2234 
2235  // We also need to unregister globals at the end, e.g., when a shared library
2236  // gets closed.
2237  if (DestructorKind != AsanDtorKind::None) {
2238  IRBuilder<> IrbDtor(CreateAsanModuleDtor(M));
2239  IrbDtor.CreateCall(AsanUnregisterElfGlobals,
2240  {IRB.CreatePointerCast(RegisteredFlag, IntptrTy),
2241  IRB.CreatePointerCast(StartELFMetadata, IntptrTy),
2242  IRB.CreatePointerCast(StopELFMetadata, IntptrTy)});
2243  }
2244 }
2245 
2246 void ModuleAddressSanitizer::InstrumentGlobalsMachO(
2247  IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
2248  ArrayRef<Constant *> MetadataInitializers) {
2249  assert(ExtendedGlobals.size() == MetadataInitializers.size());
2250 
2251  // On recent Mach-O platforms, use a structure which binds the liveness of
2252  // the global variable to the metadata struct. Keep the list of "Liveness" GV
2253  // created to be added to llvm.compiler.used
2254  StructType *LivenessTy = StructType::get(IntptrTy, IntptrTy);
2255  SmallVector<GlobalValue *, 16> LivenessGlobals(ExtendedGlobals.size());
2256 
2257  for (size_t i = 0; i < ExtendedGlobals.size(); i++) {
2258  Constant *Initializer = MetadataInitializers[i];
2259  GlobalVariable *G = ExtendedGlobals[i];
2261  CreateMetadataGlobal(M, Initializer, G->getName());
2262 
2263  // On recent Mach-O platforms, we emit the global metadata in a way that
2264  // allows the linker to properly strip dead globals.
2265  auto LivenessBinder =
2266  ConstantStruct::get(LivenessTy, Initializer->getAggregateElement(0u),
2268  GlobalVariable *Liveness = new GlobalVariable(
2269  M, LivenessTy, false, GlobalVariable::InternalLinkage, LivenessBinder,
2270  Twine("__asan_binder_") + G->getName());
2271  Liveness->setSection("__DATA,__asan_liveness,regular,live_support");
2272  LivenessGlobals[i] = Liveness;
2273  }
2274 
2275  // Update llvm.compiler.used, adding the new liveness globals. This is
2276  // needed so that during LTO these variables stay alive. The alternative
2277  // would be to have the linker handling the LTO symbols, but libLTO
2278  // current API does not expose access to the section for each symbol.
2279  if (!LivenessGlobals.empty())
2280  appendToCompilerUsed(M, LivenessGlobals);
2281 
2282  // RegisteredFlag serves two purposes. First, we can pass it to dladdr()
2283  // to look up the loaded image that contains it. Second, we can store in it
2284  // whether registration has already occurred, to prevent duplicate
2285  // registration.
2286  //
2287  // common linkage ensures that there is only one global per shared library.
2288  GlobalVariable *RegisteredFlag = new GlobalVariable(
2289  M, IntptrTy, false, GlobalVariable::CommonLinkage,
2292 
2293  IRB.CreateCall(AsanRegisterImageGlobals,
2294  {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)});
2295 
2296  // We also need to unregister globals at the end, e.g., when a shared library
2297  // gets closed.
2298  if (DestructorKind != AsanDtorKind::None) {
2299  IRBuilder<> IrbDtor(CreateAsanModuleDtor(M));
2300  IrbDtor.CreateCall(AsanUnregisterImageGlobals,
2301  {IRB.CreatePointerCast(RegisteredFlag, IntptrTy)});
2302  }
2303 }
2304 
2305 void ModuleAddressSanitizer::InstrumentGlobalsWithMetadataArray(
2306  IRBuilder<> &IRB, Module &M, ArrayRef<GlobalVariable *> ExtendedGlobals,
2307  ArrayRef<Constant *> MetadataInitializers) {
2308  assert(ExtendedGlobals.size() == MetadataInitializers.size());
2309  unsigned N = ExtendedGlobals.size();
2310  assert(N > 0);
2311 
2312  // On platforms that don't have a custom metadata section, we emit an array
2313  // of global metadata structures.
2314  ArrayType *ArrayOfGlobalStructTy =
2315  ArrayType::get(MetadataInitializers[0]->getType(), N);
2316  auto AllGlobals = new GlobalVariable(
2317  M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage,
2318  ConstantArray::get(ArrayOfGlobalStructTy, MetadataInitializers), "");
2319  if (Mapping.Scale > 3)
2320  AllGlobals->setAlignment(Align(1ULL << Mapping.Scale));
2321 
2322  IRB.CreateCall(AsanRegisterGlobals,
2323  {IRB.CreatePointerCast(AllGlobals, IntptrTy),
2324  ConstantInt::get(IntptrTy, N)});
2325 
2326  // We also need to unregister globals at the end, e.g., when a shared library
2327  // gets closed.
2328  if (DestructorKind != AsanDtorKind::None) {
2329  IRBuilder<> IrbDtor(CreateAsanModuleDtor(M));
2330  IrbDtor.CreateCall(AsanUnregisterGlobals,
2331  {IRB.CreatePointerCast(AllGlobals, IntptrTy),
2332  ConstantInt::get(IntptrTy, N)});
2333  }
2334 }
2335 
2336 // This function replaces all global variables with new variables that have
2337 // trailing redzones. It also creates a function that poisons
2338 // redzones and inserts this function into llvm.global_ctors.
2339 // Sets *CtorComdat to true if the global registration code emitted into the
2340 // asan constructor is comdat-compatible.
2341 bool ModuleAddressSanitizer::InstrumentGlobals(IRBuilder<> &IRB, Module &M,
2342  bool *CtorComdat) {
2343  *CtorComdat = false;
2344 
2345  // Build set of globals that are aliased by some GA, where
2346  // getExcludedAliasedGlobal(GA) returns the relevant GlobalVariable.
2347  SmallPtrSet<const GlobalVariable *, 16> AliasedGlobalExclusions;
2348  if (CompileKernel) {
2349  for (auto &GA : M.aliases()) {
2350  if (const GlobalVariable *GV = getExcludedAliasedGlobal(GA))
2351  AliasedGlobalExclusions.insert(GV);
2352  }
2353  }
2354 
2355  SmallVector<GlobalVariable *, 16> GlobalsToChange;
2356  for (auto &G : M.globals()) {
2357  if (!AliasedGlobalExclusions.count(&G) && shouldInstrumentGlobal(&G))
2358  GlobalsToChange.push_back(&G);
2359  }
2360 
2361  size_t n = GlobalsToChange.size();
2362  if (n == 0) {
2363  *CtorComdat = true;
2364  return false;
2365  }
2366 
2367  auto &DL = M.getDataLayout();
2368 
2369  // A global is described by a structure
2370  // size_t beg;
2371  // size_t size;
2372  // size_t size_with_redzone;
2373  // const char *name;
2374  // const char *module_name;
2375  // size_t has_dynamic_init;
2376  // void *source_location;
2377  // size_t odr_indicator;
2378  // We initialize an array of such structures and pass it to a run-time call.
2379  StructType *GlobalStructTy =
2380  StructType::get(IntptrTy, IntptrTy, IntptrTy, IntptrTy, IntptrTy,
2381  IntptrTy, IntptrTy, IntptrTy);
2383  SmallVector<Constant *, 16> Initializers(n);
2384 
2385  bool HasDynamicallyInitializedGlobals = false;
2386 
2387  // We shouldn't merge same module names, as this string serves as unique
2388  // module ID in runtime.
2390  M, M.getModuleIdentifier(), /*AllowMerging*/ false, kAsanGenPrefix);
2391 
2392  for (size_t i = 0; i < n; i++) {
2393  GlobalVariable *G = GlobalsToChange[i];
2394 
2395  // FIXME: Metadata should be attched directly to the global directly instead
2396  // of being added to llvm.asan.globals.
2397  auto MD = GlobalsMD.get(G);
2398  StringRef NameForGlobal = G->getName();
2399  // Create string holding the global name (use global name from metadata
2400  // if it's available, otherwise just write the name of global variable).
2402  M, MD.Name.empty() ? NameForGlobal : MD.Name,
2403  /*AllowMerging*/ true, kAsanGenPrefix);
2404 
2405  Type *Ty = G->getValueType();
2406  const uint64_t SizeInBytes = DL.getTypeAllocSize(Ty);
2407  const uint64_t RightRedzoneSize = getRedzoneSizeForGlobal(SizeInBytes);
2408  Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize);
2409 
2410  StructType *NewTy = StructType::get(Ty, RightRedZoneTy);
2411  Constant *NewInitializer = ConstantStruct::get(
2412  NewTy, G->getInitializer(), Constant::getNullValue(RightRedZoneTy));
2413 
2414  // Create a new global variable with enough space for a redzone.
2415  GlobalValue::LinkageTypes Linkage = G->getLinkage();
2416  if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage)
2418  GlobalVariable *NewGlobal = new GlobalVariable(
2419  M, NewTy, G->isConstant(), Linkage, NewInitializer, "", G,
2420  G->getThreadLocalMode(), G->getAddressSpace());
2421  NewGlobal->copyAttributesFrom(G);
2422  NewGlobal->setComdat(G->getComdat());
2423  NewGlobal->setAlignment(MaybeAlign(getMinRedzoneSizeForGlobal()));
2424  // Don't fold globals with redzones. ODR violation detector and redzone
2425  // poisoning implicitly creates a dependence on the global's address, so it
2426  // is no longer valid for it to be marked unnamed_addr.
2428 
2429  // Move null-terminated C strings to "__asan_cstring" section on Darwin.
2430  if (TargetTriple.isOSBinFormatMachO() && !G->hasSection() &&
2431  G->isConstant()) {
2432  auto Seq = dyn_cast<ConstantDataSequential>(G->getInitializer());
2433  if (Seq && Seq->isCString())
2434  NewGlobal->setSection("__TEXT,__asan_cstring,regular");
2435  }
2436 
2437  // Transfer the debug info and type metadata. The payload starts at offset
2438  // zero so we can copy the metadata over as is.
2439  NewGlobal->copyMetadata(G, 0);
2440 
2441  Value *Indices2[2];
2442  Indices2[0] = IRB.getInt32(0);
2443  Indices2[1] = IRB.getInt32(0);
2444 
2445  G->replaceAllUsesWith(
2446  ConstantExpr::getGetElementPtr(NewTy, NewGlobal, Indices2, true));
2447  NewGlobal->takeName(G);
2448  G->eraseFromParent();
2449  NewGlobals[i] = NewGlobal;
2450 
2451  Constant *SourceLoc;
2452  if (!MD.SourceLoc.empty()) {
2453  auto SourceLocGlobal = createPrivateGlobalForSourceLoc(M, MD.SourceLoc);
2454  SourceLoc = ConstantExpr::getPointerCast(SourceLocGlobal, IntptrTy);
2455  } else {
2456  SourceLoc = ConstantInt::get(IntptrTy, 0);
2457  }
2458 
2459  Constant *ODRIndicator = ConstantExpr::getNullValue(IRB.getInt8PtrTy());
2460  GlobalValue *InstrumentedGlobal = NewGlobal;
2461 
2462  bool CanUsePrivateAliases =
2463  TargetTriple.isOSBinFormatELF() || TargetTriple.isOSBinFormatMachO() ||
2464  TargetTriple.isOSBinFormatWasm();
2465  if (CanUsePrivateAliases && UsePrivateAlias) {
2466  // Create local alias for NewGlobal to avoid crash on ODR between
2467  // instrumented and non-instrumented libraries.
2468  InstrumentedGlobal =
2470  }
2471 
2472  // ODR should not happen for local linkage.
2473  if (NewGlobal->hasLocalLinkage()) {
2474  ODRIndicator = ConstantExpr::getIntToPtr(ConstantInt::get(IntptrTy, -1),
2475  IRB.getInt8PtrTy());
2476  } else if (UseOdrIndicator) {
2477  // With local aliases, we need to provide another externally visible
2478  // symbol __odr_asan_XXX to detect ODR violation.
2479  auto *ODRIndicatorSym =
2480  new GlobalVariable(M, IRB.getInt8Ty(), false, Linkage,
2482  kODRGenPrefix + NameForGlobal, nullptr,
2483  NewGlobal->getThreadLocalMode());
2484 
2485  // Set meaningful attributes for indicator symbol.
2486  ODRIndicatorSym->setVisibility(NewGlobal->getVisibility());
2487  ODRIndicatorSym->setDLLStorageClass(NewGlobal->getDLLStorageClass());
2488  ODRIndicatorSym->setAlignment(Align(1));
2489  ODRIndicator = ODRIndicatorSym;
2490  }
2491 
2492  Constant *Initializer = ConstantStruct::get(
2493  GlobalStructTy,
2494  ConstantExpr::getPointerCast(InstrumentedGlobal, IntptrTy),
2495  ConstantInt::get(IntptrTy, SizeInBytes),
2496  ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize),
2498  ConstantExpr::getPointerCast(ModuleName, IntptrTy),
2499  ConstantInt::get(IntptrTy, MD.IsDynInit), SourceLoc,
2500  ConstantExpr::getPointerCast(ODRIndicator, IntptrTy));
2501 
2502  if (ClInitializers && MD.IsDynInit) HasDynamicallyInitializedGlobals = true;
2503 
2504  LLVM_DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n");
2505 
2506  Initializers[i] = Initializer;
2507  }
2508 
2509  // Add instrumented globals to llvm.compiler.used list to avoid LTO from
2510  // ConstantMerge'ing them.
2511  SmallVector<GlobalValue *, 16> GlobalsToAddToUsedList;
2512  for (size_t i = 0; i < n; i++) {
2513  GlobalVariable *G = NewGlobals[i];
2514  if (G->getName().empty()) continue;
2515  GlobalsToAddToUsedList.push_back(G);
2516  }
2517  appendToCompilerUsed(M, ArrayRef<GlobalValue *>(GlobalsToAddToUsedList));
2518 
2519  std::string ELFUniqueModuleId =
2520  (UseGlobalsGC && TargetTriple.isOSBinFormatELF()) ? getUniqueModuleId(&M)
2521  : "";
2522 
2523  if (!ELFUniqueModuleId.empty()) {
2524  InstrumentGlobalsELF(IRB, M, NewGlobals, Initializers, ELFUniqueModuleId);
2525  *CtorComdat = true;
2526  } else if (UseGlobalsGC && TargetTriple.isOSBinFormatCOFF()) {
2527  InstrumentGlobalsCOFF(IRB, M, NewGlobals, Initializers);
2528  } else if (UseGlobalsGC && ShouldUseMachOGlobalsSection()) {
2529  InstrumentGlobalsMachO(IRB, M, NewGlobals, Initializers);
2530  } else {
2531  InstrumentGlobalsWithMetadataArray(IRB, M, NewGlobals, Initializers);
2532  }
2533 
2534  // Create calls for poisoning before initializers run and unpoisoning after.
2535  if (HasDynamicallyInitializedGlobals)
2536  createInitializerPoisonCalls(M, ModuleName);
2537 
2538  LLVM_DEBUG(dbgs() << M);
2539  return true;
2540 }
2541 
2542 uint64_t
2543 ModuleAddressSanitizer::getRedzoneSizeForGlobal(uint64_t SizeInBytes) const {
2544  constexpr uint64_t kMaxRZ = 1 << 18;
2545  const uint64_t MinRZ = getMinRedzoneSizeForGlobal();
2546 
2547  uint64_t RZ = 0;
2548  if (SizeInBytes <= MinRZ / 2) {
2549  // Reduce redzone size for small size objects, e.g. int, char[1]. MinRZ is
2550  // at least 32 bytes, optimize when SizeInBytes is less than or equal to
2551  // half of MinRZ.
2552  RZ = MinRZ - SizeInBytes;
2553  } else {
2554  // Calculate RZ, where MinRZ <= RZ <= MaxRZ, and RZ ~ 1/4 * SizeInBytes.
2555  RZ = std::max(MinRZ, std::min(kMaxRZ, (SizeInBytes / MinRZ / 4) * MinRZ));
2556 
2557  // Round up to multiple of MinRZ.
2558  if (SizeInBytes % MinRZ)
2559  RZ += MinRZ - (SizeInBytes % MinRZ);
2560  }
2561 
2562  assert((RZ + SizeInBytes) % MinRZ == 0);
2563 
2564  return RZ;
2565 }
2566 
2567 int ModuleAddressSanitizer::GetAsanVersion(const Module &M) const {
2568  int LongSize = M.getDataLayout().getPointerSizeInBits();
2569  bool isAndroid = Triple(M.getTargetTriple()).isAndroid();
2570  int Version = 8;
2571  // 32-bit Android is one version ahead because of the switch to dynamic
2572  // shadow.
2573  Version += (LongSize == 32 && isAndroid);
2574  return Version;
2575 }
2576 
2577 bool ModuleAddressSanitizer::instrumentModule(Module &M) {
2578  initializeCallbacks(M);
2579 
2580  // Create a module constructor. A destructor is created lazily because not all
2581  // platforms, and not all modules need it.
2582  if (CompileKernel) {
2583  // The kernel always builds with its own runtime, and therefore does not
2584  // need the init and version check calls.
2585  AsanCtorFunction = createSanitizerCtor(M, kAsanModuleCtorName);
2586  } else {
2587  std::string AsanVersion = std::to_string(GetAsanVersion(M));
2588  std::string VersionCheckName =
2589  ClInsertVersionCheck ? (kAsanVersionCheckNamePrefix + AsanVersion) : "";
2590  std::tie(AsanCtorFunction, std::ignore) =
2592  kAsanInitName, /*InitArgTypes=*/{},
2593  /*InitArgs=*/{}, VersionCheckName);
2594  }
2595 
2596  bool CtorComdat = true;
2597  if (ClGlobals) {
2598  IRBuilder<> IRB(AsanCtorFunction->getEntryBlock().getTerminator());
2599  InstrumentGlobals(IRB, M, &CtorComdat);
2600  }
2601 
2602  const uint64_t Priority = GetCtorAndDtorPriority(TargetTriple);
2603 
2604  // Put the constructor and destructor in comdat if both
2605  // (1) global instrumentation is not TU-specific
2606  // (2) target is ELF.
2607  if (UseCtorComdat && TargetTriple.isOSBinFormatELF() && CtorComdat) {
2608  AsanCtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleCtorName));
2609  appendToGlobalCtors(M, AsanCtorFunction, Priority, AsanCtorFunction);
2610  if (AsanDtorFunction) {
2611  AsanDtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleDtorName));
2612  appendToGlobalDtors(M, AsanDtorFunction, Priority, AsanDtorFunction);
2613  }
2614  } else {
2615  appendToGlobalCtors(M, AsanCtorFunction, Priority);
2616  if (AsanDtorFunction)
2617  appendToGlobalDtors(M, AsanDtorFunction, Priority);
2618  }
2619 
2620  return true;
2621 }
2622 
2623 void AddressSanitizer::initializeCallbacks(Module &M) {
2624  IRBuilder<> IRB(*C);
2625  // Create __asan_report* callbacks.
2626  // IsWrite, TypeSize and Exp are encoded in the function name.
2627  for (int Exp = 0; Exp < 2; Exp++) {
2628  for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) {
2629  const std::string TypeStr = AccessIsWrite ? "store" : "load";
2630  const std::string ExpStr = Exp ? "exp_" : "";
2631  const std::string EndingStr = Recover ? "_noabort" : "";
2632 
2633  SmallVector<Type *, 3> Args2 = {IntptrTy, IntptrTy};
2634  SmallVector<Type *, 2> Args1{1, IntptrTy};
2635  if (Exp) {
2636  Type *ExpType = Type::getInt32Ty(*C);
2637  Args2.push_back(ExpType);
2638  Args1.push_back(ExpType);
2639  }
2640  AsanErrorCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction(
2641  kAsanReportErrorTemplate + ExpStr + TypeStr + "_n" + EndingStr,
2642  FunctionType::get(IRB.getVoidTy(), Args2, false));
2643 
2644  AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] = M.getOrInsertFunction(
2645  ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr,
2646  FunctionType::get(IRB.getVoidTy(), Args2, false));
2647 
2648  for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes;
2649  AccessSizeIndex++) {
2650  const std::string Suffix = TypeStr + itostr(1ULL << AccessSizeIndex);
2651  AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] =
2652  M.getOrInsertFunction(
2653  kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr,
2654  FunctionType::get(IRB.getVoidTy(), Args1, false));
2655 
2656  AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] =
2657  M.getOrInsertFunction(
2658  ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr,
2659  FunctionType::get(IRB.getVoidTy(), Args1, false));
2660  }
2661  }
2662  }
2663 
2664  const std::string MemIntrinCallbackPrefix =
2665  CompileKernel ? std::string("") : ClMemoryAccessCallbackPrefix;
2666  AsanMemmove = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memmove",
2667  IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
2668  IRB.getInt8PtrTy(), IntptrTy);
2669  AsanMemcpy = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memcpy",
2670  IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
2671  IRB.getInt8PtrTy(), IntptrTy);
2672  AsanMemset = M.getOrInsertFunction(MemIntrinCallbackPrefix + "memset",
2673  IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
2674  IRB.getInt32Ty(), IntptrTy);
2675 
2676  AsanHandleNoReturnFunc =
2677  M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy());
2678 
2679  AsanPtrCmpFunction =
2680  M.getOrInsertFunction(kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy);
2681  AsanPtrSubFunction =
2682  M.getOrInsertFunction(kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy);
2683  if (Mapping.InGlobal)
2684  AsanShadowGlobal = M.getOrInsertGlobal("__asan_shadow",
2685  ArrayType::get(IRB.getInt8Ty(), 0));
2686 
2687  AMDGPUAddressShared = M.getOrInsertFunction(
2689  AMDGPUAddressPrivate = M.getOrInsertFunction(
2691 }
2692 
2693 bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) {
2694  // For each NSObject descendant having a +load method, this method is invoked
2695  // by the ObjC runtime before any of the static constructors is called.
2696  // Therefore we need to instrument such methods with a call to __asan_init
2697  // at the beginning in order to initialize our runtime before any access to
2698  // the shadow memory.
2699  // We cannot just ignore these methods, because they may call other
2700  // instrumented functions.
2701  if (F.getName().find(" load]") != std::string::npos) {
2702  FunctionCallee AsanInitFunction =
2703  declareSanitizerInitFunction(*F.getParent(), kAsanInitName, {});
2704  IRBuilder<> IRB(&F.front(), F.front().begin());
2705  IRB.CreateCall(AsanInitFunction, {});
2706  return true;
2707  }
2708  return false;
2709 }
2710 
2711 bool AddressSanitizer::maybeInsertDynamicShadowAtFunctionEntry(Function &F) {
2712  // Generate code only when dynamic addressing is needed.
2713  if (Mapping.Offset != kDynamicShadowSentinel)
2714  return false;
2715 
2716  IRBuilder<> IRB(&F.front().front());
2717  if (Mapping.InGlobal) {
2719  // An empty inline asm with input reg == output reg.
2720  // An opaque pointer-to-int cast, basically.
2722  FunctionType::get(IntptrTy, {AsanShadowGlobal->getType()}, false),
2723  StringRef(""), StringRef("=r,0"),
2724  /*hasSideEffects=*/false);
2725  LocalDynamicShadow =
2726  IRB.CreateCall(Asm, {AsanShadowGlobal}, ".asan.shadow");
2727  } else {
2728  LocalDynamicShadow =
2729  IRB.CreatePointerCast(AsanShadowGlobal, IntptrTy, ".asan.shadow");
2730  }
2731  } else {
2732  Value *GlobalDynamicAddress = F.getParent()->getOrInsertGlobal(
2734  LocalDynamicShadow = IRB.CreateLoad(IntptrTy, GlobalDynamicAddress);
2735  }
2736  return true;
2737 }
2738 
2739 void AddressSanitizer::markEscapedLocalAllocas(Function &F) {
2740  // Find the one possible call to llvm.localescape and pre-mark allocas passed
2741  // to it as uninteresting. This assumes we haven't started processing allocas
2742  // yet. This check is done up front because iterating the use list in
2743  // isInterestingAlloca would be algorithmically slower.
2744  assert(ProcessedAllocas.empty() && "must process localescape before allocas");
2745 
2746  // Try to get the declaration of llvm.localescape. If it's not in the module,
2747  // we can exit early.
2748  if (!F.getParent()->getFunction("llvm.localescape")) return;
2749 
2750  // Look for a call to llvm.localescape call in the entry block. It can't be in
2751  // any other block.
2752  for (Instruction &I : F.getEntryBlock()) {
2753  IntrinsicInst *II = dyn_cast<IntrinsicInst>(&I);
2754  if (II && II->getIntrinsicID() == Intrinsic::localescape) {
2755  // We found a call. Mark all the allocas passed in as uninteresting.
2756  for (Value *Arg : II->arg_operands()) {
2757  AllocaInst *AI = dyn_cast<AllocaInst>(Arg->stripPointerCasts());
2758  assert(AI && AI->isStaticAlloca() &&
2759  "non-static alloca arg to localescape");
2760  ProcessedAllocas[AI] = false;
2761  }
2762  break;
2763  }
2764  }
2765 }
2766 
2767 bool AddressSanitizer::suppressInstrumentationSiteForDebug(int &Instrumented) {
2768  bool ShouldInstrument =
2769  ClDebugMin < 0 || ClDebugMax < 0 ||
2770  (Instrumented >= ClDebugMin && Instrumented <= ClDebugMax);
2771  Instrumented++;
2772  return !ShouldInstrument;
2773 }
2774 
2775 bool AddressSanitizer::instrumentFunction(Function &F,
2776  const TargetLibraryInfo *TLI) {
2777  if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false;
2778  if (!ClDebugFunc.empty() && ClDebugFunc == F.getName()) return false;
2779  if (F.getName().startswith("__asan_")) return false;
2780 
2781  bool FunctionModified = false;
2782 
2783  // If needed, insert __asan_init before checking for SanitizeAddress attr.
2784  // This function needs to be called even if the function body is not
2785  // instrumented.
2786  if (maybeInsertAsanInitAtFunctionEntry(F))
2787  FunctionModified = true;
2788 
2789  // Leave if the function doesn't need instrumentation.
2790  if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return FunctionModified;
2791 
2792  LLVM_DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n");
2793 
2794  initializeCallbacks(*F.getParent());
2795 
2796  FunctionStateRAII CleanupObj(this);
2797 
2798  FunctionModified |= maybeInsertDynamicShadowAtFunctionEntry(F);
2799 
2800  // We can't instrument allocas used with llvm.localescape. Only static allocas
2801  // can be passed to that intrinsic.
2802  markEscapedLocalAllocas(F);
2803 
2804  // We want to instrument every address only once per basic block (unless there
2805  // are calls between uses).
2806  SmallPtrSet<Value *, 16> TempsToInstrument;
2807  SmallVector<InterestingMemoryOperand, 16> OperandsToInstrument;
2808  SmallVector<MemIntrinsic *, 16> IntrinToInstrument;
2809  SmallVector<Instruction *, 8> NoReturnCalls;
2811  SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts;
2812  int NumAllocas = 0;
2813 
2814  // Fill the set of memory operations to instrument.
2815  for (auto &BB : F) {
2816  AllBlocks.push_back(&BB);
2817  TempsToInstrument.clear();
2818  int NumInsnsPerBB = 0;
2819  for (auto &Inst : BB) {
2820  if (LooksLikeCodeInBug11395(&Inst)) return false;
2821  SmallVector<InterestingMemoryOperand, 1> InterestingOperands;
2822  getInterestingMemoryOperands(&Inst, InterestingOperands);
2823 
2824  if (!InterestingOperands.empty()) {
2825  for (auto &Operand : InterestingOperands) {
2826  if (ClOpt && ClOptSameTemp) {
2827  Value *Ptr = Operand.getPtr();
2828  // If we have a mask, skip instrumentation if we've already
2829  // instrumented the full object. But don't add to TempsToInstrument
2830  // because we might get another load/store with a different mask.
2831  if (Operand.MaybeMask) {
2832  if (TempsToInstrument.count(Ptr))
2833  continue; // We've seen this (whole) temp in the current BB.
2834  } else {
2835  if (!TempsToInstrument.insert(Ptr).second)
2836  continue; // We've seen this temp in the current BB.
2837  }
2838  }
2839  OperandsToInstrument.push_back(Operand);
2840  NumInsnsPerBB++;
2841  }
2842  } else if (((ClInvalidPointerPairs || ClInvalidPointerCmp) &&
2846  PointerComparisonsOrSubtracts.push_back(&Inst);
2847  } else if (MemIntrinsic *MI = dyn_cast<MemIntrinsic>(&Inst)) {
2848  // ok, take it.
2849  IntrinToInstrument.push_back(MI);
2850  NumInsnsPerBB++;
2851  } else {
2852  if (isa<AllocaInst>(Inst)) NumAllocas++;
2853  if (auto *CB = dyn_cast<CallBase>(&Inst)) {
2854  // A call inside BB.
2855  TempsToInstrument.clear();
2856  if (CB->doesNotReturn() && !CB->hasMetadata("nosanitize"))
2857  NoReturnCalls.push_back(CB);
2858  }
2859  if (CallInst *CI = dyn_cast<CallInst>(&Inst))
2861  }
2862  if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break;
2863  }
2864  }
2865 
2866  bool UseCalls = (ClInstrumentationWithCallsThreshold >= 0 &&
2867  OperandsToInstrument.size() + IntrinToInstrument.size() >
2869  const DataLayout &DL = F.getParent()->getDataLayout();
2870  ObjectSizeOpts ObjSizeOpts;
2871  ObjSizeOpts.RoundToAlign = true;
2872  ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), ObjSizeOpts);
2873 
2874  // Instrument.
2875  int NumInstrumented = 0;
2876  for (auto &Operand : OperandsToInstrument) {
2877  if (!suppressInstrumentationSiteForDebug(NumInstrumented))
2878  instrumentMop(ObjSizeVis, Operand, UseCalls,
2879  F.getParent()->getDataLayout());
2880  FunctionModified = true;
2881  }
2882  for (auto Inst : IntrinToInstrument) {
2883  if (!suppressInstrumentationSiteForDebug(NumInstrumented))
2884  instrumentMemIntrinsic(Inst);
2885  FunctionModified = true;
2886  }
2887 
2888  FunctionStackPoisoner FSP(F, *this);
2889  bool ChangedStack = FSP.runOnFunction();
2890 
2891  // We must unpoison the stack before NoReturn calls (throw, _exit, etc).
2892  // See e.g. https://github.com/google/sanitizers/issues/37
2893  for (auto CI : NoReturnCalls) {
2894  IRBuilder<> IRB(CI);
2895  IRB.CreateCall(AsanHandleNoReturnFunc, {});
2896  }
2897 
2898  for (auto Inst : PointerComparisonsOrSubtracts) {
2899  instrumentPointerComparisonOrSubtraction(Inst);
2900  FunctionModified = true;
2901  }
2902 
2903  if (ChangedStack || !NoReturnCalls.empty())
2904  FunctionModified = true;
2905 
2906  LLVM_DEBUG(dbgs() << "ASAN done instrumenting: " << FunctionModified << " "
2907  << F << "\n");
2908 
2909  return FunctionModified;
2910 }
2911 
2912 // Workaround for bug 11395: we don't want to instrument stack in functions
2913 // with large assembly blobs (32-bit only), otherwise reg alloc may crash.
2914 // FIXME: remove once the bug 11395 is fixed.
2915 bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) {
2916  if (LongSize != 32) return false;
2917  CallInst *CI = dyn_cast<CallInst>(I);
2918  if (!CI || !CI->isInlineAsm()) return false;
2919  if (CI->getNumArgOperands() <= 5) return false;
2920  // We have inline assembly with quite a few arguments.
2921  return true;
2922 }
2923 
2924 void FunctionStackPoisoner::initializeCallbacks(Module &M) {
2925  IRBuilder<> IRB(*C);
2926  if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always ||
2927  ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) {
2928  const char *MallocNameTemplate =
2929  ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Always
2932  for (int Index = 0; Index <= kMaxAsanStackMallocSizeClass; Index++) {
2933  std::string Suffix = itostr(Index);
2934  AsanStackMallocFunc[Index] = M.getOrInsertFunction(
2935  MallocNameTemplate + Suffix, IntptrTy, IntptrTy);
2936  AsanStackFreeFunc[Index] =
2937  M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix,
2938  IRB.getVoidTy(), IntptrTy, IntptrTy);
2939  }
2940  }
2941  if (ASan.UseAfterScope) {
2942  AsanPoisonStackMemoryFunc = M.getOrInsertFunction(
2943  kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy);
2944  AsanUnpoisonStackMemoryFunc = M.getOrInsertFunction(
2945  kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy);
2946  }
2947 
2948  for (size_t Val : {0x00, 0xf1, 0xf2, 0xf3, 0xf5, 0xf8}) {
2949  std::ostringstream Name;
2951  Name << std::setw(2) << std::setfill('0') << std::hex << Val;
2952  AsanSetShadowFunc[Val] =
2953  M.getOrInsertFunction(Name.str(), IRB.getVoidTy(), IntptrTy, IntptrTy);
2954  }
2955 
2956  AsanAllocaPoisonFunc = M.getOrInsertFunction(
2957  kAsanAllocaPoison, IRB.getVoidTy(), IntptrTy, IntptrTy);
2958  AsanAllocasUnpoisonFunc = M.getOrInsertFunction(
2959  kAsanAllocasUnpoison, IRB.getVoidTy(), IntptrTy, IntptrTy);
2960 }
2961 
2962 void FunctionStackPoisoner::copyToShadowInline(ArrayRef<uint8_t> ShadowMask,
2963  ArrayRef<uint8_t> ShadowBytes,
2964  size_t Begin, size_t End,
2965  IRBuilder<> &IRB,
2966  Value *ShadowBase) {
2967  if (Begin >= End)
2968  return;
2969 
2970  const size_t LargestStoreSizeInBytes =
2971  std::min<size_t>(sizeof(uint64_t), ASan.LongSize / 8);
2972 
2973  const bool IsLittleEndian = F.getParent()->getDataLayout().isLittleEndian();
2974 
2975  // Poison given range in shadow using larges store size with out leading and
2976  // trailing zeros in ShadowMask. Zeros never change, so they need neither
2977  // poisoning nor up-poisoning. Still we don't mind if some of them get into a
2978  // middle of a store.
2979  for (size_t i = Begin; i < End;) {
2980  if (!ShadowMask[i]) {
2981  assert(!ShadowBytes[i]);
2982  ++i;
2983  continue;
2984  }
2985 
2986  size_t StoreSizeInBytes = LargestStoreSizeInBytes;
2987  // Fit store size into the range.
2988  while (StoreSizeInBytes > End - i)
2989  StoreSizeInBytes /= 2;
2990 
2991  // Minimize store size by trimming trailing zeros.
2992  for (size_t j = StoreSizeInBytes - 1; j && !ShadowMask[i + j]; --j) {
2993  while (j <= StoreSizeInBytes / 2)
2994  StoreSizeInBytes /= 2;
2995  }
2996 
2997  uint64_t Val = 0;
2998  for (size_t j = 0; j < StoreSizeInBytes; j++) {
2999  if (IsLittleEndian)
3000  Val |= (uint64_t)ShadowBytes[i + j] << (8 * j);
3001  else
3002  Val = (Val << 8) | ShadowBytes[i + j];
3003  }
3004 
3005  Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i));
3006  Value *Poison = IRB.getIntN(StoreSizeInBytes * 8, Val);
3007  IRB.CreateAlignedStore(
3008  Poison, IRB.CreateIntToPtr(Ptr, Poison->getType()->getPointerTo()),
3009  Align(1));
3010 
3011  i += StoreSizeInBytes;
3012  }
3013 }
3014 
3015 void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask,
3016  ArrayRef<uint8_t> ShadowBytes,
3017  IRBuilder<> &IRB, Value *ShadowBase) {
3018  copyToShadow(ShadowMask, ShadowBytes, 0, ShadowMask.size(), IRB, ShadowBase);
3019 }
3020 
3021 void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask,
3022  ArrayRef<uint8_t> ShadowBytes,
3023  size_t Begin, size_t End,
3024  IRBuilder<> &IRB, Value *ShadowBase) {
3025  assert(ShadowMask.size() == ShadowBytes.size());
3026  size_t Done = Begin;
3027  for (size_t i = Begin, j = Begin + 1; i < End; i = j++) {
3028  if (!ShadowMask[i]) {
3029  assert(!ShadowBytes[i]);
3030  continue;
3031  }
3032  uint8_t Val = ShadowBytes[i];
3033  if (!AsanSetShadowFunc[Val])
3034  continue;
3035 
3036  // Skip same values.
3037  for (; j < End && ShadowMask[j] && Val == ShadowBytes[j]; ++j) {
3038  }
3039 
3040  if (j - i >= ClMaxInlinePoisoningSize) {
3041  copyToShadowInline(ShadowMask, ShadowBytes, Done, i, IRB, ShadowBase);
3042  IRB.CreateCall(AsanSetShadowFunc[Val],
3043  {IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i)),
3044  ConstantInt::get(IntptrTy, j - i)});
3045  Done = j;
3046  }
3047  }
3048 
3049  copyToShadowInline(ShadowMask, ShadowBytes, Done, End, IRB, ShadowBase);
3050 }
3051 
3052 // Fake stack allocator (asan_fake_stack.h) has 11 size classes
3053 // for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass
3054 static int StackMallocSizeClass(uint64_t LocalStackSize) {
3055  assert(LocalStackSize <= kMaxStackMallocSize);
3056  uint64_t MaxSize = kMinStackMallocSize;
3057  for (int i = 0;; i++, MaxSize *= 2)
3058  if (LocalStackSize <= MaxSize) return i;
3059  llvm_unreachable("impossible LocalStackSize");
3060 }
3061 
3062 void FunctionStackPoisoner::copyArgsPassedByValToAllocas() {
3063  Instruction *CopyInsertPoint = &F.front().front();
3064  if (CopyInsertPoint == ASan.LocalDynamicShadow) {
3065  // Insert after the dynamic shadow location is determined
3066  CopyInsertPoint = CopyInsertPoint->getNextNode();
3067  assert(CopyInsertPoint);
3068  }
3069  IRBuilder<> IRB(CopyInsertPoint);
3070  const DataLayout &DL = F.getParent()->getDataLayout();
3071  for (Argument &Arg : F.args()) {
3072  if (Arg.hasByValAttr()) {
3073  Type *Ty = Arg.getParamByValType();
3074  const Align Alignment =
3075  DL.getValueOrABITypeAlignment(Arg.getParamAlign(), Ty);
3076 
3077  AllocaInst *AI = IRB.CreateAlloca(
3078  Ty, nullptr,
3079  (Arg.hasName() ? Arg.getName() : "Arg" + Twine(Arg.getArgNo())) +
3080  ".byval");
3081  AI->setAlignment(Alignment);
3082  Arg.replaceAllUsesWith(AI);
3083 
3084  uint64_t AllocSize = DL.getTypeAllocSize(Ty);
3085  IRB.CreateMemCpy(AI, Alignment, &Arg, Alignment, AllocSize);
3086  }
3087  }
3088 }
3089 
3090 PHINode *FunctionStackPoisoner::createPHI(IRBuilder<> &IRB, Value *Cond,
3091  Value *ValueIfTrue,
3092  Instruction *ThenTerm,
3093  Value *ValueIfFalse) {
3094  PHINode *PHI = IRB.CreatePHI(IntptrTy, 2);
3095  BasicBlock *CondBlock = cast<Instruction>(Cond)->getParent();
3096  PHI->addIncoming(ValueIfFalse, CondBlock);
3097  BasicBlock *ThenBlock = ThenTerm->getParent();
3098  PHI->addIncoming(ValueIfTrue, ThenBlock);
3099  return PHI;
3100 }
3101 
3102 Value *FunctionStackPoisoner::createAllocaForLayout(
3103  IRBuilder<> &IRB, const ASanStackFrameLayout &L, bool Dynamic) {
3104  AllocaInst *Alloca;
3105  if (Dynamic) {
3106  Alloca = IRB.CreateAlloca(IRB.getInt8Ty(),
3108  "MyAlloca");
3109  } else {
3110  Alloca = IRB.CreateAlloca(ArrayType::get(IRB.getInt8Ty(), L.FrameSize),
3111  nullptr, "MyAlloca");
3112  assert(Alloca->isStaticAlloca());
3113  }
3114  assert((ClRealignStack & (ClRealignStack - 1)) == 0);
3115  size_t FrameAlignment = std::max(L.FrameAlignment, (size_t)ClRealignStack);
3116  Alloca->setAlignment(Align(FrameAlignment));
3117  return IRB.CreatePointerCast(Alloca, IntptrTy);
3118 }
3119 
3120 void FunctionStackPoisoner::createDynamicAllocasInitStorage() {
3121  BasicBlock &FirstBB = *F.begin();
3122  IRBuilder<> IRB(dyn_cast<Instruction>(FirstBB.begin()));
3123  DynamicAllocaLayout = IRB.CreateAlloca(IntptrTy, nullptr);
3124  IRB.CreateStore(Constant::getNullValue(IntptrTy), DynamicAllocaLayout);
3125  DynamicAllocaLayout->setAlignment(Align(32));
3126 }
3127 
3128 void FunctionStackPoisoner::processDynamicAllocas() {
3129  if (!ClInstrumentDynamicAllocas || DynamicAllocaVec.empty()) {
3130  assert(DynamicAllocaPoisonCallVec.empty());
3131  return;
3132  }
3133 
3134  // Insert poison calls for lifetime intrinsics for dynamic allocas.
3135  for (const auto &APC : DynamicAllocaPoisonCallVec) {
3136  assert(APC.InsBefore);
3137  assert(APC.AI);
3138  assert(ASan.isInterestingAlloca(*APC.AI));
3139  assert(!APC.AI->isStaticAlloca());
3140 
3141  IRBuilder<> IRB(APC.InsBefore);
3142  poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison);
3143  // Dynamic allocas will be unpoisoned unconditionally below in
3144  // unpoisonDynamicAllocas.
3145  // Flag that we need unpoison static allocas.
3146  }
3147 
3148  // Handle dynamic allocas.
3149  createDynamicAllocasInitStorage();
3150  for (auto &AI : DynamicAllocaVec)
3151  handleDynamicAllocaCall(AI);
3152  unpoisonDynamicAllocas();
3153 }
3154 
3155 /// Collect instructions in the entry block after \p InsBefore which initialize
3156 /// permanent storage for a function argument. These instructions must remain in
3157 /// the entry block so that uninitialized values do not appear in backtraces. An
3158 /// added benefit is that this conserves spill slots. This does not move stores
3159 /// before instrumented / "interesting" allocas.
3161  AddressSanitizer &ASan, Instruction &InsBefore,
3162  SmallVectorImpl<Instruction *> &InitInsts) {
3163  Instruction *Start = InsBefore.getNextNonDebugInstruction();
3164  for (Instruction *It = Start; It; It = It->getNextNonDebugInstruction()) {
3165  // Argument initialization looks like:
3166  // 1) store <Argument>, <Alloca> OR
3167  // 2) <CastArgument> = cast <Argument> to ...
3168  // store <CastArgument> to <Alloca>
3169  // Do not consider any other kind of instruction.
3170  //
3171  // Note: This covers all known cases, but may not be exhaustive. An
3172  // alternative to pattern-matching stores is to DFS over all Argument uses:
3173  // this might be more general, but is probably much more complicated.
3174  if (isa<AllocaInst>(It) || isa<CastInst>(It))
3175  continue;
3176  if (auto *Store = dyn_cast<StoreInst>(It)) {
3177  // The store destination must be an alloca that isn't interesting for
3178  // ASan to instrument. These are moved up before InsBefore, and they're
3179  // not interesting because allocas for arguments can be mem2reg'd.
3180  auto *Alloca = dyn_cast<AllocaInst>(Store->getPointerOperand());
3181  if (!Alloca || ASan.isInterestingAlloca(*Alloca))
3182  continue;
3183 
3184  Value *Val = Store->getValueOperand();
3185  bool IsDirectArgInit = isa<Argument>(Val);
3186  bool IsArgInitViaCast =
3187  isa<CastInst>(Val) &&
3188  isa<Argument>(cast<CastInst>(Val)->getOperand(0)) &&
3189  // Check that the cast appears directly before the store. Otherwise
3190  // moving the cast before InsBefore may break the IR.
3191  Val == It->getPrevNonDebugInstruction();
3192  bool IsArgInit = IsDirectArgInit || IsArgInitViaCast;
3193  if (!IsArgInit)
3194  continue;
3195 
3196  if (IsArgInitViaCast)
3197  InitInsts.push_back(cast<Instruction>(Val));
3198  InitInsts.push_back(Store);
3199  continue;
3200  }
3201 
3202  // Do not reorder past unknown instructions: argument initialization should
3203  // only involve casts and stores.
3204  return;
3205  }
3206 }
3207 
3208 void FunctionStackPoisoner::processStaticAllocas() {
3209  if (AllocaVec.empty()) {
3210  assert(StaticAllocaPoisonCallVec.empty());
3211  return;
3212  }
3213 
3214  int StackMallocIdx = -1;
3215  DebugLoc EntryDebugLocation;
3216  if (auto SP = F.getSubprogram())
3217  EntryDebugLocation =
3218  DILocation::get(SP->getContext(), SP->getScopeLine(), 0, SP);
3219 
3220  Instruction *InsBefore = AllocaVec[0];
3221  IRBuilder<> IRB(InsBefore);
3222 
3223  // Make sure non-instrumented allocas stay in the entry block. Otherwise,
3224  // debug info is broken, because only entry-block allocas are treated as
3225  // regular stack slots.
3226  auto InsBeforeB = InsBefore->getParent();
3227  assert(InsBeforeB == &F.getEntryBlock());
3228  for (auto *AI : StaticAllocasToMoveUp)
3229  if (AI->getParent() == InsBeforeB)
3230  AI->moveBefore(InsBefore);
3231 
3232  // Move stores of arguments into entry-block allocas as well. This prevents
3233  // extra stack slots from being generated (to house the argument values until
3234  // they can be stored into the allocas). This also prevents uninitialized
3235  // values from being shown in backtraces.
3236  SmallVector<Instruction *, 8> ArgInitInsts;
3237  findStoresToUninstrumentedArgAllocas(ASan, *InsBefore, ArgInitInsts);
3238  for (Instruction *ArgInitInst : ArgInitInsts)
3239  ArgInitInst->moveBefore(InsBefore);
3240 
3241  // If we have a call to llvm.localescape, keep it in the entry block.
3242  if (LocalEscapeCall) LocalEscapeCall->moveBefore(InsBefore);
3243 
3245  SVD.reserve(AllocaVec.size());
3246  for (AllocaInst *AI : AllocaVec) {
3248  ASan.getAllocaSizeInBytes(*AI),
3249  0,
3250  AI->getAlignment(),
3251  AI,
3252  0,
3253  0};
3254  SVD.push_back(D);
3255  }
3256 
3257  // Minimal header size (left redzone) is 4 pointers,
3258  // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms.
3259  size_t Granularity = 1ULL << Mapping.Scale;
3260  size_t MinHeaderSize = std::max((size_t)ASan.LongSize / 2, Granularity);
3261  const ASanStackFrameLayout &L =
3262  ComputeASanStackFrameLayout(SVD, Granularity, MinHeaderSize);
3263 
3264  // Build AllocaToSVDMap for ASanStackVariableDescription lookup.
3266  for (auto &Desc : SVD)
3267  AllocaToSVDMap[Desc.AI] = &Desc;
3268 
3269  // Update SVD with information from lifetime intrinsics.
3270  for (const auto &APC : StaticAllocaPoisonCallVec) {
3271  assert(APC.InsBefore);
3272  assert(APC.AI);
3273  assert(ASan.isInterestingAlloca(*APC.AI));
3274  assert(APC.AI->isStaticAlloca());
3275 
3276  ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI];
3277  Desc.LifetimeSize = Desc.Size;
3278  if (const DILocation *FnLoc = EntryDebugLocation.get()) {
3279  if (const DILocation *LifetimeLoc = APC.InsBefore->getDebugLoc().get()) {
3280  if (LifetimeLoc->getFile() == FnLoc->getFile())
3281  if (unsigned Line = LifetimeLoc->getLine())
3282  Desc.Line = std::min(Desc.Line ? Desc.Line : Line, Line);
3283  }
3284  }
3285  }
3286 
3287  auto DescriptionString = ComputeASanStackFrameDescription(SVD);
3288  LLVM_DEBUG(dbgs() << DescriptionString << " --- " << L.FrameSize << "\n");
3289  uint64_t LocalStackSize = L.FrameSize;
3290  bool DoStackMalloc =
3291  ASan.UseAfterReturn != AsanDetectStackUseAfterReturnMode::Never &&
3292  !ASan.CompileKernel && LocalStackSize <= kMaxStackMallocSize;
3293  bool DoDynamicAlloca = ClDynamicAllocaStack;
3294  // Don't do dynamic alloca or stack malloc if:
3295  // 1) There is inline asm: too often it makes assumptions on which registers
3296  // are available.
3297  // 2) There is a returns_twice call (typically setjmp), which is
3298  // optimization-hostile, and doesn't play well with introduced indirect
3299  // register-relative calculation of local variable addresses.
3300  DoDynamicAlloca &= !HasInlineAsm && !HasReturnsTwiceCall;
3301  DoStackMalloc &= !HasInlineAsm && !HasReturnsTwiceCall;
3302 
3303  Value *StaticAlloca =
3304  DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false);
3305 
3306  Value *FakeStack;
3307  Value *LocalStackBase;
3308  Value *LocalStackBaseAlloca;
3309  uint8_t DIExprFlags = DIExpression::ApplyOffset;
3310 
3311  if (DoStackMalloc) {
3312  LocalStackBaseAlloca =
3313  IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base");
3314  if (ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) {
3315  // void *FakeStack = __asan_option_detect_stack_use_after_return
3316  // ? __asan_stack_malloc_N(LocalStackSize)
3317  // : nullptr;
3318  // void *LocalStackBase = (FakeStack) ? FakeStack :
3319  // alloca(LocalStackSize);
3320  Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal(
3322  Value *UseAfterReturnIsEnabled = IRB.CreateICmpNE(
3323  IRB.CreateLoad(IRB.getInt32Ty(), OptionDetectUseAfterReturn),
3325  Instruction *Term =
3326  SplitBlockAndInsertIfThen(UseAfterReturnIsEnabled, InsBefore, false);
3327  IRBuilder<> IRBIf(Term);
3328  StackMallocIdx = StackMallocSizeClass(LocalStackSize);
3329  assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass);
3330  Value *FakeStackValue =
3331  IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx],
3332  ConstantInt::get(IntptrTy, LocalStackSize));
3333  IRB.SetInsertPoint(InsBefore);
3334  FakeStack = createPHI(IRB, UseAfterReturnIsEnabled, FakeStackValue, Term,
3335  ConstantInt::get(IntptrTy, 0));
3336  } else {
3337  // assert(ASan.UseAfterReturn == AsanDetectStackUseAfterReturnMode:Always)
3338  // void *FakeStack = __asan_stack_malloc_N(LocalStackSize);
3339  // void *LocalStackBase = (FakeStack) ? FakeStack :
3340  // alloca(LocalStackSize);
3341  StackMallocIdx = StackMallocSizeClass(LocalStackSize);
3342  FakeStack = IRB.CreateCall(AsanStackMallocFunc[StackMallocIdx],
3343  ConstantInt::get(IntptrTy, LocalStackSize));
3344  }
3345  Value *NoFakeStack =
3346  IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy));
3347  Instruction *Term =
3348  SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false);
3349  IRBuilder<> IRBIf(Term);
3350  Value *AllocaValue =
3351  DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca;
3352 
3353  IRB.SetInsertPoint(InsBefore);
3354  LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
3355  IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca);
3356  DIExprFlags |= DIExpression::DerefBefore;
3357  } else {
3358  // void *FakeStack = nullptr;
3359  // void *LocalStackBase = alloca(LocalStackSize);
3360  FakeStack = ConstantInt::get(IntptrTy, 0);
3361  LocalStackBase =
3362  DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca;
3363  LocalStackBaseAlloca = LocalStackBase;
3364  }
3365 
3366  // It shouldn't matter whether we pass an `alloca` or a `ptrtoint` as the
3367  // dbg.declare address opereand, but passing a `ptrtoint` seems to confuse
3368  // later passes and can result in dropped variable coverage in debug info.
3369  Value *LocalStackBaseAllocaPtr =
3370  isa<PtrToIntInst>(LocalStackBaseAlloca)
3371  ? cast<PtrToIntInst>(LocalStackBaseAlloca)->getPointerOperand()
3372  : LocalStackBaseAlloca;
3373  assert(isa<AllocaInst>(LocalStackBaseAllocaPtr) &&
3374  "Variable descriptions relative to ASan stack base will be dropped");
3375 
3376  // Replace Alloca instructions with base+offset.
3377  for (const auto &Desc : SVD) {
3378  AllocaInst *AI = Desc.AI;
3379  replaceDbgDeclare(AI, LocalStackBaseAllocaPtr, DIB, DIExprFlags,
3380  Desc.Offset);
3381  Value *NewAllocaPtr = IRB.CreateIntToPtr(
3382  IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)),
3383  AI->getType());
3384  AI->replaceAllUsesWith(NewAllocaPtr);
3385  }
3386 
3387  // The left-most redzone has enough space for at least 4 pointers.
3388  // Write the Magic value to redzone[0].
3389  Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy);
3391  BasePlus0);
3392  // Write the frame description constant to redzone[1].
3393  Value *BasePlus1 = IRB.CreateIntToPtr(
3394  IRB.CreateAdd(LocalStackBase,
3395  ConstantInt::get(IntptrTy, ASan.LongSize / 8)),
3396  IntptrPtrTy);
3397  GlobalVariable *StackDescriptionGlobal =
3398  createPrivateGlobalForString(*F.getParent(), DescriptionString,
3399  /*AllowMerging*/ true, kAsanGenPrefix);
3400  Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy);
3401  IRB.CreateStore(Description, BasePlus1);
3402  // Write the PC to redzone[2].
3403  Value *BasePlus2 = IRB.CreateIntToPtr(
3404  IRB.CreateAdd(LocalStackBase,
3405  ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)),
3406  IntptrPtrTy);
3407  IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2);
3408 
3409  const auto &ShadowAfterScope = GetShadowBytesAfterScope(SVD, L);
3410 
3411  // Poison the stack red zones at the entry.
3412  Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB);
3413  // As mask we must use most poisoned case: red zones and after scope.
3414  // As bytes we can use either the same or just red zones only.
3415  copyToShadow(ShadowAfterScope, ShadowAfterScope, IRB, ShadowBase);
3416 
3417  if (!StaticAllocaPoisonCallVec.empty()) {
3418  const auto &ShadowInScope = GetShadowBytes(SVD, L);
3419 
3420  // Poison static allocas near lifetime intrinsics.
3421  for (const auto &APC : StaticAllocaPoisonCallVec) {
3422  const ASanStackVariableDescription &Desc = *AllocaToSVDMap[APC.AI];
3423  assert(Desc.Offset % L.Granularity == 0);
3424  size_t Begin = Desc.Offset / L.Granularity;
3425  size_t End = Begin + (APC.Size + L.Granularity - 1) / L.Granularity;
3426 
3427  IRBuilder<> IRB(APC.InsBefore);
3428  copyToShadow(ShadowAfterScope,
3429  APC.DoPoison ? ShadowAfterScope : ShadowInScope, Begin, End,
3430  IRB, ShadowBase);
3431  }
3432  }
3433 
3434  SmallVector<uint8_t, 64> ShadowClean(ShadowAfterScope.size(), 0);
3435  SmallVector<uint8_t, 64> ShadowAfterReturn;
3436 
3437  // (Un)poison the stack before all ret instructions.
3438  for (Instruction *Ret : RetVec) {
3439  IRBuilder<> IRBRet(Ret);
3440  // Mark the current frame as retired.
3441  IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic),
3442  BasePlus0);
3443  if (DoStackMalloc) {
3444  assert(StackMallocIdx >= 0);
3445  // if FakeStack != 0 // LocalStackBase == FakeStack
3446  // // In use-after-return mode, poison the whole stack frame.
3447  // if StackMallocIdx <= 4
3448  // // For small sizes inline the whole thing:
3449  // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize);
3450  // **SavedFlagPtr(FakeStack) = 0
3451  // else
3452  // __asan_stack_free_N(FakeStack, LocalStackSize)
3453  // else
3454  // <This is not a fake stack; unpoison the redzones>
3455  Value *Cmp =
3456  IRBRet.CreateICmpNE(FakeStack, Constant::getNullValue(IntptrTy));
3457  Instruction *ThenTerm, *ElseTerm;
3458  SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm);
3459 
3460  IRBuilder<> IRBPoison(ThenTerm);
3461  if (StackMallocIdx <= 4) {
3462  int ClassSize = kMinStackMallocSize << StackMallocIdx;
3463  ShadowAfterReturn.resize(ClassSize / L.Granularity,
3465  copyToShadow(ShadowAfterReturn, ShadowAfterReturn, IRBPoison,
3466  ShadowBase);
3467  Value *SavedFlagPtrPtr = IRBPoison.CreateAdd(
3468  FakeStack,
3469  ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8));
3470  Value *SavedFlagPtr = IRBPoison.CreateLoad(
3471  IntptrTy, IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy));
3472  IRBPoison.CreateStore(
3473  Constant::getNullValue(IRBPoison.getInt8Ty()),
3474  IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy()));
3475  } else {
3476  // For larger frames call __asan_stack_free_*.
3477  IRBPoison.CreateCall(
3478  AsanStackFreeFunc[StackMallocIdx],
3479  {FakeStack, ConstantInt::get(IntptrTy, LocalStackSize)});
3480  }
3481 
3482  IRBuilder<> IRBElse(ElseTerm);
3483  copyToShadow(ShadowAfterScope, ShadowClean, IRBElse, ShadowBase);
3484  } else {
3485  copyToShadow(ShadowAfterScope, ShadowClean, IRBRet, ShadowBase);
3486  }
3487  }
3488 
3489  // We are done. Remove the old unused alloca instructions.
3490  for (auto AI : AllocaVec) AI->eraseFromParent();
3491 }
3492 
3493 void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size,
3494  IRBuilder<> &IRB, bool DoPoison) {
3495  // For now just insert the call to ASan runtime.
3496  Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy);
3497  Value *SizeArg = ConstantInt::get(IntptrTy, Size);
3498  IRB.CreateCall(
3499  DoPoison ? AsanPoisonStackMemoryFunc : AsanUnpoisonStackMemoryFunc,
3500  {AddrArg, SizeArg});
3501 }
3502 
3503 // Handling llvm.lifetime intrinsics for a given %alloca:
3504 // (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca.
3505 // (2) if %size is constant, poison memory for llvm.lifetime.end (to detect
3506 // invalid accesses) and unpoison it for llvm.lifetime.start (the memory
3507 // could be poisoned by previous llvm.lifetime.end instruction, as the
3508 // variable may go in and out of scope several times, e.g. in loops).
3509 // (3) if we poisoned at least one %alloca in a function,
3510 // unpoison the whole stack frame at function exit.
3511 void FunctionStackPoisoner::handleDynamicAllocaCall(AllocaInst *AI) {
3512  IRBuilder<> IRB(AI);
3513 
3514  const unsigned Alignment = std::max(kAllocaRzSize, AI->getAlignment());
3515  const uint64_t AllocaRedzoneMask = kAllocaRzSize - 1;
3516 
3517  Value *Zero = Constant::getNullValue(IntptrTy);
3518  Value *AllocaRzSize = ConstantInt::get(IntptrTy, kAllocaRzSize);
3519  Value *AllocaRzMask = ConstantInt::get(IntptrTy, AllocaRedzoneMask);
3520 
3521  // Since we need to extend alloca with additional memory to locate
3522  // redzones, and OldSize is number of allocated blocks with
3523  // ElementSize size, get allocated memory size in bytes by
3524  // OldSize * ElementSize.
3525  const unsigned ElementSize =
3526  F.getParent()->getDataLayout().getTypeAllocSize(AI->getAllocatedType());
3527  Value *OldSize =
3528  IRB.CreateMul(IRB.CreateIntCast(AI->getArraySize(), IntptrTy, false),
3529  ConstantInt::get(IntptrTy, ElementSize));
3530 
3531  // PartialSize = OldSize % 32
3532  Value *PartialSize = IRB.CreateAnd(OldSize, AllocaRzMask);
3533 
3534  // Misalign = kAllocaRzSize - PartialSize;
3535  Value *Misalign = IRB.CreateSub(AllocaRzSize, PartialSize);
3536 
3537  // PartialPadding = Misalign != kAllocaRzSize ? Misalign : 0;
3538  Value *Cond = IRB.CreateICmpNE(Misalign, AllocaRzSize);
3539  Value *PartialPadding = IRB.CreateSelect(Cond, Misalign, Zero);
3540 
3541  // AdditionalChunkSize = Alignment + PartialPadding + kAllocaRzSize
3542  // Alignment is added to locate left redzone, PartialPadding for possible
3543  // partial redzone and kAllocaRzSize for right redzone respectively.
3544  Value *AdditionalChunkSize = IRB.CreateAdd(
3545  ConstantInt::get(IntptrTy, Alignment + kAllocaRzSize), PartialPadding);
3546 
3547  Value *NewSize = IRB.CreateAdd(OldSize, AdditionalChunkSize);
3548 
3549  // Insert new alloca with new NewSize and Alignment params.
3550  AllocaInst *NewAlloca = IRB.CreateAlloca(IRB.getInt8Ty(), NewSize);
3551  NewAlloca->setAlignment(Align(Alignment));
3552 
3553  // NewAddress = Address + Alignment
3554  Value *NewAddress = IRB.CreateAdd(IRB.CreatePtrToInt(NewAlloca, IntptrTy),
3555  ConstantInt::get(IntptrTy, Alignment));
3556 
3557  // Insert __asan_alloca_poison call for new created alloca.
3558  IRB.CreateCall(AsanAllocaPoisonFunc, {NewAddress, OldSize});
3559 
3560  // Store the last alloca's address to DynamicAllocaLayout. We'll need this
3561  // for unpoisoning stuff.
3562  IRB.CreateStore(IRB.CreatePtrToInt(NewAlloca, IntptrTy), DynamicAllocaLayout);
3563 
3564  Value *NewAddressPtr = IRB.CreateIntToPtr(NewAddress, AI->getType());
3565 
3566  // Replace all uses of AddessReturnedByAlloca with NewAddressPtr.
3567  AI->replaceAllUsesWith(NewAddressPtr);
3568 
3569  // We are done. Erase old alloca from parent.
3570  AI->eraseFromParent();
3571 }
3572 
3573 // isSafeAccess returns true if Addr is always inbounds with respect to its
3574 // base object. For example, it is a field access or an array access with
3575 // constant inbounds index.
3576 bool AddressSanitizer::isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis,
3577  Value *Addr, uint64_t TypeSize) const {
3578  SizeOffsetType SizeOffset = ObjSizeVis.compute(Addr);
3579  if (!ObjSizeVis.bothKnown(SizeOffset)) return false;
3580  uint64_t Size = SizeOffset.first.getZExtValue();
3581  int64_t Offset = SizeOffset.second.getSExtValue();
3582  // Three checks are required to ensure safety:
3583  // . Offset >= 0 (since the offset is given from the base ptr)
3584  // . Size >= Offset (unsigned)
3585  // . Size - Offset >= NeededSize (unsigned)
3586  return Offset >= 0 && Size >= uint64_t(Offset) &&
3587  Size - uint64_t(Offset) >= TypeSize / 8;
3588 }
llvm::Check::Size
@ Size
Definition: FileCheck.h:73
llvm::MachO::S_CSTRING_LITERALS
@ S_CSTRING_LITERALS
S_CSTRING_LITERALS - Section with literal C strings.
Definition: MachO.h:129
i
i
Definition: README.txt:29
use
Move duplicate certain instructions close to their use
Definition: Localizer.cpp:31
AddressSanitizer.h
llvm::PreservedAnalyses
A set of analyses that are preserved following a run of a transformation pass.
Definition: PassManager.h:155
Instrumentation.h
llvm::Triple::riscv64
@ riscv64
Definition: Triple.h:74
llvm::SizeOffsetType
std::pair< APInt, APInt > SizeOffsetType
Definition: MemoryBuiltins.h:231
kRetiredStackFrameMagic
static const uintptr_t kRetiredStackFrameMagic
Definition: AddressSanitizer.cpp:126
llvm::OuterAnalysisManagerProxy
An analysis over an "inner" IR unit that provides access to an analysis manager over a "outer" IR uni...
Definition: PassManager.h:1051
llvm::Triple::Wasm
@ Wasm
Definition: Triple.h:238
ClInvalidPointerCmp
static cl::opt< bool > ClInvalidPointerCmp("asan-detect-invalid-pointer-cmp", cl::desc("Instrument <, <=, >, >= with pointer operands"), cl::Hidden, cl::init(false))
llvm::Argument
This class represents an incoming formal argument to a Function.
Definition: Argument.h:29
llvm::IRBuilderBase::CreateIntCast
Value * CreateIntCast(Value *V, Type *DestTy, bool isSigned, const Twine &Name="")
Definition: IRBuilder.h:2182
llvm::StringRef::startswith
LLVM_NODISCARD bool startswith(StringRef Prefix) const
Check if this string starts with the given Prefix.
Definition: StringRef.h:286
llvm::Type::isSized
bool isSized(SmallPtrSetImpl< Type * > *Visited=nullptr) const
Return true if it makes sense to take the size of this type.
Definition: Type.h:274
llvm::createPrivateGlobalForString
GlobalVariable * createPrivateGlobalForString(Module &M, StringRef Str, bool AllowMerging, const char *NamePrefix="")
Definition: Instrumentation.cpp:60
llvm::IRBuilderBase::getInt32Ty
IntegerType * getInt32Ty()
Fetch the type representing a 32-bit integer.
Definition: IRBuilder.h:518
llvm::IRBuilderBase::CreateStore
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1695
llvm::initializeASanGlobalsMetadataWrapperPassPass
void initializeASanGlobalsMetadataWrapperPassPass(PassRegistry &)
llvm::IRBuilderBase::CreateICmpSGE
Value * CreateICmpSGE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2255
MI
IRTranslator LLVM IR MI
Definition: IRTranslator.cpp:102
MathExtras.h
kDefaultShadowOffset64
static const uint64_t kDefaultShadowOffset64
Definition: AddressSanitizer.cpp:98
llvm::IRBuilderBase::SetInsertPoint
void SetInsertPoint(BasicBlock *TheBB)
This specifies that created instructions should be appended to the end of the specified block.
Definition: IRBuilder.h:184
llvm
---------------------— PointerInfo ------------------------------------—
Definition: AllocatorList.h:23
ClMemoryAccessCallbackPrefix
static cl::opt< std::string > ClMemoryAccessCallbackPrefix("asan-memory-access-callback-prefix", cl::desc("Prefix for memory access callbacks"), cl::Hidden, cl::init("__asan_"))
ClDebugMin
static cl::opt< int > ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), cl::Hidden, cl::init(-1))
llvm::ASanStackFrameLayout::FrameSize
size_t FrameSize
Definition: ASanStackFrameLayout.h:47
M
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
Definition: README.txt:252
llvm::Instruction::getModule
const Module * getModule() const
Return the module owning the function this instruction belongs to or nullptr it the function does not...
Definition: Instruction.cpp:66
llvm::StringRef::empty
LLVM_NODISCARD bool empty() const
empty - Check if the string is empty.
Definition: StringRef.h:153
Pass
print lazy value Lazy Value Info Printer Pass
Definition: LazyValueInfo.cpp:1966
llvm::IRBuilderBase::getInt64Ty
IntegerType * getInt64Ty()
Fetch the type representing a 64-bit integer.
Definition: IRBuilder.h:523
Comdat.h
ClWithComdat
static cl::opt< bool > ClWithComdat("asan-with-comdat", cl::desc("Place ASan constructors in comdat sections"), cl::Hidden, cl::init(true))
llvm::NamedMDNode
A tuple of MDNodes.
Definition: Metadata.h:1386
llvm::ReturnInst
Return a value (possibly void), from a function.
Definition: Instructions.h:2950
ClInvalidPointerPairs
static cl::opt< bool > ClInvalidPointerPairs("asan-detect-invalid-pointer-pair", cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, cl::init(false))
llvm::IRBuilderBase::CreateAlignedStore
StoreInst * CreateAlignedStore(Value *Val, Value *Ptr, MaybeAlign Align, bool isVolatile=false)
Definition: IRBuilder.h:1747
llvm::GlobalsMetadata::Entry
Definition: AddressSanitizer.h:39
llvm::StructType::get
static StructType * get(LLVMContext &Context, ArrayRef< Type * > Elements, bool isPacked=false)
This static method is the primary way to create a literal StructType.
Definition: Type.cpp:372
llvm::Triple::isMIPS32
bool isMIPS32() const
Tests whether the target is MIPS 32-bit (little and big endian).
Definition: Triple.h:742
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:112
kAllocaRzSize
static const unsigned kAllocaRzSize
Definition: AddressSanitizer.cpp:179
llvm::Intrinsic::getDeclaration
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=None)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1336
Metadata.h
llvm::User::operands
op_range operands()
Definition: User.h:242
llvm::Comdat::ExactMatch
@ ExactMatch
The data referenced by the COMDAT must be the same.
Definition: Comdat.h:35
llvm::ModulePass
ModulePass class - This class is used to implement unstructured interprocedural optimizations and ana...
Definition: Pass.h:238
llvm::CallBase::doesNotReturn
bool doesNotReturn() const
Determine if the call cannot return.
Definition: InstrTypes.h:1836
kAsanOptionDetectUseAfterReturn
const char kAsanOptionDetectUseAfterReturn[]
Definition: AddressSanitizer.cpp:164
llvm::BasicBlock::getParent
const Function * getParent() const
Return the enclosing method, or null if none.
Definition: BasicBlock.h:107
IntrinsicInst.h
llvm::Type::isPointerTy
bool isPointerTy() const
True if this is an instance of PointerType.
Definition: Type.h:228
kDefaultShadowScale
static const uint64_t kDefaultShadowScale
Definition: AddressSanitizer.cpp:96
llvm::DIBuilder
Definition: DIBuilder.h:41
llvm::initializeAddressSanitizerLegacyPassPass
void initializeAddressSanitizerLegacyPassPass(PassRegistry &)
llvm::AnalysisManager::getResult
PassT::Result & getResult(IRUnitT &IR, ExtraArgTs... ExtraArgs)
Get the result of an analysis pass for a given IR unit.
Definition: PassManager.h:769
DebugInfoMetadata.h
isUnsupportedAMDGPUAddrspace
static bool isUnsupportedAMDGPUAddrspace(Value *Addr)
Definition: AddressSanitizer.cpp:1340
llvm::GlobalVariable::copyAttributesFrom
void copyAttributesFrom(const GlobalVariable *Src)
copyAttributesFrom - copy all additional attributes (those not needed to create a GlobalVariable) fro...
Definition: Globals.cpp:412
llvm::Function::getBasicBlockList
const BasicBlockListType & getBasicBlockList() const
Get the underlying elements of the Function...
Definition: Function.h:755
llvm::Instruction::getNextNonDebugInstruction
const Instruction * getNextNonDebugInstruction(bool SkipPseudoOp=false) const
Return a pointer to the next non-debug instruction in the same basic block as 'this',...
Definition: Instruction.cpp:728
llvm::GlobalValue::dropLLVMManglingEscape
static StringRef dropLLVMManglingEscape(StringRef Name)
If the given string begins with the GlobalValue name mangling escape character '\1',...
Definition: GlobalValue.h:482
llvm::GlobalValue::HiddenVisibility
@ HiddenVisibility
The GV is hidden.
Definition: GlobalValue.h:64
kAsanStackMallocAlwaysNameTemplate
const char kAsanStackMallocAlwaysNameTemplate[]
Definition: AddressSanitizer.cpp:150
llvm::ASanStackFrameLayout::Granularity
size_t Granularity
Definition: ASanStackFrameLayout.h:45
llvm::Function
Definition: Function.h:61
llvm::IRBuilderBase::CreatePtrToInt
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2103
kNumberOfAccessSizes
static const size_t kNumberOfAccessSizes
Definition: AddressSanitizer.cpp:177
StringRef.h
llvm::ConstantStruct::get
static Constant * get(StructType *T, ArrayRef< Constant * > V)
Definition: Constants.cpp:1326
Pass.h
ClEnableKasan
static cl::opt< bool > ClEnableKasan("asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"), cl::Hidden, cl::init(false))
kAsanCtorAndDtorPriority
static const uint64_t kAsanCtorAndDtorPriority
Definition: AddressSanitizer.cpp:130
llvm::ASanGlobalsMetadataAnalysis::run
Result run(Module &, ModuleAnalysisManager &)
Definition: AddressSanitizer.cpp:1210
llvm::IntrinsicInst::getIntrinsicID
Intrinsic::ID getIntrinsicID() const
Return the intrinsic ID of this intrinsic.
Definition: IntrinsicInst.h:52
llvm::kAsanStackUseAfterReturnMagic
static const int kAsanStackUseAfterReturnMagic
Definition: ASanStackFrameLayout.h:26
kNetBSDKasan_ShadowOffset64
static const uint64_t kNetBSDKasan_ShadowOffset64
Definition: AddressSanitizer.cpp:115
llvm::PointerType::get
static PointerType * get(Type *ElementType, unsigned AddressSpace)
This constructs a pointer to an object of the specified type in a numbered address space.
Definition: Type.cpp:693
llvm::Type::getScalarType
Type * getScalarType() const
If this is a vector type, return the element type, otherwise return 'this'.
Definition: Type.h:319
llvm::StringRef::npos
static constexpr size_t npos
Definition: StringRef.h:60
llvm::GetShadowBytesAfterScope
SmallVector< uint8_t, 64 > GetShadowBytesAfterScope(const SmallVectorImpl< ASanStackVariableDescription > &Vars, const ASanStackFrameLayout &Layout)
Definition: ASanStackFrameLayout.cpp:134
llvm::Comdat::NoDeduplicate
@ NoDeduplicate
No deduplication is performed.
Definition: Comdat.h:37
llvm::AllocaInst::getType
PointerType * getType() const
Overload to return most specific pointer type.
Definition: Instructions.h:104
kMinStackMallocSize
static const size_t kMinStackMallocSize
Definition: AddressSanitizer.cpp:123
llvm::ilist_node_with_parent::getNextNode
NodeTy * getNextNode()
Get the next node, or nullptr for the list tail.
Definition: ilist_node.h:288
ClMaxInsnsToInstrumentPerBB
static cl::opt< int > ClMaxInsnsToInstrumentPerBB("asan-max-ins-per-bb", cl::init(10000), cl::desc("maximal number of instructions to instrument in any given BB"), cl::Hidden)
llvm::SmallVector
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1168
Statistic.h
TypeSizeToSizeIndex
static size_t TypeSizeToSizeIndex(uint32_t TypeSize)
Definition: AddressSanitizer.cpp:1299
InlineAsm.h
llvm::CallBase::isInlineAsm
bool isInlineAsm() const
Check if this call is an inline asm statement.
Definition: InstrTypes.h:1458
llvm::GetShadowBytes
SmallVector< uint8_t, 64 > GetShadowBytes(const SmallVectorImpl< ASanStackVariableDescription > &Vars, const ASanStackFrameLayout &Layout)
Definition: ASanStackFrameLayout.cpp:116
llvm::createSanitizerCtor
Function * createSanitizerCtor(Module &M, StringRef CtorName)
Creates sanitizer constructor function.
Definition: ModuleUtils.cpp:124
ErrorHandling.h
llvm::GlobalValue::UnnamedAddr::None
@ None
ClDebugStack
static cl::opt< int > ClDebugStack("asan-debug-stack", cl::desc("debug stack"), cl::Hidden, cl::init(0))
llvm::Type::getPointerAddressSpace
unsigned getPointerAddressSpace() const
Get the address space of this pointer or pointer vector type.
Definition: DerivedTypes.h:733
llvm::IRBuilder<>
llvm::GlobalVariable
Definition: GlobalVariable.h:40
kNetBSD_ShadowOffset32
static const uint64_t kNetBSD_ShadowOffset32
Definition: AddressSanitizer.cpp:113
kMIPS64_ShadowOffset64
static const uint64_t kMIPS64_ShadowOffset64
Definition: AddressSanitizer.cpp:107
llvm::FunctionType::get
static FunctionType * get(Type *Result, ArrayRef< Type * > Params, bool isVarArg)
This static method is the primary way of constructing a FunctionType.
Definition: Type.cpp:327
llvm::GlobalAlias
Definition: GlobalAlias.h:27
ValueTracking.h
Local.h
kAsanRegisterElfGlobalsName
const char kAsanRegisterElfGlobalsName[]
Definition: AddressSanitizer.cpp:139
isInterestingPointerSubtraction
static bool isInterestingPointerSubtraction(Instruction *I)
Definition: AddressSanitizer.cpp:1514
llvm::IRBuilderBase::CreateOr
Value * CreateOr(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1384
ClRedzoneByvalArgs
static cl::opt< bool > ClRedzoneByvalArgs("asan-redzone-byval-args", cl::desc("Create redzones for byval " "arguments (extra copy " "required)"), cl::Hidden, cl::init(true))
llvm::Triple
Triple - Helper class for working with autoconf configuration names.
Definition: Triple.h:45
llvm::InterestingMemoryOperand
Definition: AddressSanitizerCommon.h:25
ClForceExperiment
static cl::opt< uint32_t > ClForceExperiment("asan-force-experiment", cl::desc("Force optimization experiment (for testing)"), cl::Hidden, cl::init(0))
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:143
kAMDGPUAddressSharedName
const char kAMDGPUAddressSharedName[]
Definition: AddressSanitizer.cpp:173
ClDynamicAllocaStack
static cl::opt< bool > ClDynamicAllocaStack("asan-stack-dynamic-alloca", cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, cl::init(true))
kDynamicShadowSentinel
static const uint64_t kDynamicShadowSentinel
Definition: AddressSanitizer.cpp:99
llvm::DILocation
Debug location.
Definition: DebugInfoMetadata.h:1562
llvm::PreservedAnalyses::none
static PreservedAnalyses none()
Convenience factory function for the empty preserved set.
Definition: PassManager.h:158
ClInstrumentReads
static cl::opt< bool > ClInstrumentReads("asan-instrument-reads", cl::desc("instrument read instructions"), cl::Hidden, cl::init(true))
llvm::AsanDetectStackUseAfterReturnMode::Runtime
@ Runtime
Detect stack use after return if runtime flag is enabled (ASAN_OPTIONS=detect_stack_use_after_return=...
llvm::Type
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
DenseMap.h
GetCtorAndDtorPriority
static uint64_t GetCtorAndDtorPriority(Triple &TargetTriple)
Definition: AddressSanitizer.cpp:568
Module.h
llvm::Triple::x86_64
@ x86_64
Definition: Triple.h:84
MemoryBuiltins.h
ClDebugMax
static cl::opt< int > ClDebugMax("asan-debug-max", cl::desc("Debug max inst"), cl::Hidden, cl::init(-1))
createPrivateGlobalForSourceLoc
static GlobalVariable * createPrivateGlobalForSourceLoc(Module &M, LocationMetadata MD)
Create a global describing a source location.
Definition: AddressSanitizer.cpp:1306
isInterestingPointerComparison
static bool isInterestingPointerComparison(Instruction *I)
Definition: AddressSanitizer.cpp:1500
llvm::ASanStackVariableDescription::AI
AllocaInst * AI
Definition: ASanStackFrameLayout.h:37
llvm::GlobalValue::UnnamedAddr::Global
@ Global
ClOptGlobals
static cl::opt< bool > ClOptGlobals("asan-opt-globals", cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true))
llvm::MemIntrinsic
This is the common base class for memset/memcpy/memmove.
Definition: IntrinsicInst.h:852
ClRealignStack
static cl::opt< unsigned > ClRealignStack("asan-realign-stack", cl::desc("Realign stack to the value of this flag (power of two)"), cl::Hidden, cl::init(32))
kAsanAllocaPoison
const char kAsanAllocaPoison[]
Definition: AddressSanitizer.cpp:170
llvm::M68kBeads::Term
@ Term
Definition: M68kBaseInfo.h:71
llvm::IRBuilderBase::getIntN
ConstantInt * getIntN(unsigned N, uint64_t C)
Get a constant N-bit value, zero extended or truncated from a 64-bit value.
Definition: IRBuilder.h:489
Offset
uint64_t Offset
Definition: ELFObjHandler.cpp:81
llvm::Triple::XCOFF
@ XCOFF
Definition: Triple.h:239
llvm::SmallPtrSet
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
Definition: SmallPtrSet.h:449
llvm::Triple::isOSLinux
bool isOSLinux() const
Tests whether the OS is Linux.
Definition: Triple.h:595
llvm::ObjectSizeOpts::RoundToAlign
bool RoundToAlign
Whether to round the result up to the alignment of allocas, byval arguments, and global variables.
Definition: MemoryBuiltins.h:204
llvm::Comdat::Largest
@ Largest
The linker will choose the largest COMDAT.
Definition: Comdat.h:36
llvm::Triple::isAMDGPU
bool isAMDGPU() const
Definition: Triple.h:709
llvm::ValueAsMetadata::get
static ValueAsMetadata * get(Value *V)
Definition: Metadata.cpp:368
llvm::MipsISD::Ret
@ Ret
Definition: MipsISelLowering.h:116
kAsanPoisonStackMemoryName
const char kAsanPoisonStackMemoryName[]
Definition: AddressSanitizer.cpp:157
llvm::CallBase::getNumArgOperands
unsigned getNumArgOperands() const
Definition: InstrTypes.h:1336
llvm::GlobalValue::setUnnamedAddr
void setUnnamedAddr(UnnamedAddr Val)
Definition: GlobalValue.h:212
llvm::GlobalValue::LinkageTypes
LinkageTypes
An enumeration for the kinds of linkage for global values.
Definition: GlobalValue.h:47
llvm::ArrayType
Class to represent array types.
Definition: DerivedTypes.h:356
llvm::isPowerOf2_32
constexpr bool isPowerOf2_32(uint32_t Value)
Return true if the argument is a power of two > 0.
Definition: MathExtras.h:491
getShadowMapping
static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize, bool IsKasan)
Definition: AddressSanitizer.cpp:445
llvm::GlobalsMetadata::Entry::IsExcluded
bool IsExcluded
Definition: AddressSanitizer.h:43
llvm::Triple::isPS4CPU
bool isPS4CPU() const
Tests whether the target is the PS4 CPU.
Definition: Triple.h:660
and
We currently generate a but we really shouldn eax ecx xorl edx divl ecx eax divl ecx movl eax ret A similar code sequence works for division We currently compile i32 v2 eax eax jo LBB1_2 and
Definition: README.txt:1271
llvm::Triple::isOSEmscripten
bool isOSEmscripten() const
Tests whether the OS is Emscripten.
Definition: Triple.h:615
llvm::BitmaskEnumDetail::Mask
std::underlying_type_t< E > Mask()
Get a bitmask with 1s in all places up to the high-order bit of E's largest value.
Definition: BitmaskEnum.h:80
ASanStackFrameLayout.h
kPPC64_ShadowOffset64
static const uint64_t kPPC64_ShadowOffset64
Definition: AddressSanitizer.cpp:104
llvm::IRBuilderBase::CreateAlloca
AllocaInst * CreateAlloca(Type *Ty, unsigned AddrSpace, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:1639
Use.h
llvm::Type::getInt32Ty
static IntegerType * getInt32Ty(LLVMContext &C)
Definition: Type.cpp:203
llvm::IRBuilderBase::CreateIntToPtr
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2108
LLVM_DEBUG
#define LLVM_DEBUG(X)
Definition: Debug.h:122
DepthFirstIterator.h
llvm::MDNode::get
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1198
F
#define F(x, y, z)
Definition: MD5.cpp:56
kAsanAllocasUnpoison
const char kAsanAllocasUnpoison[]
Definition: AddressSanitizer.cpp:171
llvm::ConstantExpr::getPointerCast
static Constant * getPointerCast(Constant *C, Type *Ty)
Create a BitCast, AddrSpaceCast, or a PtrToInt cast constant expression.
Definition: Constants.cpp:2033
llvm::BasicBlock
LLVM Basic Block Representation.
Definition: BasicBlock.h:58
llvm::MDNode::getNumOperands
unsigned getNumOperands() const
Return number of MDNode operands.
Definition: Metadata.h:1108
llvm::Value::isSwiftError
bool isSwiftError() const
Return true if this value is a swifterror value.
Definition: Value.cpp:1000
llvm::appendToGlobalDtors
void appendToGlobalDtors(Module &M, Function *F, int Priority, Constant *Data=nullptr)
Same as appendToGlobalCtors(), but for global dtors.
Definition: ModuleUtils.cpp:70
llvm::dbgs
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
llvm::ASanStackVariableDescription::Size
uint64_t Size
Definition: ASanStackFrameLayout.h:33
llvm::ARMBuildAttrs::Section
@ Section
Legacy Tags.
Definition: ARMBuildAttributes.h:78
Arg
amdgpu Simplify well known AMD library false FunctionCallee Value * Arg
Definition: AMDGPULibCalls.cpp:206
llvm::Triple::isMacOSX
bool isMacOSX() const
isMacOSX - Is this a Mac OS X triple.
Definition: Triple.h:454
Instruction.h
kNetBSD_ShadowOffset64
static const uint64_t kNetBSD_ShadowOffset64
Definition: AddressSanitizer.cpp:114
CommandLine.h
llvm::LocationMetadata::Filename
StringRef Filename
Definition: AddressSanitizer.h:26
llvm::ConstantInt
This is the shared class of boolean and integer constants.
Definition: Constants.h:79
llvm::AllocaInst::isStaticAlloca
bool isStaticAlloca() const
Return true if this alloca is in the entry block of the function and is a constant size.
Definition: Instructions.cpp:1387
llvm::Intrinsic::getType
FunctionType * getType(LLVMContext &Context, ID id, ArrayRef< Type * > Tys=None)
Return the function type for an intrinsic.
Definition: Function.cpp:1292
kAsanUnregisterElfGlobalsName
const char kAsanUnregisterElfGlobalsName[]
Definition: AddressSanitizer.cpp:140
llvm::all_of
bool all_of(R &&range, UnaryPredicate P)
Provide wrappers to std::all_of which take ranges instead of having to pass begin/end explicitly.
Definition: STLExtras.h:1547
INITIALIZE_PASS_BEGIN
INITIALIZE_PASS(ASanGlobalsMetadataWrapperPass, "asan-globals-md", "Read metadata to mark which globals should be instrumented " "when running ASan.", false, true) char AddressSanitizerLegacyPass INITIALIZE_PASS_BEGIN(AddressSanitizerLegacyPass, "asan", "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, false) INITIALIZE_PASS_END(AddressSanitizerLegacyPass
ClOverrideDestructorKind
static cl::opt< AsanDtorKind > ClOverrideDestructorKind("asan-destructor-kind", cl::desc("Sets the ASan destructor kind. The default is to use the value " "provided to the pass constructor"), cl::values(clEnumValN(AsanDtorKind::None, "none", "No destructors"), clEnumValN(AsanDtorKind::Global, "global", "Use global destructors")), cl::init(AsanDtorKind::Invalid), cl::Hidden)
llvm::ObjectSizeOffsetVisitor::bothKnown
static bool bothKnown(const SizeOffsetType &SizeOffset)
Definition: MemoryBuiltins.h:264
llvm::Triple::isAndroid
bool isAndroid() const
Tests whether the target is Android.
Definition: Triple.h:673
llvm::IRBuilderBase::CreateMul
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1242
ClForceDynamicShadow
static cl::opt< bool > ClForceDynamicShadow("asan-force-dynamic-shadow", cl::desc("Load shadow address into a local variable for each function"), cl::Hidden, cl::init(false))
GlobalValue.h
llvm::PassRegistry::getPassRegistry
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
Definition: PassRegistry.cpp:31
kAsanHandleNoReturnName
const char kAsanHandleNoReturnName[]
Definition: AddressSanitizer.cpp:147
Constants.h
kAsanStackFreeNameTemplate
const char kAsanStackFreeNameTemplate[]
Definition: AddressSanitizer.cpp:152
llvm::AllocaInst::getAllocatedType
Type * getAllocatedType() const
Return the type that is being allocated by the instruction.
Definition: Instructions.h:113
E
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
llvm::GlobalObject::setSection
void setSection(StringRef S)
Change the section for this global.
Definition: Globals.cpp:212
llvm::DIExpression::ApplyOffset
@ ApplyOffset
Definition: DebugInfoMetadata.h:2764
Intrinsics.h
C
(vector float) vec_cmpeq(*A, *B) C
Definition: README_ALTIVEC.txt:86
isPointerOperand
static bool isPointerOperand(Value *V)
Definition: AddressSanitizer.cpp:1493
llvm::ConstantExpr::getIntToPtr
static Constant * getIntToPtr(Constant *C, Type *Ty, bool OnlyIfReduced=false)
Definition: Constants.cpp:2207
getAllocaSizeInBytes
static uint64_t getAllocaSizeInBytes(const AllocaInst &AI)
Definition: HWAddressSanitizer.cpp:959
llvm::GlobalValue::getThreadLocalMode
ThreadLocalMode getThreadLocalMode() const
Definition: GlobalValue.h:252
Twine.h
ClInstrumentationWithCallsThreshold
static cl::opt< int > ClInstrumentationWithCallsThreshold("asan-instrumentation-with-call-threshold", cl::desc("If the function being instrumented contains more than " "this number of memory accesses, use callbacks instead of " "inline checks (-1 means never use callbacks)."), cl::Hidden, cl::init(7000))
InstrTypes.h
doInstrumentAddress
static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I, Instruction *InsertBefore, Value *Addr, MaybeAlign Alignment, unsigned Granularity, uint32_t TypeSize, bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp)
Definition: AddressSanitizer.cpp:1547
llvm::IRBuilderBase::CreateLoad
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1656
llvm::BasicBlock::begin
iterator begin()
Instruction iterator methods.
Definition: BasicBlock.h:296
llvm::AsanDtorKind::None
@ None
Do not emit any destructors for ASan.
llvm::MDBuilder::createBranchWeights
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
llvm::MCSectionMachO::ParseSectionSpecifier
static Error ParseSectionSpecifier(StringRef Spec, StringRef &Segment, StringRef &Section, unsigned &TAA, bool &TAAParsed, unsigned &StubSize)
Parse the section specifier indicated by "Spec".
Definition: MCSectionMachO.cpp:177
MCSectionMachO.h
llvm::CallInst::Create
static CallInst * Create(FunctionType *Ty, Value *F, const Twine &NameStr="", Instruction *InsertBefore=nullptr)
Definition: Instructions.h:1518
llvm::AnalysisUsage
Represent the analysis usage information of a pass.
Definition: PassAnalysisSupport.h:47
Param
Value * Param
Definition: NVPTXLowerArgs.cpp:163
llvm::ReplaceInstWithInst
void ReplaceInstWithInst(BasicBlock::InstListType &BIL, BasicBlock::iterator &BI, Instruction *I)
Replace the instruction specified by BI with the instruction specified by I.
Definition: BasicBlockUtils.cpp:468
TargetLibraryInfo.h
AddressSanitizerCommon.h
llvm::Comdat::Any
@ Any
The linker may choose any COMDAT.
Definition: Comdat.h:34
llvm::ASanStackFrameLayout::FrameAlignment
size_t FrameAlignment
Definition: ASanStackFrameLayout.h:46
llvm::BasicBlock::getFirstInsertionPt
const_iterator getFirstInsertionPt() const
Returns an iterator to the first instruction in this block that is suitable for inserting a non-PHI i...
Definition: BasicBlock.cpp:249
false
Definition: StackSlotColoring.cpp:142
llvm::MaybeAlign
This struct is a compact representation of a valid (power of two) or undefined (0) alignment.
Definition: Alignment.h:109
llvm::Triple::ppc64
@ ppc64
Definition: Triple.h:69
llvm::ConstantArray
ConstantArray - Constant Array Declarations.
Definition: Constants.h:409
ClInsertVersionCheck
static cl::opt< bool > ClInsertVersionCheck("asan-guard-against-version-mismatch", cl::desc("Guard against compiler/runtime version mismatch."), cl::Hidden, cl::init(true))
llvm::AsanDetectStackUseAfterReturnMode::Always
@ Always
Always detect stack use after return.
llvm::Instruction
Definition: Instruction.h:45
MDBuilder.h
llvm::AllocaInst::getArraySize
const Value * getArraySize() const
Get the number of elements allocated.
Definition: Instructions.h:100
llvm::IRBuilderBase::getInt8Ty
IntegerType * getInt8Ty()
Fetch the type representing an 8-bit integer.
Definition: IRBuilder.h:508
llvm::appendToCompilerUsed
void appendToCompilerUsed(Module &M, ArrayRef< GlobalValue * > Values)
Adds global values to the llvm.compiler.used list.
Definition: ModuleUtils.cpp:110
llvm::report_fatal_error
void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:140
llvm::STATISTIC
STATISTIC(NumFunctions, "Total number of functions")
GlobalWasGeneratedByCompiler
static bool GlobalWasGeneratedByCompiler(GlobalVariable *G)
Check if G has been created by a trusted compiler pass.
Definition: AddressSanitizer.cpp:1322
kAsanVersionCheckNamePrefix
const char kAsanVersionCheckNamePrefix[]
Definition: AddressSanitizer.cpp:144
llvm::SmallVectorImpl::resize
void resize(size_type N)
Definition: SmallVector.h:606
llvm::codeview::EncodedFramePtrReg::BasePtr
@ BasePtr
llvm::Comdat::SameSize
@ SameSize
The data referenced by the COMDAT must be the same size.
Definition: Comdat.h:38
llvm::ConstantInt::get
static Constant * get(Type *Ty, uint64_t V, bool IsSigned=false)
If Ty is a vector type, return a Constant with a splat of the given value.
Definition: Constants.cpp:899
kAsanRegisterImageGlobalsName
const char kAsanRegisterImageGlobalsName[]
Definition: AddressSanitizer.cpp:136
llvm::getUnderlyingObject
const Value * getUnderlyingObject(const Value *V, unsigned MaxLookup=6)
This method strips off any GEP address adjustments and pointer casts from the specified value,...
Definition: ValueTracking.cpp:4356
ClMaxInlinePoisoningSize
static cl::opt< uint32_t > ClMaxInlinePoisoningSize("asan-max-inline-poisoning-size", cl::desc("Inline shadow poisoning for blocks up to the given size in bytes."), cl::Hidden, cl::init(64))
DebugLoc.h
llvm::IndexedInstrProf::Version
const uint64_t Version
Definition: InstrProf.h:991
SmallPtrSet.h
llvm::Instruction::getSuccessor
BasicBlock * getSuccessor(unsigned Idx) const
Return the specified successor. This instruction must be a terminator.
Definition: Instruction.cpp:777
ClGlobals
static cl::opt< bool > ClGlobals("asan-globals", cl::desc("Handle global objects"), cl::Hidden, cl::init(true))
ClUseAfterScope
static cl::opt< bool > ClUseAfterScope("asan-use-after-scope", cl::desc("Check stack-use-after-scope"), cl::Hidden, cl::init(false))
Align
uint64_t Align
Definition: ELFObjHandler.cpp:83
llvm::GlobalValue::InternalLinkage
@ InternalLinkage
Rename collisions when linking (static functions).
Definition: GlobalValue.h:55
llvm::Align
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
llvm::Comdat
Definition: Comdat.h:31
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:153
llvm::Metadata
Root of the metadata hierarchy.
Definition: Metadata.h:62
llvm::Triple::getArch
ArchType getArch() const
getArch - Get the parsed architecture type of this triple.
Definition: Triple.h:307
c
the resulting code requires compare and branches when and if the revised code is with conditional branches instead of More there is a byte word extend before each where there should be only and the condition codes are not remembered when the same two values are compared twice More LSR enhancements i8 and i32 load store addressing modes are identical int int c
Definition: README.txt:418
llvm::LocationMetadata
Frontend-provided metadata for source location.
Definition: AddressSanitizer.h:25
llvm::Triple::GOFF
@ GOFF
Definition: Triple.h:236
llvm::GlobalsMetadata::get
Entry get(GlobalVariable *G) const
Returns metadata entry for a given global.
Definition: AddressSanitizer.h:55
llvm::Instruction::isLifetimeStartOrEnd
bool isLifetimeStartOrEnd() const
Return true if the instruction is a llvm.lifetime.start or llvm.lifetime.end marker.
Definition: Instruction.cpp:706
llvm::None
const NoneType None
Definition: None.h:23
llvm::InlineAsm::get
static InlineAsm * get(FunctionType *Ty, StringRef AsmString, StringRef Constraints, bool hasSideEffects, bool isAlignStack=false, AsmDialect asmDialect=AD_ATT, bool canThrow=false)
InlineAsm::get - Return the specified uniqued inline asm string.
Definition: InlineAsm.cpp:42
ClInstrumentAtomics
static cl::opt< bool > ClInstrumentAtomics("asan-instrument-atomics", cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, cl::init(true))
Type.h
llvm::IRBuilderBase::CreateAnd
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1358
llvm::IRBuilderBase::CreatePointerCast
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2159
INITIALIZE_PASS_END
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:58
llvm::AllocaInst::isSwiftError
bool isSwiftError() const
Return true if this alloca is used as a swifterror argument to a call.
Definition: Instructions.h:148
kSystemZ_ShadowOffset64
static const uint64_t kSystemZ_ShadowOffset64
Definition: AddressSanitizer.cpp:105
llvm::Triple::isOSFuchsia
bool isOSFuchsia() const
Definition: Triple.h:514
llvm::MDNode::getOperand
const MDOperand & getOperand(unsigned I) const
Definition: Metadata.h:1102
llvm::InlineAsm
Definition: InlineAsm.h:31
llvm::GlobalsMetadata::Entry::IsDynInit
bool IsDynInit
Definition: AddressSanitizer.h:42
G
const DataFlowGraph & G
Definition: RDFGraph.cpp:202
llvm::GlobalsMetadata
Frontend-provided metadata for global variables.
Definition: AddressSanitizer.h:37
llvm::Triple::ppc64le
@ ppc64le
Definition: Triple.h:70
ClUsePrivateAlias
static cl::opt< bool > ClUsePrivateAlias("asan-use-private-alias", cl::desc("Use private aliases for global variables"), cl::Hidden, cl::init(false))
BasicBlock.h
llvm::cl::opt< bool >
kODRGenPrefix
const char kODRGenPrefix[]
Definition: AddressSanitizer.cpp:154
llvm::Triple::isThumb
bool isThumb() const
Tests whether the target is Thumb (little and big endian).
Definition: Triple.h:714
llvm::Triple::ELF
@ ELF
Definition: Triple.h:235
llvm::RISCVFenceField::O
@ O
Definition: RISCVBaseInfo.h:179
ClInitializers
static cl::opt< bool > ClInitializers("asan-initialization-order", cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(true))
llvm::StoreInst
An instruction for storing to memory.
Definition: Instructions.h:304
llvm::GlobalValue
Definition: GlobalValue.h:44
kSmallX86_64ShadowOffsetAlignMask
static const uint64_t kSmallX86_64ShadowOffsetAlignMask
Definition: AddressSanitizer.cpp:102
llvm::GlobalVariable::getInitializer
const Constant * getInitializer() const
getInitializer - Return the initializer for this global variable.
Definition: GlobalVariable.h:136
llvm::Constant
This is an important base class in LLVM.
Definition: Constant.h:41
llvm::cl::values
ValuesClass values(OptsTy... Options)
Helper to build a ValuesClass by forwarding a variable number of arguments as an initializer list to ...
Definition: CommandLine.h:699
llvm::Instruction::eraseFromParent
SymbolTableList< Instruction >::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
Definition: Instruction.cpp:78
llvm::Triple::isARM
bool isARM() const
Tests whether the target is ARM (little and big endian).
Definition: Triple.h:719
kAsanRegisterGlobalsName
const char kAsanRegisterGlobalsName[]
Definition: AddressSanitizer.cpp:134
llvm::createSanitizerCtorAndInitFunctions
std::pair< Function *, FunctionCallee > createSanitizerCtorAndInitFunctions(Module &M, StringRef CtorName, StringRef InitName, ArrayRef< Type * > InitArgTypes, ArrayRef< Value * > InitArgs, StringRef VersionCheckName=StringRef())
Creates sanitizer constructor function, and calls sanitizer's init function from it.
Definition: ModuleUtils.cpp:136
llvm::ICmpInst
This instruction compares its operands according to the predicate given to the constructor.
Definition: Instructions.h:1203
Index
uint32_t Index
Definition: ELFObjHandler.cpp:84
llvm::GlobalsMetadata::GlobalsMetadata
GlobalsMetadata()=default
Create a default uninitialized GlobalsMetadata instance.
llvm::TargetLibraryInfoWrapperPass
Definition: TargetLibraryInfo.h:463
llvm::Triple::isMIPS64
bool isMIPS64() const
Tests whether the target is MIPS 64-bit (little and big endian).
Definition: Triple.h:747
ClInstrumentByval
static cl::opt< bool > ClInstrumentByval("asan-instrument-byval", cl::desc("instrument byval call arguments"), cl::Hidden, cl::init(true))
llvm::GlobalValue::getVisibility
VisibilityTypes getVisibility() const
Definition: GlobalValue.h:229
D
static GCRegistry::Add< StatepointGC > D("statepoint-example", "an example strategy for statepoint")
kLinuxKasan_ShadowOffset64
static const uint64_t kLinuxKasan_ShadowOffset64
Definition: AddressSanitizer.cpp:103
Addr
uint64_t Addr
Definition: ELFObjHandler.cpp:80
llvm::AddressSanitizerPass::AddressSanitizerPass
AddressSanitizerPass(bool CompileKernel=false, bool Recover=false, bool UseAfterScope=false, AsanDetectStackUseAfterReturnMode UseAfterReturn=AsanDetectStackUseAfterReturnMode::Runtime)
Definition: AddressSanitizer.cpp:1215
llvm::Triple::isOSFreeBSD
bool isOSFreeBSD() const
Definition: Triple.h:510
kAsanInitName
const char kAsanInitName[]
Definition: AddressSanitizer.cpp:143
INITIALIZE_PASS_DEPENDENCY
INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
kRISCV64_ShadowOffset64
static const uint64_t kRISCV64_ShadowOffset64
Definition: AddressSanitizer.cpp:109
llvm::IRBuilderBase::getInt32
ConstantInt * getInt32(uint32_t C)
Get a constant 32-bit value.
Definition: IRBuilder.h:478
llvm::PHINode::addIncoming
void addIncoming(Value *V, BasicBlock *BB)
Add an incoming value to the end of the PHI list.
Definition: Instructions.h:2747
llvm::GlobalObject::copyMetadata
void copyMetadata(const GlobalObject *Src, unsigned Offset)
Copy metadata from Src, adjusting offsets by Offset.
Definition: Metadata.cpp:1457
llvm::LLVMContext
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:68
PromoteMemToReg.h
llvm::declareSanitizerInitFunction
FunctionCallee declareSanitizerInitFunction(Module &M, StringRef InitName, ArrayRef< Type * > InitArgTypes)
Definition: ModuleUtils.cpp:115
llvm::BranchInst::Create
static BranchInst * Create(BasicBlock *IfTrue, Instruction *InsertBefore=nullptr)
Definition: Instructions.h:3088
llvm::assumeAligned
Align assumeAligned(uint64_t Value)
Treats the value 0 as a 1, so Align is always at least 1.
Definition: Alignment.h:103
llvm::DenseMap
Definition: DenseMap.h:714
llvm::AnalysisKey
A special type used by analysis passes to provide an address that identifies that particular analysis...
Definition: PassManager.h:72
ClDebugFunc
static cl::opt< std::string > ClDebugFunc("asan-debug-func", cl::Hidden, cl::desc("Debug func"))
llvm::GlobalValue::getDLLStorageClass
DLLStorageClassTypes getDLLStorageClass() const
Definition: GlobalValue.h:256
I
#define I(x, y, z)
Definition: MD5.cpp:59
llvm::AddressSanitizerPass::run
PreservedAnalyses run(Function &F, FunctionAnalysisManager &AM)
Definition: AddressSanitizer.cpp:1221
llvm::DebugLoc::get
DILocation * get() const
Get the underlying DILocation.
Definition: DebugLoc.cpp:21
llvm::GlobalObject::setComdat
void setComdat(Comdat *C)
Definition: GlobalObject.h:125
llvm::IRBuilderBase::getInt8PtrTy
PointerType * getInt8PtrTy(unsigned AddrSpace=0)
Fetch the type representing a pointer to an 8-bit integer value.
Definition: IRBuilder.h:561
StringExtras.h
llvm::ObjectSizeOffsetVisitor
Evaluate the size and offset of an object pointed to by a Value* statically.
Definition: MemoryBuiltins.h:235
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:443
llvm::appendToUsed
void appendToUsed(Module &M, ArrayRef< GlobalValue * > Values)
Adds global values to the llvm.used list.
Definition: ModuleUtils.cpp:106
llvm::IRBuilderBase::CreateSelect
Value * CreateSelect(Value *C, Value *True, Value *False, const Twine &Name="", Instruction *MDFrom=nullptr)
Definition: IRBuilder.cpp:974
kMaxStackMallocSize
static const size_t kMaxStackMallocSize
Definition: AddressSanitizer.cpp:124
DIBuilder.h
ClAlwaysSlowPath
static cl::opt< bool > ClAlwaysSlowPath("asan-always-slow-path", cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, cl::init(false))
llvm::PointerType
Class to represent pointers.
Definition: DerivedTypes.h:631
llvm::AsanDetectStackUseAfterReturnMode
AsanDetectStackUseAfterReturnMode
Mode of ASan detect stack use after return.
Definition: AddressSanitizerOptions.h:25
ClWithIfuncSuppressRemat
static cl::opt< bool > ClWithIfuncSuppressRemat("asan-with-ifunc-suppress-remat", cl::desc("Suppress rematerialization of dynamic shadow address by passing " "it through inline asm in prologue."), cl::Hidden, cl::init(true))
kDefaultShadowOffset32
static const uint64_t kDefaultShadowOffset32
Definition: AddressSanitizer.cpp:97
ArrayRef.h
llvm::Instruction::setDebugLoc
void setDebugLoc(DebugLoc Loc)
Set the debug location information for this instruction.
Definition: Instruction.h:369
llvm::IRBuilderBase::CreateAdd
Value * CreateAdd(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1208
ClSkipPromotableAllocas
static cl::opt< bool > ClSkipPromotableAllocas("asan-skip-promotable-allocas", cl::desc("Do not instrument promotable allocas"), cl::Hidden, cl::init(true))
llvm::ConstantStruct::getAnon
static Constant * getAnon(ArrayRef< Constant * > V, bool Packed=false)
Return an anonymous struct that has the specified elements.
Definition: Constants.h:462
kAsanEmscriptenCtorAndDtorPriority
static const uint64_t kAsanEmscriptenCtorAndDtorPriority
Definition: AddressSanitizer.cpp:132
IRBuilder.h
ClUseAfterReturn
static cl::opt< AsanDetectStackUseAfterReturnMode > ClUseAfterReturn("asan-use-after-return", cl::desc("Sets the mode of detection for stack-use-after-return."), cl::values(clEnumValN(AsanDetectStackUseAfterReturnMode::Never, "never", "Never detect stack use after return."), clEnumValN(AsanDetectStackUseAfterReturnMode::Runtime, "runtime", "Detect stack use after return if " "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set."), clEnumValN(AsanDetectStackUseAfterReturnMode::Always, "always", "Always detect stack use after return.")), cl::Hidden, cl::init(AsanDetectStackUseAfterReturnMode::Runtime))
kAsanUnregisterGlobalsName
const char kAsanUnregisterGlobalsName[]
Definition: AddressSanitizer.cpp:135
llvm::DIExpression::DerefBefore
@ DerefBefore
Definition: DebugInfoMetadata.h:2765
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::Instruction::hasMetadata
bool hasMetadata() const
Return true if this instruction has any metadata attached to it.
Definition: Instruction.h:264
ClInstrumentWrites
static cl::opt< bool > ClInstrumentWrites("asan-instrument-writes", cl::desc("instrument write instructions"), cl::Hidden, cl::init(true))
SI
StandardInstrumentations SI(Debug, VerifyEach)
kAsanPoisonGlobalsName
const char kAsanPoisonGlobalsName[]
Definition: AddressSanitizer.cpp:141
llvm::GlobalValue::hasLocalLinkage
bool hasLocalLinkage() const
Definition: GlobalValue.h:445
ClMappingScale
static cl::opt< int > ClMappingScale("asan-mapping-scale", cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0))
llvm::IRBuilderBase::CreateExtractElement
Value * CreateExtractElement(Value *Vec, Value *Idx, const Twine &Name="")
Definition: IRBuilder.h:2438
llvm::ASanStackVariableDescription
Definition: ASanStackFrameLayout.h:30
ClMappingOffset
static cl::opt< uint64_t > ClMappingOffset("asan-mapping-offset", cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"), cl::Hidden, cl::init(0))
llvm::ArrayType::get
static ArrayType * get(Type *ElementType, uint64_t NumElements)
This static method is the primary way to construct an ArrayType.
Definition: Type.cpp:604
kEmscriptenShadowOffset
static const uint64_t kEmscriptenShadowOffset
Definition: AddressSanitizer.cpp:118
llvm::createAddressSanitizerFunctionPass
FunctionPass * createAddressSanitizerFunctionPass(bool CompileKernel=false, bool Recover=false, bool UseAfterScope=false, AsanDetectStackUseAfterReturnMode UseAfterReturn=AsanDetectStackUseAfterReturnMode::Runtime)
llvm::IRBuilderBase::getTrue
ConstantInt * getTrue()
Get the constant value for i1 true.
Definition: IRBuilder.h:458
kAsanGenPrefix
const char kAsanGenPrefix[]
Definition: AddressSanitizer.cpp:153
llvm::AsanDetectStackUseAfterReturnMode::Never
@ Never
Never detect stack use after return.
kSanCovGenPrefix
const char kSanCovGenPrefix[]
Definition: AddressSanitizer.cpp:155
llvm::Module
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:67
llvm::MDNode
Metadata node.
Definition: Metadata.h:897
OP
#define OP(n)
Definition: regex2.h:73
llvm::SplitBlockAndInsertIfThenElse
void SplitBlockAndInsertIfThenElse(Value *Cond, Instruction *SplitBefore, Instruction **ThenTerm, Instruction **ElseTerm, MDNode *BranchWeights=nullptr)
SplitBlockAndInsertIfThenElse is similar to SplitBlockAndInsertIfThen, but also creates the ElseBlock...
Definition: BasicBlockUtils.cpp:1439
INITIALIZE_PASS
INITIALIZE_PASS(ModuleAddressSanitizerLegacyPass, "asan-module", "AddressSanitizer: detects use-after-free and out-of-bounds bugs." "ModulePass", false, false) ModulePass *llvm
Definition: AddressSanitizer.cpp:1285
kAsanModuleCtorName
const char kAsanModuleCtorName[]
Definition: AddressSanitizer.cpp:128
llvm::ConstantStruct
Definition: Constants.h:441
llvm::SmallPtrSetImpl::count
size_type count(ConstPtrType Ptr) const
count - Return 1 if the specified pointer is in the set, 0 otherwise.
Definition: SmallPtrSet.h:382
ClOptSameTemp
static cl::opt< bool > ClOptSameTemp("asan-opt-same-temp", cl::desc("Instrument the same temp just once"), cl::Hidden, cl::init(true))
Triple.h
llvm::Function::createWithDefaultAttr
static Function * createWithDefaultAttr(FunctionType *Ty, LinkageTypes Linkage, unsigned AddrSpace, const Twine &N="", Module *M=nullptr)
Creates a function with some attributes recorded in llvm.module.flags applied.
Definition: Function.cpp:338
llvm::IRBuilderBase::CreatePHI
PHINode * CreatePHI(Type *Ty, unsigned NumReservedValues, const Twine &Name="")
Definition: IRBuilder.h:2383
kWindowsShadowOffset64
static const uint64_t kWindowsShadowOffset64
Definition: AddressSanitizer.cpp:121
kAsanGlobalsRegisteredFlagName
const char kAsanGlobalsRegisteredFlagName[]
Definition: AddressSanitizer.cpp:162
llvm::SmallPtrSetImplBase::clear
void clear()
Definition: SmallPtrSet.h:94
llvm::ArrayRef
ArrayRef - Represent a constant reference to an array (0 or more elements consecutively in memory),...
Definition: APInt.h:32
kMIPS32_ShadowOffset32
static const uint64_t kMIPS32_ShadowOffset32
Definition: AddressSanitizer.cpp:106
llvm::BinaryOperator
Definition: InstrTypes.h:189
findStoresToUninstrumentedArgAllocas
static void findStoresToUninstrumentedArgAllocas(AddressSanitizer &ASan, Instruction &InsBefore, SmallVectorImpl< Instruction * > &InitInsts)
Collect instructions in the entry block after InsBefore which initialize permanent storage for a func...
Definition: AddressSanitizer.cpp:3160
llvm::min
Expected< ExpressionValue > min(const ExpressionValue &Lhs, const ExpressionValue &Rhs)
Definition: FileCheck.cpp:357
DataLayout.h
llvm::codeview::ExportFlags::IsPrivate
@ IsPrivate
llvm::StructType
Class to represent struct types.
Definition: DerivedTypes.h:212
llvm::countTrailingZeros
unsigned countTrailingZeros(T Val, ZeroBehavior ZB=ZB_Width)
Count number of 0's from the least significant bit to the most stopping at the first 1.
Definition: MathExtras.h:156
Cond
SmallVector< MachineOperand, 4 > Cond
Definition: BasicBlockSections.cpp:179
kAsanUnregisterImageGlobalsName
const char kAsanUnregisterImageGlobalsName[]
Definition: AddressSanitizer.cpp:137
llvm::StringRef
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:58
this
Analysis the ScalarEvolution expression for r is this
Definition: README.txt:8
InstVisitor.h
llvm_unreachable
#define llvm_unreachable(msg)
Marks that the current location is not supposed to be reachable.
Definition: ErrorHandling.h:136
llvm::Constant::getAggregateElement
Constant * getAggregateElement(unsigned Elt) const
For aggregates (struct/array/vector) return the constant that corresponds to the specified element if...
Definition: Constants.cpp:420
llvm::Value::getType
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:256
ClOptStack
static cl::opt< bool > ClOptStack("asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), cl::Hidden, cl::init(false))
llvm::IRBuilderBase::CreateICmpEQ
Value * CreateICmpEQ(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2227
llvm::SPII::Store
@ Store
Definition: SparcInstrInfo.h:33
llvm::initializeModuleAddressSanitizerLegacyPassPass
void initializeModuleAddressSanitizerLegacyPassPass(PassRegistry &)
llvm::cantFail
void cantFail(Error Err, const char *Msg=nullptr)
Report a fatal error if Err is a failure value.
Definition: Error.h:737
llvm::Value::replaceAllUsesWith
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:520
llvm::BasicBlock::Create
static BasicBlock * Create(LLVMContext &Context, const Twine &Name="", Function *Parent=nullptr, BasicBlock *InsertBefore=nullptr)
Creates a new BasicBlock.
Definition: BasicBlock.h:100
getParent
static const Function * getParent(const Value *V)
Definition: BasicAliasAnalysis.cpp:776
uint32_t
llvm::AllocaInst::getAlignment
unsigned getAlignment() const
Definition: Instructions.h:129
llvm::AllocaInst::isArrayAllocation
bool isArrayAllocation() const
Return true if there is an allocation size parameter to the allocation instruction that is not 1.
Definition: Instructions.cpp:1378
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
llvm::ComputeASanStackFrameLayout
ASanStackFrameLayout ComputeASanStackFrameLayout(SmallVectorImpl< ASanStackVariableDescription > &Vars, size_t Granularity, size_t MinHeaderSize)
Definition: ASanStackFrameLayout.cpp:54
clEnumValN
#define clEnumValN(ENUMVAL, FLAGNAME, DESC)
Definition: CommandLine.h:674
asan
INITIALIZE_PASS(ASanGlobalsMetadataWrapperPass, "asan-globals-md", "Read metadata to mark which globals should be instrumented " "when running ASan.", false, true) char AddressSanitizerLegacyPass asan
Definition: AddressSanitizer.cpp:1271
llvm::InstVisitor
Base class for instruction visitors.
Definition: InstVisitor.h:79
llvm::ObjectSizeOpts
Various options to control the behavior of getObjectSize.
Definition: MemoryBuiltins.h:188
llvm::Triple::isiOS
bool isiOS() const
Is this an iOS triple.
Definition: Triple.h:463
llvm::maybeMarkSanitizerLibraryCallNoBuiltin
void maybeMarkSanitizerLibraryCallNoBuiltin(CallInst *CI, const TargetLibraryInfo *TLI)
Given a CallInst, check if it calls a string function known to CodeGen, and mark it with NoBuiltin if...
Definition: Local.cpp:3231
llvm::GlobalValue::AvailableExternallyLinkage
@ AvailableExternallyLinkage
Available for inspection, not emission.
Definition: GlobalValue.h:49
ClWithIfunc
static cl::opt< bool > ClWithIfunc("asan-with-ifunc", cl::desc("Access dynamic shadow through an ifunc global on " "platforms that support this"), cl::Hidden, cl::init(true))
llvm::ASanStackVariableDescription::Offset
size_t Offset
Definition: ASanStackFrameLayout.h:38
llvm::GlobalAlias::getAliasee
const Constant * getAliasee() const
Definition: GlobalAlias.h:73
llvm::Value::getName
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:297
llvm::LoadInst
An instruction for reading from memory.
Definition: Instructions.h:175
llvm::GlobalValue::CommonLinkage
@ CommonLinkage
Tentative definitions.
Definition: GlobalValue.h:58
llvm::Triple::isWatchOS
bool isWatchOS() const
Is this an Apple watchOS triple.
Definition: Triple.h:473
ClInstrumentDynamicAllocas
static cl::opt< bool > ClInstrumentDynamicAllocas("asan-instrument-dynamic-allocas", cl::desc("instrument dynamic allocas"), cl::Hidden, cl::init(true))
llvm::NamedMDNode::operands
iterator_range< op_iterator > operands()
Definition: Metadata.h:1482
llvm::AtomicRMWInst
an instruction that atomically reads a memory location, combines it with another value,...
Definition: Instructions.h:726
llvm::IRBuilderBase::CreateGEP
Value * CreateGEP(Type *Ty, Value *Ptr, ArrayRef< Value * > IdxList, const Twine &Name="")
Definition: IRBuilder.h:1795
llvm::ASanGlobalsMetadataAnalysis
The ASanGlobalsMetadataAnalysis initializes and returns a GlobalsMetadata object.
Definition: AddressSanitizer.h:81
Argument.h
llvm::ConstantInt::getZExtValue
uint64_t getZExtValue() const
Return the constant as a 64-bit unsigned integer value after it has been zero extended as appropriate...
Definition: Constants.h:142
kAsanSetShadowPrefix
const char kAsanSetShadowPrefix[]
Definition: AddressSanitizer.cpp:156
kSmallX86_64ShadowOffsetBase
static const uint64_t kSmallX86_64ShadowOffsetBase
Definition: AddressSanitizer.cpp:101
llvm::Triple::isOSWindows
bool isOSWindows() const
Tests whether the OS is Windows.
Definition: Triple.h:547
llvm::depth_first
iterator_range< df_iterator< T > > depth_first(const T &G)
Definition: DepthFirstIterator.h:229
Attributes.h
runOnFunction
static bool runOnFunction(Function &F, bool PostInlining)
Definition: EntryExitInstrumenter.cpp:69
j
return j(j<< 16)
Constant.h
llvm::ASanStackVariableDescription::Line
unsigned Line
Definition: ASanStackFrameLayout.h:40
llvm::ResumeInst
Resume the propagation of an exception.
Definition: Instructions.h:4163
llvm::Twine
Twine - A lightweight data structure for efficiently representing the concatenation of temporary valu...
Definition: Twine.h:83
kWindowsShadowOffset32
static const uint64_t kWindowsShadowOffset32
Definition: AddressSanitizer.cpp:117
llvm::GraphProgram::Name
Name
Definition: GraphWriter.h:52
ClStack
static cl::opt< bool > ClStack("asan-stack", cl::desc("Handle stack memory"), cl::Hidden, cl::init(true))
llvm::Constant::getNullValue
static Constant * getNullValue(Type *Ty)
Constructor to create a '0' constant of arbitrary type.
Definition: Constants.cpp:346
llvm::Type::getIntNTy
static IntegerType * getIntNTy(LLVMContext &C, unsigned N)
Definition: Type.cpp:207
llvm::AArch64::RZ
@ RZ
Definition: AArch64ISelLowering.h:473
llvm::AnalysisUsage::setPreservesAll
void setPreservesAll()
Set by analyses that do not transform their input at all.
Definition: PassAnalysisSupport.h:130
llvm::GlobalAlias::create
static GlobalAlias * create(Type *Ty, unsigned AddressSpace, LinkageTypes Linkage, const Twine &Name, Constant *Aliasee, Module *Parent)
If a parent module is specified, the alias is automatically inserted into the end of the specified mo...
Definition: Globals.cpp:485
get
Should compile to something r4 addze r3 instead we get
Definition: README.txt:24
kAMDGPUAddressPrivateName
const char kAMDGPUAddressPrivateName[]
Definition: AddressSanitizer.cpp:174
kAsanUnpoisonStackMemoryName
const char kAsanUnpoisonStackMemoryName[]
Definition: AddressSanitizer.cpp:158
llvm::AsanDtorKind
AsanDtorKind
Types of ASan module destructors supported.
Definition: AddressSanitizerOptions.h:17
llvm::IRBuilderBase::CreateMemCpy
CallInst * CreateMemCpy(Value *Dst, MaybeAlign DstAlign, Value *Src, MaybeAlign SrcAlign, uint64_t Size, bool isVolatile=false, MDNode *TBAATag=nullptr, MDNode *TBAAStructTag=nullptr, MDNode *ScopeTag=nullptr, MDNode *NoAliasTag=nullptr)
Create and insert a memcpy between the specified pointers.
Definition: IRBuilder.h:622
llvm::AMDGPU::SendMsg::Op
Op
Definition: SIDefines.h:314
llvm::PreservedAnalyses::all
static PreservedAnalyses all()
Construct a special preserved set that preserves all passes.
Definition: PassManager.h:161
llvm::X86::FirstMacroFusionInstKind::Cmp
@ Cmp
llvm::ASanStackVariableDescription::LifetimeSize
size_t LifetimeSize
Definition: ASanStackFrameLayout.h:34
GlobalVariable.h
kFreeBSD_ShadowOffset64
static const uint64_t kFreeBSD_ShadowOffset64
Definition: AddressSanitizer.cpp:111
llvm::TypeSize
Definition: TypeSize.h:417
kAArch64_ShadowOffset64
static const uint64_t kAArch64_ShadowOffset64
Definition: AddressSanitizer.cpp:108
Casting.h
llvm::Triple::MachO
@ MachO
Definition: Triple.h:237
Function.h
llvm::AsanDtorKind::Global
@ Global
Append to llvm.global_dtors.
llvm::Type::getPointerTo
PointerType * getPointerTo(unsigned AddrSpace=0) const
Return a pointer to the current type.
Definition: Type.cpp:738
llvm::TargetLibraryInfo
Provides information about what library functions are available for the current target.
Definition: TargetLibraryInfo.h:219
llvm::ReturnInst::Create
static ReturnInst * Create(LLVMContext &C, Value *retVal=nullptr, Instruction *InsertBefore=nullptr)
Definition: Instructions.h:2977
llvm::getUniqueModuleId
std::string getUniqueModuleId(Module *M)
Produce a unique identifier for this module by taking the MD5 sum of the names of the module's strong...
Definition: ModuleUtils.cpp:244
llvm::ConstantArray::get
static Constant * get(ArrayType *T, ArrayRef< Constant * > V)
Definition: Constants.cpp:1262
llvm::ConstantExpr::getGetElementPtr
static Constant * getGetElementPtr(Type *Ty, Constant *C, ArrayRef< Constant * > IdxList, bool InBounds=false, Optional< unsigned > InRangeIndex=None, Type *OnlyIfReducedTy=nullptr)
Getelementptr form.
Definition: Constants.h:1210
llvm::SmallVectorImpl::clear
void clear()
Definition: SmallVector.h:585
llvm::Triple::systemz
@ systemz
Definition: Triple.h:78
kFreeBSDKasan_ShadowOffset64
static const uint64_t kFreeBSDKasan_ShadowOffset64
Definition: AddressSanitizer.cpp:112
kMaxAsanStackMallocSizeClass
static const int kMaxAsanStackMallocSizeClass
Definition: AddressSanitizer.cpp:148
llvm::CleanupReturnInst
Definition: Instructions.h:4571
ClUseOdrIndicator
static cl::opt< bool > ClUseOdrIndicator("asan-use-odr-indicator", cl::desc("Use odr indicators to improve ODR reporting"), cl::Hidden, cl::init(false))
ClOpt
static cl::opt< bool > ClOpt("asan-opt", cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true))
GlobalAlias.h
llvm::IntrinsicInst
A wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:45
ClInvalidPointerSub
static cl::opt< bool > ClInvalidPointerSub("asan-detect-invalid-pointer-sub", cl::desc("Instrument - operations with pointer operands"), cl::Hidden, cl::init(false))
Vector
So we should use XX3Form_Rcr to implement instrinsic Convert DP outs ins xscvdpsp No builtin are required Round &Convert QP DP(dword[1] is set to zero) No builtin are required Round to Quad Precision because you need to assign rounding mode in instruction Provide builtin(set f128:$vT,(int_ppc_vsx_xsrqpi f128:$vB))(set f128 yields< n x< ty > >< result > yields< ty >< result > No builtin are required Load Store Vector
Definition: README_P9.txt:497
llvm::MDBuilder
Definition: MDBuilder.h:35
llvm::ComputeASanStackFrameDescription
SmallString< 64 > ComputeASanStackFrameDescription(const SmallVectorImpl< ASanStackVariableDescription > &Vars)
Definition: ASanStackFrameLayout.cpp:97
llvm::Function::front
const BasicBlock & front() const
Definition: Function.h:785
llvm::AllocaInst::setAlignment
void setAlignment(Align Align)
Definition: Instructions.h:124
llvm::ObjectSizeOffsetVisitor::compute
SizeOffsetType compute(Value *V)
Definition: MemoryBuiltins.cpp:611
llvm::Triple::isAndroidVersionLT
bool isAndroidVersionLT(unsigned Major) const
Definition: Triple.h:675
llvm::AttributeList::FunctionIndex
@ FunctionIndex
Definition: Attributes.h:402
llvm::Type::getVoidTy
static Type * getVoidTy(LLVMContext &C)
Definition: Type.cpp:186
llvm::IRBuilderBase::getInt1Ty
IntegerType * getInt1Ty()
Fetch the type representing a single bit.
Definition: IRBuilder.h:503
getRedzoneSizeForScale
static uint64_t getRedzoneSizeForScale(int MappingScale)
Definition: AddressSanitizer.cpp:562
AddressSanitizerOptions.h
llvm::Pass
Pass interface - Implemented by all 'passes'.
Definition: Pass.h:91
llvm::Triple::COFF
@ COFF
Definition: Triple.h:234
llvm::GlobalValue::PrivateLinkage
@ PrivateLinkage
Like Internal, but omit from symbol table.
Definition: GlobalValue.h:56
Instructions.h
llvm::AllocaInst::isUsedWithInAlloca
bool isUsedWithInAlloca() const
Return true if this alloca is used as an inalloca argument to a call.
Definition: Instructions.h:138
kAsanUnpoisonGlobalsName
const char kAsanUnpoisonGlobalsName[]
Definition: AddressSanitizer.cpp:142
SmallVector.h
llvm::ModuleAddressSanitizerPass::run
PreservedAnalyses run(Module &M, ModuleAnalysisManager &AM)
Definition: AddressSanitizer.cpp:1246
llvm::Instruction::getDebugLoc
const DebugLoc & getDebugLoc() const
Return the debug location for this node as a DebugLoc.
Definition: Instruction.h:372
llvm::Triple::isOSNetBSD
bool isOSNetBSD() const
Definition: Triple.h:502
llvm::createModuleAddressSanitizerLegacyPassPass
ModulePass * createModuleAddressSanitizerLegacyPassPass(bool CompileKernel=false, bool Recover=false, bool UseGlobalsGC=true, bool UseOdrIndicator=true, AsanDtorKind DestructorKind=AsanDtorKind::Global)
llvm::AsanDetectStackUseAfterReturnMode::Invalid
@ Invalid
Not a valid detect mode.
AddressSanitizer
INITIALIZE_PASS(ASanGlobalsMetadataWrapperPass, "asan-globals-md", "Read metadata to mark which globals should be instrumented " "when running ASan.", false, true) char AddressSanitizerLegacyPass AddressSanitizer
Definition: AddressSanitizer.cpp:1272
llvm::IRBuilderBase::CreateLShr
Value * CreateLShr(Value *LHS, Value *RHS, const Twine &Name="", bool isExact=false)
Definition: IRBuilder.h:1318
Dominators.h
ModuleUtils.h
llvm::CallBase::getArgOperand
Value * getArgOperand(unsigned i) const
Definition: InstrTypes.h:1338
N
#define N
kCurrentStackFrameMagic
static const uintptr_t kCurrentStackFrameMagic
Definition: AddressSanitizer.cpp:125
llvm::Instruction::getParent
const BasicBlock * getParent() const
Definition: Instruction.h:94
kFreeBSD_ShadowOffset32
static const uint64_t kFreeBSD_ShadowOffset32
Definition: AddressSanitizer.cpp:110
kAsanShadowMemoryDynamicAddress
const char kAsanShadowMemoryDynamicAddress[]
Definition: AddressSanitizer.cpp:167
llvm::to_string
std::string to_string(const T &Value)
Definition: ScopedPrinter.h:63
kAsanStackMallocNameTemplate
const char kAsanStackMallocNameTemplate[]
Definition: AddressSanitizer.cpp:149
llvm::ArrayRef::size
size_t size() const
size - Get the array size.
Definition: ArrayRef.h:165
llvm::ConstantInt::isValueValidForType
static bool isValueValidForType(Type *Ty, uint64_t V)
This static method returns true if the type Ty is big enough to represent the value V.
Definition: Constants.cpp:1588
llvm::max
Align max(MaybeAlign Lhs, Align Rhs)
Definition: Alignment.h:340
llvm::LocationMetadata::parse
void parse(MDNode *MDN)
Definition: AddressSanitizer.cpp:1166
llvm::FunctionCallee
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:164
llvm::codeview::CompileSym3Flags::Exp
@ Exp
llvm::PHINode
Definition: Instructions.h:2597
ClRecover
static cl::opt< bool > ClRecover("asan-recover", cl::desc("Enable recovery mode (continue-after-error)."), cl::Hidden, cl::init(false))
llvm::StringRef::data
const LLVM_NODISCARD char * data() const
data - Get a pointer to the start of the string (which may not be null terminated).
Definition: StringRef.h:149
llvm::SmallVectorImpl
This class consists of common code factored out of the SmallVector class to reduce code duplication b...
Definition: APFloat.h:43
kAsanReportErrorTemplate
const char kAsanReportErrorTemplate[]
Definition: AddressSanitizer.cpp:133
llvm::CallBase
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1161
llvm::LocationMetadata::LineNo
int LineNo
Definition: AddressSanitizer.h:27
llvm::Module::getDataLayout
const DataLayout & getDataLayout() const
Get the data layout for the module's target platform.
Definition: Module.cpp:401
DerivedTypes.h
llvm::AnalysisManager
A container for analyses that lazily runs them and caches their results.
Definition: InstructionSimplify.h:44
llvm::HexStyle::Asm
@ Asm
0ffh
Definition: MCInstPrinter.h:34
llvm::IntegerType::get
static IntegerType * get(LLVMContext &C, unsigned NumBits)
This static method is the primary way of constructing an IntegerType.
Definition: Type.cpp:275
llvm::FunctionPass
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:298
llvm::CallInst
This class represents a function call, abstracting a target machine's calling convention.
Definition: Instructions.h:1475
llvm::ConstantInt::isOne
bool isOne() const
This is just a convenience method to make client code smaller for a common case.
Definition: Constants.h:200
BB
Common register allocation spilling lr str ldr sxth r3 ldr mla r4 can lr mov lr str ldr sxth r3 mla r4 and then merge mul and lr str ldr sxth r3 mla r4 It also increase the likelihood the store may become dead bb27 Successors according to LLVM BB
Definition: README.txt:39
llvm::IRBuilderBase::getVoidTy
Type * getVoidTy()
Fetch the type representing void.
Definition: IRBuilder.h:556
llvm::UnreachableInst
This function has undefined behavior.
Definition: Instructions.h:4679
MachO.h
llvm::IRBuilderBase::CreateICmpNE
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2231
llvm::AnalysisUsage::addRequired
AnalysisUsage & addRequired()
Definition: PassAnalysisSupport.h:75
LLVMContext.h
kAsanPtrSub
const char kAsanPtrSub[]
Definition: AddressSanitizer.cpp:146
llvm::IRBuilderBase::CreateSub
Value * CreateSub(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1225
llvm::Value::takeName
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:370
llvm::DebugLoc
A debug info location.
Definition: DebugLoc.h:33
llvm::SplitBlockAndInsertIfThen
Instruction * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights, DominatorTree *DT, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
Definition: BasicBlockUtils.cpp:1418
kAsanPtrCmp
const char kAsanPtrCmp[]
Definition: AddressSanitizer.cpp:145
llvm::AllocaInst
an instruction to allocate memory on the stack
Definition: Instructions.h:62
llvm::appendToGlobalCtors
void appendToGlobalCtors(Module &M, Function *F, int Priority, Constant *Data=nullptr)
Append F to the list of global ctors of module M with the given Priority.
Definition: ModuleUtils.cpp:66
llvm::User::getOperand
Value * getOperand(unsigned i) const
Definition: User.h:169
llvm::BasicBlock::getTerminatingMustTailCall
const CallInst * getTerminatingMustTailCall() const
Returns the call instruction marked 'musttail' prior to the terminating return instruction of this ba...
Definition: BasicBlock.cpp:154
llvm::cl::desc
Definition: CommandLine.h:414
llvm::GlobalObject::setAlignment
void setAlignment(MaybeAlign Align)
Definition: Globals.cpp:117
llvm::GlobalValue::ExternalWeakLinkage
@ ExternalWeakLinkage
ExternalWeak linkage description.
Definition: GlobalValue.h:57
llvm::MDString::getString
StringRef getString() const
Definition: Metadata.cpp:483
llvm::BranchInst
Conditional or Unconditional Branch instruction.
Definition: Instructions.h:3032
raw_ostream.h
n
The same transformation can work with an even modulo with the addition of a and shrink the compare RHS by the same amount Unless the target supports that transformation probably isn t worthwhile The transformation can also easily be made to work with non zero equality for n
Definition: README.txt:685
llvm::CallBase::arg_operands
iterator_range< User::op_iterator > arg_operands()
Definition: InstrTypes.h:1330
llvm::SmallVectorImpl::reserve
void reserve(size_type N)
Definition: SmallVector.h:624
BasicBlockUtils.h
llvm::MDString
A single uniqued string.
Definition: Metadata.h:611
llvm::replaceDbgDeclare
bool replaceDbgDeclare(Value *Address, Value *NewAddress, DIBuilder &Builder, uint8_t DIExprFlags, int Offset)
Replaces llvm.dbg.declare instruction when the address it describes is replaced with a new value.
Definition: Local.cpp:1676
Priority
Definition: Inliner.cpp:727
Value.h
llvm::GlobalValue::setVisibility
void setVisibility(VisibilityTypes V)
Definition: GlobalValue.h:235
InitializePasses.h
StackMallocSizeClass
static int StackMallocSizeClass(uint64_t LocalStackSize)
Definition: AddressSanitizer.cpp:3054
llvm::Value
LLVM Value Representation.
Definition: Value.h:75
llvm::AtomicCmpXchgInst
An instruction that atomically checks whether a specified value is in a memory location,...
Definition: Instructions.h:521
Debug.h
llvm::TargetLibraryAnalysis
Analysis pass providing the TargetLibraryInfo.
Definition: TargetLibraryInfo.h:438
llvm::ASanStackFrameLayout
Definition: ASanStackFrameLayout.h:44
kAsanModuleDtorName
const char kAsanModuleDtorName[]
Definition: AddressSanitizer.cpp:129
llvm::Triple::aarch64
@ aarch64
Definition: Triple.h:52
llvm::LocationMetadata::ColumnNo
int ColumnNo
Definition: AddressSanitizer.h:28
llvm::IRBuilderBase::CreateCall
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=None, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2391
llvm::isAllocaPromotable
bool isAllocaPromotable(const AllocaInst *AI)
Return true if this alloca is legal for promotion.
Definition: PromoteMemoryToRegister.cpp:64
llvm::AsanDtorKind::Invalid
@ Invalid
Not a valid destructor Kind.
llvm::findAllocaForValue
AllocaInst * findAllocaForValue(Value *V, bool OffsetZero=false)
Returns unique alloca where the value comes from, or nullptr.
Definition: ValueTracking.cpp:4505
llvm::Instruction::moveBefore
void moveBefore(Instruction *MovePos)
Unlink this instruction from its current basic block and insert it into the basic block that MovePos ...
Definition: Instruction.cpp:97
of
Add support for conditional and other related patterns Instead of
Definition: README.txt:134
instrumentMaskedLoadOrStore
static void instrumentMaskedLoadOrStore(AddressSanitizer *Pass, const DataLayout &DL, Type *IntptrTy, Value *Mask, Instruction *I, Value *Addr, MaybeAlign Alignment, unsigned Granularity, uint32_t TypeSize, bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp)
Definition: AddressSanitizer.cpp:1564
llvm::Use
A Use represents the edge between a Value definition and its users.
Definition: Use.h:44
llvm::SmallVectorImpl::emplace_back
reference emplace_back(ArgTypes &&... Args)
Definition: SmallVector.h:908
llvm::SmallPtrSetImpl::insert
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:364
kPS4CPU_ShadowOffset64
static const uint64_t kPS4CPU_ShadowOffset64
Definition: AddressSanitizer.cpp:116
llvm::Intrinsic::ID
unsigned ID
Definition: TargetTransformInfo.h:38
llvm::DataLayout::getTypeAllocSize
TypeSize getTypeAllocSize(Type *Ty) const
Returns the offset in bytes between successive objects of the specified type, including alignment pad...
Definition: DataLayout.h:498
llvm::ModuleAddressSanitizerPass::ModuleAddressSanitizerPass
ModuleAddressSanitizerPass(bool CompileKernel=false, bool Recover=false, bool UseGlobalGC=true, bool UseOdrIndicator=false, AsanDtorKind DestructorKind=AsanDtorKind::Global)
Definition: AddressSanitizer.cpp:1240
ScopedPrinter.h
ClUseGlobalsGC
static cl::opt< bool > ClUseGlobalsGC("asan-globals-live-support", cl::desc("Use linker features to support dead " "code stripping of globals"), cl::Hidden, cl::init(true))
llvm::Triple::UnknownObjectFormat
@ UnknownObjectFormat
Definition: Triple.h:232
ClDebug
static cl::opt< int > ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, cl::init(0))