1 /* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2017 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
31 #include "alloc-pool.h"
32 #include "tree-pass.h"
36 #include "stringpool.h"
37 #include "tree-ssanames.h"
41 #include "gimple-pretty-print.h"
43 #include "fold-const.h"
46 #include "gimple-iterator.h"
48 #include "stor-layout.h"
49 #include "tree-iterator.h"
50 #include "stringpool.h"
57 #include "langhooks.h"
59 #include "gimple-builder.h"
60 #include "gimple-fold.h"
65 #include "tree-inline.h"
67 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
68 with <2x slowdown on average.
70 The tool consists of two parts:
71 instrumentation module (this file) and a run-time library.
72 The instrumentation module adds a run-time check before every memory insn.
73 For a 8- or 16- byte load accessing address X:
74 ShadowAddr = (X >> 3) + Offset
75 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
77 __asan_report_load8(X);
78 For a load of N bytes (N=1, 2 or 4) from address X:
79 ShadowAddr = (X >> 3) + Offset
80 ShadowValue = *(char*)ShadowAddr;
82 if ((X & 7) + N - 1 > ShadowValue)
83 __asan_report_loadN(X);
84 Stores are instrumented similarly, but using __asan_report_storeN functions.
85 A call too __asan_init_vN() is inserted to the list of module CTORs.
86 N is the version number of the AddressSanitizer API. The changes between the
87 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
89 The run-time library redefines malloc (so that redzone are inserted around
90 the allocated memory) and free (so that reuse of free-ed memory is delayed),
91 provides __asan_report* and __asan_init_vN functions.
94 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
96 The current implementation supports detection of out-of-bounds and
97 use-after-free in the heap, on the stack and for global variables.
99 [Protection of stack variables]
101 To understand how detection of out-of-bounds and use-after-free works
102 for stack variables, lets look at this example on x86_64 where the
103 stack grows downward:
117 For this function, the stack protected by asan will be organized as
118 follows, from the top of the stack to the bottom:
120 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
122 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
123 the next slot be 32 bytes aligned; this one is called Partial
124 Redzone; this 32 bytes alignment is an asan constraint]
126 Slot 3/ [24 bytes for variable 'a']
128 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
130 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
132 Slot 6/ [8 bytes for variable 'b']
134 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
137 The 32 bytes of LEFT red zone at the bottom of the stack can be
140 1/ The first 8 bytes contain a magical asan number that is always
143 2/ The following 8 bytes contains a pointer to a string (to be
144 parsed at runtime by the runtime asan library), which format is
147 "<function-name> <space> <num-of-variables-on-the-stack>
148 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
149 <length-of-var-in-bytes> ){n} "
151 where '(...){n}' means the content inside the parenthesis occurs 'n'
152 times, with 'n' being the number of variables on the stack.
154 3/ The following 8 bytes contain the PC of the current function which
155 will be used by the run-time library to print an error message.
157 4/ The following 8 bytes are reserved for internal use by the run-time.
159 The shadow memory for that stack layout is going to look like this:
161 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
162 The F1 byte pattern is a magic number called
163 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
164 the memory for that shadow byte is part of a the LEFT red zone
165 intended to seat at the bottom of the variables on the stack.
167 - content of shadow memory 8 bytes for slots 6 and 5:
168 0xF4F4F400. The F4 byte pattern is a magic number
169 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
170 memory region for this shadow byte is a PARTIAL red zone
171 intended to pad a variable A, so that the slot following
172 {A,padding} is 32 bytes aligned.
174 Note that the fact that the least significant byte of this
175 shadow memory content is 00 means that 8 bytes of its
176 corresponding memory (which corresponds to the memory of
177 variable 'b') is addressable.
179 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
180 The F2 byte pattern is a magic number called
181 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
182 region for this shadow byte is a MIDDLE red zone intended to
183 seat between two 32 aligned slots of {variable,padding}.
185 - content of shadow memory 8 bytes for slot 3 and 2:
186 0xF4000000. This represents is the concatenation of
187 variable 'a' and the partial red zone following it, like what we
188 had for variable 'b'. The least significant 3 bytes being 00
189 means that the 3 bytes of variable 'a' are addressable.
191 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
192 The F3 byte pattern is a magic number called
193 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
194 region for this shadow byte is a RIGHT red zone intended to seat
195 at the top of the variables of the stack.
197 Note that the real variable layout is done in expand_used_vars in
198 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
199 stack variables as well as the different red zones, emits some
200 prologue code to populate the shadow memory as to poison (mark as
201 non-accessible) the regions of the red zones and mark the regions of
202 stack variables as accessible, and emit some epilogue code to
203 un-poison (mark as accessible) the regions of red zones right before
206 [Protection of global variables]
208 The basic idea is to insert a red zone between two global variables
209 and install a constructor function that calls the asan runtime to do
210 the populating of the relevant shadow memory regions at load time.
212 So the global variables are laid out as to insert a red zone between
213 them. The size of the red zones is so that each variable starts on a
216 Then a constructor function is installed so that, for each global
217 variable, it calls the runtime asan library function
218 __asan_register_globals_with an instance of this type:
222 // Address of the beginning of the global variable.
225 // Initial size of the global variable.
228 // Size of the global variable + size of the red zone. This
229 // size is 32 bytes aligned.
230 uptr __size_with_redzone;
232 // Name of the global variable.
235 // Name of the module where the global variable is declared.
236 const void *__module_name;
238 // 1 if it has dynamic initialization, 0 otherwise.
239 uptr __has_dynamic_init;
241 // A pointer to struct that contains source location, could be NULL.
242 __asan_global_source_location *__location;
245 A destructor function that calls the runtime asan library function
246 _asan_unregister_globals is also installed. */
248 static unsigned HOST_WIDE_INT asan_shadow_offset_value
;
249 static bool asan_shadow_offset_computed
;
250 static vec
<char *> sanitized_sections
;
251 static tree last_alloca_addr
;
253 /* Set of variable declarations that are going to be guarded by
254 use-after-scope sanitizer. */
256 static hash_set
<tree
> *asan_handled_variables
= NULL
;
258 hash_set
<tree
> *asan_used_labels
= NULL
;
260 /* Sets shadow offset to value in string VAL. */
263 set_asan_shadow_offset (const char *val
)
268 #ifdef HAVE_LONG_LONG
269 asan_shadow_offset_value
= strtoull (val
, &endp
, 0);
271 asan_shadow_offset_value
= strtoul (val
, &endp
, 0);
273 if (!(*val
!= '\0' && *endp
== '\0' && errno
== 0))
276 asan_shadow_offset_computed
= true;
281 /* Set list of user-defined sections that need to be sanitized. */
284 set_sanitized_sections (const char *sections
)
288 FOR_EACH_VEC_ELT (sanitized_sections
, i
, pat
)
290 sanitized_sections
.truncate (0);
292 for (const char *s
= sections
; *s
; )
295 for (end
= s
; *end
&& *end
!= ','; ++end
);
296 size_t len
= end
- s
;
297 sanitized_sections
.safe_push (xstrndup (s
, len
));
298 s
= *end
? end
+ 1 : end
;
303 asan_mark_p (gimple
*stmt
, enum asan_mark_flags flag
)
305 return (gimple_call_internal_p (stmt
, IFN_ASAN_MARK
)
306 && tree_to_uhwi (gimple_call_arg (stmt
, 0)) == flag
);
310 asan_sanitize_stack_p (void)
312 return (sanitize_flags_p (SANITIZE_ADDRESS
) && ASAN_STACK
);
316 asan_sanitize_allocas_p (void)
318 return (asan_sanitize_stack_p () && ASAN_PROTECT_ALLOCAS
);
321 /* Checks whether section SEC should be sanitized. */
324 section_sanitized_p (const char *sec
)
328 FOR_EACH_VEC_ELT (sanitized_sections
, i
, pat
)
329 if (fnmatch (pat
, sec
, FNM_PERIOD
) == 0)
334 /* Returns Asan shadow offset. */
336 static unsigned HOST_WIDE_INT
337 asan_shadow_offset ()
339 if (!asan_shadow_offset_computed
)
341 asan_shadow_offset_computed
= true;
342 asan_shadow_offset_value
= targetm
.asan_shadow_offset ();
344 return asan_shadow_offset_value
;
347 alias_set_type asan_shadow_set
= -1;
349 /* Pointer types to 1, 2 or 4 byte integers in shadow memory. A separate
350 alias set is used for all shadow memory accesses. */
351 static GTY(()) tree shadow_ptr_types
[3];
353 /* Decl for __asan_option_detect_stack_use_after_return. */
354 static GTY(()) tree asan_detect_stack_use_after_return
;
356 /* Hashtable support for memory references used by gimple
359 /* This type represents a reference to a memory region. */
362 /* The expression of the beginning of the memory region. */
365 /* The size of the access. */
366 HOST_WIDE_INT access_size
;
369 object_allocator
<asan_mem_ref
> asan_mem_ref_pool ("asan_mem_ref");
371 /* Initializes an instance of asan_mem_ref. */
374 asan_mem_ref_init (asan_mem_ref
*ref
, tree start
, HOST_WIDE_INT access_size
)
377 ref
->access_size
= access_size
;
380 /* Allocates memory for an instance of asan_mem_ref into the memory
381 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
382 START is the address of (or the expression pointing to) the
383 beginning of memory reference. ACCESS_SIZE is the size of the
384 access to the referenced memory. */
387 asan_mem_ref_new (tree start
, HOST_WIDE_INT access_size
)
389 asan_mem_ref
*ref
= asan_mem_ref_pool
.allocate ();
391 asan_mem_ref_init (ref
, start
, access_size
);
395 /* This builds and returns a pointer to the end of the memory region
396 that starts at START and of length LEN. */
399 asan_mem_ref_get_end (tree start
, tree len
)
401 if (len
== NULL_TREE
|| integer_zerop (len
))
404 if (!ptrofftype_p (len
))
405 len
= convert_to_ptrofftype (len
);
407 return fold_build2 (POINTER_PLUS_EXPR
, TREE_TYPE (start
), start
, len
);
410 /* Return a tree expression that represents the end of the referenced
411 memory region. Beware that this function can actually build a new
415 asan_mem_ref_get_end (const asan_mem_ref
*ref
, tree len
)
417 return asan_mem_ref_get_end (ref
->start
, len
);
420 struct asan_mem_ref_hasher
: nofree_ptr_hash
<asan_mem_ref
>
422 static inline hashval_t
hash (const asan_mem_ref
*);
423 static inline bool equal (const asan_mem_ref
*, const asan_mem_ref
*);
426 /* Hash a memory reference. */
429 asan_mem_ref_hasher::hash (const asan_mem_ref
*mem_ref
)
431 return iterative_hash_expr (mem_ref
->start
, 0);
434 /* Compare two memory references. We accept the length of either
435 memory references to be NULL_TREE. */
438 asan_mem_ref_hasher::equal (const asan_mem_ref
*m1
,
439 const asan_mem_ref
*m2
)
441 return operand_equal_p (m1
->start
, m2
->start
, 0);
444 static hash_table
<asan_mem_ref_hasher
> *asan_mem_ref_ht
;
446 /* Returns a reference to the hash table containing memory references.
447 This function ensures that the hash table is created. Note that
448 this hash table is updated by the function
449 update_mem_ref_hash_table. */
451 static hash_table
<asan_mem_ref_hasher
> *
452 get_mem_ref_hash_table ()
454 if (!asan_mem_ref_ht
)
455 asan_mem_ref_ht
= new hash_table
<asan_mem_ref_hasher
> (10);
457 return asan_mem_ref_ht
;
460 /* Clear all entries from the memory references hash table. */
463 empty_mem_ref_hash_table ()
466 asan_mem_ref_ht
->empty ();
469 /* Free the memory references hash table. */
472 free_mem_ref_resources ()
474 delete asan_mem_ref_ht
;
475 asan_mem_ref_ht
= NULL
;
477 asan_mem_ref_pool
.release ();
480 /* Return true iff the memory reference REF has been instrumented. */
483 has_mem_ref_been_instrumented (tree ref
, HOST_WIDE_INT access_size
)
486 asan_mem_ref_init (&r
, ref
, access_size
);
488 asan_mem_ref
*saved_ref
= get_mem_ref_hash_table ()->find (&r
);
489 return saved_ref
&& saved_ref
->access_size
>= access_size
;
492 /* Return true iff the memory reference REF has been instrumented. */
495 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
)
497 return has_mem_ref_been_instrumented (ref
->start
, ref
->access_size
);
500 /* Return true iff access to memory region starting at REF and of
501 length LEN has been instrumented. */
504 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
, tree len
)
506 HOST_WIDE_INT size_in_bytes
507 = tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
509 return size_in_bytes
!= -1
510 && has_mem_ref_been_instrumented (ref
->start
, size_in_bytes
);
513 /* Set REF to the memory reference present in a gimple assignment
514 ASSIGNMENT. Return true upon successful completion, false
518 get_mem_ref_of_assignment (const gassign
*assignment
,
522 gcc_assert (gimple_assign_single_p (assignment
));
524 if (gimple_store_p (assignment
)
525 && !gimple_clobber_p (assignment
))
527 ref
->start
= gimple_assign_lhs (assignment
);
528 *ref_is_store
= true;
530 else if (gimple_assign_load_p (assignment
))
532 ref
->start
= gimple_assign_rhs1 (assignment
);
533 *ref_is_store
= false;
538 ref
->access_size
= int_size_in_bytes (TREE_TYPE (ref
->start
));
542 /* Return address of last allocated dynamic alloca. */
545 get_last_alloca_addr ()
547 if (last_alloca_addr
)
548 return last_alloca_addr
;
550 last_alloca_addr
= create_tmp_reg (ptr_type_node
, "last_alloca_addr");
551 gassign
*g
= gimple_build_assign (last_alloca_addr
, null_pointer_node
);
552 edge e
= single_succ_edge (ENTRY_BLOCK_PTR_FOR_FN (cfun
));
553 gsi_insert_on_edge_immediate (e
, g
);
554 return last_alloca_addr
;
557 /* Insert __asan_allocas_unpoison (top, bottom) call after
558 __builtin_stack_restore (new_sp) call.
559 The pseudocode of this routine should look like this:
560 __builtin_stack_restore (new_sp);
561 top = last_alloca_addr;
563 __asan_allocas_unpoison (top, bot);
564 last_alloca_addr = new_sp;
565 In general, we can't use new_sp as bot parameter because on some
566 architectures SP has non zero offset from dynamic stack area. Moreover, on
567 some architectures this offset (STACK_DYNAMIC_OFFSET) becomes known for each
568 particular function only after all callees were expanded to rtl.
569 The most noticeable example is PowerPC{,64}, see
570 http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html#DYNAM-STACK.
571 To overcome the issue we use following trick: pass new_sp as a second
572 parameter to __asan_allocas_unpoison and rewrite it during expansion with
573 virtual_dynamic_stack_rtx later in expand_asan_emit_allocas_unpoison
578 handle_builtin_stack_restore (gcall
*call
, gimple_stmt_iterator
*iter
)
580 if (!iter
|| !asan_sanitize_allocas_p ())
583 tree last_alloca
= get_last_alloca_addr ();
584 tree restored_stack
= gimple_call_arg (call
, 0);
585 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_ALLOCAS_UNPOISON
);
586 gimple
*g
= gimple_build_call (fn
, 2, last_alloca
, restored_stack
);
587 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
588 g
= gimple_build_assign (last_alloca
, restored_stack
);
589 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
592 /* Deploy and poison redzones around __builtin_alloca call. To do this, we
593 should replace this call with another one with changed parameters and
594 replace all its uses with new address, so
595 addr = __builtin_alloca (old_size, align);
597 left_redzone_size = max (align, ASAN_RED_ZONE_SIZE);
598 Following two statements are optimized out if we know that
599 old_size & (ASAN_RED_ZONE_SIZE - 1) == 0, i.e. alloca doesn't need partial
601 misalign = old_size & (ASAN_RED_ZONE_SIZE - 1);
602 partial_redzone_size = ASAN_RED_ZONE_SIZE - misalign;
603 right_redzone_size = ASAN_RED_ZONE_SIZE;
604 additional_size = left_redzone_size + partial_redzone_size +
606 new_size = old_size + additional_size;
607 new_alloca = __builtin_alloca (new_size, max (align, 32))
608 __asan_alloca_poison (new_alloca, old_size)
609 addr = new_alloca + max (align, ASAN_RED_ZONE_SIZE);
610 last_alloca_addr = new_alloca;
611 ADDITIONAL_SIZE is added to make new memory allocation contain not only
612 requested memory, but also left, partial and right redzones as well as some
613 additional space, required by alignment. */
616 handle_builtin_alloca (gcall
*call
, gimple_stmt_iterator
*iter
)
618 if (!iter
|| !asan_sanitize_allocas_p ())
623 const HOST_WIDE_INT redzone_mask
= ASAN_RED_ZONE_SIZE
- 1;
625 tree last_alloca
= get_last_alloca_addr ();
626 tree callee
= gimple_call_fndecl (call
);
627 tree old_size
= gimple_call_arg (call
, 0);
628 tree ptr_type
= gimple_call_lhs (call
) ? TREE_TYPE (gimple_call_lhs (call
))
630 tree partial_size
= NULL_TREE
;
631 bool alloca_with_align
632 = DECL_FUNCTION_CODE (callee
) == BUILT_IN_ALLOCA_WITH_ALIGN
;
634 = alloca_with_align
? tree_to_uhwi (gimple_call_arg (call
, 1)) : 0;
636 /* If ALIGN > ASAN_RED_ZONE_SIZE, we embed left redzone into first ALIGN
637 bytes of allocated space. Otherwise, align alloca to ASAN_RED_ZONE_SIZE
639 align
= MAX (align
, ASAN_RED_ZONE_SIZE
* BITS_PER_UNIT
);
641 tree alloca_rz_mask
= build_int_cst (size_type_node
, redzone_mask
);
642 tree redzone_size
= build_int_cst (size_type_node
, ASAN_RED_ZONE_SIZE
);
644 /* Extract lower bits from old_size. */
645 wide_int size_nonzero_bits
= get_nonzero_bits (old_size
);
647 = wi::uhwi (redzone_mask
, wi::get_precision (size_nonzero_bits
));
648 wide_int old_size_lower_bits
= wi::bit_and (size_nonzero_bits
, rz_mask
);
650 /* If alloca size is aligned to ASAN_RED_ZONE_SIZE, we don't need partial
651 redzone. Otherwise, compute its size here. */
652 if (wi::ne_p (old_size_lower_bits
, 0))
654 /* misalign = size & (ASAN_RED_ZONE_SIZE - 1)
655 partial_size = ASAN_RED_ZONE_SIZE - misalign. */
656 g
= gimple_build_assign (make_ssa_name (size_type_node
, NULL
),
657 BIT_AND_EXPR
, old_size
, alloca_rz_mask
);
658 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
659 tree misalign
= gimple_assign_lhs (g
);
660 g
= gimple_build_assign (make_ssa_name (size_type_node
, NULL
), MINUS_EXPR
,
661 redzone_size
, misalign
);
662 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
663 partial_size
= gimple_assign_lhs (g
);
666 /* additional_size = align + ASAN_RED_ZONE_SIZE. */
667 tree additional_size
= build_int_cst (size_type_node
, align
/ BITS_PER_UNIT
668 + ASAN_RED_ZONE_SIZE
);
669 /* If alloca has partial redzone, include it to additional_size too. */
672 /* additional_size += partial_size. */
673 g
= gimple_build_assign (make_ssa_name (size_type_node
), PLUS_EXPR
,
674 partial_size
, additional_size
);
675 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
676 additional_size
= gimple_assign_lhs (g
);
679 /* new_size = old_size + additional_size. */
680 g
= gimple_build_assign (make_ssa_name (size_type_node
), PLUS_EXPR
, old_size
,
682 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
683 tree new_size
= gimple_assign_lhs (g
);
685 /* Build new __builtin_alloca call:
686 new_alloca_with_rz = __builtin_alloca (new_size, align). */
687 tree fn
= builtin_decl_implicit (BUILT_IN_ALLOCA_WITH_ALIGN
);
688 gg
= gimple_build_call (fn
, 2, new_size
,
689 build_int_cst (size_type_node
, align
));
690 tree new_alloca_with_rz
= make_ssa_name (ptr_type
, gg
);
691 gimple_call_set_lhs (gg
, new_alloca_with_rz
);
692 gsi_insert_before (iter
, gg
, GSI_SAME_STMT
);
694 /* new_alloca = new_alloca_with_rz + align. */
695 g
= gimple_build_assign (make_ssa_name (ptr_type
), POINTER_PLUS_EXPR
,
697 build_int_cst (size_type_node
,
698 align
/ BITS_PER_UNIT
));
699 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
700 tree new_alloca
= gimple_assign_lhs (g
);
702 /* Poison newly created alloca redzones:
703 __asan_alloca_poison (new_alloca, old_size). */
704 fn
= builtin_decl_implicit (BUILT_IN_ASAN_ALLOCA_POISON
);
705 gg
= gimple_build_call (fn
, 2, new_alloca
, old_size
);
706 gsi_insert_before (iter
, gg
, GSI_SAME_STMT
);
708 /* Save new_alloca_with_rz value into last_alloca to use it during
709 allocas unpoisoning. */
710 g
= gimple_build_assign (last_alloca
, new_alloca_with_rz
);
711 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
713 /* Finally, replace old alloca ptr with NEW_ALLOCA. */
714 replace_call_with_value (iter
, new_alloca
);
717 /* Return the memory references contained in a gimple statement
718 representing a builtin call that has to do with memory access. */
721 get_mem_refs_of_builtin_call (gcall
*call
,
733 gimple_stmt_iterator
*iter
= NULL
)
735 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
737 tree callee
= gimple_call_fndecl (call
);
738 tree source0
= NULL_TREE
, source1
= NULL_TREE
,
739 dest
= NULL_TREE
, len
= NULL_TREE
;
740 bool is_store
= true, got_reference_p
= false;
741 HOST_WIDE_INT access_size
= 1;
743 *intercepted_p
= asan_intercepted_p ((DECL_FUNCTION_CODE (callee
)));
745 switch (DECL_FUNCTION_CODE (callee
))
747 /* (s, s, n) style memops. */
749 case BUILT_IN_MEMCMP
:
750 source0
= gimple_call_arg (call
, 0);
751 source1
= gimple_call_arg (call
, 1);
752 len
= gimple_call_arg (call
, 2);
755 /* (src, dest, n) style memops. */
757 source0
= gimple_call_arg (call
, 0);
758 dest
= gimple_call_arg (call
, 1);
759 len
= gimple_call_arg (call
, 2);
762 /* (dest, src, n) style memops. */
763 case BUILT_IN_MEMCPY
:
764 case BUILT_IN_MEMCPY_CHK
:
765 case BUILT_IN_MEMMOVE
:
766 case BUILT_IN_MEMMOVE_CHK
:
767 case BUILT_IN_MEMPCPY
:
768 case BUILT_IN_MEMPCPY_CHK
:
769 dest
= gimple_call_arg (call
, 0);
770 source0
= gimple_call_arg (call
, 1);
771 len
= gimple_call_arg (call
, 2);
774 /* (dest, n) style memops. */
776 dest
= gimple_call_arg (call
, 0);
777 len
= gimple_call_arg (call
, 1);
780 /* (dest, x, n) style memops*/
781 case BUILT_IN_MEMSET
:
782 case BUILT_IN_MEMSET_CHK
:
783 dest
= gimple_call_arg (call
, 0);
784 len
= gimple_call_arg (call
, 2);
787 case BUILT_IN_STRLEN
:
788 source0
= gimple_call_arg (call
, 0);
789 len
= gimple_call_lhs (call
);
792 case BUILT_IN_STACK_RESTORE
:
793 handle_builtin_stack_restore (call
, iter
);
796 case BUILT_IN_ALLOCA_WITH_ALIGN
:
797 case BUILT_IN_ALLOCA
:
798 handle_builtin_alloca (call
, iter
);
800 /* And now the __atomic* and __sync builtins.
801 These are handled differently from the classical memory memory
802 access builtins above. */
804 case BUILT_IN_ATOMIC_LOAD_1
:
807 case BUILT_IN_SYNC_FETCH_AND_ADD_1
:
808 case BUILT_IN_SYNC_FETCH_AND_SUB_1
:
809 case BUILT_IN_SYNC_FETCH_AND_OR_1
:
810 case BUILT_IN_SYNC_FETCH_AND_AND_1
:
811 case BUILT_IN_SYNC_FETCH_AND_XOR_1
:
812 case BUILT_IN_SYNC_FETCH_AND_NAND_1
:
813 case BUILT_IN_SYNC_ADD_AND_FETCH_1
:
814 case BUILT_IN_SYNC_SUB_AND_FETCH_1
:
815 case BUILT_IN_SYNC_OR_AND_FETCH_1
:
816 case BUILT_IN_SYNC_AND_AND_FETCH_1
:
817 case BUILT_IN_SYNC_XOR_AND_FETCH_1
:
818 case BUILT_IN_SYNC_NAND_AND_FETCH_1
:
819 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1
:
820 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1
:
821 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1
:
822 case BUILT_IN_SYNC_LOCK_RELEASE_1
:
823 case BUILT_IN_ATOMIC_EXCHANGE_1
:
824 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1
:
825 case BUILT_IN_ATOMIC_STORE_1
:
826 case BUILT_IN_ATOMIC_ADD_FETCH_1
:
827 case BUILT_IN_ATOMIC_SUB_FETCH_1
:
828 case BUILT_IN_ATOMIC_AND_FETCH_1
:
829 case BUILT_IN_ATOMIC_NAND_FETCH_1
:
830 case BUILT_IN_ATOMIC_XOR_FETCH_1
:
831 case BUILT_IN_ATOMIC_OR_FETCH_1
:
832 case BUILT_IN_ATOMIC_FETCH_ADD_1
:
833 case BUILT_IN_ATOMIC_FETCH_SUB_1
:
834 case BUILT_IN_ATOMIC_FETCH_AND_1
:
835 case BUILT_IN_ATOMIC_FETCH_NAND_1
:
836 case BUILT_IN_ATOMIC_FETCH_XOR_1
:
837 case BUILT_IN_ATOMIC_FETCH_OR_1
:
841 case BUILT_IN_ATOMIC_LOAD_2
:
844 case BUILT_IN_SYNC_FETCH_AND_ADD_2
:
845 case BUILT_IN_SYNC_FETCH_AND_SUB_2
:
846 case BUILT_IN_SYNC_FETCH_AND_OR_2
:
847 case BUILT_IN_SYNC_FETCH_AND_AND_2
:
848 case BUILT_IN_SYNC_FETCH_AND_XOR_2
:
849 case BUILT_IN_SYNC_FETCH_AND_NAND_2
:
850 case BUILT_IN_SYNC_ADD_AND_FETCH_2
:
851 case BUILT_IN_SYNC_SUB_AND_FETCH_2
:
852 case BUILT_IN_SYNC_OR_AND_FETCH_2
:
853 case BUILT_IN_SYNC_AND_AND_FETCH_2
:
854 case BUILT_IN_SYNC_XOR_AND_FETCH_2
:
855 case BUILT_IN_SYNC_NAND_AND_FETCH_2
:
856 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2
:
857 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2
:
858 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2
:
859 case BUILT_IN_SYNC_LOCK_RELEASE_2
:
860 case BUILT_IN_ATOMIC_EXCHANGE_2
:
861 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2
:
862 case BUILT_IN_ATOMIC_STORE_2
:
863 case BUILT_IN_ATOMIC_ADD_FETCH_2
:
864 case BUILT_IN_ATOMIC_SUB_FETCH_2
:
865 case BUILT_IN_ATOMIC_AND_FETCH_2
:
866 case BUILT_IN_ATOMIC_NAND_FETCH_2
:
867 case BUILT_IN_ATOMIC_XOR_FETCH_2
:
868 case BUILT_IN_ATOMIC_OR_FETCH_2
:
869 case BUILT_IN_ATOMIC_FETCH_ADD_2
:
870 case BUILT_IN_ATOMIC_FETCH_SUB_2
:
871 case BUILT_IN_ATOMIC_FETCH_AND_2
:
872 case BUILT_IN_ATOMIC_FETCH_NAND_2
:
873 case BUILT_IN_ATOMIC_FETCH_XOR_2
:
874 case BUILT_IN_ATOMIC_FETCH_OR_2
:
878 case BUILT_IN_ATOMIC_LOAD_4
:
881 case BUILT_IN_SYNC_FETCH_AND_ADD_4
:
882 case BUILT_IN_SYNC_FETCH_AND_SUB_4
:
883 case BUILT_IN_SYNC_FETCH_AND_OR_4
:
884 case BUILT_IN_SYNC_FETCH_AND_AND_4
:
885 case BUILT_IN_SYNC_FETCH_AND_XOR_4
:
886 case BUILT_IN_SYNC_FETCH_AND_NAND_4
:
887 case BUILT_IN_SYNC_ADD_AND_FETCH_4
:
888 case BUILT_IN_SYNC_SUB_AND_FETCH_4
:
889 case BUILT_IN_SYNC_OR_AND_FETCH_4
:
890 case BUILT_IN_SYNC_AND_AND_FETCH_4
:
891 case BUILT_IN_SYNC_XOR_AND_FETCH_4
:
892 case BUILT_IN_SYNC_NAND_AND_FETCH_4
:
893 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4
:
894 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4
:
895 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4
:
896 case BUILT_IN_SYNC_LOCK_RELEASE_4
:
897 case BUILT_IN_ATOMIC_EXCHANGE_4
:
898 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4
:
899 case BUILT_IN_ATOMIC_STORE_4
:
900 case BUILT_IN_ATOMIC_ADD_FETCH_4
:
901 case BUILT_IN_ATOMIC_SUB_FETCH_4
:
902 case BUILT_IN_ATOMIC_AND_FETCH_4
:
903 case BUILT_IN_ATOMIC_NAND_FETCH_4
:
904 case BUILT_IN_ATOMIC_XOR_FETCH_4
:
905 case BUILT_IN_ATOMIC_OR_FETCH_4
:
906 case BUILT_IN_ATOMIC_FETCH_ADD_4
:
907 case BUILT_IN_ATOMIC_FETCH_SUB_4
:
908 case BUILT_IN_ATOMIC_FETCH_AND_4
:
909 case BUILT_IN_ATOMIC_FETCH_NAND_4
:
910 case BUILT_IN_ATOMIC_FETCH_XOR_4
:
911 case BUILT_IN_ATOMIC_FETCH_OR_4
:
915 case BUILT_IN_ATOMIC_LOAD_8
:
918 case BUILT_IN_SYNC_FETCH_AND_ADD_8
:
919 case BUILT_IN_SYNC_FETCH_AND_SUB_8
:
920 case BUILT_IN_SYNC_FETCH_AND_OR_8
:
921 case BUILT_IN_SYNC_FETCH_AND_AND_8
:
922 case BUILT_IN_SYNC_FETCH_AND_XOR_8
:
923 case BUILT_IN_SYNC_FETCH_AND_NAND_8
:
924 case BUILT_IN_SYNC_ADD_AND_FETCH_8
:
925 case BUILT_IN_SYNC_SUB_AND_FETCH_8
:
926 case BUILT_IN_SYNC_OR_AND_FETCH_8
:
927 case BUILT_IN_SYNC_AND_AND_FETCH_8
:
928 case BUILT_IN_SYNC_XOR_AND_FETCH_8
:
929 case BUILT_IN_SYNC_NAND_AND_FETCH_8
:
930 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8
:
931 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8
:
932 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8
:
933 case BUILT_IN_SYNC_LOCK_RELEASE_8
:
934 case BUILT_IN_ATOMIC_EXCHANGE_8
:
935 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8
:
936 case BUILT_IN_ATOMIC_STORE_8
:
937 case BUILT_IN_ATOMIC_ADD_FETCH_8
:
938 case BUILT_IN_ATOMIC_SUB_FETCH_8
:
939 case BUILT_IN_ATOMIC_AND_FETCH_8
:
940 case BUILT_IN_ATOMIC_NAND_FETCH_8
:
941 case BUILT_IN_ATOMIC_XOR_FETCH_8
:
942 case BUILT_IN_ATOMIC_OR_FETCH_8
:
943 case BUILT_IN_ATOMIC_FETCH_ADD_8
:
944 case BUILT_IN_ATOMIC_FETCH_SUB_8
:
945 case BUILT_IN_ATOMIC_FETCH_AND_8
:
946 case BUILT_IN_ATOMIC_FETCH_NAND_8
:
947 case BUILT_IN_ATOMIC_FETCH_XOR_8
:
948 case BUILT_IN_ATOMIC_FETCH_OR_8
:
952 case BUILT_IN_ATOMIC_LOAD_16
:
955 case BUILT_IN_SYNC_FETCH_AND_ADD_16
:
956 case BUILT_IN_SYNC_FETCH_AND_SUB_16
:
957 case BUILT_IN_SYNC_FETCH_AND_OR_16
:
958 case BUILT_IN_SYNC_FETCH_AND_AND_16
:
959 case BUILT_IN_SYNC_FETCH_AND_XOR_16
:
960 case BUILT_IN_SYNC_FETCH_AND_NAND_16
:
961 case BUILT_IN_SYNC_ADD_AND_FETCH_16
:
962 case BUILT_IN_SYNC_SUB_AND_FETCH_16
:
963 case BUILT_IN_SYNC_OR_AND_FETCH_16
:
964 case BUILT_IN_SYNC_AND_AND_FETCH_16
:
965 case BUILT_IN_SYNC_XOR_AND_FETCH_16
:
966 case BUILT_IN_SYNC_NAND_AND_FETCH_16
:
967 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16
:
968 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16
:
969 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16
:
970 case BUILT_IN_SYNC_LOCK_RELEASE_16
:
971 case BUILT_IN_ATOMIC_EXCHANGE_16
:
972 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16
:
973 case BUILT_IN_ATOMIC_STORE_16
:
974 case BUILT_IN_ATOMIC_ADD_FETCH_16
:
975 case BUILT_IN_ATOMIC_SUB_FETCH_16
:
976 case BUILT_IN_ATOMIC_AND_FETCH_16
:
977 case BUILT_IN_ATOMIC_NAND_FETCH_16
:
978 case BUILT_IN_ATOMIC_XOR_FETCH_16
:
979 case BUILT_IN_ATOMIC_OR_FETCH_16
:
980 case BUILT_IN_ATOMIC_FETCH_ADD_16
:
981 case BUILT_IN_ATOMIC_FETCH_SUB_16
:
982 case BUILT_IN_ATOMIC_FETCH_AND_16
:
983 case BUILT_IN_ATOMIC_FETCH_NAND_16
:
984 case BUILT_IN_ATOMIC_FETCH_XOR_16
:
985 case BUILT_IN_ATOMIC_FETCH_OR_16
:
990 dest
= gimple_call_arg (call
, 0);
991 /* DEST represents the address of a memory location.
992 instrument_derefs wants the memory location, so lets
993 dereference the address DEST before handing it to
994 instrument_derefs. */
995 tree type
= build_nonstandard_integer_type (access_size
997 dest
= build2 (MEM_REF
, type
, dest
,
998 build_int_cst (build_pointer_type (char_type_node
), 0));
1003 /* The other builtins memory access are not instrumented in this
1004 function because they either don't have any length parameter,
1005 or their length parameter is just a limit. */
1009 if (len
!= NULL_TREE
)
1011 if (source0
!= NULL_TREE
)
1013 src0
->start
= source0
;
1014 src0
->access_size
= access_size
;
1016 *src0_is_store
= false;
1019 if (source1
!= NULL_TREE
)
1021 src1
->start
= source1
;
1022 src1
->access_size
= access_size
;
1024 *src1_is_store
= false;
1027 if (dest
!= NULL_TREE
)
1030 dst
->access_size
= access_size
;
1032 *dst_is_store
= true;
1035 got_reference_p
= true;
1040 dst
->access_size
= access_size
;
1041 *dst_len
= NULL_TREE
;
1042 *dst_is_store
= is_store
;
1043 *dest_is_deref
= true;
1044 got_reference_p
= true;
1047 return got_reference_p
;
1050 /* Return true iff a given gimple statement has been instrumented.
1051 Note that the statement is "defined" by the memory references it
1055 has_stmt_been_instrumented_p (gimple
*stmt
)
1057 if (gimple_assign_single_p (stmt
))
1061 asan_mem_ref_init (&r
, NULL
, 1);
1063 if (get_mem_ref_of_assignment (as_a
<gassign
*> (stmt
), &r
,
1065 return has_mem_ref_been_instrumented (&r
);
1067 else if (gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
1069 asan_mem_ref src0
, src1
, dest
;
1070 asan_mem_ref_init (&src0
, NULL
, 1);
1071 asan_mem_ref_init (&src1
, NULL
, 1);
1072 asan_mem_ref_init (&dest
, NULL
, 1);
1074 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
1075 bool src0_is_store
= false, src1_is_store
= false,
1076 dest_is_store
= false, dest_is_deref
= false, intercepted_p
= true;
1077 if (get_mem_refs_of_builtin_call (as_a
<gcall
*> (stmt
),
1078 &src0
, &src0_len
, &src0_is_store
,
1079 &src1
, &src1_len
, &src1_is_store
,
1080 &dest
, &dest_len
, &dest_is_store
,
1081 &dest_is_deref
, &intercepted_p
))
1083 if (src0
.start
!= NULL_TREE
1084 && !has_mem_ref_been_instrumented (&src0
, src0_len
))
1087 if (src1
.start
!= NULL_TREE
1088 && !has_mem_ref_been_instrumented (&src1
, src1_len
))
1091 if (dest
.start
!= NULL_TREE
1092 && !has_mem_ref_been_instrumented (&dest
, dest_len
))
1098 else if (is_gimple_call (stmt
) && gimple_store_p (stmt
))
1101 asan_mem_ref_init (&r
, NULL
, 1);
1103 r
.start
= gimple_call_lhs (stmt
);
1104 r
.access_size
= int_size_in_bytes (TREE_TYPE (r
.start
));
1105 return has_mem_ref_been_instrumented (&r
);
1111 /* Insert a memory reference into the hash table. */
1114 update_mem_ref_hash_table (tree ref
, HOST_WIDE_INT access_size
)
1116 hash_table
<asan_mem_ref_hasher
> *ht
= get_mem_ref_hash_table ();
1119 asan_mem_ref_init (&r
, ref
, access_size
);
1121 asan_mem_ref
**slot
= ht
->find_slot (&r
, INSERT
);
1122 if (*slot
== NULL
|| (*slot
)->access_size
< access_size
)
1123 *slot
= asan_mem_ref_new (ref
, access_size
);
1126 /* Initialize shadow_ptr_types array. */
1129 asan_init_shadow_ptr_types (void)
1131 asan_shadow_set
= new_alias_set ();
1132 tree types
[3] = { signed_char_type_node
, short_integer_type_node
,
1133 integer_type_node
};
1135 for (unsigned i
= 0; i
< 3; i
++)
1137 shadow_ptr_types
[i
] = build_distinct_type_copy (types
[i
]);
1138 TYPE_ALIAS_SET (shadow_ptr_types
[i
]) = asan_shadow_set
;
1139 shadow_ptr_types
[i
] = build_pointer_type (shadow_ptr_types
[i
]);
1142 initialize_sanitizer_builtins ();
1145 /* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
1148 asan_pp_string (pretty_printer
*pp
)
1150 const char *buf
= pp_formatted_text (pp
);
1151 size_t len
= strlen (buf
);
1152 tree ret
= build_string (len
+ 1, buf
);
1154 = build_array_type (TREE_TYPE (shadow_ptr_types
[0]),
1155 build_index_type (size_int (len
)));
1156 TREE_READONLY (ret
) = 1;
1157 TREE_STATIC (ret
) = 1;
1158 return build1 (ADDR_EXPR
, shadow_ptr_types
[0], ret
);
1161 /* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
1164 asan_shadow_cst (unsigned char shadow_bytes
[4])
1167 unsigned HOST_WIDE_INT val
= 0;
1168 gcc_assert (WORDS_BIG_ENDIAN
== BYTES_BIG_ENDIAN
);
1169 for (i
= 0; i
< 4; i
++)
1170 val
|= (unsigned HOST_WIDE_INT
) shadow_bytes
[BYTES_BIG_ENDIAN
? 3 - i
: i
]
1171 << (BITS_PER_UNIT
* i
);
1172 return gen_int_mode (val
, SImode
);
1175 /* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
1179 asan_clear_shadow (rtx shadow_mem
, HOST_WIDE_INT len
)
1181 rtx_insn
*insn
, *insns
, *jump
;
1182 rtx_code_label
*top_label
;
1186 clear_storage (shadow_mem
, GEN_INT (len
), BLOCK_OP_NORMAL
);
1187 insns
= get_insns ();
1189 for (insn
= insns
; insn
; insn
= NEXT_INSN (insn
))
1192 if (insn
== NULL_RTX
)
1198 gcc_assert ((len
& 3) == 0);
1199 top_label
= gen_label_rtx ();
1200 addr
= copy_to_mode_reg (Pmode
, XEXP (shadow_mem
, 0));
1201 shadow_mem
= adjust_automodify_address (shadow_mem
, SImode
, addr
, 0);
1202 end
= force_reg (Pmode
, plus_constant (Pmode
, addr
, len
));
1203 emit_label (top_label
);
1205 emit_move_insn (shadow_mem
, const0_rtx
);
1206 tmp
= expand_simple_binop (Pmode
, PLUS
, addr
, gen_int_mode (4, Pmode
), addr
,
1207 true, OPTAB_LIB_WIDEN
);
1209 emit_move_insn (addr
, tmp
);
1210 emit_cmp_and_jump_insns (addr
, end
, LT
, NULL_RTX
, Pmode
, true, top_label
);
1211 jump
= get_last_insn ();
1212 gcc_assert (JUMP_P (jump
));
1213 add_reg_br_prob_note (jump
,
1214 profile_probability::guessed_always ()
1215 .apply_scale (80, 100));
1219 asan_function_start (void)
1221 section
*fnsec
= function_section (current_function_decl
);
1222 switch_to_section (fnsec
);
1223 ASM_OUTPUT_DEBUG_LABEL (asm_out_file
, "LASANPC",
1224 current_function_funcdef_no
);
1227 /* Return number of shadow bytes that are occupied by a local variable
1230 static unsigned HOST_WIDE_INT
1231 shadow_mem_size (unsigned HOST_WIDE_INT size
)
1233 return ROUND_UP (size
, ASAN_SHADOW_GRANULARITY
) / ASAN_SHADOW_GRANULARITY
;
1236 /* Insert code to protect stack vars. The prologue sequence should be emitted
1237 directly, epilogue sequence returned. BASE is the register holding the
1238 stack base, against which OFFSETS array offsets are relative to, OFFSETS
1239 array contains pairs of offsets in reverse order, always the end offset
1240 of some gap that needs protection followed by starting offset,
1241 and DECLS is an array of representative decls for each var partition.
1242 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
1243 elements long (OFFSETS include gap before the first variable as well
1244 as gaps after each stack variable). PBASE is, if non-NULL, some pseudo
1245 register which stack vars DECL_RTLs are based on. Either BASE should be
1246 assigned to PBASE, when not doing use after return protection, or
1247 corresponding address based on __asan_stack_malloc* return value. */
1250 asan_emit_stack_protection (rtx base
, rtx pbase
, unsigned int alignb
,
1251 HOST_WIDE_INT
*offsets
, tree
*decls
, int length
)
1253 rtx shadow_base
, shadow_mem
, ret
, mem
, orig_base
;
1254 rtx_code_label
*lab
;
1257 unsigned char shadow_bytes
[4];
1258 HOST_WIDE_INT base_offset
= offsets
[length
- 1];
1259 HOST_WIDE_INT base_align_bias
= 0, offset
, prev_offset
;
1260 HOST_WIDE_INT asan_frame_size
= offsets
[0] - base_offset
;
1261 HOST_WIDE_INT last_offset
, last_size
;
1263 unsigned char cur_shadow_byte
= ASAN_STACK_MAGIC_LEFT
;
1264 tree str_cst
, decl
, id
;
1265 int use_after_return_class
= -1;
1267 if (shadow_ptr_types
[0] == NULL_TREE
)
1268 asan_init_shadow_ptr_types ();
1270 /* First of all, prepare the description string. */
1271 pretty_printer asan_pp
;
1273 pp_decimal_int (&asan_pp
, length
/ 2 - 1);
1274 pp_space (&asan_pp
);
1275 for (l
= length
- 2; l
; l
-= 2)
1277 tree decl
= decls
[l
/ 2 - 1];
1278 pp_wide_integer (&asan_pp
, offsets
[l
] - base_offset
);
1279 pp_space (&asan_pp
);
1280 pp_wide_integer (&asan_pp
, offsets
[l
- 1] - offsets
[l
]);
1281 pp_space (&asan_pp
);
1282 if (DECL_P (decl
) && DECL_NAME (decl
))
1284 pp_decimal_int (&asan_pp
, IDENTIFIER_LENGTH (DECL_NAME (decl
)));
1285 pp_space (&asan_pp
);
1286 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
1289 pp_string (&asan_pp
, "9 <unknown>");
1290 pp_space (&asan_pp
);
1292 str_cst
= asan_pp_string (&asan_pp
);
1294 /* Emit the prologue sequence. */
1295 if (asan_frame_size
> 32 && asan_frame_size
<= 65536 && pbase
1296 && ASAN_USE_AFTER_RETURN
)
1298 use_after_return_class
= floor_log2 (asan_frame_size
- 1) - 5;
1299 /* __asan_stack_malloc_N guarantees alignment
1300 N < 6 ? (64 << N) : 4096 bytes. */
1301 if (alignb
> (use_after_return_class
< 6
1302 ? (64U << use_after_return_class
) : 4096U))
1303 use_after_return_class
= -1;
1304 else if (alignb
> ASAN_RED_ZONE_SIZE
&& (asan_frame_size
& (alignb
- 1)))
1305 base_align_bias
= ((asan_frame_size
+ alignb
- 1)
1306 & ~(alignb
- HOST_WIDE_INT_1
)) - asan_frame_size
;
1308 /* Align base if target is STRICT_ALIGNMENT. */
1309 if (STRICT_ALIGNMENT
)
1310 base
= expand_binop (Pmode
, and_optab
, base
,
1311 gen_int_mode (-((GET_MODE_ALIGNMENT (SImode
)
1312 << ASAN_SHADOW_SHIFT
)
1313 / BITS_PER_UNIT
), Pmode
), NULL_RTX
,
1316 if (use_after_return_class
== -1 && pbase
)
1317 emit_move_insn (pbase
, base
);
1319 base
= expand_binop (Pmode
, add_optab
, base
,
1320 gen_int_mode (base_offset
- base_align_bias
, Pmode
),
1321 NULL_RTX
, 1, OPTAB_DIRECT
);
1322 orig_base
= NULL_RTX
;
1323 if (use_after_return_class
!= -1)
1325 if (asan_detect_stack_use_after_return
== NULL_TREE
)
1327 id
= get_identifier ("__asan_option_detect_stack_use_after_return");
1328 decl
= build_decl (BUILTINS_LOCATION
, VAR_DECL
, id
,
1330 SET_DECL_ASSEMBLER_NAME (decl
, id
);
1331 TREE_ADDRESSABLE (decl
) = 1;
1332 DECL_ARTIFICIAL (decl
) = 1;
1333 DECL_IGNORED_P (decl
) = 1;
1334 DECL_EXTERNAL (decl
) = 1;
1335 TREE_STATIC (decl
) = 1;
1336 TREE_PUBLIC (decl
) = 1;
1337 TREE_USED (decl
) = 1;
1338 asan_detect_stack_use_after_return
= decl
;
1340 orig_base
= gen_reg_rtx (Pmode
);
1341 emit_move_insn (orig_base
, base
);
1342 ret
= expand_normal (asan_detect_stack_use_after_return
);
1343 lab
= gen_label_rtx ();
1344 emit_cmp_and_jump_insns (ret
, const0_rtx
, EQ
, NULL_RTX
,
1346 profile_probability::very_likely ());
1347 snprintf (buf
, sizeof buf
, "__asan_stack_malloc_%d",
1348 use_after_return_class
);
1349 ret
= init_one_libfunc (buf
);
1350 ret
= emit_library_call_value (ret
, NULL_RTX
, LCT_NORMAL
, ptr_mode
, 1,
1351 GEN_INT (asan_frame_size
1353 TYPE_MODE (pointer_sized_int_node
));
1354 /* __asan_stack_malloc_[n] returns a pointer to fake stack if succeeded
1355 and NULL otherwise. Check RET value is NULL here and jump over the
1356 BASE reassignment in this case. Otherwise, reassign BASE to RET. */
1357 emit_cmp_and_jump_insns (ret
, const0_rtx
, EQ
, NULL_RTX
,
1359 profile_probability:: very_unlikely ());
1360 ret
= convert_memory_address (Pmode
, ret
);
1361 emit_move_insn (base
, ret
);
1363 emit_move_insn (pbase
, expand_binop (Pmode
, add_optab
, base
,
1364 gen_int_mode (base_align_bias
1365 - base_offset
, Pmode
),
1366 NULL_RTX
, 1, OPTAB_DIRECT
));
1368 mem
= gen_rtx_MEM (ptr_mode
, base
);
1369 mem
= adjust_address (mem
, VOIDmode
, base_align_bias
);
1370 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_FRAME_MAGIC
, ptr_mode
));
1371 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1372 emit_move_insn (mem
, expand_normal (str_cst
));
1373 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1374 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASANPC", current_function_funcdef_no
);
1375 id
= get_identifier (buf
);
1376 decl
= build_decl (DECL_SOURCE_LOCATION (current_function_decl
),
1377 VAR_DECL
, id
, char_type_node
);
1378 SET_DECL_ASSEMBLER_NAME (decl
, id
);
1379 TREE_ADDRESSABLE (decl
) = 1;
1380 TREE_READONLY (decl
) = 1;
1381 DECL_ARTIFICIAL (decl
) = 1;
1382 DECL_IGNORED_P (decl
) = 1;
1383 TREE_STATIC (decl
) = 1;
1384 TREE_PUBLIC (decl
) = 0;
1385 TREE_USED (decl
) = 1;
1386 DECL_INITIAL (decl
) = decl
;
1387 TREE_ASM_WRITTEN (decl
) = 1;
1388 TREE_ASM_WRITTEN (id
) = 1;
1389 emit_move_insn (mem
, expand_normal (build_fold_addr_expr (decl
)));
1390 shadow_base
= expand_binop (Pmode
, lshr_optab
, base
,
1391 GEN_INT (ASAN_SHADOW_SHIFT
),
1392 NULL_RTX
, 1, OPTAB_DIRECT
);
1394 = plus_constant (Pmode
, shadow_base
,
1395 asan_shadow_offset ()
1396 + (base_align_bias
>> ASAN_SHADOW_SHIFT
));
1397 gcc_assert (asan_shadow_set
!= -1
1398 && (ASAN_RED_ZONE_SIZE
>> ASAN_SHADOW_SHIFT
) == 4);
1399 shadow_mem
= gen_rtx_MEM (SImode
, shadow_base
);
1400 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1401 if (STRICT_ALIGNMENT
)
1402 set_mem_align (shadow_mem
, (GET_MODE_ALIGNMENT (SImode
)));
1403 prev_offset
= base_offset
;
1404 for (l
= length
; l
; l
-= 2)
1407 cur_shadow_byte
= ASAN_STACK_MAGIC_RIGHT
;
1408 offset
= offsets
[l
- 1];
1409 if ((offset
- base_offset
) & (ASAN_RED_ZONE_SIZE
- 1))
1413 = base_offset
+ ((offset
- base_offset
)
1414 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1415 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1416 (aoff
- prev_offset
)
1417 >> ASAN_SHADOW_SHIFT
);
1419 for (i
= 0; i
< 4; i
++, aoff
+= ASAN_SHADOW_GRANULARITY
)
1422 if (aoff
< offset
- (HOST_WIDE_INT
)ASAN_SHADOW_GRANULARITY
+ 1)
1423 shadow_bytes
[i
] = 0;
1425 shadow_bytes
[i
] = offset
- aoff
;
1428 shadow_bytes
[i
] = ASAN_STACK_MAGIC_MIDDLE
;
1429 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1432 while (offset
<= offsets
[l
- 2] - ASAN_RED_ZONE_SIZE
)
1434 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1435 (offset
- prev_offset
)
1436 >> ASAN_SHADOW_SHIFT
);
1437 prev_offset
= offset
;
1438 memset (shadow_bytes
, cur_shadow_byte
, 4);
1439 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1440 offset
+= ASAN_RED_ZONE_SIZE
;
1442 cur_shadow_byte
= ASAN_STACK_MAGIC_MIDDLE
;
1444 do_pending_stack_adjust ();
1446 /* Construct epilogue sequence. */
1450 if (use_after_return_class
!= -1)
1452 rtx_code_label
*lab2
= gen_label_rtx ();
1453 char c
= (char) ASAN_STACK_MAGIC_USE_AFTER_RET
;
1454 emit_cmp_and_jump_insns (orig_base
, base
, EQ
, NULL_RTX
,
1456 profile_probability::very_likely ());
1457 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1458 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1459 mem
= gen_rtx_MEM (ptr_mode
, base
);
1460 mem
= adjust_address (mem
, VOIDmode
, base_align_bias
);
1461 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_RETIRED_MAGIC
, ptr_mode
));
1462 unsigned HOST_WIDE_INT sz
= asan_frame_size
>> ASAN_SHADOW_SHIFT
;
1463 if (use_after_return_class
< 5
1464 && can_store_by_pieces (sz
, builtin_memset_read_str
, &c
,
1465 BITS_PER_UNIT
, true))
1466 store_by_pieces (shadow_mem
, sz
, builtin_memset_read_str
, &c
,
1467 BITS_PER_UNIT
, true, 0);
1468 else if (use_after_return_class
>= 5
1469 || !set_storage_via_setmem (shadow_mem
,
1471 gen_int_mode (c
, QImode
),
1472 BITS_PER_UNIT
, BITS_PER_UNIT
,
1475 snprintf (buf
, sizeof buf
, "__asan_stack_free_%d",
1476 use_after_return_class
);
1477 ret
= init_one_libfunc (buf
);
1478 rtx addr
= convert_memory_address (ptr_mode
, base
);
1479 rtx orig_addr
= convert_memory_address (ptr_mode
, orig_base
);
1480 emit_library_call (ret
, LCT_NORMAL
, ptr_mode
, 3, addr
, ptr_mode
,
1481 GEN_INT (asan_frame_size
+ base_align_bias
),
1482 TYPE_MODE (pointer_sized_int_node
),
1483 orig_addr
, ptr_mode
);
1485 lab
= gen_label_rtx ();
1490 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1491 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1493 if (STRICT_ALIGNMENT
)
1494 set_mem_align (shadow_mem
, (GET_MODE_ALIGNMENT (SImode
)));
1496 prev_offset
= base_offset
;
1497 last_offset
= base_offset
;
1499 for (l
= length
; l
; l
-= 2)
1501 offset
= base_offset
+ ((offsets
[l
- 1] - base_offset
)
1502 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1503 if (last_offset
+ last_size
!= offset
)
1505 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1506 (last_offset
- prev_offset
)
1507 >> ASAN_SHADOW_SHIFT
);
1508 prev_offset
= last_offset
;
1509 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1510 last_offset
= offset
;
1513 last_size
+= base_offset
+ ((offsets
[l
- 2] - base_offset
)
1514 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
))
1517 /* Unpoison shadow memory that corresponds to a variable that is
1518 is subject of use-after-return sanitization. */
1521 decl
= decls
[l
/ 2 - 2];
1522 if (asan_handled_variables
!= NULL
1523 && asan_handled_variables
->contains (decl
))
1525 HOST_WIDE_INT size
= offsets
[l
- 3] - offsets
[l
- 2];
1526 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
1528 const char *n
= (DECL_NAME (decl
)
1529 ? IDENTIFIER_POINTER (DECL_NAME (decl
))
1531 fprintf (dump_file
, "Unpoisoning shadow stack for variable: "
1532 "%s (%" PRId64
" B)\n", n
, size
);
1535 last_size
+= size
& ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
);
1541 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1542 (last_offset
- prev_offset
)
1543 >> ASAN_SHADOW_SHIFT
);
1544 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1547 /* Clean-up set with instrumented stack variables. */
1548 delete asan_handled_variables
;
1549 asan_handled_variables
= NULL
;
1550 delete asan_used_labels
;
1551 asan_used_labels
= NULL
;
1553 do_pending_stack_adjust ();
1557 insns
= get_insns ();
1562 /* Emit __asan_allocas_unpoison (top, bot) call. The BASE parameter corresponds
1563 to BOT argument, for TOP virtual_stack_dynamic_rtx is used. NEW_SEQUENCE
1564 indicates whether we're emitting new instructions sequence or not. */
1567 asan_emit_allocas_unpoison (rtx top
, rtx bot
, rtx_insn
*before
)
1570 push_to_sequence (before
);
1573 rtx ret
= init_one_libfunc ("__asan_allocas_unpoison");
1574 top
= convert_memory_address (ptr_mode
, top
);
1575 bot
= convert_memory_address (ptr_mode
, bot
);
1576 ret
= emit_library_call_value (ret
, NULL_RTX
, LCT_NORMAL
, ptr_mode
, 2, top
,
1577 ptr_mode
, bot
, ptr_mode
);
1579 do_pending_stack_adjust ();
1580 rtx_insn
*insns
= get_insns ();
1585 /* Return true if DECL, a global var, might be overridden and needs
1586 therefore a local alias. */
1589 asan_needs_local_alias (tree decl
)
1591 return DECL_WEAK (decl
) || !targetm
.binds_local_p (decl
);
1594 /* Return true if DECL, a global var, is an artificial ODR indicator symbol
1595 therefore doesn't need protection. */
1598 is_odr_indicator (tree decl
)
1600 return (DECL_ARTIFICIAL (decl
)
1601 && lookup_attribute ("asan odr indicator", DECL_ATTRIBUTES (decl
)));
1604 /* Return true if DECL is a VAR_DECL that should be protected
1605 by Address Sanitizer, by appending a red zone with protected
1606 shadow memory after it and aligning it to at least
1607 ASAN_RED_ZONE_SIZE bytes. */
1610 asan_protect_global (tree decl
)
1617 if (TREE_CODE (decl
) == STRING_CST
)
1619 /* Instrument all STRING_CSTs except those created
1620 by asan_pp_string here. */
1621 if (shadow_ptr_types
[0] != NULL_TREE
1622 && TREE_CODE (TREE_TYPE (decl
)) == ARRAY_TYPE
1623 && TREE_TYPE (TREE_TYPE (decl
)) == TREE_TYPE (shadow_ptr_types
[0]))
1628 /* TLS vars aren't statically protectable. */
1629 || DECL_THREAD_LOCAL_P (decl
)
1630 /* Externs will be protected elsewhere. */
1631 || DECL_EXTERNAL (decl
)
1632 || !DECL_RTL_SET_P (decl
)
1633 /* Comdat vars pose an ABI problem, we can't know if
1634 the var that is selected by the linker will have
1636 || DECL_ONE_ONLY (decl
)
1637 /* Similarly for common vars. People can use -fno-common.
1638 Note: Linux kernel is built with -fno-common, so we do instrument
1639 globals there even if it is C. */
1640 || (DECL_COMMON (decl
) && TREE_PUBLIC (decl
))
1641 /* Don't protect if using user section, often vars placed
1642 into user section from multiple TUs are then assumed
1643 to be an array of such vars, putting padding in there
1644 breaks this assumption. */
1645 || (DECL_SECTION_NAME (decl
) != NULL
1646 && !symtab_node::get (decl
)->implicit_section
1647 && !section_sanitized_p (DECL_SECTION_NAME (decl
)))
1648 || DECL_SIZE (decl
) == 0
1649 || ASAN_RED_ZONE_SIZE
* BITS_PER_UNIT
> MAX_OFILE_ALIGNMENT
1650 || !valid_constant_size_p (DECL_SIZE_UNIT (decl
))
1651 || DECL_ALIGN_UNIT (decl
) > 2 * ASAN_RED_ZONE_SIZE
1652 || TREE_TYPE (decl
) == ubsan_get_source_location_type ()
1653 || is_odr_indicator (decl
))
1656 rtl
= DECL_RTL (decl
);
1657 if (!MEM_P (rtl
) || GET_CODE (XEXP (rtl
, 0)) != SYMBOL_REF
)
1659 symbol
= XEXP (rtl
, 0);
1661 if (CONSTANT_POOL_ADDRESS_P (symbol
)
1662 || TREE_CONSTANT_POOL_ADDRESS_P (symbol
))
1665 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl
)))
1668 #ifndef ASM_OUTPUT_DEF
1669 if (asan_needs_local_alias (decl
))
1676 /* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16,_n}.
1677 IS_STORE is either 1 (for a store) or 0 (for a load). */
1680 report_error_func (bool is_store
, bool recover_p
, HOST_WIDE_INT size_in_bytes
,
1683 static enum built_in_function report
[2][2][6]
1684 = { { { BUILT_IN_ASAN_REPORT_LOAD1
, BUILT_IN_ASAN_REPORT_LOAD2
,
1685 BUILT_IN_ASAN_REPORT_LOAD4
, BUILT_IN_ASAN_REPORT_LOAD8
,
1686 BUILT_IN_ASAN_REPORT_LOAD16
, BUILT_IN_ASAN_REPORT_LOAD_N
},
1687 { BUILT_IN_ASAN_REPORT_STORE1
, BUILT_IN_ASAN_REPORT_STORE2
,
1688 BUILT_IN_ASAN_REPORT_STORE4
, BUILT_IN_ASAN_REPORT_STORE8
,
1689 BUILT_IN_ASAN_REPORT_STORE16
, BUILT_IN_ASAN_REPORT_STORE_N
} },
1690 { { BUILT_IN_ASAN_REPORT_LOAD1_NOABORT
,
1691 BUILT_IN_ASAN_REPORT_LOAD2_NOABORT
,
1692 BUILT_IN_ASAN_REPORT_LOAD4_NOABORT
,
1693 BUILT_IN_ASAN_REPORT_LOAD8_NOABORT
,
1694 BUILT_IN_ASAN_REPORT_LOAD16_NOABORT
,
1695 BUILT_IN_ASAN_REPORT_LOAD_N_NOABORT
},
1696 { BUILT_IN_ASAN_REPORT_STORE1_NOABORT
,
1697 BUILT_IN_ASAN_REPORT_STORE2_NOABORT
,
1698 BUILT_IN_ASAN_REPORT_STORE4_NOABORT
,
1699 BUILT_IN_ASAN_REPORT_STORE8_NOABORT
,
1700 BUILT_IN_ASAN_REPORT_STORE16_NOABORT
,
1701 BUILT_IN_ASAN_REPORT_STORE_N_NOABORT
} } };
1702 if (size_in_bytes
== -1)
1705 return builtin_decl_implicit (report
[recover_p
][is_store
][5]);
1708 int size_log2
= exact_log2 (size_in_bytes
);
1709 return builtin_decl_implicit (report
[recover_p
][is_store
][size_log2
]);
1712 /* Construct a function tree for __asan_{load,store}{1,2,4,8,16,_n}.
1713 IS_STORE is either 1 (for a store) or 0 (for a load). */
1716 check_func (bool is_store
, bool recover_p
, HOST_WIDE_INT size_in_bytes
,
1719 static enum built_in_function check
[2][2][6]
1720 = { { { BUILT_IN_ASAN_LOAD1
, BUILT_IN_ASAN_LOAD2
,
1721 BUILT_IN_ASAN_LOAD4
, BUILT_IN_ASAN_LOAD8
,
1722 BUILT_IN_ASAN_LOAD16
, BUILT_IN_ASAN_LOADN
},
1723 { BUILT_IN_ASAN_STORE1
, BUILT_IN_ASAN_STORE2
,
1724 BUILT_IN_ASAN_STORE4
, BUILT_IN_ASAN_STORE8
,
1725 BUILT_IN_ASAN_STORE16
, BUILT_IN_ASAN_STOREN
} },
1726 { { BUILT_IN_ASAN_LOAD1_NOABORT
,
1727 BUILT_IN_ASAN_LOAD2_NOABORT
,
1728 BUILT_IN_ASAN_LOAD4_NOABORT
,
1729 BUILT_IN_ASAN_LOAD8_NOABORT
,
1730 BUILT_IN_ASAN_LOAD16_NOABORT
,
1731 BUILT_IN_ASAN_LOADN_NOABORT
},
1732 { BUILT_IN_ASAN_STORE1_NOABORT
,
1733 BUILT_IN_ASAN_STORE2_NOABORT
,
1734 BUILT_IN_ASAN_STORE4_NOABORT
,
1735 BUILT_IN_ASAN_STORE8_NOABORT
,
1736 BUILT_IN_ASAN_STORE16_NOABORT
,
1737 BUILT_IN_ASAN_STOREN_NOABORT
} } };
1738 if (size_in_bytes
== -1)
1741 return builtin_decl_implicit (check
[recover_p
][is_store
][5]);
1744 int size_log2
= exact_log2 (size_in_bytes
);
1745 return builtin_decl_implicit (check
[recover_p
][is_store
][size_log2
]);
1748 /* Split the current basic block and create a condition statement
1749 insertion point right before or after the statement pointed to by
1750 ITER. Return an iterator to the point at which the caller might
1751 safely insert the condition statement.
1753 THEN_BLOCK must be set to the address of an uninitialized instance
1754 of basic_block. The function will then set *THEN_BLOCK to the
1755 'then block' of the condition statement to be inserted by the
1758 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1759 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1761 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1762 block' of the condition statement to be inserted by the caller.
1764 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1765 statements starting from *ITER, and *THEN_BLOCK is a new empty
1768 *ITER is adjusted to point to always point to the first statement
1769 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1770 same as what ITER was pointing to prior to calling this function,
1771 if BEFORE_P is true; otherwise, it is its following statement. */
1773 gimple_stmt_iterator
1774 create_cond_insert_point (gimple_stmt_iterator
*iter
,
1776 bool then_more_likely_p
,
1777 bool create_then_fallthru_edge
,
1778 basic_block
*then_block
,
1779 basic_block
*fallthrough_block
)
1781 gimple_stmt_iterator gsi
= *iter
;
1783 if (!gsi_end_p (gsi
) && before_p
)
1786 basic_block cur_bb
= gsi_bb (*iter
);
1788 edge e
= split_block (cur_bb
, gsi_stmt (gsi
));
1790 /* Get a hold on the 'condition block', the 'then block' and the
1792 basic_block cond_bb
= e
->src
;
1793 basic_block fallthru_bb
= e
->dest
;
1794 basic_block then_bb
= create_empty_bb (cond_bb
);
1797 add_bb_to_loop (then_bb
, cond_bb
->loop_father
);
1798 loops_state_set (LOOPS_NEED_FIXUP
);
1801 /* Set up the newly created 'then block'. */
1802 e
= make_edge (cond_bb
, then_bb
, EDGE_TRUE_VALUE
);
1803 profile_probability fallthrough_probability
1804 = then_more_likely_p
1805 ? profile_probability::very_unlikely ()
1806 : profile_probability::very_likely ();
1807 e
->probability
= fallthrough_probability
.invert ();
1808 if (create_then_fallthru_edge
)
1809 make_single_succ_edge (then_bb
, fallthru_bb
, EDGE_FALLTHRU
);
1811 /* Set up the fallthrough basic block. */
1812 e
= find_edge (cond_bb
, fallthru_bb
);
1813 e
->flags
= EDGE_FALSE_VALUE
;
1814 e
->count
= cond_bb
->count
;
1815 e
->probability
= fallthrough_probability
;
1817 /* Update dominance info for the newly created then_bb; note that
1818 fallthru_bb's dominance info has already been updated by
1820 if (dom_info_available_p (CDI_DOMINATORS
))
1821 set_immediate_dominator (CDI_DOMINATORS
, then_bb
, cond_bb
);
1823 *then_block
= then_bb
;
1824 *fallthrough_block
= fallthru_bb
;
1825 *iter
= gsi_start_bb (fallthru_bb
);
1827 return gsi_last_bb (cond_bb
);
1830 /* Insert an if condition followed by a 'then block' right before the
1831 statement pointed to by ITER. The fallthrough block -- which is the
1832 else block of the condition as well as the destination of the
1833 outcoming edge of the 'then block' -- starts with the statement
1836 COND is the condition of the if.
1838 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1839 'then block' is higher than the probability of the edge to the
1842 Upon completion of the function, *THEN_BB is set to the newly
1843 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1846 *ITER is adjusted to still point to the same statement it was
1847 pointing to initially. */
1850 insert_if_then_before_iter (gcond
*cond
,
1851 gimple_stmt_iterator
*iter
,
1852 bool then_more_likely_p
,
1853 basic_block
*then_bb
,
1854 basic_block
*fallthrough_bb
)
1856 gimple_stmt_iterator cond_insert_point
=
1857 create_cond_insert_point (iter
,
1860 /*create_then_fallthru_edge=*/true,
1863 gsi_insert_after (&cond_insert_point
, cond
, GSI_NEW_STMT
);
1866 /* Build (base_addr >> ASAN_SHADOW_SHIFT) + asan_shadow_offset ().
1867 If RETURN_ADDRESS is set to true, return memory location instread
1868 of a value in the shadow memory. */
1871 build_shadow_mem_access (gimple_stmt_iterator
*gsi
, location_t location
,
1872 tree base_addr
, tree shadow_ptr_type
,
1873 bool return_address
= false)
1875 tree t
, uintptr_type
= TREE_TYPE (base_addr
);
1876 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
1879 t
= build_int_cst (uintptr_type
, ASAN_SHADOW_SHIFT
);
1880 g
= gimple_build_assign (make_ssa_name (uintptr_type
), RSHIFT_EXPR
,
1882 gimple_set_location (g
, location
);
1883 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1885 t
= build_int_cst (uintptr_type
, asan_shadow_offset ());
1886 g
= gimple_build_assign (make_ssa_name (uintptr_type
), PLUS_EXPR
,
1887 gimple_assign_lhs (g
), t
);
1888 gimple_set_location (g
, location
);
1889 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1891 g
= gimple_build_assign (make_ssa_name (shadow_ptr_type
), NOP_EXPR
,
1892 gimple_assign_lhs (g
));
1893 gimple_set_location (g
, location
);
1894 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1896 if (!return_address
)
1898 t
= build2 (MEM_REF
, shadow_type
, gimple_assign_lhs (g
),
1899 build_int_cst (shadow_ptr_type
, 0));
1900 g
= gimple_build_assign (make_ssa_name (shadow_type
), MEM_REF
, t
);
1901 gimple_set_location (g
, location
);
1902 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1905 return gimple_assign_lhs (g
);
1908 /* BASE can already be an SSA_NAME; in that case, do not create a
1909 new SSA_NAME for it. */
1912 maybe_create_ssa_name (location_t loc
, tree base
, gimple_stmt_iterator
*iter
,
1915 if (TREE_CODE (base
) == SSA_NAME
)
1917 gimple
*g
= gimple_build_assign (make_ssa_name (TREE_TYPE (base
)),
1918 TREE_CODE (base
), base
);
1919 gimple_set_location (g
, loc
);
1921 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1923 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
1924 return gimple_assign_lhs (g
);
1927 /* LEN can already have necessary size and precision;
1928 in that case, do not create a new variable. */
1931 maybe_cast_to_ptrmode (location_t loc
, tree len
, gimple_stmt_iterator
*iter
,
1934 if (ptrofftype_p (len
))
1936 gimple
*g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
1938 gimple_set_location (g
, loc
);
1940 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1942 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
1943 return gimple_assign_lhs (g
);
1946 /* Instrument the memory access instruction BASE. Insert new
1947 statements before or after ITER.
1949 Note that the memory access represented by BASE can be either an
1950 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1951 location. IS_STORE is TRUE for a store, FALSE for a load.
1952 BEFORE_P is TRUE for inserting the instrumentation code before
1953 ITER, FALSE for inserting it after ITER. IS_SCALAR_ACCESS is TRUE
1954 for a scalar memory access and FALSE for memory region access.
1955 NON_ZERO_P is TRUE if memory region is guaranteed to have non-zero
1956 length. ALIGN tells alignment of accessed memory object.
1958 START_INSTRUMENTED and END_INSTRUMENTED are TRUE if start/end of
1959 memory region have already been instrumented.
1961 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1962 statement it was pointing to prior to calling this function,
1963 otherwise, it points to the statement logically following it. */
1966 build_check_stmt (location_t loc
, tree base
, tree len
,
1967 HOST_WIDE_INT size_in_bytes
, gimple_stmt_iterator
*iter
,
1968 bool is_non_zero_len
, bool before_p
, bool is_store
,
1969 bool is_scalar_access
, unsigned int align
= 0)
1971 gimple_stmt_iterator gsi
= *iter
;
1974 gcc_assert (!(size_in_bytes
> 0 && !is_non_zero_len
));
1978 base
= unshare_expr (base
);
1979 base
= maybe_create_ssa_name (loc
, base
, &gsi
, before_p
);
1983 len
= unshare_expr (len
);
1984 len
= maybe_cast_to_ptrmode (loc
, len
, iter
, before_p
);
1988 gcc_assert (size_in_bytes
!= -1);
1989 len
= build_int_cst (pointer_sized_int_node
, size_in_bytes
);
1992 if (size_in_bytes
> 1)
1994 if ((size_in_bytes
& (size_in_bytes
- 1)) != 0
1995 || size_in_bytes
> 16)
1996 is_scalar_access
= false;
1997 else if (align
&& align
< size_in_bytes
* BITS_PER_UNIT
)
1999 /* On non-strict alignment targets, if
2000 16-byte access is just 8-byte aligned,
2001 this will result in misaligned shadow
2002 memory 2 byte load, but otherwise can
2003 be handled using one read. */
2004 if (size_in_bytes
!= 16
2006 || align
< 8 * BITS_PER_UNIT
)
2007 is_scalar_access
= false;
2011 HOST_WIDE_INT flags
= 0;
2013 flags
|= ASAN_CHECK_STORE
;
2014 if (is_non_zero_len
)
2015 flags
|= ASAN_CHECK_NON_ZERO_LEN
;
2016 if (is_scalar_access
)
2017 flags
|= ASAN_CHECK_SCALAR_ACCESS
;
2019 g
= gimple_build_call_internal (IFN_ASAN_CHECK
, 4,
2020 build_int_cst (integer_type_node
, flags
),
2022 build_int_cst (integer_type_node
,
2023 align
/ BITS_PER_UNIT
));
2024 gimple_set_location (g
, loc
);
2026 gsi_insert_before (&gsi
, g
, GSI_SAME_STMT
);
2029 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2035 /* If T represents a memory access, add instrumentation code before ITER.
2036 LOCATION is source code location.
2037 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
2040 instrument_derefs (gimple_stmt_iterator
*iter
, tree t
,
2041 location_t location
, bool is_store
)
2043 if (is_store
&& !ASAN_INSTRUMENT_WRITES
)
2045 if (!is_store
&& !ASAN_INSTRUMENT_READS
)
2049 HOST_WIDE_INT size_in_bytes
;
2050 if (location
== UNKNOWN_LOCATION
)
2051 location
= EXPR_LOCATION (t
);
2053 type
= TREE_TYPE (t
);
2054 switch (TREE_CODE (t
))
2068 size_in_bytes
= int_size_in_bytes (type
);
2069 if (size_in_bytes
<= 0)
2072 HOST_WIDE_INT bitsize
, bitpos
;
2075 int unsignedp
, reversep
, volatilep
= 0;
2076 tree inner
= get_inner_reference (t
, &bitsize
, &bitpos
, &offset
, &mode
,
2077 &unsignedp
, &reversep
, &volatilep
);
2079 if (TREE_CODE (t
) == COMPONENT_REF
2080 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1)) != NULL_TREE
)
2082 tree repr
= DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1));
2083 instrument_derefs (iter
, build3 (COMPONENT_REF
, TREE_TYPE (repr
),
2084 TREE_OPERAND (t
, 0), repr
,
2085 TREE_OPERAND (t
, 2)),
2086 location
, is_store
);
2090 if (bitpos
% BITS_PER_UNIT
2091 || bitsize
!= size_in_bytes
* BITS_PER_UNIT
)
2094 if (VAR_P (inner
) && DECL_HARD_REGISTER (inner
))
2098 && offset
== NULL_TREE
2100 && DECL_SIZE (inner
)
2101 && tree_fits_shwi_p (DECL_SIZE (inner
))
2102 && bitpos
+ bitsize
<= tree_to_shwi (DECL_SIZE (inner
)))
2104 if (DECL_THREAD_LOCAL_P (inner
))
2106 if (!ASAN_GLOBALS
&& is_global_var (inner
))
2108 if (!TREE_STATIC (inner
))
2110 /* Automatic vars in the current function will be always
2112 if (decl_function_context (inner
) == current_function_decl
2113 && (!asan_sanitize_use_after_scope ()
2114 || !TREE_ADDRESSABLE (inner
)))
2117 /* Always instrument external vars, they might be dynamically
2119 else if (!DECL_EXTERNAL (inner
))
2121 /* For static vars if they are known not to be dynamically
2122 initialized, they will be always accessible. */
2123 varpool_node
*vnode
= varpool_node::get (inner
);
2124 if (vnode
&& !vnode
->dynamically_initialized
)
2129 base
= build_fold_addr_expr (t
);
2130 if (!has_mem_ref_been_instrumented (base
, size_in_bytes
))
2132 unsigned int align
= get_object_alignment (t
);
2133 build_check_stmt (location
, base
, NULL_TREE
, size_in_bytes
, iter
,
2134 /*is_non_zero_len*/size_in_bytes
> 0, /*before_p=*/true,
2135 is_store
, /*is_scalar_access*/true, align
);
2136 update_mem_ref_hash_table (base
, size_in_bytes
);
2137 update_mem_ref_hash_table (t
, size_in_bytes
);
2142 /* Insert a memory reference into the hash table if access length
2143 can be determined in compile time. */
2146 maybe_update_mem_ref_hash_table (tree base
, tree len
)
2148 if (!POINTER_TYPE_P (TREE_TYPE (base
))
2149 || !INTEGRAL_TYPE_P (TREE_TYPE (len
)))
2152 HOST_WIDE_INT size_in_bytes
= tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
2154 if (size_in_bytes
!= -1)
2155 update_mem_ref_hash_table (base
, size_in_bytes
);
2158 /* Instrument an access to a contiguous memory region that starts at
2159 the address pointed to by BASE, over a length of LEN (expressed in
2160 the sizeof (*BASE) bytes). ITER points to the instruction before
2161 which the instrumentation instructions must be inserted. LOCATION
2162 is the source location that the instrumentation instructions must
2163 have. If IS_STORE is true, then the memory access is a store;
2164 otherwise, it's a load. */
2167 instrument_mem_region_access (tree base
, tree len
,
2168 gimple_stmt_iterator
*iter
,
2169 location_t location
, bool is_store
)
2171 if (!POINTER_TYPE_P (TREE_TYPE (base
))
2172 || !INTEGRAL_TYPE_P (TREE_TYPE (len
))
2173 || integer_zerop (len
))
2176 HOST_WIDE_INT size_in_bytes
= tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
2178 if ((size_in_bytes
== -1)
2179 || !has_mem_ref_been_instrumented (base
, size_in_bytes
))
2181 build_check_stmt (location
, base
, len
, size_in_bytes
, iter
,
2182 /*is_non_zero_len*/size_in_bytes
> 0, /*before_p*/true,
2183 is_store
, /*is_scalar_access*/false, /*align*/0);
2186 maybe_update_mem_ref_hash_table (base
, len
);
2187 *iter
= gsi_for_stmt (gsi_stmt (*iter
));
2190 /* Instrument the call to a built-in memory access function that is
2191 pointed to by the iterator ITER.
2193 Upon completion, return TRUE iff *ITER has been advanced to the
2194 statement following the one it was originally pointing to. */
2197 instrument_builtin_call (gimple_stmt_iterator
*iter
)
2199 if (!ASAN_MEMINTRIN
)
2202 bool iter_advanced_p
= false;
2203 gcall
*call
= as_a
<gcall
*> (gsi_stmt (*iter
));
2205 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
2207 location_t loc
= gimple_location (call
);
2209 asan_mem_ref src0
, src1
, dest
;
2210 asan_mem_ref_init (&src0
, NULL
, 1);
2211 asan_mem_ref_init (&src1
, NULL
, 1);
2212 asan_mem_ref_init (&dest
, NULL
, 1);
2214 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
2215 bool src0_is_store
= false, src1_is_store
= false, dest_is_store
= false,
2216 dest_is_deref
= false, intercepted_p
= true;
2218 if (get_mem_refs_of_builtin_call (call
,
2219 &src0
, &src0_len
, &src0_is_store
,
2220 &src1
, &src1_len
, &src1_is_store
,
2221 &dest
, &dest_len
, &dest_is_store
,
2222 &dest_is_deref
, &intercepted_p
, iter
))
2226 instrument_derefs (iter
, dest
.start
, loc
, dest_is_store
);
2228 iter_advanced_p
= true;
2230 else if (!intercepted_p
2231 && (src0_len
|| src1_len
|| dest_len
))
2233 if (src0
.start
!= NULL_TREE
)
2234 instrument_mem_region_access (src0
.start
, src0_len
,
2235 iter
, loc
, /*is_store=*/false);
2236 if (src1
.start
!= NULL_TREE
)
2237 instrument_mem_region_access (src1
.start
, src1_len
,
2238 iter
, loc
, /*is_store=*/false);
2239 if (dest
.start
!= NULL_TREE
)
2240 instrument_mem_region_access (dest
.start
, dest_len
,
2241 iter
, loc
, /*is_store=*/true);
2243 *iter
= gsi_for_stmt (call
);
2245 iter_advanced_p
= true;
2249 if (src0
.start
!= NULL_TREE
)
2250 maybe_update_mem_ref_hash_table (src0
.start
, src0_len
);
2251 if (src1
.start
!= NULL_TREE
)
2252 maybe_update_mem_ref_hash_table (src1
.start
, src1_len
);
2253 if (dest
.start
!= NULL_TREE
)
2254 maybe_update_mem_ref_hash_table (dest
.start
, dest_len
);
2257 return iter_advanced_p
;
2260 /* Instrument the assignment statement ITER if it is subject to
2261 instrumentation. Return TRUE iff instrumentation actually
2262 happened. In that case, the iterator ITER is advanced to the next
2263 logical expression following the one initially pointed to by ITER,
2264 and the relevant memory reference that which access has been
2265 instrumented is added to the memory references hash table. */
2268 maybe_instrument_assignment (gimple_stmt_iterator
*iter
)
2270 gimple
*s
= gsi_stmt (*iter
);
2272 gcc_assert (gimple_assign_single_p (s
));
2274 tree ref_expr
= NULL_TREE
;
2275 bool is_store
, is_instrumented
= false;
2277 if (gimple_store_p (s
))
2279 ref_expr
= gimple_assign_lhs (s
);
2281 instrument_derefs (iter
, ref_expr
,
2282 gimple_location (s
),
2284 is_instrumented
= true;
2287 if (gimple_assign_load_p (s
))
2289 ref_expr
= gimple_assign_rhs1 (s
);
2291 instrument_derefs (iter
, ref_expr
,
2292 gimple_location (s
),
2294 is_instrumented
= true;
2297 if (is_instrumented
)
2300 return is_instrumented
;
2303 /* Instrument the function call pointed to by the iterator ITER, if it
2304 is subject to instrumentation. At the moment, the only function
2305 calls that are instrumented are some built-in functions that access
2306 memory. Look at instrument_builtin_call to learn more.
2308 Upon completion return TRUE iff *ITER was advanced to the statement
2309 following the one it was originally pointing to. */
2312 maybe_instrument_call (gimple_stmt_iterator
*iter
)
2314 gimple
*stmt
= gsi_stmt (*iter
);
2315 bool is_builtin
= gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
);
2317 if (is_builtin
&& instrument_builtin_call (iter
))
2320 if (gimple_call_noreturn_p (stmt
))
2324 tree callee
= gimple_call_fndecl (stmt
);
2325 switch (DECL_FUNCTION_CODE (callee
))
2327 case BUILT_IN_UNREACHABLE
:
2329 /* Don't instrument these. */
2335 tree decl
= builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN
);
2336 gimple
*g
= gimple_build_call (decl
, 0);
2337 gimple_set_location (g
, gimple_location (stmt
));
2338 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2341 bool instrumented
= false;
2342 if (gimple_store_p (stmt
))
2344 tree ref_expr
= gimple_call_lhs (stmt
);
2345 instrument_derefs (iter
, ref_expr
,
2346 gimple_location (stmt
),
2349 instrumented
= true;
2352 /* Walk through gimple_call arguments and check them id needed. */
2353 unsigned args_num
= gimple_call_num_args (stmt
);
2354 for (unsigned i
= 0; i
< args_num
; ++i
)
2356 tree arg
= gimple_call_arg (stmt
, i
);
2357 /* If ARG is not a non-aggregate register variable, compiler in general
2358 creates temporary for it and pass it as argument to gimple call.
2359 But in some cases, e.g. when we pass by value a small structure that
2360 fits to register, compiler can avoid extra overhead by pulling out
2361 these temporaries. In this case, we should check the argument. */
2362 if (!is_gimple_reg (arg
) && !is_gimple_min_invariant (arg
))
2364 instrument_derefs (iter
, arg
,
2365 gimple_location (stmt
),
2366 /*is_store=*/false);
2367 instrumented
= true;
2372 return instrumented
;
2375 /* Walk each instruction of all basic block and instrument those that
2376 represent memory references: loads, stores, or function calls.
2377 In a given basic block, this function avoids instrumenting memory
2378 references that have already been instrumented. */
2381 transform_statements (void)
2383 basic_block bb
, last_bb
= NULL
;
2384 gimple_stmt_iterator i
;
2385 int saved_last_basic_block
= last_basic_block_for_fn (cfun
);
2387 FOR_EACH_BB_FN (bb
, cfun
)
2389 basic_block prev_bb
= bb
;
2391 if (bb
->index
>= saved_last_basic_block
) continue;
2393 /* Flush the mem ref hash table, if current bb doesn't have
2394 exactly one predecessor, or if that predecessor (skipping
2395 over asan created basic blocks) isn't the last processed
2396 basic block. Thus we effectively flush on extended basic
2397 block boundaries. */
2398 while (single_pred_p (prev_bb
))
2400 prev_bb
= single_pred (prev_bb
);
2401 if (prev_bb
->index
< saved_last_basic_block
)
2404 if (prev_bb
!= last_bb
)
2405 empty_mem_ref_hash_table ();
2408 for (i
= gsi_start_bb (bb
); !gsi_end_p (i
);)
2410 gimple
*s
= gsi_stmt (i
);
2412 if (has_stmt_been_instrumented_p (s
))
2414 else if (gimple_assign_single_p (s
)
2415 && !gimple_clobber_p (s
)
2416 && maybe_instrument_assignment (&i
))
2417 /* Nothing to do as maybe_instrument_assignment advanced
2419 else if (is_gimple_call (s
) && maybe_instrument_call (&i
))
2420 /* Nothing to do as maybe_instrument_call
2421 advanced the iterator I. */;
2424 /* No instrumentation happened.
2426 If the current instruction is a function call that
2427 might free something, let's forget about the memory
2428 references that got instrumented. Otherwise we might
2429 miss some instrumentation opportunities. Do the same
2430 for a ASAN_MARK poisoning internal function. */
2431 if (is_gimple_call (s
)
2432 && (!nonfreeing_call_p (s
)
2433 || asan_mark_p (s
, ASAN_MARK_POISON
)))
2434 empty_mem_ref_hash_table ();
2440 free_mem_ref_resources ();
2444 __asan_before_dynamic_init (module_name)
2446 __asan_after_dynamic_init ()
2450 asan_dynamic_init_call (bool after_p
)
2452 if (shadow_ptr_types
[0] == NULL_TREE
)
2453 asan_init_shadow_ptr_types ();
2455 tree fn
= builtin_decl_implicit (after_p
2456 ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
2457 : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT
);
2458 tree module_name_cst
= NULL_TREE
;
2461 pretty_printer module_name_pp
;
2462 pp_string (&module_name_pp
, main_input_filename
);
2464 module_name_cst
= asan_pp_string (&module_name_pp
);
2465 module_name_cst
= fold_convert (const_ptr_type_node
,
2469 return build_call_expr (fn
, after_p
? 0 : 1, module_name_cst
);
2473 struct __asan_global
2477 uptr __size_with_redzone;
2479 const void *__module_name;
2480 uptr __has_dynamic_init;
2481 __asan_global_source_location *__location;
2482 char *__odr_indicator;
2486 asan_global_struct (void)
2488 static const char *field_names
[]
2489 = { "__beg", "__size", "__size_with_redzone",
2490 "__name", "__module_name", "__has_dynamic_init", "__location",
2491 "__odr_indicator" };
2492 tree fields
[ARRAY_SIZE (field_names
)], ret
;
2495 ret
= make_node (RECORD_TYPE
);
2496 for (i
= 0; i
< ARRAY_SIZE (field_names
); i
++)
2499 = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
,
2500 get_identifier (field_names
[i
]),
2501 (i
== 0 || i
== 3) ? const_ptr_type_node
2502 : pointer_sized_int_node
);
2503 DECL_CONTEXT (fields
[i
]) = ret
;
2505 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
2507 tree type_decl
= build_decl (input_location
, TYPE_DECL
,
2508 get_identifier ("__asan_global"), ret
);
2509 DECL_IGNORED_P (type_decl
) = 1;
2510 DECL_ARTIFICIAL (type_decl
) = 1;
2511 TYPE_FIELDS (ret
) = fields
[0];
2512 TYPE_NAME (ret
) = type_decl
;
2513 TYPE_STUB_DECL (ret
) = type_decl
;
2518 /* Create and return odr indicator symbol for DECL.
2519 TYPE is __asan_global struct type as returned by asan_global_struct. */
2522 create_odr_indicator (tree decl
, tree type
)
2525 tree uptr
= TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type
)));
2527 = (HAS_DECL_ASSEMBLER_NAME_P (decl
) ? DECL_ASSEMBLER_NAME (decl
)
2528 : DECL_NAME (decl
));
2529 /* DECL_NAME theoretically might be NULL. Bail out with 0 in this case. */
2530 if (decl_name
== NULL_TREE
)
2531 return build_int_cst (uptr
, 0);
2532 size_t len
= strlen (IDENTIFIER_POINTER (decl_name
)) + sizeof ("__odr_asan_");
2533 name
= XALLOCAVEC (char, len
);
2534 snprintf (name
, len
, "__odr_asan_%s", IDENTIFIER_POINTER (decl_name
));
2535 #ifndef NO_DOT_IN_LABEL
2536 name
[sizeof ("__odr_asan") - 1] = '.';
2537 #elif !defined(NO_DOLLAR_IN_LABEL)
2538 name
[sizeof ("__odr_asan") - 1] = '$';
2540 tree var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (name
),
2542 TREE_ADDRESSABLE (var
) = 1;
2543 TREE_READONLY (var
) = 0;
2544 TREE_THIS_VOLATILE (var
) = 1;
2545 DECL_GIMPLE_REG_P (var
) = 0;
2546 DECL_ARTIFICIAL (var
) = 1;
2547 DECL_IGNORED_P (var
) = 1;
2548 TREE_STATIC (var
) = 1;
2549 TREE_PUBLIC (var
) = 1;
2550 DECL_VISIBILITY (var
) = DECL_VISIBILITY (decl
);
2551 DECL_VISIBILITY_SPECIFIED (var
) = DECL_VISIBILITY_SPECIFIED (decl
);
2553 TREE_USED (var
) = 1;
2554 tree ctor
= build_constructor_va (TREE_TYPE (var
), 1, NULL_TREE
,
2555 build_int_cst (unsigned_type_node
, 0));
2556 TREE_CONSTANT (ctor
) = 1;
2557 TREE_STATIC (ctor
) = 1;
2558 DECL_INITIAL (var
) = ctor
;
2559 DECL_ATTRIBUTES (var
) = tree_cons (get_identifier ("asan odr indicator"),
2560 NULL
, DECL_ATTRIBUTES (var
));
2561 make_decl_rtl (var
);
2562 varpool_node::finalize_decl (var
);
2563 return fold_convert (uptr
, build_fold_addr_expr (var
));
2566 /* Return true if DECL, a global var, might be overridden and needs
2567 an additional odr indicator symbol. */
2570 asan_needs_odr_indicator_p (tree decl
)
2572 /* Don't emit ODR indicators for kernel because:
2573 a) Kernel is written in C thus doesn't need ODR indicators.
2574 b) Some kernel code may have assumptions about symbols containing specific
2575 patterns in their names. Since ODR indicators contain original names
2576 of symbols they are emitted for, these assumptions would be broken for
2577 ODR indicator symbols. */
2578 return (!(flag_sanitize
& SANITIZE_KERNEL_ADDRESS
)
2579 && !DECL_ARTIFICIAL (decl
)
2580 && !DECL_WEAK (decl
)
2581 && TREE_PUBLIC (decl
));
2584 /* Append description of a single global DECL into vector V.
2585 TYPE is __asan_global struct type as returned by asan_global_struct. */
2588 asan_add_global (tree decl
, tree type
, vec
<constructor_elt
, va_gc
> *v
)
2590 tree init
, uptr
= TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type
)));
2591 unsigned HOST_WIDE_INT size
;
2592 tree str_cst
, module_name_cst
, refdecl
= decl
;
2593 vec
<constructor_elt
, va_gc
> *vinner
= NULL
;
2595 pretty_printer asan_pp
, module_name_pp
;
2597 if (DECL_NAME (decl
))
2598 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
2600 pp_string (&asan_pp
, "<unknown>");
2601 str_cst
= asan_pp_string (&asan_pp
);
2603 pp_string (&module_name_pp
, main_input_filename
);
2604 module_name_cst
= asan_pp_string (&module_name_pp
);
2606 if (asan_needs_local_alias (decl
))
2609 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", vec_safe_length (v
) + 1);
2610 refdecl
= build_decl (DECL_SOURCE_LOCATION (decl
),
2611 VAR_DECL
, get_identifier (buf
), TREE_TYPE (decl
));
2612 TREE_ADDRESSABLE (refdecl
) = TREE_ADDRESSABLE (decl
);
2613 TREE_READONLY (refdecl
) = TREE_READONLY (decl
);
2614 TREE_THIS_VOLATILE (refdecl
) = TREE_THIS_VOLATILE (decl
);
2615 DECL_GIMPLE_REG_P (refdecl
) = DECL_GIMPLE_REG_P (decl
);
2616 DECL_ARTIFICIAL (refdecl
) = DECL_ARTIFICIAL (decl
);
2617 DECL_IGNORED_P (refdecl
) = DECL_IGNORED_P (decl
);
2618 TREE_STATIC (refdecl
) = 1;
2619 TREE_PUBLIC (refdecl
) = 0;
2620 TREE_USED (refdecl
) = 1;
2621 assemble_alias (refdecl
, DECL_ASSEMBLER_NAME (decl
));
2624 tree odr_indicator_ptr
2625 = (asan_needs_odr_indicator_p (decl
) ? create_odr_indicator (decl
, type
)
2626 : build_int_cst (uptr
, 0));
2627 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2628 fold_convert (const_ptr_type_node
,
2629 build_fold_addr_expr (refdecl
)));
2630 size
= tree_to_uhwi (DECL_SIZE_UNIT (decl
));
2631 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2632 size
+= asan_red_zone_size (size
);
2633 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2634 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2635 fold_convert (const_ptr_type_node
, str_cst
));
2636 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2637 fold_convert (const_ptr_type_node
, module_name_cst
));
2638 varpool_node
*vnode
= varpool_node::get (decl
);
2639 int has_dynamic_init
= 0;
2640 /* FIXME: Enable initialization order fiasco detection in LTO mode once
2641 proper fix for PR 79061 will be applied. */
2643 has_dynamic_init
= vnode
? vnode
->dynamically_initialized
: 0;
2644 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2645 build_int_cst (uptr
, has_dynamic_init
));
2646 tree locptr
= NULL_TREE
;
2647 location_t loc
= DECL_SOURCE_LOCATION (decl
);
2648 expanded_location xloc
= expand_location (loc
);
2649 if (xloc
.file
!= NULL
)
2651 static int lasanloccnt
= 0;
2653 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASANLOC", ++lasanloccnt
);
2654 tree var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (buf
),
2655 ubsan_get_source_location_type ());
2656 TREE_STATIC (var
) = 1;
2657 TREE_PUBLIC (var
) = 0;
2658 DECL_ARTIFICIAL (var
) = 1;
2659 DECL_IGNORED_P (var
) = 1;
2660 pretty_printer filename_pp
;
2661 pp_string (&filename_pp
, xloc
.file
);
2662 tree str
= asan_pp_string (&filename_pp
);
2663 tree ctor
= build_constructor_va (TREE_TYPE (var
), 3,
2664 NULL_TREE
, str
, NULL_TREE
,
2665 build_int_cst (unsigned_type_node
,
2666 xloc
.line
), NULL_TREE
,
2667 build_int_cst (unsigned_type_node
,
2669 TREE_CONSTANT (ctor
) = 1;
2670 TREE_STATIC (ctor
) = 1;
2671 DECL_INITIAL (var
) = ctor
;
2672 varpool_node::finalize_decl (var
);
2673 locptr
= fold_convert (uptr
, build_fold_addr_expr (var
));
2676 locptr
= build_int_cst (uptr
, 0);
2677 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, locptr
);
2678 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, odr_indicator_ptr
);
2679 init
= build_constructor (type
, vinner
);
2680 CONSTRUCTOR_APPEND_ELT (v
, NULL_TREE
, init
);
2683 /* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2685 initialize_sanitizer_builtins (void)
2689 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT
))
2692 tree BT_FN_VOID
= build_function_type_list (void_type_node
, NULL_TREE
);
2694 = build_function_type_list (void_type_node
, ptr_type_node
, NULL_TREE
);
2695 tree BT_FN_VOID_CONST_PTR
2696 = build_function_type_list (void_type_node
, const_ptr_type_node
, NULL_TREE
);
2697 tree BT_FN_VOID_PTR_PTR
2698 = build_function_type_list (void_type_node
, ptr_type_node
,
2699 ptr_type_node
, NULL_TREE
);
2700 tree BT_FN_VOID_PTR_PTR_PTR
2701 = build_function_type_list (void_type_node
, ptr_type_node
,
2702 ptr_type_node
, ptr_type_node
, NULL_TREE
);
2703 tree BT_FN_VOID_PTR_PTRMODE
2704 = build_function_type_list (void_type_node
, ptr_type_node
,
2705 pointer_sized_int_node
, NULL_TREE
);
2707 = build_function_type_list (void_type_node
, integer_type_node
, NULL_TREE
);
2708 tree BT_FN_SIZE_CONST_PTR_INT
2709 = build_function_type_list (size_type_node
, const_ptr_type_node
,
2710 integer_type_node
, NULL_TREE
);
2711 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[5];
2712 tree BT_FN_IX_CONST_VPTR_INT
[5];
2713 tree BT_FN_IX_VPTR_IX_INT
[5];
2714 tree BT_FN_VOID_VPTR_IX_INT
[5];
2716 = build_pointer_type (build_qualified_type (void_type_node
,
2717 TYPE_QUAL_VOLATILE
));
2719 = build_pointer_type (build_qualified_type (void_type_node
,
2723 = lang_hooks
.types
.type_for_size (BOOL_TYPE_SIZE
, 1);
2725 for (i
= 0; i
< 5; i
++)
2727 tree ix
= build_nonstandard_integer_type (BITS_PER_UNIT
* (1 << i
), 1);
2728 BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[i
]
2729 = build_function_type_list (boolt
, vptr
, ptr_type_node
, ix
,
2730 integer_type_node
, integer_type_node
,
2732 BT_FN_IX_CONST_VPTR_INT
[i
]
2733 = build_function_type_list (ix
, cvptr
, integer_type_node
, NULL_TREE
);
2734 BT_FN_IX_VPTR_IX_INT
[i
]
2735 = build_function_type_list (ix
, vptr
, ix
, integer_type_node
,
2737 BT_FN_VOID_VPTR_IX_INT
[i
]
2738 = build_function_type_list (void_type_node
, vptr
, ix
,
2739 integer_type_node
, NULL_TREE
);
2741 #define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2742 #define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2743 #define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2744 #define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2745 #define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2746 #define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2747 #define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2748 #define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2749 #define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2750 #define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2751 #define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2752 #define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2753 #define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2754 #define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2755 #define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2756 #define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2757 #define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2758 #define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2759 #define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2760 #define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2761 #undef ATTR_NOTHROW_LEAF_LIST
2762 #define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2763 #undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2764 #define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2765 #undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2766 #define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2767 #undef ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2768 #define ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST \
2769 ECF_CONST | ATTR_NORETURN_NOTHROW_LEAF_LIST
2770 #undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2771 #define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2772 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2773 #undef ATTR_COLD_NOTHROW_LEAF_LIST
2774 #define ATTR_COLD_NOTHROW_LEAF_LIST \
2775 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2776 #undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2777 #define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2778 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2779 #undef ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST
2780 #define ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST \
2781 /* ECF_COLD missing */ ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2782 #undef ATTR_PURE_NOTHROW_LEAF_LIST
2783 #define ATTR_PURE_NOTHROW_LEAF_LIST ECF_PURE | ATTR_NOTHROW_LEAF_LIST
2784 #undef DEF_BUILTIN_STUB
2785 #define DEF_BUILTIN_STUB(ENUM, NAME)
2786 #undef DEF_SANITIZER_BUILTIN
2787 #define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2789 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2790 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2791 set_call_expr_flags (decl, ATTRS); \
2792 set_builtin_decl (ENUM, decl, true); \
2795 #include "sanitizer.def"
2797 /* -fsanitize=object-size uses __builtin_object_size, but that might
2798 not be available for e.g. Fortran at this point. We use
2799 DEF_SANITIZER_BUILTIN here only as a convenience macro. */
2800 if ((flag_sanitize
& SANITIZE_OBJECT_SIZE
)
2801 && !builtin_decl_implicit_p (BUILT_IN_OBJECT_SIZE
))
2802 DEF_SANITIZER_BUILTIN (BUILT_IN_OBJECT_SIZE
, "object_size",
2803 BT_FN_SIZE_CONST_PTR_INT
,
2804 ATTR_PURE_NOTHROW_LEAF_LIST
)
2806 #undef DEF_SANITIZER_BUILTIN
2807 #undef DEF_BUILTIN_STUB
2810 /* Called via htab_traverse. Count number of emitted
2811 STRING_CSTs in the constant hash table. */
2814 count_string_csts (constant_descriptor_tree
**slot
,
2815 unsigned HOST_WIDE_INT
*data
)
2817 struct constant_descriptor_tree
*desc
= *slot
;
2818 if (TREE_CODE (desc
->value
) == STRING_CST
2819 && TREE_ASM_WRITTEN (desc
->value
)
2820 && asan_protect_global (desc
->value
))
2825 /* Helper structure to pass two parameters to
2828 struct asan_add_string_csts_data
2831 vec
<constructor_elt
, va_gc
> *v
;
2834 /* Called via hash_table::traverse. Call asan_add_global
2835 on emitted STRING_CSTs from the constant hash table. */
2838 add_string_csts (constant_descriptor_tree
**slot
,
2839 asan_add_string_csts_data
*aascd
)
2841 struct constant_descriptor_tree
*desc
= *slot
;
2842 if (TREE_CODE (desc
->value
) == STRING_CST
2843 && TREE_ASM_WRITTEN (desc
->value
)
2844 && asan_protect_global (desc
->value
))
2846 asan_add_global (SYMBOL_REF_DECL (XEXP (desc
->rtl
, 0)),
2847 aascd
->type
, aascd
->v
);
2852 /* Needs to be GTY(()), because cgraph_build_static_cdtor may
2853 invoke ggc_collect. */
2854 static GTY(()) tree asan_ctor_statements
;
2856 /* Module-level instrumentation.
2857 - Insert __asan_init_vN() into the list of CTORs.
2858 - TODO: insert redzones around globals.
2862 asan_finish_file (void)
2864 varpool_node
*vnode
;
2865 unsigned HOST_WIDE_INT gcount
= 0;
2867 if (shadow_ptr_types
[0] == NULL_TREE
)
2868 asan_init_shadow_ptr_types ();
2869 /* Avoid instrumenting code in the asan ctors/dtors.
2870 We don't need to insert padding after the description strings,
2871 nor after .LASAN* array. */
2872 flag_sanitize
&= ~SANITIZE_ADDRESS
;
2874 /* For user-space we want asan constructors to run first.
2875 Linux kernel does not support priorities other than default, and the only
2876 other user of constructors is coverage. So we run with the default
2878 int priority
= flag_sanitize
& SANITIZE_USER_ADDRESS
2879 ? MAX_RESERVED_INIT_PRIORITY
- 1 : DEFAULT_INIT_PRIORITY
;
2881 if (flag_sanitize
& SANITIZE_USER_ADDRESS
)
2883 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_INIT
);
2884 append_to_statement_list (build_call_expr (fn
, 0), &asan_ctor_statements
);
2885 fn
= builtin_decl_implicit (BUILT_IN_ASAN_VERSION_MISMATCH_CHECK
);
2886 append_to_statement_list (build_call_expr (fn
, 0), &asan_ctor_statements
);
2888 FOR_EACH_DEFINED_VARIABLE (vnode
)
2889 if (TREE_ASM_WRITTEN (vnode
->decl
)
2890 && asan_protect_global (vnode
->decl
))
2892 hash_table
<tree_descriptor_hasher
> *const_desc_htab
= constant_pool_htab ();
2893 const_desc_htab
->traverse
<unsigned HOST_WIDE_INT
*, count_string_csts
>
2897 tree type
= asan_global_struct (), var
, ctor
;
2898 tree dtor_statements
= NULL_TREE
;
2899 vec
<constructor_elt
, va_gc
> *v
;
2902 type
= build_array_type_nelts (type
, gcount
);
2903 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", 0);
2904 var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (buf
),
2906 TREE_STATIC (var
) = 1;
2907 TREE_PUBLIC (var
) = 0;
2908 DECL_ARTIFICIAL (var
) = 1;
2909 DECL_IGNORED_P (var
) = 1;
2910 vec_alloc (v
, gcount
);
2911 FOR_EACH_DEFINED_VARIABLE (vnode
)
2912 if (TREE_ASM_WRITTEN (vnode
->decl
)
2913 && asan_protect_global (vnode
->decl
))
2914 asan_add_global (vnode
->decl
, TREE_TYPE (type
), v
);
2915 struct asan_add_string_csts_data aascd
;
2916 aascd
.type
= TREE_TYPE (type
);
2918 const_desc_htab
->traverse
<asan_add_string_csts_data
*, add_string_csts
>
2920 ctor
= build_constructor (type
, v
);
2921 TREE_CONSTANT (ctor
) = 1;
2922 TREE_STATIC (ctor
) = 1;
2923 DECL_INITIAL (var
) = ctor
;
2924 varpool_node::finalize_decl (var
);
2926 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS
);
2927 tree gcount_tree
= build_int_cst (pointer_sized_int_node
, gcount
);
2928 append_to_statement_list (build_call_expr (fn
, 2,
2929 build_fold_addr_expr (var
),
2931 &asan_ctor_statements
);
2933 fn
= builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS
);
2934 append_to_statement_list (build_call_expr (fn
, 2,
2935 build_fold_addr_expr (var
),
2938 cgraph_build_static_cdtor ('D', dtor_statements
, priority
);
2940 if (asan_ctor_statements
)
2941 cgraph_build_static_cdtor ('I', asan_ctor_statements
, priority
);
2942 flag_sanitize
|= SANITIZE_ADDRESS
;
2945 /* Poison or unpoison (depending on IS_CLOBBER variable) shadow memory based
2946 on SHADOW address. Newly added statements will be added to ITER with
2947 given location LOC. We mark SIZE bytes in shadow memory, where
2948 LAST_CHUNK_SIZE is greater than zero in situation where we are at the
2949 end of a variable. */
2952 asan_store_shadow_bytes (gimple_stmt_iterator
*iter
, location_t loc
,
2954 unsigned HOST_WIDE_INT base_addr_offset
,
2955 bool is_clobber
, unsigned size
,
2956 unsigned last_chunk_size
)
2958 tree shadow_ptr_type
;
2963 shadow_ptr_type
= shadow_ptr_types
[0];
2966 shadow_ptr_type
= shadow_ptr_types
[1];
2969 shadow_ptr_type
= shadow_ptr_types
[2];
2975 unsigned char c
= (char) is_clobber
? ASAN_STACK_MAGIC_USE_AFTER_SCOPE
: 0;
2976 unsigned HOST_WIDE_INT val
= 0;
2977 unsigned last_pos
= size
;
2978 if (last_chunk_size
&& !is_clobber
)
2979 last_pos
= BYTES_BIG_ENDIAN
? 0 : size
- 1;
2980 for (unsigned i
= 0; i
< size
; ++i
)
2982 unsigned char shadow_c
= c
;
2984 shadow_c
= last_chunk_size
;
2985 val
|= (unsigned HOST_WIDE_INT
) shadow_c
<< (BITS_PER_UNIT
* i
);
2988 /* Handle last chunk in unpoisoning. */
2989 tree magic
= build_int_cst (TREE_TYPE (shadow_ptr_type
), val
);
2991 tree dest
= build2 (MEM_REF
, TREE_TYPE (shadow_ptr_type
), shadow
,
2992 build_int_cst (shadow_ptr_type
, base_addr_offset
));
2994 gimple
*g
= gimple_build_assign (dest
, magic
);
2995 gimple_set_location (g
, loc
);
2996 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
2999 /* Expand the ASAN_MARK builtins. */
3002 asan_expand_mark_ifn (gimple_stmt_iterator
*iter
)
3004 gimple
*g
= gsi_stmt (*iter
);
3005 location_t loc
= gimple_location (g
);
3006 HOST_WIDE_INT flag
= tree_to_shwi (gimple_call_arg (g
, 0));
3007 bool is_poison
= ((asan_mark_flags
)flag
) == ASAN_MARK_POISON
;
3009 tree base
= gimple_call_arg (g
, 1);
3010 gcc_checking_assert (TREE_CODE (base
) == ADDR_EXPR
);
3011 tree decl
= TREE_OPERAND (base
, 0);
3013 /* For a nested function, we can have: ASAN_MARK (2, &FRAME.2.fp_input, 4) */
3014 if (TREE_CODE (decl
) == COMPONENT_REF
3015 && DECL_NONLOCAL_FRAME (TREE_OPERAND (decl
, 0)))
3016 decl
= TREE_OPERAND (decl
, 0);
3018 gcc_checking_assert (TREE_CODE (decl
) == VAR_DECL
);
3022 if (asan_handled_variables
== NULL
)
3023 asan_handled_variables
= new hash_set
<tree
> (16);
3024 asan_handled_variables
->add (decl
);
3026 tree len
= gimple_call_arg (g
, 2);
3028 gcc_assert (tree_fits_shwi_p (len
));
3029 unsigned HOST_WIDE_INT size_in_bytes
= tree_to_shwi (len
);
3030 gcc_assert (size_in_bytes
);
3032 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
3034 gimple_set_location (g
, loc
);
3035 gsi_replace (iter
, g
, false);
3036 tree base_addr
= gimple_assign_lhs (g
);
3038 /* Generate direct emission if size_in_bytes is small. */
3039 if (size_in_bytes
<= ASAN_PARAM_USE_AFTER_SCOPE_DIRECT_EMISSION_THRESHOLD
)
3041 unsigned HOST_WIDE_INT shadow_size
= shadow_mem_size (size_in_bytes
);
3043 tree shadow
= build_shadow_mem_access (iter
, loc
, base_addr
,
3044 shadow_ptr_types
[0], true);
3046 for (unsigned HOST_WIDE_INT offset
= 0; offset
< shadow_size
;)
3049 if (shadow_size
- offset
>= 4)
3051 else if (shadow_size
- offset
>= 2)
3054 unsigned HOST_WIDE_INT last_chunk_size
= 0;
3055 unsigned HOST_WIDE_INT s
= (offset
+ size
) * ASAN_SHADOW_GRANULARITY
;
3056 if (s
> size_in_bytes
)
3057 last_chunk_size
= ASAN_SHADOW_GRANULARITY
- (s
- size_in_bytes
);
3059 asan_store_shadow_bytes (iter
, loc
, shadow
, offset
, is_poison
,
3060 size
, last_chunk_size
);
3066 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
3068 gimple_set_location (g
, loc
);
3069 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
3070 tree sz_arg
= gimple_assign_lhs (g
);
3073 = builtin_decl_implicit (is_poison
? BUILT_IN_ASAN_POISON_STACK_MEMORY
3074 : BUILT_IN_ASAN_UNPOISON_STACK_MEMORY
);
3075 g
= gimple_build_call (fun
, 2, base_addr
, sz_arg
);
3076 gimple_set_location (g
, loc
);
3077 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
3083 /* Expand the ASAN_{LOAD,STORE} builtins. */
3086 asan_expand_check_ifn (gimple_stmt_iterator
*iter
, bool use_calls
)
3088 gimple
*g
= gsi_stmt (*iter
);
3089 location_t loc
= gimple_location (g
);
3091 if (flag_sanitize
& SANITIZE_USER_ADDRESS
)
3092 recover_p
= (flag_sanitize_recover
& SANITIZE_USER_ADDRESS
) != 0;
3094 recover_p
= (flag_sanitize_recover
& SANITIZE_KERNEL_ADDRESS
) != 0;
3096 HOST_WIDE_INT flags
= tree_to_shwi (gimple_call_arg (g
, 0));
3097 gcc_assert (flags
< ASAN_CHECK_LAST
);
3098 bool is_scalar_access
= (flags
& ASAN_CHECK_SCALAR_ACCESS
) != 0;
3099 bool is_store
= (flags
& ASAN_CHECK_STORE
) != 0;
3100 bool is_non_zero_len
= (flags
& ASAN_CHECK_NON_ZERO_LEN
) != 0;
3102 tree base
= gimple_call_arg (g
, 1);
3103 tree len
= gimple_call_arg (g
, 2);
3104 HOST_WIDE_INT align
= tree_to_shwi (gimple_call_arg (g
, 3));
3106 HOST_WIDE_INT size_in_bytes
3107 = is_scalar_access
&& tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
3111 /* Instrument using callbacks. */
3112 gimple
*g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
3114 gimple_set_location (g
, loc
);
3115 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
3116 tree base_addr
= gimple_assign_lhs (g
);
3119 tree fun
= check_func (is_store
, recover_p
, size_in_bytes
, &nargs
);
3121 g
= gimple_build_call (fun
, 1, base_addr
);
3124 gcc_assert (nargs
== 2);
3125 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
3127 gimple_set_location (g
, loc
);
3128 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
3129 tree sz_arg
= gimple_assign_lhs (g
);
3130 g
= gimple_build_call (fun
, nargs
, base_addr
, sz_arg
);
3132 gimple_set_location (g
, loc
);
3133 gsi_replace (iter
, g
, false);
3137 HOST_WIDE_INT real_size_in_bytes
= size_in_bytes
== -1 ? 1 : size_in_bytes
;
3139 tree shadow_ptr_type
= shadow_ptr_types
[real_size_in_bytes
== 16 ? 1 : 0];
3140 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
3142 gimple_stmt_iterator gsi
= *iter
;
3144 if (!is_non_zero_len
)
3146 /* So, the length of the memory area to asan-protect is
3147 non-constant. Let's guard the generated instrumentation code
3152 //asan instrumentation code goes here.
3154 // falltrough instructions, starting with *ITER. */
3156 g
= gimple_build_cond (NE_EXPR
,
3158 build_int_cst (TREE_TYPE (len
), 0),
3159 NULL_TREE
, NULL_TREE
);
3160 gimple_set_location (g
, loc
);
3162 basic_block then_bb
, fallthrough_bb
;
3163 insert_if_then_before_iter (as_a
<gcond
*> (g
), iter
,
3164 /*then_more_likely_p=*/true,
3165 &then_bb
, &fallthrough_bb
);
3166 /* Note that fallthrough_bb starts with the statement that was
3167 pointed to by ITER. */
3169 /* The 'then block' of the 'if (len != 0) condition is where
3170 we'll generate the asan instrumentation code now. */
3171 gsi
= gsi_last_bb (then_bb
);
3174 /* Get an iterator on the point where we can add the condition
3175 statement for the instrumentation. */
3176 basic_block then_bb
, else_bb
;
3177 gsi
= create_cond_insert_point (&gsi
, /*before_p*/false,
3178 /*then_more_likely_p=*/false,
3179 /*create_then_fallthru_edge*/recover_p
,
3183 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
3185 gimple_set_location (g
, loc
);
3186 gsi_insert_before (&gsi
, g
, GSI_NEW_STMT
);
3187 tree base_addr
= gimple_assign_lhs (g
);
3190 if (real_size_in_bytes
>= 8)
3192 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_addr
,
3198 /* Slow path for 1, 2 and 4 byte accesses. */
3199 /* Test (shadow != 0)
3200 & ((base_addr & 7) + (real_size_in_bytes - 1)) >= shadow). */
3201 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_addr
,
3203 gimple
*shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
3204 gimple_seq seq
= NULL
;
3205 gimple_seq_add_stmt (&seq
, shadow_test
);
3206 /* Aligned (>= 8 bytes) can test just
3207 (real_size_in_bytes - 1 >= shadow), as base_addr & 7 is known
3211 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
,
3213 gimple_seq_add_stmt (&seq
,
3214 build_type_cast (shadow_type
,
3215 gimple_seq_last (seq
)));
3216 if (real_size_in_bytes
> 1)
3217 gimple_seq_add_stmt (&seq
,
3218 build_assign (PLUS_EXPR
,
3219 gimple_seq_last (seq
),
3220 real_size_in_bytes
- 1));
3221 t
= gimple_assign_lhs (gimple_seq_last_stmt (seq
));
3224 t
= build_int_cst (shadow_type
, real_size_in_bytes
- 1);
3225 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
, t
, shadow
));
3226 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
3227 gimple_seq_last (seq
)));
3228 t
= gimple_assign_lhs (gimple_seq_last (seq
));
3229 gimple_seq_set_location (seq
, loc
);
3230 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
3232 /* For non-constant, misaligned or otherwise weird access sizes,
3233 check first and last byte. */
3234 if (size_in_bytes
== -1)
3236 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
3238 build_int_cst (pointer_sized_int_node
, 1));
3239 gimple_set_location (g
, loc
);
3240 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
3241 tree last
= gimple_assign_lhs (g
);
3242 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
3243 PLUS_EXPR
, base_addr
, last
);
3244 gimple_set_location (g
, loc
);
3245 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
3246 tree base_end_addr
= gimple_assign_lhs (g
);
3248 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_end_addr
,
3250 gimple
*shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
3251 gimple_seq seq
= NULL
;
3252 gimple_seq_add_stmt (&seq
, shadow_test
);
3253 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
,
3255 gimple_seq_add_stmt (&seq
, build_type_cast (shadow_type
,
3256 gimple_seq_last (seq
)));
3257 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
,
3258 gimple_seq_last (seq
),
3260 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
3261 gimple_seq_last (seq
)));
3262 gimple_seq_add_stmt (&seq
, build_assign (BIT_IOR_EXPR
, t
,
3263 gimple_seq_last (seq
)));
3264 t
= gimple_assign_lhs (gimple_seq_last (seq
));
3265 gimple_seq_set_location (seq
, loc
);
3266 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
3270 g
= gimple_build_cond (NE_EXPR
, t
, build_int_cst (TREE_TYPE (t
), 0),
3271 NULL_TREE
, NULL_TREE
);
3272 gimple_set_location (g
, loc
);
3273 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
3275 /* Generate call to the run-time library (e.g. __asan_report_load8). */
3276 gsi
= gsi_start_bb (then_bb
);
3278 tree fun
= report_error_func (is_store
, recover_p
, size_in_bytes
, &nargs
);
3279 g
= gimple_build_call (fun
, nargs
, base_addr
, len
);
3280 gimple_set_location (g
, loc
);
3281 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
3283 gsi_remove (iter
, true);
3284 *iter
= gsi_start_bb (else_bb
);
3289 /* Create ASAN shadow variable for a VAR_DECL which has been rewritten
3290 into SSA. Already seen VAR_DECLs are stored in SHADOW_VARS_MAPPING. */
3293 create_asan_shadow_var (tree var_decl
,
3294 hash_map
<tree
, tree
> &shadow_vars_mapping
)
3296 tree
*slot
= shadow_vars_mapping
.get (var_decl
);
3299 tree shadow_var
= copy_node (var_decl
);
3302 memset (&id
, 0, sizeof (copy_body_data
));
3303 id
.src_fn
= id
.dst_fn
= current_function_decl
;
3304 copy_decl_for_dup_finish (&id
, var_decl
, shadow_var
);
3306 DECL_ARTIFICIAL (shadow_var
) = 1;
3307 DECL_IGNORED_P (shadow_var
) = 1;
3308 DECL_SEEN_IN_BIND_EXPR_P (shadow_var
) = 0;
3309 gimple_add_tmp_var (shadow_var
);
3311 shadow_vars_mapping
.put (var_decl
, shadow_var
);
3318 /* Expand ASAN_POISON ifn. */
3321 asan_expand_poison_ifn (gimple_stmt_iterator
*iter
,
3322 bool *need_commit_edge_insert
,
3323 hash_map
<tree
, tree
> &shadow_vars_mapping
)
3325 gimple
*g
= gsi_stmt (*iter
);
3326 tree poisoned_var
= gimple_call_lhs (g
);
3327 if (!poisoned_var
|| has_zero_uses (poisoned_var
))
3329 gsi_remove (iter
, true);
3333 if (SSA_NAME_VAR (poisoned_var
) == NULL_TREE
)
3334 SET_SSA_NAME_VAR_OR_IDENTIFIER (poisoned_var
,
3335 create_tmp_var (TREE_TYPE (poisoned_var
)));
3337 tree shadow_var
= create_asan_shadow_var (SSA_NAME_VAR (poisoned_var
),
3338 shadow_vars_mapping
);
3341 if (flag_sanitize
& SANITIZE_USER_ADDRESS
)
3342 recover_p
= (flag_sanitize_recover
& SANITIZE_USER_ADDRESS
) != 0;
3344 recover_p
= (flag_sanitize_recover
& SANITIZE_KERNEL_ADDRESS
) != 0;
3345 tree size
= DECL_SIZE_UNIT (shadow_var
);
3347 = gimple_build_call_internal (IFN_ASAN_MARK
, 3,
3348 build_int_cst (integer_type_node
,
3350 build_fold_addr_expr (shadow_var
), size
);
3353 imm_use_iterator imm_iter
;
3354 FOR_EACH_IMM_USE_STMT (use
, imm_iter
, poisoned_var
)
3356 if (is_gimple_debug (use
))
3360 bool store_p
= gimple_call_internal_p (use
, IFN_ASAN_POISON_USE
);
3361 tree fun
= report_error_func (store_p
, recover_p
, tree_to_uhwi (size
),
3364 gcall
*call
= gimple_build_call (fun
, 1,
3365 build_fold_addr_expr (shadow_var
));
3366 gimple_set_location (call
, gimple_location (use
));
3367 gimple
*call_to_insert
= call
;
3369 /* The USE can be a gimple PHI node. If so, insert the call on
3370 all edges leading to the PHI node. */
3371 if (is_a
<gphi
*> (use
))
3373 gphi
*phi
= dyn_cast
<gphi
*> (use
);
3374 for (unsigned i
= 0; i
< gimple_phi_num_args (phi
); ++i
)
3375 if (gimple_phi_arg_def (phi
, i
) == poisoned_var
)
3377 edge e
= gimple_phi_arg_edge (phi
, i
);
3379 if (call_to_insert
== NULL
)
3380 call_to_insert
= gimple_copy (call
);
3382 gsi_insert_seq_on_edge (e
, call_to_insert
);
3383 *need_commit_edge_insert
= true;
3384 call_to_insert
= NULL
;
3389 gimple_stmt_iterator gsi
= gsi_for_stmt (use
);
3391 gsi_replace (&gsi
, call
, true);
3393 gsi_insert_before (&gsi
, call
, GSI_NEW_STMT
);
3397 SSA_NAME_IS_DEFAULT_DEF (poisoned_var
) = true;
3398 SSA_NAME_DEF_STMT (poisoned_var
) = gimple_build_nop ();
3399 gsi_replace (iter
, poison_call
, false);
3404 /* Instrument the current function. */
3407 asan_instrument (void)
3409 if (shadow_ptr_types
[0] == NULL_TREE
)
3410 asan_init_shadow_ptr_types ();
3411 transform_statements ();
3412 last_alloca_addr
= NULL_TREE
;
3419 return sanitize_flags_p (SANITIZE_ADDRESS
);
3424 const pass_data pass_data_asan
=
3426 GIMPLE_PASS
, /* type */
3428 OPTGROUP_NONE
, /* optinfo_flags */
3429 TV_NONE
, /* tv_id */
3430 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
3431 0, /* properties_provided */
3432 0, /* properties_destroyed */
3433 0, /* todo_flags_start */
3434 TODO_update_ssa
, /* todo_flags_finish */
3437 class pass_asan
: public gimple_opt_pass
3440 pass_asan (gcc::context
*ctxt
)
3441 : gimple_opt_pass (pass_data_asan
, ctxt
)
3444 /* opt_pass methods: */
3445 opt_pass
* clone () { return new pass_asan (m_ctxt
); }
3446 virtual bool gate (function
*) { return gate_asan (); }
3447 virtual unsigned int execute (function
*) { return asan_instrument (); }
3449 }; // class pass_asan
3454 make_pass_asan (gcc::context
*ctxt
)
3456 return new pass_asan (ctxt
);
3461 const pass_data pass_data_asan_O0
=
3463 GIMPLE_PASS
, /* type */
3465 OPTGROUP_NONE
, /* optinfo_flags */
3466 TV_NONE
, /* tv_id */
3467 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
3468 0, /* properties_provided */
3469 0, /* properties_destroyed */
3470 0, /* todo_flags_start */
3471 TODO_update_ssa
, /* todo_flags_finish */
3474 class pass_asan_O0
: public gimple_opt_pass
3477 pass_asan_O0 (gcc::context
*ctxt
)
3478 : gimple_opt_pass (pass_data_asan_O0
, ctxt
)
3481 /* opt_pass methods: */
3482 virtual bool gate (function
*) { return !optimize
&& gate_asan (); }
3483 virtual unsigned int execute (function
*) { return asan_instrument (); }
3485 }; // class pass_asan_O0
3490 make_pass_asan_O0 (gcc::context
*ctxt
)
3492 return new pass_asan_O0 (ctxt
);
3495 #include "gt-asan.h"