1 /* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2013 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
27 #include "tree-iterator.h"
29 #include "tree-ssanames.h"
30 #include "tree-pass.h"
32 #include "gimple-pretty-print.h"
38 #include "langhooks.h"
39 #include "hash-table.h"
40 #include "alloc-pool.h"
42 #include "gimple-builder.h"
44 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
45 with <2x slowdown on average.
47 The tool consists of two parts:
48 instrumentation module (this file) and a run-time library.
49 The instrumentation module adds a run-time check before every memory insn.
50 For a 8- or 16- byte load accessing address X:
51 ShadowAddr = (X >> 3) + Offset
52 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
54 __asan_report_load8(X);
55 For a load of N bytes (N=1, 2 or 4) from address X:
56 ShadowAddr = (X >> 3) + Offset
57 ShadowValue = *(char*)ShadowAddr;
59 if ((X & 7) + N - 1 > ShadowValue)
60 __asan_report_loadN(X);
61 Stores are instrumented similarly, but using __asan_report_storeN functions.
62 A call too __asan_init_vN() is inserted to the list of module CTORs.
63 N is the version number of the AddressSanitizer API. The changes between the
64 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
66 The run-time library redefines malloc (so that redzone are inserted around
67 the allocated memory) and free (so that reuse of free-ed memory is delayed),
68 provides __asan_report* and __asan_init_vN functions.
71 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
73 The current implementation supports detection of out-of-bounds and
74 use-after-free in the heap, on the stack and for global variables.
76 [Protection of stack variables]
78 To understand how detection of out-of-bounds and use-after-free works
79 for stack variables, lets look at this example on x86_64 where the
94 For this function, the stack protected by asan will be organized as
95 follows, from the top of the stack to the bottom:
97 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
99 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
100 the next slot be 32 bytes aligned; this one is called Partial
101 Redzone; this 32 bytes alignment is an asan constraint]
103 Slot 3/ [24 bytes for variable 'a']
105 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
107 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
109 Slot 6/ [8 bytes for variable 'b']
111 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
114 The 32 bytes of LEFT red zone at the bottom of the stack can be
117 1/ The first 8 bytes contain a magical asan number that is always
120 2/ The following 8 bytes contains a pointer to a string (to be
121 parsed at runtime by the runtime asan library), which format is
124 "<function-name> <space> <num-of-variables-on-the-stack>
125 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
126 <length-of-var-in-bytes> ){n} "
128 where '(...){n}' means the content inside the parenthesis occurs 'n'
129 times, with 'n' being the number of variables on the stack.
131 3/ The following 8 bytes contain the PC of the current function which
132 will be used by the run-time library to print an error message.
134 4/ The following 8 bytes are reserved for internal use by the run-time.
136 The shadow memory for that stack layout is going to look like this:
138 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
139 The F1 byte pattern is a magic number called
140 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
141 the memory for that shadow byte is part of a the LEFT red zone
142 intended to seat at the bottom of the variables on the stack.
144 - content of shadow memory 8 bytes for slots 6 and 5:
145 0xF4F4F400. The F4 byte pattern is a magic number
146 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
147 memory region for this shadow byte is a PARTIAL red zone
148 intended to pad a variable A, so that the slot following
149 {A,padding} is 32 bytes aligned.
151 Note that the fact that the least significant byte of this
152 shadow memory content is 00 means that 8 bytes of its
153 corresponding memory (which corresponds to the memory of
154 variable 'b') is addressable.
156 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
157 The F2 byte pattern is a magic number called
158 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
159 region for this shadow byte is a MIDDLE red zone intended to
160 seat between two 32 aligned slots of {variable,padding}.
162 - content of shadow memory 8 bytes for slot 3 and 2:
163 0xF4000000. This represents is the concatenation of
164 variable 'a' and the partial red zone following it, like what we
165 had for variable 'b'. The least significant 3 bytes being 00
166 means that the 3 bytes of variable 'a' are addressable.
168 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
169 The F3 byte pattern is a magic number called
170 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
171 region for this shadow byte is a RIGHT red zone intended to seat
172 at the top of the variables of the stack.
174 Note that the real variable layout is done in expand_used_vars in
175 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
176 stack variables as well as the different red zones, emits some
177 prologue code to populate the shadow memory as to poison (mark as
178 non-accessible) the regions of the red zones and mark the regions of
179 stack variables as accessible, and emit some epilogue code to
180 un-poison (mark as accessible) the regions of red zones right before
183 [Protection of global variables]
185 The basic idea is to insert a red zone between two global variables
186 and install a constructor function that calls the asan runtime to do
187 the populating of the relevant shadow memory regions at load time.
189 So the global variables are laid out as to insert a red zone between
190 them. The size of the red zones is so that each variable starts on a
193 Then a constructor function is installed so that, for each global
194 variable, it calls the runtime asan library function
195 __asan_register_globals_with an instance of this type:
199 // Address of the beginning of the global variable.
202 // Initial size of the global variable.
205 // Size of the global variable + size of the red zone. This
206 // size is 32 bytes aligned.
207 uptr __size_with_redzone;
209 // Name of the global variable.
212 // Name of the module where the global variable is declared.
213 const void *__module_name;
215 // This is always set to NULL for now.
216 uptr __has_dynamic_init;
219 A destructor function that calls the runtime asan library function
220 _asan_unregister_globals is also installed. */
222 alias_set_type asan_shadow_set
= -1;
224 /* Pointer types to 1 resp. 2 byte integers in shadow memory. A separate
225 alias set is used for all shadow memory accesses. */
226 static GTY(()) tree shadow_ptr_types
[2];
228 /* Hashtable support for memory references used by gimple
231 /* This type represents a reference to a memory region. */
234 /* The expression of the beginning of the memory region. */
237 /* The size of the access (can be 1, 2, 4, 8, 16 for now). */
241 static alloc_pool asan_mem_ref_alloc_pool
;
243 /* This creates the alloc pool used to store the instances of
244 asan_mem_ref that are stored in the hash table asan_mem_ref_ht. */
247 asan_mem_ref_get_alloc_pool ()
249 if (asan_mem_ref_alloc_pool
== NULL
)
250 asan_mem_ref_alloc_pool
= create_alloc_pool ("asan_mem_ref",
251 sizeof (asan_mem_ref
),
253 return asan_mem_ref_alloc_pool
;
257 /* Initializes an instance of asan_mem_ref. */
260 asan_mem_ref_init (asan_mem_ref
*ref
, tree start
, char access_size
)
263 ref
->access_size
= access_size
;
266 /* Allocates memory for an instance of asan_mem_ref into the memory
267 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
268 START is the address of (or the expression pointing to) the
269 beginning of memory reference. ACCESS_SIZE is the size of the
270 access to the referenced memory. */
273 asan_mem_ref_new (tree start
, char access_size
)
276 (asan_mem_ref
*) pool_alloc (asan_mem_ref_get_alloc_pool ());
278 asan_mem_ref_init (ref
, start
, access_size
);
282 /* This builds and returns a pointer to the end of the memory region
283 that starts at START and of length LEN. */
286 asan_mem_ref_get_end (tree start
, tree len
)
288 if (len
== NULL_TREE
|| integer_zerop (len
))
291 return fold_build2 (POINTER_PLUS_EXPR
, TREE_TYPE (start
), start
, len
);
294 /* Return a tree expression that represents the end of the referenced
295 memory region. Beware that this function can actually build a new
299 asan_mem_ref_get_end (const asan_mem_ref
*ref
, tree len
)
301 return asan_mem_ref_get_end (ref
->start
, len
);
304 struct asan_mem_ref_hasher
305 : typed_noop_remove
<asan_mem_ref
>
307 typedef asan_mem_ref value_type
;
308 typedef asan_mem_ref compare_type
;
310 static inline hashval_t
hash (const value_type
*);
311 static inline bool equal (const value_type
*, const compare_type
*);
314 /* Hash a memory reference. */
317 asan_mem_ref_hasher::hash (const asan_mem_ref
*mem_ref
)
319 hashval_t h
= iterative_hash_expr (mem_ref
->start
, 0);
320 h
= iterative_hash_hashval_t (h
, mem_ref
->access_size
);
324 /* Compare two memory references. We accept the length of either
325 memory references to be NULL_TREE. */
328 asan_mem_ref_hasher::equal (const asan_mem_ref
*m1
,
329 const asan_mem_ref
*m2
)
331 return (m1
->access_size
== m2
->access_size
332 && operand_equal_p (m1
->start
, m2
->start
, 0));
335 static hash_table
<asan_mem_ref_hasher
> asan_mem_ref_ht
;
337 /* Returns a reference to the hash table containing memory references.
338 This function ensures that the hash table is created. Note that
339 this hash table is updated by the function
340 update_mem_ref_hash_table. */
342 static hash_table
<asan_mem_ref_hasher
> &
343 get_mem_ref_hash_table ()
345 if (!asan_mem_ref_ht
.is_created ())
346 asan_mem_ref_ht
.create (10);
348 return asan_mem_ref_ht
;
351 /* Clear all entries from the memory references hash table. */
354 empty_mem_ref_hash_table ()
356 if (asan_mem_ref_ht
.is_created ())
357 asan_mem_ref_ht
.empty ();
360 /* Free the memory references hash table. */
363 free_mem_ref_resources ()
365 if (asan_mem_ref_ht
.is_created ())
366 asan_mem_ref_ht
.dispose ();
368 if (asan_mem_ref_alloc_pool
)
370 free_alloc_pool (asan_mem_ref_alloc_pool
);
371 asan_mem_ref_alloc_pool
= NULL
;
375 /* Return true iff the memory reference REF has been instrumented. */
378 has_mem_ref_been_instrumented (tree ref
, char access_size
)
381 asan_mem_ref_init (&r
, ref
, access_size
);
383 return (get_mem_ref_hash_table ().find (&r
) != NULL
);
386 /* Return true iff the memory reference REF has been instrumented. */
389 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
)
391 return has_mem_ref_been_instrumented (ref
->start
, ref
->access_size
);
394 /* Return true iff access to memory region starting at REF and of
395 length LEN has been instrumented. */
398 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
, tree len
)
400 /* First let's see if the address of the beginning of REF has been
402 if (!has_mem_ref_been_instrumented (ref
))
407 /* Let's see if the end of the region has been instrumented. */
408 if (!has_mem_ref_been_instrumented (asan_mem_ref_get_end (ref
, len
),
415 /* Set REF to the memory reference present in a gimple assignment
416 ASSIGNMENT. Return true upon successful completion, false
420 get_mem_ref_of_assignment (const gimple assignment
,
424 gcc_assert (gimple_assign_single_p (assignment
));
426 if (gimple_store_p (assignment
)
427 && !gimple_clobber_p (assignment
))
429 ref
->start
= gimple_assign_lhs (assignment
);
430 *ref_is_store
= true;
432 else if (gimple_assign_load_p (assignment
))
434 ref
->start
= gimple_assign_rhs1 (assignment
);
435 *ref_is_store
= false;
440 ref
->access_size
= int_size_in_bytes (TREE_TYPE (ref
->start
));
444 /* Return the memory references contained in a gimple statement
445 representing a builtin call that has to do with memory access. */
448 get_mem_refs_of_builtin_call (const gimple call
,
460 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
462 tree callee
= gimple_call_fndecl (call
);
463 tree source0
= NULL_TREE
, source1
= NULL_TREE
,
464 dest
= NULL_TREE
, len
= NULL_TREE
;
465 bool is_store
= true, got_reference_p
= false;
466 char access_size
= 1;
468 switch (DECL_FUNCTION_CODE (callee
))
470 /* (s, s, n) style memops. */
472 case BUILT_IN_MEMCMP
:
473 source0
= gimple_call_arg (call
, 0);
474 source1
= gimple_call_arg (call
, 1);
475 len
= gimple_call_arg (call
, 2);
478 /* (src, dest, n) style memops. */
480 source0
= gimple_call_arg (call
, 0);
481 dest
= gimple_call_arg (call
, 1);
482 len
= gimple_call_arg (call
, 2);
485 /* (dest, src, n) style memops. */
486 case BUILT_IN_MEMCPY
:
487 case BUILT_IN_MEMCPY_CHK
:
488 case BUILT_IN_MEMMOVE
:
489 case BUILT_IN_MEMMOVE_CHK
:
490 case BUILT_IN_MEMPCPY
:
491 case BUILT_IN_MEMPCPY_CHK
:
492 dest
= gimple_call_arg (call
, 0);
493 source0
= gimple_call_arg (call
, 1);
494 len
= gimple_call_arg (call
, 2);
497 /* (dest, n) style memops. */
499 dest
= gimple_call_arg (call
, 0);
500 len
= gimple_call_arg (call
, 1);
503 /* (dest, x, n) style memops*/
504 case BUILT_IN_MEMSET
:
505 case BUILT_IN_MEMSET_CHK
:
506 dest
= gimple_call_arg (call
, 0);
507 len
= gimple_call_arg (call
, 2);
510 case BUILT_IN_STRLEN
:
511 source0
= gimple_call_arg (call
, 0);
512 len
= gimple_call_lhs (call
);
515 /* And now the __atomic* and __sync builtins.
516 These are handled differently from the classical memory memory
517 access builtins above. */
519 case BUILT_IN_ATOMIC_LOAD_1
:
520 case BUILT_IN_ATOMIC_LOAD_2
:
521 case BUILT_IN_ATOMIC_LOAD_4
:
522 case BUILT_IN_ATOMIC_LOAD_8
:
523 case BUILT_IN_ATOMIC_LOAD_16
:
527 case BUILT_IN_SYNC_FETCH_AND_ADD_1
:
528 case BUILT_IN_SYNC_FETCH_AND_ADD_2
:
529 case BUILT_IN_SYNC_FETCH_AND_ADD_4
:
530 case BUILT_IN_SYNC_FETCH_AND_ADD_8
:
531 case BUILT_IN_SYNC_FETCH_AND_ADD_16
:
533 case BUILT_IN_SYNC_FETCH_AND_SUB_1
:
534 case BUILT_IN_SYNC_FETCH_AND_SUB_2
:
535 case BUILT_IN_SYNC_FETCH_AND_SUB_4
:
536 case BUILT_IN_SYNC_FETCH_AND_SUB_8
:
537 case BUILT_IN_SYNC_FETCH_AND_SUB_16
:
539 case BUILT_IN_SYNC_FETCH_AND_OR_1
:
540 case BUILT_IN_SYNC_FETCH_AND_OR_2
:
541 case BUILT_IN_SYNC_FETCH_AND_OR_4
:
542 case BUILT_IN_SYNC_FETCH_AND_OR_8
:
543 case BUILT_IN_SYNC_FETCH_AND_OR_16
:
545 case BUILT_IN_SYNC_FETCH_AND_AND_1
:
546 case BUILT_IN_SYNC_FETCH_AND_AND_2
:
547 case BUILT_IN_SYNC_FETCH_AND_AND_4
:
548 case BUILT_IN_SYNC_FETCH_AND_AND_8
:
549 case BUILT_IN_SYNC_FETCH_AND_AND_16
:
551 case BUILT_IN_SYNC_FETCH_AND_XOR_1
:
552 case BUILT_IN_SYNC_FETCH_AND_XOR_2
:
553 case BUILT_IN_SYNC_FETCH_AND_XOR_4
:
554 case BUILT_IN_SYNC_FETCH_AND_XOR_8
:
555 case BUILT_IN_SYNC_FETCH_AND_XOR_16
:
557 case BUILT_IN_SYNC_FETCH_AND_NAND_1
:
558 case BUILT_IN_SYNC_FETCH_AND_NAND_2
:
559 case BUILT_IN_SYNC_FETCH_AND_NAND_4
:
560 case BUILT_IN_SYNC_FETCH_AND_NAND_8
:
562 case BUILT_IN_SYNC_ADD_AND_FETCH_1
:
563 case BUILT_IN_SYNC_ADD_AND_FETCH_2
:
564 case BUILT_IN_SYNC_ADD_AND_FETCH_4
:
565 case BUILT_IN_SYNC_ADD_AND_FETCH_8
:
566 case BUILT_IN_SYNC_ADD_AND_FETCH_16
:
568 case BUILT_IN_SYNC_SUB_AND_FETCH_1
:
569 case BUILT_IN_SYNC_SUB_AND_FETCH_2
:
570 case BUILT_IN_SYNC_SUB_AND_FETCH_4
:
571 case BUILT_IN_SYNC_SUB_AND_FETCH_8
:
572 case BUILT_IN_SYNC_SUB_AND_FETCH_16
:
574 case BUILT_IN_SYNC_OR_AND_FETCH_1
:
575 case BUILT_IN_SYNC_OR_AND_FETCH_2
:
576 case BUILT_IN_SYNC_OR_AND_FETCH_4
:
577 case BUILT_IN_SYNC_OR_AND_FETCH_8
:
578 case BUILT_IN_SYNC_OR_AND_FETCH_16
:
580 case BUILT_IN_SYNC_AND_AND_FETCH_1
:
581 case BUILT_IN_SYNC_AND_AND_FETCH_2
:
582 case BUILT_IN_SYNC_AND_AND_FETCH_4
:
583 case BUILT_IN_SYNC_AND_AND_FETCH_8
:
584 case BUILT_IN_SYNC_AND_AND_FETCH_16
:
586 case BUILT_IN_SYNC_XOR_AND_FETCH_1
:
587 case BUILT_IN_SYNC_XOR_AND_FETCH_2
:
588 case BUILT_IN_SYNC_XOR_AND_FETCH_4
:
589 case BUILT_IN_SYNC_XOR_AND_FETCH_8
:
590 case BUILT_IN_SYNC_XOR_AND_FETCH_16
:
592 case BUILT_IN_SYNC_NAND_AND_FETCH_1
:
593 case BUILT_IN_SYNC_NAND_AND_FETCH_2
:
594 case BUILT_IN_SYNC_NAND_AND_FETCH_4
:
595 case BUILT_IN_SYNC_NAND_AND_FETCH_8
:
597 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1
:
598 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2
:
599 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4
:
600 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8
:
601 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16
:
603 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1
:
604 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2
:
605 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4
:
606 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8
:
607 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16
:
609 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1
:
610 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2
:
611 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4
:
612 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8
:
613 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16
:
615 case BUILT_IN_SYNC_LOCK_RELEASE_1
:
616 case BUILT_IN_SYNC_LOCK_RELEASE_2
:
617 case BUILT_IN_SYNC_LOCK_RELEASE_4
:
618 case BUILT_IN_SYNC_LOCK_RELEASE_8
:
619 case BUILT_IN_SYNC_LOCK_RELEASE_16
:
621 case BUILT_IN_ATOMIC_EXCHANGE_1
:
622 case BUILT_IN_ATOMIC_EXCHANGE_2
:
623 case BUILT_IN_ATOMIC_EXCHANGE_4
:
624 case BUILT_IN_ATOMIC_EXCHANGE_8
:
625 case BUILT_IN_ATOMIC_EXCHANGE_16
:
627 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1
:
628 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2
:
629 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4
:
630 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8
:
631 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16
:
633 case BUILT_IN_ATOMIC_STORE_1
:
634 case BUILT_IN_ATOMIC_STORE_2
:
635 case BUILT_IN_ATOMIC_STORE_4
:
636 case BUILT_IN_ATOMIC_STORE_8
:
637 case BUILT_IN_ATOMIC_STORE_16
:
639 case BUILT_IN_ATOMIC_ADD_FETCH_1
:
640 case BUILT_IN_ATOMIC_ADD_FETCH_2
:
641 case BUILT_IN_ATOMIC_ADD_FETCH_4
:
642 case BUILT_IN_ATOMIC_ADD_FETCH_8
:
643 case BUILT_IN_ATOMIC_ADD_FETCH_16
:
645 case BUILT_IN_ATOMIC_SUB_FETCH_1
:
646 case BUILT_IN_ATOMIC_SUB_FETCH_2
:
647 case BUILT_IN_ATOMIC_SUB_FETCH_4
:
648 case BUILT_IN_ATOMIC_SUB_FETCH_8
:
649 case BUILT_IN_ATOMIC_SUB_FETCH_16
:
651 case BUILT_IN_ATOMIC_AND_FETCH_1
:
652 case BUILT_IN_ATOMIC_AND_FETCH_2
:
653 case BUILT_IN_ATOMIC_AND_FETCH_4
:
654 case BUILT_IN_ATOMIC_AND_FETCH_8
:
655 case BUILT_IN_ATOMIC_AND_FETCH_16
:
657 case BUILT_IN_ATOMIC_NAND_FETCH_1
:
658 case BUILT_IN_ATOMIC_NAND_FETCH_2
:
659 case BUILT_IN_ATOMIC_NAND_FETCH_4
:
660 case BUILT_IN_ATOMIC_NAND_FETCH_8
:
661 case BUILT_IN_ATOMIC_NAND_FETCH_16
:
663 case BUILT_IN_ATOMIC_XOR_FETCH_1
:
664 case BUILT_IN_ATOMIC_XOR_FETCH_2
:
665 case BUILT_IN_ATOMIC_XOR_FETCH_4
:
666 case BUILT_IN_ATOMIC_XOR_FETCH_8
:
667 case BUILT_IN_ATOMIC_XOR_FETCH_16
:
669 case BUILT_IN_ATOMIC_OR_FETCH_1
:
670 case BUILT_IN_ATOMIC_OR_FETCH_2
:
671 case BUILT_IN_ATOMIC_OR_FETCH_4
:
672 case BUILT_IN_ATOMIC_OR_FETCH_8
:
673 case BUILT_IN_ATOMIC_OR_FETCH_16
:
675 case BUILT_IN_ATOMIC_FETCH_ADD_1
:
676 case BUILT_IN_ATOMIC_FETCH_ADD_2
:
677 case BUILT_IN_ATOMIC_FETCH_ADD_4
:
678 case BUILT_IN_ATOMIC_FETCH_ADD_8
:
679 case BUILT_IN_ATOMIC_FETCH_ADD_16
:
681 case BUILT_IN_ATOMIC_FETCH_SUB_1
:
682 case BUILT_IN_ATOMIC_FETCH_SUB_2
:
683 case BUILT_IN_ATOMIC_FETCH_SUB_4
:
684 case BUILT_IN_ATOMIC_FETCH_SUB_8
:
685 case BUILT_IN_ATOMIC_FETCH_SUB_16
:
687 case BUILT_IN_ATOMIC_FETCH_AND_1
:
688 case BUILT_IN_ATOMIC_FETCH_AND_2
:
689 case BUILT_IN_ATOMIC_FETCH_AND_4
:
690 case BUILT_IN_ATOMIC_FETCH_AND_8
:
691 case BUILT_IN_ATOMIC_FETCH_AND_16
:
693 case BUILT_IN_ATOMIC_FETCH_NAND_1
:
694 case BUILT_IN_ATOMIC_FETCH_NAND_2
:
695 case BUILT_IN_ATOMIC_FETCH_NAND_4
:
696 case BUILT_IN_ATOMIC_FETCH_NAND_8
:
697 case BUILT_IN_ATOMIC_FETCH_NAND_16
:
699 case BUILT_IN_ATOMIC_FETCH_XOR_1
:
700 case BUILT_IN_ATOMIC_FETCH_XOR_2
:
701 case BUILT_IN_ATOMIC_FETCH_XOR_4
:
702 case BUILT_IN_ATOMIC_FETCH_XOR_8
:
703 case BUILT_IN_ATOMIC_FETCH_XOR_16
:
705 case BUILT_IN_ATOMIC_FETCH_OR_1
:
706 case BUILT_IN_ATOMIC_FETCH_OR_2
:
707 case BUILT_IN_ATOMIC_FETCH_OR_4
:
708 case BUILT_IN_ATOMIC_FETCH_OR_8
:
709 case BUILT_IN_ATOMIC_FETCH_OR_16
:
711 dest
= gimple_call_arg (call
, 0);
712 /* DEST represents the address of a memory location.
713 instrument_derefs wants the memory location, so lets
714 dereference the address DEST before handing it to
715 instrument_derefs. */
716 if (TREE_CODE (dest
) == ADDR_EXPR
)
717 dest
= TREE_OPERAND (dest
, 0);
718 else if (TREE_CODE (dest
) == SSA_NAME
|| TREE_CODE (dest
) == INTEGER_CST
)
719 dest
= build2 (MEM_REF
, TREE_TYPE (TREE_TYPE (dest
)),
720 dest
, build_int_cst (TREE_TYPE (dest
), 0));
724 access_size
= int_size_in_bytes (TREE_TYPE (dest
));
728 /* The other builtins memory access are not instrumented in this
729 function because they either don't have any length parameter,
730 or their length parameter is just a limit. */
734 if (len
!= NULL_TREE
)
736 if (source0
!= NULL_TREE
)
738 src0
->start
= source0
;
739 src0
->access_size
= access_size
;
741 *src0_is_store
= false;
744 if (source1
!= NULL_TREE
)
746 src1
->start
= source1
;
747 src1
->access_size
= access_size
;
749 *src1_is_store
= false;
752 if (dest
!= NULL_TREE
)
755 dst
->access_size
= access_size
;
757 *dst_is_store
= true;
760 got_reference_p
= true;
765 dst
->access_size
= access_size
;
766 *dst_len
= NULL_TREE
;
767 *dst_is_store
= is_store
;
768 *dest_is_deref
= true;
769 got_reference_p
= true;
772 return got_reference_p
;
775 /* Return true iff a given gimple statement has been instrumented.
776 Note that the statement is "defined" by the memory references it
780 has_stmt_been_instrumented_p (gimple stmt
)
782 if (gimple_assign_single_p (stmt
))
786 asan_mem_ref_init (&r
, NULL
, 1);
788 if (get_mem_ref_of_assignment (stmt
, &r
, &r_is_store
))
789 return has_mem_ref_been_instrumented (&r
);
791 else if (gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
793 asan_mem_ref src0
, src1
, dest
;
794 asan_mem_ref_init (&src0
, NULL
, 1);
795 asan_mem_ref_init (&src1
, NULL
, 1);
796 asan_mem_ref_init (&dest
, NULL
, 1);
798 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
799 bool src0_is_store
= false, src1_is_store
= false,
800 dest_is_store
= false, dest_is_deref
= false;
801 if (get_mem_refs_of_builtin_call (stmt
,
802 &src0
, &src0_len
, &src0_is_store
,
803 &src1
, &src1_len
, &src1_is_store
,
804 &dest
, &dest_len
, &dest_is_store
,
807 if (src0
.start
!= NULL_TREE
808 && !has_mem_ref_been_instrumented (&src0
, src0_len
))
811 if (src1
.start
!= NULL_TREE
812 && !has_mem_ref_been_instrumented (&src1
, src1_len
))
815 if (dest
.start
!= NULL_TREE
816 && !has_mem_ref_been_instrumented (&dest
, dest_len
))
825 /* Insert a memory reference into the hash table. */
828 update_mem_ref_hash_table (tree ref
, char access_size
)
830 hash_table
<asan_mem_ref_hasher
> ht
= get_mem_ref_hash_table ();
833 asan_mem_ref_init (&r
, ref
, access_size
);
835 asan_mem_ref
**slot
= ht
.find_slot (&r
, INSERT
);
837 *slot
= asan_mem_ref_new (ref
, access_size
);
840 /* Initialize shadow_ptr_types array. */
843 asan_init_shadow_ptr_types (void)
845 asan_shadow_set
= new_alias_set ();
846 shadow_ptr_types
[0] = build_distinct_type_copy (signed_char_type_node
);
847 TYPE_ALIAS_SET (shadow_ptr_types
[0]) = asan_shadow_set
;
848 shadow_ptr_types
[0] = build_pointer_type (shadow_ptr_types
[0]);
849 shadow_ptr_types
[1] = build_distinct_type_copy (short_integer_type_node
);
850 TYPE_ALIAS_SET (shadow_ptr_types
[1]) = asan_shadow_set
;
851 shadow_ptr_types
[1] = build_pointer_type (shadow_ptr_types
[1]);
852 initialize_sanitizer_builtins ();
855 /* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
858 asan_pp_string (pretty_printer
*pp
)
860 const char *buf
= pp_formatted_text (pp
);
861 size_t len
= strlen (buf
);
862 tree ret
= build_string (len
+ 1, buf
);
864 = build_array_type (TREE_TYPE (shadow_ptr_types
[0]),
865 build_index_type (size_int (len
)));
866 TREE_READONLY (ret
) = 1;
867 TREE_STATIC (ret
) = 1;
868 return build1 (ADDR_EXPR
, shadow_ptr_types
[0], ret
);
871 /* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
874 asan_shadow_cst (unsigned char shadow_bytes
[4])
877 unsigned HOST_WIDE_INT val
= 0;
878 gcc_assert (WORDS_BIG_ENDIAN
== BYTES_BIG_ENDIAN
);
879 for (i
= 0; i
< 4; i
++)
880 val
|= (unsigned HOST_WIDE_INT
) shadow_bytes
[BYTES_BIG_ENDIAN
? 3 - i
: i
]
881 << (BITS_PER_UNIT
* i
);
882 return gen_int_mode (val
, SImode
);
885 /* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
889 asan_clear_shadow (rtx shadow_mem
, HOST_WIDE_INT len
)
891 rtx insn
, insns
, top_label
, end
, addr
, tmp
, jump
;
894 clear_storage (shadow_mem
, GEN_INT (len
), BLOCK_OP_NORMAL
);
895 insns
= get_insns ();
897 for (insn
= insns
; insn
; insn
= NEXT_INSN (insn
))
900 if (insn
== NULL_RTX
)
906 gcc_assert ((len
& 3) == 0);
907 top_label
= gen_label_rtx ();
908 addr
= copy_to_mode_reg (Pmode
, XEXP (shadow_mem
, 0));
909 shadow_mem
= adjust_automodify_address (shadow_mem
, SImode
, addr
, 0);
910 end
= force_reg (Pmode
, plus_constant (Pmode
, addr
, len
));
911 emit_label (top_label
);
913 emit_move_insn (shadow_mem
, const0_rtx
);
914 tmp
= expand_simple_binop (Pmode
, PLUS
, addr
, gen_int_mode (4, Pmode
), addr
,
915 true, OPTAB_LIB_WIDEN
);
917 emit_move_insn (addr
, tmp
);
918 emit_cmp_and_jump_insns (addr
, end
, LT
, NULL_RTX
, Pmode
, true, top_label
);
919 jump
= get_last_insn ();
920 gcc_assert (JUMP_P (jump
));
921 add_int_reg_note (jump
, REG_BR_PROB
, REG_BR_PROB_BASE
* 80 / 100);
925 asan_function_start (void)
927 section
*fnsec
= function_section (current_function_decl
);
928 switch_to_section (fnsec
);
929 ASM_OUTPUT_DEBUG_LABEL (asm_out_file
, "LASANPC",
930 current_function_funcdef_no
);
933 /* Insert code to protect stack vars. The prologue sequence should be emitted
934 directly, epilogue sequence returned. BASE is the register holding the
935 stack base, against which OFFSETS array offsets are relative to, OFFSETS
936 array contains pairs of offsets in reverse order, always the end offset
937 of some gap that needs protection followed by starting offset,
938 and DECLS is an array of representative decls for each var partition.
939 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
940 elements long (OFFSETS include gap before the first variable as well
941 as gaps after each stack variable). */
944 asan_emit_stack_protection (rtx base
, HOST_WIDE_INT
*offsets
, tree
*decls
,
947 rtx shadow_base
, shadow_mem
, ret
, mem
;
949 unsigned char shadow_bytes
[4];
950 HOST_WIDE_INT base_offset
= offsets
[length
- 1], offset
, prev_offset
;
951 HOST_WIDE_INT last_offset
, last_size
;
953 unsigned char cur_shadow_byte
= ASAN_STACK_MAGIC_LEFT
;
954 tree str_cst
, decl
, id
;
956 if (shadow_ptr_types
[0] == NULL_TREE
)
957 asan_init_shadow_ptr_types ();
959 /* First of all, prepare the description string. */
960 pretty_printer asan_pp
;
962 pp_decimal_int (&asan_pp
, length
/ 2 - 1);
964 for (l
= length
- 2; l
; l
-= 2)
966 tree decl
= decls
[l
/ 2 - 1];
967 pp_wide_integer (&asan_pp
, offsets
[l
] - base_offset
);
969 pp_wide_integer (&asan_pp
, offsets
[l
- 1] - offsets
[l
]);
971 if (DECL_P (decl
) && DECL_NAME (decl
))
973 pp_decimal_int (&asan_pp
, IDENTIFIER_LENGTH (DECL_NAME (decl
)));
975 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
978 pp_string (&asan_pp
, "9 <unknown>");
981 str_cst
= asan_pp_string (&asan_pp
);
983 /* Emit the prologue sequence. */
984 base
= expand_binop (Pmode
, add_optab
, base
,
985 gen_int_mode (base_offset
, Pmode
),
986 NULL_RTX
, 1, OPTAB_DIRECT
);
987 mem
= gen_rtx_MEM (ptr_mode
, base
);
988 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_FRAME_MAGIC
, ptr_mode
));
989 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
990 emit_move_insn (mem
, expand_normal (str_cst
));
991 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
992 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASANPC", current_function_funcdef_no
);
993 id
= get_identifier (buf
);
994 decl
= build_decl (DECL_SOURCE_LOCATION (current_function_decl
),
995 VAR_DECL
, id
, char_type_node
);
996 SET_DECL_ASSEMBLER_NAME (decl
, id
);
997 TREE_ADDRESSABLE (decl
) = 1;
998 TREE_READONLY (decl
) = 1;
999 DECL_ARTIFICIAL (decl
) = 1;
1000 DECL_IGNORED_P (decl
) = 1;
1001 TREE_STATIC (decl
) = 1;
1002 TREE_PUBLIC (decl
) = 0;
1003 TREE_USED (decl
) = 1;
1004 emit_move_insn (mem
, expand_normal (build_fold_addr_expr (decl
)));
1005 shadow_base
= expand_binop (Pmode
, lshr_optab
, base
,
1006 GEN_INT (ASAN_SHADOW_SHIFT
),
1007 NULL_RTX
, 1, OPTAB_DIRECT
);
1008 shadow_base
= expand_binop (Pmode
, add_optab
, shadow_base
,
1009 gen_int_mode (targetm
.asan_shadow_offset (),
1011 NULL_RTX
, 1, OPTAB_DIRECT
);
1012 gcc_assert (asan_shadow_set
!= -1
1013 && (ASAN_RED_ZONE_SIZE
>> ASAN_SHADOW_SHIFT
) == 4);
1014 shadow_mem
= gen_rtx_MEM (SImode
, shadow_base
);
1015 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1016 prev_offset
= base_offset
;
1017 for (l
= length
; l
; l
-= 2)
1020 cur_shadow_byte
= ASAN_STACK_MAGIC_RIGHT
;
1021 offset
= offsets
[l
- 1];
1022 if ((offset
- base_offset
) & (ASAN_RED_ZONE_SIZE
- 1))
1026 = base_offset
+ ((offset
- base_offset
)
1027 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1028 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1029 (aoff
- prev_offset
)
1030 >> ASAN_SHADOW_SHIFT
);
1032 for (i
= 0; i
< 4; i
++, aoff
+= (1 << ASAN_SHADOW_SHIFT
))
1035 if (aoff
< offset
- (1 << ASAN_SHADOW_SHIFT
) + 1)
1036 shadow_bytes
[i
] = 0;
1038 shadow_bytes
[i
] = offset
- aoff
;
1041 shadow_bytes
[i
] = ASAN_STACK_MAGIC_PARTIAL
;
1042 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1045 while (offset
<= offsets
[l
- 2] - ASAN_RED_ZONE_SIZE
)
1047 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1048 (offset
- prev_offset
)
1049 >> ASAN_SHADOW_SHIFT
);
1050 prev_offset
= offset
;
1051 memset (shadow_bytes
, cur_shadow_byte
, 4);
1052 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1053 offset
+= ASAN_RED_ZONE_SIZE
;
1055 cur_shadow_byte
= ASAN_STACK_MAGIC_MIDDLE
;
1057 do_pending_stack_adjust ();
1059 /* Construct epilogue sequence. */
1062 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1063 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1064 prev_offset
= base_offset
;
1065 last_offset
= base_offset
;
1067 for (l
= length
; l
; l
-= 2)
1069 offset
= base_offset
+ ((offsets
[l
- 1] - base_offset
)
1070 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1071 if (last_offset
+ last_size
!= offset
)
1073 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1074 (last_offset
- prev_offset
)
1075 >> ASAN_SHADOW_SHIFT
);
1076 prev_offset
= last_offset
;
1077 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1078 last_offset
= offset
;
1081 last_size
+= base_offset
+ ((offsets
[l
- 2] - base_offset
)
1082 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
))
1087 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1088 (last_offset
- prev_offset
)
1089 >> ASAN_SHADOW_SHIFT
);
1090 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1093 do_pending_stack_adjust ();
1100 /* Return true if DECL, a global var, might be overridden and needs
1101 therefore a local alias. */
1104 asan_needs_local_alias (tree decl
)
1106 return DECL_WEAK (decl
) || !targetm
.binds_local_p (decl
);
1109 /* Return true if DECL is a VAR_DECL that should be protected
1110 by Address Sanitizer, by appending a red zone with protected
1111 shadow memory after it and aligning it to at least
1112 ASAN_RED_ZONE_SIZE bytes. */
1115 asan_protect_global (tree decl
)
1119 if (TREE_CODE (decl
) == STRING_CST
)
1121 /* Instrument all STRING_CSTs except those created
1122 by asan_pp_string here. */
1123 if (shadow_ptr_types
[0] != NULL_TREE
1124 && TREE_CODE (TREE_TYPE (decl
)) == ARRAY_TYPE
1125 && TREE_TYPE (TREE_TYPE (decl
)) == TREE_TYPE (shadow_ptr_types
[0]))
1129 if (TREE_CODE (decl
) != VAR_DECL
1130 /* TLS vars aren't statically protectable. */
1131 || DECL_THREAD_LOCAL_P (decl
)
1132 /* Externs will be protected elsewhere. */
1133 || DECL_EXTERNAL (decl
)
1134 || !DECL_RTL_SET_P (decl
)
1135 /* Comdat vars pose an ABI problem, we can't know if
1136 the var that is selected by the linker will have
1138 || DECL_ONE_ONLY (decl
)
1139 /* Similarly for common vars. People can use -fno-common. */
1140 || (DECL_COMMON (decl
) && TREE_PUBLIC (decl
))
1141 /* Don't protect if using user section, often vars placed
1142 into user section from multiple TUs are then assumed
1143 to be an array of such vars, putting padding in there
1144 breaks this assumption. */
1145 || (DECL_SECTION_NAME (decl
) != NULL_TREE
1146 && !DECL_HAS_IMPLICIT_SECTION_NAME_P (decl
))
1147 || DECL_SIZE (decl
) == 0
1148 || ASAN_RED_ZONE_SIZE
* BITS_PER_UNIT
> MAX_OFILE_ALIGNMENT
1149 || !valid_constant_size_p (DECL_SIZE_UNIT (decl
))
1150 || DECL_ALIGN_UNIT (decl
) > 2 * ASAN_RED_ZONE_SIZE
)
1153 rtl
= DECL_RTL (decl
);
1154 if (!MEM_P (rtl
) || GET_CODE (XEXP (rtl
, 0)) != SYMBOL_REF
)
1156 symbol
= XEXP (rtl
, 0);
1158 if (CONSTANT_POOL_ADDRESS_P (symbol
)
1159 || TREE_CONSTANT_POOL_ADDRESS_P (symbol
))
1162 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl
)))
1165 #ifndef ASM_OUTPUT_DEF
1166 if (asan_needs_local_alias (decl
))
1173 /* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16}.
1174 IS_STORE is either 1 (for a store) or 0 (for a load).
1175 SIZE_IN_BYTES is one of 1, 2, 4, 8, 16. */
1178 report_error_func (bool is_store
, int size_in_bytes
)
1180 static enum built_in_function report
[2][5]
1181 = { { BUILT_IN_ASAN_REPORT_LOAD1
, BUILT_IN_ASAN_REPORT_LOAD2
,
1182 BUILT_IN_ASAN_REPORT_LOAD4
, BUILT_IN_ASAN_REPORT_LOAD8
,
1183 BUILT_IN_ASAN_REPORT_LOAD16
},
1184 { BUILT_IN_ASAN_REPORT_STORE1
, BUILT_IN_ASAN_REPORT_STORE2
,
1185 BUILT_IN_ASAN_REPORT_STORE4
, BUILT_IN_ASAN_REPORT_STORE8
,
1186 BUILT_IN_ASAN_REPORT_STORE16
} };
1187 return builtin_decl_implicit (report
[is_store
][exact_log2 (size_in_bytes
)]);
1190 #define PROB_VERY_UNLIKELY (REG_BR_PROB_BASE / 2000 - 1)
1191 #define PROB_ALWAYS (REG_BR_PROB_BASE)
1193 /* Split the current basic block and create a condition statement
1194 insertion point right before or after the statement pointed to by
1195 ITER. Return an iterator to the point at which the caller might
1196 safely insert the condition statement.
1198 THEN_BLOCK must be set to the address of an uninitialized instance
1199 of basic_block. The function will then set *THEN_BLOCK to the
1200 'then block' of the condition statement to be inserted by the
1203 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1204 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1206 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1207 block' of the condition statement to be inserted by the caller.
1209 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1210 statements starting from *ITER, and *THEN_BLOCK is a new empty
1213 *ITER is adjusted to point to always point to the first statement
1214 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1215 same as what ITER was pointing to prior to calling this function,
1216 if BEFORE_P is true; otherwise, it is its following statement. */
1218 static gimple_stmt_iterator
1219 create_cond_insert_point (gimple_stmt_iterator
*iter
,
1221 bool then_more_likely_p
,
1222 bool create_then_fallthru_edge
,
1223 basic_block
*then_block
,
1224 basic_block
*fallthrough_block
)
1226 gimple_stmt_iterator gsi
= *iter
;
1228 if (!gsi_end_p (gsi
) && before_p
)
1231 basic_block cur_bb
= gsi_bb (*iter
);
1233 edge e
= split_block (cur_bb
, gsi_stmt (gsi
));
1235 /* Get a hold on the 'condition block', the 'then block' and the
1237 basic_block cond_bb
= e
->src
;
1238 basic_block fallthru_bb
= e
->dest
;
1239 basic_block then_bb
= create_empty_bb (cond_bb
);
1242 add_bb_to_loop (then_bb
, cond_bb
->loop_father
);
1243 loops_state_set (LOOPS_NEED_FIXUP
);
1246 /* Set up the newly created 'then block'. */
1247 e
= make_edge (cond_bb
, then_bb
, EDGE_TRUE_VALUE
);
1248 int fallthrough_probability
1249 = then_more_likely_p
1250 ? PROB_VERY_UNLIKELY
1251 : PROB_ALWAYS
- PROB_VERY_UNLIKELY
;
1252 e
->probability
= PROB_ALWAYS
- fallthrough_probability
;
1253 if (create_then_fallthru_edge
)
1254 make_single_succ_edge (then_bb
, fallthru_bb
, EDGE_FALLTHRU
);
1256 /* Set up the fallthrough basic block. */
1257 e
= find_edge (cond_bb
, fallthru_bb
);
1258 e
->flags
= EDGE_FALSE_VALUE
;
1259 e
->count
= cond_bb
->count
;
1260 e
->probability
= fallthrough_probability
;
1262 /* Update dominance info for the newly created then_bb; note that
1263 fallthru_bb's dominance info has already been updated by
1265 if (dom_info_available_p (CDI_DOMINATORS
))
1266 set_immediate_dominator (CDI_DOMINATORS
, then_bb
, cond_bb
);
1268 *then_block
= then_bb
;
1269 *fallthrough_block
= fallthru_bb
;
1270 *iter
= gsi_start_bb (fallthru_bb
);
1272 return gsi_last_bb (cond_bb
);
1275 /* Insert an if condition followed by a 'then block' right before the
1276 statement pointed to by ITER. The fallthrough block -- which is the
1277 else block of the condition as well as the destination of the
1278 outcoming edge of the 'then block' -- starts with the statement
1281 COND is the condition of the if.
1283 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1284 'then block' is higher than the probability of the edge to the
1287 Upon completion of the function, *THEN_BB is set to the newly
1288 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1291 *ITER is adjusted to still point to the same statement it was
1292 pointing to initially. */
1295 insert_if_then_before_iter (gimple cond
,
1296 gimple_stmt_iterator
*iter
,
1297 bool then_more_likely_p
,
1298 basic_block
*then_bb
,
1299 basic_block
*fallthrough_bb
)
1301 gimple_stmt_iterator cond_insert_point
=
1302 create_cond_insert_point (iter
,
1305 /*create_then_fallthru_edge=*/true,
1308 gsi_insert_after (&cond_insert_point
, cond
, GSI_NEW_STMT
);
1311 /* Instrument the memory access instruction BASE. Insert new
1312 statements before or after ITER.
1314 Note that the memory access represented by BASE can be either an
1315 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1316 location. IS_STORE is TRUE for a store, FALSE for a load.
1317 BEFORE_P is TRUE for inserting the instrumentation code before
1318 ITER, FALSE for inserting it after ITER. SIZE_IN_BYTES is one of
1321 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1322 statement it was pointing to prior to calling this function,
1323 otherwise, it points to the statement logically following it. */
1326 build_check_stmt (location_t location
, tree base
, gimple_stmt_iterator
*iter
,
1327 bool before_p
, bool is_store
, int size_in_bytes
)
1329 gimple_stmt_iterator gsi
;
1330 basic_block then_bb
, else_bb
;
1331 tree t
, base_addr
, shadow
;
1333 tree shadow_ptr_type
= shadow_ptr_types
[size_in_bytes
== 16 ? 1 : 0];
1334 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
1336 = build_nonstandard_integer_type (TYPE_PRECISION (TREE_TYPE (base
)), 1);
1337 tree base_ssa
= base
;
1339 /* Get an iterator on the point where we can add the condition
1340 statement for the instrumentation. */
1341 gsi
= create_cond_insert_point (iter
, before_p
,
1342 /*then_more_likely_p=*/false,
1343 /*create_then_fallthru_edge=*/false,
1347 base
= unshare_expr (base
);
1349 /* BASE can already be an SSA_NAME; in that case, do not create a
1350 new SSA_NAME for it. */
1351 if (TREE_CODE (base
) != SSA_NAME
)
1353 g
= gimple_build_assign_with_ops (TREE_CODE (base
),
1354 make_ssa_name (TREE_TYPE (base
), NULL
),
1356 gimple_set_location (g
, location
);
1357 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1358 base_ssa
= gimple_assign_lhs (g
);
1361 g
= gimple_build_assign_with_ops (NOP_EXPR
,
1362 make_ssa_name (uintptr_type
, NULL
),
1363 base_ssa
, NULL_TREE
);
1364 gimple_set_location (g
, location
);
1365 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1366 base_addr
= gimple_assign_lhs (g
);
1369 (base_addr >> ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset (). */
1371 t
= build_int_cst (uintptr_type
, ASAN_SHADOW_SHIFT
);
1372 g
= gimple_build_assign_with_ops (RSHIFT_EXPR
,
1373 make_ssa_name (uintptr_type
, NULL
),
1375 gimple_set_location (g
, location
);
1376 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1378 t
= build_int_cst (uintptr_type
, targetm
.asan_shadow_offset ());
1379 g
= gimple_build_assign_with_ops (PLUS_EXPR
,
1380 make_ssa_name (uintptr_type
, NULL
),
1381 gimple_assign_lhs (g
), t
);
1382 gimple_set_location (g
, location
);
1383 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1385 g
= gimple_build_assign_with_ops (NOP_EXPR
,
1386 make_ssa_name (shadow_ptr_type
, NULL
),
1387 gimple_assign_lhs (g
), NULL_TREE
);
1388 gimple_set_location (g
, location
);
1389 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1391 t
= build2 (MEM_REF
, shadow_type
, gimple_assign_lhs (g
),
1392 build_int_cst (shadow_ptr_type
, 0));
1393 g
= gimple_build_assign_with_ops (MEM_REF
,
1394 make_ssa_name (shadow_type
, NULL
),
1396 gimple_set_location (g
, location
);
1397 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1398 shadow
= gimple_assign_lhs (g
);
1400 if (size_in_bytes
< 8)
1402 /* Slow path for 1, 2 and 4 byte accesses.
1404 & ((base_addr & 7) + (size_in_bytes - 1)) >= shadow). */
1405 gimple_seq seq
= NULL
;
1406 gimple shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
1407 gimple_seq_add_stmt (&seq
, shadow_test
);
1408 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, base_addr
, 7));
1409 gimple_seq_add_stmt (&seq
, build_type_cast (shadow_type
,
1410 gimple_seq_last (seq
)));
1411 if (size_in_bytes
> 1)
1412 gimple_seq_add_stmt (&seq
,
1413 build_assign (PLUS_EXPR
, gimple_seq_last (seq
),
1414 size_in_bytes
- 1));
1415 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
, gimple_seq_last (seq
),
1417 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
1418 gimple_seq_last (seq
)));
1419 t
= gimple_assign_lhs (gimple_seq_last (seq
));
1420 gimple_seq_set_location (seq
, location
);
1421 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
1426 g
= gimple_build_cond (NE_EXPR
, t
, build_int_cst (TREE_TYPE (t
), 0),
1427 NULL_TREE
, NULL_TREE
);
1428 gimple_set_location (g
, location
);
1429 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1431 /* Generate call to the run-time library (e.g. __asan_report_load8). */
1432 gsi
= gsi_start_bb (then_bb
);
1433 g
= gimple_build_call (report_error_func (is_store
, size_in_bytes
),
1435 gimple_set_location (g
, location
);
1436 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1438 *iter
= gsi_start_bb (else_bb
);
1441 /* If T represents a memory access, add instrumentation code before ITER.
1442 LOCATION is source code location.
1443 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
1446 instrument_derefs (gimple_stmt_iterator
*iter
, tree t
,
1447 location_t location
, bool is_store
)
1450 HOST_WIDE_INT size_in_bytes
;
1452 type
= TREE_TYPE (t
);
1453 switch (TREE_CODE (t
))
1464 size_in_bytes
= int_size_in_bytes (type
);
1465 if ((size_in_bytes
& (size_in_bytes
- 1)) != 0
1466 || (unsigned HOST_WIDE_INT
) size_in_bytes
- 1 >= 16)
1469 HOST_WIDE_INT bitsize
, bitpos
;
1471 enum machine_mode mode
;
1472 int volatilep
= 0, unsignedp
= 0;
1473 get_inner_reference (t
, &bitsize
, &bitpos
, &offset
,
1474 &mode
, &unsignedp
, &volatilep
, false);
1475 if (bitpos
% (size_in_bytes
* BITS_PER_UNIT
)
1476 || bitsize
!= size_in_bytes
* BITS_PER_UNIT
)
1478 if (TREE_CODE (t
) == COMPONENT_REF
1479 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1)) != NULL_TREE
)
1481 tree repr
= DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1));
1482 instrument_derefs (iter
, build3 (COMPONENT_REF
, TREE_TYPE (repr
),
1483 TREE_OPERAND (t
, 0), repr
,
1484 NULL_TREE
), location
, is_store
);
1489 base
= build_fold_addr_expr (t
);
1490 if (!has_mem_ref_been_instrumented (base
, size_in_bytes
))
1492 build_check_stmt (location
, base
, iter
, /*before_p=*/true,
1493 is_store
, size_in_bytes
);
1494 update_mem_ref_hash_table (base
, size_in_bytes
);
1495 update_mem_ref_hash_table (t
, size_in_bytes
);
1500 /* Instrument an access to a contiguous memory region that starts at
1501 the address pointed to by BASE, over a length of LEN (expressed in
1502 the sizeof (*BASE) bytes). ITER points to the instruction before
1503 which the instrumentation instructions must be inserted. LOCATION
1504 is the source location that the instrumentation instructions must
1505 have. If IS_STORE is true, then the memory access is a store;
1506 otherwise, it's a load. */
1509 instrument_mem_region_access (tree base
, tree len
,
1510 gimple_stmt_iterator
*iter
,
1511 location_t location
, bool is_store
)
1513 if (!POINTER_TYPE_P (TREE_TYPE (base
))
1514 || !INTEGRAL_TYPE_P (TREE_TYPE (len
))
1515 || integer_zerop (len
))
1518 gimple_stmt_iterator gsi
= *iter
;
1520 basic_block fallthrough_bb
= NULL
, then_bb
= NULL
;
1522 /* If the beginning of the memory region has already been
1523 instrumented, do not instrument it. */
1524 bool start_instrumented
= has_mem_ref_been_instrumented (base
, 1);
1526 /* If the end of the memory region has already been instrumented, do
1527 not instrument it. */
1528 tree end
= asan_mem_ref_get_end (base
, len
);
1529 bool end_instrumented
= has_mem_ref_been_instrumented (end
, 1);
1531 if (start_instrumented
&& end_instrumented
)
1534 if (!is_gimple_constant (len
))
1536 /* So, the length of the memory area to asan-protect is
1537 non-constant. Let's guard the generated instrumentation code
1542 //asan instrumentation code goes here.
1544 // falltrough instructions, starting with *ITER. */
1546 gimple g
= gimple_build_cond (NE_EXPR
,
1548 build_int_cst (TREE_TYPE (len
), 0),
1549 NULL_TREE
, NULL_TREE
);
1550 gimple_set_location (g
, location
);
1551 insert_if_then_before_iter (g
, iter
, /*then_more_likely_p=*/true,
1552 &then_bb
, &fallthrough_bb
);
1553 /* Note that fallthrough_bb starts with the statement that was
1554 pointed to by ITER. */
1556 /* The 'then block' of the 'if (len != 0) condition is where
1557 we'll generate the asan instrumentation code now. */
1558 gsi
= gsi_last_bb (then_bb
);
1561 if (!start_instrumented
)
1563 /* Instrument the beginning of the memory region to be accessed,
1564 and arrange for the rest of the intrumentation code to be
1565 inserted in the then block *after* the current gsi. */
1566 build_check_stmt (location
, base
, &gsi
, /*before_p=*/true, is_store
, 1);
1569 /* We are in the case where the length of the region is not
1570 constant; so instrumentation code is being generated in the
1571 'then block' of the 'if (len != 0) condition. Let's arrange
1572 for the subsequent instrumentation statements to go in the
1574 gsi
= gsi_last_bb (then_bb
);
1578 /* Don't remember this access as instrumented, if length
1579 is unknown. It might be zero and not being actually
1580 instrumented, so we can't rely on it being instrumented. */
1581 update_mem_ref_hash_table (base
, 1);
1585 if (end_instrumented
)
1588 /* We want to instrument the access at the end of the memory region,
1589 which is at (base + len - 1). */
1591 /* offset = len - 1; */
1592 len
= unshare_expr (len
);
1594 gimple_seq seq
= NULL
;
1595 if (TREE_CODE (len
) == INTEGER_CST
)
1596 offset
= fold_build2 (MINUS_EXPR
, size_type_node
,
1597 fold_convert (size_type_node
, len
),
1598 build_int_cst (size_type_node
, 1));
1604 if (TREE_CODE (len
) != SSA_NAME
)
1606 t
= make_ssa_name (TREE_TYPE (len
), NULL
);
1607 g
= gimple_build_assign_with_ops (TREE_CODE (len
), t
, len
, NULL
);
1608 gimple_set_location (g
, location
);
1609 gimple_seq_add_stmt_without_update (&seq
, g
);
1612 if (!useless_type_conversion_p (size_type_node
, TREE_TYPE (len
)))
1614 t
= make_ssa_name (size_type_node
, NULL
);
1615 g
= gimple_build_assign_with_ops (NOP_EXPR
, t
, len
, NULL
);
1616 gimple_set_location (g
, location
);
1617 gimple_seq_add_stmt_without_update (&seq
, g
);
1621 t
= make_ssa_name (size_type_node
, NULL
);
1622 g
= gimple_build_assign_with_ops (MINUS_EXPR
, t
, len
,
1623 build_int_cst (size_type_node
, 1));
1624 gimple_set_location (g
, location
);
1625 gimple_seq_add_stmt_without_update (&seq
, g
);
1626 offset
= gimple_assign_lhs (g
);
1630 base
= unshare_expr (base
);
1632 gimple_build_assign_with_ops (TREE_CODE (base
),
1633 make_ssa_name (TREE_TYPE (base
), NULL
),
1635 gimple_set_location (region_end
, location
);
1636 gimple_seq_add_stmt_without_update (&seq
, region_end
);
1638 /* _2 = _1 + offset; */
1640 gimple_build_assign_with_ops (POINTER_PLUS_EXPR
,
1641 make_ssa_name (TREE_TYPE (base
), NULL
),
1642 gimple_assign_lhs (region_end
),
1644 gimple_set_location (region_end
, location
);
1645 gimple_seq_add_stmt_without_update (&seq
, region_end
);
1646 gsi_insert_seq_before (&gsi
, seq
, GSI_SAME_STMT
);
1648 /* instrument access at _2; */
1649 gsi
= gsi_for_stmt (region_end
);
1650 build_check_stmt (location
, gimple_assign_lhs (region_end
),
1651 &gsi
, /*before_p=*/false, is_store
, 1);
1653 if (then_bb
== NULL
)
1654 update_mem_ref_hash_table (end
, 1);
1656 *iter
= gsi_for_stmt (gsi_stmt (*iter
));
1659 /* Instrument the call (to the builtin strlen function) pointed to by
1662 This function instruments the access to the first byte of the
1663 argument, right before the call. After the call it instruments the
1664 access to the last byte of the argument; it uses the result of the
1665 call to deduce the offset of that last byte.
1667 Upon completion, iff the call has actually been instrumented, this
1668 function returns TRUE and *ITER points to the statement logically
1669 following the built-in strlen function call *ITER was initially
1670 pointing to. Otherwise, the function returns FALSE and *ITER
1671 remains unchanged. */
1674 instrument_strlen_call (gimple_stmt_iterator
*iter
)
1676 gimple call
= gsi_stmt (*iter
);
1677 gcc_assert (is_gimple_call (call
));
1679 tree callee
= gimple_call_fndecl (call
);
1680 gcc_assert (is_builtin_fn (callee
)
1681 && DECL_BUILT_IN_CLASS (callee
) == BUILT_IN_NORMAL
1682 && DECL_FUNCTION_CODE (callee
) == BUILT_IN_STRLEN
);
1684 tree len
= gimple_call_lhs (call
);
1686 /* Some passes might clear the return value of the strlen call;
1687 bail out in that case. Return FALSE as we are not advancing
1690 gcc_assert (INTEGRAL_TYPE_P (TREE_TYPE (len
)));
1692 location_t loc
= gimple_location (call
);
1693 tree str_arg
= gimple_call_arg (call
, 0);
1695 /* Instrument the access to the first byte of str_arg. i.e:
1697 _1 = str_arg; instrument (_1); */
1698 tree cptr_type
= build_pointer_type (char_type_node
);
1699 gimple str_arg_ssa
=
1700 gimple_build_assign_with_ops (NOP_EXPR
,
1701 make_ssa_name (cptr_type
, NULL
),
1703 gimple_set_location (str_arg_ssa
, loc
);
1704 gimple_stmt_iterator gsi
= *iter
;
1705 gsi_insert_before (&gsi
, str_arg_ssa
, GSI_NEW_STMT
);
1706 build_check_stmt (loc
, gimple_assign_lhs (str_arg_ssa
), &gsi
,
1707 /*before_p=*/false, /*is_store=*/false, 1);
1709 /* If we initially had an instruction like:
1711 int n = strlen (str)
1713 we now want to instrument the access to str[n], after the
1714 instruction above.*/
1716 /* So let's build the access to str[n] that is, access through the
1717 pointer_plus expr: (_1 + len). */
1719 gimple_build_assign_with_ops (POINTER_PLUS_EXPR
,
1720 make_ssa_name (cptr_type
, NULL
),
1721 gimple_assign_lhs (str_arg_ssa
),
1723 gimple_set_location (stmt
, loc
);
1724 gsi_insert_after (&gsi
, stmt
, GSI_NEW_STMT
);
1726 build_check_stmt (loc
, gimple_assign_lhs (stmt
), &gsi
,
1727 /*before_p=*/false, /*is_store=*/false, 1);
1729 /* Ensure that iter points to the statement logically following the
1730 one it was initially pointing to. */
1732 /* As *ITER has been advanced to point to the next statement, let's
1733 return true to inform transform_statements that it shouldn't
1734 advance *ITER anymore; otherwises it will skip that next
1735 statement, which wouldn't be instrumented. */
1739 /* Instrument the call to a built-in memory access function that is
1740 pointed to by the iterator ITER.
1742 Upon completion, return TRUE iff *ITER has been advanced to the
1743 statement following the one it was originally pointing to. */
1746 instrument_builtin_call (gimple_stmt_iterator
*iter
)
1748 bool iter_advanced_p
= false;
1749 gimple call
= gsi_stmt (*iter
);
1751 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
1753 tree callee
= gimple_call_fndecl (call
);
1754 location_t loc
= gimple_location (call
);
1756 if (DECL_FUNCTION_CODE (callee
) == BUILT_IN_STRLEN
)
1757 iter_advanced_p
= instrument_strlen_call (iter
);
1760 asan_mem_ref src0
, src1
, dest
;
1761 asan_mem_ref_init (&src0
, NULL
, 1);
1762 asan_mem_ref_init (&src1
, NULL
, 1);
1763 asan_mem_ref_init (&dest
, NULL
, 1);
1765 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
1766 bool src0_is_store
= false, src1_is_store
= false,
1767 dest_is_store
= false, dest_is_deref
= false;
1769 if (get_mem_refs_of_builtin_call (call
,
1770 &src0
, &src0_len
, &src0_is_store
,
1771 &src1
, &src1_len
, &src1_is_store
,
1772 &dest
, &dest_len
, &dest_is_store
,
1777 instrument_derefs (iter
, dest
.start
, loc
, dest_is_store
);
1779 iter_advanced_p
= true;
1781 else if (src0_len
|| src1_len
|| dest_len
)
1783 if (src0
.start
!= NULL_TREE
)
1784 instrument_mem_region_access (src0
.start
, src0_len
,
1785 iter
, loc
, /*is_store=*/false);
1786 if (src1
.start
!= NULL_TREE
)
1787 instrument_mem_region_access (src1
.start
, src1_len
,
1788 iter
, loc
, /*is_store=*/false);
1789 if (dest
.start
!= NULL_TREE
)
1790 instrument_mem_region_access (dest
.start
, dest_len
,
1791 iter
, loc
, /*is_store=*/true);
1792 *iter
= gsi_for_stmt (call
);
1794 iter_advanced_p
= true;
1798 return iter_advanced_p
;
1801 /* Instrument the assignment statement ITER if it is subject to
1802 instrumentation. Return TRUE iff instrumentation actually
1803 happened. In that case, the iterator ITER is advanced to the next
1804 logical expression following the one initially pointed to by ITER,
1805 and the relevant memory reference that which access has been
1806 instrumented is added to the memory references hash table. */
1809 maybe_instrument_assignment (gimple_stmt_iterator
*iter
)
1811 gimple s
= gsi_stmt (*iter
);
1813 gcc_assert (gimple_assign_single_p (s
));
1815 tree ref_expr
= NULL_TREE
;
1816 bool is_store
, is_instrumented
= false;
1818 if (gimple_store_p (s
))
1820 ref_expr
= gimple_assign_lhs (s
);
1822 instrument_derefs (iter
, ref_expr
,
1823 gimple_location (s
),
1825 is_instrumented
= true;
1828 if (gimple_assign_load_p (s
))
1830 ref_expr
= gimple_assign_rhs1 (s
);
1832 instrument_derefs (iter
, ref_expr
,
1833 gimple_location (s
),
1835 is_instrumented
= true;
1838 if (is_instrumented
)
1841 return is_instrumented
;
1844 /* Instrument the function call pointed to by the iterator ITER, if it
1845 is subject to instrumentation. At the moment, the only function
1846 calls that are instrumented are some built-in functions that access
1847 memory. Look at instrument_builtin_call to learn more.
1849 Upon completion return TRUE iff *ITER was advanced to the statement
1850 following the one it was originally pointing to. */
1853 maybe_instrument_call (gimple_stmt_iterator
*iter
)
1855 gimple stmt
= gsi_stmt (*iter
);
1856 bool is_builtin
= gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
);
1858 if (is_builtin
&& instrument_builtin_call (iter
))
1861 if (gimple_call_noreturn_p (stmt
))
1865 tree callee
= gimple_call_fndecl (stmt
);
1866 switch (DECL_FUNCTION_CODE (callee
))
1868 case BUILT_IN_UNREACHABLE
:
1870 /* Don't instrument these. */
1874 tree decl
= builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN
);
1875 gimple g
= gimple_build_call (decl
, 0);
1876 gimple_set_location (g
, gimple_location (stmt
));
1877 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1882 /* Walk each instruction of all basic block and instrument those that
1883 represent memory references: loads, stores, or function calls.
1884 In a given basic block, this function avoids instrumenting memory
1885 references that have already been instrumented. */
1888 transform_statements (void)
1890 basic_block bb
, last_bb
= NULL
;
1891 gimple_stmt_iterator i
;
1892 int saved_last_basic_block
= last_basic_block
;
1896 basic_block prev_bb
= bb
;
1898 if (bb
->index
>= saved_last_basic_block
) continue;
1900 /* Flush the mem ref hash table, if current bb doesn't have
1901 exactly one predecessor, or if that predecessor (skipping
1902 over asan created basic blocks) isn't the last processed
1903 basic block. Thus we effectively flush on extended basic
1904 block boundaries. */
1905 while (single_pred_p (prev_bb
))
1907 prev_bb
= single_pred (prev_bb
);
1908 if (prev_bb
->index
< saved_last_basic_block
)
1911 if (prev_bb
!= last_bb
)
1912 empty_mem_ref_hash_table ();
1915 for (i
= gsi_start_bb (bb
); !gsi_end_p (i
);)
1917 gimple s
= gsi_stmt (i
);
1919 if (has_stmt_been_instrumented_p (s
))
1921 else if (gimple_assign_single_p (s
)
1922 && maybe_instrument_assignment (&i
))
1923 /* Nothing to do as maybe_instrument_assignment advanced
1925 else if (is_gimple_call (s
) && maybe_instrument_call (&i
))
1926 /* Nothing to do as maybe_instrument_call
1927 advanced the iterator I. */;
1930 /* No instrumentation happened.
1932 If the current instruction is a function call that
1933 might free something, let's forget about the memory
1934 references that got instrumented. Otherwise we might
1935 miss some instrumentation opportunities. */
1936 if (is_gimple_call (s
) && !nonfreeing_call_p (s
))
1937 empty_mem_ref_hash_table ();
1943 free_mem_ref_resources ();
1947 struct __asan_global
1951 uptr __size_with_redzone;
1953 const void *__module_name;
1954 uptr __has_dynamic_init;
1958 asan_global_struct (void)
1960 static const char *field_names
[6]
1961 = { "__beg", "__size", "__size_with_redzone",
1962 "__name", "__module_name", "__has_dynamic_init" };
1963 tree fields
[6], ret
;
1966 ret
= make_node (RECORD_TYPE
);
1967 for (i
= 0; i
< 6; i
++)
1970 = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
,
1971 get_identifier (field_names
[i
]),
1972 (i
== 0 || i
== 3) ? const_ptr_type_node
1973 : pointer_sized_int_node
);
1974 DECL_CONTEXT (fields
[i
]) = ret
;
1976 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
1978 TYPE_FIELDS (ret
) = fields
[0];
1979 TYPE_NAME (ret
) = get_identifier ("__asan_global");
1984 /* Append description of a single global DECL into vector V.
1985 TYPE is __asan_global struct type as returned by asan_global_struct. */
1988 asan_add_global (tree decl
, tree type
, vec
<constructor_elt
, va_gc
> *v
)
1990 tree init
, uptr
= TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type
)));
1991 unsigned HOST_WIDE_INT size
;
1992 tree str_cst
, module_name_cst
, refdecl
= decl
;
1993 vec
<constructor_elt
, va_gc
> *vinner
= NULL
;
1995 pretty_printer asan_pp
, module_name_pp
;
1997 if (DECL_NAME (decl
))
1998 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
2000 pp_string (&asan_pp
, "<unknown>");
2001 str_cst
= asan_pp_string (&asan_pp
);
2003 pp_string (&module_name_pp
, main_input_filename
);
2004 module_name_cst
= asan_pp_string (&module_name_pp
);
2006 if (asan_needs_local_alias (decl
))
2009 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", vec_safe_length (v
) + 1);
2010 refdecl
= build_decl (DECL_SOURCE_LOCATION (decl
),
2011 VAR_DECL
, get_identifier (buf
), TREE_TYPE (decl
));
2012 TREE_ADDRESSABLE (refdecl
) = TREE_ADDRESSABLE (decl
);
2013 TREE_READONLY (refdecl
) = TREE_READONLY (decl
);
2014 TREE_THIS_VOLATILE (refdecl
) = TREE_THIS_VOLATILE (decl
);
2015 DECL_GIMPLE_REG_P (refdecl
) = DECL_GIMPLE_REG_P (decl
);
2016 DECL_ARTIFICIAL (refdecl
) = DECL_ARTIFICIAL (decl
);
2017 DECL_IGNORED_P (refdecl
) = DECL_IGNORED_P (decl
);
2018 TREE_STATIC (refdecl
) = 1;
2019 TREE_PUBLIC (refdecl
) = 0;
2020 TREE_USED (refdecl
) = 1;
2021 assemble_alias (refdecl
, DECL_ASSEMBLER_NAME (decl
));
2024 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2025 fold_convert (const_ptr_type_node
,
2026 build_fold_addr_expr (refdecl
)));
2027 size
= tree_low_cst (DECL_SIZE_UNIT (decl
), 1);
2028 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2029 size
+= asan_red_zone_size (size
);
2030 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2031 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2032 fold_convert (const_ptr_type_node
, str_cst
));
2033 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2034 fold_convert (const_ptr_type_node
, module_name_cst
));
2035 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, 0));
2036 init
= build_constructor (type
, vinner
);
2037 CONSTRUCTOR_APPEND_ELT (v
, NULL_TREE
, init
);
2040 /* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2042 initialize_sanitizer_builtins (void)
2046 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT
))
2049 tree BT_FN_VOID
= build_function_type_list (void_type_node
, NULL_TREE
);
2051 = build_function_type_list (void_type_node
, ptr_type_node
, NULL_TREE
);
2052 tree BT_FN_VOID_PTR_PTR
2053 = build_function_type_list (void_type_node
, ptr_type_node
,
2054 ptr_type_node
, NULL_TREE
);
2055 tree BT_FN_VOID_PTR_PTR_PTR
2056 = build_function_type_list (void_type_node
, ptr_type_node
,
2057 ptr_type_node
, ptr_type_node
, NULL_TREE
);
2058 tree BT_FN_VOID_PTR_PTRMODE
2059 = build_function_type_list (void_type_node
, ptr_type_node
,
2060 pointer_sized_int_node
, NULL_TREE
);
2062 = build_function_type_list (void_type_node
, integer_type_node
, NULL_TREE
);
2063 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[5];
2064 tree BT_FN_IX_CONST_VPTR_INT
[5];
2065 tree BT_FN_IX_VPTR_IX_INT
[5];
2066 tree BT_FN_VOID_VPTR_IX_INT
[5];
2068 = build_pointer_type (build_qualified_type (void_type_node
,
2069 TYPE_QUAL_VOLATILE
));
2071 = build_pointer_type (build_qualified_type (void_type_node
,
2075 = lang_hooks
.types
.type_for_size (BOOL_TYPE_SIZE
, 1);
2077 for (i
= 0; i
< 5; i
++)
2079 tree ix
= build_nonstandard_integer_type (BITS_PER_UNIT
* (1 << i
), 1);
2080 BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[i
]
2081 = build_function_type_list (boolt
, vptr
, ptr_type_node
, ix
,
2082 integer_type_node
, integer_type_node
,
2084 BT_FN_IX_CONST_VPTR_INT
[i
]
2085 = build_function_type_list (ix
, cvptr
, integer_type_node
, NULL_TREE
);
2086 BT_FN_IX_VPTR_IX_INT
[i
]
2087 = build_function_type_list (ix
, vptr
, ix
, integer_type_node
,
2089 BT_FN_VOID_VPTR_IX_INT
[i
]
2090 = build_function_type_list (void_type_node
, vptr
, ix
,
2091 integer_type_node
, NULL_TREE
);
2093 #define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2094 #define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2095 #define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2096 #define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2097 #define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2098 #define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2099 #define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2100 #define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2101 #define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2102 #define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2103 #define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2104 #define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2105 #define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2106 #define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2107 #define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2108 #define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2109 #define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2110 #define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2111 #define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2112 #define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2113 #undef ATTR_NOTHROW_LEAF_LIST
2114 #define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2115 #undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2116 #define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2117 #undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2118 #define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2119 #undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2120 #define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2121 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2122 #undef ATTR_COLD_NOTHROW_LEAF_LIST
2123 #define ATTR_COLD_NOTHROW_LEAF_LIST \
2124 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2125 #undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2126 #define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2127 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2128 #undef DEF_SANITIZER_BUILTIN
2129 #define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2130 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2131 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2132 set_call_expr_flags (decl, ATTRS); \
2133 set_builtin_decl (ENUM, decl, true);
2135 #include "sanitizer.def"
2137 #undef DEF_SANITIZER_BUILTIN
2140 /* Called via htab_traverse. Count number of emitted
2141 STRING_CSTs in the constant hash table. */
2144 count_string_csts (void **slot
, void *data
)
2146 struct constant_descriptor_tree
*desc
2147 = (struct constant_descriptor_tree
*) *slot
;
2148 if (TREE_CODE (desc
->value
) == STRING_CST
2149 && TREE_ASM_WRITTEN (desc
->value
)
2150 && asan_protect_global (desc
->value
))
2151 ++*((unsigned HOST_WIDE_INT
*) data
);
2155 /* Helper structure to pass two parameters to
2158 struct asan_add_string_csts_data
2161 vec
<constructor_elt
, va_gc
> *v
;
2164 /* Called via htab_traverse. Call asan_add_global
2165 on emitted STRING_CSTs from the constant hash table. */
2168 add_string_csts (void **slot
, void *data
)
2170 struct constant_descriptor_tree
*desc
2171 = (struct constant_descriptor_tree
*) *slot
;
2172 if (TREE_CODE (desc
->value
) == STRING_CST
2173 && TREE_ASM_WRITTEN (desc
->value
)
2174 && asan_protect_global (desc
->value
))
2176 struct asan_add_string_csts_data
*aascd
2177 = (struct asan_add_string_csts_data
*) data
;
2178 asan_add_global (SYMBOL_REF_DECL (XEXP (desc
->rtl
, 0)),
2179 aascd
->type
, aascd
->v
);
2184 /* Needs to be GTY(()), because cgraph_build_static_cdtor may
2185 invoke ggc_collect. */
2186 static GTY(()) tree asan_ctor_statements
;
2188 /* Module-level instrumentation.
2189 - Insert __asan_init_vN() into the list of CTORs.
2190 - TODO: insert redzones around globals.
2194 asan_finish_file (void)
2196 struct varpool_node
*vnode
;
2197 unsigned HOST_WIDE_INT gcount
= 0;
2199 if (shadow_ptr_types
[0] == NULL_TREE
)
2200 asan_init_shadow_ptr_types ();
2201 /* Avoid instrumenting code in the asan ctors/dtors.
2202 We don't need to insert padding after the description strings,
2203 nor after .LASAN* array. */
2204 flag_sanitize
&= ~SANITIZE_ADDRESS
;
2206 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_INIT
);
2207 append_to_statement_list (build_call_expr (fn
, 0), &asan_ctor_statements
);
2208 FOR_EACH_DEFINED_VARIABLE (vnode
)
2209 if (TREE_ASM_WRITTEN (vnode
->decl
)
2210 && asan_protect_global (vnode
->decl
))
2212 htab_t const_desc_htab
= constant_pool_htab ();
2213 htab_traverse (const_desc_htab
, count_string_csts
, &gcount
);
2216 tree type
= asan_global_struct (), var
, ctor
;
2217 tree dtor_statements
= NULL_TREE
;
2218 vec
<constructor_elt
, va_gc
> *v
;
2221 type
= build_array_type_nelts (type
, gcount
);
2222 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", 0);
2223 var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (buf
),
2225 TREE_STATIC (var
) = 1;
2226 TREE_PUBLIC (var
) = 0;
2227 DECL_ARTIFICIAL (var
) = 1;
2228 DECL_IGNORED_P (var
) = 1;
2229 vec_alloc (v
, gcount
);
2230 FOR_EACH_DEFINED_VARIABLE (vnode
)
2231 if (TREE_ASM_WRITTEN (vnode
->decl
)
2232 && asan_protect_global (vnode
->decl
))
2233 asan_add_global (vnode
->decl
, TREE_TYPE (type
), v
);
2234 struct asan_add_string_csts_data aascd
;
2235 aascd
.type
= TREE_TYPE (type
);
2237 htab_traverse (const_desc_htab
, add_string_csts
, &aascd
);
2238 ctor
= build_constructor (type
, v
);
2239 TREE_CONSTANT (ctor
) = 1;
2240 TREE_STATIC (ctor
) = 1;
2241 DECL_INITIAL (var
) = ctor
;
2242 varpool_assemble_decl (varpool_node_for_decl (var
));
2244 fn
= builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS
);
2245 tree gcount_tree
= build_int_cst (pointer_sized_int_node
, gcount
);
2246 append_to_statement_list (build_call_expr (fn
, 2,
2247 build_fold_addr_expr (var
),
2249 &asan_ctor_statements
);
2251 fn
= builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS
);
2252 append_to_statement_list (build_call_expr (fn
, 2,
2253 build_fold_addr_expr (var
),
2256 cgraph_build_static_cdtor ('D', dtor_statements
,
2257 MAX_RESERVED_INIT_PRIORITY
- 1);
2259 cgraph_build_static_cdtor ('I', asan_ctor_statements
,
2260 MAX_RESERVED_INIT_PRIORITY
- 1);
2261 flag_sanitize
|= SANITIZE_ADDRESS
;
2264 /* Instrument the current function. */
2267 asan_instrument (void)
2269 if (shadow_ptr_types
[0] == NULL_TREE
)
2270 asan_init_shadow_ptr_types ();
2271 transform_statements ();
2278 return (flag_sanitize
& SANITIZE_ADDRESS
) != 0
2279 && !lookup_attribute ("no_sanitize_address",
2280 DECL_ATTRIBUTES (current_function_decl
));
2285 const pass_data pass_data_asan
=
2287 GIMPLE_PASS
, /* type */
2289 OPTGROUP_NONE
, /* optinfo_flags */
2290 true, /* has_gate */
2291 true, /* has_execute */
2292 TV_NONE
, /* tv_id */
2293 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2294 0, /* properties_provided */
2295 0, /* properties_destroyed */
2296 0, /* todo_flags_start */
2297 ( TODO_verify_flow
| TODO_verify_stmts
2298 | TODO_update_ssa
), /* todo_flags_finish */
2301 class pass_asan
: public gimple_opt_pass
2304 pass_asan (gcc::context
*ctxt
)
2305 : gimple_opt_pass (pass_data_asan
, ctxt
)
2308 /* opt_pass methods: */
2309 opt_pass
* clone () { return new pass_asan (m_ctxt
); }
2310 bool gate () { return gate_asan (); }
2311 unsigned int execute () { return asan_instrument (); }
2313 }; // class pass_asan
2318 make_pass_asan (gcc::context
*ctxt
)
2320 return new pass_asan (ctxt
);
2326 return !optimize
&& gate_asan ();
2331 const pass_data pass_data_asan_O0
=
2333 GIMPLE_PASS
, /* type */
2335 OPTGROUP_NONE
, /* optinfo_flags */
2336 true, /* has_gate */
2337 true, /* has_execute */
2338 TV_NONE
, /* tv_id */
2339 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2340 0, /* properties_provided */
2341 0, /* properties_destroyed */
2342 0, /* todo_flags_start */
2343 ( TODO_verify_flow
| TODO_verify_stmts
2344 | TODO_update_ssa
), /* todo_flags_finish */
2347 class pass_asan_O0
: public gimple_opt_pass
2350 pass_asan_O0 (gcc::context
*ctxt
)
2351 : gimple_opt_pass (pass_data_asan_O0
, ctxt
)
2354 /* opt_pass methods: */
2355 bool gate () { return gate_asan_O0 (); }
2356 unsigned int execute () { return asan_instrument (); }
2358 }; // class pass_asan_O0
2363 make_pass_asan_O0 (gcc::context
*ctxt
)
2365 return new pass_asan_O0 (ctxt
);
2368 #include "gt-asan.h"