1 /* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2015 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
31 #include "alloc-pool.h"
32 #include "tree-pass.h"
34 #include "stringpool.h"
35 #include "tree-ssanames.h"
40 #include "gimple-pretty-print.h"
42 #include "fold-const.h"
44 #include "internal-fn.h"
46 #include "gimple-iterator.h"
49 #include "stor-layout.h"
50 #include "tree-iterator.h"
58 #include "langhooks.h"
60 #include "gimple-builder.h"
66 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
67 with <2x slowdown on average.
69 The tool consists of two parts:
70 instrumentation module (this file) and a run-time library.
71 The instrumentation module adds a run-time check before every memory insn.
72 For a 8- or 16- byte load accessing address X:
73 ShadowAddr = (X >> 3) + Offset
74 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
76 __asan_report_load8(X);
77 For a load of N bytes (N=1, 2 or 4) from address X:
78 ShadowAddr = (X >> 3) + Offset
79 ShadowValue = *(char*)ShadowAddr;
81 if ((X & 7) + N - 1 > ShadowValue)
82 __asan_report_loadN(X);
83 Stores are instrumented similarly, but using __asan_report_storeN functions.
84 A call too __asan_init_vN() is inserted to the list of module CTORs.
85 N is the version number of the AddressSanitizer API. The changes between the
86 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
88 The run-time library redefines malloc (so that redzone are inserted around
89 the allocated memory) and free (so that reuse of free-ed memory is delayed),
90 provides __asan_report* and __asan_init_vN functions.
93 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
95 The current implementation supports detection of out-of-bounds and
96 use-after-free in the heap, on the stack and for global variables.
98 [Protection of stack variables]
100 To understand how detection of out-of-bounds and use-after-free works
101 for stack variables, lets look at this example on x86_64 where the
102 stack grows downward:
116 For this function, the stack protected by asan will be organized as
117 follows, from the top of the stack to the bottom:
119 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
121 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
122 the next slot be 32 bytes aligned; this one is called Partial
123 Redzone; this 32 bytes alignment is an asan constraint]
125 Slot 3/ [24 bytes for variable 'a']
127 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
129 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
131 Slot 6/ [8 bytes for variable 'b']
133 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
136 The 32 bytes of LEFT red zone at the bottom of the stack can be
139 1/ The first 8 bytes contain a magical asan number that is always
142 2/ The following 8 bytes contains a pointer to a string (to be
143 parsed at runtime by the runtime asan library), which format is
146 "<function-name> <space> <num-of-variables-on-the-stack>
147 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
148 <length-of-var-in-bytes> ){n} "
150 where '(...){n}' means the content inside the parenthesis occurs 'n'
151 times, with 'n' being the number of variables on the stack.
153 3/ The following 8 bytes contain the PC of the current function which
154 will be used by the run-time library to print an error message.
156 4/ The following 8 bytes are reserved for internal use by the run-time.
158 The shadow memory for that stack layout is going to look like this:
160 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
161 The F1 byte pattern is a magic number called
162 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
163 the memory for that shadow byte is part of a the LEFT red zone
164 intended to seat at the bottom of the variables on the stack.
166 - content of shadow memory 8 bytes for slots 6 and 5:
167 0xF4F4F400. The F4 byte pattern is a magic number
168 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
169 memory region for this shadow byte is a PARTIAL red zone
170 intended to pad a variable A, so that the slot following
171 {A,padding} is 32 bytes aligned.
173 Note that the fact that the least significant byte of this
174 shadow memory content is 00 means that 8 bytes of its
175 corresponding memory (which corresponds to the memory of
176 variable 'b') is addressable.
178 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
179 The F2 byte pattern is a magic number called
180 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
181 region for this shadow byte is a MIDDLE red zone intended to
182 seat between two 32 aligned slots of {variable,padding}.
184 - content of shadow memory 8 bytes for slot 3 and 2:
185 0xF4000000. This represents is the concatenation of
186 variable 'a' and the partial red zone following it, like what we
187 had for variable 'b'. The least significant 3 bytes being 00
188 means that the 3 bytes of variable 'a' are addressable.
190 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
191 The F3 byte pattern is a magic number called
192 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
193 region for this shadow byte is a RIGHT red zone intended to seat
194 at the top of the variables of the stack.
196 Note that the real variable layout is done in expand_used_vars in
197 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
198 stack variables as well as the different red zones, emits some
199 prologue code to populate the shadow memory as to poison (mark as
200 non-accessible) the regions of the red zones and mark the regions of
201 stack variables as accessible, and emit some epilogue code to
202 un-poison (mark as accessible) the regions of red zones right before
205 [Protection of global variables]
207 The basic idea is to insert a red zone between two global variables
208 and install a constructor function that calls the asan runtime to do
209 the populating of the relevant shadow memory regions at load time.
211 So the global variables are laid out as to insert a red zone between
212 them. The size of the red zones is so that each variable starts on a
215 Then a constructor function is installed so that, for each global
216 variable, it calls the runtime asan library function
217 __asan_register_globals_with an instance of this type:
221 // Address of the beginning of the global variable.
224 // Initial size of the global variable.
227 // Size of the global variable + size of the red zone. This
228 // size is 32 bytes aligned.
229 uptr __size_with_redzone;
231 // Name of the global variable.
234 // Name of the module where the global variable is declared.
235 const void *__module_name;
237 // 1 if it has dynamic initialization, 0 otherwise.
238 uptr __has_dynamic_init;
240 // A pointer to struct that contains source location, could be NULL.
241 __asan_global_source_location *__location;
244 A destructor function that calls the runtime asan library function
245 _asan_unregister_globals is also installed. */
247 static unsigned HOST_WIDE_INT asan_shadow_offset_value
;
248 static bool asan_shadow_offset_computed
;
249 static vec
<char *> sanitized_sections
;
251 /* Sets shadow offset to value in string VAL. */
254 set_asan_shadow_offset (const char *val
)
259 #ifdef HAVE_LONG_LONG
260 asan_shadow_offset_value
= strtoull (val
, &endp
, 0);
262 asan_shadow_offset_value
= strtoul (val
, &endp
, 0);
264 if (!(*val
!= '\0' && *endp
== '\0' && errno
== 0))
267 asan_shadow_offset_computed
= true;
272 /* Set list of user-defined sections that need to be sanitized. */
275 set_sanitized_sections (const char *sections
)
279 FOR_EACH_VEC_ELT (sanitized_sections
, i
, pat
)
281 sanitized_sections
.truncate (0);
283 for (const char *s
= sections
; *s
; )
286 for (end
= s
; *end
&& *end
!= ','; ++end
);
287 size_t len
= end
- s
;
288 sanitized_sections
.safe_push (xstrndup (s
, len
));
289 s
= *end
? end
+ 1 : end
;
293 /* Checks whether section SEC should be sanitized. */
296 section_sanitized_p (const char *sec
)
300 FOR_EACH_VEC_ELT (sanitized_sections
, i
, pat
)
301 if (fnmatch (pat
, sec
, FNM_PERIOD
) == 0)
306 /* Returns Asan shadow offset. */
308 static unsigned HOST_WIDE_INT
309 asan_shadow_offset ()
311 if (!asan_shadow_offset_computed
)
313 asan_shadow_offset_computed
= true;
314 asan_shadow_offset_value
= targetm
.asan_shadow_offset ();
316 return asan_shadow_offset_value
;
319 alias_set_type asan_shadow_set
= -1;
321 /* Pointer types to 1 resp. 2 byte integers in shadow memory. A separate
322 alias set is used for all shadow memory accesses. */
323 static GTY(()) tree shadow_ptr_types
[2];
325 /* Decl for __asan_option_detect_stack_use_after_return. */
326 static GTY(()) tree asan_detect_stack_use_after_return
;
328 /* Various flags for Asan builtins. */
329 enum asan_check_flags
331 ASAN_CHECK_STORE
= 1 << 0,
332 ASAN_CHECK_SCALAR_ACCESS
= 1 << 1,
333 ASAN_CHECK_NON_ZERO_LEN
= 1 << 2,
334 ASAN_CHECK_LAST
= 1 << 3
337 /* Hashtable support for memory references used by gimple
340 /* This type represents a reference to a memory region. */
343 /* The expression of the beginning of the memory region. */
346 /* The size of the access. */
347 HOST_WIDE_INT access_size
;
350 object_allocator
<asan_mem_ref
> asan_mem_ref_pool ("asan_mem_ref");
352 /* Initializes an instance of asan_mem_ref. */
355 asan_mem_ref_init (asan_mem_ref
*ref
, tree start
, HOST_WIDE_INT access_size
)
358 ref
->access_size
= access_size
;
361 /* Allocates memory for an instance of asan_mem_ref into the memory
362 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
363 START is the address of (or the expression pointing to) the
364 beginning of memory reference. ACCESS_SIZE is the size of the
365 access to the referenced memory. */
368 asan_mem_ref_new (tree start
, HOST_WIDE_INT access_size
)
370 asan_mem_ref
*ref
= asan_mem_ref_pool
.allocate ();
372 asan_mem_ref_init (ref
, start
, access_size
);
376 /* This builds and returns a pointer to the end of the memory region
377 that starts at START and of length LEN. */
380 asan_mem_ref_get_end (tree start
, tree len
)
382 if (len
== NULL_TREE
|| integer_zerop (len
))
385 if (!ptrofftype_p (len
))
386 len
= convert_to_ptrofftype (len
);
388 return fold_build2 (POINTER_PLUS_EXPR
, TREE_TYPE (start
), start
, len
);
391 /* Return a tree expression that represents the end of the referenced
392 memory region. Beware that this function can actually build a new
396 asan_mem_ref_get_end (const asan_mem_ref
*ref
, tree len
)
398 return asan_mem_ref_get_end (ref
->start
, len
);
401 struct asan_mem_ref_hasher
: nofree_ptr_hash
<asan_mem_ref
>
403 static inline hashval_t
hash (const asan_mem_ref
*);
404 static inline bool equal (const asan_mem_ref
*, const asan_mem_ref
*);
407 /* Hash a memory reference. */
410 asan_mem_ref_hasher::hash (const asan_mem_ref
*mem_ref
)
412 return iterative_hash_expr (mem_ref
->start
, 0);
415 /* Compare two memory references. We accept the length of either
416 memory references to be NULL_TREE. */
419 asan_mem_ref_hasher::equal (const asan_mem_ref
*m1
,
420 const asan_mem_ref
*m2
)
422 return operand_equal_p (m1
->start
, m2
->start
, 0);
425 static hash_table
<asan_mem_ref_hasher
> *asan_mem_ref_ht
;
427 /* Returns a reference to the hash table containing memory references.
428 This function ensures that the hash table is created. Note that
429 this hash table is updated by the function
430 update_mem_ref_hash_table. */
432 static hash_table
<asan_mem_ref_hasher
> *
433 get_mem_ref_hash_table ()
435 if (!asan_mem_ref_ht
)
436 asan_mem_ref_ht
= new hash_table
<asan_mem_ref_hasher
> (10);
438 return asan_mem_ref_ht
;
441 /* Clear all entries from the memory references hash table. */
444 empty_mem_ref_hash_table ()
447 asan_mem_ref_ht
->empty ();
450 /* Free the memory references hash table. */
453 free_mem_ref_resources ()
455 delete asan_mem_ref_ht
;
456 asan_mem_ref_ht
= NULL
;
458 asan_mem_ref_pool
.release ();
461 /* Return true iff the memory reference REF has been instrumented. */
464 has_mem_ref_been_instrumented (tree ref
, HOST_WIDE_INT access_size
)
467 asan_mem_ref_init (&r
, ref
, access_size
);
469 asan_mem_ref
*saved_ref
= get_mem_ref_hash_table ()->find (&r
);
470 return saved_ref
&& saved_ref
->access_size
>= access_size
;
473 /* Return true iff the memory reference REF has been instrumented. */
476 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
)
478 return has_mem_ref_been_instrumented (ref
->start
, ref
->access_size
);
481 /* Return true iff access to memory region starting at REF and of
482 length LEN has been instrumented. */
485 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
, tree len
)
487 HOST_WIDE_INT size_in_bytes
488 = tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
490 return size_in_bytes
!= -1
491 && has_mem_ref_been_instrumented (ref
->start
, size_in_bytes
);
494 /* Set REF to the memory reference present in a gimple assignment
495 ASSIGNMENT. Return true upon successful completion, false
499 get_mem_ref_of_assignment (const gassign
*assignment
,
503 gcc_assert (gimple_assign_single_p (assignment
));
505 if (gimple_store_p (assignment
)
506 && !gimple_clobber_p (assignment
))
508 ref
->start
= gimple_assign_lhs (assignment
);
509 *ref_is_store
= true;
511 else if (gimple_assign_load_p (assignment
))
513 ref
->start
= gimple_assign_rhs1 (assignment
);
514 *ref_is_store
= false;
519 ref
->access_size
= int_size_in_bytes (TREE_TYPE (ref
->start
));
523 /* Return the memory references contained in a gimple statement
524 representing a builtin call that has to do with memory access. */
527 get_mem_refs_of_builtin_call (const gcall
*call
,
540 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
542 tree callee
= gimple_call_fndecl (call
);
543 tree source0
= NULL_TREE
, source1
= NULL_TREE
,
544 dest
= NULL_TREE
, len
= NULL_TREE
;
545 bool is_store
= true, got_reference_p
= false;
546 HOST_WIDE_INT access_size
= 1;
548 *intercepted_p
= asan_intercepted_p ((DECL_FUNCTION_CODE (callee
)));
550 switch (DECL_FUNCTION_CODE (callee
))
552 /* (s, s, n) style memops. */
554 case BUILT_IN_MEMCMP
:
555 source0
= gimple_call_arg (call
, 0);
556 source1
= gimple_call_arg (call
, 1);
557 len
= gimple_call_arg (call
, 2);
560 /* (src, dest, n) style memops. */
562 source0
= gimple_call_arg (call
, 0);
563 dest
= gimple_call_arg (call
, 1);
564 len
= gimple_call_arg (call
, 2);
567 /* (dest, src, n) style memops. */
568 case BUILT_IN_MEMCPY
:
569 case BUILT_IN_MEMCPY_CHK
:
570 case BUILT_IN_MEMMOVE
:
571 case BUILT_IN_MEMMOVE_CHK
:
572 case BUILT_IN_MEMPCPY
:
573 case BUILT_IN_MEMPCPY_CHK
:
574 dest
= gimple_call_arg (call
, 0);
575 source0
= gimple_call_arg (call
, 1);
576 len
= gimple_call_arg (call
, 2);
579 /* (dest, n) style memops. */
581 dest
= gimple_call_arg (call
, 0);
582 len
= gimple_call_arg (call
, 1);
585 /* (dest, x, n) style memops*/
586 case BUILT_IN_MEMSET
:
587 case BUILT_IN_MEMSET_CHK
:
588 dest
= gimple_call_arg (call
, 0);
589 len
= gimple_call_arg (call
, 2);
592 case BUILT_IN_STRLEN
:
593 source0
= gimple_call_arg (call
, 0);
594 len
= gimple_call_lhs (call
);
597 /* And now the __atomic* and __sync builtins.
598 These are handled differently from the classical memory memory
599 access builtins above. */
601 case BUILT_IN_ATOMIC_LOAD_1
:
602 case BUILT_IN_ATOMIC_LOAD_2
:
603 case BUILT_IN_ATOMIC_LOAD_4
:
604 case BUILT_IN_ATOMIC_LOAD_8
:
605 case BUILT_IN_ATOMIC_LOAD_16
:
609 case BUILT_IN_SYNC_FETCH_AND_ADD_1
:
610 case BUILT_IN_SYNC_FETCH_AND_ADD_2
:
611 case BUILT_IN_SYNC_FETCH_AND_ADD_4
:
612 case BUILT_IN_SYNC_FETCH_AND_ADD_8
:
613 case BUILT_IN_SYNC_FETCH_AND_ADD_16
:
615 case BUILT_IN_SYNC_FETCH_AND_SUB_1
:
616 case BUILT_IN_SYNC_FETCH_AND_SUB_2
:
617 case BUILT_IN_SYNC_FETCH_AND_SUB_4
:
618 case BUILT_IN_SYNC_FETCH_AND_SUB_8
:
619 case BUILT_IN_SYNC_FETCH_AND_SUB_16
:
621 case BUILT_IN_SYNC_FETCH_AND_OR_1
:
622 case BUILT_IN_SYNC_FETCH_AND_OR_2
:
623 case BUILT_IN_SYNC_FETCH_AND_OR_4
:
624 case BUILT_IN_SYNC_FETCH_AND_OR_8
:
625 case BUILT_IN_SYNC_FETCH_AND_OR_16
:
627 case BUILT_IN_SYNC_FETCH_AND_AND_1
:
628 case BUILT_IN_SYNC_FETCH_AND_AND_2
:
629 case BUILT_IN_SYNC_FETCH_AND_AND_4
:
630 case BUILT_IN_SYNC_FETCH_AND_AND_8
:
631 case BUILT_IN_SYNC_FETCH_AND_AND_16
:
633 case BUILT_IN_SYNC_FETCH_AND_XOR_1
:
634 case BUILT_IN_SYNC_FETCH_AND_XOR_2
:
635 case BUILT_IN_SYNC_FETCH_AND_XOR_4
:
636 case BUILT_IN_SYNC_FETCH_AND_XOR_8
:
637 case BUILT_IN_SYNC_FETCH_AND_XOR_16
:
639 case BUILT_IN_SYNC_FETCH_AND_NAND_1
:
640 case BUILT_IN_SYNC_FETCH_AND_NAND_2
:
641 case BUILT_IN_SYNC_FETCH_AND_NAND_4
:
642 case BUILT_IN_SYNC_FETCH_AND_NAND_8
:
644 case BUILT_IN_SYNC_ADD_AND_FETCH_1
:
645 case BUILT_IN_SYNC_ADD_AND_FETCH_2
:
646 case BUILT_IN_SYNC_ADD_AND_FETCH_4
:
647 case BUILT_IN_SYNC_ADD_AND_FETCH_8
:
648 case BUILT_IN_SYNC_ADD_AND_FETCH_16
:
650 case BUILT_IN_SYNC_SUB_AND_FETCH_1
:
651 case BUILT_IN_SYNC_SUB_AND_FETCH_2
:
652 case BUILT_IN_SYNC_SUB_AND_FETCH_4
:
653 case BUILT_IN_SYNC_SUB_AND_FETCH_8
:
654 case BUILT_IN_SYNC_SUB_AND_FETCH_16
:
656 case BUILT_IN_SYNC_OR_AND_FETCH_1
:
657 case BUILT_IN_SYNC_OR_AND_FETCH_2
:
658 case BUILT_IN_SYNC_OR_AND_FETCH_4
:
659 case BUILT_IN_SYNC_OR_AND_FETCH_8
:
660 case BUILT_IN_SYNC_OR_AND_FETCH_16
:
662 case BUILT_IN_SYNC_AND_AND_FETCH_1
:
663 case BUILT_IN_SYNC_AND_AND_FETCH_2
:
664 case BUILT_IN_SYNC_AND_AND_FETCH_4
:
665 case BUILT_IN_SYNC_AND_AND_FETCH_8
:
666 case BUILT_IN_SYNC_AND_AND_FETCH_16
:
668 case BUILT_IN_SYNC_XOR_AND_FETCH_1
:
669 case BUILT_IN_SYNC_XOR_AND_FETCH_2
:
670 case BUILT_IN_SYNC_XOR_AND_FETCH_4
:
671 case BUILT_IN_SYNC_XOR_AND_FETCH_8
:
672 case BUILT_IN_SYNC_XOR_AND_FETCH_16
:
674 case BUILT_IN_SYNC_NAND_AND_FETCH_1
:
675 case BUILT_IN_SYNC_NAND_AND_FETCH_2
:
676 case BUILT_IN_SYNC_NAND_AND_FETCH_4
:
677 case BUILT_IN_SYNC_NAND_AND_FETCH_8
:
679 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1
:
680 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2
:
681 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4
:
682 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8
:
683 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16
:
685 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1
:
686 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2
:
687 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4
:
688 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8
:
689 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16
:
691 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1
:
692 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2
:
693 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4
:
694 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8
:
695 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16
:
697 case BUILT_IN_SYNC_LOCK_RELEASE_1
:
698 case BUILT_IN_SYNC_LOCK_RELEASE_2
:
699 case BUILT_IN_SYNC_LOCK_RELEASE_4
:
700 case BUILT_IN_SYNC_LOCK_RELEASE_8
:
701 case BUILT_IN_SYNC_LOCK_RELEASE_16
:
703 case BUILT_IN_ATOMIC_EXCHANGE_1
:
704 case BUILT_IN_ATOMIC_EXCHANGE_2
:
705 case BUILT_IN_ATOMIC_EXCHANGE_4
:
706 case BUILT_IN_ATOMIC_EXCHANGE_8
:
707 case BUILT_IN_ATOMIC_EXCHANGE_16
:
709 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1
:
710 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2
:
711 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4
:
712 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8
:
713 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16
:
715 case BUILT_IN_ATOMIC_STORE_1
:
716 case BUILT_IN_ATOMIC_STORE_2
:
717 case BUILT_IN_ATOMIC_STORE_4
:
718 case BUILT_IN_ATOMIC_STORE_8
:
719 case BUILT_IN_ATOMIC_STORE_16
:
721 case BUILT_IN_ATOMIC_ADD_FETCH_1
:
722 case BUILT_IN_ATOMIC_ADD_FETCH_2
:
723 case BUILT_IN_ATOMIC_ADD_FETCH_4
:
724 case BUILT_IN_ATOMIC_ADD_FETCH_8
:
725 case BUILT_IN_ATOMIC_ADD_FETCH_16
:
727 case BUILT_IN_ATOMIC_SUB_FETCH_1
:
728 case BUILT_IN_ATOMIC_SUB_FETCH_2
:
729 case BUILT_IN_ATOMIC_SUB_FETCH_4
:
730 case BUILT_IN_ATOMIC_SUB_FETCH_8
:
731 case BUILT_IN_ATOMIC_SUB_FETCH_16
:
733 case BUILT_IN_ATOMIC_AND_FETCH_1
:
734 case BUILT_IN_ATOMIC_AND_FETCH_2
:
735 case BUILT_IN_ATOMIC_AND_FETCH_4
:
736 case BUILT_IN_ATOMIC_AND_FETCH_8
:
737 case BUILT_IN_ATOMIC_AND_FETCH_16
:
739 case BUILT_IN_ATOMIC_NAND_FETCH_1
:
740 case BUILT_IN_ATOMIC_NAND_FETCH_2
:
741 case BUILT_IN_ATOMIC_NAND_FETCH_4
:
742 case BUILT_IN_ATOMIC_NAND_FETCH_8
:
743 case BUILT_IN_ATOMIC_NAND_FETCH_16
:
745 case BUILT_IN_ATOMIC_XOR_FETCH_1
:
746 case BUILT_IN_ATOMIC_XOR_FETCH_2
:
747 case BUILT_IN_ATOMIC_XOR_FETCH_4
:
748 case BUILT_IN_ATOMIC_XOR_FETCH_8
:
749 case BUILT_IN_ATOMIC_XOR_FETCH_16
:
751 case BUILT_IN_ATOMIC_OR_FETCH_1
:
752 case BUILT_IN_ATOMIC_OR_FETCH_2
:
753 case BUILT_IN_ATOMIC_OR_FETCH_4
:
754 case BUILT_IN_ATOMIC_OR_FETCH_8
:
755 case BUILT_IN_ATOMIC_OR_FETCH_16
:
757 case BUILT_IN_ATOMIC_FETCH_ADD_1
:
758 case BUILT_IN_ATOMIC_FETCH_ADD_2
:
759 case BUILT_IN_ATOMIC_FETCH_ADD_4
:
760 case BUILT_IN_ATOMIC_FETCH_ADD_8
:
761 case BUILT_IN_ATOMIC_FETCH_ADD_16
:
763 case BUILT_IN_ATOMIC_FETCH_SUB_1
:
764 case BUILT_IN_ATOMIC_FETCH_SUB_2
:
765 case BUILT_IN_ATOMIC_FETCH_SUB_4
:
766 case BUILT_IN_ATOMIC_FETCH_SUB_8
:
767 case BUILT_IN_ATOMIC_FETCH_SUB_16
:
769 case BUILT_IN_ATOMIC_FETCH_AND_1
:
770 case BUILT_IN_ATOMIC_FETCH_AND_2
:
771 case BUILT_IN_ATOMIC_FETCH_AND_4
:
772 case BUILT_IN_ATOMIC_FETCH_AND_8
:
773 case BUILT_IN_ATOMIC_FETCH_AND_16
:
775 case BUILT_IN_ATOMIC_FETCH_NAND_1
:
776 case BUILT_IN_ATOMIC_FETCH_NAND_2
:
777 case BUILT_IN_ATOMIC_FETCH_NAND_4
:
778 case BUILT_IN_ATOMIC_FETCH_NAND_8
:
779 case BUILT_IN_ATOMIC_FETCH_NAND_16
:
781 case BUILT_IN_ATOMIC_FETCH_XOR_1
:
782 case BUILT_IN_ATOMIC_FETCH_XOR_2
:
783 case BUILT_IN_ATOMIC_FETCH_XOR_4
:
784 case BUILT_IN_ATOMIC_FETCH_XOR_8
:
785 case BUILT_IN_ATOMIC_FETCH_XOR_16
:
787 case BUILT_IN_ATOMIC_FETCH_OR_1
:
788 case BUILT_IN_ATOMIC_FETCH_OR_2
:
789 case BUILT_IN_ATOMIC_FETCH_OR_4
:
790 case BUILT_IN_ATOMIC_FETCH_OR_8
:
791 case BUILT_IN_ATOMIC_FETCH_OR_16
:
793 dest
= gimple_call_arg (call
, 0);
794 /* DEST represents the address of a memory location.
795 instrument_derefs wants the memory location, so lets
796 dereference the address DEST before handing it to
797 instrument_derefs. */
798 if (TREE_CODE (dest
) == ADDR_EXPR
)
799 dest
= TREE_OPERAND (dest
, 0);
800 else if (TREE_CODE (dest
) == SSA_NAME
|| TREE_CODE (dest
) == INTEGER_CST
)
801 dest
= build2 (MEM_REF
, TREE_TYPE (TREE_TYPE (dest
)),
802 dest
, build_int_cst (TREE_TYPE (dest
), 0));
806 access_size
= int_size_in_bytes (TREE_TYPE (dest
));
810 /* The other builtins memory access are not instrumented in this
811 function because they either don't have any length parameter,
812 or their length parameter is just a limit. */
816 if (len
!= NULL_TREE
)
818 if (source0
!= NULL_TREE
)
820 src0
->start
= source0
;
821 src0
->access_size
= access_size
;
823 *src0_is_store
= false;
826 if (source1
!= NULL_TREE
)
828 src1
->start
= source1
;
829 src1
->access_size
= access_size
;
831 *src1_is_store
= false;
834 if (dest
!= NULL_TREE
)
837 dst
->access_size
= access_size
;
839 *dst_is_store
= true;
842 got_reference_p
= true;
847 dst
->access_size
= access_size
;
848 *dst_len
= NULL_TREE
;
849 *dst_is_store
= is_store
;
850 *dest_is_deref
= true;
851 got_reference_p
= true;
854 return got_reference_p
;
857 /* Return true iff a given gimple statement has been instrumented.
858 Note that the statement is "defined" by the memory references it
862 has_stmt_been_instrumented_p (gimple
*stmt
)
864 if (gimple_assign_single_p (stmt
))
868 asan_mem_ref_init (&r
, NULL
, 1);
870 if (get_mem_ref_of_assignment (as_a
<gassign
*> (stmt
), &r
,
872 return has_mem_ref_been_instrumented (&r
);
874 else if (gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
876 asan_mem_ref src0
, src1
, dest
;
877 asan_mem_ref_init (&src0
, NULL
, 1);
878 asan_mem_ref_init (&src1
, NULL
, 1);
879 asan_mem_ref_init (&dest
, NULL
, 1);
881 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
882 bool src0_is_store
= false, src1_is_store
= false,
883 dest_is_store
= false, dest_is_deref
= false, intercepted_p
= true;
884 if (get_mem_refs_of_builtin_call (as_a
<gcall
*> (stmt
),
885 &src0
, &src0_len
, &src0_is_store
,
886 &src1
, &src1_len
, &src1_is_store
,
887 &dest
, &dest_len
, &dest_is_store
,
888 &dest_is_deref
, &intercepted_p
))
890 if (src0
.start
!= NULL_TREE
891 && !has_mem_ref_been_instrumented (&src0
, src0_len
))
894 if (src1
.start
!= NULL_TREE
895 && !has_mem_ref_been_instrumented (&src1
, src1_len
))
898 if (dest
.start
!= NULL_TREE
899 && !has_mem_ref_been_instrumented (&dest
, dest_len
))
908 /* Insert a memory reference into the hash table. */
911 update_mem_ref_hash_table (tree ref
, HOST_WIDE_INT access_size
)
913 hash_table
<asan_mem_ref_hasher
> *ht
= get_mem_ref_hash_table ();
916 asan_mem_ref_init (&r
, ref
, access_size
);
918 asan_mem_ref
**slot
= ht
->find_slot (&r
, INSERT
);
919 if (*slot
== NULL
|| (*slot
)->access_size
< access_size
)
920 *slot
= asan_mem_ref_new (ref
, access_size
);
923 /* Initialize shadow_ptr_types array. */
926 asan_init_shadow_ptr_types (void)
928 asan_shadow_set
= new_alias_set ();
929 shadow_ptr_types
[0] = build_distinct_type_copy (signed_char_type_node
);
930 TYPE_ALIAS_SET (shadow_ptr_types
[0]) = asan_shadow_set
;
931 shadow_ptr_types
[0] = build_pointer_type (shadow_ptr_types
[0]);
932 shadow_ptr_types
[1] = build_distinct_type_copy (short_integer_type_node
);
933 TYPE_ALIAS_SET (shadow_ptr_types
[1]) = asan_shadow_set
;
934 shadow_ptr_types
[1] = build_pointer_type (shadow_ptr_types
[1]);
935 initialize_sanitizer_builtins ();
938 /* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
941 asan_pp_string (pretty_printer
*pp
)
943 const char *buf
= pp_formatted_text (pp
);
944 size_t len
= strlen (buf
);
945 tree ret
= build_string (len
+ 1, buf
);
947 = build_array_type (TREE_TYPE (shadow_ptr_types
[0]),
948 build_index_type (size_int (len
)));
949 TREE_READONLY (ret
) = 1;
950 TREE_STATIC (ret
) = 1;
951 return build1 (ADDR_EXPR
, shadow_ptr_types
[0], ret
);
954 /* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
957 asan_shadow_cst (unsigned char shadow_bytes
[4])
960 unsigned HOST_WIDE_INT val
= 0;
961 gcc_assert (WORDS_BIG_ENDIAN
== BYTES_BIG_ENDIAN
);
962 for (i
= 0; i
< 4; i
++)
963 val
|= (unsigned HOST_WIDE_INT
) shadow_bytes
[BYTES_BIG_ENDIAN
? 3 - i
: i
]
964 << (BITS_PER_UNIT
* i
);
965 return gen_int_mode (val
, SImode
);
968 /* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
972 asan_clear_shadow (rtx shadow_mem
, HOST_WIDE_INT len
)
974 rtx_insn
*insn
, *insns
, *jump
;
975 rtx_code_label
*top_label
;
979 clear_storage (shadow_mem
, GEN_INT (len
), BLOCK_OP_NORMAL
);
980 insns
= get_insns ();
982 for (insn
= insns
; insn
; insn
= NEXT_INSN (insn
))
985 if (insn
== NULL_RTX
)
991 gcc_assert ((len
& 3) == 0);
992 top_label
= gen_label_rtx ();
993 addr
= copy_to_mode_reg (Pmode
, XEXP (shadow_mem
, 0));
994 shadow_mem
= adjust_automodify_address (shadow_mem
, SImode
, addr
, 0);
995 end
= force_reg (Pmode
, plus_constant (Pmode
, addr
, len
));
996 emit_label (top_label
);
998 emit_move_insn (shadow_mem
, const0_rtx
);
999 tmp
= expand_simple_binop (Pmode
, PLUS
, addr
, gen_int_mode (4, Pmode
), addr
,
1000 true, OPTAB_LIB_WIDEN
);
1002 emit_move_insn (addr
, tmp
);
1003 emit_cmp_and_jump_insns (addr
, end
, LT
, NULL_RTX
, Pmode
, true, top_label
);
1004 jump
= get_last_insn ();
1005 gcc_assert (JUMP_P (jump
));
1006 add_int_reg_note (jump
, REG_BR_PROB
, REG_BR_PROB_BASE
* 80 / 100);
1010 asan_function_start (void)
1012 section
*fnsec
= function_section (current_function_decl
);
1013 switch_to_section (fnsec
);
1014 ASM_OUTPUT_DEBUG_LABEL (asm_out_file
, "LASANPC",
1015 current_function_funcdef_no
);
1018 /* Insert code to protect stack vars. The prologue sequence should be emitted
1019 directly, epilogue sequence returned. BASE is the register holding the
1020 stack base, against which OFFSETS array offsets are relative to, OFFSETS
1021 array contains pairs of offsets in reverse order, always the end offset
1022 of some gap that needs protection followed by starting offset,
1023 and DECLS is an array of representative decls for each var partition.
1024 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
1025 elements long (OFFSETS include gap before the first variable as well
1026 as gaps after each stack variable). PBASE is, if non-NULL, some pseudo
1027 register which stack vars DECL_RTLs are based on. Either BASE should be
1028 assigned to PBASE, when not doing use after return protection, or
1029 corresponding address based on __asan_stack_malloc* return value. */
1032 asan_emit_stack_protection (rtx base
, rtx pbase
, unsigned int alignb
,
1033 HOST_WIDE_INT
*offsets
, tree
*decls
, int length
)
1035 rtx shadow_base
, shadow_mem
, ret
, mem
, orig_base
;
1036 rtx_code_label
*lab
;
1039 unsigned char shadow_bytes
[4];
1040 HOST_WIDE_INT base_offset
= offsets
[length
- 1];
1041 HOST_WIDE_INT base_align_bias
= 0, offset
, prev_offset
;
1042 HOST_WIDE_INT asan_frame_size
= offsets
[0] - base_offset
;
1043 HOST_WIDE_INT last_offset
, last_size
;
1045 unsigned char cur_shadow_byte
= ASAN_STACK_MAGIC_LEFT
;
1046 tree str_cst
, decl
, id
;
1047 int use_after_return_class
= -1;
1049 if (shadow_ptr_types
[0] == NULL_TREE
)
1050 asan_init_shadow_ptr_types ();
1052 /* First of all, prepare the description string. */
1053 pretty_printer asan_pp
;
1055 pp_decimal_int (&asan_pp
, length
/ 2 - 1);
1056 pp_space (&asan_pp
);
1057 for (l
= length
- 2; l
; l
-= 2)
1059 tree decl
= decls
[l
/ 2 - 1];
1060 pp_wide_integer (&asan_pp
, offsets
[l
] - base_offset
);
1061 pp_space (&asan_pp
);
1062 pp_wide_integer (&asan_pp
, offsets
[l
- 1] - offsets
[l
]);
1063 pp_space (&asan_pp
);
1064 if (DECL_P (decl
) && DECL_NAME (decl
))
1066 pp_decimal_int (&asan_pp
, IDENTIFIER_LENGTH (DECL_NAME (decl
)));
1067 pp_space (&asan_pp
);
1068 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
1071 pp_string (&asan_pp
, "9 <unknown>");
1072 pp_space (&asan_pp
);
1074 str_cst
= asan_pp_string (&asan_pp
);
1076 /* Emit the prologue sequence. */
1077 if (asan_frame_size
> 32 && asan_frame_size
<= 65536 && pbase
1078 && ASAN_USE_AFTER_RETURN
)
1080 use_after_return_class
= floor_log2 (asan_frame_size
- 1) - 5;
1081 /* __asan_stack_malloc_N guarantees alignment
1082 N < 6 ? (64 << N) : 4096 bytes. */
1083 if (alignb
> (use_after_return_class
< 6
1084 ? (64U << use_after_return_class
) : 4096U))
1085 use_after_return_class
= -1;
1086 else if (alignb
> ASAN_RED_ZONE_SIZE
&& (asan_frame_size
& (alignb
- 1)))
1087 base_align_bias
= ((asan_frame_size
+ alignb
- 1)
1088 & ~(alignb
- HOST_WIDE_INT_1
)) - asan_frame_size
;
1090 /* Align base if target is STRICT_ALIGNMENT. */
1091 if (STRICT_ALIGNMENT
)
1092 base
= expand_binop (Pmode
, and_optab
, base
,
1093 gen_int_mode (-((GET_MODE_ALIGNMENT (SImode
)
1094 << ASAN_SHADOW_SHIFT
)
1095 / BITS_PER_UNIT
), Pmode
), NULL_RTX
,
1098 if (use_after_return_class
== -1 && pbase
)
1099 emit_move_insn (pbase
, base
);
1101 base
= expand_binop (Pmode
, add_optab
, base
,
1102 gen_int_mode (base_offset
- base_align_bias
, Pmode
),
1103 NULL_RTX
, 1, OPTAB_DIRECT
);
1104 orig_base
= NULL_RTX
;
1105 if (use_after_return_class
!= -1)
1107 if (asan_detect_stack_use_after_return
== NULL_TREE
)
1109 id
= get_identifier ("__asan_option_detect_stack_use_after_return");
1110 decl
= build_decl (BUILTINS_LOCATION
, VAR_DECL
, id
,
1112 SET_DECL_ASSEMBLER_NAME (decl
, id
);
1113 TREE_ADDRESSABLE (decl
) = 1;
1114 DECL_ARTIFICIAL (decl
) = 1;
1115 DECL_IGNORED_P (decl
) = 1;
1116 DECL_EXTERNAL (decl
) = 1;
1117 TREE_STATIC (decl
) = 1;
1118 TREE_PUBLIC (decl
) = 1;
1119 TREE_USED (decl
) = 1;
1120 asan_detect_stack_use_after_return
= decl
;
1122 orig_base
= gen_reg_rtx (Pmode
);
1123 emit_move_insn (orig_base
, base
);
1124 ret
= expand_normal (asan_detect_stack_use_after_return
);
1125 lab
= gen_label_rtx ();
1126 int very_likely
= REG_BR_PROB_BASE
- (REG_BR_PROB_BASE
/ 2000 - 1);
1127 emit_cmp_and_jump_insns (ret
, const0_rtx
, EQ
, NULL_RTX
,
1128 VOIDmode
, 0, lab
, very_likely
);
1129 snprintf (buf
, sizeof buf
, "__asan_stack_malloc_%d",
1130 use_after_return_class
);
1131 ret
= init_one_libfunc (buf
);
1132 ret
= emit_library_call_value (ret
, NULL_RTX
, LCT_NORMAL
, ptr_mode
, 1,
1133 GEN_INT (asan_frame_size
1135 TYPE_MODE (pointer_sized_int_node
));
1136 /* __asan_stack_malloc_[n] returns a pointer to fake stack if succeeded
1137 and NULL otherwise. Check RET value is NULL here and jump over the
1138 BASE reassignment in this case. Otherwise, reassign BASE to RET. */
1139 int very_unlikely
= REG_BR_PROB_BASE
/ 2000 - 1;
1140 emit_cmp_and_jump_insns (ret
, const0_rtx
, EQ
, NULL_RTX
,
1141 VOIDmode
, 0, lab
, very_unlikely
);
1142 ret
= convert_memory_address (Pmode
, ret
);
1143 emit_move_insn (base
, ret
);
1145 emit_move_insn (pbase
, expand_binop (Pmode
, add_optab
, base
,
1146 gen_int_mode (base_align_bias
1147 - base_offset
, Pmode
),
1148 NULL_RTX
, 1, OPTAB_DIRECT
));
1150 mem
= gen_rtx_MEM (ptr_mode
, base
);
1151 mem
= adjust_address (mem
, VOIDmode
, base_align_bias
);
1152 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_FRAME_MAGIC
, ptr_mode
));
1153 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1154 emit_move_insn (mem
, expand_normal (str_cst
));
1155 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1156 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASANPC", current_function_funcdef_no
);
1157 id
= get_identifier (buf
);
1158 decl
= build_decl (DECL_SOURCE_LOCATION (current_function_decl
),
1159 VAR_DECL
, id
, char_type_node
);
1160 SET_DECL_ASSEMBLER_NAME (decl
, id
);
1161 TREE_ADDRESSABLE (decl
) = 1;
1162 TREE_READONLY (decl
) = 1;
1163 DECL_ARTIFICIAL (decl
) = 1;
1164 DECL_IGNORED_P (decl
) = 1;
1165 TREE_STATIC (decl
) = 1;
1166 TREE_PUBLIC (decl
) = 0;
1167 TREE_USED (decl
) = 1;
1168 DECL_INITIAL (decl
) = decl
;
1169 TREE_ASM_WRITTEN (decl
) = 1;
1170 TREE_ASM_WRITTEN (id
) = 1;
1171 emit_move_insn (mem
, expand_normal (build_fold_addr_expr (decl
)));
1172 shadow_base
= expand_binop (Pmode
, lshr_optab
, base
,
1173 GEN_INT (ASAN_SHADOW_SHIFT
),
1174 NULL_RTX
, 1, OPTAB_DIRECT
);
1176 = plus_constant (Pmode
, shadow_base
,
1177 asan_shadow_offset ()
1178 + (base_align_bias
>> ASAN_SHADOW_SHIFT
));
1179 gcc_assert (asan_shadow_set
!= -1
1180 && (ASAN_RED_ZONE_SIZE
>> ASAN_SHADOW_SHIFT
) == 4);
1181 shadow_mem
= gen_rtx_MEM (SImode
, shadow_base
);
1182 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1183 if (STRICT_ALIGNMENT
)
1184 set_mem_align (shadow_mem
, (GET_MODE_ALIGNMENT (SImode
)));
1185 prev_offset
= base_offset
;
1186 for (l
= length
; l
; l
-= 2)
1189 cur_shadow_byte
= ASAN_STACK_MAGIC_RIGHT
;
1190 offset
= offsets
[l
- 1];
1191 if ((offset
- base_offset
) & (ASAN_RED_ZONE_SIZE
- 1))
1195 = base_offset
+ ((offset
- base_offset
)
1196 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1197 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1198 (aoff
- prev_offset
)
1199 >> ASAN_SHADOW_SHIFT
);
1201 for (i
= 0; i
< 4; i
++, aoff
+= (1 << ASAN_SHADOW_SHIFT
))
1204 if (aoff
< offset
- (1 << ASAN_SHADOW_SHIFT
) + 1)
1205 shadow_bytes
[i
] = 0;
1207 shadow_bytes
[i
] = offset
- aoff
;
1210 shadow_bytes
[i
] = ASAN_STACK_MAGIC_PARTIAL
;
1211 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1214 while (offset
<= offsets
[l
- 2] - ASAN_RED_ZONE_SIZE
)
1216 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1217 (offset
- prev_offset
)
1218 >> ASAN_SHADOW_SHIFT
);
1219 prev_offset
= offset
;
1220 memset (shadow_bytes
, cur_shadow_byte
, 4);
1221 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1222 offset
+= ASAN_RED_ZONE_SIZE
;
1224 cur_shadow_byte
= ASAN_STACK_MAGIC_MIDDLE
;
1226 do_pending_stack_adjust ();
1228 /* Construct epilogue sequence. */
1232 if (use_after_return_class
!= -1)
1234 rtx_code_label
*lab2
= gen_label_rtx ();
1235 char c
= (char) ASAN_STACK_MAGIC_USE_AFTER_RET
;
1236 int very_likely
= REG_BR_PROB_BASE
- (REG_BR_PROB_BASE
/ 2000 - 1);
1237 emit_cmp_and_jump_insns (orig_base
, base
, EQ
, NULL_RTX
,
1238 VOIDmode
, 0, lab2
, very_likely
);
1239 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1240 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1241 mem
= gen_rtx_MEM (ptr_mode
, base
);
1242 mem
= adjust_address (mem
, VOIDmode
, base_align_bias
);
1243 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_RETIRED_MAGIC
, ptr_mode
));
1244 unsigned HOST_WIDE_INT sz
= asan_frame_size
>> ASAN_SHADOW_SHIFT
;
1245 if (use_after_return_class
< 5
1246 && can_store_by_pieces (sz
, builtin_memset_read_str
, &c
,
1247 BITS_PER_UNIT
, true))
1248 store_by_pieces (shadow_mem
, sz
, builtin_memset_read_str
, &c
,
1249 BITS_PER_UNIT
, true, 0);
1250 else if (use_after_return_class
>= 5
1251 || !set_storage_via_setmem (shadow_mem
,
1253 gen_int_mode (c
, QImode
),
1254 BITS_PER_UNIT
, BITS_PER_UNIT
,
1257 snprintf (buf
, sizeof buf
, "__asan_stack_free_%d",
1258 use_after_return_class
);
1259 ret
= init_one_libfunc (buf
);
1260 rtx addr
= convert_memory_address (ptr_mode
, base
);
1261 rtx orig_addr
= convert_memory_address (ptr_mode
, orig_base
);
1262 emit_library_call (ret
, LCT_NORMAL
, ptr_mode
, 3, addr
, ptr_mode
,
1263 GEN_INT (asan_frame_size
+ base_align_bias
),
1264 TYPE_MODE (pointer_sized_int_node
),
1265 orig_addr
, ptr_mode
);
1267 lab
= gen_label_rtx ();
1272 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1273 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1275 if (STRICT_ALIGNMENT
)
1276 set_mem_align (shadow_mem
, (GET_MODE_ALIGNMENT (SImode
)));
1278 prev_offset
= base_offset
;
1279 last_offset
= base_offset
;
1281 for (l
= length
; l
; l
-= 2)
1283 offset
= base_offset
+ ((offsets
[l
- 1] - base_offset
)
1284 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1285 if (last_offset
+ last_size
!= offset
)
1287 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1288 (last_offset
- prev_offset
)
1289 >> ASAN_SHADOW_SHIFT
);
1290 prev_offset
= last_offset
;
1291 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1292 last_offset
= offset
;
1295 last_size
+= base_offset
+ ((offsets
[l
- 2] - base_offset
)
1296 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
))
1301 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1302 (last_offset
- prev_offset
)
1303 >> ASAN_SHADOW_SHIFT
);
1304 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1307 do_pending_stack_adjust ();
1311 insns
= get_insns ();
1316 /* Return true if DECL, a global var, might be overridden and needs
1317 therefore a local alias. */
1320 asan_needs_local_alias (tree decl
)
1322 return DECL_WEAK (decl
) || !targetm
.binds_local_p (decl
);
1325 /* Return true if DECL is a VAR_DECL that should be protected
1326 by Address Sanitizer, by appending a red zone with protected
1327 shadow memory after it and aligning it to at least
1328 ASAN_RED_ZONE_SIZE bytes. */
1331 asan_protect_global (tree decl
)
1338 if (TREE_CODE (decl
) == STRING_CST
)
1340 /* Instrument all STRING_CSTs except those created
1341 by asan_pp_string here. */
1342 if (shadow_ptr_types
[0] != NULL_TREE
1343 && TREE_CODE (TREE_TYPE (decl
)) == ARRAY_TYPE
1344 && TREE_TYPE (TREE_TYPE (decl
)) == TREE_TYPE (shadow_ptr_types
[0]))
1348 if (TREE_CODE (decl
) != VAR_DECL
1349 /* TLS vars aren't statically protectable. */
1350 || DECL_THREAD_LOCAL_P (decl
)
1351 /* Externs will be protected elsewhere. */
1352 || DECL_EXTERNAL (decl
)
1353 || !DECL_RTL_SET_P (decl
)
1354 /* Comdat vars pose an ABI problem, we can't know if
1355 the var that is selected by the linker will have
1357 || DECL_ONE_ONLY (decl
)
1358 /* Similarly for common vars. People can use -fno-common.
1359 Note: Linux kernel is built with -fno-common, so we do instrument
1360 globals there even if it is C. */
1361 || (DECL_COMMON (decl
) && TREE_PUBLIC (decl
))
1362 /* Don't protect if using user section, often vars placed
1363 into user section from multiple TUs are then assumed
1364 to be an array of such vars, putting padding in there
1365 breaks this assumption. */
1366 || (DECL_SECTION_NAME (decl
) != NULL
1367 && !symtab_node::get (decl
)->implicit_section
1368 && !section_sanitized_p (DECL_SECTION_NAME (decl
)))
1369 || DECL_SIZE (decl
) == 0
1370 || ASAN_RED_ZONE_SIZE
* BITS_PER_UNIT
> MAX_OFILE_ALIGNMENT
1371 || !valid_constant_size_p (DECL_SIZE_UNIT (decl
))
1372 || DECL_ALIGN_UNIT (decl
) > 2 * ASAN_RED_ZONE_SIZE
1373 || TREE_TYPE (decl
) == ubsan_get_source_location_type ())
1376 rtl
= DECL_RTL (decl
);
1377 if (!MEM_P (rtl
) || GET_CODE (XEXP (rtl
, 0)) != SYMBOL_REF
)
1379 symbol
= XEXP (rtl
, 0);
1381 if (CONSTANT_POOL_ADDRESS_P (symbol
)
1382 || TREE_CONSTANT_POOL_ADDRESS_P (symbol
))
1385 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl
)))
1388 #ifndef ASM_OUTPUT_DEF
1389 if (asan_needs_local_alias (decl
))
1396 /* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16,_n}.
1397 IS_STORE is either 1 (for a store) or 0 (for a load). */
1400 report_error_func (bool is_store
, bool recover_p
, HOST_WIDE_INT size_in_bytes
,
1403 static enum built_in_function report
[2][2][6]
1404 = { { { BUILT_IN_ASAN_REPORT_LOAD1
, BUILT_IN_ASAN_REPORT_LOAD2
,
1405 BUILT_IN_ASAN_REPORT_LOAD4
, BUILT_IN_ASAN_REPORT_LOAD8
,
1406 BUILT_IN_ASAN_REPORT_LOAD16
, BUILT_IN_ASAN_REPORT_LOAD_N
},
1407 { BUILT_IN_ASAN_REPORT_STORE1
, BUILT_IN_ASAN_REPORT_STORE2
,
1408 BUILT_IN_ASAN_REPORT_STORE4
, BUILT_IN_ASAN_REPORT_STORE8
,
1409 BUILT_IN_ASAN_REPORT_STORE16
, BUILT_IN_ASAN_REPORT_STORE_N
} },
1410 { { BUILT_IN_ASAN_REPORT_LOAD1_NOABORT
,
1411 BUILT_IN_ASAN_REPORT_LOAD2_NOABORT
,
1412 BUILT_IN_ASAN_REPORT_LOAD4_NOABORT
,
1413 BUILT_IN_ASAN_REPORT_LOAD8_NOABORT
,
1414 BUILT_IN_ASAN_REPORT_LOAD16_NOABORT
,
1415 BUILT_IN_ASAN_REPORT_LOAD_N_NOABORT
},
1416 { BUILT_IN_ASAN_REPORT_STORE1_NOABORT
,
1417 BUILT_IN_ASAN_REPORT_STORE2_NOABORT
,
1418 BUILT_IN_ASAN_REPORT_STORE4_NOABORT
,
1419 BUILT_IN_ASAN_REPORT_STORE8_NOABORT
,
1420 BUILT_IN_ASAN_REPORT_STORE16_NOABORT
,
1421 BUILT_IN_ASAN_REPORT_STORE_N_NOABORT
} } };
1422 if (size_in_bytes
== -1)
1425 return builtin_decl_implicit (report
[recover_p
][is_store
][5]);
1428 int size_log2
= exact_log2 (size_in_bytes
);
1429 return builtin_decl_implicit (report
[recover_p
][is_store
][size_log2
]);
1432 /* Construct a function tree for __asan_{load,store}{1,2,4,8,16,_n}.
1433 IS_STORE is either 1 (for a store) or 0 (for a load). */
1436 check_func (bool is_store
, bool recover_p
, HOST_WIDE_INT size_in_bytes
,
1439 static enum built_in_function check
[2][2][6]
1440 = { { { BUILT_IN_ASAN_LOAD1
, BUILT_IN_ASAN_LOAD2
,
1441 BUILT_IN_ASAN_LOAD4
, BUILT_IN_ASAN_LOAD8
,
1442 BUILT_IN_ASAN_LOAD16
, BUILT_IN_ASAN_LOADN
},
1443 { BUILT_IN_ASAN_STORE1
, BUILT_IN_ASAN_STORE2
,
1444 BUILT_IN_ASAN_STORE4
, BUILT_IN_ASAN_STORE8
,
1445 BUILT_IN_ASAN_STORE16
, BUILT_IN_ASAN_STOREN
} },
1446 { { BUILT_IN_ASAN_LOAD1_NOABORT
,
1447 BUILT_IN_ASAN_LOAD2_NOABORT
,
1448 BUILT_IN_ASAN_LOAD4_NOABORT
,
1449 BUILT_IN_ASAN_LOAD8_NOABORT
,
1450 BUILT_IN_ASAN_LOAD16_NOABORT
,
1451 BUILT_IN_ASAN_LOADN_NOABORT
},
1452 { BUILT_IN_ASAN_STORE1_NOABORT
,
1453 BUILT_IN_ASAN_STORE2_NOABORT
,
1454 BUILT_IN_ASAN_STORE4_NOABORT
,
1455 BUILT_IN_ASAN_STORE8_NOABORT
,
1456 BUILT_IN_ASAN_STORE16_NOABORT
,
1457 BUILT_IN_ASAN_STOREN_NOABORT
} } };
1458 if (size_in_bytes
== -1)
1461 return builtin_decl_implicit (check
[recover_p
][is_store
][5]);
1464 int size_log2
= exact_log2 (size_in_bytes
);
1465 return builtin_decl_implicit (check
[recover_p
][is_store
][size_log2
]);
1468 /* Split the current basic block and create a condition statement
1469 insertion point right before or after the statement pointed to by
1470 ITER. Return an iterator to the point at which the caller might
1471 safely insert the condition statement.
1473 THEN_BLOCK must be set to the address of an uninitialized instance
1474 of basic_block. The function will then set *THEN_BLOCK to the
1475 'then block' of the condition statement to be inserted by the
1478 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1479 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1481 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1482 block' of the condition statement to be inserted by the caller.
1484 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1485 statements starting from *ITER, and *THEN_BLOCK is a new empty
1488 *ITER is adjusted to point to always point to the first statement
1489 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1490 same as what ITER was pointing to prior to calling this function,
1491 if BEFORE_P is true; otherwise, it is its following statement. */
1493 gimple_stmt_iterator
1494 create_cond_insert_point (gimple_stmt_iterator
*iter
,
1496 bool then_more_likely_p
,
1497 bool create_then_fallthru_edge
,
1498 basic_block
*then_block
,
1499 basic_block
*fallthrough_block
)
1501 gimple_stmt_iterator gsi
= *iter
;
1503 if (!gsi_end_p (gsi
) && before_p
)
1506 basic_block cur_bb
= gsi_bb (*iter
);
1508 edge e
= split_block (cur_bb
, gsi_stmt (gsi
));
1510 /* Get a hold on the 'condition block', the 'then block' and the
1512 basic_block cond_bb
= e
->src
;
1513 basic_block fallthru_bb
= e
->dest
;
1514 basic_block then_bb
= create_empty_bb (cond_bb
);
1517 add_bb_to_loop (then_bb
, cond_bb
->loop_father
);
1518 loops_state_set (LOOPS_NEED_FIXUP
);
1521 /* Set up the newly created 'then block'. */
1522 e
= make_edge (cond_bb
, then_bb
, EDGE_TRUE_VALUE
);
1523 int fallthrough_probability
1524 = then_more_likely_p
1525 ? PROB_VERY_UNLIKELY
1526 : PROB_ALWAYS
- PROB_VERY_UNLIKELY
;
1527 e
->probability
= PROB_ALWAYS
- fallthrough_probability
;
1528 if (create_then_fallthru_edge
)
1529 make_single_succ_edge (then_bb
, fallthru_bb
, EDGE_FALLTHRU
);
1531 /* Set up the fallthrough basic block. */
1532 e
= find_edge (cond_bb
, fallthru_bb
);
1533 e
->flags
= EDGE_FALSE_VALUE
;
1534 e
->count
= cond_bb
->count
;
1535 e
->probability
= fallthrough_probability
;
1537 /* Update dominance info for the newly created then_bb; note that
1538 fallthru_bb's dominance info has already been updated by
1540 if (dom_info_available_p (CDI_DOMINATORS
))
1541 set_immediate_dominator (CDI_DOMINATORS
, then_bb
, cond_bb
);
1543 *then_block
= then_bb
;
1544 *fallthrough_block
= fallthru_bb
;
1545 *iter
= gsi_start_bb (fallthru_bb
);
1547 return gsi_last_bb (cond_bb
);
1550 /* Insert an if condition followed by a 'then block' right before the
1551 statement pointed to by ITER. The fallthrough block -- which is the
1552 else block of the condition as well as the destination of the
1553 outcoming edge of the 'then block' -- starts with the statement
1556 COND is the condition of the if.
1558 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1559 'then block' is higher than the probability of the edge to the
1562 Upon completion of the function, *THEN_BB is set to the newly
1563 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1566 *ITER is adjusted to still point to the same statement it was
1567 pointing to initially. */
1570 insert_if_then_before_iter (gcond
*cond
,
1571 gimple_stmt_iterator
*iter
,
1572 bool then_more_likely_p
,
1573 basic_block
*then_bb
,
1574 basic_block
*fallthrough_bb
)
1576 gimple_stmt_iterator cond_insert_point
=
1577 create_cond_insert_point (iter
,
1580 /*create_then_fallthru_edge=*/true,
1583 gsi_insert_after (&cond_insert_point
, cond
, GSI_NEW_STMT
);
1587 (base_addr >> ASAN_SHADOW_SHIFT) + asan_shadow_offset (). */
1590 build_shadow_mem_access (gimple_stmt_iterator
*gsi
, location_t location
,
1591 tree base_addr
, tree shadow_ptr_type
)
1593 tree t
, uintptr_type
= TREE_TYPE (base_addr
);
1594 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
1597 t
= build_int_cst (uintptr_type
, ASAN_SHADOW_SHIFT
);
1598 g
= gimple_build_assign (make_ssa_name (uintptr_type
), RSHIFT_EXPR
,
1600 gimple_set_location (g
, location
);
1601 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1603 t
= build_int_cst (uintptr_type
, asan_shadow_offset ());
1604 g
= gimple_build_assign (make_ssa_name (uintptr_type
), PLUS_EXPR
,
1605 gimple_assign_lhs (g
), t
);
1606 gimple_set_location (g
, location
);
1607 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1609 g
= gimple_build_assign (make_ssa_name (shadow_ptr_type
), NOP_EXPR
,
1610 gimple_assign_lhs (g
));
1611 gimple_set_location (g
, location
);
1612 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1614 t
= build2 (MEM_REF
, shadow_type
, gimple_assign_lhs (g
),
1615 build_int_cst (shadow_ptr_type
, 0));
1616 g
= gimple_build_assign (make_ssa_name (shadow_type
), MEM_REF
, t
);
1617 gimple_set_location (g
, location
);
1618 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1619 return gimple_assign_lhs (g
);
1622 /* BASE can already be an SSA_NAME; in that case, do not create a
1623 new SSA_NAME for it. */
1626 maybe_create_ssa_name (location_t loc
, tree base
, gimple_stmt_iterator
*iter
,
1629 if (TREE_CODE (base
) == SSA_NAME
)
1631 gimple
*g
= gimple_build_assign (make_ssa_name (TREE_TYPE (base
)),
1632 TREE_CODE (base
), base
);
1633 gimple_set_location (g
, loc
);
1635 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1637 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
1638 return gimple_assign_lhs (g
);
1641 /* LEN can already have necessary size and precision;
1642 in that case, do not create a new variable. */
1645 maybe_cast_to_ptrmode (location_t loc
, tree len
, gimple_stmt_iterator
*iter
,
1648 if (ptrofftype_p (len
))
1650 gimple
*g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
1652 gimple_set_location (g
, loc
);
1654 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1656 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
1657 return gimple_assign_lhs (g
);
1660 /* Instrument the memory access instruction BASE. Insert new
1661 statements before or after ITER.
1663 Note that the memory access represented by BASE can be either an
1664 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1665 location. IS_STORE is TRUE for a store, FALSE for a load.
1666 BEFORE_P is TRUE for inserting the instrumentation code before
1667 ITER, FALSE for inserting it after ITER. IS_SCALAR_ACCESS is TRUE
1668 for a scalar memory access and FALSE for memory region access.
1669 NON_ZERO_P is TRUE if memory region is guaranteed to have non-zero
1670 length. ALIGN tells alignment of accessed memory object.
1672 START_INSTRUMENTED and END_INSTRUMENTED are TRUE if start/end of
1673 memory region have already been instrumented.
1675 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1676 statement it was pointing to prior to calling this function,
1677 otherwise, it points to the statement logically following it. */
1680 build_check_stmt (location_t loc
, tree base
, tree len
,
1681 HOST_WIDE_INT size_in_bytes
, gimple_stmt_iterator
*iter
,
1682 bool is_non_zero_len
, bool before_p
, bool is_store
,
1683 bool is_scalar_access
, unsigned int align
= 0)
1685 gimple_stmt_iterator gsi
= *iter
;
1688 gcc_assert (!(size_in_bytes
> 0 && !is_non_zero_len
));
1692 base
= unshare_expr (base
);
1693 base
= maybe_create_ssa_name (loc
, base
, &gsi
, before_p
);
1697 len
= unshare_expr (len
);
1698 len
= maybe_cast_to_ptrmode (loc
, len
, iter
, before_p
);
1702 gcc_assert (size_in_bytes
!= -1);
1703 len
= build_int_cst (pointer_sized_int_node
, size_in_bytes
);
1706 if (size_in_bytes
> 1)
1708 if ((size_in_bytes
& (size_in_bytes
- 1)) != 0
1709 || size_in_bytes
> 16)
1710 is_scalar_access
= false;
1711 else if (align
&& align
< size_in_bytes
* BITS_PER_UNIT
)
1713 /* On non-strict alignment targets, if
1714 16-byte access is just 8-byte aligned,
1715 this will result in misaligned shadow
1716 memory 2 byte load, but otherwise can
1717 be handled using one read. */
1718 if (size_in_bytes
!= 16
1720 || align
< 8 * BITS_PER_UNIT
)
1721 is_scalar_access
= false;
1725 HOST_WIDE_INT flags
= 0;
1727 flags
|= ASAN_CHECK_STORE
;
1728 if (is_non_zero_len
)
1729 flags
|= ASAN_CHECK_NON_ZERO_LEN
;
1730 if (is_scalar_access
)
1731 flags
|= ASAN_CHECK_SCALAR_ACCESS
;
1733 g
= gimple_build_call_internal (IFN_ASAN_CHECK
, 4,
1734 build_int_cst (integer_type_node
, flags
),
1736 build_int_cst (integer_type_node
,
1737 align
/ BITS_PER_UNIT
));
1738 gimple_set_location (g
, loc
);
1740 gsi_insert_before (&gsi
, g
, GSI_SAME_STMT
);
1743 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1749 /* If T represents a memory access, add instrumentation code before ITER.
1750 LOCATION is source code location.
1751 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
1754 instrument_derefs (gimple_stmt_iterator
*iter
, tree t
,
1755 location_t location
, bool is_store
)
1757 if (is_store
&& !ASAN_INSTRUMENT_WRITES
)
1759 if (!is_store
&& !ASAN_INSTRUMENT_READS
)
1763 HOST_WIDE_INT size_in_bytes
;
1765 type
= TREE_TYPE (t
);
1766 switch (TREE_CODE (t
))
1780 size_in_bytes
= int_size_in_bytes (type
);
1781 if (size_in_bytes
<= 0)
1784 HOST_WIDE_INT bitsize
, bitpos
;
1787 int volatilep
= 0, unsignedp
= 0;
1788 tree inner
= get_inner_reference (t
, &bitsize
, &bitpos
, &offset
,
1789 &mode
, &unsignedp
, &volatilep
, false);
1791 if (TREE_CODE (t
) == COMPONENT_REF
1792 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1)) != NULL_TREE
)
1794 tree repr
= DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1));
1795 instrument_derefs (iter
, build3 (COMPONENT_REF
, TREE_TYPE (repr
),
1796 TREE_OPERAND (t
, 0), repr
,
1797 NULL_TREE
), location
, is_store
);
1801 if (bitpos
% BITS_PER_UNIT
1802 || bitsize
!= size_in_bytes
* BITS_PER_UNIT
)
1805 if (TREE_CODE (inner
) == VAR_DECL
1806 && offset
== NULL_TREE
1808 && DECL_SIZE (inner
)
1809 && tree_fits_shwi_p (DECL_SIZE (inner
))
1810 && bitpos
+ bitsize
<= tree_to_shwi (DECL_SIZE (inner
)))
1812 if (DECL_THREAD_LOCAL_P (inner
))
1814 if (!ASAN_GLOBALS
&& is_global_var (inner
))
1816 if (!TREE_STATIC (inner
))
1818 /* Automatic vars in the current function will be always
1820 if (decl_function_context (inner
) == current_function_decl
)
1823 /* Always instrument external vars, they might be dynamically
1825 else if (!DECL_EXTERNAL (inner
))
1827 /* For static vars if they are known not to be dynamically
1828 initialized, they will be always accessible. */
1829 varpool_node
*vnode
= varpool_node::get (inner
);
1830 if (vnode
&& !vnode
->dynamically_initialized
)
1835 base
= build_fold_addr_expr (t
);
1836 if (!has_mem_ref_been_instrumented (base
, size_in_bytes
))
1838 unsigned int align
= get_object_alignment (t
);
1839 build_check_stmt (location
, base
, NULL_TREE
, size_in_bytes
, iter
,
1840 /*is_non_zero_len*/size_in_bytes
> 0, /*before_p=*/true,
1841 is_store
, /*is_scalar_access*/true, align
);
1842 update_mem_ref_hash_table (base
, size_in_bytes
);
1843 update_mem_ref_hash_table (t
, size_in_bytes
);
1848 /* Insert a memory reference into the hash table if access length
1849 can be determined in compile time. */
1852 maybe_update_mem_ref_hash_table (tree base
, tree len
)
1854 if (!POINTER_TYPE_P (TREE_TYPE (base
))
1855 || !INTEGRAL_TYPE_P (TREE_TYPE (len
)))
1858 HOST_WIDE_INT size_in_bytes
= tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
1860 if (size_in_bytes
!= -1)
1861 update_mem_ref_hash_table (base
, size_in_bytes
);
1864 /* Instrument an access to a contiguous memory region that starts at
1865 the address pointed to by BASE, over a length of LEN (expressed in
1866 the sizeof (*BASE) bytes). ITER points to the instruction before
1867 which the instrumentation instructions must be inserted. LOCATION
1868 is the source location that the instrumentation instructions must
1869 have. If IS_STORE is true, then the memory access is a store;
1870 otherwise, it's a load. */
1873 instrument_mem_region_access (tree base
, tree len
,
1874 gimple_stmt_iterator
*iter
,
1875 location_t location
, bool is_store
)
1877 if (!POINTER_TYPE_P (TREE_TYPE (base
))
1878 || !INTEGRAL_TYPE_P (TREE_TYPE (len
))
1879 || integer_zerop (len
))
1882 HOST_WIDE_INT size_in_bytes
= tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
1884 if ((size_in_bytes
== -1)
1885 || !has_mem_ref_been_instrumented (base
, size_in_bytes
))
1887 build_check_stmt (location
, base
, len
, size_in_bytes
, iter
,
1888 /*is_non_zero_len*/size_in_bytes
> 0, /*before_p*/true,
1889 is_store
, /*is_scalar_access*/false, /*align*/0);
1892 maybe_update_mem_ref_hash_table (base
, len
);
1893 *iter
= gsi_for_stmt (gsi_stmt (*iter
));
1896 /* Instrument the call to a built-in memory access function that is
1897 pointed to by the iterator ITER.
1899 Upon completion, return TRUE iff *ITER has been advanced to the
1900 statement following the one it was originally pointing to. */
1903 instrument_builtin_call (gimple_stmt_iterator
*iter
)
1905 if (!ASAN_MEMINTRIN
)
1908 bool iter_advanced_p
= false;
1909 gcall
*call
= as_a
<gcall
*> (gsi_stmt (*iter
));
1911 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
1913 location_t loc
= gimple_location (call
);
1915 asan_mem_ref src0
, src1
, dest
;
1916 asan_mem_ref_init (&src0
, NULL
, 1);
1917 asan_mem_ref_init (&src1
, NULL
, 1);
1918 asan_mem_ref_init (&dest
, NULL
, 1);
1920 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
1921 bool src0_is_store
= false, src1_is_store
= false, dest_is_store
= false,
1922 dest_is_deref
= false, intercepted_p
= true;
1924 if (get_mem_refs_of_builtin_call (call
,
1925 &src0
, &src0_len
, &src0_is_store
,
1926 &src1
, &src1_len
, &src1_is_store
,
1927 &dest
, &dest_len
, &dest_is_store
,
1928 &dest_is_deref
, &intercepted_p
))
1932 instrument_derefs (iter
, dest
.start
, loc
, dest_is_store
);
1934 iter_advanced_p
= true;
1936 else if (!intercepted_p
1937 && (src0_len
|| src1_len
|| dest_len
))
1939 if (src0
.start
!= NULL_TREE
)
1940 instrument_mem_region_access (src0
.start
, src0_len
,
1941 iter
, loc
, /*is_store=*/false);
1942 if (src1
.start
!= NULL_TREE
)
1943 instrument_mem_region_access (src1
.start
, src1_len
,
1944 iter
, loc
, /*is_store=*/false);
1945 if (dest
.start
!= NULL_TREE
)
1946 instrument_mem_region_access (dest
.start
, dest_len
,
1947 iter
, loc
, /*is_store=*/true);
1949 *iter
= gsi_for_stmt (call
);
1951 iter_advanced_p
= true;
1955 if (src0
.start
!= NULL_TREE
)
1956 maybe_update_mem_ref_hash_table (src0
.start
, src0_len
);
1957 if (src1
.start
!= NULL_TREE
)
1958 maybe_update_mem_ref_hash_table (src1
.start
, src1_len
);
1959 if (dest
.start
!= NULL_TREE
)
1960 maybe_update_mem_ref_hash_table (dest
.start
, dest_len
);
1963 return iter_advanced_p
;
1966 /* Instrument the assignment statement ITER if it is subject to
1967 instrumentation. Return TRUE iff instrumentation actually
1968 happened. In that case, the iterator ITER is advanced to the next
1969 logical expression following the one initially pointed to by ITER,
1970 and the relevant memory reference that which access has been
1971 instrumented is added to the memory references hash table. */
1974 maybe_instrument_assignment (gimple_stmt_iterator
*iter
)
1976 gimple
*s
= gsi_stmt (*iter
);
1978 gcc_assert (gimple_assign_single_p (s
));
1980 tree ref_expr
= NULL_TREE
;
1981 bool is_store
, is_instrumented
= false;
1983 if (gimple_store_p (s
))
1985 ref_expr
= gimple_assign_lhs (s
);
1987 instrument_derefs (iter
, ref_expr
,
1988 gimple_location (s
),
1990 is_instrumented
= true;
1993 if (gimple_assign_load_p (s
))
1995 ref_expr
= gimple_assign_rhs1 (s
);
1997 instrument_derefs (iter
, ref_expr
,
1998 gimple_location (s
),
2000 is_instrumented
= true;
2003 if (is_instrumented
)
2006 return is_instrumented
;
2009 /* Instrument the function call pointed to by the iterator ITER, if it
2010 is subject to instrumentation. At the moment, the only function
2011 calls that are instrumented are some built-in functions that access
2012 memory. Look at instrument_builtin_call to learn more.
2014 Upon completion return TRUE iff *ITER was advanced to the statement
2015 following the one it was originally pointing to. */
2018 maybe_instrument_call (gimple_stmt_iterator
*iter
)
2020 gimple
*stmt
= gsi_stmt (*iter
);
2021 bool is_builtin
= gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
);
2023 if (is_builtin
&& instrument_builtin_call (iter
))
2026 if (gimple_call_noreturn_p (stmt
))
2030 tree callee
= gimple_call_fndecl (stmt
);
2031 switch (DECL_FUNCTION_CODE (callee
))
2033 case BUILT_IN_UNREACHABLE
:
2035 /* Don't instrument these. */
2041 tree decl
= builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN
);
2042 gimple
*g
= gimple_build_call (decl
, 0);
2043 gimple_set_location (g
, gimple_location (stmt
));
2044 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2049 /* Walk each instruction of all basic block and instrument those that
2050 represent memory references: loads, stores, or function calls.
2051 In a given basic block, this function avoids instrumenting memory
2052 references that have already been instrumented. */
2055 transform_statements (void)
2057 basic_block bb
, last_bb
= NULL
;
2058 gimple_stmt_iterator i
;
2059 int saved_last_basic_block
= last_basic_block_for_fn (cfun
);
2061 FOR_EACH_BB_FN (bb
, cfun
)
2063 basic_block prev_bb
= bb
;
2065 if (bb
->index
>= saved_last_basic_block
) continue;
2067 /* Flush the mem ref hash table, if current bb doesn't have
2068 exactly one predecessor, or if that predecessor (skipping
2069 over asan created basic blocks) isn't the last processed
2070 basic block. Thus we effectively flush on extended basic
2071 block boundaries. */
2072 while (single_pred_p (prev_bb
))
2074 prev_bb
= single_pred (prev_bb
);
2075 if (prev_bb
->index
< saved_last_basic_block
)
2078 if (prev_bb
!= last_bb
)
2079 empty_mem_ref_hash_table ();
2082 for (i
= gsi_start_bb (bb
); !gsi_end_p (i
);)
2084 gimple
*s
= gsi_stmt (i
);
2086 if (has_stmt_been_instrumented_p (s
))
2088 else if (gimple_assign_single_p (s
)
2089 && !gimple_clobber_p (s
)
2090 && maybe_instrument_assignment (&i
))
2091 /* Nothing to do as maybe_instrument_assignment advanced
2093 else if (is_gimple_call (s
) && maybe_instrument_call (&i
))
2094 /* Nothing to do as maybe_instrument_call
2095 advanced the iterator I. */;
2098 /* No instrumentation happened.
2100 If the current instruction is a function call that
2101 might free something, let's forget about the memory
2102 references that got instrumented. Otherwise we might
2103 miss some instrumentation opportunities. */
2104 if (is_gimple_call (s
) && !nonfreeing_call_p (s
))
2105 empty_mem_ref_hash_table ();
2111 free_mem_ref_resources ();
2115 __asan_before_dynamic_init (module_name)
2117 __asan_after_dynamic_init ()
2121 asan_dynamic_init_call (bool after_p
)
2123 tree fn
= builtin_decl_implicit (after_p
2124 ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
2125 : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT
);
2126 tree module_name_cst
= NULL_TREE
;
2129 pretty_printer module_name_pp
;
2130 pp_string (&module_name_pp
, main_input_filename
);
2132 if (shadow_ptr_types
[0] == NULL_TREE
)
2133 asan_init_shadow_ptr_types ();
2134 module_name_cst
= asan_pp_string (&module_name_pp
);
2135 module_name_cst
= fold_convert (const_ptr_type_node
,
2139 return build_call_expr (fn
, after_p
? 0 : 1, module_name_cst
);
2143 struct __asan_global
2147 uptr __size_with_redzone;
2149 const void *__module_name;
2150 uptr __has_dynamic_init;
2151 __asan_global_source_location *__location;
2155 asan_global_struct (void)
2157 static const char *field_names
[7]
2158 = { "__beg", "__size", "__size_with_redzone",
2159 "__name", "__module_name", "__has_dynamic_init", "__location"};
2160 tree fields
[7], ret
;
2163 ret
= make_node (RECORD_TYPE
);
2164 for (i
= 0; i
< 7; i
++)
2167 = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
,
2168 get_identifier (field_names
[i
]),
2169 (i
== 0 || i
== 3) ? const_ptr_type_node
2170 : pointer_sized_int_node
);
2171 DECL_CONTEXT (fields
[i
]) = ret
;
2173 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
2175 tree type_decl
= build_decl (input_location
, TYPE_DECL
,
2176 get_identifier ("__asan_global"), ret
);
2177 DECL_IGNORED_P (type_decl
) = 1;
2178 DECL_ARTIFICIAL (type_decl
) = 1;
2179 TYPE_FIELDS (ret
) = fields
[0];
2180 TYPE_NAME (ret
) = type_decl
;
2181 TYPE_STUB_DECL (ret
) = type_decl
;
2186 /* Append description of a single global DECL into vector V.
2187 TYPE is __asan_global struct type as returned by asan_global_struct. */
2190 asan_add_global (tree decl
, tree type
, vec
<constructor_elt
, va_gc
> *v
)
2192 tree init
, uptr
= TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type
)));
2193 unsigned HOST_WIDE_INT size
;
2194 tree str_cst
, module_name_cst
, refdecl
= decl
;
2195 vec
<constructor_elt
, va_gc
> *vinner
= NULL
;
2197 pretty_printer asan_pp
, module_name_pp
;
2199 if (DECL_NAME (decl
))
2200 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
2202 pp_string (&asan_pp
, "<unknown>");
2203 str_cst
= asan_pp_string (&asan_pp
);
2205 pp_string (&module_name_pp
, main_input_filename
);
2206 module_name_cst
= asan_pp_string (&module_name_pp
);
2208 if (asan_needs_local_alias (decl
))
2211 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", vec_safe_length (v
) + 1);
2212 refdecl
= build_decl (DECL_SOURCE_LOCATION (decl
),
2213 VAR_DECL
, get_identifier (buf
), TREE_TYPE (decl
));
2214 TREE_ADDRESSABLE (refdecl
) = TREE_ADDRESSABLE (decl
);
2215 TREE_READONLY (refdecl
) = TREE_READONLY (decl
);
2216 TREE_THIS_VOLATILE (refdecl
) = TREE_THIS_VOLATILE (decl
);
2217 DECL_GIMPLE_REG_P (refdecl
) = DECL_GIMPLE_REG_P (decl
);
2218 DECL_ARTIFICIAL (refdecl
) = DECL_ARTIFICIAL (decl
);
2219 DECL_IGNORED_P (refdecl
) = DECL_IGNORED_P (decl
);
2220 TREE_STATIC (refdecl
) = 1;
2221 TREE_PUBLIC (refdecl
) = 0;
2222 TREE_USED (refdecl
) = 1;
2223 assemble_alias (refdecl
, DECL_ASSEMBLER_NAME (decl
));
2226 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2227 fold_convert (const_ptr_type_node
,
2228 build_fold_addr_expr (refdecl
)));
2229 size
= tree_to_uhwi (DECL_SIZE_UNIT (decl
));
2230 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2231 size
+= asan_red_zone_size (size
);
2232 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2233 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2234 fold_convert (const_ptr_type_node
, str_cst
));
2235 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2236 fold_convert (const_ptr_type_node
, module_name_cst
));
2237 varpool_node
*vnode
= varpool_node::get (decl
);
2238 int has_dynamic_init
= vnode
? vnode
->dynamically_initialized
: 0;
2239 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2240 build_int_cst (uptr
, has_dynamic_init
));
2241 tree locptr
= NULL_TREE
;
2242 location_t loc
= DECL_SOURCE_LOCATION (decl
);
2243 expanded_location xloc
= expand_location (loc
);
2244 if (xloc
.file
!= NULL
)
2246 static int lasanloccnt
= 0;
2248 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASANLOC", ++lasanloccnt
);
2249 tree var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (buf
),
2250 ubsan_get_source_location_type ());
2251 TREE_STATIC (var
) = 1;
2252 TREE_PUBLIC (var
) = 0;
2253 DECL_ARTIFICIAL (var
) = 1;
2254 DECL_IGNORED_P (var
) = 1;
2255 pretty_printer filename_pp
;
2256 pp_string (&filename_pp
, xloc
.file
);
2257 tree str
= asan_pp_string (&filename_pp
);
2258 tree ctor
= build_constructor_va (TREE_TYPE (var
), 3,
2259 NULL_TREE
, str
, NULL_TREE
,
2260 build_int_cst (unsigned_type_node
,
2261 xloc
.line
), NULL_TREE
,
2262 build_int_cst (unsigned_type_node
,
2264 TREE_CONSTANT (ctor
) = 1;
2265 TREE_STATIC (ctor
) = 1;
2266 DECL_INITIAL (var
) = ctor
;
2267 varpool_node::finalize_decl (var
);
2268 locptr
= fold_convert (uptr
, build_fold_addr_expr (var
));
2271 locptr
= build_int_cst (uptr
, 0);
2272 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, locptr
);
2273 init
= build_constructor (type
, vinner
);
2274 CONSTRUCTOR_APPEND_ELT (v
, NULL_TREE
, init
);
2277 /* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2279 initialize_sanitizer_builtins (void)
2283 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT
))
2286 tree BT_FN_VOID
= build_function_type_list (void_type_node
, NULL_TREE
);
2288 = build_function_type_list (void_type_node
, ptr_type_node
, NULL_TREE
);
2289 tree BT_FN_VOID_CONST_PTR
2290 = build_function_type_list (void_type_node
, const_ptr_type_node
, NULL_TREE
);
2291 tree BT_FN_VOID_PTR_PTR
2292 = build_function_type_list (void_type_node
, ptr_type_node
,
2293 ptr_type_node
, NULL_TREE
);
2294 tree BT_FN_VOID_PTR_PTR_PTR
2295 = build_function_type_list (void_type_node
, ptr_type_node
,
2296 ptr_type_node
, ptr_type_node
, NULL_TREE
);
2297 tree BT_FN_VOID_PTR_PTRMODE
2298 = build_function_type_list (void_type_node
, ptr_type_node
,
2299 pointer_sized_int_node
, NULL_TREE
);
2301 = build_function_type_list (void_type_node
, integer_type_node
, NULL_TREE
);
2302 tree BT_FN_SIZE_CONST_PTR_INT
2303 = build_function_type_list (size_type_node
, const_ptr_type_node
,
2304 integer_type_node
, NULL_TREE
);
2305 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[5];
2306 tree BT_FN_IX_CONST_VPTR_INT
[5];
2307 tree BT_FN_IX_VPTR_IX_INT
[5];
2308 tree BT_FN_VOID_VPTR_IX_INT
[5];
2310 = build_pointer_type (build_qualified_type (void_type_node
,
2311 TYPE_QUAL_VOLATILE
));
2313 = build_pointer_type (build_qualified_type (void_type_node
,
2317 = lang_hooks
.types
.type_for_size (BOOL_TYPE_SIZE
, 1);
2319 for (i
= 0; i
< 5; i
++)
2321 tree ix
= build_nonstandard_integer_type (BITS_PER_UNIT
* (1 << i
), 1);
2322 BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[i
]
2323 = build_function_type_list (boolt
, vptr
, ptr_type_node
, ix
,
2324 integer_type_node
, integer_type_node
,
2326 BT_FN_IX_CONST_VPTR_INT
[i
]
2327 = build_function_type_list (ix
, cvptr
, integer_type_node
, NULL_TREE
);
2328 BT_FN_IX_VPTR_IX_INT
[i
]
2329 = build_function_type_list (ix
, vptr
, ix
, integer_type_node
,
2331 BT_FN_VOID_VPTR_IX_INT
[i
]
2332 = build_function_type_list (void_type_node
, vptr
, ix
,
2333 integer_type_node
, NULL_TREE
);
2335 #define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2336 #define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2337 #define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2338 #define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2339 #define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2340 #define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2341 #define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2342 #define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2343 #define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2344 #define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2345 #define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2346 #define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2347 #define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2348 #define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2349 #define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2350 #define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2351 #define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2352 #define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2353 #define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2354 #define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2355 #undef ATTR_NOTHROW_LEAF_LIST
2356 #define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2357 #undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2358 #define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2359 #undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2360 #define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2361 #undef ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2362 #define ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST \
2363 ECF_CONST | ATTR_NORETURN_NOTHROW_LEAF_LIST
2364 #undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2365 #define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2366 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2367 #undef ATTR_COLD_NOTHROW_LEAF_LIST
2368 #define ATTR_COLD_NOTHROW_LEAF_LIST \
2369 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2370 #undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2371 #define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2372 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2373 #undef ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST
2374 #define ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST \
2375 /* ECF_COLD missing */ ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2376 #undef ATTR_PURE_NOTHROW_LEAF_LIST
2377 #define ATTR_PURE_NOTHROW_LEAF_LIST ECF_PURE | ATTR_NOTHROW_LEAF_LIST
2378 #undef DEF_SANITIZER_BUILTIN
2379 #define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2380 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2381 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2382 set_call_expr_flags (decl, ATTRS); \
2383 set_builtin_decl (ENUM, decl, true);
2385 #include "sanitizer.def"
2387 /* -fsanitize=object-size uses __builtin_object_size, but that might
2388 not be available for e.g. Fortran at this point. We use
2389 DEF_SANITIZER_BUILTIN here only as a convenience macro. */
2390 if ((flag_sanitize
& SANITIZE_OBJECT_SIZE
)
2391 && !builtin_decl_implicit_p (BUILT_IN_OBJECT_SIZE
))
2392 DEF_SANITIZER_BUILTIN (BUILT_IN_OBJECT_SIZE
, "object_size",
2393 BT_FN_SIZE_CONST_PTR_INT
,
2394 ATTR_PURE_NOTHROW_LEAF_LIST
)
2396 #undef DEF_SANITIZER_BUILTIN
2399 /* Called via htab_traverse. Count number of emitted
2400 STRING_CSTs in the constant hash table. */
2403 count_string_csts (constant_descriptor_tree
**slot
,
2404 unsigned HOST_WIDE_INT
*data
)
2406 struct constant_descriptor_tree
*desc
= *slot
;
2407 if (TREE_CODE (desc
->value
) == STRING_CST
2408 && TREE_ASM_WRITTEN (desc
->value
)
2409 && asan_protect_global (desc
->value
))
2414 /* Helper structure to pass two parameters to
2417 struct asan_add_string_csts_data
2420 vec
<constructor_elt
, va_gc
> *v
;
2423 /* Called via hash_table::traverse. Call asan_add_global
2424 on emitted STRING_CSTs from the constant hash table. */
2427 add_string_csts (constant_descriptor_tree
**slot
,
2428 asan_add_string_csts_data
*aascd
)
2430 struct constant_descriptor_tree
*desc
= *slot
;
2431 if (TREE_CODE (desc
->value
) == STRING_CST
2432 && TREE_ASM_WRITTEN (desc
->value
)
2433 && asan_protect_global (desc
->value
))
2435 asan_add_global (SYMBOL_REF_DECL (XEXP (desc
->rtl
, 0)),
2436 aascd
->type
, aascd
->v
);
2441 /* Needs to be GTY(()), because cgraph_build_static_cdtor may
2442 invoke ggc_collect. */
2443 static GTY(()) tree asan_ctor_statements
;
2445 /* Module-level instrumentation.
2446 - Insert __asan_init_vN() into the list of CTORs.
2447 - TODO: insert redzones around globals.
2451 asan_finish_file (void)
2453 varpool_node
*vnode
;
2454 unsigned HOST_WIDE_INT gcount
= 0;
2456 if (shadow_ptr_types
[0] == NULL_TREE
)
2457 asan_init_shadow_ptr_types ();
2458 /* Avoid instrumenting code in the asan ctors/dtors.
2459 We don't need to insert padding after the description strings,
2460 nor after .LASAN* array. */
2461 flag_sanitize
&= ~SANITIZE_ADDRESS
;
2463 /* For user-space we want asan constructors to run first.
2464 Linux kernel does not support priorities other than default, and the only
2465 other user of constructors is coverage. So we run with the default
2467 int priority
= flag_sanitize
& SANITIZE_USER_ADDRESS
2468 ? MAX_RESERVED_INIT_PRIORITY
- 1 : DEFAULT_INIT_PRIORITY
;
2470 if (flag_sanitize
& SANITIZE_USER_ADDRESS
)
2472 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_INIT
);
2473 append_to_statement_list (build_call_expr (fn
, 0), &asan_ctor_statements
);
2474 fn
= builtin_decl_implicit (BUILT_IN_ASAN_VERSION_MISMATCH_CHECK
);
2475 append_to_statement_list (build_call_expr (fn
, 0), &asan_ctor_statements
);
2477 FOR_EACH_DEFINED_VARIABLE (vnode
)
2478 if (TREE_ASM_WRITTEN (vnode
->decl
)
2479 && asan_protect_global (vnode
->decl
))
2481 hash_table
<tree_descriptor_hasher
> *const_desc_htab
= constant_pool_htab ();
2482 const_desc_htab
->traverse
<unsigned HOST_WIDE_INT
*, count_string_csts
>
2486 tree type
= asan_global_struct (), var
, ctor
;
2487 tree dtor_statements
= NULL_TREE
;
2488 vec
<constructor_elt
, va_gc
> *v
;
2491 type
= build_array_type_nelts (type
, gcount
);
2492 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", 0);
2493 var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (buf
),
2495 TREE_STATIC (var
) = 1;
2496 TREE_PUBLIC (var
) = 0;
2497 DECL_ARTIFICIAL (var
) = 1;
2498 DECL_IGNORED_P (var
) = 1;
2499 vec_alloc (v
, gcount
);
2500 FOR_EACH_DEFINED_VARIABLE (vnode
)
2501 if (TREE_ASM_WRITTEN (vnode
->decl
)
2502 && asan_protect_global (vnode
->decl
))
2503 asan_add_global (vnode
->decl
, TREE_TYPE (type
), v
);
2504 struct asan_add_string_csts_data aascd
;
2505 aascd
.type
= TREE_TYPE (type
);
2507 const_desc_htab
->traverse
<asan_add_string_csts_data
*, add_string_csts
>
2509 ctor
= build_constructor (type
, v
);
2510 TREE_CONSTANT (ctor
) = 1;
2511 TREE_STATIC (ctor
) = 1;
2512 DECL_INITIAL (var
) = ctor
;
2513 varpool_node::finalize_decl (var
);
2515 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS
);
2516 tree gcount_tree
= build_int_cst (pointer_sized_int_node
, gcount
);
2517 append_to_statement_list (build_call_expr (fn
, 2,
2518 build_fold_addr_expr (var
),
2520 &asan_ctor_statements
);
2522 fn
= builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS
);
2523 append_to_statement_list (build_call_expr (fn
, 2,
2524 build_fold_addr_expr (var
),
2527 cgraph_build_static_cdtor ('D', dtor_statements
, priority
);
2529 if (asan_ctor_statements
)
2530 cgraph_build_static_cdtor ('I', asan_ctor_statements
, priority
);
2531 flag_sanitize
|= SANITIZE_ADDRESS
;
2534 /* Expand the ASAN_{LOAD,STORE} builtins. */
2537 asan_expand_check_ifn (gimple_stmt_iterator
*iter
, bool use_calls
)
2539 gimple
*g
= gsi_stmt (*iter
);
2540 location_t loc
= gimple_location (g
);
2543 = (flag_sanitize
& flag_sanitize_recover
& SANITIZE_KERNEL_ADDRESS
) != 0;
2545 HOST_WIDE_INT flags
= tree_to_shwi (gimple_call_arg (g
, 0));
2546 gcc_assert (flags
< ASAN_CHECK_LAST
);
2547 bool is_scalar_access
= (flags
& ASAN_CHECK_SCALAR_ACCESS
) != 0;
2548 bool is_store
= (flags
& ASAN_CHECK_STORE
) != 0;
2549 bool is_non_zero_len
= (flags
& ASAN_CHECK_NON_ZERO_LEN
) != 0;
2551 tree base
= gimple_call_arg (g
, 1);
2552 tree len
= gimple_call_arg (g
, 2);
2553 HOST_WIDE_INT align
= tree_to_shwi (gimple_call_arg (g
, 3));
2555 HOST_WIDE_INT size_in_bytes
2556 = is_scalar_access
&& tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
2560 /* Instrument using callbacks. */
2561 gimple
*g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2563 gimple_set_location (g
, loc
);
2564 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2565 tree base_addr
= gimple_assign_lhs (g
);
2568 tree fun
= check_func (is_store
, recover_p
, size_in_bytes
, &nargs
);
2570 g
= gimple_build_call (fun
, 1, base_addr
);
2573 gcc_assert (nargs
== 2);
2574 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2576 gimple_set_location (g
, loc
);
2577 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2578 tree sz_arg
= gimple_assign_lhs (g
);
2579 g
= gimple_build_call (fun
, nargs
, base_addr
, sz_arg
);
2581 gimple_set_location (g
, loc
);
2582 gsi_replace (iter
, g
, false);
2586 HOST_WIDE_INT real_size_in_bytes
= size_in_bytes
== -1 ? 1 : size_in_bytes
;
2588 tree shadow_ptr_type
= shadow_ptr_types
[real_size_in_bytes
== 16 ? 1 : 0];
2589 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
2591 gimple_stmt_iterator gsi
= *iter
;
2593 if (!is_non_zero_len
)
2595 /* So, the length of the memory area to asan-protect is
2596 non-constant. Let's guard the generated instrumentation code
2601 //asan instrumentation code goes here.
2603 // falltrough instructions, starting with *ITER. */
2605 g
= gimple_build_cond (NE_EXPR
,
2607 build_int_cst (TREE_TYPE (len
), 0),
2608 NULL_TREE
, NULL_TREE
);
2609 gimple_set_location (g
, loc
);
2611 basic_block then_bb
, fallthrough_bb
;
2612 insert_if_then_before_iter (as_a
<gcond
*> (g
), iter
,
2613 /*then_more_likely_p=*/true,
2614 &then_bb
, &fallthrough_bb
);
2615 /* Note that fallthrough_bb starts with the statement that was
2616 pointed to by ITER. */
2618 /* The 'then block' of the 'if (len != 0) condition is where
2619 we'll generate the asan instrumentation code now. */
2620 gsi
= gsi_last_bb (then_bb
);
2623 /* Get an iterator on the point where we can add the condition
2624 statement for the instrumentation. */
2625 basic_block then_bb
, else_bb
;
2626 gsi
= create_cond_insert_point (&gsi
, /*before_p*/false,
2627 /*then_more_likely_p=*/false,
2628 /*create_then_fallthru_edge*/recover_p
,
2632 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2634 gimple_set_location (g
, loc
);
2635 gsi_insert_before (&gsi
, g
, GSI_NEW_STMT
);
2636 tree base_addr
= gimple_assign_lhs (g
);
2639 if (real_size_in_bytes
>= 8)
2641 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_addr
,
2647 /* Slow path for 1, 2 and 4 byte accesses. */
2648 /* Test (shadow != 0)
2649 & ((base_addr & 7) + (real_size_in_bytes - 1)) >= shadow). */
2650 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_addr
,
2652 gimple
*shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
2653 gimple_seq seq
= NULL
;
2654 gimple_seq_add_stmt (&seq
, shadow_test
);
2655 /* Aligned (>= 8 bytes) can test just
2656 (real_size_in_bytes - 1 >= shadow), as base_addr & 7 is known
2660 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
,
2662 gimple_seq_add_stmt (&seq
,
2663 build_type_cast (shadow_type
,
2664 gimple_seq_last (seq
)));
2665 if (real_size_in_bytes
> 1)
2666 gimple_seq_add_stmt (&seq
,
2667 build_assign (PLUS_EXPR
,
2668 gimple_seq_last (seq
),
2669 real_size_in_bytes
- 1));
2670 t
= gimple_assign_lhs (gimple_seq_last_stmt (seq
));
2673 t
= build_int_cst (shadow_type
, real_size_in_bytes
- 1);
2674 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
, t
, shadow
));
2675 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
2676 gimple_seq_last (seq
)));
2677 t
= gimple_assign_lhs (gimple_seq_last (seq
));
2678 gimple_seq_set_location (seq
, loc
);
2679 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
2681 /* For non-constant, misaligned or otherwise weird access sizes,
2682 check first and last byte. */
2683 if (size_in_bytes
== -1)
2685 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2687 build_int_cst (pointer_sized_int_node
, 1));
2688 gimple_set_location (g
, loc
);
2689 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2690 tree last
= gimple_assign_lhs (g
);
2691 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2692 PLUS_EXPR
, base_addr
, last
);
2693 gimple_set_location (g
, loc
);
2694 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2695 tree base_end_addr
= gimple_assign_lhs (g
);
2697 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_end_addr
,
2699 gimple
*shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
2700 gimple_seq seq
= NULL
;
2701 gimple_seq_add_stmt (&seq
, shadow_test
);
2702 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
,
2704 gimple_seq_add_stmt (&seq
, build_type_cast (shadow_type
,
2705 gimple_seq_last (seq
)));
2706 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
,
2707 gimple_seq_last (seq
),
2709 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
2710 gimple_seq_last (seq
)));
2711 gimple_seq_add_stmt (&seq
, build_assign (BIT_IOR_EXPR
, t
,
2712 gimple_seq_last (seq
)));
2713 t
= gimple_assign_lhs (gimple_seq_last (seq
));
2714 gimple_seq_set_location (seq
, loc
);
2715 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
2719 g
= gimple_build_cond (NE_EXPR
, t
, build_int_cst (TREE_TYPE (t
), 0),
2720 NULL_TREE
, NULL_TREE
);
2721 gimple_set_location (g
, loc
);
2722 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2724 /* Generate call to the run-time library (e.g. __asan_report_load8). */
2725 gsi
= gsi_start_bb (then_bb
);
2727 tree fun
= report_error_func (is_store
, recover_p
, size_in_bytes
, &nargs
);
2728 g
= gimple_build_call (fun
, nargs
, base_addr
, len
);
2729 gimple_set_location (g
, loc
);
2730 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2732 gsi_remove (iter
, true);
2733 *iter
= gsi_start_bb (else_bb
);
2738 /* Instrument the current function. */
2741 asan_instrument (void)
2743 if (shadow_ptr_types
[0] == NULL_TREE
)
2744 asan_init_shadow_ptr_types ();
2745 transform_statements ();
2752 return (flag_sanitize
& SANITIZE_ADDRESS
) != 0
2753 && !lookup_attribute ("no_sanitize_address",
2754 DECL_ATTRIBUTES (current_function_decl
));
2759 const pass_data pass_data_asan
=
2761 GIMPLE_PASS
, /* type */
2763 OPTGROUP_NONE
, /* optinfo_flags */
2764 TV_NONE
, /* tv_id */
2765 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2766 0, /* properties_provided */
2767 0, /* properties_destroyed */
2768 0, /* todo_flags_start */
2769 TODO_update_ssa
, /* todo_flags_finish */
2772 class pass_asan
: public gimple_opt_pass
2775 pass_asan (gcc::context
*ctxt
)
2776 : gimple_opt_pass (pass_data_asan
, ctxt
)
2779 /* opt_pass methods: */
2780 opt_pass
* clone () { return new pass_asan (m_ctxt
); }
2781 virtual bool gate (function
*) { return gate_asan (); }
2782 virtual unsigned int execute (function
*) { return asan_instrument (); }
2784 }; // class pass_asan
2789 make_pass_asan (gcc::context
*ctxt
)
2791 return new pass_asan (ctxt
);
2796 const pass_data pass_data_asan_O0
=
2798 GIMPLE_PASS
, /* type */
2800 OPTGROUP_NONE
, /* optinfo_flags */
2801 TV_NONE
, /* tv_id */
2802 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2803 0, /* properties_provided */
2804 0, /* properties_destroyed */
2805 0, /* todo_flags_start */
2806 TODO_update_ssa
, /* todo_flags_finish */
2809 class pass_asan_O0
: public gimple_opt_pass
2812 pass_asan_O0 (gcc::context
*ctxt
)
2813 : gimple_opt_pass (pass_data_asan_O0
, ctxt
)
2816 /* opt_pass methods: */
2817 virtual bool gate (function
*) { return !optimize
&& gate_asan (); }
2818 virtual unsigned int execute (function
*) { return asan_instrument (); }
2820 }; // class pass_asan_O0
2825 make_pass_asan_O0 (gcc::context
*ctxt
)
2827 return new pass_asan_O0 (ctxt
);
2830 #include "gt-asan.h"