#include "llvm/Transforms/Instrumentation.h"
#include "llvm/ADT/ArrayRef.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/ADT/DepthFirstIterator.h"
#include "llvm/ADT/OwningPtr.h"
#include "llvm/ADT/SmallSet.h"
#include "llvm/ADT/SmallString.h"
#include "llvm/ADT/SmallVector.h"
#include "llvm/ADT/Statistic.h"
#include "llvm/ADT/StringExtras.h"
#include "llvm/ADT/Triple.h"
#include "llvm/DIBuilder.h"
#include "llvm/IR/DataLayout.h"
#include "llvm/IR/Function.h"
#include "llvm/IR/IRBuilder.h"
#include "llvm/IR/InlineAsm.h"
#include "llvm/IR/IntrinsicInst.h"
#include "llvm/IR/LLVMContext.h"
#include "llvm/IR/Module.h"
#include "llvm/IR/Type.h"
#include "llvm/InstVisitor.h"
#include "llvm/Support/CallSite.h"
#include "llvm/Support/CommandLine.h"
#include "llvm/Support/DataTypes.h"
#include "llvm/Support/Debug.h"
#include "llvm/Support/Endian.h"
#include "llvm/Support/raw_ostream.h"
#include "llvm/Support/system_error.h"
#include "llvm/Transforms/Utils/BasicBlockUtils.h"
#include "llvm/Transforms/Utils/Cloning.h"
#include "llvm/Transforms/Utils/Local.h"
#include "llvm/Transforms/Utils/ModuleUtils.h"
#include "llvm/Transforms/Utils/SpecialCaseList.h"
#include <algorithm>
#include <string>

Include dependency graph for AddressSanitizer.cpp:

Macros
#define	DEBUG_TYPE "asan"

Functions
	STATISTIC (NumInstrumentedReads,"Number of instrumented reads")

	STATISTIC (NumInstrumentedWrites,"Number of instrumented writes")

	STATISTIC (NumOptimizedAccessesToGlobalArray,"Number of optimized accesses to global arrays")

	STATISTIC (NumOptimizedAccessesToGlobalVar,"Number of optimized accesses to global vars")

	INITIALIZE_PASS (AddressSanitizer,"asan","AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, false) FunctionPass *llvm

	INITIALIZE_PASS (AddressSanitizerModule,"asan-module","AddressSanitizer: detects use-after-free and out-of-bounds bugs.""ModulePass", false, false) ModulePass *llvm

static size_t	TypeSizeToSizeIndex (uint32_t TypeSize)

static GlobalVariable *	createPrivateGlobalForString (Module &M, StringRef Str)

static bool	GlobalWasGeneratedByAsan (GlobalVariable *G)

static Value *	isInterestingMemoryAccess (Instruction I, bool IsWrite)

static Function *	checkInterfaceFunction (Constant *FuncOrBitcast)

static uint64_t	ValueForPoison (uint64_t PoisonByte, size_t ShadowRedzoneSize)

static void	PoisonShadowPartialRightRedzone (uint8_t *Shadow, size_t Size, size_t RZSize, size_t ShadowGranularity, uint8_t Magic)

static int	StackMallocSizeClass (uint64_t LocalStackSize)

Variables
static const uint64_t	kDefaultShadowScale = 3

static const uint64_t	kDefaultShadowOffset32 = 1ULL << 29

static const uint64_t	kDefaultShadowOffset64 = 1ULL << 44

static const uint64_t	kDefaultShort64bitShadowOffset = 0x7FFF8000

static const uint64_t	kPPC64_ShadowOffset64 = 1ULL << 41

static const uint64_t	kMIPS32_ShadowOffset32 = 0x0aaa8000

static const size_t	kMinStackMallocSize = 1 << 6

static const size_t	kMaxStackMallocSize = 1 << 16

static const uintptr_t	kCurrentStackFrameMagic = 0x41B58AB3

static const uintptr_t	kRetiredStackFrameMagic = 0x45E0360E

static const char *const	kAsanModuleCtorName = "asan.module_ctor"

static const char *const	kAsanModuleDtorName = "asan.module_dtor"

static const int	kAsanCtorAndCtorPriority = 1

static const char *const	kAsanReportErrorTemplate = "__asan_report_"

static const char *const	kAsanReportLoadN = "__asan_report_load_n"

static const char *const	kAsanReportStoreN = "__asan_report_store_n"

static const char *const	kAsanRegisterGlobalsName = "__asan_register_globals"

static const char *const	kAsanUnregisterGlobalsName

static const char *const	kAsanPoisonGlobalsName = "__asan_before_dynamic_init"

static const char *const	kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"

static const char *const	kAsanInitName = "__asan_init_v3"

static const char *const	kAsanCovName = "__sanitizer_cov"

static const char *const	kAsanHandleNoReturnName = "__asan_handle_no_return"

static const char *const	kAsanMappingOffsetName = "__asan_mapping_offset"

static const char *const	kAsanMappingScaleName = "__asan_mapping_scale"

static const int	kMaxAsanStackMallocSizeClass = 10

static const char *const	kAsanStackMallocNameTemplate = "__asan_stack_malloc_"

static const char *const	kAsanStackFreeNameTemplate = "__asan_stack_free_"

static const char *const	kAsanGenPrefix = "__asan_gen_"

static const char *const	kAsanPoisonStackMemoryName

static const char *const	kAsanUnpoisonStackMemoryName

static const char *const	kAsanOptionDetectUAR

static const int	kAsanStackLeftRedzoneMagic = 0xf1

static const int	kAsanStackMidRedzoneMagic = 0xf2

static const int	kAsanStackRightRedzoneMagic = 0xf3

static const int	kAsanStackPartialRedzoneMagic = 0xf4

static const int	kAsanStackAfterReturnMagic = 0xf5

static const size_t	kNumberOfAccessSizes = 5

static cl::opt< bool >	ClInstrumentReads ("asan-instrument-reads", cl::desc("instrument read instructions"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClInstrumentWrites ("asan-instrument-writes", cl::desc("instrument write instructions"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClInstrumentAtomics ("asan-instrument-atomics", cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClAlwaysSlowPath ("asan-always-slow-path", cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, cl::init(false))

static cl::opt< int >	ClMaxInsnsToInstrumentPerBB ("asan-max-ins-per-bb", cl::init(10000), cl::desc("maximal number of instructions to instrument in any given BB"), cl::Hidden)

static cl::opt< bool >	ClStack ("asan-stack", cl::desc("Handle stack memory"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClUseAfterReturn ("asan-use-after-return", cl::desc("Check return-after-free"), cl::Hidden, cl::init(false))

static cl::opt< bool >	ClGlobals ("asan-globals", cl::desc("Handle global objects"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClCoverage ("asan-coverage", cl::desc("ASan coverage"), cl::Hidden, cl::init(false))

static cl::opt< bool >	ClInitializers ("asan-initialization-order", cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(false))

static cl::opt< bool >	ClMemIntrin ("asan-memintrin", cl::desc("Handle memset/memcpy/memmove"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClRealignStack ("asan-realign-stack", cl::desc("Realign stack to 32"), cl::Hidden, cl::init(true))

static cl::opt< std::string >	ClBlacklistFile ("asan-blacklist", cl::desc("File containing the list of objects to ignore ""during instrumentation"), cl::Hidden)

static cl::opt< bool >	ClKeepUninstrumented ("asan-keep-uninstrumented-functions", cl::desc("Keep uninstrumented copies of functions"), cl::Hidden, cl::init(false))

static cl::opt< int >	ClMappingScale ("asan-mapping-scale", cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0))

static cl::opt< int >	ClMappingOffsetLog ("asan-mapping-offset-log", cl::desc("offset of asan shadow mapping"), cl::Hidden, cl::init(-1))

static cl::opt< bool >	ClShort64BitOffset ("asan-short-64bit-mapping-offset", cl::desc("Use short immediate constant as the mapping offset for 64bit"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClOpt ("asan-opt", cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClOptSameTemp ("asan-opt-same-temp", cl::desc("Instrument the same temp just once"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClOptGlobals ("asan-opt-globals", cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClCheckLifetime ("asan-check-lifetime", cl::desc("Use llvm.lifetime intrinsics to insert extra checks"), cl::Hidden, cl::init(false))

static cl::opt< int >	ClDebug ("asan-debug", cl::desc("debug"), cl::Hidden, cl::init(0))

static cl::opt< int >	ClDebugStack ("asan-debug-stack", cl::desc("debug stack"), cl::Hidden, cl::init(0))

static cl::opt< std::string >	ClDebugFunc ("asan-debug-func", cl::Hidden, cl::desc("Debug func"))

static cl::opt< int >	ClDebugMin ("asan-debug-min", cl::desc("Debug min inst"), cl::Hidden, cl::init(-1))

static cl::opt< int >	ClDebugMax ("asan-debug-max", cl::desc("Debug man inst"), cl::Hidden, cl::init(-1))

Macro Definition Documentation

#define DEBUG_TYPE "asan"

Definition at line 16 of file AddressSanitizer.cpp.

Function Documentation

static Function* checkInterfaceFunction ( Constant * FuncOrBitcast )

static

Definition at line 739 of file AddressSanitizer.cpp.

References llvm::Value::dump(), and llvm::report_fatal_error().

static GlobalVariable* createPrivateGlobalForString	(	Module &	M,
		StringRef	Str
	)

static

Definition at line 579 of file AddressSanitizer.cpp.

References llvm::Module::getContext(), llvm::ConstantDataArray::getString(), llvm::Value::getType(), llvm::GlobalValue::InternalLinkage, kAsanGenPrefix, and llvm::GlobalValue::setUnnamedAddr().

static bool GlobalWasGeneratedByAsan ( GlobalVariable * G )

static

Definition at line 589 of file AddressSanitizer.cpp.

References llvm::StringRef::find(), llvm::Value::getName(), and kAsanGenPrefix.

INITIALIZE_PASS	(	AddressSanitizer	,
		"asan"	,
		"AddressSanitizer: detects use-after-free and out-of-bounds bugs."	,
		false	,
		false
	)

Definition at line 552 of file AddressSanitizer.cpp.

INITIALIZE_PASS	(	AddressSanitizerModule	,
		"asan-module"	,
		"AddressSanitizer: detects use-after-free and out-of-bounds bugs.""ModulePass"	,
		false	,
		false
	)

Definition at line 563 of file AddressSanitizer.cpp.

static Value* isInterestingMemoryAccess	(	Instruction *	I,
		bool *	IsWrite
	)

static

Definition at line 649 of file AddressSanitizer.cpp.

References ClInstrumentAtomics, ClInstrumentReads, ClInstrumentWrites, and LI.

static void PoisonShadowPartialRightRedzone	(	uint8_t *	Shadow,
		size_t	Size,
		size_t	RZSize,
		size_t	ShadowGranularity,
		uint8_t	Magic
	)

static

Definition at line 1335 of file AddressSanitizer.cpp.

References Magic.

static int StackMallocSizeClass ( uint64_t LocalStackSize )

static

Definition at line 1445 of file AddressSanitizer.cpp.

References kMaxStackMallocSize, kMinStackMallocSize, and llvm_unreachable.

STATISTIC	(	NumInstrumentedReads	,
		"Number of instrumented reads"
	)

STATISTIC	(	NumInstrumentedWrites	,
		"Number of instrumented writes"
	)

STATISTIC	(	NumOptimizedAccessesToGlobalArray	,
		"Number of optimized accesses to global arrays"
	)

STATISTIC	(	NumOptimizedAccessesToGlobalVar	,
		"Number of optimized accesses to global vars"
	)

static size_t TypeSizeToSizeIndex ( uint32_t TypeSize )

static

Definition at line 572 of file AddressSanitizer.cpp.

References llvm::countTrailingZeros(), and kNumberOfAccessSizes.

static uint64_t ValueForPoison	(	uint64_t	PoisonByte,
		size_t	ShadowRedzoneSize
	)

static

Definition at line 1326 of file AddressSanitizer.cpp.

References llvm_unreachable.

Variable Documentation

cl::opt<bool> ClAlwaysSlowPath("asan-always-slow-path", cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, cl::init(false))

static

cl::opt<std::string> ClBlacklistFile("asan-blacklist", cl::desc("File containing the list of objects to ignore ""during instrumentation"), cl::Hidden)

static

cl::opt<bool> ClCheckLifetime("asan-check-lifetime", cl::desc("Use llvm.lifetime intrinsics to insert extra checks"), cl::Hidden, cl::init(false))

static

cl::opt<bool> ClCoverage("asan-coverage", cl::desc("ASan coverage"), cl::Hidden, cl::init(false))

static

cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, cl::init(0))

static

cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden, cl::desc("Debug func"))

static

cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), cl::Hidden, cl::init(-1))

static

cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), cl::Hidden, cl::init(-1))

static

cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), cl::Hidden, cl::init(0))

static

cl::opt<bool> ClGlobals("asan-globals", cl::desc("Handle global objects"), cl::Hidden, cl::init(true))

static

cl::opt<bool> ClInitializers("asan-initialization-order", cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(false))

static

cl::opt<bool> ClInstrumentAtomics("asan-instrument-atomics", cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, cl::init(true))

static

Referenced by isInterestingMemoryAccess().

cl::opt<bool> ClInstrumentReads("asan-instrument-reads", cl::desc("instrument read instructions"), cl::Hidden, cl::init(true))

static

Referenced by isInterestingMemoryAccess().

cl::opt<bool> ClInstrumentWrites("asan-instrument-writes", cl::desc("instrument write instructions"), cl::Hidden, cl::init(true))

static

Referenced by isInterestingMemoryAccess().

cl::opt<bool> ClKeepUninstrumented("asan-keep-uninstrumented-functions", cl::desc("Keep uninstrumented copies of functions"), cl::Hidden, cl::init(false))

static

cl::opt<int> ClMappingOffsetLog("asan-mapping-offset-log", cl::desc("offset of asan shadow mapping"), cl::Hidden, cl::init(-1))

static

cl::opt<int> ClMappingScale("asan-mapping-scale", cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0))

static

cl::opt<int> ClMaxInsnsToInstrumentPerBB("asan-max-ins-per-bb", cl::init(10000), cl::desc("maximal number of instructions to instrument in any given BB"), cl::Hidden)

static

cl::opt<bool> ClMemIntrin("asan-memintrin", cl::desc("Handle memset/memcpy/memmove"), cl::Hidden, cl::init(true))

static

cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true))

static

cl::opt<bool> ClOptGlobals("asan-opt-globals", cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true))

static

cl::opt<bool> ClOptSameTemp("asan-opt-same-temp", cl::desc("Instrument the same temp just once"), cl::Hidden, cl::init(true))

static

cl::opt<bool> ClRealignStack("asan-realign-stack", cl::desc("Realign stack to 32"), cl::Hidden, cl::init(true))

static

cl::opt<bool> ClShort64BitOffset("asan-short-64bit-mapping-offset", cl::desc("Use short immediate constant as the mapping offset for 64bit"), cl::Hidden, cl::init(true))

static

cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"), cl::Hidden, cl::init(true))

static

cl::opt<bool> ClUseAfterReturn("asan-use-after-return", cl::desc("Check return-after-free"), cl::Hidden, cl::init(false))

static

const char* const kAsanCovName = "__sanitizer_cov"

static

Definition at line 80 of file AddressSanitizer.cpp.

const int kAsanCtorAndCtorPriority = 1

static

Definition at line 70 of file AddressSanitizer.cpp.

const char* const kAsanGenPrefix = "__asan_gen_"

static

Definition at line 87 of file AddressSanitizer.cpp.

Referenced by createPrivateGlobalForString(), and GlobalWasGeneratedByAsan().

const char* const kAsanHandleNoReturnName = "__asan_handle_no_return"

static

Definition at line 81 of file AddressSanitizer.cpp.

const char* const kAsanInitName = "__asan_init_v3"

static

Definition at line 79 of file AddressSanitizer.cpp.

const char* const kAsanMappingOffsetName = "__asan_mapping_offset"

static

Definition at line 82 of file AddressSanitizer.cpp.

const char* const kAsanMappingScaleName = "__asan_mapping_scale"

static

Definition at line 83 of file AddressSanitizer.cpp.

const char* const kAsanModuleCtorName = "asan.module_ctor"

static

Definition at line 68 of file AddressSanitizer.cpp.

const char* const kAsanModuleDtorName = "asan.module_dtor"

static

Definition at line 69 of file AddressSanitizer.cpp.

const char* const kAsanOptionDetectUAR

static

Initial value:

=

"__asan_option_detect_stack_use_after_return"

Definition at line 93 of file AddressSanitizer.cpp.

const char* const kAsanPoisonGlobalsName = "__asan_before_dynamic_init"

static

Definition at line 77 of file AddressSanitizer.cpp.

const char* const kAsanPoisonStackMemoryName

static

Initial value:

=

"__asan_poison_stack_memory"

Definition at line 88 of file AddressSanitizer.cpp.

const char* const kAsanRegisterGlobalsName = "__asan_register_globals"

static

Definition at line 74 of file AddressSanitizer.cpp.

const char* const kAsanReportErrorTemplate = "__asan_report_"

static

Definition at line 71 of file AddressSanitizer.cpp.

const char* const kAsanReportLoadN = "__asan_report_load_n"

static

Definition at line 72 of file AddressSanitizer.cpp.

const char* const kAsanReportStoreN = "__asan_report_store_n"

static

Definition at line 73 of file AddressSanitizer.cpp.

const int kAsanStackAfterReturnMagic = 0xf5

static

Definition at line 102 of file AddressSanitizer.cpp.

const char* const kAsanStackFreeNameTemplate = "__asan_stack_free_"

static

Definition at line 86 of file AddressSanitizer.cpp.

const int kAsanStackLeftRedzoneMagic = 0xf1

static

Definition at line 97 of file AddressSanitizer.cpp.

const char* const kAsanStackMallocNameTemplate = "__asan_stack_malloc_"

static

Definition at line 85 of file AddressSanitizer.cpp.

const int kAsanStackMidRedzoneMagic = 0xf2

static

Definition at line 98 of file AddressSanitizer.cpp.

const int kAsanStackPartialRedzoneMagic = 0xf4

static

Definition at line 100 of file AddressSanitizer.cpp.

const int kAsanStackRightRedzoneMagic = 0xf3

static

Definition at line 99 of file AddressSanitizer.cpp.

const char* const kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"

static

Definition at line 78 of file AddressSanitizer.cpp.

const char* const kAsanUnpoisonStackMemoryName

static

Initial value:

=

"__asan_unpoison_stack_memory"

Definition at line 90 of file AddressSanitizer.cpp.

const char* const kAsanUnregisterGlobalsName

static

Initial value:

=

"__asan_unregister_globals"

Definition at line 75 of file AddressSanitizer.cpp.

const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3

static

Definition at line 65 of file AddressSanitizer.cpp.

const uint64_t kDefaultShadowOffset32 = 1ULL << 29

static

Definition at line 57 of file AddressSanitizer.cpp.

const uint64_t kDefaultShadowOffset64 = 1ULL << 44

static

Definition at line 58 of file AddressSanitizer.cpp.

const uint64_t kDefaultShadowScale = 3

static

Definition at line 56 of file AddressSanitizer.cpp.

const uint64_t kDefaultShort64bitShadowOffset = 0x7FFF8000

static

Definition at line 59 of file AddressSanitizer.cpp.

const int kMaxAsanStackMallocSizeClass = 10

static

Definition at line 84 of file AddressSanitizer.cpp.

const size_t kMaxStackMallocSize = 1 << 16

static

Definition at line 64 of file AddressSanitizer.cpp.

Referenced by StackMallocSizeClass().

const size_t kMinStackMallocSize = 1 << 6

static

Definition at line 63 of file AddressSanitizer.cpp.

Referenced by StackMallocSizeClass().

const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa8000

static

Definition at line 61 of file AddressSanitizer.cpp.

const size_t kNumberOfAccessSizes = 5

static

Definition at line 106 of file AddressSanitizer.cpp.

Referenced by TypeSizeToSizeIndex().

const uint64_t kPPC64_ShadowOffset64 = 1ULL << 41

static

Definition at line 60 of file AddressSanitizer.cpp.

const uintptr_t kRetiredStackFrameMagic = 0x45E0360E

static

Definition at line 66 of file AddressSanitizer.cpp.

Macros

Functions

Variables

Macro Definition Documentation

Function Documentation

Variable Documentation