gcc/c-family/c-ubsan.c

   1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
   2    Copyright (C) 2013-2017 Free Software Foundation, Inc.
   3    Contributed by Marek Polacek <polacek@redhat.com>
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #include "system.h"
  23 #include "coretypes.h"
  24 #include "tm.h"
  25 #include "c-family/c-common.h"
  26 #include "ubsan.h"
  27 #include "c-family/c-ubsan.h"
  28 #include "asan.h"
  29 #include "stor-layout.h"
  30 #include "builtins.h"
  31 #include "gimplify.h"
  32
  33 /* Instrument division by zero and INT_MIN / -1.  If not instrumenting,
  34    return NULL_TREE.  */
  35
  36 tree
  37 ubsan_instrument_division (location_t loc, tree op0, tree op1)
  38 {
  39   tree t, tt;
  40   tree type = TREE_TYPE (op0);
  41
  42   /* At this point both operands should have the same type,
  43      because they are already converted to RESULT_TYPE.
  44      Use TYPE_MAIN_VARIANT since typedefs can confuse us.  */
  45   gcc_assert (TYPE_MAIN_VARIANT (TREE_TYPE (op0))
  46               == TYPE_MAIN_VARIANT (TREE_TYPE (op1)));
  47
  48   op0 = unshare_expr (op0);
  49   op1 = unshare_expr (op1);
  50
  51   if (TREE_CODE (type) == INTEGER_TYPE
  52       && (flag_sanitize & SANITIZE_DIVIDE))
  53     t = fold_build2 (EQ_EXPR, boolean_type_node,
  54                      op1, build_int_cst (type, 0));
  55   else if (TREE_CODE (type) == REAL_TYPE
  56            && (flag_sanitize & SANITIZE_FLOAT_DIVIDE))
  57     t = fold_build2 (EQ_EXPR, boolean_type_node,
  58                      op1, build_real (type, dconst0));
  59   else
  60     return NULL_TREE;
  61
  62   /* We check INT_MIN / -1 only for signed types.  */
  63   if (TREE_CODE (type) == INTEGER_TYPE
  64       && (flag_sanitize & SANITIZE_DIVIDE)
  65       && !TYPE_UNSIGNED (type))
  66     {
  67       tree x;
  68       tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1),
  69                         build_int_cst (type, -1));
  70       x = fold_build2 (EQ_EXPR, boolean_type_node, op0,
  71                        TYPE_MIN_VALUE (type));
  72       x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt);
  73       t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x);
  74     }
  75
  76   /* If the condition was folded to 0, no need to instrument
  77      this expression.  */
  78   if (integer_zerop (t))
  79     return NULL_TREE;
  80
  81   /* In case we have a SAVE_EXPR in a conditional context, we need to
  82      make sure it gets evaluated before the condition.  */
  83   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
  84   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
  85   if (flag_sanitize_undefined_trap_on_error)
  86     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
  87   else
  88     {
  89       tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc,
  90                                      ubsan_type_descriptor (type), NULL_TREE,
  91                                      NULL_TREE);
  92       data = build_fold_addr_expr_loc (loc, data);
  93       enum built_in_function bcode
  94         = (flag_sanitize_recover & SANITIZE_DIVIDE)
  95           ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
  96           : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
  97       tt = builtin_decl_explicit (bcode);
  98       op0 = unshare_expr (op0);
  99       op1 = unshare_expr (op1);
 100       tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
 101                                 ubsan_encode_value (op1));
 102     }
 103   t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
 104
 105   return t;
 106 }
 107
 108 /* Instrument left and right shifts.  */
 109
 110 tree
 111 ubsan_instrument_shift (location_t loc, enum tree_code code,
 112                         tree op0, tree op1)
 113 {
 114   tree t, tt = NULL_TREE;
 115   tree type0 = TREE_TYPE (op0);
 116   tree type1 = TREE_TYPE (op1);
 117   if (!INTEGRAL_TYPE_P (type0))
 118     return NULL_TREE;
 119
 120   tree op1_utype = unsigned_type_for (type1);
 121   HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
 122   tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);
 123
 124   op0 = unshare_expr (op0);
 125   op1 = unshare_expr (op1);
 126
 127   t = fold_convert_loc (loc, op1_utype, op1);
 128   t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);
 129
 130   /* If this is not a signed operation, don't perform overflow checks.
 131      Also punt on bit-fields.  */
 132   if (TYPE_OVERFLOW_WRAPS (type0)
 133       || GET_MODE_BITSIZE (TYPE_MODE (type0)) != TYPE_PRECISION (type0)
 134       || (flag_sanitize & SANITIZE_SHIFT_BASE) == 0)
 135     ;
 136
 137   /* For signed x << y, in C99/C11, the following:
 138      (unsigned) x >> (uprecm1 - y)
 139      if non-zero, is undefined.  */
 140   else if (code == LSHIFT_EXPR && flag_isoc99 && cxx_dialect < cxx11)
 141     {
 142       tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
 143                             fold_convert (op1_utype, unshare_expr (op1)));
 144       tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
 145       tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
 146       tt = fold_build2 (NE_EXPR, boolean_type_node, tt,
 147                         build_int_cst (TREE_TYPE (tt), 0));
 148     }
 149
 150   /* For signed x << y, in C++11 and later, the following:
 151      x < 0 || ((unsigned) x >> (uprecm1 - y))
 152      if > 1, is undefined.  */
 153   else if (code == LSHIFT_EXPR && cxx_dialect >= cxx11)
 154     {
 155       tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
 156                             fold_convert (op1_utype, unshare_expr (op1)));
 157       tt = fold_convert_loc (loc, unsigned_type_for (type0),
 158                              unshare_expr (op0));
 159       tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
 160       tt = fold_build2 (GT_EXPR, boolean_type_node, tt,
 161                         build_int_cst (TREE_TYPE (tt), 1));
 162       x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0),
 163                        build_int_cst (type0, 0));
 164       tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt);
 165     }
 166
 167   /* If the condition was folded to 0, no need to instrument
 168      this expression.  */
 169   if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt)))
 170     return NULL_TREE;
 171
 172   /* In case we have a SAVE_EXPR in a conditional context, we need to
 173      make sure it gets evaluated before the condition.  */
 174   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
 175   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
 176
 177   enum sanitize_code recover_kind = SANITIZE_SHIFT_EXPONENT;
 178   tree else_t = void_node;
 179   if (tt)
 180     {
 181       if ((flag_sanitize & SANITIZE_SHIFT_EXPONENT) == 0)
 182         {
 183           t = fold_build1 (TRUTH_NOT_EXPR, boolean_type_node, t);
 184           t = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, t, tt);
 185           recover_kind = SANITIZE_SHIFT_BASE;
 186         }
 187       else
 188         {
 189           if (flag_sanitize_undefined_trap_on_error
 190               || ((!(flag_sanitize_recover & SANITIZE_SHIFT_EXPONENT))
 191                   == (!(flag_sanitize_recover & SANITIZE_SHIFT_BASE))))
 192             t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, tt);
 193           else
 194             else_t = tt;
 195         }
 196     }
 197
 198   if (flag_sanitize_undefined_trap_on_error)
 199     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 200   else
 201     {
 202       tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc,
 203                                      ubsan_type_descriptor (type0),
 204                                      ubsan_type_descriptor (type1), NULL_TREE,
 205                                      NULL_TREE);
 206       data = build_fold_addr_expr_loc (loc, data);
 207
 208       enum built_in_function bcode
 209         = (flag_sanitize_recover & recover_kind)
 210           ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
 211           : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
 212       tt = builtin_decl_explicit (bcode);
 213       op0 = unshare_expr (op0);
 214       op1 = unshare_expr (op1);
 215       tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
 216                                 ubsan_encode_value (op1));
 217       if (else_t != void_node)
 218         {
 219           bcode = (flag_sanitize_recover & SANITIZE_SHIFT_BASE)
 220                   ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
 221                   : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
 222           tree else_tt = builtin_decl_explicit (bcode);
 223           op0 = unshare_expr (op0);
 224           op1 = unshare_expr (op1);
 225           else_tt = build_call_expr_loc (loc, else_tt, 3, data,
 226                                          ubsan_encode_value (op0),
 227                                          ubsan_encode_value (op1));
 228           else_t = fold_build3 (COND_EXPR, void_type_node, else_t,
 229                                 else_tt, void_node);
 230         }
 231     }
 232   t = fold_build3 (COND_EXPR, void_type_node, t, tt, else_t);
 233
 234   return t;
 235 }
 236
 237 /* Instrument variable length array bound.  */
 238
 239 tree
 240 ubsan_instrument_vla (location_t loc, tree size)
 241 {
 242   tree type = TREE_TYPE (size);
 243   tree t, tt;
 244
 245   t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0));
 246   if (flag_sanitize_undefined_trap_on_error)
 247     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 248   else
 249     {
 250       tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc,
 251                                      ubsan_type_descriptor (type), NULL_TREE,
 252                                      NULL_TREE);
 253       data = build_fold_addr_expr_loc (loc, data);
 254       enum built_in_function bcode
 255         = (flag_sanitize_recover & SANITIZE_VLA)
 256           ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
 257           : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT;
 258       tt = builtin_decl_explicit (bcode);
 259       tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size));
 260     }
 261   t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
 262
 263   return t;
 264 }
 265
 266 /* Instrument missing return in C++ functions returning non-void.  */
 267
 268 tree
 269 ubsan_instrument_return (location_t loc)
 270 {
 271   if (flag_sanitize_undefined_trap_on_error)
 272     return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 273
 274   tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc,
 275                                  NULL_TREE, NULL_TREE);
 276   tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN);
 277   return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
 278 }
 279
 280 /* Instrument array bounds for ARRAY_REFs.  We create special builtin,
 281    that gets expanded in the sanopt pass, and make an array dimension
 282    of it.  ARRAY is the array, *INDEX is an index to the array.
 283    Return NULL_TREE if no instrumentation is emitted.
 284    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
 285
 286 tree
 287 ubsan_instrument_bounds (location_t loc, tree array, tree *index,
 288                          bool ignore_off_by_one)
 289 {
 290   tree type = TREE_TYPE (array);
 291   tree domain = TYPE_DOMAIN (type);
 292
 293   if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE)
 294     return NULL_TREE;
 295
 296   tree bound = TYPE_MAX_VALUE (domain);
 297   if (ignore_off_by_one)
 298     bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound,
 299                          build_int_cst (TREE_TYPE (bound), 1));
 300
 301   /* Detect flexible array members and suchlike, unless
 302      -fsanitize=bounds-strict.  */
 303   tree base = get_base_address (array);
 304   if ((flag_sanitize & SANITIZE_BOUNDS_STRICT) == 0
 305       && TREE_CODE (array) == COMPONENT_REF
 306       && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
 307     {
 308       tree next = NULL_TREE;
 309       tree cref = array;
 310
 311       /* Walk all structs/unions.  */
 312       while (TREE_CODE (cref) == COMPONENT_REF)
 313         {
 314           if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
 315             for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
 316                  next && TREE_CODE (next) != FIELD_DECL;
 317                  next = DECL_CHAIN (next))
 318               ;
 319           if (next)
 320             /* Not a last element.  Instrument it.  */
 321             break;
 322           /* Ok, this is the last field of the structure/union.  But the
 323              aggregate containing the field must be the last field too,
 324              recursively.  */
 325           cref = TREE_OPERAND (cref, 0);
 326         }
 327       if (!next)
 328         /* Don't instrument this flexible array member-like array in non-strict
 329            -fsanitize=bounds mode.  */
 330         return NULL_TREE;
 331     }
 332
 333   /* Don't emit instrumentation in the most common cases.  */
 334   tree idx = NULL_TREE;
 335   if (TREE_CODE (*index) == INTEGER_CST)
 336     idx = *index;
 337   else if (TREE_CODE (*index) == BIT_AND_EXPR
 338            && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST)
 339     idx = TREE_OPERAND (*index, 1);
 340   if (idx
 341       && TREE_CODE (bound) == INTEGER_CST
 342       && tree_int_cst_sgn (idx) >= 0
 343       && tree_int_cst_le (idx, bound))
 344     return NULL_TREE;
 345
 346   *index = save_expr (*index);
 347   /* Create a "(T *) 0" tree node to describe the array type.  */
 348   tree zero_with_type = build_int_cst (build_pointer_type (type), 0);
 349   return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS,
 350                                        void_type_node, 3, zero_with_type,
 351                                        *index, bound);
 352 }
 353
 354 /* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS.  */
 355
 356 bool
 357 ubsan_array_ref_instrumented_p (const_tree t)
 358 {
 359   if (TREE_CODE (t) != ARRAY_REF)
 360     return false;
 361
 362   tree op1 = TREE_OPERAND (t, 1);
 363   return TREE_CODE (op1) == COMPOUND_EXPR
 364          && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR
 365          && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE
 366          && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS;
 367 }
 368
 369 /* Instrument an ARRAY_REF, if it hasn't already been instrumented.
 370    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
 371
 372 void
 373 ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one)
 374 {
 375   if (!ubsan_array_ref_instrumented_p (*expr_p)
 376       && do_ubsan_in_current_function ())
 377     {
 378       tree op0 = TREE_OPERAND (*expr_p, 0);
 379       tree op1 = TREE_OPERAND (*expr_p, 1);
 380       tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1,
 381                                         ignore_off_by_one);
 382       if (e != NULL_TREE)
 383         {
 384           tree t = copy_node (*expr_p);
 385           TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1),
 386                                         e, op1);
 387           *expr_p = t;
 388         }
 389     }
 390 }
 391
 392 static tree
 393 ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
 394                                           enum ubsan_null_ckind ckind)
 395 {
 396   if (!do_ubsan_in_current_function ())
 397     return NULL_TREE;
 398
 399   tree type = TREE_TYPE (ptype);
 400   tree orig_op = op;
 401   bool instrument = false;
 402   unsigned int mina = 0;
 403
 404   if (flag_sanitize & SANITIZE_ALIGNMENT)
 405     {
 406       mina = min_align_of_type (type);
 407       if (mina <= 1)
 408         mina = 0;
 409     }
 410   while ((TREE_CODE (op) == NOP_EXPR
 411           || TREE_CODE (op) == NON_LVALUE_EXPR)
 412          && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE)
 413     op = TREE_OPERAND (op, 0);
 414   if (TREE_CODE (op) == NOP_EXPR
 415       && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
 416     {
 417       if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op))))
 418         instrument = true;
 419     }
 420   else
 421     {
 422       if ((flag_sanitize & SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR)
 423         {
 424           bool strict_overflow_p = false;
 425           /* tree_single_nonzero_warnv_p will not return true for non-weak
 426              non-automatic decls with -fno-delete-null-pointer-checks,
 427              which is disabled during -fsanitize=null.  We don't want to
 428              instrument those, just weak vars though.  */
 429           int save_flag_delete_null_pointer_checks
 430             = flag_delete_null_pointer_checks;
 431           flag_delete_null_pointer_checks = 1;
 432           if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
 433               || strict_overflow_p)
 434             instrument = true;
 435           flag_delete_null_pointer_checks
 436             = save_flag_delete_null_pointer_checks;
 437         }
 438       else if (flag_sanitize & SANITIZE_NULL)
 439         instrument = true;
 440       if (mina && mina > 1)
 441         {
 442           if (!POINTER_TYPE_P (TREE_TYPE (op))
 443               || mina > get_pointer_alignment (op) / BITS_PER_UNIT)
 444             instrument = true;
 445         }
 446     }
 447   if (!instrument)
 448     return NULL_TREE;
 449   op = save_expr (orig_op);
 450   gcc_assert (POINTER_TYPE_P (ptype));
 451   if (TREE_CODE (ptype) == REFERENCE_TYPE)
 452     ptype = build_pointer_type (TREE_TYPE (ptype));
 453   tree kind = build_int_cst (ptype, ckind);
 454   tree align = build_int_cst (pointer_sized_int_node, mina);
 455   tree call
 456     = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node,
 457                                     3, op, kind, align);
 458   TREE_SIDE_EFFECTS (call) = 1;
 459   return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
 460 }
 461
 462 /* Instrument a NOP_EXPR to REFERENCE_TYPE or INTEGER_CST with REFERENCE_TYPE
 463    type if needed.  */
 464
 465 void
 466 ubsan_maybe_instrument_reference (tree *stmt_p)
 467 {
 468   tree stmt = *stmt_p;
 469   tree op = stmt;
 470   if (TREE_CODE (stmt) == NOP_EXPR)
 471     op = TREE_OPERAND (stmt, 0);
 472   op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
 473                                                  TREE_TYPE (stmt),
 474                                                  UBSAN_REF_BINDING);
 475   if (op)
 476     {
 477       if (TREE_CODE (stmt) == NOP_EXPR)
 478         TREE_OPERAND (stmt, 0) = op;
 479       else
 480         *stmt_p = op;
 481     }
 482 }
 483
 484 /* Instrument a CALL_EXPR to a method if needed.  */
 485
 486 void
 487 ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor)
 488 {
 489   if (call_expr_nargs (stmt) == 0)
 490     return;
 491   tree op = CALL_EXPR_ARG (stmt, 0);
 492   if (op == error_mark_node
 493       || !POINTER_TYPE_P (TREE_TYPE (op)))
 494     return;
 495   op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
 496                                                  TREE_TYPE (op),
 497                                                  is_ctor ? UBSAN_CTOR_CALL
 498                                                  : UBSAN_MEMBER_CALL);
 499   if (op)
 500     CALL_EXPR_ARG (stmt, 0) = op;
 501 }