Remove UBSAN in dwarf2out.c (PR tree-optimization/82491).
[official-gcc.git] / gcc / asan.c
blobdf9bc7b34049d496dbee914fa7d9acb1c4f52d7e
1 /* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2018 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
10 version.
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 for more details.
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
22 #include "config.h"
23 #include "system.h"
24 #include "coretypes.h"
25 #include "backend.h"
26 #include "target.h"
27 #include "rtl.h"
28 #include "tree.h"
29 #include "gimple.h"
30 #include "cfghooks.h"
31 #include "alloc-pool.h"
32 #include "tree-pass.h"
33 #include "memmodel.h"
34 #include "tm_p.h"
35 #include "ssa.h"
36 #include "stringpool.h"
37 #include "tree-ssanames.h"
38 #include "optabs.h"
39 #include "emit-rtl.h"
40 #include "cgraph.h"
41 #include "gimple-pretty-print.h"
42 #include "alias.h"
43 #include "fold-const.h"
44 #include "cfganal.h"
45 #include "gimplify.h"
46 #include "gimple-iterator.h"
47 #include "varasm.h"
48 #include "stor-layout.h"
49 #include "tree-iterator.h"
50 #include "stringpool.h"
51 #include "attribs.h"
52 #include "asan.h"
53 #include "dojump.h"
54 #include "explow.h"
55 #include "expr.h"
56 #include "output.h"
57 #include "langhooks.h"
58 #include "cfgloop.h"
59 #include "gimple-builder.h"
60 #include "gimple-fold.h"
61 #include "ubsan.h"
62 #include "params.h"
63 #include "builtins.h"
64 #include "fnmatch.h"
65 #include "tree-inline.h"
67 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
68 with <2x slowdown on average.
70 The tool consists of two parts:
71 instrumentation module (this file) and a run-time library.
72 The instrumentation module adds a run-time check before every memory insn.
73 For a 8- or 16- byte load accessing address X:
74 ShadowAddr = (X >> 3) + Offset
75 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
76 if (ShadowValue)
77 __asan_report_load8(X);
78 For a load of N bytes (N=1, 2 or 4) from address X:
79 ShadowAddr = (X >> 3) + Offset
80 ShadowValue = *(char*)ShadowAddr;
81 if (ShadowValue)
82 if ((X & 7) + N - 1 > ShadowValue)
83 __asan_report_loadN(X);
84 Stores are instrumented similarly, but using __asan_report_storeN functions.
85 A call too __asan_init_vN() is inserted to the list of module CTORs.
86 N is the version number of the AddressSanitizer API. The changes between the
87 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
89 The run-time library redefines malloc (so that redzone are inserted around
90 the allocated memory) and free (so that reuse of free-ed memory is delayed),
91 provides __asan_report* and __asan_init_vN functions.
93 Read more:
94 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
96 The current implementation supports detection of out-of-bounds and
97 use-after-free in the heap, on the stack and for global variables.
99 [Protection of stack variables]
101 To understand how detection of out-of-bounds and use-after-free works
102 for stack variables, lets look at this example on x86_64 where the
103 stack grows downward:
106 foo ()
108 char a[23] = {0};
109 int b[2] = {0};
111 a[5] = 1;
112 b[1] = 2;
114 return a[5] + b[1];
117 For this function, the stack protected by asan will be organized as
118 follows, from the top of the stack to the bottom:
120 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
122 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
123 the next slot be 32 bytes aligned; this one is called Partial
124 Redzone; this 32 bytes alignment is an asan constraint]
126 Slot 3/ [24 bytes for variable 'a']
128 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
130 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
132 Slot 6/ [8 bytes for variable 'b']
134 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
135 'LEFT RedZone']
137 The 32 bytes of LEFT red zone at the bottom of the stack can be
138 decomposed as such:
140 1/ The first 8 bytes contain a magical asan number that is always
141 0x41B58AB3.
143 2/ The following 8 bytes contains a pointer to a string (to be
144 parsed at runtime by the runtime asan library), which format is
145 the following:
147 "<function-name> <space> <num-of-variables-on-the-stack>
148 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
149 <length-of-var-in-bytes> ){n} "
151 where '(...){n}' means the content inside the parenthesis occurs 'n'
152 times, with 'n' being the number of variables on the stack.
154 3/ The following 8 bytes contain the PC of the current function which
155 will be used by the run-time library to print an error message.
157 4/ The following 8 bytes are reserved for internal use by the run-time.
159 The shadow memory for that stack layout is going to look like this:
161 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
162 The F1 byte pattern is a magic number called
163 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
164 the memory for that shadow byte is part of a the LEFT red zone
165 intended to seat at the bottom of the variables on the stack.
167 - content of shadow memory 8 bytes for slots 6 and 5:
168 0xF4F4F400. The F4 byte pattern is a magic number
169 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
170 memory region for this shadow byte is a PARTIAL red zone
171 intended to pad a variable A, so that the slot following
172 {A,padding} is 32 bytes aligned.
174 Note that the fact that the least significant byte of this
175 shadow memory content is 00 means that 8 bytes of its
176 corresponding memory (which corresponds to the memory of
177 variable 'b') is addressable.
179 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
180 The F2 byte pattern is a magic number called
181 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
182 region for this shadow byte is a MIDDLE red zone intended to
183 seat between two 32 aligned slots of {variable,padding}.
185 - content of shadow memory 8 bytes for slot 3 and 2:
186 0xF4000000. This represents is the concatenation of
187 variable 'a' and the partial red zone following it, like what we
188 had for variable 'b'. The least significant 3 bytes being 00
189 means that the 3 bytes of variable 'a' are addressable.
191 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
192 The F3 byte pattern is a magic number called
193 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
194 region for this shadow byte is a RIGHT red zone intended to seat
195 at the top of the variables of the stack.
197 Note that the real variable layout is done in expand_used_vars in
198 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
199 stack variables as well as the different red zones, emits some
200 prologue code to populate the shadow memory as to poison (mark as
201 non-accessible) the regions of the red zones and mark the regions of
202 stack variables as accessible, and emit some epilogue code to
203 un-poison (mark as accessible) the regions of red zones right before
204 the function exits.
206 [Protection of global variables]
208 The basic idea is to insert a red zone between two global variables
209 and install a constructor function that calls the asan runtime to do
210 the populating of the relevant shadow memory regions at load time.
212 So the global variables are laid out as to insert a red zone between
213 them. The size of the red zones is so that each variable starts on a
214 32 bytes boundary.
216 Then a constructor function is installed so that, for each global
217 variable, it calls the runtime asan library function
218 __asan_register_globals_with an instance of this type:
220 struct __asan_global
222 // Address of the beginning of the global variable.
223 const void *__beg;
225 // Initial size of the global variable.
226 uptr __size;
228 // Size of the global variable + size of the red zone. This
229 // size is 32 bytes aligned.
230 uptr __size_with_redzone;
232 // Name of the global variable.
233 const void *__name;
235 // Name of the module where the global variable is declared.
236 const void *__module_name;
238 // 1 if it has dynamic initialization, 0 otherwise.
239 uptr __has_dynamic_init;
241 // A pointer to struct that contains source location, could be NULL.
242 __asan_global_source_location *__location;
245 A destructor function that calls the runtime asan library function
246 _asan_unregister_globals is also installed. */
248 static unsigned HOST_WIDE_INT asan_shadow_offset_value;
249 static bool asan_shadow_offset_computed;
250 static vec<char *> sanitized_sections;
251 static tree last_alloca_addr;
253 /* Set of variable declarations that are going to be guarded by
254 use-after-scope sanitizer. */
256 static hash_set<tree> *asan_handled_variables = NULL;
258 hash_set <tree> *asan_used_labels = NULL;
260 /* Sets shadow offset to value in string VAL. */
262 bool
263 set_asan_shadow_offset (const char *val)
265 char *endp;
267 errno = 0;
268 #ifdef HAVE_LONG_LONG
269 asan_shadow_offset_value = strtoull (val, &endp, 0);
270 #else
271 asan_shadow_offset_value = strtoul (val, &endp, 0);
272 #endif
273 if (!(*val != '\0' && *endp == '\0' && errno == 0))
274 return false;
276 asan_shadow_offset_computed = true;
278 return true;
281 /* Set list of user-defined sections that need to be sanitized. */
283 void
284 set_sanitized_sections (const char *sections)
286 char *pat;
287 unsigned i;
288 FOR_EACH_VEC_ELT (sanitized_sections, i, pat)
289 free (pat);
290 sanitized_sections.truncate (0);
292 for (const char *s = sections; *s; )
294 const char *end;
295 for (end = s; *end && *end != ','; ++end);
296 size_t len = end - s;
297 sanitized_sections.safe_push (xstrndup (s, len));
298 s = *end ? end + 1 : end;
302 bool
303 asan_mark_p (gimple *stmt, enum asan_mark_flags flag)
305 return (gimple_call_internal_p (stmt, IFN_ASAN_MARK)
306 && tree_to_uhwi (gimple_call_arg (stmt, 0)) == flag);
309 bool
310 asan_sanitize_stack_p (void)
312 return (sanitize_flags_p (SANITIZE_ADDRESS) && ASAN_STACK);
315 bool
316 asan_sanitize_allocas_p (void)
318 return (asan_sanitize_stack_p () && ASAN_PROTECT_ALLOCAS);
321 /* Checks whether section SEC should be sanitized. */
323 static bool
324 section_sanitized_p (const char *sec)
326 char *pat;
327 unsigned i;
328 FOR_EACH_VEC_ELT (sanitized_sections, i, pat)
329 if (fnmatch (pat, sec, FNM_PERIOD) == 0)
330 return true;
331 return false;
334 /* Returns Asan shadow offset. */
336 static unsigned HOST_WIDE_INT
337 asan_shadow_offset ()
339 if (!asan_shadow_offset_computed)
341 asan_shadow_offset_computed = true;
342 asan_shadow_offset_value = targetm.asan_shadow_offset ();
344 return asan_shadow_offset_value;
347 alias_set_type asan_shadow_set = -1;
349 /* Pointer types to 1, 2 or 4 byte integers in shadow memory. A separate
350 alias set is used for all shadow memory accesses. */
351 static GTY(()) tree shadow_ptr_types[3];
353 /* Decl for __asan_option_detect_stack_use_after_return. */
354 static GTY(()) tree asan_detect_stack_use_after_return;
356 /* Hashtable support for memory references used by gimple
357 statements. */
359 /* This type represents a reference to a memory region. */
360 struct asan_mem_ref
362 /* The expression of the beginning of the memory region. */
363 tree start;
365 /* The size of the access. */
366 HOST_WIDE_INT access_size;
369 object_allocator <asan_mem_ref> asan_mem_ref_pool ("asan_mem_ref");
371 /* Initializes an instance of asan_mem_ref. */
373 static void
374 asan_mem_ref_init (asan_mem_ref *ref, tree start, HOST_WIDE_INT access_size)
376 ref->start = start;
377 ref->access_size = access_size;
380 /* Allocates memory for an instance of asan_mem_ref into the memory
381 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
382 START is the address of (or the expression pointing to) the
383 beginning of memory reference. ACCESS_SIZE is the size of the
384 access to the referenced memory. */
386 static asan_mem_ref*
387 asan_mem_ref_new (tree start, HOST_WIDE_INT access_size)
389 asan_mem_ref *ref = asan_mem_ref_pool.allocate ();
391 asan_mem_ref_init (ref, start, access_size);
392 return ref;
395 /* This builds and returns a pointer to the end of the memory region
396 that starts at START and of length LEN. */
398 tree
399 asan_mem_ref_get_end (tree start, tree len)
401 if (len == NULL_TREE || integer_zerop (len))
402 return start;
404 if (!ptrofftype_p (len))
405 len = convert_to_ptrofftype (len);
407 return fold_build2 (POINTER_PLUS_EXPR, TREE_TYPE (start), start, len);
410 /* Return a tree expression that represents the end of the referenced
411 memory region. Beware that this function can actually build a new
412 tree expression. */
414 tree
415 asan_mem_ref_get_end (const asan_mem_ref *ref, tree len)
417 return asan_mem_ref_get_end (ref->start, len);
420 struct asan_mem_ref_hasher : nofree_ptr_hash <asan_mem_ref>
422 static inline hashval_t hash (const asan_mem_ref *);
423 static inline bool equal (const asan_mem_ref *, const asan_mem_ref *);
426 /* Hash a memory reference. */
428 inline hashval_t
429 asan_mem_ref_hasher::hash (const asan_mem_ref *mem_ref)
431 return iterative_hash_expr (mem_ref->start, 0);
434 /* Compare two memory references. We accept the length of either
435 memory references to be NULL_TREE. */
437 inline bool
438 asan_mem_ref_hasher::equal (const asan_mem_ref *m1,
439 const asan_mem_ref *m2)
441 return operand_equal_p (m1->start, m2->start, 0);
444 static hash_table<asan_mem_ref_hasher> *asan_mem_ref_ht;
446 /* Returns a reference to the hash table containing memory references.
447 This function ensures that the hash table is created. Note that
448 this hash table is updated by the function
449 update_mem_ref_hash_table. */
451 static hash_table<asan_mem_ref_hasher> *
452 get_mem_ref_hash_table ()
454 if (!asan_mem_ref_ht)
455 asan_mem_ref_ht = new hash_table<asan_mem_ref_hasher> (10);
457 return asan_mem_ref_ht;
460 /* Clear all entries from the memory references hash table. */
462 static void
463 empty_mem_ref_hash_table ()
465 if (asan_mem_ref_ht)
466 asan_mem_ref_ht->empty ();
469 /* Free the memory references hash table. */
471 static void
472 free_mem_ref_resources ()
474 delete asan_mem_ref_ht;
475 asan_mem_ref_ht = NULL;
477 asan_mem_ref_pool.release ();
480 /* Return true iff the memory reference REF has been instrumented. */
482 static bool
483 has_mem_ref_been_instrumented (tree ref, HOST_WIDE_INT access_size)
485 asan_mem_ref r;
486 asan_mem_ref_init (&r, ref, access_size);
488 asan_mem_ref *saved_ref = get_mem_ref_hash_table ()->find (&r);
489 return saved_ref && saved_ref->access_size >= access_size;
492 /* Return true iff the memory reference REF has been instrumented. */
494 static bool
495 has_mem_ref_been_instrumented (const asan_mem_ref *ref)
497 return has_mem_ref_been_instrumented (ref->start, ref->access_size);
500 /* Return true iff access to memory region starting at REF and of
501 length LEN has been instrumented. */
503 static bool
504 has_mem_ref_been_instrumented (const asan_mem_ref *ref, tree len)
506 HOST_WIDE_INT size_in_bytes
507 = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
509 return size_in_bytes != -1
510 && has_mem_ref_been_instrumented (ref->start, size_in_bytes);
513 /* Set REF to the memory reference present in a gimple assignment
514 ASSIGNMENT. Return true upon successful completion, false
515 otherwise. */
517 static bool
518 get_mem_ref_of_assignment (const gassign *assignment,
519 asan_mem_ref *ref,
520 bool *ref_is_store)
522 gcc_assert (gimple_assign_single_p (assignment));
524 if (gimple_store_p (assignment)
525 && !gimple_clobber_p (assignment))
527 ref->start = gimple_assign_lhs (assignment);
528 *ref_is_store = true;
530 else if (gimple_assign_load_p (assignment))
532 ref->start = gimple_assign_rhs1 (assignment);
533 *ref_is_store = false;
535 else
536 return false;
538 ref->access_size = int_size_in_bytes (TREE_TYPE (ref->start));
539 return true;
542 /* Return address of last allocated dynamic alloca. */
544 static tree
545 get_last_alloca_addr ()
547 if (last_alloca_addr)
548 return last_alloca_addr;
550 last_alloca_addr = create_tmp_reg (ptr_type_node, "last_alloca_addr");
551 gassign *g = gimple_build_assign (last_alloca_addr, null_pointer_node);
552 edge e = single_succ_edge (ENTRY_BLOCK_PTR_FOR_FN (cfun));
553 gsi_insert_on_edge_immediate (e, g);
554 return last_alloca_addr;
557 /* Insert __asan_allocas_unpoison (top, bottom) call after
558 __builtin_stack_restore (new_sp) call.
559 The pseudocode of this routine should look like this:
560 __builtin_stack_restore (new_sp);
561 top = last_alloca_addr;
562 bot = new_sp;
563 __asan_allocas_unpoison (top, bot);
564 last_alloca_addr = new_sp;
565 In general, we can't use new_sp as bot parameter because on some
566 architectures SP has non zero offset from dynamic stack area. Moreover, on
567 some architectures this offset (STACK_DYNAMIC_OFFSET) becomes known for each
568 particular function only after all callees were expanded to rtl.
569 The most noticeable example is PowerPC{,64}, see
570 http://refspecs.linuxfoundation.org/ELF/ppc64/PPC-elf64abi.html#DYNAM-STACK.
571 To overcome the issue we use following trick: pass new_sp as a second
572 parameter to __asan_allocas_unpoison and rewrite it during expansion with
573 virtual_dynamic_stack_rtx later in expand_asan_emit_allocas_unpoison
574 function.
577 static void
578 handle_builtin_stack_restore (gcall *call, gimple_stmt_iterator *iter)
580 if (!iter || !asan_sanitize_allocas_p ())
581 return;
583 tree last_alloca = get_last_alloca_addr ();
584 tree restored_stack = gimple_call_arg (call, 0);
585 tree fn = builtin_decl_implicit (BUILT_IN_ASAN_ALLOCAS_UNPOISON);
586 gimple *g = gimple_build_call (fn, 2, last_alloca, restored_stack);
587 gsi_insert_after (iter, g, GSI_NEW_STMT);
588 g = gimple_build_assign (last_alloca, restored_stack);
589 gsi_insert_after (iter, g, GSI_NEW_STMT);
592 /* Deploy and poison redzones around __builtin_alloca call. To do this, we
593 should replace this call with another one with changed parameters and
594 replace all its uses with new address, so
595 addr = __builtin_alloca (old_size, align);
596 is replaced by
597 left_redzone_size = max (align, ASAN_RED_ZONE_SIZE);
598 Following two statements are optimized out if we know that
599 old_size & (ASAN_RED_ZONE_SIZE - 1) == 0, i.e. alloca doesn't need partial
600 redzone.
601 misalign = old_size & (ASAN_RED_ZONE_SIZE - 1);
602 partial_redzone_size = ASAN_RED_ZONE_SIZE - misalign;
603 right_redzone_size = ASAN_RED_ZONE_SIZE;
604 additional_size = left_redzone_size + partial_redzone_size +
605 right_redzone_size;
606 new_size = old_size + additional_size;
607 new_alloca = __builtin_alloca (new_size, max (align, 32))
608 __asan_alloca_poison (new_alloca, old_size)
609 addr = new_alloca + max (align, ASAN_RED_ZONE_SIZE);
610 last_alloca_addr = new_alloca;
611 ADDITIONAL_SIZE is added to make new memory allocation contain not only
612 requested memory, but also left, partial and right redzones as well as some
613 additional space, required by alignment. */
615 static void
616 handle_builtin_alloca (gcall *call, gimple_stmt_iterator *iter)
618 if (!iter || !asan_sanitize_allocas_p ())
619 return;
621 gassign *g;
622 gcall *gg;
623 const HOST_WIDE_INT redzone_mask = ASAN_RED_ZONE_SIZE - 1;
625 tree last_alloca = get_last_alloca_addr ();
626 tree callee = gimple_call_fndecl (call);
627 tree old_size = gimple_call_arg (call, 0);
628 tree ptr_type = gimple_call_lhs (call) ? TREE_TYPE (gimple_call_lhs (call))
629 : ptr_type_node;
630 tree partial_size = NULL_TREE;
631 unsigned int align
632 = DECL_FUNCTION_CODE (callee) == BUILT_IN_ALLOCA
633 ? 0 : tree_to_uhwi (gimple_call_arg (call, 1));
635 /* If ALIGN > ASAN_RED_ZONE_SIZE, we embed left redzone into first ALIGN
636 bytes of allocated space. Otherwise, align alloca to ASAN_RED_ZONE_SIZE
637 manually. */
638 align = MAX (align, ASAN_RED_ZONE_SIZE * BITS_PER_UNIT);
640 tree alloca_rz_mask = build_int_cst (size_type_node, redzone_mask);
641 tree redzone_size = build_int_cst (size_type_node, ASAN_RED_ZONE_SIZE);
643 /* Extract lower bits from old_size. */
644 wide_int size_nonzero_bits = get_nonzero_bits (old_size);
645 wide_int rz_mask
646 = wi::uhwi (redzone_mask, wi::get_precision (size_nonzero_bits));
647 wide_int old_size_lower_bits = wi::bit_and (size_nonzero_bits, rz_mask);
649 /* If alloca size is aligned to ASAN_RED_ZONE_SIZE, we don't need partial
650 redzone. Otherwise, compute its size here. */
651 if (wi::ne_p (old_size_lower_bits, 0))
653 /* misalign = size & (ASAN_RED_ZONE_SIZE - 1)
654 partial_size = ASAN_RED_ZONE_SIZE - misalign. */
655 g = gimple_build_assign (make_ssa_name (size_type_node, NULL),
656 BIT_AND_EXPR, old_size, alloca_rz_mask);
657 gsi_insert_before (iter, g, GSI_SAME_STMT);
658 tree misalign = gimple_assign_lhs (g);
659 g = gimple_build_assign (make_ssa_name (size_type_node, NULL), MINUS_EXPR,
660 redzone_size, misalign);
661 gsi_insert_before (iter, g, GSI_SAME_STMT);
662 partial_size = gimple_assign_lhs (g);
665 /* additional_size = align + ASAN_RED_ZONE_SIZE. */
666 tree additional_size = build_int_cst (size_type_node, align / BITS_PER_UNIT
667 + ASAN_RED_ZONE_SIZE);
668 /* If alloca has partial redzone, include it to additional_size too. */
669 if (partial_size)
671 /* additional_size += partial_size. */
672 g = gimple_build_assign (make_ssa_name (size_type_node), PLUS_EXPR,
673 partial_size, additional_size);
674 gsi_insert_before (iter, g, GSI_SAME_STMT);
675 additional_size = gimple_assign_lhs (g);
678 /* new_size = old_size + additional_size. */
679 g = gimple_build_assign (make_ssa_name (size_type_node), PLUS_EXPR, old_size,
680 additional_size);
681 gsi_insert_before (iter, g, GSI_SAME_STMT);
682 tree new_size = gimple_assign_lhs (g);
684 /* Build new __builtin_alloca call:
685 new_alloca_with_rz = __builtin_alloca (new_size, align). */
686 tree fn = builtin_decl_implicit (BUILT_IN_ALLOCA_WITH_ALIGN);
687 gg = gimple_build_call (fn, 2, new_size,
688 build_int_cst (size_type_node, align));
689 tree new_alloca_with_rz = make_ssa_name (ptr_type, gg);
690 gimple_call_set_lhs (gg, new_alloca_with_rz);
691 gsi_insert_before (iter, gg, GSI_SAME_STMT);
693 /* new_alloca = new_alloca_with_rz + align. */
694 g = gimple_build_assign (make_ssa_name (ptr_type), POINTER_PLUS_EXPR,
695 new_alloca_with_rz,
696 build_int_cst (size_type_node,
697 align / BITS_PER_UNIT));
698 gsi_insert_before (iter, g, GSI_SAME_STMT);
699 tree new_alloca = gimple_assign_lhs (g);
701 /* Poison newly created alloca redzones:
702 __asan_alloca_poison (new_alloca, old_size). */
703 fn = builtin_decl_implicit (BUILT_IN_ASAN_ALLOCA_POISON);
704 gg = gimple_build_call (fn, 2, new_alloca, old_size);
705 gsi_insert_before (iter, gg, GSI_SAME_STMT);
707 /* Save new_alloca_with_rz value into last_alloca to use it during
708 allocas unpoisoning. */
709 g = gimple_build_assign (last_alloca, new_alloca_with_rz);
710 gsi_insert_before (iter, g, GSI_SAME_STMT);
712 /* Finally, replace old alloca ptr with NEW_ALLOCA. */
713 replace_call_with_value (iter, new_alloca);
716 /* Return the memory references contained in a gimple statement
717 representing a builtin call that has to do with memory access. */
719 static bool
720 get_mem_refs_of_builtin_call (gcall *call,
721 asan_mem_ref *src0,
722 tree *src0_len,
723 bool *src0_is_store,
724 asan_mem_ref *src1,
725 tree *src1_len,
726 bool *src1_is_store,
727 asan_mem_ref *dst,
728 tree *dst_len,
729 bool *dst_is_store,
730 bool *dest_is_deref,
731 bool *intercepted_p,
732 gimple_stmt_iterator *iter = NULL)
734 gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL));
736 tree callee = gimple_call_fndecl (call);
737 tree source0 = NULL_TREE, source1 = NULL_TREE,
738 dest = NULL_TREE, len = NULL_TREE;
739 bool is_store = true, got_reference_p = false;
740 HOST_WIDE_INT access_size = 1;
742 *intercepted_p = asan_intercepted_p ((DECL_FUNCTION_CODE (callee)));
744 switch (DECL_FUNCTION_CODE (callee))
746 /* (s, s, n) style memops. */
747 case BUILT_IN_BCMP:
748 case BUILT_IN_MEMCMP:
749 source0 = gimple_call_arg (call, 0);
750 source1 = gimple_call_arg (call, 1);
751 len = gimple_call_arg (call, 2);
752 break;
754 /* (src, dest, n) style memops. */
755 case BUILT_IN_BCOPY:
756 source0 = gimple_call_arg (call, 0);
757 dest = gimple_call_arg (call, 1);
758 len = gimple_call_arg (call, 2);
759 break;
761 /* (dest, src, n) style memops. */
762 case BUILT_IN_MEMCPY:
763 case BUILT_IN_MEMCPY_CHK:
764 case BUILT_IN_MEMMOVE:
765 case BUILT_IN_MEMMOVE_CHK:
766 case BUILT_IN_MEMPCPY:
767 case BUILT_IN_MEMPCPY_CHK:
768 dest = gimple_call_arg (call, 0);
769 source0 = gimple_call_arg (call, 1);
770 len = gimple_call_arg (call, 2);
771 break;
773 /* (dest, n) style memops. */
774 case BUILT_IN_BZERO:
775 dest = gimple_call_arg (call, 0);
776 len = gimple_call_arg (call, 1);
777 break;
779 /* (dest, x, n) style memops*/
780 case BUILT_IN_MEMSET:
781 case BUILT_IN_MEMSET_CHK:
782 dest = gimple_call_arg (call, 0);
783 len = gimple_call_arg (call, 2);
784 break;
786 case BUILT_IN_STRLEN:
787 source0 = gimple_call_arg (call, 0);
788 len = gimple_call_lhs (call);
789 break;
791 case BUILT_IN_STACK_RESTORE:
792 handle_builtin_stack_restore (call, iter);
793 break;
795 CASE_BUILT_IN_ALLOCA:
796 handle_builtin_alloca (call, iter);
797 break;
798 /* And now the __atomic* and __sync builtins.
799 These are handled differently from the classical memory memory
800 access builtins above. */
802 case BUILT_IN_ATOMIC_LOAD_1:
803 is_store = false;
804 /* FALLTHRU */
805 case BUILT_IN_SYNC_FETCH_AND_ADD_1:
806 case BUILT_IN_SYNC_FETCH_AND_SUB_1:
807 case BUILT_IN_SYNC_FETCH_AND_OR_1:
808 case BUILT_IN_SYNC_FETCH_AND_AND_1:
809 case BUILT_IN_SYNC_FETCH_AND_XOR_1:
810 case BUILT_IN_SYNC_FETCH_AND_NAND_1:
811 case BUILT_IN_SYNC_ADD_AND_FETCH_1:
812 case BUILT_IN_SYNC_SUB_AND_FETCH_1:
813 case BUILT_IN_SYNC_OR_AND_FETCH_1:
814 case BUILT_IN_SYNC_AND_AND_FETCH_1:
815 case BUILT_IN_SYNC_XOR_AND_FETCH_1:
816 case BUILT_IN_SYNC_NAND_AND_FETCH_1:
817 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1:
818 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1:
819 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1:
820 case BUILT_IN_SYNC_LOCK_RELEASE_1:
821 case BUILT_IN_ATOMIC_EXCHANGE_1:
822 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1:
823 case BUILT_IN_ATOMIC_STORE_1:
824 case BUILT_IN_ATOMIC_ADD_FETCH_1:
825 case BUILT_IN_ATOMIC_SUB_FETCH_1:
826 case BUILT_IN_ATOMIC_AND_FETCH_1:
827 case BUILT_IN_ATOMIC_NAND_FETCH_1:
828 case BUILT_IN_ATOMIC_XOR_FETCH_1:
829 case BUILT_IN_ATOMIC_OR_FETCH_1:
830 case BUILT_IN_ATOMIC_FETCH_ADD_1:
831 case BUILT_IN_ATOMIC_FETCH_SUB_1:
832 case BUILT_IN_ATOMIC_FETCH_AND_1:
833 case BUILT_IN_ATOMIC_FETCH_NAND_1:
834 case BUILT_IN_ATOMIC_FETCH_XOR_1:
835 case BUILT_IN_ATOMIC_FETCH_OR_1:
836 access_size = 1;
837 goto do_atomic;
839 case BUILT_IN_ATOMIC_LOAD_2:
840 is_store = false;
841 /* FALLTHRU */
842 case BUILT_IN_SYNC_FETCH_AND_ADD_2:
843 case BUILT_IN_SYNC_FETCH_AND_SUB_2:
844 case BUILT_IN_SYNC_FETCH_AND_OR_2:
845 case BUILT_IN_SYNC_FETCH_AND_AND_2:
846 case BUILT_IN_SYNC_FETCH_AND_XOR_2:
847 case BUILT_IN_SYNC_FETCH_AND_NAND_2:
848 case BUILT_IN_SYNC_ADD_AND_FETCH_2:
849 case BUILT_IN_SYNC_SUB_AND_FETCH_2:
850 case BUILT_IN_SYNC_OR_AND_FETCH_2:
851 case BUILT_IN_SYNC_AND_AND_FETCH_2:
852 case BUILT_IN_SYNC_XOR_AND_FETCH_2:
853 case BUILT_IN_SYNC_NAND_AND_FETCH_2:
854 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2:
855 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2:
856 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2:
857 case BUILT_IN_SYNC_LOCK_RELEASE_2:
858 case BUILT_IN_ATOMIC_EXCHANGE_2:
859 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2:
860 case BUILT_IN_ATOMIC_STORE_2:
861 case BUILT_IN_ATOMIC_ADD_FETCH_2:
862 case BUILT_IN_ATOMIC_SUB_FETCH_2:
863 case BUILT_IN_ATOMIC_AND_FETCH_2:
864 case BUILT_IN_ATOMIC_NAND_FETCH_2:
865 case BUILT_IN_ATOMIC_XOR_FETCH_2:
866 case BUILT_IN_ATOMIC_OR_FETCH_2:
867 case BUILT_IN_ATOMIC_FETCH_ADD_2:
868 case BUILT_IN_ATOMIC_FETCH_SUB_2:
869 case BUILT_IN_ATOMIC_FETCH_AND_2:
870 case BUILT_IN_ATOMIC_FETCH_NAND_2:
871 case BUILT_IN_ATOMIC_FETCH_XOR_2:
872 case BUILT_IN_ATOMIC_FETCH_OR_2:
873 access_size = 2;
874 goto do_atomic;
876 case BUILT_IN_ATOMIC_LOAD_4:
877 is_store = false;
878 /* FALLTHRU */
879 case BUILT_IN_SYNC_FETCH_AND_ADD_4:
880 case BUILT_IN_SYNC_FETCH_AND_SUB_4:
881 case BUILT_IN_SYNC_FETCH_AND_OR_4:
882 case BUILT_IN_SYNC_FETCH_AND_AND_4:
883 case BUILT_IN_SYNC_FETCH_AND_XOR_4:
884 case BUILT_IN_SYNC_FETCH_AND_NAND_4:
885 case BUILT_IN_SYNC_ADD_AND_FETCH_4:
886 case BUILT_IN_SYNC_SUB_AND_FETCH_4:
887 case BUILT_IN_SYNC_OR_AND_FETCH_4:
888 case BUILT_IN_SYNC_AND_AND_FETCH_4:
889 case BUILT_IN_SYNC_XOR_AND_FETCH_4:
890 case BUILT_IN_SYNC_NAND_AND_FETCH_4:
891 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4:
892 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4:
893 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4:
894 case BUILT_IN_SYNC_LOCK_RELEASE_4:
895 case BUILT_IN_ATOMIC_EXCHANGE_4:
896 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4:
897 case BUILT_IN_ATOMIC_STORE_4:
898 case BUILT_IN_ATOMIC_ADD_FETCH_4:
899 case BUILT_IN_ATOMIC_SUB_FETCH_4:
900 case BUILT_IN_ATOMIC_AND_FETCH_4:
901 case BUILT_IN_ATOMIC_NAND_FETCH_4:
902 case BUILT_IN_ATOMIC_XOR_FETCH_4:
903 case BUILT_IN_ATOMIC_OR_FETCH_4:
904 case BUILT_IN_ATOMIC_FETCH_ADD_4:
905 case BUILT_IN_ATOMIC_FETCH_SUB_4:
906 case BUILT_IN_ATOMIC_FETCH_AND_4:
907 case BUILT_IN_ATOMIC_FETCH_NAND_4:
908 case BUILT_IN_ATOMIC_FETCH_XOR_4:
909 case BUILT_IN_ATOMIC_FETCH_OR_4:
910 access_size = 4;
911 goto do_atomic;
913 case BUILT_IN_ATOMIC_LOAD_8:
914 is_store = false;
915 /* FALLTHRU */
916 case BUILT_IN_SYNC_FETCH_AND_ADD_8:
917 case BUILT_IN_SYNC_FETCH_AND_SUB_8:
918 case BUILT_IN_SYNC_FETCH_AND_OR_8:
919 case BUILT_IN_SYNC_FETCH_AND_AND_8:
920 case BUILT_IN_SYNC_FETCH_AND_XOR_8:
921 case BUILT_IN_SYNC_FETCH_AND_NAND_8:
922 case BUILT_IN_SYNC_ADD_AND_FETCH_8:
923 case BUILT_IN_SYNC_SUB_AND_FETCH_8:
924 case BUILT_IN_SYNC_OR_AND_FETCH_8:
925 case BUILT_IN_SYNC_AND_AND_FETCH_8:
926 case BUILT_IN_SYNC_XOR_AND_FETCH_8:
927 case BUILT_IN_SYNC_NAND_AND_FETCH_8:
928 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8:
929 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8:
930 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8:
931 case BUILT_IN_SYNC_LOCK_RELEASE_8:
932 case BUILT_IN_ATOMIC_EXCHANGE_8:
933 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8:
934 case BUILT_IN_ATOMIC_STORE_8:
935 case BUILT_IN_ATOMIC_ADD_FETCH_8:
936 case BUILT_IN_ATOMIC_SUB_FETCH_8:
937 case BUILT_IN_ATOMIC_AND_FETCH_8:
938 case BUILT_IN_ATOMIC_NAND_FETCH_8:
939 case BUILT_IN_ATOMIC_XOR_FETCH_8:
940 case BUILT_IN_ATOMIC_OR_FETCH_8:
941 case BUILT_IN_ATOMIC_FETCH_ADD_8:
942 case BUILT_IN_ATOMIC_FETCH_SUB_8:
943 case BUILT_IN_ATOMIC_FETCH_AND_8:
944 case BUILT_IN_ATOMIC_FETCH_NAND_8:
945 case BUILT_IN_ATOMIC_FETCH_XOR_8:
946 case BUILT_IN_ATOMIC_FETCH_OR_8:
947 access_size = 8;
948 goto do_atomic;
950 case BUILT_IN_ATOMIC_LOAD_16:
951 is_store = false;
952 /* FALLTHRU */
953 case BUILT_IN_SYNC_FETCH_AND_ADD_16:
954 case BUILT_IN_SYNC_FETCH_AND_SUB_16:
955 case BUILT_IN_SYNC_FETCH_AND_OR_16:
956 case BUILT_IN_SYNC_FETCH_AND_AND_16:
957 case BUILT_IN_SYNC_FETCH_AND_XOR_16:
958 case BUILT_IN_SYNC_FETCH_AND_NAND_16:
959 case BUILT_IN_SYNC_ADD_AND_FETCH_16:
960 case BUILT_IN_SYNC_SUB_AND_FETCH_16:
961 case BUILT_IN_SYNC_OR_AND_FETCH_16:
962 case BUILT_IN_SYNC_AND_AND_FETCH_16:
963 case BUILT_IN_SYNC_XOR_AND_FETCH_16:
964 case BUILT_IN_SYNC_NAND_AND_FETCH_16:
965 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16:
966 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16:
967 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16:
968 case BUILT_IN_SYNC_LOCK_RELEASE_16:
969 case BUILT_IN_ATOMIC_EXCHANGE_16:
970 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16:
971 case BUILT_IN_ATOMIC_STORE_16:
972 case BUILT_IN_ATOMIC_ADD_FETCH_16:
973 case BUILT_IN_ATOMIC_SUB_FETCH_16:
974 case BUILT_IN_ATOMIC_AND_FETCH_16:
975 case BUILT_IN_ATOMIC_NAND_FETCH_16:
976 case BUILT_IN_ATOMIC_XOR_FETCH_16:
977 case BUILT_IN_ATOMIC_OR_FETCH_16:
978 case BUILT_IN_ATOMIC_FETCH_ADD_16:
979 case BUILT_IN_ATOMIC_FETCH_SUB_16:
980 case BUILT_IN_ATOMIC_FETCH_AND_16:
981 case BUILT_IN_ATOMIC_FETCH_NAND_16:
982 case BUILT_IN_ATOMIC_FETCH_XOR_16:
983 case BUILT_IN_ATOMIC_FETCH_OR_16:
984 access_size = 16;
985 /* FALLTHRU */
986 do_atomic:
988 dest = gimple_call_arg (call, 0);
989 /* DEST represents the address of a memory location.
990 instrument_derefs wants the memory location, so lets
991 dereference the address DEST before handing it to
992 instrument_derefs. */
993 tree type = build_nonstandard_integer_type (access_size
994 * BITS_PER_UNIT, 1);
995 dest = build2 (MEM_REF, type, dest,
996 build_int_cst (build_pointer_type (char_type_node), 0));
997 break;
1000 default:
1001 /* The other builtins memory access are not instrumented in this
1002 function because they either don't have any length parameter,
1003 or their length parameter is just a limit. */
1004 break;
1007 if (len != NULL_TREE)
1009 if (source0 != NULL_TREE)
1011 src0->start = source0;
1012 src0->access_size = access_size;
1013 *src0_len = len;
1014 *src0_is_store = false;
1017 if (source1 != NULL_TREE)
1019 src1->start = source1;
1020 src1->access_size = access_size;
1021 *src1_len = len;
1022 *src1_is_store = false;
1025 if (dest != NULL_TREE)
1027 dst->start = dest;
1028 dst->access_size = access_size;
1029 *dst_len = len;
1030 *dst_is_store = true;
1033 got_reference_p = true;
1035 else if (dest)
1037 dst->start = dest;
1038 dst->access_size = access_size;
1039 *dst_len = NULL_TREE;
1040 *dst_is_store = is_store;
1041 *dest_is_deref = true;
1042 got_reference_p = true;
1045 return got_reference_p;
1048 /* Return true iff a given gimple statement has been instrumented.
1049 Note that the statement is "defined" by the memory references it
1050 contains. */
1052 static bool
1053 has_stmt_been_instrumented_p (gimple *stmt)
1055 if (gimple_assign_single_p (stmt))
1057 bool r_is_store;
1058 asan_mem_ref r;
1059 asan_mem_ref_init (&r, NULL, 1);
1061 if (get_mem_ref_of_assignment (as_a <gassign *> (stmt), &r,
1062 &r_is_store))
1063 return has_mem_ref_been_instrumented (&r);
1065 else if (gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
1067 asan_mem_ref src0, src1, dest;
1068 asan_mem_ref_init (&src0, NULL, 1);
1069 asan_mem_ref_init (&src1, NULL, 1);
1070 asan_mem_ref_init (&dest, NULL, 1);
1072 tree src0_len = NULL_TREE, src1_len = NULL_TREE, dest_len = NULL_TREE;
1073 bool src0_is_store = false, src1_is_store = false,
1074 dest_is_store = false, dest_is_deref = false, intercepted_p = true;
1075 if (get_mem_refs_of_builtin_call (as_a <gcall *> (stmt),
1076 &src0, &src0_len, &src0_is_store,
1077 &src1, &src1_len, &src1_is_store,
1078 &dest, &dest_len, &dest_is_store,
1079 &dest_is_deref, &intercepted_p))
1081 if (src0.start != NULL_TREE
1082 && !has_mem_ref_been_instrumented (&src0, src0_len))
1083 return false;
1085 if (src1.start != NULL_TREE
1086 && !has_mem_ref_been_instrumented (&src1, src1_len))
1087 return false;
1089 if (dest.start != NULL_TREE
1090 && !has_mem_ref_been_instrumented (&dest, dest_len))
1091 return false;
1093 return true;
1096 else if (is_gimple_call (stmt) && gimple_store_p (stmt))
1098 asan_mem_ref r;
1099 asan_mem_ref_init (&r, NULL, 1);
1101 r.start = gimple_call_lhs (stmt);
1102 r.access_size = int_size_in_bytes (TREE_TYPE (r.start));
1103 return has_mem_ref_been_instrumented (&r);
1106 return false;
1109 /* Insert a memory reference into the hash table. */
1111 static void
1112 update_mem_ref_hash_table (tree ref, HOST_WIDE_INT access_size)
1114 hash_table<asan_mem_ref_hasher> *ht = get_mem_ref_hash_table ();
1116 asan_mem_ref r;
1117 asan_mem_ref_init (&r, ref, access_size);
1119 asan_mem_ref **slot = ht->find_slot (&r, INSERT);
1120 if (*slot == NULL || (*slot)->access_size < access_size)
1121 *slot = asan_mem_ref_new (ref, access_size);
1124 /* Initialize shadow_ptr_types array. */
1126 static void
1127 asan_init_shadow_ptr_types (void)
1129 asan_shadow_set = new_alias_set ();
1130 tree types[3] = { signed_char_type_node, short_integer_type_node,
1131 integer_type_node };
1133 for (unsigned i = 0; i < 3; i++)
1135 shadow_ptr_types[i] = build_distinct_type_copy (types[i]);
1136 TYPE_ALIAS_SET (shadow_ptr_types[i]) = asan_shadow_set;
1137 shadow_ptr_types[i] = build_pointer_type (shadow_ptr_types[i]);
1140 initialize_sanitizer_builtins ();
1143 /* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
1145 static tree
1146 asan_pp_string (pretty_printer *pp)
1148 const char *buf = pp_formatted_text (pp);
1149 size_t len = strlen (buf);
1150 tree ret = build_string (len + 1, buf);
1151 TREE_TYPE (ret)
1152 = build_array_type (TREE_TYPE (shadow_ptr_types[0]),
1153 build_index_type (size_int (len)));
1154 TREE_READONLY (ret) = 1;
1155 TREE_STATIC (ret) = 1;
1156 return build1 (ADDR_EXPR, shadow_ptr_types[0], ret);
1159 /* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
1161 static rtx
1162 asan_shadow_cst (unsigned char shadow_bytes[4])
1164 int i;
1165 unsigned HOST_WIDE_INT val = 0;
1166 gcc_assert (WORDS_BIG_ENDIAN == BYTES_BIG_ENDIAN);
1167 for (i = 0; i < 4; i++)
1168 val |= (unsigned HOST_WIDE_INT) shadow_bytes[BYTES_BIG_ENDIAN ? 3 - i : i]
1169 << (BITS_PER_UNIT * i);
1170 return gen_int_mode (val, SImode);
1173 /* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
1174 though. */
1176 static void
1177 asan_clear_shadow (rtx shadow_mem, HOST_WIDE_INT len)
1179 rtx_insn *insn, *insns, *jump;
1180 rtx_code_label *top_label;
1181 rtx end, addr, tmp;
1183 start_sequence ();
1184 clear_storage (shadow_mem, GEN_INT (len), BLOCK_OP_NORMAL);
1185 insns = get_insns ();
1186 end_sequence ();
1187 for (insn = insns; insn; insn = NEXT_INSN (insn))
1188 if (CALL_P (insn))
1189 break;
1190 if (insn == NULL_RTX)
1192 emit_insn (insns);
1193 return;
1196 gcc_assert ((len & 3) == 0);
1197 top_label = gen_label_rtx ();
1198 addr = copy_to_mode_reg (Pmode, XEXP (shadow_mem, 0));
1199 shadow_mem = adjust_automodify_address (shadow_mem, SImode, addr, 0);
1200 end = force_reg (Pmode, plus_constant (Pmode, addr, len));
1201 emit_label (top_label);
1203 emit_move_insn (shadow_mem, const0_rtx);
1204 tmp = expand_simple_binop (Pmode, PLUS, addr, gen_int_mode (4, Pmode), addr,
1205 true, OPTAB_LIB_WIDEN);
1206 if (tmp != addr)
1207 emit_move_insn (addr, tmp);
1208 emit_cmp_and_jump_insns (addr, end, LT, NULL_RTX, Pmode, true, top_label);
1209 jump = get_last_insn ();
1210 gcc_assert (JUMP_P (jump));
1211 add_reg_br_prob_note (jump,
1212 profile_probability::guessed_always ()
1213 .apply_scale (80, 100));
1216 void
1217 asan_function_start (void)
1219 section *fnsec = function_section (current_function_decl);
1220 switch_to_section (fnsec);
1221 ASM_OUTPUT_DEBUG_LABEL (asm_out_file, "LASANPC",
1222 current_function_funcdef_no);
1225 /* Return number of shadow bytes that are occupied by a local variable
1226 of SIZE bytes. */
1228 static unsigned HOST_WIDE_INT
1229 shadow_mem_size (unsigned HOST_WIDE_INT size)
1231 /* It must be possible to align stack variables to granularity
1232 of shadow memory. */
1233 gcc_assert (BITS_PER_UNIT
1234 * ASAN_SHADOW_GRANULARITY <= MAX_SUPPORTED_STACK_ALIGNMENT);
1236 return ROUND_UP (size, ASAN_SHADOW_GRANULARITY) / ASAN_SHADOW_GRANULARITY;
1239 /* Insert code to protect stack vars. The prologue sequence should be emitted
1240 directly, epilogue sequence returned. BASE is the register holding the
1241 stack base, against which OFFSETS array offsets are relative to, OFFSETS
1242 array contains pairs of offsets in reverse order, always the end offset
1243 of some gap that needs protection followed by starting offset,
1244 and DECLS is an array of representative decls for each var partition.
1245 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
1246 elements long (OFFSETS include gap before the first variable as well
1247 as gaps after each stack variable). PBASE is, if non-NULL, some pseudo
1248 register which stack vars DECL_RTLs are based on. Either BASE should be
1249 assigned to PBASE, when not doing use after return protection, or
1250 corresponding address based on __asan_stack_malloc* return value. */
1252 rtx_insn *
1253 asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
1254 HOST_WIDE_INT *offsets, tree *decls, int length)
1256 rtx shadow_base, shadow_mem, ret, mem, orig_base;
1257 rtx_code_label *lab;
1258 rtx_insn *insns;
1259 char buf[32];
1260 unsigned char shadow_bytes[4];
1261 HOST_WIDE_INT base_offset = offsets[length - 1];
1262 HOST_WIDE_INT base_align_bias = 0, offset, prev_offset;
1263 HOST_WIDE_INT asan_frame_size = offsets[0] - base_offset;
1264 HOST_WIDE_INT last_offset, last_size;
1265 int l;
1266 unsigned char cur_shadow_byte = ASAN_STACK_MAGIC_LEFT;
1267 tree str_cst, decl, id;
1268 int use_after_return_class = -1;
1270 if (shadow_ptr_types[0] == NULL_TREE)
1271 asan_init_shadow_ptr_types ();
1273 /* First of all, prepare the description string. */
1274 pretty_printer asan_pp;
1276 pp_decimal_int (&asan_pp, length / 2 - 1);
1277 pp_space (&asan_pp);
1278 for (l = length - 2; l; l -= 2)
1280 tree decl = decls[l / 2 - 1];
1281 pp_wide_integer (&asan_pp, offsets[l] - base_offset);
1282 pp_space (&asan_pp);
1283 pp_wide_integer (&asan_pp, offsets[l - 1] - offsets[l]);
1284 pp_space (&asan_pp);
1285 if (DECL_P (decl) && DECL_NAME (decl))
1287 pp_decimal_int (&asan_pp, IDENTIFIER_LENGTH (DECL_NAME (decl)));
1288 pp_space (&asan_pp);
1289 pp_tree_identifier (&asan_pp, DECL_NAME (decl));
1291 else
1292 pp_string (&asan_pp, "9 <unknown>");
1293 pp_space (&asan_pp);
1295 str_cst = asan_pp_string (&asan_pp);
1297 /* Emit the prologue sequence. */
1298 if (asan_frame_size > 32 && asan_frame_size <= 65536 && pbase
1299 && ASAN_USE_AFTER_RETURN)
1301 use_after_return_class = floor_log2 (asan_frame_size - 1) - 5;
1302 /* __asan_stack_malloc_N guarantees alignment
1303 N < 6 ? (64 << N) : 4096 bytes. */
1304 if (alignb > (use_after_return_class < 6
1305 ? (64U << use_after_return_class) : 4096U))
1306 use_after_return_class = -1;
1307 else if (alignb > ASAN_RED_ZONE_SIZE && (asan_frame_size & (alignb - 1)))
1308 base_align_bias = ((asan_frame_size + alignb - 1)
1309 & ~(alignb - HOST_WIDE_INT_1)) - asan_frame_size;
1311 /* Align base if target is STRICT_ALIGNMENT. */
1312 if (STRICT_ALIGNMENT)
1313 base = expand_binop (Pmode, and_optab, base,
1314 gen_int_mode (-((GET_MODE_ALIGNMENT (SImode)
1315 << ASAN_SHADOW_SHIFT)
1316 / BITS_PER_UNIT), Pmode), NULL_RTX,
1317 1, OPTAB_DIRECT);
1319 if (use_after_return_class == -1 && pbase)
1320 emit_move_insn (pbase, base);
1322 base = expand_binop (Pmode, add_optab, base,
1323 gen_int_mode (base_offset - base_align_bias, Pmode),
1324 NULL_RTX, 1, OPTAB_DIRECT);
1325 orig_base = NULL_RTX;
1326 if (use_after_return_class != -1)
1328 if (asan_detect_stack_use_after_return == NULL_TREE)
1330 id = get_identifier ("__asan_option_detect_stack_use_after_return");
1331 decl = build_decl (BUILTINS_LOCATION, VAR_DECL, id,
1332 integer_type_node);
1333 SET_DECL_ASSEMBLER_NAME (decl, id);
1334 TREE_ADDRESSABLE (decl) = 1;
1335 DECL_ARTIFICIAL (decl) = 1;
1336 DECL_IGNORED_P (decl) = 1;
1337 DECL_EXTERNAL (decl) = 1;
1338 TREE_STATIC (decl) = 1;
1339 TREE_PUBLIC (decl) = 1;
1340 TREE_USED (decl) = 1;
1341 asan_detect_stack_use_after_return = decl;
1343 orig_base = gen_reg_rtx (Pmode);
1344 emit_move_insn (orig_base, base);
1345 ret = expand_normal (asan_detect_stack_use_after_return);
1346 lab = gen_label_rtx ();
1347 emit_cmp_and_jump_insns (ret, const0_rtx, EQ, NULL_RTX,
1348 VOIDmode, 0, lab,
1349 profile_probability::very_likely ());
1350 snprintf (buf, sizeof buf, "__asan_stack_malloc_%d",
1351 use_after_return_class);
1352 ret = init_one_libfunc (buf);
1353 ret = emit_library_call_value (ret, NULL_RTX, LCT_NORMAL, ptr_mode,
1354 GEN_INT (asan_frame_size
1355 + base_align_bias),
1356 TYPE_MODE (pointer_sized_int_node));
1357 /* __asan_stack_malloc_[n] returns a pointer to fake stack if succeeded
1358 and NULL otherwise. Check RET value is NULL here and jump over the
1359 BASE reassignment in this case. Otherwise, reassign BASE to RET. */
1360 emit_cmp_and_jump_insns (ret, const0_rtx, EQ, NULL_RTX,
1361 VOIDmode, 0, lab,
1362 profile_probability:: very_unlikely ());
1363 ret = convert_memory_address (Pmode, ret);
1364 emit_move_insn (base, ret);
1365 emit_label (lab);
1366 emit_move_insn (pbase, expand_binop (Pmode, add_optab, base,
1367 gen_int_mode (base_align_bias
1368 - base_offset, Pmode),
1369 NULL_RTX, 1, OPTAB_DIRECT));
1371 mem = gen_rtx_MEM (ptr_mode, base);
1372 mem = adjust_address (mem, VOIDmode, base_align_bias);
1373 emit_move_insn (mem, gen_int_mode (ASAN_STACK_FRAME_MAGIC, ptr_mode));
1374 mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode));
1375 emit_move_insn (mem, expand_normal (str_cst));
1376 mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode));
1377 ASM_GENERATE_INTERNAL_LABEL (buf, "LASANPC", current_function_funcdef_no);
1378 id = get_identifier (buf);
1379 decl = build_decl (DECL_SOURCE_LOCATION (current_function_decl),
1380 VAR_DECL, id, char_type_node);
1381 SET_DECL_ASSEMBLER_NAME (decl, id);
1382 TREE_ADDRESSABLE (decl) = 1;
1383 TREE_READONLY (decl) = 1;
1384 DECL_ARTIFICIAL (decl) = 1;
1385 DECL_IGNORED_P (decl) = 1;
1386 TREE_STATIC (decl) = 1;
1387 TREE_PUBLIC (decl) = 0;
1388 TREE_USED (decl) = 1;
1389 DECL_INITIAL (decl) = decl;
1390 TREE_ASM_WRITTEN (decl) = 1;
1391 TREE_ASM_WRITTEN (id) = 1;
1392 emit_move_insn (mem, expand_normal (build_fold_addr_expr (decl)));
1393 shadow_base = expand_binop (Pmode, lshr_optab, base,
1394 gen_int_shift_amount (Pmode, ASAN_SHADOW_SHIFT),
1395 NULL_RTX, 1, OPTAB_DIRECT);
1396 shadow_base
1397 = plus_constant (Pmode, shadow_base,
1398 asan_shadow_offset ()
1399 + (base_align_bias >> ASAN_SHADOW_SHIFT));
1400 gcc_assert (asan_shadow_set != -1
1401 && (ASAN_RED_ZONE_SIZE >> ASAN_SHADOW_SHIFT) == 4);
1402 shadow_mem = gen_rtx_MEM (SImode, shadow_base);
1403 set_mem_alias_set (shadow_mem, asan_shadow_set);
1404 if (STRICT_ALIGNMENT)
1405 set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)));
1406 prev_offset = base_offset;
1407 for (l = length; l; l -= 2)
1409 if (l == 2)
1410 cur_shadow_byte = ASAN_STACK_MAGIC_RIGHT;
1411 offset = offsets[l - 1];
1412 if ((offset - base_offset) & (ASAN_RED_ZONE_SIZE - 1))
1414 int i;
1415 HOST_WIDE_INT aoff
1416 = base_offset + ((offset - base_offset)
1417 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
1418 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1419 (aoff - prev_offset)
1420 >> ASAN_SHADOW_SHIFT);
1421 prev_offset = aoff;
1422 for (i = 0; i < 4; i++, aoff += ASAN_SHADOW_GRANULARITY)
1423 if (aoff < offset)
1425 if (aoff < offset - (HOST_WIDE_INT)ASAN_SHADOW_GRANULARITY + 1)
1426 shadow_bytes[i] = 0;
1427 else
1428 shadow_bytes[i] = offset - aoff;
1430 else
1431 shadow_bytes[i] = ASAN_STACK_MAGIC_MIDDLE;
1432 emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
1433 offset = aoff;
1435 while (offset <= offsets[l - 2] - ASAN_RED_ZONE_SIZE)
1437 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1438 (offset - prev_offset)
1439 >> ASAN_SHADOW_SHIFT);
1440 prev_offset = offset;
1441 memset (shadow_bytes, cur_shadow_byte, 4);
1442 emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
1443 offset += ASAN_RED_ZONE_SIZE;
1445 cur_shadow_byte = ASAN_STACK_MAGIC_MIDDLE;
1447 do_pending_stack_adjust ();
1449 /* Construct epilogue sequence. */
1450 start_sequence ();
1452 lab = NULL;
1453 if (use_after_return_class != -1)
1455 rtx_code_label *lab2 = gen_label_rtx ();
1456 char c = (char) ASAN_STACK_MAGIC_USE_AFTER_RET;
1457 emit_cmp_and_jump_insns (orig_base, base, EQ, NULL_RTX,
1458 VOIDmode, 0, lab2,
1459 profile_probability::very_likely ());
1460 shadow_mem = gen_rtx_MEM (BLKmode, shadow_base);
1461 set_mem_alias_set (shadow_mem, asan_shadow_set);
1462 mem = gen_rtx_MEM (ptr_mode, base);
1463 mem = adjust_address (mem, VOIDmode, base_align_bias);
1464 emit_move_insn (mem, gen_int_mode (ASAN_STACK_RETIRED_MAGIC, ptr_mode));
1465 unsigned HOST_WIDE_INT sz = asan_frame_size >> ASAN_SHADOW_SHIFT;
1466 if (use_after_return_class < 5
1467 && can_store_by_pieces (sz, builtin_memset_read_str, &c,
1468 BITS_PER_UNIT, true))
1469 store_by_pieces (shadow_mem, sz, builtin_memset_read_str, &c,
1470 BITS_PER_UNIT, true, 0);
1471 else if (use_after_return_class >= 5
1472 || !set_storage_via_setmem (shadow_mem,
1473 GEN_INT (sz),
1474 gen_int_mode (c, QImode),
1475 BITS_PER_UNIT, BITS_PER_UNIT,
1476 -1, sz, sz, sz))
1478 snprintf (buf, sizeof buf, "__asan_stack_free_%d",
1479 use_after_return_class);
1480 ret = init_one_libfunc (buf);
1481 rtx addr = convert_memory_address (ptr_mode, base);
1482 rtx orig_addr = convert_memory_address (ptr_mode, orig_base);
1483 emit_library_call (ret, LCT_NORMAL, ptr_mode, addr, ptr_mode,
1484 GEN_INT (asan_frame_size + base_align_bias),
1485 TYPE_MODE (pointer_sized_int_node),
1486 orig_addr, ptr_mode);
1488 lab = gen_label_rtx ();
1489 emit_jump (lab);
1490 emit_label (lab2);
1493 shadow_mem = gen_rtx_MEM (BLKmode, shadow_base);
1494 set_mem_alias_set (shadow_mem, asan_shadow_set);
1496 if (STRICT_ALIGNMENT)
1497 set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)));
1499 prev_offset = base_offset;
1500 last_offset = base_offset;
1501 last_size = 0;
1502 for (l = length; l; l -= 2)
1504 offset = base_offset + ((offsets[l - 1] - base_offset)
1505 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
1506 if (last_offset + last_size != offset)
1508 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1509 (last_offset - prev_offset)
1510 >> ASAN_SHADOW_SHIFT);
1511 prev_offset = last_offset;
1512 asan_clear_shadow (shadow_mem, last_size >> ASAN_SHADOW_SHIFT);
1513 last_offset = offset;
1514 last_size = 0;
1516 last_size += base_offset + ((offsets[l - 2] - base_offset)
1517 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1))
1518 - offset;
1520 /* Unpoison shadow memory that corresponds to a variable that is
1521 is subject of use-after-return sanitization. */
1522 if (l > 2)
1524 decl = decls[l / 2 - 2];
1525 if (asan_handled_variables != NULL
1526 && asan_handled_variables->contains (decl))
1528 HOST_WIDE_INT size = offsets[l - 3] - offsets[l - 2];
1529 if (dump_file && (dump_flags & TDF_DETAILS))
1531 const char *n = (DECL_NAME (decl)
1532 ? IDENTIFIER_POINTER (DECL_NAME (decl))
1533 : "<unknown>");
1534 fprintf (dump_file, "Unpoisoning shadow stack for variable: "
1535 "%s (%" PRId64 " B)\n", n, size);
1538 last_size += size & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1);
1542 if (last_size)
1544 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1545 (last_offset - prev_offset)
1546 >> ASAN_SHADOW_SHIFT);
1547 asan_clear_shadow (shadow_mem, last_size >> ASAN_SHADOW_SHIFT);
1550 /* Clean-up set with instrumented stack variables. */
1551 delete asan_handled_variables;
1552 asan_handled_variables = NULL;
1553 delete asan_used_labels;
1554 asan_used_labels = NULL;
1556 do_pending_stack_adjust ();
1557 if (lab)
1558 emit_label (lab);
1560 insns = get_insns ();
1561 end_sequence ();
1562 return insns;
1565 /* Emit __asan_allocas_unpoison (top, bot) call. The BASE parameter corresponds
1566 to BOT argument, for TOP virtual_stack_dynamic_rtx is used. NEW_SEQUENCE
1567 indicates whether we're emitting new instructions sequence or not. */
1569 rtx_insn *
1570 asan_emit_allocas_unpoison (rtx top, rtx bot, rtx_insn *before)
1572 if (before)
1573 push_to_sequence (before);
1574 else
1575 start_sequence ();
1576 rtx ret = init_one_libfunc ("__asan_allocas_unpoison");
1577 top = convert_memory_address (ptr_mode, top);
1578 bot = convert_memory_address (ptr_mode, bot);
1579 ret = emit_library_call_value (ret, NULL_RTX, LCT_NORMAL, ptr_mode,
1580 top, ptr_mode, bot, ptr_mode);
1582 do_pending_stack_adjust ();
1583 rtx_insn *insns = get_insns ();
1584 end_sequence ();
1585 return insns;
1588 /* Return true if DECL, a global var, might be overridden and needs
1589 therefore a local alias. */
1591 static bool
1592 asan_needs_local_alias (tree decl)
1594 return DECL_WEAK (decl) || !targetm.binds_local_p (decl);
1597 /* Return true if DECL, a global var, is an artificial ODR indicator symbol
1598 therefore doesn't need protection. */
1600 static bool
1601 is_odr_indicator (tree decl)
1603 return (DECL_ARTIFICIAL (decl)
1604 && lookup_attribute ("asan odr indicator", DECL_ATTRIBUTES (decl)));
1607 /* Return true if DECL is a VAR_DECL that should be protected
1608 by Address Sanitizer, by appending a red zone with protected
1609 shadow memory after it and aligning it to at least
1610 ASAN_RED_ZONE_SIZE bytes. */
1612 bool
1613 asan_protect_global (tree decl, bool ignore_decl_rtl_set_p)
1615 if (!ASAN_GLOBALS)
1616 return false;
1618 rtx rtl, symbol;
1620 if (TREE_CODE (decl) == STRING_CST)
1622 /* Instrument all STRING_CSTs except those created
1623 by asan_pp_string here. */
1624 if (shadow_ptr_types[0] != NULL_TREE
1625 && TREE_CODE (TREE_TYPE (decl)) == ARRAY_TYPE
1626 && TREE_TYPE (TREE_TYPE (decl)) == TREE_TYPE (shadow_ptr_types[0]))
1627 return false;
1628 return true;
1630 if (!VAR_P (decl)
1631 /* TLS vars aren't statically protectable. */
1632 || DECL_THREAD_LOCAL_P (decl)
1633 /* Externs will be protected elsewhere. */
1634 || DECL_EXTERNAL (decl)
1635 /* PR sanitizer/81697: For architectures that use section anchors first
1636 call to asan_protect_global may occur before DECL_RTL (decl) is set.
1637 We should ignore DECL_RTL_SET_P then, because otherwise the first call
1638 to asan_protect_global will return FALSE and the following calls on the
1639 same decl after setting DECL_RTL (decl) will return TRUE and we'll end
1640 up with inconsistency at runtime. */
1641 || (!DECL_RTL_SET_P (decl) && !ignore_decl_rtl_set_p)
1642 /* Comdat vars pose an ABI problem, we can't know if
1643 the var that is selected by the linker will have
1644 padding or not. */
1645 || DECL_ONE_ONLY (decl)
1646 /* Similarly for common vars. People can use -fno-common.
1647 Note: Linux kernel is built with -fno-common, so we do instrument
1648 globals there even if it is C. */
1649 || (DECL_COMMON (decl) && TREE_PUBLIC (decl))
1650 /* Don't protect if using user section, often vars placed
1651 into user section from multiple TUs are then assumed
1652 to be an array of such vars, putting padding in there
1653 breaks this assumption. */
1654 || (DECL_SECTION_NAME (decl) != NULL
1655 && !symtab_node::get (decl)->implicit_section
1656 && !section_sanitized_p (DECL_SECTION_NAME (decl)))
1657 || DECL_SIZE (decl) == 0
1658 || ASAN_RED_ZONE_SIZE * BITS_PER_UNIT > MAX_OFILE_ALIGNMENT
1659 || TREE_CODE (DECL_SIZE_UNIT (decl)) != INTEGER_CST
1660 || !valid_constant_size_p (DECL_SIZE_UNIT (decl))
1661 || DECL_ALIGN_UNIT (decl) > 2 * ASAN_RED_ZONE_SIZE
1662 || TREE_TYPE (decl) == ubsan_get_source_location_type ()
1663 || is_odr_indicator (decl))
1664 return false;
1666 if (!ignore_decl_rtl_set_p || DECL_RTL_SET_P (decl))
1669 rtl = DECL_RTL (decl);
1670 if (!MEM_P (rtl) || GET_CODE (XEXP (rtl, 0)) != SYMBOL_REF)
1671 return false;
1672 symbol = XEXP (rtl, 0);
1674 if (CONSTANT_POOL_ADDRESS_P (symbol)
1675 || TREE_CONSTANT_POOL_ADDRESS_P (symbol))
1676 return false;
1679 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl)))
1680 return false;
1682 if (!TARGET_SUPPORTS_ALIASES && asan_needs_local_alias (decl))
1683 return false;
1685 return true;
1688 /* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16,_n}.
1689 IS_STORE is either 1 (for a store) or 0 (for a load). */
1691 static tree
1692 report_error_func (bool is_store, bool recover_p, HOST_WIDE_INT size_in_bytes,
1693 int *nargs)
1695 static enum built_in_function report[2][2][6]
1696 = { { { BUILT_IN_ASAN_REPORT_LOAD1, BUILT_IN_ASAN_REPORT_LOAD2,
1697 BUILT_IN_ASAN_REPORT_LOAD4, BUILT_IN_ASAN_REPORT_LOAD8,
1698 BUILT_IN_ASAN_REPORT_LOAD16, BUILT_IN_ASAN_REPORT_LOAD_N },
1699 { BUILT_IN_ASAN_REPORT_STORE1, BUILT_IN_ASAN_REPORT_STORE2,
1700 BUILT_IN_ASAN_REPORT_STORE4, BUILT_IN_ASAN_REPORT_STORE8,
1701 BUILT_IN_ASAN_REPORT_STORE16, BUILT_IN_ASAN_REPORT_STORE_N } },
1702 { { BUILT_IN_ASAN_REPORT_LOAD1_NOABORT,
1703 BUILT_IN_ASAN_REPORT_LOAD2_NOABORT,
1704 BUILT_IN_ASAN_REPORT_LOAD4_NOABORT,
1705 BUILT_IN_ASAN_REPORT_LOAD8_NOABORT,
1706 BUILT_IN_ASAN_REPORT_LOAD16_NOABORT,
1707 BUILT_IN_ASAN_REPORT_LOAD_N_NOABORT },
1708 { BUILT_IN_ASAN_REPORT_STORE1_NOABORT,
1709 BUILT_IN_ASAN_REPORT_STORE2_NOABORT,
1710 BUILT_IN_ASAN_REPORT_STORE4_NOABORT,
1711 BUILT_IN_ASAN_REPORT_STORE8_NOABORT,
1712 BUILT_IN_ASAN_REPORT_STORE16_NOABORT,
1713 BUILT_IN_ASAN_REPORT_STORE_N_NOABORT } } };
1714 if (size_in_bytes == -1)
1716 *nargs = 2;
1717 return builtin_decl_implicit (report[recover_p][is_store][5]);
1719 *nargs = 1;
1720 int size_log2 = exact_log2 (size_in_bytes);
1721 return builtin_decl_implicit (report[recover_p][is_store][size_log2]);
1724 /* Construct a function tree for __asan_{load,store}{1,2,4,8,16,_n}.
1725 IS_STORE is either 1 (for a store) or 0 (for a load). */
1727 static tree
1728 check_func (bool is_store, bool recover_p, HOST_WIDE_INT size_in_bytes,
1729 int *nargs)
1731 static enum built_in_function check[2][2][6]
1732 = { { { BUILT_IN_ASAN_LOAD1, BUILT_IN_ASAN_LOAD2,
1733 BUILT_IN_ASAN_LOAD4, BUILT_IN_ASAN_LOAD8,
1734 BUILT_IN_ASAN_LOAD16, BUILT_IN_ASAN_LOADN },
1735 { BUILT_IN_ASAN_STORE1, BUILT_IN_ASAN_STORE2,
1736 BUILT_IN_ASAN_STORE4, BUILT_IN_ASAN_STORE8,
1737 BUILT_IN_ASAN_STORE16, BUILT_IN_ASAN_STOREN } },
1738 { { BUILT_IN_ASAN_LOAD1_NOABORT,
1739 BUILT_IN_ASAN_LOAD2_NOABORT,
1740 BUILT_IN_ASAN_LOAD4_NOABORT,
1741 BUILT_IN_ASAN_LOAD8_NOABORT,
1742 BUILT_IN_ASAN_LOAD16_NOABORT,
1743 BUILT_IN_ASAN_LOADN_NOABORT },
1744 { BUILT_IN_ASAN_STORE1_NOABORT,
1745 BUILT_IN_ASAN_STORE2_NOABORT,
1746 BUILT_IN_ASAN_STORE4_NOABORT,
1747 BUILT_IN_ASAN_STORE8_NOABORT,
1748 BUILT_IN_ASAN_STORE16_NOABORT,
1749 BUILT_IN_ASAN_STOREN_NOABORT } } };
1750 if (size_in_bytes == -1)
1752 *nargs = 2;
1753 return builtin_decl_implicit (check[recover_p][is_store][5]);
1755 *nargs = 1;
1756 int size_log2 = exact_log2 (size_in_bytes);
1757 return builtin_decl_implicit (check[recover_p][is_store][size_log2]);
1760 /* Split the current basic block and create a condition statement
1761 insertion point right before or after the statement pointed to by
1762 ITER. Return an iterator to the point at which the caller might
1763 safely insert the condition statement.
1765 THEN_BLOCK must be set to the address of an uninitialized instance
1766 of basic_block. The function will then set *THEN_BLOCK to the
1767 'then block' of the condition statement to be inserted by the
1768 caller.
1770 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1771 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1773 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1774 block' of the condition statement to be inserted by the caller.
1776 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1777 statements starting from *ITER, and *THEN_BLOCK is a new empty
1778 block.
1780 *ITER is adjusted to point to always point to the first statement
1781 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1782 same as what ITER was pointing to prior to calling this function,
1783 if BEFORE_P is true; otherwise, it is its following statement. */
1785 gimple_stmt_iterator
1786 create_cond_insert_point (gimple_stmt_iterator *iter,
1787 bool before_p,
1788 bool then_more_likely_p,
1789 bool create_then_fallthru_edge,
1790 basic_block *then_block,
1791 basic_block *fallthrough_block)
1793 gimple_stmt_iterator gsi = *iter;
1795 if (!gsi_end_p (gsi) && before_p)
1796 gsi_prev (&gsi);
1798 basic_block cur_bb = gsi_bb (*iter);
1800 edge e = split_block (cur_bb, gsi_stmt (gsi));
1802 /* Get a hold on the 'condition block', the 'then block' and the
1803 'else block'. */
1804 basic_block cond_bb = e->src;
1805 basic_block fallthru_bb = e->dest;
1806 basic_block then_bb = create_empty_bb (cond_bb);
1807 if (current_loops)
1809 add_bb_to_loop (then_bb, cond_bb->loop_father);
1810 loops_state_set (LOOPS_NEED_FIXUP);
1813 /* Set up the newly created 'then block'. */
1814 e = make_edge (cond_bb, then_bb, EDGE_TRUE_VALUE);
1815 profile_probability fallthrough_probability
1816 = then_more_likely_p
1817 ? profile_probability::very_unlikely ()
1818 : profile_probability::very_likely ();
1819 e->probability = fallthrough_probability.invert ();
1820 then_bb->count = e->count ();
1821 if (create_then_fallthru_edge)
1822 make_single_succ_edge (then_bb, fallthru_bb, EDGE_FALLTHRU);
1824 /* Set up the fallthrough basic block. */
1825 e = find_edge (cond_bb, fallthru_bb);
1826 e->flags = EDGE_FALSE_VALUE;
1827 e->probability = fallthrough_probability;
1829 /* Update dominance info for the newly created then_bb; note that
1830 fallthru_bb's dominance info has already been updated by
1831 split_bock. */
1832 if (dom_info_available_p (CDI_DOMINATORS))
1833 set_immediate_dominator (CDI_DOMINATORS, then_bb, cond_bb);
1835 *then_block = then_bb;
1836 *fallthrough_block = fallthru_bb;
1837 *iter = gsi_start_bb (fallthru_bb);
1839 return gsi_last_bb (cond_bb);
1842 /* Insert an if condition followed by a 'then block' right before the
1843 statement pointed to by ITER. The fallthrough block -- which is the
1844 else block of the condition as well as the destination of the
1845 outcoming edge of the 'then block' -- starts with the statement
1846 pointed to by ITER.
1848 COND is the condition of the if.
1850 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1851 'then block' is higher than the probability of the edge to the
1852 fallthrough block.
1854 Upon completion of the function, *THEN_BB is set to the newly
1855 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1856 fallthrough block.
1858 *ITER is adjusted to still point to the same statement it was
1859 pointing to initially. */
1861 static void
1862 insert_if_then_before_iter (gcond *cond,
1863 gimple_stmt_iterator *iter,
1864 bool then_more_likely_p,
1865 basic_block *then_bb,
1866 basic_block *fallthrough_bb)
1868 gimple_stmt_iterator cond_insert_point =
1869 create_cond_insert_point (iter,
1870 /*before_p=*/true,
1871 then_more_likely_p,
1872 /*create_then_fallthru_edge=*/true,
1873 then_bb,
1874 fallthrough_bb);
1875 gsi_insert_after (&cond_insert_point, cond, GSI_NEW_STMT);
1878 /* Build (base_addr >> ASAN_SHADOW_SHIFT) + asan_shadow_offset ().
1879 If RETURN_ADDRESS is set to true, return memory location instread
1880 of a value in the shadow memory. */
1882 static tree
1883 build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
1884 tree base_addr, tree shadow_ptr_type,
1885 bool return_address = false)
1887 tree t, uintptr_type = TREE_TYPE (base_addr);
1888 tree shadow_type = TREE_TYPE (shadow_ptr_type);
1889 gimple *g;
1891 t = build_int_cst (uintptr_type, ASAN_SHADOW_SHIFT);
1892 g = gimple_build_assign (make_ssa_name (uintptr_type), RSHIFT_EXPR,
1893 base_addr, t);
1894 gimple_set_location (g, location);
1895 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1897 t = build_int_cst (uintptr_type, asan_shadow_offset ());
1898 g = gimple_build_assign (make_ssa_name (uintptr_type), PLUS_EXPR,
1899 gimple_assign_lhs (g), t);
1900 gimple_set_location (g, location);
1901 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1903 g = gimple_build_assign (make_ssa_name (shadow_ptr_type), NOP_EXPR,
1904 gimple_assign_lhs (g));
1905 gimple_set_location (g, location);
1906 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1908 if (!return_address)
1910 t = build2 (MEM_REF, shadow_type, gimple_assign_lhs (g),
1911 build_int_cst (shadow_ptr_type, 0));
1912 g = gimple_build_assign (make_ssa_name (shadow_type), MEM_REF, t);
1913 gimple_set_location (g, location);
1914 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1917 return gimple_assign_lhs (g);
1920 /* BASE can already be an SSA_NAME; in that case, do not create a
1921 new SSA_NAME for it. */
1923 static tree
1924 maybe_create_ssa_name (location_t loc, tree base, gimple_stmt_iterator *iter,
1925 bool before_p)
1927 if (TREE_CODE (base) == SSA_NAME)
1928 return base;
1929 gimple *g = gimple_build_assign (make_ssa_name (TREE_TYPE (base)),
1930 TREE_CODE (base), base);
1931 gimple_set_location (g, loc);
1932 if (before_p)
1933 gsi_insert_before (iter, g, GSI_SAME_STMT);
1934 else
1935 gsi_insert_after (iter, g, GSI_NEW_STMT);
1936 return gimple_assign_lhs (g);
1939 /* LEN can already have necessary size and precision;
1940 in that case, do not create a new variable. */
1942 tree
1943 maybe_cast_to_ptrmode (location_t loc, tree len, gimple_stmt_iterator *iter,
1944 bool before_p)
1946 if (ptrofftype_p (len))
1947 return len;
1948 gimple *g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
1949 NOP_EXPR, len);
1950 gimple_set_location (g, loc);
1951 if (before_p)
1952 gsi_insert_before (iter, g, GSI_SAME_STMT);
1953 else
1954 gsi_insert_after (iter, g, GSI_NEW_STMT);
1955 return gimple_assign_lhs (g);
1958 /* Instrument the memory access instruction BASE. Insert new
1959 statements before or after ITER.
1961 Note that the memory access represented by BASE can be either an
1962 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1963 location. IS_STORE is TRUE for a store, FALSE for a load.
1964 BEFORE_P is TRUE for inserting the instrumentation code before
1965 ITER, FALSE for inserting it after ITER. IS_SCALAR_ACCESS is TRUE
1966 for a scalar memory access and FALSE for memory region access.
1967 NON_ZERO_P is TRUE if memory region is guaranteed to have non-zero
1968 length. ALIGN tells alignment of accessed memory object.
1970 START_INSTRUMENTED and END_INSTRUMENTED are TRUE if start/end of
1971 memory region have already been instrumented.
1973 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1974 statement it was pointing to prior to calling this function,
1975 otherwise, it points to the statement logically following it. */
1977 static void
1978 build_check_stmt (location_t loc, tree base, tree len,
1979 HOST_WIDE_INT size_in_bytes, gimple_stmt_iterator *iter,
1980 bool is_non_zero_len, bool before_p, bool is_store,
1981 bool is_scalar_access, unsigned int align = 0)
1983 gimple_stmt_iterator gsi = *iter;
1984 gimple *g;
1986 gcc_assert (!(size_in_bytes > 0 && !is_non_zero_len));
1988 gsi = *iter;
1990 base = unshare_expr (base);
1991 base = maybe_create_ssa_name (loc, base, &gsi, before_p);
1993 if (len)
1995 len = unshare_expr (len);
1996 len = maybe_cast_to_ptrmode (loc, len, iter, before_p);
1998 else
2000 gcc_assert (size_in_bytes != -1);
2001 len = build_int_cst (pointer_sized_int_node, size_in_bytes);
2004 if (size_in_bytes > 1)
2006 if ((size_in_bytes & (size_in_bytes - 1)) != 0
2007 || size_in_bytes > 16)
2008 is_scalar_access = false;
2009 else if (align && align < size_in_bytes * BITS_PER_UNIT)
2011 /* On non-strict alignment targets, if
2012 16-byte access is just 8-byte aligned,
2013 this will result in misaligned shadow
2014 memory 2 byte load, but otherwise can
2015 be handled using one read. */
2016 if (size_in_bytes != 16
2017 || STRICT_ALIGNMENT
2018 || align < 8 * BITS_PER_UNIT)
2019 is_scalar_access = false;
2023 HOST_WIDE_INT flags = 0;
2024 if (is_store)
2025 flags |= ASAN_CHECK_STORE;
2026 if (is_non_zero_len)
2027 flags |= ASAN_CHECK_NON_ZERO_LEN;
2028 if (is_scalar_access)
2029 flags |= ASAN_CHECK_SCALAR_ACCESS;
2031 g = gimple_build_call_internal (IFN_ASAN_CHECK, 4,
2032 build_int_cst (integer_type_node, flags),
2033 base, len,
2034 build_int_cst (integer_type_node,
2035 align / BITS_PER_UNIT));
2036 gimple_set_location (g, loc);
2037 if (before_p)
2038 gsi_insert_before (&gsi, g, GSI_SAME_STMT);
2039 else
2041 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2042 gsi_next (&gsi);
2043 *iter = gsi;
2047 /* If T represents a memory access, add instrumentation code before ITER.
2048 LOCATION is source code location.
2049 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
2051 static void
2052 instrument_derefs (gimple_stmt_iterator *iter, tree t,
2053 location_t location, bool is_store)
2055 if (is_store && !ASAN_INSTRUMENT_WRITES)
2056 return;
2057 if (!is_store && !ASAN_INSTRUMENT_READS)
2058 return;
2060 tree type, base;
2061 HOST_WIDE_INT size_in_bytes;
2062 if (location == UNKNOWN_LOCATION)
2063 location = EXPR_LOCATION (t);
2065 type = TREE_TYPE (t);
2066 switch (TREE_CODE (t))
2068 case ARRAY_REF:
2069 case COMPONENT_REF:
2070 case INDIRECT_REF:
2071 case MEM_REF:
2072 case VAR_DECL:
2073 case BIT_FIELD_REF:
2074 break;
2075 /* FALLTHRU */
2076 default:
2077 return;
2080 size_in_bytes = int_size_in_bytes (type);
2081 if (size_in_bytes <= 0)
2082 return;
2084 poly_int64 bitsize, bitpos;
2085 tree offset;
2086 machine_mode mode;
2087 int unsignedp, reversep, volatilep = 0;
2088 tree inner = get_inner_reference (t, &bitsize, &bitpos, &offset, &mode,
2089 &unsignedp, &reversep, &volatilep);
2091 if (TREE_CODE (t) == COMPONENT_REF
2092 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1)) != NULL_TREE)
2094 tree repr = DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1));
2095 instrument_derefs (iter, build3 (COMPONENT_REF, TREE_TYPE (repr),
2096 TREE_OPERAND (t, 0), repr,
2097 TREE_OPERAND (t, 2)),
2098 location, is_store);
2099 return;
2102 if (!multiple_p (bitpos, BITS_PER_UNIT)
2103 || maybe_ne (bitsize, size_in_bytes * BITS_PER_UNIT))
2104 return;
2106 if (VAR_P (inner) && DECL_HARD_REGISTER (inner))
2107 return;
2109 poly_int64 decl_size;
2110 if (VAR_P (inner)
2111 && offset == NULL_TREE
2112 && DECL_SIZE (inner)
2113 && poly_int_tree_p (DECL_SIZE (inner), &decl_size)
2114 && known_subrange_p (bitpos, bitsize, 0, decl_size))
2116 if (DECL_THREAD_LOCAL_P (inner))
2117 return;
2118 if (!ASAN_GLOBALS && is_global_var (inner))
2119 return;
2120 if (!TREE_STATIC (inner))
2122 /* Automatic vars in the current function will be always
2123 accessible. */
2124 if (decl_function_context (inner) == current_function_decl
2125 && (!asan_sanitize_use_after_scope ()
2126 || !TREE_ADDRESSABLE (inner)))
2127 return;
2129 /* Always instrument external vars, they might be dynamically
2130 initialized. */
2131 else if (!DECL_EXTERNAL (inner))
2133 /* For static vars if they are known not to be dynamically
2134 initialized, they will be always accessible. */
2135 varpool_node *vnode = varpool_node::get (inner);
2136 if (vnode && !vnode->dynamically_initialized)
2137 return;
2141 base = build_fold_addr_expr (t);
2142 if (!has_mem_ref_been_instrumented (base, size_in_bytes))
2144 unsigned int align = get_object_alignment (t);
2145 build_check_stmt (location, base, NULL_TREE, size_in_bytes, iter,
2146 /*is_non_zero_len*/size_in_bytes > 0, /*before_p=*/true,
2147 is_store, /*is_scalar_access*/true, align);
2148 update_mem_ref_hash_table (base, size_in_bytes);
2149 update_mem_ref_hash_table (t, size_in_bytes);
2154 /* Insert a memory reference into the hash table if access length
2155 can be determined in compile time. */
2157 static void
2158 maybe_update_mem_ref_hash_table (tree base, tree len)
2160 if (!POINTER_TYPE_P (TREE_TYPE (base))
2161 || !INTEGRAL_TYPE_P (TREE_TYPE (len)))
2162 return;
2164 HOST_WIDE_INT size_in_bytes = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
2166 if (size_in_bytes != -1)
2167 update_mem_ref_hash_table (base, size_in_bytes);
2170 /* Instrument an access to a contiguous memory region that starts at
2171 the address pointed to by BASE, over a length of LEN (expressed in
2172 the sizeof (*BASE) bytes). ITER points to the instruction before
2173 which the instrumentation instructions must be inserted. LOCATION
2174 is the source location that the instrumentation instructions must
2175 have. If IS_STORE is true, then the memory access is a store;
2176 otherwise, it's a load. */
2178 static void
2179 instrument_mem_region_access (tree base, tree len,
2180 gimple_stmt_iterator *iter,
2181 location_t location, bool is_store)
2183 if (!POINTER_TYPE_P (TREE_TYPE (base))
2184 || !INTEGRAL_TYPE_P (TREE_TYPE (len))
2185 || integer_zerop (len))
2186 return;
2188 HOST_WIDE_INT size_in_bytes = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
2190 if ((size_in_bytes == -1)
2191 || !has_mem_ref_been_instrumented (base, size_in_bytes))
2193 build_check_stmt (location, base, len, size_in_bytes, iter,
2194 /*is_non_zero_len*/size_in_bytes > 0, /*before_p*/true,
2195 is_store, /*is_scalar_access*/false, /*align*/0);
2198 maybe_update_mem_ref_hash_table (base, len);
2199 *iter = gsi_for_stmt (gsi_stmt (*iter));
2202 /* Instrument the call to a built-in memory access function that is
2203 pointed to by the iterator ITER.
2205 Upon completion, return TRUE iff *ITER has been advanced to the
2206 statement following the one it was originally pointing to. */
2208 static bool
2209 instrument_builtin_call (gimple_stmt_iterator *iter)
2211 if (!ASAN_MEMINTRIN)
2212 return false;
2214 bool iter_advanced_p = false;
2215 gcall *call = as_a <gcall *> (gsi_stmt (*iter));
2217 gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL));
2219 location_t loc = gimple_location (call);
2221 asan_mem_ref src0, src1, dest;
2222 asan_mem_ref_init (&src0, NULL, 1);
2223 asan_mem_ref_init (&src1, NULL, 1);
2224 asan_mem_ref_init (&dest, NULL, 1);
2226 tree src0_len = NULL_TREE, src1_len = NULL_TREE, dest_len = NULL_TREE;
2227 bool src0_is_store = false, src1_is_store = false, dest_is_store = false,
2228 dest_is_deref = false, intercepted_p = true;
2230 if (get_mem_refs_of_builtin_call (call,
2231 &src0, &src0_len, &src0_is_store,
2232 &src1, &src1_len, &src1_is_store,
2233 &dest, &dest_len, &dest_is_store,
2234 &dest_is_deref, &intercepted_p, iter))
2236 if (dest_is_deref)
2238 instrument_derefs (iter, dest.start, loc, dest_is_store);
2239 gsi_next (iter);
2240 iter_advanced_p = true;
2242 else if (!intercepted_p
2243 && (src0_len || src1_len || dest_len))
2245 if (src0.start != NULL_TREE)
2246 instrument_mem_region_access (src0.start, src0_len,
2247 iter, loc, /*is_store=*/false);
2248 if (src1.start != NULL_TREE)
2249 instrument_mem_region_access (src1.start, src1_len,
2250 iter, loc, /*is_store=*/false);
2251 if (dest.start != NULL_TREE)
2252 instrument_mem_region_access (dest.start, dest_len,
2253 iter, loc, /*is_store=*/true);
2255 *iter = gsi_for_stmt (call);
2256 gsi_next (iter);
2257 iter_advanced_p = true;
2259 else
2261 if (src0.start != NULL_TREE)
2262 maybe_update_mem_ref_hash_table (src0.start, src0_len);
2263 if (src1.start != NULL_TREE)
2264 maybe_update_mem_ref_hash_table (src1.start, src1_len);
2265 if (dest.start != NULL_TREE)
2266 maybe_update_mem_ref_hash_table (dest.start, dest_len);
2269 return iter_advanced_p;
2272 /* Instrument the assignment statement ITER if it is subject to
2273 instrumentation. Return TRUE iff instrumentation actually
2274 happened. In that case, the iterator ITER is advanced to the next
2275 logical expression following the one initially pointed to by ITER,
2276 and the relevant memory reference that which access has been
2277 instrumented is added to the memory references hash table. */
2279 static bool
2280 maybe_instrument_assignment (gimple_stmt_iterator *iter)
2282 gimple *s = gsi_stmt (*iter);
2284 gcc_assert (gimple_assign_single_p (s));
2286 tree ref_expr = NULL_TREE;
2287 bool is_store, is_instrumented = false;
2289 if (gimple_store_p (s))
2291 ref_expr = gimple_assign_lhs (s);
2292 is_store = true;
2293 instrument_derefs (iter, ref_expr,
2294 gimple_location (s),
2295 is_store);
2296 is_instrumented = true;
2299 if (gimple_assign_load_p (s))
2301 ref_expr = gimple_assign_rhs1 (s);
2302 is_store = false;
2303 instrument_derefs (iter, ref_expr,
2304 gimple_location (s),
2305 is_store);
2306 is_instrumented = true;
2309 if (is_instrumented)
2310 gsi_next (iter);
2312 return is_instrumented;
2315 /* Instrument the function call pointed to by the iterator ITER, if it
2316 is subject to instrumentation. At the moment, the only function
2317 calls that are instrumented are some built-in functions that access
2318 memory. Look at instrument_builtin_call to learn more.
2320 Upon completion return TRUE iff *ITER was advanced to the statement
2321 following the one it was originally pointing to. */
2323 static bool
2324 maybe_instrument_call (gimple_stmt_iterator *iter)
2326 gimple *stmt = gsi_stmt (*iter);
2327 bool is_builtin = gimple_call_builtin_p (stmt, BUILT_IN_NORMAL);
2329 if (is_builtin && instrument_builtin_call (iter))
2330 return true;
2332 if (gimple_call_noreturn_p (stmt))
2334 if (is_builtin)
2336 tree callee = gimple_call_fndecl (stmt);
2337 switch (DECL_FUNCTION_CODE (callee))
2339 case BUILT_IN_UNREACHABLE:
2340 case BUILT_IN_TRAP:
2341 /* Don't instrument these. */
2342 return false;
2343 default:
2344 break;
2347 tree decl = builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN);
2348 gimple *g = gimple_build_call (decl, 0);
2349 gimple_set_location (g, gimple_location (stmt));
2350 gsi_insert_before (iter, g, GSI_SAME_STMT);
2353 bool instrumented = false;
2354 if (gimple_store_p (stmt))
2356 tree ref_expr = gimple_call_lhs (stmt);
2357 instrument_derefs (iter, ref_expr,
2358 gimple_location (stmt),
2359 /*is_store=*/true);
2361 instrumented = true;
2364 /* Walk through gimple_call arguments and check them id needed. */
2365 unsigned args_num = gimple_call_num_args (stmt);
2366 for (unsigned i = 0; i < args_num; ++i)
2368 tree arg = gimple_call_arg (stmt, i);
2369 /* If ARG is not a non-aggregate register variable, compiler in general
2370 creates temporary for it and pass it as argument to gimple call.
2371 But in some cases, e.g. when we pass by value a small structure that
2372 fits to register, compiler can avoid extra overhead by pulling out
2373 these temporaries. In this case, we should check the argument. */
2374 if (!is_gimple_reg (arg) && !is_gimple_min_invariant (arg))
2376 instrument_derefs (iter, arg,
2377 gimple_location (stmt),
2378 /*is_store=*/false);
2379 instrumented = true;
2382 if (instrumented)
2383 gsi_next (iter);
2384 return instrumented;
2387 /* Walk each instruction of all basic block and instrument those that
2388 represent memory references: loads, stores, or function calls.
2389 In a given basic block, this function avoids instrumenting memory
2390 references that have already been instrumented. */
2392 static void
2393 transform_statements (void)
2395 basic_block bb, last_bb = NULL;
2396 gimple_stmt_iterator i;
2397 int saved_last_basic_block = last_basic_block_for_fn (cfun);
2399 FOR_EACH_BB_FN (bb, cfun)
2401 basic_block prev_bb = bb;
2403 if (bb->index >= saved_last_basic_block) continue;
2405 /* Flush the mem ref hash table, if current bb doesn't have
2406 exactly one predecessor, or if that predecessor (skipping
2407 over asan created basic blocks) isn't the last processed
2408 basic block. Thus we effectively flush on extended basic
2409 block boundaries. */
2410 while (single_pred_p (prev_bb))
2412 prev_bb = single_pred (prev_bb);
2413 if (prev_bb->index < saved_last_basic_block)
2414 break;
2416 if (prev_bb != last_bb)
2417 empty_mem_ref_hash_table ();
2418 last_bb = bb;
2420 for (i = gsi_start_bb (bb); !gsi_end_p (i);)
2422 gimple *s = gsi_stmt (i);
2424 if (has_stmt_been_instrumented_p (s))
2425 gsi_next (&i);
2426 else if (gimple_assign_single_p (s)
2427 && !gimple_clobber_p (s)
2428 && maybe_instrument_assignment (&i))
2429 /* Nothing to do as maybe_instrument_assignment advanced
2430 the iterator I. */;
2431 else if (is_gimple_call (s) && maybe_instrument_call (&i))
2432 /* Nothing to do as maybe_instrument_call
2433 advanced the iterator I. */;
2434 else
2436 /* No instrumentation happened.
2438 If the current instruction is a function call that
2439 might free something, let's forget about the memory
2440 references that got instrumented. Otherwise we might
2441 miss some instrumentation opportunities. Do the same
2442 for a ASAN_MARK poisoning internal function. */
2443 if (is_gimple_call (s)
2444 && (!nonfreeing_call_p (s)
2445 || asan_mark_p (s, ASAN_MARK_POISON)))
2446 empty_mem_ref_hash_table ();
2448 gsi_next (&i);
2452 free_mem_ref_resources ();
2455 /* Build
2456 __asan_before_dynamic_init (module_name)
2458 __asan_after_dynamic_init ()
2459 call. */
2461 tree
2462 asan_dynamic_init_call (bool after_p)
2464 if (shadow_ptr_types[0] == NULL_TREE)
2465 asan_init_shadow_ptr_types ();
2467 tree fn = builtin_decl_implicit (after_p
2468 ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
2469 : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT);
2470 tree module_name_cst = NULL_TREE;
2471 if (!after_p)
2473 pretty_printer module_name_pp;
2474 pp_string (&module_name_pp, main_input_filename);
2476 module_name_cst = asan_pp_string (&module_name_pp);
2477 module_name_cst = fold_convert (const_ptr_type_node,
2478 module_name_cst);
2481 return build_call_expr (fn, after_p ? 0 : 1, module_name_cst);
2484 /* Build
2485 struct __asan_global
2487 const void *__beg;
2488 uptr __size;
2489 uptr __size_with_redzone;
2490 const void *__name;
2491 const void *__module_name;
2492 uptr __has_dynamic_init;
2493 __asan_global_source_location *__location;
2494 char *__odr_indicator;
2495 } type. */
2497 static tree
2498 asan_global_struct (void)
2500 static const char *field_names[]
2501 = { "__beg", "__size", "__size_with_redzone",
2502 "__name", "__module_name", "__has_dynamic_init", "__location",
2503 "__odr_indicator" };
2504 tree fields[ARRAY_SIZE (field_names)], ret;
2505 unsigned i;
2507 ret = make_node (RECORD_TYPE);
2508 for (i = 0; i < ARRAY_SIZE (field_names); i++)
2510 fields[i]
2511 = build_decl (UNKNOWN_LOCATION, FIELD_DECL,
2512 get_identifier (field_names[i]),
2513 (i == 0 || i == 3) ? const_ptr_type_node
2514 : pointer_sized_int_node);
2515 DECL_CONTEXT (fields[i]) = ret;
2516 if (i)
2517 DECL_CHAIN (fields[i - 1]) = fields[i];
2519 tree type_decl = build_decl (input_location, TYPE_DECL,
2520 get_identifier ("__asan_global"), ret);
2521 DECL_IGNORED_P (type_decl) = 1;
2522 DECL_ARTIFICIAL (type_decl) = 1;
2523 TYPE_FIELDS (ret) = fields[0];
2524 TYPE_NAME (ret) = type_decl;
2525 TYPE_STUB_DECL (ret) = type_decl;
2526 layout_type (ret);
2527 return ret;
2530 /* Create and return odr indicator symbol for DECL.
2531 TYPE is __asan_global struct type as returned by asan_global_struct. */
2533 static tree
2534 create_odr_indicator (tree decl, tree type)
2536 char *name;
2537 tree uptr = TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type)));
2538 tree decl_name
2539 = (HAS_DECL_ASSEMBLER_NAME_P (decl) ? DECL_ASSEMBLER_NAME (decl)
2540 : DECL_NAME (decl));
2541 /* DECL_NAME theoretically might be NULL. Bail out with 0 in this case. */
2542 if (decl_name == NULL_TREE)
2543 return build_int_cst (uptr, 0);
2544 const char *dname = IDENTIFIER_POINTER (decl_name);
2545 if (HAS_DECL_ASSEMBLER_NAME_P (decl))
2546 dname = targetm.strip_name_encoding (dname);
2547 size_t len = strlen (dname) + sizeof ("__odr_asan_");
2548 name = XALLOCAVEC (char, len);
2549 snprintf (name, len, "__odr_asan_%s", dname);
2550 #ifndef NO_DOT_IN_LABEL
2551 name[sizeof ("__odr_asan") - 1] = '.';
2552 #elif !defined(NO_DOLLAR_IN_LABEL)
2553 name[sizeof ("__odr_asan") - 1] = '$';
2554 #endif
2555 tree var = build_decl (UNKNOWN_LOCATION, VAR_DECL, get_identifier (name),
2556 char_type_node);
2557 TREE_ADDRESSABLE (var) = 1;
2558 TREE_READONLY (var) = 0;
2559 TREE_THIS_VOLATILE (var) = 1;
2560 DECL_GIMPLE_REG_P (var) = 0;
2561 DECL_ARTIFICIAL (var) = 1;
2562 DECL_IGNORED_P (var) = 1;
2563 TREE_STATIC (var) = 1;
2564 TREE_PUBLIC (var) = 1;
2565 DECL_VISIBILITY (var) = DECL_VISIBILITY (decl);
2566 DECL_VISIBILITY_SPECIFIED (var) = DECL_VISIBILITY_SPECIFIED (decl);
2568 TREE_USED (var) = 1;
2569 tree ctor = build_constructor_va (TREE_TYPE (var), 1, NULL_TREE,
2570 build_int_cst (unsigned_type_node, 0));
2571 TREE_CONSTANT (ctor) = 1;
2572 TREE_STATIC (ctor) = 1;
2573 DECL_INITIAL (var) = ctor;
2574 DECL_ATTRIBUTES (var) = tree_cons (get_identifier ("asan odr indicator"),
2575 NULL, DECL_ATTRIBUTES (var));
2576 make_decl_rtl (var);
2577 varpool_node::finalize_decl (var);
2578 return fold_convert (uptr, build_fold_addr_expr (var));
2581 /* Return true if DECL, a global var, might be overridden and needs
2582 an additional odr indicator symbol. */
2584 static bool
2585 asan_needs_odr_indicator_p (tree decl)
2587 /* Don't emit ODR indicators for kernel because:
2588 a) Kernel is written in C thus doesn't need ODR indicators.
2589 b) Some kernel code may have assumptions about symbols containing specific
2590 patterns in their names. Since ODR indicators contain original names
2591 of symbols they are emitted for, these assumptions would be broken for
2592 ODR indicator symbols. */
2593 return (!(flag_sanitize & SANITIZE_KERNEL_ADDRESS)
2594 && !DECL_ARTIFICIAL (decl)
2595 && !DECL_WEAK (decl)
2596 && TREE_PUBLIC (decl));
2599 /* Append description of a single global DECL into vector V.
2600 TYPE is __asan_global struct type as returned by asan_global_struct. */
2602 static void
2603 asan_add_global (tree decl, tree type, vec<constructor_elt, va_gc> *v)
2605 tree init, uptr = TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type)));
2606 unsigned HOST_WIDE_INT size;
2607 tree str_cst, module_name_cst, refdecl = decl;
2608 vec<constructor_elt, va_gc> *vinner = NULL;
2610 pretty_printer asan_pp, module_name_pp;
2612 if (DECL_NAME (decl))
2613 pp_tree_identifier (&asan_pp, DECL_NAME (decl));
2614 else
2615 pp_string (&asan_pp, "<unknown>");
2616 str_cst = asan_pp_string (&asan_pp);
2618 pp_string (&module_name_pp, main_input_filename);
2619 module_name_cst = asan_pp_string (&module_name_pp);
2621 if (asan_needs_local_alias (decl))
2623 char buf[20];
2624 ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", vec_safe_length (v) + 1);
2625 refdecl = build_decl (DECL_SOURCE_LOCATION (decl),
2626 VAR_DECL, get_identifier (buf), TREE_TYPE (decl));
2627 TREE_ADDRESSABLE (refdecl) = TREE_ADDRESSABLE (decl);
2628 TREE_READONLY (refdecl) = TREE_READONLY (decl);
2629 TREE_THIS_VOLATILE (refdecl) = TREE_THIS_VOLATILE (decl);
2630 DECL_GIMPLE_REG_P (refdecl) = DECL_GIMPLE_REG_P (decl);
2631 DECL_ARTIFICIAL (refdecl) = DECL_ARTIFICIAL (decl);
2632 DECL_IGNORED_P (refdecl) = DECL_IGNORED_P (decl);
2633 TREE_STATIC (refdecl) = 1;
2634 TREE_PUBLIC (refdecl) = 0;
2635 TREE_USED (refdecl) = 1;
2636 assemble_alias (refdecl, DECL_ASSEMBLER_NAME (decl));
2639 tree odr_indicator_ptr
2640 = (asan_needs_odr_indicator_p (decl) ? create_odr_indicator (decl, type)
2641 : build_int_cst (uptr, 0));
2642 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2643 fold_convert (const_ptr_type_node,
2644 build_fold_addr_expr (refdecl)));
2645 size = tree_to_uhwi (DECL_SIZE_UNIT (decl));
2646 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size));
2647 size += asan_red_zone_size (size);
2648 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size));
2649 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2650 fold_convert (const_ptr_type_node, str_cst));
2651 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2652 fold_convert (const_ptr_type_node, module_name_cst));
2653 varpool_node *vnode = varpool_node::get (decl);
2654 int has_dynamic_init = 0;
2655 /* FIXME: Enable initialization order fiasco detection in LTO mode once
2656 proper fix for PR 79061 will be applied. */
2657 if (!in_lto_p)
2658 has_dynamic_init = vnode ? vnode->dynamically_initialized : 0;
2659 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2660 build_int_cst (uptr, has_dynamic_init));
2661 tree locptr = NULL_TREE;
2662 location_t loc = DECL_SOURCE_LOCATION (decl);
2663 expanded_location xloc = expand_location (loc);
2664 if (xloc.file != NULL)
2666 static int lasanloccnt = 0;
2667 char buf[25];
2668 ASM_GENERATE_INTERNAL_LABEL (buf, "LASANLOC", ++lasanloccnt);
2669 tree var = build_decl (UNKNOWN_LOCATION, VAR_DECL, get_identifier (buf),
2670 ubsan_get_source_location_type ());
2671 TREE_STATIC (var) = 1;
2672 TREE_PUBLIC (var) = 0;
2673 DECL_ARTIFICIAL (var) = 1;
2674 DECL_IGNORED_P (var) = 1;
2675 pretty_printer filename_pp;
2676 pp_string (&filename_pp, xloc.file);
2677 tree str = asan_pp_string (&filename_pp);
2678 tree ctor = build_constructor_va (TREE_TYPE (var), 3,
2679 NULL_TREE, str, NULL_TREE,
2680 build_int_cst (unsigned_type_node,
2681 xloc.line), NULL_TREE,
2682 build_int_cst (unsigned_type_node,
2683 xloc.column));
2684 TREE_CONSTANT (ctor) = 1;
2685 TREE_STATIC (ctor) = 1;
2686 DECL_INITIAL (var) = ctor;
2687 varpool_node::finalize_decl (var);
2688 locptr = fold_convert (uptr, build_fold_addr_expr (var));
2690 else
2691 locptr = build_int_cst (uptr, 0);
2692 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, locptr);
2693 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, odr_indicator_ptr);
2694 init = build_constructor (type, vinner);
2695 CONSTRUCTOR_APPEND_ELT (v, NULL_TREE, init);
2698 /* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2699 void
2700 initialize_sanitizer_builtins (void)
2702 tree decl;
2704 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT))
2705 return;
2707 tree BT_FN_VOID = build_function_type_list (void_type_node, NULL_TREE);
2708 tree BT_FN_VOID_PTR
2709 = build_function_type_list (void_type_node, ptr_type_node, NULL_TREE);
2710 tree BT_FN_VOID_CONST_PTR
2711 = build_function_type_list (void_type_node, const_ptr_type_node, NULL_TREE);
2712 tree BT_FN_VOID_PTR_PTR
2713 = build_function_type_list (void_type_node, ptr_type_node,
2714 ptr_type_node, NULL_TREE);
2715 tree BT_FN_VOID_PTR_PTR_PTR
2716 = build_function_type_list (void_type_node, ptr_type_node,
2717 ptr_type_node, ptr_type_node, NULL_TREE);
2718 tree BT_FN_VOID_PTR_PTRMODE
2719 = build_function_type_list (void_type_node, ptr_type_node,
2720 pointer_sized_int_node, NULL_TREE);
2721 tree BT_FN_VOID_INT
2722 = build_function_type_list (void_type_node, integer_type_node, NULL_TREE);
2723 tree BT_FN_SIZE_CONST_PTR_INT
2724 = build_function_type_list (size_type_node, const_ptr_type_node,
2725 integer_type_node, NULL_TREE);
2727 tree BT_FN_VOID_UINT8_UINT8
2728 = build_function_type_list (void_type_node, unsigned_char_type_node,
2729 unsigned_char_type_node, NULL_TREE);
2730 tree BT_FN_VOID_UINT16_UINT16
2731 = build_function_type_list (void_type_node, uint16_type_node,
2732 uint16_type_node, NULL_TREE);
2733 tree BT_FN_VOID_UINT32_UINT32
2734 = build_function_type_list (void_type_node, uint32_type_node,
2735 uint32_type_node, NULL_TREE);
2736 tree BT_FN_VOID_UINT64_UINT64
2737 = build_function_type_list (void_type_node, uint64_type_node,
2738 uint64_type_node, NULL_TREE);
2739 tree BT_FN_VOID_FLOAT_FLOAT
2740 = build_function_type_list (void_type_node, float_type_node,
2741 float_type_node, NULL_TREE);
2742 tree BT_FN_VOID_DOUBLE_DOUBLE
2743 = build_function_type_list (void_type_node, double_type_node,
2744 double_type_node, NULL_TREE);
2745 tree BT_FN_VOID_UINT64_PTR
2746 = build_function_type_list (void_type_node, uint64_type_node,
2747 ptr_type_node, NULL_TREE);
2749 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT[5];
2750 tree BT_FN_IX_CONST_VPTR_INT[5];
2751 tree BT_FN_IX_VPTR_IX_INT[5];
2752 tree BT_FN_VOID_VPTR_IX_INT[5];
2753 tree vptr
2754 = build_pointer_type (build_qualified_type (void_type_node,
2755 TYPE_QUAL_VOLATILE));
2756 tree cvptr
2757 = build_pointer_type (build_qualified_type (void_type_node,
2758 TYPE_QUAL_VOLATILE
2759 |TYPE_QUAL_CONST));
2760 tree boolt
2761 = lang_hooks.types.type_for_size (BOOL_TYPE_SIZE, 1);
2762 int i;
2763 for (i = 0; i < 5; i++)
2765 tree ix = build_nonstandard_integer_type (BITS_PER_UNIT * (1 << i), 1);
2766 BT_FN_BOOL_VPTR_PTR_IX_INT_INT[i]
2767 = build_function_type_list (boolt, vptr, ptr_type_node, ix,
2768 integer_type_node, integer_type_node,
2769 NULL_TREE);
2770 BT_FN_IX_CONST_VPTR_INT[i]
2771 = build_function_type_list (ix, cvptr, integer_type_node, NULL_TREE);
2772 BT_FN_IX_VPTR_IX_INT[i]
2773 = build_function_type_list (ix, vptr, ix, integer_type_node,
2774 NULL_TREE);
2775 BT_FN_VOID_VPTR_IX_INT[i]
2776 = build_function_type_list (void_type_node, vptr, ix,
2777 integer_type_node, NULL_TREE);
2779 #define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2780 #define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2781 #define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2782 #define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2783 #define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2784 #define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2785 #define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2786 #define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2787 #define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2788 #define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2789 #define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2790 #define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2791 #define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2792 #define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2793 #define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2794 #define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2795 #define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2796 #define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2797 #define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2798 #define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2799 #undef ATTR_NOTHROW_LEAF_LIST
2800 #define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2801 #undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2802 #define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2803 #undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2804 #define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2805 #undef ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2806 #define ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST \
2807 ECF_CONST | ATTR_NORETURN_NOTHROW_LEAF_LIST
2808 #undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2809 #define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2810 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2811 #undef ATTR_COLD_NOTHROW_LEAF_LIST
2812 #define ATTR_COLD_NOTHROW_LEAF_LIST \
2813 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2814 #undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2815 #define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2816 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2817 #undef ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST
2818 #define ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST \
2819 /* ECF_COLD missing */ ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2820 #undef ATTR_PURE_NOTHROW_LEAF_LIST
2821 #define ATTR_PURE_NOTHROW_LEAF_LIST ECF_PURE | ATTR_NOTHROW_LEAF_LIST
2822 #undef DEF_BUILTIN_STUB
2823 #define DEF_BUILTIN_STUB(ENUM, NAME)
2824 #undef DEF_SANITIZER_BUILTIN_1
2825 #define DEF_SANITIZER_BUILTIN_1(ENUM, NAME, TYPE, ATTRS) \
2826 do { \
2827 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2828 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2829 set_call_expr_flags (decl, ATTRS); \
2830 set_builtin_decl (ENUM, decl, true); \
2831 } while (0)
2832 #undef DEF_SANITIZER_BUILTIN
2833 #define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2834 DEF_SANITIZER_BUILTIN_1 (ENUM, NAME, TYPE, ATTRS);
2836 #include "sanitizer.def"
2838 /* -fsanitize=object-size uses __builtin_object_size, but that might
2839 not be available for e.g. Fortran at this point. We use
2840 DEF_SANITIZER_BUILTIN here only as a convenience macro. */
2841 if ((flag_sanitize & SANITIZE_OBJECT_SIZE)
2842 && !builtin_decl_implicit_p (BUILT_IN_OBJECT_SIZE))
2843 DEF_SANITIZER_BUILTIN_1 (BUILT_IN_OBJECT_SIZE, "object_size",
2844 BT_FN_SIZE_CONST_PTR_INT,
2845 ATTR_PURE_NOTHROW_LEAF_LIST);
2847 #undef DEF_SANITIZER_BUILTIN_1
2848 #undef DEF_SANITIZER_BUILTIN
2849 #undef DEF_BUILTIN_STUB
2852 /* Called via htab_traverse. Count number of emitted
2853 STRING_CSTs in the constant hash table. */
2856 count_string_csts (constant_descriptor_tree **slot,
2857 unsigned HOST_WIDE_INT *data)
2859 struct constant_descriptor_tree *desc = *slot;
2860 if (TREE_CODE (desc->value) == STRING_CST
2861 && TREE_ASM_WRITTEN (desc->value)
2862 && asan_protect_global (desc->value))
2863 ++*data;
2864 return 1;
2867 /* Helper structure to pass two parameters to
2868 add_string_csts. */
2870 struct asan_add_string_csts_data
2872 tree type;
2873 vec<constructor_elt, va_gc> *v;
2876 /* Called via hash_table::traverse. Call asan_add_global
2877 on emitted STRING_CSTs from the constant hash table. */
2880 add_string_csts (constant_descriptor_tree **slot,
2881 asan_add_string_csts_data *aascd)
2883 struct constant_descriptor_tree *desc = *slot;
2884 if (TREE_CODE (desc->value) == STRING_CST
2885 && TREE_ASM_WRITTEN (desc->value)
2886 && asan_protect_global (desc->value))
2888 asan_add_global (SYMBOL_REF_DECL (XEXP (desc->rtl, 0)),
2889 aascd->type, aascd->v);
2891 return 1;
2894 /* Needs to be GTY(()), because cgraph_build_static_cdtor may
2895 invoke ggc_collect. */
2896 static GTY(()) tree asan_ctor_statements;
2898 /* Module-level instrumentation.
2899 - Insert __asan_init_vN() into the list of CTORs.
2900 - TODO: insert redzones around globals.
2903 void
2904 asan_finish_file (void)
2906 varpool_node *vnode;
2907 unsigned HOST_WIDE_INT gcount = 0;
2909 if (shadow_ptr_types[0] == NULL_TREE)
2910 asan_init_shadow_ptr_types ();
2911 /* Avoid instrumenting code in the asan ctors/dtors.
2912 We don't need to insert padding after the description strings,
2913 nor after .LASAN* array. */
2914 flag_sanitize &= ~SANITIZE_ADDRESS;
2916 /* For user-space we want asan constructors to run first.
2917 Linux kernel does not support priorities other than default, and the only
2918 other user of constructors is coverage. So we run with the default
2919 priority. */
2920 int priority = flag_sanitize & SANITIZE_USER_ADDRESS
2921 ? MAX_RESERVED_INIT_PRIORITY - 1 : DEFAULT_INIT_PRIORITY;
2923 if (flag_sanitize & SANITIZE_USER_ADDRESS)
2925 tree fn = builtin_decl_implicit (BUILT_IN_ASAN_INIT);
2926 append_to_statement_list (build_call_expr (fn, 0), &asan_ctor_statements);
2927 fn = builtin_decl_implicit (BUILT_IN_ASAN_VERSION_MISMATCH_CHECK);
2928 append_to_statement_list (build_call_expr (fn, 0), &asan_ctor_statements);
2930 FOR_EACH_DEFINED_VARIABLE (vnode)
2931 if (TREE_ASM_WRITTEN (vnode->decl)
2932 && asan_protect_global (vnode->decl))
2933 ++gcount;
2934 hash_table<tree_descriptor_hasher> *const_desc_htab = constant_pool_htab ();
2935 const_desc_htab->traverse<unsigned HOST_WIDE_INT *, count_string_csts>
2936 (&gcount);
2937 if (gcount)
2939 tree type = asan_global_struct (), var, ctor;
2940 tree dtor_statements = NULL_TREE;
2941 vec<constructor_elt, va_gc> *v;
2942 char buf[20];
2944 type = build_array_type_nelts (type, gcount);
2945 ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", 0);
2946 var = build_decl (UNKNOWN_LOCATION, VAR_DECL, get_identifier (buf),
2947 type);
2948 TREE_STATIC (var) = 1;
2949 TREE_PUBLIC (var) = 0;
2950 DECL_ARTIFICIAL (var) = 1;
2951 DECL_IGNORED_P (var) = 1;
2952 vec_alloc (v, gcount);
2953 FOR_EACH_DEFINED_VARIABLE (vnode)
2954 if (TREE_ASM_WRITTEN (vnode->decl)
2955 && asan_protect_global (vnode->decl))
2956 asan_add_global (vnode->decl, TREE_TYPE (type), v);
2957 struct asan_add_string_csts_data aascd;
2958 aascd.type = TREE_TYPE (type);
2959 aascd.v = v;
2960 const_desc_htab->traverse<asan_add_string_csts_data *, add_string_csts>
2961 (&aascd);
2962 ctor = build_constructor (type, v);
2963 TREE_CONSTANT (ctor) = 1;
2964 TREE_STATIC (ctor) = 1;
2965 DECL_INITIAL (var) = ctor;
2966 SET_DECL_ALIGN (var, MAX (DECL_ALIGN (var),
2967 ASAN_SHADOW_GRANULARITY * BITS_PER_UNIT));
2969 varpool_node::finalize_decl (var);
2971 tree fn = builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS);
2972 tree gcount_tree = build_int_cst (pointer_sized_int_node, gcount);
2973 append_to_statement_list (build_call_expr (fn, 2,
2974 build_fold_addr_expr (var),
2975 gcount_tree),
2976 &asan_ctor_statements);
2978 fn = builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS);
2979 append_to_statement_list (build_call_expr (fn, 2,
2980 build_fold_addr_expr (var),
2981 gcount_tree),
2982 &dtor_statements);
2983 cgraph_build_static_cdtor ('D', dtor_statements, priority);
2985 if (asan_ctor_statements)
2986 cgraph_build_static_cdtor ('I', asan_ctor_statements, priority);
2987 flag_sanitize |= SANITIZE_ADDRESS;
2990 /* Poison or unpoison (depending on IS_CLOBBER variable) shadow memory based
2991 on SHADOW address. Newly added statements will be added to ITER with
2992 given location LOC. We mark SIZE bytes in shadow memory, where
2993 LAST_CHUNK_SIZE is greater than zero in situation where we are at the
2994 end of a variable. */
2996 static void
2997 asan_store_shadow_bytes (gimple_stmt_iterator *iter, location_t loc,
2998 tree shadow,
2999 unsigned HOST_WIDE_INT base_addr_offset,
3000 bool is_clobber, unsigned size,
3001 unsigned last_chunk_size)
3003 tree shadow_ptr_type;
3005 switch (size)
3007 case 1:
3008 shadow_ptr_type = shadow_ptr_types[0];
3009 break;
3010 case 2:
3011 shadow_ptr_type = shadow_ptr_types[1];
3012 break;
3013 case 4:
3014 shadow_ptr_type = shadow_ptr_types[2];
3015 break;
3016 default:
3017 gcc_unreachable ();
3020 unsigned char c = (char) is_clobber ? ASAN_STACK_MAGIC_USE_AFTER_SCOPE : 0;
3021 unsigned HOST_WIDE_INT val = 0;
3022 unsigned last_pos = size;
3023 if (last_chunk_size && !is_clobber)
3024 last_pos = BYTES_BIG_ENDIAN ? 0 : size - 1;
3025 for (unsigned i = 0; i < size; ++i)
3027 unsigned char shadow_c = c;
3028 if (i == last_pos)
3029 shadow_c = last_chunk_size;
3030 val |= (unsigned HOST_WIDE_INT) shadow_c << (BITS_PER_UNIT * i);
3033 /* Handle last chunk in unpoisoning. */
3034 tree magic = build_int_cst (TREE_TYPE (shadow_ptr_type), val);
3036 tree dest = build2 (MEM_REF, TREE_TYPE (shadow_ptr_type), shadow,
3037 build_int_cst (shadow_ptr_type, base_addr_offset));
3039 gimple *g = gimple_build_assign (dest, magic);
3040 gimple_set_location (g, loc);
3041 gsi_insert_after (iter, g, GSI_NEW_STMT);
3044 /* Expand the ASAN_MARK builtins. */
3046 bool
3047 asan_expand_mark_ifn (gimple_stmt_iterator *iter)
3049 gimple *g = gsi_stmt (*iter);
3050 location_t loc = gimple_location (g);
3051 HOST_WIDE_INT flag = tree_to_shwi (gimple_call_arg (g, 0));
3052 bool is_poison = ((asan_mark_flags)flag) == ASAN_MARK_POISON;
3054 tree base = gimple_call_arg (g, 1);
3055 gcc_checking_assert (TREE_CODE (base) == ADDR_EXPR);
3056 tree decl = TREE_OPERAND (base, 0);
3058 /* For a nested function, we can have: ASAN_MARK (2, &FRAME.2.fp_input, 4) */
3059 if (TREE_CODE (decl) == COMPONENT_REF
3060 && DECL_NONLOCAL_FRAME (TREE_OPERAND (decl, 0)))
3061 decl = TREE_OPERAND (decl, 0);
3063 gcc_checking_assert (TREE_CODE (decl) == VAR_DECL);
3065 if (is_poison)
3067 if (asan_handled_variables == NULL)
3068 asan_handled_variables = new hash_set<tree> (16);
3069 asan_handled_variables->add (decl);
3071 tree len = gimple_call_arg (g, 2);
3073 gcc_assert (tree_fits_shwi_p (len));
3074 unsigned HOST_WIDE_INT size_in_bytes = tree_to_shwi (len);
3075 gcc_assert (size_in_bytes);
3077 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3078 NOP_EXPR, base);
3079 gimple_set_location (g, loc);
3080 gsi_replace (iter, g, false);
3081 tree base_addr = gimple_assign_lhs (g);
3083 /* Generate direct emission if size_in_bytes is small. */
3084 if (size_in_bytes <= ASAN_PARAM_USE_AFTER_SCOPE_DIRECT_EMISSION_THRESHOLD)
3086 unsigned HOST_WIDE_INT shadow_size = shadow_mem_size (size_in_bytes);
3088 tree shadow = build_shadow_mem_access (iter, loc, base_addr,
3089 shadow_ptr_types[0], true);
3091 for (unsigned HOST_WIDE_INT offset = 0; offset < shadow_size;)
3093 unsigned size = 1;
3094 if (shadow_size - offset >= 4)
3095 size = 4;
3096 else if (shadow_size - offset >= 2)
3097 size = 2;
3099 unsigned HOST_WIDE_INT last_chunk_size = 0;
3100 unsigned HOST_WIDE_INT s = (offset + size) * ASAN_SHADOW_GRANULARITY;
3101 if (s > size_in_bytes)
3102 last_chunk_size = ASAN_SHADOW_GRANULARITY - (s - size_in_bytes);
3104 asan_store_shadow_bytes (iter, loc, shadow, offset, is_poison,
3105 size, last_chunk_size);
3106 offset += size;
3109 else
3111 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3112 NOP_EXPR, len);
3113 gimple_set_location (g, loc);
3114 gsi_insert_before (iter, g, GSI_SAME_STMT);
3115 tree sz_arg = gimple_assign_lhs (g);
3117 tree fun
3118 = builtin_decl_implicit (is_poison ? BUILT_IN_ASAN_POISON_STACK_MEMORY
3119 : BUILT_IN_ASAN_UNPOISON_STACK_MEMORY);
3120 g = gimple_build_call (fun, 2, base_addr, sz_arg);
3121 gimple_set_location (g, loc);
3122 gsi_insert_after (iter, g, GSI_NEW_STMT);
3125 return false;
3128 /* Expand the ASAN_{LOAD,STORE} builtins. */
3130 bool
3131 asan_expand_check_ifn (gimple_stmt_iterator *iter, bool use_calls)
3133 gimple *g = gsi_stmt (*iter);
3134 location_t loc = gimple_location (g);
3135 bool recover_p;
3136 if (flag_sanitize & SANITIZE_USER_ADDRESS)
3137 recover_p = (flag_sanitize_recover & SANITIZE_USER_ADDRESS) != 0;
3138 else
3139 recover_p = (flag_sanitize_recover & SANITIZE_KERNEL_ADDRESS) != 0;
3141 HOST_WIDE_INT flags = tree_to_shwi (gimple_call_arg (g, 0));
3142 gcc_assert (flags < ASAN_CHECK_LAST);
3143 bool is_scalar_access = (flags & ASAN_CHECK_SCALAR_ACCESS) != 0;
3144 bool is_store = (flags & ASAN_CHECK_STORE) != 0;
3145 bool is_non_zero_len = (flags & ASAN_CHECK_NON_ZERO_LEN) != 0;
3147 tree base = gimple_call_arg (g, 1);
3148 tree len = gimple_call_arg (g, 2);
3149 HOST_WIDE_INT align = tree_to_shwi (gimple_call_arg (g, 3));
3151 HOST_WIDE_INT size_in_bytes
3152 = is_scalar_access && tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
3154 if (use_calls)
3156 /* Instrument using callbacks. */
3157 gimple *g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3158 NOP_EXPR, base);
3159 gimple_set_location (g, loc);
3160 gsi_insert_before (iter, g, GSI_SAME_STMT);
3161 tree base_addr = gimple_assign_lhs (g);
3163 int nargs;
3164 tree fun = check_func (is_store, recover_p, size_in_bytes, &nargs);
3165 if (nargs == 1)
3166 g = gimple_build_call (fun, 1, base_addr);
3167 else
3169 gcc_assert (nargs == 2);
3170 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3171 NOP_EXPR, len);
3172 gimple_set_location (g, loc);
3173 gsi_insert_before (iter, g, GSI_SAME_STMT);
3174 tree sz_arg = gimple_assign_lhs (g);
3175 g = gimple_build_call (fun, nargs, base_addr, sz_arg);
3177 gimple_set_location (g, loc);
3178 gsi_replace (iter, g, false);
3179 return false;
3182 HOST_WIDE_INT real_size_in_bytes = size_in_bytes == -1 ? 1 : size_in_bytes;
3184 tree shadow_ptr_type = shadow_ptr_types[real_size_in_bytes == 16 ? 1 : 0];
3185 tree shadow_type = TREE_TYPE (shadow_ptr_type);
3187 gimple_stmt_iterator gsi = *iter;
3189 if (!is_non_zero_len)
3191 /* So, the length of the memory area to asan-protect is
3192 non-constant. Let's guard the generated instrumentation code
3193 like:
3195 if (len != 0)
3197 //asan instrumentation code goes here.
3199 // falltrough instructions, starting with *ITER. */
3201 g = gimple_build_cond (NE_EXPR,
3202 len,
3203 build_int_cst (TREE_TYPE (len), 0),
3204 NULL_TREE, NULL_TREE);
3205 gimple_set_location (g, loc);
3207 basic_block then_bb, fallthrough_bb;
3208 insert_if_then_before_iter (as_a <gcond *> (g), iter,
3209 /*then_more_likely_p=*/true,
3210 &then_bb, &fallthrough_bb);
3211 /* Note that fallthrough_bb starts with the statement that was
3212 pointed to by ITER. */
3214 /* The 'then block' of the 'if (len != 0) condition is where
3215 we'll generate the asan instrumentation code now. */
3216 gsi = gsi_last_bb (then_bb);
3219 /* Get an iterator on the point where we can add the condition
3220 statement for the instrumentation. */
3221 basic_block then_bb, else_bb;
3222 gsi = create_cond_insert_point (&gsi, /*before_p*/false,
3223 /*then_more_likely_p=*/false,
3224 /*create_then_fallthru_edge*/recover_p,
3225 &then_bb,
3226 &else_bb);
3228 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3229 NOP_EXPR, base);
3230 gimple_set_location (g, loc);
3231 gsi_insert_before (&gsi, g, GSI_NEW_STMT);
3232 tree base_addr = gimple_assign_lhs (g);
3234 tree t = NULL_TREE;
3235 if (real_size_in_bytes >= 8)
3237 tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
3238 shadow_ptr_type);
3239 t = shadow;
3241 else
3243 /* Slow path for 1, 2 and 4 byte accesses. */
3244 /* Test (shadow != 0)
3245 & ((base_addr & 7) + (real_size_in_bytes - 1)) >= shadow). */
3246 tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
3247 shadow_ptr_type);
3248 gimple *shadow_test = build_assign (NE_EXPR, shadow, 0);
3249 gimple_seq seq = NULL;
3250 gimple_seq_add_stmt (&seq, shadow_test);
3251 /* Aligned (>= 8 bytes) can test just
3252 (real_size_in_bytes - 1 >= shadow), as base_addr & 7 is known
3253 to be 0. */
3254 if (align < 8)
3256 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR,
3257 base_addr, 7));
3258 gimple_seq_add_stmt (&seq,
3259 build_type_cast (shadow_type,
3260 gimple_seq_last (seq)));
3261 if (real_size_in_bytes > 1)
3262 gimple_seq_add_stmt (&seq,
3263 build_assign (PLUS_EXPR,
3264 gimple_seq_last (seq),
3265 real_size_in_bytes - 1));
3266 t = gimple_assign_lhs (gimple_seq_last_stmt (seq));
3268 else
3269 t = build_int_cst (shadow_type, real_size_in_bytes - 1);
3270 gimple_seq_add_stmt (&seq, build_assign (GE_EXPR, t, shadow));
3271 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
3272 gimple_seq_last (seq)));
3273 t = gimple_assign_lhs (gimple_seq_last (seq));
3274 gimple_seq_set_location (seq, loc);
3275 gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);
3277 /* For non-constant, misaligned or otherwise weird access sizes,
3278 check first and last byte. */
3279 if (size_in_bytes == -1)
3281 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3282 MINUS_EXPR, len,
3283 build_int_cst (pointer_sized_int_node, 1));
3284 gimple_set_location (g, loc);
3285 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
3286 tree last = gimple_assign_lhs (g);
3287 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
3288 PLUS_EXPR, base_addr, last);
3289 gimple_set_location (g, loc);
3290 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
3291 tree base_end_addr = gimple_assign_lhs (g);
3293 tree shadow = build_shadow_mem_access (&gsi, loc, base_end_addr,
3294 shadow_ptr_type);
3295 gimple *shadow_test = build_assign (NE_EXPR, shadow, 0);
3296 gimple_seq seq = NULL;
3297 gimple_seq_add_stmt (&seq, shadow_test);
3298 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR,
3299 base_end_addr, 7));
3300 gimple_seq_add_stmt (&seq, build_type_cast (shadow_type,
3301 gimple_seq_last (seq)));
3302 gimple_seq_add_stmt (&seq, build_assign (GE_EXPR,
3303 gimple_seq_last (seq),
3304 shadow));
3305 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
3306 gimple_seq_last (seq)));
3307 gimple_seq_add_stmt (&seq, build_assign (BIT_IOR_EXPR, t,
3308 gimple_seq_last (seq)));
3309 t = gimple_assign_lhs (gimple_seq_last (seq));
3310 gimple_seq_set_location (seq, loc);
3311 gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);
3315 g = gimple_build_cond (NE_EXPR, t, build_int_cst (TREE_TYPE (t), 0),
3316 NULL_TREE, NULL_TREE);
3317 gimple_set_location (g, loc);
3318 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
3320 /* Generate call to the run-time library (e.g. __asan_report_load8). */
3321 gsi = gsi_start_bb (then_bb);
3322 int nargs;
3323 tree fun = report_error_func (is_store, recover_p, size_in_bytes, &nargs);
3324 g = gimple_build_call (fun, nargs, base_addr, len);
3325 gimple_set_location (g, loc);
3326 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
3328 gsi_remove (iter, true);
3329 *iter = gsi_start_bb (else_bb);
3331 return true;
3334 /* Create ASAN shadow variable for a VAR_DECL which has been rewritten
3335 into SSA. Already seen VAR_DECLs are stored in SHADOW_VARS_MAPPING. */
3337 static tree
3338 create_asan_shadow_var (tree var_decl,
3339 hash_map<tree, tree> &shadow_vars_mapping)
3341 tree *slot = shadow_vars_mapping.get (var_decl);
3342 if (slot == NULL)
3344 tree shadow_var = copy_node (var_decl);
3346 copy_body_data id;
3347 memset (&id, 0, sizeof (copy_body_data));
3348 id.src_fn = id.dst_fn = current_function_decl;
3349 copy_decl_for_dup_finish (&id, var_decl, shadow_var);
3351 DECL_ARTIFICIAL (shadow_var) = 1;
3352 DECL_IGNORED_P (shadow_var) = 1;
3353 DECL_SEEN_IN_BIND_EXPR_P (shadow_var) = 0;
3354 gimple_add_tmp_var (shadow_var);
3356 shadow_vars_mapping.put (var_decl, shadow_var);
3357 return shadow_var;
3359 else
3360 return *slot;
3363 /* Expand ASAN_POISON ifn. */
3365 bool
3366 asan_expand_poison_ifn (gimple_stmt_iterator *iter,
3367 bool *need_commit_edge_insert,
3368 hash_map<tree, tree> &shadow_vars_mapping)
3370 gimple *g = gsi_stmt (*iter);
3371 tree poisoned_var = gimple_call_lhs (g);
3372 if (!poisoned_var || has_zero_uses (poisoned_var))
3374 gsi_remove (iter, true);
3375 return true;
3378 if (SSA_NAME_VAR (poisoned_var) == NULL_TREE)
3379 SET_SSA_NAME_VAR_OR_IDENTIFIER (poisoned_var,
3380 create_tmp_var (TREE_TYPE (poisoned_var)));
3382 tree shadow_var = create_asan_shadow_var (SSA_NAME_VAR (poisoned_var),
3383 shadow_vars_mapping);
3385 bool recover_p;
3386 if (flag_sanitize & SANITIZE_USER_ADDRESS)
3387 recover_p = (flag_sanitize_recover & SANITIZE_USER_ADDRESS) != 0;
3388 else
3389 recover_p = (flag_sanitize_recover & SANITIZE_KERNEL_ADDRESS) != 0;
3390 tree size = DECL_SIZE_UNIT (shadow_var);
3391 gimple *poison_call
3392 = gimple_build_call_internal (IFN_ASAN_MARK, 3,
3393 build_int_cst (integer_type_node,
3394 ASAN_MARK_POISON),
3395 build_fold_addr_expr (shadow_var), size);
3397 gimple *use;
3398 imm_use_iterator imm_iter;
3399 FOR_EACH_IMM_USE_STMT (use, imm_iter, poisoned_var)
3401 if (is_gimple_debug (use))
3402 continue;
3404 int nargs;
3405 bool store_p = gimple_call_internal_p (use, IFN_ASAN_POISON_USE);
3406 tree fun = report_error_func (store_p, recover_p, tree_to_uhwi (size),
3407 &nargs);
3409 gcall *call = gimple_build_call (fun, 1,
3410 build_fold_addr_expr (shadow_var));
3411 gimple_set_location (call, gimple_location (use));
3412 gimple *call_to_insert = call;
3414 /* The USE can be a gimple PHI node. If so, insert the call on
3415 all edges leading to the PHI node. */
3416 if (is_a <gphi *> (use))
3418 gphi *phi = dyn_cast<gphi *> (use);
3419 for (unsigned i = 0; i < gimple_phi_num_args (phi); ++i)
3420 if (gimple_phi_arg_def (phi, i) == poisoned_var)
3422 edge e = gimple_phi_arg_edge (phi, i);
3424 /* Do not insert on an edge we can't split. */
3425 if (e->flags & EDGE_ABNORMAL)
3426 continue;
3428 if (call_to_insert == NULL)
3429 call_to_insert = gimple_copy (call);
3431 gsi_insert_seq_on_edge (e, call_to_insert);
3432 *need_commit_edge_insert = true;
3433 call_to_insert = NULL;
3436 else
3438 gimple_stmt_iterator gsi = gsi_for_stmt (use);
3439 if (store_p)
3440 gsi_replace (&gsi, call, true);
3441 else
3442 gsi_insert_before (&gsi, call, GSI_NEW_STMT);
3446 SSA_NAME_IS_DEFAULT_DEF (poisoned_var) = true;
3447 SSA_NAME_DEF_STMT (poisoned_var) = gimple_build_nop ();
3448 gsi_replace (iter, poison_call, false);
3450 return true;
3453 /* Instrument the current function. */
3455 static unsigned int
3456 asan_instrument (void)
3458 if (shadow_ptr_types[0] == NULL_TREE)
3459 asan_init_shadow_ptr_types ();
3460 transform_statements ();
3461 last_alloca_addr = NULL_TREE;
3462 return 0;
3465 static bool
3466 gate_asan (void)
3468 return sanitize_flags_p (SANITIZE_ADDRESS);
3471 namespace {
3473 const pass_data pass_data_asan =
3475 GIMPLE_PASS, /* type */
3476 "asan", /* name */
3477 OPTGROUP_NONE, /* optinfo_flags */
3478 TV_NONE, /* tv_id */
3479 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
3480 0, /* properties_provided */
3481 0, /* properties_destroyed */
3482 0, /* todo_flags_start */
3483 TODO_update_ssa, /* todo_flags_finish */
3486 class pass_asan : public gimple_opt_pass
3488 public:
3489 pass_asan (gcc::context *ctxt)
3490 : gimple_opt_pass (pass_data_asan, ctxt)
3493 /* opt_pass methods: */
3494 opt_pass * clone () { return new pass_asan (m_ctxt); }
3495 virtual bool gate (function *) { return gate_asan (); }
3496 virtual unsigned int execute (function *) { return asan_instrument (); }
3498 }; // class pass_asan
3500 } // anon namespace
3502 gimple_opt_pass *
3503 make_pass_asan (gcc::context *ctxt)
3505 return new pass_asan (ctxt);
3508 namespace {
3510 const pass_data pass_data_asan_O0 =
3512 GIMPLE_PASS, /* type */
3513 "asan0", /* name */
3514 OPTGROUP_NONE, /* optinfo_flags */
3515 TV_NONE, /* tv_id */
3516 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
3517 0, /* properties_provided */
3518 0, /* properties_destroyed */
3519 0, /* todo_flags_start */
3520 TODO_update_ssa, /* todo_flags_finish */
3523 class pass_asan_O0 : public gimple_opt_pass
3525 public:
3526 pass_asan_O0 (gcc::context *ctxt)
3527 : gimple_opt_pass (pass_data_asan_O0, ctxt)
3530 /* opt_pass methods: */
3531 virtual bool gate (function *) { return !optimize && gate_asan (); }
3532 virtual unsigned int execute (function *) { return asan_instrument (); }
3534 }; // class pass_asan_O0
3536 } // anon namespace
3538 gimple_opt_pass *
3539 make_pass_asan_O0 (gcc::context *ctxt)
3541 return new pass_asan_O0 (ctxt);
3544 #include "gt-asan.h"