gcc/c-family/c-ubsan.c

   1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
   2    Copyright (C) 2013-2014 Free Software Foundation, Inc.
   3    Contributed by Marek Polacek <polacek@redhat.com>
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #include "system.h"
  23 #include "coretypes.h"
  24 #include "tree.h"
  25 #include "alloc-pool.h"
  26 #include "hash-map.h"
  27 #include "is-a.h"
  28 #include "plugin-api.h"
  29 #include "vec.h"
  30 #include "hashtab.h"
  31 #include "hash-set.h"
  32 #include "machmode.h"
  33 #include "tm.h"
  34 #include "hard-reg-set.h"
  35 #include "input.h"
  36 #include "function.h"
  37 #include "ipa-ref.h"
  38 #include "cgraph.h"
  39 #include "output.h"
  40 #include "toplev.h"
  41 #include "ubsan.h"
  42 #include "c-family/c-common.h"
  43 #include "c-family/c-ubsan.h"
  44 #include "asan.h"
  45 #include "internal-fn.h"
  46 #include "stor-layout.h"
  47 #include "builtins.h"
  48
  49 /* Instrument division by zero and INT_MIN / -1.  If not instrumenting,
  50    return NULL_TREE.  */
  51
  52 tree
  53 ubsan_instrument_division (location_t loc, tree op0, tree op1)
  54 {
  55   tree t, tt;
  56   tree type = TREE_TYPE (op0);
  57
  58   /* At this point both operands should have the same type,
  59      because they are already converted to RESULT_TYPE.
  60      Use TYPE_MAIN_VARIANT since typedefs can confuse us.  */
  61   gcc_assert (TYPE_MAIN_VARIANT (TREE_TYPE (op0))
  62               == TYPE_MAIN_VARIANT (TREE_TYPE (op1)));
  63
  64   if (TREE_CODE (type) == INTEGER_TYPE
  65       && (flag_sanitize & SANITIZE_DIVIDE))
  66     t = fold_build2 (EQ_EXPR, boolean_type_node,
  67                      op1, build_int_cst (type, 0));
  68   else if (TREE_CODE (type) == REAL_TYPE
  69            && (flag_sanitize & SANITIZE_FLOAT_DIVIDE))
  70     t = fold_build2 (EQ_EXPR, boolean_type_node,
  71                      op1, build_real (type, dconst0));
  72   else
  73     return NULL_TREE;
  74
  75   /* We check INT_MIN / -1 only for signed types.  */
  76   if (TREE_CODE (type) == INTEGER_TYPE
  77       && (flag_sanitize & SANITIZE_DIVIDE)
  78       && !TYPE_UNSIGNED (type))
  79     {
  80       tree x;
  81       tt = fold_build2 (EQ_EXPR, boolean_type_node, op1,
  82                         build_int_cst (type, -1));
  83       x = fold_build2 (EQ_EXPR, boolean_type_node, op0,
  84                        TYPE_MIN_VALUE (type));
  85       x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt);
  86       t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x);
  87     }
  88
  89   /* If the condition was folded to 0, no need to instrument
  90      this expression.  */
  91   if (integer_zerop (t))
  92     return NULL_TREE;
  93
  94   /* In case we have a SAVE_EXPR in a conditional context, we need to
  95      make sure it gets evaluated before the condition.  If the OP0 is
  96      an instrumented array reference, mark it as having side effects so
  97      it's not folded away.  */
  98   if (flag_sanitize & SANITIZE_BOUNDS)
  99     {
 100       tree xop0 = op0;
 101       while (CONVERT_EXPR_P (xop0))
 102         xop0 = TREE_OPERAND (xop0, 0);
 103       if (TREE_CODE (xop0) == ARRAY_REF)
 104         {
 105           TREE_SIDE_EFFECTS (xop0) = 1;
 106           TREE_SIDE_EFFECTS (op0) = 1;
 107         }
 108     }
 109   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), op0, t);
 110   if (flag_sanitize_undefined_trap_on_error)
 111     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 112   else
 113     {
 114       tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc,
 115                                      ubsan_type_descriptor (type), NULL_TREE,
 116                                      NULL_TREE);
 117       data = build_fold_addr_expr_loc (loc, data);
 118       enum built_in_function bcode
 119         = (flag_sanitize_recover & SANITIZE_DIVIDE)
 120           ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
 121           : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
 122       tt = builtin_decl_explicit (bcode);
 123       tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
 124                                 ubsan_encode_value (op1));
 125     }
 126   t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
 127
 128   return t;
 129 }
 130
 131 /* Instrument left and right shifts.  */
 132
 133 tree
 134 ubsan_instrument_shift (location_t loc, enum tree_code code,
 135                         tree op0, tree op1)
 136 {
 137   tree t, tt = NULL_TREE;
 138   tree type0 = TREE_TYPE (op0);
 139   tree type1 = TREE_TYPE (op1);
 140   tree op1_utype = unsigned_type_for (type1);
 141   HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
 142   tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);
 143
 144   t = fold_convert_loc (loc, op1_utype, op1);
 145   t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);
 146
 147   /* For signed x << y, in C99/C11, the following:
 148      (unsigned) x >> (uprecm1 - y)
 149      if non-zero, is undefined.  */
 150   if (code == LSHIFT_EXPR
 151       && !TYPE_UNSIGNED (type0)
 152       && flag_isoc99)
 153     {
 154       tree x = fold_build2 (MINUS_EXPR, unsigned_type_node, uprecm1,
 155                             fold_convert (op1_utype, op1));
 156       tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
 157       tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
 158       tt = fold_build2 (NE_EXPR, boolean_type_node, tt,
 159                         build_int_cst (TREE_TYPE (tt), 0));
 160     }
 161
 162   /* For signed x << y, in C++11 and later, the following:
 163      x < 0 || ((unsigned) x >> (uprecm1 - y))
 164      if > 1, is undefined.  */
 165   if (code == LSHIFT_EXPR
 166       && !TYPE_UNSIGNED (TREE_TYPE (op0))
 167       && (cxx_dialect >= cxx11))
 168     {
 169       tree x = fold_build2 (MINUS_EXPR, unsigned_type_node, uprecm1,
 170                             fold_convert (op1_utype, op1));
 171       tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
 172       tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
 173       tt = fold_build2 (GT_EXPR, boolean_type_node, tt,
 174                         build_int_cst (TREE_TYPE (tt), 1));
 175       x = fold_build2 (LT_EXPR, boolean_type_node, op0,
 176                        build_int_cst (type0, 0));
 177       tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt);
 178     }
 179
 180   /* If the condition was folded to 0, no need to instrument
 181      this expression.  */
 182   if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt)))
 183     return NULL_TREE;
 184
 185   /* In case we have a SAVE_EXPR in a conditional context, we need to
 186      make sure it gets evaluated before the condition.  If the OP0 is
 187      an instrumented array reference, mark it as having side effects so
 188      it's not folded away.  */
 189   if (flag_sanitize & SANITIZE_BOUNDS)
 190     {
 191       tree xop0 = op0;
 192       while (CONVERT_EXPR_P (xop0))
 193         xop0 = TREE_OPERAND (xop0, 0);
 194       if (TREE_CODE (xop0) == ARRAY_REF)
 195         {
 196           TREE_SIDE_EFFECTS (xop0) = 1;
 197           TREE_SIDE_EFFECTS (op0) = 1;
 198         }
 199     }
 200   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), op0, t);
 201   t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t,
 202                    tt ? tt : integer_zero_node);
 203
 204   if (flag_sanitize_undefined_trap_on_error)
 205     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 206   else
 207     {
 208       tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc,
 209                                      ubsan_type_descriptor (type0),
 210                                      ubsan_type_descriptor (type1), NULL_TREE,
 211                                      NULL_TREE);
 212       data = build_fold_addr_expr_loc (loc, data);
 213
 214       enum built_in_function bcode
 215         = (flag_sanitize_recover & SANITIZE_SHIFT)
 216           ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
 217           : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
 218       tt = builtin_decl_explicit (bcode);
 219       tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
 220                                 ubsan_encode_value (op1));
 221     }
 222   t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
 223
 224   return t;
 225 }
 226
 227 /* Instrument variable length array bound.  */
 228
 229 tree
 230 ubsan_instrument_vla (location_t loc, tree size)
 231 {
 232   tree type = TREE_TYPE (size);
 233   tree t, tt;
 234
 235   t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0));
 236   if (flag_sanitize_undefined_trap_on_error)
 237     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 238   else
 239     {
 240       tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc,
 241                                      ubsan_type_descriptor (type), NULL_TREE,
 242                                      NULL_TREE);
 243       data = build_fold_addr_expr_loc (loc, data);
 244       enum built_in_function bcode
 245         = (flag_sanitize_recover & SANITIZE_VLA)
 246           ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
 247           : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT;
 248       tt = builtin_decl_explicit (bcode);
 249       tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size));
 250     }
 251   t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
 252
 253   return t;
 254 }
 255
 256 /* Instrument missing return in C++ functions returning non-void.  */
 257
 258 tree
 259 ubsan_instrument_return (location_t loc)
 260 {
 261   if (flag_sanitize_undefined_trap_on_error)
 262     return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 263   /* It is possible that PCH zapped table with definitions of sanitizer
 264      builtins.  Reinitialize them if needed.  */
 265   initialize_sanitizer_builtins ();
 266
 267   tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc,
 268                                  NULL_TREE, NULL_TREE);
 269   tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN);
 270   return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
 271 }
 272
 273 /* Instrument array bounds for ARRAY_REFs.  We create special builtin,
 274    that gets expanded in the sanopt pass, and make an array dimension
 275    of it.  ARRAY is the array, *INDEX is an index to the array.
 276    Return NULL_TREE if no instrumentation is emitted.
 277    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
 278
 279 tree
 280 ubsan_instrument_bounds (location_t loc, tree array, tree *index,
 281                          bool ignore_off_by_one)
 282 {
 283   tree type = TREE_TYPE (array);
 284   tree domain = TYPE_DOMAIN (type);
 285
 286   if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE)
 287     return NULL_TREE;
 288
 289   tree bound = TYPE_MAX_VALUE (domain);
 290   if (ignore_off_by_one)
 291     bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound,
 292                          build_int_cst (TREE_TYPE (bound), 1));
 293
 294   /* Detect flexible array members and suchlike.  */
 295   tree base = get_base_address (array);
 296   if (base && (TREE_CODE (base) == INDIRECT_REF
 297                || TREE_CODE (base) == MEM_REF))
 298     {
 299       tree next = NULL_TREE;
 300       tree cref = array;
 301
 302       /* Walk all structs/unions.  */
 303       while (TREE_CODE (cref) == COMPONENT_REF)
 304         {
 305           if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
 306             for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
 307                  next && TREE_CODE (next) != FIELD_DECL;
 308                  next = DECL_CHAIN (next))
 309               ;
 310           if (next)
 311             /* Not a last element.  Instrument it.  */
 312             break;
 313           /* Ok, this is the last field of the structure/union.  But the
 314              aggregate containing the field must be the last field too,
 315              recursively.  */
 316           cref = TREE_OPERAND (cref, 0);
 317         }
 318       if (!next)
 319         /* Don't instrument this flexible array member-like array in non-strict
 320            -fsanitize=bounds mode.  */
 321         return NULL_TREE;
 322     }
 323
 324   /* Don't emit instrumentation in the most common cases.  */
 325   tree idx = NULL_TREE;
 326   if (TREE_CODE (*index) == INTEGER_CST)
 327     idx = *index;
 328   else if (TREE_CODE (*index) == BIT_AND_EXPR
 329            && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST)
 330     idx = TREE_OPERAND (*index, 1);
 331   if (idx
 332       && TREE_CODE (bound) == INTEGER_CST
 333       && tree_int_cst_sgn (idx) >= 0
 334       && tree_int_cst_le (idx, bound))
 335     return NULL_TREE;
 336
 337   *index = save_expr (*index);
 338   /* Create a "(T *) 0" tree node to describe the array type.  */
 339   tree zero_with_type = build_int_cst (build_pointer_type (type), 0);
 340   return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS,
 341                                        void_type_node, 3, zero_with_type,
 342                                        *index, bound);
 343 }
 344
 345 /* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS.  */
 346
 347 bool
 348 ubsan_array_ref_instrumented_p (const_tree t)
 349 {
 350   if (TREE_CODE (t) != ARRAY_REF)
 351     return false;
 352
 353   tree op1 = TREE_OPERAND (t, 1);
 354   return TREE_CODE (op1) == COMPOUND_EXPR
 355          && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR
 356          && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE
 357          && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS;
 358 }
 359
 360 /* Instrument an ARRAY_REF, if it hasn't already been instrumented.
 361    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
 362
 363 void
 364 ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one)
 365 {
 366   if (!ubsan_array_ref_instrumented_p (*expr_p)
 367       && current_function_decl != NULL_TREE
 368       && !lookup_attribute ("no_sanitize_undefined",
 369                             DECL_ATTRIBUTES (current_function_decl)))
 370     {
 371       tree op0 = TREE_OPERAND (*expr_p, 0);
 372       tree op1 = TREE_OPERAND (*expr_p, 1);
 373       tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1,
 374                                         ignore_off_by_one);
 375       if (e != NULL_TREE)
 376         {
 377           tree t = copy_node (*expr_p);
 378           TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1),
 379                                         e, op1);
 380           *expr_p = t;
 381         }
 382     }
 383 }
 384
 385 static tree
 386 ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
 387                                           enum ubsan_null_ckind ckind)
 388 {
 389   if (current_function_decl == NULL_TREE
 390       || lookup_attribute ("no_sanitize_undefined",
 391                            DECL_ATTRIBUTES (current_function_decl)))
 392     return NULL_TREE;
 393
 394   tree type = TREE_TYPE (ptype);
 395   tree orig_op = op;
 396   bool instrument = false;
 397   unsigned int mina = 0;
 398
 399   if (flag_sanitize & SANITIZE_ALIGNMENT)
 400     {
 401       mina = min_align_of_type (type);
 402       if (mina <= 1)
 403         mina = 0;
 404     }
 405   while ((TREE_CODE (op) == NOP_EXPR
 406           || TREE_CODE (op) == NON_LVALUE_EXPR)
 407          && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE)
 408     op = TREE_OPERAND (op, 0);
 409   if (TREE_CODE (op) == NOP_EXPR
 410       && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
 411     {
 412       if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op))))
 413         instrument = true;
 414     }
 415   else
 416     {
 417       if ((flag_sanitize & SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR)
 418         {
 419           bool strict_overflow_p = false;
 420           /* tree_single_nonzero_warnv_p will not return true for non-weak
 421              non-automatic decls with -fno-delete-null-pointer-checks,
 422              which is disabled during -fsanitize=null.  We don't want to
 423              instrument those, just weak vars though.  */
 424           int save_flag_delete_null_pointer_checks
 425             = flag_delete_null_pointer_checks;
 426           flag_delete_null_pointer_checks = 1;
 427           if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
 428               || strict_overflow_p)
 429             instrument = true;
 430           flag_delete_null_pointer_checks
 431             = save_flag_delete_null_pointer_checks;
 432         }
 433       else if (flag_sanitize & SANITIZE_NULL)
 434         instrument = true;
 435       if (mina && mina > 1)
 436         {
 437           if (!POINTER_TYPE_P (TREE_TYPE (op))
 438               || mina > get_pointer_alignment (op) / BITS_PER_UNIT)
 439             instrument = true;
 440         }
 441     }
 442   if (!instrument)
 443     return NULL_TREE;
 444   op = save_expr (orig_op);
 445   gcc_assert (POINTER_TYPE_P (ptype));
 446   if (TREE_CODE (ptype) == REFERENCE_TYPE)
 447     ptype = build_pointer_type (TREE_TYPE (ptype));
 448   tree kind = build_int_cst (ptype, ckind);
 449   tree align = build_int_cst (pointer_sized_int_node, mina);
 450   tree call
 451     = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node,
 452                                     3, op, kind, align);
 453   TREE_SIDE_EFFECTS (call) = 1;
 454   return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
 455 }
 456
 457 /* Instrument a NOP_EXPR to REFERENCE_TYPE if needed.  */
 458
 459 void
 460 ubsan_maybe_instrument_reference (tree stmt)
 461 {
 462   tree op = TREE_OPERAND (stmt, 0);
 463   op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
 464                                                  TREE_TYPE (stmt),
 465                                                  UBSAN_REF_BINDING);
 466   if (op)
 467     TREE_OPERAND (stmt, 0) = op;
 468 }
 469
 470 /* Instrument a CALL_EXPR to a method if needed.  */
 471
 472 void
 473 ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor)
 474 {
 475   if (call_expr_nargs (stmt) == 0)
 476     return;
 477   tree op = CALL_EXPR_ARG (stmt, 0);
 478   if (op == error_mark_node
 479       || !POINTER_TYPE_P (TREE_TYPE (op)))
 480     return;
 481   op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
 482                                                  TREE_TYPE (op),
 483                                                  is_ctor ? UBSAN_CTOR_CALL
 484                                                  : UBSAN_MEMBER_CALL);
 485   if (op)
 486     CALL_EXPR_ARG (stmt, 0) = op;
 487 }