* testsuite/libgomp.oacc-c-c++-common/collapse-2.c: Sequential
[official-gcc.git] / gcc / asan.c
blob0df5e3234b5d7f3d6ebbef291fcffa0f93b85dc9
1 /* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2015 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
10 version.
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 for more details.
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
22 #include "config.h"
23 #include "system.h"
24 #include "coretypes.h"
25 #include "backend.h"
26 #include "target.h"
27 #include "rtl.h"
28 #include "tree.h"
29 #include "gimple.h"
30 #include "cfghooks.h"
31 #include "alloc-pool.h"
32 #include "tree-pass.h"
33 #include "tm_p.h"
34 #include "stringpool.h"
35 #include "tree-ssanames.h"
36 #include "optabs.h"
37 #include "emit-rtl.h"
38 #include "cgraph.h"
39 #include "gimple-pretty-print.h"
40 #include "alias.h"
41 #include "fold-const.h"
42 #include "cfganal.h"
43 #include "gimplify.h"
44 #include "gimple-iterator.h"
45 #include "varasm.h"
46 #include "stor-layout.h"
47 #include "tree-iterator.h"
48 #include "asan.h"
49 #include "dojump.h"
50 #include "explow.h"
51 #include "expr.h"
52 #include "output.h"
53 #include "langhooks.h"
54 #include "cfgloop.h"
55 #include "gimple-builder.h"
56 #include "ubsan.h"
57 #include "params.h"
58 #include "builtins.h"
59 #include "fnmatch.h"
61 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
62 with <2x slowdown on average.
64 The tool consists of two parts:
65 instrumentation module (this file) and a run-time library.
66 The instrumentation module adds a run-time check before every memory insn.
67 For a 8- or 16- byte load accessing address X:
68 ShadowAddr = (X >> 3) + Offset
69 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
70 if (ShadowValue)
71 __asan_report_load8(X);
72 For a load of N bytes (N=1, 2 or 4) from address X:
73 ShadowAddr = (X >> 3) + Offset
74 ShadowValue = *(char*)ShadowAddr;
75 if (ShadowValue)
76 if ((X & 7) + N - 1 > ShadowValue)
77 __asan_report_loadN(X);
78 Stores are instrumented similarly, but using __asan_report_storeN functions.
79 A call too __asan_init_vN() is inserted to the list of module CTORs.
80 N is the version number of the AddressSanitizer API. The changes between the
81 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
83 The run-time library redefines malloc (so that redzone are inserted around
84 the allocated memory) and free (so that reuse of free-ed memory is delayed),
85 provides __asan_report* and __asan_init_vN functions.
87 Read more:
88 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
90 The current implementation supports detection of out-of-bounds and
91 use-after-free in the heap, on the stack and for global variables.
93 [Protection of stack variables]
95 To understand how detection of out-of-bounds and use-after-free works
96 for stack variables, lets look at this example on x86_64 where the
97 stack grows downward:
99 int
100 foo ()
102 char a[23] = {0};
103 int b[2] = {0};
105 a[5] = 1;
106 b[1] = 2;
108 return a[5] + b[1];
111 For this function, the stack protected by asan will be organized as
112 follows, from the top of the stack to the bottom:
114 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
116 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
117 the next slot be 32 bytes aligned; this one is called Partial
118 Redzone; this 32 bytes alignment is an asan constraint]
120 Slot 3/ [24 bytes for variable 'a']
122 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
124 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
126 Slot 6/ [8 bytes for variable 'b']
128 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
129 'LEFT RedZone']
131 The 32 bytes of LEFT red zone at the bottom of the stack can be
132 decomposed as such:
134 1/ The first 8 bytes contain a magical asan number that is always
135 0x41B58AB3.
137 2/ The following 8 bytes contains a pointer to a string (to be
138 parsed at runtime by the runtime asan library), which format is
139 the following:
141 "<function-name> <space> <num-of-variables-on-the-stack>
142 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
143 <length-of-var-in-bytes> ){n} "
145 where '(...){n}' means the content inside the parenthesis occurs 'n'
146 times, with 'n' being the number of variables on the stack.
148 3/ The following 8 bytes contain the PC of the current function which
149 will be used by the run-time library to print an error message.
151 4/ The following 8 bytes are reserved for internal use by the run-time.
153 The shadow memory for that stack layout is going to look like this:
155 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
156 The F1 byte pattern is a magic number called
157 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
158 the memory for that shadow byte is part of a the LEFT red zone
159 intended to seat at the bottom of the variables on the stack.
161 - content of shadow memory 8 bytes for slots 6 and 5:
162 0xF4F4F400. The F4 byte pattern is a magic number
163 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
164 memory region for this shadow byte is a PARTIAL red zone
165 intended to pad a variable A, so that the slot following
166 {A,padding} is 32 bytes aligned.
168 Note that the fact that the least significant byte of this
169 shadow memory content is 00 means that 8 bytes of its
170 corresponding memory (which corresponds to the memory of
171 variable 'b') is addressable.
173 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
174 The F2 byte pattern is a magic number called
175 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
176 region for this shadow byte is a MIDDLE red zone intended to
177 seat between two 32 aligned slots of {variable,padding}.
179 - content of shadow memory 8 bytes for slot 3 and 2:
180 0xF4000000. This represents is the concatenation of
181 variable 'a' and the partial red zone following it, like what we
182 had for variable 'b'. The least significant 3 bytes being 00
183 means that the 3 bytes of variable 'a' are addressable.
185 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
186 The F3 byte pattern is a magic number called
187 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
188 region for this shadow byte is a RIGHT red zone intended to seat
189 at the top of the variables of the stack.
191 Note that the real variable layout is done in expand_used_vars in
192 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
193 stack variables as well as the different red zones, emits some
194 prologue code to populate the shadow memory as to poison (mark as
195 non-accessible) the regions of the red zones and mark the regions of
196 stack variables as accessible, and emit some epilogue code to
197 un-poison (mark as accessible) the regions of red zones right before
198 the function exits.
200 [Protection of global variables]
202 The basic idea is to insert a red zone between two global variables
203 and install a constructor function that calls the asan runtime to do
204 the populating of the relevant shadow memory regions at load time.
206 So the global variables are laid out as to insert a red zone between
207 them. The size of the red zones is so that each variable starts on a
208 32 bytes boundary.
210 Then a constructor function is installed so that, for each global
211 variable, it calls the runtime asan library function
212 __asan_register_globals_with an instance of this type:
214 struct __asan_global
216 // Address of the beginning of the global variable.
217 const void *__beg;
219 // Initial size of the global variable.
220 uptr __size;
222 // Size of the global variable + size of the red zone. This
223 // size is 32 bytes aligned.
224 uptr __size_with_redzone;
226 // Name of the global variable.
227 const void *__name;
229 // Name of the module where the global variable is declared.
230 const void *__module_name;
232 // 1 if it has dynamic initialization, 0 otherwise.
233 uptr __has_dynamic_init;
235 // A pointer to struct that contains source location, could be NULL.
236 __asan_global_source_location *__location;
239 A destructor function that calls the runtime asan library function
240 _asan_unregister_globals is also installed. */
242 static unsigned HOST_WIDE_INT asan_shadow_offset_value;
243 static bool asan_shadow_offset_computed;
244 static vec<char *> sanitized_sections;
246 /* Sets shadow offset to value in string VAL. */
248 bool
249 set_asan_shadow_offset (const char *val)
251 char *endp;
253 errno = 0;
254 #ifdef HAVE_LONG_LONG
255 asan_shadow_offset_value = strtoull (val, &endp, 0);
256 #else
257 asan_shadow_offset_value = strtoul (val, &endp, 0);
258 #endif
259 if (!(*val != '\0' && *endp == '\0' && errno == 0))
260 return false;
262 asan_shadow_offset_computed = true;
264 return true;
267 /* Set list of user-defined sections that need to be sanitized. */
269 void
270 set_sanitized_sections (const char *sections)
272 char *pat;
273 unsigned i;
274 FOR_EACH_VEC_ELT (sanitized_sections, i, pat)
275 free (pat);
276 sanitized_sections.truncate (0);
278 for (const char *s = sections; *s; )
280 const char *end;
281 for (end = s; *end && *end != ','; ++end);
282 size_t len = end - s;
283 sanitized_sections.safe_push (xstrndup (s, len));
284 s = *end ? end + 1 : end;
288 /* Checks whether section SEC should be sanitized. */
290 static bool
291 section_sanitized_p (const char *sec)
293 char *pat;
294 unsigned i;
295 FOR_EACH_VEC_ELT (sanitized_sections, i, pat)
296 if (fnmatch (pat, sec, FNM_PERIOD) == 0)
297 return true;
298 return false;
301 /* Returns Asan shadow offset. */
303 static unsigned HOST_WIDE_INT
304 asan_shadow_offset ()
306 if (!asan_shadow_offset_computed)
308 asan_shadow_offset_computed = true;
309 asan_shadow_offset_value = targetm.asan_shadow_offset ();
311 return asan_shadow_offset_value;
314 alias_set_type asan_shadow_set = -1;
316 /* Pointer types to 1 resp. 2 byte integers in shadow memory. A separate
317 alias set is used for all shadow memory accesses. */
318 static GTY(()) tree shadow_ptr_types[2];
320 /* Decl for __asan_option_detect_stack_use_after_return. */
321 static GTY(()) tree asan_detect_stack_use_after_return;
323 /* Various flags for Asan builtins. */
324 enum asan_check_flags
326 ASAN_CHECK_STORE = 1 << 0,
327 ASAN_CHECK_SCALAR_ACCESS = 1 << 1,
328 ASAN_CHECK_NON_ZERO_LEN = 1 << 2,
329 ASAN_CHECK_LAST = 1 << 3
332 /* Hashtable support for memory references used by gimple
333 statements. */
335 /* This type represents a reference to a memory region. */
336 struct asan_mem_ref
338 /* The expression of the beginning of the memory region. */
339 tree start;
341 /* The size of the access. */
342 HOST_WIDE_INT access_size;
345 object_allocator <asan_mem_ref> asan_mem_ref_pool ("asan_mem_ref");
347 /* Initializes an instance of asan_mem_ref. */
349 static void
350 asan_mem_ref_init (asan_mem_ref *ref, tree start, HOST_WIDE_INT access_size)
352 ref->start = start;
353 ref->access_size = access_size;
356 /* Allocates memory for an instance of asan_mem_ref into the memory
357 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
358 START is the address of (or the expression pointing to) the
359 beginning of memory reference. ACCESS_SIZE is the size of the
360 access to the referenced memory. */
362 static asan_mem_ref*
363 asan_mem_ref_new (tree start, HOST_WIDE_INT access_size)
365 asan_mem_ref *ref = asan_mem_ref_pool.allocate ();
367 asan_mem_ref_init (ref, start, access_size);
368 return ref;
371 /* This builds and returns a pointer to the end of the memory region
372 that starts at START and of length LEN. */
374 tree
375 asan_mem_ref_get_end (tree start, tree len)
377 if (len == NULL_TREE || integer_zerop (len))
378 return start;
380 if (!ptrofftype_p (len))
381 len = convert_to_ptrofftype (len);
383 return fold_build2 (POINTER_PLUS_EXPR, TREE_TYPE (start), start, len);
386 /* Return a tree expression that represents the end of the referenced
387 memory region. Beware that this function can actually build a new
388 tree expression. */
390 tree
391 asan_mem_ref_get_end (const asan_mem_ref *ref, tree len)
393 return asan_mem_ref_get_end (ref->start, len);
396 struct asan_mem_ref_hasher : nofree_ptr_hash <asan_mem_ref>
398 static inline hashval_t hash (const asan_mem_ref *);
399 static inline bool equal (const asan_mem_ref *, const asan_mem_ref *);
402 /* Hash a memory reference. */
404 inline hashval_t
405 asan_mem_ref_hasher::hash (const asan_mem_ref *mem_ref)
407 return iterative_hash_expr (mem_ref->start, 0);
410 /* Compare two memory references. We accept the length of either
411 memory references to be NULL_TREE. */
413 inline bool
414 asan_mem_ref_hasher::equal (const asan_mem_ref *m1,
415 const asan_mem_ref *m2)
417 return operand_equal_p (m1->start, m2->start, 0);
420 static hash_table<asan_mem_ref_hasher> *asan_mem_ref_ht;
422 /* Returns a reference to the hash table containing memory references.
423 This function ensures that the hash table is created. Note that
424 this hash table is updated by the function
425 update_mem_ref_hash_table. */
427 static hash_table<asan_mem_ref_hasher> *
428 get_mem_ref_hash_table ()
430 if (!asan_mem_ref_ht)
431 asan_mem_ref_ht = new hash_table<asan_mem_ref_hasher> (10);
433 return asan_mem_ref_ht;
436 /* Clear all entries from the memory references hash table. */
438 static void
439 empty_mem_ref_hash_table ()
441 if (asan_mem_ref_ht)
442 asan_mem_ref_ht->empty ();
445 /* Free the memory references hash table. */
447 static void
448 free_mem_ref_resources ()
450 delete asan_mem_ref_ht;
451 asan_mem_ref_ht = NULL;
453 asan_mem_ref_pool.release ();
456 /* Return true iff the memory reference REF has been instrumented. */
458 static bool
459 has_mem_ref_been_instrumented (tree ref, HOST_WIDE_INT access_size)
461 asan_mem_ref r;
462 asan_mem_ref_init (&r, ref, access_size);
464 asan_mem_ref *saved_ref = get_mem_ref_hash_table ()->find (&r);
465 return saved_ref && saved_ref->access_size >= access_size;
468 /* Return true iff the memory reference REF has been instrumented. */
470 static bool
471 has_mem_ref_been_instrumented (const asan_mem_ref *ref)
473 return has_mem_ref_been_instrumented (ref->start, ref->access_size);
476 /* Return true iff access to memory region starting at REF and of
477 length LEN has been instrumented. */
479 static bool
480 has_mem_ref_been_instrumented (const asan_mem_ref *ref, tree len)
482 HOST_WIDE_INT size_in_bytes
483 = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
485 return size_in_bytes != -1
486 && has_mem_ref_been_instrumented (ref->start, size_in_bytes);
489 /* Set REF to the memory reference present in a gimple assignment
490 ASSIGNMENT. Return true upon successful completion, false
491 otherwise. */
493 static bool
494 get_mem_ref_of_assignment (const gassign *assignment,
495 asan_mem_ref *ref,
496 bool *ref_is_store)
498 gcc_assert (gimple_assign_single_p (assignment));
500 if (gimple_store_p (assignment)
501 && !gimple_clobber_p (assignment))
503 ref->start = gimple_assign_lhs (assignment);
504 *ref_is_store = true;
506 else if (gimple_assign_load_p (assignment))
508 ref->start = gimple_assign_rhs1 (assignment);
509 *ref_is_store = false;
511 else
512 return false;
514 ref->access_size = int_size_in_bytes (TREE_TYPE (ref->start));
515 return true;
518 /* Return the memory references contained in a gimple statement
519 representing a builtin call that has to do with memory access. */
521 static bool
522 get_mem_refs_of_builtin_call (const gcall *call,
523 asan_mem_ref *src0,
524 tree *src0_len,
525 bool *src0_is_store,
526 asan_mem_ref *src1,
527 tree *src1_len,
528 bool *src1_is_store,
529 asan_mem_ref *dst,
530 tree *dst_len,
531 bool *dst_is_store,
532 bool *dest_is_deref,
533 bool *intercepted_p)
535 gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL));
537 tree callee = gimple_call_fndecl (call);
538 tree source0 = NULL_TREE, source1 = NULL_TREE,
539 dest = NULL_TREE, len = NULL_TREE;
540 bool is_store = true, got_reference_p = false;
541 HOST_WIDE_INT access_size = 1;
543 *intercepted_p = asan_intercepted_p ((DECL_FUNCTION_CODE (callee)));
545 switch (DECL_FUNCTION_CODE (callee))
547 /* (s, s, n) style memops. */
548 case BUILT_IN_BCMP:
549 case BUILT_IN_MEMCMP:
550 source0 = gimple_call_arg (call, 0);
551 source1 = gimple_call_arg (call, 1);
552 len = gimple_call_arg (call, 2);
553 break;
555 /* (src, dest, n) style memops. */
556 case BUILT_IN_BCOPY:
557 source0 = gimple_call_arg (call, 0);
558 dest = gimple_call_arg (call, 1);
559 len = gimple_call_arg (call, 2);
560 break;
562 /* (dest, src, n) style memops. */
563 case BUILT_IN_MEMCPY:
564 case BUILT_IN_MEMCPY_CHK:
565 case BUILT_IN_MEMMOVE:
566 case BUILT_IN_MEMMOVE_CHK:
567 case BUILT_IN_MEMPCPY:
568 case BUILT_IN_MEMPCPY_CHK:
569 dest = gimple_call_arg (call, 0);
570 source0 = gimple_call_arg (call, 1);
571 len = gimple_call_arg (call, 2);
572 break;
574 /* (dest, n) style memops. */
575 case BUILT_IN_BZERO:
576 dest = gimple_call_arg (call, 0);
577 len = gimple_call_arg (call, 1);
578 break;
580 /* (dest, x, n) style memops*/
581 case BUILT_IN_MEMSET:
582 case BUILT_IN_MEMSET_CHK:
583 dest = gimple_call_arg (call, 0);
584 len = gimple_call_arg (call, 2);
585 break;
587 case BUILT_IN_STRLEN:
588 source0 = gimple_call_arg (call, 0);
589 len = gimple_call_lhs (call);
590 break ;
592 /* And now the __atomic* and __sync builtins.
593 These are handled differently from the classical memory memory
594 access builtins above. */
596 case BUILT_IN_ATOMIC_LOAD_1:
597 case BUILT_IN_ATOMIC_LOAD_2:
598 case BUILT_IN_ATOMIC_LOAD_4:
599 case BUILT_IN_ATOMIC_LOAD_8:
600 case BUILT_IN_ATOMIC_LOAD_16:
601 is_store = false;
602 /* fall through. */
604 case BUILT_IN_SYNC_FETCH_AND_ADD_1:
605 case BUILT_IN_SYNC_FETCH_AND_ADD_2:
606 case BUILT_IN_SYNC_FETCH_AND_ADD_4:
607 case BUILT_IN_SYNC_FETCH_AND_ADD_8:
608 case BUILT_IN_SYNC_FETCH_AND_ADD_16:
610 case BUILT_IN_SYNC_FETCH_AND_SUB_1:
611 case BUILT_IN_SYNC_FETCH_AND_SUB_2:
612 case BUILT_IN_SYNC_FETCH_AND_SUB_4:
613 case BUILT_IN_SYNC_FETCH_AND_SUB_8:
614 case BUILT_IN_SYNC_FETCH_AND_SUB_16:
616 case BUILT_IN_SYNC_FETCH_AND_OR_1:
617 case BUILT_IN_SYNC_FETCH_AND_OR_2:
618 case BUILT_IN_SYNC_FETCH_AND_OR_4:
619 case BUILT_IN_SYNC_FETCH_AND_OR_8:
620 case BUILT_IN_SYNC_FETCH_AND_OR_16:
622 case BUILT_IN_SYNC_FETCH_AND_AND_1:
623 case BUILT_IN_SYNC_FETCH_AND_AND_2:
624 case BUILT_IN_SYNC_FETCH_AND_AND_4:
625 case BUILT_IN_SYNC_FETCH_AND_AND_8:
626 case BUILT_IN_SYNC_FETCH_AND_AND_16:
628 case BUILT_IN_SYNC_FETCH_AND_XOR_1:
629 case BUILT_IN_SYNC_FETCH_AND_XOR_2:
630 case BUILT_IN_SYNC_FETCH_AND_XOR_4:
631 case BUILT_IN_SYNC_FETCH_AND_XOR_8:
632 case BUILT_IN_SYNC_FETCH_AND_XOR_16:
634 case BUILT_IN_SYNC_FETCH_AND_NAND_1:
635 case BUILT_IN_SYNC_FETCH_AND_NAND_2:
636 case BUILT_IN_SYNC_FETCH_AND_NAND_4:
637 case BUILT_IN_SYNC_FETCH_AND_NAND_8:
639 case BUILT_IN_SYNC_ADD_AND_FETCH_1:
640 case BUILT_IN_SYNC_ADD_AND_FETCH_2:
641 case BUILT_IN_SYNC_ADD_AND_FETCH_4:
642 case BUILT_IN_SYNC_ADD_AND_FETCH_8:
643 case BUILT_IN_SYNC_ADD_AND_FETCH_16:
645 case BUILT_IN_SYNC_SUB_AND_FETCH_1:
646 case BUILT_IN_SYNC_SUB_AND_FETCH_2:
647 case BUILT_IN_SYNC_SUB_AND_FETCH_4:
648 case BUILT_IN_SYNC_SUB_AND_FETCH_8:
649 case BUILT_IN_SYNC_SUB_AND_FETCH_16:
651 case BUILT_IN_SYNC_OR_AND_FETCH_1:
652 case BUILT_IN_SYNC_OR_AND_FETCH_2:
653 case BUILT_IN_SYNC_OR_AND_FETCH_4:
654 case BUILT_IN_SYNC_OR_AND_FETCH_8:
655 case BUILT_IN_SYNC_OR_AND_FETCH_16:
657 case BUILT_IN_SYNC_AND_AND_FETCH_1:
658 case BUILT_IN_SYNC_AND_AND_FETCH_2:
659 case BUILT_IN_SYNC_AND_AND_FETCH_4:
660 case BUILT_IN_SYNC_AND_AND_FETCH_8:
661 case BUILT_IN_SYNC_AND_AND_FETCH_16:
663 case BUILT_IN_SYNC_XOR_AND_FETCH_1:
664 case BUILT_IN_SYNC_XOR_AND_FETCH_2:
665 case BUILT_IN_SYNC_XOR_AND_FETCH_4:
666 case BUILT_IN_SYNC_XOR_AND_FETCH_8:
667 case BUILT_IN_SYNC_XOR_AND_FETCH_16:
669 case BUILT_IN_SYNC_NAND_AND_FETCH_1:
670 case BUILT_IN_SYNC_NAND_AND_FETCH_2:
671 case BUILT_IN_SYNC_NAND_AND_FETCH_4:
672 case BUILT_IN_SYNC_NAND_AND_FETCH_8:
674 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1:
675 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2:
676 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4:
677 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8:
678 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16:
680 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1:
681 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2:
682 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4:
683 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8:
684 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16:
686 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1:
687 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2:
688 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4:
689 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8:
690 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16:
692 case BUILT_IN_SYNC_LOCK_RELEASE_1:
693 case BUILT_IN_SYNC_LOCK_RELEASE_2:
694 case BUILT_IN_SYNC_LOCK_RELEASE_4:
695 case BUILT_IN_SYNC_LOCK_RELEASE_8:
696 case BUILT_IN_SYNC_LOCK_RELEASE_16:
698 case BUILT_IN_ATOMIC_EXCHANGE_1:
699 case BUILT_IN_ATOMIC_EXCHANGE_2:
700 case BUILT_IN_ATOMIC_EXCHANGE_4:
701 case BUILT_IN_ATOMIC_EXCHANGE_8:
702 case BUILT_IN_ATOMIC_EXCHANGE_16:
704 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1:
705 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2:
706 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4:
707 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8:
708 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16:
710 case BUILT_IN_ATOMIC_STORE_1:
711 case BUILT_IN_ATOMIC_STORE_2:
712 case BUILT_IN_ATOMIC_STORE_4:
713 case BUILT_IN_ATOMIC_STORE_8:
714 case BUILT_IN_ATOMIC_STORE_16:
716 case BUILT_IN_ATOMIC_ADD_FETCH_1:
717 case BUILT_IN_ATOMIC_ADD_FETCH_2:
718 case BUILT_IN_ATOMIC_ADD_FETCH_4:
719 case BUILT_IN_ATOMIC_ADD_FETCH_8:
720 case BUILT_IN_ATOMIC_ADD_FETCH_16:
722 case BUILT_IN_ATOMIC_SUB_FETCH_1:
723 case BUILT_IN_ATOMIC_SUB_FETCH_2:
724 case BUILT_IN_ATOMIC_SUB_FETCH_4:
725 case BUILT_IN_ATOMIC_SUB_FETCH_8:
726 case BUILT_IN_ATOMIC_SUB_FETCH_16:
728 case BUILT_IN_ATOMIC_AND_FETCH_1:
729 case BUILT_IN_ATOMIC_AND_FETCH_2:
730 case BUILT_IN_ATOMIC_AND_FETCH_4:
731 case BUILT_IN_ATOMIC_AND_FETCH_8:
732 case BUILT_IN_ATOMIC_AND_FETCH_16:
734 case BUILT_IN_ATOMIC_NAND_FETCH_1:
735 case BUILT_IN_ATOMIC_NAND_FETCH_2:
736 case BUILT_IN_ATOMIC_NAND_FETCH_4:
737 case BUILT_IN_ATOMIC_NAND_FETCH_8:
738 case BUILT_IN_ATOMIC_NAND_FETCH_16:
740 case BUILT_IN_ATOMIC_XOR_FETCH_1:
741 case BUILT_IN_ATOMIC_XOR_FETCH_2:
742 case BUILT_IN_ATOMIC_XOR_FETCH_4:
743 case BUILT_IN_ATOMIC_XOR_FETCH_8:
744 case BUILT_IN_ATOMIC_XOR_FETCH_16:
746 case BUILT_IN_ATOMIC_OR_FETCH_1:
747 case BUILT_IN_ATOMIC_OR_FETCH_2:
748 case BUILT_IN_ATOMIC_OR_FETCH_4:
749 case BUILT_IN_ATOMIC_OR_FETCH_8:
750 case BUILT_IN_ATOMIC_OR_FETCH_16:
752 case BUILT_IN_ATOMIC_FETCH_ADD_1:
753 case BUILT_IN_ATOMIC_FETCH_ADD_2:
754 case BUILT_IN_ATOMIC_FETCH_ADD_4:
755 case BUILT_IN_ATOMIC_FETCH_ADD_8:
756 case BUILT_IN_ATOMIC_FETCH_ADD_16:
758 case BUILT_IN_ATOMIC_FETCH_SUB_1:
759 case BUILT_IN_ATOMIC_FETCH_SUB_2:
760 case BUILT_IN_ATOMIC_FETCH_SUB_4:
761 case BUILT_IN_ATOMIC_FETCH_SUB_8:
762 case BUILT_IN_ATOMIC_FETCH_SUB_16:
764 case BUILT_IN_ATOMIC_FETCH_AND_1:
765 case BUILT_IN_ATOMIC_FETCH_AND_2:
766 case BUILT_IN_ATOMIC_FETCH_AND_4:
767 case BUILT_IN_ATOMIC_FETCH_AND_8:
768 case BUILT_IN_ATOMIC_FETCH_AND_16:
770 case BUILT_IN_ATOMIC_FETCH_NAND_1:
771 case BUILT_IN_ATOMIC_FETCH_NAND_2:
772 case BUILT_IN_ATOMIC_FETCH_NAND_4:
773 case BUILT_IN_ATOMIC_FETCH_NAND_8:
774 case BUILT_IN_ATOMIC_FETCH_NAND_16:
776 case BUILT_IN_ATOMIC_FETCH_XOR_1:
777 case BUILT_IN_ATOMIC_FETCH_XOR_2:
778 case BUILT_IN_ATOMIC_FETCH_XOR_4:
779 case BUILT_IN_ATOMIC_FETCH_XOR_8:
780 case BUILT_IN_ATOMIC_FETCH_XOR_16:
782 case BUILT_IN_ATOMIC_FETCH_OR_1:
783 case BUILT_IN_ATOMIC_FETCH_OR_2:
784 case BUILT_IN_ATOMIC_FETCH_OR_4:
785 case BUILT_IN_ATOMIC_FETCH_OR_8:
786 case BUILT_IN_ATOMIC_FETCH_OR_16:
788 dest = gimple_call_arg (call, 0);
789 /* DEST represents the address of a memory location.
790 instrument_derefs wants the memory location, so lets
791 dereference the address DEST before handing it to
792 instrument_derefs. */
793 if (TREE_CODE (dest) == ADDR_EXPR)
794 dest = TREE_OPERAND (dest, 0);
795 else if (TREE_CODE (dest) == SSA_NAME || TREE_CODE (dest) == INTEGER_CST)
796 dest = build2 (MEM_REF, TREE_TYPE (TREE_TYPE (dest)),
797 dest, build_int_cst (TREE_TYPE (dest), 0));
798 else
799 gcc_unreachable ();
801 access_size = int_size_in_bytes (TREE_TYPE (dest));
804 default:
805 /* The other builtins memory access are not instrumented in this
806 function because they either don't have any length parameter,
807 or their length parameter is just a limit. */
808 break;
811 if (len != NULL_TREE)
813 if (source0 != NULL_TREE)
815 src0->start = source0;
816 src0->access_size = access_size;
817 *src0_len = len;
818 *src0_is_store = false;
821 if (source1 != NULL_TREE)
823 src1->start = source1;
824 src1->access_size = access_size;
825 *src1_len = len;
826 *src1_is_store = false;
829 if (dest != NULL_TREE)
831 dst->start = dest;
832 dst->access_size = access_size;
833 *dst_len = len;
834 *dst_is_store = true;
837 got_reference_p = true;
839 else if (dest)
841 dst->start = dest;
842 dst->access_size = access_size;
843 *dst_len = NULL_TREE;
844 *dst_is_store = is_store;
845 *dest_is_deref = true;
846 got_reference_p = true;
849 return got_reference_p;
852 /* Return true iff a given gimple statement has been instrumented.
853 Note that the statement is "defined" by the memory references it
854 contains. */
856 static bool
857 has_stmt_been_instrumented_p (gimple *stmt)
859 if (gimple_assign_single_p (stmt))
861 bool r_is_store;
862 asan_mem_ref r;
863 asan_mem_ref_init (&r, NULL, 1);
865 if (get_mem_ref_of_assignment (as_a <gassign *> (stmt), &r,
866 &r_is_store))
867 return has_mem_ref_been_instrumented (&r);
869 else if (gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
871 asan_mem_ref src0, src1, dest;
872 asan_mem_ref_init (&src0, NULL, 1);
873 asan_mem_ref_init (&src1, NULL, 1);
874 asan_mem_ref_init (&dest, NULL, 1);
876 tree src0_len = NULL_TREE, src1_len = NULL_TREE, dest_len = NULL_TREE;
877 bool src0_is_store = false, src1_is_store = false,
878 dest_is_store = false, dest_is_deref = false, intercepted_p = true;
879 if (get_mem_refs_of_builtin_call (as_a <gcall *> (stmt),
880 &src0, &src0_len, &src0_is_store,
881 &src1, &src1_len, &src1_is_store,
882 &dest, &dest_len, &dest_is_store,
883 &dest_is_deref, &intercepted_p))
885 if (src0.start != NULL_TREE
886 && !has_mem_ref_been_instrumented (&src0, src0_len))
887 return false;
889 if (src1.start != NULL_TREE
890 && !has_mem_ref_been_instrumented (&src1, src1_len))
891 return false;
893 if (dest.start != NULL_TREE
894 && !has_mem_ref_been_instrumented (&dest, dest_len))
895 return false;
897 return true;
900 return false;
903 /* Insert a memory reference into the hash table. */
905 static void
906 update_mem_ref_hash_table (tree ref, HOST_WIDE_INT access_size)
908 hash_table<asan_mem_ref_hasher> *ht = get_mem_ref_hash_table ();
910 asan_mem_ref r;
911 asan_mem_ref_init (&r, ref, access_size);
913 asan_mem_ref **slot = ht->find_slot (&r, INSERT);
914 if (*slot == NULL || (*slot)->access_size < access_size)
915 *slot = asan_mem_ref_new (ref, access_size);
918 /* Initialize shadow_ptr_types array. */
920 static void
921 asan_init_shadow_ptr_types (void)
923 asan_shadow_set = new_alias_set ();
924 shadow_ptr_types[0] = build_distinct_type_copy (signed_char_type_node);
925 TYPE_ALIAS_SET (shadow_ptr_types[0]) = asan_shadow_set;
926 shadow_ptr_types[0] = build_pointer_type (shadow_ptr_types[0]);
927 shadow_ptr_types[1] = build_distinct_type_copy (short_integer_type_node);
928 TYPE_ALIAS_SET (shadow_ptr_types[1]) = asan_shadow_set;
929 shadow_ptr_types[1] = build_pointer_type (shadow_ptr_types[1]);
930 initialize_sanitizer_builtins ();
933 /* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
935 static tree
936 asan_pp_string (pretty_printer *pp)
938 const char *buf = pp_formatted_text (pp);
939 size_t len = strlen (buf);
940 tree ret = build_string (len + 1, buf);
941 TREE_TYPE (ret)
942 = build_array_type (TREE_TYPE (shadow_ptr_types[0]),
943 build_index_type (size_int (len)));
944 TREE_READONLY (ret) = 1;
945 TREE_STATIC (ret) = 1;
946 return build1 (ADDR_EXPR, shadow_ptr_types[0], ret);
949 /* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
951 static rtx
952 asan_shadow_cst (unsigned char shadow_bytes[4])
954 int i;
955 unsigned HOST_WIDE_INT val = 0;
956 gcc_assert (WORDS_BIG_ENDIAN == BYTES_BIG_ENDIAN);
957 for (i = 0; i < 4; i++)
958 val |= (unsigned HOST_WIDE_INT) shadow_bytes[BYTES_BIG_ENDIAN ? 3 - i : i]
959 << (BITS_PER_UNIT * i);
960 return gen_int_mode (val, SImode);
963 /* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
964 though. */
966 static void
967 asan_clear_shadow (rtx shadow_mem, HOST_WIDE_INT len)
969 rtx_insn *insn, *insns, *jump;
970 rtx_code_label *top_label;
971 rtx end, addr, tmp;
973 start_sequence ();
974 clear_storage (shadow_mem, GEN_INT (len), BLOCK_OP_NORMAL);
975 insns = get_insns ();
976 end_sequence ();
977 for (insn = insns; insn; insn = NEXT_INSN (insn))
978 if (CALL_P (insn))
979 break;
980 if (insn == NULL_RTX)
982 emit_insn (insns);
983 return;
986 gcc_assert ((len & 3) == 0);
987 top_label = gen_label_rtx ();
988 addr = copy_to_mode_reg (Pmode, XEXP (shadow_mem, 0));
989 shadow_mem = adjust_automodify_address (shadow_mem, SImode, addr, 0);
990 end = force_reg (Pmode, plus_constant (Pmode, addr, len));
991 emit_label (top_label);
993 emit_move_insn (shadow_mem, const0_rtx);
994 tmp = expand_simple_binop (Pmode, PLUS, addr, gen_int_mode (4, Pmode), addr,
995 true, OPTAB_LIB_WIDEN);
996 if (tmp != addr)
997 emit_move_insn (addr, tmp);
998 emit_cmp_and_jump_insns (addr, end, LT, NULL_RTX, Pmode, true, top_label);
999 jump = get_last_insn ();
1000 gcc_assert (JUMP_P (jump));
1001 add_int_reg_note (jump, REG_BR_PROB, REG_BR_PROB_BASE * 80 / 100);
1004 void
1005 asan_function_start (void)
1007 section *fnsec = function_section (current_function_decl);
1008 switch_to_section (fnsec);
1009 ASM_OUTPUT_DEBUG_LABEL (asm_out_file, "LASANPC",
1010 current_function_funcdef_no);
1013 /* Insert code to protect stack vars. The prologue sequence should be emitted
1014 directly, epilogue sequence returned. BASE is the register holding the
1015 stack base, against which OFFSETS array offsets are relative to, OFFSETS
1016 array contains pairs of offsets in reverse order, always the end offset
1017 of some gap that needs protection followed by starting offset,
1018 and DECLS is an array of representative decls for each var partition.
1019 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
1020 elements long (OFFSETS include gap before the first variable as well
1021 as gaps after each stack variable). PBASE is, if non-NULL, some pseudo
1022 register which stack vars DECL_RTLs are based on. Either BASE should be
1023 assigned to PBASE, when not doing use after return protection, or
1024 corresponding address based on __asan_stack_malloc* return value. */
1026 rtx_insn *
1027 asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
1028 HOST_WIDE_INT *offsets, tree *decls, int length)
1030 rtx shadow_base, shadow_mem, ret, mem, orig_base;
1031 rtx_code_label *lab;
1032 rtx_insn *insns;
1033 char buf[30];
1034 unsigned char shadow_bytes[4];
1035 HOST_WIDE_INT base_offset = offsets[length - 1];
1036 HOST_WIDE_INT base_align_bias = 0, offset, prev_offset;
1037 HOST_WIDE_INT asan_frame_size = offsets[0] - base_offset;
1038 HOST_WIDE_INT last_offset, last_size;
1039 int l;
1040 unsigned char cur_shadow_byte = ASAN_STACK_MAGIC_LEFT;
1041 tree str_cst, decl, id;
1042 int use_after_return_class = -1;
1044 if (shadow_ptr_types[0] == NULL_TREE)
1045 asan_init_shadow_ptr_types ();
1047 /* First of all, prepare the description string. */
1048 pretty_printer asan_pp;
1050 pp_decimal_int (&asan_pp, length / 2 - 1);
1051 pp_space (&asan_pp);
1052 for (l = length - 2; l; l -= 2)
1054 tree decl = decls[l / 2 - 1];
1055 pp_wide_integer (&asan_pp, offsets[l] - base_offset);
1056 pp_space (&asan_pp);
1057 pp_wide_integer (&asan_pp, offsets[l - 1] - offsets[l]);
1058 pp_space (&asan_pp);
1059 if (DECL_P (decl) && DECL_NAME (decl))
1061 pp_decimal_int (&asan_pp, IDENTIFIER_LENGTH (DECL_NAME (decl)));
1062 pp_space (&asan_pp);
1063 pp_tree_identifier (&asan_pp, DECL_NAME (decl));
1065 else
1066 pp_string (&asan_pp, "9 <unknown>");
1067 pp_space (&asan_pp);
1069 str_cst = asan_pp_string (&asan_pp);
1071 /* Emit the prologue sequence. */
1072 if (asan_frame_size > 32 && asan_frame_size <= 65536 && pbase
1073 && ASAN_USE_AFTER_RETURN)
1075 use_after_return_class = floor_log2 (asan_frame_size - 1) - 5;
1076 /* __asan_stack_malloc_N guarantees alignment
1077 N < 6 ? (64 << N) : 4096 bytes. */
1078 if (alignb > (use_after_return_class < 6
1079 ? (64U << use_after_return_class) : 4096U))
1080 use_after_return_class = -1;
1081 else if (alignb > ASAN_RED_ZONE_SIZE && (asan_frame_size & (alignb - 1)))
1082 base_align_bias = ((asan_frame_size + alignb - 1)
1083 & ~(alignb - HOST_WIDE_INT_1)) - asan_frame_size;
1085 /* Align base if target is STRICT_ALIGNMENT. */
1086 if (STRICT_ALIGNMENT)
1087 base = expand_binop (Pmode, and_optab, base,
1088 gen_int_mode (-((GET_MODE_ALIGNMENT (SImode)
1089 << ASAN_SHADOW_SHIFT)
1090 / BITS_PER_UNIT), Pmode), NULL_RTX,
1091 1, OPTAB_DIRECT);
1093 if (use_after_return_class == -1 && pbase)
1094 emit_move_insn (pbase, base);
1096 base = expand_binop (Pmode, add_optab, base,
1097 gen_int_mode (base_offset - base_align_bias, Pmode),
1098 NULL_RTX, 1, OPTAB_DIRECT);
1099 orig_base = NULL_RTX;
1100 if (use_after_return_class != -1)
1102 if (asan_detect_stack_use_after_return == NULL_TREE)
1104 id = get_identifier ("__asan_option_detect_stack_use_after_return");
1105 decl = build_decl (BUILTINS_LOCATION, VAR_DECL, id,
1106 integer_type_node);
1107 SET_DECL_ASSEMBLER_NAME (decl, id);
1108 TREE_ADDRESSABLE (decl) = 1;
1109 DECL_ARTIFICIAL (decl) = 1;
1110 DECL_IGNORED_P (decl) = 1;
1111 DECL_EXTERNAL (decl) = 1;
1112 TREE_STATIC (decl) = 1;
1113 TREE_PUBLIC (decl) = 1;
1114 TREE_USED (decl) = 1;
1115 asan_detect_stack_use_after_return = decl;
1117 orig_base = gen_reg_rtx (Pmode);
1118 emit_move_insn (orig_base, base);
1119 ret = expand_normal (asan_detect_stack_use_after_return);
1120 lab = gen_label_rtx ();
1121 int very_likely = REG_BR_PROB_BASE - (REG_BR_PROB_BASE / 2000 - 1);
1122 emit_cmp_and_jump_insns (ret, const0_rtx, EQ, NULL_RTX,
1123 VOIDmode, 0, lab, very_likely);
1124 snprintf (buf, sizeof buf, "__asan_stack_malloc_%d",
1125 use_after_return_class);
1126 ret = init_one_libfunc (buf);
1127 ret = emit_library_call_value (ret, NULL_RTX, LCT_NORMAL, ptr_mode, 1,
1128 GEN_INT (asan_frame_size
1129 + base_align_bias),
1130 TYPE_MODE (pointer_sized_int_node));
1131 /* __asan_stack_malloc_[n] returns a pointer to fake stack if succeeded
1132 and NULL otherwise. Check RET value is NULL here and jump over the
1133 BASE reassignment in this case. Otherwise, reassign BASE to RET. */
1134 int very_unlikely = REG_BR_PROB_BASE / 2000 - 1;
1135 emit_cmp_and_jump_insns (ret, const0_rtx, EQ, NULL_RTX,
1136 VOIDmode, 0, lab, very_unlikely);
1137 ret = convert_memory_address (Pmode, ret);
1138 emit_move_insn (base, ret);
1139 emit_label (lab);
1140 emit_move_insn (pbase, expand_binop (Pmode, add_optab, base,
1141 gen_int_mode (base_align_bias
1142 - base_offset, Pmode),
1143 NULL_RTX, 1, OPTAB_DIRECT));
1145 mem = gen_rtx_MEM (ptr_mode, base);
1146 mem = adjust_address (mem, VOIDmode, base_align_bias);
1147 emit_move_insn (mem, gen_int_mode (ASAN_STACK_FRAME_MAGIC, ptr_mode));
1148 mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode));
1149 emit_move_insn (mem, expand_normal (str_cst));
1150 mem = adjust_address (mem, VOIDmode, GET_MODE_SIZE (ptr_mode));
1151 ASM_GENERATE_INTERNAL_LABEL (buf, "LASANPC", current_function_funcdef_no);
1152 id = get_identifier (buf);
1153 decl = build_decl (DECL_SOURCE_LOCATION (current_function_decl),
1154 VAR_DECL, id, char_type_node);
1155 SET_DECL_ASSEMBLER_NAME (decl, id);
1156 TREE_ADDRESSABLE (decl) = 1;
1157 TREE_READONLY (decl) = 1;
1158 DECL_ARTIFICIAL (decl) = 1;
1159 DECL_IGNORED_P (decl) = 1;
1160 TREE_STATIC (decl) = 1;
1161 TREE_PUBLIC (decl) = 0;
1162 TREE_USED (decl) = 1;
1163 DECL_INITIAL (decl) = decl;
1164 TREE_ASM_WRITTEN (decl) = 1;
1165 TREE_ASM_WRITTEN (id) = 1;
1166 emit_move_insn (mem, expand_normal (build_fold_addr_expr (decl)));
1167 shadow_base = expand_binop (Pmode, lshr_optab, base,
1168 GEN_INT (ASAN_SHADOW_SHIFT),
1169 NULL_RTX, 1, OPTAB_DIRECT);
1170 shadow_base
1171 = plus_constant (Pmode, shadow_base,
1172 asan_shadow_offset ()
1173 + (base_align_bias >> ASAN_SHADOW_SHIFT));
1174 gcc_assert (asan_shadow_set != -1
1175 && (ASAN_RED_ZONE_SIZE >> ASAN_SHADOW_SHIFT) == 4);
1176 shadow_mem = gen_rtx_MEM (SImode, shadow_base);
1177 set_mem_alias_set (shadow_mem, asan_shadow_set);
1178 if (STRICT_ALIGNMENT)
1179 set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)));
1180 prev_offset = base_offset;
1181 for (l = length; l; l -= 2)
1183 if (l == 2)
1184 cur_shadow_byte = ASAN_STACK_MAGIC_RIGHT;
1185 offset = offsets[l - 1];
1186 if ((offset - base_offset) & (ASAN_RED_ZONE_SIZE - 1))
1188 int i;
1189 HOST_WIDE_INT aoff
1190 = base_offset + ((offset - base_offset)
1191 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
1192 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1193 (aoff - prev_offset)
1194 >> ASAN_SHADOW_SHIFT);
1195 prev_offset = aoff;
1196 for (i = 0; i < 4; i++, aoff += (1 << ASAN_SHADOW_SHIFT))
1197 if (aoff < offset)
1199 if (aoff < offset - (1 << ASAN_SHADOW_SHIFT) + 1)
1200 shadow_bytes[i] = 0;
1201 else
1202 shadow_bytes[i] = offset - aoff;
1204 else
1205 shadow_bytes[i] = ASAN_STACK_MAGIC_PARTIAL;
1206 emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
1207 offset = aoff;
1209 while (offset <= offsets[l - 2] - ASAN_RED_ZONE_SIZE)
1211 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1212 (offset - prev_offset)
1213 >> ASAN_SHADOW_SHIFT);
1214 prev_offset = offset;
1215 memset (shadow_bytes, cur_shadow_byte, 4);
1216 emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
1217 offset += ASAN_RED_ZONE_SIZE;
1219 cur_shadow_byte = ASAN_STACK_MAGIC_MIDDLE;
1221 do_pending_stack_adjust ();
1223 /* Construct epilogue sequence. */
1224 start_sequence ();
1226 lab = NULL;
1227 if (use_after_return_class != -1)
1229 rtx_code_label *lab2 = gen_label_rtx ();
1230 char c = (char) ASAN_STACK_MAGIC_USE_AFTER_RET;
1231 int very_likely = REG_BR_PROB_BASE - (REG_BR_PROB_BASE / 2000 - 1);
1232 emit_cmp_and_jump_insns (orig_base, base, EQ, NULL_RTX,
1233 VOIDmode, 0, lab2, very_likely);
1234 shadow_mem = gen_rtx_MEM (BLKmode, shadow_base);
1235 set_mem_alias_set (shadow_mem, asan_shadow_set);
1236 mem = gen_rtx_MEM (ptr_mode, base);
1237 mem = adjust_address (mem, VOIDmode, base_align_bias);
1238 emit_move_insn (mem, gen_int_mode (ASAN_STACK_RETIRED_MAGIC, ptr_mode));
1239 unsigned HOST_WIDE_INT sz = asan_frame_size >> ASAN_SHADOW_SHIFT;
1240 if (use_after_return_class < 5
1241 && can_store_by_pieces (sz, builtin_memset_read_str, &c,
1242 BITS_PER_UNIT, true))
1243 store_by_pieces (shadow_mem, sz, builtin_memset_read_str, &c,
1244 BITS_PER_UNIT, true, 0);
1245 else if (use_after_return_class >= 5
1246 || !set_storage_via_setmem (shadow_mem,
1247 GEN_INT (sz),
1248 gen_int_mode (c, QImode),
1249 BITS_PER_UNIT, BITS_PER_UNIT,
1250 -1, sz, sz, sz))
1252 snprintf (buf, sizeof buf, "__asan_stack_free_%d",
1253 use_after_return_class);
1254 ret = init_one_libfunc (buf);
1255 rtx addr = convert_memory_address (ptr_mode, base);
1256 rtx orig_addr = convert_memory_address (ptr_mode, orig_base);
1257 emit_library_call (ret, LCT_NORMAL, ptr_mode, 3, addr, ptr_mode,
1258 GEN_INT (asan_frame_size + base_align_bias),
1259 TYPE_MODE (pointer_sized_int_node),
1260 orig_addr, ptr_mode);
1262 lab = gen_label_rtx ();
1263 emit_jump (lab);
1264 emit_label (lab2);
1267 shadow_mem = gen_rtx_MEM (BLKmode, shadow_base);
1268 set_mem_alias_set (shadow_mem, asan_shadow_set);
1270 if (STRICT_ALIGNMENT)
1271 set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)));
1273 prev_offset = base_offset;
1274 last_offset = base_offset;
1275 last_size = 0;
1276 for (l = length; l; l -= 2)
1278 offset = base_offset + ((offsets[l - 1] - base_offset)
1279 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
1280 if (last_offset + last_size != offset)
1282 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1283 (last_offset - prev_offset)
1284 >> ASAN_SHADOW_SHIFT);
1285 prev_offset = last_offset;
1286 asan_clear_shadow (shadow_mem, last_size >> ASAN_SHADOW_SHIFT);
1287 last_offset = offset;
1288 last_size = 0;
1290 last_size += base_offset + ((offsets[l - 2] - base_offset)
1291 & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1))
1292 - offset;
1294 if (last_size)
1296 shadow_mem = adjust_address (shadow_mem, VOIDmode,
1297 (last_offset - prev_offset)
1298 >> ASAN_SHADOW_SHIFT);
1299 asan_clear_shadow (shadow_mem, last_size >> ASAN_SHADOW_SHIFT);
1302 do_pending_stack_adjust ();
1303 if (lab)
1304 emit_label (lab);
1306 insns = get_insns ();
1307 end_sequence ();
1308 return insns;
1311 /* Return true if DECL, a global var, might be overridden and needs
1312 therefore a local alias. */
1314 static bool
1315 asan_needs_local_alias (tree decl)
1317 return DECL_WEAK (decl) || !targetm.binds_local_p (decl);
1320 /* Return true if DECL is a VAR_DECL that should be protected
1321 by Address Sanitizer, by appending a red zone with protected
1322 shadow memory after it and aligning it to at least
1323 ASAN_RED_ZONE_SIZE bytes. */
1325 bool
1326 asan_protect_global (tree decl)
1328 if (!ASAN_GLOBALS)
1329 return false;
1331 rtx rtl, symbol;
1333 if (TREE_CODE (decl) == STRING_CST)
1335 /* Instrument all STRING_CSTs except those created
1336 by asan_pp_string here. */
1337 if (shadow_ptr_types[0] != NULL_TREE
1338 && TREE_CODE (TREE_TYPE (decl)) == ARRAY_TYPE
1339 && TREE_TYPE (TREE_TYPE (decl)) == TREE_TYPE (shadow_ptr_types[0]))
1340 return false;
1341 return true;
1343 if (TREE_CODE (decl) != VAR_DECL
1344 /* TLS vars aren't statically protectable. */
1345 || DECL_THREAD_LOCAL_P (decl)
1346 /* Externs will be protected elsewhere. */
1347 || DECL_EXTERNAL (decl)
1348 || !DECL_RTL_SET_P (decl)
1349 /* Comdat vars pose an ABI problem, we can't know if
1350 the var that is selected by the linker will have
1351 padding or not. */
1352 || DECL_ONE_ONLY (decl)
1353 /* Similarly for common vars. People can use -fno-common.
1354 Note: Linux kernel is built with -fno-common, so we do instrument
1355 globals there even if it is C. */
1356 || (DECL_COMMON (decl) && TREE_PUBLIC (decl))
1357 /* Don't protect if using user section, often vars placed
1358 into user section from multiple TUs are then assumed
1359 to be an array of such vars, putting padding in there
1360 breaks this assumption. */
1361 || (DECL_SECTION_NAME (decl) != NULL
1362 && !symtab_node::get (decl)->implicit_section
1363 && !section_sanitized_p (DECL_SECTION_NAME (decl)))
1364 || DECL_SIZE (decl) == 0
1365 || ASAN_RED_ZONE_SIZE * BITS_PER_UNIT > MAX_OFILE_ALIGNMENT
1366 || !valid_constant_size_p (DECL_SIZE_UNIT (decl))
1367 || DECL_ALIGN_UNIT (decl) > 2 * ASAN_RED_ZONE_SIZE
1368 || TREE_TYPE (decl) == ubsan_get_source_location_type ())
1369 return false;
1371 rtl = DECL_RTL (decl);
1372 if (!MEM_P (rtl) || GET_CODE (XEXP (rtl, 0)) != SYMBOL_REF)
1373 return false;
1374 symbol = XEXP (rtl, 0);
1376 if (CONSTANT_POOL_ADDRESS_P (symbol)
1377 || TREE_CONSTANT_POOL_ADDRESS_P (symbol))
1378 return false;
1380 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl)))
1381 return false;
1383 #ifndef ASM_OUTPUT_DEF
1384 if (asan_needs_local_alias (decl))
1385 return false;
1386 #endif
1388 return true;
1391 /* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16,_n}.
1392 IS_STORE is either 1 (for a store) or 0 (for a load). */
1394 static tree
1395 report_error_func (bool is_store, bool recover_p, HOST_WIDE_INT size_in_bytes,
1396 int *nargs)
1398 static enum built_in_function report[2][2][6]
1399 = { { { BUILT_IN_ASAN_REPORT_LOAD1, BUILT_IN_ASAN_REPORT_LOAD2,
1400 BUILT_IN_ASAN_REPORT_LOAD4, BUILT_IN_ASAN_REPORT_LOAD8,
1401 BUILT_IN_ASAN_REPORT_LOAD16, BUILT_IN_ASAN_REPORT_LOAD_N },
1402 { BUILT_IN_ASAN_REPORT_STORE1, BUILT_IN_ASAN_REPORT_STORE2,
1403 BUILT_IN_ASAN_REPORT_STORE4, BUILT_IN_ASAN_REPORT_STORE8,
1404 BUILT_IN_ASAN_REPORT_STORE16, BUILT_IN_ASAN_REPORT_STORE_N } },
1405 { { BUILT_IN_ASAN_REPORT_LOAD1_NOABORT,
1406 BUILT_IN_ASAN_REPORT_LOAD2_NOABORT,
1407 BUILT_IN_ASAN_REPORT_LOAD4_NOABORT,
1408 BUILT_IN_ASAN_REPORT_LOAD8_NOABORT,
1409 BUILT_IN_ASAN_REPORT_LOAD16_NOABORT,
1410 BUILT_IN_ASAN_REPORT_LOAD_N_NOABORT },
1411 { BUILT_IN_ASAN_REPORT_STORE1_NOABORT,
1412 BUILT_IN_ASAN_REPORT_STORE2_NOABORT,
1413 BUILT_IN_ASAN_REPORT_STORE4_NOABORT,
1414 BUILT_IN_ASAN_REPORT_STORE8_NOABORT,
1415 BUILT_IN_ASAN_REPORT_STORE16_NOABORT,
1416 BUILT_IN_ASAN_REPORT_STORE_N_NOABORT } } };
1417 if (size_in_bytes == -1)
1419 *nargs = 2;
1420 return builtin_decl_implicit (report[recover_p][is_store][5]);
1422 *nargs = 1;
1423 int size_log2 = exact_log2 (size_in_bytes);
1424 return builtin_decl_implicit (report[recover_p][is_store][size_log2]);
1427 /* Construct a function tree for __asan_{load,store}{1,2,4,8,16,_n}.
1428 IS_STORE is either 1 (for a store) or 0 (for a load). */
1430 static tree
1431 check_func (bool is_store, bool recover_p, HOST_WIDE_INT size_in_bytes,
1432 int *nargs)
1434 static enum built_in_function check[2][2][6]
1435 = { { { BUILT_IN_ASAN_LOAD1, BUILT_IN_ASAN_LOAD2,
1436 BUILT_IN_ASAN_LOAD4, BUILT_IN_ASAN_LOAD8,
1437 BUILT_IN_ASAN_LOAD16, BUILT_IN_ASAN_LOADN },
1438 { BUILT_IN_ASAN_STORE1, BUILT_IN_ASAN_STORE2,
1439 BUILT_IN_ASAN_STORE4, BUILT_IN_ASAN_STORE8,
1440 BUILT_IN_ASAN_STORE16, BUILT_IN_ASAN_STOREN } },
1441 { { BUILT_IN_ASAN_LOAD1_NOABORT,
1442 BUILT_IN_ASAN_LOAD2_NOABORT,
1443 BUILT_IN_ASAN_LOAD4_NOABORT,
1444 BUILT_IN_ASAN_LOAD8_NOABORT,
1445 BUILT_IN_ASAN_LOAD16_NOABORT,
1446 BUILT_IN_ASAN_LOADN_NOABORT },
1447 { BUILT_IN_ASAN_STORE1_NOABORT,
1448 BUILT_IN_ASAN_STORE2_NOABORT,
1449 BUILT_IN_ASAN_STORE4_NOABORT,
1450 BUILT_IN_ASAN_STORE8_NOABORT,
1451 BUILT_IN_ASAN_STORE16_NOABORT,
1452 BUILT_IN_ASAN_STOREN_NOABORT } } };
1453 if (size_in_bytes == -1)
1455 *nargs = 2;
1456 return builtin_decl_implicit (check[recover_p][is_store][5]);
1458 *nargs = 1;
1459 int size_log2 = exact_log2 (size_in_bytes);
1460 return builtin_decl_implicit (check[recover_p][is_store][size_log2]);
1463 /* Split the current basic block and create a condition statement
1464 insertion point right before or after the statement pointed to by
1465 ITER. Return an iterator to the point at which the caller might
1466 safely insert the condition statement.
1468 THEN_BLOCK must be set to the address of an uninitialized instance
1469 of basic_block. The function will then set *THEN_BLOCK to the
1470 'then block' of the condition statement to be inserted by the
1471 caller.
1473 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1474 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1476 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1477 block' of the condition statement to be inserted by the caller.
1479 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1480 statements starting from *ITER, and *THEN_BLOCK is a new empty
1481 block.
1483 *ITER is adjusted to point to always point to the first statement
1484 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1485 same as what ITER was pointing to prior to calling this function,
1486 if BEFORE_P is true; otherwise, it is its following statement. */
1488 gimple_stmt_iterator
1489 create_cond_insert_point (gimple_stmt_iterator *iter,
1490 bool before_p,
1491 bool then_more_likely_p,
1492 bool create_then_fallthru_edge,
1493 basic_block *then_block,
1494 basic_block *fallthrough_block)
1496 gimple_stmt_iterator gsi = *iter;
1498 if (!gsi_end_p (gsi) && before_p)
1499 gsi_prev (&gsi);
1501 basic_block cur_bb = gsi_bb (*iter);
1503 edge e = split_block (cur_bb, gsi_stmt (gsi));
1505 /* Get a hold on the 'condition block', the 'then block' and the
1506 'else block'. */
1507 basic_block cond_bb = e->src;
1508 basic_block fallthru_bb = e->dest;
1509 basic_block then_bb = create_empty_bb (cond_bb);
1510 if (current_loops)
1512 add_bb_to_loop (then_bb, cond_bb->loop_father);
1513 loops_state_set (LOOPS_NEED_FIXUP);
1516 /* Set up the newly created 'then block'. */
1517 e = make_edge (cond_bb, then_bb, EDGE_TRUE_VALUE);
1518 int fallthrough_probability
1519 = then_more_likely_p
1520 ? PROB_VERY_UNLIKELY
1521 : PROB_ALWAYS - PROB_VERY_UNLIKELY;
1522 e->probability = PROB_ALWAYS - fallthrough_probability;
1523 if (create_then_fallthru_edge)
1524 make_single_succ_edge (then_bb, fallthru_bb, EDGE_FALLTHRU);
1526 /* Set up the fallthrough basic block. */
1527 e = find_edge (cond_bb, fallthru_bb);
1528 e->flags = EDGE_FALSE_VALUE;
1529 e->count = cond_bb->count;
1530 e->probability = fallthrough_probability;
1532 /* Update dominance info for the newly created then_bb; note that
1533 fallthru_bb's dominance info has already been updated by
1534 split_bock. */
1535 if (dom_info_available_p (CDI_DOMINATORS))
1536 set_immediate_dominator (CDI_DOMINATORS, then_bb, cond_bb);
1538 *then_block = then_bb;
1539 *fallthrough_block = fallthru_bb;
1540 *iter = gsi_start_bb (fallthru_bb);
1542 return gsi_last_bb (cond_bb);
1545 /* Insert an if condition followed by a 'then block' right before the
1546 statement pointed to by ITER. The fallthrough block -- which is the
1547 else block of the condition as well as the destination of the
1548 outcoming edge of the 'then block' -- starts with the statement
1549 pointed to by ITER.
1551 COND is the condition of the if.
1553 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1554 'then block' is higher than the probability of the edge to the
1555 fallthrough block.
1557 Upon completion of the function, *THEN_BB is set to the newly
1558 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1559 fallthrough block.
1561 *ITER is adjusted to still point to the same statement it was
1562 pointing to initially. */
1564 static void
1565 insert_if_then_before_iter (gcond *cond,
1566 gimple_stmt_iterator *iter,
1567 bool then_more_likely_p,
1568 basic_block *then_bb,
1569 basic_block *fallthrough_bb)
1571 gimple_stmt_iterator cond_insert_point =
1572 create_cond_insert_point (iter,
1573 /*before_p=*/true,
1574 then_more_likely_p,
1575 /*create_then_fallthru_edge=*/true,
1576 then_bb,
1577 fallthrough_bb);
1578 gsi_insert_after (&cond_insert_point, cond, GSI_NEW_STMT);
1581 /* Build
1582 (base_addr >> ASAN_SHADOW_SHIFT) + asan_shadow_offset (). */
1584 static tree
1585 build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
1586 tree base_addr, tree shadow_ptr_type)
1588 tree t, uintptr_type = TREE_TYPE (base_addr);
1589 tree shadow_type = TREE_TYPE (shadow_ptr_type);
1590 gimple *g;
1592 t = build_int_cst (uintptr_type, ASAN_SHADOW_SHIFT);
1593 g = gimple_build_assign (make_ssa_name (uintptr_type), RSHIFT_EXPR,
1594 base_addr, t);
1595 gimple_set_location (g, location);
1596 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1598 t = build_int_cst (uintptr_type, asan_shadow_offset ());
1599 g = gimple_build_assign (make_ssa_name (uintptr_type), PLUS_EXPR,
1600 gimple_assign_lhs (g), t);
1601 gimple_set_location (g, location);
1602 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1604 g = gimple_build_assign (make_ssa_name (shadow_ptr_type), NOP_EXPR,
1605 gimple_assign_lhs (g));
1606 gimple_set_location (g, location);
1607 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1609 t = build2 (MEM_REF, shadow_type, gimple_assign_lhs (g),
1610 build_int_cst (shadow_ptr_type, 0));
1611 g = gimple_build_assign (make_ssa_name (shadow_type), MEM_REF, t);
1612 gimple_set_location (g, location);
1613 gsi_insert_after (gsi, g, GSI_NEW_STMT);
1614 return gimple_assign_lhs (g);
1617 /* BASE can already be an SSA_NAME; in that case, do not create a
1618 new SSA_NAME for it. */
1620 static tree
1621 maybe_create_ssa_name (location_t loc, tree base, gimple_stmt_iterator *iter,
1622 bool before_p)
1624 if (TREE_CODE (base) == SSA_NAME)
1625 return base;
1626 gimple *g = gimple_build_assign (make_ssa_name (TREE_TYPE (base)),
1627 TREE_CODE (base), base);
1628 gimple_set_location (g, loc);
1629 if (before_p)
1630 gsi_insert_before (iter, g, GSI_SAME_STMT);
1631 else
1632 gsi_insert_after (iter, g, GSI_NEW_STMT);
1633 return gimple_assign_lhs (g);
1636 /* LEN can already have necessary size and precision;
1637 in that case, do not create a new variable. */
1639 tree
1640 maybe_cast_to_ptrmode (location_t loc, tree len, gimple_stmt_iterator *iter,
1641 bool before_p)
1643 if (ptrofftype_p (len))
1644 return len;
1645 gimple *g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
1646 NOP_EXPR, len);
1647 gimple_set_location (g, loc);
1648 if (before_p)
1649 gsi_insert_before (iter, g, GSI_SAME_STMT);
1650 else
1651 gsi_insert_after (iter, g, GSI_NEW_STMT);
1652 return gimple_assign_lhs (g);
1655 /* Instrument the memory access instruction BASE. Insert new
1656 statements before or after ITER.
1658 Note that the memory access represented by BASE can be either an
1659 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1660 location. IS_STORE is TRUE for a store, FALSE for a load.
1661 BEFORE_P is TRUE for inserting the instrumentation code before
1662 ITER, FALSE for inserting it after ITER. IS_SCALAR_ACCESS is TRUE
1663 for a scalar memory access and FALSE for memory region access.
1664 NON_ZERO_P is TRUE if memory region is guaranteed to have non-zero
1665 length. ALIGN tells alignment of accessed memory object.
1667 START_INSTRUMENTED and END_INSTRUMENTED are TRUE if start/end of
1668 memory region have already been instrumented.
1670 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1671 statement it was pointing to prior to calling this function,
1672 otherwise, it points to the statement logically following it. */
1674 static void
1675 build_check_stmt (location_t loc, tree base, tree len,
1676 HOST_WIDE_INT size_in_bytes, gimple_stmt_iterator *iter,
1677 bool is_non_zero_len, bool before_p, bool is_store,
1678 bool is_scalar_access, unsigned int align = 0)
1680 gimple_stmt_iterator gsi = *iter;
1681 gimple *g;
1683 gcc_assert (!(size_in_bytes > 0 && !is_non_zero_len));
1685 gsi = *iter;
1687 base = unshare_expr (base);
1688 base = maybe_create_ssa_name (loc, base, &gsi, before_p);
1690 if (len)
1692 len = unshare_expr (len);
1693 len = maybe_cast_to_ptrmode (loc, len, iter, before_p);
1695 else
1697 gcc_assert (size_in_bytes != -1);
1698 len = build_int_cst (pointer_sized_int_node, size_in_bytes);
1701 if (size_in_bytes > 1)
1703 if ((size_in_bytes & (size_in_bytes - 1)) != 0
1704 || size_in_bytes > 16)
1705 is_scalar_access = false;
1706 else if (align && align < size_in_bytes * BITS_PER_UNIT)
1708 /* On non-strict alignment targets, if
1709 16-byte access is just 8-byte aligned,
1710 this will result in misaligned shadow
1711 memory 2 byte load, but otherwise can
1712 be handled using one read. */
1713 if (size_in_bytes != 16
1714 || STRICT_ALIGNMENT
1715 || align < 8 * BITS_PER_UNIT)
1716 is_scalar_access = false;
1720 HOST_WIDE_INT flags = 0;
1721 if (is_store)
1722 flags |= ASAN_CHECK_STORE;
1723 if (is_non_zero_len)
1724 flags |= ASAN_CHECK_NON_ZERO_LEN;
1725 if (is_scalar_access)
1726 flags |= ASAN_CHECK_SCALAR_ACCESS;
1728 g = gimple_build_call_internal (IFN_ASAN_CHECK, 4,
1729 build_int_cst (integer_type_node, flags),
1730 base, len,
1731 build_int_cst (integer_type_node,
1732 align / BITS_PER_UNIT));
1733 gimple_set_location (g, loc);
1734 if (before_p)
1735 gsi_insert_before (&gsi, g, GSI_SAME_STMT);
1736 else
1738 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
1739 gsi_next (&gsi);
1740 *iter = gsi;
1744 /* If T represents a memory access, add instrumentation code before ITER.
1745 LOCATION is source code location.
1746 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
1748 static void
1749 instrument_derefs (gimple_stmt_iterator *iter, tree t,
1750 location_t location, bool is_store)
1752 if (is_store && !ASAN_INSTRUMENT_WRITES)
1753 return;
1754 if (!is_store && !ASAN_INSTRUMENT_READS)
1755 return;
1757 tree type, base;
1758 HOST_WIDE_INT size_in_bytes;
1760 type = TREE_TYPE (t);
1761 switch (TREE_CODE (t))
1763 case ARRAY_REF:
1764 case COMPONENT_REF:
1765 case INDIRECT_REF:
1766 case MEM_REF:
1767 case VAR_DECL:
1768 case BIT_FIELD_REF:
1769 break;
1770 /* FALLTHRU */
1771 default:
1772 return;
1775 size_in_bytes = int_size_in_bytes (type);
1776 if (size_in_bytes <= 0)
1777 return;
1779 HOST_WIDE_INT bitsize, bitpos;
1780 tree offset;
1781 machine_mode mode;
1782 int unsignedp, reversep, volatilep = 0;
1783 tree inner = get_inner_reference (t, &bitsize, &bitpos, &offset, &mode,
1784 &unsignedp, &reversep, &volatilep, false);
1786 if (TREE_CODE (t) == COMPONENT_REF
1787 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1)) != NULL_TREE)
1789 tree repr = DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t, 1));
1790 instrument_derefs (iter, build3 (COMPONENT_REF, TREE_TYPE (repr),
1791 TREE_OPERAND (t, 0), repr,
1792 NULL_TREE), location, is_store);
1793 return;
1796 if (bitpos % BITS_PER_UNIT
1797 || bitsize != size_in_bytes * BITS_PER_UNIT)
1798 return;
1800 if (TREE_CODE (inner) == VAR_DECL
1801 && offset == NULL_TREE
1802 && bitpos >= 0
1803 && DECL_SIZE (inner)
1804 && tree_fits_shwi_p (DECL_SIZE (inner))
1805 && bitpos + bitsize <= tree_to_shwi (DECL_SIZE (inner)))
1807 if (DECL_THREAD_LOCAL_P (inner))
1808 return;
1809 if (!ASAN_GLOBALS && is_global_var (inner))
1810 return;
1811 if (!TREE_STATIC (inner))
1813 /* Automatic vars in the current function will be always
1814 accessible. */
1815 if (decl_function_context (inner) == current_function_decl)
1816 return;
1818 /* Always instrument external vars, they might be dynamically
1819 initialized. */
1820 else if (!DECL_EXTERNAL (inner))
1822 /* For static vars if they are known not to be dynamically
1823 initialized, they will be always accessible. */
1824 varpool_node *vnode = varpool_node::get (inner);
1825 if (vnode && !vnode->dynamically_initialized)
1826 return;
1830 base = build_fold_addr_expr (t);
1831 if (!has_mem_ref_been_instrumented (base, size_in_bytes))
1833 unsigned int align = get_object_alignment (t);
1834 build_check_stmt (location, base, NULL_TREE, size_in_bytes, iter,
1835 /*is_non_zero_len*/size_in_bytes > 0, /*before_p=*/true,
1836 is_store, /*is_scalar_access*/true, align);
1837 update_mem_ref_hash_table (base, size_in_bytes);
1838 update_mem_ref_hash_table (t, size_in_bytes);
1843 /* Insert a memory reference into the hash table if access length
1844 can be determined in compile time. */
1846 static void
1847 maybe_update_mem_ref_hash_table (tree base, tree len)
1849 if (!POINTER_TYPE_P (TREE_TYPE (base))
1850 || !INTEGRAL_TYPE_P (TREE_TYPE (len)))
1851 return;
1853 HOST_WIDE_INT size_in_bytes = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
1855 if (size_in_bytes != -1)
1856 update_mem_ref_hash_table (base, size_in_bytes);
1859 /* Instrument an access to a contiguous memory region that starts at
1860 the address pointed to by BASE, over a length of LEN (expressed in
1861 the sizeof (*BASE) bytes). ITER points to the instruction before
1862 which the instrumentation instructions must be inserted. LOCATION
1863 is the source location that the instrumentation instructions must
1864 have. If IS_STORE is true, then the memory access is a store;
1865 otherwise, it's a load. */
1867 static void
1868 instrument_mem_region_access (tree base, tree len,
1869 gimple_stmt_iterator *iter,
1870 location_t location, bool is_store)
1872 if (!POINTER_TYPE_P (TREE_TYPE (base))
1873 || !INTEGRAL_TYPE_P (TREE_TYPE (len))
1874 || integer_zerop (len))
1875 return;
1877 HOST_WIDE_INT size_in_bytes = tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
1879 if ((size_in_bytes == -1)
1880 || !has_mem_ref_been_instrumented (base, size_in_bytes))
1882 build_check_stmt (location, base, len, size_in_bytes, iter,
1883 /*is_non_zero_len*/size_in_bytes > 0, /*before_p*/true,
1884 is_store, /*is_scalar_access*/false, /*align*/0);
1887 maybe_update_mem_ref_hash_table (base, len);
1888 *iter = gsi_for_stmt (gsi_stmt (*iter));
1891 /* Instrument the call to a built-in memory access function that is
1892 pointed to by the iterator ITER.
1894 Upon completion, return TRUE iff *ITER has been advanced to the
1895 statement following the one it was originally pointing to. */
1897 static bool
1898 instrument_builtin_call (gimple_stmt_iterator *iter)
1900 if (!ASAN_MEMINTRIN)
1901 return false;
1903 bool iter_advanced_p = false;
1904 gcall *call = as_a <gcall *> (gsi_stmt (*iter));
1906 gcc_checking_assert (gimple_call_builtin_p (call, BUILT_IN_NORMAL));
1908 location_t loc = gimple_location (call);
1910 asan_mem_ref src0, src1, dest;
1911 asan_mem_ref_init (&src0, NULL, 1);
1912 asan_mem_ref_init (&src1, NULL, 1);
1913 asan_mem_ref_init (&dest, NULL, 1);
1915 tree src0_len = NULL_TREE, src1_len = NULL_TREE, dest_len = NULL_TREE;
1916 bool src0_is_store = false, src1_is_store = false, dest_is_store = false,
1917 dest_is_deref = false, intercepted_p = true;
1919 if (get_mem_refs_of_builtin_call (call,
1920 &src0, &src0_len, &src0_is_store,
1921 &src1, &src1_len, &src1_is_store,
1922 &dest, &dest_len, &dest_is_store,
1923 &dest_is_deref, &intercepted_p))
1925 if (dest_is_deref)
1927 instrument_derefs (iter, dest.start, loc, dest_is_store);
1928 gsi_next (iter);
1929 iter_advanced_p = true;
1931 else if (!intercepted_p
1932 && (src0_len || src1_len || dest_len))
1934 if (src0.start != NULL_TREE)
1935 instrument_mem_region_access (src0.start, src0_len,
1936 iter, loc, /*is_store=*/false);
1937 if (src1.start != NULL_TREE)
1938 instrument_mem_region_access (src1.start, src1_len,
1939 iter, loc, /*is_store=*/false);
1940 if (dest.start != NULL_TREE)
1941 instrument_mem_region_access (dest.start, dest_len,
1942 iter, loc, /*is_store=*/true);
1944 *iter = gsi_for_stmt (call);
1945 gsi_next (iter);
1946 iter_advanced_p = true;
1948 else
1950 if (src0.start != NULL_TREE)
1951 maybe_update_mem_ref_hash_table (src0.start, src0_len);
1952 if (src1.start != NULL_TREE)
1953 maybe_update_mem_ref_hash_table (src1.start, src1_len);
1954 if (dest.start != NULL_TREE)
1955 maybe_update_mem_ref_hash_table (dest.start, dest_len);
1958 return iter_advanced_p;
1961 /* Instrument the assignment statement ITER if it is subject to
1962 instrumentation. Return TRUE iff instrumentation actually
1963 happened. In that case, the iterator ITER is advanced to the next
1964 logical expression following the one initially pointed to by ITER,
1965 and the relevant memory reference that which access has been
1966 instrumented is added to the memory references hash table. */
1968 static bool
1969 maybe_instrument_assignment (gimple_stmt_iterator *iter)
1971 gimple *s = gsi_stmt (*iter);
1973 gcc_assert (gimple_assign_single_p (s));
1975 tree ref_expr = NULL_TREE;
1976 bool is_store, is_instrumented = false;
1978 if (gimple_store_p (s))
1980 ref_expr = gimple_assign_lhs (s);
1981 is_store = true;
1982 instrument_derefs (iter, ref_expr,
1983 gimple_location (s),
1984 is_store);
1985 is_instrumented = true;
1988 if (gimple_assign_load_p (s))
1990 ref_expr = gimple_assign_rhs1 (s);
1991 is_store = false;
1992 instrument_derefs (iter, ref_expr,
1993 gimple_location (s),
1994 is_store);
1995 is_instrumented = true;
1998 if (is_instrumented)
1999 gsi_next (iter);
2001 return is_instrumented;
2004 /* Instrument the function call pointed to by the iterator ITER, if it
2005 is subject to instrumentation. At the moment, the only function
2006 calls that are instrumented are some built-in functions that access
2007 memory. Look at instrument_builtin_call to learn more.
2009 Upon completion return TRUE iff *ITER was advanced to the statement
2010 following the one it was originally pointing to. */
2012 static bool
2013 maybe_instrument_call (gimple_stmt_iterator *iter)
2015 gimple *stmt = gsi_stmt (*iter);
2016 bool is_builtin = gimple_call_builtin_p (stmt, BUILT_IN_NORMAL);
2018 if (is_builtin && instrument_builtin_call (iter))
2019 return true;
2021 if (gimple_call_noreturn_p (stmt))
2023 if (is_builtin)
2025 tree callee = gimple_call_fndecl (stmt);
2026 switch (DECL_FUNCTION_CODE (callee))
2028 case BUILT_IN_UNREACHABLE:
2029 case BUILT_IN_TRAP:
2030 /* Don't instrument these. */
2031 return false;
2032 default:
2033 break;
2036 tree decl = builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN);
2037 gimple *g = gimple_build_call (decl, 0);
2038 gimple_set_location (g, gimple_location (stmt));
2039 gsi_insert_before (iter, g, GSI_SAME_STMT);
2041 return false;
2044 /* Walk each instruction of all basic block and instrument those that
2045 represent memory references: loads, stores, or function calls.
2046 In a given basic block, this function avoids instrumenting memory
2047 references that have already been instrumented. */
2049 static void
2050 transform_statements (void)
2052 basic_block bb, last_bb = NULL;
2053 gimple_stmt_iterator i;
2054 int saved_last_basic_block = last_basic_block_for_fn (cfun);
2056 FOR_EACH_BB_FN (bb, cfun)
2058 basic_block prev_bb = bb;
2060 if (bb->index >= saved_last_basic_block) continue;
2062 /* Flush the mem ref hash table, if current bb doesn't have
2063 exactly one predecessor, or if that predecessor (skipping
2064 over asan created basic blocks) isn't the last processed
2065 basic block. Thus we effectively flush on extended basic
2066 block boundaries. */
2067 while (single_pred_p (prev_bb))
2069 prev_bb = single_pred (prev_bb);
2070 if (prev_bb->index < saved_last_basic_block)
2071 break;
2073 if (prev_bb != last_bb)
2074 empty_mem_ref_hash_table ();
2075 last_bb = bb;
2077 for (i = gsi_start_bb (bb); !gsi_end_p (i);)
2079 gimple *s = gsi_stmt (i);
2081 if (has_stmt_been_instrumented_p (s))
2082 gsi_next (&i);
2083 else if (gimple_assign_single_p (s)
2084 && !gimple_clobber_p (s)
2085 && maybe_instrument_assignment (&i))
2086 /* Nothing to do as maybe_instrument_assignment advanced
2087 the iterator I. */;
2088 else if (is_gimple_call (s) && maybe_instrument_call (&i))
2089 /* Nothing to do as maybe_instrument_call
2090 advanced the iterator I. */;
2091 else
2093 /* No instrumentation happened.
2095 If the current instruction is a function call that
2096 might free something, let's forget about the memory
2097 references that got instrumented. Otherwise we might
2098 miss some instrumentation opportunities. */
2099 if (is_gimple_call (s) && !nonfreeing_call_p (s))
2100 empty_mem_ref_hash_table ();
2102 gsi_next (&i);
2106 free_mem_ref_resources ();
2109 /* Build
2110 __asan_before_dynamic_init (module_name)
2112 __asan_after_dynamic_init ()
2113 call. */
2115 tree
2116 asan_dynamic_init_call (bool after_p)
2118 tree fn = builtin_decl_implicit (after_p
2119 ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
2120 : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT);
2121 tree module_name_cst = NULL_TREE;
2122 if (!after_p)
2124 pretty_printer module_name_pp;
2125 pp_string (&module_name_pp, main_input_filename);
2127 if (shadow_ptr_types[0] == NULL_TREE)
2128 asan_init_shadow_ptr_types ();
2129 module_name_cst = asan_pp_string (&module_name_pp);
2130 module_name_cst = fold_convert (const_ptr_type_node,
2131 module_name_cst);
2134 return build_call_expr (fn, after_p ? 0 : 1, module_name_cst);
2137 /* Build
2138 struct __asan_global
2140 const void *__beg;
2141 uptr __size;
2142 uptr __size_with_redzone;
2143 const void *__name;
2144 const void *__module_name;
2145 uptr __has_dynamic_init;
2146 __asan_global_source_location *__location;
2147 } type. */
2149 static tree
2150 asan_global_struct (void)
2152 static const char *field_names[7]
2153 = { "__beg", "__size", "__size_with_redzone",
2154 "__name", "__module_name", "__has_dynamic_init", "__location"};
2155 tree fields[7], ret;
2156 int i;
2158 ret = make_node (RECORD_TYPE);
2159 for (i = 0; i < 7; i++)
2161 fields[i]
2162 = build_decl (UNKNOWN_LOCATION, FIELD_DECL,
2163 get_identifier (field_names[i]),
2164 (i == 0 || i == 3) ? const_ptr_type_node
2165 : pointer_sized_int_node);
2166 DECL_CONTEXT (fields[i]) = ret;
2167 if (i)
2168 DECL_CHAIN (fields[i - 1]) = fields[i];
2170 tree type_decl = build_decl (input_location, TYPE_DECL,
2171 get_identifier ("__asan_global"), ret);
2172 DECL_IGNORED_P (type_decl) = 1;
2173 DECL_ARTIFICIAL (type_decl) = 1;
2174 TYPE_FIELDS (ret) = fields[0];
2175 TYPE_NAME (ret) = type_decl;
2176 TYPE_STUB_DECL (ret) = type_decl;
2177 layout_type (ret);
2178 return ret;
2181 /* Append description of a single global DECL into vector V.
2182 TYPE is __asan_global struct type as returned by asan_global_struct. */
2184 static void
2185 asan_add_global (tree decl, tree type, vec<constructor_elt, va_gc> *v)
2187 tree init, uptr = TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type)));
2188 unsigned HOST_WIDE_INT size;
2189 tree str_cst, module_name_cst, refdecl = decl;
2190 vec<constructor_elt, va_gc> *vinner = NULL;
2192 pretty_printer asan_pp, module_name_pp;
2194 if (DECL_NAME (decl))
2195 pp_tree_identifier (&asan_pp, DECL_NAME (decl));
2196 else
2197 pp_string (&asan_pp, "<unknown>");
2198 str_cst = asan_pp_string (&asan_pp);
2200 pp_string (&module_name_pp, main_input_filename);
2201 module_name_cst = asan_pp_string (&module_name_pp);
2203 if (asan_needs_local_alias (decl))
2205 char buf[20];
2206 ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", vec_safe_length (v) + 1);
2207 refdecl = build_decl (DECL_SOURCE_LOCATION (decl),
2208 VAR_DECL, get_identifier (buf), TREE_TYPE (decl));
2209 TREE_ADDRESSABLE (refdecl) = TREE_ADDRESSABLE (decl);
2210 TREE_READONLY (refdecl) = TREE_READONLY (decl);
2211 TREE_THIS_VOLATILE (refdecl) = TREE_THIS_VOLATILE (decl);
2212 DECL_GIMPLE_REG_P (refdecl) = DECL_GIMPLE_REG_P (decl);
2213 DECL_ARTIFICIAL (refdecl) = DECL_ARTIFICIAL (decl);
2214 DECL_IGNORED_P (refdecl) = DECL_IGNORED_P (decl);
2215 TREE_STATIC (refdecl) = 1;
2216 TREE_PUBLIC (refdecl) = 0;
2217 TREE_USED (refdecl) = 1;
2218 assemble_alias (refdecl, DECL_ASSEMBLER_NAME (decl));
2221 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2222 fold_convert (const_ptr_type_node,
2223 build_fold_addr_expr (refdecl)));
2224 size = tree_to_uhwi (DECL_SIZE_UNIT (decl));
2225 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size));
2226 size += asan_red_zone_size (size);
2227 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, build_int_cst (uptr, size));
2228 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2229 fold_convert (const_ptr_type_node, str_cst));
2230 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2231 fold_convert (const_ptr_type_node, module_name_cst));
2232 varpool_node *vnode = varpool_node::get (decl);
2233 int has_dynamic_init = vnode ? vnode->dynamically_initialized : 0;
2234 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE,
2235 build_int_cst (uptr, has_dynamic_init));
2236 tree locptr = NULL_TREE;
2237 location_t loc = DECL_SOURCE_LOCATION (decl);
2238 expanded_location xloc = expand_location (loc);
2239 if (xloc.file != NULL)
2241 static int lasanloccnt = 0;
2242 char buf[25];
2243 ASM_GENERATE_INTERNAL_LABEL (buf, "LASANLOC", ++lasanloccnt);
2244 tree var = build_decl (UNKNOWN_LOCATION, VAR_DECL, get_identifier (buf),
2245 ubsan_get_source_location_type ());
2246 TREE_STATIC (var) = 1;
2247 TREE_PUBLIC (var) = 0;
2248 DECL_ARTIFICIAL (var) = 1;
2249 DECL_IGNORED_P (var) = 1;
2250 pretty_printer filename_pp;
2251 pp_string (&filename_pp, xloc.file);
2252 tree str = asan_pp_string (&filename_pp);
2253 tree ctor = build_constructor_va (TREE_TYPE (var), 3,
2254 NULL_TREE, str, NULL_TREE,
2255 build_int_cst (unsigned_type_node,
2256 xloc.line), NULL_TREE,
2257 build_int_cst (unsigned_type_node,
2258 xloc.column));
2259 TREE_CONSTANT (ctor) = 1;
2260 TREE_STATIC (ctor) = 1;
2261 DECL_INITIAL (var) = ctor;
2262 varpool_node::finalize_decl (var);
2263 locptr = fold_convert (uptr, build_fold_addr_expr (var));
2265 else
2266 locptr = build_int_cst (uptr, 0);
2267 CONSTRUCTOR_APPEND_ELT (vinner, NULL_TREE, locptr);
2268 init = build_constructor (type, vinner);
2269 CONSTRUCTOR_APPEND_ELT (v, NULL_TREE, init);
2272 /* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2273 void
2274 initialize_sanitizer_builtins (void)
2276 tree decl;
2278 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT))
2279 return;
2281 tree BT_FN_VOID = build_function_type_list (void_type_node, NULL_TREE);
2282 tree BT_FN_VOID_PTR
2283 = build_function_type_list (void_type_node, ptr_type_node, NULL_TREE);
2284 tree BT_FN_VOID_CONST_PTR
2285 = build_function_type_list (void_type_node, const_ptr_type_node, NULL_TREE);
2286 tree BT_FN_VOID_PTR_PTR
2287 = build_function_type_list (void_type_node, ptr_type_node,
2288 ptr_type_node, NULL_TREE);
2289 tree BT_FN_VOID_PTR_PTR_PTR
2290 = build_function_type_list (void_type_node, ptr_type_node,
2291 ptr_type_node, ptr_type_node, NULL_TREE);
2292 tree BT_FN_VOID_PTR_PTRMODE
2293 = build_function_type_list (void_type_node, ptr_type_node,
2294 pointer_sized_int_node, NULL_TREE);
2295 tree BT_FN_VOID_INT
2296 = build_function_type_list (void_type_node, integer_type_node, NULL_TREE);
2297 tree BT_FN_SIZE_CONST_PTR_INT
2298 = build_function_type_list (size_type_node, const_ptr_type_node,
2299 integer_type_node, NULL_TREE);
2300 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT[5];
2301 tree BT_FN_IX_CONST_VPTR_INT[5];
2302 tree BT_FN_IX_VPTR_IX_INT[5];
2303 tree BT_FN_VOID_VPTR_IX_INT[5];
2304 tree vptr
2305 = build_pointer_type (build_qualified_type (void_type_node,
2306 TYPE_QUAL_VOLATILE));
2307 tree cvptr
2308 = build_pointer_type (build_qualified_type (void_type_node,
2309 TYPE_QUAL_VOLATILE
2310 |TYPE_QUAL_CONST));
2311 tree boolt
2312 = lang_hooks.types.type_for_size (BOOL_TYPE_SIZE, 1);
2313 int i;
2314 for (i = 0; i < 5; i++)
2316 tree ix = build_nonstandard_integer_type (BITS_PER_UNIT * (1 << i), 1);
2317 BT_FN_BOOL_VPTR_PTR_IX_INT_INT[i]
2318 = build_function_type_list (boolt, vptr, ptr_type_node, ix,
2319 integer_type_node, integer_type_node,
2320 NULL_TREE);
2321 BT_FN_IX_CONST_VPTR_INT[i]
2322 = build_function_type_list (ix, cvptr, integer_type_node, NULL_TREE);
2323 BT_FN_IX_VPTR_IX_INT[i]
2324 = build_function_type_list (ix, vptr, ix, integer_type_node,
2325 NULL_TREE);
2326 BT_FN_VOID_VPTR_IX_INT[i]
2327 = build_function_type_list (void_type_node, vptr, ix,
2328 integer_type_node, NULL_TREE);
2330 #define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2331 #define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2332 #define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2333 #define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2334 #define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2335 #define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2336 #define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2337 #define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2338 #define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2339 #define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2340 #define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2341 #define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2342 #define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2343 #define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2344 #define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2345 #define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2346 #define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2347 #define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2348 #define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2349 #define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2350 #undef ATTR_NOTHROW_LEAF_LIST
2351 #define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2352 #undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2353 #define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2354 #undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2355 #define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2356 #undef ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2357 #define ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST \
2358 ECF_CONST | ATTR_NORETURN_NOTHROW_LEAF_LIST
2359 #undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2360 #define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2361 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2362 #undef ATTR_COLD_NOTHROW_LEAF_LIST
2363 #define ATTR_COLD_NOTHROW_LEAF_LIST \
2364 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2365 #undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2366 #define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2367 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2368 #undef ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST
2369 #define ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST \
2370 /* ECF_COLD missing */ ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2371 #undef ATTR_PURE_NOTHROW_LEAF_LIST
2372 #define ATTR_PURE_NOTHROW_LEAF_LIST ECF_PURE | ATTR_NOTHROW_LEAF_LIST
2373 #undef DEF_SANITIZER_BUILTIN
2374 #define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2375 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2376 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2377 set_call_expr_flags (decl, ATTRS); \
2378 set_builtin_decl (ENUM, decl, true);
2380 #include "sanitizer.def"
2382 /* -fsanitize=object-size uses __builtin_object_size, but that might
2383 not be available for e.g. Fortran at this point. We use
2384 DEF_SANITIZER_BUILTIN here only as a convenience macro. */
2385 if ((flag_sanitize & SANITIZE_OBJECT_SIZE)
2386 && !builtin_decl_implicit_p (BUILT_IN_OBJECT_SIZE))
2387 DEF_SANITIZER_BUILTIN (BUILT_IN_OBJECT_SIZE, "object_size",
2388 BT_FN_SIZE_CONST_PTR_INT,
2389 ATTR_PURE_NOTHROW_LEAF_LIST)
2391 #undef DEF_SANITIZER_BUILTIN
2394 /* Called via htab_traverse. Count number of emitted
2395 STRING_CSTs in the constant hash table. */
2398 count_string_csts (constant_descriptor_tree **slot,
2399 unsigned HOST_WIDE_INT *data)
2401 struct constant_descriptor_tree *desc = *slot;
2402 if (TREE_CODE (desc->value) == STRING_CST
2403 && TREE_ASM_WRITTEN (desc->value)
2404 && asan_protect_global (desc->value))
2405 ++*data;
2406 return 1;
2409 /* Helper structure to pass two parameters to
2410 add_string_csts. */
2412 struct asan_add_string_csts_data
2414 tree type;
2415 vec<constructor_elt, va_gc> *v;
2418 /* Called via hash_table::traverse. Call asan_add_global
2419 on emitted STRING_CSTs from the constant hash table. */
2422 add_string_csts (constant_descriptor_tree **slot,
2423 asan_add_string_csts_data *aascd)
2425 struct constant_descriptor_tree *desc = *slot;
2426 if (TREE_CODE (desc->value) == STRING_CST
2427 && TREE_ASM_WRITTEN (desc->value)
2428 && asan_protect_global (desc->value))
2430 asan_add_global (SYMBOL_REF_DECL (XEXP (desc->rtl, 0)),
2431 aascd->type, aascd->v);
2433 return 1;
2436 /* Needs to be GTY(()), because cgraph_build_static_cdtor may
2437 invoke ggc_collect. */
2438 static GTY(()) tree asan_ctor_statements;
2440 /* Module-level instrumentation.
2441 - Insert __asan_init_vN() into the list of CTORs.
2442 - TODO: insert redzones around globals.
2445 void
2446 asan_finish_file (void)
2448 varpool_node *vnode;
2449 unsigned HOST_WIDE_INT gcount = 0;
2451 if (shadow_ptr_types[0] == NULL_TREE)
2452 asan_init_shadow_ptr_types ();
2453 /* Avoid instrumenting code in the asan ctors/dtors.
2454 We don't need to insert padding after the description strings,
2455 nor after .LASAN* array. */
2456 flag_sanitize &= ~SANITIZE_ADDRESS;
2458 /* For user-space we want asan constructors to run first.
2459 Linux kernel does not support priorities other than default, and the only
2460 other user of constructors is coverage. So we run with the default
2461 priority. */
2462 int priority = flag_sanitize & SANITIZE_USER_ADDRESS
2463 ? MAX_RESERVED_INIT_PRIORITY - 1 : DEFAULT_INIT_PRIORITY;
2465 if (flag_sanitize & SANITIZE_USER_ADDRESS)
2467 tree fn = builtin_decl_implicit (BUILT_IN_ASAN_INIT);
2468 append_to_statement_list (build_call_expr (fn, 0), &asan_ctor_statements);
2469 fn = builtin_decl_implicit (BUILT_IN_ASAN_VERSION_MISMATCH_CHECK);
2470 append_to_statement_list (build_call_expr (fn, 0), &asan_ctor_statements);
2472 FOR_EACH_DEFINED_VARIABLE (vnode)
2473 if (TREE_ASM_WRITTEN (vnode->decl)
2474 && asan_protect_global (vnode->decl))
2475 ++gcount;
2476 hash_table<tree_descriptor_hasher> *const_desc_htab = constant_pool_htab ();
2477 const_desc_htab->traverse<unsigned HOST_WIDE_INT *, count_string_csts>
2478 (&gcount);
2479 if (gcount)
2481 tree type = asan_global_struct (), var, ctor;
2482 tree dtor_statements = NULL_TREE;
2483 vec<constructor_elt, va_gc> *v;
2484 char buf[20];
2486 type = build_array_type_nelts (type, gcount);
2487 ASM_GENERATE_INTERNAL_LABEL (buf, "LASAN", 0);
2488 var = build_decl (UNKNOWN_LOCATION, VAR_DECL, get_identifier (buf),
2489 type);
2490 TREE_STATIC (var) = 1;
2491 TREE_PUBLIC (var) = 0;
2492 DECL_ARTIFICIAL (var) = 1;
2493 DECL_IGNORED_P (var) = 1;
2494 vec_alloc (v, gcount);
2495 FOR_EACH_DEFINED_VARIABLE (vnode)
2496 if (TREE_ASM_WRITTEN (vnode->decl)
2497 && asan_protect_global (vnode->decl))
2498 asan_add_global (vnode->decl, TREE_TYPE (type), v);
2499 struct asan_add_string_csts_data aascd;
2500 aascd.type = TREE_TYPE (type);
2501 aascd.v = v;
2502 const_desc_htab->traverse<asan_add_string_csts_data *, add_string_csts>
2503 (&aascd);
2504 ctor = build_constructor (type, v);
2505 TREE_CONSTANT (ctor) = 1;
2506 TREE_STATIC (ctor) = 1;
2507 DECL_INITIAL (var) = ctor;
2508 varpool_node::finalize_decl (var);
2510 tree fn = builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS);
2511 tree gcount_tree = build_int_cst (pointer_sized_int_node, gcount);
2512 append_to_statement_list (build_call_expr (fn, 2,
2513 build_fold_addr_expr (var),
2514 gcount_tree),
2515 &asan_ctor_statements);
2517 fn = builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS);
2518 append_to_statement_list (build_call_expr (fn, 2,
2519 build_fold_addr_expr (var),
2520 gcount_tree),
2521 &dtor_statements);
2522 cgraph_build_static_cdtor ('D', dtor_statements, priority);
2524 if (asan_ctor_statements)
2525 cgraph_build_static_cdtor ('I', asan_ctor_statements, priority);
2526 flag_sanitize |= SANITIZE_ADDRESS;
2529 /* Expand the ASAN_{LOAD,STORE} builtins. */
2531 bool
2532 asan_expand_check_ifn (gimple_stmt_iterator *iter, bool use_calls)
2534 gimple *g = gsi_stmt (*iter);
2535 location_t loc = gimple_location (g);
2537 bool recover_p
2538 = (flag_sanitize & flag_sanitize_recover & SANITIZE_KERNEL_ADDRESS) != 0;
2540 HOST_WIDE_INT flags = tree_to_shwi (gimple_call_arg (g, 0));
2541 gcc_assert (flags < ASAN_CHECK_LAST);
2542 bool is_scalar_access = (flags & ASAN_CHECK_SCALAR_ACCESS) != 0;
2543 bool is_store = (flags & ASAN_CHECK_STORE) != 0;
2544 bool is_non_zero_len = (flags & ASAN_CHECK_NON_ZERO_LEN) != 0;
2546 tree base = gimple_call_arg (g, 1);
2547 tree len = gimple_call_arg (g, 2);
2548 HOST_WIDE_INT align = tree_to_shwi (gimple_call_arg (g, 3));
2550 HOST_WIDE_INT size_in_bytes
2551 = is_scalar_access && tree_fits_shwi_p (len) ? tree_to_shwi (len) : -1;
2553 if (use_calls)
2555 /* Instrument using callbacks. */
2556 gimple *g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
2557 NOP_EXPR, base);
2558 gimple_set_location (g, loc);
2559 gsi_insert_before (iter, g, GSI_SAME_STMT);
2560 tree base_addr = gimple_assign_lhs (g);
2562 int nargs;
2563 tree fun = check_func (is_store, recover_p, size_in_bytes, &nargs);
2564 if (nargs == 1)
2565 g = gimple_build_call (fun, 1, base_addr);
2566 else
2568 gcc_assert (nargs == 2);
2569 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
2570 NOP_EXPR, len);
2571 gimple_set_location (g, loc);
2572 gsi_insert_before (iter, g, GSI_SAME_STMT);
2573 tree sz_arg = gimple_assign_lhs (g);
2574 g = gimple_build_call (fun, nargs, base_addr, sz_arg);
2576 gimple_set_location (g, loc);
2577 gsi_replace (iter, g, false);
2578 return false;
2581 HOST_WIDE_INT real_size_in_bytes = size_in_bytes == -1 ? 1 : size_in_bytes;
2583 tree shadow_ptr_type = shadow_ptr_types[real_size_in_bytes == 16 ? 1 : 0];
2584 tree shadow_type = TREE_TYPE (shadow_ptr_type);
2586 gimple_stmt_iterator gsi = *iter;
2588 if (!is_non_zero_len)
2590 /* So, the length of the memory area to asan-protect is
2591 non-constant. Let's guard the generated instrumentation code
2592 like:
2594 if (len != 0)
2596 //asan instrumentation code goes here.
2598 // falltrough instructions, starting with *ITER. */
2600 g = gimple_build_cond (NE_EXPR,
2601 len,
2602 build_int_cst (TREE_TYPE (len), 0),
2603 NULL_TREE, NULL_TREE);
2604 gimple_set_location (g, loc);
2606 basic_block then_bb, fallthrough_bb;
2607 insert_if_then_before_iter (as_a <gcond *> (g), iter,
2608 /*then_more_likely_p=*/true,
2609 &then_bb, &fallthrough_bb);
2610 /* Note that fallthrough_bb starts with the statement that was
2611 pointed to by ITER. */
2613 /* The 'then block' of the 'if (len != 0) condition is where
2614 we'll generate the asan instrumentation code now. */
2615 gsi = gsi_last_bb (then_bb);
2618 /* Get an iterator on the point where we can add the condition
2619 statement for the instrumentation. */
2620 basic_block then_bb, else_bb;
2621 gsi = create_cond_insert_point (&gsi, /*before_p*/false,
2622 /*then_more_likely_p=*/false,
2623 /*create_then_fallthru_edge*/recover_p,
2624 &then_bb,
2625 &else_bb);
2627 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
2628 NOP_EXPR, base);
2629 gimple_set_location (g, loc);
2630 gsi_insert_before (&gsi, g, GSI_NEW_STMT);
2631 tree base_addr = gimple_assign_lhs (g);
2633 tree t = NULL_TREE;
2634 if (real_size_in_bytes >= 8)
2636 tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
2637 shadow_ptr_type);
2638 t = shadow;
2640 else
2642 /* Slow path for 1, 2 and 4 byte accesses. */
2643 /* Test (shadow != 0)
2644 & ((base_addr & 7) + (real_size_in_bytes - 1)) >= shadow). */
2645 tree shadow = build_shadow_mem_access (&gsi, loc, base_addr,
2646 shadow_ptr_type);
2647 gimple *shadow_test = build_assign (NE_EXPR, shadow, 0);
2648 gimple_seq seq = NULL;
2649 gimple_seq_add_stmt (&seq, shadow_test);
2650 /* Aligned (>= 8 bytes) can test just
2651 (real_size_in_bytes - 1 >= shadow), as base_addr & 7 is known
2652 to be 0. */
2653 if (align < 8)
2655 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR,
2656 base_addr, 7));
2657 gimple_seq_add_stmt (&seq,
2658 build_type_cast (shadow_type,
2659 gimple_seq_last (seq)));
2660 if (real_size_in_bytes > 1)
2661 gimple_seq_add_stmt (&seq,
2662 build_assign (PLUS_EXPR,
2663 gimple_seq_last (seq),
2664 real_size_in_bytes - 1));
2665 t = gimple_assign_lhs (gimple_seq_last_stmt (seq));
2667 else
2668 t = build_int_cst (shadow_type, real_size_in_bytes - 1);
2669 gimple_seq_add_stmt (&seq, build_assign (GE_EXPR, t, shadow));
2670 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
2671 gimple_seq_last (seq)));
2672 t = gimple_assign_lhs (gimple_seq_last (seq));
2673 gimple_seq_set_location (seq, loc);
2674 gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);
2676 /* For non-constant, misaligned or otherwise weird access sizes,
2677 check first and last byte. */
2678 if (size_in_bytes == -1)
2680 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
2681 MINUS_EXPR, len,
2682 build_int_cst (pointer_sized_int_node, 1));
2683 gimple_set_location (g, loc);
2684 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2685 tree last = gimple_assign_lhs (g);
2686 g = gimple_build_assign (make_ssa_name (pointer_sized_int_node),
2687 PLUS_EXPR, base_addr, last);
2688 gimple_set_location (g, loc);
2689 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2690 tree base_end_addr = gimple_assign_lhs (g);
2692 tree shadow = build_shadow_mem_access (&gsi, loc, base_end_addr,
2693 shadow_ptr_type);
2694 gimple *shadow_test = build_assign (NE_EXPR, shadow, 0);
2695 gimple_seq seq = NULL;
2696 gimple_seq_add_stmt (&seq, shadow_test);
2697 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR,
2698 base_end_addr, 7));
2699 gimple_seq_add_stmt (&seq, build_type_cast (shadow_type,
2700 gimple_seq_last (seq)));
2701 gimple_seq_add_stmt (&seq, build_assign (GE_EXPR,
2702 gimple_seq_last (seq),
2703 shadow));
2704 gimple_seq_add_stmt (&seq, build_assign (BIT_AND_EXPR, shadow_test,
2705 gimple_seq_last (seq)));
2706 gimple_seq_add_stmt (&seq, build_assign (BIT_IOR_EXPR, t,
2707 gimple_seq_last (seq)));
2708 t = gimple_assign_lhs (gimple_seq_last (seq));
2709 gimple_seq_set_location (seq, loc);
2710 gsi_insert_seq_after (&gsi, seq, GSI_CONTINUE_LINKING);
2714 g = gimple_build_cond (NE_EXPR, t, build_int_cst (TREE_TYPE (t), 0),
2715 NULL_TREE, NULL_TREE);
2716 gimple_set_location (g, loc);
2717 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2719 /* Generate call to the run-time library (e.g. __asan_report_load8). */
2720 gsi = gsi_start_bb (then_bb);
2721 int nargs;
2722 tree fun = report_error_func (is_store, recover_p, size_in_bytes, &nargs);
2723 g = gimple_build_call (fun, nargs, base_addr, len);
2724 gimple_set_location (g, loc);
2725 gsi_insert_after (&gsi, g, GSI_NEW_STMT);
2727 gsi_remove (iter, true);
2728 *iter = gsi_start_bb (else_bb);
2730 return true;
2733 /* Instrument the current function. */
2735 static unsigned int
2736 asan_instrument (void)
2738 if (shadow_ptr_types[0] == NULL_TREE)
2739 asan_init_shadow_ptr_types ();
2740 transform_statements ();
2741 return 0;
2744 static bool
2745 gate_asan (void)
2747 return (flag_sanitize & SANITIZE_ADDRESS) != 0
2748 && !lookup_attribute ("no_sanitize_address",
2749 DECL_ATTRIBUTES (current_function_decl));
2752 namespace {
2754 const pass_data pass_data_asan =
2756 GIMPLE_PASS, /* type */
2757 "asan", /* name */
2758 OPTGROUP_NONE, /* optinfo_flags */
2759 TV_NONE, /* tv_id */
2760 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
2761 0, /* properties_provided */
2762 0, /* properties_destroyed */
2763 0, /* todo_flags_start */
2764 TODO_update_ssa, /* todo_flags_finish */
2767 class pass_asan : public gimple_opt_pass
2769 public:
2770 pass_asan (gcc::context *ctxt)
2771 : gimple_opt_pass (pass_data_asan, ctxt)
2774 /* opt_pass methods: */
2775 opt_pass * clone () { return new pass_asan (m_ctxt); }
2776 virtual bool gate (function *) { return gate_asan (); }
2777 virtual unsigned int execute (function *) { return asan_instrument (); }
2779 }; // class pass_asan
2781 } // anon namespace
2783 gimple_opt_pass *
2784 make_pass_asan (gcc::context *ctxt)
2786 return new pass_asan (ctxt);
2789 namespace {
2791 const pass_data pass_data_asan_O0 =
2793 GIMPLE_PASS, /* type */
2794 "asan0", /* name */
2795 OPTGROUP_NONE, /* optinfo_flags */
2796 TV_NONE, /* tv_id */
2797 ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
2798 0, /* properties_provided */
2799 0, /* properties_destroyed */
2800 0, /* todo_flags_start */
2801 TODO_update_ssa, /* todo_flags_finish */
2804 class pass_asan_O0 : public gimple_opt_pass
2806 public:
2807 pass_asan_O0 (gcc::context *ctxt)
2808 : gimple_opt_pass (pass_data_asan_O0, ctxt)
2811 /* opt_pass methods: */
2812 virtual bool gate (function *) { return !optimize && gate_asan (); }
2813 virtual unsigned int execute (function *) { return asan_instrument (); }
2815 }; // class pass_asan_O0
2817 } // anon namespace
2819 gimple_opt_pass *
2820 make_pass_asan_O0 (gcc::context *ctxt)
2822 return new pass_asan_O0 (ctxt);
2825 #include "gt-asan.h"