1 /* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2014 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
26 #include "hash-table.h"
33 #include "hard-reg-set.h"
36 #include "dominance.h"
39 #include "basic-block.h"
40 #include "tree-ssa-alias.h"
41 #include "internal-fn.h"
42 #include "gimple-expr.h"
47 #include "gimple-iterator.h"
50 #include "stor-layout.h"
51 #include "tree-iterator.h"
53 #include "plugin-api.h"
56 #include "stringpool.h"
57 #include "tree-ssanames.h"
58 #include "tree-pass.h"
60 #include "gimple-pretty-print.h"
63 #include "insn-codes.h"
67 #include "langhooks.h"
68 #include "alloc-pool.h"
70 #include "gimple-builder.h"
75 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
76 with <2x slowdown on average.
78 The tool consists of two parts:
79 instrumentation module (this file) and a run-time library.
80 The instrumentation module adds a run-time check before every memory insn.
81 For a 8- or 16- byte load accessing address X:
82 ShadowAddr = (X >> 3) + Offset
83 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
85 __asan_report_load8(X);
86 For a load of N bytes (N=1, 2 or 4) from address X:
87 ShadowAddr = (X >> 3) + Offset
88 ShadowValue = *(char*)ShadowAddr;
90 if ((X & 7) + N - 1 > ShadowValue)
91 __asan_report_loadN(X);
92 Stores are instrumented similarly, but using __asan_report_storeN functions.
93 A call too __asan_init_vN() is inserted to the list of module CTORs.
94 N is the version number of the AddressSanitizer API. The changes between the
95 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
97 The run-time library redefines malloc (so that redzone are inserted around
98 the allocated memory) and free (so that reuse of free-ed memory is delayed),
99 provides __asan_report* and __asan_init_vN functions.
102 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
104 The current implementation supports detection of out-of-bounds and
105 use-after-free in the heap, on the stack and for global variables.
107 [Protection of stack variables]
109 To understand how detection of out-of-bounds and use-after-free works
110 for stack variables, lets look at this example on x86_64 where the
111 stack grows downward:
125 For this function, the stack protected by asan will be organized as
126 follows, from the top of the stack to the bottom:
128 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
130 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
131 the next slot be 32 bytes aligned; this one is called Partial
132 Redzone; this 32 bytes alignment is an asan constraint]
134 Slot 3/ [24 bytes for variable 'a']
136 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
138 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
140 Slot 6/ [8 bytes for variable 'b']
142 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
145 The 32 bytes of LEFT red zone at the bottom of the stack can be
148 1/ The first 8 bytes contain a magical asan number that is always
151 2/ The following 8 bytes contains a pointer to a string (to be
152 parsed at runtime by the runtime asan library), which format is
155 "<function-name> <space> <num-of-variables-on-the-stack>
156 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
157 <length-of-var-in-bytes> ){n} "
159 where '(...){n}' means the content inside the parenthesis occurs 'n'
160 times, with 'n' being the number of variables on the stack.
162 3/ The following 8 bytes contain the PC of the current function which
163 will be used by the run-time library to print an error message.
165 4/ The following 8 bytes are reserved for internal use by the run-time.
167 The shadow memory for that stack layout is going to look like this:
169 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
170 The F1 byte pattern is a magic number called
171 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
172 the memory for that shadow byte is part of a the LEFT red zone
173 intended to seat at the bottom of the variables on the stack.
175 - content of shadow memory 8 bytes for slots 6 and 5:
176 0xF4F4F400. The F4 byte pattern is a magic number
177 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
178 memory region for this shadow byte is a PARTIAL red zone
179 intended to pad a variable A, so that the slot following
180 {A,padding} is 32 bytes aligned.
182 Note that the fact that the least significant byte of this
183 shadow memory content is 00 means that 8 bytes of its
184 corresponding memory (which corresponds to the memory of
185 variable 'b') is addressable.
187 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
188 The F2 byte pattern is a magic number called
189 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
190 region for this shadow byte is a MIDDLE red zone intended to
191 seat between two 32 aligned slots of {variable,padding}.
193 - content of shadow memory 8 bytes for slot 3 and 2:
194 0xF4000000. This represents is the concatenation of
195 variable 'a' and the partial red zone following it, like what we
196 had for variable 'b'. The least significant 3 bytes being 00
197 means that the 3 bytes of variable 'a' are addressable.
199 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
200 The F3 byte pattern is a magic number called
201 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
202 region for this shadow byte is a RIGHT red zone intended to seat
203 at the top of the variables of the stack.
205 Note that the real variable layout is done in expand_used_vars in
206 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
207 stack variables as well as the different red zones, emits some
208 prologue code to populate the shadow memory as to poison (mark as
209 non-accessible) the regions of the red zones and mark the regions of
210 stack variables as accessible, and emit some epilogue code to
211 un-poison (mark as accessible) the regions of red zones right before
214 [Protection of global variables]
216 The basic idea is to insert a red zone between two global variables
217 and install a constructor function that calls the asan runtime to do
218 the populating of the relevant shadow memory regions at load time.
220 So the global variables are laid out as to insert a red zone between
221 them. The size of the red zones is so that each variable starts on a
224 Then a constructor function is installed so that, for each global
225 variable, it calls the runtime asan library function
226 __asan_register_globals_with an instance of this type:
230 // Address of the beginning of the global variable.
233 // Initial size of the global variable.
236 // Size of the global variable + size of the red zone. This
237 // size is 32 bytes aligned.
238 uptr __size_with_redzone;
240 // Name of the global variable.
243 // Name of the module where the global variable is declared.
244 const void *__module_name;
246 // 1 if it has dynamic initialization, 0 otherwise.
247 uptr __has_dynamic_init;
249 // A pointer to struct that contains source location, could be NULL.
250 __asan_global_source_location *__location;
253 A destructor function that calls the runtime asan library function
254 _asan_unregister_globals is also installed. */
256 static unsigned HOST_WIDE_INT asan_shadow_offset_value
;
257 static bool asan_shadow_offset_computed
;
259 /* Sets shadow offset to value in string VAL. */
262 set_asan_shadow_offset (const char *val
)
267 #ifdef HAVE_LONG_LONG
268 asan_shadow_offset_value
= strtoull (val
, &endp
, 0);
270 asan_shadow_offset_value
= strtoul (val
, &endp
, 0);
272 if (!(*val
!= '\0' && *endp
== '\0' && errno
== 0))
275 asan_shadow_offset_computed
= true;
280 /* Returns Asan shadow offset. */
282 static unsigned HOST_WIDE_INT
283 asan_shadow_offset ()
285 if (!asan_shadow_offset_computed
)
287 asan_shadow_offset_computed
= true;
288 asan_shadow_offset_value
= targetm
.asan_shadow_offset ();
290 return asan_shadow_offset_value
;
293 alias_set_type asan_shadow_set
= -1;
295 /* Pointer types to 1 resp. 2 byte integers in shadow memory. A separate
296 alias set is used for all shadow memory accesses. */
297 static GTY(()) tree shadow_ptr_types
[2];
299 /* Decl for __asan_option_detect_stack_use_after_return. */
300 static GTY(()) tree asan_detect_stack_use_after_return
;
302 /* Various flags for Asan builtins. */
303 enum asan_check_flags
305 ASAN_CHECK_STORE
= 1 << 0,
306 ASAN_CHECK_SCALAR_ACCESS
= 1 << 1,
307 ASAN_CHECK_NON_ZERO_LEN
= 1 << 2,
308 ASAN_CHECK_LAST
= 1 << 3
311 /* Hashtable support for memory references used by gimple
314 /* This type represents a reference to a memory region. */
317 /* The expression of the beginning of the memory region. */
320 /* The size of the access. */
321 HOST_WIDE_INT access_size
;
324 static alloc_pool asan_mem_ref_alloc_pool
;
326 /* This creates the alloc pool used to store the instances of
327 asan_mem_ref that are stored in the hash table asan_mem_ref_ht. */
330 asan_mem_ref_get_alloc_pool ()
332 if (asan_mem_ref_alloc_pool
== NULL
)
333 asan_mem_ref_alloc_pool
= create_alloc_pool ("asan_mem_ref",
334 sizeof (asan_mem_ref
),
336 return asan_mem_ref_alloc_pool
;
340 /* Initializes an instance of asan_mem_ref. */
343 asan_mem_ref_init (asan_mem_ref
*ref
, tree start
, HOST_WIDE_INT access_size
)
346 ref
->access_size
= access_size
;
349 /* Allocates memory for an instance of asan_mem_ref into the memory
350 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
351 START is the address of (or the expression pointing to) the
352 beginning of memory reference. ACCESS_SIZE is the size of the
353 access to the referenced memory. */
356 asan_mem_ref_new (tree start
, HOST_WIDE_INT access_size
)
359 (asan_mem_ref
*) pool_alloc (asan_mem_ref_get_alloc_pool ());
361 asan_mem_ref_init (ref
, start
, access_size
);
365 /* This builds and returns a pointer to the end of the memory region
366 that starts at START and of length LEN. */
369 asan_mem_ref_get_end (tree start
, tree len
)
371 if (len
== NULL_TREE
|| integer_zerop (len
))
374 if (!ptrofftype_p (len
))
375 len
= convert_to_ptrofftype (len
);
377 return fold_build2 (POINTER_PLUS_EXPR
, TREE_TYPE (start
), start
, len
);
380 /* Return a tree expression that represents the end of the referenced
381 memory region. Beware that this function can actually build a new
385 asan_mem_ref_get_end (const asan_mem_ref
*ref
, tree len
)
387 return asan_mem_ref_get_end (ref
->start
, len
);
390 struct asan_mem_ref_hasher
391 : typed_noop_remove
<asan_mem_ref
>
393 typedef asan_mem_ref value_type
;
394 typedef asan_mem_ref compare_type
;
396 static inline hashval_t
hash (const value_type
*);
397 static inline bool equal (const value_type
*, const compare_type
*);
400 /* Hash a memory reference. */
403 asan_mem_ref_hasher::hash (const asan_mem_ref
*mem_ref
)
405 return iterative_hash_expr (mem_ref
->start
, 0);
408 /* Compare two memory references. We accept the length of either
409 memory references to be NULL_TREE. */
412 asan_mem_ref_hasher::equal (const asan_mem_ref
*m1
,
413 const asan_mem_ref
*m2
)
415 return operand_equal_p (m1
->start
, m2
->start
, 0);
418 static hash_table
<asan_mem_ref_hasher
> *asan_mem_ref_ht
;
420 /* Returns a reference to the hash table containing memory references.
421 This function ensures that the hash table is created. Note that
422 this hash table is updated by the function
423 update_mem_ref_hash_table. */
425 static hash_table
<asan_mem_ref_hasher
> *
426 get_mem_ref_hash_table ()
428 if (!asan_mem_ref_ht
)
429 asan_mem_ref_ht
= new hash_table
<asan_mem_ref_hasher
> (10);
431 return asan_mem_ref_ht
;
434 /* Clear all entries from the memory references hash table. */
437 empty_mem_ref_hash_table ()
440 asan_mem_ref_ht
->empty ();
443 /* Free the memory references hash table. */
446 free_mem_ref_resources ()
448 delete asan_mem_ref_ht
;
449 asan_mem_ref_ht
= NULL
;
451 if (asan_mem_ref_alloc_pool
)
453 free_alloc_pool (asan_mem_ref_alloc_pool
);
454 asan_mem_ref_alloc_pool
= NULL
;
458 /* Return true iff the memory reference REF has been instrumented. */
461 has_mem_ref_been_instrumented (tree ref
, HOST_WIDE_INT access_size
)
464 asan_mem_ref_init (&r
, ref
, access_size
);
466 asan_mem_ref
*saved_ref
= get_mem_ref_hash_table ()->find (&r
);
467 return saved_ref
&& saved_ref
->access_size
>= access_size
;
470 /* Return true iff the memory reference REF has been instrumented. */
473 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
)
475 return has_mem_ref_been_instrumented (ref
->start
, ref
->access_size
);
478 /* Return true iff access to memory region starting at REF and of
479 length LEN has been instrumented. */
482 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
, tree len
)
484 HOST_WIDE_INT size_in_bytes
485 = tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
487 return size_in_bytes
!= -1
488 && has_mem_ref_been_instrumented (ref
->start
, size_in_bytes
);
491 /* Set REF to the memory reference present in a gimple assignment
492 ASSIGNMENT. Return true upon successful completion, false
496 get_mem_ref_of_assignment (const gassign
*assignment
,
500 gcc_assert (gimple_assign_single_p (assignment
));
502 if (gimple_store_p (assignment
)
503 && !gimple_clobber_p (assignment
))
505 ref
->start
= gimple_assign_lhs (assignment
);
506 *ref_is_store
= true;
508 else if (gimple_assign_load_p (assignment
))
510 ref
->start
= gimple_assign_rhs1 (assignment
);
511 *ref_is_store
= false;
516 ref
->access_size
= int_size_in_bytes (TREE_TYPE (ref
->start
));
520 /* Return the memory references contained in a gimple statement
521 representing a builtin call that has to do with memory access. */
524 get_mem_refs_of_builtin_call (const gcall
*call
,
537 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
539 tree callee
= gimple_call_fndecl (call
);
540 tree source0
= NULL_TREE
, source1
= NULL_TREE
,
541 dest
= NULL_TREE
, len
= NULL_TREE
;
542 bool is_store
= true, got_reference_p
= false;
543 HOST_WIDE_INT access_size
= 1;
545 *intercepted_p
= asan_intercepted_p ((DECL_FUNCTION_CODE (callee
)));
547 switch (DECL_FUNCTION_CODE (callee
))
549 /* (s, s, n) style memops. */
551 case BUILT_IN_MEMCMP
:
552 source0
= gimple_call_arg (call
, 0);
553 source1
= gimple_call_arg (call
, 1);
554 len
= gimple_call_arg (call
, 2);
557 /* (src, dest, n) style memops. */
559 source0
= gimple_call_arg (call
, 0);
560 dest
= gimple_call_arg (call
, 1);
561 len
= gimple_call_arg (call
, 2);
564 /* (dest, src, n) style memops. */
565 case BUILT_IN_MEMCPY
:
566 case BUILT_IN_MEMCPY_CHK
:
567 case BUILT_IN_MEMMOVE
:
568 case BUILT_IN_MEMMOVE_CHK
:
569 case BUILT_IN_MEMPCPY
:
570 case BUILT_IN_MEMPCPY_CHK
:
571 dest
= gimple_call_arg (call
, 0);
572 source0
= gimple_call_arg (call
, 1);
573 len
= gimple_call_arg (call
, 2);
576 /* (dest, n) style memops. */
578 dest
= gimple_call_arg (call
, 0);
579 len
= gimple_call_arg (call
, 1);
582 /* (dest, x, n) style memops*/
583 case BUILT_IN_MEMSET
:
584 case BUILT_IN_MEMSET_CHK
:
585 dest
= gimple_call_arg (call
, 0);
586 len
= gimple_call_arg (call
, 2);
589 case BUILT_IN_STRLEN
:
590 source0
= gimple_call_arg (call
, 0);
591 len
= gimple_call_lhs (call
);
594 /* And now the __atomic* and __sync builtins.
595 These are handled differently from the classical memory memory
596 access builtins above. */
598 case BUILT_IN_ATOMIC_LOAD_1
:
599 case BUILT_IN_ATOMIC_LOAD_2
:
600 case BUILT_IN_ATOMIC_LOAD_4
:
601 case BUILT_IN_ATOMIC_LOAD_8
:
602 case BUILT_IN_ATOMIC_LOAD_16
:
606 case BUILT_IN_SYNC_FETCH_AND_ADD_1
:
607 case BUILT_IN_SYNC_FETCH_AND_ADD_2
:
608 case BUILT_IN_SYNC_FETCH_AND_ADD_4
:
609 case BUILT_IN_SYNC_FETCH_AND_ADD_8
:
610 case BUILT_IN_SYNC_FETCH_AND_ADD_16
:
612 case BUILT_IN_SYNC_FETCH_AND_SUB_1
:
613 case BUILT_IN_SYNC_FETCH_AND_SUB_2
:
614 case BUILT_IN_SYNC_FETCH_AND_SUB_4
:
615 case BUILT_IN_SYNC_FETCH_AND_SUB_8
:
616 case BUILT_IN_SYNC_FETCH_AND_SUB_16
:
618 case BUILT_IN_SYNC_FETCH_AND_OR_1
:
619 case BUILT_IN_SYNC_FETCH_AND_OR_2
:
620 case BUILT_IN_SYNC_FETCH_AND_OR_4
:
621 case BUILT_IN_SYNC_FETCH_AND_OR_8
:
622 case BUILT_IN_SYNC_FETCH_AND_OR_16
:
624 case BUILT_IN_SYNC_FETCH_AND_AND_1
:
625 case BUILT_IN_SYNC_FETCH_AND_AND_2
:
626 case BUILT_IN_SYNC_FETCH_AND_AND_4
:
627 case BUILT_IN_SYNC_FETCH_AND_AND_8
:
628 case BUILT_IN_SYNC_FETCH_AND_AND_16
:
630 case BUILT_IN_SYNC_FETCH_AND_XOR_1
:
631 case BUILT_IN_SYNC_FETCH_AND_XOR_2
:
632 case BUILT_IN_SYNC_FETCH_AND_XOR_4
:
633 case BUILT_IN_SYNC_FETCH_AND_XOR_8
:
634 case BUILT_IN_SYNC_FETCH_AND_XOR_16
:
636 case BUILT_IN_SYNC_FETCH_AND_NAND_1
:
637 case BUILT_IN_SYNC_FETCH_AND_NAND_2
:
638 case BUILT_IN_SYNC_FETCH_AND_NAND_4
:
639 case BUILT_IN_SYNC_FETCH_AND_NAND_8
:
641 case BUILT_IN_SYNC_ADD_AND_FETCH_1
:
642 case BUILT_IN_SYNC_ADD_AND_FETCH_2
:
643 case BUILT_IN_SYNC_ADD_AND_FETCH_4
:
644 case BUILT_IN_SYNC_ADD_AND_FETCH_8
:
645 case BUILT_IN_SYNC_ADD_AND_FETCH_16
:
647 case BUILT_IN_SYNC_SUB_AND_FETCH_1
:
648 case BUILT_IN_SYNC_SUB_AND_FETCH_2
:
649 case BUILT_IN_SYNC_SUB_AND_FETCH_4
:
650 case BUILT_IN_SYNC_SUB_AND_FETCH_8
:
651 case BUILT_IN_SYNC_SUB_AND_FETCH_16
:
653 case BUILT_IN_SYNC_OR_AND_FETCH_1
:
654 case BUILT_IN_SYNC_OR_AND_FETCH_2
:
655 case BUILT_IN_SYNC_OR_AND_FETCH_4
:
656 case BUILT_IN_SYNC_OR_AND_FETCH_8
:
657 case BUILT_IN_SYNC_OR_AND_FETCH_16
:
659 case BUILT_IN_SYNC_AND_AND_FETCH_1
:
660 case BUILT_IN_SYNC_AND_AND_FETCH_2
:
661 case BUILT_IN_SYNC_AND_AND_FETCH_4
:
662 case BUILT_IN_SYNC_AND_AND_FETCH_8
:
663 case BUILT_IN_SYNC_AND_AND_FETCH_16
:
665 case BUILT_IN_SYNC_XOR_AND_FETCH_1
:
666 case BUILT_IN_SYNC_XOR_AND_FETCH_2
:
667 case BUILT_IN_SYNC_XOR_AND_FETCH_4
:
668 case BUILT_IN_SYNC_XOR_AND_FETCH_8
:
669 case BUILT_IN_SYNC_XOR_AND_FETCH_16
:
671 case BUILT_IN_SYNC_NAND_AND_FETCH_1
:
672 case BUILT_IN_SYNC_NAND_AND_FETCH_2
:
673 case BUILT_IN_SYNC_NAND_AND_FETCH_4
:
674 case BUILT_IN_SYNC_NAND_AND_FETCH_8
:
676 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1
:
677 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2
:
678 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4
:
679 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8
:
680 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16
:
682 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1
:
683 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2
:
684 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4
:
685 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8
:
686 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16
:
688 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1
:
689 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2
:
690 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4
:
691 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8
:
692 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16
:
694 case BUILT_IN_SYNC_LOCK_RELEASE_1
:
695 case BUILT_IN_SYNC_LOCK_RELEASE_2
:
696 case BUILT_IN_SYNC_LOCK_RELEASE_4
:
697 case BUILT_IN_SYNC_LOCK_RELEASE_8
:
698 case BUILT_IN_SYNC_LOCK_RELEASE_16
:
700 case BUILT_IN_ATOMIC_EXCHANGE_1
:
701 case BUILT_IN_ATOMIC_EXCHANGE_2
:
702 case BUILT_IN_ATOMIC_EXCHANGE_4
:
703 case BUILT_IN_ATOMIC_EXCHANGE_8
:
704 case BUILT_IN_ATOMIC_EXCHANGE_16
:
706 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1
:
707 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2
:
708 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4
:
709 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8
:
710 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16
:
712 case BUILT_IN_ATOMIC_STORE_1
:
713 case BUILT_IN_ATOMIC_STORE_2
:
714 case BUILT_IN_ATOMIC_STORE_4
:
715 case BUILT_IN_ATOMIC_STORE_8
:
716 case BUILT_IN_ATOMIC_STORE_16
:
718 case BUILT_IN_ATOMIC_ADD_FETCH_1
:
719 case BUILT_IN_ATOMIC_ADD_FETCH_2
:
720 case BUILT_IN_ATOMIC_ADD_FETCH_4
:
721 case BUILT_IN_ATOMIC_ADD_FETCH_8
:
722 case BUILT_IN_ATOMIC_ADD_FETCH_16
:
724 case BUILT_IN_ATOMIC_SUB_FETCH_1
:
725 case BUILT_IN_ATOMIC_SUB_FETCH_2
:
726 case BUILT_IN_ATOMIC_SUB_FETCH_4
:
727 case BUILT_IN_ATOMIC_SUB_FETCH_8
:
728 case BUILT_IN_ATOMIC_SUB_FETCH_16
:
730 case BUILT_IN_ATOMIC_AND_FETCH_1
:
731 case BUILT_IN_ATOMIC_AND_FETCH_2
:
732 case BUILT_IN_ATOMIC_AND_FETCH_4
:
733 case BUILT_IN_ATOMIC_AND_FETCH_8
:
734 case BUILT_IN_ATOMIC_AND_FETCH_16
:
736 case BUILT_IN_ATOMIC_NAND_FETCH_1
:
737 case BUILT_IN_ATOMIC_NAND_FETCH_2
:
738 case BUILT_IN_ATOMIC_NAND_FETCH_4
:
739 case BUILT_IN_ATOMIC_NAND_FETCH_8
:
740 case BUILT_IN_ATOMIC_NAND_FETCH_16
:
742 case BUILT_IN_ATOMIC_XOR_FETCH_1
:
743 case BUILT_IN_ATOMIC_XOR_FETCH_2
:
744 case BUILT_IN_ATOMIC_XOR_FETCH_4
:
745 case BUILT_IN_ATOMIC_XOR_FETCH_8
:
746 case BUILT_IN_ATOMIC_XOR_FETCH_16
:
748 case BUILT_IN_ATOMIC_OR_FETCH_1
:
749 case BUILT_IN_ATOMIC_OR_FETCH_2
:
750 case BUILT_IN_ATOMIC_OR_FETCH_4
:
751 case BUILT_IN_ATOMIC_OR_FETCH_8
:
752 case BUILT_IN_ATOMIC_OR_FETCH_16
:
754 case BUILT_IN_ATOMIC_FETCH_ADD_1
:
755 case BUILT_IN_ATOMIC_FETCH_ADD_2
:
756 case BUILT_IN_ATOMIC_FETCH_ADD_4
:
757 case BUILT_IN_ATOMIC_FETCH_ADD_8
:
758 case BUILT_IN_ATOMIC_FETCH_ADD_16
:
760 case BUILT_IN_ATOMIC_FETCH_SUB_1
:
761 case BUILT_IN_ATOMIC_FETCH_SUB_2
:
762 case BUILT_IN_ATOMIC_FETCH_SUB_4
:
763 case BUILT_IN_ATOMIC_FETCH_SUB_8
:
764 case BUILT_IN_ATOMIC_FETCH_SUB_16
:
766 case BUILT_IN_ATOMIC_FETCH_AND_1
:
767 case BUILT_IN_ATOMIC_FETCH_AND_2
:
768 case BUILT_IN_ATOMIC_FETCH_AND_4
:
769 case BUILT_IN_ATOMIC_FETCH_AND_8
:
770 case BUILT_IN_ATOMIC_FETCH_AND_16
:
772 case BUILT_IN_ATOMIC_FETCH_NAND_1
:
773 case BUILT_IN_ATOMIC_FETCH_NAND_2
:
774 case BUILT_IN_ATOMIC_FETCH_NAND_4
:
775 case BUILT_IN_ATOMIC_FETCH_NAND_8
:
776 case BUILT_IN_ATOMIC_FETCH_NAND_16
:
778 case BUILT_IN_ATOMIC_FETCH_XOR_1
:
779 case BUILT_IN_ATOMIC_FETCH_XOR_2
:
780 case BUILT_IN_ATOMIC_FETCH_XOR_4
:
781 case BUILT_IN_ATOMIC_FETCH_XOR_8
:
782 case BUILT_IN_ATOMIC_FETCH_XOR_16
:
784 case BUILT_IN_ATOMIC_FETCH_OR_1
:
785 case BUILT_IN_ATOMIC_FETCH_OR_2
:
786 case BUILT_IN_ATOMIC_FETCH_OR_4
:
787 case BUILT_IN_ATOMIC_FETCH_OR_8
:
788 case BUILT_IN_ATOMIC_FETCH_OR_16
:
790 dest
= gimple_call_arg (call
, 0);
791 /* DEST represents the address of a memory location.
792 instrument_derefs wants the memory location, so lets
793 dereference the address DEST before handing it to
794 instrument_derefs. */
795 if (TREE_CODE (dest
) == ADDR_EXPR
)
796 dest
= TREE_OPERAND (dest
, 0);
797 else if (TREE_CODE (dest
) == SSA_NAME
|| TREE_CODE (dest
) == INTEGER_CST
)
798 dest
= build2 (MEM_REF
, TREE_TYPE (TREE_TYPE (dest
)),
799 dest
, build_int_cst (TREE_TYPE (dest
), 0));
803 access_size
= int_size_in_bytes (TREE_TYPE (dest
));
807 /* The other builtins memory access are not instrumented in this
808 function because they either don't have any length parameter,
809 or their length parameter is just a limit. */
813 if (len
!= NULL_TREE
)
815 if (source0
!= NULL_TREE
)
817 src0
->start
= source0
;
818 src0
->access_size
= access_size
;
820 *src0_is_store
= false;
823 if (source1
!= NULL_TREE
)
825 src1
->start
= source1
;
826 src1
->access_size
= access_size
;
828 *src1_is_store
= false;
831 if (dest
!= NULL_TREE
)
834 dst
->access_size
= access_size
;
836 *dst_is_store
= true;
839 got_reference_p
= true;
844 dst
->access_size
= access_size
;
845 *dst_len
= NULL_TREE
;
846 *dst_is_store
= is_store
;
847 *dest_is_deref
= true;
848 got_reference_p
= true;
851 return got_reference_p
;
854 /* Return true iff a given gimple statement has been instrumented.
855 Note that the statement is "defined" by the memory references it
859 has_stmt_been_instrumented_p (gimple stmt
)
861 if (gimple_assign_single_p (stmt
))
865 asan_mem_ref_init (&r
, NULL
, 1);
867 if (get_mem_ref_of_assignment (as_a
<gassign
*> (stmt
), &r
,
869 return has_mem_ref_been_instrumented (&r
);
871 else if (gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
873 asan_mem_ref src0
, src1
, dest
;
874 asan_mem_ref_init (&src0
, NULL
, 1);
875 asan_mem_ref_init (&src1
, NULL
, 1);
876 asan_mem_ref_init (&dest
, NULL
, 1);
878 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
879 bool src0_is_store
= false, src1_is_store
= false,
880 dest_is_store
= false, dest_is_deref
= false, intercepted_p
= true;
881 if (get_mem_refs_of_builtin_call (as_a
<gcall
*> (stmt
),
882 &src0
, &src0_len
, &src0_is_store
,
883 &src1
, &src1_len
, &src1_is_store
,
884 &dest
, &dest_len
, &dest_is_store
,
885 &dest_is_deref
, &intercepted_p
))
887 if (src0
.start
!= NULL_TREE
888 && !has_mem_ref_been_instrumented (&src0
, src0_len
))
891 if (src1
.start
!= NULL_TREE
892 && !has_mem_ref_been_instrumented (&src1
, src1_len
))
895 if (dest
.start
!= NULL_TREE
896 && !has_mem_ref_been_instrumented (&dest
, dest_len
))
905 /* Insert a memory reference into the hash table. */
908 update_mem_ref_hash_table (tree ref
, HOST_WIDE_INT access_size
)
910 hash_table
<asan_mem_ref_hasher
> *ht
= get_mem_ref_hash_table ();
913 asan_mem_ref_init (&r
, ref
, access_size
);
915 asan_mem_ref
**slot
= ht
->find_slot (&r
, INSERT
);
916 if (*slot
== NULL
|| (*slot
)->access_size
< access_size
)
917 *slot
= asan_mem_ref_new (ref
, access_size
);
920 /* Initialize shadow_ptr_types array. */
923 asan_init_shadow_ptr_types (void)
925 asan_shadow_set
= new_alias_set ();
926 shadow_ptr_types
[0] = build_distinct_type_copy (signed_char_type_node
);
927 TYPE_ALIAS_SET (shadow_ptr_types
[0]) = asan_shadow_set
;
928 shadow_ptr_types
[0] = build_pointer_type (shadow_ptr_types
[0]);
929 shadow_ptr_types
[1] = build_distinct_type_copy (short_integer_type_node
);
930 TYPE_ALIAS_SET (shadow_ptr_types
[1]) = asan_shadow_set
;
931 shadow_ptr_types
[1] = build_pointer_type (shadow_ptr_types
[1]);
932 initialize_sanitizer_builtins ();
935 /* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
938 asan_pp_string (pretty_printer
*pp
)
940 const char *buf
= pp_formatted_text (pp
);
941 size_t len
= strlen (buf
);
942 tree ret
= build_string (len
+ 1, buf
);
944 = build_array_type (TREE_TYPE (shadow_ptr_types
[0]),
945 build_index_type (size_int (len
)));
946 TREE_READONLY (ret
) = 1;
947 TREE_STATIC (ret
) = 1;
948 return build1 (ADDR_EXPR
, shadow_ptr_types
[0], ret
);
951 /* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
954 asan_shadow_cst (unsigned char shadow_bytes
[4])
957 unsigned HOST_WIDE_INT val
= 0;
958 gcc_assert (WORDS_BIG_ENDIAN
== BYTES_BIG_ENDIAN
);
959 for (i
= 0; i
< 4; i
++)
960 val
|= (unsigned HOST_WIDE_INT
) shadow_bytes
[BYTES_BIG_ENDIAN
? 3 - i
: i
]
961 << (BITS_PER_UNIT
* i
);
962 return gen_int_mode (val
, SImode
);
965 /* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
969 asan_clear_shadow (rtx shadow_mem
, HOST_WIDE_INT len
)
971 rtx_insn
*insn
, *insns
, *jump
;
972 rtx_code_label
*top_label
;
976 clear_storage (shadow_mem
, GEN_INT (len
), BLOCK_OP_NORMAL
);
977 insns
= get_insns ();
979 for (insn
= insns
; insn
; insn
= NEXT_INSN (insn
))
982 if (insn
== NULL_RTX
)
988 gcc_assert ((len
& 3) == 0);
989 top_label
= gen_label_rtx ();
990 addr
= copy_to_mode_reg (Pmode
, XEXP (shadow_mem
, 0));
991 shadow_mem
= adjust_automodify_address (shadow_mem
, SImode
, addr
, 0);
992 end
= force_reg (Pmode
, plus_constant (Pmode
, addr
, len
));
993 emit_label (top_label
);
995 emit_move_insn (shadow_mem
, const0_rtx
);
996 tmp
= expand_simple_binop (Pmode
, PLUS
, addr
, gen_int_mode (4, Pmode
), addr
,
997 true, OPTAB_LIB_WIDEN
);
999 emit_move_insn (addr
, tmp
);
1000 emit_cmp_and_jump_insns (addr
, end
, LT
, NULL_RTX
, Pmode
, true, top_label
);
1001 jump
= get_last_insn ();
1002 gcc_assert (JUMP_P (jump
));
1003 add_int_reg_note (jump
, REG_BR_PROB
, REG_BR_PROB_BASE
* 80 / 100);
1007 asan_function_start (void)
1009 section
*fnsec
= function_section (current_function_decl
);
1010 switch_to_section (fnsec
);
1011 ASM_OUTPUT_DEBUG_LABEL (asm_out_file
, "LASANPC",
1012 current_function_funcdef_no
);
1015 /* Insert code to protect stack vars. The prologue sequence should be emitted
1016 directly, epilogue sequence returned. BASE is the register holding the
1017 stack base, against which OFFSETS array offsets are relative to, OFFSETS
1018 array contains pairs of offsets in reverse order, always the end offset
1019 of some gap that needs protection followed by starting offset,
1020 and DECLS is an array of representative decls for each var partition.
1021 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
1022 elements long (OFFSETS include gap before the first variable as well
1023 as gaps after each stack variable). PBASE is, if non-NULL, some pseudo
1024 register which stack vars DECL_RTLs are based on. Either BASE should be
1025 assigned to PBASE, when not doing use after return protection, or
1026 corresponding address based on __asan_stack_malloc* return value. */
1029 asan_emit_stack_protection (rtx base
, rtx pbase
, unsigned int alignb
,
1030 HOST_WIDE_INT
*offsets
, tree
*decls
, int length
)
1032 rtx shadow_base
, shadow_mem
, ret
, mem
, orig_base
;
1033 rtx_code_label
*lab
;
1036 unsigned char shadow_bytes
[4];
1037 HOST_WIDE_INT base_offset
= offsets
[length
- 1];
1038 HOST_WIDE_INT base_align_bias
= 0, offset
, prev_offset
;
1039 HOST_WIDE_INT asan_frame_size
= offsets
[0] - base_offset
;
1040 HOST_WIDE_INT last_offset
, last_size
;
1042 unsigned char cur_shadow_byte
= ASAN_STACK_MAGIC_LEFT
;
1043 tree str_cst
, decl
, id
;
1044 int use_after_return_class
= -1;
1046 if (shadow_ptr_types
[0] == NULL_TREE
)
1047 asan_init_shadow_ptr_types ();
1049 /* First of all, prepare the description string. */
1050 pretty_printer asan_pp
;
1052 pp_decimal_int (&asan_pp
, length
/ 2 - 1);
1053 pp_space (&asan_pp
);
1054 for (l
= length
- 2; l
; l
-= 2)
1056 tree decl
= decls
[l
/ 2 - 1];
1057 pp_wide_integer (&asan_pp
, offsets
[l
] - base_offset
);
1058 pp_space (&asan_pp
);
1059 pp_wide_integer (&asan_pp
, offsets
[l
- 1] - offsets
[l
]);
1060 pp_space (&asan_pp
);
1061 if (DECL_P (decl
) && DECL_NAME (decl
))
1063 pp_decimal_int (&asan_pp
, IDENTIFIER_LENGTH (DECL_NAME (decl
)));
1064 pp_space (&asan_pp
);
1065 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
1068 pp_string (&asan_pp
, "9 <unknown>");
1069 pp_space (&asan_pp
);
1071 str_cst
= asan_pp_string (&asan_pp
);
1073 /* Emit the prologue sequence. */
1074 if (asan_frame_size
> 32 && asan_frame_size
<= 65536 && pbase
1075 && ASAN_USE_AFTER_RETURN
)
1077 use_after_return_class
= floor_log2 (asan_frame_size
- 1) - 5;
1078 /* __asan_stack_malloc_N guarantees alignment
1079 N < 6 ? (64 << N) : 4096 bytes. */
1080 if (alignb
> (use_after_return_class
< 6
1081 ? (64U << use_after_return_class
) : 4096U))
1082 use_after_return_class
= -1;
1083 else if (alignb
> ASAN_RED_ZONE_SIZE
&& (asan_frame_size
& (alignb
- 1)))
1084 base_align_bias
= ((asan_frame_size
+ alignb
- 1)
1085 & ~(alignb
- HOST_WIDE_INT_1
)) - asan_frame_size
;
1087 /* Align base if target is STRICT_ALIGNMENT. */
1088 if (STRICT_ALIGNMENT
)
1089 base
= expand_binop (Pmode
, and_optab
, base
,
1090 gen_int_mode (-((GET_MODE_ALIGNMENT (SImode
)
1091 << ASAN_SHADOW_SHIFT
)
1092 / BITS_PER_UNIT
), Pmode
), NULL_RTX
,
1095 if (use_after_return_class
== -1 && pbase
)
1096 emit_move_insn (pbase
, base
);
1098 base
= expand_binop (Pmode
, add_optab
, base
,
1099 gen_int_mode (base_offset
- base_align_bias
, Pmode
),
1100 NULL_RTX
, 1, OPTAB_DIRECT
);
1101 orig_base
= NULL_RTX
;
1102 if (use_after_return_class
!= -1)
1104 if (asan_detect_stack_use_after_return
== NULL_TREE
)
1106 id
= get_identifier ("__asan_option_detect_stack_use_after_return");
1107 decl
= build_decl (BUILTINS_LOCATION
, VAR_DECL
, id
,
1109 SET_DECL_ASSEMBLER_NAME (decl
, id
);
1110 TREE_ADDRESSABLE (decl
) = 1;
1111 DECL_ARTIFICIAL (decl
) = 1;
1112 DECL_IGNORED_P (decl
) = 1;
1113 DECL_EXTERNAL (decl
) = 1;
1114 TREE_STATIC (decl
) = 1;
1115 TREE_PUBLIC (decl
) = 1;
1116 TREE_USED (decl
) = 1;
1117 asan_detect_stack_use_after_return
= decl
;
1119 orig_base
= gen_reg_rtx (Pmode
);
1120 emit_move_insn (orig_base
, base
);
1121 ret
= expand_normal (asan_detect_stack_use_after_return
);
1122 lab
= gen_label_rtx ();
1123 int very_likely
= REG_BR_PROB_BASE
- (REG_BR_PROB_BASE
/ 2000 - 1);
1124 emit_cmp_and_jump_insns (ret
, const0_rtx
, EQ
, NULL_RTX
,
1125 VOIDmode
, 0, lab
, very_likely
);
1126 snprintf (buf
, sizeof buf
, "__asan_stack_malloc_%d",
1127 use_after_return_class
);
1128 ret
= init_one_libfunc (buf
);
1129 rtx addr
= convert_memory_address (ptr_mode
, base
);
1130 ret
= emit_library_call_value (ret
, NULL_RTX
, LCT_NORMAL
, ptr_mode
, 2,
1131 GEN_INT (asan_frame_size
1133 TYPE_MODE (pointer_sized_int_node
),
1135 ret
= convert_memory_address (Pmode
, ret
);
1136 emit_move_insn (base
, ret
);
1138 emit_move_insn (pbase
, expand_binop (Pmode
, add_optab
, base
,
1139 gen_int_mode (base_align_bias
1140 - base_offset
, Pmode
),
1141 NULL_RTX
, 1, OPTAB_DIRECT
));
1143 mem
= gen_rtx_MEM (ptr_mode
, base
);
1144 mem
= adjust_address (mem
, VOIDmode
, base_align_bias
);
1145 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_FRAME_MAGIC
, ptr_mode
));
1146 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1147 emit_move_insn (mem
, expand_normal (str_cst
));
1148 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1149 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASANPC", current_function_funcdef_no
);
1150 id
= get_identifier (buf
);
1151 decl
= build_decl (DECL_SOURCE_LOCATION (current_function_decl
),
1152 VAR_DECL
, id
, char_type_node
);
1153 SET_DECL_ASSEMBLER_NAME (decl
, id
);
1154 TREE_ADDRESSABLE (decl
) = 1;
1155 TREE_READONLY (decl
) = 1;
1156 DECL_ARTIFICIAL (decl
) = 1;
1157 DECL_IGNORED_P (decl
) = 1;
1158 TREE_STATIC (decl
) = 1;
1159 TREE_PUBLIC (decl
) = 0;
1160 TREE_USED (decl
) = 1;
1161 DECL_INITIAL (decl
) = decl
;
1162 TREE_ASM_WRITTEN (decl
) = 1;
1163 TREE_ASM_WRITTEN (id
) = 1;
1164 emit_move_insn (mem
, expand_normal (build_fold_addr_expr (decl
)));
1165 shadow_base
= expand_binop (Pmode
, lshr_optab
, base
,
1166 GEN_INT (ASAN_SHADOW_SHIFT
),
1167 NULL_RTX
, 1, OPTAB_DIRECT
);
1169 = plus_constant (Pmode
, shadow_base
,
1170 asan_shadow_offset ()
1171 + (base_align_bias
>> ASAN_SHADOW_SHIFT
));
1172 gcc_assert (asan_shadow_set
!= -1
1173 && (ASAN_RED_ZONE_SIZE
>> ASAN_SHADOW_SHIFT
) == 4);
1174 shadow_mem
= gen_rtx_MEM (SImode
, shadow_base
);
1175 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1176 if (STRICT_ALIGNMENT
)
1177 set_mem_align (shadow_mem
, (GET_MODE_ALIGNMENT (SImode
)));
1178 prev_offset
= base_offset
;
1179 for (l
= length
; l
; l
-= 2)
1182 cur_shadow_byte
= ASAN_STACK_MAGIC_RIGHT
;
1183 offset
= offsets
[l
- 1];
1184 if ((offset
- base_offset
) & (ASAN_RED_ZONE_SIZE
- 1))
1188 = base_offset
+ ((offset
- base_offset
)
1189 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1190 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1191 (aoff
- prev_offset
)
1192 >> ASAN_SHADOW_SHIFT
);
1194 for (i
= 0; i
< 4; i
++, aoff
+= (1 << ASAN_SHADOW_SHIFT
))
1197 if (aoff
< offset
- (1 << ASAN_SHADOW_SHIFT
) + 1)
1198 shadow_bytes
[i
] = 0;
1200 shadow_bytes
[i
] = offset
- aoff
;
1203 shadow_bytes
[i
] = ASAN_STACK_MAGIC_PARTIAL
;
1204 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1207 while (offset
<= offsets
[l
- 2] - ASAN_RED_ZONE_SIZE
)
1209 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1210 (offset
- prev_offset
)
1211 >> ASAN_SHADOW_SHIFT
);
1212 prev_offset
= offset
;
1213 memset (shadow_bytes
, cur_shadow_byte
, 4);
1214 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1215 offset
+= ASAN_RED_ZONE_SIZE
;
1217 cur_shadow_byte
= ASAN_STACK_MAGIC_MIDDLE
;
1219 do_pending_stack_adjust ();
1221 /* Construct epilogue sequence. */
1225 if (use_after_return_class
!= -1)
1227 rtx_code_label
*lab2
= gen_label_rtx ();
1228 char c
= (char) ASAN_STACK_MAGIC_USE_AFTER_RET
;
1229 int very_likely
= REG_BR_PROB_BASE
- (REG_BR_PROB_BASE
/ 2000 - 1);
1230 emit_cmp_and_jump_insns (orig_base
, base
, EQ
, NULL_RTX
,
1231 VOIDmode
, 0, lab2
, very_likely
);
1232 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1233 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1234 mem
= gen_rtx_MEM (ptr_mode
, base
);
1235 mem
= adjust_address (mem
, VOIDmode
, base_align_bias
);
1236 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_RETIRED_MAGIC
, ptr_mode
));
1237 unsigned HOST_WIDE_INT sz
= asan_frame_size
>> ASAN_SHADOW_SHIFT
;
1238 if (use_after_return_class
< 5
1239 && can_store_by_pieces (sz
, builtin_memset_read_str
, &c
,
1240 BITS_PER_UNIT
, true))
1241 store_by_pieces (shadow_mem
, sz
, builtin_memset_read_str
, &c
,
1242 BITS_PER_UNIT
, true, 0);
1243 else if (use_after_return_class
>= 5
1244 || !set_storage_via_setmem (shadow_mem
,
1246 gen_int_mode (c
, QImode
),
1247 BITS_PER_UNIT
, BITS_PER_UNIT
,
1250 snprintf (buf
, sizeof buf
, "__asan_stack_free_%d",
1251 use_after_return_class
);
1252 ret
= init_one_libfunc (buf
);
1253 rtx addr
= convert_memory_address (ptr_mode
, base
);
1254 rtx orig_addr
= convert_memory_address (ptr_mode
, orig_base
);
1255 emit_library_call (ret
, LCT_NORMAL
, ptr_mode
, 3, addr
, ptr_mode
,
1256 GEN_INT (asan_frame_size
+ base_align_bias
),
1257 TYPE_MODE (pointer_sized_int_node
),
1258 orig_addr
, ptr_mode
);
1260 lab
= gen_label_rtx ();
1265 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1266 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1268 if (STRICT_ALIGNMENT
)
1269 set_mem_align (shadow_mem
, (GET_MODE_ALIGNMENT (SImode
)));
1271 prev_offset
= base_offset
;
1272 last_offset
= base_offset
;
1274 for (l
= length
; l
; l
-= 2)
1276 offset
= base_offset
+ ((offsets
[l
- 1] - base_offset
)
1277 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1278 if (last_offset
+ last_size
!= offset
)
1280 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1281 (last_offset
- prev_offset
)
1282 >> ASAN_SHADOW_SHIFT
);
1283 prev_offset
= last_offset
;
1284 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1285 last_offset
= offset
;
1288 last_size
+= base_offset
+ ((offsets
[l
- 2] - base_offset
)
1289 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
))
1294 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1295 (last_offset
- prev_offset
)
1296 >> ASAN_SHADOW_SHIFT
);
1297 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1300 do_pending_stack_adjust ();
1304 insns
= get_insns ();
1309 /* Return true if DECL, a global var, might be overridden and needs
1310 therefore a local alias. */
1313 asan_needs_local_alias (tree decl
)
1315 return DECL_WEAK (decl
) || !targetm
.binds_local_p (decl
);
1318 /* Return true if DECL is a VAR_DECL that should be protected
1319 by Address Sanitizer, by appending a red zone with protected
1320 shadow memory after it and aligning it to at least
1321 ASAN_RED_ZONE_SIZE bytes. */
1324 asan_protect_global (tree decl
)
1331 if (TREE_CODE (decl
) == STRING_CST
)
1333 /* Instrument all STRING_CSTs except those created
1334 by asan_pp_string here. */
1335 if (shadow_ptr_types
[0] != NULL_TREE
1336 && TREE_CODE (TREE_TYPE (decl
)) == ARRAY_TYPE
1337 && TREE_TYPE (TREE_TYPE (decl
)) == TREE_TYPE (shadow_ptr_types
[0]))
1341 if (TREE_CODE (decl
) != VAR_DECL
1342 /* TLS vars aren't statically protectable. */
1343 || DECL_THREAD_LOCAL_P (decl
)
1344 /* Externs will be protected elsewhere. */
1345 || DECL_EXTERNAL (decl
)
1346 || !DECL_RTL_SET_P (decl
)
1347 /* Comdat vars pose an ABI problem, we can't know if
1348 the var that is selected by the linker will have
1350 || DECL_ONE_ONLY (decl
)
1351 /* Similarly for common vars. People can use -fno-common.
1352 Note: Linux kernel is built with -fno-common, so we do instrument
1353 globals there even if it is C. */
1354 || (DECL_COMMON (decl
) && TREE_PUBLIC (decl
))
1355 /* Don't protect if using user section, often vars placed
1356 into user section from multiple TUs are then assumed
1357 to be an array of such vars, putting padding in there
1358 breaks this assumption. */
1359 || (DECL_SECTION_NAME (decl
) != NULL
1360 && !symtab_node::get (decl
)->implicit_section
)
1361 || DECL_SIZE (decl
) == 0
1362 || ASAN_RED_ZONE_SIZE
* BITS_PER_UNIT
> MAX_OFILE_ALIGNMENT
1363 || !valid_constant_size_p (DECL_SIZE_UNIT (decl
))
1364 || DECL_ALIGN_UNIT (decl
) > 2 * ASAN_RED_ZONE_SIZE
1365 || TREE_TYPE (decl
) == ubsan_get_source_location_type ())
1368 rtl
= DECL_RTL (decl
);
1369 if (!MEM_P (rtl
) || GET_CODE (XEXP (rtl
, 0)) != SYMBOL_REF
)
1371 symbol
= XEXP (rtl
, 0);
1373 if (CONSTANT_POOL_ADDRESS_P (symbol
)
1374 || TREE_CONSTANT_POOL_ADDRESS_P (symbol
))
1377 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl
)))
1380 #ifndef ASM_OUTPUT_DEF
1381 if (asan_needs_local_alias (decl
))
1388 /* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16,_n}.
1389 IS_STORE is either 1 (for a store) or 0 (for a load). */
1392 report_error_func (bool is_store
, bool recover_p
, HOST_WIDE_INT size_in_bytes
,
1395 static enum built_in_function report
[2][2][6]
1396 = { { { BUILT_IN_ASAN_REPORT_LOAD1
, BUILT_IN_ASAN_REPORT_LOAD2
,
1397 BUILT_IN_ASAN_REPORT_LOAD4
, BUILT_IN_ASAN_REPORT_LOAD8
,
1398 BUILT_IN_ASAN_REPORT_LOAD16
, BUILT_IN_ASAN_REPORT_LOAD_N
},
1399 { BUILT_IN_ASAN_REPORT_STORE1
, BUILT_IN_ASAN_REPORT_STORE2
,
1400 BUILT_IN_ASAN_REPORT_STORE4
, BUILT_IN_ASAN_REPORT_STORE8
,
1401 BUILT_IN_ASAN_REPORT_STORE16
, BUILT_IN_ASAN_REPORT_STORE_N
} },
1402 { { BUILT_IN_ASAN_REPORT_LOAD1_NOABORT
,
1403 BUILT_IN_ASAN_REPORT_LOAD2_NOABORT
,
1404 BUILT_IN_ASAN_REPORT_LOAD4_NOABORT
,
1405 BUILT_IN_ASAN_REPORT_LOAD8_NOABORT
,
1406 BUILT_IN_ASAN_REPORT_LOAD16_NOABORT
,
1407 BUILT_IN_ASAN_REPORT_LOAD_N_NOABORT
},
1408 { BUILT_IN_ASAN_REPORT_STORE1_NOABORT
,
1409 BUILT_IN_ASAN_REPORT_STORE2_NOABORT
,
1410 BUILT_IN_ASAN_REPORT_STORE4_NOABORT
,
1411 BUILT_IN_ASAN_REPORT_STORE8_NOABORT
,
1412 BUILT_IN_ASAN_REPORT_STORE16_NOABORT
,
1413 BUILT_IN_ASAN_REPORT_STORE_N_NOABORT
} } };
1414 if (size_in_bytes
== -1)
1417 return builtin_decl_implicit (report
[recover_p
][is_store
][5]);
1420 int size_log2
= exact_log2 (size_in_bytes
);
1421 return builtin_decl_implicit (report
[recover_p
][is_store
][size_log2
]);
1424 /* Construct a function tree for __asan_{load,store}{1,2,4,8,16,_n}.
1425 IS_STORE is either 1 (for a store) or 0 (for a load). */
1428 check_func (bool is_store
, bool recover_p
, HOST_WIDE_INT size_in_bytes
,
1431 static enum built_in_function check
[2][2][6]
1432 = { { { BUILT_IN_ASAN_LOAD1
, BUILT_IN_ASAN_LOAD2
,
1433 BUILT_IN_ASAN_LOAD4
, BUILT_IN_ASAN_LOAD8
,
1434 BUILT_IN_ASAN_LOAD16
, BUILT_IN_ASAN_LOADN
},
1435 { BUILT_IN_ASAN_STORE1
, BUILT_IN_ASAN_STORE2
,
1436 BUILT_IN_ASAN_STORE4
, BUILT_IN_ASAN_STORE8
,
1437 BUILT_IN_ASAN_STORE16
, BUILT_IN_ASAN_STOREN
} },
1438 { { BUILT_IN_ASAN_LOAD1_NOABORT
,
1439 BUILT_IN_ASAN_LOAD2_NOABORT
,
1440 BUILT_IN_ASAN_LOAD4_NOABORT
,
1441 BUILT_IN_ASAN_LOAD8_NOABORT
,
1442 BUILT_IN_ASAN_LOAD16_NOABORT
,
1443 BUILT_IN_ASAN_LOADN_NOABORT
},
1444 { BUILT_IN_ASAN_STORE1_NOABORT
,
1445 BUILT_IN_ASAN_STORE2_NOABORT
,
1446 BUILT_IN_ASAN_STORE4_NOABORT
,
1447 BUILT_IN_ASAN_STORE8_NOABORT
,
1448 BUILT_IN_ASAN_STORE16_NOABORT
,
1449 BUILT_IN_ASAN_STOREN_NOABORT
} } };
1450 if (size_in_bytes
== -1)
1453 return builtin_decl_implicit (check
[recover_p
][is_store
][5]);
1456 int size_log2
= exact_log2 (size_in_bytes
);
1457 return builtin_decl_implicit (check
[recover_p
][is_store
][size_log2
]);
1460 /* Split the current basic block and create a condition statement
1461 insertion point right before or after the statement pointed to by
1462 ITER. Return an iterator to the point at which the caller might
1463 safely insert the condition statement.
1465 THEN_BLOCK must be set to the address of an uninitialized instance
1466 of basic_block. The function will then set *THEN_BLOCK to the
1467 'then block' of the condition statement to be inserted by the
1470 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1471 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1473 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1474 block' of the condition statement to be inserted by the caller.
1476 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1477 statements starting from *ITER, and *THEN_BLOCK is a new empty
1480 *ITER is adjusted to point to always point to the first statement
1481 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1482 same as what ITER was pointing to prior to calling this function,
1483 if BEFORE_P is true; otherwise, it is its following statement. */
1485 gimple_stmt_iterator
1486 create_cond_insert_point (gimple_stmt_iterator
*iter
,
1488 bool then_more_likely_p
,
1489 bool create_then_fallthru_edge
,
1490 basic_block
*then_block
,
1491 basic_block
*fallthrough_block
)
1493 gimple_stmt_iterator gsi
= *iter
;
1495 if (!gsi_end_p (gsi
) && before_p
)
1498 basic_block cur_bb
= gsi_bb (*iter
);
1500 edge e
= split_block (cur_bb
, gsi_stmt (gsi
));
1502 /* Get a hold on the 'condition block', the 'then block' and the
1504 basic_block cond_bb
= e
->src
;
1505 basic_block fallthru_bb
= e
->dest
;
1506 basic_block then_bb
= create_empty_bb (cond_bb
);
1509 add_bb_to_loop (then_bb
, cond_bb
->loop_father
);
1510 loops_state_set (LOOPS_NEED_FIXUP
);
1513 /* Set up the newly created 'then block'. */
1514 e
= make_edge (cond_bb
, then_bb
, EDGE_TRUE_VALUE
);
1515 int fallthrough_probability
1516 = then_more_likely_p
1517 ? PROB_VERY_UNLIKELY
1518 : PROB_ALWAYS
- PROB_VERY_UNLIKELY
;
1519 e
->probability
= PROB_ALWAYS
- fallthrough_probability
;
1520 if (create_then_fallthru_edge
)
1521 make_single_succ_edge (then_bb
, fallthru_bb
, EDGE_FALLTHRU
);
1523 /* Set up the fallthrough basic block. */
1524 e
= find_edge (cond_bb
, fallthru_bb
);
1525 e
->flags
= EDGE_FALSE_VALUE
;
1526 e
->count
= cond_bb
->count
;
1527 e
->probability
= fallthrough_probability
;
1529 /* Update dominance info for the newly created then_bb; note that
1530 fallthru_bb's dominance info has already been updated by
1532 if (dom_info_available_p (CDI_DOMINATORS
))
1533 set_immediate_dominator (CDI_DOMINATORS
, then_bb
, cond_bb
);
1535 *then_block
= then_bb
;
1536 *fallthrough_block
= fallthru_bb
;
1537 *iter
= gsi_start_bb (fallthru_bb
);
1539 return gsi_last_bb (cond_bb
);
1542 /* Insert an if condition followed by a 'then block' right before the
1543 statement pointed to by ITER. The fallthrough block -- which is the
1544 else block of the condition as well as the destination of the
1545 outcoming edge of the 'then block' -- starts with the statement
1548 COND is the condition of the if.
1550 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1551 'then block' is higher than the probability of the edge to the
1554 Upon completion of the function, *THEN_BB is set to the newly
1555 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1558 *ITER is adjusted to still point to the same statement it was
1559 pointing to initially. */
1562 insert_if_then_before_iter (gcond
*cond
,
1563 gimple_stmt_iterator
*iter
,
1564 bool then_more_likely_p
,
1565 basic_block
*then_bb
,
1566 basic_block
*fallthrough_bb
)
1568 gimple_stmt_iterator cond_insert_point
=
1569 create_cond_insert_point (iter
,
1572 /*create_then_fallthru_edge=*/true,
1575 gsi_insert_after (&cond_insert_point
, cond
, GSI_NEW_STMT
);
1579 (base_addr >> ASAN_SHADOW_SHIFT) + asan_shadow_offset (). */
1582 build_shadow_mem_access (gimple_stmt_iterator
*gsi
, location_t location
,
1583 tree base_addr
, tree shadow_ptr_type
)
1585 tree t
, uintptr_type
= TREE_TYPE (base_addr
);
1586 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
1589 t
= build_int_cst (uintptr_type
, ASAN_SHADOW_SHIFT
);
1590 g
= gimple_build_assign (make_ssa_name (uintptr_type
), RSHIFT_EXPR
,
1592 gimple_set_location (g
, location
);
1593 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1595 t
= build_int_cst (uintptr_type
, asan_shadow_offset ());
1596 g
= gimple_build_assign (make_ssa_name (uintptr_type
), PLUS_EXPR
,
1597 gimple_assign_lhs (g
), t
);
1598 gimple_set_location (g
, location
);
1599 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1601 g
= gimple_build_assign (make_ssa_name (shadow_ptr_type
), NOP_EXPR
,
1602 gimple_assign_lhs (g
));
1603 gimple_set_location (g
, location
);
1604 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1606 t
= build2 (MEM_REF
, shadow_type
, gimple_assign_lhs (g
),
1607 build_int_cst (shadow_ptr_type
, 0));
1608 g
= gimple_build_assign (make_ssa_name (shadow_type
), MEM_REF
, t
);
1609 gimple_set_location (g
, location
);
1610 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1611 return gimple_assign_lhs (g
);
1614 /* BASE can already be an SSA_NAME; in that case, do not create a
1615 new SSA_NAME for it. */
1618 maybe_create_ssa_name (location_t loc
, tree base
, gimple_stmt_iterator
*iter
,
1621 if (TREE_CODE (base
) == SSA_NAME
)
1623 gimple g
= gimple_build_assign (make_ssa_name (TREE_TYPE (base
)),
1624 TREE_CODE (base
), base
);
1625 gimple_set_location (g
, loc
);
1627 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1629 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
1630 return gimple_assign_lhs (g
);
1633 /* LEN can already have necessary size and precision;
1634 in that case, do not create a new variable. */
1637 maybe_cast_to_ptrmode (location_t loc
, tree len
, gimple_stmt_iterator
*iter
,
1640 if (ptrofftype_p (len
))
1642 gimple g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
1644 gimple_set_location (g
, loc
);
1646 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1648 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
1649 return gimple_assign_lhs (g
);
1652 /* Instrument the memory access instruction BASE. Insert new
1653 statements before or after ITER.
1655 Note that the memory access represented by BASE can be either an
1656 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1657 location. IS_STORE is TRUE for a store, FALSE for a load.
1658 BEFORE_P is TRUE for inserting the instrumentation code before
1659 ITER, FALSE for inserting it after ITER. IS_SCALAR_ACCESS is TRUE
1660 for a scalar memory access and FALSE for memory region access.
1661 NON_ZERO_P is TRUE if memory region is guaranteed to have non-zero
1662 length. ALIGN tells alignment of accessed memory object.
1664 START_INSTRUMENTED and END_INSTRUMENTED are TRUE if start/end of
1665 memory region have already been instrumented.
1667 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1668 statement it was pointing to prior to calling this function,
1669 otherwise, it points to the statement logically following it. */
1672 build_check_stmt (location_t loc
, tree base
, tree len
,
1673 HOST_WIDE_INT size_in_bytes
, gimple_stmt_iterator
*iter
,
1674 bool is_non_zero_len
, bool before_p
, bool is_store
,
1675 bool is_scalar_access
, unsigned int align
= 0)
1677 gimple_stmt_iterator gsi
= *iter
;
1680 gcc_assert (!(size_in_bytes
> 0 && !is_non_zero_len
));
1684 base
= unshare_expr (base
);
1685 base
= maybe_create_ssa_name (loc
, base
, &gsi
, before_p
);
1689 len
= unshare_expr (len
);
1690 len
= maybe_cast_to_ptrmode (loc
, len
, iter
, before_p
);
1694 gcc_assert (size_in_bytes
!= -1);
1695 len
= build_int_cst (pointer_sized_int_node
, size_in_bytes
);
1698 if (size_in_bytes
> 1)
1700 if ((size_in_bytes
& (size_in_bytes
- 1)) != 0
1701 || size_in_bytes
> 16)
1702 is_scalar_access
= false;
1703 else if (align
&& align
< size_in_bytes
* BITS_PER_UNIT
)
1705 /* On non-strict alignment targets, if
1706 16-byte access is just 8-byte aligned,
1707 this will result in misaligned shadow
1708 memory 2 byte load, but otherwise can
1709 be handled using one read. */
1710 if (size_in_bytes
!= 16
1712 || align
< 8 * BITS_PER_UNIT
)
1713 is_scalar_access
= false;
1717 HOST_WIDE_INT flags
= 0;
1719 flags
|= ASAN_CHECK_STORE
;
1720 if (is_non_zero_len
)
1721 flags
|= ASAN_CHECK_NON_ZERO_LEN
;
1722 if (is_scalar_access
)
1723 flags
|= ASAN_CHECK_SCALAR_ACCESS
;
1725 g
= gimple_build_call_internal (IFN_ASAN_CHECK
, 4,
1726 build_int_cst (integer_type_node
, flags
),
1728 build_int_cst (integer_type_node
,
1729 align
/ BITS_PER_UNIT
));
1730 gimple_set_location (g
, loc
);
1732 gsi_insert_before (&gsi
, g
, GSI_SAME_STMT
);
1735 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1741 /* If T represents a memory access, add instrumentation code before ITER.
1742 LOCATION is source code location.
1743 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
1746 instrument_derefs (gimple_stmt_iterator
*iter
, tree t
,
1747 location_t location
, bool is_store
)
1749 if (is_store
&& !ASAN_INSTRUMENT_WRITES
)
1751 if (!is_store
&& !ASAN_INSTRUMENT_READS
)
1755 HOST_WIDE_INT size_in_bytes
;
1757 type
= TREE_TYPE (t
);
1758 switch (TREE_CODE (t
))
1772 size_in_bytes
= int_size_in_bytes (type
);
1773 if (size_in_bytes
<= 0)
1776 HOST_WIDE_INT bitsize
, bitpos
;
1779 int volatilep
= 0, unsignedp
= 0;
1780 tree inner
= get_inner_reference (t
, &bitsize
, &bitpos
, &offset
,
1781 &mode
, &unsignedp
, &volatilep
, false);
1783 if (TREE_CODE (t
) == COMPONENT_REF
1784 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1)) != NULL_TREE
)
1786 tree repr
= DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1));
1787 instrument_derefs (iter
, build3 (COMPONENT_REF
, TREE_TYPE (repr
),
1788 TREE_OPERAND (t
, 0), repr
,
1789 NULL_TREE
), location
, is_store
);
1793 if (bitpos
% BITS_PER_UNIT
1794 || bitsize
!= size_in_bytes
* BITS_PER_UNIT
)
1797 if (TREE_CODE (inner
) == VAR_DECL
1798 && offset
== NULL_TREE
1800 && DECL_SIZE (inner
)
1801 && tree_fits_shwi_p (DECL_SIZE (inner
))
1802 && bitpos
+ bitsize
<= tree_to_shwi (DECL_SIZE (inner
)))
1804 if (DECL_THREAD_LOCAL_P (inner
))
1806 if (!TREE_STATIC (inner
))
1808 /* Automatic vars in the current function will be always
1810 if (decl_function_context (inner
) == current_function_decl
)
1813 /* Always instrument external vars, they might be dynamically
1815 else if (!DECL_EXTERNAL (inner
))
1817 /* For static vars if they are known not to be dynamically
1818 initialized, they will be always accessible. */
1819 varpool_node
*vnode
= varpool_node::get (inner
);
1820 if (vnode
&& !vnode
->dynamically_initialized
)
1825 base
= build_fold_addr_expr (t
);
1826 if (!has_mem_ref_been_instrumented (base
, size_in_bytes
))
1828 unsigned int align
= get_object_alignment (t
);
1829 build_check_stmt (location
, base
, NULL_TREE
, size_in_bytes
, iter
,
1830 /*is_non_zero_len*/size_in_bytes
> 0, /*before_p=*/true,
1831 is_store
, /*is_scalar_access*/true, align
);
1832 update_mem_ref_hash_table (base
, size_in_bytes
);
1833 update_mem_ref_hash_table (t
, size_in_bytes
);
1838 /* Insert a memory reference into the hash table if access length
1839 can be determined in compile time. */
1842 maybe_update_mem_ref_hash_table (tree base
, tree len
)
1844 if (!POINTER_TYPE_P (TREE_TYPE (base
))
1845 || !INTEGRAL_TYPE_P (TREE_TYPE (len
)))
1848 HOST_WIDE_INT size_in_bytes
= tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
1850 if (size_in_bytes
!= -1)
1851 update_mem_ref_hash_table (base
, size_in_bytes
);
1854 /* Instrument an access to a contiguous memory region that starts at
1855 the address pointed to by BASE, over a length of LEN (expressed in
1856 the sizeof (*BASE) bytes). ITER points to the instruction before
1857 which the instrumentation instructions must be inserted. LOCATION
1858 is the source location that the instrumentation instructions must
1859 have. If IS_STORE is true, then the memory access is a store;
1860 otherwise, it's a load. */
1863 instrument_mem_region_access (tree base
, tree len
,
1864 gimple_stmt_iterator
*iter
,
1865 location_t location
, bool is_store
)
1867 if (!POINTER_TYPE_P (TREE_TYPE (base
))
1868 || !INTEGRAL_TYPE_P (TREE_TYPE (len
))
1869 || integer_zerop (len
))
1872 HOST_WIDE_INT size_in_bytes
= tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
1874 if ((size_in_bytes
== -1)
1875 || !has_mem_ref_been_instrumented (base
, size_in_bytes
))
1877 build_check_stmt (location
, base
, len
, size_in_bytes
, iter
,
1878 /*is_non_zero_len*/size_in_bytes
> 0, /*before_p*/true,
1879 is_store
, /*is_scalar_access*/false, /*align*/0);
1882 maybe_update_mem_ref_hash_table (base
, len
);
1883 *iter
= gsi_for_stmt (gsi_stmt (*iter
));
1886 /* Instrument the call to a built-in memory access function that is
1887 pointed to by the iterator ITER.
1889 Upon completion, return TRUE iff *ITER has been advanced to the
1890 statement following the one it was originally pointing to. */
1893 instrument_builtin_call (gimple_stmt_iterator
*iter
)
1895 if (!ASAN_MEMINTRIN
)
1898 bool iter_advanced_p
= false;
1899 gcall
*call
= as_a
<gcall
*> (gsi_stmt (*iter
));
1901 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
1903 location_t loc
= gimple_location (call
);
1905 asan_mem_ref src0
, src1
, dest
;
1906 asan_mem_ref_init (&src0
, NULL
, 1);
1907 asan_mem_ref_init (&src1
, NULL
, 1);
1908 asan_mem_ref_init (&dest
, NULL
, 1);
1910 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
1911 bool src0_is_store
= false, src1_is_store
= false, dest_is_store
= false,
1912 dest_is_deref
= false, intercepted_p
= true;
1914 if (get_mem_refs_of_builtin_call (call
,
1915 &src0
, &src0_len
, &src0_is_store
,
1916 &src1
, &src1_len
, &src1_is_store
,
1917 &dest
, &dest_len
, &dest_is_store
,
1918 &dest_is_deref
, &intercepted_p
))
1922 instrument_derefs (iter
, dest
.start
, loc
, dest_is_store
);
1924 iter_advanced_p
= true;
1926 else if (!intercepted_p
1927 && (src0_len
|| src1_len
|| dest_len
))
1929 if (src0
.start
!= NULL_TREE
)
1930 instrument_mem_region_access (src0
.start
, src0_len
,
1931 iter
, loc
, /*is_store=*/false);
1932 if (src1
.start
!= NULL_TREE
)
1933 instrument_mem_region_access (src1
.start
, src1_len
,
1934 iter
, loc
, /*is_store=*/false);
1935 if (dest
.start
!= NULL_TREE
)
1936 instrument_mem_region_access (dest
.start
, dest_len
,
1937 iter
, loc
, /*is_store=*/true);
1939 *iter
= gsi_for_stmt (call
);
1941 iter_advanced_p
= true;
1945 if (src0
.start
!= NULL_TREE
)
1946 maybe_update_mem_ref_hash_table (src0
.start
, src0_len
);
1947 if (src1
.start
!= NULL_TREE
)
1948 maybe_update_mem_ref_hash_table (src1
.start
, src1_len
);
1949 if (dest
.start
!= NULL_TREE
)
1950 maybe_update_mem_ref_hash_table (dest
.start
, dest_len
);
1953 return iter_advanced_p
;
1956 /* Instrument the assignment statement ITER if it is subject to
1957 instrumentation. Return TRUE iff instrumentation actually
1958 happened. In that case, the iterator ITER is advanced to the next
1959 logical expression following the one initially pointed to by ITER,
1960 and the relevant memory reference that which access has been
1961 instrumented is added to the memory references hash table. */
1964 maybe_instrument_assignment (gimple_stmt_iterator
*iter
)
1966 gimple s
= gsi_stmt (*iter
);
1968 gcc_assert (gimple_assign_single_p (s
));
1970 tree ref_expr
= NULL_TREE
;
1971 bool is_store
, is_instrumented
= false;
1973 if (gimple_store_p (s
))
1975 ref_expr
= gimple_assign_lhs (s
);
1977 instrument_derefs (iter
, ref_expr
,
1978 gimple_location (s
),
1980 is_instrumented
= true;
1983 if (gimple_assign_load_p (s
))
1985 ref_expr
= gimple_assign_rhs1 (s
);
1987 instrument_derefs (iter
, ref_expr
,
1988 gimple_location (s
),
1990 is_instrumented
= true;
1993 if (is_instrumented
)
1996 return is_instrumented
;
1999 /* Instrument the function call pointed to by the iterator ITER, if it
2000 is subject to instrumentation. At the moment, the only function
2001 calls that are instrumented are some built-in functions that access
2002 memory. Look at instrument_builtin_call to learn more.
2004 Upon completion return TRUE iff *ITER was advanced to the statement
2005 following the one it was originally pointing to. */
2008 maybe_instrument_call (gimple_stmt_iterator
*iter
)
2010 gimple stmt
= gsi_stmt (*iter
);
2011 bool is_builtin
= gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
);
2013 if (is_builtin
&& instrument_builtin_call (iter
))
2016 if (gimple_call_noreturn_p (stmt
))
2020 tree callee
= gimple_call_fndecl (stmt
);
2021 switch (DECL_FUNCTION_CODE (callee
))
2023 case BUILT_IN_UNREACHABLE
:
2025 /* Don't instrument these. */
2031 tree decl
= builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN
);
2032 gimple g
= gimple_build_call (decl
, 0);
2033 gimple_set_location (g
, gimple_location (stmt
));
2034 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2039 /* Walk each instruction of all basic block and instrument those that
2040 represent memory references: loads, stores, or function calls.
2041 In a given basic block, this function avoids instrumenting memory
2042 references that have already been instrumented. */
2045 transform_statements (void)
2047 basic_block bb
, last_bb
= NULL
;
2048 gimple_stmt_iterator i
;
2049 int saved_last_basic_block
= last_basic_block_for_fn (cfun
);
2051 FOR_EACH_BB_FN (bb
, cfun
)
2053 basic_block prev_bb
= bb
;
2055 if (bb
->index
>= saved_last_basic_block
) continue;
2057 /* Flush the mem ref hash table, if current bb doesn't have
2058 exactly one predecessor, or if that predecessor (skipping
2059 over asan created basic blocks) isn't the last processed
2060 basic block. Thus we effectively flush on extended basic
2061 block boundaries. */
2062 while (single_pred_p (prev_bb
))
2064 prev_bb
= single_pred (prev_bb
);
2065 if (prev_bb
->index
< saved_last_basic_block
)
2068 if (prev_bb
!= last_bb
)
2069 empty_mem_ref_hash_table ();
2072 for (i
= gsi_start_bb (bb
); !gsi_end_p (i
);)
2074 gimple s
= gsi_stmt (i
);
2076 if (has_stmt_been_instrumented_p (s
))
2078 else if (gimple_assign_single_p (s
)
2079 && !gimple_clobber_p (s
)
2080 && maybe_instrument_assignment (&i
))
2081 /* Nothing to do as maybe_instrument_assignment advanced
2083 else if (is_gimple_call (s
) && maybe_instrument_call (&i
))
2084 /* Nothing to do as maybe_instrument_call
2085 advanced the iterator I. */;
2088 /* No instrumentation happened.
2090 If the current instruction is a function call that
2091 might free something, let's forget about the memory
2092 references that got instrumented. Otherwise we might
2093 miss some instrumentation opportunities. */
2094 if (is_gimple_call (s
) && !nonfreeing_call_p (s
))
2095 empty_mem_ref_hash_table ();
2101 free_mem_ref_resources ();
2105 __asan_before_dynamic_init (module_name)
2107 __asan_after_dynamic_init ()
2111 asan_dynamic_init_call (bool after_p
)
2113 tree fn
= builtin_decl_implicit (after_p
2114 ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
2115 : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT
);
2116 tree module_name_cst
= NULL_TREE
;
2119 pretty_printer module_name_pp
;
2120 pp_string (&module_name_pp
, main_input_filename
);
2122 if (shadow_ptr_types
[0] == NULL_TREE
)
2123 asan_init_shadow_ptr_types ();
2124 module_name_cst
= asan_pp_string (&module_name_pp
);
2125 module_name_cst
= fold_convert (const_ptr_type_node
,
2129 return build_call_expr (fn
, after_p
? 0 : 1, module_name_cst
);
2133 struct __asan_global
2137 uptr __size_with_redzone;
2139 const void *__module_name;
2140 uptr __has_dynamic_init;
2141 __asan_global_source_location *__location;
2145 asan_global_struct (void)
2147 static const char *field_names
[7]
2148 = { "__beg", "__size", "__size_with_redzone",
2149 "__name", "__module_name", "__has_dynamic_init", "__location"};
2150 tree fields
[7], ret
;
2153 ret
= make_node (RECORD_TYPE
);
2154 for (i
= 0; i
< 7; i
++)
2157 = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
,
2158 get_identifier (field_names
[i
]),
2159 (i
== 0 || i
== 3) ? const_ptr_type_node
2160 : pointer_sized_int_node
);
2161 DECL_CONTEXT (fields
[i
]) = ret
;
2163 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
2165 tree type_decl
= build_decl (input_location
, TYPE_DECL
,
2166 get_identifier ("__asan_global"), ret
);
2167 DECL_IGNORED_P (type_decl
) = 1;
2168 DECL_ARTIFICIAL (type_decl
) = 1;
2169 TYPE_FIELDS (ret
) = fields
[0];
2170 TYPE_NAME (ret
) = type_decl
;
2171 TYPE_STUB_DECL (ret
) = type_decl
;
2176 /* Append description of a single global DECL into vector V.
2177 TYPE is __asan_global struct type as returned by asan_global_struct. */
2180 asan_add_global (tree decl
, tree type
, vec
<constructor_elt
, va_gc
> *v
)
2182 tree init
, uptr
= TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type
)));
2183 unsigned HOST_WIDE_INT size
;
2184 tree str_cst
, module_name_cst
, refdecl
= decl
;
2185 vec
<constructor_elt
, va_gc
> *vinner
= NULL
;
2187 pretty_printer asan_pp
, module_name_pp
;
2189 if (DECL_NAME (decl
))
2190 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
2192 pp_string (&asan_pp
, "<unknown>");
2193 str_cst
= asan_pp_string (&asan_pp
);
2195 pp_string (&module_name_pp
, main_input_filename
);
2196 module_name_cst
= asan_pp_string (&module_name_pp
);
2198 if (asan_needs_local_alias (decl
))
2201 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", vec_safe_length (v
) + 1);
2202 refdecl
= build_decl (DECL_SOURCE_LOCATION (decl
),
2203 VAR_DECL
, get_identifier (buf
), TREE_TYPE (decl
));
2204 TREE_ADDRESSABLE (refdecl
) = TREE_ADDRESSABLE (decl
);
2205 TREE_READONLY (refdecl
) = TREE_READONLY (decl
);
2206 TREE_THIS_VOLATILE (refdecl
) = TREE_THIS_VOLATILE (decl
);
2207 DECL_GIMPLE_REG_P (refdecl
) = DECL_GIMPLE_REG_P (decl
);
2208 DECL_ARTIFICIAL (refdecl
) = DECL_ARTIFICIAL (decl
);
2209 DECL_IGNORED_P (refdecl
) = DECL_IGNORED_P (decl
);
2210 TREE_STATIC (refdecl
) = 1;
2211 TREE_PUBLIC (refdecl
) = 0;
2212 TREE_USED (refdecl
) = 1;
2213 assemble_alias (refdecl
, DECL_ASSEMBLER_NAME (decl
));
2216 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2217 fold_convert (const_ptr_type_node
,
2218 build_fold_addr_expr (refdecl
)));
2219 size
= tree_to_uhwi (DECL_SIZE_UNIT (decl
));
2220 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2221 size
+= asan_red_zone_size (size
);
2222 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2223 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2224 fold_convert (const_ptr_type_node
, str_cst
));
2225 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2226 fold_convert (const_ptr_type_node
, module_name_cst
));
2227 varpool_node
*vnode
= varpool_node::get (decl
);
2228 int has_dynamic_init
= vnode
? vnode
->dynamically_initialized
: 0;
2229 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2230 build_int_cst (uptr
, has_dynamic_init
));
2231 tree locptr
= NULL_TREE
;
2232 location_t loc
= DECL_SOURCE_LOCATION (decl
);
2233 expanded_location xloc
= expand_location (loc
);
2234 if (xloc
.file
!= NULL
)
2236 static int lasanloccnt
= 0;
2238 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASANLOC", ++lasanloccnt
);
2239 tree var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (buf
),
2240 ubsan_get_source_location_type ());
2241 TREE_STATIC (var
) = 1;
2242 TREE_PUBLIC (var
) = 0;
2243 DECL_ARTIFICIAL (var
) = 1;
2244 DECL_IGNORED_P (var
) = 1;
2245 pretty_printer filename_pp
;
2246 pp_string (&filename_pp
, xloc
.file
);
2247 tree str
= asan_pp_string (&filename_pp
);
2248 tree ctor
= build_constructor_va (TREE_TYPE (var
), 3,
2249 NULL_TREE
, str
, NULL_TREE
,
2250 build_int_cst (unsigned_type_node
,
2251 xloc
.line
), NULL_TREE
,
2252 build_int_cst (unsigned_type_node
,
2254 TREE_CONSTANT (ctor
) = 1;
2255 TREE_STATIC (ctor
) = 1;
2256 DECL_INITIAL (var
) = ctor
;
2257 varpool_node::finalize_decl (var
);
2258 locptr
= fold_convert (uptr
, build_fold_addr_expr (var
));
2261 locptr
= build_int_cst (uptr
, 0);
2262 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, locptr
);
2263 init
= build_constructor (type
, vinner
);
2264 CONSTRUCTOR_APPEND_ELT (v
, NULL_TREE
, init
);
2267 /* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2269 initialize_sanitizer_builtins (void)
2273 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT
))
2276 tree BT_FN_VOID
= build_function_type_list (void_type_node
, NULL_TREE
);
2278 = build_function_type_list (void_type_node
, ptr_type_node
, NULL_TREE
);
2279 tree BT_FN_VOID_CONST_PTR
2280 = build_function_type_list (void_type_node
, const_ptr_type_node
, NULL_TREE
);
2281 tree BT_FN_VOID_PTR_PTR
2282 = build_function_type_list (void_type_node
, ptr_type_node
,
2283 ptr_type_node
, NULL_TREE
);
2284 tree BT_FN_VOID_PTR_PTR_PTR
2285 = build_function_type_list (void_type_node
, ptr_type_node
,
2286 ptr_type_node
, ptr_type_node
, NULL_TREE
);
2287 tree BT_FN_VOID_PTR_PTRMODE
2288 = build_function_type_list (void_type_node
, ptr_type_node
,
2289 pointer_sized_int_node
, NULL_TREE
);
2291 = build_function_type_list (void_type_node
, integer_type_node
, NULL_TREE
);
2292 tree BT_FN_SIZE_CONST_PTR_INT
2293 = build_function_type_list (size_type_node
, const_ptr_type_node
,
2294 integer_type_node
, NULL_TREE
);
2295 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[5];
2296 tree BT_FN_IX_CONST_VPTR_INT
[5];
2297 tree BT_FN_IX_VPTR_IX_INT
[5];
2298 tree BT_FN_VOID_VPTR_IX_INT
[5];
2300 = build_pointer_type (build_qualified_type (void_type_node
,
2301 TYPE_QUAL_VOLATILE
));
2303 = build_pointer_type (build_qualified_type (void_type_node
,
2307 = lang_hooks
.types
.type_for_size (BOOL_TYPE_SIZE
, 1);
2309 for (i
= 0; i
< 5; i
++)
2311 tree ix
= build_nonstandard_integer_type (BITS_PER_UNIT
* (1 << i
), 1);
2312 BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[i
]
2313 = build_function_type_list (boolt
, vptr
, ptr_type_node
, ix
,
2314 integer_type_node
, integer_type_node
,
2316 BT_FN_IX_CONST_VPTR_INT
[i
]
2317 = build_function_type_list (ix
, cvptr
, integer_type_node
, NULL_TREE
);
2318 BT_FN_IX_VPTR_IX_INT
[i
]
2319 = build_function_type_list (ix
, vptr
, ix
, integer_type_node
,
2321 BT_FN_VOID_VPTR_IX_INT
[i
]
2322 = build_function_type_list (void_type_node
, vptr
, ix
,
2323 integer_type_node
, NULL_TREE
);
2325 #define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2326 #define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2327 #define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2328 #define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2329 #define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2330 #define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2331 #define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2332 #define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2333 #define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2334 #define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2335 #define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2336 #define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2337 #define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2338 #define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2339 #define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2340 #define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2341 #define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2342 #define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2343 #define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2344 #define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2345 #undef ATTR_NOTHROW_LEAF_LIST
2346 #define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2347 #undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2348 #define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2349 #undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2350 #define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2351 #undef ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2352 #define ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST \
2353 ECF_CONST | ATTR_NORETURN_NOTHROW_LEAF_LIST
2354 #undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2355 #define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2356 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2357 #undef ATTR_COLD_NOTHROW_LEAF_LIST
2358 #define ATTR_COLD_NOTHROW_LEAF_LIST \
2359 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2360 #undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2361 #define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2362 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2363 #undef ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST
2364 #define ATTR_COLD_CONST_NORETURN_NOTHROW_LEAF_LIST \
2365 /* ECF_COLD missing */ ATTR_CONST_NORETURN_NOTHROW_LEAF_LIST
2366 #undef ATTR_PURE_NOTHROW_LEAF_LIST
2367 #define ATTR_PURE_NOTHROW_LEAF_LIST ECF_PURE | ATTR_NOTHROW_LEAF_LIST
2368 #undef DEF_SANITIZER_BUILTIN
2369 #define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2370 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2371 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2372 set_call_expr_flags (decl, ATTRS); \
2373 set_builtin_decl (ENUM, decl, true);
2375 #include "sanitizer.def"
2377 /* -fsanitize=object-size uses __builtin_object_size, but that might
2378 not be available for e.g. Fortran at this point. We use
2379 DEF_SANITIZER_BUILTIN here only as a convenience macro. */
2380 if ((flag_sanitize
& SANITIZE_OBJECT_SIZE
)
2381 && !builtin_decl_implicit_p (BUILT_IN_OBJECT_SIZE
))
2382 DEF_SANITIZER_BUILTIN (BUILT_IN_OBJECT_SIZE
, "object_size",
2383 BT_FN_SIZE_CONST_PTR_INT
,
2384 ATTR_PURE_NOTHROW_LEAF_LIST
)
2386 #undef DEF_SANITIZER_BUILTIN
2389 /* Called via htab_traverse. Count number of emitted
2390 STRING_CSTs in the constant hash table. */
2393 count_string_csts (constant_descriptor_tree
**slot
,
2394 unsigned HOST_WIDE_INT
*data
)
2396 struct constant_descriptor_tree
*desc
= *slot
;
2397 if (TREE_CODE (desc
->value
) == STRING_CST
2398 && TREE_ASM_WRITTEN (desc
->value
)
2399 && asan_protect_global (desc
->value
))
2404 /* Helper structure to pass two parameters to
2407 struct asan_add_string_csts_data
2410 vec
<constructor_elt
, va_gc
> *v
;
2413 /* Called via hash_table::traverse. Call asan_add_global
2414 on emitted STRING_CSTs from the constant hash table. */
2417 add_string_csts (constant_descriptor_tree
**slot
,
2418 asan_add_string_csts_data
*aascd
)
2420 struct constant_descriptor_tree
*desc
= *slot
;
2421 if (TREE_CODE (desc
->value
) == STRING_CST
2422 && TREE_ASM_WRITTEN (desc
->value
)
2423 && asan_protect_global (desc
->value
))
2425 asan_add_global (SYMBOL_REF_DECL (XEXP (desc
->rtl
, 0)),
2426 aascd
->type
, aascd
->v
);
2431 /* Needs to be GTY(()), because cgraph_build_static_cdtor may
2432 invoke ggc_collect. */
2433 static GTY(()) tree asan_ctor_statements
;
2435 /* Module-level instrumentation.
2436 - Insert __asan_init_vN() into the list of CTORs.
2437 - TODO: insert redzones around globals.
2441 asan_finish_file (void)
2443 varpool_node
*vnode
;
2444 unsigned HOST_WIDE_INT gcount
= 0;
2446 if (shadow_ptr_types
[0] == NULL_TREE
)
2447 asan_init_shadow_ptr_types ();
2448 /* Avoid instrumenting code in the asan ctors/dtors.
2449 We don't need to insert padding after the description strings,
2450 nor after .LASAN* array. */
2451 flag_sanitize
&= ~SANITIZE_ADDRESS
;
2453 /* For user-space we want asan constructors to run first.
2454 Linux kernel does not support priorities other than default, and the only
2455 other user of constructors is coverage. So we run with the default
2457 int priority
= flag_sanitize
& SANITIZE_USER_ADDRESS
2458 ? MAX_RESERVED_INIT_PRIORITY
- 1 : DEFAULT_INIT_PRIORITY
;
2460 if (flag_sanitize
& SANITIZE_USER_ADDRESS
)
2462 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_INIT
);
2463 append_to_statement_list (build_call_expr (fn
, 0), &asan_ctor_statements
);
2465 FOR_EACH_DEFINED_VARIABLE (vnode
)
2466 if (TREE_ASM_WRITTEN (vnode
->decl
)
2467 && asan_protect_global (vnode
->decl
))
2469 hash_table
<tree_descriptor_hasher
> *const_desc_htab
= constant_pool_htab ();
2470 const_desc_htab
->traverse
<unsigned HOST_WIDE_INT
*, count_string_csts
>
2474 tree type
= asan_global_struct (), var
, ctor
;
2475 tree dtor_statements
= NULL_TREE
;
2476 vec
<constructor_elt
, va_gc
> *v
;
2479 type
= build_array_type_nelts (type
, gcount
);
2480 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", 0);
2481 var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (buf
),
2483 TREE_STATIC (var
) = 1;
2484 TREE_PUBLIC (var
) = 0;
2485 DECL_ARTIFICIAL (var
) = 1;
2486 DECL_IGNORED_P (var
) = 1;
2487 vec_alloc (v
, gcount
);
2488 FOR_EACH_DEFINED_VARIABLE (vnode
)
2489 if (TREE_ASM_WRITTEN (vnode
->decl
)
2490 && asan_protect_global (vnode
->decl
))
2491 asan_add_global (vnode
->decl
, TREE_TYPE (type
), v
);
2492 struct asan_add_string_csts_data aascd
;
2493 aascd
.type
= TREE_TYPE (type
);
2495 const_desc_htab
->traverse
<asan_add_string_csts_data
*, add_string_csts
>
2497 ctor
= build_constructor (type
, v
);
2498 TREE_CONSTANT (ctor
) = 1;
2499 TREE_STATIC (ctor
) = 1;
2500 DECL_INITIAL (var
) = ctor
;
2501 varpool_node::finalize_decl (var
);
2503 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS
);
2504 tree gcount_tree
= build_int_cst (pointer_sized_int_node
, gcount
);
2505 append_to_statement_list (build_call_expr (fn
, 2,
2506 build_fold_addr_expr (var
),
2508 &asan_ctor_statements
);
2510 fn
= builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS
);
2511 append_to_statement_list (build_call_expr (fn
, 2,
2512 build_fold_addr_expr (var
),
2515 cgraph_build_static_cdtor ('D', dtor_statements
, priority
);
2517 if (asan_ctor_statements
)
2518 cgraph_build_static_cdtor ('I', asan_ctor_statements
, priority
);
2519 flag_sanitize
|= SANITIZE_ADDRESS
;
2522 /* Expand the ASAN_{LOAD,STORE} builtins. */
2525 asan_expand_check_ifn (gimple_stmt_iterator
*iter
, bool use_calls
)
2527 gimple g
= gsi_stmt (*iter
);
2528 location_t loc
= gimple_location (g
);
2531 = (flag_sanitize
& flag_sanitize_recover
& SANITIZE_KERNEL_ADDRESS
) != 0;
2533 HOST_WIDE_INT flags
= tree_to_shwi (gimple_call_arg (g
, 0));
2534 gcc_assert (flags
< ASAN_CHECK_LAST
);
2535 bool is_scalar_access
= (flags
& ASAN_CHECK_SCALAR_ACCESS
) != 0;
2536 bool is_store
= (flags
& ASAN_CHECK_STORE
) != 0;
2537 bool is_non_zero_len
= (flags
& ASAN_CHECK_NON_ZERO_LEN
) != 0;
2539 tree base
= gimple_call_arg (g
, 1);
2540 tree len
= gimple_call_arg (g
, 2);
2541 HOST_WIDE_INT align
= tree_to_shwi (gimple_call_arg (g
, 3));
2543 HOST_WIDE_INT size_in_bytes
2544 = is_scalar_access
&& tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
2548 /* Instrument using callbacks. */
2549 gimple g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2551 gimple_set_location (g
, loc
);
2552 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2553 tree base_addr
= gimple_assign_lhs (g
);
2556 tree fun
= check_func (is_store
, recover_p
, size_in_bytes
, &nargs
);
2558 g
= gimple_build_call (fun
, 1, base_addr
);
2561 gcc_assert (nargs
== 2);
2562 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2564 gimple_set_location (g
, loc
);
2565 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2566 tree sz_arg
= gimple_assign_lhs (g
);
2567 g
= gimple_build_call (fun
, nargs
, base_addr
, sz_arg
);
2569 gimple_set_location (g
, loc
);
2570 gsi_replace (iter
, g
, false);
2574 HOST_WIDE_INT real_size_in_bytes
= size_in_bytes
== -1 ? 1 : size_in_bytes
;
2576 tree shadow_ptr_type
= shadow_ptr_types
[real_size_in_bytes
== 16 ? 1 : 0];
2577 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
2579 gimple_stmt_iterator gsi
= *iter
;
2581 if (!is_non_zero_len
)
2583 /* So, the length of the memory area to asan-protect is
2584 non-constant. Let's guard the generated instrumentation code
2589 //asan instrumentation code goes here.
2591 // falltrough instructions, starting with *ITER. */
2593 g
= gimple_build_cond (NE_EXPR
,
2595 build_int_cst (TREE_TYPE (len
), 0),
2596 NULL_TREE
, NULL_TREE
);
2597 gimple_set_location (g
, loc
);
2599 basic_block then_bb
, fallthrough_bb
;
2600 insert_if_then_before_iter (as_a
<gcond
*> (g
), iter
,
2601 /*then_more_likely_p=*/true,
2602 &then_bb
, &fallthrough_bb
);
2603 /* Note that fallthrough_bb starts with the statement that was
2604 pointed to by ITER. */
2606 /* The 'then block' of the 'if (len != 0) condition is where
2607 we'll generate the asan instrumentation code now. */
2608 gsi
= gsi_last_bb (then_bb
);
2611 /* Get an iterator on the point where we can add the condition
2612 statement for the instrumentation. */
2613 basic_block then_bb
, else_bb
;
2614 gsi
= create_cond_insert_point (&gsi
, /*before_p*/false,
2615 /*then_more_likely_p=*/false,
2616 /*create_then_fallthru_edge*/recover_p
,
2620 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2622 gimple_set_location (g
, loc
);
2623 gsi_insert_before (&gsi
, g
, GSI_NEW_STMT
);
2624 tree base_addr
= gimple_assign_lhs (g
);
2627 if (real_size_in_bytes
>= 8)
2629 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_addr
,
2635 /* Slow path for 1, 2 and 4 byte accesses. */
2636 /* Test (shadow != 0)
2637 & ((base_addr & 7) + (real_size_in_bytes - 1)) >= shadow). */
2638 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_addr
,
2640 gimple shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
2641 gimple_seq seq
= NULL
;
2642 gimple_seq_add_stmt (&seq
, shadow_test
);
2643 /* Aligned (>= 8 bytes) can test just
2644 (real_size_in_bytes - 1 >= shadow), as base_addr & 7 is known
2648 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
,
2650 gimple_seq_add_stmt (&seq
,
2651 build_type_cast (shadow_type
,
2652 gimple_seq_last (seq
)));
2653 if (real_size_in_bytes
> 1)
2654 gimple_seq_add_stmt (&seq
,
2655 build_assign (PLUS_EXPR
,
2656 gimple_seq_last (seq
),
2657 real_size_in_bytes
- 1));
2658 t
= gimple_assign_lhs (gimple_seq_last_stmt (seq
));
2661 t
= build_int_cst (shadow_type
, real_size_in_bytes
- 1);
2662 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
, t
, shadow
));
2663 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
2664 gimple_seq_last (seq
)));
2665 t
= gimple_assign_lhs (gimple_seq_last (seq
));
2666 gimple_seq_set_location (seq
, loc
);
2667 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
2669 /* For non-constant, misaligned or otherwise weird access sizes,
2670 check first and last byte. */
2671 if (size_in_bytes
== -1)
2673 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2675 build_int_cst (pointer_sized_int_node
, 1));
2676 gimple_set_location (g
, loc
);
2677 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2678 tree last
= gimple_assign_lhs (g
);
2679 g
= gimple_build_assign (make_ssa_name (pointer_sized_int_node
),
2680 PLUS_EXPR
, base_addr
, last
);
2681 gimple_set_location (g
, loc
);
2682 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2683 tree base_end_addr
= gimple_assign_lhs (g
);
2685 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_end_addr
,
2687 gimple shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
2688 gimple_seq seq
= NULL
;
2689 gimple_seq_add_stmt (&seq
, shadow_test
);
2690 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
,
2692 gimple_seq_add_stmt (&seq
, build_type_cast (shadow_type
,
2693 gimple_seq_last (seq
)));
2694 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
,
2695 gimple_seq_last (seq
),
2697 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
2698 gimple_seq_last (seq
)));
2699 gimple_seq_add_stmt (&seq
, build_assign (BIT_IOR_EXPR
, t
,
2700 gimple_seq_last (seq
)));
2701 t
= gimple_assign_lhs (gimple_seq_last (seq
));
2702 gimple_seq_set_location (seq
, loc
);
2703 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
2707 g
= gimple_build_cond (NE_EXPR
, t
, build_int_cst (TREE_TYPE (t
), 0),
2708 NULL_TREE
, NULL_TREE
);
2709 gimple_set_location (g
, loc
);
2710 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2712 /* Generate call to the run-time library (e.g. __asan_report_load8). */
2713 gsi
= gsi_start_bb (then_bb
);
2715 tree fun
= report_error_func (is_store
, recover_p
, size_in_bytes
, &nargs
);
2716 g
= gimple_build_call (fun
, nargs
, base_addr
, len
);
2717 gimple_set_location (g
, loc
);
2718 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2720 gsi_remove (iter
, true);
2721 *iter
= gsi_start_bb (else_bb
);
2726 /* Instrument the current function. */
2729 asan_instrument (void)
2731 if (shadow_ptr_types
[0] == NULL_TREE
)
2732 asan_init_shadow_ptr_types ();
2733 transform_statements ();
2740 return (flag_sanitize
& SANITIZE_ADDRESS
) != 0
2741 && !lookup_attribute ("no_sanitize_address",
2742 DECL_ATTRIBUTES (current_function_decl
));
2747 const pass_data pass_data_asan
=
2749 GIMPLE_PASS
, /* type */
2751 OPTGROUP_NONE
, /* optinfo_flags */
2752 TV_NONE
, /* tv_id */
2753 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2754 0, /* properties_provided */
2755 0, /* properties_destroyed */
2756 0, /* todo_flags_start */
2757 TODO_update_ssa
, /* todo_flags_finish */
2760 class pass_asan
: public gimple_opt_pass
2763 pass_asan (gcc::context
*ctxt
)
2764 : gimple_opt_pass (pass_data_asan
, ctxt
)
2767 /* opt_pass methods: */
2768 opt_pass
* clone () { return new pass_asan (m_ctxt
); }
2769 virtual bool gate (function
*) { return gate_asan (); }
2770 virtual unsigned int execute (function
*) { return asan_instrument (); }
2772 }; // class pass_asan
2777 make_pass_asan (gcc::context
*ctxt
)
2779 return new pass_asan (ctxt
);
2784 const pass_data pass_data_asan_O0
=
2786 GIMPLE_PASS
, /* type */
2788 OPTGROUP_NONE
, /* optinfo_flags */
2789 TV_NONE
, /* tv_id */
2790 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2791 0, /* properties_provided */
2792 0, /* properties_destroyed */
2793 0, /* todo_flags_start */
2794 TODO_update_ssa
, /* todo_flags_finish */
2797 class pass_asan_O0
: public gimple_opt_pass
2800 pass_asan_O0 (gcc::context
*ctxt
)
2801 : gimple_opt_pass (pass_data_asan_O0
, ctxt
)
2804 /* opt_pass methods: */
2805 virtual bool gate (function
*) { return !optimize
&& gate_asan (); }
2806 virtual unsigned int execute (function
*) { return asan_instrument (); }
2808 }; // class pass_asan_O0
2813 make_pass_asan_O0 (gcc::context
*ctxt
)
2815 return new pass_asan_O0 (ctxt
);
2818 #include "gt-asan.h"