gcc/cp/cp-ubsan.c

   1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
   2    Copyright (C) 2014-2017 Free Software Foundation, Inc.
   3    Contributed by Jakub Jelinek <jakub@redhat.com>
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #include "system.h"
  23 #include "coretypes.h"
  24 #include "cp-tree.h"
  25 #include "ubsan.h"
  26 #include "asan.h"
  27
  28 /* Test if we should instrument vptr access.  */
  29
  30 static bool
  31 cp_ubsan_instrument_vptr_p (tree type)
  32 {
  33   if (!flag_rtti || flag_sanitize_undefined_trap_on_error)
  34     return false;
  35
  36   if (!sanitize_flags_p (SANITIZE_VPTR))
  37     return false;
  38
  39   if (type)
  40     {
  41       type = TYPE_MAIN_VARIANT (type);
  42       if (!CLASS_TYPE_P (type) || !CLASSTYPE_VTABLES (type))
  43         return false;
  44     }
  45
  46   return true;
  47 }
  48
  49 /* Helper function for
  50    cp_ubsan_maybe_instrument_{member_{call,access},downcast}.
  51    Instrument vptr access.  */
  52
  53 static tree
  54 cp_ubsan_instrument_vptr (location_t loc, tree op, tree type, bool is_addr,
  55                           enum ubsan_null_ckind ckind)
  56 {
  57   type = TYPE_MAIN_VARIANT (type);
  58   const char *mangled = mangle_type_string (type);
  59   hashval_t str_hash1 = htab_hash_string (mangled);
  60   hashval_t str_hash2 = iterative_hash (mangled, strlen (mangled), 0);
  61   tree str_hash = wide_int_to_tree (uint64_type_node,
  62                                     wi::uhwi (((uint64_t) str_hash1 << 32)
  63                                               | str_hash2, 64));
  64   if (!is_addr)
  65     op = build_fold_addr_expr_loc (loc, op);
  66   op = save_expr (op);
  67   tree vptr = fold_build3_loc (loc, COMPONENT_REF,
  68                                TREE_TYPE (TYPE_VFIELD (type)),
  69                                build_fold_indirect_ref_loc (loc, op),
  70                                TYPE_VFIELD (type), NULL_TREE);
  71   vptr = fold_convert_loc (loc, pointer_sized_int_node, vptr);
  72   vptr = fold_convert_loc (loc, uint64_type_node, vptr);
  73   if (ckind == UBSAN_DOWNCAST_POINTER)
  74     {
  75       tree cond = build2_loc (loc, NE_EXPR, boolean_type_node, op,
  76                               build_zero_cst (TREE_TYPE (op)));
  77       /* This is a compiler generated comparison, don't emit
  78          e.g. -Wnonnull-compare warning for it.  */
  79       TREE_NO_WARNING (cond) = 1;
  80       vptr = build3_loc (loc, COND_EXPR, uint64_type_node, cond,
  81                          vptr, build_int_cst (uint64_type_node, 0));
  82     }
  83   tree ti_decl = get_tinfo_decl (type);
  84   mark_used (ti_decl);
  85   tree ptype = build_pointer_type (type);
  86   tree call
  87     = build_call_expr_internal_loc (loc, IFN_UBSAN_VPTR,
  88                                     void_type_node, 5, op, vptr, str_hash,
  89                                     build_address (ti_decl),
  90                                     build_int_cst (ptype, ckind));
  91   TREE_SIDE_EFFECTS (call) = 1;
  92   return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
  93 }
  94
  95 /* Helper function for
  96    cp_ubsan_maybe_instrument_{member_{call,access},downcast}.
  97    Instrument vptr access if it should be instrumented, otherwise return
  98    NULL_TREE.  */
  99
 100 static tree
 101 cp_ubsan_maybe_instrument_vptr (location_t loc, tree op, tree type,
 102                                 bool is_addr, enum ubsan_null_ckind ckind)
 103 {
 104   if (!cp_ubsan_instrument_vptr_p (type))
 105     return NULL_TREE;
 106   return cp_ubsan_instrument_vptr (loc, op, type, is_addr, ckind);
 107 }
 108
 109 /* Instrument a member call (but not constructor call) if needed.  */
 110
 111 void
 112 cp_ubsan_maybe_instrument_member_call (tree stmt)
 113 {
 114   if (call_expr_nargs (stmt) == 0)
 115     return;
 116   tree *opp = &CALL_EXPR_ARG (stmt, 0);
 117   tree op = *opp;
 118   if (op == error_mark_node
 119       || !POINTER_TYPE_P (TREE_TYPE (op)))
 120     return;
 121   while (TREE_CODE (op) == COMPOUND_EXPR)
 122     {
 123       opp = &TREE_OPERAND (op, 1);
 124       op = *opp;
 125     }
 126   op = cp_ubsan_maybe_instrument_vptr (EXPR_LOCATION (stmt), op,
 127                                        TREE_TYPE (TREE_TYPE (op)),
 128                                        true, UBSAN_MEMBER_CALL);
 129   if (op)
 130     *opp = op;
 131 }
 132
 133 /* Data passed to cp_ubsan_check_member_access_r.  */
 134
 135 struct cp_ubsan_check_member_access_data
 136 {
 137   hash_set<tree> *pset;
 138   bool is_addr;
 139 };
 140
 141 static tree cp_ubsan_check_member_access_r (tree *, int *, void *);
 142
 143 /* Instrument a member access.  */
 144
 145 static bool
 146 cp_ubsan_maybe_instrument_member_access
 147      (tree stmt, cp_ubsan_check_member_access_data *ucmd)
 148 {
 149   if (DECL_ARTIFICIAL (TREE_OPERAND (stmt, 1)))
 150     return false;
 151
 152   tree base = TREE_OPERAND (stmt, 0);
 153   if (!cp_ubsan_instrument_vptr_p (TREE_TYPE (base)))
 154     return false;
 155
 156   cp_walk_tree (&base, cp_ubsan_check_member_access_r, ucmd, ucmd->pset);
 157
 158   base = cp_ubsan_instrument_vptr (EXPR_LOCATION (stmt), base,
 159                                    TREE_TYPE (base), false,
 160                                    UBSAN_MEMBER_ACCESS);
 161   TREE_OPERAND (stmt, 0)
 162     = build_fold_indirect_ref_loc (EXPR_LOCATION (stmt), base);
 163   return true;
 164 }
 165
 166 /* Attempt to instrument member accesses inside of the function.
 167    cp_ubsan_maybe_instrument_member_access should be called on COMPONENT_REFs
 168    in the GENERIC IL, but only when the field is actually accessed, not
 169    merely when it's address is taken.  Therefore we track in is_addr field
 170    whether in the current context we are processing address taken
 171    handled components or not.  E.g. for &x->y[w->z] we want to call
 172    cp_ubsan_maybe_instrument_member_access on *w.z COMPONENT_REF, but
 173    not on *x.y.  */
 174
 175 static tree
 176 cp_ubsan_check_member_access_r (tree *stmt_p, int *walk_subtrees, void *data)
 177 {
 178   tree stmt = *stmt_p, t;
 179   cp_ubsan_check_member_access_data *ucmd
 180     = (cp_ubsan_check_member_access_data *) data;
 181   switch (TREE_CODE (stmt))
 182     {
 183     case ADDR_EXPR:
 184       t = TREE_OPERAND (stmt, 0);
 185       while ((TREE_CODE (t) == MEM_REF || INDIRECT_REF_P (t))
 186              && TREE_CODE (TREE_OPERAND (t, 0)) == ADDR_EXPR)
 187         t = TREE_OPERAND (TREE_OPERAND (t, 0), 0);
 188       if (handled_component_p (t))
 189         {
 190           *walk_subtrees = 0;
 191           ucmd->is_addr = true;
 192           cp_walk_tree (&t, cp_ubsan_check_member_access_r,
 193                         data, ucmd->pset);
 194           ucmd->is_addr = false;
 195         }
 196       break;
 197     case MEM_REF:
 198     case INDIRECT_REF:
 199       t = TREE_OPERAND (stmt, 0);
 200       if (TREE_CODE (t) == ADDR_EXPR)
 201         {
 202           *walk_subtrees = 0;
 203           t = TREE_OPERAND (stmt, 0);
 204           cp_walk_tree (&t, cp_ubsan_check_member_access_r, data, ucmd->pset);
 205         }
 206       break;
 207     case COMPONENT_REF:
 208       if (!ucmd->is_addr && cp_ubsan_maybe_instrument_member_access (stmt, ucmd))
 209         {
 210           *walk_subtrees = 0;
 211           break;
 212         }
 213       /* FALLTHRU */
 214     default:
 215       if (ucmd->is_addr && handled_component_p (stmt))
 216         {
 217           int i, len = TREE_OPERAND_LENGTH (stmt);
 218           *walk_subtrees = 0;
 219           if (!handled_component_p (TREE_OPERAND (stmt, 0)))
 220             ucmd->is_addr = false;
 221           for (i = 0; i < len; i++)
 222             {
 223               cp_walk_tree (&TREE_OPERAND (stmt, i),
 224                             cp_ubsan_check_member_access_r, data, ucmd->pset);
 225               ucmd->is_addr = false;
 226             }
 227           ucmd->is_addr = true;
 228         }
 229       break;
 230     }
 231   return NULL_TREE;
 232 }
 233
 234 /* Instrument all member accesses inside GENERIC *T_P.  */
 235
 236 void
 237 cp_ubsan_instrument_member_accesses (tree *t_p)
 238 {
 239   if (cp_ubsan_instrument_vptr_p (NULL_TREE))
 240     {
 241       hash_set<tree> pset;
 242       cp_ubsan_check_member_access_data ucmd;
 243       ucmd.pset = &pset;
 244       ucmd.is_addr = false;
 245       cp_walk_tree (t_p, cp_ubsan_check_member_access_r, &ucmd, &pset);
 246     }
 247 }
 248
 249 /* Instrument downcast.  */
 250
 251 tree
 252 cp_ubsan_maybe_instrument_downcast (location_t loc, tree type,
 253                                     tree intype, tree op)
 254 {
 255   if (!POINTER_TYPE_P (type)
 256       || !POINTER_TYPE_P (intype)
 257       || !POINTER_TYPE_P (TREE_TYPE (op))
 258       || !CLASS_TYPE_P (TREE_TYPE (TREE_TYPE (op)))
 259       || !is_properly_derived_from (TREE_TYPE (type), TREE_TYPE (intype)))
 260     return NULL_TREE;
 261
 262   return cp_ubsan_maybe_instrument_vptr (loc, op, TREE_TYPE (type), true,
 263                                          TREE_CODE (type) == POINTER_TYPE
 264                                          ? UBSAN_DOWNCAST_POINTER
 265                                          : UBSAN_DOWNCAST_REFERENCE);
 266 }
 267
 268 /* Instrument cast to virtual base.  */
 269
 270 tree
 271 cp_ubsan_maybe_instrument_cast_to_vbase (location_t loc, tree type, tree op)
 272 {
 273   return cp_ubsan_maybe_instrument_vptr (loc, op, type, true,
 274                                          UBSAN_CAST_TO_VBASE);
 275 }
 276
 277 /* Called from initialize_vtbl_ptrs via dfs_walk.  BINFO is the base
 278    which we want to initialize the vtable pointer for, DATA is
 279    TREE_LIST whose TREE_VALUE is the this ptr expression.  */
 280
 281 static tree
 282 cp_ubsan_dfs_initialize_vtbl_ptrs (tree binfo, void *data)
 283 {
 284   if (!TYPE_CONTAINS_VPTR_P (BINFO_TYPE (binfo)))
 285     return dfs_skip_bases;
 286
 287   if (!BINFO_PRIMARY_P (binfo))
 288     {
 289       tree base_ptr = TREE_VALUE ((tree) data);
 290
 291       base_ptr = build_base_path (PLUS_EXPR, base_ptr, binfo, /*nonnull=*/1,
 292                                   tf_warning_or_error);
 293
 294       /* Compute the location of the vtpr.  */
 295       tree vtbl_ptr
 296         = build_vfield_ref (cp_build_indirect_ref (base_ptr, RO_NULL,
 297                                                    tf_warning_or_error),
 298                             TREE_TYPE (binfo));
 299       gcc_assert (vtbl_ptr != error_mark_node);
 300
 301       /* Assign NULL to the vptr.  */
 302       tree vtbl = build_zero_cst (TREE_TYPE (vtbl_ptr));
 303       tree stmt = cp_build_modify_expr (input_location, vtbl_ptr, NOP_EXPR,
 304                                         vtbl, tf_warning_or_error);
 305       if (vptr_via_virtual_p (binfo))
 306         /* If this vptr comes from a virtual base of the complete object, only
 307            clear it if we're in charge of virtual bases.  */
 308         stmt = build_if_in_charge (stmt);
 309       finish_expr_stmt (stmt);
 310     }
 311
 312   return NULL_TREE;
 313 }
 314
 315 /* Initialize all the vtable pointers in the object pointed to by
 316    ADDR to NULL, so that we catch invalid calls to methods before
 317    mem-initializers are completed.  */
 318
 319 void
 320 cp_ubsan_maybe_initialize_vtbl_ptrs (tree addr)
 321 {
 322   if (!cp_ubsan_instrument_vptr_p (NULL_TREE))
 323     return;
 324
 325   tree type = TREE_TYPE (TREE_TYPE (addr));
 326   tree list = build_tree_list (type, addr);
 327   /* We cannot rely on the vtable being set up.  We have to indirect via the
 328      vtt_parm.  */
 329   int save_in_base_initializer = in_base_initializer;
 330   in_base_initializer = 1;
 331
 332   /* Walk through the hierarchy, initializing the vptr in each base
 333      class to NULL.  */
 334   dfs_walk_once (TYPE_BINFO (type), cp_ubsan_dfs_initialize_vtbl_ptrs,
 335                  NULL, list);
 336
 337   in_base_initializer = save_in_base_initializer;
 338 }