gcc/ChangeLog:
[official-gcc.git] / libsanitizer / ubsan / ubsan_handlers.cc
blob5631e457a1c9656b726bcf0cd7f09976af3041d1
1 //===-- ubsan_handlers.cc -------------------------------------------------===//
2 //
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
5 //
6 //===----------------------------------------------------------------------===//
7 //
8 // Error logging entry points for the UBSan runtime.
9 //
10 //===----------------------------------------------------------------------===//
12 #include "ubsan_platform.h"
13 #if CAN_SANITIZE_UB
14 #include "ubsan_handlers.h"
15 #include "ubsan_diag.h"
17 #include "sanitizer_common/sanitizer_common.h"
19 using namespace __sanitizer;
20 using namespace __ubsan;
22 namespace __ubsan {
23 bool ignoreReport(SourceLocation SLoc, ReportOptions Opts, ErrorType ET) {
24 // We are not allowed to skip error report: if we are in unrecoverable
25 // handler, we have to terminate the program right now, and therefore
26 // have to print some diagnostic.
28 // Even if source location is disabled, it doesn't mean that we have
29 // already report an error to the user: some concurrently running
30 // thread could have acquired it, but not yet printed the report.
31 if (Opts.FromUnrecoverableHandler)
32 return false;
33 return SLoc.isDisabled() || IsPCSuppressed(ET, Opts.pc, SLoc.getFilename());
36 const char *TypeCheckKinds[] = {
37 "load of", "store to", "reference binding to", "member access within",
38 "member call on", "constructor call on", "downcast of", "downcast of",
39 "upcast of", "cast to virtual base of"};
42 static void handleTypeMismatchImpl(TypeMismatchData *Data, ValueHandle Pointer,
43 ReportOptions Opts) {
44 Location Loc = Data->Loc.acquire();
46 ErrorType ET;
47 if (!Pointer)
48 ET = ErrorType::NullPointerUse;
49 else if (Data->Alignment && (Pointer & (Data->Alignment - 1)))
50 ET = ErrorType::MisalignedPointerUse;
51 else
52 ET = ErrorType::InsufficientObjectSize;
54 // Use the SourceLocation from Data to track deduplication, even if it's
55 // invalid.
56 if (ignoreReport(Loc.getSourceLocation(), Opts, ET))
57 return;
59 SymbolizedStackHolder FallbackLoc;
60 if (Data->Loc.isInvalid()) {
61 FallbackLoc.reset(getCallerLocation(Opts.pc));
62 Loc = FallbackLoc;
65 ScopedReport R(Opts, Loc, ET);
67 switch (ET) {
68 case ErrorType::NullPointerUse:
69 Diag(Loc, DL_Error, "%0 null pointer of type %1")
70 << TypeCheckKinds[Data->TypeCheckKind] << Data->Type;
71 break;
72 case ErrorType::MisalignedPointerUse:
73 Diag(Loc, DL_Error, "%0 misaligned address %1 for type %3, "
74 "which requires %2 byte alignment")
75 << TypeCheckKinds[Data->TypeCheckKind] << (void *)Pointer
76 << Data->Alignment << Data->Type;
77 break;
78 case ErrorType::InsufficientObjectSize:
79 Diag(Loc, DL_Error, "%0 address %1 with insufficient space "
80 "for an object of type %2")
81 << TypeCheckKinds[Data->TypeCheckKind] << (void *)Pointer << Data->Type;
82 break;
83 default:
84 UNREACHABLE("unexpected error type!");
87 if (Pointer)
88 Diag(Pointer, DL_Note, "pointer points here");
91 void __ubsan::__ubsan_handle_type_mismatch(TypeMismatchData *Data,
92 ValueHandle Pointer) {
93 GET_REPORT_OPTIONS(false);
94 handleTypeMismatchImpl(Data, Pointer, Opts);
96 void __ubsan::__ubsan_handle_type_mismatch_abort(TypeMismatchData *Data,
97 ValueHandle Pointer) {
98 GET_REPORT_OPTIONS(true);
99 handleTypeMismatchImpl(Data, Pointer, Opts);
100 Die();
103 /// \brief Common diagnostic emission for various forms of integer overflow.
104 template <typename T>
105 static void handleIntegerOverflowImpl(OverflowData *Data, ValueHandle LHS,
106 const char *Operator, T RHS,
107 ReportOptions Opts) {
108 SourceLocation Loc = Data->Loc.acquire();
109 bool IsSigned = Data->Type.isSignedIntegerTy();
110 ErrorType ET = IsSigned ? ErrorType::SignedIntegerOverflow
111 : ErrorType::UnsignedIntegerOverflow;
113 if (ignoreReport(Loc, Opts, ET))
114 return;
116 ScopedReport R(Opts, Loc, ET);
118 Diag(Loc, DL_Error, "%0 integer overflow: "
119 "%1 %2 %3 cannot be represented in type %4")
120 << (IsSigned ? "signed" : "unsigned")
121 << Value(Data->Type, LHS) << Operator << RHS << Data->Type;
124 #define UBSAN_OVERFLOW_HANDLER(handler_name, op, unrecoverable) \
125 void __ubsan::handler_name(OverflowData *Data, ValueHandle LHS, \
126 ValueHandle RHS) { \
127 GET_REPORT_OPTIONS(unrecoverable); \
128 handleIntegerOverflowImpl(Data, LHS, op, Value(Data->Type, RHS), Opts); \
129 if (unrecoverable) \
130 Die(); \
133 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_add_overflow, "+", false)
134 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_add_overflow_abort, "+", true)
135 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_sub_overflow, "-", false)
136 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_sub_overflow_abort, "-", true)
137 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_mul_overflow, "*", false)
138 UBSAN_OVERFLOW_HANDLER(__ubsan_handle_mul_overflow_abort, "*", true)
140 static void handleNegateOverflowImpl(OverflowData *Data, ValueHandle OldVal,
141 ReportOptions Opts) {
142 SourceLocation Loc = Data->Loc.acquire();
143 bool IsSigned = Data->Type.isSignedIntegerTy();
144 ErrorType ET = IsSigned ? ErrorType::SignedIntegerOverflow
145 : ErrorType::UnsignedIntegerOverflow;
147 if (ignoreReport(Loc, Opts, ET))
148 return;
150 ScopedReport R(Opts, Loc, ET);
152 if (IsSigned)
153 Diag(Loc, DL_Error,
154 "negation of %0 cannot be represented in type %1; "
155 "cast to an unsigned type to negate this value to itself")
156 << Value(Data->Type, OldVal) << Data->Type;
157 else
158 Diag(Loc, DL_Error, "negation of %0 cannot be represented in type %1")
159 << Value(Data->Type, OldVal) << Data->Type;
162 void __ubsan::__ubsan_handle_negate_overflow(OverflowData *Data,
163 ValueHandle OldVal) {
164 GET_REPORT_OPTIONS(false);
165 handleNegateOverflowImpl(Data, OldVal, Opts);
167 void __ubsan::__ubsan_handle_negate_overflow_abort(OverflowData *Data,
168 ValueHandle OldVal) {
169 GET_REPORT_OPTIONS(true);
170 handleNegateOverflowImpl(Data, OldVal, Opts);
171 Die();
174 static void handleDivremOverflowImpl(OverflowData *Data, ValueHandle LHS,
175 ValueHandle RHS, ReportOptions Opts) {
176 SourceLocation Loc = Data->Loc.acquire();
177 Value LHSVal(Data->Type, LHS);
178 Value RHSVal(Data->Type, RHS);
180 ErrorType ET;
181 if (RHSVal.isMinusOne())
182 ET = ErrorType::SignedIntegerOverflow;
183 else if (Data->Type.isIntegerTy())
184 ET = ErrorType::IntegerDivideByZero;
185 else
186 ET = ErrorType::FloatDivideByZero;
188 if (ignoreReport(Loc, Opts, ET))
189 return;
191 ScopedReport R(Opts, Loc, ET);
193 switch (ET) {
194 case ErrorType::SignedIntegerOverflow:
195 Diag(Loc, DL_Error, "division of %0 by -1 cannot be represented in type %1")
196 << LHSVal << Data->Type;
197 break;
198 default:
199 Diag(Loc, DL_Error, "division by zero");
200 break;
204 void __ubsan::__ubsan_handle_divrem_overflow(OverflowData *Data,
205 ValueHandle LHS, ValueHandle RHS) {
206 GET_REPORT_OPTIONS(false);
207 handleDivremOverflowImpl(Data, LHS, RHS, Opts);
209 void __ubsan::__ubsan_handle_divrem_overflow_abort(OverflowData *Data,
210 ValueHandle LHS,
211 ValueHandle RHS) {
212 GET_REPORT_OPTIONS(true);
213 handleDivremOverflowImpl(Data, LHS, RHS, Opts);
214 Die();
217 static void handleShiftOutOfBoundsImpl(ShiftOutOfBoundsData *Data,
218 ValueHandle LHS, ValueHandle RHS,
219 ReportOptions Opts) {
220 SourceLocation Loc = Data->Loc.acquire();
221 Value LHSVal(Data->LHSType, LHS);
222 Value RHSVal(Data->RHSType, RHS);
224 ErrorType ET;
225 if (RHSVal.isNegative() ||
226 RHSVal.getPositiveIntValue() >= Data->LHSType.getIntegerBitWidth())
227 ET = ErrorType::InvalidShiftExponent;
228 else
229 ET = ErrorType::InvalidShiftBase;
231 if (ignoreReport(Loc, Opts, ET))
232 return;
234 ScopedReport R(Opts, Loc, ET);
236 if (ET == ErrorType::InvalidShiftExponent) {
237 if (RHSVal.isNegative())
238 Diag(Loc, DL_Error, "shift exponent %0 is negative") << RHSVal;
239 else
240 Diag(Loc, DL_Error, "shift exponent %0 is too large for %1-bit type %2")
241 << RHSVal << Data->LHSType.getIntegerBitWidth() << Data->LHSType;
242 } else {
243 if (LHSVal.isNegative())
244 Diag(Loc, DL_Error, "left shift of negative value %0") << LHSVal;
245 else
246 Diag(Loc, DL_Error,
247 "left shift of %0 by %1 places cannot be represented in type %2")
248 << LHSVal << RHSVal << Data->LHSType;
252 void __ubsan::__ubsan_handle_shift_out_of_bounds(ShiftOutOfBoundsData *Data,
253 ValueHandle LHS,
254 ValueHandle RHS) {
255 GET_REPORT_OPTIONS(false);
256 handleShiftOutOfBoundsImpl(Data, LHS, RHS, Opts);
258 void __ubsan::__ubsan_handle_shift_out_of_bounds_abort(
259 ShiftOutOfBoundsData *Data,
260 ValueHandle LHS,
261 ValueHandle RHS) {
262 GET_REPORT_OPTIONS(true);
263 handleShiftOutOfBoundsImpl(Data, LHS, RHS, Opts);
264 Die();
267 static void handleOutOfBoundsImpl(OutOfBoundsData *Data, ValueHandle Index,
268 ReportOptions Opts) {
269 SourceLocation Loc = Data->Loc.acquire();
270 ErrorType ET = ErrorType::OutOfBoundsIndex;
272 if (ignoreReport(Loc, Opts, ET))
273 return;
275 ScopedReport R(Opts, Loc, ET);
277 Value IndexVal(Data->IndexType, Index);
278 Diag(Loc, DL_Error, "index %0 out of bounds for type %1")
279 << IndexVal << Data->ArrayType;
282 void __ubsan::__ubsan_handle_out_of_bounds(OutOfBoundsData *Data,
283 ValueHandle Index) {
284 GET_REPORT_OPTIONS(false);
285 handleOutOfBoundsImpl(Data, Index, Opts);
287 void __ubsan::__ubsan_handle_out_of_bounds_abort(OutOfBoundsData *Data,
288 ValueHandle Index) {
289 GET_REPORT_OPTIONS(true);
290 handleOutOfBoundsImpl(Data, Index, Opts);
291 Die();
294 static void handleBuiltinUnreachableImpl(UnreachableData *Data,
295 ReportOptions Opts) {
296 ScopedReport R(Opts, Data->Loc, ErrorType::UnreachableCall);
297 Diag(Data->Loc, DL_Error, "execution reached a __builtin_unreachable() call");
300 void __ubsan::__ubsan_handle_builtin_unreachable(UnreachableData *Data) {
301 GET_REPORT_OPTIONS(true);
302 handleBuiltinUnreachableImpl(Data, Opts);
303 Die();
306 static void handleMissingReturnImpl(UnreachableData *Data, ReportOptions Opts) {
307 ScopedReport R(Opts, Data->Loc, ErrorType::MissingReturn);
308 Diag(Data->Loc, DL_Error,
309 "execution reached the end of a value-returning function "
310 "without returning a value");
313 void __ubsan::__ubsan_handle_missing_return(UnreachableData *Data) {
314 GET_REPORT_OPTIONS(true);
315 handleMissingReturnImpl(Data, Opts);
316 Die();
319 static void handleVLABoundNotPositive(VLABoundData *Data, ValueHandle Bound,
320 ReportOptions Opts) {
321 SourceLocation Loc = Data->Loc.acquire();
322 ErrorType ET = ErrorType::NonPositiveVLAIndex;
324 if (ignoreReport(Loc, Opts, ET))
325 return;
327 ScopedReport R(Opts, Loc, ET);
329 Diag(Loc, DL_Error, "variable length array bound evaluates to "
330 "non-positive value %0")
331 << Value(Data->Type, Bound);
334 void __ubsan::__ubsan_handle_vla_bound_not_positive(VLABoundData *Data,
335 ValueHandle Bound) {
336 GET_REPORT_OPTIONS(false);
337 handleVLABoundNotPositive(Data, Bound, Opts);
339 void __ubsan::__ubsan_handle_vla_bound_not_positive_abort(VLABoundData *Data,
340 ValueHandle Bound) {
341 GET_REPORT_OPTIONS(true);
342 handleVLABoundNotPositive(Data, Bound, Opts);
343 Die();
346 static bool looksLikeFloatCastOverflowDataV1(void *Data) {
347 // First field is either a pointer to filename or a pointer to a
348 // TypeDescriptor.
349 u8 *FilenameOrTypeDescriptor;
350 internal_memcpy(&FilenameOrTypeDescriptor, Data,
351 sizeof(FilenameOrTypeDescriptor));
353 // Heuristic: For float_cast_overflow, the TypeKind will be either TK_Integer
354 // (0x0), TK_Float (0x1) or TK_Unknown (0xff). If both types are known,
355 // adding both bytes will be 0 or 1 (for BE or LE). If it were a filename,
356 // adding two printable characters will not yield such a value. Otherwise,
357 // if one of them is 0xff, this is most likely TK_Unknown type descriptor.
358 u16 MaybeFromTypeKind =
359 FilenameOrTypeDescriptor[0] + FilenameOrTypeDescriptor[1];
360 return MaybeFromTypeKind < 2 || FilenameOrTypeDescriptor[0] == 0xff ||
361 FilenameOrTypeDescriptor[1] == 0xff;
364 static void handleFloatCastOverflow(void *DataPtr, ValueHandle From,
365 ReportOptions Opts) {
366 SymbolizedStackHolder CallerLoc;
367 Location Loc;
368 const TypeDescriptor *FromType, *ToType;
369 ErrorType ET = ErrorType::FloatCastOverflow;
371 if (looksLikeFloatCastOverflowDataV1(DataPtr)) {
372 auto Data = reinterpret_cast<FloatCastOverflowData *>(DataPtr);
373 CallerLoc.reset(getCallerLocation(Opts.pc));
374 Loc = CallerLoc;
375 FromType = &Data->FromType;
376 ToType = &Data->ToType;
377 } else {
378 auto Data = reinterpret_cast<FloatCastOverflowDataV2 *>(DataPtr);
379 SourceLocation SLoc = Data->Loc.acquire();
380 if (ignoreReport(SLoc, Opts, ET))
381 return;
382 Loc = SLoc;
383 FromType = &Data->FromType;
384 ToType = &Data->ToType;
387 ScopedReport R(Opts, Loc, ET);
389 Diag(Loc, DL_Error,
390 "value %0 is outside the range of representable values of type %2")
391 << Value(*FromType, From) << *FromType << *ToType;
394 void __ubsan::__ubsan_handle_float_cast_overflow(void *Data, ValueHandle From) {
395 GET_REPORT_OPTIONS(false);
396 handleFloatCastOverflow(Data, From, Opts);
398 void __ubsan::__ubsan_handle_float_cast_overflow_abort(void *Data,
399 ValueHandle From) {
400 GET_REPORT_OPTIONS(true);
401 handleFloatCastOverflow(Data, From, Opts);
402 Die();
405 static void handleLoadInvalidValue(InvalidValueData *Data, ValueHandle Val,
406 ReportOptions Opts) {
407 SourceLocation Loc = Data->Loc.acquire();
408 // This check could be more precise if we used different handlers for
409 // -fsanitize=bool and -fsanitize=enum.
410 bool IsBool = (0 == internal_strcmp(Data->Type.getTypeName(), "'bool'"));
411 ErrorType ET =
412 IsBool ? ErrorType::InvalidBoolLoad : ErrorType::InvalidEnumLoad;
414 if (ignoreReport(Loc, Opts, ET))
415 return;
417 ScopedReport R(Opts, Loc, ET);
419 Diag(Loc, DL_Error,
420 "load of value %0, which is not a valid value for type %1")
421 << Value(Data->Type, Val) << Data->Type;
424 void __ubsan::__ubsan_handle_load_invalid_value(InvalidValueData *Data,
425 ValueHandle Val) {
426 GET_REPORT_OPTIONS(false);
427 handleLoadInvalidValue(Data, Val, Opts);
429 void __ubsan::__ubsan_handle_load_invalid_value_abort(InvalidValueData *Data,
430 ValueHandle Val) {
431 GET_REPORT_OPTIONS(true);
432 handleLoadInvalidValue(Data, Val, Opts);
433 Die();
436 static void handleFunctionTypeMismatch(FunctionTypeMismatchData *Data,
437 ValueHandle Function,
438 ReportOptions Opts) {
439 SourceLocation CallLoc = Data->Loc.acquire();
440 ErrorType ET = ErrorType::FunctionTypeMismatch;
442 if (ignoreReport(CallLoc, Opts, ET))
443 return;
445 ScopedReport R(Opts, CallLoc, ET);
447 SymbolizedStackHolder FLoc(getSymbolizedLocation(Function));
448 const char *FName = FLoc.get()->info.function;
449 if (!FName)
450 FName = "(unknown)";
452 Diag(CallLoc, DL_Error,
453 "call to function %0 through pointer to incorrect function type %1")
454 << FName << Data->Type;
455 Diag(FLoc, DL_Note, "%0 defined here") << FName;
458 void
459 __ubsan::__ubsan_handle_function_type_mismatch(FunctionTypeMismatchData *Data,
460 ValueHandle Function) {
461 GET_REPORT_OPTIONS(false);
462 handleFunctionTypeMismatch(Data, Function, Opts);
465 void __ubsan::__ubsan_handle_function_type_mismatch_abort(
466 FunctionTypeMismatchData *Data, ValueHandle Function) {
467 GET_REPORT_OPTIONS(true);
468 handleFunctionTypeMismatch(Data, Function, Opts);
469 Die();
472 static void handleNonNullReturn(NonNullReturnData *Data, ReportOptions Opts) {
473 SourceLocation Loc = Data->Loc.acquire();
474 ErrorType ET = ErrorType::InvalidNullReturn;
476 if (ignoreReport(Loc, Opts, ET))
477 return;
479 ScopedReport R(Opts, Loc, ET);
481 Diag(Loc, DL_Error, "null pointer returned from function declared to never "
482 "return null");
483 if (!Data->AttrLoc.isInvalid())
484 Diag(Data->AttrLoc, DL_Note, "returns_nonnull attribute specified here");
487 void __ubsan::__ubsan_handle_nonnull_return(NonNullReturnData *Data) {
488 GET_REPORT_OPTIONS(false);
489 handleNonNullReturn(Data, Opts);
492 void __ubsan::__ubsan_handle_nonnull_return_abort(NonNullReturnData *Data) {
493 GET_REPORT_OPTIONS(true);
494 handleNonNullReturn(Data, Opts);
495 Die();
498 static void handleNonNullArg(NonNullArgData *Data, ReportOptions Opts) {
499 SourceLocation Loc = Data->Loc.acquire();
500 ErrorType ET = ErrorType::InvalidNullArgument;
502 if (ignoreReport(Loc, Opts, ET))
503 return;
505 ScopedReport R(Opts, Loc, ET);
507 Diag(Loc, DL_Error, "null pointer passed as argument %0, which is declared to "
508 "never be null") << Data->ArgIndex;
509 if (!Data->AttrLoc.isInvalid())
510 Diag(Data->AttrLoc, DL_Note, "nonnull attribute specified here");
513 void __ubsan::__ubsan_handle_nonnull_arg(NonNullArgData *Data) {
514 GET_REPORT_OPTIONS(false);
515 handleNonNullArg(Data, Opts);
518 void __ubsan::__ubsan_handle_nonnull_arg_abort(NonNullArgData *Data) {
519 GET_REPORT_OPTIONS(true);
520 handleNonNullArg(Data, Opts);
521 Die();
524 static void handleCFIBadIcall(CFICheckFailData *Data, ValueHandle Function,
525 ReportOptions Opts) {
526 if (Data->CheckKind != CFITCK_ICall)
527 Die();
529 SourceLocation Loc = Data->Loc.acquire();
530 ErrorType ET = ErrorType::CFIBadType;
532 if (ignoreReport(Loc, Opts, ET))
533 return;
535 ScopedReport R(Opts, Loc, ET);
537 Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
538 "indirect function call")
539 << Data->Type;
541 SymbolizedStackHolder FLoc(getSymbolizedLocation(Function));
542 const char *FName = FLoc.get()->info.function;
543 if (!FName)
544 FName = "(unknown)";
545 Diag(FLoc, DL_Note, "%0 defined here") << FName;
548 namespace __ubsan {
549 #ifdef UBSAN_CAN_USE_CXXABI
550 SANITIZER_WEAK_ATTRIBUTE
551 void HandleCFIBadType(CFICheckFailData *Data, ValueHandle Vtable,
552 bool ValidVtable, ReportOptions Opts);
553 #else
554 static void HandleCFIBadType(CFICheckFailData *Data, ValueHandle Vtable,
555 bool ValidVtable, ReportOptions Opts) {
556 Die();
558 #endif
559 } // namespace __ubsan
561 void __ubsan::__ubsan_handle_cfi_bad_icall(CFIBadIcallData *CallData,
562 ValueHandle Function) {
563 GET_REPORT_OPTIONS(false);
564 CFICheckFailData Data = {CFITCK_ICall, CallData->Loc, CallData->Type};
565 handleCFIBadIcall(&Data, Function, Opts);
568 void __ubsan::__ubsan_handle_cfi_bad_icall_abort(CFIBadIcallData *CallData,
569 ValueHandle Function) {
570 GET_REPORT_OPTIONS(true);
571 CFICheckFailData Data = {CFITCK_ICall, CallData->Loc, CallData->Type};
572 handleCFIBadIcall(&Data, Function, Opts);
573 Die();
576 void __ubsan::__ubsan_handle_cfi_check_fail(CFICheckFailData *Data,
577 ValueHandle Value,
578 uptr ValidVtable) {
579 GET_REPORT_OPTIONS(false);
580 if (Data->CheckKind == CFITCK_ICall)
581 handleCFIBadIcall(Data, Value, Opts);
582 else
583 HandleCFIBadType(Data, Value, ValidVtable, Opts);
586 void __ubsan::__ubsan_handle_cfi_check_fail_abort(CFICheckFailData *Data,
587 ValueHandle Value,
588 uptr ValidVtable) {
589 GET_REPORT_OPTIONS(true);
590 if (Data->CheckKind == CFITCK_ICall)
591 handleCFIBadIcall(Data, Value, Opts);
592 else
593 HandleCFIBadType(Data, Value, ValidVtable, Opts);
594 Die();
597 #endif // CAN_SANITIZE_UB