gcc/c-family/c-ubsan.c

   1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
   2    Copyright (C) 2013-2015 Free Software Foundation, Inc.
   3    Contributed by Marek Polacek <polacek@redhat.com>
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 You should have received a copy of the GNU General Public License
  18 along with GCC; see the file COPYING3.  If not see
  19 <http://www.gnu.org/licenses/>.  */
  20
  21 #include "config.h"
  22 #include "system.h"
  23 #include "coretypes.h"
  24 #include "tm.h"
  25 #include "c-family/c-common.h"
  26 #include "ubsan.h"
  27 #include "c-family/c-ubsan.h"
  28 #include "asan.h"
  29 #include "stor-layout.h"
  30 #include "builtins.h"
  31 #include "gimplify.h"
  32
  33 /* Instrument division by zero and INT_MIN / -1.  If not instrumenting,
  34    return NULL_TREE.  */
  35
  36 tree
  37 ubsan_instrument_division (location_t loc, tree op0, tree op1)
  38 {
  39   tree t, tt;
  40   tree type = TREE_TYPE (op0);
  41
  42   /* At this point both operands should have the same type,
  43      because they are already converted to RESULT_TYPE.
  44      Use TYPE_MAIN_VARIANT since typedefs can confuse us.  */
  45   gcc_assert (TYPE_MAIN_VARIANT (TREE_TYPE (op0))
  46               == TYPE_MAIN_VARIANT (TREE_TYPE (op1)));
  47
  48   op0 = unshare_expr (op0);
  49   op1 = unshare_expr (op1);
  50
  51   if (TREE_CODE (type) == INTEGER_TYPE
  52       && (flag_sanitize & SANITIZE_DIVIDE))
  53     t = fold_build2 (EQ_EXPR, boolean_type_node,
  54                      op1, build_int_cst (type, 0));
  55   else if (TREE_CODE (type) == REAL_TYPE
  56            && (flag_sanitize & SANITIZE_FLOAT_DIVIDE))
  57     t = fold_build2 (EQ_EXPR, boolean_type_node,
  58                      op1, build_real (type, dconst0));
  59   else
  60     return NULL_TREE;
  61
  62   /* We check INT_MIN / -1 only for signed types.  */
  63   if (TREE_CODE (type) == INTEGER_TYPE
  64       && (flag_sanitize & SANITIZE_DIVIDE)
  65       && !TYPE_UNSIGNED (type))
  66     {
  67       tree x;
  68       tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1),
  69                         build_int_cst (type, -1));
  70       x = fold_build2 (EQ_EXPR, boolean_type_node, op0,
  71                        TYPE_MIN_VALUE (type));
  72       x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt);
  73       t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x);
  74     }
  75
  76   /* If the condition was folded to 0, no need to instrument
  77      this expression.  */
  78   if (integer_zerop (t))
  79     return NULL_TREE;
  80
  81   /* In case we have a SAVE_EXPR in a conditional context, we need to
  82      make sure it gets evaluated before the condition.  */
  83   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
  84   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
  85   if (flag_sanitize_undefined_trap_on_error)
  86     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
  87   else
  88     {
  89       tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc,
  90                                      ubsan_type_descriptor (type), NULL_TREE,
  91                                      NULL_TREE);
  92       data = build_fold_addr_expr_loc (loc, data);
  93       enum built_in_function bcode
  94         = (flag_sanitize_recover & SANITIZE_DIVIDE)
  95           ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
  96           : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
  97       tt = builtin_decl_explicit (bcode);
  98       op0 = unshare_expr (op0);
  99       op1 = unshare_expr (op1);
 100       tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
 101                                 ubsan_encode_value (op1));
 102     }
 103   t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
 104
 105   return t;
 106 }
 107
 108 /* Instrument left and right shifts.  */
 109
 110 tree
 111 ubsan_instrument_shift (location_t loc, enum tree_code code,
 112                         tree op0, tree op1)
 113 {
 114   tree t, tt = NULL_TREE;
 115   tree type0 = TREE_TYPE (op0);
 116   tree type1 = TREE_TYPE (op1);
 117   tree op1_utype = unsigned_type_for (type1);
 118   HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
 119   tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);
 120
 121   op0 = unshare_expr (op0);
 122   op1 = unshare_expr (op1);
 123
 124   t = fold_convert_loc (loc, op1_utype, op1);
 125   t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);
 126
 127   /* For signed x << y, in C99/C11, the following:
 128      (unsigned) x >> (uprecm1 - y)
 129      if non-zero, is undefined.  */
 130   if (code == LSHIFT_EXPR
 131       && !TYPE_UNSIGNED (type0)
 132       && flag_isoc99)
 133     {
 134       tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
 135                             fold_convert (op1_utype, unshare_expr (op1)));
 136       tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
 137       tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
 138       tt = fold_build2 (NE_EXPR, boolean_type_node, tt,
 139                         build_int_cst (TREE_TYPE (tt), 0));
 140     }
 141
 142   /* For signed x << y, in C++11 and later, the following:
 143      x < 0 || ((unsigned) x >> (uprecm1 - y))
 144      if > 1, is undefined.  */
 145   if (code == LSHIFT_EXPR
 146       && !TYPE_UNSIGNED (type0)
 147       && (cxx_dialect >= cxx11))
 148     {
 149       tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
 150                             fold_convert (op1_utype, unshare_expr (op1)));
 151       tt = fold_convert_loc (loc, unsigned_type_for (type0),
 152                              unshare_expr (op0));
 153       tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
 154       tt = fold_build2 (GT_EXPR, boolean_type_node, tt,
 155                         build_int_cst (TREE_TYPE (tt), 1));
 156       x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0),
 157                        build_int_cst (type0, 0));
 158       tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt);
 159     }
 160
 161   /* If the condition was folded to 0, no need to instrument
 162      this expression.  */
 163   if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt)))
 164     return NULL_TREE;
 165
 166   /* In case we have a SAVE_EXPR in a conditional context, we need to
 167      make sure it gets evaluated before the condition.  */
 168   t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
 169   t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t,
 170                    tt ? tt : integer_zero_node);
 171
 172   if (flag_sanitize_undefined_trap_on_error)
 173     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 174   else
 175     {
 176       tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc,
 177                                      ubsan_type_descriptor (type0),
 178                                      ubsan_type_descriptor (type1), NULL_TREE,
 179                                      NULL_TREE);
 180       data = build_fold_addr_expr_loc (loc, data);
 181
 182       enum built_in_function bcode
 183         = (flag_sanitize_recover & SANITIZE_SHIFT)
 184           ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
 185           : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
 186       tt = builtin_decl_explicit (bcode);
 187       op0 = unshare_expr (op0);
 188       op1 = unshare_expr (op1);
 189       tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
 190                                 ubsan_encode_value (op1));
 191     }
 192   t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
 193
 194   return t;
 195 }
 196
 197 /* Instrument variable length array bound.  */
 198
 199 tree
 200 ubsan_instrument_vla (location_t loc, tree size)
 201 {
 202   tree type = TREE_TYPE (size);
 203   tree t, tt;
 204
 205   t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0));
 206   if (flag_sanitize_undefined_trap_on_error)
 207     tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 208   else
 209     {
 210       tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc,
 211                                      ubsan_type_descriptor (type), NULL_TREE,
 212                                      NULL_TREE);
 213       data = build_fold_addr_expr_loc (loc, data);
 214       enum built_in_function bcode
 215         = (flag_sanitize_recover & SANITIZE_VLA)
 216           ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
 217           : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT;
 218       tt = builtin_decl_explicit (bcode);
 219       tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size));
 220     }
 221   t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
 222
 223   return t;
 224 }
 225
 226 /* Instrument missing return in C++ functions returning non-void.  */
 227
 228 tree
 229 ubsan_instrument_return (location_t loc)
 230 {
 231   if (flag_sanitize_undefined_trap_on_error)
 232     return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
 233   /* It is possible that PCH zapped table with definitions of sanitizer
 234      builtins.  Reinitialize them if needed.  */
 235   initialize_sanitizer_builtins ();
 236
 237   tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc,
 238                                  NULL_TREE, NULL_TREE);
 239   tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN);
 240   return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
 241 }
 242
 243 /* Instrument array bounds for ARRAY_REFs.  We create special builtin,
 244    that gets expanded in the sanopt pass, and make an array dimension
 245    of it.  ARRAY is the array, *INDEX is an index to the array.
 246    Return NULL_TREE if no instrumentation is emitted.
 247    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
 248
 249 tree
 250 ubsan_instrument_bounds (location_t loc, tree array, tree *index,
 251                          bool ignore_off_by_one)
 252 {
 253   tree type = TREE_TYPE (array);
 254   tree domain = TYPE_DOMAIN (type);
 255
 256   if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE)
 257     return NULL_TREE;
 258
 259   tree bound = TYPE_MAX_VALUE (domain);
 260   if (ignore_off_by_one)
 261     bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound,
 262                          build_int_cst (TREE_TYPE (bound), 1));
 263
 264   /* Detect flexible array members and suchlike, unless
 265      -fsanitize=bounds-strict.  */
 266   tree base = get_base_address (array);
 267   if ((flag_sanitize & SANITIZE_BOUNDS_STRICT) == 0
 268       && TREE_CODE (array) == COMPONENT_REF
 269       && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
 270     {
 271       tree next = NULL_TREE;
 272       tree cref = array;
 273
 274       /* Walk all structs/unions.  */
 275       while (TREE_CODE (cref) == COMPONENT_REF)
 276         {
 277           if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
 278             for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
 279                  next && TREE_CODE (next) != FIELD_DECL;
 280                  next = DECL_CHAIN (next))
 281               ;
 282           if (next)
 283             /* Not a last element.  Instrument it.  */
 284             break;
 285           /* Ok, this is the last field of the structure/union.  But the
 286              aggregate containing the field must be the last field too,
 287              recursively.  */
 288           cref = TREE_OPERAND (cref, 0);
 289         }
 290       if (!next)
 291         /* Don't instrument this flexible array member-like array in non-strict
 292            -fsanitize=bounds mode.  */
 293         return NULL_TREE;
 294     }
 295
 296   /* Don't emit instrumentation in the most common cases.  */
 297   tree idx = NULL_TREE;
 298   if (TREE_CODE (*index) == INTEGER_CST)
 299     idx = *index;
 300   else if (TREE_CODE (*index) == BIT_AND_EXPR
 301            && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST)
 302     idx = TREE_OPERAND (*index, 1);
 303   if (idx
 304       && TREE_CODE (bound) == INTEGER_CST
 305       && tree_int_cst_sgn (idx) >= 0
 306       && tree_int_cst_le (idx, bound))
 307     return NULL_TREE;
 308
 309   *index = save_expr (*index);
 310   /* Create a "(T *) 0" tree node to describe the array type.  */
 311   tree zero_with_type = build_int_cst (build_pointer_type (type), 0);
 312   return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS,
 313                                        void_type_node, 3, zero_with_type,
 314                                        *index, bound);
 315 }
 316
 317 /* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS.  */
 318
 319 bool
 320 ubsan_array_ref_instrumented_p (const_tree t)
 321 {
 322   if (TREE_CODE (t) != ARRAY_REF)
 323     return false;
 324
 325   tree op1 = TREE_OPERAND (t, 1);
 326   return TREE_CODE (op1) == COMPOUND_EXPR
 327          && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR
 328          && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE
 329          && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS;
 330 }
 331
 332 /* Instrument an ARRAY_REF, if it hasn't already been instrumented.
 333    IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR.  */
 334
 335 void
 336 ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one)
 337 {
 338   if (!ubsan_array_ref_instrumented_p (*expr_p)
 339       && do_ubsan_in_current_function ())
 340     {
 341       tree op0 = TREE_OPERAND (*expr_p, 0);
 342       tree op1 = TREE_OPERAND (*expr_p, 1);
 343       tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1,
 344                                         ignore_off_by_one);
 345       if (e != NULL_TREE)
 346         {
 347           tree t = copy_node (*expr_p);
 348           TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1),
 349                                         e, op1);
 350           *expr_p = t;
 351         }
 352     }
 353 }
 354
 355 static tree
 356 ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
 357                                           enum ubsan_null_ckind ckind)
 358 {
 359   if (!do_ubsan_in_current_function ())
 360     return NULL_TREE;
 361
 362   tree type = TREE_TYPE (ptype);
 363   tree orig_op = op;
 364   bool instrument = false;
 365   unsigned int mina = 0;
 366
 367   if (flag_sanitize & SANITIZE_ALIGNMENT)
 368     {
 369       mina = min_align_of_type (type);
 370       if (mina <= 1)
 371         mina = 0;
 372     }
 373   while ((TREE_CODE (op) == NOP_EXPR
 374           || TREE_CODE (op) == NON_LVALUE_EXPR)
 375          && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE)
 376     op = TREE_OPERAND (op, 0);
 377   if (TREE_CODE (op) == NOP_EXPR
 378       && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
 379     {
 380       if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op))))
 381         instrument = true;
 382     }
 383   else
 384     {
 385       if ((flag_sanitize & SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR)
 386         {
 387           bool strict_overflow_p = false;
 388           /* tree_single_nonzero_warnv_p will not return true for non-weak
 389              non-automatic decls with -fno-delete-null-pointer-checks,
 390              which is disabled during -fsanitize=null.  We don't want to
 391              instrument those, just weak vars though.  */
 392           int save_flag_delete_null_pointer_checks
 393             = flag_delete_null_pointer_checks;
 394           flag_delete_null_pointer_checks = 1;
 395           if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
 396               || strict_overflow_p)
 397             instrument = true;
 398           flag_delete_null_pointer_checks
 399             = save_flag_delete_null_pointer_checks;
 400         }
 401       else if (flag_sanitize & SANITIZE_NULL)
 402         instrument = true;
 403       if (mina && mina > 1)
 404         {
 405           if (!POINTER_TYPE_P (TREE_TYPE (op))
 406               || mina > get_pointer_alignment (op) / BITS_PER_UNIT)
 407             instrument = true;
 408         }
 409     }
 410   if (!instrument)
 411     return NULL_TREE;
 412   op = save_expr (orig_op);
 413   gcc_assert (POINTER_TYPE_P (ptype));
 414   if (TREE_CODE (ptype) == REFERENCE_TYPE)
 415     ptype = build_pointer_type (TREE_TYPE (ptype));
 416   tree kind = build_int_cst (ptype, ckind);
 417   tree align = build_int_cst (pointer_sized_int_node, mina);
 418   tree call
 419     = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node,
 420                                     3, op, kind, align);
 421   TREE_SIDE_EFFECTS (call) = 1;
 422   return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
 423 }
 424
 425 /* Instrument a NOP_EXPR to REFERENCE_TYPE if needed.  */
 426
 427 void
 428 ubsan_maybe_instrument_reference (tree stmt)
 429 {
 430   tree op = TREE_OPERAND (stmt, 0);
 431   op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
 432                                                  TREE_TYPE (stmt),
 433                                                  UBSAN_REF_BINDING);
 434   if (op)
 435     TREE_OPERAND (stmt, 0) = op;
 436 }
 437
 438 /* Instrument a CALL_EXPR to a method if needed.  */
 439
 440 void
 441 ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor)
 442 {
 443   if (call_expr_nargs (stmt) == 0)
 444     return;
 445   tree op = CALL_EXPR_ARG (stmt, 0);
 446   if (op == error_mark_node
 447       || !POINTER_TYPE_P (TREE_TYPE (op)))
 448     return;
 449   op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
 450                                                  TREE_TYPE (op),
 451                                                  is_ctor ? UBSAN_CTOR_CALL
 452                                                  : UBSAN_MEMBER_CALL);
 453   if (op)
 454     CALL_EXPR_ARG (stmt, 0) = op;
 455 }