1 /* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2014 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
26 #include "hash-table.h"
27 #include "basic-block.h"
28 #include "tree-ssa-alias.h"
29 #include "internal-fn.h"
30 #include "gimple-expr.h"
35 #include "gimple-iterator.h"
38 #include "stor-layout.h"
39 #include "tree-iterator.h"
41 #include "stringpool.h"
42 #include "tree-ssanames.h"
43 #include "tree-pass.h"
45 #include "gimple-pretty-print.h"
51 #include "langhooks.h"
52 #include "alloc-pool.h"
54 #include "gimple-builder.h"
60 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
61 with <2x slowdown on average.
63 The tool consists of two parts:
64 instrumentation module (this file) and a run-time library.
65 The instrumentation module adds a run-time check before every memory insn.
66 For a 8- or 16- byte load accessing address X:
67 ShadowAddr = (X >> 3) + Offset
68 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
70 __asan_report_load8(X);
71 For a load of N bytes (N=1, 2 or 4) from address X:
72 ShadowAddr = (X >> 3) + Offset
73 ShadowValue = *(char*)ShadowAddr;
75 if ((X & 7) + N - 1 > ShadowValue)
76 __asan_report_loadN(X);
77 Stores are instrumented similarly, but using __asan_report_storeN functions.
78 A call too __asan_init_vN() is inserted to the list of module CTORs.
79 N is the version number of the AddressSanitizer API. The changes between the
80 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
82 The run-time library redefines malloc (so that redzone are inserted around
83 the allocated memory) and free (so that reuse of free-ed memory is delayed),
84 provides __asan_report* and __asan_init_vN functions.
87 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
89 The current implementation supports detection of out-of-bounds and
90 use-after-free in the heap, on the stack and for global variables.
92 [Protection of stack variables]
94 To understand how detection of out-of-bounds and use-after-free works
95 for stack variables, lets look at this example on x86_64 where the
110 For this function, the stack protected by asan will be organized as
111 follows, from the top of the stack to the bottom:
113 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
115 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
116 the next slot be 32 bytes aligned; this one is called Partial
117 Redzone; this 32 bytes alignment is an asan constraint]
119 Slot 3/ [24 bytes for variable 'a']
121 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
123 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
125 Slot 6/ [8 bytes for variable 'b']
127 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
130 The 32 bytes of LEFT red zone at the bottom of the stack can be
133 1/ The first 8 bytes contain a magical asan number that is always
136 2/ The following 8 bytes contains a pointer to a string (to be
137 parsed at runtime by the runtime asan library), which format is
140 "<function-name> <space> <num-of-variables-on-the-stack>
141 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
142 <length-of-var-in-bytes> ){n} "
144 where '(...){n}' means the content inside the parenthesis occurs 'n'
145 times, with 'n' being the number of variables on the stack.
147 3/ The following 8 bytes contain the PC of the current function which
148 will be used by the run-time library to print an error message.
150 4/ The following 8 bytes are reserved for internal use by the run-time.
152 The shadow memory for that stack layout is going to look like this:
154 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
155 The F1 byte pattern is a magic number called
156 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
157 the memory for that shadow byte is part of a the LEFT red zone
158 intended to seat at the bottom of the variables on the stack.
160 - content of shadow memory 8 bytes for slots 6 and 5:
161 0xF4F4F400. The F4 byte pattern is a magic number
162 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
163 memory region for this shadow byte is a PARTIAL red zone
164 intended to pad a variable A, so that the slot following
165 {A,padding} is 32 bytes aligned.
167 Note that the fact that the least significant byte of this
168 shadow memory content is 00 means that 8 bytes of its
169 corresponding memory (which corresponds to the memory of
170 variable 'b') is addressable.
172 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
173 The F2 byte pattern is a magic number called
174 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
175 region for this shadow byte is a MIDDLE red zone intended to
176 seat between two 32 aligned slots of {variable,padding}.
178 - content of shadow memory 8 bytes for slot 3 and 2:
179 0xF4000000. This represents is the concatenation of
180 variable 'a' and the partial red zone following it, like what we
181 had for variable 'b'. The least significant 3 bytes being 00
182 means that the 3 bytes of variable 'a' are addressable.
184 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
185 The F3 byte pattern is a magic number called
186 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
187 region for this shadow byte is a RIGHT red zone intended to seat
188 at the top of the variables of the stack.
190 Note that the real variable layout is done in expand_used_vars in
191 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
192 stack variables as well as the different red zones, emits some
193 prologue code to populate the shadow memory as to poison (mark as
194 non-accessible) the regions of the red zones and mark the regions of
195 stack variables as accessible, and emit some epilogue code to
196 un-poison (mark as accessible) the regions of red zones right before
199 [Protection of global variables]
201 The basic idea is to insert a red zone between two global variables
202 and install a constructor function that calls the asan runtime to do
203 the populating of the relevant shadow memory regions at load time.
205 So the global variables are laid out as to insert a red zone between
206 them. The size of the red zones is so that each variable starts on a
209 Then a constructor function is installed so that, for each global
210 variable, it calls the runtime asan library function
211 __asan_register_globals_with an instance of this type:
215 // Address of the beginning of the global variable.
218 // Initial size of the global variable.
221 // Size of the global variable + size of the red zone. This
222 // size is 32 bytes aligned.
223 uptr __size_with_redzone;
225 // Name of the global variable.
228 // Name of the module where the global variable is declared.
229 const void *__module_name;
231 // 1 if it has dynamic initialization, 0 otherwise.
232 uptr __has_dynamic_init;
235 A destructor function that calls the runtime asan library function
236 _asan_unregister_globals is also installed. */
238 alias_set_type asan_shadow_set
= -1;
240 /* Pointer types to 1 resp. 2 byte integers in shadow memory. A separate
241 alias set is used for all shadow memory accesses. */
242 static GTY(()) tree shadow_ptr_types
[2];
244 /* Decl for __asan_option_detect_stack_use_after_return. */
245 static GTY(()) tree asan_detect_stack_use_after_return
;
247 /* Various flags for Asan builtins. */
248 enum asan_check_flags
250 ASAN_CHECK_STORE
= 1 << 0,
251 ASAN_CHECK_SCALAR_ACCESS
= 1 << 1,
252 ASAN_CHECK_NON_ZERO_LEN
= 1 << 2,
253 ASAN_CHECK_START_INSTRUMENTED
= 1 << 3,
254 ASAN_CHECK_END_INSTRUMENTED
= 1 << 4,
258 /* Hashtable support for memory references used by gimple
261 /* This type represents a reference to a memory region. */
264 /* The expression of the beginning of the memory region. */
267 /* The size of the access. */
268 HOST_WIDE_INT access_size
;
271 static alloc_pool asan_mem_ref_alloc_pool
;
273 /* This creates the alloc pool used to store the instances of
274 asan_mem_ref that are stored in the hash table asan_mem_ref_ht. */
277 asan_mem_ref_get_alloc_pool ()
279 if (asan_mem_ref_alloc_pool
== NULL
)
280 asan_mem_ref_alloc_pool
= create_alloc_pool ("asan_mem_ref",
281 sizeof (asan_mem_ref
),
283 return asan_mem_ref_alloc_pool
;
287 /* Initializes an instance of asan_mem_ref. */
290 asan_mem_ref_init (asan_mem_ref
*ref
, tree start
, HOST_WIDE_INT access_size
)
293 ref
->access_size
= access_size
;
296 /* Allocates memory for an instance of asan_mem_ref into the memory
297 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
298 START is the address of (or the expression pointing to) the
299 beginning of memory reference. ACCESS_SIZE is the size of the
300 access to the referenced memory. */
303 asan_mem_ref_new (tree start
, HOST_WIDE_INT access_size
)
306 (asan_mem_ref
*) pool_alloc (asan_mem_ref_get_alloc_pool ());
308 asan_mem_ref_init (ref
, start
, access_size
);
312 /* This builds and returns a pointer to the end of the memory region
313 that starts at START and of length LEN. */
316 asan_mem_ref_get_end (tree start
, tree len
)
318 if (len
== NULL_TREE
|| integer_zerop (len
))
321 return fold_build2 (POINTER_PLUS_EXPR
, TREE_TYPE (start
), start
, len
);
324 /* Return a tree expression that represents the end of the referenced
325 memory region. Beware that this function can actually build a new
329 asan_mem_ref_get_end (const asan_mem_ref
*ref
, tree len
)
331 return asan_mem_ref_get_end (ref
->start
, len
);
334 struct asan_mem_ref_hasher
335 : typed_noop_remove
<asan_mem_ref
>
337 typedef asan_mem_ref value_type
;
338 typedef asan_mem_ref compare_type
;
340 static inline hashval_t
hash (const value_type
*);
341 static inline bool equal (const value_type
*, const compare_type
*);
344 /* Hash a memory reference. */
347 asan_mem_ref_hasher::hash (const asan_mem_ref
*mem_ref
)
349 inchash::hash hstate
;
350 inchash::add_expr (mem_ref
->start
, hstate
);
351 hstate
.add_wide_int (mem_ref
->access_size
);
352 return hstate
.end ();
355 /* Compare two memory references. We accept the length of either
356 memory references to be NULL_TREE. */
359 asan_mem_ref_hasher::equal (const asan_mem_ref
*m1
,
360 const asan_mem_ref
*m2
)
362 return (m1
->access_size
== m2
->access_size
363 && operand_equal_p (m1
->start
, m2
->start
, 0));
366 static hash_table
<asan_mem_ref_hasher
> *asan_mem_ref_ht
;
368 /* Returns a reference to the hash table containing memory references.
369 This function ensures that the hash table is created. Note that
370 this hash table is updated by the function
371 update_mem_ref_hash_table. */
373 static hash_table
<asan_mem_ref_hasher
> *
374 get_mem_ref_hash_table ()
376 if (!asan_mem_ref_ht
)
377 asan_mem_ref_ht
= new hash_table
<asan_mem_ref_hasher
> (10);
379 return asan_mem_ref_ht
;
382 /* Clear all entries from the memory references hash table. */
385 empty_mem_ref_hash_table ()
388 asan_mem_ref_ht
->empty ();
391 /* Free the memory references hash table. */
394 free_mem_ref_resources ()
396 delete asan_mem_ref_ht
;
397 asan_mem_ref_ht
= NULL
;
399 if (asan_mem_ref_alloc_pool
)
401 free_alloc_pool (asan_mem_ref_alloc_pool
);
402 asan_mem_ref_alloc_pool
= NULL
;
406 /* Return true iff the memory reference REF has been instrumented. */
409 has_mem_ref_been_instrumented (tree ref
, HOST_WIDE_INT access_size
)
412 asan_mem_ref_init (&r
, ref
, access_size
);
414 return (get_mem_ref_hash_table ()->find (&r
) != NULL
);
417 /* Return true iff the memory reference REF has been instrumented. */
420 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
)
422 return has_mem_ref_been_instrumented (ref
->start
, ref
->access_size
);
425 /* Return true iff access to memory region starting at REF and of
426 length LEN has been instrumented. */
429 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
, tree len
)
431 /* First let's see if the address of the beginning of REF has been
433 if (!has_mem_ref_been_instrumented (ref
))
438 /* Let's see if the end of the region has been instrumented. */
439 if (!has_mem_ref_been_instrumented (asan_mem_ref_get_end (ref
, len
),
446 /* Set REF to the memory reference present in a gimple assignment
447 ASSIGNMENT. Return true upon successful completion, false
451 get_mem_ref_of_assignment (const gimple assignment
,
455 gcc_assert (gimple_assign_single_p (assignment
));
457 if (gimple_store_p (assignment
)
458 && !gimple_clobber_p (assignment
))
460 ref
->start
= gimple_assign_lhs (assignment
);
461 *ref_is_store
= true;
463 else if (gimple_assign_load_p (assignment
))
465 ref
->start
= gimple_assign_rhs1 (assignment
);
466 *ref_is_store
= false;
471 ref
->access_size
= int_size_in_bytes (TREE_TYPE (ref
->start
));
475 /* Return the memory references contained in a gimple statement
476 representing a builtin call that has to do with memory access. */
479 get_mem_refs_of_builtin_call (const gimple call
,
491 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
493 tree callee
= gimple_call_fndecl (call
);
494 tree source0
= NULL_TREE
, source1
= NULL_TREE
,
495 dest
= NULL_TREE
, len
= NULL_TREE
;
496 bool is_store
= true, got_reference_p
= false;
497 HOST_WIDE_INT access_size
= 1;
499 switch (DECL_FUNCTION_CODE (callee
))
501 /* (s, s, n) style memops. */
503 case BUILT_IN_MEMCMP
:
504 source0
= gimple_call_arg (call
, 0);
505 source1
= gimple_call_arg (call
, 1);
506 len
= gimple_call_arg (call
, 2);
509 /* (src, dest, n) style memops. */
511 source0
= gimple_call_arg (call
, 0);
512 dest
= gimple_call_arg (call
, 1);
513 len
= gimple_call_arg (call
, 2);
516 /* (dest, src, n) style memops. */
517 case BUILT_IN_MEMCPY
:
518 case BUILT_IN_MEMCPY_CHK
:
519 case BUILT_IN_MEMMOVE
:
520 case BUILT_IN_MEMMOVE_CHK
:
521 case BUILT_IN_MEMPCPY
:
522 case BUILT_IN_MEMPCPY_CHK
:
523 dest
= gimple_call_arg (call
, 0);
524 source0
= gimple_call_arg (call
, 1);
525 len
= gimple_call_arg (call
, 2);
528 /* (dest, n) style memops. */
530 dest
= gimple_call_arg (call
, 0);
531 len
= gimple_call_arg (call
, 1);
534 /* (dest, x, n) style memops*/
535 case BUILT_IN_MEMSET
:
536 case BUILT_IN_MEMSET_CHK
:
537 dest
= gimple_call_arg (call
, 0);
538 len
= gimple_call_arg (call
, 2);
541 case BUILT_IN_STRLEN
:
542 source0
= gimple_call_arg (call
, 0);
543 len
= gimple_call_lhs (call
);
546 /* And now the __atomic* and __sync builtins.
547 These are handled differently from the classical memory memory
548 access builtins above. */
550 case BUILT_IN_ATOMIC_LOAD_1
:
551 case BUILT_IN_ATOMIC_LOAD_2
:
552 case BUILT_IN_ATOMIC_LOAD_4
:
553 case BUILT_IN_ATOMIC_LOAD_8
:
554 case BUILT_IN_ATOMIC_LOAD_16
:
558 case BUILT_IN_SYNC_FETCH_AND_ADD_1
:
559 case BUILT_IN_SYNC_FETCH_AND_ADD_2
:
560 case BUILT_IN_SYNC_FETCH_AND_ADD_4
:
561 case BUILT_IN_SYNC_FETCH_AND_ADD_8
:
562 case BUILT_IN_SYNC_FETCH_AND_ADD_16
:
564 case BUILT_IN_SYNC_FETCH_AND_SUB_1
:
565 case BUILT_IN_SYNC_FETCH_AND_SUB_2
:
566 case BUILT_IN_SYNC_FETCH_AND_SUB_4
:
567 case BUILT_IN_SYNC_FETCH_AND_SUB_8
:
568 case BUILT_IN_SYNC_FETCH_AND_SUB_16
:
570 case BUILT_IN_SYNC_FETCH_AND_OR_1
:
571 case BUILT_IN_SYNC_FETCH_AND_OR_2
:
572 case BUILT_IN_SYNC_FETCH_AND_OR_4
:
573 case BUILT_IN_SYNC_FETCH_AND_OR_8
:
574 case BUILT_IN_SYNC_FETCH_AND_OR_16
:
576 case BUILT_IN_SYNC_FETCH_AND_AND_1
:
577 case BUILT_IN_SYNC_FETCH_AND_AND_2
:
578 case BUILT_IN_SYNC_FETCH_AND_AND_4
:
579 case BUILT_IN_SYNC_FETCH_AND_AND_8
:
580 case BUILT_IN_SYNC_FETCH_AND_AND_16
:
582 case BUILT_IN_SYNC_FETCH_AND_XOR_1
:
583 case BUILT_IN_SYNC_FETCH_AND_XOR_2
:
584 case BUILT_IN_SYNC_FETCH_AND_XOR_4
:
585 case BUILT_IN_SYNC_FETCH_AND_XOR_8
:
586 case BUILT_IN_SYNC_FETCH_AND_XOR_16
:
588 case BUILT_IN_SYNC_FETCH_AND_NAND_1
:
589 case BUILT_IN_SYNC_FETCH_AND_NAND_2
:
590 case BUILT_IN_SYNC_FETCH_AND_NAND_4
:
591 case BUILT_IN_SYNC_FETCH_AND_NAND_8
:
593 case BUILT_IN_SYNC_ADD_AND_FETCH_1
:
594 case BUILT_IN_SYNC_ADD_AND_FETCH_2
:
595 case BUILT_IN_SYNC_ADD_AND_FETCH_4
:
596 case BUILT_IN_SYNC_ADD_AND_FETCH_8
:
597 case BUILT_IN_SYNC_ADD_AND_FETCH_16
:
599 case BUILT_IN_SYNC_SUB_AND_FETCH_1
:
600 case BUILT_IN_SYNC_SUB_AND_FETCH_2
:
601 case BUILT_IN_SYNC_SUB_AND_FETCH_4
:
602 case BUILT_IN_SYNC_SUB_AND_FETCH_8
:
603 case BUILT_IN_SYNC_SUB_AND_FETCH_16
:
605 case BUILT_IN_SYNC_OR_AND_FETCH_1
:
606 case BUILT_IN_SYNC_OR_AND_FETCH_2
:
607 case BUILT_IN_SYNC_OR_AND_FETCH_4
:
608 case BUILT_IN_SYNC_OR_AND_FETCH_8
:
609 case BUILT_IN_SYNC_OR_AND_FETCH_16
:
611 case BUILT_IN_SYNC_AND_AND_FETCH_1
:
612 case BUILT_IN_SYNC_AND_AND_FETCH_2
:
613 case BUILT_IN_SYNC_AND_AND_FETCH_4
:
614 case BUILT_IN_SYNC_AND_AND_FETCH_8
:
615 case BUILT_IN_SYNC_AND_AND_FETCH_16
:
617 case BUILT_IN_SYNC_XOR_AND_FETCH_1
:
618 case BUILT_IN_SYNC_XOR_AND_FETCH_2
:
619 case BUILT_IN_SYNC_XOR_AND_FETCH_4
:
620 case BUILT_IN_SYNC_XOR_AND_FETCH_8
:
621 case BUILT_IN_SYNC_XOR_AND_FETCH_16
:
623 case BUILT_IN_SYNC_NAND_AND_FETCH_1
:
624 case BUILT_IN_SYNC_NAND_AND_FETCH_2
:
625 case BUILT_IN_SYNC_NAND_AND_FETCH_4
:
626 case BUILT_IN_SYNC_NAND_AND_FETCH_8
:
628 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1
:
629 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2
:
630 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4
:
631 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8
:
632 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16
:
634 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1
:
635 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2
:
636 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4
:
637 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8
:
638 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16
:
640 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1
:
641 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2
:
642 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4
:
643 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8
:
644 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16
:
646 case BUILT_IN_SYNC_LOCK_RELEASE_1
:
647 case BUILT_IN_SYNC_LOCK_RELEASE_2
:
648 case BUILT_IN_SYNC_LOCK_RELEASE_4
:
649 case BUILT_IN_SYNC_LOCK_RELEASE_8
:
650 case BUILT_IN_SYNC_LOCK_RELEASE_16
:
652 case BUILT_IN_ATOMIC_EXCHANGE_1
:
653 case BUILT_IN_ATOMIC_EXCHANGE_2
:
654 case BUILT_IN_ATOMIC_EXCHANGE_4
:
655 case BUILT_IN_ATOMIC_EXCHANGE_8
:
656 case BUILT_IN_ATOMIC_EXCHANGE_16
:
658 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1
:
659 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2
:
660 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4
:
661 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8
:
662 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16
:
664 case BUILT_IN_ATOMIC_STORE_1
:
665 case BUILT_IN_ATOMIC_STORE_2
:
666 case BUILT_IN_ATOMIC_STORE_4
:
667 case BUILT_IN_ATOMIC_STORE_8
:
668 case BUILT_IN_ATOMIC_STORE_16
:
670 case BUILT_IN_ATOMIC_ADD_FETCH_1
:
671 case BUILT_IN_ATOMIC_ADD_FETCH_2
:
672 case BUILT_IN_ATOMIC_ADD_FETCH_4
:
673 case BUILT_IN_ATOMIC_ADD_FETCH_8
:
674 case BUILT_IN_ATOMIC_ADD_FETCH_16
:
676 case BUILT_IN_ATOMIC_SUB_FETCH_1
:
677 case BUILT_IN_ATOMIC_SUB_FETCH_2
:
678 case BUILT_IN_ATOMIC_SUB_FETCH_4
:
679 case BUILT_IN_ATOMIC_SUB_FETCH_8
:
680 case BUILT_IN_ATOMIC_SUB_FETCH_16
:
682 case BUILT_IN_ATOMIC_AND_FETCH_1
:
683 case BUILT_IN_ATOMIC_AND_FETCH_2
:
684 case BUILT_IN_ATOMIC_AND_FETCH_4
:
685 case BUILT_IN_ATOMIC_AND_FETCH_8
:
686 case BUILT_IN_ATOMIC_AND_FETCH_16
:
688 case BUILT_IN_ATOMIC_NAND_FETCH_1
:
689 case BUILT_IN_ATOMIC_NAND_FETCH_2
:
690 case BUILT_IN_ATOMIC_NAND_FETCH_4
:
691 case BUILT_IN_ATOMIC_NAND_FETCH_8
:
692 case BUILT_IN_ATOMIC_NAND_FETCH_16
:
694 case BUILT_IN_ATOMIC_XOR_FETCH_1
:
695 case BUILT_IN_ATOMIC_XOR_FETCH_2
:
696 case BUILT_IN_ATOMIC_XOR_FETCH_4
:
697 case BUILT_IN_ATOMIC_XOR_FETCH_8
:
698 case BUILT_IN_ATOMIC_XOR_FETCH_16
:
700 case BUILT_IN_ATOMIC_OR_FETCH_1
:
701 case BUILT_IN_ATOMIC_OR_FETCH_2
:
702 case BUILT_IN_ATOMIC_OR_FETCH_4
:
703 case BUILT_IN_ATOMIC_OR_FETCH_8
:
704 case BUILT_IN_ATOMIC_OR_FETCH_16
:
706 case BUILT_IN_ATOMIC_FETCH_ADD_1
:
707 case BUILT_IN_ATOMIC_FETCH_ADD_2
:
708 case BUILT_IN_ATOMIC_FETCH_ADD_4
:
709 case BUILT_IN_ATOMIC_FETCH_ADD_8
:
710 case BUILT_IN_ATOMIC_FETCH_ADD_16
:
712 case BUILT_IN_ATOMIC_FETCH_SUB_1
:
713 case BUILT_IN_ATOMIC_FETCH_SUB_2
:
714 case BUILT_IN_ATOMIC_FETCH_SUB_4
:
715 case BUILT_IN_ATOMIC_FETCH_SUB_8
:
716 case BUILT_IN_ATOMIC_FETCH_SUB_16
:
718 case BUILT_IN_ATOMIC_FETCH_AND_1
:
719 case BUILT_IN_ATOMIC_FETCH_AND_2
:
720 case BUILT_IN_ATOMIC_FETCH_AND_4
:
721 case BUILT_IN_ATOMIC_FETCH_AND_8
:
722 case BUILT_IN_ATOMIC_FETCH_AND_16
:
724 case BUILT_IN_ATOMIC_FETCH_NAND_1
:
725 case BUILT_IN_ATOMIC_FETCH_NAND_2
:
726 case BUILT_IN_ATOMIC_FETCH_NAND_4
:
727 case BUILT_IN_ATOMIC_FETCH_NAND_8
:
728 case BUILT_IN_ATOMIC_FETCH_NAND_16
:
730 case BUILT_IN_ATOMIC_FETCH_XOR_1
:
731 case BUILT_IN_ATOMIC_FETCH_XOR_2
:
732 case BUILT_IN_ATOMIC_FETCH_XOR_4
:
733 case BUILT_IN_ATOMIC_FETCH_XOR_8
:
734 case BUILT_IN_ATOMIC_FETCH_XOR_16
:
736 case BUILT_IN_ATOMIC_FETCH_OR_1
:
737 case BUILT_IN_ATOMIC_FETCH_OR_2
:
738 case BUILT_IN_ATOMIC_FETCH_OR_4
:
739 case BUILT_IN_ATOMIC_FETCH_OR_8
:
740 case BUILT_IN_ATOMIC_FETCH_OR_16
:
742 dest
= gimple_call_arg (call
, 0);
743 /* DEST represents the address of a memory location.
744 instrument_derefs wants the memory location, so lets
745 dereference the address DEST before handing it to
746 instrument_derefs. */
747 if (TREE_CODE (dest
) == ADDR_EXPR
)
748 dest
= TREE_OPERAND (dest
, 0);
749 else if (TREE_CODE (dest
) == SSA_NAME
|| TREE_CODE (dest
) == INTEGER_CST
)
750 dest
= build2 (MEM_REF
, TREE_TYPE (TREE_TYPE (dest
)),
751 dest
, build_int_cst (TREE_TYPE (dest
), 0));
755 access_size
= int_size_in_bytes (TREE_TYPE (dest
));
759 /* The other builtins memory access are not instrumented in this
760 function because they either don't have any length parameter,
761 or their length parameter is just a limit. */
765 if (len
!= NULL_TREE
)
767 if (source0
!= NULL_TREE
)
769 src0
->start
= source0
;
770 src0
->access_size
= access_size
;
772 *src0_is_store
= false;
775 if (source1
!= NULL_TREE
)
777 src1
->start
= source1
;
778 src1
->access_size
= access_size
;
780 *src1_is_store
= false;
783 if (dest
!= NULL_TREE
)
786 dst
->access_size
= access_size
;
788 *dst_is_store
= true;
791 got_reference_p
= true;
796 dst
->access_size
= access_size
;
797 *dst_len
= NULL_TREE
;
798 *dst_is_store
= is_store
;
799 *dest_is_deref
= true;
800 got_reference_p
= true;
803 return got_reference_p
;
806 /* Return true iff a given gimple statement has been instrumented.
807 Note that the statement is "defined" by the memory references it
811 has_stmt_been_instrumented_p (gimple stmt
)
813 if (gimple_assign_single_p (stmt
))
817 asan_mem_ref_init (&r
, NULL
, 1);
819 if (get_mem_ref_of_assignment (stmt
, &r
, &r_is_store
))
820 return has_mem_ref_been_instrumented (&r
);
822 else if (gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
824 asan_mem_ref src0
, src1
, dest
;
825 asan_mem_ref_init (&src0
, NULL
, 1);
826 asan_mem_ref_init (&src1
, NULL
, 1);
827 asan_mem_ref_init (&dest
, NULL
, 1);
829 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
830 bool src0_is_store
= false, src1_is_store
= false,
831 dest_is_store
= false, dest_is_deref
= false;
832 if (get_mem_refs_of_builtin_call (stmt
,
833 &src0
, &src0_len
, &src0_is_store
,
834 &src1
, &src1_len
, &src1_is_store
,
835 &dest
, &dest_len
, &dest_is_store
,
838 if (src0
.start
!= NULL_TREE
839 && !has_mem_ref_been_instrumented (&src0
, src0_len
))
842 if (src1
.start
!= NULL_TREE
843 && !has_mem_ref_been_instrumented (&src1
, src1_len
))
846 if (dest
.start
!= NULL_TREE
847 && !has_mem_ref_been_instrumented (&dest
, dest_len
))
856 /* Insert a memory reference into the hash table. */
859 update_mem_ref_hash_table (tree ref
, HOST_WIDE_INT access_size
)
861 hash_table
<asan_mem_ref_hasher
> *ht
= get_mem_ref_hash_table ();
864 asan_mem_ref_init (&r
, ref
, access_size
);
866 asan_mem_ref
**slot
= ht
->find_slot (&r
, INSERT
);
868 *slot
= asan_mem_ref_new (ref
, access_size
);
871 /* Initialize shadow_ptr_types array. */
874 asan_init_shadow_ptr_types (void)
876 asan_shadow_set
= new_alias_set ();
877 shadow_ptr_types
[0] = build_distinct_type_copy (signed_char_type_node
);
878 TYPE_ALIAS_SET (shadow_ptr_types
[0]) = asan_shadow_set
;
879 shadow_ptr_types
[0] = build_pointer_type (shadow_ptr_types
[0]);
880 shadow_ptr_types
[1] = build_distinct_type_copy (short_integer_type_node
);
881 TYPE_ALIAS_SET (shadow_ptr_types
[1]) = asan_shadow_set
;
882 shadow_ptr_types
[1] = build_pointer_type (shadow_ptr_types
[1]);
883 initialize_sanitizer_builtins ();
886 /* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
889 asan_pp_string (pretty_printer
*pp
)
891 const char *buf
= pp_formatted_text (pp
);
892 size_t len
= strlen (buf
);
893 tree ret
= build_string (len
+ 1, buf
);
895 = build_array_type (TREE_TYPE (shadow_ptr_types
[0]),
896 build_index_type (size_int (len
)));
897 TREE_READONLY (ret
) = 1;
898 TREE_STATIC (ret
) = 1;
899 return build1 (ADDR_EXPR
, shadow_ptr_types
[0], ret
);
902 /* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
905 asan_shadow_cst (unsigned char shadow_bytes
[4])
908 unsigned HOST_WIDE_INT val
= 0;
909 gcc_assert (WORDS_BIG_ENDIAN
== BYTES_BIG_ENDIAN
);
910 for (i
= 0; i
< 4; i
++)
911 val
|= (unsigned HOST_WIDE_INT
) shadow_bytes
[BYTES_BIG_ENDIAN
? 3 - i
: i
]
912 << (BITS_PER_UNIT
* i
);
913 return gen_int_mode (val
, SImode
);
916 /* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
920 asan_clear_shadow (rtx shadow_mem
, HOST_WIDE_INT len
)
922 rtx insn
, insns
, top_label
, end
, addr
, tmp
, jump
;
925 clear_storage (shadow_mem
, GEN_INT (len
), BLOCK_OP_NORMAL
);
926 insns
= get_insns ();
928 for (insn
= insns
; insn
; insn
= NEXT_INSN (insn
))
931 if (insn
== NULL_RTX
)
937 gcc_assert ((len
& 3) == 0);
938 top_label
= gen_label_rtx ();
939 addr
= copy_to_mode_reg (Pmode
, XEXP (shadow_mem
, 0));
940 shadow_mem
= adjust_automodify_address (shadow_mem
, SImode
, addr
, 0);
941 end
= force_reg (Pmode
, plus_constant (Pmode
, addr
, len
));
942 emit_label (top_label
);
944 emit_move_insn (shadow_mem
, const0_rtx
);
945 tmp
= expand_simple_binop (Pmode
, PLUS
, addr
, gen_int_mode (4, Pmode
), addr
,
946 true, OPTAB_LIB_WIDEN
);
948 emit_move_insn (addr
, tmp
);
949 emit_cmp_and_jump_insns (addr
, end
, LT
, NULL_RTX
, Pmode
, true, top_label
);
950 jump
= get_last_insn ();
951 gcc_assert (JUMP_P (jump
));
952 add_int_reg_note (jump
, REG_BR_PROB
, REG_BR_PROB_BASE
* 80 / 100);
956 asan_function_start (void)
958 section
*fnsec
= function_section (current_function_decl
);
959 switch_to_section (fnsec
);
960 ASM_OUTPUT_DEBUG_LABEL (asm_out_file
, "LASANPC",
961 current_function_funcdef_no
);
964 /* Insert code to protect stack vars. The prologue sequence should be emitted
965 directly, epilogue sequence returned. BASE is the register holding the
966 stack base, against which OFFSETS array offsets are relative to, OFFSETS
967 array contains pairs of offsets in reverse order, always the end offset
968 of some gap that needs protection followed by starting offset,
969 and DECLS is an array of representative decls for each var partition.
970 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
971 elements long (OFFSETS include gap before the first variable as well
972 as gaps after each stack variable). PBASE is, if non-NULL, some pseudo
973 register which stack vars DECL_RTLs are based on. Either BASE should be
974 assigned to PBASE, when not doing use after return protection, or
975 corresponding address based on __asan_stack_malloc* return value. */
978 asan_emit_stack_protection (rtx base
, rtx pbase
, unsigned int alignb
,
979 HOST_WIDE_INT
*offsets
, tree
*decls
, int length
)
981 rtx shadow_base
, shadow_mem
, ret
, mem
, orig_base
, lab
;
983 unsigned char shadow_bytes
[4];
984 HOST_WIDE_INT base_offset
= offsets
[length
- 1];
985 HOST_WIDE_INT base_align_bias
= 0, offset
, prev_offset
;
986 HOST_WIDE_INT asan_frame_size
= offsets
[0] - base_offset
;
987 HOST_WIDE_INT last_offset
, last_size
;
989 unsigned char cur_shadow_byte
= ASAN_STACK_MAGIC_LEFT
;
990 tree str_cst
, decl
, id
;
991 int use_after_return_class
= -1;
993 if (shadow_ptr_types
[0] == NULL_TREE
)
994 asan_init_shadow_ptr_types ();
996 /* First of all, prepare the description string. */
997 pretty_printer asan_pp
;
999 pp_decimal_int (&asan_pp
, length
/ 2 - 1);
1000 pp_space (&asan_pp
);
1001 for (l
= length
- 2; l
; l
-= 2)
1003 tree decl
= decls
[l
/ 2 - 1];
1004 pp_wide_integer (&asan_pp
, offsets
[l
] - base_offset
);
1005 pp_space (&asan_pp
);
1006 pp_wide_integer (&asan_pp
, offsets
[l
- 1] - offsets
[l
]);
1007 pp_space (&asan_pp
);
1008 if (DECL_P (decl
) && DECL_NAME (decl
))
1010 pp_decimal_int (&asan_pp
, IDENTIFIER_LENGTH (DECL_NAME (decl
)));
1011 pp_space (&asan_pp
);
1012 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
1015 pp_string (&asan_pp
, "9 <unknown>");
1016 pp_space (&asan_pp
);
1018 str_cst
= asan_pp_string (&asan_pp
);
1020 /* Emit the prologue sequence. */
1021 if (asan_frame_size
> 32 && asan_frame_size
<= 65536 && pbase
1022 && ASAN_USE_AFTER_RETURN
)
1024 use_after_return_class
= floor_log2 (asan_frame_size
- 1) - 5;
1025 /* __asan_stack_malloc_N guarantees alignment
1026 N < 6 ? (64 << N) : 4096 bytes. */
1027 if (alignb
> (use_after_return_class
< 6
1028 ? (64U << use_after_return_class
) : 4096U))
1029 use_after_return_class
= -1;
1030 else if (alignb
> ASAN_RED_ZONE_SIZE
&& (asan_frame_size
& (alignb
- 1)))
1031 base_align_bias
= ((asan_frame_size
+ alignb
- 1)
1032 & ~(alignb
- HOST_WIDE_INT_1
)) - asan_frame_size
;
1034 /* Align base if target is STRICT_ALIGNMENT. */
1035 if (STRICT_ALIGNMENT
)
1036 base
= expand_binop (Pmode
, and_optab
, base
,
1037 gen_int_mode (-((GET_MODE_ALIGNMENT (SImode
)
1038 << ASAN_SHADOW_SHIFT
)
1039 / BITS_PER_UNIT
), Pmode
), NULL_RTX
,
1042 if (use_after_return_class
== -1 && pbase
)
1043 emit_move_insn (pbase
, base
);
1045 base
= expand_binop (Pmode
, add_optab
, base
,
1046 gen_int_mode (base_offset
- base_align_bias
, Pmode
),
1047 NULL_RTX
, 1, OPTAB_DIRECT
);
1048 orig_base
= NULL_RTX
;
1049 if (use_after_return_class
!= -1)
1051 if (asan_detect_stack_use_after_return
== NULL_TREE
)
1053 id
= get_identifier ("__asan_option_detect_stack_use_after_return");
1054 decl
= build_decl (BUILTINS_LOCATION
, VAR_DECL
, id
,
1056 SET_DECL_ASSEMBLER_NAME (decl
, id
);
1057 TREE_ADDRESSABLE (decl
) = 1;
1058 DECL_ARTIFICIAL (decl
) = 1;
1059 DECL_IGNORED_P (decl
) = 1;
1060 DECL_EXTERNAL (decl
) = 1;
1061 TREE_STATIC (decl
) = 1;
1062 TREE_PUBLIC (decl
) = 1;
1063 TREE_USED (decl
) = 1;
1064 asan_detect_stack_use_after_return
= decl
;
1066 orig_base
= gen_reg_rtx (Pmode
);
1067 emit_move_insn (orig_base
, base
);
1068 ret
= expand_normal (asan_detect_stack_use_after_return
);
1069 lab
= gen_label_rtx ();
1070 int very_likely
= REG_BR_PROB_BASE
- (REG_BR_PROB_BASE
/ 2000 - 1);
1071 emit_cmp_and_jump_insns (ret
, const0_rtx
, EQ
, NULL_RTX
,
1072 VOIDmode
, 0, lab
, very_likely
);
1073 snprintf (buf
, sizeof buf
, "__asan_stack_malloc_%d",
1074 use_after_return_class
);
1075 ret
= init_one_libfunc (buf
);
1076 rtx addr
= convert_memory_address (ptr_mode
, base
);
1077 ret
= emit_library_call_value (ret
, NULL_RTX
, LCT_NORMAL
, ptr_mode
, 2,
1078 GEN_INT (asan_frame_size
1080 TYPE_MODE (pointer_sized_int_node
),
1082 ret
= convert_memory_address (Pmode
, ret
);
1083 emit_move_insn (base
, ret
);
1085 emit_move_insn (pbase
, expand_binop (Pmode
, add_optab
, base
,
1086 gen_int_mode (base_align_bias
1087 - base_offset
, Pmode
),
1088 NULL_RTX
, 1, OPTAB_DIRECT
));
1090 mem
= gen_rtx_MEM (ptr_mode
, base
);
1091 mem
= adjust_address (mem
, VOIDmode
, base_align_bias
);
1092 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_FRAME_MAGIC
, ptr_mode
));
1093 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1094 emit_move_insn (mem
, expand_normal (str_cst
));
1095 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1096 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASANPC", current_function_funcdef_no
);
1097 id
= get_identifier (buf
);
1098 decl
= build_decl (DECL_SOURCE_LOCATION (current_function_decl
),
1099 VAR_DECL
, id
, char_type_node
);
1100 SET_DECL_ASSEMBLER_NAME (decl
, id
);
1101 TREE_ADDRESSABLE (decl
) = 1;
1102 TREE_READONLY (decl
) = 1;
1103 DECL_ARTIFICIAL (decl
) = 1;
1104 DECL_IGNORED_P (decl
) = 1;
1105 TREE_STATIC (decl
) = 1;
1106 TREE_PUBLIC (decl
) = 0;
1107 TREE_USED (decl
) = 1;
1108 DECL_INITIAL (decl
) = decl
;
1109 TREE_ASM_WRITTEN (decl
) = 1;
1110 TREE_ASM_WRITTEN (id
) = 1;
1111 emit_move_insn (mem
, expand_normal (build_fold_addr_expr (decl
)));
1112 shadow_base
= expand_binop (Pmode
, lshr_optab
, base
,
1113 GEN_INT (ASAN_SHADOW_SHIFT
),
1114 NULL_RTX
, 1, OPTAB_DIRECT
);
1116 = plus_constant (Pmode
, shadow_base
,
1117 targetm
.asan_shadow_offset ()
1118 + (base_align_bias
>> ASAN_SHADOW_SHIFT
));
1119 gcc_assert (asan_shadow_set
!= -1
1120 && (ASAN_RED_ZONE_SIZE
>> ASAN_SHADOW_SHIFT
) == 4);
1121 shadow_mem
= gen_rtx_MEM (SImode
, shadow_base
);
1122 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1123 if (STRICT_ALIGNMENT
)
1124 set_mem_align (shadow_mem
, (GET_MODE_ALIGNMENT (SImode
)));
1125 prev_offset
= base_offset
;
1126 for (l
= length
; l
; l
-= 2)
1129 cur_shadow_byte
= ASAN_STACK_MAGIC_RIGHT
;
1130 offset
= offsets
[l
- 1];
1131 if ((offset
- base_offset
) & (ASAN_RED_ZONE_SIZE
- 1))
1135 = base_offset
+ ((offset
- base_offset
)
1136 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1137 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1138 (aoff
- prev_offset
)
1139 >> ASAN_SHADOW_SHIFT
);
1141 for (i
= 0; i
< 4; i
++, aoff
+= (1 << ASAN_SHADOW_SHIFT
))
1144 if (aoff
< offset
- (1 << ASAN_SHADOW_SHIFT
) + 1)
1145 shadow_bytes
[i
] = 0;
1147 shadow_bytes
[i
] = offset
- aoff
;
1150 shadow_bytes
[i
] = ASAN_STACK_MAGIC_PARTIAL
;
1151 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1154 while (offset
<= offsets
[l
- 2] - ASAN_RED_ZONE_SIZE
)
1156 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1157 (offset
- prev_offset
)
1158 >> ASAN_SHADOW_SHIFT
);
1159 prev_offset
= offset
;
1160 memset (shadow_bytes
, cur_shadow_byte
, 4);
1161 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1162 offset
+= ASAN_RED_ZONE_SIZE
;
1164 cur_shadow_byte
= ASAN_STACK_MAGIC_MIDDLE
;
1166 do_pending_stack_adjust ();
1168 /* Construct epilogue sequence. */
1172 if (use_after_return_class
!= -1)
1174 rtx lab2
= gen_label_rtx ();
1175 char c
= (char) ASAN_STACK_MAGIC_USE_AFTER_RET
;
1176 int very_likely
= REG_BR_PROB_BASE
- (REG_BR_PROB_BASE
/ 2000 - 1);
1177 emit_cmp_and_jump_insns (orig_base
, base
, EQ
, NULL_RTX
,
1178 VOIDmode
, 0, lab2
, very_likely
);
1179 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1180 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1181 mem
= gen_rtx_MEM (ptr_mode
, base
);
1182 mem
= adjust_address (mem
, VOIDmode
, base_align_bias
);
1183 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_RETIRED_MAGIC
, ptr_mode
));
1184 unsigned HOST_WIDE_INT sz
= asan_frame_size
>> ASAN_SHADOW_SHIFT
;
1185 if (use_after_return_class
< 5
1186 && can_store_by_pieces (sz
, builtin_memset_read_str
, &c
,
1187 BITS_PER_UNIT
, true))
1188 store_by_pieces (shadow_mem
, sz
, builtin_memset_read_str
, &c
,
1189 BITS_PER_UNIT
, true, 0);
1190 else if (use_after_return_class
>= 5
1191 || !set_storage_via_setmem (shadow_mem
,
1193 gen_int_mode (c
, QImode
),
1194 BITS_PER_UNIT
, BITS_PER_UNIT
,
1197 snprintf (buf
, sizeof buf
, "__asan_stack_free_%d",
1198 use_after_return_class
);
1199 ret
= init_one_libfunc (buf
);
1200 rtx addr
= convert_memory_address (ptr_mode
, base
);
1201 rtx orig_addr
= convert_memory_address (ptr_mode
, orig_base
);
1202 emit_library_call (ret
, LCT_NORMAL
, ptr_mode
, 3, addr
, ptr_mode
,
1203 GEN_INT (asan_frame_size
+ base_align_bias
),
1204 TYPE_MODE (pointer_sized_int_node
),
1205 orig_addr
, ptr_mode
);
1207 lab
= gen_label_rtx ();
1212 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1213 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1215 if (STRICT_ALIGNMENT
)
1216 set_mem_align (shadow_mem
, (GET_MODE_ALIGNMENT (SImode
)));
1218 prev_offset
= base_offset
;
1219 last_offset
= base_offset
;
1221 for (l
= length
; l
; l
-= 2)
1223 offset
= base_offset
+ ((offsets
[l
- 1] - base_offset
)
1224 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1225 if (last_offset
+ last_size
!= offset
)
1227 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1228 (last_offset
- prev_offset
)
1229 >> ASAN_SHADOW_SHIFT
);
1230 prev_offset
= last_offset
;
1231 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1232 last_offset
= offset
;
1235 last_size
+= base_offset
+ ((offsets
[l
- 2] - base_offset
)
1236 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
))
1241 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1242 (last_offset
- prev_offset
)
1243 >> ASAN_SHADOW_SHIFT
);
1244 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1247 do_pending_stack_adjust ();
1256 /* Return true if DECL, a global var, might be overridden and needs
1257 therefore a local alias. */
1260 asan_needs_local_alias (tree decl
)
1262 return DECL_WEAK (decl
) || !targetm
.binds_local_p (decl
);
1265 /* Return true if DECL is a VAR_DECL that should be protected
1266 by Address Sanitizer, by appending a red zone with protected
1267 shadow memory after it and aligning it to at least
1268 ASAN_RED_ZONE_SIZE bytes. */
1271 asan_protect_global (tree decl
)
1278 if (TREE_CODE (decl
) == STRING_CST
)
1280 /* Instrument all STRING_CSTs except those created
1281 by asan_pp_string here. */
1282 if (shadow_ptr_types
[0] != NULL_TREE
1283 && TREE_CODE (TREE_TYPE (decl
)) == ARRAY_TYPE
1284 && TREE_TYPE (TREE_TYPE (decl
)) == TREE_TYPE (shadow_ptr_types
[0]))
1288 if (TREE_CODE (decl
) != VAR_DECL
1289 /* TLS vars aren't statically protectable. */
1290 || DECL_THREAD_LOCAL_P (decl
)
1291 /* Externs will be protected elsewhere. */
1292 || DECL_EXTERNAL (decl
)
1293 || !DECL_RTL_SET_P (decl
)
1294 /* Comdat vars pose an ABI problem, we can't know if
1295 the var that is selected by the linker will have
1297 || DECL_ONE_ONLY (decl
)
1298 /* Similarly for common vars. People can use -fno-common. */
1299 || (DECL_COMMON (decl
) && TREE_PUBLIC (decl
))
1300 /* Don't protect if using user section, often vars placed
1301 into user section from multiple TUs are then assumed
1302 to be an array of such vars, putting padding in there
1303 breaks this assumption. */
1304 || (DECL_SECTION_NAME (decl
) != NULL
1305 && !symtab_node::get (decl
)->implicit_section
)
1306 || DECL_SIZE (decl
) == 0
1307 || ASAN_RED_ZONE_SIZE
* BITS_PER_UNIT
> MAX_OFILE_ALIGNMENT
1308 || !valid_constant_size_p (DECL_SIZE_UNIT (decl
))
1309 || DECL_ALIGN_UNIT (decl
) > 2 * ASAN_RED_ZONE_SIZE
)
1312 rtl
= DECL_RTL (decl
);
1313 if (!MEM_P (rtl
) || GET_CODE (XEXP (rtl
, 0)) != SYMBOL_REF
)
1315 symbol
= XEXP (rtl
, 0);
1317 if (CONSTANT_POOL_ADDRESS_P (symbol
)
1318 || TREE_CONSTANT_POOL_ADDRESS_P (symbol
))
1321 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl
)))
1324 #ifndef ASM_OUTPUT_DEF
1325 if (asan_needs_local_alias (decl
))
1332 /* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16,_n}.
1333 IS_STORE is either 1 (for a store) or 0 (for a load). */
1336 report_error_func (bool is_store
, HOST_WIDE_INT size_in_bytes
, int *nargs
)
1338 static enum built_in_function report
[2][6]
1339 = { { BUILT_IN_ASAN_REPORT_LOAD1
, BUILT_IN_ASAN_REPORT_LOAD2
,
1340 BUILT_IN_ASAN_REPORT_LOAD4
, BUILT_IN_ASAN_REPORT_LOAD8
,
1341 BUILT_IN_ASAN_REPORT_LOAD16
, BUILT_IN_ASAN_REPORT_LOAD_N
},
1342 { BUILT_IN_ASAN_REPORT_STORE1
, BUILT_IN_ASAN_REPORT_STORE2
,
1343 BUILT_IN_ASAN_REPORT_STORE4
, BUILT_IN_ASAN_REPORT_STORE8
,
1344 BUILT_IN_ASAN_REPORT_STORE16
, BUILT_IN_ASAN_REPORT_STORE_N
} };
1345 if (size_in_bytes
== -1)
1348 return builtin_decl_implicit (report
[is_store
][5]);
1351 return builtin_decl_implicit (report
[is_store
][exact_log2 (size_in_bytes
)]);
1354 /* Construct a function tree for __asan_{load,store}{1,2,4,8,16,_n}.
1355 IS_STORE is either 1 (for a store) or 0 (for a load). */
1358 check_func (bool is_store
, int size_in_bytes
, int *nargs
)
1360 static enum built_in_function check
[2][6]
1361 = { { BUILT_IN_ASAN_LOAD1
, BUILT_IN_ASAN_LOAD2
,
1362 BUILT_IN_ASAN_LOAD4
, BUILT_IN_ASAN_LOAD8
,
1363 BUILT_IN_ASAN_LOAD16
, BUILT_IN_ASAN_LOADN
},
1364 { BUILT_IN_ASAN_STORE1
, BUILT_IN_ASAN_STORE2
,
1365 BUILT_IN_ASAN_STORE4
, BUILT_IN_ASAN_STORE8
,
1366 BUILT_IN_ASAN_STORE16
, BUILT_IN_ASAN_STOREN
} };
1367 if (size_in_bytes
== -1)
1370 return builtin_decl_implicit (check
[is_store
][5]);
1373 return builtin_decl_implicit (check
[is_store
][exact_log2 (size_in_bytes
)]);
1376 /* Split the current basic block and create a condition statement
1377 insertion point right before or after the statement pointed to by
1378 ITER. Return an iterator to the point at which the caller might
1379 safely insert the condition statement.
1381 THEN_BLOCK must be set to the address of an uninitialized instance
1382 of basic_block. The function will then set *THEN_BLOCK to the
1383 'then block' of the condition statement to be inserted by the
1386 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1387 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1389 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1390 block' of the condition statement to be inserted by the caller.
1392 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1393 statements starting from *ITER, and *THEN_BLOCK is a new empty
1396 *ITER is adjusted to point to always point to the first statement
1397 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1398 same as what ITER was pointing to prior to calling this function,
1399 if BEFORE_P is true; otherwise, it is its following statement. */
1401 gimple_stmt_iterator
1402 create_cond_insert_point (gimple_stmt_iterator
*iter
,
1404 bool then_more_likely_p
,
1405 bool create_then_fallthru_edge
,
1406 basic_block
*then_block
,
1407 basic_block
*fallthrough_block
)
1409 gimple_stmt_iterator gsi
= *iter
;
1411 if (!gsi_end_p (gsi
) && before_p
)
1414 basic_block cur_bb
= gsi_bb (*iter
);
1416 edge e
= split_block (cur_bb
, gsi_stmt (gsi
));
1418 /* Get a hold on the 'condition block', the 'then block' and the
1420 basic_block cond_bb
= e
->src
;
1421 basic_block fallthru_bb
= e
->dest
;
1422 basic_block then_bb
= create_empty_bb (cond_bb
);
1425 add_bb_to_loop (then_bb
, cond_bb
->loop_father
);
1426 loops_state_set (LOOPS_NEED_FIXUP
);
1429 /* Set up the newly created 'then block'. */
1430 e
= make_edge (cond_bb
, then_bb
, EDGE_TRUE_VALUE
);
1431 int fallthrough_probability
1432 = then_more_likely_p
1433 ? PROB_VERY_UNLIKELY
1434 : PROB_ALWAYS
- PROB_VERY_UNLIKELY
;
1435 e
->probability
= PROB_ALWAYS
- fallthrough_probability
;
1436 if (create_then_fallthru_edge
)
1437 make_single_succ_edge (then_bb
, fallthru_bb
, EDGE_FALLTHRU
);
1439 /* Set up the fallthrough basic block. */
1440 e
= find_edge (cond_bb
, fallthru_bb
);
1441 e
->flags
= EDGE_FALSE_VALUE
;
1442 e
->count
= cond_bb
->count
;
1443 e
->probability
= fallthrough_probability
;
1445 /* Update dominance info for the newly created then_bb; note that
1446 fallthru_bb's dominance info has already been updated by
1448 if (dom_info_available_p (CDI_DOMINATORS
))
1449 set_immediate_dominator (CDI_DOMINATORS
, then_bb
, cond_bb
);
1451 *then_block
= then_bb
;
1452 *fallthrough_block
= fallthru_bb
;
1453 *iter
= gsi_start_bb (fallthru_bb
);
1455 return gsi_last_bb (cond_bb
);
1458 /* Insert an if condition followed by a 'then block' right before the
1459 statement pointed to by ITER. The fallthrough block -- which is the
1460 else block of the condition as well as the destination of the
1461 outcoming edge of the 'then block' -- starts with the statement
1464 COND is the condition of the if.
1466 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1467 'then block' is higher than the probability of the edge to the
1470 Upon completion of the function, *THEN_BB is set to the newly
1471 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1474 *ITER is adjusted to still point to the same statement it was
1475 pointing to initially. */
1478 insert_if_then_before_iter (gimple cond
,
1479 gimple_stmt_iterator
*iter
,
1480 bool then_more_likely_p
,
1481 basic_block
*then_bb
,
1482 basic_block
*fallthrough_bb
)
1484 gimple_stmt_iterator cond_insert_point
=
1485 create_cond_insert_point (iter
,
1488 /*create_then_fallthru_edge=*/true,
1491 gsi_insert_after (&cond_insert_point
, cond
, GSI_NEW_STMT
);
1495 (base_addr >> ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset (). */
1498 build_shadow_mem_access (gimple_stmt_iterator
*gsi
, location_t location
,
1499 tree base_addr
, tree shadow_ptr_type
)
1501 tree t
, uintptr_type
= TREE_TYPE (base_addr
);
1502 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
1505 t
= build_int_cst (uintptr_type
, ASAN_SHADOW_SHIFT
);
1506 g
= gimple_build_assign_with_ops (RSHIFT_EXPR
,
1507 make_ssa_name (uintptr_type
, NULL
),
1509 gimple_set_location (g
, location
);
1510 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1512 t
= build_int_cst (uintptr_type
, targetm
.asan_shadow_offset ());
1513 g
= gimple_build_assign_with_ops (PLUS_EXPR
,
1514 make_ssa_name (uintptr_type
, NULL
),
1515 gimple_assign_lhs (g
), t
);
1516 gimple_set_location (g
, location
);
1517 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1519 g
= gimple_build_assign_with_ops (NOP_EXPR
,
1520 make_ssa_name (shadow_ptr_type
, NULL
),
1521 gimple_assign_lhs (g
), NULL_TREE
);
1522 gimple_set_location (g
, location
);
1523 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1525 t
= build2 (MEM_REF
, shadow_type
, gimple_assign_lhs (g
),
1526 build_int_cst (shadow_ptr_type
, 0));
1527 g
= gimple_build_assign_with_ops (MEM_REF
,
1528 make_ssa_name (shadow_type
, NULL
),
1530 gimple_set_location (g
, location
);
1531 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
1532 return gimple_assign_lhs (g
);
1535 /* BASE can already be an SSA_NAME; in that case, do not create a
1536 new SSA_NAME for it. */
1539 maybe_create_ssa_name (location_t loc
, tree base
, gimple_stmt_iterator
*iter
,
1542 if (TREE_CODE (base
) == SSA_NAME
)
1545 = gimple_build_assign_with_ops (TREE_CODE (base
),
1546 make_ssa_name (TREE_TYPE (base
), NULL
),
1548 gimple_set_location (g
, loc
);
1550 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1552 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
1553 return gimple_assign_lhs (g
);
1556 /* Instrument the memory access instruction BASE. Insert new
1557 statements before or after ITER.
1559 Note that the memory access represented by BASE can be either an
1560 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1561 location. IS_STORE is TRUE for a store, FALSE for a load.
1562 BEFORE_P is TRUE for inserting the instrumentation code before
1563 ITER, FALSE for inserting it after ITER. IS_SCALAR_ACCESS is TRUE
1564 for a scalar memory access and FALSE for memory region access.
1565 NON_ZERO_P is TRUE if memory region is guaranteed to have non-zero
1566 length. ALIGN tells alignment of accessed memory object.
1568 START_INSTRUMENTED and END_INSTRUMENTED are TRUE if start/end of
1569 memory region have already been instrumented.
1571 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1572 statement it was pointing to prior to calling this function,
1573 otherwise, it points to the statement logically following it. */
1576 build_check_stmt (location_t loc
, tree base
, tree len
,
1577 HOST_WIDE_INT size_in_bytes
, gimple_stmt_iterator
*iter
,
1578 bool is_non_zero_len
, bool before_p
, bool is_store
,
1579 bool is_scalar_access
, unsigned int align
= 0,
1580 bool start_instrumented
= false,
1581 bool end_instrumented
= false)
1583 gimple_stmt_iterator gsi
= *iter
;
1586 gcc_assert (!(size_in_bytes
> 0 && !is_non_zero_len
));
1588 if (start_instrumented
&& end_instrumented
)
1597 base
= unshare_expr (base
);
1598 base
= maybe_create_ssa_name (loc
, base
, &gsi
, before_p
);
1601 len
= unshare_expr (len
);
1604 gcc_assert (size_in_bytes
!= -1);
1605 len
= build_int_cst (pointer_sized_int_node
, size_in_bytes
);
1608 if (size_in_bytes
> 1)
1610 if ((size_in_bytes
& (size_in_bytes
- 1)) != 0
1611 || size_in_bytes
> 16)
1612 is_scalar_access
= false;
1613 else if (align
&& align
< size_in_bytes
* BITS_PER_UNIT
)
1615 /* On non-strict alignment targets, if
1616 16-byte access is just 8-byte aligned,
1617 this will result in misaligned shadow
1618 memory 2 byte load, but otherwise can
1619 be handled using one read. */
1620 if (size_in_bytes
!= 16
1622 || align
< 8 * BITS_PER_UNIT
)
1623 is_scalar_access
= false;
1627 HOST_WIDE_INT flags
= 0;
1629 flags
|= ASAN_CHECK_STORE
;
1630 if (is_non_zero_len
)
1631 flags
|= ASAN_CHECK_NON_ZERO_LEN
;
1632 if (is_scalar_access
)
1633 flags
|= ASAN_CHECK_SCALAR_ACCESS
;
1634 if (start_instrumented
)
1635 flags
|= ASAN_CHECK_START_INSTRUMENTED
;
1636 if (end_instrumented
)
1637 flags
|= ASAN_CHECK_END_INSTRUMENTED
;
1639 g
= gimple_build_call_internal (IFN_ASAN_CHECK
, 3,
1640 build_int_cst (integer_type_node
, flags
),
1642 gimple_set_location (g
, loc
);
1644 gsi_insert_before (&gsi
, g
, GSI_SAME_STMT
);
1647 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1653 /* If T represents a memory access, add instrumentation code before ITER.
1654 LOCATION is source code location.
1655 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
1658 instrument_derefs (gimple_stmt_iterator
*iter
, tree t
,
1659 location_t location
, bool is_store
)
1661 if (is_store
&& !ASAN_INSTRUMENT_WRITES
)
1663 if (!is_store
&& !ASAN_INSTRUMENT_READS
)
1667 HOST_WIDE_INT size_in_bytes
;
1669 type
= TREE_TYPE (t
);
1670 switch (TREE_CODE (t
))
1683 size_in_bytes
= int_size_in_bytes (type
);
1684 if (size_in_bytes
<= 0)
1687 HOST_WIDE_INT bitsize
, bitpos
;
1689 enum machine_mode mode
;
1690 int volatilep
= 0, unsignedp
= 0;
1691 tree inner
= get_inner_reference (t
, &bitsize
, &bitpos
, &offset
,
1692 &mode
, &unsignedp
, &volatilep
, false);
1694 if (TREE_CODE (t
) == COMPONENT_REF
1695 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1)) != NULL_TREE
)
1697 tree repr
= DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1));
1698 instrument_derefs (iter
, build3 (COMPONENT_REF
, TREE_TYPE (repr
),
1699 TREE_OPERAND (t
, 0), repr
,
1700 NULL_TREE
), location
, is_store
);
1704 if (bitpos
% BITS_PER_UNIT
1705 || bitsize
!= size_in_bytes
* BITS_PER_UNIT
)
1708 if (TREE_CODE (inner
) == VAR_DECL
1709 && offset
== NULL_TREE
1711 && DECL_SIZE (inner
)
1712 && tree_fits_shwi_p (DECL_SIZE (inner
))
1713 && bitpos
+ bitsize
<= tree_to_shwi (DECL_SIZE (inner
)))
1715 if (DECL_THREAD_LOCAL_P (inner
))
1717 if (!TREE_STATIC (inner
))
1719 /* Automatic vars in the current function will be always
1721 if (decl_function_context (inner
) == current_function_decl
)
1724 /* Always instrument external vars, they might be dynamically
1726 else if (!DECL_EXTERNAL (inner
))
1728 /* For static vars if they are known not to be dynamically
1729 initialized, they will be always accessible. */
1730 varpool_node
*vnode
= varpool_node::get (inner
);
1731 if (vnode
&& !vnode
->dynamically_initialized
)
1736 base
= build_fold_addr_expr (t
);
1737 if (!has_mem_ref_been_instrumented (base
, size_in_bytes
))
1739 unsigned int align
= get_object_alignment (t
);
1740 build_check_stmt (location
, base
, NULL_TREE
, size_in_bytes
, iter
,
1741 /*is_non_zero_len*/size_in_bytes
> 0, /*before_p=*/true,
1742 is_store
, /*is_scalar_access*/true, align
);
1743 update_mem_ref_hash_table (base
, size_in_bytes
);
1744 update_mem_ref_hash_table (t
, size_in_bytes
);
1749 /* Instrument an access to a contiguous memory region that starts at
1750 the address pointed to by BASE, over a length of LEN (expressed in
1751 the sizeof (*BASE) bytes). ITER points to the instruction before
1752 which the instrumentation instructions must be inserted. LOCATION
1753 is the source location that the instrumentation instructions must
1754 have. If IS_STORE is true, then the memory access is a store;
1755 otherwise, it's a load. */
1758 instrument_mem_region_access (tree base
, tree len
,
1759 gimple_stmt_iterator
*iter
,
1760 location_t location
, bool is_store
)
1762 if (!POINTER_TYPE_P (TREE_TYPE (base
))
1763 || !INTEGRAL_TYPE_P (TREE_TYPE (len
))
1764 || integer_zerop (len
))
1767 /* If the beginning of the memory region has already been
1768 instrumented, do not instrument it. */
1769 bool start_instrumented
= has_mem_ref_been_instrumented (base
, 1);
1771 /* If the end of the memory region has already been instrumented, do
1772 not instrument it. */
1773 tree end
= asan_mem_ref_get_end (base
, len
);
1774 bool end_instrumented
= has_mem_ref_been_instrumented (end
, 1);
1776 HOST_WIDE_INT size_in_bytes
= tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
1778 build_check_stmt (location
, base
, len
, size_in_bytes
, iter
,
1779 /*is_non_zero_len*/size_in_bytes
> 0, /*before_p*/true,
1780 is_store
, /*is_scalar_access*/false, /*align*/0,
1781 start_instrumented
, end_instrumented
);
1783 update_mem_ref_hash_table (base
, 1);
1784 if (size_in_bytes
!= -1)
1785 update_mem_ref_hash_table (end
, 1);
1787 *iter
= gsi_for_stmt (gsi_stmt (*iter
));
1790 /* Instrument the call (to the builtin strlen function) pointed to by
1793 This function instruments the access to the first byte of the
1794 argument, right before the call. After the call it instruments the
1795 access to the last byte of the argument; it uses the result of the
1796 call to deduce the offset of that last byte.
1798 Upon completion, iff the call has actually been instrumented, this
1799 function returns TRUE and *ITER points to the statement logically
1800 following the built-in strlen function call *ITER was initially
1801 pointing to. Otherwise, the function returns FALSE and *ITER
1802 remains unchanged. */
1805 instrument_strlen_call (gimple_stmt_iterator
*iter
)
1807 gimple call
= gsi_stmt (*iter
);
1808 gcc_assert (is_gimple_call (call
));
1810 tree callee
= gimple_call_fndecl (call
);
1811 gcc_assert (is_builtin_fn (callee
)
1812 && DECL_BUILT_IN_CLASS (callee
) == BUILT_IN_NORMAL
1813 && DECL_FUNCTION_CODE (callee
) == BUILT_IN_STRLEN
);
1815 tree len
= gimple_call_lhs (call
);
1817 /* Some passes might clear the return value of the strlen call;
1818 bail out in that case. Return FALSE as we are not advancing
1821 gcc_assert (INTEGRAL_TYPE_P (TREE_TYPE (len
)));
1823 location_t loc
= gimple_location (call
);
1824 tree str_arg
= gimple_call_arg (call
, 0);
1825 bool start_instrumented
= has_mem_ref_been_instrumented (str_arg
, 1);
1827 tree cptr_type
= build_pointer_type (char_type_node
);
1828 gimple str_arg_ssa
=
1829 gimple_build_assign_with_ops (NOP_EXPR
,
1830 make_ssa_name (cptr_type
, NULL
),
1832 gimple_set_location (str_arg_ssa
, loc
);
1833 gsi_insert_before (iter
, str_arg_ssa
, GSI_SAME_STMT
);
1835 build_check_stmt (loc
, gimple_assign_lhs (str_arg_ssa
), NULL_TREE
, 1, iter
,
1836 /*is_non_zero_len*/true, /*before_p=*/true,
1837 /*is_store=*/false, /*is_scalar_access*/true, /*align*/0,
1838 start_instrumented
, start_instrumented
);
1841 gimple_build_assign_with_ops (POINTER_PLUS_EXPR
,
1842 make_ssa_name (cptr_type
, NULL
),
1843 gimple_assign_lhs (str_arg_ssa
),
1845 gimple_set_location (g
, loc
);
1846 gsi_insert_after (iter
, g
, GSI_NEW_STMT
);
1848 build_check_stmt (loc
, gimple_assign_lhs (g
), NULL_TREE
, 1, iter
,
1849 /*is_non_zero_len*/true, /*before_p=*/false,
1850 /*is_store=*/false, /*is_scalar_access*/true, /*align*/0);
1855 /* Instrument the call to a built-in memory access function that is
1856 pointed to by the iterator ITER.
1858 Upon completion, return TRUE iff *ITER has been advanced to the
1859 statement following the one it was originally pointing to. */
1862 instrument_builtin_call (gimple_stmt_iterator
*iter
)
1864 if (!ASAN_MEMINTRIN
)
1867 bool iter_advanced_p
= false;
1868 gimple call
= gsi_stmt (*iter
);
1870 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
1872 tree callee
= gimple_call_fndecl (call
);
1873 location_t loc
= gimple_location (call
);
1875 if (DECL_FUNCTION_CODE (callee
) == BUILT_IN_STRLEN
)
1876 iter_advanced_p
= instrument_strlen_call (iter
);
1879 asan_mem_ref src0
, src1
, dest
;
1880 asan_mem_ref_init (&src0
, NULL
, 1);
1881 asan_mem_ref_init (&src1
, NULL
, 1);
1882 asan_mem_ref_init (&dest
, NULL
, 1);
1884 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
1885 bool src0_is_store
= false, src1_is_store
= false,
1886 dest_is_store
= false, dest_is_deref
= false;
1888 if (get_mem_refs_of_builtin_call (call
,
1889 &src0
, &src0_len
, &src0_is_store
,
1890 &src1
, &src1_len
, &src1_is_store
,
1891 &dest
, &dest_len
, &dest_is_store
,
1896 instrument_derefs (iter
, dest
.start
, loc
, dest_is_store
);
1898 iter_advanced_p
= true;
1900 else if (src0_len
|| src1_len
|| dest_len
)
1902 if (src0
.start
!= NULL_TREE
)
1903 instrument_mem_region_access (src0
.start
, src0_len
,
1904 iter
, loc
, /*is_store=*/false);
1905 if (src1
.start
!= NULL_TREE
)
1906 instrument_mem_region_access (src1
.start
, src1_len
,
1907 iter
, loc
, /*is_store=*/false);
1908 if (dest
.start
!= NULL_TREE
)
1909 instrument_mem_region_access (dest
.start
, dest_len
,
1910 iter
, loc
, /*is_store=*/true);
1911 *iter
= gsi_for_stmt (call
);
1913 iter_advanced_p
= true;
1917 return iter_advanced_p
;
1920 /* Instrument the assignment statement ITER if it is subject to
1921 instrumentation. Return TRUE iff instrumentation actually
1922 happened. In that case, the iterator ITER is advanced to the next
1923 logical expression following the one initially pointed to by ITER,
1924 and the relevant memory reference that which access has been
1925 instrumented is added to the memory references hash table. */
1928 maybe_instrument_assignment (gimple_stmt_iterator
*iter
)
1930 gimple s
= gsi_stmt (*iter
);
1932 gcc_assert (gimple_assign_single_p (s
));
1934 tree ref_expr
= NULL_TREE
;
1935 bool is_store
, is_instrumented
= false;
1937 if (gimple_store_p (s
))
1939 ref_expr
= gimple_assign_lhs (s
);
1941 instrument_derefs (iter
, ref_expr
,
1942 gimple_location (s
),
1944 is_instrumented
= true;
1947 if (gimple_assign_load_p (s
))
1949 ref_expr
= gimple_assign_rhs1 (s
);
1951 instrument_derefs (iter
, ref_expr
,
1952 gimple_location (s
),
1954 is_instrumented
= true;
1957 if (is_instrumented
)
1960 return is_instrumented
;
1963 /* Instrument the function call pointed to by the iterator ITER, if it
1964 is subject to instrumentation. At the moment, the only function
1965 calls that are instrumented are some built-in functions that access
1966 memory. Look at instrument_builtin_call to learn more.
1968 Upon completion return TRUE iff *ITER was advanced to the statement
1969 following the one it was originally pointing to. */
1972 maybe_instrument_call (gimple_stmt_iterator
*iter
)
1974 gimple stmt
= gsi_stmt (*iter
);
1975 bool is_builtin
= gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
);
1977 if (is_builtin
&& instrument_builtin_call (iter
))
1980 if (gimple_call_noreturn_p (stmt
))
1984 tree callee
= gimple_call_fndecl (stmt
);
1985 switch (DECL_FUNCTION_CODE (callee
))
1987 case BUILT_IN_UNREACHABLE
:
1989 /* Don't instrument these. */
1993 tree decl
= builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN
);
1994 gimple g
= gimple_build_call (decl
, 0);
1995 gimple_set_location (g
, gimple_location (stmt
));
1996 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2001 /* Walk each instruction of all basic block and instrument those that
2002 represent memory references: loads, stores, or function calls.
2003 In a given basic block, this function avoids instrumenting memory
2004 references that have already been instrumented. */
2007 transform_statements (void)
2009 basic_block bb
, last_bb
= NULL
;
2010 gimple_stmt_iterator i
;
2011 int saved_last_basic_block
= last_basic_block_for_fn (cfun
);
2013 FOR_EACH_BB_FN (bb
, cfun
)
2015 basic_block prev_bb
= bb
;
2017 if (bb
->index
>= saved_last_basic_block
) continue;
2019 /* Flush the mem ref hash table, if current bb doesn't have
2020 exactly one predecessor, or if that predecessor (skipping
2021 over asan created basic blocks) isn't the last processed
2022 basic block. Thus we effectively flush on extended basic
2023 block boundaries. */
2024 while (single_pred_p (prev_bb
))
2026 prev_bb
= single_pred (prev_bb
);
2027 if (prev_bb
->index
< saved_last_basic_block
)
2030 if (prev_bb
!= last_bb
)
2031 empty_mem_ref_hash_table ();
2034 for (i
= gsi_start_bb (bb
); !gsi_end_p (i
);)
2036 gimple s
= gsi_stmt (i
);
2038 if (has_stmt_been_instrumented_p (s
))
2040 else if (gimple_assign_single_p (s
)
2041 && maybe_instrument_assignment (&i
))
2042 /* Nothing to do as maybe_instrument_assignment advanced
2044 else if (is_gimple_call (s
) && maybe_instrument_call (&i
))
2045 /* Nothing to do as maybe_instrument_call
2046 advanced the iterator I. */;
2049 /* No instrumentation happened.
2051 If the current instruction is a function call that
2052 might free something, let's forget about the memory
2053 references that got instrumented. Otherwise we might
2054 miss some instrumentation opportunities. */
2055 if (is_gimple_call (s
) && !nonfreeing_call_p (s
))
2056 empty_mem_ref_hash_table ();
2062 free_mem_ref_resources ();
2066 __asan_before_dynamic_init (module_name)
2068 __asan_after_dynamic_init ()
2072 asan_dynamic_init_call (bool after_p
)
2074 tree fn
= builtin_decl_implicit (after_p
2075 ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
2076 : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT
);
2077 tree module_name_cst
= NULL_TREE
;
2080 pretty_printer module_name_pp
;
2081 pp_string (&module_name_pp
, main_input_filename
);
2083 if (shadow_ptr_types
[0] == NULL_TREE
)
2084 asan_init_shadow_ptr_types ();
2085 module_name_cst
= asan_pp_string (&module_name_pp
);
2086 module_name_cst
= fold_convert (const_ptr_type_node
,
2090 return build_call_expr (fn
, after_p
? 0 : 1, module_name_cst
);
2094 struct __asan_global
2098 uptr __size_with_redzone;
2100 const void *__module_name;
2101 uptr __has_dynamic_init;
2105 asan_global_struct (void)
2107 static const char *field_names
[6]
2108 = { "__beg", "__size", "__size_with_redzone",
2109 "__name", "__module_name", "__has_dynamic_init" };
2110 tree fields
[6], ret
;
2113 ret
= make_node (RECORD_TYPE
);
2114 for (i
= 0; i
< 6; i
++)
2117 = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
,
2118 get_identifier (field_names
[i
]),
2119 (i
== 0 || i
== 3) ? const_ptr_type_node
2120 : pointer_sized_int_node
);
2121 DECL_CONTEXT (fields
[i
]) = ret
;
2123 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
2125 TYPE_FIELDS (ret
) = fields
[0];
2126 TYPE_NAME (ret
) = get_identifier ("__asan_global");
2131 /* Append description of a single global DECL into vector V.
2132 TYPE is __asan_global struct type as returned by asan_global_struct. */
2135 asan_add_global (tree decl
, tree type
, vec
<constructor_elt
, va_gc
> *v
)
2137 tree init
, uptr
= TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type
)));
2138 unsigned HOST_WIDE_INT size
;
2139 tree str_cst
, module_name_cst
, refdecl
= decl
;
2140 vec
<constructor_elt
, va_gc
> *vinner
= NULL
;
2142 pretty_printer asan_pp
, module_name_pp
;
2144 if (DECL_NAME (decl
))
2145 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
2147 pp_string (&asan_pp
, "<unknown>");
2148 str_cst
= asan_pp_string (&asan_pp
);
2150 pp_string (&module_name_pp
, main_input_filename
);
2151 module_name_cst
= asan_pp_string (&module_name_pp
);
2153 if (asan_needs_local_alias (decl
))
2156 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", vec_safe_length (v
) + 1);
2157 refdecl
= build_decl (DECL_SOURCE_LOCATION (decl
),
2158 VAR_DECL
, get_identifier (buf
), TREE_TYPE (decl
));
2159 TREE_ADDRESSABLE (refdecl
) = TREE_ADDRESSABLE (decl
);
2160 TREE_READONLY (refdecl
) = TREE_READONLY (decl
);
2161 TREE_THIS_VOLATILE (refdecl
) = TREE_THIS_VOLATILE (decl
);
2162 DECL_GIMPLE_REG_P (refdecl
) = DECL_GIMPLE_REG_P (decl
);
2163 DECL_ARTIFICIAL (refdecl
) = DECL_ARTIFICIAL (decl
);
2164 DECL_IGNORED_P (refdecl
) = DECL_IGNORED_P (decl
);
2165 TREE_STATIC (refdecl
) = 1;
2166 TREE_PUBLIC (refdecl
) = 0;
2167 TREE_USED (refdecl
) = 1;
2168 assemble_alias (refdecl
, DECL_ASSEMBLER_NAME (decl
));
2171 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2172 fold_convert (const_ptr_type_node
,
2173 build_fold_addr_expr (refdecl
)));
2174 size
= tree_to_uhwi (DECL_SIZE_UNIT (decl
));
2175 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2176 size
+= asan_red_zone_size (size
);
2177 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2178 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2179 fold_convert (const_ptr_type_node
, str_cst
));
2180 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2181 fold_convert (const_ptr_type_node
, module_name_cst
));
2182 varpool_node
*vnode
= varpool_node::get (decl
);
2183 int has_dynamic_init
= vnode
? vnode
->dynamically_initialized
: 0;
2184 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2185 build_int_cst (uptr
, has_dynamic_init
));
2186 init
= build_constructor (type
, vinner
);
2187 CONSTRUCTOR_APPEND_ELT (v
, NULL_TREE
, init
);
2190 /* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2192 initialize_sanitizer_builtins (void)
2196 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT
))
2199 tree BT_FN_VOID
= build_function_type_list (void_type_node
, NULL_TREE
);
2201 = build_function_type_list (void_type_node
, ptr_type_node
, NULL_TREE
);
2202 tree BT_FN_VOID_CONST_PTR
2203 = build_function_type_list (void_type_node
, const_ptr_type_node
, NULL_TREE
);
2204 tree BT_FN_VOID_PTR_PTR
2205 = build_function_type_list (void_type_node
, ptr_type_node
,
2206 ptr_type_node
, NULL_TREE
);
2207 tree BT_FN_VOID_PTR_PTR_PTR
2208 = build_function_type_list (void_type_node
, ptr_type_node
,
2209 ptr_type_node
, ptr_type_node
, NULL_TREE
);
2210 tree BT_FN_VOID_PTR_PTRMODE
2211 = build_function_type_list (void_type_node
, ptr_type_node
,
2212 pointer_sized_int_node
, NULL_TREE
);
2214 = build_function_type_list (void_type_node
, integer_type_node
, NULL_TREE
);
2215 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[5];
2216 tree BT_FN_IX_CONST_VPTR_INT
[5];
2217 tree BT_FN_IX_VPTR_IX_INT
[5];
2218 tree BT_FN_VOID_VPTR_IX_INT
[5];
2220 = build_pointer_type (build_qualified_type (void_type_node
,
2221 TYPE_QUAL_VOLATILE
));
2223 = build_pointer_type (build_qualified_type (void_type_node
,
2227 = lang_hooks
.types
.type_for_size (BOOL_TYPE_SIZE
, 1);
2229 for (i
= 0; i
< 5; i
++)
2231 tree ix
= build_nonstandard_integer_type (BITS_PER_UNIT
* (1 << i
), 1);
2232 BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[i
]
2233 = build_function_type_list (boolt
, vptr
, ptr_type_node
, ix
,
2234 integer_type_node
, integer_type_node
,
2236 BT_FN_IX_CONST_VPTR_INT
[i
]
2237 = build_function_type_list (ix
, cvptr
, integer_type_node
, NULL_TREE
);
2238 BT_FN_IX_VPTR_IX_INT
[i
]
2239 = build_function_type_list (ix
, vptr
, ix
, integer_type_node
,
2241 BT_FN_VOID_VPTR_IX_INT
[i
]
2242 = build_function_type_list (void_type_node
, vptr
, ix
,
2243 integer_type_node
, NULL_TREE
);
2245 #define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2246 #define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2247 #define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2248 #define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2249 #define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2250 #define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2251 #define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2252 #define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2253 #define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2254 #define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2255 #define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2256 #define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2257 #define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2258 #define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2259 #define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2260 #define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2261 #define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2262 #define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2263 #define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2264 #define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2265 #undef ATTR_NOTHROW_LEAF_LIST
2266 #define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2267 #undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2268 #define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2269 #undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2270 #define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2271 #undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2272 #define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2273 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2274 #undef ATTR_COLD_NOTHROW_LEAF_LIST
2275 #define ATTR_COLD_NOTHROW_LEAF_LIST \
2276 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2277 #undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2278 #define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2279 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2280 #undef DEF_SANITIZER_BUILTIN
2281 #define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2282 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2283 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2284 set_call_expr_flags (decl, ATTRS); \
2285 set_builtin_decl (ENUM, decl, true);
2287 #include "sanitizer.def"
2289 #undef DEF_SANITIZER_BUILTIN
2292 /* Called via htab_traverse. Count number of emitted
2293 STRING_CSTs in the constant hash table. */
2296 count_string_csts (void **slot
, void *data
)
2298 struct constant_descriptor_tree
*desc
2299 = (struct constant_descriptor_tree
*) *slot
;
2300 if (TREE_CODE (desc
->value
) == STRING_CST
2301 && TREE_ASM_WRITTEN (desc
->value
)
2302 && asan_protect_global (desc
->value
))
2303 ++*((unsigned HOST_WIDE_INT
*) data
);
2307 /* Helper structure to pass two parameters to
2310 struct asan_add_string_csts_data
2313 vec
<constructor_elt
, va_gc
> *v
;
2316 /* Called via htab_traverse. Call asan_add_global
2317 on emitted STRING_CSTs from the constant hash table. */
2320 add_string_csts (void **slot
, void *data
)
2322 struct constant_descriptor_tree
*desc
2323 = (struct constant_descriptor_tree
*) *slot
;
2324 if (TREE_CODE (desc
->value
) == STRING_CST
2325 && TREE_ASM_WRITTEN (desc
->value
)
2326 && asan_protect_global (desc
->value
))
2328 struct asan_add_string_csts_data
*aascd
2329 = (struct asan_add_string_csts_data
*) data
;
2330 asan_add_global (SYMBOL_REF_DECL (XEXP (desc
->rtl
, 0)),
2331 aascd
->type
, aascd
->v
);
2336 /* Needs to be GTY(()), because cgraph_build_static_cdtor may
2337 invoke ggc_collect. */
2338 static GTY(()) tree asan_ctor_statements
;
2340 /* Module-level instrumentation.
2341 - Insert __asan_init_vN() into the list of CTORs.
2342 - TODO: insert redzones around globals.
2346 asan_finish_file (void)
2348 varpool_node
*vnode
;
2349 unsigned HOST_WIDE_INT gcount
= 0;
2351 if (shadow_ptr_types
[0] == NULL_TREE
)
2352 asan_init_shadow_ptr_types ();
2353 /* Avoid instrumenting code in the asan ctors/dtors.
2354 We don't need to insert padding after the description strings,
2355 nor after .LASAN* array. */
2356 flag_sanitize
&= ~SANITIZE_ADDRESS
;
2358 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_INIT
);
2359 append_to_statement_list (build_call_expr (fn
, 0), &asan_ctor_statements
);
2360 FOR_EACH_DEFINED_VARIABLE (vnode
)
2361 if (TREE_ASM_WRITTEN (vnode
->decl
)
2362 && asan_protect_global (vnode
->decl
))
2364 htab_t const_desc_htab
= constant_pool_htab ();
2365 htab_traverse (const_desc_htab
, count_string_csts
, &gcount
);
2368 tree type
= asan_global_struct (), var
, ctor
;
2369 tree dtor_statements
= NULL_TREE
;
2370 vec
<constructor_elt
, va_gc
> *v
;
2373 type
= build_array_type_nelts (type
, gcount
);
2374 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", 0);
2375 var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (buf
),
2377 TREE_STATIC (var
) = 1;
2378 TREE_PUBLIC (var
) = 0;
2379 DECL_ARTIFICIAL (var
) = 1;
2380 DECL_IGNORED_P (var
) = 1;
2381 vec_alloc (v
, gcount
);
2382 FOR_EACH_DEFINED_VARIABLE (vnode
)
2383 if (TREE_ASM_WRITTEN (vnode
->decl
)
2384 && asan_protect_global (vnode
->decl
))
2385 asan_add_global (vnode
->decl
, TREE_TYPE (type
), v
);
2386 struct asan_add_string_csts_data aascd
;
2387 aascd
.type
= TREE_TYPE (type
);
2389 htab_traverse (const_desc_htab
, add_string_csts
, &aascd
);
2390 ctor
= build_constructor (type
, v
);
2391 TREE_CONSTANT (ctor
) = 1;
2392 TREE_STATIC (ctor
) = 1;
2393 DECL_INITIAL (var
) = ctor
;
2394 varpool_node::finalize_decl (var
);
2396 fn
= builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS
);
2397 tree gcount_tree
= build_int_cst (pointer_sized_int_node
, gcount
);
2398 append_to_statement_list (build_call_expr (fn
, 2,
2399 build_fold_addr_expr (var
),
2401 &asan_ctor_statements
);
2403 fn
= builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS
);
2404 append_to_statement_list (build_call_expr (fn
, 2,
2405 build_fold_addr_expr (var
),
2408 cgraph_build_static_cdtor ('D', dtor_statements
,
2409 MAX_RESERVED_INIT_PRIORITY
- 1);
2411 cgraph_build_static_cdtor ('I', asan_ctor_statements
,
2412 MAX_RESERVED_INIT_PRIORITY
- 1);
2413 flag_sanitize
|= SANITIZE_ADDRESS
;
2416 /* Expand the ASAN_{LOAD,STORE} builtins. */
2419 asan_expand_check_ifn (gimple_stmt_iterator
*iter
, bool use_calls
)
2421 gimple g
= gsi_stmt (*iter
);
2422 location_t loc
= gimple_location (g
);
2424 HOST_WIDE_INT flags
= tree_to_shwi (gimple_call_arg (g
, 0));
2425 gcc_assert (flags
< ASAN_CHECK_LAST
);
2426 bool is_scalar_access
= (flags
& ASAN_CHECK_SCALAR_ACCESS
) != 0;
2427 bool is_store
= (flags
& ASAN_CHECK_STORE
) != 0;
2428 bool is_non_zero_len
= (flags
& ASAN_CHECK_NON_ZERO_LEN
) != 0;
2429 bool start_instrumented
= (flags
& ASAN_CHECK_START_INSTRUMENTED
) != 0;
2430 bool end_instrumented
= (flags
& ASAN_CHECK_END_INSTRUMENTED
) != 0;
2432 tree base
= gimple_call_arg (g
, 1);
2433 tree len
= gimple_call_arg (g
, 2);
2435 HOST_WIDE_INT size_in_bytes
2436 = is_scalar_access
&& tree_fits_shwi_p (len
) ? tree_to_shwi (len
) : -1;
2440 /* Instrument using callbacks. */
2442 = gimple_build_assign_with_ops (NOP_EXPR
,
2443 make_ssa_name (pointer_sized_int_node
,
2446 gimple_set_location (g
, loc
);
2447 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2448 tree base_addr
= gimple_assign_lhs (g
);
2451 tree fun
= check_func (is_store
, size_in_bytes
, &nargs
);
2453 g
= gimple_build_call (fun
, 1, base_addr
);
2456 gcc_assert (nargs
== 2);
2457 g
= gimple_build_assign_with_ops (NOP_EXPR
,
2458 make_ssa_name (pointer_sized_int_node
,
2461 gimple_set_location (g
, loc
);
2462 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
2463 tree sz_arg
= gimple_assign_lhs (g
);
2464 g
= gimple_build_call (fun
, nargs
, base_addr
, sz_arg
);
2466 gimple_set_location (g
, loc
);
2467 gsi_replace (iter
, g
, false);
2471 HOST_WIDE_INT real_size_in_bytes
= size_in_bytes
== -1 ? 1 : size_in_bytes
;
2474 = build_nonstandard_integer_type (TYPE_PRECISION (TREE_TYPE (base
)), 1);
2476 tree shadow_ptr_type
= shadow_ptr_types
[real_size_in_bytes
== 16 ? 1 : 0];
2477 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
2479 gimple_stmt_iterator gsi
= *iter
;
2481 if (!is_non_zero_len
)
2483 /* So, the length of the memory area to asan-protect is
2484 non-constant. Let's guard the generated instrumentation code
2489 //asan instrumentation code goes here.
2491 // falltrough instructions, starting with *ITER. */
2493 g
= gimple_build_cond (NE_EXPR
,
2495 build_int_cst (TREE_TYPE (len
), 0),
2496 NULL_TREE
, NULL_TREE
);
2497 gimple_set_location (g
, loc
);
2499 basic_block then_bb
, fallthrough_bb
;
2500 insert_if_then_before_iter (g
, iter
, /*then_more_likely_p=*/true,
2501 &then_bb
, &fallthrough_bb
);
2502 /* Note that fallthrough_bb starts with the statement that was
2503 pointed to by ITER. */
2505 /* The 'then block' of the 'if (len != 0) condition is where
2506 we'll generate the asan instrumentation code now. */
2507 gsi
= gsi_last_bb (then_bb
);
2510 /* Get an iterator on the point where we can add the condition
2511 statement for the instrumentation. */
2512 basic_block then_bb
, else_bb
;
2513 gsi
= create_cond_insert_point (&gsi
, /*before_p*/false,
2514 /*then_more_likely_p=*/false,
2515 /*create_then_fallthru_edge=*/false,
2519 g
= gimple_build_assign_with_ops (NOP_EXPR
,
2520 make_ssa_name (pointer_sized_int_node
,
2523 gimple_set_location (g
, loc
);
2524 gsi_insert_before (&gsi
, g
, GSI_NEW_STMT
);
2525 tree base_addr
= gimple_assign_lhs (g
);
2528 if (real_size_in_bytes
>= 8)
2530 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_addr
,
2536 /* Slow path for 1, 2 and 4 byte accesses. */
2538 if (!start_instrumented
)
2540 /* Test (shadow != 0)
2541 & ((base_addr & 7) + (real_size_in_bytes - 1)) >= shadow). */
2542 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_addr
,
2544 gimple shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
2545 gimple_seq seq
= NULL
;
2546 gimple_seq_add_stmt (&seq
, shadow_test
);
2547 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, base_addr
, 7));
2548 gimple_seq_add_stmt (&seq
, build_type_cast (shadow_type
,
2549 gimple_seq_last (seq
)));
2550 if (real_size_in_bytes
> 1)
2551 gimple_seq_add_stmt (&seq
,
2552 build_assign (PLUS_EXPR
, gimple_seq_last (seq
),
2553 real_size_in_bytes
- 1));
2554 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
,
2555 gimple_seq_last (seq
),
2557 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
2558 gimple_seq_last (seq
)));
2559 t
= gimple_assign_lhs (gimple_seq_last (seq
));
2560 gimple_seq_set_location (seq
, loc
);
2561 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
2564 /* For non-constant, misaligned or otherwise weird access sizes,
2565 check first and last byte. */
2566 if (size_in_bytes
== -1 && !end_instrumented
)
2568 g
= gimple_build_assign_with_ops (MINUS_EXPR
,
2569 make_ssa_name (uintptr_type
, NULL
),
2571 build_int_cst (uintptr_type
, 1));
2572 gimple_set_location (g
, loc
);
2573 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2574 tree last
= gimple_assign_lhs (g
);
2575 g
= gimple_build_assign_with_ops (PLUS_EXPR
,
2576 make_ssa_name (uintptr_type
, NULL
),
2579 gimple_set_location (g
, loc
);
2580 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2581 tree base_end_addr
= gimple_assign_lhs (g
);
2583 tree shadow
= build_shadow_mem_access (&gsi
, loc
, base_end_addr
,
2585 gimple shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
2586 gimple_seq seq
= NULL
;
2587 gimple_seq_add_stmt (&seq
, shadow_test
);
2588 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
,
2590 gimple_seq_add_stmt (&seq
, build_type_cast (shadow_type
,
2591 gimple_seq_last (seq
)));
2592 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
,
2593 gimple_seq_last (seq
),
2595 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
2596 gimple_seq_last (seq
)));
2597 if (!start_instrumented
)
2598 gimple_seq_add_stmt (&seq
, build_assign (BIT_IOR_EXPR
, t
,
2599 gimple_seq_last (seq
)));
2600 t
= gimple_assign_lhs (gimple_seq_last (seq
));
2601 gimple_seq_set_location (seq
, loc
);
2602 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
2606 g
= gimple_build_cond (NE_EXPR
, t
, build_int_cst (TREE_TYPE (t
), 0),
2607 NULL_TREE
, NULL_TREE
);
2608 gimple_set_location (g
, loc
);
2609 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2611 /* Generate call to the run-time library (e.g. __asan_report_load8). */
2612 gsi
= gsi_start_bb (then_bb
);
2614 tree fun
= report_error_func (is_store
, size_in_bytes
, &nargs
);
2615 g
= gimple_build_call (fun
, nargs
, base_addr
, len
);
2616 gimple_set_location (g
, loc
);
2617 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
2619 gsi_remove (iter
, true);
2620 *iter
= gsi_start_bb (else_bb
);
2625 /* Instrument the current function. */
2628 asan_instrument (void)
2630 if (shadow_ptr_types
[0] == NULL_TREE
)
2631 asan_init_shadow_ptr_types ();
2632 transform_statements ();
2639 return (flag_sanitize
& SANITIZE_ADDRESS
) != 0
2640 && !lookup_attribute ("no_sanitize_address",
2641 DECL_ATTRIBUTES (current_function_decl
));
2646 const pass_data pass_data_asan
=
2648 GIMPLE_PASS
, /* type */
2650 OPTGROUP_NONE
, /* optinfo_flags */
2651 TV_NONE
, /* tv_id */
2652 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2653 0, /* properties_provided */
2654 0, /* properties_destroyed */
2655 0, /* todo_flags_start */
2656 TODO_update_ssa
, /* todo_flags_finish */
2659 class pass_asan
: public gimple_opt_pass
2662 pass_asan (gcc::context
*ctxt
)
2663 : gimple_opt_pass (pass_data_asan
, ctxt
)
2666 /* opt_pass methods: */
2667 opt_pass
* clone () { return new pass_asan (m_ctxt
); }
2668 virtual bool gate (function
*) { return gate_asan (); }
2669 virtual unsigned int execute (function
*) { return asan_instrument (); }
2671 }; // class pass_asan
2676 make_pass_asan (gcc::context
*ctxt
)
2678 return new pass_asan (ctxt
);
2683 const pass_data pass_data_asan_O0
=
2685 GIMPLE_PASS
, /* type */
2687 OPTGROUP_NONE
, /* optinfo_flags */
2688 TV_NONE
, /* tv_id */
2689 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2690 0, /* properties_provided */
2691 0, /* properties_destroyed */
2692 0, /* todo_flags_start */
2693 TODO_update_ssa
, /* todo_flags_finish */
2696 class pass_asan_O0
: public gimple_opt_pass
2699 pass_asan_O0 (gcc::context
*ctxt
)
2700 : gimple_opt_pass (pass_data_asan_O0
, ctxt
)
2703 /* opt_pass methods: */
2704 virtual bool gate (function
*) { return !optimize
&& gate_asan (); }
2705 virtual unsigned int execute (function
*) { return asan_instrument (); }
2707 }; // class pass_asan_O0
2712 make_pass_asan_O0 (gcc::context
*ctxt
)
2714 return new pass_asan_O0 (ctxt
);
2717 /* Perform optimization of sanitize functions. */
2721 const pass_data pass_data_sanopt
=
2723 GIMPLE_PASS
, /* type */
2724 "sanopt", /* name */
2725 OPTGROUP_NONE
, /* optinfo_flags */
2726 TV_NONE
, /* tv_id */
2727 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2728 0, /* properties_provided */
2729 0, /* properties_destroyed */
2730 0, /* todo_flags_start */
2731 TODO_update_ssa
, /* todo_flags_finish */
2734 class pass_sanopt
: public gimple_opt_pass
2737 pass_sanopt (gcc::context
*ctxt
)
2738 : gimple_opt_pass (pass_data_sanopt
, ctxt
)
2741 /* opt_pass methods: */
2742 virtual bool gate (function
*) { return flag_sanitize
; }
2743 virtual unsigned int execute (function
*);
2745 }; // class pass_sanopt
2748 pass_sanopt::execute (function
*fun
)
2752 int asan_num_accesses
= 0;
2753 if (flag_sanitize
& SANITIZE_ADDRESS
)
2755 gimple_stmt_iterator gsi
;
2756 FOR_EACH_BB_FN (bb
, fun
)
2757 for (gsi
= gsi_start_bb (bb
); !gsi_end_p (gsi
); gsi_next (&gsi
))
2759 gimple stmt
= gsi_stmt (gsi
);
2760 if (is_gimple_call (stmt
) && gimple_call_internal_p (stmt
)
2761 && gimple_call_internal_fn (stmt
) == IFN_ASAN_CHECK
)
2762 ++asan_num_accesses
;
2766 bool use_calls
= ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD
< INT_MAX
2767 && asan_num_accesses
>= ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD
;
2769 FOR_EACH_BB_FN (bb
, fun
)
2771 gimple_stmt_iterator gsi
;
2772 for (gsi
= gsi_start_bb (bb
); !gsi_end_p (gsi
); )
2774 gimple stmt
= gsi_stmt (gsi
);
2775 bool no_next
= false;
2777 if (!is_gimple_call (stmt
))
2783 if (gimple_call_internal_p (stmt
))
2785 enum internal_fn ifn
= gimple_call_internal_fn (stmt
);
2788 case IFN_UBSAN_NULL
:
2789 no_next
= ubsan_expand_null_ifn (&gsi
);
2791 case IFN_UBSAN_BOUNDS
:
2792 no_next
= ubsan_expand_bounds_ifn (&gsi
);
2794 case IFN_ASAN_CHECK
:
2796 no_next
= asan_expand_check_ifn (&gsi
, use_calls
);
2804 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2806 fprintf (dump_file
, "Optimized\n ");
2807 print_gimple_stmt (dump_file
, stmt
, 0, dump_flags
);
2808 fprintf (dump_file
, "\n");
2821 make_pass_sanopt (gcc::context
*ctxt
)
2823 return new pass_sanopt (ctxt
);
2826 #include "gt-asan.h"