LLVM  3.7.0
Macros | Functions | Variables
AddressSanitizer.cpp File Reference
#include "llvm/Transforms/Instrumentation.h"
#include "llvm/ADT/ArrayRef.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/ADT/DenseSet.h"
#include "llvm/ADT/DepthFirstIterator.h"
#include "llvm/ADT/SmallSet.h"
#include "llvm/ADT/SmallString.h"
#include "llvm/ADT/SmallVector.h"
#include "llvm/ADT/Statistic.h"
#include "llvm/ADT/StringExtras.h"
#include "llvm/ADT/Triple.h"
#include "llvm/Analysis/MemoryBuiltins.h"
#include "llvm/Analysis/TargetLibraryInfo.h"
#include "llvm/Analysis/ValueTracking.h"
#include "llvm/IR/CallSite.h"
#include "llvm/IR/DIBuilder.h"
#include "llvm/IR/DataLayout.h"
#include "llvm/IR/Dominators.h"
#include "llvm/IR/Function.h"
#include "llvm/IR/IRBuilder.h"
#include "llvm/IR/InlineAsm.h"
#include "llvm/IR/InstVisitor.h"
#include "llvm/IR/IntrinsicInst.h"
#include "llvm/IR/LLVMContext.h"
#include "llvm/IR/MDBuilder.h"
#include "llvm/IR/Module.h"
#include "llvm/IR/Type.h"
#include "llvm/MC/MCSectionMachO.h"
#include "llvm/Support/CommandLine.h"
#include "llvm/Support/DataTypes.h"
#include "llvm/Support/Debug.h"
#include "llvm/Support/Endian.h"
#include "llvm/Support/SwapByteOrder.h"
#include "llvm/Support/raw_ostream.h"
#include "llvm/Transforms/Scalar.h"
#include "llvm/Transforms/Utils/ASanStackFrameLayout.h"
#include "llvm/Transforms/Utils/BasicBlockUtils.h"
#include "llvm/Transforms/Utils/Cloning.h"
#include "llvm/Transforms/Utils/Local.h"
#include "llvm/Transforms/Utils/ModuleUtils.h"
#include "llvm/Transforms/Utils/PromoteMemToReg.h"
#include <algorithm>
#include <string>
#include <system_error>
Include dependency graph for AddressSanitizer.cpp:

Go to the source code of this file.

Macros

#define DEBUG_TYPE   "asan"
 

Functions

 STATISTIC (NumInstrumentedReads,"Number of instrumented reads")
 
 STATISTIC (NumInstrumentedWrites,"Number of instrumented writes")
 
 STATISTIC (NumOptimizedAccessesToGlobalVar,"Number of optimized accesses to global vars")
 
 STATISTIC (NumOptimizedAccessesToStackVar,"Number of optimized accesses to stack vars")
 
 INITIALIZE_PASS_BEGIN (AddressSanitizer,"asan","AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false, false) INITIALIZE_PASS_END(AddressSanitizer
 
 INITIALIZE_PASS (AddressSanitizerModule,"asan-module","AddressSanitizer: detects use-after-free and out-of-bounds bugs.""ModulePass", false, false) ModulePass *llvm
 
static size_t TypeSizeToSizeIndex (uint32_t TypeSize)
 
static GlobalVariablecreatePrivateGlobalForString (Module &M, StringRef Str, bool AllowMerging)
 
static GlobalVariablecreatePrivateGlobalForSourceLoc (Module &M, LocationMetadata MD)
 Create a global describing a source location. More...
 
static bool GlobalWasGeneratedByAsan (GlobalVariable *G)
 
static bool isPointerOperand (Value *V)
 
static bool isInterestingPointerComparisonOrSubtraction (Instruction *I)
 
static int StackMallocSizeClass (uint64_t LocalStackSize)
 

Variables

static const uint64_t kDefaultShadowScale = 3
 
static const uint64_t kDefaultShadowOffset32 = 1ULL << 29
 
static const uint64_t kIOSShadowOffset32 = 1ULL << 30
 
static const uint64_t kDefaultShadowOffset64 = 1ULL << 44
 
static const uint64_t kSmallX86_64ShadowOffset = 0x7FFF8000
 
static const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000
 
static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 41
 
static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000
 
static const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37
 
static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36
 
static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30
 
static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46
 
static const uint64_t kWindowsShadowOffset32 = 3ULL << 28
 
static const size_t kMinStackMallocSize = 1 << 6
 
static const size_t kMaxStackMallocSize = 1 << 16
 
static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3
 
static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E
 
static const char *const kAsanModuleCtorName = "asan.module_ctor"
 
static const char *const kAsanModuleDtorName = "asan.module_dtor"
 
static const uint64_t kAsanCtorAndDtorPriority = 1
 
static const char *const kAsanReportErrorTemplate = "__asan_report_"
 
static const char *const kAsanRegisterGlobalsName = "__asan_register_globals"
 
static const char *const kAsanUnregisterGlobalsName
 
static const char *const kAsanPoisonGlobalsName = "__asan_before_dynamic_init"
 
static const char *const kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"
 
static const char *const kAsanInitName = "__asan_init_v5"
 
static const char *const kAsanPtrCmp = "__sanitizer_ptr_cmp"
 
static const char *const kAsanPtrSub = "__sanitizer_ptr_sub"
 
static const char *const kAsanHandleNoReturnName = "__asan_handle_no_return"
 
static const int kMaxAsanStackMallocSizeClass = 10
 
static const char *const kAsanStackMallocNameTemplate = "__asan_stack_malloc_"
 
static const char *const kAsanStackFreeNameTemplate = "__asan_stack_free_"
 
static const char *const kAsanGenPrefix = "__asan_gen_"
 
static const char *const kSanCovGenPrefix = "__sancov_gen_"
 
static const char *const kAsanPoisonStackMemoryName
 
static const char *const kAsanUnpoisonStackMemoryName
 
static const char *const kAsanOptionDetectUAR
 
static const char *const kAsanAllocaPoison = "__asan_alloca_poison"
 
static const char *const kAsanAllocasUnpoison = "__asan_allocas_unpoison"
 
static const size_t kNumberOfAccessSizes = 5
 
static const unsigned kAllocaRzSize = 32
 
static cl::opt< boolClEnableKasan ("asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"), cl::Hidden, cl::init(false))
 
static cl::opt< boolClInstrumentReads ("asan-instrument-reads", cl::desc("instrument read instructions"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClInstrumentWrites ("asan-instrument-writes", cl::desc("instrument write instructions"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClInstrumentAtomics ("asan-instrument-atomics", cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClAlwaysSlowPath ("asan-always-slow-path", cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, cl::init(false))
 
static cl::opt< intClMaxInsnsToInstrumentPerBB ("asan-max-ins-per-bb", cl::init(10000), cl::desc("maximal number of instructions to instrument in any given BB"), cl::Hidden)
 
static cl::opt< boolClStack ("asan-stack", cl::desc("Handle stack memory"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClUseAfterReturn ("asan-use-after-return", cl::desc("Check return-after-free"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClGlobals ("asan-globals", cl::desc("Handle global objects"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClInitializers ("asan-initialization-order", cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClInvalidPointerPairs ("asan-detect-invalid-pointer-pair", cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, cl::init(false))
 
static cl::opt< unsignedClRealignStack ("asan-realign-stack", cl::desc("Realign stack to the value of this flag (power of two)"), cl::Hidden, cl::init(32))
 
static cl::opt< intClInstrumentationWithCallsThreshold ("asan-instrumentation-with-call-threshold", cl::desc("If the function being instrumented contains more than ""this number of memory accesses, use callbacks instead of ""inline checks (-1 means never use callbacks)."), cl::Hidden, cl::init(7000))
 
static cl::opt< std::string > ClMemoryAccessCallbackPrefix ("asan-memory-access-callback-prefix", cl::desc("Prefix for memory access callbacks"), cl::Hidden, cl::init("__asan_"))
 
static cl::opt< boolClInstrumentAllocas ("asan-instrument-allocas", cl::desc("instrument dynamic allocas"), cl::Hidden, cl::init(false))
 
static cl::opt< boolClSkipPromotableAllocas ("asan-skip-promotable-allocas", cl::desc("Do not instrument promotable allocas"), cl::Hidden, cl::init(true))
 
static cl::opt< intClMappingScale ("asan-mapping-scale", cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0))
 
static cl::opt< boolClOpt ("asan-opt", cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClOptSameTemp ("asan-opt-same-temp", cl::desc("Instrument the same temp just once"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClOptGlobals ("asan-opt-globals", cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true))
 
static cl::opt< boolClOptStack ("asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), cl::Hidden, cl::init(false))
 
static cl::opt< boolClCheckLifetime ("asan-check-lifetime", cl::desc("Use llvm.lifetime intrinsics to insert extra checks"), cl::Hidden, cl::init(false))
 
static cl::opt< boolClDynamicAllocaStack ("asan-stack-dynamic-alloca", cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, cl::init(true))
 
static cl::opt< uint32_t > ClForceExperiment ("asan-force-experiment", cl::desc("Force optimization experiment (for testing)"), cl::Hidden, cl::init(0))
 
static cl::opt< intClDebug ("asan-debug", cl::desc("debug"), cl::Hidden, cl::init(0))
 
static cl::opt< intClDebugStack ("asan-debug-stack", cl::desc("debug stack"), cl::Hidden, cl::init(0))
 
static cl::opt< std::string > ClDebugFunc ("asan-debug-func", cl::Hidden, cl::desc("Debug func"))
 
static cl::opt< intClDebugMin ("asan-debug-min", cl::desc("Debug min inst"), cl::Hidden, cl::init(-1))
 
static cl::opt< intClDebugMax ("asan-debug-max", cl::desc("Debug man inst"), cl::Hidden, cl::init(-1))
 
 asan
 
AddressSanitizer __pad0__
 
AddressSanitizer false
 

Macro Definition Documentation

#define DEBUG_TYPE   "asan"

Definition at line 63 of file AddressSanitizer.cpp.

Function Documentation

static GlobalVariable* createPrivateGlobalForSourceLoc ( Module M,
LocationMetadata  MD 
)
static
static GlobalVariable* createPrivateGlobalForString ( Module M,
StringRef  Str,
bool  AllowMerging 
)
static
static bool GlobalWasGeneratedByAsan ( GlobalVariable G)
static
INITIALIZE_PASS ( AddressSanitizerModule  ,
"asan-module"  ,
"AddressSanitizer: detects use-after-free and out-of-bounds bugs.""ModulePass ,
false  ,
false   
)

Definition at line 709 of file AddressSanitizer.cpp.

INITIALIZE_PASS_BEGIN ( AddressSanitizer  ,
"asan"  ,
"AddressSanitizer: detects use-after-free and out-of-bounds bugs."  ,
false  ,
false   
)
static bool isInterestingPointerComparisonOrSubtraction ( Instruction I)
static

Definition at line 863 of file AddressSanitizer.cpp.

References llvm::User::getOperand(), and isPointerOperand().

static bool isPointerOperand ( Value V)
static
static int StackMallocSizeClass ( uint64_t  LocalStackSize)
static

Definition at line 1649 of file AddressSanitizer.cpp.

References kMaxStackMallocSize, kMinStackMallocSize, and llvm_unreachable.

STATISTIC ( NumInstrumentedReads  ,
"Number of instrumented reads"   
)
STATISTIC ( NumInstrumentedWrites  ,
"Number of instrumented writes"   
)
STATISTIC ( NumOptimizedAccessesToGlobalVar  ,
"Number of optimized accesses to global vars"   
)
STATISTIC ( NumOptimizedAccessesToStackVar  ,
"Number of optimized accesses to stack vars"   
)
static size_t TypeSizeToSizeIndex ( uint32_t  TypeSize)
static

Definition at line 718 of file AddressSanitizer.cpp.

References llvm::countTrailingZeros(), and kNumberOfAccessSizes.

Variable Documentation

AddressSanitizer __pad0__

Definition at line 701 of file AddressSanitizer.cpp.

asan

Definition at line 701 of file AddressSanitizer.cpp.

cl::opt<bool> ClAlwaysSlowPath("asan-always-slow-path", cl::desc("use instrumentation with slow path for all accesses"), cl::Hidden, cl::init(false))
static
cl::opt<bool> ClCheckLifetime("asan-check-lifetime", cl::desc("Use llvm.lifetime intrinsics to insert extra checks"), cl::Hidden, cl::init(false))
static
cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden, cl::init(0))
static
cl::opt<std::string> ClDebugFunc("asan-debug-func", cl::Hidden, cl::desc("Debug func"))
static
cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"), cl::Hidden, cl::init(-1))
static
cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"), cl::Hidden, cl::init(-1))
static
cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"), cl::Hidden, cl::init(0))
static
cl::opt<bool> ClDynamicAllocaStack("asan-stack-dynamic-alloca", cl::desc("Use dynamic alloca to represent stack variables"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClEnableKasan("asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"), cl::Hidden, cl::init(false))
static
cl::opt<uint32_t> ClForceExperiment("asan-force-experiment", cl::desc("Force optimization experiment (for testing)"), cl::Hidden, cl::init(0))
static
cl::opt<bool> ClGlobals("asan-globals", cl::desc("Handle global objects"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClInitializers("asan-initialization-order", cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClInstrumentAllocas("asan-instrument-allocas", cl::desc("instrument dynamic allocas"), cl::Hidden, cl::init(false))
static
cl::opt<int> ClInstrumentationWithCallsThreshold("asan-instrumentation-with-call-threshold", cl::desc("If the function being instrumented contains more than ""this number of memory accesses, use callbacks instead of ""inline checks (-1 means never use callbacks)."), cl::Hidden, cl::init(7000))
static
cl::opt<bool> ClInstrumentAtomics("asan-instrument-atomics", cl::desc("instrument atomic instructions (rmw, cmpxchg)"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClInstrumentReads("asan-instrument-reads", cl::desc("instrument read instructions"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClInstrumentWrites("asan-instrument-writes", cl::desc("instrument write instructions"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClInvalidPointerPairs("asan-detect-invalid-pointer-pair", cl::desc("Instrument <, <=, >, >=, - with pointer operands"), cl::Hidden, cl::init(false))
static
cl::opt<int> ClMappingScale("asan-mapping-scale", cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0))
static
cl::opt<int> ClMaxInsnsToInstrumentPerBB("asan-max-ins-per-bb", cl::init(10000), cl::desc("maximal number of instructions to instrument in any given BB"), cl::Hidden)
static
cl::opt<std::string> ClMemoryAccessCallbackPrefix("asan-memory-access-callback-prefix", cl::desc("Prefix for memory access callbacks"), cl::Hidden, cl::init("__asan_"))
static
cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClOptGlobals("asan-opt-globals", cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClOptSameTemp("asan-opt-same-temp", cl::desc("Instrument the same temp just once"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClOptStack("asan-opt-stack", cl::desc("Don't instrument scalar stack variables"), cl::Hidden, cl::init(false))
static
cl::opt<unsigned> ClRealignStack("asan-realign-stack", cl::desc("Realign stack to the value of this flag (power of two)"), cl::Hidden, cl::init(32))
static
cl::opt<bool> ClSkipPromotableAllocas("asan-skip-promotable-allocas", cl::desc("Do not instrument promotable allocas"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"), cl::Hidden, cl::init(true))
static
cl::opt<bool> ClUseAfterReturn("asan-use-after-return", cl::desc("Check return-after-free"), cl::Hidden, cl::init(true))
static
AddressSanitizer false

Definition at line 701 of file AddressSanitizer.cpp.

const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36
static

Definition at line 74 of file AddressSanitizer.cpp.

const unsigned kAllocaRzSize = 32
static

Definition at line 116 of file AddressSanitizer.cpp.

const char* const kAsanAllocaPoison = "__asan_alloca_poison"
static

Definition at line 110 of file AddressSanitizer.cpp.

const char* const kAsanAllocasUnpoison = "__asan_allocas_unpoison"
static

Definition at line 111 of file AddressSanitizer.cpp.

const uint64_t kAsanCtorAndDtorPriority = 1
static

Definition at line 86 of file AddressSanitizer.cpp.

const char* const kAsanGenPrefix = "__asan_gen_"
static
const char* const kAsanHandleNoReturnName = "__asan_handle_no_return"
static

Definition at line 96 of file AddressSanitizer.cpp.

const char* const kAsanInitName = "__asan_init_v5"
static

Definition at line 93 of file AddressSanitizer.cpp.

const char* const kAsanModuleCtorName = "asan.module_ctor"
static

Definition at line 84 of file AddressSanitizer.cpp.

const char* const kAsanModuleDtorName = "asan.module_dtor"
static

Definition at line 85 of file AddressSanitizer.cpp.

const char* const kAsanOptionDetectUAR
static
Initial value:
=
"__asan_option_detect_stack_use_after_return"

Definition at line 107 of file AddressSanitizer.cpp.

const char* const kAsanPoisonGlobalsName = "__asan_before_dynamic_init"
static

Definition at line 91 of file AddressSanitizer.cpp.

const char* const kAsanPoisonStackMemoryName
static
Initial value:
=
"__asan_poison_stack_memory"

Definition at line 102 of file AddressSanitizer.cpp.

const char* const kAsanPtrCmp = "__sanitizer_ptr_cmp"
static

Definition at line 94 of file AddressSanitizer.cpp.

const char* const kAsanPtrSub = "__sanitizer_ptr_sub"
static

Definition at line 95 of file AddressSanitizer.cpp.

const char* const kAsanRegisterGlobalsName = "__asan_register_globals"
static

Definition at line 88 of file AddressSanitizer.cpp.

const char* const kAsanReportErrorTemplate = "__asan_report_"
static

Definition at line 87 of file AddressSanitizer.cpp.

const char* const kAsanStackFreeNameTemplate = "__asan_stack_free_"
static

Definition at line 99 of file AddressSanitizer.cpp.

const char* const kAsanStackMallocNameTemplate = "__asan_stack_malloc_"
static

Definition at line 98 of file AddressSanitizer.cpp.

const char* const kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init"
static

Definition at line 92 of file AddressSanitizer.cpp.

const char* const kAsanUnpoisonStackMemoryName
static
Initial value:
=
"__asan_unpoison_stack_memory"

Definition at line 104 of file AddressSanitizer.cpp.

const char* const kAsanUnregisterGlobalsName
static
Initial value:
=
"__asan_unregister_globals"

Definition at line 89 of file AddressSanitizer.cpp.

const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3
static

Definition at line 81 of file AddressSanitizer.cpp.

const uint64_t kDefaultShadowOffset32 = 1ULL << 29
static

Definition at line 66 of file AddressSanitizer.cpp.

const uint64_t kDefaultShadowOffset64 = 1ULL << 44
static

Definition at line 68 of file AddressSanitizer.cpp.

const uint64_t kDefaultShadowScale = 3
static

Definition at line 65 of file AddressSanitizer.cpp.

const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30
static

Definition at line 75 of file AddressSanitizer.cpp.

const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46
static

Definition at line 76 of file AddressSanitizer.cpp.

const uint64_t kIOSShadowOffset32 = 1ULL << 30
static

Definition at line 67 of file AddressSanitizer.cpp.

const uint64_t kLinuxKasan_ShadowOffset64 = 0xdffffc0000000000
static

Definition at line 70 of file AddressSanitizer.cpp.

const int kMaxAsanStackMallocSizeClass = 10
static

Definition at line 97 of file AddressSanitizer.cpp.

const size_t kMaxStackMallocSize = 1 << 16
static

Definition at line 80 of file AddressSanitizer.cpp.

Referenced by StackMallocSizeClass().

const size_t kMinStackMallocSize = 1 << 6
static

Definition at line 79 of file AddressSanitizer.cpp.

Referenced by StackMallocSizeClass().

const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa0000
static

Definition at line 72 of file AddressSanitizer.cpp.

const uint64_t kMIPS64_ShadowOffset64 = 1ULL << 37
static

Definition at line 73 of file AddressSanitizer.cpp.

const size_t kNumberOfAccessSizes = 5
static

Definition at line 114 of file AddressSanitizer.cpp.

Referenced by TypeSizeToSizeIndex().

const uint64_t kPPC64_ShadowOffset64 = 1ULL << 41
static

Definition at line 71 of file AddressSanitizer.cpp.

const uintptr_t kRetiredStackFrameMagic = 0x45E0360E
static

Definition at line 82 of file AddressSanitizer.cpp.

const char* const kSanCovGenPrefix = "__sancov_gen_"
static

Definition at line 101 of file AddressSanitizer.cpp.

Referenced by GlobalWasGeneratedByAsan().

const uint64_t kSmallX86_64ShadowOffset = 0x7FFF8000
static

Definition at line 69 of file AddressSanitizer.cpp.

const uint64_t kWindowsShadowOffset32 = 3ULL << 28
static

Definition at line 77 of file AddressSanitizer.cpp.