Bug Summary

File:llvm/lib/Target/AArch64/AArch64StackTagging.cpp
Warning:line 449, column 18
Called C++ object pointer is null

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name AArch64StackTagging.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -mthread-model posix -mframe-pointer=none -fmath-errno -fno-rounding-math -masm-verbose -mconstructor-aliases -munwind-tables -target-cpu x86-64 -dwarf-column-info -fno-split-dwarf-inlining -debugger-tuning=gdb -ffunction-sections -fdata-sections -resource-dir /usr/lib/llvm-11/lib/clang/11.0.0 -D _DEBUG -D _GNU_SOURCE -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -I /build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347/build-llvm/lib/Target/AArch64 -I /build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347/llvm/lib/Target/AArch64 -I /build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347/build-llvm/include -I /build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347/llvm/include -U NDEBUG -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/6.3.0/../../../../include/c++/6.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/6.3.0/../../../../include/x86_64-linux-gnu/c++/6.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/6.3.0/../../../../include/x86_64-linux-gnu/c++/6.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/6.3.0/../../../../include/c++/6.3.0/backward -internal-isystem /usr/local/include -internal-isystem /usr/lib/llvm-11/lib/clang/11.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-comment -std=c++14 -fdeprecated-macro -fdebug-compilation-dir /build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347/build-llvm/lib/Target/AArch64 -fdebug-prefix-map=/build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347=. -ferror-limit 19 -fmessage-length 0 -fvisibility hidden -fvisibility-inlines-hidden -stack-protector 2 -fgnuc-version=4.2.1 -fobjc-runtime=gcc -fdiagnostics-show-option -vectorize-loops -vectorize-slp -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -o /tmp/scan-build-2020-03-09-184146-41876-1 -x c++ /build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347/llvm/lib/Target/AArch64/AArch64StackTagging.cpp
1//===- AArch64StackTagging.cpp - Stack tagging in IR --===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//===----------------------------------------------------------------------===//
10
11#include "AArch64.h"
12#include "AArch64InstrInfo.h"
13#include "AArch64Subtarget.h"
14#include "AArch64TargetMachine.h"
15#include "llvm/ADT/DenseMap.h"
16#include "llvm/ADT/DepthFirstIterator.h"
17#include "llvm/ADT/MapVector.h"
18#include "llvm/ADT/None.h"
19#include "llvm/ADT/Optional.h"
20#include "llvm/ADT/SmallVector.h"
21#include "llvm/ADT/Statistic.h"
22#include "llvm/Analysis/CFG.h"
23#include "llvm/Analysis/LoopInfo.h"
24#include "llvm/Analysis/ScalarEvolution.h"
25#include "llvm/Analysis/ScalarEvolutionExpressions.h"
26#include "llvm/Analysis/ValueTracking.h"
27#include "llvm/CodeGen/LiveRegUnits.h"
28#include "llvm/CodeGen/MachineBasicBlock.h"
29#include "llvm/CodeGen/MachineFunction.h"
30#include "llvm/CodeGen/MachineFunctionPass.h"
31#include "llvm/CodeGen/MachineInstr.h"
32#include "llvm/CodeGen/MachineInstrBuilder.h"
33#include "llvm/CodeGen/MachineLoopInfo.h"
34#include "llvm/CodeGen/MachineOperand.h"
35#include "llvm/CodeGen/MachineRegisterInfo.h"
36#include "llvm/CodeGen/TargetPassConfig.h"
37#include "llvm/CodeGen/TargetRegisterInfo.h"
38#include "llvm/IR/DebugLoc.h"
39#include "llvm/IR/Dominators.h"
40#include "llvm/IR/Function.h"
41#include "llvm/IR/GetElementPtrTypeIterator.h"
42#include "llvm/IR/Instruction.h"
43#include "llvm/IR/Instructions.h"
44#include "llvm/IR/IntrinsicInst.h"
45#include "llvm/IR/IntrinsicsAArch64.h"
46#include "llvm/IR/Metadata.h"
47#include "llvm/Pass.h"
48#include "llvm/Support/Casting.h"
49#include "llvm/Support/Debug.h"
50#include "llvm/Support/raw_ostream.h"
51#include "llvm/Transforms/Utils/Local.h"
52#include <cassert>
53#include <iterator>
54#include <utility>
55
56using namespace llvm;
57
58#define DEBUG_TYPE"stack-tagging" "stack-tagging"
59
60static cl::opt<bool> ClMergeInit(
61 "stack-tagging-merge-init", cl::Hidden, cl::init(true), cl::ZeroOrMore,
62 cl::desc("merge stack variable initializers with tagging when possible"));
63
64static cl::opt<unsigned> ClScanLimit("stack-tagging-merge-init-scan-limit",
65 cl::init(40), cl::Hidden);
66
67static const Align kTagGranuleSize = Align(16);
68
69namespace {
70
71class InitializerBuilder {
72 uint64_t Size;
73 const DataLayout *DL;
74 Value *BasePtr;
75 Function *SetTagFn;
76 Function *SetTagZeroFn;
77 Function *StgpFn;
78
79 // List of initializers sorted by start offset.
80 struct Range {
81 uint64_t Start, End;
82 Instruction *Inst;
83 };
84 SmallVector<Range, 4> Ranges;
85 // 8-aligned offset => 8-byte initializer
86 // Missing keys are zero initialized.
87 std::map<uint64_t, Value *> Out;
88
89public:
90 InitializerBuilder(uint64_t Size, const DataLayout *DL, Value *BasePtr,
91 Function *SetTagFn, Function *SetTagZeroFn,
92 Function *StgpFn)
93 : Size(Size), DL(DL), BasePtr(BasePtr), SetTagFn(SetTagFn),
94 SetTagZeroFn(SetTagZeroFn), StgpFn(StgpFn) {}
95
96 bool addRange(uint64_t Start, uint64_t End, Instruction *Inst) {
97 auto I = std::lower_bound(
98 Ranges.begin(), Ranges.end(), Start,
99 [](const Range &LHS, uint64_t RHS) { return LHS.End <= RHS; });
100 if (I != Ranges.end() && End > I->Start) {
101 // Overlap - bail.
102 return false;
103 }
104 Ranges.insert(I, {Start, End, Inst});
105 return true;
106 }
107
108 bool addStore(uint64_t Offset, StoreInst *SI, const DataLayout *DL) {
109 int64_t StoreSize = DL->getTypeStoreSize(SI->getOperand(0)->getType());
110 if (!addRange(Offset, Offset + StoreSize, SI))
111 return false;
112 IRBuilder<> IRB(SI);
113 applyStore(IRB, Offset, Offset + StoreSize, SI->getOperand(0));
114 return true;
115 }
116
117 bool addMemSet(uint64_t Offset, MemSetInst *MSI) {
118 uint64_t StoreSize = cast<ConstantInt>(MSI->getLength())->getZExtValue();
119 if (!addRange(Offset, Offset + StoreSize, MSI))
120 return false;
121 IRBuilder<> IRB(MSI);
122 applyMemSet(IRB, Offset, Offset + StoreSize,
123 cast<ConstantInt>(MSI->getValue()));
124 return true;
125 }
126
127 void applyMemSet(IRBuilder<> &IRB, int64_t Start, int64_t End,
128 ConstantInt *V) {
129 // Out[] does not distinguish between zero and undef, and we already know
130 // that this memset does not overlap with any other initializer. Nothing to
131 // do for memset(0).
132 if (V->isZero())
133 return;
134 for (int64_t Offset = Start - Start % 8; Offset < End; Offset += 8) {
135 uint64_t Cst = 0x0101010101010101UL;
136 int LowBits = Offset < Start ? (Start - Offset) * 8 : 0;
137 if (LowBits)
138 Cst = (Cst >> LowBits) << LowBits;
139 int HighBits = End - Offset < 8 ? (8 - (End - Offset)) * 8 : 0;
140 if (HighBits)
141 Cst = (Cst << HighBits) >> HighBits;
142 ConstantInt *C =
143 ConstantInt::get(IRB.getInt64Ty(), Cst * V->getZExtValue());
144
145 Value *&CurrentV = Out[Offset];
146 if (!CurrentV) {
147 CurrentV = C;
148 } else {
149 CurrentV = IRB.CreateOr(CurrentV, C);
150 }
151 }
152 }
153
154 // Take a 64-bit slice of the value starting at the given offset (in bytes).
155 // Offset can be negative. Pad with zeroes on both sides when necessary.
156 Value *sliceValue(IRBuilder<> &IRB, Value *V, int64_t Offset) {
157 if (Offset > 0) {
158 V = IRB.CreateLShr(V, Offset * 8);
159 V = IRB.CreateZExtOrTrunc(V, IRB.getInt64Ty());
160 } else if (Offset < 0) {
161 V = IRB.CreateZExtOrTrunc(V, IRB.getInt64Ty());
162 V = IRB.CreateShl(V, -Offset * 8);
163 } else {
164 V = IRB.CreateZExtOrTrunc(V, IRB.getInt64Ty());
165 }
166 return V;
167 }
168
169 void applyStore(IRBuilder<> &IRB, int64_t Start, int64_t End,
170 Value *StoredValue) {
171 StoredValue = flatten(IRB, StoredValue);
172 for (int64_t Offset = Start - Start % 8; Offset < End; Offset += 8) {
173 Value *V = sliceValue(IRB, StoredValue, Offset - Start);
174 Value *&CurrentV = Out[Offset];
175 if (!CurrentV) {
176 CurrentV = V;
177 } else {
178 CurrentV = IRB.CreateOr(CurrentV, V);
179 }
180 }
181 }
182
183 void generate(IRBuilder<> &IRB) {
184 LLVM_DEBUG(dbgs() << "Combined initializer\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("stack-tagging")) { dbgs() << "Combined initializer\n"
; } } while (false)
;
185 // No initializers => the entire allocation is undef.
186 if (Ranges.empty()) {
187 emitUndef(IRB, 0, Size);
188 return;
189 }
190
191 // Look through 8-byte initializer list 16 bytes at a time;
192 // If one of the two 8-byte halfs is non-zero non-undef, emit STGP.
193 // Otherwise, emit zeroes up to next available item.
194 uint64_t LastOffset = 0;
195 for (uint64_t Offset = 0; Offset < Size; Offset += 16) {
196 auto I1 = Out.find(Offset);
197 auto I2 = Out.find(Offset + 8);
198 if (I1 == Out.end() && I2 == Out.end())
199 continue;
200
201 if (Offset > LastOffset)
202 emitZeroes(IRB, LastOffset, Offset - LastOffset);
203
204 Value *Store1 = I1 == Out.end() ? Constant::getNullValue(IRB.getInt64Ty())
205 : I1->second;
206 Value *Store2 = I2 == Out.end() ? Constant::getNullValue(IRB.getInt64Ty())
207 : I2->second;
208 emitPair(IRB, Offset, Store1, Store2);
209 LastOffset = Offset + 16;
210 }
211
212 // memset(0) does not update Out[], therefore the tail can be either undef
213 // or zero.
214 if (LastOffset < Size)
215 emitZeroes(IRB, LastOffset, Size - LastOffset);
216
217 for (const auto &R : Ranges) {
218 R.Inst->eraseFromParent();
219 }
220 }
221
222 void emitZeroes(IRBuilder<> &IRB, uint64_t Offset, uint64_t Size) {
223 LLVM_DEBUG(dbgs() << " [" << Offset << ", " << Offset + Sizedo { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("stack-tagging")) { dbgs() << " [" << Offset <<
", " << Offset + Size << ") zero\n"; } } while (
false)
224 << ") zero\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("stack-tagging")) { dbgs() << " [" << Offset <<
", " << Offset + Size << ") zero\n"; } } while (
false)
;
225 Value *Ptr = BasePtr;
226 if (Offset)
227 Ptr = IRB.CreateConstGEP1_32(Ptr, Offset);
228 IRB.CreateCall(SetTagZeroFn,
229 {Ptr, ConstantInt::get(IRB.getInt64Ty(), Size)});
230 }
231
232 void emitUndef(IRBuilder<> &IRB, uint64_t Offset, uint64_t Size) {
233 LLVM_DEBUG(dbgs() << " [" << Offset << ", " << Offset + Sizedo { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("stack-tagging")) { dbgs() << " [" << Offset <<
", " << Offset + Size << ") undef\n"; } } while (
false)
234 << ") undef\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("stack-tagging")) { dbgs() << " [" << Offset <<
", " << Offset + Size << ") undef\n"; } } while (
false)
;
235 Value *Ptr = BasePtr;
236 if (Offset)
237 Ptr = IRB.CreateConstGEP1_32(Ptr, Offset);
238 IRB.CreateCall(SetTagFn, {Ptr, ConstantInt::get(IRB.getInt64Ty(), Size)});
239 }
240
241 void emitPair(IRBuilder<> &IRB, uint64_t Offset, Value *A, Value *B) {
242 LLVM_DEBUG(dbgs() << " [" << Offset << ", " << Offset + 16 << "):\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("stack-tagging")) { dbgs() << " [" << Offset <<
", " << Offset + 16 << "):\n"; } } while (false)
;
243 LLVM_DEBUG(dbgs() << " " << *A << "\n " << *B << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("stack-tagging")) { dbgs() << " " << *A <<
"\n " << *B << "\n"; } } while (false)
;
244 Value *Ptr = BasePtr;
245 if (Offset)
246 Ptr = IRB.CreateConstGEP1_32(Ptr, Offset);
247 IRB.CreateCall(StgpFn, {Ptr, A, B});
248 }
249
250 Value *flatten(IRBuilder<> &IRB, Value *V) {
251 if (V->getType()->isIntegerTy())
252 return V;
253 // vector of pointers -> vector of ints
254 if (VectorType *VecTy = dyn_cast<VectorType>(V->getType())) {
255 LLVMContext &Ctx = IRB.getContext();
256 Type *EltTy = VecTy->getElementType();
257 if (EltTy->isPointerTy()) {
258 uint32_t EltSize = DL->getTypeSizeInBits(EltTy);
259 Type *NewTy = VectorType::get(IntegerType::get(Ctx, EltSize),
260 VecTy->getNumElements());
261 V = IRB.CreatePointerCast(V, NewTy);
262 }
263 }
264 return IRB.CreateBitOrPointerCast(
265 V, IRB.getIntNTy(DL->getTypeStoreSize(V->getType()) * 8));
266 }
267};
268
269class AArch64StackTagging : public FunctionPass {
270 struct AllocaInfo {
271 AllocaInst *AI;
272 SmallVector<IntrinsicInst *, 2> LifetimeStart;
273 SmallVector<IntrinsicInst *, 2> LifetimeEnd;
274 SmallVector<DbgVariableIntrinsic *, 2> DbgVariableIntrinsics;
275 int Tag; // -1 for non-tagged allocations
276 };
277
278 bool MergeInit;
279
280public:
281 static char ID; // Pass ID, replacement for typeid
282
283 AArch64StackTagging(bool MergeInit = true)
284 : FunctionPass(ID),
285 MergeInit(ClMergeInit.getNumOccurrences() > 0 ? ClMergeInit
286 : MergeInit) {
287 initializeAArch64StackTaggingPass(*PassRegistry::getPassRegistry());
288 }
289
290 bool isInterestingAlloca(const AllocaInst &AI);
291 void alignAndPadAlloca(AllocaInfo &Info);
292
293 void tagAlloca(AllocaInst *AI, Instruction *InsertBefore, Value *Ptr,
294 uint64_t Size);
295 void untagAlloca(AllocaInst *AI, Instruction *InsertBefore, uint64_t Size);
296
297 Instruction *collectInitializers(Instruction *StartInst, Value *StartPtr,
298 uint64_t Size, InitializerBuilder &IB);
299
300 Instruction *
301 insertBaseTaggedPointer(const MapVector<AllocaInst *, AllocaInfo> &Allocas,
302 const DominatorTree *DT);
303 bool runOnFunction(Function &F) override;
304
305 StringRef getPassName() const override { return "AArch64 Stack Tagging"; }
306
307private:
308 Function *F;
309 Function *SetTagFunc;
310 const DataLayout *DL;
311 AAResults *AA;
312
313 void getAnalysisUsage(AnalysisUsage &AU) const override {
314 AU.setPreservesCFG();
315 if (MergeInit)
316 AU.addRequired<AAResultsWrapperPass>();
317 }
318};
319
320} // end anonymous namespace
321
322char AArch64StackTagging::ID = 0;
323
324INITIALIZE_PASS_BEGIN(AArch64StackTagging, DEBUG_TYPE, "AArch64 Stack Tagging",static void *initializeAArch64StackTaggingPassOnce(PassRegistry
&Registry) {
325 false, false)static void *initializeAArch64StackTaggingPassOnce(PassRegistry
&Registry) {
326INITIALIZE_PASS_END(AArch64StackTagging, DEBUG_TYPE, "AArch64 Stack Tagging",PassInfo *PI = new PassInfo( "AArch64 Stack Tagging", "stack-tagging"
, &AArch64StackTagging::ID, PassInfo::NormalCtor_t(callDefaultCtor
<AArch64StackTagging>), false, false); Registry.registerPass
(*PI, true); return PI; } static llvm::once_flag InitializeAArch64StackTaggingPassFlag
; void llvm::initializeAArch64StackTaggingPass(PassRegistry &
Registry) { llvm::call_once(InitializeAArch64StackTaggingPassFlag
, initializeAArch64StackTaggingPassOnce, std::ref(Registry));
}
327 false, false)PassInfo *PI = new PassInfo( "AArch64 Stack Tagging", "stack-tagging"
, &AArch64StackTagging::ID, PassInfo::NormalCtor_t(callDefaultCtor
<AArch64StackTagging>), false, false); Registry.registerPass
(*PI, true); return PI; } static llvm::once_flag InitializeAArch64StackTaggingPassFlag
; void llvm::initializeAArch64StackTaggingPass(PassRegistry &
Registry) { llvm::call_once(InitializeAArch64StackTaggingPassFlag
, initializeAArch64StackTaggingPassOnce, std::ref(Registry));
}
328
329FunctionPass *llvm::createAArch64StackTaggingPass(bool MergeInit) {
330 return new AArch64StackTagging(MergeInit);
331}
332
333Instruction *AArch64StackTagging::collectInitializers(Instruction *StartInst,
334 Value *StartPtr,
335 uint64_t Size,
336 InitializerBuilder &IB) {
337 MemoryLocation AllocaLoc{StartPtr, Size};
338 Instruction *LastInst = StartInst;
339 BasicBlock::iterator BI(StartInst);
340
341 unsigned Count = 0;
342 for (; Count < ClScanLimit && !BI->isTerminator(); ++BI) {
343 if (!isa<DbgInfoIntrinsic>(*BI))
344 ++Count;
345
346 if (isNoModRef(AA->getModRefInfo(&*BI, AllocaLoc)))
347 continue;
348
349 if (!isa<StoreInst>(BI) && !isa<MemSetInst>(BI)) {
350 // If the instruction is readnone, ignore it, otherwise bail out. We
351 // don't even allow readonly here because we don't want something like:
352 // A[1] = 2; strlen(A); A[2] = 2; -> memcpy(A, ...); strlen(A).
353 if (BI->mayWriteToMemory() || BI->mayReadFromMemory())
354 break;
355 continue;
356 }
357
358 if (StoreInst *NextStore = dyn_cast<StoreInst>(BI)) {
359 if (!NextStore->isSimple())
360 break;
361
362 // Check to see if this store is to a constant offset from the start ptr.
363 Optional<int64_t> Offset =
364 isPointerOffset(StartPtr, NextStore->getPointerOperand(), *DL);
365 if (!Offset)
366 break;
367
368 if (!IB.addStore(*Offset, NextStore, DL))
369 break;
370 LastInst = NextStore;
371 } else {
372 MemSetInst *MSI = cast<MemSetInst>(BI);
373
374 if (MSI->isVolatile() || !isa<ConstantInt>(MSI->getLength()))
375 break;
376
377 if (!isa<ConstantInt>(MSI->getValue()))
378 break;
379
380 // Check to see if this store is to a constant offset from the start ptr.
381 Optional<int64_t> Offset = isPointerOffset(StartPtr, MSI->getDest(), *DL);
382 if (!Offset)
383 break;
384
385 if (!IB.addMemSet(*Offset, MSI))
386 break;
387 LastInst = MSI;
388 }
389 }
390 return LastInst;
391}
392
393bool AArch64StackTagging::isInterestingAlloca(const AllocaInst &AI) {
394 // FIXME: support dynamic allocas
395 bool IsInteresting =
396 AI.getAllocatedType()->isSized() && AI.isStaticAlloca() &&
397 // alloca() may be called with 0 size, ignore it.
398 AI.getAllocationSizeInBits(*DL).getValue() > 0 &&
399 // inalloca allocas are not treated as static, and we don't want
400 // dynamic alloca instrumentation for them as well.
401 !AI.isUsedWithInAlloca() &&
402 // swifterror allocas are register promoted by ISel
403 !AI.isSwiftError();
404 return IsInteresting;
405}
406
407void AArch64StackTagging::tagAlloca(AllocaInst *AI, Instruction *InsertBefore,
408 Value *Ptr, uint64_t Size) {
409 auto SetTagZeroFunc =
410 Intrinsic::getDeclaration(F->getParent(), Intrinsic::aarch64_settag_zero);
411 auto StgpFunc =
412 Intrinsic::getDeclaration(F->getParent(), Intrinsic::aarch64_stgp);
413
414 InitializerBuilder IB(Size, DL, Ptr, SetTagFunc, SetTagZeroFunc, StgpFunc);
415 bool LittleEndian =
416 Triple(AI->getModule()->getTargetTriple()).isLittleEndian();
417 // Current implementation of initializer merging assumes little endianness.
418 if (MergeInit && !F->hasOptNone() && LittleEndian) {
419 LLVM_DEBUG(dbgs() << "collecting initializers for " << *AIdo { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("stack-tagging")) { dbgs() << "collecting initializers for "
<< *AI << ", size = " << Size << "\n"
; } } while (false)
420 << ", size = " << Size << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("stack-tagging")) { dbgs() << "collecting initializers for "
<< *AI << ", size = " << Size << "\n"
; } } while (false)
;
421 InsertBefore = collectInitializers(InsertBefore, Ptr, Size, IB);
422 }
423
424 IRBuilder<> IRB(InsertBefore);
425 IB.generate(IRB);
426}
427
428void AArch64StackTagging::untagAlloca(AllocaInst *AI, Instruction *InsertBefore,
429 uint64_t Size) {
430 IRBuilder<> IRB(InsertBefore);
431 IRB.CreateCall(SetTagFunc, {IRB.CreatePointerCast(AI, IRB.getInt8PtrTy()),
432 ConstantInt::get(IRB.getInt64Ty(), Size)});
433}
434
435Instruction *AArch64StackTagging::insertBaseTaggedPointer(
436 const MapVector<AllocaInst *, AllocaInfo> &Allocas,
437 const DominatorTree *DT) {
438 BasicBlock *PrologueBB = nullptr;
439 // Try sinking IRG as deep as possible to avoid hurting shrink wrap.
440 for (auto &I : Allocas) {
441 const AllocaInfo &Info = I.second;
442 AllocaInst *AI = Info.AI;
443 if (Info.Tag < 0)
28
Assuming field 'Tag' is >= 0
29
Taking false branch
32
Assuming field 'Tag' is >= 0
33
Taking false branch
444 continue;
445 if (!PrologueBB
29.1
'PrologueBB' is null
) {
30
Taking true branch
34
Assuming 'PrologueBB' is non-null
35
Taking false branch
446 PrologueBB = AI->getParent();
447 continue;
31
Execution continues on line 440
448 }
449 PrologueBB = DT->findNearestCommonDominator(PrologueBB, AI->getParent());
36
Called C++ object pointer is null
450 }
451 assert(PrologueBB)((PrologueBB) ? static_cast<void> (0) : __assert_fail (
"PrologueBB", "/build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347/llvm/lib/Target/AArch64/AArch64StackTagging.cpp"
, 451, __PRETTY_FUNCTION__))
;
452
453 IRBuilder<> IRB(&PrologueBB->front());
454 Function *IRG_SP =
455 Intrinsic::getDeclaration(F->getParent(), Intrinsic::aarch64_irg_sp);
456 Instruction *Base =
457 IRB.CreateCall(IRG_SP, {Constant::getNullValue(IRB.getInt64Ty())});
458 Base->setName("basetag");
459 return Base;
460}
461
462void AArch64StackTagging::alignAndPadAlloca(AllocaInfo &Info) {
463 const Align NewAlignment =
464 max(MaybeAlign(Info.AI->getAlignment()), kTagGranuleSize);
465 Info.AI->setAlignment(NewAlignment);
466
467 uint64_t Size = Info.AI->getAllocationSizeInBits(*DL).getValue() / 8;
468 uint64_t AlignedSize = alignTo(Size, kTagGranuleSize);
469 if (Size == AlignedSize)
470 return;
471
472 // Add padding to the alloca.
473 Type *AllocatedType =
474 Info.AI->isArrayAllocation()
475 ? ArrayType::get(
476 Info.AI->getAllocatedType(),
477 cast<ConstantInt>(Info.AI->getArraySize())->getZExtValue())
478 : Info.AI->getAllocatedType();
479 Type *PaddingType =
480 ArrayType::get(Type::getInt8Ty(F->getContext()), AlignedSize - Size);
481 Type *TypeWithPadding = StructType::get(AllocatedType, PaddingType);
482 auto *NewAI = new AllocaInst(
483 TypeWithPadding, Info.AI->getType()->getAddressSpace(), nullptr, "", Info.AI);
484 NewAI->takeName(Info.AI);
485 NewAI->setAlignment(MaybeAlign(Info.AI->getAlignment()));
486 NewAI->setUsedWithInAlloca(Info.AI->isUsedWithInAlloca());
487 NewAI->setSwiftError(Info.AI->isSwiftError());
488 NewAI->copyMetadata(*Info.AI);
489
490 auto *NewPtr = new BitCastInst(NewAI, Info.AI->getType(), "", Info.AI);
491 Info.AI->replaceAllUsesWith(NewPtr);
492 Info.AI->eraseFromParent();
493 Info.AI = NewAI;
494}
495
496// Helper function to check for post-dominance.
497static bool postDominates(const PostDominatorTree *PDT, const IntrinsicInst *A,
498 const IntrinsicInst *B) {
499 const BasicBlock *ABB = A->getParent();
500 const BasicBlock *BBB = B->getParent();
501
502 if (ABB != BBB)
503 return PDT->dominates(ABB, BBB);
504
505 for (const Instruction &I : *ABB) {
506 if (&I == B)
507 return true;
508 if (&I == A)
509 return false;
510 }
511 llvm_unreachable("Corrupt instruction list")::llvm::llvm_unreachable_internal("Corrupt instruction list",
"/build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347/llvm/lib/Target/AArch64/AArch64StackTagging.cpp"
, 511)
;
512}
513
514// FIXME: check for MTE extension
515bool AArch64StackTagging::runOnFunction(Function &Fn) {
516 if (!Fn.hasFnAttribute(Attribute::SanitizeMemTag))
1
Assuming the condition is false
2
Taking false branch
517 return false;
518
519 F = &Fn;
520 DL = &Fn.getParent()->getDataLayout();
521 if (MergeInit)
3
Assuming field 'MergeInit' is false
4
Taking false branch
522 AA = &getAnalysis<AAResultsWrapperPass>().getAAResults();
523
524 MapVector<AllocaInst *, AllocaInfo> Allocas; // need stable iteration order
525 SmallVector<Instruction *, 8> RetVec;
526 DenseMap<Value *, AllocaInst *> AllocaForValue;
527 SmallVector<Instruction *, 4> UnrecognizedLifetimes;
528
529 for (auto &BB : *F) {
530 for (BasicBlock::iterator IT = BB.begin(); IT != BB.end(); ++IT) {
531 Instruction *I = &*IT;
532 if (auto *AI = dyn_cast<AllocaInst>(I)) {
533 Allocas[AI].AI = AI;
534 continue;
535 }
536
537 if (auto *DVI = dyn_cast<DbgVariableIntrinsic>(I)) {
538 if (auto *AI =
539 dyn_cast_or_null<AllocaInst>(DVI->getVariableLocation())) {
540 Allocas[AI].DbgVariableIntrinsics.push_back(DVI);
541 }
542 continue;
543 }
544
545 auto *II = dyn_cast<IntrinsicInst>(I);
546 if (II && (II->getIntrinsicID() == Intrinsic::lifetime_start ||
547 II->getIntrinsicID() == Intrinsic::lifetime_end)) {
548 AllocaInst *AI =
549 llvm::findAllocaForValue(II->getArgOperand(1), AllocaForValue);
550 if (!AI) {
551 UnrecognizedLifetimes.push_back(I);
552 continue;
553 }
554 if (II->getIntrinsicID() == Intrinsic::lifetime_start)
555 Allocas[AI].LifetimeStart.push_back(II);
556 else
557 Allocas[AI].LifetimeEnd.push_back(II);
558 }
559
560 if (isa<ReturnInst>(I) || isa<ResumeInst>(I) || isa<CleanupReturnInst>(I))
561 RetVec.push_back(I);
562 }
563 }
564
565 if (Allocas.empty())
5
Assuming the condition is false
6
Taking false branch
566 return false;
567
568 int NextTag = 0;
569 int NumInterestingAllocas = 0;
570 for (auto &I : Allocas) {
571 AllocaInfo &Info = I.second;
572 assert(Info.AI)((Info.AI) ? static_cast<void> (0) : __assert_fail ("Info.AI"
, "/build/llvm-toolchain-snapshot-11~++20200309111110+2c36c23f347/llvm/lib/Target/AArch64/AArch64StackTagging.cpp"
, 572, __PRETTY_FUNCTION__))
;
7
Assuming field 'AI' is non-null
8
'?' condition is true
11
Assuming field 'AI' is non-null
12
'?' condition is true
15
Assuming field 'AI' is non-null
16
'?' condition is true
573
574 if (!isInterestingAlloca(*Info.AI)) {
9
Taking true branch
13
Taking true branch
17
Taking false branch
575 Info.Tag = -1;
576 continue;
10
Execution continues on line 570
14
Execution continues on line 570
577 }
578
579 alignAndPadAlloca(Info);
580 NumInterestingAllocas++;
581 Info.Tag = NextTag;
582 NextTag = (NextTag + 1) % 16;
583 }
584
585 if (NumInterestingAllocas
17.1
'NumInterestingAllocas' is not equal to 0
== 0)
18
Taking false branch
586 return true;
587
588 std::unique_ptr<DominatorTree> DeleteDT;
589 DominatorTree *DT = nullptr;
19
'DT' initialized to a null pointer value
590 if (auto *P
19.1
'P' is null
= getAnalysisIfAvailable<DominatorTreeWrapperPass>())
20
Taking false branch
591 DT = &P->getDomTree();
592
593 if (DT == nullptr && (NumInterestingAllocas
20.1
'NumInterestingAllocas' is <= 1
> 1 ||
22
Taking false branch
594 !F->hasFnAttribute(Attribute::OptimizeNone))) {
21
Assuming the condition is false
595 DeleteDT = std::make_unique<DominatorTree>(*F);
596 DT = DeleteDT.get();
597 }
598
599 std::unique_ptr<PostDominatorTree> DeletePDT;
600 PostDominatorTree *PDT = nullptr;
601 if (auto *P
22.1
'P' is null
= getAnalysisIfAvailable<PostDominatorTreeWrapperPass>())
23
Taking false branch
602 PDT = &P->getPostDomTree();
603
604 if (PDT == nullptr && !F->hasFnAttribute(Attribute::OptimizeNone)) {
24
Assuming the condition is false
25
Taking false branch
605 DeletePDT = std::make_unique<PostDominatorTree>(*F);
606 PDT = DeletePDT.get();
607 }
608
609 SetTagFunc =
610 Intrinsic::getDeclaration(F->getParent(), Intrinsic::aarch64_settag);
611
612 Instruction *Base = insertBaseTaggedPointer(Allocas, DT);
26
Passing null pointer value via 2nd parameter 'DT'
27
Calling 'AArch64StackTagging::insertBaseTaggedPointer'
613
614 for (auto &I : Allocas) {
615 const AllocaInfo &Info = I.second;
616 AllocaInst *AI = Info.AI;
617 if (Info.Tag < 0)
618 continue;
619
620 // Replace alloca with tagp(alloca).
621 IRBuilder<> IRB(Info.AI->getNextNode());
622 Function *TagP = Intrinsic::getDeclaration(
623 F->getParent(), Intrinsic::aarch64_tagp, {Info.AI->getType()});
624 Instruction *TagPCall =
625 IRB.CreateCall(TagP, {Constant::getNullValue(Info.AI->getType()), Base,
626 ConstantInt::get(IRB.getInt64Ty(), Info.Tag)});
627 if (Info.AI->hasName())
628 TagPCall->setName(Info.AI->getName() + ".tag");
629 Info.AI->replaceAllUsesWith(TagPCall);
630 TagPCall->setOperand(0, Info.AI);
631
632 if (UnrecognizedLifetimes.empty() && Info.LifetimeStart.size() == 1 &&
633 Info.LifetimeEnd.size() == 1) {
634 IntrinsicInst *Start = Info.LifetimeStart[0];
635 IntrinsicInst *End = Info.LifetimeEnd[0];
636 uint64_t Size =
637 dyn_cast<ConstantInt>(Start->getArgOperand(0))->getZExtValue();
638 Size = alignTo(Size, kTagGranuleSize);
639 tagAlloca(AI, Start->getNextNode(), Start->getArgOperand(1), Size);
640 // We need to ensure that if we tag some object, we certainly untag it
641 // before the function exits.
642 if (PDT != nullptr && postDominates(PDT, End, Start)) {
643 untagAlloca(AI, End, Size);
644 } else {
645 SmallVector<Instruction *, 8> ReachableRetVec;
646 unsigned NumCoveredExits = 0;
647 for (auto &RI : RetVec) {
648 if (!isPotentiallyReachable(Start, RI, nullptr, DT))
649 continue;
650 ReachableRetVec.push_back(RI);
651 if (DT != nullptr && DT->dominates(End, RI))
652 ++NumCoveredExits;
653 }
654 // If there's a mix of covered and non-covered exits, just put the untag
655 // on exits, so we avoid the redundancy of untagging twice.
656 if (NumCoveredExits == ReachableRetVec.size()) {
657 untagAlloca(AI, End, Size);
658 } else {
659 for (auto &RI : ReachableRetVec)
660 untagAlloca(AI, RI, Size);
661 // We may have inserted untag outside of the lifetime interval.
662 // Remove the lifetime end call for this alloca.
663 End->eraseFromParent();
664 }
665 }
666 } else {
667 uint64_t Size = Info.AI->getAllocationSizeInBits(*DL).getValue() / 8;
668 Value *Ptr = IRB.CreatePointerCast(TagPCall, IRB.getInt8PtrTy());
669 tagAlloca(AI, &*IRB.GetInsertPoint(), Ptr, Size);
670 for (auto &RI : RetVec) {
671 untagAlloca(AI, RI, Size);
672 }
673 // We may have inserted tag/untag outside of any lifetime interval.
674 // Remove all lifetime intrinsics for this alloca.
675 for (auto &II : Info.LifetimeStart)
676 II->eraseFromParent();
677 for (auto &II : Info.LifetimeEnd)
678 II->eraseFromParent();
679 }
680
681 // Fixup debug intrinsics to point to the new alloca.
682 for (auto DVI : Info.DbgVariableIntrinsics)
683 DVI->setArgOperand(
684 0,
685 MetadataAsValue::get(F->getContext(), LocalAsMetadata::get(Info.AI)));
686 }
687
688 // If we have instrumented at least one alloca, all unrecognized lifetime
689 // instrinsics have to go.
690 for (auto &I : UnrecognizedLifetimes)
691 I->eraseFromParent();
692
693 return true;
694}