This file is a part of DataFlowSanitizer, a generalised dynamic data flow analysis. More...

#include "llvm/ADT/DenseMap.h"
#include "llvm/ADT/DenseSet.h"
#include "llvm/ADT/DepthFirstIterator.h"
#include "llvm/ADT/None.h"
#include "llvm/ADT/SmallPtrSet.h"
#include "llvm/ADT/SmallVector.h"
#include "llvm/ADT/StringExtras.h"
#include "llvm/ADT/StringRef.h"
#include "llvm/ADT/Triple.h"
#include "llvm/Transforms/Utils/Local.h"
#include "llvm/Analysis/ValueTracking.h"
#include "llvm/IR/Argument.h"
#include "llvm/IR/Attributes.h"
#include "llvm/IR/BasicBlock.h"
#include "llvm/IR/CallSite.h"
#include "llvm/IR/Constant.h"
#include "llvm/IR/Constants.h"
#include "llvm/IR/DataLayout.h"
#include "llvm/IR/DerivedTypes.h"
#include "llvm/IR/Dominators.h"
#include "llvm/IR/Function.h"
#include "llvm/IR/GlobalAlias.h"
#include "llvm/IR/GlobalValue.h"
#include "llvm/IR/GlobalVariable.h"
#include "llvm/IR/IRBuilder.h"
#include "llvm/IR/InlineAsm.h"
#include "llvm/IR/InstVisitor.h"
#include "llvm/IR/InstrTypes.h"
#include "llvm/IR/Instruction.h"
#include "llvm/IR/Instructions.h"
#include "llvm/IR/IntrinsicInst.h"
#include "llvm/IR/LLVMContext.h"
#include "llvm/IR/MDBuilder.h"
#include "llvm/IR/Module.h"
#include "llvm/IR/Type.h"
#include "llvm/IR/User.h"
#include "llvm/IR/Value.h"
#include "llvm/Pass.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/CommandLine.h"
#include "llvm/Support/ErrorHandling.h"
#include "llvm/Support/SpecialCaseList.h"
#include "llvm/Transforms/Instrumentation.h"
#include "llvm/Transforms/Utils/BasicBlockUtils.h"
#include <algorithm>
#include <cassert>
#include <cstddef>
#include <cstdint>
#include <iterator>
#include <memory>
#include <set>
#include <string>
#include <utility>
#include <vector>

Functions
static StringRef	GetGlobalTypeString (const GlobalValue &G)

	INITIALIZE_PASS (DataFlowSanitizer, "dfsan", "DataFlowSanitizer: dynamic data flow analysis.", false, false) ModulePass *llvm

Variables
static const char *const	kDFSanExternShadowPtrMask = "__dfsan_shadow_ptr_mask"

static cl::opt< bool >	ClPreserveAlignment ("dfsan-preserve-alignment", cl::desc("respect alignment requirements provided by input IR"), cl::Hidden, cl::init(false))

static cl::list< std::string >	ClABIListFiles ("dfsan-abilist", cl::desc("File listing native ABI functions and how the pass treats them"), cl::Hidden)

static cl::opt< bool >	ClArgsABI ("dfsan-args-abi", cl::desc("Use the argument ABI rather than the TLS ABI"), cl::Hidden)

static cl::opt< bool >	ClCombinePointerLabelsOnLoad ("dfsan-combine-pointer-labels-on-load", cl::desc("Combine the label of the pointer with the label of the data when " "loading from memory."), cl::Hidden, cl::init(true))

static cl::opt< bool >	ClCombinePointerLabelsOnStore ("dfsan-combine-pointer-labels-on-store", cl::desc("Combine the label of the pointer with the label of the data when " "storing in memory."), cl::Hidden, cl::init(false))

static cl::opt< bool >	ClDebugNonzeroLabels ("dfsan-debug-nonzero-labels", cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, " "load or return with a nonzero label"), cl::Hidden)

Detailed Description

This file is a part of DataFlowSanitizer, a generalised dynamic data flow analysis.

Unlike other Sanitizer tools, this tool is not designed to detect a specific class of bugs on its own. Instead, it provides a generic dynamic data flow analysis framework to be used by clients to help detect application-specific issues within their own code.

The analysis is based on automatic propagation of data flow labels (also known as taint labels) through a program as it performs computation. Each byte of application memory is backed by two bytes of shadow memory which hold the label. On Linux/x86_64, memory is laid out as follows:

To derive a shadow memory address from an application memory address, bits 44-46 are cleared to bring the address into the range [0x000000008000,0x100000000000). Then the address is shifted left by 1 to account for the double byte representation of shadow labels and move the address into the shadow memory range. See the function DataFlowSanitizer::getShadowAddress below.

For more information, please refer to the design document: http://clang.llvm.org/docs/DataFlowSanitizerDesign.html

Definition in file DataFlowSanitizer.cpp.

Function Documentation

◆ GetGlobalTypeString()

static StringRef GetGlobalTypeString ( const GlobalValue & G )

static

◆ INITIALIZE_PASS()

INITIALIZE_PASS	(	DataFlowSanitizer	,
		"dfsan"	,
		"DataFlowSanitizer: dynamic data flow analysis."	,
		false	,
		false
	)

Definition at line 465 of file DataFlowSanitizer.cpp.

Variable Documentation

◆ ClABIListFiles

cl::list<std::string> ClABIListFiles("dfsan-abilist", cl::desc("File listing native ABI functions and how the pass treats them"), cl::Hidden)

static

Referenced by INITIALIZE_PASS().

◆ ClArgsABI

cl::opt<bool> ClArgsABI("dfsan-args-abi", cl::desc("Use the argument ABI rather than the TLS ABI"), cl::Hidden)

static

Referenced by INITIALIZE_PASS().

◆ ClCombinePointerLabelsOnLoad

cl::opt<bool> ClCombinePointerLabelsOnLoad("dfsan-combine-pointer-labels-on-load", cl::desc("Combine the label of the pointer with the label of the data when " "loading from memory."), cl::Hidden, cl::init(true))

static

Referenced by INITIALIZE_PASS().

◆ ClCombinePointerLabelsOnStore

cl::opt<bool> ClCombinePointerLabelsOnStore("dfsan-combine-pointer-labels-on-store", cl::desc("Combine the label of the pointer with the label of the data when " "storing in memory."), cl::Hidden, cl::init(false))

static

Referenced by INITIALIZE_PASS().

◆ ClDebugNonzeroLabels

cl::opt<bool> ClDebugNonzeroLabels("dfsan-debug-nonzero-labels", cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, " "load or return with a nonzero label"), cl::Hidden)

static

Referenced by INITIALIZE_PASS().

◆ ClPreserveAlignment

cl::opt<bool> ClPreserveAlignment("dfsan-preserve-alignment", cl::desc("respect alignment requirements provided by input IR"), cl::Hidden, cl::init(false))

static

Referenced by INITIALIZE_PASS().

◆ kDFSanExternShadowPtrMask

const char* const kDFSanExternShadowPtrMask = "__dfsan_shadow_ptr_mask"

static

Definition at line 109 of file DataFlowSanitizer.cpp.

Functions

Variables

Detailed Description

Function Documentation

◆ GetGlobalTypeString()

◆ INITIALIZE_PASS()

Variable Documentation

◆ ClABIListFiles

◆ ClArgsABI

◆ ClCombinePointerLabelsOnLoad

◆ ClCombinePointerLabelsOnStore

◆ ClDebugNonzeroLabels

◆ ClPreserveAlignment

◆ kDFSanExternShadowPtrMask