DataFlowSanitizer.cpp File Reference

This file is a part of DataFlowSanitizer, a generalised dynamic data flow analysis. More...

#include "llvm/Transforms/Instrumentation/DataFlowSanitizer.h"
#include "InstrumentationOptions.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/ADT/DenseSet.h"
#include "llvm/ADT/DepthFirstIterator.h"
#include "llvm/ADT/SmallPtrSet.h"
#include "llvm/ADT/SmallVector.h"
#include "llvm/ADT/StringRef.h"
#include "llvm/ADT/StringSet.h"
#include "llvm/ADT/iterator.h"
#include "llvm/Analysis/DomTreeUpdater.h"
#include "llvm/Analysis/GlobalsModRef.h"
#include "llvm/Analysis/TargetLibraryInfo.h"
#include "llvm/Analysis/ValueTracking.h"
#include "llvm/IR/Argument.h"
#include "llvm/IR/AttributeMask.h"
#include "llvm/IR/Attributes.h"
#include "llvm/IR/BasicBlock.h"
#include "llvm/IR/Constant.h"
#include "llvm/IR/Constants.h"
#include "llvm/IR/DataLayout.h"
#include "llvm/IR/DerivedTypes.h"
#include "llvm/IR/Dominators.h"
#include "llvm/IR/Function.h"
#include "llvm/IR/GlobalAlias.h"
#include "llvm/IR/GlobalValue.h"
#include "llvm/IR/GlobalVariable.h"
#include "llvm/IR/IRBuilder.h"
#include "llvm/IR/InstVisitor.h"
#include "llvm/IR/InstrTypes.h"
#include "llvm/IR/Instruction.h"
#include "llvm/IR/Instructions.h"
#include "llvm/IR/IntrinsicInst.h"
#include "llvm/IR/MDBuilder.h"
#include "llvm/IR/Module.h"
#include "llvm/IR/PassManager.h"
#include "llvm/IR/Type.h"
#include "llvm/IR/User.h"
#include "llvm/IR/Value.h"
#include "llvm/Support/Alignment.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/ErrorHandling.h"
#include "llvm/Support/SpecialCaseList.h"
#include "llvm/Support/VirtualFileSystem.h"
#include "llvm/TargetParser/Triple.h"
#include "llvm/Transforms/Utils/BasicBlockUtils.h"
#include "llvm/Transforms/Utils/Instrumentation.h"
#include "llvm/Transforms/Utils/Local.h"
#include <algorithm>
#include <cassert>
#include <cstddef>
#include <cstdint>
#include <memory>
#include <set>
#include <string>
#include <utility>
#include <vector>

Go to the source code of this file.

Functions
static StringRef	getGlobalTypeString (const GlobalValue &G)
static Value *	expandFromPrimitiveShadowRecursive (Value *Shadow, SmallVector< unsigned, 4 > &Indices, Type *SubShadowTy, Value *PrimitiveShadow, IRBuilder<> &IRB)
static AtomicOrdering	addAcquireOrdering (AtomicOrdering AO)
Value *	StripPointerGEPsAndCasts (Value *V)
static AtomicOrdering	addReleaseOrdering (AtomicOrdering AO)
static bool	isAMustTailRetVal (Value *RetVal)

Variables
static const Align	ShadowTLSAlignment = Align(2)
static const Align	MinOriginAlignment = Align(4)
static const unsigned	ArgTLSSize = 800
static const unsigned	RetvalTLSSize = 800
const MemoryMapParams	Linux_AArch64_MemoryMapParams
const MemoryMapParams	Linux_X86_64_MemoryMapParams
const MemoryMapParams	Linux_LoongArch64_MemoryMapParams
const MemoryMapParams	Linux_S390X_MemoryMapParams

Detailed Description

This file is a part of DataFlowSanitizer, a generalised dynamic data flow analysis.

Unlike other Sanitizer tools, this tool is not designed to detect a specific class of bugs on its own. Instead, it provides a generic dynamic data flow analysis framework to be used by clients to help detect application-specific issues within their own code.

The analysis is based on automatic propagation of data flow labels (also known as taint labels) through a program as it performs computation.

Argument and return value labels are passed through TLS variables __dfsan_arg_tls and __dfsan_retval_tls.

Each byte of application memory is backed by a shadow memory byte. The shadow byte can represent up to 8 labels. On Linux/x86_64, memory is then laid out as follows:

+-----------------—+ 0x800000000000 (top of memory) | application 3 | +-----------------—+ 0x700000000000 | invalid | +-----------------—+ 0x610000000000 | origin 1 | +-----------------—+ 0x600000000000 | application 2 | +-----------------—+ 0x510000000000 | shadow 1 | +-----------------—+ 0x500000000000 | invalid | +-----------------—+ 0x400000000000 | origin 3 | +-----------------—+ 0x300000000000 | shadow 3 | +-----------------—+ 0x200000000000 | origin 2 | +-----------------—+ 0x110000000000 | invalid | +-----------------—+ 0x100000000000 | shadow 2 | +-----------------—+ 0x010000000000 | application 1 | +-----------------—+ 0x000000000000

MEM_TO_SHADOW(mem) = mem ^ 0x500000000000 SHADOW_TO_ORIGIN(shadow) = shadow + 0x100000000000

For more information, please refer to the design document: http://clang.llvm.org/docs/DataFlowSanitizerDesign.html

Definition in file DataFlowSanitizer.cpp.

Function Documentation

addAcquireOrdering()

AtomicOrdering addAcquireOrdering ( AtomicOrdering AO )

static

Definition at line 2304 of file DataFlowSanitizer.cpp.

References llvm::Acquire, llvm::AcquireRelease, llvm_unreachable, llvm::Monotonic, llvm::NotAtomic, llvm::Release, llvm::SequentiallyConsistent, and llvm::Unordered.

addReleaseOrdering()

AtomicOrdering addReleaseOrdering ( AtomicOrdering AO )

static

Definition at line 2594 of file DataFlowSanitizer.cpp.

References llvm::Acquire, llvm::AcquireRelease, llvm_unreachable, llvm::Monotonic, llvm::NotAtomic, llvm::Release, llvm::SequentiallyConsistent, and llvm::Unordered.

expandFromPrimitiveShadowRecursive()

Value * expandFromPrimitiveShadowRecursive ( Value * Shadow, SmallVector< unsigned, 4 > & Indices, Type * SubShadowTy, Value * PrimitiveShadow, IRBuilder<> & IRB )

static

Definition at line 865 of file DataFlowSanitizer.cpp.

References llvm::IRBuilderBase::CreateInsertValue(), llvm::dyn_cast(), expandFromPrimitiveShadowRecursive(), llvm::isa(), llvm_unreachable, llvm::SmallVectorTemplateBase< T, bool >::pop_back(), and llvm::SmallVectorTemplateBase< T, bool >::push_back().

Referenced by expandFromPrimitiveShadowRecursive().

getGlobalTypeString()

StringRef getGlobalTypeString ( const GlobalValue & G )

static

Definition at line 149 of file DataFlowSanitizer.cpp.

References llvm::dyn_cast(), and G.

isAMustTailRetVal()

bool isAMustTailRetVal ( Value * RetVal )

static

Definition at line 2920 of file DataFlowSanitizer.cpp.

References llvm::dyn_cast(), and I.

StripPointerGEPsAndCasts()

Value * StripPointerGEPsAndCasts

(

Value *

V

)

Definition at line 2321 of file DataFlowSanitizer.cpp.

References llvm::cast(), llvm::dyn_cast(), GEP, llvm::Operator::getOpcode(), llvm::SmallPtrSetImpl< PtrType >::insert(), and llvm::isa().

Variable Documentation

ArgTLSSize

const unsigned ArgTLSSize = 800

static

Definition at line 129 of file DataFlowSanitizer.cpp.

Linux_AArch64_MemoryMapParams

const MemoryMapParams Linux_AArch64_MemoryMapParams

Initial value:

= {
    0,               
    0x0B00000000000, 
    0,               
    0x0200000000000, 
}

Definition at line 177 of file DataFlowSanitizer.cpp.

Linux_LoongArch64_MemoryMapParams

const MemoryMapParams Linux_LoongArch64_MemoryMapParams

Initial value:

= {
    0,              
    0x500000000000, 
    0,              
    0x100000000000, 
}

Definition at line 194 of file DataFlowSanitizer.cpp.

Linux_S390X_MemoryMapParams

const MemoryMapParams Linux_S390X_MemoryMapParams

Initial value:

= {
    0xC00000000000, 
    0,              
    0x080000000000, 
    0x1C0000000000, 
}

Definition at line 202 of file DataFlowSanitizer.cpp.

Linux_X86_64_MemoryMapParams

const MemoryMapParams Linux_X86_64_MemoryMapParams

Initial value:

= {
    0,              
    0x500000000000, 
    0,              
    0x100000000000, 
}

Definition at line 185 of file DataFlowSanitizer.cpp.

MinOriginAlignment

const Align MinOriginAlignment = Align(4)

static

Definition at line 125 of file DataFlowSanitizer.cpp.

RetvalTLSSize

const unsigned RetvalTLSSize = 800

static

Definition at line 130 of file DataFlowSanitizer.cpp.

ShadowTLSAlignment

const Align ShadowTLSAlignment = Align(2)

static

Definition at line 123 of file DataFlowSanitizer.cpp.