Commit Graph

255 Commits

Author SHA1 Message Date
Stephan Bergmann e215996a29 Finish "Adapt -fsanitize=function to SANITIZER_NON_UNIQUE_TYPEINFO"
i.e., recent 5745eccef54ddd3caca278d1d292a88b2281528b:

* Bump the function_type_mismatch handler version, as its signature has changed.

* The function_type_mismatch handler can return successfully now, so
  SanitizerKind::Function must be AlwaysRecoverable (like for
  SanitizerKind::Vptr).

* But the minimal runtime would still unconditionally treat a call to the
  function_type_mismatch handler as failure, so disallow -fsanitize=function in
  combination with -fsanitize-minimal-runtime (like it was already done for
  -fsanitize=vptr).

* Add tests.

Differential Revision: https://reviews.llvm.org/D61479

llvm-svn: 366186
2019-07-16 06:23:27 +00:00
Evgeniy Stepanov c5e7f56249 ARM MTE stack sanitizer.
Add "memtag" sanitizer that detects and mitigates stack memory issues
using armv8.5 Memory Tagging Extension.

It is similar in principle to HWASan, which is a software implementation
of the same idea, but there are enough differencies to warrant a new
sanitizer type IMHO. It is also expected to have very different
performance properties.

The new sanitizer does not have a runtime library (it may grow one
later, along with a "debugging" mode). Similar to SafeStack and
StackProtector, the instrumentation pass (in a follow up change) will be
inserted in all cases, but will only affect functions marked with the
new sanitize_memtag attribute.

Reviewers: pcc, hctim, vitalybuka, ostannard

Subscribers: srhines, mehdi_amini, javed.absar, kristof.beyls, hiraditya, cryptoad, steven_wu, dexonsmith, cfe-commits, llvm-commits

Tags: #clang, #llvm

Differential Revision: https://reviews.llvm.org/D64169

llvm-svn: 366123
2019-07-15 20:02:23 +00:00
Fangrui Song 9c147bd40b [Driver] Add float-divide-by-zero back to supported sanitizers after D63793/rC365272
D63793 removed float-divide-by-zero from the "undefined" set but it
failed to add it to getSupportedSanitizers(), thus the sanitizer is
rejected by the driver:

    clang-9: error: unsupported option '-fsanitize=float-divide-by-zero' for target 'x86_64-unknown-linux-gnu'

Also, add SanitizerMask::FloatDivideByZero to a few other masks to make -fsanitize-trap, -fsanitize-recover, -fsanitize-minimal-runtime and -fsanitize-coverage work.

Reviewed By: rsmith, vitalybuka

Differential Revision: https://reviews.llvm.org/D64317

llvm-svn: 365587
2019-07-10 00:30:02 +00:00
Pierre Gousseau 1e39fc1faa [asan] Add gcc 8's driver option -fsanitize=pointer-compare and -fsanitize=pointer-substract.
Disabled by default as this is still an experimental feature.

Reviewed By: thakis

Differential Revision: https://reviews.llvm.org/D59221

llvm-svn: 358285
2019-04-12 14:14:58 +00:00
Pierre Gousseau 0b9527119f [Driver] Enable -fsanitize-address-globals-dead-stripping by default on PS4.
Can be safely enabled on PS4.

Reviewed By: probinson

Differential Revision: https://reviews.llvm.org/D59815

llvm-svn: 357480
2019-04-02 15:20:26 +00:00
Nico Weber 885b790f89 Remove esan.
It hasn't seen active development in years, and it hasn't reached a
state where it was useful.

Remove the code until someone is interested in working on it again.

Differential Revision: https://reviews.llvm.org/D59133

llvm-svn: 355862
2019-03-11 20:23:40 +00:00
Pierre Gousseau ae5303d010 [Driver] Allow enum SanitizerOrdinal to represent more than 64 different sanitizer checks, NFC.
enum SanitizerOrdinal has reached maximum capacity, this change extends the capacity to 128 sanitizer checks.
This can eventually allow us to add gcc 8's options "-fsanitize=pointer-substract" and "-fsanitize=pointer-compare".

This is a recommit of r354873 but with a fix for unqualified lookup error in lldb cmake build bot.

Fixes: https://llvm.org/PR39425

Differential Revision: https://reviews.llvm.org/D57914

llvm-svn: 355190
2019-03-01 10:05:15 +00:00
Pierre Gousseau 40ad3d2aa4 revert r354873 as this breaks lldb builds.
llvm-svn: 354875
2019-02-26 13:50:29 +00:00
Pierre Gousseau 44fad947a5 [Driver] Allow enum SanitizerOrdinal to represent more than 64 different sanitizer checks, NFC.
enum SanitizerOrdinal has reached maximum capacity, this change extends the capacity to 128 sanitizer checks.
This can eventually allow us to add gcc 8's options "-fsanitize=pointer-substract" and "-fsanitize=pointer-compare".

Fixes: https://llvm.org/PR39425

Differential Revision: https://reviews.llvm.org/D57914

llvm-svn: 354873
2019-02-26 13:30:14 +00:00
Pierre Gousseau 8198b7e7a9 Test commit: fix typo.
llvm-svn: 352042
2019-01-24 11:44:24 +00:00
Chandler Carruth 2946cd7010 Update the file headers across all of the LLVM projects in the monorepo
to reflect the new license.

We understand that people may be surprised that we're moving the header
entirely to discuss the new license. We checked this carefully with the
Foundation's lawyer and we believe this is the correct approach.

Essentially, all code in the project is now made available by the LLVM
project under our new license, so you will see that the license headers
include that license only. Some of our contributors have contributed
code under our old license, and accordingly, we have retained a copy of
our old license notice in the top-level files in each project and
repository.

llvm-svn: 351636
2019-01-19 08:50:56 +00:00
Teresa Johnson 84cecfcb3d [LTO] Add option to enable LTOUnit splitting, and disable unless needed
Summary:
Adds a new -f[no]split-lto-unit flag that is disabled by default to
control module splitting during ThinLTO. It is automatically enabled
for -fsanitize=cfi and -fwhole-program-vtables.

The new EnableSplitLTOUnit codegen flag is passed down to llvm
via a new module flag of the same name.

Depends on D53890.

Reviewers: pcc

Subscribers: ormris, mehdi_amini, inglorion, eraman, steven_wu, dexonsmith, cfe-commits, llvm-commits

Differential Revision: https://reviews.llvm.org/D53891

llvm-svn: 350949
2019-01-11 18:32:07 +00:00
Peter Collingbourne 87f477b5e4 hwasan: Implement lazy thread initialization for the interceptor ABI.
The problem is similar to D55986 but for threads: a process with the
interceptor hwasan library loaded might have some threads started by
instrumented libraries and some by uninstrumented libraries, and we
need to be able to run instrumented code on the latter.

The solution is to perform per-thread initialization lazily. If a
function needs to access shadow memory or add itself to the per-thread
ring buffer its prologue checks to see whether the value in the
sanitizer TLS slot is null, and if so it calls __hwasan_thread_enter
and reloads from the TLS slot. The runtime does the same thing if it
needs to access this data structure.

This change means that the code generator needs to know whether we
are targeting the interceptor runtime, since we don't want to pay
the cost of lazy initialization when targeting a platform with native
hwasan support. A flag -fsanitize-hwaddress-abi={interceptor,platform}
has been introduced for selecting the runtime ABI to target. The
default ABI is set to interceptor since it's assumed that it will
be more common that users will be compiling application code than
platform code.

Because we can no longer assume that the TLS slot is initialized,
the pthread_create interceptor is no longer necessary, so it has
been removed.

Ideally, lazy initialization should only cost one instruction in the
hot path, but at present the call may cause us to spill arguments
to the stack, which means more instructions in the hot path (or
theoretically in the cold path if the spills are moved with shrink
wrapping). With an appropriately chosen calling convention for
the per-thread initialization function (TODO) the hot path should
always need just one instruction and the cold path should need two
instructions with no spilling required.

Differential Revision: https://reviews.llvm.org/D56038

llvm-svn: 350429
2019-01-04 19:27:04 +00:00
Vitaly Buka 8076c57fd2 [asan] Add clang flag -fsanitize-address-use-odr-indicator
Reviewers: eugenis, m.ostapenko, ygribov

Subscribers: hiraditya, llvm-commits

Differential Revision: https://reviews.llvm.org/D55157

llvm-svn: 348327
2018-12-05 01:44:31 +00:00
Peter Collingbourne b5e19658a2 Driver: SCS is compatible with every other sanitizer.
Because SCS relies on system-provided runtime support, we can use it
together with any other sanitizer simply by linking the runtime for
the other sanitizer.

Differential Revision: https://reviews.llvm.org/D54735

llvm-svn: 347282
2018-11-20 01:01:49 +00:00
Peter Collingbourne c97638556b Driver: Make -fsanitize=shadow-call-stack compatible with -fsanitize-minimal-runtime.
Differential Revision: https://reviews.llvm.org/D54330

llvm-svn: 346526
2018-11-09 17:54:49 +00:00
Filipe Cabecinhas 0eb5008352 Change -fsanitize-address-poison-class-member-array-new-cookie to -fsanitize-address-poison-custom-array-cookie
Handle it in the driver and propagate it to cc1

Reviewers: rjmccall, kcc, rsmith

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D52615

llvm-svn: 346001
2018-11-02 17:29:04 +00:00
Alexander Potapenko d49c32ce3f [MSan] add KMSAN support to Clang driver
Boilerplate code for using KMSAN instrumentation in Clang.

We add a new command line flag, -fsanitize=kernel-memory, with a
corresponding SanitizerKind::KernelMemory, which, along with
SanitizerKind::Memory, maps to the memory_sanitizer feature.

KMSAN is only supported on x86_64 Linux.

It's incompatible with other sanitizers, but supports code coverage
instrumentation.

llvm-svn: 341641
2018-09-07 09:21:09 +00:00
Fangrui Song 6907ce2f8f Remove trailing space
sed -Ei 's/[[:space:]]+$//' include/**/*.{def,h,td} lib/**/*.{cpp,h}

llvm-svn: 338291
2018-07-30 19:24:48 +00:00
Roman Lebedev b69ba22773 [clang][ubsan] Implicit Conversion Sanitizer - integer truncation - clang part
Summary:
C and C++ are interesting languages. They are statically typed, but weakly.
The implicit conversions are allowed. This is nice, allows to write code
while balancing between getting drowned in everything being convertible,
and nothing being convertible. As usual, this comes with a price:

```
unsigned char store = 0;

bool consume(unsigned int val);

void test(unsigned long val) {
  if (consume(val)) {
    // the 'val' is `unsigned long`, but `consume()` takes `unsigned int`.
    // If their bit widths are different on this platform, the implicit
    // truncation happens. And if that `unsigned long` had a value bigger
    // than UINT_MAX, then you may or may not have a bug.

    // Similarly, integer addition happens on `int`s, so `store` will
    // be promoted to an `int`, the sum calculated (0+768=768),
    // and the result demoted to `unsigned char`, and stored to `store`.
    // In this case, the `store` will still be 0. Again, not always intended.
    store = store + 768; // before addition, 'store' was promoted to int.
  }

  // But yes, sometimes this is intentional.
  // You can either make the conversion explicit
  (void)consume((unsigned int)val);
  // or mask the value so no bits will be *implicitly* lost.
  (void)consume((~((unsigned int)0)) & val);
}
```

Yes, there is a `-Wconversion`` diagnostic group, but first, it is kinda
noisy, since it warns on everything (unlike sanitizers, warning on an
actual issues), and second, there are cases where it does **not** warn.
So a Sanitizer is needed. I don't have any motivational numbers, but i know
i had this kind of problem 10-20 times, and it was never easy to track down.

The logic to detect whether an truncation has happened is pretty simple
if you think about it - https://godbolt.org/g/NEzXbb - basically, just
extend (using the new, not original!, signedness) the 'truncated' value
back to it's original width, and equality-compare it with the original value.

The most non-trivial thing here is the logic to detect whether this
`ImplicitCastExpr` AST node is **actually** an implicit conversion, //or//
part of an explicit cast. Because the explicit casts are modeled as an outer
`ExplicitCastExpr` with some `ImplicitCastExpr`'s as **direct** children.
https://godbolt.org/g/eE1GkJ

Nowadays, we can just use the new `part_of_explicit_cast` flag, which is set
on all the implicitly-added `ImplicitCastExpr`'s of an `ExplicitCastExpr`.
So if that flag is **not** set, then it is an actual implicit conversion.

As you may have noted, this isn't just named `-fsanitize=implicit-integer-truncation`.
There are potentially some more implicit conversions to be warned about.
Namely, implicit conversions that result in sign change; implicit conversion
between different floating point types, or between fp and an integer,
when again, that conversion is lossy.

One thing i know isn't handled is bitfields.

This is a clang part.
The compiler-rt part is D48959.

Fixes [[ https://bugs.llvm.org/show_bug.cgi?id=21530 | PR21530 ]], [[ https://bugs.llvm.org/show_bug.cgi?id=37552 | PR37552 ]], [[ https://bugs.llvm.org/show_bug.cgi?id=35409 | PR35409 ]].
Partially fixes [[ https://bugs.llvm.org/show_bug.cgi?id=9821 | PR9821 ]].
Fixes https://github.com/google/sanitizers/issues/940. (other than sign-changing implicit conversions)

Reviewers: rjmccall, rsmith, samsonov, pcc, vsk, eugenis, efriedma, kcc, erichkeane

Reviewed By: rsmith, vsk, erichkeane

Subscribers: erichkeane, klimek, #sanitizers, aaron.ballman, RKSimon, dtzWill, filcab, danielaustin, ygribov, dvyukov, milianw, mclow.lists, cfe-commits, regehr

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D48958

llvm-svn: 338288
2018-07-30 18:58:30 +00:00
Peter Collingbourne e44acadf6a Implement CFI for indirect calls via a member function pointer.
Similarly to CFI on virtual and indirect calls, this implementation
tries to use program type information to make the checks as precise
as possible.  The basic way that it works is as follows, where `C`
is the name of the class being defined or the target of a call and
the function type is assumed to be `void()`.

For virtual calls:
- Attach type metadata to the addresses of function pointers in vtables
  (not the functions themselves) of type `void (B::*)()` for each `B`
  that is a recursive dynamic base class of `C`, including `C` itself.
  This type metadata has an annotation that the type is for virtual
  calls (to distinguish it from the non-virtual case).
- At the call site, check that the computed address of the function
  pointer in the vtable has type `void (C::*)()`.

For non-virtual calls:
- Attach type metadata to each non-virtual member function whose address
  can be taken with a member function pointer. The type of a function
  in class `C` of type `void()` is each of the types `void (B::*)()`
  where `B` is a most-base class of `C`. A most-base class of `C`
  is defined as a recursive base class of `C`, including `C` itself,
  that does not have any bases.
- At the call site, check that the function pointer has one of the types
  `void (B::*)()` where `B` is a most-base class of `C`.

Differential Revision: https://reviews.llvm.org/D47567

llvm-svn: 335569
2018-06-26 02:15:47 +00:00
Kostya Kortchinsky 64d8093691 [Driver] Make scudo compatible with -fsanitize-minimal-runtime
Summary:
This is the clang side of the change, there is a compiler-rt counterpart.

Scudo works with UBSan using `-fsanitize=scudo,integer` for example, and to do
so it embeds UBSan runtime. This makes it not compatible with the UBSan minimal
runtime, but this is something we want for production purposes.

The idea is to have a Scudo minimal runtime on the compiler-rt side that will
not embed UBSan. This is basically the runtime that is currently in use for
Fuchsia, without coverage, stacktraces or symbolization. With this, Scudo
becomes compatible with `-fsanitize-minimal-runtime`.

If this approach is suitable, I'll add the tests as well, otherwise I am open
to other options.

Reviewers: eugenis

Reviewed By: eugenis

Subscribers: llvm-commits, cfe-commits

Differential Revision: https://reviews.llvm.org/D48373

llvm-svn: 335352
2018-06-22 14:31:30 +00:00
Sunil Srivastava 2ada2499ea Do not enable RTTI with -fexceptions, for PS4
NFC for targets other than PS4.

This patch is a change in behavior for PS4, in that PS4 will no longer enable
RTTI when -fexceptions is specified (RTTI and Exceptions are disabled by default
on PS4). RTTI will remain disabled except for types being thrown or caught.
Also, '-fexceptions -fno-rtti' (previously prohibited on PS4) is now accepted,
as it is for other targets.

This patch removes some PS4 specific code, making the code cleaner.

Also, in the test file rtti-options.cpp, PS4 tests where the behavior is the
same as the generic x86_64-linux are removed, making the test cleaner.

Differential Revision: https://reviews.llvm.org/D46982

llvm-svn: 332784
2018-05-18 23:32:01 +00:00
Peter Collingbourne 374599cf23 [CFI] Force LLVM to die if the implicit blacklist files cannot be found.
Currently LLVM CFI tries to use an implicit blacklist file, currently
in /usr/lib64/clang/<version>/share. If the file is not there, LLVM
happily continues, which causes CFI to add checks to files/functions
that are known to fail, generating binaries that fail. This CL causes
LLVM to die (I hope) if it can't find these implicit blacklist files.

Patch by Caroline Tice!

Differential Revision: https://reviews.llvm.org/D46403

llvm-svn: 331674
2018-05-07 20:54:05 +00:00
Andrey Konovalov 1ba9d9c6ca hwasan: add -fsanitize=kernel-hwaddress flag
This patch adds -fsanitize=kernel-hwaddress flag, that essentially enables
-hwasan-kernel=1 -hwasan-recover=1 -hwasan-match-all-tag=0xff.

Differential Revision: https://reviews.llvm.org/D45046

llvm-svn: 330044
2018-04-13 18:05:21 +00:00
Peter Collingbourne f11eb3ebe7 AArch64: Implement support for the shadowcallstack attribute.
The implementation of shadow call stack on aarch64 is quite different to
the implementation on x86_64. Instead of reserving a segment register for
the shadow call stack, we reserve the platform register, x18. Any function
that spills lr to sp also spills it to the shadow call stack, a pointer to
which is stored in x18.

Differential Revision: https://reviews.llvm.org/D45239

llvm-svn: 329236
2018-04-04 21:55:44 +00:00
Vlad Tsyrklevich e55aa03ad4 Add the -fsanitize=shadow-call-stack flag
Summary:
Add support for the -fsanitize=shadow-call-stack flag which causes clang
to add ShadowCallStack attribute to functions compiled with that flag
enabled.

Reviewers: pcc, kcc

Reviewed By: pcc, kcc

Subscribers: cryptoad, cfe-commits, kcc

Differential Revision: https://reviews.llvm.org/D44801

llvm-svn: 329122
2018-04-03 22:33:53 +00:00
Alex Shlyapnikov 0a20cefffd [HWASan] Port HWASan to Linux x86-64 (clang)
Summary: Porting HWASan to Linux x86-64, the third of the three patches, clang part.

Reviewers: eugenis

Subscribers: cryptoad, cfe-commits

Differential Revision: https://reviews.llvm.org/D44745

llvm-svn: 328361
2018-03-23 19:47:45 +00:00
Petr Hosek 8b8d6bf62f [Driver] Update the comment about incompatible sanitizers
Differential Revision: https://reviews.llvm.org/D44371

llvm-svn: 327249
2018-03-12 00:23:37 +00:00
Petr Hosek a14b46073e [Driver] Automatically disable incompatible default sanitizers
When a sanitizer incompatible with one of the default sanitizers
is explicitly enabled, automatically disable all the conflicting
default sanitizers.

Differential Revision: https://reviews.llvm.org/D44064

llvm-svn: 326860
2018-03-07 01:27:03 +00:00
Petr Hosek a459dab937 [Driver] Add SafeStack to a map of incompatible sanitizers
This allows reporting an error when user tries to use SafeStack with
incompatible sanitizers.

Differential Revision: https://reviews.llvm.org/D43606

llvm-svn: 326151
2018-02-27 00:01:26 +00:00
Richard Smith 6cd4861c22 When multiple sanitizers are enabled (ubsan + something else), use all relevant blacklists.
Ideally, we'd only use the ubsan blacklist for ubsan sanitizers, and only use
the other-sanitizer blacklist for its sanitizers, but this at least enables the
intended suppressions.

llvm-svn: 325640
2018-02-20 23:17:41 +00:00
Petr Hosek 84d036a0d1 Reland "[Driver] Update default sanitizer blacklist location"
This is related to moving the sanitizer blacklists to share/
subdirectory.

Differential Revision: https://reviews.llvm.org/D41706

llvm-svn: 322452
2018-01-14 03:43:17 +00:00
Petr Hosek 605d3b9225 Revert "[Driver] Update default sanitizer blacklist location"
This reverts commit r322258: broke the dfsan build.

llvm-svn: 322260
2018-01-11 07:05:38 +00:00
Petr Hosek bb9c6fc3bc Reland "[Driver] Update default sanitizer blacklist location"
This is related to moving the sanitizer blacklists to share/
subdirectory.

Differential Revision: https://reviews.llvm.org/D41706

llvm-svn: 322258
2018-01-11 06:42:12 +00:00
Petr Hosek aaf4da6c10 Revert "[Driver] Update default sanitizer blacklist location"
This reverts commit r322233: this is breaking dfsan tests.

llvm-svn: 322242
2018-01-11 00:12:02 +00:00
Petr Hosek 7e48abc764 Reland "[Driver] Update default sanitizer blacklist location"
This is related to moving the sanitizer blacklists to share/
subdirectory.

Differential Revision: https://reviews.llvm.org/D41706

llvm-svn: 322233
2018-01-10 22:59:00 +00:00
Petr Hosek 1747f3572e Revert "[Driver] Update default sanitizer blacklist location"
This reverts commit r322154 because it broke sanitizer bots.

llvm-svn: 322155
2018-01-10 02:24:09 +00:00
Petr Hosek b931670ae6 [Driver] Update default sanitizer blacklist location
This is related to moving the sanitizer blacklists to share/
subdirectory.

Differential Revision: https://reviews.llvm.org/D41706

llvm-svn: 322154
2018-01-10 02:12:24 +00:00
Benjamin Kramer 3a13ed60ba Avoid int to string conversion in Twine or raw_ostream contexts.
Some output changes from uppercase hex to lowercase hex, no other functionality change intended.

llvm-svn: 321526
2017-12-28 16:58:54 +00:00
Vedant Kumar fae4f7c681 [Driver] Ensure no overlap between trapping & recoverable sanitizers. NFC.
This is NFC because in EmitCheck(), -fsanitize-trap=X overrides
-fsanitize-recover=X.

llvm-svn: 321230
2017-12-21 00:10:24 +00:00
Evgeniy Stepanov 12817e59de Hardware-assisted AddressSanitizer (clang part).
Summary:
Driver, frontend and LLVM codegen for HWASan.
A clone of ASan, basically.

Reviewers: kcc, pcc, alekseyshl

Subscribers: srhines, javed.absar, cfe-commits

Differential Revision: https://reviews.llvm.org/D40936

llvm-svn: 320232
2017-12-09 01:32:07 +00:00
Hans Wennborg 5fd1f17370 Update a link to the old code.google.com bug tracker
llvm-svn: 318109
2017-11-13 23:27:54 +00:00
Kostya Kortchinsky 8acdc98271 [Driver] Add Scudo as a possible -fsanitize= option
Summary:
This change adds Scudo as a possible Sanitizer option via -fsanitize=.
This allows for easier static & shared linking of the Scudo library, it allows
us to enforce PIE (otherwise the security of the allocator is moot), and check
for incompatible Sanitizers combo.

In its current form, Scudo is not compatible with any other Sanitizer, but the
plan is to make it work in conjunction with UBsan (-fsanitize=scudo,undefined),
which will require additional work outside of the scope of this change.

Reviewers: eugenis, kcc, alekseyshl

Reviewed By: eugenis, alekseyshl

Subscribers: llvm-commits, srhines

Differential Revision: https://reviews.llvm.org/D39334

llvm-svn: 317337
2017-11-03 17:04:13 +00:00
Vlad Tsyrklevich 634c601fe3 [CFI] Add CFI-icall pointer type generalization
Summary:
This change allows generalizing pointers in type signatures used for
cfi-icall by enabling the -fsanitize-cfi-icall-generalize-pointers flag.
This works by 1) emitting an additional generalized type signature
metadata node for functions and 2) llvm.type.test()ing for the
generalized type for translation units with the flag specified.

This flag is incompatible with -fsanitize-cfi-cross-dso because it would
require emitting twice as many type hashes which would increase artifact
size.

Reviewers: pcc, eugenis

Reviewed By: pcc

Subscribers: kcc

Differential Revision: https://reviews.llvm.org/D39358

llvm-svn: 317044
2017-10-31 22:39:44 +00:00
Evgeniy Stepanov 117627c9a1 Enable -pie and --enable-new-dtags by default on Android.
Summary:
Also enable -no-pie on Gnu toolchain (previously available on Darwin only).

Non-PIE executables won't even start on recent Android, and DT_RPATH is ignored by the loader.

Reviewers: srhines, danalbert

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D38430

llvm-svn: 316606
2017-10-25 20:39:22 +00:00
Evgeniy Stepanov d5d36a162d Do not link clang_rt.cfi on Android.
Summary:
The OS provides cross-dso CFI support starting with Android O.
Trapping mode does not require any runtime at all, and diagnostic mode
requires just ubsan-standalone.

Reviewers: pcc

Subscribers: srhines, cfe-commits

Differential Revision: https://reviews.llvm.org/D38908

llvm-svn: 315921
2017-10-16 18:02:57 +00:00
Vedant Kumar 358d642f65 [Driver] Fix -static-libsan / -shared-libsan on Darwin
Don't ignore these flags on Darwin. The old behavior of using the
dynamic runtime when neither flag is passed is preserved.

llvm-svn: 315142
2017-10-07 01:42:09 +00:00
Evgeniy Stepanov 0876cfb2f4 Cleanup and generalize -shared-libasan.
Summary:
* Rename -shared-libasan to -shared-libsan, keeping the old name as alias.
* Add -static-libsan for targets that default to shared.
* Remove an Android special case. It is now possible (but untested) to use static compiler-rt libraries there.
* Support libclang_rt.ubsan_standalone as a shared library.

Unlike GCC, this change applies -shared-libsan / -static-libsan to all sanitizers.
I don't see a point in multiple flags like -shared-libubsan, considering that most sanitizers
are not compatible with each other, and each link has basically a single shared/static choice.

Reviewers: vitalybuka, kcc, rsmith

Subscribers: srhines, cfe-commits

Differential Revision: https://reviews.llvm.org/D38525

llvm-svn: 315015
2017-10-05 20:14:00 +00:00
Matt Morehouse 175625c8b8 [MSan] Specify use-after-dtor default value in header.
llvm-svn: 313319
2017-09-14 23:53:56 +00:00
Matt Morehouse bb26f86e6f [MSan] Add flag to disable use-after-dtor.
Summary: Flag is -fno-sanitize-use-after-dtor.

Reviewers: vitalybuka, eugenis, kcc

Reviewed By: vitalybuka, eugenis

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D37867

llvm-svn: 313314
2017-09-14 23:14:37 +00:00
Vedant Kumar 44ee6e4179 [ubsan] Extend default blacklist support to integer/nullability groups
The default blacklist should also apply when the integer or nullability
checks are enabled.

llvm-svn: 313062
2017-09-12 18:58:00 +00:00
Kostya Serebryany a523135f97 [libFuzzer] switch -fsanitize=fuzzer from trace-pc-guard to inline-8bit-counters
llvm-svn: 312346
2017-09-01 18:34:36 +00:00
Matt Morehouse 034126e507 [SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer
Summary:
- Don't sanitize __sancov_lowest_stack.
- Don't instrument leaf functions.
- Add CoverageStackDepth to Fuzzer and FuzzerNoLink.
- Only enable on Linux.

Reviewers: vitalybuka, kcc, george.karpenkov

Reviewed By: kcc

Subscribers: kubamracek, cfe-commits, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D37156

llvm-svn: 312185
2017-08-30 22:49:31 +00:00
Matt Morehouse ba2e61b357 Revert "[SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer"
This reverts r312026 due to bot breakage.

llvm-svn: 312047
2017-08-29 21:56:56 +00:00
Matt Morehouse 2edac86cdb Re-enable stack depth instrumentation on Windows.
Specified tls_model attribute properly. Should compile on Windows
now.

llvm-svn: 312037
2017-08-29 21:15:33 +00:00
Matt Morehouse c29c2c9b0c Disable stack depth tracking on Windows.
Windows doesn't support the tls_model attribute.

llvm-svn: 312032
2017-08-29 20:44:41 +00:00
Evgeniy Stepanov 6d2b6f0a5f Minimal runtime for UBSan.
Summary:
An implementation of ubsan runtime library suitable for use in production.

Minimal attack surface.
* No stack traces.
* Definitely no C++ demangling.
* No UBSAN_OPTIONS=log_file=/path (very suid-unfriendly). And no UBSAN_OPTIONS in general.
* as simple as possible

Minimal CPU and RAM overhead.
* Source locations unnecessary in the presence of (split) debug info.
* Values and types (as in A+B overflows T) can be reconstructed from register/stack dumps, once you know what type of error you are looking at.
* above two items save 3% binary size.

When UBSan is used with -ftrap-function=abort, sometimes it is hard to reason about failures. This library replaces abort with a slightly more informative message without much extra overhead. Since ubsan interface in not stable, this code must reside in compiler-rt.

Reviewers: pcc, kcc

Subscribers: srhines, mgorny, aprantl, krytarowski, llvm-commits

Differential Revision: https://reviews.llvm.org/D36810

llvm-svn: 312029
2017-08-29 20:03:51 +00:00
Matt Morehouse 2ad8d948b2 [SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer
Summary:
- Don't sanitize __sancov_lowest_stack.
- Don't instrument leaf functions.
- Add CoverageStackDepth to Fuzzer and FuzzerNoLink.
- Disable stack depth tracking on Mac.

Reviewers: vitalybuka, kcc, george.karpenkov

Reviewed By: kcc

Subscribers: kubamracek, cfe-commits, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D37156

llvm-svn: 312026
2017-08-29 19:48:12 +00:00
Matt Morehouse 6ec7595b1e Revert "[SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer"
This reverts r311801 due to a bot failure.

llvm-svn: 311803
2017-08-25 22:01:21 +00:00
Matt Morehouse f42bd31323 [SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer
Summary:
- Don't sanitize __sancov_lowest_stack.
- Don't instrument leaf functions.
- Add CoverageStackDepth to Fuzzer and FuzzerNoLink.

Reviewers: vitalybuka, kcc

Reviewed By: kcc

Subscribers: cfe-commits, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D37156

llvm-svn: 311801
2017-08-25 21:18:29 +00:00
Matt Morehouse 5c7fc76983 [SanitizerCoverage] Add stack depth tracing instrumentation.
Summary:
Augment SanitizerCoverage to insert maximum stack depth tracing for
use by libFuzzer.  The new instrumentation is enabled by the flag
-fsanitize-coverage=stack-depth and is compatible with the existing
trace-pc-guard coverage.  The user must also declare the following
global variable in their code:
  thread_local uintptr_t __sancov_lowest_stack

https://bugs.llvm.org/show_bug.cgi?id=33857

Reviewers: vitalybuka, kcc

Reviewed By: vitalybuka

Subscribers: kubamracek, hiraditya, cfe-commits, llvm-commits

Differential Revision: https://reviews.llvm.org/D36839

llvm-svn: 311186
2017-08-18 18:43:30 +00:00
Petr Hosek 766288b191 [Driver] SafeStack does not need a runtime library on Fuchsia
Patch by Roland McGrath

Differential Revision: https://reviews.llvm.org/D36779

llvm-svn: 311034
2017-08-16 19:06:05 +00:00
George Karpenkov 33613f63f6 Add -fsanitize=fuzzer-no-link flag to the driver.
The flag will perform instrumentation necessary to the fuzzing,
but will NOT link libLLVMFuzzer.a library.
Necessary when modifying CFLAGS for projects which may produce
executables as well as a fuzzable target.

Differential Revision: https://reviews.llvm.org/D36600

llvm-svn: 310733
2017-08-11 17:22:58 +00:00
Kostya Serebryany 9f338dcd4f [sanitizer-coverage] -fsanitize-coverage=bb,inline-8bit-counters
llvm-svn: 310409
2017-08-08 20:20:40 +00:00
Kostya Serebryany 7dbb1e179e [libFuzzer] add -fsanitize-coverage-pc-table to -fsanitize=fuzzer
llvm-svn: 310136
2017-08-04 21:35:11 +00:00
Petr Hosek b31582b196 Enable AddressSanitizer for Fuchsia targets
Patch by Roland McGrath

Differential Revision: https://reviews.llvm.org/D35922

llvm-svn: 309999
2017-08-03 23:02:22 +00:00
Han Shen 0d7ac5f037 [UBSan] Provide default blacklist filename for UBSan
Summary:
This is to provide a default blacklist filename for UBSan.

While UBSan is turned on, it's better that clang pick up a blacklist file (when exists), just as what ASan / MSan does, so we do not end up adding the "-fsanitize-blacklist" option to every command line.

Reviewers: chandlerc, echristo, vsk, eugenis

Reviewed By: vsk, eugenis

Subscribers: vsk, eugenis, echristo, cfe-commits

Differential Revision: https://reviews.llvm.org/D35849

llvm-svn: 309873
2017-08-02 19:53:38 +00:00
Vedant Kumar a0c3671b20 [ubsan] Have -fsanitize=vptr emit a null check if -fsanitize=null isn't available
In r309007, I made -fsanitize=null a hard prerequisite for -fsanitize=vptr. I
did not see the need for the two checks to have separate null checking logic
for the same pointer. I expected the two checks to either always be enabled
together, or to be mutually compatible.

In the mailing list discussion re: r309007 it became clear that that isn't the
case. If a codebase is -fsanitize=vptr clean but not -fsanitize=null clean,
it's useful to have -fsanitize=vptr emit its own null check. That's what this
patch does: with it, -fsanitize=vptr can be used without -fsanitize=null.

Differential Revision: https://reviews.llvm.org/D36112

llvm-svn: 309846
2017-08-02 18:10:31 +00:00
Kostya Serebryany 6145776720 [sanitizer-coverage] clang flags pumbing for -fsanitize-coverage=pc-table
llvm-svn: 309338
2017-07-28 00:10:10 +00:00
Vedant Kumar bbc953fed4 [ubsan] Null-check pointers in -fsanitize=vptr (PR33881)
The instrumentation generated by -fsanitize=vptr does not null check a
user pointer before loading from it. This causes crashes in the face of
UB member calls (this=nullptr), i.e it's causing user programs to crash
only after UBSan is turned on.

The fix is to make run-time null checking a prerequisite for enabling
-fsanitize=vptr, and to then teach UBSan to reuse these run-time null
checks to make -fsanitize=vptr safe.

Testing: check-clang, check-ubsan, a stage2 ubsan-enabled build

Differential Revision: https://reviews.llvm.org/D35735

https://bugs.llvm.org/show_bug.cgi?id=33881

llvm-svn: 309007
2017-07-25 19:34:23 +00:00
Petr Hosek eb4127ffb5 [Driver] Consider -fno-sanitize=... state when filtering out -fsanitize-coverage=...
The driver ignores -fsanitize-coverage=... flags when also given
-fsanitize=... flags for sanitizer flavors that don't support the
coverage runtime. This logic failed to account for subsequent
-fno-sanitize=... flags that disable the sanitizer flavors that
conflict with -fsanitize-coverage=... flags.

Patch by Roland McGrath

Differential Revision: https://reviews.llvm.org/D35603

llvm-svn: 308707
2017-07-21 01:17:49 +00:00
George Karpenkov 3f984ecb45 [libFuzzer] Add Fuzzer to the list of sanitizers which support coverage.
Without this change, additional coverage flags specified after
-fsanitize=fuzzer would get discarded.

https://reviews.llvm.org/D34794

llvm-svn: 306734
2017-06-29 19:58:20 +00:00
Vedant Kumar 7aacb659da [ubsan] Disable the object size check at -O0
This check currently isn't able to diagnose any issues at -O0, not is it
likely to [1]. Disabling the check at -O0 leads to substantial compile
time and binary size savings.

[1] [cfe-dev] Disabling ubsan's object size check at -O0

Differential Revision: https://reviews.llvm.org/D34563

llvm-svn: 306181
2017-06-23 23:15:24 +00:00
Kostya Serebryany 2c2fb8896b [sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet. Reapplying revisions 304630, 304631, 304632, 304673, see PR33308
llvm-svn: 305026
2017-06-08 22:58:19 +00:00
Alexander Potapenko dc5b95b553 [sanitizer-coverage] Allow using KASAN instrumentation with sancov
llvm-svn: 304984
2017-06-08 16:24:21 +00:00
Renato Golin de72b918f3 Revert "[sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet. (clang part)"
This reverts commit r304631, as it broke ARM/AArch64 bots for 2 days.

llvm-svn: 304697
2017-06-05 07:35:45 +00:00
Kostya Serebryany e425aada63 [sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet. (clang part)
llvm-svn: 304631
2017-06-03 01:36:23 +00:00
Evgeniy Stepanov d991cdd50b [asan] A clang flag to enable ELF globals-gc.
This feature is subtly broken when the linker is gold 2.26 or
earlier. See the following bug for details:
  https://sourceware.org/bugzilla/show_bug.cgi?id=19002

Since the decision needs to be made at compilation time, we can not
test the linker version. The flag is off by default on ELF targets,
and on otherwise.

llvm-svn: 302591
2017-05-09 21:57:43 +00:00
Evgeniy Stepanov b86ca11b57 Remove unnecessary calls to MakeArgString.
llvm-svn: 302590
2017-05-09 21:57:39 +00:00
Vedant Kumar a9d8be68c1 [Driver] Don't enable -fsanitize-use-after-scope when ASan is disabled
When enabling any sanitizer, -fsanitize-use-after-scope is enabled by
default. This doesn't actually turn ASan on, because we've been getting
lucky and there are extra checks in BackendUtil that stop this from
happening.

However, this has been causing a behavior change: extra lifetime markers
are emitted in some cases where they aren't needed or expected.

llvm-svn: 302468
2017-05-08 21:11:55 +00:00
Kostya Serebryany 50fb618b93 [sanitizer-coverage] implement -fsanitize-coverage=no-prune,... instead of a hidden -mllvm flag. clang part.
llvm-svn: 302320
2017-05-05 23:28:18 +00:00
Kostya Serebryany 8955efc36f [sanitizer-coverage] add a deprecation warning to the old sanitizer-coverage flag combinations
llvm-svn: 301994
2017-05-03 01:27:28 +00:00
George Karpenkov f2fc5b068e Flag -fsanitize=fuzzer to enable libfuzzer
Previously, adding libfuzzer to a project was a multi-step procedure,
involving libfuzzer compilation, linking the library, and specifying
coverage flags.
With this change,libfuzzer can be enabled by adding a single
-fsanitize=fuzzer flag instead.

llvm-svn: 301212
2017-04-24 18:23:24 +00:00
Kostya Serebryany 1c0e9e98c0 [sanitizer-coverage] deprecate -fsanitize-coverage=trace-bb
llvm-svn: 300767
2017-04-19 21:31:11 +00:00
Kostya Serebryany 1a02d8bc8d [sanitizer-coverage] deprecate -fsanitize-coverage=8bit-counters
llvm-svn: 300744
2017-04-19 20:15:58 +00:00
Kostya Serebryany 9d1ed13b53 [sanitizer-coverage] deprecate some of the stale coverage variants
llvm-svn: 300738
2017-04-19 19:57:16 +00:00
Vedant Kumar 42c17ec5ac [ubsan] Add a nullability sanitizer
Teach UBSan to detect when a value with the _Nonnull type annotation
assumes a null value. Call expressions, initializers, assignments, and
return statements are all checked.

Because _Nonnull does not affect IRGen, the new checks are disabled by
default. The new driver flags are:

  -fsanitize=nullability-arg      (_Nonnull violation in call)
  -fsanitize=nullability-assign   (_Nonnull violation in assignment)
  -fsanitize=nullability-return   (_Nonnull violation in return stmt)
  -fsanitize=nullability          (all of the above)

This patch builds on top of UBSan's existing support for detecting
violations of the nonnull attributes ('nonnull' and 'returns_nonnull'),
and relies on the compiler-rt support for those checks. Eventually we
will need to update the diagnostic messages in compiler-rt (there are
FIXME's for this, which will be addressed in a follow-up).

One point of note is that the nullability-return check is only allowed
to kick in if all arguments to the function satisfy their nullability
preconditions. This makes it necessary to emit some null checks in the
function body itself.

Testing: check-clang and check-ubsan. I also built some Apple ObjC
frameworks with an asserts-enabled compiler, and verified that we get
valid reports.

Differential Revision: https://reviews.llvm.org/D30762

llvm-svn: 297700
2017-03-14 01:56:34 +00:00
David L. Jones f561abab56 [Driver] Consolidate tools and toolchains by target platform. (NFC)
Summary:
(This is a move-only refactoring patch. There are no functionality changes.)

This patch splits apart the Clang driver's tool and toolchain implementation
files. Each target platform toolchain is moved to its own file, along with the
closest-related tools. Each target platform toolchain has separate headers and
implementation files, so the hierarchy of classes is unchanged.

There are some remaining shared free functions, mostly from Tools.cpp. Several
of these move to their own architecture-specific files, similar to r296056. Some
of them are only used by a single target platform; since the tools and
toolchains are now together, some helpers now live in a platform-specific file.
The balance are helpers related to manipulating argument lists, so they are now
in a new file pair, CommonArgs.h and .cpp.

I've tried to cluster the code logically, which is fairly straightforward for
most of the target platforms and shared architectures. I think I've made
reasonable choices for these, as well as the various shared helpers; but of
course, I'm happy to hear feedback in the review.

There are some particular things I don't like about this patch, but haven't been
able to find a better overall solution. The first is the proliferation of files:
there are several files that are tiny because the toolchain is not very
different from its base (usually the Gnu tools/toolchain). I think this is
mostly a reflection of the true complexity, though, so it may not be "fixable"
in any reasonable sense. The second thing I don't like are the includes like
"../Something.h". I've avoided this largely by clustering into the current file
structure. However, a few of these includes remain, and in those cases it
doesn't make sense to me to sink an existing file any deeper.

Reviewers: rsmith, mehdi_amini, compnerd, rnk, javed.absar

Subscribers: emaste, jfb, danalbert, srhines, dschuff, jyknight, nemanjai, nhaehnle, mgorny, cfe-commits

Differential Revision: https://reviews.llvm.org/D30372

llvm-svn: 297250
2017-03-08 01:02:16 +00:00
Mike Aizatsky d1033f5756 [sanitizers] lsan+sancov doesn't need ubsanrt (multi def error)
Reviewers: eugenis

Differential Revision: https://reviews.llvm.org/D27594

llvm-svn: 289144
2016-12-08 22:25:01 +00:00
Evgeniy Stepanov 8a2bedbf27 Tread TSan LLVM flags to driver: add TSan controlling flags to clang.
Summary:
New clang flags, all default to true:
-f[no-]sanitize-thread-data-races
-f[no-]sanitize-thread-stack-traces
-f[no-]sanitize-thread-atomics

Reviewers: dvyukov, pcc, eugenis

Subscribers: pcc, cfe-commits

Patch by Alex Shlyapnikov.

Differential Revision: https://reviews.llvm.org/D26461

llvm-svn: 286669
2016-11-11 23:17:36 +00:00
Vitaly Buka a77ac1b214 Add -fno-sanitize-address-use-after-scope flag
Reviewers: eugenis

Differential Revision: https://reviews.llvm.org/D25453

llvm-svn: 283801
2016-10-10 21:31:50 +00:00
Justin Lebar 6efbc73c25 [CUDA] Don't try to run sanitizers on NVPTX.
Summary:
Sanitizers aren't supported on NVPTX -- don't try to run them.

This lets you e.g. pass -fsanitize=address and get asan on your host
code.

Reviewers: kcc

Subscribers: cfe-commits, tra, jhen

Differential Revision: https://reviews.llvm.org/D24640

llvm-svn: 281680
2016-09-15 23:44:13 +00:00
Kostya Serebryany 60cdd6113f [sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. Clang part
llvm-svn: 281432
2016-09-14 01:39:49 +00:00
Kostya Serebryany 3b41971763 [sanitizer-coverage] add two more modes of instrumentation: trace-div and trace-gep, mostly usaful for value-profile-based fuzzing; clang part
llvm-svn: 280044
2016-08-30 01:27:03 +00:00
Vedant Kumar 5fb00e4bd7 Revert "[Driver] Compute effective target triples once per job (NFCI)"
This reverts commit r275895 in order to address some post-commit review
feedback from Eric Christopher (see: the list thread for r275895).

llvm-svn: 276936
2016-07-27 23:01:55 +00:00
Vedant Kumar bf51e703cf [Driver] Compute effective target triples once per job (NFCI)
Compute an effective target triple exactly once in ConstructJob(), and
then simply pass around references to it. This eliminates wasteful
re-computation of effective triples (e.g in getARMFloatABI()).

Differential Revision: https://reviews.llvm.org/D22290

llvm-svn: 275895
2016-07-18 19:56:38 +00:00
Evgeniy Stepanov aac94b1e2e Fix linking of DFSan + coverage.
Broken in r272717 because of no test coverage.

llvm-svn: 272853
2016-06-15 23:05:21 +00:00
Evgeniy Stepanov 5c063c108a Fix sanitizer coverage support in the win32 driver.
--dependent-lib arguments for the sanitizer libraries must be emitted when
coverage is enabled w/o any sanitizers.

llvm-svn: 272735
2016-06-14 23:21:19 +00:00
Evgeniy Stepanov 5b49eb42c5 [sanitizer] Allow sanitize coverage w/o sanitizers.
The reason is that this (a) seems to work just fine and (b) useful when building stuff with
sanitizer+coverage, but need to exclude the sanitizer for a particular source file.

llvm-svn: 272717
2016-06-14 21:33:40 +00:00