Commit Graph

11254 Commits

Author SHA1 Message Date
Kostya Serebryany 5c0751ec3e [libFuzzer] remove stale code, NFC
llvm-svn: 352604
2019-01-30 06:21:20 +00:00
Kostya Serebryany 6fd4d8ab9c [libFuzzer] refactor the handling of instrumentation counters so that they are grouped in regions one full page each. Needed for future optimization. NFC
llvm-svn: 352603
2019-01-30 06:15:52 +00:00
Kostya Serebryany 3a94519a77 [libFuzzer] update a test
llvm-svn: 352577
2019-01-30 00:36:28 +00:00
Kostya Serebryany 2891b257c2 [libFuzzer] remove stale code
llvm-svn: 352571
2019-01-29 23:53:28 +00:00
Kostya Serebryany 035c08f73d [libFuzzer] revert an accidental commit
llvm-svn: 352567
2019-01-29 23:41:50 +00:00
Kostya Serebryany 62d7270610 [libFuzzer] remove deprecated support for -fsanitize-coverage=trace-pc[-guard]
llvm-svn: 352566
2019-01-29 23:40:05 +00:00
Kostya Serebryany 50a1c69712 [libFuzzer] remove deprecated support for -fsanitize-coverage=trace-pc[-guard]
llvm-svn: 352564
2019-01-29 23:37:20 +00:00
James Y Knight 5d71fc5d7b Adjust documentation for git migration.
This fixes most references to the paths:
 llvm.org/svn/
 llvm.org/git/
 llvm.org/viewvc/
 github.com/llvm-mirror/
 github.com/llvm-project/
 reviews.llvm.org/diffusion/

to instead point to https://github.com/llvm/llvm-project.

This is *not* a trivial substitution, because additionally, all the
checkout instructions had to be migrated to instruct users on how to
use the monorepo layout, setting LLVM_ENABLE_PROJECTS instead of
checking out various projects into various subdirectories.

I've attempted to not change any scripts here, only documentation. The
scripts will have to be addressed separately.

Additionally, I've deleted one document which appeared to be outdated
and unneeded:
  lldb/docs/building-with-debug-llvm.txt

Differential Revision: https://reviews.llvm.org/D57330

llvm-svn: 352514
2019-01-29 16:37:27 +00:00
Jeremy Morse b0d7cf5df4 Add 'REQUIRES: zlib' to a fuzzer test
Fixes tests on build environments that don't have zlib. See also r352483.

llvm-svn: 352487
2019-01-29 13:06:17 +00:00
Jeremy Morse 2601aa5406 Add zlib feature test to lit configuration
Some new tests in libfuzzer have dependencies on zlib: add a feature test
for zlib so that we can add a REQUIRES field to the relevant tests.

Patch by Matthew Voss.

Differential Revision: https://reviews.llvm.org/D57366

llvm-svn: 352483
2019-01-29 12:00:01 +00:00
Igor Kudrin 0f13000958 [compiler-rt] Fix reporting unrecognized flags in unit tests.
Previously, the warning messages might be issued within a wrong test case.

Differential Revision: https://reviews.llvm.org/D57318

llvm-svn: 352447
2019-01-29 02:31:57 +00:00
Petr Hosek 12f4b86808 Revert "[CMake] Use __libc_start_main rather than fopen when checking for C library"
This reverts commit r352341: it broke the build on macOS which doesn't
seem to provide __libc_start_main in its C library.

llvm-svn: 352411
2019-01-28 19:26:41 +00:00
Jonathan Metzman 8f7fc95ab7 [libFuzzer][Windows] Use dllexport for all declarations in FuzzerInterface.h
Summary:
Use dllexport for all declarations in FuzzerInterface.h Use it for clang
even though clang supports default visibility attribute to prevent a
warning from being thrown when LLVMFuzzerMutate is defined with dllexport.
This makes `FUZZER_INTERFACE_VISIBILITY` (FuzzerInterface.h) consistent with
`ATTRIBUTE_INTERFACE` (FuzzerDefs.h) when using clang on Windows.

Reviewers: vitalybuka, morehouse

Reviewed By: morehouse

Differential Revision: https://reviews.llvm.org/D57305

llvm-svn: 352395
2019-01-28 17:51:13 +00:00
Jonathan Metzman 3720e2b39e [fuzzer][afl] Remove AFL_DRIVER_EXTRA_STATS_FILENAME
Summary:
Remove this feature as it is unused, buggy, and not worth correcting
since the forkserver makes it difficult.

Reviewers: morehouse, jfb

Reviewed By: morehouse

Differential Revision: https://reviews.llvm.org/D57308

llvm-svn: 352392
2019-01-28 17:15:49 +00:00
Stefan Granitz 6163039ce0 [CMake] Quick-Fix FileCheck target does not exist when building against LLVM install-tree with COMPILER_RT_INCLUDE_TESTS=ON
The issue came up during release testing for LLVM 8: https://bugs.llvm.org/show_bug.cgi?id=40443

Differential Revision: https://reviews.llvm.org/D57224

llvm-svn: 352381
2019-01-28 16:14:57 +00:00
Petr Hosek b667153cf6 [CMake] Use __libc_start_main rather than fopen when checking for C library
The check_library_exists CMake uses a custom symbol definition. This
is a problem when checking for C library symbols because Clang
recognizes many of them as builtins, and returns the
-Wbuiltin-requires-header (or -Wincompatible-library-redeclaration)
error. When building with -Werror which is the default, this causes
the check_library_exists check fail making the build think that C
library isn't available.

To avoid this issue, we should use a symbol that isn't recognized by
Clang and wouldn't cause the same issue. __libc_start_main seems like
reasonable choice that fits the bill.

Differential Revision: https://reviews.llvm.org/D57142

llvm-svn: 352341
2019-01-28 04:12:54 +00:00
Dan Liew 225eb75a10 Make more allocator methods work correctly with in an out-of-process mode.
Summary:
This makes `GetBlockBegin()` and `GetBlockBeginFastLocked()` work correctly with `RemoteAddressSpaceView`.

This has a knock on effect of also making the `PointerIsMine()` and
`GetMetaData()` methods behave correctly when `RemoteAddressSpaceView`
is used to instantiate the allocators.

This will be used by future out-of-process allocator enumeration
patches.

rdar://problem/45284065

Reviewers: kcc, vitalybuka, dvyukov, cryptoad, eugenis, george.karpenkov, yln

Subscribers: #sanitizers, llvm-commits, kubamracek

Differential Revision: https://reviews.llvm.org/D56964

llvm-svn: 352335
2019-01-27 22:45:11 +00:00
Kostya Serebryany 71ab4acb16 [libFuzzer] add CompressedTest.cpp, a real-life-ish test for a custom mutator
llvm-svn: 352265
2019-01-26 02:38:56 +00:00
Kostya Serebryany bb01a098b1 [libFuzzer] print uncovered functions when doing -print_coverage=1
llvm-svn: 352263
2019-01-26 01:33:09 +00:00
Dimitry Andric d849f8fd8f Fix XRayTest link on FreeBSD (and likely NetBSD too)
Summary:
As reported on llvm-testers, during 8.0.0-rc1 testing I got errors while
building of `XRayTest`, during `check-all`:

```
[100%] Generating XRayTest-x86_64-Test
/home/dim/llvm/8.0.0/rc1/Phase3/Release/llvmCore-8.0.0-rc1.obj/./lib/libLLVMSupport.a(Signals.cpp.o): In function `llvm::sys::PrintStackTrace(llvm::raw_ostream&)':
Signals.cpp:(.text._ZN4llvm3sys15PrintStackTraceERNS_11raw_ostreamE+0x24): undefined reference to `backtrace'
Signals.cpp:(.text._ZN4llvm3sys15PrintStackTraceERNS_11raw_ostreamE+0x254): undefined reference to `llvm::itaniumDemangle(char const*, char*, unsigned long*, int*)'
clang-8: error: linker command failed with exit code 1 (use -v to see invocation)
gmake[3]: *** [projects/compiler-rt/lib/xray/tests/unit/CMakeFiles/TXRayTest-x86_64-Test.dir/build.make:73: projects/compiler-rt/lib/xray/tests/unit/XRayTest-x86_64-Test] Error 1
gmake[3]: Target 'projects/compiler-rt/lib/xray/tests/unit/CMakeFiles/TXRayTest-x86_64-Test.dir/build' not remade because of errors.
gmake[2]: *** [CMakeFiles/Makefile2:33513: projects/compiler-rt/lib/xray/tests/unit/CMakeFiles/TXRayTest-x86_64-Test.dir/all] Error 2
gmake[2]: Target 'CMakeFiles/check-all.dir/all' not remade because of errors.
gmake[1]: *** [CMakeFiles/Makefile2:737: CMakeFiles/check-all.dir/rule] Error 2
gmake[1]: Target 'check-all' not remade because of errors.
gmake: *** [Makefile:277: check-all] Error 2
[Release Phase3] check-all failed
```

This is because the `backtrace` function requires `-lexecinfo` on BSD
platforms.  To fix this, detect the `execinfo` library in
`cmake/config-ix.cmake`, and add it to the unit test link flags.

Additionally, since the code in `sys::PrintStackTrace` makes use of
`itaniumDemangle`, also add `-lLLVMDemangle`.  (Note that this is more
of a general problem with libLLVMSupport, but I'm looking for a quick
fix now so it can be merged to the 8.0 branch.)

Reviewers: dberris, hans, mgorny, samsonov

Reviewed By: dberris

Subscribers: krytarowski, delcypher, erik.pilkington, #sanitizers, emaste, llvm-commits

Differential Revision: https://reviews.llvm.org/D57181

llvm-svn: 352234
2019-01-25 19:36:47 +00:00
Kostya Kortchinsky a04584b095 [scudo] Delay allocations in the RSS check test
Summary:
D57116 fails on the armv7 bots, which is I assume due to the timing of
the RSS check on the platform. While I don't have a platform to test
that change on, I assume this would do.

The test could be made more reliable by either delaying more the
allocations, or allocating more large-chunks, but both those options
have a somewhat non negligible impact (more memory used, longer test).

Hence me trying to keep the additional sleeping/allocating to a
minimum.

Reviewers: eugenis, yroux

Reviewed By: yroux

Subscribers: javed.absar, kristof.beyls, delcypher, #sanitizers, llvm-commits

Differential Revision: https://reviews.llvm.org/D57241

llvm-svn: 352220
2019-01-25 17:23:29 +00:00
Kamil Rytarowski 63bd043a12 Enhance support for NetBSD in SafeStack
Summary:
Always try to detect and call internal or real libc symbols instead of
locally installed interceptors.

This covers:
 - GetTid()
 - TgKill()
 - Mmap()
 - Munmap()
 - Mprotect()

This cherry-picks code from sanitizer_common/sanitizer_netbsd.cc.

Reviewers: vitalybuka

Reviewed By: vitalybuka

Subscribers: llvm-commits, mgorny, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D57179

llvm-svn: 352154
2019-01-25 02:18:01 +00:00
Evgeniy Stepanov f4e7051c67 [hwasan] Madvise away thread aux data
Summary:
Release memory pages for thread data (allocator cache, stack allocations
ring buffer, etc) when a thread exits. We can not simply munmap them
because this memory is custom allocated within a limited address range,
and it needs to stay "reserved".

This change alters thread storage layout by putting the ring buffer
before Thread instead of after it. This makes it possible to find the
start of the thread aux allocation given only the Thread pointer.

Reviewers: kcc, pcc

Subscribers: kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D56621

llvm-svn: 352151
2019-01-25 02:05:48 +00:00
Evgeniy Stepanov 9ea001401c [hwasan] Implement print_module_map flag.
Reviewers: kcc, pcc

Subscribers: kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D57130

llvm-svn: 352150
2019-01-25 02:05:25 +00:00
Jonathan Metzman 62f1871060 [libFuzzer][MSVC] Disable exceptions in MSVC headers
Summary:
Disable exceptions in MSVC headers using -D_HAS_EXCEPTIONS=0
to silence compiler warning instead of using /Ehsc.

Reviewers: rnk, morehouse, metzman

Reviewed By: rnk, morehouse, metzman

Subscribers: rnk, morehouse, mgorny

Differential Revision: https://reviews.llvm.org/D57119

llvm-svn: 352144
2019-01-25 01:10:57 +00:00
Kostya Serebryany 360bf5ff58 [libFuzzer] more agressive value profiling and CMP tracing for switch statements
llvm-svn: 352107
2019-01-24 21:08:54 +00:00
Kamil Rytarowski 66b62979b7 Disable LSan on NetBSD
This no longer builds after refactoring and needs restoration.
Additionally the checked in support was incomplete.

llvm-svn: 352085
2019-01-24 19:15:53 +00:00
Julian Lettner b62e9dc46b Revert "[Sanitizers] UBSan unreachable incompatible with ASan in the presence of `noreturn` calls"
This reverts commit cea84ab93a.

llvm-svn: 352069
2019-01-24 18:04:21 +00:00
Kostya Kortchinsky f0fbeaf44a [scudo] Tuning changes based on feedback from current use
Summary:
This tunes several of the default parameters used within the allocator:
- disable the deallocation type mismatch on Android by default; this
  was causing too many issues with third party libraries;
- change the default `SizeClassMap` to `Dense`, it caches less entries
  and is way more memory efficient overall;
- relax the timing of the RSS checks, 10 times per second was too much,
  lower it to 4 times (every 250ms), and update the test so that it
  passes with the new default.

Reviewers: eugenis

Reviewed By: eugenis

Subscribers: srhines, delcypher, #sanitizers, llvm-commits

Differential Revision: https://reviews.llvm.org/D57116

llvm-svn: 352057
2019-01-24 15:56:54 +00:00
Martin Liska acc348aad0 Revert https://reviews.llvm.org/D56485.
llvm-svn: 352033
2019-01-24 08:46:06 +00:00
Martin Liska dc5c81330b Always compare C++ typeinfo (based on libstdc++ implementation).
Differential Revision: https://reviews.llvm.org/D56485.

llvm-svn: 352032
2019-01-24 08:25:36 +00:00
Julian Lettner 0bd6017228 Temporarily deactivate tests; it fails on certain bots
llvm-svn: 352020
2019-01-24 03:51:01 +00:00
Fangrui Song 4d91cf71cc [ubsan] Fix test when isPICDefault() returns false after rCTE352003
llvm-svn: 352013
2019-01-24 02:56:34 +00:00
Julian Lettner cea84ab93a [Sanitizers] UBSan unreachable incompatible with ASan in the presence of `noreturn` calls
Summary:
UBSan wants to detect when unreachable code is actually reached, so it
adds instrumentation before every `unreachable` instruction. However,
the optimizer will remove code after calls to functions marked with
`noreturn`. To avoid this UBSan removes `noreturn` from both the call
instruction as well as from the function itself. Unfortunately, ASan
relies on this annotation to unpoison the stack by inserting calls to
`_asan_handle_no_return` before `noreturn` functions. This is important
for functions that do not return but access the the stack memory, e.g.,
unwinder functions *like* `longjmp` (`longjmp` itself is actually
"double-proofed" via its interceptor). The result is that when ASan and
UBSan are combined, the `noreturn` attributes are missing and ASan
cannot unpoison the stack, so it has false positives when stack
unwinding is used.

Changes:
  # UBSan now adds the `expect_noreturn` attribute whenever it removes
    the `noreturn` attribute from a function
  # ASan additionally checks for the presence of this attribute

Generated code:
```
call void @__asan_handle_no_return    // Additionally inserted to avoid false positives
call void @longjmp
call void @__asan_handle_no_return
call void @__ubsan_handle_builtin_unreachable
unreachable
```

The second call to `__asan_handle_no_return` is redundant. This will be
cleaned up in a follow-up patch.

rdar://problem/40723397

Reviewers: delcypher, eugenis

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D56624

llvm-svn: 352003
2019-01-24 01:06:19 +00:00
Peter Collingbourne 020ce3f026 hwasan: Read shadow address from ifunc if we don't need a frame record.
This saves a cbz+cold call in the interceptor ABI, as well as a realign
in both ABIs, trading off a dcache entry against some branch predictor
entries and some code size.

Unfortunately the functionality is hidden behind a flag because ifunc is
known to be broken on static binaries on Android.

Differential Revision: https://reviews.llvm.org/D57084

llvm-svn: 351989
2019-01-23 22:39:11 +00:00
Martin Storsjo b5a5055704 Fix building sanitizers for MinGW
The /EHsc flag is MSVC specific, not generic to the windows target.

llvm-svn: 351927
2019-01-23 07:23:16 +00:00
Peter Collingbourne 73078ecd38 hwasan: Move memory access checks into small outlined functions on aarch64.
Each hwasan check requires emitting a small piece of code like this:
https://clang.llvm.org/docs/HardwareAssistedAddressSanitizerDesign.html#memory-accesses

The problem with this is that these code blocks typically bloat code
size significantly.

An obvious solution is to outline these blocks of code. In fact, this
has already been implemented under the -hwasan-instrument-with-calls
flag. However, as currently implemented this has a number of problems:
- The functions use the same calling convention as regular C functions.
  This means that the backend must spill all temporary registers as
  required by the platform's C calling convention, even though the
  check only needs two registers on the hot path.
- The functions take the address to be checked in a fixed register,
  which increases register pressure.
Both of these factors can diminish the code size effect and increase
the performance hit of -hwasan-instrument-with-calls.

The solution that this patch implements is to involve the aarch64
backend in outlining the checks. An intrinsic and pseudo-instruction
are created to represent a hwasan check. The pseudo-instruction
is register allocated like any other instruction, and we allow the
register allocator to select almost any register for the address to
check. A particular combination of (register selection, type of check)
triggers the creation in the backend of a function to handle the check
for specifically that pair. The resulting functions are deduplicated by
the linker. The pseudo-instruction (really the function) is specified
to preserve all registers except for the registers that the AAPCS
specifies may be clobbered by a call.

To measure the code size and performance effect of this change, I
took a number of measurements using Chromium for Android on aarch64,
comparing a browser with inlined checks (the baseline) against a
browser with outlined checks.

Code size: Size of .text decreases from 243897420 to 171619972 bytes,
or a 30% decrease.

Performance: Using Chromium's blink_perf.layout microbenchmarks I
measured a median performance regression of 6.24%.

The fact that a perf/size tradeoff is evident here suggests that
we might want to make the new behaviour conditional on -Os/-Oz.
But for now I've enabled it unconditionally, my reasoning being that
hwasan users typically expect a relatively large perf hit, and ~6%
isn't really adding much. We may want to revisit this decision in
the future, though.

I also tried experimenting with varying the number of registers
selectable by the hwasan check pseudo-instruction (which would result
in fewer variants being created), on the hypothesis that creating
fewer variants of the function would expose another perf/size tradeoff
by reducing icache pressure from the check functions at the cost of
register pressure. Although I did observe a code size increase with
fewer registers, I did not observe a strong correlation between the
number of registers and the performance of the resulting browser on the
microbenchmarks, so I conclude that we might as well use ~all registers
to get the maximum code size improvement. My results are below:

Regs | .text size | Perf hit
-----+------------+---------
~all | 171619972  | 6.24%
  16 | 171765192  | 7.03%
   8 | 172917788  | 5.82%
   4 | 177054016  | 6.89%

Differential Revision: https://reviews.llvm.org/D56954

llvm-svn: 351920
2019-01-23 02:20:10 +00:00
Yi Kong 02d85149a0 [builtins] Do not set hidden attribute on Android
Bionic libc relies on an old libgcc behaviour which does not set hidden
visibility attribute. Keep exporting these symbols on Android for 
compatibility.

Differential Revision: https://reviews.llvm.org/D56977

llvm-svn: 351915
2019-01-23 01:59:35 +00:00
Jonathan Metzman 3c535a60dd [libFuzzer][MSVC] Enable building libFuzzer with MSVC
Summary:
Enable building libFuzzer with MSVC.

* Don't try to include <endian.h> in FuzzerSHA1.cpp. MSVC
  doesn't have this header, and WINDOWS is always little
  endian (even on ARM)

Subscribers: srhines, mgorny, javed.absar, kristof.beyls

Differential Revision: https://reviews.llvm.org/D56510

llvm-svn: 351855
2019-01-22 18:59:25 +00:00
Vitaly Buka 096ee9159f [safestack] Return syscalls for mmap, munmap and mprotect
This function can be already intercepted by instrumented code.

llvm-svn: 351783
2019-01-22 05:23:48 +00:00
Vitaly Buka b793d25443 [safestack] Fix NetBSD build
llvm-svn: 351771
2019-01-22 00:39:59 +00:00
Chandler Carruth 4a1b95bda0 Fix typos throughout the license files that somehow I and my reviewers
all missed!

Thanks to Alex Bradbury for pointing this out, and the fact that I never
added the intended `legacy` anchor to the developer policy. Add that
anchor too. With hope, this will cause the links to all resolve
successfully.

llvm-svn: 351731
2019-01-21 09:52:34 +00:00
Eugene Leviant 0d7952ce78 [HWASAN] Improve tag mismatch diagnostics
Reports correct size and tags when either size is not power of two
or offset to bad granule is not zero.

Differential revision: https://reviews.llvm.org/D56603

llvm-svn: 351730
2019-01-21 09:51:10 +00:00
Vitaly Buka d733430c19 [fuzzer] Fix test checks broken after license header update
llvm-svn: 351717
2019-01-21 02:22:06 +00:00
Vitaly Buka 2b3d8b3286 [safestack] Remove unsupported platforms
llvm-svn: 351716
2019-01-21 02:21:59 +00:00
Vitaly Buka 7ef159dda5 [safestack] Fix FreeBSD runtime build
llvm-svn: 351715
2019-01-21 02:21:51 +00:00
Jonathan Metzman dd467f4f43 [libFuzzer][MSVC] Make Sanitizer Coverage MSVC-compatible
Summary:
Make Sanitizer Coverage work when compiled work when compiler-rt
is compiled with MSVC.

The previous solution did not work for MSVC because MSVC tried to
align the .SCOV$CZ section even though we used
__declspec(align(1)) on its only symbol:
__stop___sancov_cntrs.
Because the counter array is composed
of 1 byte elements, it does not always end on an 8 or 4 byte
boundary. This means that padding was sometimes added to
added to align the next section, .SCOV$CZ.
Use a different strategy now: instead of only instructing
the compiler not to align the symbol, make the section
one byte long by making its only symbol a uint8_t, so that
the linker won't try to align it.

Reviewers: morehouse, rnk

Reviewed By: rnk

Subscribers: kubamracek

Differential Revision: https://reviews.llvm.org/D56866

llvm-svn: 351714
2019-01-21 02:15:29 +00:00
Dan Liew a35df433bf [ASan] On Darwin record global allocator pointer and size in introspection struct.
This implements `mi_extra_init(...)` for the ASan allocator on
Darwin and uses the `__lsan::GetAllocatorGlobalRange(...)` function
to retrieve the allocator pointer and size.

rdar://problem/45284065

llvm-svn: 351713
2019-01-21 01:41:12 +00:00
Dan Liew 5a3857c9b2 On Darwin add allocator address and size fields to
`sanitizer_malloc_introspection_t` and initialize them to zero.

We allow sanitizer implementations to perform different initialization
by defining `COMMON_MALLOC_HAS_EXTRA_INTROSPECTION_INIT` to be `1`
and providing an implementation of `mi_extra_init(...)`.

We use these changes in future patches to implement malloc zone enumeration.

rdar://problem/45284065

llvm-svn: 351712
2019-01-21 01:41:08 +00:00
Dan Liew 4dd0bf9487 On Darwin allow for sanitizer malloc implementations to provide a zone
enumerator.

This is done by defining `COMMON_MALLOC_HAS_ZONE_ENUMERATOR` to `1` and
then by providing an implementation of the `mi_enumerator(...)` function.
If a custom implementation isn't desired the macro is set to `0` which
causes a stub version (that fails) to be used.

Currently all Darwin sanitizers that have malloc implementations define
this to be `0` so there is no functionality change.

rdar://problem/45284065

llvm-svn: 351711
2019-01-21 01:41:01 +00:00