<br><br><div class="gmail_quote">On Thu, Jun 16, 2011 at 11:14 PM, Kostya Serebryany <span dir="ltr"><<a href="mailto:kcc@google.com">kcc@google.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br><br><div class="gmail_quote"><div class="im">On Thu, Jun 16, 2011 at 11:00 PM, Chris Lattner <span dir="ltr"><<a href="mailto:clattner@apple.com" target="_blank">clattner@apple.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><br><div><div><div>On Jun 16, 2011, at 1:27 AM, Kostya Serebryany wrote:</div><br><blockquote type="cite">Hello again, <div><br></div><div>The tool we announced 1.5 months ago has matured quite a bit. </div>
<div>In addition to heap <span style="border-collapse:collapse;font-family:arial, sans-serif;font-size:13px">out-of-bound and use-after-free bugs it also finds stack overruns/underruns. </span></div>
<div><font face="arial, sans-serif"><span style="border-collapse:collapse"><span style="font-size:13px">AddressSanitizer is being actively used by the Chromium developers and already found over 20 bugs: <a href="http://blog.chromium.org/2011/06/testing-chromium-addresssanitizer-fast.html" target="_blank">http://blog.chromium.org/2011/06/testing-chromium-addresssanitizer-fast.html</a></span><br>
</span></font></div><div><font face="arial, sans-serif"><span style="border-collapse:collapse"><br></span></font></div><div><font face="arial, sans-serif"><span style="border-collapse:collapse">Question to the LLVM developers: would you consider adding the </span></font><span style="border-collapse:collapse;font-family:arial, sans-serif;font-size:13px">AddressSanitizer code to the LLVM trunk? </span></div>
</blockquote><div><br></div></div><div>Having functionality like this in mainline would be really interesting. I haven't looked at your code yet, what are the major components, what impact does it have on the codebase?</div>
</div></div></blockquote><div><br></div></div><div>LLVM: </div><div> - The instrumentation pass <a href="http://code.google.com/p/address-sanitizer/source/browse/trunk/llvm/AddressSanitizer.cpp" target="_blank">http://code.google.com/p/address-sanitizer/source/browse/trunk/llvm/AddressSanitizer.cpp</a> . It instruments all memory accesses and inserts redzones around stack objects (around globals too, but this is unfinished). </div>
<div> - Tiny patch to actually insert the instrumentation pass and to handle the "-fasan" flag in the driver. <a href="http://code.google.com/p/address-sanitizer/source/browse/trunk/llvm/clang.patch" target="_blank">http://code.google.com/p/address-sanitizer/source/browse/trunk/llvm/clang.patch</a> This patch is a bit outdated (applies to r130919) </div>
<div> - The 'ignore' machinery is taken from the ThreadSanitizer project. This is basically a whitelist/blacklist by function name, file name or module name. <a href="http://code.google.com/p/data-race-test/source/browse/trunk/tsan/ignore.h" target="_blank">http://code.google.com/p/data-race-test/source/browse/trunk/tsan/ignore.h</a>. If LLVM has its own whitelist/blacklist functionality, we could use that instead. </div>
<div>
<br></div><div>This is my first code in LLVM, so it definitely needs cleanup to meet the LLVM guidelines. </div><div><br></div><div>Run time library (could be used with any other compiler): </div><div> - Almost everything is on one file: <a href="http://code.google.com/p/address-sanitizer/source/browse/trunk/asan/asan_rtl.cc" target="_blank">http://code.google.com/p/address-sanitizer/source/browse/trunk/asan/asan_rtl.cc</a></div>
<div>This library replaces malloc, tracks thread stacks, replaces SIGILL and SIGSEGV handlers, reports warnings. Linux x86/x86_64 and ChromiumOS is fully functional, MacOS is in flight. </div><div><br></div><div>Tests: <a href="http://code.google.com/p/address-sanitizer/source/browse/trunk/asan/asan_test.cc" target="_blank">http://code.google.com/p/address-sanitizer/source/browse/trunk/asan/asan_test.cc</a></div>
</div></blockquote><div><br></div><div>One more part is the symbolizer -- when reporting an error we need to provide function name, file name and line number of every PC in the stack. </div><div>There are two options: offline symbolizer (simple python script which uses addr2line) and in-process symbolizer based on libbfd. </div>
<div>Due to the huge size of dwarf generated by llvm (suspected <a href="http://llvm.org/bugs/show_bug.cgi?id=7554">http://llvm.org/bugs/show_bug.cgi?id=7554</a>) both options are terribly slow -- up to 1 minute and 7G RAM on chromium per one report. </div>
<div>I don't like either option, please recommend if LLVM has another one. </div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="gmail_quote">
<div><br></div><div>--kcc </div><div class="im"><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><div><div><br></div><font color="#888888"><div>-Chris</div><div><br></div><br></font><blockquote type="cite"><div>
<div><font face="arial, sans-serif"><span style="border-collapse:collapse"><br></span></font></div><div>
<font face="arial, sans-serif"><span style="border-collapse:collapse">Thanks, </span></font></div><div><font face="arial, sans-serif"><span style="border-collapse:collapse"><br>
</span></font></div><div><font face="arial, sans-serif"><span style="border-collapse:collapse">--kcc </span></font></div><div><font face="arial, sans-serif"><span style="border-collapse:collapse"><br>
</span></font><div class="gmail_quote">On Tue, May 3, 2011 at 10:52 PM, Kostya Serebryany <span dir="ltr"><<a href="mailto:kcc@google.com" target="_blank">kcc@google.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span style="border-collapse:collapse;font-family:arial, sans-serif;font-size:13px">Hello, <div><br></div><div>We've just released the first version of our LLVM-based address sanity checker: AddressSanitizer (<a href="http://code.google.com/p/address-sanitizer/" style="color:rgb(0, 101, 204)" target="_blank">http://code.google.com/p/address-sanitizer/</a>).</div>
<div>The tool finds out-of-bound and use-after-free bugs (the subset of bugs detectable by Valgrind/Memcheck); </div><div>it consists of a LLVM compiler plugin which performs simple code instrumentation and a malloc replacement library. </div>
<div>The main advantage of the new tool is high speed: the slowdown is usually within 2x-2.5x. </div><div>Detailed description of the algorithm is found here: <a href="http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm" style="color:rgb(0, 101, 204)" target="_blank">http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm</a></div>
<div>The tool is young, but it already can run the Chromium browser (interactively!) and find bugs in it. </div><div><br></div><div>Would the LLVM community be interested in adopting this code into the LLVM trunk? </div>
<div>
The instrumentation pass is ~350 LOC (<a href="http://code.google.com/p/address-sanitizer/source/browse/trunk/llvm/AddressSanitizer.cpp" target="_blank">http://code.google.com/p/address-sanitizer/source/browse/trunk/llvm/AddressSanitizer.cpp</a>), but may grow over time as we add optimizations. </div>
<div>The run-time library (malloc replacement, <a href="http://code.google.com/p/address-sanitizer/source/browse/trunk/asan/asan_rtl.cc" target="_blank">http://code.google.com/p/address-sanitizer/source/browse/trunk/asan/asan_rtl.cc</a>) is ~1500 LOC. </div>
<div><br></div><div>Thanks, </div><div><br></div><div>--kcc </div></span>
</blockquote></div><br></div></div><div>
_______________________________________________<br>LLVM Developers mailing list<br><a href="mailto:LLVMdev@cs.uiuc.edu" target="_blank">LLVMdev@cs.uiuc.edu</a> <a href="http://llvm.cs.uiuc.edu" target="_blank">http://llvm.cs.uiuc.edu</a><br>
<a href="http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/llvmdev</a><br></div></blockquote></div><br></div>
</blockquote></div></div><br>
</blockquote></div><br>