[PATCH] D41602: [hwasan] Stack instrumentation.

[Evgenii Stepanov via Phabricator via llvm-commits]

eugenis created this revision.
eugenis added reviewers: kcc, alekseyshl.
Herald added subscribers: hiraditya, javed.absar, kubamracek, srhines.

Very basic stack instrumentation using tagged pointers.
Tag for N'th alloca in a function is built as XOR of:

- base tag for the function, which is just some bits of SP (poor man's random)
- small constant which is a function of N.

Allocas are aligned to 16 bytes. On every ReturnInst allocas are
re-tagged to catch use-after-return.

This implementation has a bunch of issues that will be taken care of
later:

1. lifetime intrinsics referring to tagged pointers are not recognized in SDAG. This effectively disables stack coloring.
2. Generated code is quite inefficient. There is one extra instruction at each memory access that adds the base tag to the untagged alloca address. It would be better to keep tagged SP in a callee-saved register and address allocas as an offset of that XOR retag, but that needs better coordination between hwasan instrumentation pass and prologue/epilogue insertion.
3. Lifetime instrinsics are ignored and use-after-scope is not implemented. This would be harder to do than in ASan, because we need to use a differently tagged pointer depending on which lifetime.start / lifetime.end the current instruction is dominated / post-dominated.


https://reviews.llvm.org/D41602

Files:
  compiler-rt/lib/hwasan/hwasan.cc
  compiler-rt/lib/hwasan/hwasan.h
  compiler-rt/lib/hwasan/hwasan_interceptors.cc
  compiler-rt/lib/hwasan/hwasan_interface_internal.h
  compiler-rt/lib/hwasan/hwasan_linux.cc
  compiler-rt/test/hwasan/TestCases/stack-oob.cc
  compiler-rt/test/hwasan/TestCases/stack-uar.cc
  llvm/lib/Target/AArch64/AArch64ISelLowering.h
  llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp
  llvm/test/Instrumentation/HWAddressSanitizer/alloca.ll

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D41602.128245.patch
Type: text/x-patch
Size: 18388 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20171227/ad4e3956/attachment.bin>