[compiler-rt] [llvm] [Asan] Add "funclet" OpBundle to generated runtime calls if required by EH personality (PR #82533)
via llvm-commits
llvm-commits at lists.llvm.org
Wed Feb 21 13:05:16 PST 2024
llvmbot wrote:
<!--LLVM PR SUMMARY COMMENT-->
@llvm/pr-subscribers-compiler-rt-sanitizer
Author: None (sylvain-audi)
<details>
<summary>Changes</summary>
Previously, runtime calls introduced by ASan instrumentation into EH pads were missing the funclet token expected by WinEHPrepare. WinEHPrepare would then identify the containing BB as invalid and discard it, causing invalid code generation that most likely crashes.
Also fixed localescape test, switching its EH personality to match code without funclets.
This PR is based on the Phabricator patch https://reviews.llvm.org/D143108
Fixes https://github.com/llvm/llvm-project/issues/64990
---
Patch is 31.09 KiB, truncated to 20.00 KiB below, full version: https://github.com/llvm/llvm-project/pull/82533.diff
4 Files Affected:
- (added) compiler-rt/test/asan/TestCases/Windows/issue64990.cpp (+18)
- (modified) llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp (+159-73)
- (added) llvm/test/Instrumentation/AddressSanitizer/asan-funclet.ll (+128)
- (modified) llvm/test/Instrumentation/AddressSanitizer/localescape.ll (+2-2)
``````````diff
diff --git a/compiler-rt/test/asan/TestCases/Windows/issue64990.cpp b/compiler-rt/test/asan/TestCases/Windows/issue64990.cpp
new file mode 100644
index 00000000000000..a5a46b5a81ddca
--- /dev/null
+++ b/compiler-rt/test/asan/TestCases/Windows/issue64990.cpp
@@ -0,0 +1,18 @@
+// Repro for the issue #64990: Asan with Windows EH generates __asan_xxx runtime calls without required funclet tokens
+// RUN: %clang_cl_asan %Od %s -EHsc %Fe%t
+// RUN: not %run %t 2>&1 | FileCheck %s
+
+char buff1[6] = "hello";
+char buff2[6] = "hello";
+
+int main(int argc, char **argv) {
+ try {
+ throw 1;
+ } catch (...) {
+ // Make asan generate call to __asan_memcpy inside the EH pad.
+ __builtin_memcpy(buff1, buff2 + 3, 6);
+ }
+ return 0;
+}
+
+// CHECK: SUMMARY: AddressSanitizer: global-buffer-overflow {{.*}} in __asan_memcpy
diff --git a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
index 8a2864a0787312..368d1c42ee44a2 100644
--- a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
+++ b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
@@ -43,6 +43,7 @@
#include "llvm/IR/DebugInfoMetadata.h"
#include "llvm/IR/DebugLoc.h"
#include "llvm/IR/DerivedTypes.h"
+#include "llvm/IR/EHPersonalities.h"
#include "llvm/IR/Function.h"
#include "llvm/IR/GlobalAlias.h"
#include "llvm/IR/GlobalValue.h"
@@ -642,6 +643,70 @@ static uint64_t GetCtorAndDtorPriority(Triple &TargetTriple) {
}
namespace {
+/// Helper RAII class to keep track of the inserted asan runtime calls during a
+/// pass on a single Function. Upon end of scope, detects and applies the
+/// required funclet OpBundle.
+class RuntimeCallInserter {
+ Function *OwnerFn = nullptr;
+ bool TrackInsertedCalls = false;
+ std::vector<CallInst *> InsertedCalls;
+
+public:
+ RuntimeCallInserter(Function &Fn) : OwnerFn(&Fn) {
+ if (Fn.hasPersonalityFn()) {
+ auto Personality = classifyEHPersonality(Fn.getPersonalityFn());
+ if (isScopedEHPersonality(Personality))
+ TrackInsertedCalls = true;
+ }
+ }
+
+ ~RuntimeCallInserter() {
+ if (!TrackInsertedCalls || InsertedCalls.empty())
+ return;
+
+ DenseMap<BasicBlock *, ColorVector> BlockColors = colorEHFunclets(*OwnerFn);
+ for (CallInst *CI : InsertedCalls) {
+ BasicBlock *BB = CI->getParent();
+ assert(BB && "Instruction doesn't belong to a BasicBlock");
+ assert(BB->getParent() == OwnerFn &&
+ "Instruction doesn't belong to the expected Function!");
+
+ ColorVector &Colors = BlockColors[BB];
+ // funclet opbundles are only valid in monochromatic BBs.
+ // Note that unreachable BBs are seen as colorless by colorEHFunclets()
+ // and will be DCE'ed later.
+ if (Colors.size() != 1) {
+ OwnerFn->getContext().emitError(
+ "Instruction's BasicBlock is not monochromatic");
+ continue;
+ }
+
+ BasicBlock *Color = Colors.front();
+ Instruction *EHPad = Color->getFirstNonPHI();
+
+ if (EHPad && EHPad->isEHPad()) {
+ // Replace CI with a clone with an added funclet OperandBundle
+ OperandBundleDef OB("funclet", EHPad);
+ auto *NewCall =
+ CallBase::addOperandBundle(CI, LLVMContext::OB_funclet, OB, CI);
+ NewCall->copyMetadata(*CI);
+ CI->replaceAllUsesWith(NewCall);
+ CI->eraseFromParent();
+ }
+ }
+ }
+
+ CallInst *createRuntimeCall(IRBuilder<> &IRB, FunctionCallee Callee,
+ ArrayRef<Value *> Args = {},
+ const Twine &Name = "") {
+ assert(IRB.GetInsertBlock()->getParent() == OwnerFn);
+
+ CallInst *Inst = IRB.CreateCall(Callee, Args, Name, nullptr);
+ if (TrackInsertedCalls)
+ InsertedCalls.push_back(Inst);
+ return Inst;
+ }
+};
/// AddressSanitizer: instrument the code in module to find memory bugs.
struct AddressSanitizer {
@@ -691,12 +756,14 @@ struct AddressSanitizer {
void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
InterestingMemoryOperand &O, bool UseCalls,
- const DataLayout &DL);
- void instrumentPointerComparisonOrSubtraction(Instruction *I);
+ const DataLayout &DL, RuntimeCallInserter &RTCI);
+ void instrumentPointerComparisonOrSubtraction(Instruction *I,
+ RuntimeCallInserter &RTCI);
void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore,
Value *Addr, MaybeAlign Alignment,
uint32_t TypeStoreSize, bool IsWrite,
- Value *SizeArgument, bool UseCalls, uint32_t Exp);
+ Value *SizeArgument, bool UseCalls, uint32_t Exp,
+ RuntimeCallInserter &RTCI);
Instruction *instrumentAMDGPUAddress(Instruction *OrigIns,
Instruction *InsertBefore, Value *Addr,
uint32_t TypeStoreSize, bool IsWrite,
@@ -707,20 +774,22 @@ struct AddressSanitizer {
Instruction *InsertBefore, Value *Addr,
TypeSize TypeStoreSize, bool IsWrite,
Value *SizeArgument, bool UseCalls,
- uint32_t Exp);
+ uint32_t Exp,
+ RuntimeCallInserter &RTCI);
void instrumentMaskedLoadOrStore(AddressSanitizer *Pass, const DataLayout &DL,
Type *IntptrTy, Value *Mask, Value *EVL,
Value *Stride, Instruction *I, Value *Addr,
MaybeAlign Alignment, unsigned Granularity,
Type *OpType, bool IsWrite,
Value *SizeArgument, bool UseCalls,
- uint32_t Exp);
+ uint32_t Exp, RuntimeCallInserter &RTCI);
Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
Value *ShadowValue, uint32_t TypeStoreSize);
Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
bool IsWrite, size_t AccessSizeIndex,
- Value *SizeArgument, uint32_t Exp);
- void instrumentMemIntrinsic(MemIntrinsic *MI);
+ Value *SizeArgument, uint32_t Exp,
+ RuntimeCallInserter &RTCI);
+ void instrumentMemIntrinsic(MemIntrinsic *MI, RuntimeCallInserter &RTCI);
Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
bool suppressInstrumentationSiteForDebug(int &Instrumented);
bool instrumentFunction(Function &F, const TargetLibraryInfo *TLI);
@@ -912,6 +981,7 @@ class ModuleAddressSanitizer {
struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
Function &F;
AddressSanitizer &ASan;
+ RuntimeCallInserter &RTCI;
DIBuilder DIB;
LLVMContext *C;
Type *IntptrTy;
@@ -948,10 +1018,12 @@ struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
bool HasReturnsTwiceCall = false;
bool PoisonStack;
- FunctionStackPoisoner(Function &F, AddressSanitizer &ASan)
- : F(F), ASan(ASan), DIB(*F.getParent(), /*AllowUnresolved*/ false),
- C(ASan.C), IntptrTy(ASan.IntptrTy),
- IntptrPtrTy(PointerType::get(IntptrTy, 0)), Mapping(ASan.Mapping),
+ FunctionStackPoisoner(Function &F, AddressSanitizer &ASan,
+ RuntimeCallInserter &RTCI)
+ : F(F), ASan(ASan), RTCI(RTCI),
+ DIB(*F.getParent(), /*AllowUnresolved*/ false), C(ASan.C),
+ IntptrTy(ASan.IntptrTy), IntptrPtrTy(PointerType::get(IntptrTy, 0)),
+ Mapping(ASan.Mapping),
PoisonStack(ClStack &&
!Triple(F.getParent()->getTargetTriple()).isAMDGPU()) {}
@@ -1034,8 +1106,8 @@ struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
DynamicAreaOffset);
}
- IRB.CreateCall(
- AsanAllocasUnpoisonFunc,
+ RTCI.createRuntimeCall(
+ IRB, AsanAllocasUnpoisonFunc,
{IRB.CreateLoad(IntptrTy, DynamicAllocaLayout), DynamicAreaPtr});
}
@@ -1251,16 +1323,18 @@ Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) {
}
// Instrument memset/memmove/memcpy
-void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) {
+void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI,
+ RuntimeCallInserter &RTCI) {
InstrumentationIRBuilder IRB(MI);
if (isa<MemTransferInst>(MI)) {
- IRB.CreateCall(isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy,
- {IRB.CreateAddrSpaceCast(MI->getOperand(0), PtrTy),
- IRB.CreateAddrSpaceCast(MI->getOperand(1), PtrTy),
- IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
+ RTCI.createRuntimeCall(
+ IRB, isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy,
+ {IRB.CreateAddrSpaceCast(MI->getOperand(0), PtrTy),
+ IRB.CreateAddrSpaceCast(MI->getOperand(1), PtrTy),
+ IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
} else if (isa<MemSetInst>(MI)) {
- IRB.CreateCall(
- AsanMemset,
+ RTCI.createRuntimeCall(
+ IRB, AsanMemset,
{IRB.CreateAddrSpaceCast(MI->getOperand(0), PtrTy),
IRB.CreateIntCast(MI->getOperand(1), IRB.getInt32Ty(), false),
IRB.CreateIntCast(MI->getOperand(2), IntptrTy, false)});
@@ -1498,7 +1572,7 @@ bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) {
}
void AddressSanitizer::instrumentPointerComparisonOrSubtraction(
- Instruction *I) {
+ Instruction *I, RuntimeCallInserter &RTCI) {
IRBuilder<> IRB(I);
FunctionCallee F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction;
Value *Param[2] = {I->getOperand(0), I->getOperand(1)};
@@ -1506,7 +1580,7 @@ void AddressSanitizer::instrumentPointerComparisonOrSubtraction(
if (i->getType()->isPointerTy())
i = IRB.CreatePointerCast(i, IntptrTy);
}
- IRB.CreateCall(F, Param);
+ RTCI.createRuntimeCall(IRB, F, Param);
}
static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I,
@@ -1514,7 +1588,7 @@ static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I,
MaybeAlign Alignment, unsigned Granularity,
TypeSize TypeStoreSize, bool IsWrite,
Value *SizeArgument, bool UseCalls,
- uint32_t Exp) {
+ uint32_t Exp, RuntimeCallInserter &RTCI) {
// Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check
// if the data is properly aligned.
if (!TypeStoreSize.isScalable()) {
@@ -1529,18 +1603,19 @@ static void doInstrumentAddress(AddressSanitizer *Pass, Instruction *I,
*Alignment >= FixedSize / 8)
return Pass->instrumentAddress(I, InsertBefore, Addr, Alignment,
FixedSize, IsWrite, nullptr, UseCalls,
- Exp);
+ Exp, RTCI);
}
}
Pass->instrumentUnusualSizeOrAlignment(I, InsertBefore, Addr, TypeStoreSize,
- IsWrite, nullptr, UseCalls, Exp);
+ IsWrite, nullptr, UseCalls, Exp, RTCI);
}
void AddressSanitizer::instrumentMaskedLoadOrStore(
AddressSanitizer *Pass, const DataLayout &DL, Type *IntptrTy, Value *Mask,
Value *EVL, Value *Stride, Instruction *I, Value *Addr,
MaybeAlign Alignment, unsigned Granularity, Type *OpType, bool IsWrite,
- Value *SizeArgument, bool UseCalls, uint32_t Exp) {
+ Value *SizeArgument, bool UseCalls, uint32_t Exp,
+ RuntimeCallInserter &RTCI) {
auto *VTy = cast<VectorType>(OpType);
TypeSize ElemTypeSize = DL.getTypeStoreSizeInBits(VTy->getScalarType());
auto Zero = ConstantInt::get(IntptrTy, 0);
@@ -1595,15 +1670,16 @@ void AddressSanitizer::instrumentMaskedLoadOrStore(
} else {
InstrumentedAddress = IRB.CreateGEP(VTy, Addr, {Zero, Index});
}
- doInstrumentAddress(Pass, I, &*IRB.GetInsertPoint(),
- InstrumentedAddress, Alignment, Granularity,
- ElemTypeSize, IsWrite, SizeArgument, UseCalls, Exp);
+ doInstrumentAddress(Pass, I, &*IRB.GetInsertPoint(), InstrumentedAddress,
+ Alignment, Granularity, ElemTypeSize, IsWrite,
+ SizeArgument, UseCalls, Exp, RTCI);
});
}
void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
InterestingMemoryOperand &O, bool UseCalls,
- const DataLayout &DL) {
+ const DataLayout &DL,
+ RuntimeCallInserter &RTCI) {
Value *Addr = O.getPtr();
// Optimization experiments.
@@ -1649,11 +1725,11 @@ void AddressSanitizer::instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis,
instrumentMaskedLoadOrStore(this, DL, IntptrTy, O.MaybeMask, O.MaybeEVL,
O.MaybeStride, O.getInsn(), Addr, O.Alignment,
Granularity, O.OpType, O.IsWrite, nullptr,
- UseCalls, Exp);
+ UseCalls, Exp, RTCI);
} else {
doInstrumentAddress(this, O.getInsn(), O.getInsn(), Addr, O.Alignment,
- Granularity, O.TypeStoreSize, O.IsWrite, nullptr, UseCalls,
- Exp);
+ Granularity, O.TypeStoreSize, O.IsWrite, nullptr,
+ UseCalls, Exp, RTCI);
}
}
@@ -1661,24 +1737,25 @@ Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore,
Value *Addr, bool IsWrite,
size_t AccessSizeIndex,
Value *SizeArgument,
- uint32_t Exp) {
+ uint32_t Exp,
+ RuntimeCallInserter &RTCI) {
InstrumentationIRBuilder IRB(InsertBefore);
Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp);
CallInst *Call = nullptr;
if (SizeArgument) {
if (Exp == 0)
- Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][0],
- {Addr, SizeArgument});
+ Call = RTCI.createRuntimeCall(IRB, AsanErrorCallbackSized[IsWrite][0],
+ {Addr, SizeArgument});
else
- Call = IRB.CreateCall(AsanErrorCallbackSized[IsWrite][1],
- {Addr, SizeArgument, ExpVal});
+ Call = RTCI.createRuntimeCall(IRB, AsanErrorCallbackSized[IsWrite][1],
+ {Addr, SizeArgument, ExpVal});
} else {
if (Exp == 0)
- Call =
- IRB.CreateCall(AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr);
+ Call = RTCI.createRuntimeCall(
+ IRB, AsanErrorCallback[IsWrite][0][AccessSizeIndex], Addr);
else
- Call = IRB.CreateCall(AsanErrorCallback[IsWrite][1][AccessSizeIndex],
- {Addr, ExpVal});
+ Call = RTCI.createRuntimeCall(
+ IRB, AsanErrorCallback[IsWrite][1][AccessSizeIndex], {Addr, ExpVal});
}
Call->setCannotMerge();
@@ -1754,7 +1831,8 @@ void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
MaybeAlign Alignment,
uint32_t TypeStoreSize, bool IsWrite,
Value *SizeArgument, bool UseCalls,
- uint32_t Exp) {
+ uint32_t Exp,
+ RuntimeCallInserter &RTCI) {
if (TargetTriple.isAMDGPU()) {
InsertBefore = instrumentAMDGPUAddress(OrigIns, InsertBefore, Addr,
TypeStoreSize, IsWrite, SizeArgument);
@@ -1779,11 +1857,12 @@ void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
if (UseCalls) {
if (Exp == 0)
- IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex],
- AddrLong);
+ RTCI.createRuntimeCall(
+ IRB, AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex], AddrLong);
else
- IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex],
- {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)});
+ RTCI.createRuntimeCall(
+ IRB, AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex],
+ {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)});
return;
}
@@ -1830,8 +1909,8 @@ void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, !Recover);
}
- Instruction *Crash = generateCrashCode(CrashTerm, AddrLong, IsWrite,
- AccessSizeIndex, SizeArgument, Exp);
+ Instruction *Crash = generateCrashCode(
+ CrashTerm, AddrLong, IsWrite, AccessSizeIndex, SizeArgument, Exp, RTCI);
if (OrigIns->getDebugLoc())
Crash->setDebugLoc(OrigIns->getDebugLoc());
}
@@ -1841,8 +1920,9 @@ void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
// and the last bytes. We call __asan_report_*_n(addr, real_size) to be able
// to report the actual access size.
void AddressSanitizer::instrumentUnusualSizeOrAlignment(
- Instruction *I, Instruction *InsertBefore, Value *Addr, TypeSize TypeStoreSize,
- bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp) {
+ Instruction *I, Instruction *InsertBefore, Value *Addr,
+ TypeSize TypeStoreSize, bool IsWrite, Value *SizeArgument, bool UseCalls,
+ uint32_t Exp, RuntimeCallInserter &RTCI) {
InstrumentationIRBuilder IRB(InsertBefore);
Value *NumBits = IRB.CreateTypeSize(IntptrTy, TypeStoreSize);
Value *Size = IRB.CreateLShr(NumBits, ConstantInt::get(IntptrTy, 3));
@@ -1850,19 +1930,21 @@ void AddressSanitizer::instrumentUnusualSizeOrAlignment(
Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
if (UseCalls) {
if (Exp == 0)
- IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0],
- {AddrLong, Size});
+ RTCI.createRuntimeCall(IRB, AsanMemoryAccessCallbackSized[IsWrite][0],
+ {AddrLong, Size});
else
- IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1],
- {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)});
+ RTCI.createRuntimeCall(
+ IRB, AsanMemoryAccessCallbackSized[IsWrite][1],
+ {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)});
} else {
Value *SizeMinusOne = IRB.CreateSub(Size, ConstantInt::get(IntptrTy, 1));
Value *LastByte = IRB.CreateIntToPtr(
IRB.CreateAdd(AddrLong, SizeMinusOne),
Addr->getType());
- instrumentAddress(I, InsertBefore, Addr, {}, 8, IsWrite, Size, false, Exp);
+ instrumentAddress(I, InsertBefore, Addr, {}, 8, IsWrite, Size, false, Exp,
+ RTCI);
instrumentAddress(I, InsertBefore, LastByte, {}, 8, IsWrite, Size, false,
- Exp);
+ Exp, RTCI);
}
}
@@ -2877,6 +2959,8 @@ bool AddressSanitizer::instrumentFunction(Function &F,
FunctionStateRAII CleanupObj(this);
+ RuntimeCallInserter RTCI(F);
+
FunctionModified |= maybeInsertDynamicShadowAtFunctionEntry(F);
// We can't instrument allocas used with llvm.localescape. Only static allocas
@@ -2959,27 +3043,27 @@ bool AddressSanitizer::instrumentFunction(Function &F,
for (auto &Operand : OperandsToInstrument) {
if (!suppressInstrumentationSiteForDebug(NumInstrumented))
instrumentMop(ObjSizeVis, Operand, UseCalls,
- F.getParent()->getDataLayout());
+ F.getParent(...
[truncated]
``````````
</details>
https://github.com/llvm/llvm-project/pull/82533
More information about the llvm-commits
mailing list