Commit Graph

2157 Commits

Author SHA1 Message Date
Peter Wu dbc4f7413c [ASAN] Add interceptor for __longjmp_chk
Summary:
glibc on Linux calls __longjmp_chk instead of longjmp (or _longjmp) when
_FORTIFY_SOURCE is defined. Ensure that an ASAN-instrumented program
intercepts this function when a system library calls it, otherwise the
stack might remain poisoned and result in CHECK failures and false
positives.

Fixes https://github.com/google/sanitizers/issues/721

Reviewed By: eugenis

Differential Revision: https://reviews.llvm.org/D32408

llvm-svn: 302152
2017-05-04 14:03:57 +00:00
Pierre Gousseau 1c5550671d Revert r301904 causing tsan test failure in x86_64-linux-autoconf
llvm-svn: 301909
2017-05-02 10:22:05 +00:00
Pierre Gousseau b7101479a8 [asan] Add strndup/__strndup interceptors if targeting linux.
Differential Revision: https://reviews.llvm.org/D31457

llvm-svn: 301904
2017-05-02 09:01:02 +00:00
Kostya Serebryany e5ca68cfcd [asan] speed up small memcpy (> 32 but <= 64 bytes)
llvm-svn: 301837
2017-05-01 21:05:29 +00:00
Evgeniy Stepanov 4094d9a127 [asan] Fix dead stripping of globals on Linux (compiler-rt).
Third attempt. See the description of the corresponding commit in
LLVM for more details.

llvm-svn: 301588
2017-04-27 20:27:33 +00:00
Alex Shlyapnikov bdbb894a52 Define a suppression for known leaks on pthread_exit call.
Summary: Refer to D32194 for the context.

Reviewers: eugenis

Subscribers: kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D32303

llvm-svn: 300886
2017-04-20 20:54:19 +00:00
Alex Shlyapnikov 87276d68cd Turn symbolization on for ASan unit test.
Summary:
On PowerPC and ARM (possibly, need to verify), couple tests involving
pthread_exit fail due to leaks detected by LSan. pthread_exit tries
to perform unwinding that leads to dlopen'ing libgcc_s.so. dlopen
mallocs "libgcc_s.so" string which confuses LSan, it fails to
realize that this allocation happens in dynamic linker and should
be ignored.
Symbolized leak report is required to define a suppression for this
known problem.

Reviewers: eugenis

Subscribers: aemerson, rengolin, kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D32194

Turn symbolization on for PPC and Thumb only to do not slow down other platforms.

llvm-svn: 300748
2017-04-19 20:39:09 +00:00
Kuba Mracek ceb30b0717 [sanitizer] Introduce tid_t as a typedef for OS-provided thread IDs
We seem to assume that OS-provided thread IDs are either uptr or int, neither of which is true on Darwin. This introduces a tid_t type, which holds a OS-provided thread ID (gettid on Linux, pthread_threadid_np on Darwin, pthread_self on FreeBSD).

Differential Revision: https://reviews.llvm.org/D31774

llvm-svn: 300473
2017-04-17 18:17:38 +00:00
Francis Ricci e9438b35aa Fix memory leaks in address sanitizer darwin tests
Summary: These leaks are detected by leak sanitizer for darwin.

Reviewers: glider, kubamracek, kcc, alekseyshl

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D31978

llvm-svn: 300080
2017-04-12 17:31:41 +00:00
Maxim Ostapenko de3b9a2ecc Reapply "Enable LSan for arm Linux"
This patch reapplies r299923 with typo fixed in BLX macros.

llvm-svn: 299948
2017-04-11 14:58:26 +00:00
Nico Weber 7124b5f6f9 Revert r299923, it doesn't build in bootstrap builds.
FAILED: lib/sanitizer_common/CMakeFiles/RTSanitizerCommon.arm.dir/sanitizer_linux.cc.o 
lib/sanitizer_common/sanitizer_linux.cc:1340:24: error: invalid instruction
                       BLX(ip)
                       ^
lib/sanitizer_common/sanitizer_linux.cc:1313:19: note: expanded from macro 'BLX'
#  define BLX(R) "mov lr, pc; bx" #R "\n"
                  ^
<inline asm>:6:13: note: instantiated into assembly here
mov lr, pc; bxip
            ^~~~

llvm-svn: 299943
2017-04-11 14:28:49 +00:00
Maxim Ostapenko 950d2809d5 [lsan] Enable LSan for arm Linux
This patch enables LSan for arm Linux.

Differential Revision: https://reviews.llvm.org/D29586

llvm-svn: 299923
2017-04-11 08:13:38 +00:00
Evgeniy Stepanov 2384165155 Revert "[asan] Fix dead stripping of globals on Linux (compiler-rt)."
This reverts r299698, which caused a big increase in object file size.

llvm-svn: 299881
2017-04-10 20:36:43 +00:00
Ivan A. Kosarev ec4880905d [Asan] Eliminate SHADOW_TO_MEM() macro
Differential Revision: https://reviews.llvm.org/D31592

llvm-svn: 299867
2017-04-10 19:13:47 +00:00
Evgeniy Stepanov 0680968ff3 [asan] Fix dead stripping of globals on Linux (compiler-rt).
This is a re-land of r298173, r298169, r298159.

llvm-svn: 299698
2017-04-06 19:55:52 +00:00
Francis Ricci 4cce35f0ce Enable builds of darwin lsan by default
Summary: Testing and asan leak detection are disabled by default.

Reviewers: kubamracek, kcc

Subscribers: srhines, llvm-commits, mgorny

Differential Revision: https://reviews.llvm.org/D31307

llvm-svn: 299669
2017-04-06 17:41:26 +00:00
Maxim Ostapenko f73b73d04d [asan] Move AsanCheckDynamicRTPrereqs check under flag
The patch addresses https://github.com/google/sanitizers/issues/786. Currently AsanCheckDynamicRTPrereqs prevents
dynamic ASan runtime from running in some important environments e.g. cowbuilder and fakeroot that may also work with interposition.
Let's allow users to switch off the check given that they know what they do.

Differential Revision: https://reviews.llvm.org/D31420

llvm-svn: 299188
2017-03-31 06:36:37 +00:00
Kuba Mracek fe7e91b003 [asan] Implement "scribble" flags, which overwrite free'd memory with 0x55
This patch implements "Malloc Scribble" in ASan via "max_free_fill_size" and "free_fill_byte" flags, which can be used to overwrite free()'d memory. We also match the behavior of MallocScribble and MallocPreScribble env vars on macOS (see https://developer.apple.com/library/content/documentation/Performance/Conceptual/ManagingMemory/Articles/MallocDebug.html), which is a helpful tool to detect use-after-free bugs that happen in non-instrumented code.

Differential Revision: https://reviews.llvm.org/D30101

llvm-svn: 299085
2017-03-30 15:44:57 +00:00
Kuba Mracek 8ed2928d2c [asan] Support line numbers in StackVarDescr
When -fsanitize-address-use-after-scope is used, the instrumentation produces line numbers in stack frame descriptions. This patch make sure the ASan runtime supports this format (ParseFrameDescription needs to be able to parse "varname:line") and prepares lit tests to allow line numbers in ASan report output.

Differential Revision: https://reviews.llvm.org/D31484

llvm-svn: 299043
2017-03-30 00:41:09 +00:00
Filipe Cabecinhas e144b72372 Add allocator_frees_and_returns_null_on_realloc_zero=false flag for compatibility with allocators which allow a realloc(p, 0) and don't free the pointer.
Summary:
I know of two implementations that do this (ASan is not protecting against accessing the returned memory for now, just like malloc(0)):
SIE libc on the PS4
dlmalloc has a flag for this

This allows us to properly support this behaviour.

Reviewers: vsk, kcc

Subscribers: llvm-commits, kubamracek

Differential Revision: https://reviews.llvm.org/D31295

llvm-svn: 299016
2017-03-29 18:17:22 +00:00
Bill Seurer 467afc5f84 [powerpc] deactivate ManyThreadsTest asan test on powerpc64
This test case occassionally hangs when run on powerpc.  This is also a
problem on AArch64 (see https://bugs.llvm.org/show_bug.cgi?id=24389).
Reactivate this when the problem is fixed.

This could also be related to the same problem as with the tests
ThreadedOneSizeMallocStressTest, ThreadedMallocStressTest, and several
others that do not run reliably on powerpc.

llvm-svn: 298873
2017-03-27 18:36:06 +00:00
Alex Shlyapnikov d6848fc58f Add strtok interceptor for ASAN for Windows.
Summary: Fixes test broken by D30384

Reviewers: eugenis

Subscribers: kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D31312

llvm-svn: 298658
2017-03-23 23:20:47 +00:00
Evgeniy Stepanov 3bf85d3124 Revert r298174, r298173, r298169, r298159.
Revert "Fix sanitizer tests with LLVM_TOOL_LLD_BUILD=OFF."
Revert "[asan] Remove gc-sections test with bfd."
Revert "[asan] Disable globals-gc test with ld.bfd."
Revert "[asan] Fix dead stripping of globals on Linux (compiler-rt)"

OOM in gold linker.

llvm-svn: 298287
2017-03-20 18:45:27 +00:00
Evgeniy Stepanov 79ee0c1813 [asan] Fix dead stripping of globals on Linux (compiler-rt)
Runtime support for the new instrumentation of globals based on !associated, and a bunch of tests.

Differential Revision: https://reviews.llvm.org/D30120

llvm-svn: 298159
2017-03-17 22:17:38 +00:00
Kostya Serebryany ec3ceb1ce5 [asan] trying to fix the windows build
llvm-svn: 297918
2017-03-15 23:53:12 +00:00
Kostya Serebryany 82a41dd6c4 [asan] add one more argument to __sanitizer_print_memory_profile, remove a redundant weak definition.
llvm-svn: 297914
2017-03-15 23:27:14 +00:00
Reid Kleckner 029dbd5e97 Fix -Wstring-conversion instance
llvm-svn: 297879
2017-03-15 19:50:02 +00:00
Filipe Cabecinhas 51c5396de8 Some ASan bots (AArch64 at least) use SEGV for a unit test error instead of SIGBUS
llvm-svn: 297728
2017-03-14 10:26:37 +00:00
Filipe Cabecinhas f7c7c11312 [asan] Split SIGSEGV / SIGBUS handling so we can handle only one of them and not the other.
Summary: This is useful in some platforms where one of these signals is special.

Reviewers: kubamracek, kcc

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D30783

llvm-svn: 297665
2017-03-13 21:06:41 +00:00
Maxim Ostapenko 76630d43f6 [sanitizer] Bail out with warning if user dlopens shared library with RTLD_DEEPBIND flag
People keep hitting on spurious failures in malloc/free routines when using sanitizers
with shared libraries dlopened with RTLD_DEEPBIND (see https://github.com/google/sanitizers/issues/611 for details).
Let's check for this flag and bail out with warning message instead of failing in random places.

Differential Revision: https://reviews.llvm.org/D30504

llvm-svn: 297370
2017-03-09 10:47:38 +00:00
Filipe Cabecinhas 9a563daff5 Restrict usage of MemoryMappingLayout to platforms which support it
llvm-svn: 296657
2017-03-01 19:20:13 +00:00
Filipe Cabecinhas 74ad311556 Reapply r296419: [asan] Print a "PC is at a non-executable memory region" message if that's the case
Summary: Points the user to look at function pointer assignments.

Reviewers: kcc, eugenis, kubamracek

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D30432

llvm-svn: 296653
2017-03-01 18:52:11 +00:00
Filipe Cabecinhas 6e36c11d2a Revert r296419 since the strings appear to need some tweaking.
llvm-svn: 296428
2017-02-28 02:45:46 +00:00
Filipe Cabecinhas cd643f6324 [asan] Print a "PC is at a non-executable memory region" message if that's the case
Summary: Points the user to look at function pointer assignments.

Reviewers: kcc, eugenis, kubamracek

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D30432

llvm-svn: 296419
2017-02-28 00:56:43 +00:00
Etienne Bergeron fc68c2c777 [compiler-rt][asan] Add support for desallocation of unhandled pointers
Summary: On windows 10, the ucrt DLL is performing allocations before the function hooking and there are multiple allocations not handled by Asan. When a free occur at the end of the process, asan is reporting desallocations not malloc-ed.

Reviewers: rnk, kcc

Reviewed By: rnk, kcc

Subscribers: kcc, llvm-commits, kubamracek, chrisha, dberris

Differential Revision: https://reviews.llvm.org/D25946

llvm-svn: 295730
2017-02-21 16:09:38 +00:00
Etienne Bergeron b69639e217 [compiler-rt][asan|win] Fix ASAN exception handler missing import
Summary:
This patch is adding a missing ASAN API redirection from an instrumented DLL.
The bug was introduced here:
  https://reviews.llvm.org/D29463

This is causing this chromium bug:
  https://bugs.chromium.org/p/chromium/issues/detail?id=692580

Reviewers: rnk

Reviewed By: rnk

Subscribers: kubamracek, dberris, llvm-commits, chrisha, thakis

Differential Revision: https://reviews.llvm.org/D30001

llvm-svn: 295232
2017-02-15 20:48:04 +00:00
Francis Ricci 8187c7b06b Add cmake build support for lsan on OS X
Summary:
Adds a new cmake flag 'COMPILER_RT_ENABLE_LSAN_OSX', which enables lsan
compilation and is turned off by default. Patches to fix build errors
when this flag is enabled will be uploaded soon.

This is part of an effort to port LSan to OS X, but LSan on OS X does not
currently work or pass tests currently.

Reviewers: kubamracek, kcc, glider, alekseyshl

Reviewed By: kubamracek

Subscribers: danalbert, srhines, mgorny, llvm-commits

Differential Revision: https://reviews.llvm.org/D29783

llvm-svn: 295012
2017-02-14 00:56:53 +00:00
Saleem Abdulrasool 8a450fb140 build: repair cross-compilation with clang
When building for Windows, we would check if we were using MSVC rather
than WIN32.  This resulted in needed targets not being defined by
sanitizer_common.  Fix the conditional.

When registering the objects libraries for ASAN, we would multiply
register for all targets as we were creating them inside a loop over all
architectures.  Only define the target per architecture.

llvm-svn: 294510
2017-02-08 20:43:39 +00:00
NAKAMURA Takumi 9c2d8102d1 asan_symbolize.py: [Py3] Get rid of "print" statement. Use print() or write() instead.
Differential Revision: https://reviews.llvm.org/D27404

llvm-svn: 294450
2017-02-08 14:07:39 +00:00
NAKAMURA Takumi ce43bdb3d0 asan_symbolize.py: [Py3] Use text mode with universal_newlines=True for Popen.
With universal_newlines, readline() stalls to fill the buffer. Therefore, let the pipe unbuffered.

This is part of https://reviews.llvm.org/D27404

FIXME: Use Popen.communicate()
llvm-svn: 294303
2017-02-07 14:06:01 +00:00
Alexander Kornienko a8ebc34252 [asan] Remove `using std::vector` and `using std::map`
Looks like these are not needed anymore.

llvm-svn: 294200
2017-02-06 17:28:05 +00:00
Marcos Pividori 2b9c44e226 [sanitizer] Use interception to access to strong definitions in the executable.
In Windows, when sanitizers are implemented as a shared library (DLL), users can
redefine and export a new definition for weak functions, in the main executable,
for example:

extern "C" __declspec(dllexport)
void __sanitizer_cov_trace_pc_guard(u32* guard) {
  // Different implementation provided by the client.
}

However, other dlls, will continue using the default implementation imported
from the sanitizer dll. This is different in linux, where all the shared
libraries will consider the strong definition.

With the implementation in this diff, when the dll is initialized, it will check
if the main executable exports the definition for some weak function (for
example __sanitizer_cov_trace_pc_guard). If it finds that function, then it will
override the function in the dll with that pointer. So, all the dlls with
instrumentation that import __sanitizer_cov_trace_pc_guard__dll() from asan dll,
will be using the function provided by the main executable.

In other words, when the main executable exports a strong definition for a weak
function, we ensure all the dlls use that implementation instead of the default
weak implementation.

The behavior is similar to linux. Now, every user that want to override a weak
function, only has to define and export it. The same for Linux and Windows, and
it will work fine. So, there is no difference on the user's side.

All the sanitizers will include a file sanitizer_win_weak_interception.cc that
register sanitizer's weak functions to be intercepted in the binary section WEAK

When the sanitizer dll is initialized, it will execute weak_intercept_init()
which will consider all the CB registered in the section WEAK. So, for all the
weak functions registered, we will check if a strong definition is provided in
the main executable.

All the files sanitizer_win_weak_interception.cc are independent, so we do not
need to include a specific list of sanitizers.
Now, we include [asan|ubsan|sanitizer_coverage]_win_weak_interception.cc and
sanitizer_win_weak_interception.cc in asan dll, so when it is initialized, it
will consider all the weak functions from asan, ubsan and sanitizer coverage.

After this diff, sanitizer coverage is fixed for MD on Windows. In particular
libFuzzer can provide custom implementation for all sanitizer coverage's weak
functions, and they will be considered by asan dll.

Differential Revision: https://reviews.llvm.org/D29168

llvm-svn: 293958
2017-02-02 23:02:11 +00:00
Marcos Pividori e49ec6d57c [asan] Intercept SetUnhandledExceptionFilter.
In this diff I update the code for asan on Windows, so we can intercept
SetUnhandledExceptionFilter and catch some exceptions depending on the result of
IsHandledDeadlyException() (which depends on asan flags).

This way we have the same behavior on Windows and Posix systems.
On Posix, we intercept signal and sigaction, so user's code can only register
signal handlers for signals that are not handled by asan.
After this diff, the same happens on Windows, user's code can only register
exception handlers for exceptions that are not handled by asan.

Differential Revision: https://reviews.llvm.org/D29463

llvm-svn: 293957
2017-02-02 23:02:04 +00:00
Marcos Pividori fe9288a6a0 [sanitizer] Move DescribeSignalOrException to sanitizer_common.
Differential Revision: https://reviews.llvm.org/D29459

llvm-svn: 293956
2017-02-02 23:01:59 +00:00
Marcos Pividori ee22156b78 [sanitizer] Move exception code to sanitizer_common.
Differential Revision: https://reviews.llvm.org/D29458

llvm-svn: 293955
2017-02-02 23:01:51 +00:00
Marcos Pividori 387210c6c8 [asan] Properly handle exceptions.
Differential Revision: https://reviews.llvm.org/D29457

llvm-svn: 293954
2017-02-02 23:01:46 +00:00
Marcos Pividori b88e87d4b2 [sanitizer] Add dynamic_runtime_thunk for different sanitizers.
In Windows, when the sanitizer is implemented as a shared library (DLL), we need
an auxiliary static library dynamic_runtime_thunk that will be linked to the
main executable and dlls.

In the sanitizer DLL, we are exposing weak functions with WIN_WEAK_EXPORT_DEF(),
which exports the default implementation with __dll suffix. For example: for
sanitizer coverage, the default implementation of __sanitizer_cov_trace_cmp is
exported as: __sanitizer_cov_trace_cmp__dll.

In the dynamic_runtime_thunk static library, we include weak aliases to the
imported implementation from the dll, using the macro WIN_WEAK_IMPORT_DEF().

By default, all users's programs that include calls to weak functions like
__sanitizer_cov_trace_cmp, will be redirected to the implementation in the dll,
when linking to dynamic_runtime_thunk.

After this diff, we are able to compile code with sanitizer coverage
instrumentation on Windows. When the instrumented object files are linked with
clang-rt_asan_dynamic_runtime_thunk-arch.lib all the weak symbols will be
resolved to the implementation imported from asan dll.

All the files sanitizer_dynamic_runtime_thunk.cc are independent, so we do not
need to include a specific list of sanitizers.
Now, we compile: [asan|ubsan|sanitizer_coverage]_win_dynamic_runtime_thunk.cc
and sanitizer_win_dynamic_runtime_thunk.cc to generate
asan_dynamic_runtime_thunk.lib, because we include asan, ubsan and sanitizer
coverage in the address sanitizer library.

Differential Revision: https://reviews.llvm.org/D29158

llvm-svn: 293953
2017-02-02 23:01:41 +00:00
Marcos Pividori f5d265460d [sanitizer] Intercept weak functions in dll_thunks.
In this diff, I update current implementation of the interception in dll_thunks
to consider the special case of weak functions.
First we check if the client has redefined the function in the main executable
(for example: __sanitizer_cov_trace_pc_guard). It we can't find it, then we look
for the default implementation (__sanitizer_cov_trace_pc_guard__dll). The
default implementation is always available because the static runtime is linked
to the main executable.

Differential Revision: https://reviews.llvm.org/D29155

llvm-svn: 293952
2017-02-02 23:01:34 +00:00
Marcos Pividori bfdfaa11ca [sanitizer] Split dll_thunks into different sanitizers.
When the sanitizer is implemented as a static library and is included in the
main executable, we need an auxiliary static library dll_thunk that will be
linked to the dlls that have instrumentation, so they can refer to the runtime
in the main executable. Basically, it uses interception to get a pointer the
function in the main executable and override its function with that pointer.

Before this diff, all of the implementation for dll_thunks was included in asan.
In this diff I split it into different sanitizers, so we can use other
sanitizers regardless of whether we include asan or not.

All the sanitizers include a file sanitizer_win_dll_thunk.cc that register
functions to be intercepted in the binary section: DLLTH

When the dll including dll_thunk is initialized, it will execute
__dll_thunk_init() implemented in: sanitizer_common/sanitizer_win_dll_thunk.cc,
which will consider all the CB registered in the section DLLTH. So, all the
functions registered will be intercepted, and redirected to the implementation
in the main executable.

All the files "sanitizer_win_dll_thunk.cc" are independent, so we don't need to
include a specific list of sanitizers. Now, we compile:  asan_win_dll_thunk.cc
ubsan_win_dll_thunk.cc,  sanitizer_coverage_win_dll_thunk.cc and
sanitizer_win_dll_thunk.cc, to generate asan_dll_thunk, because we include asan,
ubsan and sanitizer coverage in the address sanitizer library.

Differential Revision: https://reviews.llvm.org/D29154

llvm-svn: 293951
2017-02-02 23:01:28 +00:00
Kuba Mracek bba1d40589 [tsan] Properly describe GCD worker threads in reports
When dealing with GCD worker threads, TSan currently prints weird things like "created by thread T-1" and "[failed to restore the stack]" in reports. This patch avoids that and instead prints "Thread T3 (...) is a GCD worker thread".

Differential Revision: https://reviews.llvm.org/D29103

llvm-svn: 293882
2017-02-02 12:54:21 +00:00