Commit Graph

298 Commits

Author SHA1 Message Date
Nico Weber bfb9c749c0 Fix some typos in d7ec48d71b 2021-05-04 10:44:01 -04:00
Nico Weber d7ec48d71b [clang] accept -fsanitize-ignorelist= in addition to -fsanitize-blacklist=
Use that for internal names (including the default ignorelists of the
sanitizers).

Differential Revision: https://reviews.llvm.org/D101832
2021-05-04 10:24:00 -04:00
Julian Lettner 9360f1a191 [Sanitizer] Fix sanitizer tests without reducing optimization levels
As discussed, these tests are compiled with optimization to mimic real
sanitizer usage [1].

Let's mark relevant functions with `noinline` so we can continue to
check against the stack traces in the report.

[1] https://reviews.llvm.org/D96198

This reverts commit 04af72c542.

Differential Revision: https://reviews.llvm.org/D96357
2021-02-11 15:22:20 -08:00
Vedant Kumar 897bec937e [test/ubsan] Allow unused FileCheck prefixes in TypeCheck/vptr.cpp
This test started failing after https://reviews.llvm.org/D95849
defaulted --allow-unused-prefixes to false.

Taking a look at the test, I didn't see an obvious need to add
OS-specific check lines for each supported value of %os.

rdar://74207657
2021-02-10 16:06:51 -08:00
Julian Lettner 04af72c542 [Sanitizer] Fix failing sanitizer tests
The new pass manager was enabled by default [1].

The commit message states the following relevant differences:
  * The inliner works slightly differently
  * -O1 does some amount of inlining

These tests are affected because they specify `-O1` and then check the
reported stack trace.

[1] https://reviews.llvm.org/D95380

Differential Revision: https://reviews.llvm.org/D96198
2021-02-08 09:56:32 -08:00
Fangrui Song 327196d688 [test] Fix unused FileCheck prefixes in compiler-rt/test 2021-02-01 21:24:58 -08:00
Fangrui Song a8970dff1a [ubsan][test] FLush stdout before checking interleaved stdout/stderr
Detected by musl.
2020-12-28 20:30:32 -08:00
Vitaly Buka 985a5d970a [NFC][UBSAN] Replace "count 0" with FileCheck
Unrelated system warnings may confuse "check 0"
2020-11-04 02:36:13 -08:00
Vitaly Buka 8ecf1c4969 [NFC][UBSAN] Try to re-enable tests on IOS
Looks like the reason they were disabled is the same as for Android
and it's fixed by 776a15d8ae
2020-10-27 23:49:31 -07:00
Vitaly Buka 58828f6a93 [NFC][UBSAN] Remove XFAIL from fixed tests 2020-10-27 23:43:50 -07:00
Vitaly Buka 776a15d8ae [NFC][UBSAN] Avoid "not FileCheck" in tests
It's not clear if "not FileCheck" succeeded because
input is empty or because input does not match "CHECK:"
pattern.
2020-10-23 19:13:01 -07:00
Rainer Orth a9cbe5cf30 [X86] Fix stack alignment on 32-bit Solaris/x86
On Solaris/x86, several hundred 32-bit tests `FAIL`, all in the same way:

  env ASAN_OPTIONS=halt_on_error=false ./halt_on_error_suppress_equal_pcs.cpp.tmp
  Segmentation Fault (core dumped)

They segfault during startup:

  Thread 2 received signal SIGSEGV, Segmentation fault.
  [Switching to Thread 1 (LWP 1)]
  0x080f21f0 in __sanitizer::internal_mmap(void*, unsigned long, int, int, int, unsigned long long) () at /vol/llvm/src/llvm-project/dist/compiler-rt/lib/sanitizer_common/sanitizer_solaris.cpp:65
  65	                             int prot, int flags, int fd, OFF_T offset) {
  1: x/i $pc
  => 0x80f21f0 <_ZN11__sanitizer13internal_mmapEPvmiiiy+16>:	movaps 0x30(%esp),%xmm0
  (gdb) p/x $esp
  $3 = 0xfeffd488

The problem is that `movaps` expects 16-byte alignment, while 32-bit Solaris/x86
only guarantees 4-byte alignment following the i386 psABI.

This patch updates `X86Subtarget::initSubtargetFeatures` accordingly,
handles Solaris/x86 in the corresponding testcase, and allows for some
variation in address alignment in
`compiler-rt/test/ubsan/TestCases/TypeCheck/vptr.cpp`.

Tested on `amd64-pc-solaris2.11` and `x86_64-pc-linux-gnu`.

Differential Revision: https://reviews.llvm.org/D87615
2020-09-17 11:17:11 +02:00
Rainer Orth 76e85ae268 [clang][Sparc] Default to -mcpu=v9 for Sparc V8 on Solaris
As reported in Bug 42535, `clang` doesn't inline atomic ops on 32-bit
Sparc, unlike `gcc` on Solaris.  In a 1-stage build with `gcc`, only two
testcases are affected (currently `XFAIL`ed), while in a 2-stage build more
than 100 tests `FAIL` due to this issue.

The reason for this `gcc`/`clang` difference is that `gcc` on 32-bit
Solaris/SPARC defaults to `-mpcu=v9` where atomic ops are supported, unlike
with `clang`'s default of `-mcpu=v8`.  This patch changes `clang` to use
`-mcpu=v9` on 32-bit Solaris/SPARC, too.

Doing so uncovered two bugs:

`clang -m32 -mcpu=v9` chokes with any Solaris system headers included:

  /usr/include/sys/isa_defs.h:461:2: error: "Both _ILP32 and _LP64 are defined"
  #error "Both _ILP32 and _LP64 are defined"

While `clang` currently defines `__sparcv9` in a 32-bit `-mcpu=v9`
compilation, neither `gcc` nor Studio `cc` do.  In fact, the Studio 12.6
`cc(1)` man page clearly states:

            These predefinitions are valid in all modes:
  [...]
               __sparcv8 (SPARC)
               __sparcv9 (SPARC -m64)

At the same time, the patch defines `__GCC_HAVE_SYNC_COMPARE_AND_SWAP_[1248]`
for a 32-bit Sparc compilation with any V9 cpu.  I've also changed
`MaxAtomicInlineWidth` for V9, matching what `gcc` does and the Oracle
Developer Studio 12.6: C User's Guide documents (Ch. 3, Support for Atomic
Types, 3.1 Size and Alignment of Atomic C Types).

The two testcases that had been `XFAIL`ed for Bug 42535 are un-`XFAIL`ed
again.

Tested on `sparcv9-sun-solaris2.11` and `amd64-pc-solaris2.11`.

Differential Revision: https://reviews.llvm.org/D86621
2020-09-11 09:53:19 +02:00
JF Bastien 82d29b397b Add an unsigned shift base sanitizer
It's not undefined behavior for an unsigned left shift to overflow (i.e. to
shift bits out), but it has been the source of bugs and exploits in certain
codebases in the past. As we do in other parts of UBSan, this patch adds a
dynamic checker which acts beyond UBSan and checks other sources of errors. The
option is enabled as part of -fsanitize=integer.

The flag is named: -fsanitize=unsigned-shift-base
This matches shift-base and shift-exponent flags.

<rdar://problem/46129047>

Differential Revision: https://reviews.llvm.org/D86000
2020-08-27 19:50:10 -07:00
Rainer Orth 13080ca1f0 [compiler-rt][test] XFAIL two tests on 32-bit sparc
Two tests `FAIL` on 32-bit sparc:

  Profile-sparc :: Posix/instrprof-gcov-parallel.test
  UBSan-Standalone-sparc :: TestCases/Float/cast-overflow.cpp

The failure mode is similar:

  Undefined                       first referenced
   symbol                             in file
  __atomic_store_4                    /var/tmp/instrprof-gcov-parallel-6afe8d.o
  __atomic_load_4                     /var/tmp/instrprof-gcov-parallel-6afe8d.o

  Undefined                       first referenced
   symbol                             in file
  __atomic_load_1                     /var/tmp/cast-overflow-72a808.o

This is a known bug: `clang` doesn't inline atomics on 32-bit sparc, unlike
`gcc`.

The patch therefore `XFAIL`s the tests.

Tested on `sparcv9-sun-solaris2.11` and `amd64-pc-solaris2.11`.

Differential Revision: https://reviews.llvm.org/D85346
2020-08-18 11:32:51 +02:00
Rainer Orth 8144a7d8fc [compiler-rt][ubsan][test] Fix TypeCheck/misaligned.cpp on Sparc
Two ubsan tests FAIL on Sparc:

  UBSan-Standalone-sparc :: TestCases/TypeCheck/misaligned.cpp
  UBSan-Standalone-sparcv9 :: TestCases/TypeCheck/misaligned.cpp

I've reported the details in Bug 47015, but it boils down to the fact that
the `s1` subtest actually incurs a fault on strict-alignment targets like
Sparc which UBSan doesn't expect.

This can be fixed like the `w1` subtest by compiling with
`-fno-sanitize-recover=alignment`.

Tested on `sparcv9-sun-solaris2.11`, `amd64-pc-solaris2.11`, and
`x86_64-pc-linux-gnu`.

Differential Revision: https://reviews.llvm.org/D85433
2020-08-11 12:46:34 +02:00
Julian Lettner 1d7790604c [UBSan] Increase robustness of tests
These UBSan tests assert the absence of runtime errors via `count 0`,
which means "expect no output".  This fails the test unnecessarily in
some environments (e.g., iOS simulator in our case).  Alter the test to
be a bit more specific and "expect no error" instead of "expect no
output".

rdar://65503408

Differential Revision: https://reviews.llvm.org/D85155
2020-08-03 15:26:58 -07:00
Vedant Kumar 8c4a65b9b2 [ubsan] Check implicit casts in ObjC for-in statements
Check that the implicit cast from `id` used to construct the element
variable in an ObjC for-in statement is valid.

This check is included as part of a new `objc-cast` sanitizer, outside
of the main 'undefined' group, as (IIUC) the behavior it's checking for
is not technically UB.

The check can be extended to cover other kinds of invalid casts in ObjC.

Partially addresses: rdar://12903059, rdar://9542496

Differential Revision: https://reviews.llvm.org/D71491
2020-07-13 15:11:18 -07:00
Jinsong Ji a7141480fb [compiler-rt][NFC]Fix Wdeprecated warnings for fsanitize-coverage
A few testcases are still using deprecated options.

warning: argument '-fsanitize-coverage=[func|bb|edge]' is deprecated,
use '-fsanitize-coverage=[func|bb|edge],[trace-pc-guard|trace-pc]'
instead [-Wdeprecated]

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D79741
2020-05-27 02:37:30 +00:00
Julian Lettner 80022ae2b5 [UBSan] Fix vptr checks on arm64e
Fix UBSan's vptr checks in the presence of arm64e pointer signing.

Radar-Id: rdar://61786404

Reviewed By: vsk

Differential Revision: https://reviews.llvm.org/D78230
2020-04-16 16:09:05 -07:00
Reid Kleckner 5d3a995938 Port ubsan nullability.c test to Windows
Two issues:
- Need to add env prefix to be compatible with the lit internal shell
- Need to quote the colon in Windows paths with '"%t.supp"'
2020-03-03 13:18:58 -08:00
Vedant Kumar 0eb5b6e88c [test/compiler-rt] Disable ubsan/TestCases/Misc/nullability.c on Android
It looks like the suppression file isn't being copied over to the
device.
2020-03-02 12:01:09 -08:00
Vedant Kumar 7300c338e5 [compiler-rt/test] Relax a test so we can debug it on sanitizer-x86_64-linux-android
This test is failing with a core dump on /just/ this bot, and I'd like
to find out why.

http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-android/builds/27979/
2020-02-28 17:46:56 -08:00
Vedant Kumar e71835f15c [compiler-rt/test] Use FileCheck -allow-empty instead of count 0
Hope this fixes:

http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-android/builds/27977/steps/run%20lit%20tests%20%5Bi686%2Ffugu-userdebug%2FN2G48C%5D/logs/stdio

```
: 'RUN: at line 8';   UBSAN_OPTIONS=suppressions=/var/lib/buildbot/sanitizer-buildbot6/sanitizer-x86_64-linux-android/build/compiler_rt_build_android_i686/test/ubsan/Standalone-i386/TestCases/Misc/Output/nullability.c.tmp.supp  /var/lib/buildbot/sanitizer-buildbot6/sanitizer-x86_64-linux-android/build/compiler_rt_build_android_i686/test/ubsan/Standalone-i386/TestCases/Misc/Output/nullability.c.tmp 2>&1 | count 0
--
Exit Code: 1

Command Output (stderr):
--
Expected 0 lines, got 2.
```

Not sure what this would be printing though, a sanitizer initialization message?
2020-02-28 16:21:57 -08:00
Vedant Kumar c54597b99d [ubsan] Add support for -fsanitize=nullability-* suppressions
rdar://59402904
2020-02-28 14:30:40 -08:00
Dan Liew f5951bdc3a [compiler-rt] Provide a lit config variable that defines the minimum deployment OS version flag appropriate for the configured OS.
This patch defines `config.apple_platform_min_deployment_target_flag`
in the ASan, LibFuzzer, TSan, and UBSan lit test configs.

rdar://problem/59463146
2020-02-14 13:53:54 -08:00
Jonas Devlieghere 4fe839ef3a [CMake] Rename EXCLUDE_FROM_ALL and make it an argument to add_lit_testsuite
EXCLUDE_FROM_ALL means something else for add_lit_testsuite as it does
for something like add_executable. Distinguish between the two by
renaming the variable and making it an argument to add_lit_testsuite.

Differential revision: https://reviews.llvm.org/D74168
2020-02-06 15:33:18 -08:00
Michał Górny d3d1ca14ce [compiler-rt] [test] Disable ASLR on UBSAN+[AMT]SAN tests on NetBSD 2019-12-18 17:21:15 +01:00
Vedant Kumar ed83942bc0 [ubsan] Enable testing of .m files
This allows `.m` test files, like the existing Misc/bool.m, to be
tested.
2019-12-13 14:55:29 -08:00
Roman Lebedev b98a0c7f6c
[clang][CodeGen] Implicit Conversion Sanitizer: handle increment/decrement (PR44054)(take 2)
Summary:
Implicit Conversion Sanitizer is *almost* feature complete.
There aren't *that* much unsanitized things left,
two major ones are increment/decrement (this patch) and bit fields.

As it was discussed in
[[ https://bugs.llvm.org/show_bug.cgi?id=39519 | PR39519 ]],
unlike `CompoundAssignOperator` (which is promoted internally),
or `BinaryOperator` (for which we always have promotion/demotion in AST)
or parts of `UnaryOperator` (we have promotion/demotion but only for
certain operations), for inc/dec, clang omits promotion/demotion
altogether, under as-if rule.

This is technically correct: https://rise4fun.com/Alive/zPgD
As it can be seen in `InstCombineCasts.cpp` `canEvaluateTruncated()`,
`add`/`sub`/`mul`/`and`/`or`/`xor` operators can all arbitrarily
be extended or truncated:
901cd3b3f6/llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp (L1320-L1334)

But that has serious implications:
1. Since we no longer model implicit casts, do we pessimise
   their AST representation and everything that uses it?
2. There is no demotion, so lossy demotion sanitizer does not trigger :]

Now, i'm not going to argue about the first problem here,
but the second one **needs** to be addressed. As it was stated
in the report, this is done intentionally, so changing
this in all modes would be considered a penalization/regression.
Which means, the sanitization-less codegen must not be altered.

It was also suggested to not change the sanitized codegen
to the one with demotion, but i quite strongly believe
that will not be the wise choice here:
1. One will need to re-engineer the check that the inc/dec was lossy
   in terms of `@llvm.{u,s}{add,sub}.with.overflow` builtins
2. We will still need to compute the result we would lossily demote.
   (i.e. the result of wide `add`ition/`sub`traction)
3. I suspect it would need to be done right here, in sanitization.
   Which kinda defeats the point of
   using `@llvm.{u,s}{add,sub}.with.overflow` builtins:
   we'd have two `add`s with basically the same arguments,
   one of which is used for check+error-less codepath and other one
   for the error reporting. That seems worse than a single wide op+check.
4. OR, we would need to do that in the compiler-rt handler.
   Which means we'll need a whole new handler.
   But then what about the `CompoundAssignOperator`,
   it would also be applicable for it.
   So this also doesn't really seem like the right path to me.
5. At least X86 (but likely others) pessimizes all sub-`i32` operations
   (due to partial register stalls), so even if we avoid promotion+demotion,
   the computations will //likely// be performed in `i32` anyways.

So i'm not really seeing much benefit of
not doing the straight-forward thing.

While looking into this, i have noticed a few more LLVM middle-end
missed canonicalizations, and filed
[[ https://bugs.llvm.org/show_bug.cgi?id=44100 | PR44100 ]],
[[ https://bugs.llvm.org/show_bug.cgi?id=44102 | PR44102 ]].

Those are not specific to inc/dec, we also have them for
`CompoundAssignOperator`, and it can happen for normal arithmetics, too.
But if we take some other path in the patch, it will not be applicable
here, and we will have most likely played ourselves.

TLDR: front-end should emit canonical, easy-to-optimize yet
un-optimized code. It is middle-end's job to make it optimal.

I'm really hoping reviewers agree with my personal assessment
of the path this patch should take..

This originally landed in 9872ea4ed1
but got immediately reverted in cbfa237892
because the assertion was faulty. That fault ended up being caused
by the enum - while there will be promotion, both types are unsigned,
with same width. So we still don't need to sanitize non-signed cases.
So far. Maybe the assert will tell us this isn't so.

Fixes [[ https://bugs.llvm.org/show_bug.cgi?id=44054 | PR44054 ]].
Refs. https://github.com/google/sanitizers/issues/940

Reviewers: rjmccall, erichkeane, rsmith, vsk

Reviewed By: erichkeane

Subscribers: mehdi_amini, dexonsmith, cfe-commits, #sanitizers, llvm-commits, aaron.ballman, t.p.northover, efriedma, regehr

Tags: #llvm, #clang, #sanitizers

Differential Revision: https://reviews.llvm.org/D70539
2019-11-27 21:52:41 +03:00
Roman Lebedev cbfa237892
Revert "[clang][CodeGen] Implicit Conversion Sanitizer: handle increment/decrement (PR44054)"
The asssertion that was added does not hold,
breaks on test-suite/MultiSource/Applications/SPASS/analyze.c
Will reduce the testcase and revisit.

This reverts commit 9872ea4ed1, 870f3542d3.
2019-11-27 17:05:21 +03:00
Roman Lebedev 9872ea4ed1
[clang][CodeGen] Implicit Conversion Sanitizer: handle increment/decrement (PR44054)
Summary:
Implicit Conversion Sanitizer is *almost* feature complete.
There aren't *that* much unsanitized things left,
two major ones are increment/decrement (this patch) and bit fields.

As it was discussed in
[[ https://bugs.llvm.org/show_bug.cgi?id=39519 | PR39519 ]],
unlike `CompoundAssignOperator` (which is promoted internally),
or `BinaryOperator` (for which we always have promotion/demotion in AST)
or parts of `UnaryOperator` (we have promotion/demotion but only for
certain operations), for inc/dec, clang omits promotion/demotion
altogether, under as-if rule.

This is technically correct: https://rise4fun.com/Alive/zPgD
As it can be seen in `InstCombineCasts.cpp` `canEvaluateTruncated()`,
`add`/`sub`/`mul`/`and`/`or`/`xor` operators can all arbitrarily
be extended or truncated:
901cd3b3f6/llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp (L1320-L1334)

But that has serious implications:
1. Since we no longer model implicit casts, do we pessimise
   their AST representation and everything that uses it?
2. There is no demotion, so lossy demotion sanitizer does not trigger :]

Now, i'm not going to argue about the first problem here,
but the second one **needs** to be addressed. As it was stated
in the report, this is done intentionally, so changing
this in all modes would be considered a penalization/regression.
Which means, the sanitization-less codegen must not be altered.

It was also suggested to not change the sanitized codegen
to the one with demotion, but i quite strongly believe
that will not be the wise choice here:
1. One will need to re-engineer the check that the inc/dec was lossy
   in terms of `@llvm.{u,s}{add,sub}.with.overflow` builtins
2. We will still need to compute the result we would lossily demote.
   (i.e. the result of wide `add`ition/`sub`traction)
3. I suspect it would need to be done right here, in sanitization.
   Which kinda defeats the point of
   using `@llvm.{u,s}{add,sub}.with.overflow` builtins:
   we'd have two `add`s with basically the same arguments,
   one of which is used for check+error-less codepath and other one
   for the error reporting. That seems worse than a single wide op+check.
4. OR, we would need to do that in the compiler-rt handler.
   Which means we'll need a whole new handler.
   But then what about the `CompoundAssignOperator`,
   it would also be applicable for it.
   So this also doesn't really seem like the right path to me.
5. At least X86 (but likely others) pessimizes all sub-`i32` operations
   (due to partial register stalls), so even if we avoid promotion+demotion,
   the computations will //likely// be performed in `i32` anyways.

So i'm not really seeing much benefit of
not doing the straight-forward thing.

While looking into this, i have noticed a few more LLVM middle-end
missed canonicalizations, and filed
[[ https://bugs.llvm.org/show_bug.cgi?id=44100 | PR44100 ]],
[[ https://bugs.llvm.org/show_bug.cgi?id=44102 | PR44102 ]].

Those are not specific to inc/dec, we also have them for
`CompoundAssignOperator`, and it can happen for normal arithmetics, too.
But if we take some other path in the patch, it will not be applicable
here, and we will have most likely played ourselves.

TLDR: front-end should emit canonical, easy-to-optimize yet
un-optimized code. It is middle-end's job to make it optimal.

I'm really hoping reviewers agree with my personal assessment
of the path this patch should take..

Fixes [[ https://bugs.llvm.org/show_bug.cgi?id=44054 | PR44054 ]].

Reviewers: rjmccall, erichkeane, rsmith, vsk

Reviewed By: erichkeane

Subscribers: mehdi_amini, dexonsmith, cfe-commits, #sanitizers, llvm-commits, aaron.ballman, t.p.northover, efriedma, regehr

Tags: #llvm, #clang, #sanitizers

Differential Revision: https://reviews.llvm.org/D70539
2019-11-27 15:39:55 +03:00
Evgenii Stepanov a1817996fa Fix lld detection in standalone compiler-rt.
Summary:
Right now all hwasan tests on Android are silently disabled because they
require "has_lld" and standalone compiler-rt can not (and AFAIK was
never able to) set it.

Reviewers: pcc

Subscribers: dberris, mgorny, #sanitizers, llvm-commits

Tags: #sanitizers, #llvm

Differential Revision: https://reviews.llvm.org/D69405
2019-10-24 14:46:10 -07:00
Roman Lebedev eb8b6fe745 [UBSan] Split nullptr-and-nonzero-offset-variable.c in another direction
llvm-svn: 374309
2019-10-10 11:03:41 +00:00
Roman Lebedev 5d59f20cc0 [UBSan] Split nullptr-and-nonzero-offset-variable.cpp into C and C++ variants
I do not understand the BB failire, it fully passes locally.

llvm-svn: 374306
2019-10-10 10:41:42 +00:00
Roman Lebedev 3de28b83c2 [UBSan] Revisit nullptr-and-nonzero-offset-variable.cpp test to hopefully make it pass on sanitizer-windows BB
llvm-svn: 374298
2019-10-10 09:51:13 +00:00
Roman Lebedev 536b0ee40a [UBSan][clang][compiler-rt] Applying non-zero offset to nullptr is undefined behaviour
Summary:
Quote from http://eel.is/c++draft/expr.add#4:
```
4     When an expression J that has integral type is added to or subtracted
      from an expression P of pointer type, the result has the type of P.
(4.1) If P evaluates to a null pointer value and J evaluates to 0,
      the result is a null pointer value.
(4.2) Otherwise, if P points to an array element i of an array object x with n
      elements ([dcl.array]), the expressions P + J and J + P
      (where J has the value j) point to the (possibly-hypothetical) array
      element i+j of x if 0≤i+j≤n and the expression P - J points to the
      (possibly-hypothetical) array element i−j of x if 0≤i−j≤n.
(4.3) Otherwise, the behavior is undefined.
```

Therefore, as per the standard, applying non-zero offset to `nullptr`
(or making non-`nullptr` a `nullptr`, by subtracting pointer's integral value
from the pointer itself) is undefined behavior. (*if* `nullptr` is not defined,
i.e. e.g. `-fno-delete-null-pointer-checks` was *not* specified.)

To make things more fun, in C (6.5.6p8), applying *any* offset to null pointer
is undefined, although Clang front-end pessimizes the code by not lowering
that info, so this UB is "harmless".

Since rL369789 (D66608 `[InstCombine] icmp eq/ne (gep inbounds P, Idx..), null -> icmp eq/ne P, null`)
LLVM middle-end uses those guarantees for transformations.
If the source contains such UB's, said code may now be miscompiled.
Such miscompilations were already observed:
* https://lists.llvm.org/pipermail/llvm-commits/Week-of-Mon-20190826/687838.html
* https://github.com/google/filament/pull/1566

Surprisingly, UBSan does not catch those issues
... until now. This diff teaches UBSan about these UB's.

`getelementpointer inbounds` is a pretty frequent instruction,
so this does have a measurable impact on performance;
I've addressed most of the obvious missing folds (and thus decreased the performance impact by ~5%),
and then re-performed some performance measurements using my [[ https://github.com/darktable-org/rawspeed | RawSpeed ]] benchmark:
(all measurements done with LLVM ToT, the sanitizer never fired.)
* no sanitization vs. existing check: average `+21.62%` slowdown
* existing check vs. check after this patch: average `22.04%` slowdown
* no sanitization vs. this patch: average `48.42%` slowdown

Reviewers: vsk, filcab, rsmith, aaron.ballman, vitalybuka, rjmccall, #sanitizers

Reviewed By: rsmith

Subscribers: kristof.beyls, nickdesaulniers, nikic, ychen, dtzWill, xbolva00, dberris, arphaman, rupprecht, reames, regehr, llvm-commits, cfe-commits

Tags: #clang, #sanitizers, #llvm

Differential Revision: https://reviews.llvm.org/D67122

llvm-svn: 374293
2019-10-10 09:25:02 +00:00
Dan Liew bbde056b88 [CMake] Fix the value of `config.target_cflags` for non-macOS Apple platforms. Attempt #3.
The main problem here is that `-*-version_min=` was not being passed to
the compiler when building test cases. This can cause problems when
testing on devices running older OSs because Clang would previously
assume the minimum deployment target is the the latest OS in the SDK
which could be much newer than what the device is running.

Previously the generated value looked like this:

`-arch arm64 -isysroot
<path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`

With this change it now looks like:

`-arch arm64 -stdlib=libc++ -miphoneos-version-min=8.0 -isysroot
<path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`

This mirrors the setting of config.target_cflags on macOS.

This change is made for ASan, LibFuzzer, TSan, and UBSan.

To implement this a new `get_test_cflags_for_apple_platform()` function
has been added that when given an Apple platform name and architecture
returns a string containing the C compiler flags to use when building
tests. This also calls a new helper function `is_valid_apple_platform()`
that validates Apple platform names.

This is the third attempt at landing the patch.

The first attempt (r359305) had to be reverted (r359327) due to a buildbot
failure. The problem was that calling `get_test_cflags_for_apple_platform()`
can trigger a CMake error if the provided architecture is not supported by the
current CMake configuration. Previously, this could be triggered by passing
`-DCOMPILER_RT_ENABLE_IOS=OFF` to CMake. The root cause is that we were
generating test configurations for a list of architectures without checking if
the relevant Sanitizer actually supported that architecture. We now intersect
the list of architectures for an Apple platform with
`<SANITIZER>_SUPPORTED_ARCH` (where `<SANITIZER>` is a Sanitizer name) to
iterate through the correct list of architectures.

The second attempt (r363633) had to be reverted (r363779) due to a build
failure. The failed build was using a modified Apple toolchain where the iOS
simulator SDK was missing. This exposed a bug in the existing UBSan test
generation code where it was assumed that `COMPILER_RT_ENABLE_IOS` implied that
the toolchain supported both iOS and the iOS simulator. This is not true. This
has been fixed by using the list `SANITIZER_COMMON_SUPPORTED_OS` for the list
of supported Apple platforms for UBSan. For consistency with the other
Sanitizers we also now intersect the list of architectures with
UBSAN_SUPPORTED_ARCH.

rdar://problem/50124489

Differential Revision: https://reviews.llvm.org/D61242

llvm-svn: 373405
2019-10-01 23:08:18 +00:00
Kamil Rytarowski 8b83f50c03 Remove xfail i386 NetBSD mark in vptr-non-unique-typeinfo.cpp
This test passes now.

llvm-svn: 371575
2019-09-10 23:55:03 +00:00
Max Moroz 9508738cd1 [UBSan] Do not overwrite the default print_summary sanitizer option.
Summary:
This option is true by default in sanitizer common. The default
false value was added a while ago without any reasoning in
524e934112

so, presumably it's safe to remove for consistency.

Reviewers: hctim, samsonov, morehouse, kcc, vitalybuka

Reviewed By: hctim, samsonov, vitalybuka

Subscribers: delcypher, #sanitizers, llvm-commits, kcc

Tags: #llvm, #sanitizers

Differential Revision: https://reviews.llvm.org/D67193

llvm-svn: 371442
2019-09-09 19:30:48 +00:00
Nico Weber 6eed7e7e94 compiler-rt: Rename last few cc files below test/ubsan to cpp
See r367803 and similar other changes.

llvm-svn: 367855
2019-08-05 13:23:38 +00:00
Nico Weber 46ba969752 compiler-rt: Rename .cc files in lib/ubsan to .cpp.
See https://reviews.llvm.org/D58620 for discussion, and for the commands
I ran. In addition I also ran

  for f in $(svn diff | diffstat | grep .cc | cut -f 2 -d ' '); do rg $f . ; done

and manually updated references to renamed files found by that.

llvm-svn: 367452
2019-07-31 17:51:05 +00:00
Stephan Bergmann e215996a29 Finish "Adapt -fsanitize=function to SANITIZER_NON_UNIQUE_TYPEINFO"
i.e., recent 5745eccef54ddd3caca278d1d292a88b2281528b:

* Bump the function_type_mismatch handler version, as its signature has changed.

* The function_type_mismatch handler can return successfully now, so
  SanitizerKind::Function must be AlwaysRecoverable (like for
  SanitizerKind::Vptr).

* But the minimal runtime would still unconditionally treat a call to the
  function_type_mismatch handler as failure, so disallow -fsanitize=function in
  combination with -fsanitize-minimal-runtime (like it was already done for
  -fsanitize=vptr).

* Add tests.

Differential Revision: https://reviews.llvm.org/D61479

llvm-svn: 366186
2019-07-16 06:23:27 +00:00
Rainer Orth 4a9a772f44 Enable compiler-rt on SPARC
This patch enables compiler-rt on SPARC targets. Most of the changes are straightforward:

- Add 32 and 64-bit sparc to compiler-rt

- lib/builtins/fp_lib.h needed to check if the int128_t and uint128_t types exist (which they don't on sparc)

There's one issue of note: many asan tests fail to compile on Solaris/SPARC:

fatal error: error in backend: Function "_ZN7testing8internal16BoolFromGTestEnvEPKcb": over-aligned dynamic alloca not supported.

Therefore, while asan is still built, both asan and ubsan-with-asan testing is disabled. The
goal is to check if asan keeps compiling on Solaris/SPARC. This serves asan in gcc,
which doesn't have the problem above and works just fine.

With this patch, sparcv9-sun-solaris2.11 test results are pretty good:

Failing Tests (9):
    Builtins-sparc-sunos :: divtc3_test.c
    Builtins-sparcv9-sunos :: compiler_rt_logbl_test.c
    Builtins-sparcv9-sunos :: divtc3_test.c
[...]
    UBSan-Standalone-sparc :: TestCases/TypeCheck/misaligned.cpp
    UBSan-Standalone-sparcv9 :: TestCases/TypeCheck/misaligned.cpp

The builtin failures are due to Bugs 42493 and 42496. The tree contained a few additonal
patches either currently in review or about to be submitted.

Tested on sparcv9-sun-solaris2.11.

Differential Revision: https://reviews.llvm.org/D40943

llvm-svn: 365880
2019-07-12 08:30:17 +00:00
Fangrui Song 7f9a94e1f8 [ubsan][test] Restore float-divide-by-zero test
Removed by rCTE365307 to fix buildbots. It can be restored now because D64317/rC365587 brought back -fsanitize=float-divide-by-zero

llvm-svn: 365591
2019-07-10 01:53:11 +00:00
Fangrui Song 1f7bd40f68 [ubsan][test] Fix cast-overflow.cpp and delete float-divide-by-zero test after D63793/rC365272
llvm-svn: 365307
2019-07-08 09:47:04 +00:00
Rainer Orth 04ea772d5a [ubsan][test] Fix several UBSan-* :: TestCases/ImplicitConversion tests on Solaris
A couple of UBSan-*  :: TestCases/ImplicitConversion testcases FAIL on Solaris/x86
(and Solaris/SPARC with https://reviews.llvm.org/D40900):

  FAIL: UBSan-AddressSanitizer-i386 :: TestCases/ImplicitConversion/signed-integer-truncation-or-sign-change-blacklist.c (49187 of 49849)
  ******************** TEST 'UBSan-AddressSanitizer-i386 :: TestCases/ImplicitConversion/signed-integer-truncation-or-sign-change-blacklist.c' FAILED ********************
  [...]
  Command Output (stderr):
  --
  /vol/llvm/src/compiler-rt/local/test/ubsan/TestCases/ImplicitConversion/signed-integer-truncation-or-sign-change-blacklist.c:53:11: error: CHECK: expected string not found in input
  // CHECK: {{.*}}signed-integer-truncation-or-sign-change-blacklist.c:[[@LINE-1]]:10: runtime error: implicit conversion from type '{{.*}}' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type '{{.*}}' (aka 'signed char') changed the value to -1 (8-bit, signed)
            ^
  <stdin>:1:1: note: scanning from here
  /vol/llvm/src/compiler-rt/local/test/ubsan/TestCases/ImplicitConversion/signed-integer-truncation-or-sign-change-blacklist.c:52:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'int8_t' (aka 'char') changed the value to -1 (8-bit, signed)
  ^
  <stdin>:1:1: note: with "@LINE-1" equal to "52"
  /vol/llvm/src/compiler-rt/local/test/ubsan/TestCases/ImplicitConversion/signed-integer-truncation-or-sign-change-blacklist.c:52:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'int8_t' (aka 'char') changed the value to -1 (8-bit, signed)
  ^
  <stdin>:1:69: note: possible intended match here
  /vol/llvm/src/compiler-rt/local/test/ubsan/TestCases/ImplicitConversion/signed-integer-truncation-or-sign-change-blacklist.c:52:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'int8_t' (aka 'char') changed the value to -1 (8-bit, signed)
                                                                      ^

This is always a difference for int8_t where signed char is expected, but only
char seen.

I could trace this to <sys/int_types.h> which has

  /*
   * Basic / Extended integer types
   *
   * The following defines the basic fixed-size integer types.
   *
   * Implementations are free to typedef them to Standard C integer types or
   * extensions that they support. If an implementation does not support one
   * of the particular integer data types below, then it should not define the
   * typedefs and macros corresponding to that data type.  Note that int8_t
   * is not defined in -Xs mode on ISAs for which the ABI specifies "char"
   * as an unsigned entity because there is no way to define an eight bit
   * signed integral.
   */
  #if defined(_CHAR_IS_SIGNED)
  typedef char			int8_t;
  #else
  #if defined(__STDC__)
  typedef signed char		int8_t;
  #endif
  #endif

_CHAR_IS_SIGNED is always defined on both sparc and x86.  Since it seems ok
to have either form, I've changed the affected tests to use
'{{(signed )?}}char' instead of 'signed char'.

Tested on x86_64-pc-solaris2.11, sparcv9-sun-solaris2.11, and x86_64-pc-linux-gnu.

Differential Revision: https://reviews.llvm.org/D63984

llvm-svn: 365303
2019-07-08 09:22:05 +00:00
Rainer Orth d11df93898 [ubsan][test] Don't disable ubsan testing on 64-bit Solaris/x86
Unlike asan, which isn't supported yet on 64-bit Solaris/x86, there's no reason to disable
ubsan.  This patch does that, but keeps the 64-bit ubsan-with-asan tests disabled.

Tested on x86_64-pc-solaris2.11.

Differential Revision: https://reviews.llvm.org/D63982

llvm-svn: 365302
2019-07-08 09:18:38 +00:00
Reid Kleckner 8007ff1ab1 [compiler-rt] Rename lit.*.cfg.* -> lit.*.cfg.py.*
These lit configuration files are really Python source code. Using the
.py file extension helps editors and tools use the correct language
mode. LLVM and Clang already use this convention for lit configuration,
this change simply applies it to all of compiler-rt.

Reviewers: vitalybuka, dberris

Differential Revision: https://reviews.llvm.org/D63658

llvm-svn: 364591
2019-06-27 20:56:04 +00:00
Dan Liew d38e251bf2 Follow up fix for r364366.
When setting the parallelism group support MSan and use a syntactically
compact condition.

rdar://problem/51754620

llvm-svn: 364369
2019-06-26 00:54:06 +00:00