Commit Graph

123 Commits

Author SHA1 Message Date
Etienne Bergeron 2bb23bfc73 [compilter-rt] Try to fix correctly rL277560
rL277560: [compiler-rt] Fix broken interception unittest
llvm-svn: 277567
2016-08-03 05:03:35 +00:00
Etienne Bergeron 50b98dce2e [compiler-rt] Fix broken interception unittest
Summary:
This patch is fixing a broken unittest which make the win64 bot failing.

The bug was introduce here:
  https://reviews.llvm.org/D23046

The interception code is not the same in 32-bit and in 64-bit.
The added unittest can only be patched on 32-bits.

Reviewers: rnk

Subscribers: llvm-commits, chrisha

Differential Revision: https://reviews.llvm.org/D23099

llvm-svn: 277560
2016-08-03 02:44:30 +00:00
Etienne Bergeron 5d42763779 [compiler-rt] Add more interception patterns.
Summary:
These instructions where not supported on my win7 computer.
They were happening on strstr when building chrome unittests with asan.

Reviewers: rnk

Subscribers: llvm-commits, chrisha

Differential Revision: https://reviews.llvm.org/D23081

llvm-svn: 277519
2016-08-02 20:38:05 +00:00
Reid Kleckner d6371ea52a [asan] Intercept RtlRaiseException instead of kernel32!RaiseException
Summary:
On my install of Windows 10, RaiseException is a tail call to
kernelbase!RaiseException. Obviously, we fail to intercept that.
Instead, try hooking at the ntdll!RtlRaiseException layer. It is
unlikely that this layer will contain control flow.

Intercepting at this level requires adding a decoding for
'LEA ESP, [ESP + 0xXXXXXXXX]', which is a really obscure way to write
'SUB ESP, 0xXXXXXXXX' that avoids clobbering EFLAGS.

Reviewers: etienneb

Subscribers: llvm-commits, kubabrecka

Differential Revision: https://reviews.llvm.org/D23046

llvm-svn: 277518
2016-08-02 20:36:29 +00:00
Etienne Bergeron 0b2d71373b [compiler-rt] Add support for interception redirect exports.
Summary:
On windows, an export can be redirected to an other DLL.
This patch is adding the required support to the internal
GetProcAddress implementation.

This case was encountered by instrumenting chromium (win 64-bits)
using this GN configuration:
```
is_component_build = true
is_debug = false
enable_nacl = false
is_clang = true
is_asan = true
clang_base_path = "d:\src\llvm\ninja64"
clang_use_chrome_plugins = false
clang_version = "4.0.0"
```

The operating system is win7 (x64).
Visual Studio: 2015 Professional



Reviewers: rnk

Subscribers: llvm-commits, chrisha

Differential Revision: https://reviews.llvm.org/D22880

llvm-svn: 277294
2016-07-31 17:56:26 +00:00
Etienne Bergeron 74999eb50f Fix broken build bot
The address resolution is ussing RTLD_NEXT and not RTLD_DEFAULT.
Which means &func may not be equivalent to dlsym("func").

llvm-svn: 276951
2016-07-28 01:35:32 +00:00
Etienne Bergeron 8c6eb1566c [compiler-rt] Fix warnings in interception code
Summary:
This patch is re-introducing the code to fix the
dynamic hooking on windows and to fix a compiler
warning on Apple.

Related patches:

* https://reviews.llvm.org/D22641
* https://reviews.llvm.org/D22610
* https://reviews.llvm.org/rL276311
* https://reviews.llvm.org/rL276490

Both architecture are using different techniques to
hook on library functions (memchr, strcpy,...). 

On Apple, the function is not dynamically hooked and
the symbol always points to a valid function 
(i.e. can't be null). The REAL macro returns the
symbol.

On windows, the function is dynamically patch and the
REAL(...) function may or may not be null. It depend
on whether or not the function was hooked correctly.
Also, on windows memcpy and memmove are the same.

```
#if !defined(__APPLE__)
[...]
# define REAL(x) __interception::PTR_TO_REAL(x)
# define ASSIGN_REAL(dst, src) REAL(dst) = REAL(src)
[...]
#else  // __APPLE__
[...]
# define REAL(x) x
# define ASSIGN_REAL(x, y)
[...]
#endif  // __APPLE__

Reviewers: rnk

Subscribers: kcc, hans, kubabrecka, llvm-commits, bruno, chrisha

Differential Revision: https://reviews.llvm.org/D22758

llvm-svn: 276885
2016-07-27 16:16:54 +00:00
Bruno Cardoso Lopes fb4358d15b Revert "fix https://reviews.llvm.org/D22610" and "[compiler-rt] Fix memmove/memcpy overlap detection on windows"
This currently fails ~500 tests on Darwin:
http://lab.llvm.org:8080/green/job/clang-stage1-configure-RA_check/20456/

This reverts commit 4cfee0dff1facb8fa2827d25c5943bfef96d1a8f and
dbd91205d578cb61ab77be06087e9f65ba8a7ec8.

llvm-svn: 276490
2016-07-22 23:02:34 +00:00
Etienne Bergeron 901b0dc96a [compiler-rt] Add support for relative offset adjustment in interception
Summary:
Some instructions can only be copied if the relative offset is adjusted.

This patch adds support for two common instruction.
It's quite common to have a indirect load in the prologue 
(loading the security cookie).

Reviewers: rnk

Subscribers: llvm-commits, wang0109, chrisha

Differential Revision: https://reviews.llvm.org/D22647

llvm-svn: 276336
2016-07-21 21:08:54 +00:00
Etienne Bergeron 2c781262b8 fix https://reviews.llvm.org/D22610
AppleClang can't compile the assignment expression.

llvm-svn: 276311
2016-07-21 17:58:04 +00:00
Vedant Kumar 55ecc100b0 [interception] Remove extra whitespace to appease linters (NFC)
Attempt to fix:

  http://lab.llvm.org:8011/builders/clang-s390x-linux/builds/7774

llvm-svn: 275901
2016-07-18 20:07:27 +00:00
Etienne Bergeron a81a44ffd4 [compiler-rt] Fix incorrect handling of indirect load.
Summary:
Indirect load are relative offset from RIP.

The current trampoline implementation is incorrectly
copying these instructions which make some unittests
crashing.

This patch is not fixing the unittests but it's fixing
the crashes. The functions are no longer hooked.

Patches will come soon to fix these unittests.

Reviewers: rnk

Subscribers: llvm-commits, wang0109, chrisha

Differential Revision: https://reviews.llvm.org/D22410

llvm-svn: 275892
2016-07-18 19:50:55 +00:00
Etienne Bergeron d61042b549 [compiler-rt] Allow trampoline allocation further and 1 gig.
Summary:
The trampoline allocation limits the memory scanning to 1 gig.
There is an unittest that is allocating a large object which make
it impossible to the trampoline allocator to find a free spot.

see shadow_mapping_failures:
```
char bigchunk[1 << 30];
```

This patch is not fixing the unittest but it's fixing it's infinite
loop behavior.

Reviewers: rnk

Subscribers: llvm-commits, wang0109, chrisha

Differential Revision: https://reviews.llvm.org/D22471

llvm-svn: 275887
2016-07-18 19:33:05 +00:00
Etienne Bergeron a566fe341f [compiler-rt] Fix incorrect handling of indirect load.
Summary:
Indirect load are relative offset from RIP.

The current trampoline implementation is incorrectly
copying these instructions which make some unittests
crashing.

This patch is not fixing the unittests but it's fixing
the crashes. The functions are no longer hooked.

Patches will come soon to fix these unittests.

Reviewers: rnk

Subscribers: llvm-commits, wang0109, chrisha

Differential Revision: https://reviews.llvm.org/D22410

llvm-svn: 275584
2016-07-15 17:26:33 +00:00
Etienne Bergeron 3d89db445d TestCase null_deref was failing in Win64:
c:\lipo\work\asan\b_llvm>c:\lipo\work\asan\b_llvm\projects\compiler-rt\test\asan\X86_64WindowsConfig\TestCases\Output\null_deref.cc.tmp
=================================================================
==5488==ERROR: AddressSanitizer: access-violation on unknown address 0x000000000028 (pc 0x7ff701f91067 bp 0x000c8cf8fbf0 sp 0x000c8cf8fbb0 T0)
==5488==The signal is caused by a READ memory access.
==5488==Hint: address points to the zero page.
    #0 0x7ff701f91066 in NullDeref(int *) C:\lipo\work\asan\llvm\projects\compiler-rt\test\asan\TestCases\null_deref.cc:15:10
    #1 0x8a0388830a67  (<unknown module>)
The reason was symbols was not initilized. In fact, it was first inited
with a call to stack.Print(), which calls
WinSymbolizerTool::SymbolizePC, then InitializeDbgHelpIfNeeded().

Since the StackWalk was performed before the stack.Print(), stack frames
where not gathered correctly.

There should be a better place to initialize symbols. For now, this
patch makes the test happy.

Patch by Wei Wang
Differential Revision: https://reviews.llvm.org/D22410

llvm-svn: 275580
2016-07-15 17:16:37 +00:00
Etienne Bergeron 8fc1dca8f7 [compiler-rt] Add more assembly patterns for interception
Summary:
These patterns are encounter when using instrumented DLL.

Without this patch, asan lit test are crashing when trying to hook
on RaiseException function.

Reviewers: rnk

Subscribers: llvm-commits, wang0109, chrisha

Differential Revision: https://reviews.llvm.org/D22340

llvm-svn: 275489
2016-07-14 22:14:33 +00:00
Etienne Bergeron e318b83745 [asan] Fix interception unittest on Windows64.
mov edi,edi is _not_ NOP in 64-bit, use 66,90h instead.
This bug was causing interception unittest to crash on 
Windows64 (windows 8 and windows 10).

Credits to etienneb for finding the root cause.

Patch by: Wei Wang
Differential Revision: http://reviews.llvm.org/D22274

llvm-svn: 275207
2016-07-12 19:39:07 +00:00
Etienne Bergeron 9c2a22000e [compiler-rt] Enhance function padding detection for function interception
Summary:
Many CRT (64-bits) functions contains a "hint-nop". The current padding
detection is not able to recognize the 10-bytes padding and the HotPatch
hooking technique cannot be used.

Other patterns may be discover and may be added later.

Reviewers: rnk

Subscribers: llvm-commits, wang0109, chrisha

Differential Revision: http://reviews.llvm.org/D22258

llvm-svn: 275180
2016-07-12 15:33:04 +00:00
Etienne Bergeron ef4b449124 fix incorrect constant (from http://reviews.llvm.org/D22111)
llvm-svn: 275136
2016-07-12 01:30:58 +00:00
Etienne Bergeron c9c5405b52 missing modifications for http://reviews.llvm.org/D21952
llvm-svn: 275124
2016-07-11 23:09:33 +00:00
Etienne Bergeron f5525670ad [compiler-rt] Refactor the interception code on windows.
Summary:
This is a cleanup and refactoring of the interception code on windows

Enhancement:
  * Adding the support for 64-bits code
  * Adding several hooking technique:
    * Detour
    * JumpRedirect
    * HotPatch
    * Trampoline
  * Adding a trampoline memory pool (64-bits) and release the allocated memory in unittests

Cleanup:
  * Adding unittests for 64-bits hooking techniques
  * Enhancing the RoundUpInstruction by sharing common decoder

Reviewers: rnk

Subscribers: llvm-commits, wang0109, chrisha

Differential Revision: http://reviews.llvm.org/D22111

llvm-svn: 275123
2016-07-11 23:02:18 +00:00
Etienne Bergeron 0e6a1b3bd2 remove empty lines
llvm-svn: 275112
2016-07-11 21:57:11 +00:00
Etienne Bergeron 31f4672f93 [compiler-rt] Enhance unittest coverage for lib interception
Summary:
This patch is adding more unittests for testing the interception
of 32-bits code.

Reviewers: rnk

Subscribers: llvm-commits, wang0109, chrisha

Differential Revision: http://reviews.llvm.org/D22077

llvm-svn: 274775
2016-07-07 17:51:50 +00:00
Etienne Bergeron 01e8082418 Fix cmake generation on Apple for interception unittests
llvm-svn: 274671
2016-07-06 21:02:32 +00:00
Etienne Bergeron 179feead53 [compiler-rt] Disable interception tests on Apple
Summary:
The CMake generation is not working on Apple.

This patch is disabling the generation until it's fixed.

Reviewers: rnk

Subscribers: tberghammer, chrisha, danalbert, llvm-commits, srhines

Differential Revision: http://reviews.llvm.org/D22066

llvm-svn: 274667
2016-07-06 20:15:50 +00:00
Etienne Bergeron cc464d560c [compilter-rt] Add unittests for interception library
Summary:
This patch is adding unittests for the interception library.


Reviewers: rnk

Subscribers: majnemer, llvm-commits, wang0109, chrisha, tberghammer, danalbert, srhines

Differential Revision: http://reviews.llvm.org/D21980

llvm-svn: 274657
2016-07-06 19:15:11 +00:00
Etienne Bergeron 3ac879f9a6 Add missing decoding patterns toRoundUpToInstrBoundary
Summary:
The RoundUpToInstrBoundary determines intructions boundary and it's used to determine how to patch (intercept) functions.

The current x64-bit implementation is incomplete. This patch is adding patterns observed when trying to sanitize a 64-bit executable on my computer.

Thw two current functions not intercepted are:
```
RaiseExceptionStub:
000000007720C3B0 EB 06                jmp         RaiseException (07720C3B8h)  
000000007720C3B2 90                   nop  
000000007720C3B3 90                   nop  
000000007720C3B4 90                   nop  
000000007720C3B5 90                   nop  
000000007720C3B6 90                   nop  
000000007720C3B7 90                   nop  
RaiseException:
000000007720C3B8 FF 25 3A 18 09 00    jmp         qword ptr [__imp_RaiseException (07729DBF8h)]  
000000007720C3BE 8B 44 24 54          mov         eax,dword ptr [rsp+54h]  
000000007720C3C2 85 C0                test        eax,eax  
000000007720C3C4 0F 84 F5 05 00 00    je          Wow64NtCreateKey+12Fh (07720C9BFh)  
```

```
CreateThreadStub:
0000000077215A10 48 83 EC 48          sub         rsp,48h  
0000000077215A14 48 8B 44 24 78       mov         rax,qword ptr [rsp+78h]  
0000000077215A19 48 89 44 24 38       mov         qword ptr [rsp+38h],rax  
0000000077215A1E 8B 44 24 70          mov         eax,dword ptr [rsp+70h]  
```

Reviewers: rnk

Subscribers: wang0109, chrisha

Differential Revision: http://reviews.llvm.org/D21519

llvm-svn: 273176
2016-06-20 18:00:03 +00:00
Etienne Bergeron 7a1bafd6ae This patch attempts to primitive support for Win64 asan
Some known issues are:

When "head" include instructions that involve branching, the "cut and paste" approach may break down in a way that function interception still work but calling back the original function does not work.
The jmp [rip -8] saves some bytes in the "head" but finding the safe zone of 0xCC is not implemented yet. So it may stomp on preceding codes.
The shadow offset is not working yet on Win64. More complexity maybe involved since there are some differences regarding virtual address space between Window 8 and Windows 8.1/10.

Patch by: Wang Wei

Differential Revision: http://reviews.llvm.org/D20884

llvm-svn: 271915
2016-06-06 18:09:54 +00:00
Etienne Bergeron 00f3f6e296 This patch is activating the build of Asan on Windows 64-bits.
It's fixing compilation errors. The runtime is not yet working.

Missing features:

OverrideFunction for x64
an equiv function for inline asm (atomic_compare_exchange_strong)
shadow memory offset needs to be adjusted
RoundUpToInstrBoundary for x64
They will be implemented by subsequent patches.

Patch by Wei Wang.

Differential revision: http://reviews.llvm.org/D20455

llvm-svn: 271049
2016-05-27 21:29:31 +00:00
Reid Kleckner 3b0290570b [asan] Intercept all Heap* related imports from ucrtbase.dll
ucrtbase.dll appears to be built with some kind of cross-module
inlining, because there are calls to imported Heap* routines sprinkled
throughout the code. This inlining defeats our attempts to hotpatch
malloc, _malloc_base, and related functions. Failing to intercept an
allocation or deallocation results in a crash when the program attempts
to deallocate or reallocate memory with the wrong allocator.

This change patches the IAT of ucrtbase.dll to replace the addresses of
the imported Heap* functions with implementations provided by ASan.  We
don't globally intercept the win32 Heap* functions because they are
typically used by system DLLs that run before ASan initializes.
Eventually, we may want to intercept them, but for now I think this is
the minimal change that will keep ASan stable.

Reviewers: samsonov

Differential Revision: http://reviews.llvm.org/D18413

llvm-svn: 264327
2016-03-24 20:19:48 +00:00
Reid Kleckner d83633f552 [asan] Add ucrtbase.dll to the list of DLLs to intercept
Reduces number of test failures in check-asan-dynamic with VS 2015.

llvm-svn: 264061
2016-03-22 15:46:50 +00:00
Reid Kleckner 2310c658d8 [asan] Add one more x86 encoding to the interceptor for strrchr
llvm-svn: 264060
2016-03-22 15:46:43 +00:00
Reid Kleckner 23d0fde535 [asan] Intercept strdup on Windows
Some unit tests were failing because we didn't intercept strdup.  It
turns out it works just fine on 2013 and 2015 with a small patch to the
interception logic.

llvm-svn: 264013
2016-03-22 00:52:47 +00:00
Reid Kleckner d2f05f52b4 [asan] Update hotpatch code for VS 2015 memset implementation
In VS 2015, the memset fill parameter is zero extended from one byte
instead of being copied wholesale.

The issue reproduces with existing tests if you use VS2015.

llvm-svn: 263966
2016-03-21 18:23:07 +00:00
Filipe Cabecinhas b08c76f5f8 [cmake] Address Samsonov's post-commit review of r262723
Reviewers: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D17896

llvm-svn: 262770
2016-03-05 10:01:04 +00:00
Chris Bieneman 63a81b1415 Remove autoconf support for building runtime libraries.
Summary:
This patch is provided in preparation for removing autoconf on 1/26. The proposal to remove autoconf on 1/26 was discussed on the llvm-dev thread here: http://lists.llvm.org/pipermail/llvm-dev/2016-January/093875.html

    "I am the punishment of God... If [autoconf] had not committed great sins, God would not have sent a punishment like me upon [it]."
    -Genghis Khan

Reviewers: chandlerc, grosbach, bob.wilson, zaks.anna, kubabrecka, samsonov, echristo

Subscribers: iains, llvm-commits

Differential Revision: http://reviews.llvm.org/D16473

llvm-svn: 258863
2016-01-26 21:31:12 +00:00
Alexey Samsonov 145e4d6471 Tell clang-format that (most) sanitizers are written using Google style guide.
llvm-svn: 253608
2015-11-19 22:11:10 +00:00
Saleem Abdulrasool d006c9368d Sanitizer: define WIN32_LEAN_AND_MEAN
Define WIN32_LEAN_AND_MEAN before including Windows.h.  This is already being
done in some places.  This does it more broadly.  This permits building ASAN on
Linux for Winndows, as well as reduces the amount of included declarations.

llvm-svn: 251649
2015-10-29 20:36:55 +00:00
Evgeniy Stepanov 9147de0ddf [asan] Versioned interceptor for pthread_create.
This fixes a crash in pthread_create on linux/i386 due to abi
incompatibility between intercepted and non-intercepted functions.

See the test case for more details.

llvm-svn: 248325
2015-09-22 21:34:44 +00:00
Reid Kleckner d85f7010cc [windows] Implement GetProcAddress internally to avoid initializing the CRT
ASan uses GetProcAddress to get the address of malloc so it can patch
it. Newer versions of Windows make GetProcAddress initialize the DLL
before returning a function pointer into it. That's perfectly
reasonable, but ASan needs to finish patching malloc before CRT
initialization. So now we roll our own GetProcAddress.

Fixes PR24237

Based on a patch by David Major

Originally written by David Major as part of:
https://hg.mozilla.org/mozilla-central/file/tip/toolkit/xre/WindowsCrtPatch.h

llvm-svn: 245377
2015-08-18 22:38:27 +00:00
Filipe Cabecinhas 7af0a1cb84 CMake: Stop using LLVM's custom parse_arguments. NFC
Summary:
Use CMake's cmake_parse_arguments() instead.
It's called in a slightly different way, but supports all our use cases.
It's in CMake 2.8.8, which is our minimum supported version.

CMake 3.0 doc (roughly the same. No direct link to 2.8.8 doc):
http://www.cmake.org/cmake/help/v3.0/module/CMakeParseArguments.html?highlight=cmake_parse_arguments

Since I was already changing these calls, I changed ARCH and LIB into
ARCHS and LIBS to make it more clear that they're lists of arguments.

Reviewers: eugenis, samsonov, beanz

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D10529

llvm-svn: 240120
2015-06-19 03:39:24 +00:00
Chris Bieneman 6bd006f31a [CMake] Cleanup add_compiler_rt_object_library to be platform-agnostic
Summary:
This change takes darwin-specific goop that was scattered around CMakeLists files and spread between add_compiler_rt_object_library and add_compiler_rt_darwin_object_library and moves it all under add_compiler_rt_object_library.

The goal of this is to try to push platform handling as low in the utility functions as possible.

Reviewers: rnk, samsonov

Reviewed By: rnk, samsonov

Subscribers: rnk, rsmith, llvm-commits

Differential Revision: http://reviews.llvm.org/D10250

llvm-svn: 239498
2015-06-10 23:55:07 +00:00
Timur Iskhodzhanov d58230b9dc [ASan/Win] Fix a CHECK failure when an exception is thrown from a callback passed to BindIoCompletionCallback
This also simplifies how we handle QueueUserWorkItem

llvm-svn: 232499
2015-03-17 16:50:59 +00:00
Timur Iskhodzhanov 817ac724e2 [ASan] NFC: Factor out platform-specific interceptors
Reviewed at http://reviews.llvm.org/D8321

llvm-svn: 232377
2015-03-16 14:22:53 +00:00
Matthias Braun c0a2279099 Revert "Remove support for building sanitizers from Makefile/autoconf build."
This reverts commit r229556.

Reverting this for now as internal apple builds rely on this
functionality.

llvm-svn: 229585
2015-02-17 23:30:51 +00:00
Alexey Samsonov d907016dd0 Remove support for building sanitizers from Makefile/autoconf build.
They autotools build has a number of missing features, supports less
OS, architectures, build configurations, doesn't have any tests and
is hard to support in sync with CMake build.

llvm-svn: 229556
2015-02-17 21:53:45 +00:00
Evgeniy Stepanov 9e922e7d24 [sanitizer] Android build cleanup.
* Detect Android toolchain target arch and set correct runtime library name.
* Merged a lot of Android and non-Android code paths.
* Android is only supported in standalone build of compiler-rt now.
* Linking lsan-common in ASan-Android (makes lsan annotations work).
* Relying on -fsanitize=address linker flag when building tests (again,
  unification with non-Android path).
* Runtime library moved from lib/asan to lib/linux.

llvm-svn: 218605
2014-09-29 13:18:55 +00:00
Ehsan Akhgari 5bb7234b23 Add support for intercepting functions from msvcr110.dll
Summary: This finishes support for ASAN on MSVC2012.

Test Plan: |ninja check-asan| passes locally with this on MSVC2012.

Reviewers: timurrrr

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D5494

llvm-svn: 218465
2014-09-25 20:47:10 +00:00
Timur Iskhodzhanov 0a88b25c43 [ASan/Win] Intercept memory allocation functions in the MD CRT
llvm-svn: 216382
2014-08-25 13:19:05 +00:00
Timur Iskhodzhanov 220ddacf8d [ASan/Win] Land the trivial bits of -MD RTL support (PR20214)
llvm-svn: 216265
2014-08-22 12:38:07 +00:00