Commit Graph

10166 Commits

Author SHA1 Message Date
Vitaly Buka 75e01fa00b [sanitizer] Intercept __pthread_mutex_lock and __pthread_mutex_unlock
Reviewers: eugenis, dvyukov

Subscribers: srhines, kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D46793

llvm-svn: 332320
2018-05-15 01:39:25 +00:00
Vitaly Buka 3f1fd7988c [asan] Workaround to avoid hangs in Chromium tests
Summary:
For some reasons on Chromium when we start leak checking we get own pid as 1.
After that we see threads with PPID:0 assuming that thread is dead in infinite
loop.

To resolve particularly this case and possible issues like this, when IsAlive check failed to detect thread status, we need to limit the number of SuspendAllThreads
iterations.

Reviewers: eugenis

Subscribers: kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D46852

llvm-svn: 332319
2018-05-15 01:39:13 +00:00
Kostya Serebryany 2f7edaeb39 [libFuzzer] deprecate equivalence_server
llvm-svn: 332316
2018-05-15 01:15:47 +00:00
Dean Michael Berris 980d93d0e0 [XRay][profiler] Part 2: XRay Function Call Trie
Summary:
This is part of the larger XRay Profiling Mode effort.

This patch implements a central data structure for capturing statistics
about XRay instrumented function call stacks. The `FunctionCallTrie`
type does the following things:

*  It keeps track of a shadow function call stack of XRay instrumented
   functions as they are entered (function enter event) and as they are
   exited (function exit event).

*  When a function is entered, the shadow stack contains information
   about the entry TSC, and updates the trie (or prefix tree)
   representing the current function call stack. If we haven't
   encountered this function call before, this creates a unique node for
   the function in this position on the stack. We update the list of
   callees of the parent function as well to reflect this newly found
   path.

*  When a function is exited, we compute statistics (TSC deltas,
   function call count frequency) for the associated function(s) up the
   stack as we unwind to find the matching entry event.

This builds upon the XRay `Allocator` and `Array` types in Part 1 of
this series of patches.

Depends on D45756.

Reviewers: echristo, pelikan, kpw

Reviewed By: kpw

Subscribers: llvm-commits, mgorny

Differential Revision: https://reviews.llvm.org/D45757

llvm-svn: 332313
2018-05-15 00:42:36 +00:00
Vitaly Buka cdb89b72f5 Revert "[sanitizer] Intercept __pthread_mutex_lock and __pthread_mutex_unlock"
Tsan tests fail.

This reverts commit r332268

llvm-svn: 332276
2018-05-14 18:53:13 +00:00
Vitaly Buka e5bd326822 [sanitizer] Intercept __pthread_mutex_lock and __pthread_mutex_unlock
Reviewers: eugenis, dvyukov

Subscribers: srhines, kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D46793

llvm-svn: 332268
2018-05-14 18:03:34 +00:00
Dan Liew fe7250c2fa Fix another case where libstdc++ is being inappropriately requested (see
r328775) for all platforms.

Given that this is the second occurance of this problem it seemed worth
fixing this problem in a more generic way. r328775 has been reverted and
now a substitution `%linux_static_libstdcplusplus` has been provided.
This substitution expands to Clang driver arguments to use a static
libstdc++ on Linux and on all other platforms it expands to nothing.

The `asan/TestCases/throw_invoke_test.cc` and
`test/tsan/static_init6.cc` test cases now use this substitution.

rdar://problem/39948818

Differential Revision: https://reviews.llvm.org/D46401

llvm-svn: 332254
2018-05-14 15:48:49 +00:00
Dean Michael Berris 238aa1366e [XRay][compiler-rt] Relocate a DCHECK to the correct location.
Fixes a bad DCHECK where the condition being checked is still valid (for
iterators pointing to sentinels).

Follow-up to D45756.

llvm-svn: 332212
2018-05-14 04:21:12 +00:00
Dean Michael Berris 034b6c1a66 [XRay][compiler-rt] Fixup: Use proper string comparison for DCHECK
Fixes the sanitizer build.

Follow-up to D46574.

llvm-svn: 332211
2018-05-14 04:14:39 +00:00
Dean Michael Berris 845fe8a708 [XRay][compiler-rt] Fixup: Avoid C++11 narrowing in non-x86_64
This should fix non-x86_64 builds where size_t != atomic_uint64_t::Type.

Follow-up to D46574.

llvm-svn: 332209
2018-05-14 03:55:12 +00:00
Dean Michael Berris a2a0e1f353 [XRay][compiler-rt] Support in-memory processing of FDR mode logs
Summary:
This change allows for handling the in-memory data associated with the
FDR mode implementation through the new `__xray_log_process_buffers`
API. With this change, we can now allow users to process the data
in-memory of the process instead of through writing files.

This for example allows users to stream the data of the FDR logging
implementation through network sockets, or through other mechanisms
instead of saving them to local files.

We introduce an FDR-specific flag, for "no_file_flush" which lets the
flushing logic skip opening/writing to files.

This option can be defaulted to `true` when building the compiler-rt
XRay runtime through the `XRAY_FDR_OPTIONS` preprocessor macro.

Reviewers: kpw, echristo, pelikan, eizan

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D46574

llvm-svn: 332208
2018-05-14 03:35:01 +00:00
Vitaly Buka afce413098 [sanitizer] Replace #if SANITIZER_NETBSD with #if SANITIZER_INTERCEPT___LIBC_MUTEX
llvm-svn: 332190
2018-05-13 05:55:45 +00:00
Vitaly Buka 5e9dd3174d [sanitizer] Fix typo in macro name
llvm-svn: 332171
2018-05-12 03:23:55 +00:00
Walter Lee d8f7b0b5d5 [sanitizer] Allow Fuchsia symbolizer to be reused by Myriad RTEMS
Like Fuchsia, Myriad RTEMS uses an off-line symbolizer -- we just need
a custom backtrace frame string.  Move this definition to
sanitizer_fuchsia.h; the corresponding RTEMS one will be added when we
add sanitizer_rtems.h.

Differential Revision: https://reviews.llvm.org/D46462

llvm-svn: 332157
2018-05-11 23:52:19 +00:00
George Karpenkov 669375814c [libFuzzer] [NFC] Split fuzzer.test into smaller tests
Keeping fuzzer.test together as a gigantic test has no advantages and multiple disadvantages:

 - Worse test parallelization (fuzzer.test is always blocking the test
run on a machine with many cores)
 - Debugging test failures is made more difficult (not clear what fails
from fuzzer.test failing)
 - Makes porting tests to new platforms more difficult (whenever
fuzzer.test fails have to inspect the output to figure out what is going
on, and then restart all of it)
 - Hides dead code (in our case, "Done1000000" FileCheck variable was
never used, DISABLED: not %t-UninstrumentedTest-Uninstrumented was never
compiled, and there was small amount of duplication vs. simple-cmp.test)
 - Makes correspondence between LIT .test files and .cpp files less
straightforward

Differential Revision: https://reviews.llvm.org/D46557

llvm-svn: 332145
2018-05-11 21:29:53 +00:00
George Karpenkov fa57519e31 [libFuzzer] [NFC] Prefix all run lines with %run
This patch does not do anything, but paves the way for future changes,
where %run command will be expanded into a script performing the testing
on device.

Differential Revision: https://reviews.llvm.org/D46553

llvm-svn: 332144
2018-05-11 21:29:51 +00:00
David Major 868b31bf21 [winasan] Update GetInstructionSize for Win10 1803
In Windows version 1803, the first instruction of ntdll!strchr is:
8a01 mov al,byte ptr [rcx]

This is the only needed change for this version as far as I can tell.

Differential Revision: https://reviews.llvm.org/D46458

llvm-svn: 332095
2018-05-11 14:31:14 +00:00
David Major 49fcf17d5f [ASan] Fix range check in AddrIsInHighShadow
This appears to be a copy/paste artifact from `AddrIsInHighMem`. It was caught by Firefox's jit-tests on Win64.

Differential Revision: https://reviews.llvm.org/D46291

llvm-svn: 332092
2018-05-11 14:23:39 +00:00
Kostya Serebryany 6a6e690d24 [libFuzzer] refactor the implementation of -print_coverage
llvm-svn: 332073
2018-05-11 01:17:52 +00:00
Kamil Rytarowski 65e9f1f2c9 Enable SANITIZER_INTERCEPTOR_HOOKS for NetBSD
Summary:
This feature is required for proper libFuzzer support.

Adding SI_NETBSD to the list of OSes, fixes breakage in several
libFuzzer tests. It has been debugged with aid from kcc@.

Sponsored by <The NetBSD Foundation>

Reviewers: joerg, vitalybuka, kcc

Reviewed By: vitalybuka

Subscribers: kubamracek, llvm-commits, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D46729

llvm-svn: 332051
2018-05-10 22:09:24 +00:00
Kuba Mracek 2903a9bb02 [tsan] Add debugging API to retrieve the "external tag" from reports
Differential Revision: https://reviews.llvm.org/D46661

llvm-svn: 332048
2018-05-10 21:46:00 +00:00
Walter Lee ca804caed0 [asan] Enable memtrinsics interception for RTEMS
Replace decltype(memcpy) with decltype(__asan_memcpy) because memcpy
has not been defined in any headers on RTEMS.  Similarly for memmove
and memset.

Differential Revision: https://reviews.llvm.org/D46625

llvm-svn: 332047
2018-05-10 21:45:13 +00:00
Walter Lee 603c7ae232 [sanitizer] Port fast stack unwinder to sparcv8
Differential Revision: https://reviews.llvm.org/D46469

llvm-svn: 332046
2018-05-10 21:40:16 +00:00
Kostya Serebryany 5d95f2782d [libFuzzer] simplify tests, remove one redundant test; NFC
llvm-svn: 332037
2018-05-10 20:37:08 +00:00
Kostya Serebryany d80e821646 [libFuzzer] remove the dump_coverage flag, it hasn't been working with the inline sanitizer coverage anyway
llvm-svn: 332036
2018-05-10 20:24:39 +00:00
Kamil Rytarowski 9788e60736 Setup ORIGIN/NetBSD option in sanitizer tests
Summary:
NetBSD can use the approach that exists in FreeBSD, Linux and SunOS.

Pick the FreeBSD one as marking programs with "-z origin" is useful.

Sponsored by <The NetBSD Foundation>

Reviewers: joerg, vitalybuka, kcc

Reviewed By: vitalybuka

Subscribers: emaste, fedor.sergeev, llvm-commits, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D46718

llvm-svn: 332035
2018-05-10 20:13:36 +00:00
Kostya Serebryany 59bf1e8b36 [libFuzzer] remove the experimental support for clang coverage instrumentation. This mode has not been used and our experiments with https://github.com/google/fuzzer-test-suite show that this signal is weaker than the SanitizerCoverage
llvm-svn: 332034
2018-05-10 20:12:15 +00:00
Walter Lee 3bde962255 [asan] Initialize fake stack during thread init
If detect-stack-use-after-return is on, initialize fake stack during
AsanThread::Init(), rather than lazily.  This is required on Myriad.
From kcc: "There used to be a reason why this was done lazily, but I
don't remember if we still have that reason."  Tested on x86.

Differential Revision: https://reviews.llvm.org/D46626

llvm-svn: 332033
2018-05-10 20:09:03 +00:00
Kostya Serebryany f489e2bfef [libFuzzer] Experimental data flow tracer for fuzz targets.
Summary:
Experimental data flow tracer for fuzz targets.
Allows to tell which bytes of the input affect which functions of the fuzz target.

We previously attempted to use DFSan directly in the libFuzzer process,
and that didn't work nicely.
Now we will try to collect the data flow information for the seed corpus
in a separate process (using this tracer), and then use it in the regular libFuzzer runs.

Reviewers: morehouse, pcc, Dor1s

Reviewed By: morehouse, Dor1s

Subscribers: delcypher, #sanitizers, llvm-commits

Differential Revision: https://reviews.llvm.org/D46666

llvm-svn: 332029
2018-05-10 19:59:01 +00:00
Kamil Rytarowski b8238db4c4 Register NetBSD/i386 in asan_mapping.h
Summary:
Introduce kNetBSD_ShadowOffset32 and document
NetBSD/i386 (hosted on amd64 kernel) process virtual
address space ranges.

Sponsored by <The NetBSD Foundation>

Reviewers: joerg, kcc, vitalybuka

Reviewed By: vitalybuka

Subscribers: kubamracek, llvm-commits, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D46708

llvm-svn: 332027
2018-05-10 19:51:40 +00:00
Peter Wu c58988a908 [lsan] Try to fix test failure due to compiler optimization
Summary:
The SanitizerCommon-lsan-x86_64-Linux test failed due to the address of
the very first allocation ending up in the stack through "delete[]".
Workaround this by performing another allocation. The issue was only
present with optimization enabled, the test would pass with -O0.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D46650

llvm-svn: 332020
2018-05-10 19:02:32 +00:00
Kamil Rytarowski aee7b0f209 wrong usages of sem_open in the libFuzzer
Summary:
Fixed two non-standard usages of sem_open in the libFuzzer library and
one NetBSD-related modification with test script.


  - The return value to indicate error should be SEM_FAILED instead of
    (void *)-1 (please refer to "RETURN VALUE" section in this [[
    http://pubs.opengroup.org/onlinepubs/9699919799/functions/sem_open.html
    | page ]]). Actually, SEM_FAILED != (void *)-1 holds in NetBSD.

  - The SharedMemoryRegion::SemName function should return name
    starting with slash. Because the behaviour of name which does not
    start with slash is unspecified as the [[
    http://pubs.opengroup.org/onlinepubs/9699919799/functions/sem_open.html
    | "DESCRIPTION" section ]] specified:

> If name does not begin with the <slash> character, the effect is implementation-defined.

  - The length of name is limited to 14 in NetBSD, it is suggested to
    reduce the length of equivalence server name in the test script.

Patch by: Yang Zheng

Reviewers: vitalybuka, krytarowski, kcc

Reviewed By: kcc

Subscribers: kcc, #sanitizers, llvm-commits, joerg

Differential Revision: https://reviews.llvm.org/D46622

llvm-svn: 332003
2018-05-10 17:31:06 +00:00
Vitaly Buka 327f5f3a92 [sanitizer] Attempt to fix strace_test.cc on ppc64le
llvm-svn: 331964
2018-05-10 08:16:23 +00:00
Vitaly Buka ebbc754717 [sanitizer] Fix typo in comment
llvm-svn: 331956
2018-05-10 04:21:41 +00:00
Vitaly Buka 5dcc94c177 [sanitizer] Renamed local variable
llvm-svn: 331955
2018-05-10 04:16:44 +00:00
Vitaly Buka edad575a35 [sanitizer] Fix compilation after invalid rebase
llvm-svn: 331954
2018-05-10 04:10:09 +00:00
Vitaly Buka e0c6eadef7 [sanitizer] Don't miss threads by ThreadSuspender
Summary:
Enumerating /proc/<pid>/task/ dir Linux may stop if thread is dead. In this case
we miss some alive threads and can report false memory leaks.
To solve this issue we repeat enumeration if the last thread is dead.
Do detect dead threads same way as proc_task_readdir we use
/proc/<pid>/task/<tid>/status.

Similarly it also ends enumeration of if proc_fill_cache fails, but in this case
Linux sets inode to 1 (Bad block).

And just in case re-list threads if we had to call internal_getdents more than
twice or result takes more than half of the buffer.

Reviewers: eugenis, dvyukov, glider

Subscribers: llvm-commits, kubamracek

Differential Revision: https://reviews.llvm.org/D46517

llvm-svn: 331953
2018-05-10 04:02:59 +00:00
Kostya Serebryany d790effacb [libFuzzer] add a simple puzzle that is difficult for today's libFuzzer
llvm-svn: 331951
2018-05-10 02:02:41 +00:00
Vitaly Buka c779388c7b [sanitizer] Use all available rounded up capacity
Reviewers: eugenis

Subscribers: kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D46617

llvm-svn: 331940
2018-05-09 23:31:05 +00:00
Vitaly Buka ed43f18b55 [lsan] Report unsuspended threads
Summary:
Leak checker needs to suspend all process threads. If we have some running
thread in registry but not suspended we can have false leak report. So we will
report this case here for future debugging.

Reviewers: eugenis

Subscribers: kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D46663

llvm-svn: 331936
2018-05-09 23:02:14 +00:00
Vitaly Buka cf50425b77 [sanitizer] Fix argument type and remove unneeded vector resize
llvm-svn: 331927
2018-05-09 22:03:52 +00:00
Petr Hosek 1608ca6d64 [CMake] Build shared version of runtimes for Fuchsia
Fuchsia is no longer treated as UNIX which means we need to explicitly
enable building of shared versions of runtimes.

Differential Revision: https://reviews.llvm.org/D46609

llvm-svn: 331922
2018-05-09 21:24:06 +00:00
Vitaly Buka 34794a9669 [sanitizer] Use tid_t in ThreadLister
llvm-svn: 331921
2018-05-09 21:21:26 +00:00
Vitaly Buka d3e55bf7fc [sanitizer] Cleanup sorting functions
llvm-svn: 331915
2018-05-09 20:42:11 +00:00
Kostya Serebryany 73634e4037 [dfsan] add one more sanitizer-coverage hook to the whitelist
llvm-svn: 331908
2018-05-09 18:35:09 +00:00
Matt Morehouse 0a4d213176 [libFuzzer] Disable print-func.test on Darwin.
The try-lock guard change seems to be making this test fail on Mac, but
I haven't been able to reproduce the failure.  Disabling the test on Mac
to fix build bot.

llvm-svn: 331894
2018-05-09 17:05:07 +00:00
Kostya Kortchinsky cb7912cc0f [sanitizer] Correct 64-bit atomic_store on 32-bit "other" platforms
Summary:
I think there might be something to optimize in `atomic_store`.
Currently, if everything goes well (and we have a different new value), we
always iterate 3 times.
For example, `with a = 0`, `oldval = a`, `newval = 42`, we get:
```
oldval = 0, newval = 42, curval = 0  
oldval = 0, newval = 42, curval = 42 
oldval = 42, newval = 42, curval = 42
```
and then it breaks.

Unless I am not seeing something, I don't see a point to the third iteration.
If the current value is the one we want, we should just break.
This means that 2 iterations (with a different newval) should be sufficient to
achieve what we want.

Reviewers: dvyukov, alekseyshl

Reviewed By: dvyukov

Subscribers: kubamracek, delcypher, #sanitizers, llvm-commits

Differential Revision: https://reviews.llvm.org/D46597

llvm-svn: 331890
2018-05-09 16:20:52 +00:00
Sid Manning ed3065f7a1 Add basic compiler-rt builtins support for hexagon.
Differential Revision: https://reviews.llvm.org/D46364

llvm-svn: 331881
2018-05-09 14:44:54 +00:00
Vitaly Buka fb663789d3 [sanitizer] Remove unneeded blank lines
llvm-svn: 331831
2018-05-09 00:44:26 +00:00
Vitaly Buka 0590a5bd4b [sanitizer] Update .clang-format in compiler-rt
Historically style is Google, but we never used AllowShortIfStatementsOnASingleLine.

llvm-svn: 331829
2018-05-09 00:41:53 +00:00