Commit Graph

13861 Commits

Author SHA1 Message Date
Vitaly Buka 5e9e463e1f [lsan] Test to show lsan dependency on globals
This test from @MaskRay comment on D69428. The patch is looking to
break this behavior. If we go with D69428 I hope we will have some
workaround for this test or include explicit test update into the patch.

Reviewed By: MaskRay

Differential Revision: https://reviews.llvm.org/D100906
2021-04-20 22:00:26 -07:00
Fangrui Song 031c40dc3c [sanitizer] Fix glibc sparc build and add GetTls support
sanitizer_linux_libcdep.cpp doesn't build for Linux sparc (with minimum support
but can build) after D98926. I wasn't aware because the file didn't mention
`__sparc__`.

While here, add the relevant support since it does not add complexity
(the D99566 approach).  Adds an explicit `#error` for unsupported
non-Android Linux and FreeBSD architectures.

ThreadDescriptorSize is only used by lsan to scan thread-specific data keys in
the thread control block.

On TLS Variant II architectures (i386/x86_64/s390/sparc), our dl_iterate_phdr
based approach can cover the region from the first byte of the static TLS block
(static TLS surplus) to the thread pointer.
We just need to extend the range to include the first few members of struct
pthread. offsetof(struct pthread, specific_used) satisfies the requirement and
has not changed since 2007-05-10. We don't need to update ThreadDescriptorSize
for each glibc version.

Technically we could use the 524/1552 for x86_64 as well but there is potential
risk that large applications with thousands of shared object dependency may
dislike the time complexity increase if there are many threads, so I don't make
the simplification for now.

Differential Revision: https://reviews.llvm.org/D100892
2021-04-20 17:42:41 -07:00
Dan Liew 6f4f0afaa8 [Compiler-rt] Fix bug when considering CMake path returned by llvm-config.
The previous check was wrong because it only checks that the LLVM CMake
directory exists. However, it's possible that the directory exists but
the `LLVMConfig.cmake` file does not. When this happens we would
incorectly try to include the non-existant file.

To fix this we make the check stricter by checking that the file
we want to include actually exists.

This is a follow up to fd28517d87.

rdar://76870467
2021-04-20 11:57:20 -07:00
Evgenii Stepanov fbb9132e71 Fix android-x86 library name in asan_device_setup.
https://reviews.llvm.org/D26764 removed i686 variants of compiler-rt
libraries and canonicalized the i386 name.

https://reviews.llvm.org/D37278 partially reverted the previous change
to keep i686 name on Android, but did not update asan_device_setup
script.

This changes fixes asan_device_setup.

Differential Revision: https://reviews.llvm.org/D100505
2021-04-19 17:39:58 -07:00
Emily Shi cc2b62a06e [compiler-rt] assert max virtual address is <= mmap range size
If these sizes do not match, asan will not work as expected.

If possible, assert at compile time that the vm size is less than or equal to mmap range.
If a compile time assert is not possible, check at run time (for iOS)

rdar://76477969

Reviewed By: delcypher, yln

Differential Revision: https://reviews.llvm.org/D100239
2021-04-19 14:01:07 -07:00
Emily Shi 94ba3b6e3b [compiler-rt][asan] use full vm range on apple silicon macs
We previously shrunk the mmap range size on ios, but those settings got inherited by apple silicon macs.
Don't shrink the vm range on apple silicon Mac since we have access to the full range.

Also don't shrink vm range for iOS simulators because they have the same range as the host OS, not the simulated OS.

rdar://75302812

Reviewed By: delcypher, kubamracek, yln

Differential Revision: https://reviews.llvm.org/D100234
2021-04-19 12:12:26 -07:00
Sylvestre Ledru 485e561f8d Try to unbreak the compiler-rt build on s390x
Introduced by:
3d1d7156e9
2021-04-19 13:17:47 +02:00
Fangrui Song 3d1d7156e9 [sanitizer] Don't call __tls_get_addr on s390x after D98926
glibc s390x doesn't define __tls_get_addr.

Fix PR50017
2021-04-18 10:42:44 -07:00
David CARLIER 61fc02dc03 [Sanitizers] Fix build 2021-04-17 11:15:31 +01:00
David Carlier 0df0d6acea [Sanitizers] DragonFlyBSD adding support for builtins
Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D89653
2021-04-17 11:10:35 +01:00
David Carlier 4583759414 [Sanitizers] Undefined Behavior Sanitizer support for DragonFlyBSD
Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D89631
2021-04-17 11:08:00 +01:00
Fangrui Song 08843a0c3f [sanitizer] GetTls: work around ppc64 with glibc<2.25(?) or GNU ld 2.30
GNU ld 2.26 and GNU ld 2.31 seem fine but GNU ld 2.30 has mysterious
segfaults linking msan tests.
2021-04-16 14:03:28 -07:00
Vitaly Buka b93629dd33 Address D100645 comment 2021-04-16 11:28:41 -07:00
Vitaly Buka 82150606fb Sanitizer built against glibc 2.34 doesn't work
As mentioned in https://gcc.gnu.org/PR100114 , glibc starting with the
https://sourceware.org/git/?p=glibc.git;a=commit;h=6c57d320484988e87e446e2e60ce42816bf51d53
change doesn't define SIGSTKSZ and MINSIGSTKSZ macros to constants, but to sysconf function call.
sanitizer_posix_libcdep.cpp has
static const uptr kAltStackSize = SIGSTKSZ * 4;  // SIGSTKSZ is not enough.
which is generally fine, just means that when SIGSTKSZ is not a compile time constant will be initialized later.
The problem is that kAltStackSize is used in SetAlternateSignalStack which is called very early, from .preinit_array
initialization, i.e. far before file scope variables are constructed, which means it is not initialized and
mmapping 0 will fail:
==145==ERROR: AddressSanitizer failed to allocate 0x0 (0) bytes of SetAlternateSignalStack (error code: 22)

Here is one possible fix, another one could be to make kAltStackSize a preprocessor macro if _SG_SIGSTKSZ is defined
(but perhaps with having an automatic const variable initialized to it so that sysconf isn't at least called twice
during SetAlternateSignalStack.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D100645
2021-04-16 11:21:03 -07:00
Alexey Vishnyakov 827ccc93b8 [fuzzer] Print reloaded file paths
In order to integrate libFuzzer with a dynamic symbolic execution tool
Sydr we need to print loaded file paths.

Reviewed By: morehouse

Differential Revision: https://reviews.llvm.org/D100303
2021-04-16 10:00:24 -07:00
Fangrui Song 376db8eaef [sanitizer] Mark g_use_dlpi_tls_data as unused
There is a -Wunused-variable warning on Android
2021-04-16 09:28:51 -07:00
George Balatsouras 98b114d480 [dfsan] Remove hard-coded constant in release_shadow_space.c
Reviewed By: stephan.yichao.zhao

Differential Revision: https://reviews.llvm.org/D100608
2021-04-15 17:24:35 -07:00
George Balatsouras b2b59f622e [dfsan] Add test for origin tracking stack traces
Reviewed By: stephan.yichao.zhao

Differential Revision: https://reviews.llvm.org/D100518
2021-04-15 16:22:47 -07:00
Fangrui Song afec953857 [sanitizer] Simplify GetTls with dl_iterate_phdr on Linux and use it on musl/FreeBSD
... so that FreeBSD specific GetTls/glibc specific pthread_self code can be
removed. This also helps FreeBSD arm64/powerpc64 which don't have GetTls
implementation yet.

GetTls is the range of

* thread control block and optional TLS_PRE_TCB_SIZE
* static TLS blocks plus static TLS surplus

On glibc, lsan requires the range to include
`pthread::{specific_1stblock,specific}` so that allocations only referenced by
`pthread_setspecific` can be scanned.

This patch uses `dl_iterate_phdr` to collect TLS blocks. Find the one
with `dlpi_tls_modid==1` as one of the initially loaded module, then find
consecutive ranges. The boundaries give us addr and size.

This allows us to drop the glibc internal `_dl_get_tls_static_info` and
`InitTlsSize`. However, huge glibc x86-64 binaries with numerous shared objects
may observe time complexity penalty, so exclude them for now. Use the simplified
method with non-Android Linux for now, but in theory this can be used with *BSD
and potentially other ELF OSes.

This removal of RISC-V `__builtin_thread_pointer` makes the code compilable with
more compiler versions (added in Clang in 2020-03, added in GCC in 2020-07).

This simplification enables D99566 for TLS Variant I architectures.

Note: as of musl 1.2.2 and FreeBSD 12.2, dlpi_tls_data returned by
dl_iterate_phdr is not desired: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254774
This can be worked around by using `__tls_get_addr({modid,0})` instead
of `dlpi_tls_data`. The workaround can be shared with the workaround for glibc<2.25.

This fixes some tests on Alpine Linux x86-64 (musl)

```
test/lsan/Linux/cleanup_in_tsd_destructor.c
test/lsan/Linux/fork.cpp
test/lsan/Linux/fork_threaded.cpp
test/lsan/Linux/use_tls_static.cpp
test/lsan/many_tls_keys_thread.cpp

test/msan/tls_reuse.cpp
```

and `test/lsan/TestCases/many_tls_keys_pthread.cpp` on glibc aarch64.

The number of sanitizer test failures does not change on FreeBSD/amd64 12.2.

Differential Revision: https://reviews.llvm.org/D98926
2021-04-15 15:34:43 -07:00
Kostya Kortchinsky 3f97c66b00 [scudo][standalone] Fuchsia related fixes
While attempting to roll the latest Scudo in Fuchsia, some issues
arose. While trying to debug them, it appeared that `DCHECK`s were
also never exercised in Fuchsia. This CL fixes the following
problems:
- the size of a block in the TransferBatch class must be a multiple
  of the compact pointer scale. In some cases, it wasn't true, which
  lead to obscure crashes. Now, we round up `sizeof(TransferBatch)`.
  This only materialized in Fuchsia due to the specific parameters
  of the `DefaultConfig`;
- 2 `DCHECK` statements in Fuchsia were incorrect;
- `map()` & co. require a size multiple of a page (as enforced in
  Fuchsia `DCHECK`s), which wasn't the case for `PackedCounters`.
- In the Secondary, a parameter was marked as `UNUSED` while it is
  actually used.

Differential Revision: https://reviews.llvm.org/D100524
2021-04-15 13:26:23 -07:00
Martijn Vels 3c23807569 Add convenient composed tsan constants
This change adds convenient composed constants to be used for tsan_read_try_lock annotations, reducing the boilerplate at the instrumentation site.

Reviewed By: dvyukov

Differential Revision: https://reviews.llvm.org/D99595
2021-04-15 10:25:41 +02:00
Vitaly Buka 2a894b698c [scudo] Restore zxtest compatibility
Reviewed By: cryptoad

Differential Revision: https://reviews.llvm.org/D100426
2021-04-14 22:21:06 -07:00
Evgenii Stepanov 51aa61e74b [hwasan] Fix lock contention on thread creation.
Do not hold the free/live thread list lock longer than necessary.
This change speeds up the following benchmark 10x.

constexpr int kTopThreads = 50;
constexpr int kChildThreads = 20;
constexpr int kChildIterations = 8;

void Thread() {
  for (int i = 0; i < kChildIterations; ++i) {
    std::vector<std::thread> threads;
    for (int i = 0; i < kChildThreads; ++i)
      threads.emplace_back([](){});
    for (auto& t : threads)
      t.join();
  }
}

int main() {
  std::vector<std::thread> threads;
  for (int i = 0; i < kTopThreads; ++i)
    threads.emplace_back(Thread);
  for (auto& t : threads)
    t.join();
}

Differential Revision: https://reviews.llvm.org/D100348
2021-04-14 17:13:15 -07:00
Ties Stuij 3b9dc59dbf [arm][compiler-rt] add armv8m.main and arv8.1m.main targets
These changes were enough to compile compiler-rt builtins for armv8m.main and
armv8.1m.main.

Differential Revision: https://reviews.llvm.org/D99600
2021-04-14 16:41:03 +01:00
Roland McGrath 5c500c9f01 [scudo] Make MTE inline asm compatible with GNU assembler
The GNU assembler can't parse `.arch_extension ...` before a `;`.
So instead uniformly use raw string syntax with separate lines
instead of `;` separators in the assembly code.

Reviewed By: pcc

Differential Revision: https://reviews.llvm.org/D100413
2021-04-13 18:11:42 -07:00
Matt Morehouse b351590bae [libFuzzer] Fix fuzzer-oom.test.
SinkPtr was not correctly marked as volatile, causing the malloc to get
optimized out.  This was causing 20-minute timeouts for the test and no
OOM.
2021-04-13 11:33:41 -07:00
Matt Morehouse 4230249048 [libFuzzer] Fix MSan false positives with custom mutators.
We need to unpoison parameters before calling into MSan-instrumented
user-defined mutators.

Addresses https://github.com/google/oss-fuzz/issues/4605.

Reviewed By: metzman

Differential Revision: https://reviews.llvm.org/D100355
2021-04-13 10:49:42 -07:00
Freddy Ye b28ec3fd18 [compiler-rt][X86] fix build fail after "[X86] Support -march=rocketlake"
This copy error will cause a failed builder on sanitizer-x86_64-linux
2021-04-13 14:33:12 +08:00
Freddy Ye 3fc1fe8db8 [X86] Support -march=rocketlake
Reviewed By: skan, craig.topper, MaskRay

Differential Revision: https://reviews.llvm.org/D100085
2021-04-13 09:48:13 +08:00
Pirama Arumuga Nainar 5d214238a1 [compiler-rt][aarch64] Add PAC-RET/BTI property to hwasan_interceptors_vfork.S
D100143 added similar annotations but missed this file.

Differential Revision: https://reviews.llvm.org/D100354
2021-04-12 17:17:33 -07:00
Julian Lettner 05df5c54e8 [TSan] Allow test contents to be copied before execution
Allow test contents to be copied before execution by using
`%ld_flags_rpath_so`, `%ld_flags_rpath_exe`, and `%dynamiclib`
substitutions.

rdar://76302416

Differential Revision: https://reviews.llvm.org/D100240
2021-04-12 13:30:06 -07:00
Emily Shi 20f38d0142 [compiler-rt] add SANITIZER_OSX
This will allow us to make osx specific changes easier. Because apple silicon macs also run on aarch64, it was easy to confuse it with iOS.

rdar://75302812

Reviewed By: yln

Differential Revision: https://reviews.llvm.org/D100157
2021-04-12 11:45:45 -07:00
Mitch Phillips 15689f3af0 [asan] Replaceable new/delete is unsupported in Windows.
Mark the test as unsupported to bring the bot online. Could probably be
permanently fixed by using one of the workarounds already present in
compiler-rt.
2021-04-12 09:50:34 -07:00
Daniel Kiss a46effbd2a [compiler-rt][aarch64] Add PAC-RET/BTI support to HWASAN.
Support for -mbranch-protection.

Reviewed By: eugenis

Differential Revision: https://reviews.llvm.org/D100143
2021-04-12 17:02:45 +02:00
Jim Lin dd4c999c23 fix typo in a CMake SANITIZER_CAN_USE_CXXABI variable initial definition
The current variable name isn't used anywhere else, which indicates it's
a typo.  Let's fix it before someone copy+pastes it somewhere else.

Reviewed By: Jim

Differential Revision: https://reviews.llvm.org/D39157
2021-04-12 14:05:37 +08:00
Mitch Phillips 7df30e77d4 [ASan] Allow new/delete replacement by making interceptors weak
ASan declares these functions as strongly-defined, which results in
'duplicate symbol' errors when trying to replace them in user code when
linking the runtimes statically.

Reviewed By: eugenis

Differential Revision: https://reviews.llvm.org/D100220
2021-04-09 14:19:39 -07:00
Kostya Kortchinsky 50979defc9 [scudo][standalone] Use BatchClassId in drain rather than 0
D99763 fixed `SizeClassAllocatorLocalCache::drain` but with the
assumption that `BatchClassId` is 0 - which is currently true. I would
rather not make the assumption so that if we ever change the ID of
the batch class, the loop would still work. Since `BatchClassId` is
used more often in `local_cache.h`, introduce a constant so that we
don't have to specify `SizeClassMap::` every time.

Differential Revision: https://reviews.llvm.org/D100062
2021-04-09 13:42:05 -07:00
Alex Richardson ed0bf875a9 [builtins] Avoid enum name conflicts with fenv.h
After a follow-up change (D98332) this header can be included the same time
as fenv.h when running the tests. To avoid enum members conflicting with
the macros/enums defined in the host fenv.h, prefix them with CRT_.

Reviewed By: peter.smith

Differential Revision: https://reviews.llvm.org/D98333
2021-04-09 18:48:49 +01:00
Leonard Chan a7b51d8a4f [compiler-rt][hwasan] Add C++17 new/delete operators with alignment
Differential Revision: https://reviews.llvm.org/D99368
2021-04-08 15:44:39 -07:00
David Spickett 466fab5c94 [lsan] Mark 2 new lsan tests unsupported on arm-linux
These tests were added in:
1daa48f005
59e422c90b

malloc_zero.c and realloc_too_big.c fail when only
leak sanitizer is enabled.
http://lab.llvm.org:8011/#/builders/59/builds/1635
(also in an armv8 32 bit build)

(I would XFAIL them but the same test is run with
address and leak sanitizer enabled and that one does
pass)
2021-04-08 15:57:46 +01:00
Luís Marques 0c3bc1f3a4 [ASan][RISCV] Fix RISC-V memory mapping
Fixes the ASan RISC-V memory mapping (originally introduced by D87580 and
D87581). This should be an improvement both in terms of first principles
soundness and observed test failures --- test failures would occur
non-deterministically depending on the ASLR random offset.

On RISC-V Linux (64-bit), `TASK_UNMAPPED_BASE` is currently defined as
`PAGE_ALIGN(TASK_SIZE / 3)`. The non-power-of-two divisor makes the result
be the not very round number 0x1555556000. That address had to be further
rounded to ensure page alignment after the shadow scale shifting is applied.
Still, that value explains why the mapping table may look less regular than
expected.

Further cleanups:
- Moved the mapping table comment, to ensure that the two Linux/AArch64
tables stayed together;
- Removed mention of Sv48. Neither the original mapping nor this one are
compatible with an actual Linux Sv48 address space (mainline Linux still
operates Sv48 in Sv39 mode). A future patch can improve this;
- Removed the additional comments, for consistency.

Differential Revision: https://reviews.llvm.org/D97646
2021-04-06 20:46:17 +01:00
James Y Knight 3b1b1d7530 Fix f6ee97d8271e1dfd9b6572222fefe8f40433952e:
PrintAddress needs to be false (as it was before), or this breaks sanitizer backtraces.
2021-04-06 14:10:26 -04:00
Julian Lettner a3e1b11123 [Sanitizer] Adopt Python 3 for iOS simulator test scripts
Differential Revision: https://reviews.llvm.org/D99911
2021-04-06 09:14:14 -07:00
Dan Liew fd28517d87 [CMake][Compiler-rt] Make it possible to configure standalone compiler-rt without `LLVMConfig.cmake`.
Previously it wasn't possible to configure a standalone compiler-rt
build if the `LLVMConfig.cmake` file isn't present in a shipped
toolchain.

This patch adds a fallback behaviour for when `LLVMConfig.cmake` is not
available in the toolchain being used for configure. The fallback
behaviour mocks out the bare minimum required to make a configure
succeed when the host is Darwin. Support for other platforms could
be added in future patches.

The new code path is taken either in one of the following cases:

* `llvm-config` is not available.
* `llvm-config` is available but it provides an invalid path for the CMake files.

The motivation here is to be able to generate the compiler-rt lit test
suites for an arbitrary LLVM toolchain and then run the tests against
it.

The invocation to do this looks something like.

```
CC=/path/to/cc \
CXX=/path/to/c++ \
cmake \
  -G Ninja \
  -DLLVM_CONFIG_PATH=/path/to/llvm-config \
  -DCOMPILER_RT_INCLUDE_TESTS=ON \
  /path/to/llvm-project/compiler-rt

 # Note we don't compile compiler-rt in this workflow.
bin/llvm-lit -v test/path/to/generated/test_suite
```

A possible alternative approach is to configure the
`cmake/modules/LLVMConfig.cmake.in` file in the LLVM source tree
and then include it. This approach was not taken because it is more
complicated.

An interesting side benefit of this patch is that it is now
possible to configure on Darwin without `llvm-config` being available
by configuring with `-DLLVM_CONFIG_PATH=""`. This moves us a step
closer to a world where no LLVM build artefacts are required to
build compiler-rt.

rdar://76016632

Differential Revision: https://reviews.llvm.org/D99621
2021-04-06 08:31:18 -07:00
Dan Liew fa818bb035 [CMake][Compiler-rt] Compute `LLVM_MAIN_SRC_DIR` assuming the monorepo
layout.

When doing a standalone compiler-rt build we currently rely on
getting information from the `llvm-config` binary. Previously
we would rely on calling `llvm-config --src-root` to find the
LLVM sources. Unfortunately the returned path could easily be wrong
if the sources were built on another machine.

Now that compiler-rt is part of a monorepo we can easily fix this
problem by finding the LLVM source tree next to `compiler-rt` in
the monorepo. We do this regardless of whether or not the `llvm-config`
binary is available which moves us one step closer to not requiring
`llvm-config` to be available.

To try avoid anyone breaking anyone who relies on the current behavior,
if the path assuming the monorepo layout doesn't exist we invoke
`llvm-config --src-root` to get the path. A deprecation warning is
emitted if this path is taken because we should remove this path
in the future given that other runtimes already assume the monorepo
layout.

We also now emit a warning if `LLVM_MAIN_SRC_DIR` does not exist.
The intention is that this should be a hard error in future but
to avoid breaking existing users we'll keep this as a warning
for now.

rdar://76016632

Differential Revision: https://reviews.llvm.org/D99620
2021-04-06 08:31:18 -07:00
Alexander Belyaev f6ee97d827 [rt] Update DIPrinter usage in 'sanitizer_symbolize.cpp`.
These changes were required after
5f57793c4f

Differential Revision: https://reviews.llvm.org/D99937
2021-04-06 12:31:47 +02:00
David Spickett 34f8a7f93c [lsan][test] Disable many_tls_keys_pthread.cpp on AArch64
Partially reverts 04dbb63400.

This test requires 9be8f8b34d
which is/has been reverted a few times but this test was
left enabled.

Currently that change is reverted and this test is failing:
http://lab.llvm.org:8011/#/builders/7/builds/2327
2021-04-06 11:28:02 +01:00
Nico Weber 0e92cbd6a6 Revert "[sanitizer] Simplify GetTls with dl_iterate_phdr on Linux"
This reverts commit ec575e3b0a.
Still doesn't work, see https://crbug.com/1196037
2021-04-05 19:00:18 -04:00
Fangrui Song ec575e3b0a [sanitizer] Simplify GetTls with dl_iterate_phdr on Linux
This was reverted by f176803ef1 due to
Ubuntu 16.04 x86-64 glibc 2.23 problems.
This commit additionally calls `__tls_get_addr({modid,0})` to work around the
dlpi_tls_data==NULL issues for glibc<2.25
(https://sourceware.org/bugzilla/show_bug.cgi?id=19826)

GetTls is the range of

* thread control block and optional TLS_PRE_TCB_SIZE
* static TLS blocks plus static TLS surplus

On glibc, lsan requires the range to include
`pthread::{specific_1stblock,specific}` so that allocations only referenced by
`pthread_setspecific` can be scanned.

This patch uses `dl_iterate_phdr` to collect TLS blocks. Find the one
with `dlpi_tls_modid==1` as one of the initially loaded module, then find
consecutive ranges. The boundaries give us addr and size.

This allows us to drop the glibc internal `_dl_get_tls_static_info` and
`InitTlsSize` entirely. Use the simplified method with non-Android Linux for
now, but in theory this can be used with *BSD and potentially other ELF OSes.

This simplification enables D99566 for TLS Variant I architectures.

See https://reviews.llvm.org/D93972#2480556 for analysis on GetTls usage
across various sanitizers.

Differential Revision: https://reviews.llvm.org/D98926
2021-04-04 15:35:53 -07:00
Vitaly Buka c4c5113372 [NFC][scudo] Restore !UseQuarantine check in tests
The check was removed in D99786 as it seems that quarantine is
irrelevant for the just created allocator. However there is internal
issues with tagged memory access.

We should be able to fix iterateOverChunks for taggin later.
2021-04-03 23:52:06 -07:00