Commit Graph

7120 Commits

Author SHA1 Message Date
Max Moroz 3f26dac416 [libfuzzer] Compare TotalNumberOfRuns with MaxNumberOfRuns when testing a memory leak.
Summary:
Fuzzer::TryDetectingAMemoryLeak may call ExecuteCallback which would
increment TotalNumberOfRuns, but it doesn't respect Options.MaxNumberOfRuns
value specified by a user.

Context: https://github.com/google/oss-fuzz/issues/822#issuecomment-328153970

Reviewers: kcc

Reviewed By: kcc

Differential Revision: https://reviews.llvm.org/D37632

llvm-svn: 312993
2017-09-12 02:01:54 +00:00
Dean Michael Berris d56b90fb4c [XRay][compiler-rt] Use a single global volatile recursion guard for FDR handlers
Summary:
Before this change, the recursion guard for the flight data recorder
(FDR) mode handlers were independent. This change makes it so that when
a handler is already in the process of running and somehow the same or
another handler starts running -- say in a signal handler, while the
XRay handler is executing -- then we can use the same thread-local
recursion guard to stop the second handler from running.

Reviewers: kpw, eizan

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D37612

llvm-svn: 312992
2017-09-12 01:37:59 +00:00
Vitaly Buka f6fc68c7d1 [compiler-rt] Move IsStackOverflow from asan into sanitizer_common
Summary: Part of https://github.com/google/sanitizers/issues/637

Reviewers: eugenis, alekseyshl

Subscribers: kubamracek, dberris, llvm-commits

Differential Revision: https://reviews.llvm.org/D37536

llvm-svn: 312987
2017-09-12 00:44:23 +00:00
Vitaly Buka 7af8e4b146 Revert "[compiler-rt] Move IsStackOverflow from asan into sanitizer_common"
Windows is broken.

This reverts commit r312951

llvm-svn: 312984
2017-09-12 00:14:33 +00:00
Evgeniy Stepanov 93f2edc215 Runtime detection of android_set_abort_message.
Summary:
Use runtime detection (with a weak-undef symbol) of
android_set_abort_message availability. Android NDK provides a single
version of the ASan runtime library to be used for any target API
level, which makes compile-time feature detection impossible (the
library itself is built at API level 9).

Reviewers: vitalybuka

Subscribers: srhines, llvm-commits, kubamracek

Differential Revision: https://reviews.llvm.org/D37716

llvm-svn: 312973
2017-09-11 23:27:58 +00:00
Vedant Kumar 7669679e82 [ubsan-minimal] Enable on Darwin
Testing: check-ubsan-minimal

Differential Revision: https://reviews.llvm.org/D37646

llvm-svn: 312959
2017-09-11 21:37:53 +00:00
Vitaly Buka 54cc3603de [ubsan] Make ubsan version of __sanitizer_print_stack_trace consistent with other sanitizers
Summary: Other sanitizers include __sanitizer_print_stack_trace into stack trace.

Reviewers: eugenis, alekseyshl

Subscribers: llvm-commits, kubamracek

Differential Revision: https://reviews.llvm.org/D37657

llvm-svn: 312954
2017-09-11 21:25:22 +00:00
Vitaly Buka bdcc82d7ed [ubsan] Save binary name before parsing options
Summary: To parser "include" we may need to do binary name substitution.

Reviewers: eugenis, alekseyshl

Subscribers: llvm-commits, kubamracek

Differential Revision: https://reviews.llvm.org/D37658

llvm-svn: 312953
2017-09-11 21:13:06 +00:00
Vitaly Buka 4084a583d9 Revert "[ubsan] Save binary name before parsing options"
Patch was corrupted by rebase.

This reverts commit r312933

llvm-svn: 312952
2017-09-11 21:12:43 +00:00
Vitaly Buka ecba46d0e6 [compiler-rt] Move IsStackOverflow from asan into sanitizer_common
Summary: Part of https://github.com/google/sanitizers/issues/637

Reviewers: eugenis, alekseyshl

Subscribers: kubamracek, dberris, llvm-commits

Differential Revision: https://reviews.llvm.org/D37536

llvm-svn: 312951
2017-09-11 21:00:24 +00:00
Vitaly Buka 36266b6b0d [compiler-rt] Cleanup decorators
Summary:
Removed redundant End*() methods which defined same way.
Removed redundant Warning() methods.

Reviewers: eugenis

Subscribers: kubamracek, llvm-commits, dberris

Differential Revision: https://reviews.llvm.org/D37549

llvm-svn: 312950
2017-09-11 20:55:49 +00:00
Kostya Kortchinsky 040c211bc4 [scudo] Fix improper TSD init after TLS destructors are called
Summary:
Some of glibc's own thread local data is destroyed after a user's thread local
destructors are called, via __libc_thread_freeres. This might involve calling
free, as is the case for strerror_thread_freeres.
If there is no prior heap operation in the thread, this free would end up
initializing some thread specific data that would never be destroyed properly
(as user's pthread destructors have already been called), while still being
deallocated when the TLS goes away. As a result, a program could SEGV, usually
in __sanitizer::AllocatorGlobalStats::Unregister, where one of the doubly linked
list links would refer to a now unmapped memory area.

To prevent this from happening, we will not do a full initialization from the
deallocation path. This means that the fallback cache & quarantine will be used
if no other heap operation has been called, and we effectively prevent the TSD
being initialized and never destroyed. The TSD will be fully initialized for all
other paths.

In the event of a thread doing only frees and nothing else, a TSD would never
be initialized for that thread, but this situation is unlikely and we can live
with that.

Reviewers: alekseyshl

Reviewed By: alekseyshl

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D37697

llvm-svn: 312939
2017-09-11 19:59:40 +00:00
Vitaly Buka 57ff314368 [ubsan] Save binary name before parsing options
Summary: To parser "include" we may need to do binary name substitution.

Reviewers: eugenis, alekseyshl

Subscribers: llvm-commits, kubamracek

Differential Revision: https://reviews.llvm.org/D37658

llvm-svn: 312933
2017-09-11 18:32:51 +00:00
Vitaly Buka e7e7194a73 [asan] Use more generic string in error message
Summary: Part of https://github.com/google/sanitizers/issues/637

Reviewers: eugenis, alekseyshl

Subscribers: llvm-commits, kubamracek

Differential Revision: https://reviews.llvm.org/D37609

llvm-svn: 312858
2017-09-09 05:58:52 +00:00
Kostya Serebryany 25d6b95679 [libFuzzer] remove a couple of reduntant includes
llvm-svn: 312848
2017-09-09 00:56:34 +00:00
Evgeniy Stepanov 7d1ab555ae [asan] Add a note to shadow memory setup error.
Point to https://github.com/google/sanitizers/issues/856 as a possible cause of the failed mapping.

llvm-svn: 312687
2017-09-07 01:35:59 +00:00
Kostya Kortchinsky 6bc7b26d18 [scudo] getauxval alternative for Android
Summary:
`getauxval` was introduced with API level 18. In order to get things to work
at lower API levels (for the toolchain itself which is built at 14 for 32-bit),
we introduce an alternative implementation reading directly from
`/proc/self/auxv`.

Reviewers: alekseyshl

Reviewed By: alekseyshl

Subscribers: srhines, llvm-commits

Differential Revision: https://reviews.llvm.org/D37488

llvm-svn: 312653
2017-09-06 17:51:32 +00:00
Evgeniy Stepanov 9566d28997 [msan] Remove a stale fixme (NFC).
It was fixed in 312576.

llvm-svn: 312597
2017-09-06 00:28:52 +00:00
Petr Hosek 4f4bdc3c20 [sanitizer_common][Fuchsia] Update Fuchsia sanitizer markup
Include URLs to the markup format specification in code comments.
Use sanitizer markup in the sancov message about a dump just produced.

Patch by Roland McGrath

Differential Revision: https://reviews.llvm.org/D37273

llvm-svn: 312596
2017-09-06 00:00:46 +00:00
Evgeniy Stepanov 29c7487167 Remove ld.config.txt for Android O.
ld.config.txt defines linker namespaces in a way that is incompatible
with ASan. Remove the file when installing ASan on an Android O
(8.0.x) device.

Patch by Jiyong Park.

llvm-svn: 312581
2017-09-05 21:51:20 +00:00
Evgeniy Stepanov 8b80b328d1 [msan] Check sigset_t and sigaction arguments.
Summary:
Check sigset_t arguments in ppoll, sig*wait*, sigprocmask
interceptors, and the entire "struct sigaction" in sigaction. This
can be done because sigemptyset/sigfullset are intercepted and
signal masks should be correctly marked as initialized.

Reviewers: vitalybuka

Subscribers: kubamracek, llvm-commits

Differential Revision: https://reviews.llvm.org/D37367

llvm-svn: 312576
2017-09-05 21:08:56 +00:00
Evgeniy Stepanov 00dedc208f (NFC) Fix the use of do{}while(0) in a macro.
llvm-svn: 312396
2017-09-02 00:09:57 +00:00
David Blaikie 387d0964ba Fix constant-logical-operand warning.
llvm-svn: 312394
2017-09-01 23:57:34 +00:00
Kostya Serebryany 082e9a7528 [libFuzzer] tolerate missing files when loading the seed corpus
llvm-svn: 312269
2017-08-31 19:17:15 +00:00
Alex Lorenz 341317fda4 Revert r312240
The buildbots have shown that -Wstrict-prototypes behaves differently in GCC
and Clang so we should keep it disabled until Clang follows GCC's behaviour

llvm-svn: 312246
2017-08-31 15:51:23 +00:00
Alex Lorenz fbac1ae062 Build LLVM with -Wstrict-prototypes enabled
Clang 5 supports -Wstrict-prototypes. We should use it to catch any C
declarations that declare a non-prototype function.

rdar://33705313

Differential Revision: https://reviews.llvm.org/D36669

llvm-svn: 312240
2017-08-31 13:23:24 +00:00
Dean Michael Berris 1704f6289a [XRay][compiler-rt] Enable the XRay compiler-rt unit tests.
Summary:
Before this change we seemed to not be running the unit tests, and therefore we
set out to run them. In the process of making this happen we found a divergence
between the implementation and the tests.

This includes changes to both the CMake files as well as the implementation and
headers of the XRay runtime. We've also updated documentation on the changed
functions.

Reviewers: kpw, eizan

Subscribers: mgorny, llvm-commits

Differential Revision: https://reviews.llvm.org/D37290

llvm-svn: 312202
2017-08-31 00:50:12 +00:00
Kamil Rytarowski d92f3982ce Finalize ASAN/NetBSD
Summary:
This revision contains various cleanups.

Sponsored by <The NetBSD Foundation>

Reviewers: kcc, vitalybuka, joerg, eugenis

Reviewed By: kcc

Subscribers: emaste, srhines, llvm-commits, kubamracek, mgorny, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D37244

llvm-svn: 312188
2017-08-30 23:02:36 +00:00
Matt Morehouse 034126e507 [SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer
Summary:
- Don't sanitize __sancov_lowest_stack.
- Don't instrument leaf functions.
- Add CoverageStackDepth to Fuzzer and FuzzerNoLink.
- Only enable on Linux.

Reviewers: vitalybuka, kcc, george.karpenkov

Reviewed By: kcc

Subscribers: kubamracek, cfe-commits, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D37156

llvm-svn: 312185
2017-08-30 22:49:31 +00:00
Kamil Rytarowski 06f2f80791 Add NetBSD support in lsan_interceptors.cc
Summary:
NetBSD is a modern POSIX-like UNIX-like Operating System derived from 4.4BSD/386BSD.

Sponsored by <The NetBSD Foundation>

Reviewers: joerg, vitalybuka, kcc, dvyukov

Reviewed By: kcc

Subscribers: llvm-commits, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D37307

llvm-svn: 312184
2017-08-30 22:47:05 +00:00
Kamil Rytarowski 8da2722a9f Add preliminary NetBSD support in libfuzzer
Summary:
This code already works and passes some number of tests.

There is need to finish remaining sanitizers to get better coverage.

Many tests fail due to overly long file names of executables (>31).
This is a current shortcoming of the NetBSD 8(beta) kernel, as
certain functions can fail (like retrieving file name of executable).

Sponsored by <The NetBSD Foundation>

Reviewers: joerg, kcc, vitalybuka, george.karpenkov

Reviewed By: kcc

Subscribers: mgorny, llvm-commits, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D37304

llvm-svn: 312183
2017-08-30 22:44:11 +00:00
Kamil Rytarowski 5ec32d4f96 Add NetBSD support in tsan_interceptors.cc
Summary:
NetBSD is a POSIX-like BSD Operating System.

Sponsored by <The NetBSD Foundation>

Reviewers: joerg, kcc, vitalybuka, dvyukov, eugenis

Reviewed By: dvyukov

Subscribers: srhines, kubamracek, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D37305

llvm-svn: 312160
2017-08-30 19:41:30 +00:00
Francis Ricci e3b018f6e5 [builtins] Prevent duplicate definitions for overridden functions
Summary:
Some architecture-specific function overrides (for example, i386/ashrdi3.S)
duplicate generic functions (in that case, ashrdi3.c). Prevent duplicate definitions
by filtering out the generic files before compiling.

Reviewers: compnerd, beanz

Subscribers: llvm-commits, mgorny

Differential Revision: https://reviews.llvm.org/D37166

llvm-svn: 312140
2017-08-30 17:12:57 +00:00
George Karpenkov 5a2898ae03 Fix for TSan unit-tests:
Previous refactoring has left unit-tests in a buggy state,
where they were not launched at all.

llvm-svn: 312094
2017-08-30 02:24:31 +00:00
Matt Morehouse ba2e61b357 Revert "[SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer"
This reverts r312026 due to bot breakage.

llvm-svn: 312047
2017-08-29 21:56:56 +00:00
Kostya Kortchinsky 913d038b29 Enable GetRandom for Fuchsia sanitizer.
Summary: Adds a true implementation of GetRandom, to be used by scudo_utils.h.

Reviewers: mcgrathr, phosek, kcc, vitalybuka, cryptoad

Reviewed By: mcgrathr

Subscribers: kubamracek

Differential Revision: https://reviews.llvm.org/D37218

llvm-svn: 312046
2017-08-29 21:52:56 +00:00
Matt Morehouse 2edac86cdb Re-enable stack depth instrumentation on Windows.
Specified tls_model attribute properly. Should compile on Windows
now.

llvm-svn: 312037
2017-08-29 21:15:33 +00:00
Evgeniy Stepanov 3bafa546d0 Disable ubsan-minimal on Darwin.
Should un-break this bot:
http://green.lab.llvm.org/green//job/clang-stage1-configure-RA_build/38264/consoleFull

llvm-svn: 312036
2017-08-29 21:15:08 +00:00
Kostya Serebryany 4faeb87ebe [libFUzzer] change the way we load the seed corpora: instead of loading all files and these executing all files, load and execute them one-by-one. This should reduce the memory usage in many cases
llvm-svn: 312033
2017-08-29 20:51:24 +00:00
Matt Morehouse c29c2c9b0c Disable stack depth tracking on Windows.
Windows doesn't support the tls_model attribute.

llvm-svn: 312032
2017-08-29 20:44:41 +00:00
Evgeniy Stepanov 6d2b6f0a5f Minimal runtime for UBSan.
Summary:
An implementation of ubsan runtime library suitable for use in production.

Minimal attack surface.
* No stack traces.
* Definitely no C++ demangling.
* No UBSAN_OPTIONS=log_file=/path (very suid-unfriendly). And no UBSAN_OPTIONS in general.
* as simple as possible

Minimal CPU and RAM overhead.
* Source locations unnecessary in the presence of (split) debug info.
* Values and types (as in A+B overflows T) can be reconstructed from register/stack dumps, once you know what type of error you are looking at.
* above two items save 3% binary size.

When UBSan is used with -ftrap-function=abort, sometimes it is hard to reason about failures. This library replaces abort with a slightly more informative message without much extra overhead. Since ubsan interface in not stable, this code must reside in compiler-rt.

Reviewers: pcc, kcc

Subscribers: srhines, mgorny, aprantl, krytarowski, llvm-commits

Differential Revision: https://reviews.llvm.org/D36810

llvm-svn: 312029
2017-08-29 20:03:51 +00:00
Matt Morehouse 2ad8d948b2 [SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer
Summary:
- Don't sanitize __sancov_lowest_stack.
- Don't instrument leaf functions.
- Add CoverageStackDepth to Fuzzer and FuzzerNoLink.
- Disable stack depth tracking on Mac.

Reviewers: vitalybuka, kcc, george.karpenkov

Reviewed By: kcc

Subscribers: kubamracek, cfe-commits, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D37156

llvm-svn: 312026
2017-08-29 19:48:12 +00:00
Dean Michael Berris eca980396e [XRay][compiler-rt][NFC] Refactor global TLS variables behind an accessor function.
Summary:
This change hides all the initialization of thread_local variables used
by the XRay FDR mode implementation behind a function call. This makes
initialization of thread-local data to be done lazily, instead of
eagerly when they're done as globals. It also gives us an isolation
mechanism if/when we want to change the TLS implementation from using
the C++ thread_local keyword, for something more ad-hoc (potentialy
using pthread directly) on some platforms or set-ups where we cannot use
the C++ thread_local variables.

Reviewers: kpw, eizan

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D37248

llvm-svn: 311997
2017-08-29 12:21:45 +00:00
Kostya Serebryany 3a8e3c8336 [libFuzzer] refactoring: move reading the seed corpus closer to where it's consumed; NFC
llvm-svn: 311972
2017-08-29 02:05:01 +00:00
Kamil Rytarowski 802afb4c0a Shorten filenames of tests (-with-calls to -calls)
Summary:
The NetBSD's 8(beta) versions of kernel functions to retrieve
program name (vnode to path translator) and process memory
map have internal limit of processing filenames with maximum
of 31 characters.

Filenames like Asan-x86_64-with-calls-Noinst-Test break this
limit and affect tests. Rename "-with-calls" to "-calls".

This changes fixes all issues for the Address Sanitizer test
target (check-asan) on the current NetBSD support caused
by long filenames.

Sponsored by <The NetBSD Foundation>

Reviewers: joerg, vitalybuka, filcab, fjricci, kcc

Reviewed By: vitalybuka

Subscribers: kubamracek, mgorny, llvm-commits, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D37149

llvm-svn: 311966
2017-08-29 01:03:13 +00:00
Kostya Serebryany c07008653c [libFuzzer] allow -print_funcs=N: N is the max number of new covered function printed
llvm-svn: 311945
2017-08-28 22:52:22 +00:00
Kamil Rytarowski 357bbc57f9 Add NetBSD ASAN shadow mapping for x86-64
Summary:
The maximal virtual address on NetBSD/amd64 is 0x7f7ffffff000.
Define shadow offset 0x400000000000 (1ULL << 46).

Sponsored by <The NetBSD Foundation>

Reviewers: joerg, vitalybuka, filcab, fjricci, kcc, eugenis, pcc

Reviewed By: kcc

Subscribers: llvm-commits, kubamracek, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D36587

llvm-svn: 311937
2017-08-28 21:41:04 +00:00
Kamil Rytarowski 5abb0ac6ea Add NetBSD specific version of sanitizer_platform_limits_posix
Summary:
NetBSD is an Open-Source POSIX-like BSD Operating System.

Part of the code inspired by the original work on libsanitizer in GCC 5.4 by Christos Zoulas.

Sponsored by <The NetBSD Foundation>

Reviewers: joerg, kcc, vitalybuka, filcab, fjricci

Reviewed By: kcc

Subscribers: llvm-commits, kubamracek, mgorny, #sanitizers

Tags: #sanitizers

Differential Revision: https://reviews.llvm.org/D37193

llvm-svn: 311933
2017-08-28 21:03:23 +00:00
Michal Gorny 0e52de05db Reland r311842 - [cmake] Remove i686 target that is duplicate to i386
Remove the explicit i686 target that is completely duplicate to
the i386 target, with the latter being used more commonly.

1. The runtime built for i686 will be identical to the one built for
i386.

2. Supporting both -i386 and -i686 suffixes causes unnecessary confusion
on the clang end which has to expect either of them.

3. The checks are based on wrong assumption that __i686__ is defined for
all newer x86 CPUs. In fact, it is only declared when -march=i686 is
explicitly used. It is not available when a more specific (or newer)
-march is used.

Curious enough, if CFLAGS contain -march=i686, the runtime will be built
both for i386 and i686. For any other value, only i386 variant will be
built.

Differential Revision: https://reviews.llvm.org/D26764

llvm-svn: 311924
2017-08-28 20:30:12 +00:00
George Karpenkov dacfd66dfd [libFuzzer] Fix libFuzzer flag propagation for standalone builds.
Under the previous configurations, flags from SANITIZER_COMMON were not
propagated for standalone builds.

Differential Revision: https://reviews.llvm.org/D37225

llvm-svn: 311912
2017-08-28 19:44:19 +00:00