Skip to content

Commit ab8d005

Browse files
fhahnfhahn
committed
[TySan] A Type Sanitizer (Clang)
1 parent a6d44dd commit ab8d005

File tree

16 files changed

+114
-27
lines changed

16 files changed

+114
-27
lines changed

‎clang/include/clang/Basic/Features.def‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,7 @@ FEATURE(numerical_stability_sanitizer, LangOpts.Sanitize.has(SanitizerKind::Nume
102102
FEATURE(memory_sanitizer,
103103
LangOpts.Sanitize.hasOneOf(SanitizerKind::Memory |
104104
SanitizerKind::KernelMemory))
105+
FEATURE(type_sanitizer, LangOpts.Sanitize.has(SanitizerKind::Type))
105106
FEATURE(thread_sanitizer, LangOpts.Sanitize.has(SanitizerKind::Thread))
106107
FEATURE(dataflow_sanitizer, LangOpts.Sanitize.has(SanitizerKind::DataFlow))
107108
FEATURE(scudo, LangOpts.Sanitize.hasOneOf(SanitizerKind::Scudo))

‎clang/include/clang/Basic/Sanitizers.def‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,9 @@ SANITIZER("fuzzer", Fuzzer)
7373
// libFuzzer-required instrumentation, no linking.
7474
SANITIZER("fuzzer-no-link", FuzzerNoLink)
7575

76+
// TypeSanitizer
77+
SANITIZER("type", Type)
78+
7679
// ThreadSanitizer
7780
SANITIZER("thread", Thread)
7881

‎clang/include/clang/Driver/SanitizerArgs.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ class SanitizerArgs {
8787
bool needsHwasanAliasesRt() const {
8888
return needsHwasanRt() && HwasanUseAliases;
8989
}
90+
bool needsTysanRt() const { return Sanitizers.has(SanitizerKind::Type); }
9091
bool needsTsanRt() const { return Sanitizers.has(SanitizerKind::Thread); }
9192
bool needsMsanRt() const { return Sanitizers.has(SanitizerKind::Memory); }
9293
bool needsFuzzer() const { return Sanitizers.has(SanitizerKind::Fuzzer); }

‎clang/lib/CodeGen/BackendUtil.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@
7777
#include "llvm/Transforms/Instrumentation/SanitizerBinaryMetadata.h"
7878
#include "llvm/Transforms/Instrumentation/SanitizerCoverage.h"
7979
#include "llvm/Transforms/Instrumentation/ThreadSanitizer.h"
80+
#include "llvm/Transforms/Instrumentation/TypeSanitizer.h"
8081
#include "llvm/Transforms/ObjCARC.h"
8182
#include "llvm/Transforms/Scalar/EarlyCSE.h"
8283
#include "llvm/Transforms/Scalar/GVN.h"
@@ -735,6 +736,11 @@ static void addSanitizers(const Triple &TargetTriple,
735736
MPM.addPass(createModuleToFunctionPassAdaptor(ThreadSanitizerPass()));
736737
}
737738

739+
if (LangOpts.Sanitize.has(SanitizerKind::Type)) {
740+
MPM.addPass(ModuleTypeSanitizerPass());
741+
MPM.addPass(createModuleToFunctionPassAdaptor(TypeSanitizerPass()));
742+
}
743+
738744
if (LangOpts.Sanitize.has(SanitizerKind::NumericalStability))
739745
MPM.addPass(NumericalStabilitySanitizerPass());
740746

‎clang/lib/CodeGen/CGDecl.cpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -458,7 +458,8 @@ void CodeGenFunction::EmitStaticVarDecl(const VarDecl &D,
458458
LocalDeclMap.find(&D)->second = Address(castedAddr, elemTy, alignment);
459459
CGM.setStaticLocalDeclAddress(&D, castedAddr);
460460

461-
CGM.getSanitizerMetadata()->reportGlobal(var, D);
461+
CGM.getSanitizerMetadata()->reportGlobalToASan(var, D);
462+
CGM.getSanitizerMetadata()->reportGlobalToTySan(var, D);
462463

463464
// Emit global variable debug descriptor for static vars.
464465
CGDebugInfo *DI = getDebugInfo();

‎clang/lib/CodeGen/CGDeclCXX.cpp‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -479,6 +479,10 @@ llvm::Function *CodeGenModule::CreateGlobalInitOrCleanUpFunction(
479479
!isInNoSanitizeList(SanitizerKind::MemtagStack, Fn, Loc))
480480
Fn->addFnAttr(llvm::Attribute::SanitizeMemTag);
481481

482+
if (getLangOpts().Sanitize.has(SanitizerKind::Type) &&
483+
!isInNoSanitizeList(SanitizerKind::Type, Fn, Loc))
484+
Fn->addFnAttr(llvm::Attribute::SanitizeType);
485+
482486
if (getLangOpts().Sanitize.has(SanitizerKind::Thread) &&
483487
!isInNoSanitizeList(SanitizerKind::Thread, Fn, Loc))
484488
Fn->addFnAttr(llvm::Attribute::SanitizeThread);

‎clang/lib/CodeGen/CodeGenFunction.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -837,6 +837,8 @@ void CodeGenFunction::StartFunction(GlobalDecl GD, QualType RetTy,
837837
Fn->addFnAttr(llvm::Attribute::SanitizeMemTag);
838838
if (SanOpts.has(SanitizerKind::Thread))
839839
Fn->addFnAttr(llvm::Attribute::SanitizeThread);
840+
if (SanOpts.has(SanitizerKind::Type))
841+
Fn->addFnAttr(llvm::Attribute::SanitizeType);
840842
if (SanOpts.has(SanitizerKind::NumericalStability))
841843
Fn->addFnAttr(llvm::Attribute::SanitizeNumericalStability);
842844
if (SanOpts.hasOneOf(SanitizerKind::Memory | SanitizerKind::KernelMemory))

‎clang/lib/CodeGen/CodeGenModule.cpp‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -397,8 +397,8 @@ CodeGenModule::CodeGenModule(ASTContext &C,
397397
if (LangOpts.HLSL)
398398
createHLSLRuntime();
399399

400-
// Enable TBAA unless it's suppressed. ThreadSanitizer needs TBAA even at O0.
401-
if (LangOpts.Sanitize.has(SanitizerKind::Thread) ||
400+
// Enable TBAA unless it's suppressed. TSan and TySan need TBAA even at O0.
401+
if (LangOpts.Sanitize.hasOneOf(SanitizerKind::Thread | SanitizerKind::Type) ||
402402
(!CodeGenOpts.RelaxedAliasing && CodeGenOpts.OptimizationLevel > 0))
403403
TBAA.reset(new CodeGenTBAA(Context, getTypes(), TheModule, CodeGenOpts,
404404
getLangOpts()));
@@ -5174,7 +5174,7 @@ CodeGenModule::GetOrCreateLLVMGlobal(StringRef MangledName, llvm::Type *Ty,
51745174
}
51755175

51765176
if (D)
5177-
SanitizerMD->reportGlobal(GV, *D);
5177+
SanitizerMD->reportGlobalToASan(GV, *D);
51785178

51795179
LangAS ExpectedAS =
51805180
D ? D->getType().getAddressSpace()
@@ -5740,7 +5740,8 @@ void CodeGenModule::EmitGlobalVarDefinition(const VarDecl *D,
57405740
if (NeedsGlobalCtor || NeedsGlobalDtor)
57415741
EmitCXXGlobalVarDeclInitFunc(D, GV, NeedsGlobalCtor);
57425742

5743-
SanitizerMD->reportGlobal(GV, *D, NeedsGlobalCtor);
5743+
SanitizerMD->reportGlobalToASan(GV, *D, NeedsGlobalCtor);
5744+
SanitizerMD->reportGlobalToTySan(GV, *D);
57445745

57455746
// Emit global variable debug information.
57465747
if (CGDebugInfo *DI = getModuleDebugInfo())
@@ -6630,7 +6631,8 @@ CodeGenModule::GetAddrOfConstantStringFromLiteral(const StringLiteral *S,
66306631
if (Entry)
66316632
*Entry = GV;
66326633

6633-
SanitizerMD->reportGlobal(GV, S->getStrTokenLoc(0), "<string literal>");
6634+
SanitizerMD->reportGlobalToASan(GV, S->getStrTokenLoc(0), "<string literal>");
6635+
// FIXME: Should we also report to the TySan?
66346636

66356637
return ConstantAddress(castStringLiteralToDefaultAddressSpace(*this, GV),
66366638
GV->getValueType(), Alignment);

‎clang/lib/CodeGen/CodeGenTBAA.cpp‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -314,8 +314,10 @@ llvm::MDNode *CodeGenTBAA::getTypeInfoHelper(const Type *Ty) {
314314
}
315315

316316
llvm::MDNode *CodeGenTBAA::getTypeInfo(QualType QTy) {
317-
// At -O0 or relaxed aliasing, TBAA is not emitted for regular types.
318-
if (CodeGenOpts.OptimizationLevel == 0 || CodeGenOpts.RelaxedAliasing)
317+
// At -O0 or relaxed aliasing, TBAA is not emitted for regular types (unless
318+
// we're running TypeSanitizer).
319+
if (!Features.Sanitize.has(SanitizerKind::Type) &&
320+
(CodeGenOpts.OptimizationLevel == 0 || CodeGenOpts.RelaxedAliasing))
319321
return nullptr;
320322

321323
// If the type has the may_alias attribute (even on a typedef), it is

‎clang/lib/CodeGen/SanitizerMetadata.cpp‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@ static SanitizerMask expandKernelSanitizerMasks(SanitizerMask Mask) {
3131
return Mask;
3232
}
3333

34-
void SanitizerMetadata::reportGlobal(llvm::GlobalVariable *GV,
35-
SourceLocation Loc, StringRef Name,
36-
QualType Ty,
37-
SanitizerMask NoSanitizeAttrMask,
38-
bool IsDynInit) {
34+
void SanitizerMetadata::reportGlobalToASan(llvm::GlobalVariable *GV,
35+
SourceLocation Loc, StringRef Name,
36+
QualType Ty,
37+
SanitizerMask NoSanitizeAttrMask,
38+
bool IsDynInit) {
3939
SanitizerSet FsanitizeArgument = CGM.getLangOpts().Sanitize;
4040
if (!isAsanHwasanOrMemTag(FsanitizeArgument))
4141
return;
@@ -72,8 +72,8 @@ void SanitizerMetadata::reportGlobal(llvm::GlobalVariable *GV,
7272
GV->setSanitizerMetadata(Meta);
7373
}
7474

75-
void SanitizerMetadata::reportGlobal(llvm::GlobalVariable *GV, const VarDecl &D,
76-
bool IsDynInit) {
75+
void SanitizerMetadata::reportGlobalToASan(llvm::GlobalVariable *GV,
76+
const VarDecl &D, bool IsDynInit) {
7777
if (!isAsanHwasanOrMemTag(CGM.getLangOpts().Sanitize))
7878
return;
7979
std::string QualName;
@@ -95,6 +95,30 @@ void SanitizerMetadata::reportGlobal(llvm::GlobalVariable *GV, const VarDecl &D,
9595
IsDynInit);
9696
}
9797

98+
void SanitizerMetadata::reportGlobalToTySan(llvm::GlobalVariable *GV,
99+
const VarDecl &D) {
100+
if (!CGM.getLangOpts().Sanitize.has(SanitizerKind::Type))
101+
return;
102+
103+
for (auto Attr : D.specific_attrs<NoSanitizeAttr>())
104+
if (Attr->getMask() & SanitizerKind::Type)
105+
return;
106+
107+
QualType QTy = D.getType();
108+
llvm::MDNode *TBAAInfo = CGM.getTBAATypeInfo(QTy);
109+
if (!TBAAInfo || TBAAInfo == CGM.getTBAATypeInfo(CGM.getContext().CharTy))
110+
return;
111+
112+
llvm::Metadata *GlobalMetadata[] = {llvm::ConstantAsMetadata::get(GV),
113+
TBAAInfo};
114+
115+
llvm::MDNode *ThisGlobal =
116+
llvm::MDNode::get(CGM.getLLVMContext(), GlobalMetadata);
117+
llvm::NamedMDNode *TysanGlobals =
118+
CGM.getModule().getOrInsertNamedMetadata("llvm.tysan.globals");
119+
TysanGlobals->addOperand(ThisGlobal);
120+
}
121+
98122
void SanitizerMetadata::disableSanitizerForGlobal(llvm::GlobalVariable *GV) {
99-
reportGlobal(GV, SourceLocation(), "", QualType(), SanitizerKind::All);
123+
reportGlobalToASan(GV, SourceLocation(), "", QualType(), SanitizerKind::All);
100124
}

0 commit comments

Comments
 (0)