Imported Upstream version 6.10.0.49

Former-commit-id: 1d6753294b2993e1fbf92de9366bb9544db4189b
This commit is contained in:
Xamarin Public Jenkins (auto-signing)
2020-01-16 16:38:04 +00:00
parent d94e79959b
commit 468663ddbb
48518 changed files with 2789335 additions and 61176 deletions

View File

@@ -0,0 +1 @@
BasedOnStyle: Google

View File

@@ -0,0 +1,47 @@
include_directories(..)
# Runtime library sources and build flags.
set(DFSAN_RTL_SOURCES
dfsan.cc
dfsan_custom.cc
dfsan_interceptors.cc)
set(DFSAN_COMMON_CFLAGS ${SANITIZER_COMMON_CFLAGS})
append_rtti_flag(OFF DFSAN_COMMON_CFLAGS)
# Prevent clang from generating libc calls.
append_list_if(COMPILER_RT_HAS_FFREESTANDING_FLAG -ffreestanding DFSAN_COMMON_CFLAGS)
# Static runtime library.
add_compiler_rt_component(dfsan)
foreach(arch ${DFSAN_SUPPORTED_ARCH})
set(DFSAN_CFLAGS ${DFSAN_COMMON_CFLAGS})
append_list_if(COMPILER_RT_HAS_FPIE_FLAG -fPIE DFSAN_CFLAGS)
add_compiler_rt_runtime(clang_rt.dfsan
STATIC
ARCHS ${arch}
SOURCES ${DFSAN_RTL_SOURCES}
$<TARGET_OBJECTS:RTInterception.${arch}>
$<TARGET_OBJECTS:RTSanitizerCommon.${arch}>
$<TARGET_OBJECTS:RTSanitizerCommonLibc.${arch}>
CFLAGS ${DFSAN_CFLAGS}
PARENT_TARGET dfsan)
add_sanitizer_rt_symbols(clang_rt.dfsan
ARCHS ${arch}
EXTRA dfsan.syms.extra)
add_dependencies(dfsan
clang_rt.dfsan-${arch}-symbols)
endforeach()
set(dfsan_abilist_filename ${COMPILER_RT_OUTPUT_DIR}/dfsan_abilist.txt)
add_custom_target(dfsan_abilist ALL
DEPENDS ${dfsan_abilist_filename})
add_custom_command(OUTPUT ${dfsan_abilist_filename}
VERBATIM
COMMAND
cat ${CMAKE_CURRENT_SOURCE_DIR}/done_abilist.txt
${CMAKE_CURRENT_SOURCE_DIR}/libc_ubuntu1404_abilist.txt
> ${dfsan_abilist_filename}
DEPENDS done_abilist.txt libc_ubuntu1404_abilist.txt)
add_dependencies(dfsan dfsan_abilist)
install(FILES ${dfsan_abilist_filename}
DESTINATION ${COMPILER_RT_INSTALL_PATH})

View File

@@ -0,0 +1,452 @@
//===-- dfsan.cc ----------------------------------------------------------===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// This file is a part of DataFlowSanitizer.
//
// DataFlowSanitizer runtime. This file defines the public interface to
// DataFlowSanitizer as well as the definition of certain runtime functions
// called automatically by the compiler (specifically the instrumentation pass
// in llvm/lib/Transforms/Instrumentation/DataFlowSanitizer.cpp).
//
// The public interface is defined in include/sanitizer/dfsan_interface.h whose
// functions are prefixed dfsan_ while the compiler interface functions are
// prefixed __dfsan_.
//===----------------------------------------------------------------------===//
#include "sanitizer_common/sanitizer_atomic.h"
#include "sanitizer_common/sanitizer_common.h"
#include "sanitizer_common/sanitizer_file.h"
#include "sanitizer_common/sanitizer_flags.h"
#include "sanitizer_common/sanitizer_flag_parser.h"
#include "sanitizer_common/sanitizer_libc.h"
#include "dfsan/dfsan.h"
using namespace __dfsan;
typedef atomic_uint16_t atomic_dfsan_label;
static const dfsan_label kInitializingLabel = -1;
static const uptr kNumLabels = 1 << (sizeof(dfsan_label) * 8);
static atomic_dfsan_label __dfsan_last_label;
static dfsan_label_info __dfsan_label_info[kNumLabels];
Flags __dfsan::flags_data;
SANITIZER_INTERFACE_ATTRIBUTE THREADLOCAL dfsan_label __dfsan_retval_tls;
SANITIZER_INTERFACE_ATTRIBUTE THREADLOCAL dfsan_label __dfsan_arg_tls[64];
SANITIZER_INTERFACE_ATTRIBUTE uptr __dfsan_shadow_ptr_mask;
// On Linux/x86_64, memory is laid out as follows:
//
// +--------------------+ 0x800000000000 (top of memory)
// | application memory |
// +--------------------+ 0x700000008000 (kAppAddr)
// | |
// | unused |
// | |
// +--------------------+ 0x200200000000 (kUnusedAddr)
// | union table |
// +--------------------+ 0x200000000000 (kUnionTableAddr)
// | shadow memory |
// +--------------------+ 0x000000010000 (kShadowAddr)
// | reserved by kernel |
// +--------------------+ 0x000000000000
//
// To derive a shadow memory address from an application memory address,
// bits 44-46 are cleared to bring the address into the range
// [0x000000008000,0x100000000000). Then the address is shifted left by 1 to
// account for the double byte representation of shadow labels and move the
// address into the shadow memory range. See the function shadow_for below.
// On Linux/MIPS64, memory is laid out as follows:
//
// +--------------------+ 0x10000000000 (top of memory)
// | application memory |
// +--------------------+ 0xF000008000 (kAppAddr)
// | |
// | unused |
// | |
// +--------------------+ 0x2200000000 (kUnusedAddr)
// | union table |
// +--------------------+ 0x2000000000 (kUnionTableAddr)
// | shadow memory |
// +--------------------+ 0x0000010000 (kShadowAddr)
// | reserved by kernel |
// +--------------------+ 0x0000000000
// On Linux/AArch64 (39-bit VMA), memory is laid out as follow:
//
// +--------------------+ 0x8000000000 (top of memory)
// | application memory |
// +--------------------+ 0x7000008000 (kAppAddr)
// | |
// | unused |
// | |
// +--------------------+ 0x1200000000 (kUnusedAddr)
// | union table |
// +--------------------+ 0x1000000000 (kUnionTableAddr)
// | shadow memory |
// +--------------------+ 0x0000010000 (kShadowAddr)
// | reserved by kernel |
// +--------------------+ 0x0000000000
// On Linux/AArch64 (42-bit VMA), memory is laid out as follow:
//
// +--------------------+ 0x40000000000 (top of memory)
// | application memory |
// +--------------------+ 0x3ff00008000 (kAppAddr)
// | |
// | unused |
// | |
// +--------------------+ 0x1200000000 (kUnusedAddr)
// | union table |
// +--------------------+ 0x8000000000 (kUnionTableAddr)
// | shadow memory |
// +--------------------+ 0x0000010000 (kShadowAddr)
// | reserved by kernel |
// +--------------------+ 0x0000000000
// On Linux/AArch64 (48-bit VMA), memory is laid out as follow:
//
// +--------------------+ 0x1000000000000 (top of memory)
// | application memory |
// +--------------------+ 0xffff00008000 (kAppAddr)
// | unused |
// +--------------------+ 0xaaaab0000000 (top of PIE address)
// | application PIE |
// +--------------------+ 0xaaaaa0000000 (top of PIE address)
// | |
// | unused |
// | |
// +--------------------+ 0x1200000000 (kUnusedAddr)
// | union table |
// +--------------------+ 0x8000000000 (kUnionTableAddr)
// | shadow memory |
// +--------------------+ 0x0000010000 (kShadowAddr)
// | reserved by kernel |
// +--------------------+ 0x0000000000
typedef atomic_dfsan_label dfsan_union_table_t[kNumLabels][kNumLabels];
#ifdef DFSAN_RUNTIME_VMA
// Runtime detected VMA size.
int __dfsan::vmaSize;
#endif
static uptr UnusedAddr() {
return MappingArchImpl<MAPPING_UNION_TABLE_ADDR>()
+ sizeof(dfsan_union_table_t);
}
static atomic_dfsan_label *union_table(dfsan_label l1, dfsan_label l2) {
return &(*(dfsan_union_table_t *) UnionTableAddr())[l1][l2];
}
// Checks we do not run out of labels.
static void dfsan_check_label(dfsan_label label) {
if (label == kInitializingLabel) {
Report("FATAL: DataFlowSanitizer: out of labels\n");
Die();
}
}
// Resolves the union of two unequal labels. Nonequality is a precondition for
// this function (the instrumentation pass inlines the equality test).
extern "C" SANITIZER_INTERFACE_ATTRIBUTE
dfsan_label __dfsan_union(dfsan_label l1, dfsan_label l2) {
DCHECK_NE(l1, l2);
if (l1 == 0)
return l2;
if (l2 == 0)
return l1;
if (l1 > l2)
Swap(l1, l2);
atomic_dfsan_label *table_ent = union_table(l1, l2);
// We need to deal with the case where two threads concurrently request
// a union of the same pair of labels. If the table entry is uninitialized,
// (i.e. 0) use a compare-exchange to set the entry to kInitializingLabel
// (i.e. -1) to mark that we are initializing it.
dfsan_label label = 0;
if (atomic_compare_exchange_strong(table_ent, &label, kInitializingLabel,
memory_order_acquire)) {
// Check whether l2 subsumes l1. We don't need to check whether l1
// subsumes l2 because we are guaranteed here that l1 < l2, and (at least
// in the cases we are interested in) a label may only subsume labels
// created earlier (i.e. with a lower numerical value).
if (__dfsan_label_info[l2].l1 == l1 ||
__dfsan_label_info[l2].l2 == l1) {
label = l2;
} else {
label =
atomic_fetch_add(&__dfsan_last_label, 1, memory_order_relaxed) + 1;
dfsan_check_label(label);
__dfsan_label_info[label].l1 = l1;
__dfsan_label_info[label].l2 = l2;
}
atomic_store(table_ent, label, memory_order_release);
} else if (label == kInitializingLabel) {
// Another thread is initializing the entry. Wait until it is finished.
do {
internal_sched_yield();
label = atomic_load(table_ent, memory_order_acquire);
} while (label == kInitializingLabel);
}
return label;
}
extern "C" SANITIZER_INTERFACE_ATTRIBUTE
dfsan_label __dfsan_union_load(const dfsan_label *ls, uptr n) {
dfsan_label label = ls[0];
for (uptr i = 1; i != n; ++i) {
dfsan_label next_label = ls[i];
if (label != next_label)
label = __dfsan_union(label, next_label);
}
return label;
}
extern "C" SANITIZER_INTERFACE_ATTRIBUTE
void __dfsan_unimplemented(char *fname) {
if (flags().warn_unimplemented)
Report("WARNING: DataFlowSanitizer: call to uninstrumented function %s\n",
fname);
}
// Use '-mllvm -dfsan-debug-nonzero-labels' and break on this function
// to try to figure out where labels are being introduced in a nominally
// label-free program.
extern "C" SANITIZER_INTERFACE_ATTRIBUTE void __dfsan_nonzero_label() {
if (flags().warn_nonzero_labels)
Report("WARNING: DataFlowSanitizer: saw nonzero label\n");
}
// Indirect call to an uninstrumented vararg function. We don't have a way of
// handling these at the moment.
extern "C" SANITIZER_INTERFACE_ATTRIBUTE void
__dfsan_vararg_wrapper(const char *fname) {
Report("FATAL: DataFlowSanitizer: unsupported indirect call to vararg "
"function %s\n", fname);
Die();
}
// Like __dfsan_union, but for use from the client or custom functions. Hence
// the equality comparison is done here before calling __dfsan_union.
SANITIZER_INTERFACE_ATTRIBUTE dfsan_label
dfsan_union(dfsan_label l1, dfsan_label l2) {
if (l1 == l2)
return l1;
return __dfsan_union(l1, l2);
}
extern "C" SANITIZER_INTERFACE_ATTRIBUTE
dfsan_label dfsan_create_label(const char *desc, void *userdata) {
dfsan_label label =
atomic_fetch_add(&__dfsan_last_label, 1, memory_order_relaxed) + 1;
dfsan_check_label(label);
__dfsan_label_info[label].l1 = __dfsan_label_info[label].l2 = 0;
__dfsan_label_info[label].desc = desc;
__dfsan_label_info[label].userdata = userdata;
return label;
}
extern "C" SANITIZER_INTERFACE_ATTRIBUTE
void __dfsan_set_label(dfsan_label label, void *addr, uptr size) {
for (dfsan_label *labelp = shadow_for(addr); size != 0; --size, ++labelp) {
// Don't write the label if it is already the value we need it to be.
// In a program where most addresses are not labeled, it is common that
// a page of shadow memory is entirely zeroed. The Linux copy-on-write
// implementation will share all of the zeroed pages, making a copy of a
// page when any value is written. The un-sharing will happen even if
// the value written does not change the value in memory. Avoiding the
// write when both |label| and |*labelp| are zero dramatically reduces
// the amount of real memory used by large programs.
if (label == *labelp)
continue;
*labelp = label;
}
}
SANITIZER_INTERFACE_ATTRIBUTE
void dfsan_set_label(dfsan_label label, void *addr, uptr size) {
__dfsan_set_label(label, addr, size);
}
SANITIZER_INTERFACE_ATTRIBUTE
void dfsan_add_label(dfsan_label label, void *addr, uptr size) {
for (dfsan_label *labelp = shadow_for(addr); size != 0; --size, ++labelp)
if (*labelp != label)
*labelp = __dfsan_union(*labelp, label);
}
// Unlike the other dfsan interface functions the behavior of this function
// depends on the label of one of its arguments. Hence it is implemented as a
// custom function.
extern "C" SANITIZER_INTERFACE_ATTRIBUTE dfsan_label
__dfsw_dfsan_get_label(long data, dfsan_label data_label,
dfsan_label *ret_label) {
*ret_label = 0;
return data_label;
}
SANITIZER_INTERFACE_ATTRIBUTE dfsan_label
dfsan_read_label(const void *addr, uptr size) {
if (size == 0)
return 0;
return __dfsan_union_load(shadow_for(addr), size);
}
extern "C" SANITIZER_INTERFACE_ATTRIBUTE
const struct dfsan_label_info *dfsan_get_label_info(dfsan_label label) {
return &__dfsan_label_info[label];
}
extern "C" SANITIZER_INTERFACE_ATTRIBUTE int
dfsan_has_label(dfsan_label label, dfsan_label elem) {
if (label == elem)
return true;
const dfsan_label_info *info = dfsan_get_label_info(label);
if (info->l1 != 0) {
return dfsan_has_label(info->l1, elem) || dfsan_has_label(info->l2, elem);
} else {
return false;
}
}
extern "C" SANITIZER_INTERFACE_ATTRIBUTE dfsan_label
dfsan_has_label_with_desc(dfsan_label label, const char *desc) {
const dfsan_label_info *info = dfsan_get_label_info(label);
if (info->l1 != 0) {
return dfsan_has_label_with_desc(info->l1, desc) ||
dfsan_has_label_with_desc(info->l2, desc);
} else {
return internal_strcmp(desc, info->desc) == 0;
}
}
extern "C" SANITIZER_INTERFACE_ATTRIBUTE uptr
dfsan_get_label_count(void) {
dfsan_label max_label_allocated =
atomic_load(&__dfsan_last_label, memory_order_relaxed);
return static_cast<uptr>(max_label_allocated);
}
extern "C" SANITIZER_INTERFACE_ATTRIBUTE void
dfsan_dump_labels(int fd) {
dfsan_label last_label =
atomic_load(&__dfsan_last_label, memory_order_relaxed);
for (uptr l = 1; l <= last_label; ++l) {
char buf[64];
internal_snprintf(buf, sizeof(buf), "%u %u %u ", l,
__dfsan_label_info[l].l1, __dfsan_label_info[l].l2);
WriteToFile(fd, buf, internal_strlen(buf));
if (__dfsan_label_info[l].l1 == 0 && __dfsan_label_info[l].desc) {
WriteToFile(fd, __dfsan_label_info[l].desc,
internal_strlen(__dfsan_label_info[l].desc));
}
WriteToFile(fd, "\n", 1);
}
}
void Flags::SetDefaults() {
#define DFSAN_FLAG(Type, Name, DefaultValue, Description) Name = DefaultValue;
#include "dfsan_flags.inc"
#undef DFSAN_FLAG
}
static void RegisterDfsanFlags(FlagParser *parser, Flags *f) {
#define DFSAN_FLAG(Type, Name, DefaultValue, Description) \
RegisterFlag(parser, #Name, Description, &f->Name);
#include "dfsan_flags.inc"
#undef DFSAN_FLAG
}
static void InitializeFlags() {
SetCommonFlagsDefaults();
flags().SetDefaults();
FlagParser parser;
RegisterCommonFlags(&parser);
RegisterDfsanFlags(&parser, &flags());
parser.ParseString(GetEnv("DFSAN_OPTIONS"));
InitializeCommonFlags();
if (Verbosity()) ReportUnrecognizedFlags();
if (common_flags()->help) parser.PrintFlagDescriptions();
}
static void InitializePlatformEarly() {
AvoidCVE_2016_2143();
#ifdef DFSAN_RUNTIME_VMA
__dfsan::vmaSize =
(MostSignificantSetBitIndex(GET_CURRENT_FRAME()) + 1);
if (__dfsan::vmaSize == 39 || __dfsan::vmaSize == 42 ||
__dfsan::vmaSize == 48) {
__dfsan_shadow_ptr_mask = ShadowMask();
} else {
Printf("FATAL: DataFlowSanitizer: unsupported VMA range\n");
Printf("FATAL: Found %d - Supported 39, 42, and 48\n", __dfsan::vmaSize);
Die();
}
#endif
}
static void dfsan_fini() {
if (internal_strcmp(flags().dump_labels_at_exit, "") != 0) {
fd_t fd = OpenFile(flags().dump_labels_at_exit, WrOnly);
if (fd == kInvalidFd) {
Report("WARNING: DataFlowSanitizer: unable to open output file %s\n",
flags().dump_labels_at_exit);
return;
}
Report("INFO: DataFlowSanitizer: dumping labels to %s\n",
flags().dump_labels_at_exit);
dfsan_dump_labels(fd);
CloseFile(fd);
}
}
static void dfsan_init(int argc, char **argv, char **envp) {
InitializeFlags();
InitializePlatformEarly();
MmapFixedNoReserve(ShadowAddr(), UnusedAddr() - ShadowAddr());
// Protect the region of memory we don't use, to preserve the one-to-one
// mapping from application to shadow memory. But if ASLR is disabled, Linux
// will load our executable in the middle of our unused region. This mostly
// works so long as the program doesn't use too much memory. We support this
// case by disabling memory protection when ASLR is disabled.
uptr init_addr = (uptr)&dfsan_init;
if (!(init_addr >= UnusedAddr() && init_addr < AppAddr()))
MmapFixedNoAccess(UnusedAddr(), AppAddr() - UnusedAddr());
InitializeInterceptors();
// Register the fini callback to run when the program terminates successfully
// or it is killed by the runtime.
Atexit(dfsan_fini);
AddDieCallback(dfsan_fini);
__dfsan_label_info[kInitializingLabel].desc = "<init label>";
}
#if SANITIZER_CAN_USE_PREINIT_ARRAY
__attribute__((section(".preinit_array"), used))
static void (*dfsan_init_ptr)(int, char **, char **) = dfsan_init;
#endif

View File

@@ -0,0 +1,73 @@
//===-- dfsan.h -------------------------------------------------*- C++ -*-===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// This file is a part of DataFlowSanitizer.
//
// Private DFSan header.
//===----------------------------------------------------------------------===//
#ifndef DFSAN_H
#define DFSAN_H
#include "sanitizer_common/sanitizer_internal_defs.h"
#include "dfsan_platform.h"
using __sanitizer::uptr;
using __sanitizer::u16;
// Copy declarations from public sanitizer/dfsan_interface.h header here.
typedef u16 dfsan_label;
struct dfsan_label_info {
dfsan_label l1;
dfsan_label l2;
const char *desc;
void *userdata;
};
extern "C" {
void dfsan_add_label(dfsan_label label, void *addr, uptr size);
void dfsan_set_label(dfsan_label label, void *addr, uptr size);
dfsan_label dfsan_read_label(const void *addr, uptr size);
dfsan_label dfsan_union(dfsan_label l1, dfsan_label l2);
} // extern "C"
template <typename T>
void dfsan_set_label(dfsan_label label, T &data) { // NOLINT
dfsan_set_label(label, (void *)&data, sizeof(T));
}
namespace __dfsan {
void InitializeInterceptors();
inline dfsan_label *shadow_for(void *ptr) {
return (dfsan_label *) ((((uptr) ptr) & ShadowMask()) << 1);
}
inline const dfsan_label *shadow_for(const void *ptr) {
return shadow_for(const_cast<void *>(ptr));
}
struct Flags {
#define DFSAN_FLAG(Type, Name, DefaultValue, Description) Type Name;
#include "dfsan_flags.inc"
#undef DFSAN_FLAG
void SetDefaults();
};
extern Flags flags_data;
inline Flags &flags() {
return flags_data;
}
} // namespace __dfsan
#endif // DFSAN_H

View File

@@ -0,0 +1,3 @@
dfsan_*
__dfsan_*
__dfsw_*

File diff suppressed because it is too large Load Diff

View File

@@ -0,0 +1,32 @@
//===-- dfsan_flags.inc -----------------------------------------*- C++ -*-===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// DFSan runtime flags.
//
//===----------------------------------------------------------------------===//
#ifndef DFSAN_FLAG
# error "Define DFSAN_FLAG prior to including this file!"
#endif
// DFSAN_FLAG(Type, Name, DefaultValue, Description)
// See COMMON_FLAG in sanitizer_flags.inc for more details.
DFSAN_FLAG(bool, warn_unimplemented, true,
"Whether to warn on unimplemented functions.")
DFSAN_FLAG(bool, warn_nonzero_labels, false,
"Whether to warn on unimplemented functions.")
DFSAN_FLAG(
bool, strict_data_dependencies, true,
"Whether to propagate labels only when there is an obvious data dependency"
"(e.g., when comparing strings, ignore the fact that the output of the"
"comparison might be data-dependent on the content of the strings). This"
"applies only to the custom functions defined in 'custom.c'.")
DFSAN_FLAG(const char *, dump_labels_at_exit, "", "The path of the file where "
"to dump the labels when the "
"program terminates.")

View File

@@ -0,0 +1,46 @@
//===-- dfsan_interceptors.cc ---------------------------------------------===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// This file is a part of DataFlowSanitizer.
//
// Interceptors for standard library functions.
//===----------------------------------------------------------------------===//
#include "dfsan/dfsan.h"
#include "interception/interception.h"
#include "sanitizer_common/sanitizer_common.h"
using namespace __sanitizer;
INTERCEPTOR(void *, mmap, void *addr, SIZE_T length, int prot, int flags,
int fd, OFF_T offset) {
void *res = REAL(mmap)(addr, length, prot, flags, fd, offset);
if (res != (void*)-1)
dfsan_set_label(0, res, RoundUpTo(length, GetPageSize()));
return res;
}
INTERCEPTOR(void *, mmap64, void *addr, SIZE_T length, int prot, int flags,
int fd, OFF64_T offset) {
void *res = REAL(mmap64)(addr, length, prot, flags, fd, offset);
if (res != (void*)-1)
dfsan_set_label(0, res, RoundUpTo(length, GetPageSize()));
return res;
}
namespace __dfsan {
void InitializeInterceptors() {
static int inited = 0;
CHECK_EQ(inited, 0);
INTERCEPT_FUNCTION(mmap);
INTERCEPT_FUNCTION(mmap64);
inited = 1;
}
} // namespace __dfsan

View File

@@ -0,0 +1,116 @@
//===-- dfsan_platform.h ----------------------------------------*- C++ -*-===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// This file is a part of DataFlowSanitizer.
//
// Platform specific information for DFSan.
//===----------------------------------------------------------------------===//
#ifndef DFSAN_PLATFORM_H
#define DFSAN_PLATFORM_H
namespace __dfsan {
#if defined(__x86_64__)
struct Mapping {
static const uptr kShadowAddr = 0x10000;
static const uptr kUnionTableAddr = 0x200000000000;
static const uptr kAppAddr = 0x700000008000;
static const uptr kShadowMask = ~0x700000000000;
};
#elif defined(__mips64)
struct Mapping {
static const uptr kShadowAddr = 0x10000;
static const uptr kUnionTableAddr = 0x2000000000;
static const uptr kAppAddr = 0xF000008000;
static const uptr kShadowMask = ~0xF000000000;
};
#elif defined(__aarch64__)
struct Mapping39 {
static const uptr kShadowAddr = 0x10000;
static const uptr kUnionTableAddr = 0x1000000000;
static const uptr kAppAddr = 0x7000008000;
static const uptr kShadowMask = ~0x7800000000;
};
struct Mapping42 {
static const uptr kShadowAddr = 0x10000;
static const uptr kUnionTableAddr = 0x8000000000;
static const uptr kAppAddr = 0x3ff00008000;
static const uptr kShadowMask = ~0x3c000000000;
};
struct Mapping48 {
static const uptr kShadowAddr = 0x10000;
static const uptr kUnionTableAddr = 0x8000000000;
static const uptr kAppAddr = 0xffff00008000;
static const uptr kShadowMask = ~0xfffff0000000;
};
extern int vmaSize;
# define DFSAN_RUNTIME_VMA 1
#else
# error "DFSan not supported for this platform!"
#endif
enum MappingType {
MAPPING_SHADOW_ADDR,
MAPPING_UNION_TABLE_ADDR,
MAPPING_APP_ADDR,
MAPPING_SHADOW_MASK
};
template<typename Mapping, int Type>
uptr MappingImpl(void) {
switch (Type) {
case MAPPING_SHADOW_ADDR: return Mapping::kShadowAddr;
case MAPPING_UNION_TABLE_ADDR: return Mapping::kUnionTableAddr;
case MAPPING_APP_ADDR: return Mapping::kAppAddr;
case MAPPING_SHADOW_MASK: return Mapping::kShadowMask;
}
}
template<int Type>
uptr MappingArchImpl(void) {
#ifdef __aarch64__
switch (vmaSize) {
case 39: return MappingImpl<Mapping39, Type>();
case 42: return MappingImpl<Mapping42, Type>();
case 48: return MappingImpl<Mapping48, Type>();
}
DCHECK(0);
return 0;
#else
return MappingImpl<Mapping, Type>();
#endif
}
ALWAYS_INLINE
uptr ShadowAddr() {
return MappingArchImpl<MAPPING_SHADOW_ADDR>();
}
ALWAYS_INLINE
uptr UnionTableAddr() {
return MappingArchImpl<MAPPING_UNION_TABLE_ADDR>();
}
ALWAYS_INLINE
uptr AppAddr() {
return MappingArchImpl<MAPPING_APP_ADDR>();
}
ALWAYS_INLINE
uptr ShadowMask() {
return MappingArchImpl<MAPPING_SHADOW_MASK>();
}
} // namespace __dfsan
#endif

View File

@@ -0,0 +1,298 @@
fun:main=uninstrumented
fun:main=discard
###############################################################################
# DFSan interface functions
###############################################################################
fun:dfsan_union=uninstrumented
fun:dfsan_union=discard
fun:dfsan_create_label=uninstrumented
fun:dfsan_create_label=discard
fun:dfsan_set_label=uninstrumented
fun:dfsan_set_label=discard
fun:dfsan_add_label=uninstrumented
fun:dfsan_add_label=discard
fun:dfsan_get_label=uninstrumented
fun:dfsan_get_label=custom
fun:dfsan_read_label=uninstrumented
fun:dfsan_read_label=discard
fun:dfsan_get_label_count=uninstrumented
fun:dfsan_get_label_count=discard
fun:dfsan_get_label_info=uninstrumented
fun:dfsan_get_label_info=discard
fun:dfsan_has_label=uninstrumented
fun:dfsan_has_label=discard
fun:dfsan_has_label_with_desc=uninstrumented
fun:dfsan_has_label_with_desc=discard
fun:dfsan_set_write_callback=uninstrumented
fun:dfsan_set_write_callback=custom
###############################################################################
# glibc
###############################################################################
fun:malloc=discard
fun:realloc=discard
fun:free=discard
# Functions that return a value that depends on the input, but the output might
# not be necessarily data-dependent on the input.
fun:isalpha=functional
fun:isdigit=functional
fun:isprint=functional
fun:isxdigit=functional
fun:isalnum=functional
fun:ispunct=functional
fun:isspace=functional
fun:tolower=functional
fun:toupper=functional
# Functions that return a value that is data-dependent on the input.
fun:btowc=functional
fun:exp=functional
fun:exp2=functional
fun:fabs=functional
fun:finite=functional
fun:floor=functional
fun:fmod=functional
fun:isinf=functional
fun:isnan=functional
fun:log=functional
fun:modf=functional
fun:pow=functional
fun:round=functional
fun:sqrt=functional
fun:wctob=functional
# Functions that produce an output that does not depend on the input (shadow is
# zeroed automatically).
fun:__assert_fail=discard
fun:__ctype_b_loc=discard
fun:__cxa_atexit=discard
fun:__errno_location=discard
fun:__newlocale=discard
fun:__sbrk=discard
fun:__sigsetjmp=discard
fun:__uselocale=discard
fun:__wctype_l=discard
fun:access=discard
fun:alarm=discard
fun:atexit=discard
fun:bind=discard
fun:chdir=discard
fun:close=discard
fun:closedir=discard
fun:connect=discard
fun:dladdr=discard
fun:dlclose=discard
fun:fclose=discard
fun:feof=discard
fun:ferror=discard
fun:fflush=discard
fun:fileno=discard
fun:fopen=discard
fun:fprintf=discard
fun:fputc=discard
fun:fputc=discard
fun:fputs=discard
fun:fputs=discard
fun:fseek=discard
fun:ftell=discard
fun:fwrite=discard
fun:getenv=discard
fun:getuid=discard
fun:geteuid=discard
fun:getpagesize=discard
fun:getpid=discard
fun:kill=discard
fun:listen=discard
fun:lseek=discard
fun:mkdir=discard
fun:mmap=discard
fun:munmap=discard
fun:open=discard
fun:pipe=discard
fun:posix_fadvise=discard
fun:posix_memalign=discard
fun:prctl=discard
fun:printf=discard
fun:pthread_sigmask=discard
fun:putc=discard
fun:putchar=discard
fun:puts=discard
fun:rand=discard
fun:random=discard
fun:remove=discard
fun:sched_getcpu=discard
fun:sched_get_priority_max=discard
fun:sched_setaffinity=discard
fun:sched_yield=discard
fun:sem_destroy=discard
fun:sem_init=discard
fun:sem_post=discard
fun:sem_wait=discard
fun:send=discard
fun:sendmsg=discard
fun:sendto=discard
fun:setsockopt=discard
fun:shutdown=discard
fun:sleep=discard
fun:socket=discard
fun:strerror=discard
fun:strspn=discard
fun:strcspn=discard
fun:symlink=discard
fun:syscall=discard
fun:unlink=discard
fun:uselocale=discard
# Functions that produce output does not depend on the input (need to zero the
# shadow manually).
fun:calloc=custom
fun:clock_gettime=custom
fun:dlopen=custom
fun:fgets=custom
fun:fstat=custom
fun:getcwd=custom
fun:get_current_dir_name=custom
fun:gethostname=custom
fun:getrlimit=custom
fun:getrusage=custom
fun:nanosleep=custom
fun:pread=custom
fun:read=custom
fun:socketpair=custom
fun:stat=custom
fun:time=custom
# Functions that produce an output that depend on the input (propagate the
# shadow manually).
fun:ctime_r=custom
fun:inet_pton=custom
fun:localtime_r=custom
fun:memcpy=custom
fun:memset=custom
fun:strcpy=custom
fun:strdup=custom
fun:strncpy=custom
fun:strtod=custom
fun:strtol=custom
fun:strtoll=custom
fun:strtoul=custom
fun:strtoull=custom
# Functions that produce an output that is computed from the input, but is not
# necessarily data dependent.
fun:memchr=custom
fun:memcmp=custom
fun:strcasecmp=custom
fun:strchr=custom
fun:strcmp=custom
fun:strlen=custom
fun:strncasecmp=custom
fun:strncmp=custom
fun:strrchr=custom
fun:strstr=custom
# Functions which take action based on global state, such as running a callback
# set by a sepperate function.
fun:write=custom
# Functions that take a callback (wrap the callback manually).
fun:dl_iterate_phdr=custom
fun:getpwuid_r=custom
fun:poll=custom
fun:sched_getaffinity=custom
fun:select=custom
fun:sigemptyset=custom
fun:sigaction=custom
fun:gettimeofday=custom
# sprintf-like
fun:sprintf=custom
fun:snprintf=custom
# TODO: custom
fun:asprintf=discard
fun:qsort=discard
###############################################################################
# pthread
###############################################################################
fun:pthread_equal=discard
fun:pthread_getspecific=discard
fun:pthread_key_create=discard
fun:pthread_key_delete=discard
fun:pthread_mutex_destroy=discard
fun:pthread_mutex_init=discard
fun:pthread_mutex_lock=discard
fun:pthread_mutex_trylock=discard
fun:pthread_mutex_unlock=discard
fun:pthread_mutexattr_destroy=discard
fun:pthread_mutexattr_init=discard
fun:pthread_mutexattr_settype=discard
fun:pthread_once=discard
fun:pthread_self=discard
fun:pthread_setspecific=discard
# Functions that take a callback (wrap the callback manually).
fun:pthread_create=custom
###############################################################################
# libffi/libgo
###############################################################################
# Functions that are written in asm or are called from asm.
fun:ffi_call_unix64=uninstrumented
fun:ffi_call_unix64=discard
fun:ffi_closure_unix64_inner=uninstrumented
fun:ffi_closure_unix64_inner=discard
fun:ffi_closure_unix64=uninstrumented
fun:ffi_closure_unix64=discard
fun:__go_get_closure=uninstrumented
fun:__go_get_closure=discard
fun:__go_makefunc_can_recover=uninstrumented
fun:__go_makefunc_can_recover=discard
fun:__go_makefunc_returning=uninstrumented
fun:__go_makefunc_returning=discard
fun:reflect.MakeFuncStubGo=uninstrumented
fun:reflect.MakeFuncStubGo=discard
fun:reflect.makeFuncStub=uninstrumented
fun:reflect.makeFuncStub=discard
###############################################################################
# lib/Fuzzer
###############################################################################
# Replaces __sanitizer_cov_trace_cmp with __dfsw___sanitizer_cov_trace_cmp
fun:__sanitizer_cov_trace_cmp=custom
fun:__sanitizer_cov_trace_cmp=uninstrumented
fun:__sanitizer_cov_trace_cmp1=custom
fun:__sanitizer_cov_trace_cmp1=uninstrumented
fun:__sanitizer_cov_trace_cmp2=custom
fun:__sanitizer_cov_trace_cmp2=uninstrumented
fun:__sanitizer_cov_trace_cmp4=custom
fun:__sanitizer_cov_trace_cmp4=uninstrumented
fun:__sanitizer_cov_trace_cmp8=custom
fun:__sanitizer_cov_trace_cmp8=uninstrumented
# Similar for __sanitizer_cov_trace_switch
fun:__sanitizer_cov_trace_switch=custom
fun:__sanitizer_cov_trace_switch=uninstrumented
# Ignores all other __sanitizer callbacks.
fun:__sanitizer_cov=uninstrumented
fun:__sanitizer_cov=discard
fun:__sanitizer_cov_module_init=uninstrumented
fun:__sanitizer_cov_module_init=discard
fun:__sanitizer_cov_with_check=uninstrumented
fun:__sanitizer_cov_with_check=discard
fun:__sanitizer_set_death_callback=uninstrumented
fun:__sanitizer_set_death_callback=discard
fun:__sanitizer_update_counter_bitset_and_clear_counters=uninstrumented
fun:__sanitizer_update_counter_bitset_and_clear_counters=discard
# Ignores the dfsan wrappers.
fun:__dfsw_*=uninstrumented
fun:__dfsw_*=discard
# Don't add extra parameters to the Fuzzer callback.
fun:LLVMFuzzerTestOneInput=uninstrumented

View File

@@ -0,0 +1 @@
a1ea0a06b5375ce2c9aa2d3046b89fe2829c3f00

View File

@@ -0,0 +1,96 @@
#!/usr/bin/env python
#===- lib/dfsan/scripts/build-libc-list.py ---------------------------------===#
#
# The LLVM Compiler Infrastructure
#
# This file is distributed under the University of Illinois Open Source
# License. See LICENSE.TXT for details.
#
#===------------------------------------------------------------------------===#
# The purpose of this script is to identify every function symbol in a set of
# libraries (in this case, libc and libgcc) so that they can be marked as
# uninstrumented, thus allowing the instrumentation pass to treat calls to those
# functions correctly.
import os
import subprocess
import sys
from optparse import OptionParser
def defined_function_list(object):
functions = []
readelf_proc = subprocess.Popen(['readelf', '-s', '-W', object],
stdout=subprocess.PIPE)
readelf = readelf_proc.communicate()[0].split('\n')
if readelf_proc.returncode != 0:
raise subprocess.CalledProcessError(readelf_proc.returncode, 'readelf')
for line in readelf:
if (line[31:35] == 'FUNC' or line[31:36] == 'IFUNC') and \
line[39:44] != 'LOCAL' and \
line[55:58] != 'UND':
function_name = line[59:].split('@')[0]
functions.append(function_name)
return functions
p = OptionParser()
p.add_option('--libc-dso-path', metavar='PATH',
help='path to libc DSO directory',
default='/lib/x86_64-linux-gnu')
p.add_option('--libc-archive-path', metavar='PATH',
help='path to libc archive directory',
default='/usr/lib/x86_64-linux-gnu')
p.add_option('--libgcc-dso-path', metavar='PATH',
help='path to libgcc DSO directory',
default='/lib/x86_64-linux-gnu')
p.add_option('--libgcc-archive-path', metavar='PATH',
help='path to libgcc archive directory',
default='/usr/lib/gcc/x86_64-linux-gnu/4.6')
p.add_option('--with-libstdcxx', action='store_true',
dest='with_libstdcxx',
help='include libstdc++ in the list (inadvisable)')
p.add_option('--libstdcxx-dso-path', metavar='PATH',
help='path to libstdc++ DSO directory',
default='/usr/lib/x86_64-linux-gnu')
(options, args) = p.parse_args()
libs = [os.path.join(options.libc_dso_path, name) for name in
['ld-linux-x86-64.so.2',
'libanl.so.1',
'libBrokenLocale.so.1',
'libcidn.so.1',
'libcrypt.so.1',
'libc.so.6',
'libdl.so.2',
'libm.so.6',
'libnsl.so.1',
'libpthread.so.0',
'libresolv.so.2',
'librt.so.1',
'libthread_db.so.1',
'libutil.so.1']]
libs += [os.path.join(options.libc_archive_path, name) for name in
['libc_nonshared.a',
'libpthread_nonshared.a']]
libs.append(os.path.join(options.libgcc_dso_path, 'libgcc_s.so.1'))
libs.append(os.path.join(options.libgcc_archive_path, 'libgcc.a'))
if options.with_libstdcxx:
libs.append(os.path.join(options.libstdcxx_dso_path, 'libstdc++.so.6'))
functions = []
for l in libs:
if os.path.exists(l):
functions += defined_function_list(l)
else:
print >> sys.stderr, 'warning: library %s not found' % l
functions = list(set(functions))
functions.sort()
for f in functions:
print 'fun:%s=uninstrumented' % f

View File

@@ -0,0 +1,52 @@
#!/bin/sh
DFSAN_DIR=$(dirname "$0")/../
DFSAN_CUSTOM_TESTS=${DFSAN_DIR}/../../test/dfsan/custom.cc
DFSAN_CUSTOM_WRAPPERS=${DFSAN_DIR}/dfsan_custom.cc
DFSAN_ABI_LIST=${DFSAN_DIR}/done_abilist.txt
DIFFOUT=$(mktemp -q /tmp/tmp.XXXXXXXXXX)
ERRORLOG=$(mktemp -q /tmp/tmp.XXXXXXXXXX)
DIFF_A=$(mktemp -q /tmp/tmp.XXXXXXXXXX)
DIFF_B=$(mktemp -q /tmp/tmp.XXXXXXXXXX)
on_exit() {
rm -f ${DIFFOUT} 2> /dev/null
rm -f ${ERRORLOG} 2> /dev/null
rm -f ${DIFF_A} 2> /dev/null
rm -f ${DIFF_B} 2> /dev/null
}
# Ignore __sanitizer_cov_trace* because they are implemented elsewhere.
trap on_exit EXIT
grep -E "^fun:.*=custom" ${DFSAN_ABI_LIST} \
| grep -v "dfsan_get_label\|__sanitizer_cov_trace" \
| sed "s/^fun:\(.*\)=custom.*/\1/" | sort > $DIFF_A
grep -E "__dfsw.*\(" ${DFSAN_CUSTOM_WRAPPERS} \
| sed "s/.*__dfsw_\(.*\)(.*/\1/" | sort > $DIFF_B
diff -u $DIFF_A $DIFF_B > ${DIFFOUT}
if [ $? -ne 0 ]
then
echo -n "The following differences between the ABI list and ">> ${ERRORLOG}
echo "the implemented custom wrappers have been found:" >> ${ERRORLOG}
cat ${DIFFOUT} >> ${ERRORLOG}
fi
grep -E __dfsw_ ${DFSAN_CUSTOM_WRAPPERS} \
| sed "s/.*__dfsw_\([^(]*\).*/\1/" | sort > $DIFF_A
grep -E "^[[:space:]]*test_.*\(\);" ${DFSAN_CUSTOM_TESTS} \
| sed "s/.*test_\(.*\)();/\1/" | sort > $DIFF_B
diff -u $DIFF_A $DIFF_B > ${DIFFOUT}
if [ $? -ne 0 ]
then
echo -n "The following differences between the implemented " >> ${ERRORLOG}
echo "custom wrappers and the tests have been found:" >> ${ERRORLOG}
cat ${DIFFOUT} >> ${ERRORLOG}
fi
if [ -s ${ERRORLOG} ]
then
cat ${ERRORLOG}
exit 1
fi