Mercurial > hg > CbC > CbC_gcc

comparison gcc/c-family/c-ubsan.c @ 111:04ced10e8804

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
gcc 7
author kono
date Fri, 27 Oct 2017 22:46:09 +0900
parents
children 84e7813d76e9
comparison
equal deleted inserted replaced
68:561a7518be6b 111:04ced10e8804
1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
2 Copyright (C) 2013-2017 Free Software Foundation, Inc.
3 Contributed by Marek Polacek <polacek@redhat.com>
4
5 This file is part of GCC.
6
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
10 version.
11
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
20
21 #include "config.h"
22 #include "system.h"
23 #include "coretypes.h"
24 #include "tm.h"
25 #include "c-family/c-common.h"
26 #include "ubsan.h"
27 #include "c-family/c-ubsan.h"
28 #include "stor-layout.h"
29 #include "builtins.h"
30 #include "gimplify.h"
31 #include "stringpool.h"
32 #include "attribs.h"
33 #include "asan.h"
34
35 /* Instrument division by zero and INT_MIN / -1. If not instrumenting,
36 return NULL_TREE. */
37
38 tree
39 ubsan_instrument_division (location_t loc, tree op0, tree op1)
40 {
41 tree t, tt;
42 tree type = TREE_TYPE (op0);
43
44 /* At this point both operands should have the same type,
45 because they are already converted to RESULT_TYPE.
46 Use TYPE_MAIN_VARIANT since typedefs can confuse us. */
47 gcc_assert (TYPE_MAIN_VARIANT (TREE_TYPE (op0))
48 == TYPE_MAIN_VARIANT (TREE_TYPE (op1)));
49
50 op0 = unshare_expr (op0);
51 op1 = unshare_expr (op1);
52
53 if (TREE_CODE (type) == INTEGER_TYPE
54 && sanitize_flags_p (SANITIZE_DIVIDE))
55 t = fold_build2 (EQ_EXPR, boolean_type_node,
56 op1, build_int_cst (type, 0));
57 else if (TREE_CODE (type) == REAL_TYPE
58 && sanitize_flags_p (SANITIZE_FLOAT_DIVIDE))
59 t = fold_build2 (EQ_EXPR, boolean_type_node,
60 op1, build_real (type, dconst0));
61 else
62 return NULL_TREE;
63
64 /* We check INT_MIN / -1 only for signed types. */
65 if (TREE_CODE (type) == INTEGER_TYPE
66 && sanitize_flags_p (SANITIZE_DIVIDE)
67 && !TYPE_UNSIGNED (type))
68 {
69 tree x;
70 tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1),
71 build_int_cst (type, -1));
72 x = fold_build2 (EQ_EXPR, boolean_type_node, op0,
73 TYPE_MIN_VALUE (type));
74 x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt);
75 t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x);
76 }
77
78 /* If the condition was folded to 0, no need to instrument
79 this expression. */
80 if (integer_zerop (t))
81 return NULL_TREE;
82
83 /* In case we have a SAVE_EXPR in a conditional context, we need to
84 make sure it gets evaluated before the condition. */
85 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
86 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
87 if (flag_sanitize_undefined_trap_on_error)
88 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
89 else
90 {
91 tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc,
92 ubsan_type_descriptor (type), NULL_TREE,
93 NULL_TREE);
94 data = build_fold_addr_expr_loc (loc, data);
95 enum built_in_function bcode
96 = (flag_sanitize_recover & SANITIZE_DIVIDE)
97 ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
98 : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
99 tt = builtin_decl_explicit (bcode);
100 op0 = unshare_expr (op0);
101 op1 = unshare_expr (op1);
102 tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
103 ubsan_encode_value (op1));
104 }
105 t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
106
107 return t;
108 }
109
110 /* Instrument left and right shifts. */
111
112 tree
113 ubsan_instrument_shift (location_t loc, enum tree_code code,
114 tree op0, tree op1)
115 {
116 tree t, tt = NULL_TREE;
117 tree type0 = TREE_TYPE (op0);
118 tree type1 = TREE_TYPE (op1);
119 if (!INTEGRAL_TYPE_P (type0))
120 return NULL_TREE;
121
122 tree op1_utype = unsigned_type_for (type1);
123 HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
124 tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);
125
126 op0 = unshare_expr (op0);
127 op1 = unshare_expr (op1);
128
129 t = fold_convert_loc (loc, op1_utype, op1);
130 t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);
131
132 /* If this is not a signed operation, don't perform overflow checks.
133 Also punt on bit-fields. */
134 if (TYPE_OVERFLOW_WRAPS (type0)
135 || GET_MODE_BITSIZE (TYPE_MODE (type0)) != TYPE_PRECISION (type0)
136 || !sanitize_flags_p (SANITIZE_SHIFT_BASE))
137 ;
138
139 /* For signed x << y, in C99/C11, the following:
140 (unsigned) x >> (uprecm1 - y)
141 if non-zero, is undefined. */
142 else if (code == LSHIFT_EXPR && flag_isoc99 && cxx_dialect < cxx11)
143 {
144 tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
145 fold_convert (op1_utype, unshare_expr (op1)));
146 tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
147 tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
148 tt = fold_build2 (NE_EXPR, boolean_type_node, tt,
149 build_int_cst (TREE_TYPE (tt), 0));
150 }
151
152 /* For signed x << y, in C++11 and later, the following:
153 x < 0 || ((unsigned) x >> (uprecm1 - y))
154 if > 1, is undefined. */
155 else if (code == LSHIFT_EXPR && cxx_dialect >= cxx11)
156 {
157 tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
158 fold_convert (op1_utype, unshare_expr (op1)));
159 tt = fold_convert_loc (loc, unsigned_type_for (type0),
160 unshare_expr (op0));
161 tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
162 tt = fold_build2 (GT_EXPR, boolean_type_node, tt,
163 build_int_cst (TREE_TYPE (tt), 1));
164 x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0),
165 build_int_cst (type0, 0));
166 tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt);
167 }
168
169 /* If the condition was folded to 0, no need to instrument
170 this expression. */
171 if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt)))
172 return NULL_TREE;
173
174 /* In case we have a SAVE_EXPR in a conditional context, we need to
175 make sure it gets evaluated before the condition. */
176 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
177 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
178
179 enum sanitize_code recover_kind = SANITIZE_SHIFT_EXPONENT;
180 tree else_t = void_node;
181 if (tt)
182 {
183 if (!sanitize_flags_p (SANITIZE_SHIFT_EXPONENT))
184 {
185 t = fold_build1 (TRUTH_NOT_EXPR, boolean_type_node, t);
186 t = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, t, tt);
187 recover_kind = SANITIZE_SHIFT_BASE;
188 }
189 else
190 {
191 if (flag_sanitize_undefined_trap_on_error
192 || ((!(flag_sanitize_recover & SANITIZE_SHIFT_EXPONENT))
193 == (!(flag_sanitize_recover & SANITIZE_SHIFT_BASE))))
194 t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, tt);
195 else
196 else_t = tt;
197 }
198 }
199
200 if (flag_sanitize_undefined_trap_on_error)
201 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
202 else
203 {
204 tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc,
205 ubsan_type_descriptor (type0),
206 ubsan_type_descriptor (type1), NULL_TREE,
207 NULL_TREE);
208 data = build_fold_addr_expr_loc (loc, data);
209
210 enum built_in_function bcode
211 = (flag_sanitize_recover & recover_kind)
212 ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
213 : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
214 tt = builtin_decl_explicit (bcode);
215 op0 = unshare_expr (op0);
216 op1 = unshare_expr (op1);
217 tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
218 ubsan_encode_value (op1));
219 if (else_t != void_node)
220 {
221 bcode = (flag_sanitize_recover & SANITIZE_SHIFT_BASE)
222 ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
223 : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
224 tree else_tt = builtin_decl_explicit (bcode);
225 op0 = unshare_expr (op0);
226 op1 = unshare_expr (op1);
227 else_tt = build_call_expr_loc (loc, else_tt, 3, data,
228 ubsan_encode_value (op0),
229 ubsan_encode_value (op1));
230 else_t = fold_build3 (COND_EXPR, void_type_node, else_t,
231 else_tt, void_node);
232 }
233 }
234 t = fold_build3 (COND_EXPR, void_type_node, t, tt, else_t);
235
236 return t;
237 }
238
239 /* Instrument variable length array bound. */
240
241 tree
242 ubsan_instrument_vla (location_t loc, tree size)
243 {
244 tree type = TREE_TYPE (size);
245 tree t, tt;
246
247 t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0));
248 if (flag_sanitize_undefined_trap_on_error)
249 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
250 else
251 {
252 tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc,
253 ubsan_type_descriptor (type), NULL_TREE,
254 NULL_TREE);
255 data = build_fold_addr_expr_loc (loc, data);
256 enum built_in_function bcode
257 = (flag_sanitize_recover & SANITIZE_VLA)
258 ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
259 : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT;
260 tt = builtin_decl_explicit (bcode);
261 tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size));
262 }
263 t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
264
265 return t;
266 }
267
268 /* Instrument missing return in C++ functions returning non-void. */
269
270 tree
271 ubsan_instrument_return (location_t loc)
272 {
273 if (flag_sanitize_undefined_trap_on_error)
274 return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
275
276 tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc,
277 NULL_TREE, NULL_TREE);
278 tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN);
279 return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
280 }
281
282 /* Instrument array bounds for ARRAY_REFs. We create special builtin,
283 that gets expanded in the sanopt pass, and make an array dimension
284 of it. ARRAY is the array, *INDEX is an index to the array.
285 Return NULL_TREE if no instrumentation is emitted.
286 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
287
288 tree
289 ubsan_instrument_bounds (location_t loc, tree array, tree *index,
290 bool ignore_off_by_one)
291 {
292 tree type = TREE_TYPE (array);
293 tree domain = TYPE_DOMAIN (type);
294
295 if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE)
296 return NULL_TREE;
297
298 tree bound = TYPE_MAX_VALUE (domain);
299 if (ignore_off_by_one)
300 bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound,
301 build_int_cst (TREE_TYPE (bound), 1));
302
303 /* Detect flexible array members and suchlike, unless
304 -fsanitize=bounds-strict. */
305 tree base = get_base_address (array);
306 if (!sanitize_flags_p (SANITIZE_BOUNDS_STRICT)
307 && TREE_CODE (array) == COMPONENT_REF
308 && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
309 {
310 tree next = NULL_TREE;
311 tree cref = array;
312
313 /* Walk all structs/unions. */
314 while (TREE_CODE (cref) == COMPONENT_REF)
315 {
316 if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
317 for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
318 next && TREE_CODE (next) != FIELD_DECL;
319 next = DECL_CHAIN (next))
320 ;
321 if (next)
322 /* Not a last element. Instrument it. */
323 break;
324 /* Ok, this is the last field of the structure/union. But the
325 aggregate containing the field must be the last field too,
326 recursively. */
327 cref = TREE_OPERAND (cref, 0);
328 }
329 if (!next)
330 /* Don't instrument this flexible array member-like array in non-strict
331 -fsanitize=bounds mode. */
332 return NULL_TREE;
333 }
334
335 /* Don't emit instrumentation in the most common cases. */
336 tree idx = NULL_TREE;
337 if (TREE_CODE (*index) == INTEGER_CST)
338 idx = *index;
339 else if (TREE_CODE (*index) == BIT_AND_EXPR
340 && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST)
341 idx = TREE_OPERAND (*index, 1);
342 if (idx
343 && TREE_CODE (bound) == INTEGER_CST
344 && tree_int_cst_sgn (idx) >= 0
345 && tree_int_cst_le (idx, bound))
346 return NULL_TREE;
347
348 *index = save_expr (*index);
349 /* Create a "(T *) 0" tree node to describe the array type. */
350 tree zero_with_type = build_int_cst (build_pointer_type (type), 0);
351 return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS,
352 void_type_node, 3, zero_with_type,
353 *index, bound);
354 }
355
356 /* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS. */
357
358 bool
359 ubsan_array_ref_instrumented_p (const_tree t)
360 {
361 if (TREE_CODE (t) != ARRAY_REF)
362 return false;
363
364 tree op1 = TREE_OPERAND (t, 1);
365 return TREE_CODE (op1) == COMPOUND_EXPR
366 && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR
367 && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE
368 && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS;
369 }
370
371 /* Instrument an ARRAY_REF, if it hasn't already been instrumented.
372 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
373
374 void
375 ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one)
376 {
377 if (!ubsan_array_ref_instrumented_p (*expr_p)
378 && sanitize_flags_p (SANITIZE_BOUNDS | SANITIZE_BOUNDS_STRICT)
379 && current_function_decl != NULL_TREE)
380 {
381 tree op0 = TREE_OPERAND (*expr_p, 0);
382 tree op1 = TREE_OPERAND (*expr_p, 1);
383 tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1,
384 ignore_off_by_one);
385 if (e != NULL_TREE)
386 {
387 tree t = copy_node (*expr_p);
388 TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1),
389 e, op1);
390 *expr_p = t;
391 }
392 }
393 }
394
395 static tree
396 ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
397 enum ubsan_null_ckind ckind)
398 {
399 if (!sanitize_flags_p (SANITIZE_ALIGNMENT | SANITIZE_NULL)
400 || current_function_decl == NULL_TREE)
401 return NULL_TREE;
402
403 tree type = TREE_TYPE (ptype);
404 tree orig_op = op;
405 bool instrument = false;
406 unsigned int mina = 0;
407
408 if (sanitize_flags_p (SANITIZE_ALIGNMENT))
409 {
410 mina = min_align_of_type (type);
411 if (mina <= 1)
412 mina = 0;
413 }
414 while ((TREE_CODE (op) == NOP_EXPR
415 || TREE_CODE (op) == NON_LVALUE_EXPR)
416 && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE)
417 op = TREE_OPERAND (op, 0);
418 if (TREE_CODE (op) == NOP_EXPR
419 && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
420 {
421 if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op))))
422 instrument = true;
423 }
424 else
425 {
426 if (sanitize_flags_p (SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR)
427 {
428 bool strict_overflow_p = false;
429 /* tree_single_nonzero_warnv_p will not return true for non-weak
430 non-automatic decls with -fno-delete-null-pointer-checks,
431 which is disabled during -fsanitize=null. We don't want to
432 instrument those, just weak vars though. */
433 int save_flag_delete_null_pointer_checks
434 = flag_delete_null_pointer_checks;
435 flag_delete_null_pointer_checks = 1;
436 if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
437 || strict_overflow_p)
438 instrument = true;
439 flag_delete_null_pointer_checks
440 = save_flag_delete_null_pointer_checks;
441 }
442 else if (sanitize_flags_p (SANITIZE_NULL))
443 instrument = true;
444 if (mina && mina > 1)
445 {
446 if (!POINTER_TYPE_P (TREE_TYPE (op))
447 || mina > get_pointer_alignment (op) / BITS_PER_UNIT)
448 instrument = true;
449 }
450 }
451 if (!instrument)
452 return NULL_TREE;
453 op = save_expr (orig_op);
454 gcc_assert (POINTER_TYPE_P (ptype));
455 if (TREE_CODE (ptype) == REFERENCE_TYPE)
456 ptype = build_pointer_type (TREE_TYPE (ptype));
457 tree kind = build_int_cst (ptype, ckind);
458 tree align = build_int_cst (pointer_sized_int_node, mina);
459 tree call
460 = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node,
461 3, op, kind, align);
462 TREE_SIDE_EFFECTS (call) = 1;
463 return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
464 }
465
466 /* Instrument a NOP_EXPR to REFERENCE_TYPE or INTEGER_CST with REFERENCE_TYPE
467 type if needed. */
468
469 void
470 ubsan_maybe_instrument_reference (tree *stmt_p)
471 {
472 tree stmt = *stmt_p;
473 tree op = stmt;
474 if (TREE_CODE (stmt) == NOP_EXPR)
475 op = TREE_OPERAND (stmt, 0);
476 op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
477 TREE_TYPE (stmt),
478 UBSAN_REF_BINDING);
479 if (op)
480 {
481 if (TREE_CODE (stmt) == NOP_EXPR)
482 TREE_OPERAND (stmt, 0) = op;
483 else
484 *stmt_p = op;
485 }
486 }
487
488 /* Instrument a CALL_EXPR to a method if needed. */
489
490 void
491 ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor)
492 {
493 if (call_expr_nargs (stmt) == 0)
494 return;
495 tree op = CALL_EXPR_ARG (stmt, 0);
496 if (op == error_mark_node
497 || !POINTER_TYPE_P (TREE_TYPE (op)))
498 return;
499 op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
500 TREE_TYPE (op),
501 is_ctor ? UBSAN_CTOR_CALL
502 : UBSAN_MEMBER_CALL);
503 if (op)
504 CALL_EXPR_ARG (stmt, 0) = op;
505 }