[clang][Codegen] Introduce the disable_sanitizer_instrumentation attribute

[glider]

Summary

The purpose of attribute((disable_sanitizer_instrumentation)) is to
prevent all kinds of sanitizer instrumentation applied to a certain
function, Objective-C method, or global variable.

The no_sanitize(...) attribute drops instrumentation checks, but may
still insert code preventing false positive reports. In some cases
though (e.g. when building Linux kernel with -fsanitize=kernel-memory
or -fsanitize=thread) the users may want to avoid any kind of
instrumentation.

[glider]

Added a comment to clang/lib/CodeGen/CodeGenFunction.h

[melver]

llvm/include/llvm/AsmParser/LLToken.h

223

LLVM seems to just call them nofoo i.e. here it'd be nosanitizer_instrumentation.
I think Clang and LLVM are a bit inconsistent in their naming (no_foo vs nofoo) . See e.g. nosanitize_coverage which is similarly inconsistent yet consistent with other LLVM attrs.

[dvyukov]

clang/lib/CodeGen/CodeGenFunction.cpp

526

When is CurFuncDecl nullptr? Maybe we should look at definition in this case?

[aaron.ballman]

clang/include/clang/Basic/AttrDocs.td

2611–2612

Has there been agreement that this isn't actually a bug? My understanding of no_sanitize is that it disables sanitizer support for a function or global. The documentation for that attribute says:

Use the ``no_sanitize`` attribute on a function or a global variable
declaration to specify that a particular instrumentation or set of
instrumentations should not be applied.

That sure reads like "do not instrument this at all" to me, and makes me think we don't need a second attribute that says "no, really, I mean it this time."

[glider]

clang/include/clang/Basic/AttrDocs.td

2611–2612

No, this isn't a bug, but might need to be better clarified in the docs.
ThreadSanitizer and MemorySanitizer do insert some instrumentation into ignore functions to prevent false positives:

ThreadSanitizer still instruments such functions to avoid false positives and provide meaningful stack traces.

(https://clang.llvm.org/docs/ThreadSanitizer.html#attribute-no-sanitize-thread)

and

MemorySanitizer may still instrument such functions to avoid false positives.

(https://clang.llvm.org/docs/MemorySanitizer.html#attribute-no-sanitize-memory)

This is the behavior people rely onto, although at this point I don't think no_sanitize(...) is the best name for attribute not disabling instrumentation completely.

[aaron.ballman]

clang/include/clang/Basic/AttrDocs.td

2611–2612

Thank you for the information!

Having two attributes with basically the same name to perform this functionality is confusing because users (understandably) will reach for the succinctly named one and make assumptions about what it does from the name.

One possibility would be to change no_sanitize to take an additional argument, as in: __attribute__((no_sanitize(fully_disable, "thread"))). Perhaps another solution would be to give the proposed attribute a more distinct name, like disable_sanitizer_instrumentation, sanitizer_instrumentation_disabled, or something else.

[melver]

clang/include/clang/Basic/AttrDocs.td

2611–2612

Last I looked at no_sanitize, it's quite awkward that it is an attribute that accepts arguments, because it makes it very hard to query for existence of attribute additions/changes with __has_attribute(). Given this new attribute is meant to be semantically quite different, the cleaner and less intrusive way with that in mind is to create a new attribute. Unless of course there's a nice way to make __has_attribute() work.

Here's another suggestion for name, which actually makes the difference between no_sanitize and the new one obvious: no_sanitize_any_permit_false_positives

At least it would semantically tell a user what might happen, which in turn would hopefully make them avoid this attribute (also because it's hard enough to type) unless they are absolutely sure.

[aaron.ballman]

clang/include/clang/Basic/AttrDocs.td

2611–2612

Given this new attribute is meant to be semantically quite different, the cleaner and less intrusive way with that in mind is to create a new attribute. Unless of course there's a nice way to make __has_attribute() work.

That sounds like good rationale for a separate attribute.

Here's another suggestion for name, which actually makes the difference between no_sanitize and the new one obvious: no_sanitize_any_permit_false_positives

At least it would semantically tell a user what might happen, which in turn would hopefully make them avoid this attribute (also because it's hard enough to type) unless they are absolutely sure.

That would certainly solve my concerns! Do you envision this being used far less often than no_sanitize? (That's my intuition, so I'm just double-checking that this isn't expected to be a popular replacement or something where the long name may be really undesirable.)

[eugenis]

The new attribute should be very rare, and not something that a typical end user should even know about.
That's why I'd prefer if the name reflected how the attribute affects code generation rather than user-visible behavior: disable_sanitizer_instrumentation sounds perfect to me.

[glider]

Renamed no_sanitizer_instrumentation to disable_sanitizer_instrumentation
Added bitcode attribute declaration and missing handling of the new attribute in switches.

[glider]

clang/include/clang/Basic/AttrDocs.td

2611–2612

Yes, right now we only want to apply this attribute to a couple of critical places in the Linux kernel.
Other users may pop up in e.g. other kernels (NetBSD is using KMSAN) and maybe userspace programs, but we don't expect it to be popular, so having a lengthy attribute name is fine.

clang/lib/CodeGen/CodeGenFunction.cpp

526

I borrowed this check from ShouldInstrumentFunction(), it fires e.g. in the following case (borrowed from an existing regtest):

namespace rdar9445102 {
  class Rdar9445102 {
    public:
      Rdar9445102();
  };
}

static rdar9445102::Rdar9445102 s_rdar9445102Initializer;

We don't need to distinguish between the declaration and the definition, it happens automatically.
E.g. if we apply the attribute to either of them, the resulting function will have the disable_sanitizer_instrumentation LLVM attribute.

llvm/include/llvm/AsmParser/LLToken.h

223

Renamed the attribute to disable_sanitizer_instrumentation per Evgenii's comment.

[glider]

+krytarowski FYI

[glider]

Updated patch description

[aaron.ballman]

clang/include/clang/Basic/Attr.td

2953

Do we want this to also appertain to GlobalVar and ObjCMethod so it's got the same subjects as no_sanitize?

clang/include/clang/Basic/AttrDocs.td

2611–2612

Fantastic, thank you for the confirmation!

clang/lib/CodeGen/CodeGenFunction.cpp

528–530

[glider]

Address Aaron's comments

clang/include/clang/Basic/Attr.td

2953

Good catch, thank you. When adding the new attribute to ASan, we probably want it to mimic the behavior of no_sanitize("address")

clang/lib/CodeGen/CodeGenFunction.cpp

528–530

Right :)

[aaron.ballman]

Clang bits LGTM with a few minor documentation nits.

clang/include/clang/Basic/AttrDocs.td

2608–2609

function, Objective-C method, or global variable.

2611–2612

[melver]

llvm/include/llvm/IR/Attributes.td

90

There's this long-tail of changes required for adding new keywords to the IR. Have a look at https://reviews.llvm.org/D102772 -- things that I see currently missing are various tests etc.

llvm/lib/Bitcode/Writer/BitcodeWriter.cpp

629

There's also BitcodeReader, which needs something similar.

[glider]

Fix the docs

[glider]

llvm/include/llvm/IR/Attributes.td

90

It's ridiculous that we have so many handwritten files that list all the attributes (all those llvm.vim etc)
But I'll definitely need to update BitcodeReader and the tests. Thanks!

[melver]

clang/test/CodeGen/attr-no-sanitize-coverage.c

1 ↗

(On Diff #366887)

This file says it's called attr-no-sanitize-coverage.c, I think that's the wrong name.

[glider]

llvm/include/llvm/Bitcode/LLVMBitCodes.h

674

Missing "_KIND_"

[glider]

Updated BitcodeReader.cpp and several tests per Marco's suggestion
Renamed ATTR_DISABLE_SANITIZER_INSTRUMENTATION to ATTR_KIND_DISABLE_SANITIZER_INSTRUMENTATION

[melver]

llvm/lib/AsmParser/LLLexer.cpp

646

Do the tests pass?

There should also be the code that actually turns the token into the attribute in llvm/lib/AsmParser/LLParser.cpp

[melver]

llvm/docs/LangRef.rst also needs a corresponding change.

[glider]

In D108029#2954566, @melver wrote:

llvm/docs/LangRef.rst also needs a corresponding change.

Right, will do. I thought LangRef was missing the sanitizer bits as well, and was planning to add them together, but apparently I was just looking for the wrong attributes.

llvm/lib/AsmParser/LLLexer.cpp

646

check-llvm and check-clang pass for me, check-all seems to choke on some unrelated bugs.

LLParser is using Tablegen now, no need to change it: https://github.com/llvm/llvm-project/blob/main/llvm/lib/AsmParser/LLParser.cpp#L1247

[melver]

LGTM
with the LangRef change.

Thanks!

llvm/lib/AsmParser/LLLexer.cpp

646

Ah, nice, I missed that.

[glider]

Updated LangRef.rst

[glider]

In D108029#2954604, @glider wrote:

In D108029#2954566, @melver wrote:

llvm/docs/LangRef.rst also needs a corresponding change.

Right, will do. I thought LangRef was missing the sanitizer bits as well, and was planning to add them together, but apparently I was just looking for the wrong attributes.

I've added the function attribute description to LangRef. Looks like global attributes aren't listed explicitly.

clang/include/clang/Basic/Attr.td

let Spellings = [GCC<"no_address_safety_analysis">,
                    GCC<"no_sanitize_thread">,
                    Clang<"no_sanitize_memory">];
   let Subjects = SubjectList<[Function, GlobalVar], ErrorDiag>;
   let Documentation = [NoSanitizeAddressDocs, NoSanitizeThreadDocs,
                        NoSanitizeMemoryDocs];
   let ASTNode = 0;
 }
 
+def DisableSanitizerInstrumentation : InheritableAttr {
+  let Spellings = [Clang<"disable_sanitizer_instrumentation">];
+  let Subjects = SubjectList<[Function, ObjCMethod, GlobalVar]>;
+  let Documentation = [DisableSanitizerInstrumentationDocs];
+  let SimpleHandler = 1;
+}
+
 def CFICanonicalJumpTable : InheritableAttr {
   let Spellings = [Clang<"cfi_canonical_jump_table">];
   let Subjects = SubjectList<[Function], ErrorDiag>;
   let Documentation = [CFICanonicalJumpTableDocs];
   let SimpleHandler = 1;
 }
 
 // C/C++ Thread safety attributes (e.g. for deadlock, data race checking)

clang/include/clang/Basic/AttrDocs.td

 or variable. Using ``__attribute__((no_sanitize("coverage")))`` specifies that
 SanitizerCoverage should not be applied to the function.
 
 See :ref:`Controlling Code Generation <controlling-code-generation>` for a
 full list of supported sanitizer flags.
   }];
 }
 
+def DisableSanitizerInstrumentationDocs : Documentation {
+  let Category = DocCatFunction;
+  let Content = [{
+Use the ``disable_sanitizer_instrumentation`` attribute on a function,
+Objective-C method, or global variable, to specify that no sanitizer
+instrumentation should be applied.
+
+This is not the same as ``__attribute__((no_sanitize(...)))``, which depending
+on the tool may still insert instrumentation to prevent false positive reports.
+  }];
+}
+
 def NoSanitizeAddressDocs : Documentation {
   let Category = DocCatFunction;
   // This function has multiple distinct spellings, and so it requires a custom
   // heading to be specified. The most common spelling is sufficient.
   let Heading = "no_sanitize_address, no_address_safety_analysis";
   let Content = [{
 .. _langext-address_sanitizer:
 

clang/lib/CodeGen/CodeGenFunction.h

public:
   /// should call destructors on members and base classes in reverse
   /// order of their construction.
   void EnterDtorCleanups(const CXXDestructorDecl *Dtor, CXXDtorType Type);
 
   /// ShouldInstrumentFunction - Return true if the current function should be
   /// instrumented with __cyg_profile_func_* calls
   bool ShouldInstrumentFunction();
 
+  /// ShouldSkipSanitizerInstrumentation - Return true if the current function
+  /// should not be instrumented with sanitizers.
+  bool ShouldSkipSanitizerInstrumentation();
+
   /// ShouldXRayInstrument - Return true if the current function should be
   /// instrumented with XRay nop sleds.
   bool ShouldXRayInstrumentFunction() const;
 
   /// AlwaysEmitXRayCustomEvents - Return true if we must unconditionally emit
   /// XRay custom event handling calls.
   bool AlwaysEmitXRayCustomEvents() const;
 

clang/lib/CodeGen/CodeGenFunction.cpp

void CodeGenFunction::FinishFunction(SourceLocation EndLoc) {
   if (ShouldInstrumentFunction()) {
     if (CGM.getCodeGenOpts().InstrumentFunctions)
       CurFn->addFnAttr("instrument-function-exit", "__cyg_profile_func_exit");
     if (CGM.getCodeGenOpts().InstrumentFunctionsAfterInlining)
       CurFn->addFnAttr("instrument-function-exit-inlined",
                        "__cyg_profile_func_exit");
   }
 
+  if (ShouldSkipSanitizerInstrumentation())
+    CurFn->addFnAttr(llvm::Attribute::DisableSanitizerInstrumentation);
+
   // Emit debug descriptor for function end.
   if (CGDebugInfo *DI = getDebugInfo())
     DI->EmitFunctionEnd(Builder, CurFn);
 
   // Reset the debug location to that of the simple 'return' expression, if any
   // rather than that of the end of the function's scope '}'.
   ApplyDebugLocation AL(*this, Loc);
   EmitFunctionEpilog(*CurFnInfo, EmitRetDbgLoc, EndLoc);
if (!CGM.getCodeGenOpts().InstrumentFunctions &&
       !CGM.getCodeGenOpts().InstrumentFunctionsAfterInlining &&
       !CGM.getCodeGenOpts().InstrumentFunctionEntryBare)
     return false;
   if (!CurFuncDecl || CurFuncDecl->hasAttr<NoInstrumentFunctionAttr>())
     return false;
   return true;
 }
 
+bool CodeGenFunction::ShouldSkipSanitizerInstrumentation() {
+  if (!CurFuncDecl)
+    return false;
+  return CurFuncDecl->hasAttr<DisableSanitizerInstrumentationAttr>();
+}
+
 /// ShouldXRayInstrument - Return true if the current function should be
 /// instrumented with XRay nop sleds.
 bool CodeGenFunction::ShouldXRayInstrumentFunction() const {
   return CGM.getCodeGenOpts().XRayInstrumentFunctions;
 }
 
 /// AlwaysEmitXRayCustomEvents - Return true if we should emit IR for calls to
 /// the __xray_customevent(...) builtin calls, when doing XRay instrumentation.

clang/test/CodeGen/attr-disable-sanitizer-instrumentation.c

+// RUN: %clang_cc1 -debug-info-kind=limited %s -emit-llvm -o - | FileCheck %s
+
+void t1() __attribute__((disable_sanitizer_instrumentation)) {
+}
+// CHECK: disable_sanitizer_instrumentation
+// CHECK-NEXT: void @t1
+
+// CHECK-NOT: disable_sanitizer_instrumentation
+// CHECK: void @t2
+void t2() {
+}

clang/test/Misc/pragma-attribute-supported-attributes-list.test

 // CHECK-NEXT: Constructor (SubjectMatchRule_function)
 // CHECK-NEXT: Consumable (SubjectMatchRule_record)
 // CHECK-NEXT: ConsumableAutoCast (SubjectMatchRule_record)
 // CHECK-NEXT: ConsumableSetOnRead (SubjectMatchRule_record)
 // CHECK-NEXT: Convergent (SubjectMatchRule_function)
 // CHECK-NEXT: DLLExport (SubjectMatchRule_function, SubjectMatchRule_variable, SubjectMatchRule_record, SubjectMatchRule_objc_interface)
 // CHECK-NEXT: DLLImport (SubjectMatchRule_function, SubjectMatchRule_variable, SubjectMatchRule_record, SubjectMatchRule_objc_interface)
 // CHECK-NEXT: Destructor (SubjectMatchRule_function)
+// CHECK-NEXT: DisableSanitizerInstrumentation (SubjectMatchRule_function, SubjectMatchRule_objc_method, SubjectMatchRule_variable_is_global)
 // CHECK-NEXT: DisableTailCalls (SubjectMatchRule_function, SubjectMatchRule_objc_method)
 // CHECK-NEXT: EnableIf (SubjectMatchRule_function)
 // CHECK-NEXT: EnforceTCB (SubjectMatchRule_function)
 // CHECK-NEXT: EnforceTCBLeaf (SubjectMatchRule_function)
 // CHECK-NEXT: EnumExtensibility (SubjectMatchRule_enum)
 // CHECK-NEXT: ExcludeFromExplicitInstantiation (SubjectMatchRule_variable, SubjectMatchRule_function, SubjectMatchRule_record)
 // CHECK-NEXT: ExternalSourceSymbol ((SubjectMatchRule_record, SubjectMatchRule_enum, SubjectMatchRule_enum_constant, SubjectMatchRule_field, SubjectMatchRule_function, SubjectMatchRule_namespace, SubjectMatchRule_objc_category, SubjectMatchRule_objc_implementation, SubjectMatchRule_objc_interface, SubjectMatchRule_objc_method, SubjectMatchRule_objc_property, SubjectMatchRule_objc_protocol, SubjectMatchRule_record, SubjectMatchRule_type_alias, SubjectMatchRule_variable))
 // CHECK-NEXT: FlagEnum (SubjectMatchRule_enum)

llvm/docs/BitCodeFormat.rst

 * code 66: ``no_merge``
 * code 67: ``null_pointer_is_valid``
 * code 68: ``noundef``
 * code 69: ``byref``
 * code 70: ``mustprogress``
 * code 74: ``vscale_range(<Min>[, <Max>])``
 * code 75: ``swiftasync``
 * code 76: ``nosanitize_coverage``
+* code 77: ``elementtype``
+* code 78: ``disable_sanitizer_instrumentation``
 
 .. note::
   The ``allocsize`` attribute has a special encoding for its arguments. Its two
   arguments, which are 32-bit integers, are packed into one 64-bit integer value
   (i.e. ``(EltSizeParam << 32) | NumEltsParam``), with ``NumEltsParam`` taking on
   the sentinel value -1 if it is not specified.
 
 .. note::

llvm/docs/LangRef.rst

``convergent``
     that we should treat the call as though we're calling a convergent
     function.  This is particularly useful on indirect calls; without this we
     may treat such calls as though the target is non-convergent.
 
     The optimizer may remove the ``convergent`` attribute on functions when it
     can prove that the function does not execute any convergent operations.
     Similarly, the optimizer may remove ``convergent`` on calls/invokes when it
     can prove that the call/invoke cannot call a convergent function.
+``disable_sanitizer_instrumentation``
+    When instrumenting code with sanitizers, it can be important to skip certain
+    functions to ensure no instrumentation is applied to them.
+
+    This attribute is not always similar to absent ``sanitize_<name>``
+    attributes: depending on the specific sanitizer, code can be inserted into
+    functions regardless of the ``sanitize_<name>`` attribute to prevent false
+    positive reports.
+
+    ``disable_sanitizer_instrumentation`` disables all kinds of instrumentation,
+    taking precedence over the ``sanitize_<name>`` attributes and other compiler
+    flags.
+
 ``"frame-pointer"``
     This attribute tells the code generator whether the function
     should keep the frame pointer. The code generator may emit the frame pointer
     even if this attribute says the frame pointer can be eliminated.
     The allowed string values are:
 
      * ``"none"`` (default) - the frame pointer can be eliminated.
      * ``"non-leaf"`` - the frame pointer should be kept if the function calls

llvm/include/llvm/AsmParser/LLToken.h

enum Kind {
   kw_sanitize_memtag,
   kw_builtin,
   kw_byval,
   kw_inalloca,
   kw_cold,
   kw_convergent,
   kw_dereferenceable,
   kw_dereferenceable_or_null,
+  kw_disable_sanitizer_instrumentation,
   kw_elementtype,
   kw_inaccessiblememonly,
   kw_inaccessiblemem_or_argmemonly,
   kw_inlinehint,
   kw_inreg,
   kw_jumptable,
   kw_minsize,
   kw_naked,
enum Kind {
   kw_nonnull,
   kw_noprofile,
   kw_noredzone,
   kw_noreturn,
   kw_nosync,
   kw_nocf_check,
   kw_nounwind,
   kw_nosanitize_coverage,
   kw_null_pointer_is_valid,
   kw_optforfuzzing,
   kw_optnone,
   kw_optsize,
   kw_preallocated,
   kw_readnone,
   kw_readonly,
   kw_returned,
   kw_returns_twice,

llvm/include/llvm/Bitcode/LLVMBitCodes.h

enum AttributeKindCodes {
   ATTR_KIND_MUSTPROGRESS = 70,
   ATTR_KIND_NO_CALLBACK = 71,
   ATTR_KIND_HOT = 72,
   ATTR_KIND_NO_PROFILE = 73,
   ATTR_KIND_VSCALE_RANGE = 74,
   ATTR_KIND_SWIFT_ASYNC = 75,
   ATTR_KIND_NO_SANITIZE_COVERAGE = 76,
   ATTR_KIND_ELEMENTTYPE = 77,
+  ATTR_KIND_DISABLE_SANITIZER_INSTRUMENTATION = 78,
 };
 
 enum ComdatSelectionKindCodes {
   COMDAT_SELECTION_KIND_ANY = 1,
   COMDAT_SELECTION_KIND_EXACT_MATCH = 2,
   COMDAT_SELECTION_KIND_LARGEST = 3,
   COMDAT_SELECTION_KIND_NO_DUPLICATES = 4,
   COMDAT_SELECTION_KIND_SAME_SIZE = 5,

llvm/include/llvm/IR/Attributes.td

 
 /// Pointer is known to be dereferenceable.
 def Dereferenceable : IntAttr<"dereferenceable", [ParamAttr, RetAttr]>;
 
 /// Pointer is either null or dereferenceable.
 def DereferenceableOrNull : IntAttr<"dereferenceable_or_null",
                                     [ParamAttr, RetAttr]>;
 
+/// Do not instrument function with sanitizers.
+def DisableSanitizerInstrumentation: EnumAttr<"disable_sanitizer_instrumentation", [FnAttr]>;
+
 /// Provide pointer element type to intrinsic.
 def ElementType : TypeAttr<"elementtype", [ParamAttr]>;
 
 /// Function may only access memory that is inaccessible from IR.
 def InaccessibleMemOnly : EnumAttr<"inaccessiblememonly", [FnAttr]>;
 
 /// Function may only access memory that is either inaccessible from the IR,
 /// or pointed to by its pointer arguments.

llvm/lib/AsmParser/LLLexer.cpp

#define KEYWORD(STR)                                                           \
   KEYWORD(argmemonly);
   KEYWORD(builtin);
   KEYWORD(byval);
   KEYWORD(inalloca);
   KEYWORD(cold);
   KEYWORD(convergent);
   KEYWORD(dereferenceable);
   KEYWORD(dereferenceable_or_null);
+  KEYWORD(disable_sanitizer_instrumentation);
   KEYWORD(elementtype);
   KEYWORD(inaccessiblememonly);
   KEYWORD(inaccessiblemem_or_argmemonly);
   KEYWORD(inlinehint);
   KEYWORD(inreg);
   KEYWORD(jumptable);
   KEYWORD(minsize);
   KEYWORD(naked);

llvm/lib/Bitcode/Reader/BitcodeReader.cpp

static Attribute::AttrKind getAttrFromCode(uint64_t Code) {
   case bitc::ATTR_KIND_BY_VAL:
     return Attribute::ByVal;
   case bitc::ATTR_KIND_IN_ALLOCA:
     return Attribute::InAlloca;
   case bitc::ATTR_KIND_COLD:
     return Attribute::Cold;
   case bitc::ATTR_KIND_CONVERGENT:
     return Attribute::Convergent;
+  case bitc::ATTR_KIND_DISABLE_SANITIZER_INSTRUMENTATION:
+    return Attribute::DisableSanitizerInstrumentation;
   case bitc::ATTR_KIND_ELEMENTTYPE:
     return Attribute::ElementType;
   case bitc::ATTR_KIND_INACCESSIBLEMEM_ONLY:
     return Attribute::InaccessibleMemOnly;
   case bitc::ATTR_KIND_INACCESSIBLEMEM_OR_ARGMEMONLY:
     return Attribute::InaccessibleMemOrArgMemOnly;
   case bitc::ATTR_KIND_INLINE_HINT:
     return Attribute::InlineHint;

llvm/lib/Bitcode/Writer/BitcodeWriter.cpp

static uint64_t getAttrKindEncoding(Attribute::AttrKind Kind) {
   case Attribute::ByVal:
     return bitc::ATTR_KIND_BY_VAL;
   case Attribute::Convergent:
     return bitc::ATTR_KIND_CONVERGENT;
   case Attribute::InAlloca:
     return bitc::ATTR_KIND_IN_ALLOCA;
   case Attribute::Cold:
     return bitc::ATTR_KIND_COLD;
+  case Attribute::DisableSanitizerInstrumentation:
+    return bitc::ATTR_KIND_DISABLE_SANITIZER_INSTRUMENTATION;
   case Attribute::Hot:
     return bitc::ATTR_KIND_HOT;
   case Attribute::ElementType:
     return bitc::ATTR_KIND_ELEMENTTYPE;
   case Attribute::InaccessibleMemOnly:
     return bitc::ATTR_KIND_INACCESSIBLEMEM_ONLY;
   case Attribute::InaccessibleMemOrArgMemOnly:
     return bitc::ATTR_KIND_INACCESSIBLEMEM_OR_ARGMEMONLY;

llvm/lib/Transforms/Utils/CodeExtractor.cpp

if (Attr.isStringAttribute()) {
       case Attribute::ByRef:
       case Attribute::EndAttrKinds:
       case Attribute::EmptyKey:
       case Attribute::TombstoneKey:
         continue;
       // Those attributes should be safe to propagate to the extracted function.
       case Attribute::AlwaysInline:
       case Attribute::Cold:
+      case Attribute::DisableSanitizerInstrumentation:
       case Attribute::Hot:
       case Attribute::NoRecurse:
       case Attribute::InlineHint:
       case Attribute::MinSize:
       case Attribute::NoCallback:
       case Attribute::NoDuplicate:
       case Attribute::NoFree:
       case Attribute::NoImplicitFloat:

llvm/test/Bitcode/attributes.ll

 
 declare void @llvm.some.intrinsic(i32*)
 define void @f79() {
 ; CHECK: call void @llvm.some.intrinsic(i32* elementtype(i32) null)
   call void @llvm.some.intrinsic(i32* elementtype(i32) null)
   ret void
 }
 
+; CHECK: define void @f80() #50
+define void @f80() disable_sanitizer_instrumentation
+{
+        ret void;
+}
+
 ; CHECK: attributes #0 = { noreturn }
 ; CHECK: attributes #1 = { nounwind }
 ; CHECK: attributes #2 = { readnone }
 ; CHECK: attributes #3 = { readonly }
 ; CHECK: attributes #4 = { noinline }
 ; CHECK: attributes #5 = { alwaysinline }
 ; CHECK: attributes #6 = { optsize }
 ; CHECK: attributes #7 = { ssp }

 ; CHECK: attributes #42 = { nocallback }
 ; CHECK: attributes #43 = { cold }
 ; CHECK: attributes #44 = { hot }
 ; CHECK: attributes #45 = { vscale_range(8,8) }
 ; CHECK: attributes #46 = { vscale_range(1,8) }
 ; CHECK: attributes #47 = { vscale_range(1,0) }
 ; CHECK: attributes #48 = { nosanitize_coverage }
 ; CHECK: attributes #49 = { noprofile }
+; CHECK: attributes #50 = { disable_sanitizer_instrumentation }
 ; CHECK: attributes #[[NOBUILTIN]] = { nobuiltin }

llvm/test/Bitcode/compatibility.ll

exit:
   ; CHECK: phi i32 [ %v1, %L1 ], [ %v2, %L2 ], [ %op1, %entry ]
 
   select i1 true, i32 0, i32 1
   ; CHECK: select i1 true, i32 0, i32 1
   select <2 x i1> <i1 true, i1 false>, <2 x i8> <i8 2, i8 3>, <2 x i8> <i8 3, i8 2>
   ; CHECK: select <2 x i1> <i1 true, i1 false>, <2 x i8> <i8 2, i8 3>, <2 x i8> <i8 3, i8 2>
 
   call void @f.nobuiltin() builtin
-  ; CHECK: call void @f.nobuiltin() #45
+  ; CHECK: call void @f.nobuiltin() #46
 
   call fastcc noalias i32* @f.noalias() noinline
   ; CHECK: call fastcc noalias i32* @f.noalias() #12
   tail call ghccc nonnull i32* @f.nonnull() minsize
   ; CHECK: tail call ghccc nonnull i32* @f.nonnull() #7
 
   freeze i32 %op1
   ; CHECK: freeze i32 %op1
define void @instructions.strictfp() strictfp {
   ; CHECK: call void @f.strictfp() #43
 
   ret void
 }
 
 declare void @f.nosanitize_coverage() nosanitize_coverage
 ; CHECK: declare void @f.nosanitize_coverage() #44
 
+declare void @f.disable_sanitizer_instrumentation() disable_sanitizer_instrumentation
+; CHECK: declare void @f.disable_sanitizer_instrumentation() #45
+
 ; immarg attribute
 declare void @llvm.test.immarg.intrinsic(i32 immarg)
 ; CHECK: declare void @llvm.test.immarg.intrinsic(i32 immarg)
 
 ; byval attribute with type
 %named_type = type [8 x i8]
 declare void @byval_type(i32* byval(i32) align 2)
 declare void @byval_type2({ i8, i8* }* byval({ i8, i8* }))

 ; CHECK: attributes #37 = { argmemonly nounwind readonly }
 ; CHECK: attributes #38 = { argmemonly nounwind }
 ; CHECK: attributes #39 = { nounwind readonly }
 ; CHECK: attributes #40 = { inaccessiblemem_or_argmemonly nofree nosync nounwind willreturn }
 ; CHECK: attributes #41 = { writeonly }
 ; CHECK: attributes #42 = { speculatable }
 ; CHECK: attributes #43 = { strictfp }
 ; CHECK: attributes #44 = { nosanitize_coverage }
-; CHECK: attributes #45 = { builtin }
+; CHECK: attributes #45 = { disable_sanitizer_instrumentation }
+; CHECK: attributes #46 = { builtin }
 
 ;; Metadata
 
 ; Metadata -- Module flags
 !llvm.module.flags = !{!0, !1, !2, !4, !5, !6}
 ; CHECK: !llvm.module.flags = !{!0, !1, !2, !4, !5, !6}
 
 !0 = !{i32 1, !"mod1", i32 0}