[SanitizerBounds] Add support for NoSanitizeBounds function

[ztong0001]

Summary

This fix is very similar to D102772 that adds the ability to selectively
disable sanitizer pass on certain functions.
Currently adding attribute no_sanitize(bounds) isn't really disabling
-fsanitize=local-bounds (also enabled in -fsanitize=bounds).
Clang handles fsanitize=array-bounds which is already working.
LLVM(BoundsChecking pass in middle-end) handles fsanitize=local-bounds.
In this patch, if we detect no_sanitize(bounds) provided an additional
function attribute (NoSanitizeBounds) is attached to IR to let LLVM know
we want to disable local_bounds checking for this function as well.
In order to support this feature, IR is modified (similar to D102772) to make
clang able to preserve the information and let BoundsChecking pass know bounds
checking is disabled for certain function.

[nlopes]

Well, this patch is just a band-aid and a disaster waiting to happen.
If kmalloc is tagged with an __attribute__ stating the allocation size, then you can't dereference beyond that limit or risk the alias analysis do something you don't want. You are triggering UB like that.
Can't you just remove the __attribute__ from kmalloc instead to avoid triggering UB?

[melver]

What about this test then: https://github.com/llvm/llvm-project/blob/b0a0df980927ca54a7840a1b0c9766e98c05039b/clang/test/CodeGen/sanitize-coverage.c#L74

Can you show an independent C reproducer where no_sanitize does not work for you?

Is there an LKML discussion?

I also think sprinkling no_sanitize for UBSAN is again the wrong solution, as it was also for [1]. UBSAN has a tendency to generate too many false positives in the kernel, and we just have to work on finding solutions that tackle the problem wholesale rather than adding more band-aids.

In this case, I think the right solution is to simply make ksize() kill the optimizer's ability to know the object size. By definition ksize() will return the "true" allocation size, and it is fair to assume once that's called, the caller wants to use the full object size for its size-class.

[1] https://lore.kernel.org/all/[e-mail]/T/#u

[melver]

Right, I was able to repro this. The problem is the trap, which generally sucks that no_sanitize still leaves in the trap.

We also have -fno-sanitize-undefined-trap-on-error, which seems to have no effect either (should it?).

So I think there are 2 problems:

1. Clang still emitting traps even though it shouldn't.

2. The Linux kernel problem.

I think it's fine if you address problem 1 with this, as it's an oversight. But I think problem 2 wants to be solved differently as I suggested.

[ztong0001]

In D119816#3331658, @nlopes wrote:

Well, this patch is just a band-aid and a disaster waiting to happen.
If kmalloc is tagged with an __attribute__ stating the allocation size, then you can't dereference beyond that limit or risk the alias analysis do something you don't want. You are triggering UB like that.
Can't you just remove the __attribute__ from kmalloc instead to avoid triggering UB?

I am not sure I fully get what you are saying.
What I am suggesting is something like below to avoid bounds check pass from running on this function.

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9d0388bed0c1..186fca35266d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1679,7 +1679,7 @@ EXPORT_SYMBOL(__pskb_copy_fclone);
  *     All the pointers pointing into skb header may change and must be
  *     reloaded after call to this function.
  */
-
+__attribute__((no_sanitize("bounds")))
 int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                     gfp_t gfp_mask)
 {

[nlopes]

In D119816#3332414, @ztong0001 wrote:

In D119816#3331658, @nlopes wrote:

Well, this patch is just a band-aid and a disaster waiting to happen.
If kmalloc is tagged with an __attribute__ stating the allocation size, then you can't dereference beyond that limit or risk the alias analysis do something you don't want. You are triggering UB like that.
Can't you just remove the __attribute__ from kmalloc instead to avoid triggering UB?

I am not sure I fully get what you are saying.
What I am suggesting is something like below to avoid bounds check pass from running on this function.

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9d0388bed0c1..186fca35266d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1679,7 +1679,7 @@ EXPORT_SYMBOL(__pskb_copy_fclone);
  *     All the pointers pointing into skb header may change and must be
  *     reloaded after call to this function.
  */
-
+__attribute__((no_sanitize("bounds")))
 int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
                     gfp_t gfp_mask)
 {

The main issue is that the kernel is wrong. It has a bug. The sanitizer's error is not a false-positive!
So what you are proposing is a band-aid. It's not a real solution and it's just masking a wider problem. LLVM knows that kmalloc(x) allocates x bytes because someone placed an __attribute__ ((alloc_size (1))) on kmalloc. That attribute is just wrong and should be removed. It allows LLVM to mark all accesses beyond kmalloc(x) + x - 1 as undefined behavior.

TL;DR: this patch is not the solution for your problems.

[ztong0001]

In D119816#3331797, @melver wrote:

Right, I was able to repro this. The problem is the trap, which generally sucks that no_sanitize still leaves in the trap.

We also have -fno-sanitize-undefined-trap-on-error, which seems to have no effect either (should it?).

So I think there are 2 problems:

1. Clang still emitting traps even though it shouldn't.

2. The Linux kernel problem.

I think it's fine if you address problem 1 with this, as it's an oversight. But I think problem 2 wants to be solved differently as I suggested.

I haven't tried -fno-sanitize-undefined-trap-on-error yet.

IMO trap in kernel gives a generic crash message which is... hard to tell from other cases without further investigating. If I enable KASAN kernel will print out something like

`
[ 1.197953] BUG: KASAN: use-after-free in __pci_enable_msi_range+0x234/0x320
[ 1.198327] Freed by task 1:
[ 1.198327] kfree+0x8f/0x2b0
[ 1.198327] msi_free_msi_descs_range+0xf5/0x130
`

I agree with you that there are two problems.
I think it makes sense to let optimizer aware of ksize() if the kernel API won't change dramatically in the future.

[ztong0001]

In D119816#3332441, @nlopes wrote:

The main issue is that the kernel is wrong. It has a bug. The sanitizer's error is not a false-positive!
So what you are proposing is a band-aid. It's not a real solution and it's just masking a wider problem. LLVM knows that kmalloc(x) allocates x bytes because someone placed an __attribute__ ((alloc_size (1))) on kmalloc. That attribute is just wrong and should be removed. It allows LLVM to mark all accesses beyond kmalloc(x) + x - 1 as undefined behavior.

But isn't this something the author intended to do in order to catch an error?
ksize() case makes some exceptions out of this.

TL;DR: this patch is not the solution for your problems.

[ztong0001]

Thank you all!
I have modified the summary, this patch focus on fixing non-working __attribute__((no_sanitize("bounds"))) attribute.
I will try to fix kernel ksize() related issue and -fno-sanitize-undefined-trap-on-error on separate patches.

[melver]

Adding a new IR attribute comes with a whole slew of other required changes. Please see https://reviews.llvm.org/D102772 for an example.

In addition, please update the patch description to explain what the problem is exactly (remove the old kernel-specific problem, because it's only a distraction). In particular, what current no_sanitize does (because it does something for "bounds checking), and what is missing. Introducing a new IR attribute needs to be properly justified, so if you can explain why this can't be solved another way would also be useful (something like .. the local-bounds code generation happens in the middleend and not frontend unlike some other UBSAN checks).

Also, you need to add some IR tests.

[ztong0001]

Thank you @melver. I will revise patch as suggested.

[ztong0001]

update patch and description as suggested by Marco

[melver]

Thanks - this looks good so far.

clang/test/CodeGen/sanitize-coverage.c

56

This test by itself is not sufficient, it's technically only for fsanitize-coverage.

2 places with more tests would be good:

1. extend clang/test/CodeGen/bounds-checking.c
2. add a pure IR test in llvm/test/Instrumentation/BoundsChecking

With that, it'll also be very clear what was broken before, and what is being fixed now.

[ztong0001]

Thank you, Marco! I have made the following changes:

• extend clang/test/CodeGen/bounds-checking.c to include additional test for newly added nosanitize_bounds attribute
• added a new pure IR test in llvm/test/Instrumentation/BoundsChecking/nosanitize-bounds.ll to test if the new attribute will prevent BoundsChecking pass running on the function

[melver]

Looks good. Few minor changes.

I did some more digging, and it's only fsanitize=local-bounds, so please verify this and also update the commit description. In fact, the Linux kernel already has a comment about Clang's weirdness of local-bounds vs. array-bounds here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/lib/Kconfig.ubsan#n62

[melver]

clang/lib/CodeGen/CodeGenFunction.cpp

757

These 2 checks can be reduced to 1 due to SanitizerKind::Bounds including both. However, as noted, this only affects local-bounds, so I'm not sure if we want to include both -- perhaps for completeness it makes sense, but in the array-bounds only case this attribute will be a nop (AFAIK).

Also, I think we don't want to attach the attribute if bounds checking isn't enabled -- at least it seems unnecessary to do so.

See the following suggested change:

diff --git a/clang/lib/CodeGen/CodeGenFunction.cpp b/clang/lib/CodeGen/CodeGenFunction.cpp
index 842ce0245d45..c1f3a3014a19 100644
--- a/clang/lib/CodeGen/CodeGenFunction.cpp
+++ b/clang/lib/CodeGen/CodeGenFunction.cpp
@@ -740,6 +740,7 @@ void CodeGenFunction::StartFunction(GlobalDecl GD, QualType RetTy,
   } while (false);
 
   if (D) {
+    const bool SanitizeBounds = SanOpts.hasOneOf(SanitizerKind::Bounds);
     bool NoSanitizeCoverage = false;
 
     for (auto Attr : D->specific_attrs<NoSanitizeAttr>()) {
@@ -754,16 +755,15 @@ void CodeGenFunction::StartFunction(GlobalDecl GD, QualType RetTy,
         SanOpts.set(SanitizerKind::KernelHWAddress, false);
       if (mask & SanitizerKind::KernelHWAddress)
         SanOpts.set(SanitizerKind::HWAddress, false);
-      if (mask & SanitizerKind::LocalBounds)
-        Fn->addFnAttr(llvm::Attribute::NoSanitizeBounds);
-      if (mask & SanitizerKind::ArrayBounds)
-        Fn->addFnAttr(llvm::Attribute::NoSanitizeBounds);
 
       // SanitizeCoverage is not handled by SanOpts.
       if (Attr->hasCoverage())
         NoSanitizeCoverage = true;
     }
 
+    if (SanitizeBounds && !SanOpts.hasOneOf(SanitizerKind::Bounds))
+      Fn->addFnAttr(llvm::Attribute::NoSanitizeBounds);
+
     if (NoSanitizeCoverage && CGM.getCodeGenOpts().hasSanitizeCoverage())
       Fn->addFnAttr(llvm::Attribute::NoSanitizeCoverage);
   }

[ztong0001]

In D119816#3345302, @melver wrote:

Looks good. Few minor changes.

I did some more digging, and it's only fsanitize=local-bounds, so please verify this and also update the commit description. In fact, the Linux kernel already has a comment about Clang's weirdness of local-bounds vs. array-bounds here: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/lib/Kconfig.ubsan#n62

Yes I can confirm this. It is indeed fsanitize=local-bounds causing the kernel crash we discussed earlier. (UBSAN_LOCAL_BOUNDS=y)

[ztong0001]

clang/lib/CodeGen/CodeGenFunction.cpp

757

Agreed. I will revise patch and commit description.

[ztong0001]

clang/lib/CodeGen/CodeGenFunction.cpp

757

BTW: Just to double check we are on the same page

when no_sanitize(bounds) is provided, fsanitize=array-bounds is also disabled -- right ? I can confirm this attribute is also affecting array-bounds as this is handled in clang side and we are setting llvm::Attribute::NoSanitizeBounds so that clang's array-bounds can also see this.

I will also add another test for -fsanitize=array-bounds

[ztong0001]

• update commit description
• In: CodeGenFunction::StartFunction(), merge two checks(SanitizerKind::LocalBounds, SanitizerKind::ArrayBounds) into one(SanitizerKind::Bounds)
• update test: clang/test/CodeGen/bounds-checking.c to show no_sanitize("bounds") can also affect fsanitize=array-bounds (clang)

[melver]

clang/lib/CodeGen/CodeGenFunction.cpp

757

Well, no_sanitize("bounds") already worked for array-bounds before this patch. But adding more tests never hurt.

[ztong0001]

clang/lib/CodeGen/CodeGenFunction.cpp

757

Got it. Thanks!

[kees]

FWIW, related problems with pskb_expand_head were seen again here:
https://github.com/ClangBuiltLinux/linux/issues/1599

I have trouble reproducing it, but I think the kernel patch there solves the problem created by __alloc_size vs ksize().

[ztong0001]

In D119816#3346575, @kees wrote:

FWIW, related problems with pskb_expand_head were seen again here:
https://github.com/ClangBuiltLinux/linux/issues/1599

I have trouble reproducing it, but I think the kernel patch there solves the problem created by __alloc_size vs ksize().

yes, the asm ("" : "=r" (p) : "0" (p)); really did the trick

[melver]

LGTM

Let me know if you need help landing this.

[ztong0001]

Hi Marco,
@melver, Could you please help me landing it? I don't have write permission to the repo.
Please use Tong Zhang<[e-mail]>
Thanks,

• Tong

[ztong0001]

Hi Marco,
@melver, Could you please help me landing it? I don't have write permission to the repo.
Please use Tong Zhang<[e-mail]>
Thanks,

Tong

[melver]

In D119816#3349076, @ztong0001 wrote:

Hi Marco,
@melver, Could you please help me landing it? I don't have write permission to the repo.
Please use Tong Zhang<[e-mail]>

Sure. I had already applied the patch locally to test, but then got distracted. Doing it now.

Thanks for your work.

clang/lib/CodeGen/CodeGenFunction.cpp

if (SanOpts.has(SanitizerKind::ID))                                          \
     if (CGM.isInNoSanitizeList(SanitizerKind::ID, Fn, Loc))                    \
       SanOpts.set(SanitizerKind::ID, false);
 
 #include "clang/Basic/Sanitizers.def"
 #undef SANITIZER
   } while (false);
 
   if (D) {
+    const bool SanitizeBounds = SanOpts.hasOneOf(SanitizerKind::Bounds);
     bool NoSanitizeCoverage = false;
 
     for (auto Attr : D->specific_attrs<NoSanitizeAttr>()) {
       // Apply the no_sanitize* attributes to SanOpts.
       SanitizerMask mask = Attr->getMask();
       SanOpts.Mask &= ~mask;
       if (mask & SanitizerKind::Address)
         SanOpts.set(SanitizerKind::KernelAddress, false);
       if (mask & SanitizerKind::KernelAddress)
         SanOpts.set(SanitizerKind::Address, false);
       if (mask & SanitizerKind::HWAddress)
         SanOpts.set(SanitizerKind::KernelHWAddress, false);
       if (mask & SanitizerKind::KernelHWAddress)
         SanOpts.set(SanitizerKind::HWAddress, false);
 
       // SanitizeCoverage is not handled by SanOpts.
       if (Attr->hasCoverage())
         NoSanitizeCoverage = true;
     }
 
+    if (SanitizeBounds && !SanOpts.hasOneOf(SanitizerKind::Bounds))
+      Fn->addFnAttr(llvm::Attribute::NoSanitizeBounds);
+
     if (NoSanitizeCoverage && CGM.getCodeGenOpts().hasSanitizeCoverage())
       Fn->addFnAttr(llvm::Attribute::NoSanitizeCoverage);
   }
 
   if (ShouldSkipSanitizerInstrumentation()) {
     CurFn->addFnAttr(llvm::Attribute::DisableSanitizerInstrumentation);
   } else {
     // Apply sanitizer attributes to the function.

clang/test/CodeGen/bounds-checking.c

 
 // CHECK-LABEL: define {{.*}} @f5
 int f5(union U *u, int i) {
   // c is not a flexible array member.
   // NONLOCAL: call {{.*}} @llvm.ubsantrap
   return u->c[i];
   // CHECK: }
 }
+
+__attribute__((no_sanitize("bounds")))
+int f6(int i) {
+  int b[64];
+  // CHECK-NOT: call void @llvm.trap()
+  // CHECK-NOT: trap:
+  // CHECK-NOT: cont:
+  return b[i];
+}

clang/test/CodeGen/sanitize-coverage.c

 // CHECK-LABEL: define dso_local void @test_no_sanitize_combined(
 __attribute__((no_sanitize("address", "memory", "thread", "bounds", "undefined", "coverage")))
 void test_no_sanitize_combined(int n) {
   // CHECK-NOT: call void @__sanitizer_cov_trace_pc
   // CHECK-NOT: call void @__sanitizer_cov_trace_const_cmp
   // ASAN-NOT: call void @__asan_report_store
   // MSAN-NOT: call void @__msan_warning
   // BOUNDS-NOT: call void @__ubsan_handle_out_of_bounds
+  // BOUNDS-NOT: call void @llvm.trap()
   // TSAN-NOT: call void @__tsan_func_entry
   // UBSAN-NOT: call void @__ubsan_handle
   if (n)
     x[n] = 42;
 }
 
 // CHECK-LABEL: define dso_local void @test_no_sanitize_separate(
 __attribute__((no_sanitize("address")))
 __attribute__((no_sanitize("memory")))
 __attribute__((no_sanitize("thread")))
 __attribute__((no_sanitize("bounds")))
 __attribute__((no_sanitize("undefined")))
 __attribute__((no_sanitize("coverage")))
 void test_no_sanitize_separate(int n) {
   // CHECK-NOT: call void @__sanitizer_cov_trace_pc
   // CHECK-NOT: call void @__sanitizer_cov_trace_const_cmp
   // ASAN-NOT: call void @__asan_report_store
   // MSAN-NOT: call void @__msan_warning
   // BOUNDS-NOT: call void @__ubsan_handle_out_of_bounds
+  // BOUNDS-NOT: call void @llvm.trap()
   // TSAN-NOT: call void @__tsan_func_entry
   // UBSAN-NOT: call void @__ubsan_handle
   if (n)
     x[n] = 42;
 }
 
 // CHECK-LABEL: define dso_local void @test_no_sanitize_always_inline(
 __attribute__((no_sanitize("coverage")))
 void test_no_sanitize_always_inline(int n) {
   // CHECK-NOT: call void @__sanitizer_cov_trace_pc
   // CHECK-NOT: call void @__sanitizer_cov_trace_const_cmp
   always_inlined_fn(n);
 }
 
 // CHECK-LABEL: declare void

llvm/bindings/go/llvm/ir_test.go

attrTests := []string{
     "noduplicate",
     "noimplicitfloat",
     "noinline",
     "nonlazybind",
     "nonnull",
     "noredzone",
     "noreturn",
     "nounwind",
+    "nosanitize_bounds",
     "nosanitize_coverage",
     "optnone",
     "optsize",
     "readnone",
     "readonly",
     "returned",
     "returns_twice",
     "signext",

llvm/docs/BitCodeFormat.rst

 * code 68: ``noundef``
 * code 69: ``byref``
 * code 70: ``mustprogress``
 * code 74: ``vscale_range(<Min>[, <Max>])``
 * code 75: ``swiftasync``
 * code 76: ``nosanitize_coverage``
 * code 77: ``elementtype``
 * code 78: ``disable_sanitizer_instrumentation``
+* code 79: ``nosanitize_bounds``
 
 .. note::
   The ``allocsize`` attribute has a special encoding for its arguments. Its two
   arguments, which are 32-bit integers, are packed into one 64-bit integer value
   (i.e. ``(EltSizeParam << 32) | NumEltsParam``), with ``NumEltsParam`` taking on
   the sentinel value -1 if it is not specified.
 
 .. note::

llvm/docs/LangRef.rst

``nosync``
     the behavior is undefined.
 ``nounwind``
     This function attribute indicates that the function never raises an
     exception. If the function does raise an exception, its runtime
     behavior is undefined. However, functions marked nounwind may still
     trap or generate asynchronous exceptions. Exception handling schemes
     that are recognized by LLVM to handle asynchronous exceptions, such
     as SEH, will still provide their implementation defined semantics.
+``nosanitize_bounds``
+    This attribute indicates that bounds checking sanitizer instrumentation
+    is disabled for this function.
 ``nosanitize_coverage``
     This attribute indicates that SanitizerCoverage instrumentation is disabled
     for this function.
 ``null_pointer_is_valid``
    If ``null_pointer_is_valid`` is set, then the ``null`` address
    in address-space 0 is considered to be a valid address for memory loads and
    stores. Any analysis or optimization should not treat dereferencing a
    pointer to ``null`` as undefined behavior in this function.

llvm/include/llvm/AsmParser/LLToken.h

enum Kind {
   kw_nomerge,
   kw_nonnull,
   kw_noprofile,
   kw_noredzone,
   kw_noreturn,
   kw_nosync,
   kw_nocf_check,
   kw_nounwind,
+  kw_nosanitize_bounds,
   kw_nosanitize_coverage,
   kw_null_pointer_is_valid,
   kw_optforfuzzing,
   kw_optnone,
   kw_optsize,
   kw_preallocated,
   kw_readnone,
   kw_readonly,

llvm/include/llvm/Bitcode/LLVMBitCodes.h

enum AttributeKindCodes {
   ATTR_KIND_NO_CALLBACK = 71,
   ATTR_KIND_HOT = 72,
   ATTR_KIND_NO_PROFILE = 73,
   ATTR_KIND_VSCALE_RANGE = 74,
   ATTR_KIND_SWIFT_ASYNC = 75,
   ATTR_KIND_NO_SANITIZE_COVERAGE = 76,
   ATTR_KIND_ELEMENTTYPE = 77,
   ATTR_KIND_DISABLE_SANITIZER_INSTRUMENTATION = 78,
+  ATTR_KIND_NO_SANITIZE_BOUNDS = 79,
 };
 
 enum ComdatSelectionKindCodes {
   COMDAT_SELECTION_KIND_ANY = 1,
   COMDAT_SELECTION_KIND_EXACT_MATCH = 2,
   COMDAT_SELECTION_KIND_LARGEST = 3,
   COMDAT_SELECTION_KIND_NO_DUPLICATES = 4,
   COMDAT_SELECTION_KIND_SAME_SIZE = 5,

llvm/include/llvm/IR/Attributes.td

 def NoCfCheck : EnumAttr<"nocf_check", [FnAttr]>;
 
 /// Function should not be instrumented.
 def NoProfile : EnumAttr<"noprofile", [FnAttr]>;
 
 /// Function doesn't unwind stack.
 def NoUnwind : EnumAttr<"nounwind", [FnAttr]>;
 
+/// No SanitizeBounds instrumentation.
+def NoSanitizeBounds : EnumAttr<"nosanitize_bounds", [FnAttr]>;
+
 /// No SanitizeCoverage instrumentation.
 def NoSanitizeCoverage : EnumAttr<"nosanitize_coverage", [FnAttr]>;
 
 /// Null pointer in address space zero is valid.
 def NullPointerIsValid : EnumAttr<"null_pointer_is_valid", [FnAttr]>;
 
 /// Select optimizations for best fuzzing signal.
 def OptForFuzzing : EnumAttr<"optforfuzzing", [FnAttr]>;

llvm/lib/AsmParser/LLLexer.cpp

#define KEYWORD(STR)                                                           \
   KEYWORD(nonnull);
   KEYWORD(noprofile);
   KEYWORD(noredzone);
   KEYWORD(noreturn);
   KEYWORD(nosync);
   KEYWORD(nocf_check);
   KEYWORD(noundef);
   KEYWORD(nounwind);
+  KEYWORD(nosanitize_bounds);
   KEYWORD(nosanitize_coverage);
   KEYWORD(null_pointer_is_valid);
   KEYWORD(optforfuzzing);
   KEYWORD(optnone);
   KEYWORD(optsize);
   KEYWORD(preallocated);
   KEYWORD(readnone);
   KEYWORD(readonly);

llvm/lib/Bitcode/Reader/BitcodeReader.cpp

static Attribute::AttrKind getAttrFromCode(uint64_t Code) {
   case bitc::ATTR_KIND_NOSYNC:
     return Attribute::NoSync;
   case bitc::ATTR_KIND_NOCF_CHECK:
     return Attribute::NoCfCheck;
   case bitc::ATTR_KIND_NO_PROFILE:
     return Attribute::NoProfile;
   case bitc::ATTR_KIND_NO_UNWIND:
     return Attribute::NoUnwind;
+  case bitc::ATTR_KIND_NO_SANITIZE_BOUNDS:
+    return Attribute::NoSanitizeBounds;
   case bitc::ATTR_KIND_NO_SANITIZE_COVERAGE:
     return Attribute::NoSanitizeCoverage;
   case bitc::ATTR_KIND_NULL_POINTER_IS_VALID:
     return Attribute::NullPointerIsValid;
   case bitc::ATTR_KIND_OPT_FOR_FUZZING:
     return Attribute::OptForFuzzing;
   case bitc::ATTR_KIND_OPTIMIZE_FOR_SIZE:
     return Attribute::OptimizeForSize;

llvm/lib/Bitcode/Writer/BitcodeWriter.cpp

static uint64_t getAttrKindEncoding(Attribute::AttrKind Kind) {
   case Attribute::NoSync:
     return bitc::ATTR_KIND_NOSYNC;
   case Attribute::NoCfCheck:
     return bitc::ATTR_KIND_NOCF_CHECK;
   case Attribute::NoProfile:
     return bitc::ATTR_KIND_NO_PROFILE;
   case Attribute::NoUnwind:
     return bitc::ATTR_KIND_NO_UNWIND;
+  case Attribute::NoSanitizeBounds:
+    return bitc::ATTR_KIND_NO_SANITIZE_BOUNDS;
   case Attribute::NoSanitizeCoverage:
     return bitc::ATTR_KIND_NO_SANITIZE_COVERAGE;
   case Attribute::NullPointerIsValid:
     return bitc::ATTR_KIND_NULL_POINTER_IS_VALID;
   case Attribute::OptForFuzzing:
     return bitc::ATTR_KIND_OPT_FOR_FUZZING;
   case Attribute::OptimizeForSize:
     return bitc::ATTR_KIND_OPTIMIZE_FOR_SIZE;

llvm/lib/Transforms/Instrumentation/BoundsChecking.cpp

static void insertBoundsCheck(Value *Or, BuilderTy &IRB, GetTrapBBT GetTrapBB) {
   }
 
   // Create the conditional branch.
   BranchInst::Create(GetTrapBB(IRB), Cont, Or, OldBB);
 }
 
 static bool addBoundsChecking(Function &F, TargetLibraryInfo &TLI,
                               ScalarEvolution &SE) {
+  if (F.hasFnAttribute(Attribute::NoSanitizeBounds))
+    return false;
+
   const DataLayout &DL = F.getParent()->getDataLayout();
   ObjectSizeOpts EvalOpts;
   EvalOpts.RoundToAlign = true;
   ObjectSizeOffsetEvaluator ObjSizeEval(DL, &TLI, F.getContext(), EvalOpts);
 
   // check HANDLE_MEMORY_INST in include/llvm/Instruction.def for memory
   // touching instructions
   SmallVector<std::pair<Instruction *, Value *>, 4> TrapInfo;

llvm/lib/Transforms/Utils/CodeExtractor.cpp

if (Attr.isStringAttribute()) {
       case Attribute::NoCallback:
       case Attribute::NoDuplicate:
       case Attribute::NoFree:
       case Attribute::NoImplicitFloat:
       case Attribute::NoInline:
       case Attribute::NonLazyBind:
       case Attribute::NoRedZone:
       case Attribute::NoUnwind:
+      case Attribute::NoSanitizeBounds:
       case Attribute::NoSanitizeCoverage:
       case Attribute::NullPointerIsValid:
       case Attribute::OptForFuzzing:
       case Attribute::OptimizeNone:
       case Attribute::OptimizeForSize:
       case Attribute::SafeStack:
       case Attribute::ShadowCallStack:
       case Attribute::SanitizeAddress:

llvm/test/Bitcode/attributes.ll

define void @f84() uwtable(sync) {
         ret void;
 }
 
 ; CHECK: define void @f85() #15
 define void @f85() uwtable(async) {
         ret void;
 }
 
+; CHECK: define void @f86() #52
+define void @f86() nosanitize_bounds
+{
+        ret void;
+}
+
 ; CHECK: attributes #0 = { noreturn }
 ; CHECK: attributes #1 = { nounwind }
 ; CHECK: attributes #2 = { readnone }
 ; CHECK: attributes #3 = { readonly }
 ; CHECK: attributes #4 = { noinline }
 ; CHECK: attributes #5 = { alwaysinline }
 ; CHECK: attributes #6 = { optsize }
 ; CHECK: attributes #7 = { ssp }

 ; CHECK: attributes #44 = { hot }
 ; CHECK: attributes #45 = { vscale_range(8,8) }
 ; CHECK: attributes #46 = { vscale_range(1,8) }
 ; CHECK: attributes #47 = { vscale_range(1,0) }
 ; CHECK: attributes #48 = { nosanitize_coverage }
 ; CHECK: attributes #49 = { noprofile }
 ; CHECK: attributes #50 = { disable_sanitizer_instrumentation }
 ; CHECK: attributes #51 = { uwtable(sync) }
+; CHECK: attributes #52 = { nosanitize_bounds }
 ; CHECK: attributes #[[NOBUILTIN]] = { nobuiltin }

llvm/test/Bitcode/compatibility.ll

exit:
   ; CHECK: phi i32 [ %v1, %L1 ], [ %v2, %L2 ], [ %op1, %entry ]
 
   select i1 true, i32 0, i32 1
   ; CHECK: select i1 true, i32 0, i32 1
   select <2 x i1> <i1 true, i1 false>, <2 x i8> <i8 2, i8 3>, <2 x i8> <i8 3, i8 2>
   ; CHECK: select <2 x i1> <i1 true, i1 false>, <2 x i8> <i8 2, i8 3>, <2 x i8> <i8 3, i8 2>
 
   call void @f.nobuiltin() builtin
-  ; CHECK: call void @f.nobuiltin() #48
+  ; CHECK: call void @f.nobuiltin() #49
 
   call fastcc noalias i32* @f.noalias() noinline
   ; CHECK: call fastcc noalias i32* @f.noalias() #12
   tail call ghccc nonnull i32* @f.nonnull() minsize
   ; CHECK: tail call ghccc nonnull i32* @f.nonnull() #7
 
   freeze i32 %op1
   ; CHECK: freeze i32 %op1

 
 declare void @f.allocsize_one(i32) allocsize(0)
 declare void @f.allocsize_two(i32, i32) allocsize(1, 0)
 ; CHECK: Function Attrs: allocsize(0)
 ; CHECK: declare void @f.allocsize_one(i32)
 ; CHECK: Function Attrs: allocsize(1,0)
 ; CHECK: declare void @f.allocsize_two(i32, i32)
 
+declare void @f.nosanitize_bounds() nosanitize_bounds
+; CHECK: declare void @f.nosanitize_bounds() #48
+
 ; CHECK: attributes #0 = { alignstack=4 }
 ; CHECK: attributes #1 = { alignstack=8 }
 ; CHECK: attributes #2 = { alwaysinline }
 ; CHECK: attributes #3 = { cold }
 ; CHECK: attributes #4 = { convergent }
 ; CHECK: attributes #5 = { inlinehint }
 ; CHECK: attributes #6 = { jumptable }
 ; CHECK: attributes #7 = { minsize }

 ; CHECK: attributes #40 = { inaccessiblemem_or_argmemonly nofree nosync nounwind willreturn }
 ; CHECK: attributes #41 = { writeonly }
 ; CHECK: attributes #42 = { speculatable }
 ; CHECK: attributes #43 = { strictfp }
 ; CHECK: attributes #44 = { nosanitize_coverage }
 ; CHECK: attributes #45 = { disable_sanitizer_instrumentation }
 ; CHECK: attributes #46 = { allocsize(0) }
 ; CHECK: attributes #47 = { allocsize(1,0) }
-; CHECK: attributes #48 = { builtin }
+; CHECK: attributes #48 = { nosanitize_bounds }
+; CHECK: attributes #49 = { builtin }
 
 ;; Metadata
 
 ; Metadata -- Module flags
 !llvm.module.flags = !{!0, !1, !2, !4, !5, !6}
 ; CHECK: !llvm.module.flags = !{!0, !1, !2, !4, !5, !6}
 
 !0 = !{i32 1, !"mod1", i32 0}

llvm/test/Instrumentation/BoundsChecking/nosanitize-bounds.ll

+; RUN: opt < %s -passes=bounds-checking -S | FileCheck %s
+target datalayout = "e-p:64:64:64-p1:16:16:16-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
+
+; CHECK: @foo
+define i32 @foo(i32 %i) nosanitize_bounds {
+entry:
+  %i.addr = alloca i32, align 4
+  %b = alloca [64 x i32], align 16
+  store i32 %i, i32* %i.addr, align 4
+  %0 = load i32, i32* %i.addr, align 4
+  %idxprom = sext i32 %0 to i64
+  %arrayidx = getelementptr inbounds [64 x i32], [64 x i32]* %b, i64 0, i64 %idxprom
+  %1 = load i32, i32* %arrayidx, align 4
+  ret i32 %1
+; CHECK-NOT: call void @llvm.trap()
+}
+

llvm/utils/emacs/llvm-mode.el

 
 (defvar llvm-font-lock-keywords
   (list
    ;; Attributes
    `(,(regexp-opt
        '("alwaysinline" "argmemonly" "allocsize" "builtin" "cold" "convergent" "dereferenceable" "dereferenceable_or_null" "hot" "inaccessiblememonly"
          "inaccessiblemem_or_argmemonly" "inalloca" "inlinehint" "jumptable" "minsize" "mustprogress" "naked" "nobuiltin" "nonnull"
          "nocallback" "nocf_check" "noduplicate" "nofree" "noimplicitfloat" "noinline" "nomerge" "nonlazybind" "noprofile" "noredzone" "noreturn"
-         "norecurse" "nosync" "noundef" "nounwind" "nosanitize_coverage" "null_pointer_is_valid" "optforfuzzing" "optnone" "optsize" "preallocated" "readnone" "readonly" "returned" "returns_twice"
+         "norecurse" "nosync" "noundef" "nounwind" "nosanitize_bounds" "nosanitize_coverage" "null_pointer_is_valid" "optforfuzzing" "optnone" "optsize" "preallocated" "readnone" "readonly" "returned" "returns_twice"
          "shadowcallstack" "speculatable" "speculative_load_hardening" "ssp" "sspreq" "sspstrong" "safestack" "sanitize_address" "sanitize_hwaddress" "sanitize_memtag"
          "sanitize_thread" "sanitize_memory" "strictfp" "swifterror" "uwtable" "vscale_range" "willreturn" "writeonly" "immarg") 'symbols) . font-lock-constant-face)
    ;; Variables
    '("%[-a-zA-Z$._][-a-zA-Z$._0-9]*" . font-lock-variable-name-face)
    ;; Labels
    '("[-a-zA-Z$._0-9]+:" . font-lock-variable-name-face)
    ;; Unnamed variable slots
    '("%[-]?[0-9]+" . font-lock-variable-name-face)

llvm/utils/llvm.grm

  | ssp
  | sspreq
  | returns_twice
  | nonlazybind
  | sanitize_address
  | sanitize_thread
  | sanitize_memory
  | mustprogress
+ | nosanitize_bounds
  | nosanitize_coverage
  ;
 
 OptFuncAttrs  ::= + _ | OptFuncAttrs FuncAttr ;
 
 OptGC         ::= + _ | gc STRINGCONSTANT ;
 
 OptAlign      ::= + _ | align EUINT64VAL ;

llvm/utils/vim/syntax/llvm.vim

syn keyword llvmKeyword
       \ nonnull
       \ noprofile
       \ norecurse
       \ noredzone
       \ noreturn
       \ nosync
       \ noundef
       \ nounwind
+      \ nosanitize_bounds
       \ nosanitize_coverage
       \ null_pointer_is_valid
       \ optforfuzzing
       \ optnone
       \ optsize
       \ personality
       \ preallocated
       \ private

llvm/utils/vscode/llvm/syntaxes/ll.tmLanguage.yaml

- match: "\\bacq_rel\\b|\
             \\bnonnull\\b|\
             \\bnoprofile\\b|\
             \\bnorecurse\\b|\
             \\bnoredzone\\b|\
             \\bnoreturn\\b|\
             \\bnosync\\b|\
             \\bnoundef\\b|\
             \\bnounwind\\b|\
+            \\bnosanitize_bounds\\b|\
             \\bnosanitize_coverage\\b|\
             \\bnull_pointer_is_valid\\b|\
             \\boptforfuzzing\\b|\
             \\boptnone\\b|\
             \\boptsize\\b|\
             \\bpersonality\\b|\
             \\bpreallocated\\b|\
             \\bprivate\\b|\