[ModuleUtils][KCFI] Set !kcfi_type metadata for sanitizer constructors

[samitolvanen]

Summary

Set KCFI type metadata for the sanitizer constructors to prevent
runtime failures when these functions are indirectly called in
instrumented code. This fixes a compatibility issue with KASAN and
-fsanitize=kcfi in the Linux kernel.

Link: https://github.com/ClangBuiltLinux/linux/issues/1742

[samitolvanen]

Added a test.

[MaskRay]

LGTM.

llvm/lib/Transforms/Utils/ModuleUtils.cpp

121

Add a comment that this matches CodeGenModule::CreateKCFITypeId in Clang.

llvm/test/Instrumentation/AddressSanitizer/kcfi.ll

1

12

delete trailing blank line

remove excess indentation

[samitolvanen]

Addressed feedback.

[MaskRay]

llvm/test/Instrumentation/AddressSanitizer/kcfi.ll

11

fix the next line as well

[samitolvanen]

Really fix the indentation this time...

llvm/lib/Transforms/Utils/ModuleUtils.cpp

 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 #include "llvm/Analysis/VectorUtils.h"
 #include "llvm/IR/DerivedTypes.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/IRBuilder.h"
+#include "llvm/IR/MDBuilder.h"
 #include "llvm/IR/Module.h"
 #include "llvm/Support/raw_ostream.h"
+#include "llvm/Support/xxhash.h"
 using namespace llvm;
 
 #define DEBUG_TYPE "moduleutils"
 
 static void appendToGlobalArray(StringRef ArrayName, Module &M, Function *F,
                                 int Priority, Constant *Data) {
   IRBuilder<> IRB(M.getContext());
   FunctionType *FnTy = FunctionType::get(IRB.getVoidTy(), false);

 void llvm::appendToUsed(Module &M, ArrayRef<GlobalValue *> Values) {
   appendToUsedList(M, "llvm.used", Values);
 }
 
 void llvm::appendToCompilerUsed(Module &M, ArrayRef<GlobalValue *> Values) {
   appendToUsedList(M, "llvm.compiler.used", Values);
 }
 
+static void setKCFIType(Module &M, Function &F, StringRef MangledType) {
+  if (!M.getModuleFlag("kcfi"))
+    return;
+
+  LLVMContext &Ctx = M.getContext();
+  MDBuilder MDB(Ctx);
+  F.setMetadata(
+      LLVMContext::MD_kcfi_type,
+      MDNode::get(Ctx, MDB.createConstant(ConstantInt::get(
+                           Type::getInt32Ty(Ctx),
+                           static_cast<uint32_t>(xxHash64(MangledType))))));
+}
+
 FunctionCallee
 llvm::declareSanitizerInitFunction(Module &M, StringRef InitName,
                                    ArrayRef<Type *> InitArgTypes) {
   assert(!InitName.empty() && "Expected init function name");
   return M.getOrInsertFunction(
       InitName,
       FunctionType::get(Type::getVoidTy(M.getContext()), InitArgTypes, false),
       AttributeList());
 }
 
 Function *llvm::createSanitizerCtor(Module &M, StringRef CtorName) {
   Function *Ctor = Function::createWithDefaultAttr(
       FunctionType::get(Type::getVoidTy(M.getContext()), false),
       GlobalValue::InternalLinkage, M.getDataLayout().getProgramAddressSpace(),
       CtorName, &M);
   Ctor->addFnAttr(Attribute::NoUnwind);
+  setKCFIType(M, *Ctor, "_ZTSFvvE"); // void (*)(void)
   BasicBlock *CtorBB = BasicBlock::Create(M.getContext(), "", Ctor);
   ReturnInst::Create(M.getContext(), CtorBB);
   // Ensure Ctor cannot be discarded, even if in a comdat.
   appendToUsed(M, {Ctor});
   return Ctor;
 }
 
 std::pair<Function *, FunctionCallee> llvm::createSanitizerCtorAndInitFunctions(

llvm/test/Instrumentation/AddressSanitizer/kcfi.ll

+; Test that we emit kcfi_type metadata for asan.module_ctor with KCFI.
+
+; RUN: opt < %s -passes=asan -S | FileCheck %s
+
+; CHECK: @llvm.global_ctors = {{.*}}{ i32 1, ptr @asan.module_ctor, ptr @asan.module_ctor }
+
+; CHECK: define internal void @asan.module_ctor()
+; CHECK-SAME: !kcfi_type
+
+  !llvm.module.flags = !{!0}
+  !0 = !{i32 4, !"kcfi", i32 1}
+