[sanitizers] Initial implementation for -fsanitize=init-locals

[glider]

Summary

This patch adds a new feature, -fsanitize=init-locals, which generates zero initializers for uninitialized local variables.

There's been discussions in the security community about the impact of zero-initializing all locals to prevent information leaks. The new feature shall help evaluating the pros and cons of such an approach.

Credits for the code go to Daniel Micay (original patch is at https://github.com/AndroidHardeningArchive/platform_external_clang/commit/776a0955ef6686d23a82d2e6a3cbd4a6a882c31c)

[lebedev.ri]

include/clang/Basic/Sanitizers.def

163

Unless i'm mistaken, I suspect you may see some surprising behavior here, unfortunately.
Bug 39425 - SanitizerOrdinal is out of bits

[kcc]

This new flag inhibits the warnings from -Wuninitialized, right?
While this is fine for experimenting (and I want to have this in ToT to enable wide experimentation)
we should clearly state (in the comments) that the final intent is to make the feature work together with -Wuninitialized.

Another thing that we will need (and not necessary in the first change) is to have fine grained controls over what we zero-initialize.
We may want to make separate decisions for pointer/non-pointer scalars, PODs, arrays of {scalars, pointers, PODs}, etc.

[glider]

In D54473#1297460, @kcc wrote:

This new flag inhibits the warnings from -Wuninitialized, right?
While this is fine for experimenting (and I want to have this in ToT to enable wide experimentation)
we should clearly state (in the comments) that the final intent is to make the feature work together with -Wuninitialized.

No, as far as I can see, the warnings from -Wuninitialized are still present (see the test).

Another thing that we will need (and not necessary in the first change) is to have fine grained controls over what we zero-initialize.
We may want to make separate decisions for pointer/non-pointer scalars, PODs, arrays of {scalars, pointers, PODs}, etc.

Ok, noted.

[glider]

include/clang/Basic/Sanitizers.def

163

Um, this is unfortunate.
We don't strictly need this feature to live under -fsanitize= flag, although having the corresponding attribute could've been handy.

[kcc]

I think you can safely abandon this change in favor of https://reviews.llvm.org/D54604 -- please join the review there.

include/clang/Basic/Sanitizers.def

 
 // EfficiencySanitizer
 SANITIZER("efficiency-cache-frag", EfficiencyCacheFrag)
 SANITIZER("efficiency-working-set", EfficiencyWorkingSet)
 // Meta-group only used internally.
 SANITIZER_GROUP("efficiency-all", Efficiency,
                 EfficiencyCacheFrag | EfficiencyWorkingSet)
 
+// Initialize local variables.
+SANITIZER("init-locals", InitLocals)
+
 // Scudo hardened allocator
 SANITIZER("scudo", Scudo)
 
 // Magic group, containing all sanitizers. For example, "-fno-sanitize=all"
 // can be used to disable all the sanitizers.
 SANITIZER_GROUP("all", All, ~0ULL)
 
 #undef SANITIZER
 #undef SANITIZER_GROUP

lib/CodeGen/CGDecl.cpp

if (!Init &&
           QualType::PDIK_Struct) {
     LValue Dst = MakeAddrLValue(emission.getAllocatedAddress(), type);
     if (emission.IsEscapingByRef)
       drillIntoBlockVariable(*this, Dst, &D);
     defaultInitNonTrivialCStructVar(Dst);
     return;
   }
 
-  if (isTrivialInitializer(Init))
+  bool trivial = isTrivialInitializer(Init);
+  if (trivial && !getLangOpts().Sanitize.has(SanitizerKind::InitLocals))
     return;
 
   // Check whether this is a byref variable that's potentially
   // captured and moved by its own initializer.  If so, we'll need to
   // emit the initializer first, then copy into the variable.
   bool capturedByInit = emission.IsEscapingByRef && isCapturedBy(D, Init);
 
   Address Loc =
     capturedByInit ? emission.Addr : emission.getObjectAddress(*this);
 
+  bool constantAggregate = emission.IsConstantAggregate;
+
   llvm::Constant *constant = nullptr;
-  if (emission.IsConstantAggregate || D.isConstexpr()) {
+  if (trivial) {
+    QualType Ty = D.getType();
+    constant = CGM.EmitNullConstant(Ty);
+    if (Ty->isArrayType() || Ty->isRecordType())
+      constantAggregate = true;
+  } else if (emission.IsConstantAggregate || D.isConstexpr()) {
     assert(!capturedByInit && "constant init contains a capturing block?");
     constant = ConstantEmitter(*this).tryEmitAbstractForInitializer(D);
   }
 
   if (!constant) {
     LValue lv = MakeAddrLValue(Loc, type);
     lv.setNonGC(true);
     return EmitExprAsInit(Init, &D, lv, capturedByInit);
   }
 
-  if (!emission.IsConstantAggregate) {
+  if (!constantAggregate) {
     // For simple scalar/complex initialization, store the value directly.
     LValue lv = MakeAddrLValue(Loc, type);
     lv.setNonGC(true);
     return EmitStoreThroughLValue(RValue::get(constant), lv, true);
   }
 
   // If this is a simple aggregate initialization, we can optimize it
   // in various ways.

lib/Driver/ToolChain.cpp

 SanitizerMask ToolChain::getSupportedSanitizers() const {
   // Return sanitizers which don't require runtime support and are not
   // platform dependent.
 
   using namespace SanitizerKind;
 
   SanitizerMask Res = (Undefined & ~Vptr & ~Function) | (CFI & ~CFIICall) |
                       CFICastStrict | UnsignedIntegerOverflow |
-                      ImplicitConversion | Nullability | LocalBounds;
+                      ImplicitConversion | Nullability | LocalBounds | InitLocals;
   if (getTriple().getArch() == llvm::Triple::x86 ||
       getTriple().getArch() == llvm::Triple::x86_64 ||
       getTriple().getArch() == llvm::Triple::arm ||
       getTriple().getArch() == llvm::Triple::aarch64 ||
       getTriple().getArch() == llvm::Triple::wasm32 ||
       getTriple().getArch() == llvm::Triple::wasm64)
     Res |= CFIICall;
   if (getTriple().getArch() == llvm::Triple::x86_64 ||

test/CodeGen/sanitize-init-locals.c

+// Test for -fsanitize=init-locals.
+
+// RUN: %clang_cc1 %s -O0 -triple x86_64-unknown-linux-gnu -emit-llvm -o - | FileCheck %s
+// RUN: %clang_cc1 %s -O0 -triple x86_64-unknown-linux-gnu -fsanitize=init-locals -emit-llvm -o - | FileCheck -check-prefixes=CHECK,CHECK-INIT-LOCALS %s
+// RUN: %clang_cc1 %s -O0 -triple x86_64-unknown-linux-gnu -Wuninitialized -emit-llvm -o - 2>&1 | FileCheck -check-prefix=CHECK-WUNINITIALIZED %s
+// RUN: %clang_cc1 %s -O0 -triple x86_64-unknown-linux-gnu -Wuninitialized -fsanitize=init-locals -emit-llvm -o - 2>&1 | FileCheck -check-prefix=CHECK-WUNINITIALIZED %s
+
+
+// CHECK: @testSanitizeInitLocals.local_array_init_part = private unnamed_addr constant [5 x i32] [i32 0, i32 1, i32 2, i32 0, i32 0], align 16
+// CHECK: @testSanitizeInitLocals.local_array_init = private unnamed_addr constant [5 x i32] [i32 0, i32 1, i32 2, i32 3, i32 4], align 16
+
+// CHECK: %local_int_uninit = alloca i32, align 4
+// CHECK: %local_int_init_0 = alloca i32, align 4
+// CHECK: %local_int_init = alloca i32, align 4
+// CHECK: %local_array_uninit = alloca [5 x i32], align 16
+// CHECK: %local_array_init_part = alloca [5 x i32], align 16
+// CHECK: %local_array_init = alloca [5 x i32], align 16
+
+// CHECK-INIT-LOCALS: store i32 0, i32* %local_int_uninit, align 4
+// CHECK: store i32 0, i32* %local_int_init_0, align 4
+// CHECK: store i32 1, i32* %local_int_init, align 4
+//
+// CHECK-INIT-LOCALS: [[CAST0:%.*]] = {{.*}}%local_array_uninit
+// CHECK-INIT-LOCALS: call void @llvm.memset{{.*}}({{.*}}[[CAST0]], i8 0, i64 20
+// CHECK: [[CAST1:%.*]] = {{.*}}%local_array_init_part
+// CHECK: call void @llvm.memcpy{{.*}}({{.*}}[[CAST1]], {{.*}}@testSanitizeInitLocals.local_array_init_part{{.*}}, {{.*}} 20
+// CHECK: [[CAST2:%.*]] = {{.*}}%local_array_init
+// CHECK: call void @llvm.memcpy{{.*}}({{.*}}[[CAST2]], {{.*}}@testSanitizeInitLocals.local_array_init{{.*}}, {{.*}} 20
+
+// CHECK-WUNINITIALIZED: warning: variable 'local_int_uninit' is uninitialized when used here
+
+int testSanitizeInitLocals(void)
+{
+  const int local_int_uninit;
+  const int local_int_init_0 = 0;
+  const int local_int_init = 1;
+  const int local_array_uninit[5];
+  const int local_array_init_part[5] = {0, 1, 2};
+  const int local_array_init[5] = {0, 1, 2, 3, 4};
+  return local_int_uninit;
+}
+