[RFC] [KASAN] Instrument globals

[glider]

Summary

Enable globals instrumentation in KASAN. To avoid breaking the kernel logic, we don't instrument non-default data sections, most of which usually contain arrays of structs or pointers.

[dvyukov]

Alex, is this still relevant? If not, please close.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

if (Comdat *C = G->getComdat()) {
     case Comdat::SameSize:
       return false;
     }
   }
 
   if (G->hasSection()) {
     StringRef Section = G->getSection();
 
+    // There are many non-default sections in the kernel, many of which contain
+    // arrays of structures and pointers, which are merged together and
+    // traversed at runtime. Instrumenting them would break the kernel.
+    if (CompileKernel)
+      return false;
+
     // Globals from llvm.metadata aren't emitted, do not instrument them.
     if (Section == "llvm.metadata") return false;
     // Do not instrument globals from special LLVM sections.
     if (Section.find("__llvm") != StringRef::npos || Section.find("__LLVM") != StringRef::npos) return false;
 
     // Do not instrument function pointers to initialization and termination
     // routines: dynamic linker will not properly handle redzones.
     if (Section.startswith(".preinit_array") ||
for (size_t i = 0; i < n; i++) {
     GlobalsToAddToUsedList.push_back(G);
   }
   appendToCompilerUsed(M, ArrayRef<GlobalValue *>(GlobalsToAddToUsedList));
 
   std::string ELFUniqueModuleId =
       (UseGlobalsGC && TargetTriple.isOSBinFormatELF()) ? getUniqueModuleId(&M)
                                                         : "";
 
-  if (!ELFUniqueModuleId.empty()) {
+  // Clang emits invalid flags for section directives when trying to instrument
+  // kernel globals with InstrumentGlobalsELF().
+  if (!ELFUniqueModuleId.empty() && !CompileKernel) {
     InstrumentGlobalsELF(IRB, M, NewGlobals, Initializers, ELFUniqueModuleId);
     *CtorComdat = true;
   } else if (UseGlobalsGC && TargetTriple.isOSBinFormatCOFF()) {
     InstrumentGlobalsCOFF(IRB, M, NewGlobals, Initializers);
   } else if (UseGlobalsGC && ShouldUseMachOGlobalsSection()) {
     InstrumentGlobalsMachO(IRB, M, NewGlobals, Initializers);
   } else {
     InstrumentGlobalsWithMetadataArray(IRB, M, NewGlobals, Initializers);

 bool AddressSanitizerModule::runOnModule(Module &M) {
   C = &(M.getContext());
   int LongSize = M.getDataLayout().getPointerSizeInBits();
   IntptrTy = Type::getIntNTy(*C, LongSize);
   TargetTriple = Triple(M.getTargetTriple());
   Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel);
   initializeCallbacks(M);
 
-  if (CompileKernel)
-    return false;
+  // No need to emit __asan_init and __asan_version_mismatch_check_vXX for the
+  // kernel.
+  std::string VersionCheckName =
+      CompileKernel
+          ? ""
+          : kAsanVersionCheckNamePrefix + std::to_string(GetAsanVersion(M));
+  std::string InitName = CompileKernel ? "" : kAsanInitName;
 
   // Create a module constructor. A destructor is created lazily because not all
   // platforms, and not all modules need it.
-  std::string VersionCheckName =
-      kAsanVersionCheckNamePrefix + std::to_string(GetAsanVersion(M));
   std::tie(AsanCtorFunction, std::ignore) = createSanitizerCtorAndInitFunctions(
-      M, kAsanModuleCtorName, kAsanInitName, /*InitArgTypes=*/{},
+      M, kAsanModuleCtorName, InitName, /*InitArgTypes=*/{},
       /*InitArgs=*/{}, VersionCheckName);
 
   bool CtorComdat = true;
   bool Changed = false;
-  // TODO(glider): temporarily disabled globals instrumentation for KASan.
   if (ClGlobals) {
     IRBuilder<> IRB(AsanCtorFunction->getEntryBlock().getTerminator());
     Changed |= InstrumentGlobals(IRB, M, &CtorComdat);
   }
 
   // Put the constructor and destructor in comdat if both
   // (1) global instrumentation is not TU-specific
   // (2) target is ELF.
   if (UseCtorComdat && TargetTriple.isOSBinFormatELF() && CtorComdat) {
+    // When building the kernel, don't emit the constructor if there're no
+    // globals.
+    if (!CompileKernel || Changed) {
       AsanCtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleCtorName));
       appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndDtorPriority,
                           AsanCtorFunction);
+    }
     if (AsanDtorFunction) {
       AsanDtorFunction->setComdat(M.getOrInsertComdat(kAsanModuleDtorName));
       appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndDtorPriority,
                           AsanDtorFunction);
     }
   } else {
     appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndDtorPriority);
     if (AsanDtorFunction)

lib/Transforms/Utils/ModuleUtils.cpp

 
 std::pair<Function *, Function *> llvm::createSanitizerCtorAndInitFunctions(
     Module &M, StringRef CtorName, StringRef InitName,
     ArrayRef<Type *> InitArgTypes, ArrayRef<Value *> InitArgs,
     StringRef VersionCheckName) {
   assert(!InitName.empty() && "Expected init function name");
   assert(InitArgs.size() == InitArgTypes.size() &&
          "Sanitizer's init function expects different number of arguments");
-  Function *InitFunction =
-      declareSanitizerInitFunction(M, InitName, InitArgTypes);
+  Function *InitFunction = nullptr;
+
   Function *Ctor = Function::Create(
       FunctionType::get(Type::getVoidTy(M.getContext()), false),
       GlobalValue::InternalLinkage, CtorName, &M);
   BasicBlock *CtorBB = BasicBlock::Create(M.getContext(), "", Ctor);
   IRBuilder<> IRB(ReturnInst::Create(M.getContext(), CtorBB));
+  if (!InitName.empty()) {
+    InitFunction = declareSanitizerInitFunction(M, InitName, InitArgTypes);
     IRB.CreateCall(InitFunction, InitArgs);
+  }
   if (!VersionCheckName.empty()) {
     Function *VersionCheckFunction =
         checkSanitizerInterfaceFunction(M.getOrInsertFunction(
             VersionCheckName, FunctionType::get(IRB.getVoidTy(), {}, false),
             AttributeList()));
     IRB.CreateCall(VersionCheckFunction, {});
   }
   return std::make_pair(Ctor, InitFunction);

test/Instrumentation/AddressSanitizer/adaptive_global_redzones.ll

 ; RUN: opt < %s -asan -asan-module -S | FileCheck %s
 ; RUN: opt < %s -asan -asan-module -asan-mapping-scale=5 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -asan-kernel=1 -S | FileCheck %s
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
 target triple = "x86_64-unknown-linux-gnu"
 
 ; Here we check that the global redzone sizes grow with the object size.
 
 @G10 = global [10 x i8] zeroinitializer, align 1
 ; CHECK: @G10 = global { [10 x i8], [54 x i8] }