[dfsan] Tracking origins at memory transfer

[stephan.yichao.zhao]

Summary

This is a part of https://reviews.llvm.org/D95835.

[morehouse]

compiler-rt/test/dfsan/origin_memcpy.c

20

Why don't we get an origin saved for these stores?

35

Currently the test triggers read of uninitialized memory, but that isn't necessary for this test. So let's initialize these two variables here.

compiler-rt/test/dfsan/origin_unaligned_memtrans.c

45

This test seems to cover all the cases from origin_memmove.c and origin_memcpy.c. Do we still need those?

[stephan.yichao.zhao]

initialized variables
added missing stacks for fn_g

[stephan.yichao.zhao]

made origin_memmove.c use aligned addresses

[stephan.yichao.zhao]

compiler-rt/test/dfsan/origin_memcpy.c

20

Thank you for catching this. Added the missing tracks in the 3 test cases.

compiler-rt/test/dfsan/origin_unaligned_memtrans.c

45

Updated origin_memmove.cc to use aligned addresses.
Then this file focuses on unaligned addresses.

[morehouse]

LGTM

compiler-rt/test/dfsan/origin_memcpy.c

+// RUN: %clang_dfsan -gmlt -DOFFSET=0 -mllvm -dfsan-track-origins=1 -mllvm -dfsan-fast-16-labels=true %s -o %t && \
+// RUN:     %run %t >%t.out 2>&1
+// RUN: FileCheck %s --check-prefix=CHECK0 < %t.out
+
+// RUN: %clang_dfsan -gmlt -DOFFSET=10 -mllvm -dfsan-track-origins=1 -mllvm -dfsan-fast-16-labels=true %s -o %t && \
+// RUN:     %run %t >%t.out 2>&1
+// RUN: FileCheck %s --check-prefix=CHECK10 < %t.out
+
+#include <sanitizer/dfsan_interface.h>
+
+#include <string.h>
+
+int xx[10000];
+int yy[10000];
+volatile int idx = 30;
+
+__attribute__((noinline))
+void fn_g(int a, int b) {
+  xx[idx] = a; xx[idx + 10] = b;
+}
+
+__attribute__((noinline))
+void fn_f(int a, int b) {
+  fn_g(a, b);
+}
+
+__attribute__((noinline))
+void fn_h() {
+  memcpy(&yy, &xx, sizeof(xx));
+}
+
+int main(int argc, char *argv[]) {
+  int volatile z1 = 0;
+  int volatile z2 = 0;
+  dfsan_set_label(8, (void *)&z1, sizeof(z1));
+  dfsan_set_label(16, (void *)&z2, sizeof(z2));
+  fn_f(z1, z2);
+  fn_h();
+  dfsan_print_origin_trace(&yy[idx + OFFSET], NULL);
+  return 0;
+}
+
+// CHECK0: Taint value 0x8 {{.*}} origin tracking ()
+// CHECK0: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK0: #0 {{.*}} in dfs$fn_h {{.*}}origin_memcpy.c:[[@LINE-16]]
+// CHECK0: #1 {{.*}} in main {{.*}}origin_memcpy.c:[[@LINE-8]]
+
+// CHECK0: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK0: #0 {{.*}} in dfs$fn_g {{.*}}origin_memcpy.c:[[@LINE-30]]
+// CHECK0: #1 {{.*}} in dfs$fn_f {{.*}}origin_memcpy.c:[[@LINE-26]]
+// CHECK0: #2 {{.*}} in main {{.*}}origin_memcpy.c:[[@LINE-14]]
+
+// CHECK0: Origin value: {{.*}}, Taint value was created at
+// CHECK0: #0 {{.*}} in main {{.*}}origin_memcpy.c:[[@LINE-19]]
+
+// CHECK10: Taint value 0x10 {{.*}} origin tracking ()
+// CHECK10: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK10: #0 {{.*}} in dfs$fn_h {{.*}}origin_memcpy.c:[[@LINE-29]]
+// CHECK10: #1 {{.*}} in main {{.*}}origin_memcpy.c:[[@LINE-21]]
+
+// CHECK10: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK10: #0 {{.*}} in dfs$fn_g {{.*}}origin_memcpy.c:[[@LINE-43]]
+// CHECK10: #1 {{.*}} in dfs$fn_f {{.*}}origin_memcpy.c:[[@LINE-39]]
+// CHECK10: #2 {{.*}} in main {{.*}}origin_memcpy.c:[[@LINE-27]]
+
+// CHECK10: Origin value: {{.*}}, Taint value was created at
+// CHECK10: #0 {{.*}} in main {{.*}}origin_memcpy.c:[[@LINE-31]]

compiler-rt/test/dfsan/origin_memmove.c

+// RUN: %clang_dfsan -gmlt -DOFFSET=0 -mllvm -dfsan-track-origins=1 -mllvm -dfsan-fast-16-labels=true %s -o %t && \
+// RUN:     %run %t >%t.out 2>&1
+// RUN: FileCheck %s --check-prefix=CHECK0 < %t.out
+
+// RUN: %clang_dfsan -gmlt -DOFFSET=10 -mllvm -dfsan-track-origins=1 -mllvm -dfsan-fast-16-labels=true %s -o %t && \
+// RUN:     %run %t >%t.out 2>&1
+// RUN: FileCheck %s --check-prefix=CHECK10 < %t.out
+
+#include <sanitizer/dfsan_interface.h>
+
+#include <string.h>
+
+int xx[10000];
+
+volatile int idx = 30;
+
+__attribute__((noinline))
+void fn_g(int a, int b) {
+  xx[idx] = a; xx[idx + 10] = b;
+}
+
+__attribute__((noinline))
+void fn_f(int a, int b) {
+  fn_g(a, b);
+}
+
+__attribute__((noinline))
+void fn_h() {
+  memmove(&xx[24], &xx, 7500);
+}
+
+int main(int argc, char *argv[]) {
+  int volatile z1 = 0;
+  int volatile z2 = 0;
+  dfsan_set_label(8, (void *)&z1, sizeof(z1));
+  dfsan_set_label(16, (void *)&z2, sizeof(z2));
+  fn_f(z1, z2);
+  fn_h();
+  dfsan_print_origin_trace(&xx[24 + idx + OFFSET], NULL);
+  return 0;
+}
+
+// CHECK0: Taint value 0x8 {{.*}} origin tracking ()
+// CHECK0: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK0: #0 {{.*}} in dfs$fn_h {{.*}}origin_memmove.c:[[@LINE-16]]
+// CHECK0: #1 {{.*}} in main {{.*}}origin_memmove.c:[[@LINE-8]]
+
+// CHECK0: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK0: #0 {{.*}} in dfs$fn_g {{.*}}origin_memmove.c:[[@LINE-30]]
+// CHECK0: #1 {{.*}} in dfs$fn_f {{.*}}origin_memmove.c:[[@LINE-26]]
+// CHECK0: #2 {{.*}} in main {{.*}}origin_memmove.c:[[@LINE-14]]
+
+// CHECK0: Origin value: {{.*}}, Taint value was created at
+// CHECK0: #0 {{.*}} in main {{.*}}origin_memmove.c:[[@LINE-19]]
+
+// CHECK10: Taint value 0x10 {{.*}} origin tracking ()
+// CHECK10: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK10: #0 {{.*}} in dfs$fn_h {{.*}}origin_memmove.c:[[@LINE-29]]
+// CHECK10: #1 {{.*}} in main {{.*}}origin_memmove.c:[[@LINE-21]]
+
+// CHECK10: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK10: #0 {{.*}} in dfs$fn_g {{.*}}origin_memmove.c:[[@LINE-43]]
+// CHECK10: #1 {{.*}} in dfs$fn_f {{.*}}origin_memmove.c:[[@LINE-39]]
+// CHECK10: #2 {{.*}} in main {{.*}}origin_memmove.c:[[@LINE-27]]
+
+// CHECK10: Origin value: {{.*}}, Taint value was created at
+// CHECK10: #0 {{.*}} in main {{.*}}origin_memmove.c:[[@LINE-31]]

compiler-rt/test/dfsan/origin_unaligned_memtrans.c

+// RUN: %clang_dfsan -gmlt -DOFFSET=0 -mllvm -dfsan-track-origins=1 -mllvm -dfsan-fast-16-labels=true %s -o %t && \
+// RUN:     %run %t >%t.out 2>&1
+// RUN: FileCheck %s --check-prefix=CHECK0 < %t.out
+
+// RUN: %clang_dfsan -gmlt -DOFFSET=10 -mllvm -dfsan-track-origins=1 -mllvm -dfsan-fast-16-labels=true %s -o %t && \
+// RUN:     %run %t >%t.out 2>&1
+// RUN: FileCheck %s --check-prefix=CHECK10 < %t.out
+
+#include <sanitizer/dfsan_interface.h>
+
+#include <string.h>
+
+char xx[10000];
+char yy[10000];
+volatile int idx = 30;
+
+__attribute__((noinline)) void fn_g(char a, char b) {
+  xx[idx] = a; xx[idx + 10] = b;
+}
+
+__attribute__((noinline)) void fn_f(char a, char b) {
+  fn_g(a, b);
+}
+
+__attribute__((noinline)) void fn_h() {
+  memcpy(&yy[2], &xx[2], sizeof(xx) - 4);
+}
+
+__attribute__((noinline)) void fn_i() {
+  memmove(&yy[25], &yy, 7500);
+}
+
+int main(int argc, char *argv[]) {
+  char volatile z1 = 0;
+  int volatile buffer = 0;
+  char volatile z2 = 0;
+  dfsan_set_label(8, (void *)&z1, sizeof(z1));
+  dfsan_set_label(16, (void *)&z2, sizeof(z2));
+  fn_f(z1, z2);
+  fn_h();
+  fn_i();
+  dfsan_print_origin_trace(&yy[25 + idx + OFFSET], NULL);
+  return 0;
+}
+
+// CHECK0: Taint value 0x8 {{.*}} origin tracking ()
+// CHECK0: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK0: #0 {{.*}} in dfs$fn_i {{.*}}origin_unaligned_memtrans.c:[[@LINE-18]]
+// CHECK0: #1 {{.*}} in main {{.*}}origin_unaligned_memtrans.c:[[@LINE-8]]
+
+// CHECK0: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK0: #0 {{.*}} in dfs$fn_h {{.*}}origin_unaligned_memtrans.c:[[@LINE-26]]
+// CHECK0: #1 {{.*}} in main {{.*}}origin_unaligned_memtrans.c:[[@LINE-13]]
+
+// CHECK0: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK0: #0 {{.*}} in dfs$fn_g {{.*}}origin_unaligned_memtrans.c:[[@LINE-38]]
+// CHECK0: #1 {{.*}} in dfs$fn_f {{.*}}origin_unaligned_memtrans.c:[[@LINE-35]]
+// CHECK0: #2 {{.*}} in main {{.*}}origin_unaligned_memtrans.c:[[@LINE-19]]
+
+// CHECK0: Origin value: {{.*}}, Taint value was created at
+// CHECK0: #0 {{.*}} in main {{.*}}origin_unaligned_memtrans.c:[[@LINE-24]]
+
+// CHECK10: Taint value 0x10 {{.*}} origin tracking
+// CHECK10: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK10: #0 {{.*}} in dfs$fn_i {{.*}}origin_unaligned_memtrans.c:[[@LINE-35]]
+// CHECK10: #1 {{.*}} in main {{.*}}origin_unaligned_memtrans.c:[[@LINE-25]]
+
+// CHECK10: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK10: #0 {{.*}} in dfs$fn_h {{.*}}origin_unaligned_memtrans.c:[[@LINE-43]]
+// CHECK10: #1 {{.*}} in main {{.*}}origin_unaligned_memtrans.c:[[@LINE-30]]
+
+// CHECK10: Origin value: {{.*}}, Taint value was stored to memory at
+// CHECK10: #0 {{.*}} in dfs$fn_g {{.*}}origin_unaligned_memtrans.c:[[@LINE-55]]
+// CHECK10: #1 {{.*}} in dfs$fn_f {{.*}}origin_unaligned_memtrans.c:[[@LINE-52]]
+// CHECK10: #2 {{.*}} in main {{.*}}origin_unaligned_memtrans.c:[[@LINE-36]]
+
+// CHECK10: Origin value: {{.*}}, Taint value was created at
+// CHECK10: #0 {{.*}} in main {{.*}}origin_unaligned_memtrans.c:[[@LINE-40]]

llvm/lib/Transforms/Instrumentation/DataFlowSanitizer.cpp

if (ShouldTrackOrigins) {
       Shadows.push_back(PtrShadow);
       Origins.push_back(DFSF.getOrigin(SI.getPointerOperand()));
     }
     PrimitiveShadow = DFSF.combineShadows(Shadow, PtrShadow, &SI);
   } else {
     PrimitiveShadow = DFSF.collapseToPrimitiveShadow(Shadow, &SI);
   }
   Value *Origin = nullptr;
-  if (ShouldTrackOrigins) {
+  if (ShouldTrackOrigins)
     Origin = DFSF.combineOrigins(Shadows, Origins, &SI);
-  }
   DFSF.storePrimitiveShadowOrigin(SI.getPointerOperand(), Size, SI.getAlign(),
                                   PrimitiveShadow, Origin, &SI);
   if (ClEventCallbacks) {
     IRBuilder<> IRB(&SI);
     Value *Addr8 = IRB.CreateBitCast(SI.getPointerOperand(), DFSF.DFS.Int8Ptr);
     IRB.CreateCall(DFSF.DFS.DFSanStoreCallbackFn, {PrimitiveShadow, Addr8});
   }
 }
IRB.CreateCall(
       DFSF.DFS.DFSanSetLabelFn,
       {ValShadow, ValOrigin,
        IRB.CreateBitCast(I.getDest(), Type::getInt8PtrTy(*DFSF.DFS.Ctx)),
        IRB.CreateZExtOrTrunc(I.getLength(), DFSF.DFS.IntptrTy)});
 }
 
 void DFSanVisitor::visitMemTransferInst(MemTransferInst &I) {
   IRBuilder<> IRB(&I);
+
+  // CopyOrMoveOrigin transfers origins by refering to their shadows. So we
+  // need to move origins before moving shadows.
+  if (DFSF.DFS.shouldTrackOrigins()) {
+    IRB.CreateCall(
+        DFSF.DFS.DFSanMemOriginTransferFn,
+        {IRB.CreatePointerCast(I.getArgOperand(0), IRB.getInt8PtrTy()),
+         IRB.CreatePointerCast(I.getArgOperand(1), IRB.getInt8PtrTy()),
+         IRB.CreateIntCast(I.getArgOperand(2), DFSF.DFS.IntptrTy, false)});
+  }
+
   Value *RawDestShadow = DFSF.DFS.getShadowAddress(I.getDest(), &I);
   Value *SrcShadow = DFSF.DFS.getShadowAddress(I.getSource(), &I);
   Value *LenShadow =
       IRB.CreateMul(I.getLength(), ConstantInt::get(I.getLength()->getType(),
                                                     DFSF.DFS.ShadowWidthBytes));
   Type *Int8Ptr = Type::getInt8PtrTy(*DFSF.DFS.Ctx);
   Value *DestShadow = IRB.CreateBitCast(RawDestShadow, Int8Ptr);
   SrcShadow = IRB.CreateBitCast(SrcShadow, Int8Ptr);

llvm/test/Instrumentation/DataFlowSanitizer/origin_mem_intrinsic.ll

 ; RUN: opt < %s -dfsan -dfsan-track-origins=1 -dfsan-fast-16-labels=true -S | FileCheck %s --check-prefix=CHECK
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
+; CHECK: @__dfsan_shadow_width_bits = weak_odr constant i32 [[#SBITS:]]
+; CHECK: @__dfsan_shadow_width_bytes = weak_odr constant i32 [[#SBYTES:]]
+
+declare void @llvm.memcpy.p0i8.p0i8.i32(i8*, i8*, i32, i1)
+declare void @llvm.memmove.p0i8.p0i8.i32(i8*, i8*, i32, i1)
 declare void @llvm.memset.p0i8.i64(i8* nocapture, i8, i64, i1)
 
+define void @memcpy(i8* %d, i8* %s, i32 %l) {
+  ; CHECK: @"dfs$memcpy"
+  ; CHECK: [[L64:%.*]] = zext i32 %l to i64
+  ; CHECK: call void @__dfsan_mem_origin_transfer(i8* %d, i8* %s, i64 [[L64]])
+  ; CHECK: call void @llvm.memcpy.p0i8.p0i8.i32(i8* align 2 {{.*}}, i8* align 2 {{.*}}, i32 {{.*}}, i1 false)
+  ; CHECK: call void @llvm.memcpy.p0i8.p0i8.i32(i8* %d, i8* %s, i32 %l, i1 false)
+
+  call void @llvm.memcpy.p0i8.p0i8.i32(i8* %d, i8* %s, i32 %l, i1 0)
+  ret void
+}
+
+define void @memmove(i8* %d, i8* %s, i32 %l) {
+  ; CHECK: @"dfs$memmove"
+  ; CHECK: [[L64:%.*]] = zext i32 %l to i64
+  ; CHECK: call void @__dfsan_mem_origin_transfer(i8* %d, i8* %s, i64 [[L64]])
+  ; CHECK: call void @llvm.memmove.p0i8.p0i8.i32(i8* align 2 {{.*}}, i8* align 2 {{.*}}, i32 {{.*}}, i1 false)
+  ; CHECK: call void @llvm.memmove.p0i8.p0i8.i32(i8* %d, i8* %s, i32 %l, i1 false)
+
+  call void @llvm.memmove.p0i8.p0i8.i32(i8* %d, i8* %s, i32 %l, i1 0)
+  ret void
+}
+
 define void @memset(i8* %p, i8 %v) {
   ; CHECK: @"dfs$memset"
   ; CHECK: [[O:%.*]] = load i32, i32* getelementptr inbounds ([200 x i32], [200 x i32]* @__dfsan_arg_origin_tls, i64 0, i64 1), align 4
-  ; CHECK: [[S:%.*]] = load i16, i16* inttoptr (i64 add (i64 ptrtoint ([100 x i64]* @__dfsan_arg_tls to i64), i64 2) to i16*), align 2
-  ; CHECK: call void @__dfsan_set_label(i16 [[S]], i32 [[O]], i8* %p, i64 1)
+  ; CHECK: [[S:%.*]] = load i[[#SBITS]], i[[#SBITS]]* inttoptr (i64 add (i64 ptrtoint ([100 x i64]* @__dfsan_arg_tls to i64), i64 2) to i[[#SBITS]]*), align [[#SBYTES]]
+  ; CHECK: call void @__dfsan_set_label(i[[#SBITS]] [[S]], i32 [[O]], i8* %p, i64 1)
   call void @llvm.memset.p0i8.i64(i8* %p, i8 %v, i64 1, i1 1)
   ret void
 }
 No newline at end of file