Skip to content

Commit b453cd6

Browse files
pccpcc
committedOct 20, 2013
Implement function type checker for the undefined behavior sanitizer.
This uses function prefix data to store function type information at the function pointer. Differential Revision: http://llvm-reviews.chandlerc.com/D1338 llvm-svn: 193058
1 parent f7ef3fd commit b453cd6

File tree

12 files changed

+122
-12
lines changed

12 files changed

+122
-12
lines changed
 

‎clang/docs/UsersManual.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -921,6 +921,8 @@ are listed below.
921921
destination.
922922
- ``-fsanitize=float-divide-by-zero``: Floating point division by
923923
zero.
924+
- ``-fsanitize=function``: Indirect call of a function through a
925+
function pointer of the wrong type (C++ and x86/x86_64 only).
924926
- ``-fsanitize=integer-divide-by-zero``: Integer division by zero.
925927
- ``-fsanitize=null``: Use of a null pointer or creation of a null
926928
reference.

‎clang/include/clang/Basic/Sanitizers.def

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ SANITIZER("bounds", Bounds)
6464
SANITIZER("enum", Enum)
6565
SANITIZER("float-cast-overflow", FloatCastOverflow)
6666
SANITIZER("float-divide-by-zero", FloatDivideByZero)
67+
SANITIZER("function", Function)
6768
SANITIZER("integer-divide-by-zero", IntegerDivideByZero)
6869
SANITIZER("null", Null)
6970
SANITIZER("object-size", ObjectSize)
@@ -84,9 +85,9 @@ SANITIZER("dataflow", DataFlow)
8485
// ABI or address space layout implications, and only catch undefined behavior.
8586
SANITIZER_GROUP("undefined", Undefined,
8687
Alignment | Bool | Bounds | Enum | FloatCastOverflow |
87-
FloatDivideByZero | IntegerDivideByZero | Null | ObjectSize |
88-
Return | Shift | SignedIntegerOverflow | Unreachable |
89-
VLABound | Vptr)
88+
FloatDivideByZero | Function | IntegerDivideByZero | Null |
89+
ObjectSize | Return | Shift | SignedIntegerOverflow |
90+
Unreachable | VLABound | Vptr)
9091

9192
// -fsanitize=undefined-trap (and its alias -fcatch-undefined-behavior) includes
9293
// all sanitizers included by -fsanitize=undefined, except those that require

‎clang/lib/CodeGen/CGBuiltin.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ static Value *EmitFAbs(CodeGenFunction &CGF, Value *V, QualType ValTy) {
165165

166166
static RValue emitLibraryCall(CodeGenFunction &CGF, const FunctionDecl *Fn,
167167
const CallExpr *E, llvm::Value *calleeValue) {
168-
return CGF.EmitCall(E->getCallee()->getType(), calleeValue,
168+
return CGF.EmitCall(E->getCallee()->getType(), calleeValue, E->getLocStart(),
169169
ReturnValueSlot(), E->arg_begin(), E->arg_end(), Fn);
170170
}
171171

‎clang/lib/CodeGen/CGCUDARuntime.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ RValue CGCUDARuntime::EmitCUDAKernelCallExpr(CodeGenFunction &CGF,
4444
}
4545

4646
llvm::Value *Callee = CGF.EmitScalarExpr(E->getCallee());
47-
CGF.EmitCall(E->getCallee()->getType(), Callee, ReturnValue,
48-
E->arg_begin(), E->arg_end(), TargetDecl);
47+
CGF.EmitCall(E->getCallee()->getType(), Callee, E->getLocStart(),
48+
ReturnValue, E->arg_begin(), E->arg_end(), TargetDecl);
4949
CGF.EmitBranch(ContBlock);
5050

5151
CGF.EmitBlock(ContBlock);

‎clang/lib/CodeGen/CGExpr.cpp

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2931,8 +2931,8 @@ RValue CodeGenFunction::EmitCallExpr(const CallExpr *E,
29312931
}
29322932

29332933
llvm::Value *Callee = EmitScalarExpr(E->getCallee());
2934-
return EmitCall(E->getCallee()->getType(), Callee, ReturnValue,
2935-
E->arg_begin(), E->arg_end(), TargetDecl);
2934+
return EmitCall(E->getCallee()->getType(), Callee, E->getLocStart(),
2935+
ReturnValue, E->arg_begin(), E->arg_end(), TargetDecl);
29362936
}
29372937

29382938
LValue CodeGenFunction::EmitBinaryOperatorLValue(const BinaryOperator *E) {
@@ -3103,6 +3103,7 @@ LValue CodeGenFunction::EmitStmtExprLValue(const StmtExpr *E) {
31033103
}
31043104

31053105
RValue CodeGenFunction::EmitCall(QualType CalleeType, llvm::Value *Callee,
3106+
SourceLocation CallLoc,
31063107
ReturnValueSlot ReturnValue,
31073108
CallExpr::const_arg_iterator ArgBeg,
31083109
CallExpr::const_arg_iterator ArgEnd,
@@ -3123,6 +3124,51 @@ RValue CodeGenFunction::EmitCall(QualType CalleeType, llvm::Value *Callee,
31233124
if (const FunctionDecl* FD = dyn_cast_or_null<const FunctionDecl>(TargetDecl))
31243125
ForceColumnInfo = FD->isInlineSpecified();
31253126

3127+
if (getLangOpts().CPlusPlus && SanOpts->Function &&
3128+
(!TargetDecl || !isa<FunctionDecl>(TargetDecl))) {
3129+
if (llvm::Constant *PrefixSig =
3130+
CGM.getTargetCodeGenInfo().getUBSanFunctionSignature(CGM)) {
3131+
llvm::Constant *FTRTTIConst =
3132+
CGM.GetAddrOfRTTIDescriptor(QualType(FnType, 0), /*ForEH=*/true);
3133+
llvm::Type *PrefixStructTyElems[] = {
3134+
PrefixSig->getType(),
3135+
FTRTTIConst->getType()
3136+
};
3137+
llvm::StructType *PrefixStructTy = llvm::StructType::get(
3138+
CGM.getLLVMContext(), PrefixStructTyElems, /*isPacked=*/true);
3139+
3140+
llvm::Value *CalleePrefixStruct = Builder.CreateBitCast(
3141+
Callee, llvm::PointerType::getUnqual(PrefixStructTy));
3142+
llvm::Value *CalleeSigPtr =
3143+
Builder.CreateConstGEP2_32(CalleePrefixStruct, 0, 0);
3144+
llvm::Value *CalleeSig = Builder.CreateLoad(CalleeSigPtr);
3145+
llvm::Value *CalleeSigMatch = Builder.CreateICmpEQ(CalleeSig, PrefixSig);
3146+
3147+
llvm::BasicBlock *Cont = createBasicBlock("cont");
3148+
llvm::BasicBlock *TypeCheck = createBasicBlock("typecheck");
3149+
Builder.CreateCondBr(CalleeSigMatch, TypeCheck, Cont);
3150+
3151+
EmitBlock(TypeCheck);
3152+
llvm::Value *CalleeRTTIPtr =
3153+
Builder.CreateConstGEP2_32(CalleePrefixStruct, 0, 1);
3154+
llvm::Value *CalleeRTTI = Builder.CreateLoad(CalleeRTTIPtr);
3155+
llvm::Value *CalleeRTTIMatch =
3156+
Builder.CreateICmpEQ(CalleeRTTI, FTRTTIConst);
3157+
llvm::Constant *StaticData[] = {
3158+
EmitCheckSourceLocation(CallLoc),
3159+
EmitCheckTypeDescriptor(CalleeType)
3160+
};
3161+
EmitCheck(CalleeRTTIMatch,
3162+
"function_type_mismatch",
3163+
StaticData,
3164+
Callee,
3165+
CRK_Recoverable);
3166+
3167+
Builder.CreateBr(Cont);
3168+
EmitBlock(Cont);
3169+
}
3170+
}
3171+
31263172
CallArgList Args;
31273173
EmitCallArgs(Args, dyn_cast<FunctionProtoType>(FnType), ArgBeg, ArgEnd,
31283174
ForceColumnInfo);

‎clang/lib/CodeGen/CGExprCXX.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,8 @@ RValue CodeGenFunction::EmitCXXMemberCallExpr(const CXXMemberCallExpr *CE,
8686
// The method is static, emit it as we would a regular call.
8787
llvm::Value *Callee = CGM.GetAddrOfFunction(MD);
8888
return EmitCall(getContext().getPointerType(MD->getType()), Callee,
89-
ReturnValue, CE->arg_begin(), CE->arg_end());
89+
CE->getLocStart(), ReturnValue, CE->arg_begin(),
90+
CE->arg_end());
9091
}
9192

9293
// Compute the object pointer.

‎clang/lib/CodeGen/CodeGenFunction.cpp

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
#include "CGCXXABI.h"
1717
#include "CGDebugInfo.h"
1818
#include "CodeGenModule.h"
19+
#include "TargetInfo.h"
1920
#include "clang/AST/ASTContext.h"
2021
#include "clang/AST/Decl.h"
2122
#include "clang/AST/DeclCXX.h"
@@ -519,6 +520,22 @@ void CodeGenFunction::StartFunction(GlobalDecl GD,
519520
EmitOpenCLKernelMetadata(FD, Fn);
520521
}
521522

523+
// If we are checking function types, emit a function type signature as
524+
// prefix data.
525+
if (getLangOpts().CPlusPlus && SanOpts->Function) {
526+
if (const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(D)) {
527+
if (llvm::Constant *PrefixSig =
528+
CGM.getTargetCodeGenInfo().getUBSanFunctionSignature(CGM)) {
529+
llvm::Constant *FTRTTIConst =
530+
CGM.GetAddrOfRTTIDescriptor(FD->getType(), /*ForEH=*/true);
531+
llvm::Constant *PrefixStructElems[] = { PrefixSig, FTRTTIConst };
532+
llvm::Constant *PrefixStructConst =
533+
llvm::ConstantStruct::getAnon(PrefixStructElems, /*Packed=*/true);
534+
Fn->setPrefixData(PrefixStructConst);
535+
}
536+
}
537+
}
538+
522539
llvm::BasicBlock *EntryBB = createBasicBlock("entry", CurFn);
523540

524541
// Create a marker to make it easy to insert allocas into the entryblock

‎clang/lib/CodeGen/CodeGenFunction.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2073,6 +2073,7 @@ class CodeGenFunction : public CodeGenTypeCache {
20732073
llvm::Instruction **callOrInvoke = 0);
20742074

20752075
RValue EmitCall(QualType FnType, llvm::Value *Callee,
2076+
SourceLocation CallLoc,
20762077
ReturnValueSlot ReturnValue,
20772078
CallExpr::const_arg_iterator ArgBeg,
20782079
CallExpr::const_arg_iterator ArgEnd,

‎clang/lib/CodeGen/TargetInfo.cpp

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -601,6 +601,14 @@ class X86_32TargetCodeGenInfo : public TargetCodeGenInfo {
601601
return X86AdjustInlineAsmType(CGF, Constraint, Ty);
602602
}
603603

604+
llvm::Constant *getUBSanFunctionSignature(CodeGen::CodeGenModule &CGM) const {
605+
unsigned Sig = (0xeb << 0) | // jmp rel8
606+
(0x06 << 8) | // .+0x08
607+
('F' << 16) |
608+
('T' << 24);
609+
return llvm::ConstantInt::get(CGM.Int32Ty, Sig);
610+
}
611+
604612
};
605613

606614
}
@@ -1284,6 +1292,14 @@ class X86_64TargetCodeGenInfo : public TargetCodeGenInfo {
12841292
return TargetCodeGenInfo::isNoProtoCallVariadic(args, fnType);
12851293
}
12861294

1295+
llvm::Constant *getUBSanFunctionSignature(CodeGen::CodeGenModule &CGM) const {
1296+
unsigned Sig = (0xeb << 0) | // jmp rel8
1297+
(0x0a << 8) | // .+0x0c
1298+
('F' << 16) |
1299+
('T' << 24);
1300+
return llvm::ConstantInt::get(CGM.Int32Ty, Sig);
1301+
}
1302+
12871303
};
12881304

12891305
static std::string qualifyWindowsLibrary(llvm::StringRef Lib) {

‎clang/lib/CodeGen/TargetInfo.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
#include "llvm/ADT/SmallString.h"
2222

2323
namespace llvm {
24+
class Constant;
2425
class GlobalValue;
2526
class Type;
2627
class Value;
@@ -136,6 +137,13 @@ namespace clang {
136137
return "";
137138
}
138139

140+
/// Return a constant used by UBSan as a signature to identify functions
141+
/// possessing type information, or 0 if the platform is unsupported.
142+
virtual llvm::Constant *getUBSanFunctionSignature(
143+
CodeGen::CodeGenModule &CGM) const {
144+
return 0;
145+
}
146+
139147
/// Determine whether a call to an unprototyped functions under
140148
/// the given calling convention should use the variadic
141149
/// convention or the non-variadic convention.

‎clang/test/CodeGenCXX/catch-undef-behavior.cpp

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// RUN: %clang_cc1 -std=c++11 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,bounds -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s
1+
// RUN: %clang_cc1 -std=c++11 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,bounds,function -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s
22

33
struct S {
44
double d;
@@ -372,6 +372,24 @@ void downcast_reference(B &b) {
372372
// CHECK-NEXT: br i1 [[AND]]
373373
}
374374

375+
// CHECK-LABEL: @_Z22indirect_function_callPFviE({{.*}} prefix <{ i32, i8* }> <{ i32 1413876459, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
376+
void indirect_function_call(void (*p)(int)) {
377+
// CHECK: [[PTR:%[0-9]*]] = bitcast void (i32)* {{.*}} to <{ i32, i8* }>*
378+
379+
// Signature check
380+
// CHECK-NEXT: [[SIGPTR:%[0-9]*]] = getelementptr <{ i32, i8* }>* [[PTR]], i32 0, i32 0
381+
// CHECK-NEXT: [[SIG:%[0-9]*]] = load i32* [[SIGPTR]]
382+
// CHECK-NEXT: [[SIGCMP:%[0-9]*]] = icmp eq i32 [[SIG]], 1413876459
383+
// CHECK-NEXT: br i1 [[SIGCMP]]
384+
385+
// RTTI pointer check
386+
// CHECK: [[RTTIPTR:%[0-9]*]] = getelementptr <{ i32, i8* }>* [[PTR]], i32 0, i32 1
387+
// CHECK-NEXT: [[RTTI:%[0-9]*]] = load i8** [[RTTIPTR]]
388+
// CHECK-NEXT: [[RTTICMP:%[0-9]*]] = icmp eq i8* [[RTTI]], bitcast ({ i8*, i8* }* @_ZTIFviE to i8*)
389+
// CHECK-NEXT: br i1 [[RTTICMP]]
390+
p(42);
391+
}
392+
375393
namespace CopyValueRepresentation {
376394
// CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S3aSERKS0_
377395
// CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value

‎clang/test/Driver/fsanitize.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@
55
// CHECK-UNDEFINED-TRAP: "-fsanitize-undefined-trap-on-error"
66

77
// RUN: %clang -target x86_64-linux-gnu -fsanitize=undefined %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-UNDEFINED
8-
// CHECK-UNDEFINED: "-fsanitize={{((signed-integer-overflow|integer-divide-by-zero|float-divide-by-zero|shift|unreachable|return|vla-bound|alignment|null|vptr|object-size|float-cast-overflow|bounds|enum|bool),?){15}"}}
8+
// CHECK-UNDEFINED: "-fsanitize={{((signed-integer-overflow|integer-divide-by-zero|float-divide-by-zero|function|shift|unreachable|return|vla-bound|alignment|null|vptr|object-size|float-cast-overflow|bounds|enum|bool),?){16}"}}
99

1010
// RUN: %clang -target x86_64-linux-gnu -fsanitize=integer %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-INTEGER
1111
// CHECK-INTEGER: "-fsanitize={{((signed-integer-overflow|unsigned-integer-overflow|integer-divide-by-zero|shift),?){4}"}}
1212

1313
// RUN: %clang -target x86_64-linux-gnu -fsanitize=thread,undefined -fno-thread-sanitizer -fno-sanitize=float-cast-overflow,vptr,bool,enum %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-PARTIAL-UNDEFINED
14-
// CHECK-PARTIAL-UNDEFINED: "-fsanitize={{((signed-integer-overflow|integer-divide-by-zero|float-divide-by-zero|shift|unreachable|return|vla-bound|alignment|null|object-size|bounds),?){11}"}}
14+
// CHECK-PARTIAL-UNDEFINED: "-fsanitize={{((signed-integer-overflow|integer-divide-by-zero|float-divide-by-zero|function|shift|unreachable|return|vla-bound|alignment|null|object-size|bounds),?){12}"}}
1515

1616
// RUN: %clang -target x86_64-linux-gnu -fsanitize=address-full %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-FULL
1717
// CHECK-ASAN-FULL: "-fsanitize={{((address|init-order|use-after-return|use-after-scope),?){4}"}}

0 commit comments

Comments
 (0)