procyberian/gcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hwasan: instrument new memory and string functions [PR112644]

Browse source 
Recent libhwasan updates[1] intercept various string and memory functions.
These functions have checking in them, which means there's no need to
inline the checking.

This patch marks said functions as intercepted, and adjusts a testcase
to handle the difference.  It also looks for HWASAN in a check in
expand_builtin.  This check originally is there to avoid using expand to
inline the behaviour of builtins like memset which are intercepted by
ASAN and hence which we rely on the function call staying as a function
call.  With the new reliance on function calls in HWASAN we need to do
the same thing for HWASAN too.

HWASAN and ASAN don't seem to however instrument the same functions.

Looking into libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc
it looks like the common ones are memset, memmove and memcpy.

The rest of the routines for asan seem to be defined in
compiler-rt/lib/asan/asan_interceptors.h however compiler-rt/lib/hwasan/
does not have such a file but it does have
compiler-rt/lib/hwasan/hwasan_platform_interceptors.h which it looks like is
forcing off everything but memset, memmove, memcpy, memcmp and bcmp.

As such I've taken those as the final list that hwasan currently supports.
This also means that on future updates this list should be cross checked.

[1] https://discourse.llvm.org/t/hwasan-question-about-the-recent-interceptors-being-added/75351

gcc/ChangeLog:

	PR sanitizer/112644
	* asan.h (asan_intercepted_p): Incercept memset, memmove, memcpy and
	memcmp.
	* builtins.cc (expand_builtin): Include HWASAN when checking for
	builtin inlining.

gcc/testsuite/ChangeLog:

	PR sanitizer/112644
	* c-c++-common/hwasan/builtin-special-handling.c: Update testcase.

Co-Authored-By: Matthew Malcomson <matthew.malcomson@arm.com>
This commit is contained in:
Tamar Christina 2024-01-31 14:50:33 +00:00
parent a73421bcf3
commit 0debaceb11
3 changed files with 17 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
gcc/asan.h
View file

@ -185,8 +185,13 @@ extern hash_set<tree> *asan_handled_variables;
inline bool
asan_intercepted_p (enum built_in_function fcode)
{
/* This list should be kept up-to-date with upstream's version at
compiler-rt/lib/hwasan/hwasan_platform_interceptors.h. */
if (hwasan_sanitize_p ())
return false;
return fcode == BUILT_IN_MEMCMP
|| fcode == BUILT_IN_MEMCPY
|| fcode == BUILT_IN_MEMMOVE
|| fcode == BUILT_IN_MEMSET;
return fcode == BUILT_IN_INDEX
|| fcode == BUILT_IN_MEMCHR

3
gcc/builtins.cc
View file

@ -7791,7 +7791,8 @@ expand_builtin (tree exp, rtx target, rtx subtarget, machine_mode mode,
default:
break;
}
if (sanitize_flags_p (SANITIZE_ADDRESS) && asan_intercepted_p (fcode))
if (sanitize_flags_p (SANITIZE_ADDRESS | SANITIZE_HWADDRESS)
&& asan_intercepted_p (fcode))
return expand_call (exp, target, ignore);
/* When not optimizing, generate calls to library functions for a certain

18
gcc/testsuite/c-c++-common/hwasan/builtin-special-handling.c
View file

@ -8,24 +8,24 @@
/* { dg-skip-if "" { *-*-* } { "-flto" } { "-flto-partition=none" } } */
typedef __SIZE_TYPE__ size_t;
/* Functions to observe that HWASAN instruments memory builtins in the expected
manner. */
/* HWASAN used to instrument calls to memset, memcpy, and memmove. It no
longer does this. Many other string and memory builtins are intercepted by
the runtime (and hence the codegen need not do anything). */
void * __attribute__((noinline))
memset_builtin (void *dest, int value, size_t len)
{
return __builtin_memset (dest, value, len);
}
/* HWASAN avoids strlen because it doesn't know the size of the memory access
until *after* the function call. */
size_t __attribute__ ((noinline))
strlen_builtin (char *element)
{
return __builtin_strlen (element);
}
/* First test ensures that the HWASAN_CHECK was emitted before the
memset. Second test ensures there was only HWASAN_CHECK (which demonstrates
that strlen was not instrumented). */
/* { dg-final { scan-tree-dump-times "HWASAN_CHECK.*memset" 1 "asan1" } } */
/* { dg-final { scan-tree-dump-times "HWASAN_CHECK" 1 "asan1" } } */
/* First check here ensures there is no inline instrumentation generated for
these builtins. Second checks that we end up calling memset (i.e. that it's
not optimised into an inline operation, which would happen without the
instrumentation). */
/* { dg-final { scan-tree-dump-not "HWASAN_CHECK" "asan1" } } */
/* { dg-final { scan-assembler-times "\tmemset\\M" 1 } } */