From 0debaceb11dee9781f9a8b320cb5893836324878 Mon Sep 17 00:00:00 2001 From: Tamar Christina Date: Wed, 31 Jan 2024 14:50:33 +0000 Subject: [PATCH] hwasan: instrument new memory and string functions [PR112644] Recent libhwasan updates[1] intercept various string and memory functions. These functions have checking in them, which means there's no need to inline the checking. This patch marks said functions as intercepted, and adjusts a testcase to handle the difference. It also looks for HWASAN in a check in expand_builtin. This check originally is there to avoid using expand to inline the behaviour of builtins like memset which are intercepted by ASAN and hence which we rely on the function call staying as a function call. With the new reliance on function calls in HWASAN we need to do the same thing for HWASAN too. HWASAN and ASAN don't seem to however instrument the same functions. Looking into libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc it looks like the common ones are memset, memmove and memcpy. The rest of the routines for asan seem to be defined in compiler-rt/lib/asan/asan_interceptors.h however compiler-rt/lib/hwasan/ does not have such a file but it does have compiler-rt/lib/hwasan/hwasan_platform_interceptors.h which it looks like is forcing off everything but memset, memmove, memcpy, memcmp and bcmp. As such I've taken those as the final list that hwasan currently supports. This also means that on future updates this list should be cross checked. [1] https://discourse.llvm.org/t/hwasan-question-about-the-recent-interceptors-being-added/75351 gcc/ChangeLog: PR sanitizer/112644 * asan.h (asan_intercepted_p): Incercept memset, memmove, memcpy and memcmp. * builtins.cc (expand_builtin): Include HWASAN when checking for builtin inlining. gcc/testsuite/ChangeLog: PR sanitizer/112644 * c-c++-common/hwasan/builtin-special-handling.c: Update testcase. Co-Authored-By: Matthew Malcomson --- gcc/asan.h | 7 ++++++- gcc/builtins.cc | 3 ++- .../hwasan/builtin-special-handling.c | 18 +++++++++--------- 3 files changed, 17 insertions(+), 11 deletions(-) diff --git a/gcc/asan.h b/gcc/asan.h index 82811bdbe69..d1bf8b1e701 100644 --- a/gcc/asan.h +++ b/gcc/asan.h @@ -185,8 +185,13 @@ extern hash_set *asan_handled_variables; inline bool asan_intercepted_p (enum built_in_function fcode) { + /* This list should be kept up-to-date with upstream's version at + compiler-rt/lib/hwasan/hwasan_platform_interceptors.h. */ if (hwasan_sanitize_p ()) - return false; + return fcode == BUILT_IN_MEMCMP + || fcode == BUILT_IN_MEMCPY + || fcode == BUILT_IN_MEMMOVE + || fcode == BUILT_IN_MEMSET; return fcode == BUILT_IN_INDEX || fcode == BUILT_IN_MEMCHR diff --git a/gcc/builtins.cc b/gcc/builtins.cc index 1d54ea0a832..4c04ae03321 100644 --- a/gcc/builtins.cc +++ b/gcc/builtins.cc @@ -7791,7 +7791,8 @@ expand_builtin (tree exp, rtx target, rtx subtarget, machine_mode mode, default: break; } - if (sanitize_flags_p (SANITIZE_ADDRESS) && asan_intercepted_p (fcode)) + if (sanitize_flags_p (SANITIZE_ADDRESS | SANITIZE_HWADDRESS) + && asan_intercepted_p (fcode)) return expand_call (exp, target, ignore); /* When not optimizing, generate calls to library functions for a certain diff --git a/gcc/testsuite/c-c++-common/hwasan/builtin-special-handling.c b/gcc/testsuite/c-c++-common/hwasan/builtin-special-handling.c index a7a6d91693a..f975baaaa1c 100644 --- a/gcc/testsuite/c-c++-common/hwasan/builtin-special-handling.c +++ b/gcc/testsuite/c-c++-common/hwasan/builtin-special-handling.c @@ -8,24 +8,24 @@ /* { dg-skip-if "" { *-*-* } { "-flto" } { "-flto-partition=none" } } */ typedef __SIZE_TYPE__ size_t; -/* Functions to observe that HWASAN instruments memory builtins in the expected - manner. */ +/* HWASAN used to instrument calls to memset, memcpy, and memmove. It no + longer does this. Many other string and memory builtins are intercepted by + the runtime (and hence the codegen need not do anything). */ void * __attribute__((noinline)) memset_builtin (void *dest, int value, size_t len) { return __builtin_memset (dest, value, len); } -/* HWASAN avoids strlen because it doesn't know the size of the memory access - until *after* the function call. */ size_t __attribute__ ((noinline)) strlen_builtin (char *element) { return __builtin_strlen (element); } -/* First test ensures that the HWASAN_CHECK was emitted before the - memset. Second test ensures there was only HWASAN_CHECK (which demonstrates - that strlen was not instrumented). */ -/* { dg-final { scan-tree-dump-times "HWASAN_CHECK.*memset" 1 "asan1" } } */ -/* { dg-final { scan-tree-dump-times "HWASAN_CHECK" 1 "asan1" } } */ +/* First check here ensures there is no inline instrumentation generated for + these builtins. Second checks that we end up calling memset (i.e. that it's + not optimised into an inline operation, which would happen without the + instrumentation). */ +/* { dg-final { scan-tree-dump-not "HWASAN_CHECK" "asan1" } } */ +/* { dg-final { scan-assembler-times "\tmemset\\M" 1 } } */