caio/clang-p2996
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a0c9ec1f5e70e8f15da170667b2a8e63d024f3ab
clang-p2996/llvm/test/Instrumentation/DataFlowSanitizer/store.ll
Jianzhou Zhao ea981165a4 [dfsan] Track field/index-level shadow values in variables 
*************
* The problem
*************
See motivation examples in compiler-rt/test/dfsan/pair.cpp. The current
DFSan always uses a 16bit shadow value for a variable with any type by
combining all shadow values of all bytes of the variable. So it cannot
distinguish two fields of a struct: each field's shadow value equals the
combined shadow value of all fields. This introduces an overtaint issue.

Consider a parsing function

   std::pair<char*, int> get_token(char* p);

where p points to a buffer to parse, the returned pair includes the next
token and the pointer to the position in the buffer after the token.

If the token is tainted, then both the returned pointer and int ar
tainted. If the parser keeps on using get_token for the rest parsing,
all the following outputs are tainted because of the tainted pointer.

The CL is the first change to address the issue.

**************************
* The proposed improvement
**************************
Eventually all fields and indices have their own shadow values in
variables and memory.

For example, variables with type {i1, i3}, [2 x i1], {[2 x i4], i8},
[2 x {i1, i1}] have shadow values with type {i16, i16}, [2 x i16],
{[2 x i16], i16}, [2 x {i16, i16}] correspondingly; variables with
primary type still have shadow values i16.

***************************
* An potential implementation plan
***************************

The idea is to adopt the change incrementially.

1) This CL
Support field-level accuracy at variables/args/ret in TLS mode,
load/store/alloca still use combined shadow values.

After the alloca promotion and SSA construction phases (>=-O1), we
assume alloca and memory operations are reduced. So if struct
variables do not relate to memory, their tracking is accurate at
field level.

2) Support field-level accuracy at alloca
3) Support field-level accuracy at load/store

These two should make O0 and real memory access work.

4) Support vector if necessary.
5) Support Args mode if necessary.
6) Support passing more accurate shadow values via custom functions if
necessary.

***************
* About this CL.
***************
The CL did the following

1) extended TLS arg/ret to work with aggregate types. This is similar
to what MSan does.

2) implemented how to map between an original type/value/zero-const to
its shadow type/value/zero-const.

3) extended (insert|extract)value to use field/index-level progagation.

4) for other instructions, propagation rules are combining inputs by or.
The CL converts between aggragate and primary shadow values at the
cases.

5) Custom function interfaces also need such a conversion because
all existing custom functions use i16. It is unclear whether custome
functions need more accurate shadow propagation yet.

6) Added test cases for aggregate type related cases.

Reviewed-by: morehouse

Differential Revision: https://reviews.llvm.org/D92261
2020-12-09 19:38:35 +00:00

166 lines
6.1 KiB
LLVM
Raw Blame History

; RUN: opt < %s -dfsan -dfsan-combine-pointer-labels-on-store=1 -S | FileCheck %s --check-prefix=COMBINE_PTR_LABEL
; RUN: opt < %s -dfsan -dfsan-combine-pointer-labels-on-store=0 -S | FileCheck %s --check-prefix=NO_COMBINE_PTR_LABEL
target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"
define void @store0({} %v, {}* %p) {
; COMBINE_PTR_LABEL: @"dfs$store0"
; COMBINE_PTR_LABEL: store
; COMBINE_PTR_LABEL-NOT: store
; NO_COMBINE_PTR_LABEL: @"dfs$store0"
; NO_COMBINE_PTR_LABEL: store
; NO_COMBINE_PTR_LABEL-NOT: store
store {} %v, {}* %p
ret void
}
define void @store8(i8 %v, i8* %p) {
; NO_COMBINE_PTR_LABEL: @"dfs$store8"
; NO_COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; NO_COMBINE_PTR_LABEL: ptrtoint i8* {{.*}} i64
; NO_COMBINE_PTR_LABEL: and i64
; NO_COMBINE_PTR_LABEL: mul i64
; NO_COMBINE_PTR_LABEL: inttoptr i64 {{.*}} i16*
; NO_COMBINE_PTR_LABEL: getelementptr i16, i16*
; NO_COMBINE_PTR_LABEL: store i16
; NO_COMBINE_PTR_LABEL: store i8
; COMBINE_PTR_LABEL: @"dfs$store8"
; COMBINE_PTR_LABEL: load i16, i16*
; COMBINE_PTR_LABEL: load i16, i16*
; COMBINE_PTR_LABEL: icmp ne i16
; COMBINE_PTR_LABEL: call {{.*}} @__dfsan_union
; COMBINE_PTR_LABEL: ptrtoint i8* {{.*}} i64
; COMBINE_PTR_LABEL: and i64
; COMBINE_PTR_LABEL: mul i64
; COMBINE_PTR_LABEL: inttoptr i64 {{.*}} i16*
; COMBINE_PTR_LABEL: getelementptr i16, i16*
; COMBINE_PTR_LABEL: store i16
; COMBINE_PTR_LABEL: store i8
store i8 %v, i8* %p
ret void
}
define void @store16(i16 %v, i16* %p) {
; NO_COMBINE_PTR_LABEL: @"dfs$store16"
; NO_COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; NO_COMBINE_PTR_LABEL: ptrtoint i16* {{.*}} i64
; NO_COMBINE_PTR_LABEL: and i64
; NO_COMBINE_PTR_LABEL: mul i64
; NO_COMBINE_PTR_LABEL: inttoptr i64 {{.*}} i16*
; NO_COMBINE_PTR_LABEL: getelementptr i16, i16*
; NO_COMBINE_PTR_LABEL: store i16
; NO_COMBINE_PTR_LABEL: getelementptr i16, i16*
; NO_COMBINE_PTR_LABEL: store i16
; NO_COMBINE_PTR_LABEL: store i16
; COMBINE_PTR_LABEL: @"dfs$store16"
; COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; COMBINE_PTR_LABEL: icmp ne i16
; COMBINE_PTR_LABEL: call {{.*}} @__dfsan_union
; COMBINE_PTR_LABEL: ptrtoint i16* {{.*}} i64
; COMBINE_PTR_LABEL: and i64
; COMBINE_PTR_LABEL: mul i64
; COMBINE_PTR_LABEL: inttoptr i64 {{.*}} i16*
; COMBINE_PTR_LABEL: getelementptr i16, i16*
; COMBINE_PTR_LABEL: store i16
; COMBINE_PTR_LABEL: getelementptr i16, i16*
; COMBINE_PTR_LABEL: store i16
; COMBINE_PTR_LABEL: store i16
store i16 %v, i16* %p
ret void
}
define void @store32(i32 %v, i32* %p) {
; NO_COMBINE_PTR_LABEL: @"dfs$store32"
; NO_COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; NO_COMBINE_PTR_LABEL: ptrtoint i32* {{.*}} i64
; NO_COMBINE_PTR_LABEL: and i64
; NO_COMBINE_PTR_LABEL: mul i64
; NO_COMBINE_PTR_LABEL: inttoptr i64 {{.*}} i16*
; NO_COMBINE_PTR_LABEL: getelementptr i16, i16*
; NO_COMBINE_PTR_LABEL: store i16
; NO_COMBINE_PTR_LABEL: getelementptr i16, i16*
; NO_COMBINE_PTR_LABEL: store i16
; NO_COMBINE_PTR_LABEL: getelementptr i16, i16*
; NO_COMBINE_PTR_LABEL: store i16
; NO_COMBINE_PTR_LABEL: getelementptr i16, i16*
; NO_COMBINE_PTR_LABEL: store i16
; NO_COMBINE_PTR_LABEL: store i32
; COMBINE_PTR_LABEL: @"dfs$store32"
; COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; COMBINE_PTR_LABEL: icmp ne i16
; COMBINE_PTR_LABEL: call {{.*}} @__dfsan_union
; COMBINE_PTR_LABEL: ptrtoint i32* {{.*}} i64
; COMBINE_PTR_LABEL: and i64
; COMBINE_PTR_LABEL: mul i64
; COMBINE_PTR_LABEL: inttoptr i64 {{.*}} i16*
; COMBINE_PTR_LABEL: getelementptr i16, i16*
; COMBINE_PTR_LABEL: store i16
; COMBINE_PTR_LABEL: getelementptr i16, i16*
; COMBINE_PTR_LABEL: store i16
; COMBINE_PTR_LABEL: getelementptr i16, i16*
; COMBINE_PTR_LABEL: store i16
; COMBINE_PTR_LABEL: getelementptr i16, i16*
; COMBINE_PTR_LABEL: store i16
; COMBINE_PTR_LABEL: store i32
store i32 %v, i32* %p
ret void
}
define void @store64(i64 %v, i64* %p) {
; NO_COMBINE_PTR_LABEL: @"dfs$store64"
; NO_COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; NO_COMBINE_PTR_LABEL: ptrtoint i64* {{.*}} i64
; NO_COMBINE_PTR_LABEL: and i64
; NO_COMBINE_PTR_LABEL: mul i64
; NO_COMBINE_PTR_LABEL: inttoptr i64 {{.*}} i16*
; NO_COMBINE_PTR_LABEL: insertelement {{.*}} i16
; NO_COMBINE_PTR_LABEL: insertelement {{.*}} i16
; NO_COMBINE_PTR_LABEL: insertelement {{.*}} i16
; NO_COMBINE_PTR_LABEL: insertelement {{.*}} i16
; NO_COMBINE_PTR_LABEL: insertelement {{.*}} i16
; NO_COMBINE_PTR_LABEL: insertelement {{.*}} i16
; NO_COMBINE_PTR_LABEL: insertelement {{.*}} i16
; NO_COMBINE_PTR_LABEL: insertelement {{.*}} i16
; NO_COMBINE_PTR_LABEL: bitcast i16* {{.*}} <8 x i16>*
; NO_COMBINE_PTR_LABEL: store i64
; COMBINE_PTR_LABEL: @"dfs$store64"
; COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; COMBINE_PTR_LABEL: load i16, i16* {{.*}} @__dfsan_arg_tls
; COMBINE_PTR_LABEL: icmp ne i16
; COMBINE_PTR_LABEL: call {{.*}} @__dfsan_union
; COMBINE_PTR_LABEL: ptrtoint i64* {{.*}} i64
; COMBINE_PTR_LABEL: and i64
; COMBINE_PTR_LABEL: mul i64
; COMBINE_PTR_LABEL: inttoptr i64 {{.*}} i16*
; COMBINE_PTR_LABEL: insertelement {{.*}} i16
; COMBINE_PTR_LABEL: insertelement {{.*}} i16
; COMBINE_PTR_LABEL: insertelement {{.*}} i16
; COMBINE_PTR_LABEL: insertelement {{.*}} i16
; COMBINE_PTR_LABEL: insertelement {{.*}} i16
; COMBINE_PTR_LABEL: insertelement {{.*}} i16
; COMBINE_PTR_LABEL: insertelement {{.*}} i16
; COMBINE_PTR_LABEL: insertelement {{.*}} i16
; COMBINE_PTR_LABEL: bitcast i16* {{.*}} <8 x i16>*
; COMBINE_PTR_LABEL: store <8 x i16>
; COMBINE_PTR_LABEL: store i64
store i64 %v, i64* %p
ret void
}
define void @store_zero(i32* %p) {
; NO_COMBINE_PTR_LABEL: store i64 0, i64* {{.*}}, align 2
store i32 0, i32* %p
ret void
}
Reference in New Issue View Git Blame Copy Permalink