summaryrefslogtreecommitdiff
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
* [libFuzzer] Don't prefix absolute paths in fuchsia.Jake Ehrlich2019-10-111-5/+6
| | | | | | | | | | | | | | | | | | | | | | | The ExecuteCommand function in fuchsia used to prefix the getOutputFile for each command run with the artifact_prefix flag if it was available, because fuchsia components don't have a writable working directory. However, if a file with a global path is provided, fuchsia should honor that. An example of this is using the global /tmp directory to store stuff. In fuchsia it ended up being translated to data///tmp, whereas we want to make sure it is using /tmp (which is available to components using the isolated-temp feature). To test this I made the change, compiled fuchsia with this toolchain and ran a fuzzer with the -fork=1 flag (that mode makes use of the /tmp directory). I also tested that normal fuzzing workflow was not affected by this. Author: charco (Marco Vanotti) Differential Revision: https://reviews.llvm.org/D68774 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374612 91177308-0d34-0410-b5e6-96231b3b80d8
* Fix check-interception link error in compiler-rt debug modeReid Kleckner2019-10-101-1/+4
| | | | git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374472 91177308-0d34-0410-b5e6-96231b3b80d8
* Reland "[ASan] Do not misrepresent high value address dereferences as null ↵Julian Lettner2019-10-106-6/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | dereferences" Updated: Removed offending TODO comment. Dereferences with addresses above the 48-bit hardware addressable range produce "invalid instruction" (instead of "invalid access") hardware exceptions (there is no hardware address decoding logic for those bits), and the address provided by this exception is the address of the instruction (not the faulting address). The kernel maps the "invalid instruction" to SEGV, but fails to provide the real fault address. Because of this ASan lies and says that those cases are null dereferences. This downgrades the severity of a found bug in terms of security. In the ASan signal handler, we can not provide the real faulting address, but at least we can try not to lie. rdar://50366151 Reviewed By: vitalybuka Differential Revision: https://reviews.llvm.org/D68676 llvm-svn: 374265 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374384 91177308-0d34-0410-b5e6-96231b3b80d8
* Fix sanitizer lint check after r374315Russell Gallop2019-10-101-1/+2
| | | | git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374321 91177308-0d34-0410-b5e6-96231b3b80d8
* [UBSan] Appease linterRoman Lebedev2019-10-101-2/+4
| | | | git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374316 91177308-0d34-0410-b5e6-96231b3b80d8
* [Sanitizers] Porting getrandom/getentropy interceptors to FreeBSDDavid Carlier2019-10-102-1/+18
| | | | | | | | | | | | | - Available from 12.x branch, by the time it lands next year in FreeBSD tree, the 11.x's might be EOL. - Intentionally changed the getrandom test to C code as with 12.0 (might be fixed in CURRENT since), there is a linkage issue in C++ context. Reviewers: emaste, dim, vitalybuka Reviewed-By: vitalybuka Differential Revision: https://reviews.llvm.org/D68451 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374315 91177308-0d34-0410-b5e6-96231b3b80d8
* Revert "[ASan] Do not misrepresent high value address dereferences as null ↵Russell Gallop2019-10-106-40/+6
| | | | | | | | | | dereferences" As it was breaking bots running sanitizer lint check This reverts r374265 (git b577efe4567f1f6a711ad36e1d17280dd1c4f009) git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374308 91177308-0d34-0410-b5e6-96231b3b80d8
* [UBSan][clang][compiler-rt] Applying non-zero offset to nullptr is undefined ↵Roman Lebedev2019-10-103-3/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | behaviour Summary: Quote from http://eel.is/c++draft/expr.add#4: ``` 4 When an expression J that has integral type is added to or subtracted from an expression P of pointer type, the result has the type of P. (4.1) If P evaluates to a null pointer value and J evaluates to 0, the result is a null pointer value. (4.2) Otherwise, if P points to an array element i of an array object x with n elements ([dcl.array]), the expressions P + J and J + P (where J has the value j) point to the (possibly-hypothetical) array element i+j of x if 0≤i+j≤n and the expression P - J points to the (possibly-hypothetical) array element i−j of x if 0≤i−j≤n. (4.3) Otherwise, the behavior is undefined. ``` Therefore, as per the standard, applying non-zero offset to `nullptr` (or making non-`nullptr` a `nullptr`, by subtracting pointer's integral value from the pointer itself) is undefined behavior. (*if* `nullptr` is not defined, i.e. e.g. `-fno-delete-null-pointer-checks` was *not* specified.) To make things more fun, in C (6.5.6p8), applying *any* offset to null pointer is undefined, although Clang front-end pessimizes the code by not lowering that info, so this UB is "harmless". Since rL369789 (D66608 `[InstCombine] icmp eq/ne (gep inbounds P, Idx..), null -> icmp eq/ne P, null`) LLVM middle-end uses those guarantees for transformations. If the source contains such UB's, said code may now be miscompiled. Such miscompilations were already observed: * https://lists.llvm.org/pipermail/llvm-commits/Week-of-Mon-20190826/687838.html * https://github.com/google/filament/pull/1566 Surprisingly, UBSan does not catch those issues ... until now. This diff teaches UBSan about these UB's. `getelementpointer inbounds` is a pretty frequent instruction, so this does have a measurable impact on performance; I've addressed most of the obvious missing folds (and thus decreased the performance impact by ~5%), and then re-performed some performance measurements using my [[ https://github.com/darktable-org/rawspeed | RawSpeed ]] benchmark: (all measurements done with LLVM ToT, the sanitizer never fired.) * no sanitization vs. existing check: average `+21.62%` slowdown * existing check vs. check after this patch: average `22.04%` slowdown * no sanitization vs. this patch: average `48.42%` slowdown Reviewers: vsk, filcab, rsmith, aaron.ballman, vitalybuka, rjmccall, #sanitizers Reviewed By: rsmith Subscribers: kristof.beyls, nickdesaulniers, nikic, ychen, dtzWill, xbolva00, dberris, arphaman, rupprecht, reames, regehr, llvm-commits, cfe-commits Tags: #clang, #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D67122 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374293 91177308-0d34-0410-b5e6-96231b3b80d8
* [ASan] Do not misrepresent high value address dereferences as null dereferencesJulian Lettner2019-10-106-6/+40
| | | | | | | | | | | | | | | | | | | | | | Dereferences with addresses above the 48-bit hardware addressable range produce "invalid instruction" (instead of "invalid access") hardware exceptions (there is no hardware address decoding logic for those bits), and the address provided by this exception is the address of the instruction (not the faulting address). The kernel maps the "invalid instruction" to SEGV, but fails to provide the real fault address. Because of this ASan lies and says that those cases are null dereferences. This downgrades the severity of a found bug in terms of security. In the ASan signal handler, we can not provide the real faulting address, but at least we can try not to lie. rdar://50366151 Reviewed By: vitalybuka Differential Revision: https://reviews.llvm.org/D68676 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374265 91177308-0d34-0410-b5e6-96231b3b80d8
* [sanitizer_common] Remove OnPrint from Go build.Matt Morehouse2019-10-091-6/+0
| | | | | | | | | | | | | | | | Summary: Go now uses __sanitizer_on_print instead. Reviewers: vitalybuka, dvyukov Reviewed By: vitalybuka Subscribers: llvm-commits Tags: #llvm Differential Revision: https://reviews.llvm.org/D68621 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374258 91177308-0d34-0410-b5e6-96231b3b80d8
* [libFuzzer] Fix Alarm callback in fuchsia.Jake Ehrlich2019-10-091-2/+2
| | | | | | | | | | | | | | | | This patch adds an #if macro to skip the InFuzzingThread() comparison for fuchsia, similar to what it is done for Windows and NetBSD. In fuchsia, the alarm callback runs in a separate thread[0], making it fail the comparison InFuzzingThread(), breaking the -timeout flag. [0]: https://github.com/llvm/llvm-project/blob/master/compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp#L323 Author: charco (aka Marco Vanotti) Differential Revision: https://reviews.llvm.org/D68166 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374228 91177308-0d34-0410-b5e6-96231b3b80d8
* [scudo][standalone] Get statistics in a char bufferKostya Kortchinsky2019-10-0914-69/+145
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: Following up on D68471, this CL introduces some `getStats` APIs to gather statistics in char buffers (`ScopedString` really) instead of printing them out right away. Ultimately `printStats` will just output the buffer, but that allows us to potentially do some work on the intermediate buffer, and can be used for a `mallocz` type of functionality. This allows us to pretty much get rid of all the `Printf` calls around, but I am keeping the function in for debugging purposes. This changes the existing tests to use the new APIs when required. I will add new tests as suggested in D68471 in another CL. Reviewers: morehouse, hctim, vitalybuka, eugenis, cferris Reviewed By: morehouse Subscribers: delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D68653 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374173 91177308-0d34-0410-b5e6-96231b3b80d8
* [builtins] Unbreak build on FreeBSD armv7 after D60351David Carlier2019-10-082-3/+9
| | | | | | | | | | | | headers include reordering. Reviewers: phosek, echristo Reviewed-By: phosek Differential Revsion: https://reviews.llvm.org/D68045 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@374070 91177308-0d34-0410-b5e6-96231b3b80d8
* [msan] Add interceptors: crypt, crypt_r.Evgeniy Stepanov2019-10-084-0/+42
| | | | | | | | | | | | Reviewers: vitalybuka Subscribers: srhines, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68431 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373993 91177308-0d34-0410-b5e6-96231b3b80d8
* [tsan, go] fix Go windows buildVitaly Buka2019-10-072-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | | Summary: Don't use weak exports when building tsan into a shared library for Go. gcc can't handle the pragmas used to make the weak references. Include files that have been added since the last update to build.bat. (We should really find a better way to list all the files needed.) Add windows version defines (WINVER and _WIN32_WINNT) to get AcquireSRWLockExclusive and ReleaseSRWLockExclusive defined. Define GetProcessMemoryInfo to use the kernel32 version. This is kind of a hack, the windows header files should do this translation for us. I think we're not in the right family partition (we're using Desktop, but that translation only happens for App and System partitions???), but hacking the family partition seems equally gross and I have no idea what the consequences of that might be. Patch by Keith Randall. Reviewers: dvyukov, vitalybuka Reviewed By: vitalybuka Subscribers: jfb, delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D68599 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373984 91177308-0d34-0410-b5e6-96231b3b80d8
* [tsan, go] break commands into multiple linesVitaly Buka2019-10-071-3/+55
| | | | | | | | | | | | | | Summary: Patch by Keith Randall. Reviewers: dvyukov, vitalybuka Subscribers: delcypher, jfb, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D68596 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373983 91177308-0d34-0410-b5e6-96231b3b80d8
* [sanitizer] Print SIGTRAP for corresponding signalVitaly Buka2019-10-071-0/+2
| | | | | | | | | | | | Reviewers: eugenis, jfb Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68603 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373979 91177308-0d34-0410-b5e6-96231b3b80d8
* [tsan] Don't delay SIGTRAP handlerVitaly Buka2019-10-071-4/+5
| | | | | | | | | | | | Reviewers: eugenis, jfb Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68604 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373978 91177308-0d34-0410-b5e6-96231b3b80d8
* [scudo][standalone] Correct releaseToOS behaviorKostya Kortchinsky2019-10-073-27/+67
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: There was an issue in `releaseToOSMaybe`: one of the criteria to decide if we should proceed with the release was wrong. Namely: ``` const uptr N = Sci->Stats.PoppedBlocks - Sci->Stats.PushedBlocks; if (N * BlockSize < PageSize) return; // No chance to release anything. ``` I meant to check if the amount of bytes in the free list was lower than a page, but this actually checks if the amount of **in use** bytes was lower than a page. The correct code is: ``` const uptr BytesInFreeList = Region->AllocatedUser - (Region->Stats.PoppedBlocks - Region->Stats.PushedBlocks) * BlockSize; if (BytesInFreeList < PageSize) return 0; // No chance to release anything. ``` Consequences of the bug: - if a class size has less than a page worth of in-use bytes (allocated or in a cache), reclaiming would not occur, whatever the amount of blocks in the free list; in real world scenarios this is unlikely to happen and be impactful; - if a class size had less than a page worth of free bytes (and enough in-use bytes, etc), then reclaiming would be attempted, with likely no result. This means the reclaiming was overzealous at times. I didn't have a good way to test for this, so I changed the prototype of the function to return the number of bytes released, allowing to get the information needed. The test added fails with the initial criteria. Another issue is that `ReleaseToOsInterval` can actually be 0, meaning we always try to release (side note: it's terrible for performances). so change a `> 0` check to `>= 0`. Additionally, decrease the `CanRelease` threshold to `PageSize / 32`. I still have to make that configurable but I will do it at another time. Finally, rename some variables in `printStats`: I feel like "available" was too ambiguous, so change it to "total". Reviewers: morehouse, hctim, eugenis, vitalybuka, cferris Reviewed By: morehouse Subscribers: delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D68471 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373930 91177308-0d34-0410-b5e6-96231b3b80d8
* [scudo][standalone] Make malloc_info return a minimal XMLKostya Kortchinsky2019-10-043-4/+16
| | | | | | | | | | | | | | | | | | | | | Summary: Initially, our malloc_info was returning ENOTSUP, but Android would rather have it return successfully and write a barebone XML to the stream, so we will oblige. Add an associated test. Reviewers: cferris, morehouse, hctim, eugenis, vitalybuka Reviewed By: morehouse Subscribers: delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D68427 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373754 91177308-0d34-0410-b5e6-96231b3b80d8
* compiler-rt: use __GLIBC_PREREQ for SANITIZER_INTERCEPT_GETRANDOMVitaly Buka2019-10-041-2/+2
| | | | | | | | | | | | | | Summary: Fixes https://github.com/google/oss-fuzz/issues/2836 Reviewers: eugenis Subscribers: dberris, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68178 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373681 91177308-0d34-0410-b5e6-96231b3b80d8
* compiler-rt: move all __GLIBC_PREREQ into own header fileVitaly Buka2019-10-035-19/+38
| | | | | | | | | | | | Reviewers: eugenis Subscribers: dberris, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68177 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373632 91177308-0d34-0410-b5e6-96231b3b80d8
* Move SanitizerInitializeUnwinder outside anonymous namespace.Matt Morehouse2019-10-021-32/+32
| | | | | | Fixes the Android build breakage introduced in r373528. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373539 91177308-0d34-0410-b5e6-96231b3b80d8
* [sanitizer_common] Declare __sanitizer_on_print in Windows interception.Matt Morehouse2019-10-021-0/+1
| | | | | | Speculative fix for Windows bot. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373532 91177308-0d34-0410-b5e6-96231b3b80d8
* [sanitizer_common] Add __sanitizer_on_print to interface list.Matt Morehouse2019-10-021-0/+1
| | | | | | Should fix the current Windows buildbot failure. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373530 91177308-0d34-0410-b5e6-96231b3b80d8
* [compiler-rt] Use GetNextInstructionPc in signal handlersVitaly Buka2019-10-025-6/+8
| | | | | | | | | | | | | | | | | | Summary: All other stack trace callers assume that PC contains return address. HWAsan already use GetNextInstructionPc in similar code. PR43339 Reviewers: eugenis, kcc, jfb Subscribers: dexonsmith, dberris, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68313 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373529 91177308-0d34-0410-b5e6-96231b3b80d8
* NFC: add namespace {}Vitaly Buka2019-10-021-0/+4
| | | | git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373528 91177308-0d34-0410-b5e6-96231b3b80d8
* [sanitizer_common] Rename OnPrint to __sanitizer_on_print.Matt Morehouse2019-10-021-1/+7
| | | | | | | | | | | | | | | | | | Summary: https://reviews.llvm.org/D28596 exposed OnPrint in the global namespace, which can cause collisions with user-defined OnPrint() functions. Reviewers: vitalybuka, dvyukov Reviewed By: vitalybuka, dvyukov Subscribers: llvm-commits Tags: #llvm Differential Revision: https://reviews.llvm.org/D67987 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373518 91177308-0d34-0410-b5e6-96231b3b80d8
* [libFuzzer] Remove lazy counters.Matt Morehouse2019-10-0110-67/+0
| | | | | | | | | | | | | | | | Summary: Lazy counters haven't improved performance for large fuzz targets. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Tags: #llvm Differential Revision: https://reviews.llvm.org/D67476 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373403 91177308-0d34-0410-b5e6-96231b3b80d8
* Revert "compiler-rt: use __GLIBC_PREREQ for SANITIZER_INTERCEPT_GETRANDOM"Vitaly Buka2019-10-016-37/+21
| | | | | | | | | | | Revert "compiler-rt: move all __GLIBC_PREREQ into own header file" "move all __GLIBC_PREREQ" breaks build on some bots This reverts commit 2d75ee937397c209dbd95aefc88da6301fed07da. This reverts commit 7a6461fcc2ed8e28c43993c561721af0bbe97f3a. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373367 91177308-0d34-0410-b5e6-96231b3b80d8
* compiler-rt: use __GLIBC_PREREQ for SANITIZER_INTERCEPT_GETRANDOMVitaly Buka2019-10-011-2/+2
| | | | | | | | | | | | | | Summary: Fixes https://github.com/google/oss-fuzz/issues/2836 Reviewers: eugenis Subscribers: dberris, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68178 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373284 91177308-0d34-0410-b5e6-96231b3b80d8
* compiler-rt: move all __GLIBC_PREREQ into own header fileVitaly Buka2019-10-015-19/+35
| | | | | | | | | | | | Reviewers: eugenis Subscribers: dberris, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68177 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373283 91177308-0d34-0410-b5e6-96231b3b80d8
* Rename tsan_interceptors.cpp into tsan_interceptors_posix.cppVitaly Buka2019-10-013-3/+3
| | | | | | | | | | | | | | | | | | | | | Summary: It's needed to use __GLIBC_PREREQ from <features.h> tsan didn't let us to include <features.h> by using --sysroot=. to disable system includes on anything that is not named as "tsan*posix*", "tsan*mac*", "tsan*linux*". See compiler-rt/lib/tsan/CMakeLists.txt Reviewers: eugenis, dvyukov, kcc Reviewed By: kcc Subscribers: mgorny, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68176 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373282 91177308-0d34-0410-b5e6-96231b3b80d8
* [msan] Intercept __getrlimit.Evgeniy Stepanov2019-09-301-7/+17
| | | | | | | | | | | | | | | | | | | | Summary: This interceptor is useful on its own, but the main purpose of this change is to intercept libpthread initialization on linux/glibc in order to run __msan_init before any .preinit_array constructors. We used to trigger on pthread_initialize_minimal -> getrlimit(), but that call has changed to __getrlimit at some point. Reviewers: vitalybuka, pcc Subscribers: jfb, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68168 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373239 91177308-0d34-0410-b5e6-96231b3b80d8
* [libFuzzer] Dump trace and provide correct msg for overwritten input.Mitch Phillips2019-09-271-1/+3
| | | | | | | | | | | | | | | | | | Summary: Now crashes with a stacktrace and uses 'overwrites-const-input' as the error message instead of 'out-of-memory'. Reviewers: morehouse, Dor1s Reviewed By: morehouse, Dor1s Subscribers: #sanitizers, llvm-commits, metzman, Dor1s Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D68067 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373130 91177308-0d34-0410-b5e6-96231b3b80d8
* hwasan: Compatibility fixes for short granules.Peter Collingbourne2019-09-271-2/+48
| | | | | | | | | | | | | | | | | | | | | | | | | We can't use short granules with stack instrumentation when targeting older API levels because the rest of the system won't understand the short granule tags stored in shadow memory. Moreover, we need to be able to let old binaries (which won't understand short granule tags) run on a new system that supports short granule tags. Such binaries will call the __hwasan_tag_mismatch function when their outlined checks fail. We can compensate for the binary's lack of support for short granules by implementing the short granule part of the check in the __hwasan_tag_mismatch function. Unfortunately we can't do anything about inline checks, but I don't believe that we can generate these by default on aarch64, nor did we do so when the ABI was fixed. A new function, __hwasan_tag_mismatch_v2, is introduced that lets code targeting the new runtime avoid redoing the short granule check. Because tag mismatches are rare this isn't important from a performance perspective; the main benefit is that it introduces a symbol dependency that prevents binaries targeting the new runtime from running on older (i.e. incompatible) runtimes. Differential Revision: https://reviews.llvm.org/D68059 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@373035 91177308-0d34-0410-b5e6-96231b3b80d8
* [libFuzzer] [NFC] Fix grammar error with "it's"Mitch Phillips2019-09-261-1/+1
| | | | git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372937 91177308-0d34-0410-b5e6-96231b3b80d8
* [TSAN] Add read/write range interface functions with PCJoachim Protze2019-09-242-0/+13
| | | | | | | | | | Adding annotation function variants __tsan_write_range_pc and __tsan_read_range_pc to annotate ranged access to memory while providing a program counter for the access. Differential Revision: https://reviews.llvm.org/D66885 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372730 91177308-0d34-0410-b5e6-96231b3b80d8
* sanitizer_common: fix freebsd build errorDmitry Vyukov2019-09-241-1/+0
| | | | | | | | | | | Variable flags is not used. Remove it. Suggested-by: randall77 (Keith Randall) Review: https://reviews.llvm.org/D67928 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372698 91177308-0d34-0410-b5e6-96231b3b80d8
* Fix int to bool errors exposed due to r372612.Rumeet Dhindsa2019-09-243-4/+4
| | | | | | | | | | Differential Revision: https://reviews.llvm.org/D67937 M lib/builtins/fp_add_impl.inc M lib/builtins/fp_lib.h M lib/builtins/fp_trunc_impl.inc git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372684 91177308-0d34-0410-b5e6-96231b3b80d8
* [compiler-rt] Fix lint check failure on commentsJinsong Ji2019-09-222-2/+4
| | | | | | | | | This fixes buildbot failures for https://reviews.llvm.org/rL372459. (at least on PowerPC/Z ) The fix is generated by running clang-format on the error lines only. git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372511 91177308-0d34-0410-b5e6-96231b3b80d8
* Add __lsan::ScopedInterceptorDisabler for strerror(3)Kamil Rytarowski2019-09-213-0/+23
| | | | | | | | | | | | | | | | | | | | Summary: strerror(3) on NetBSD uses internally TSD with a destructor that is never fired for exit(3). It's correctly called for pthread_exit(3) scenarios. This is a case when a leak on exit(3) is expected, unavoidable and harmless. Reviewers: joerg, vitalybuka, dvyukov, mgorny Reviewed By: vitalybuka Subscribers: dmgreen, kristof.beyls, jfb, llvm-commits, #sanitizers Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D67337 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372461 91177308-0d34-0410-b5e6-96231b3b80d8
* Stop tracking atexit/__cxa_atexit/pthread_atfork allocations in LSan/NetBSDKamil Rytarowski2019-09-214-1/+101
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: The atexit(3) and __cxa_atexit() calls allocate internally memory and free on exit, after executing all callback. This causes false positives as DoLeakCheck() is called from the atexit handler. In the LSan/ASan tests there are strict checks triggering false positives here. Intercept all atexit(3) and __cxa_atexit() calls and disable LSan when calling the real functions. Stop tracing allocations in pthread_atfork(3) funtions, as there are performed internal allocations that are not freed for the time of running StopTheWorld() code. This avoids false-positives. The same changes have to be replicated in the ASan and LSan runtime. Non-NetBSD OSs are not tested and this code is restricted to NetBSD only. Reviewers: dvyukov, joerg, mgorny, vitalybuka, eugenis Reviewed By: vitalybuka Subscribers: jfb, llvm-commits, #sanitizers Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D67331 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372459 91177308-0d34-0410-b5e6-96231b3b80d8
* [lsan] Fix deadlock in dl_iterate_phdr.Evgeniy Stepanov2019-09-194-12/+17
| | | | | | | | | | | | | | | | | Summary: Do not grab the allocator lock before calling dl_iterate_phdr. This may cause a lock order inversion with (valid) user code that uses malloc inside a dl_iterate_phdr callback. Reviewers: vitalybuka, hctim Subscribers: jfb, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D67738 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372348 91177308-0d34-0410-b5e6-96231b3b80d8
* tsan: allow the Go runtime to return multiple stack frames for a single PCDmitry Vyukov2019-09-181-7/+18
| | | | | | | | | | | | | | This fix allows tsan to report stack traces correctly even in the presence of mid-stack inlining by the Go compiler. See https://go-review.googlesource.com/c/go/+/195781 for the Go runtime side of this change. Author: randall77 (Keith Randall) Reviewed: https://reviews.llvm.org/D67671 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372205 91177308-0d34-0410-b5e6-96231b3b80d8
* Remove asan test for strncat(x, y, 0)David Bolvansky2019-09-171-3/+1
| | | | git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372143 91177308-0d34-0410-b5e6-96231b3b80d8
* [ASAN] Adjust asan tests due to new optimizationsDavid Bolvansky2019-09-171-1/+1
| | | | git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372141 91177308-0d34-0410-b5e6-96231b3b80d8
* [libFuzzer] Always print DSO map on Fuchsia libFuzzer launchJake Ehrlich2019-09-172-0/+12
| | | | | | | | | | | | | | | | Fuchsia doesn't have /proc/id/maps, so it relies on the kernel logging system to provide the DSO map to be able to symbolize in the context of ASLR. The DSO map is logged automatically on Fuchsia when encountering a crash or writing to the sanitizer log for the first time in a process. There are several cases where libFuzzer doesn't encounter a crash, e.g. on timeouts, OOMs, and when configured to print new PCs as they become covered, to name a few. Therefore, this change always writes to the sanitizer log on startup to ensure the DSO map is available in the log. Author: aarongreen Differential Revision: https://reviews.llvm.org/D66233 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372056 91177308-0d34-0410-b5e6-96231b3b80d8
* [compiler-rt][crt] make test case nontrivial in check_cxx_section_existsJian Cai2019-09-161-1/+1
| | | | | | | | | | | | | | | | | | Summary: .init_array gets optimized away when building with -O2 and as a result, check_cxx_section_exists failed to pass -DCOMPILER_RT_HAS_INITFINI_ARRAY when building crtbegin.o and crtend.o, which causes binaries linked with them encounter segmentation fault. See https://crbug.com/855759 for details. This change prevents .init_array section to be optimized away even with -O2 or higher optimization level. Subscribers: dberris, mgorny, #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D67628 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@372038 91177308-0d34-0410-b5e6-96231b3b80d8
* [libFuzzer] Remove unused version of FuzzedDataProvider.h.Max Moroz2019-09-161-247/+0
| | | | | | | | | | | | | | | | Summary: The actual version lives in compiler-rt/include/fuzzer/. Reviewers: Dor1s Reviewed By: Dor1s Subscribers: delcypher, #sanitizers, llvm-commits Tags: #llvm, #sanitizers Differential Revision: https://reviews.llvm.org/D67623 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@371997 91177308-0d34-0410-b5e6-96231b3b80d8
View Lorry Controller Status