9 Commits

Author SHA1 Message Date
Peter Collingbourne
a77d9f726a DataFlowSanitizer: Add a debugging feature to help us track nonzero labels.
Summary:
When the -dfsan-debug-nonzero-labels parameter is supplied, the code
is instrumented such that when a call parameter, return value or load
produces a nonzero label, the function __dfsan_nonzero_label is called.
The idea is that a debugger breakpoint can be set on this function
in a nominally label-free program to help identify any bugs in the
instrumentation pass causing labels to be introduced.

Reviewers: eugenis

CC: llvm-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D1405

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@188472 91177308-0d34-0410-b5e6-96231b3b80d8
2013-08-15 18:51:12 +00:00
Peter Collingbourne
ef8136dda1 DataFlowSanitizer: Instrumentation for memset.
Differential Revision: http://llvm-reviews.chandlerc.com/D1395

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@188412 91177308-0d34-0410-b5e6-96231b3b80d8
2013-08-14 20:51:38 +00:00
Peter Collingbourne
fdb1a6c341 DataFlowSanitizer: greylist is now ABI list.
This replaces the old incomplete greylist functionality with an ABI
list, which can provide more detailed information about the ABI and
semantics of specific functions.  The pass treats every function in
the "uninstrumented" category in the ABI list file as conforming to
the "native" (i.e. unsanitized) ABI.  Unless the ABI list contains
additional categories for those functions, a call to one of those
functions will produce a warning message, as the labelling behaviour
of the function is unknown.  The other supported categories are
"functional", "discard" and "custom".

- "discard" -- This function does not write to (user-accessible) memory,
  and its return value is unlabelled.
- "functional" -- This function does not write to (user-accessible)
  memory, and the label of its return value is the union of the label of
  its arguments.
- "custom" -- Instead of calling the function, a custom wrapper __dfsw_F
  is called, where F is the name of the function.  This function may wrap
  the original function or provide its own implementation.

Differential Revision: http://llvm-reviews.chandlerc.com/D1345

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@188402 91177308-0d34-0410-b5e6-96231b3b80d8
2013-08-14 18:54:12 +00:00
Dmitry Vyukov
a036a31d94 dfsan: fix lint warnings
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@188293 91177308-0d34-0410-b5e6-96231b3b80d8
2013-08-13 16:52:41 +00:00
Peter Collingbourne
a90d91fd1a DataFlowSanitizer: fix a use-after-free. Spotted by libgmalloc.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@188216 91177308-0d34-0410-b5e6-96231b3b80d8
2013-08-12 22:38:39 +00:00
Alexey Samsonov
e39e1316f0 Add SpecialCaseList::createOrDie() factory and use it in sanitizer passes
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@188169 91177308-0d34-0410-b5e6-96231b3b80d8
2013-08-12 11:46:09 +00:00
Peter Collingbourne
aaae6e9cb8 DataFlowSanitizer: Remove unreachable BBs so IR continues to verify
under the args ABI.

Differential Revision: http://llvm-reviews.chandlerc.com/D1316

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@188113 91177308-0d34-0410-b5e6-96231b3b80d8
2013-08-09 21:42:53 +00:00
Peter Collingbourne
46c72c74cf Fix ARM build.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@187944 91177308-0d34-0410-b5e6-96231b3b80d8
2013-08-08 00:15:27 +00:00
Peter Collingbourne
6fa33f5dd9 DataFlowSanitizer; LLVM changes.
DataFlowSanitizer is a generalised dynamic data flow analysis.

Unlike other Sanitizer tools, this tool is not designed to detect a
specific class of bugs on its own.  Instead, it provides a generic
dynamic data flow analysis framework to be used by clients to help
detect application-specific issues within their own code.

Differential Revision: http://llvm-reviews.chandlerc.com/D965

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@187923 91177308-0d34-0410-b5e6-96231b3b80d8
2013-08-07 22:47:18 +00:00