[ASan] Use llvm.global_ctors to insert init-order checking calls into ASan runtime.

Don't assume that dynamically initialized globals are all initialized from
_GLOBAL__<module_name>I_ function. Instead, scan the llvm.global_ctors and
insert poison/unpoison calls to each function there.

Patch by Nico Weber!


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@209780 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Alexey Samsonov 2014-05-29 00:51:15 +00:00
parent 1d4e8baa9c
commit b18eabd2d8
2 changed files with 25 additions and 34 deletions

View File

@ -391,6 +391,7 @@ class AddressSanitizerModule : public ModulePass {
void initializeCallbacks(Module &M);
bool ShouldInstrumentGlobal(GlobalVariable *G);
void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName);
void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName);
size_t MinRedzoneSizeForGlobal() const {
return RedzoneSizeForScale(Mapping.Scale);
@ -851,48 +852,36 @@ void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
Crash->setDebugLoc(OrigIns->getDebugLoc());
}
void AddressSanitizerModule::createInitializerPoisonCalls(
Module &M, GlobalValue *ModuleName) {
// We do all of our poisoning and unpoisoning within a global constructor.
// These are called _GLOBAL__(sub_)?I_.*.
// TODO: Consider looking through the functions in
// M.getGlobalVariable("llvm.global_ctors") instead of using this stringly
// typed approach.
Function *GlobalInit = nullptr;
for (auto &F : M.getFunctionList()) {
StringRef FName = F.getName();
const char kGlobalPrefix[] = "_GLOBAL__";
if (!FName.startswith(kGlobalPrefix))
continue;
FName = FName.substr(strlen(kGlobalPrefix));
const char kOptionalSub[] = "sub_";
if (FName.startswith(kOptionalSub))
FName = FName.substr(strlen(kOptionalSub));
if (FName.startswith("I_")) {
GlobalInit = &F;
break;
}
}
// If that function is not present, this TU contains no globals, or they have
// all been optimized away
if (!GlobalInit)
return;
void AddressSanitizerModule::poisonOneInitializer(Function &GlobalInit,
GlobalValue *ModuleName) {
// Set up the arguments to our poison/unpoison functions.
IRBuilder<> IRB(GlobalInit->begin()->getFirstInsertionPt());
IRBuilder<> IRB(GlobalInit.begin()->getFirstInsertionPt());
// Add a call to poison all external globals before the given function starts.
Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy);
IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr);
// Add calls to unpoison all globals before each return instruction.
for (Function::iterator I = GlobalInit->begin(), E = GlobalInit->end();
I != E; ++I) {
if (ReturnInst *RI = dyn_cast<ReturnInst>(I->getTerminator())) {
for (auto &BB : GlobalInit.getBasicBlockList())
if (ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator()))
CallInst::Create(AsanUnpoisonGlobals, "", RI);
}
void AddressSanitizerModule::createInitializerPoisonCalls(
Module &M, GlobalValue *ModuleName) {
GlobalVariable *GV = M.getGlobalVariable("llvm.global_ctors");
ConstantArray *CA = cast<ConstantArray>(GV->getInitializer());
for (Use &OP : CA->operands()) {
if (isa<ConstantAggregateZero>(OP))
continue;
ConstantStruct *CS = cast<ConstantStruct>(OP);
// Must have a function or null ptr.
// (CS->getOperand(0) is the init priority.)
if (Function* F = dyn_cast<Function>(CS->getOperand(1))) {
if (F->getName() != kAsanModuleCtorName)
poisonOneInitializer(*F, ModuleName);
}
}
}

View File

@ -23,6 +23,8 @@ entry:
ret void
}
@llvm.global_ctors = appending global [1 x { i32, void ()* }] [{ i32, void ()* } { i32 65535, void ()* @_GLOBAL__I_a }]
define internal void @_GLOBAL__I_a() sanitize_address section ".text.startup" {
entry:
call void @__cxx_global_var_init()