1 /* UndefinedBehaviorSanitizer, undefined behavior detector.
2 Copyright (C) 2013-2016 Free Software Foundation, Inc.
3 Contributed by Marek Polacek <polacek@redhat.com>
4
5 This file is part of GCC.
6
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
10 version.
11
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
20
21 #include "config.h"
22 #include "system.h"
23 #include "coretypes.h"
24 #include "tm.h"
25 #include "c-family/c-common.h"
26 #include "ubsan.h"
27 #include "c-family/c-ubsan.h"
28 #include "asan.h"
29 #include "stor-layout.h"
30 #include "builtins.h"
31 #include "gimplify.h"
32
33 /* Instrument division by zero and INT_MIN / -1. If not instrumenting,
34 return NULL_TREE. */
35
36 tree
ubsan_instrument_division(location_t loc,tree op0,tree op1)37 ubsan_instrument_division (location_t loc, tree op0, tree op1)
38 {
39 tree t, tt;
40 tree type = TREE_TYPE (op0);
41
42 /* At this point both operands should have the same type,
43 because they are already converted to RESULT_TYPE.
44 Use TYPE_MAIN_VARIANT since typedefs can confuse us. */
45 gcc_assert (TYPE_MAIN_VARIANT (TREE_TYPE (op0))
46 == TYPE_MAIN_VARIANT (TREE_TYPE (op1)));
47
48 op0 = unshare_expr (op0);
49 op1 = unshare_expr (op1);
50
51 if (TREE_CODE (type) == INTEGER_TYPE
52 && (flag_sanitize & SANITIZE_DIVIDE))
53 t = fold_build2 (EQ_EXPR, boolean_type_node,
54 op1, build_int_cst (type, 0));
55 else if (TREE_CODE (type) == REAL_TYPE
56 && (flag_sanitize & SANITIZE_FLOAT_DIVIDE))
57 t = fold_build2 (EQ_EXPR, boolean_type_node,
58 op1, build_real (type, dconst0));
59 else
60 return NULL_TREE;
61
62 /* We check INT_MIN / -1 only for signed types. */
63 if (TREE_CODE (type) == INTEGER_TYPE
64 && (flag_sanitize & SANITIZE_DIVIDE)
65 && !TYPE_UNSIGNED (type))
66 {
67 tree x;
68 tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1),
69 build_int_cst (type, -1));
70 x = fold_build2 (EQ_EXPR, boolean_type_node, op0,
71 TYPE_MIN_VALUE (type));
72 x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt);
73 t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x);
74 }
75
76 /* If the condition was folded to 0, no need to instrument
77 this expression. */
78 if (integer_zerop (t))
79 return NULL_TREE;
80
81 /* In case we have a SAVE_EXPR in a conditional context, we need to
82 make sure it gets evaluated before the condition. */
83 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
84 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
85 if (flag_sanitize_undefined_trap_on_error)
86 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
87 else
88 {
89 tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc,
90 ubsan_type_descriptor (type), NULL_TREE,
91 NULL_TREE);
92 data = build_fold_addr_expr_loc (loc, data);
93 enum built_in_function bcode
94 = (flag_sanitize_recover & SANITIZE_DIVIDE)
95 ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW
96 : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT;
97 tt = builtin_decl_explicit (bcode);
98 op0 = unshare_expr (op0);
99 op1 = unshare_expr (op1);
100 tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
101 ubsan_encode_value (op1));
102 }
103 t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
104
105 return t;
106 }
107
108 /* Instrument left and right shifts. */
109
110 tree
ubsan_instrument_shift(location_t loc,enum tree_code code,tree op0,tree op1)111 ubsan_instrument_shift (location_t loc, enum tree_code code,
112 tree op0, tree op1)
113 {
114 tree t, tt = NULL_TREE;
115 tree type0 = TREE_TYPE (op0);
116 tree type1 = TREE_TYPE (op1);
117 tree op1_utype = unsigned_type_for (type1);
118 HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
119 tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);
120
121 op0 = unshare_expr (op0);
122 op1 = unshare_expr (op1);
123
124 t = fold_convert_loc (loc, op1_utype, op1);
125 t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);
126
127 /* If this is not a signed operation, don't perform overflow checks.
128 Also punt on bit-fields. */
129 if (!INTEGRAL_TYPE_P (type0)
130 || TYPE_OVERFLOW_WRAPS (type0)
131 || GET_MODE_BITSIZE (TYPE_MODE (type0)) != TYPE_PRECISION (type0))
132 ;
133
134 /* For signed x << y, in C99/C11, the following:
135 (unsigned) x >> (uprecm1 - y)
136 if non-zero, is undefined. */
137 else if (code == LSHIFT_EXPR && flag_isoc99 && cxx_dialect < cxx11)
138 {
139 tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
140 fold_convert (op1_utype, unshare_expr (op1)));
141 tt = fold_convert_loc (loc, unsigned_type_for (type0), op0);
142 tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
143 tt = fold_build2 (NE_EXPR, boolean_type_node, tt,
144 build_int_cst (TREE_TYPE (tt), 0));
145 }
146
147 /* For signed x << y, in C++11 and later, the following:
148 x < 0 || ((unsigned) x >> (uprecm1 - y))
149 if > 1, is undefined. */
150 else if (code == LSHIFT_EXPR && cxx_dialect >= cxx11)
151 {
152 tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1,
153 fold_convert (op1_utype, unshare_expr (op1)));
154 tt = fold_convert_loc (loc, unsigned_type_for (type0),
155 unshare_expr (op0));
156 tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x);
157 tt = fold_build2 (GT_EXPR, boolean_type_node, tt,
158 build_int_cst (TREE_TYPE (tt), 1));
159 x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0),
160 build_int_cst (type0, 0));
161 tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt);
162 }
163
164 /* If the condition was folded to 0, no need to instrument
165 this expression. */
166 if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt)))
167 return NULL_TREE;
168
169 /* In case we have a SAVE_EXPR in a conditional context, we need to
170 make sure it gets evaluated before the condition. */
171 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t);
172 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t);
173 t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t,
174 tt ? tt : integer_zero_node);
175
176 if (flag_sanitize_undefined_trap_on_error)
177 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
178 else
179 {
180 tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc,
181 ubsan_type_descriptor (type0),
182 ubsan_type_descriptor (type1), NULL_TREE,
183 NULL_TREE);
184 data = build_fold_addr_expr_loc (loc, data);
185
186 enum built_in_function bcode
187 = (flag_sanitize_recover & SANITIZE_SHIFT)
188 ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS
189 : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT;
190 tt = builtin_decl_explicit (bcode);
191 op0 = unshare_expr (op0);
192 op1 = unshare_expr (op1);
193 tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0),
194 ubsan_encode_value (op1));
195 }
196 t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
197
198 return t;
199 }
200
201 /* Instrument variable length array bound. */
202
203 tree
ubsan_instrument_vla(location_t loc,tree size)204 ubsan_instrument_vla (location_t loc, tree size)
205 {
206 tree type = TREE_TYPE (size);
207 tree t, tt;
208
209 t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0));
210 if (flag_sanitize_undefined_trap_on_error)
211 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
212 else
213 {
214 tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc,
215 ubsan_type_descriptor (type), NULL_TREE,
216 NULL_TREE);
217 data = build_fold_addr_expr_loc (loc, data);
218 enum built_in_function bcode
219 = (flag_sanitize_recover & SANITIZE_VLA)
220 ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE
221 : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT;
222 tt = builtin_decl_explicit (bcode);
223 tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size));
224 }
225 t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node);
226
227 return t;
228 }
229
230 /* Instrument missing return in C++ functions returning non-void. */
231
232 tree
ubsan_instrument_return(location_t loc)233 ubsan_instrument_return (location_t loc)
234 {
235 if (flag_sanitize_undefined_trap_on_error)
236 return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0);
237 /* It is possible that PCH zapped table with definitions of sanitizer
238 builtins. Reinitialize them if needed. */
239 initialize_sanitizer_builtins ();
240
241 tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc,
242 NULL_TREE, NULL_TREE);
243 tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN);
244 return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data));
245 }
246
247 /* Instrument array bounds for ARRAY_REFs. We create special builtin,
248 that gets expanded in the sanopt pass, and make an array dimension
249 of it. ARRAY is the array, *INDEX is an index to the array.
250 Return NULL_TREE if no instrumentation is emitted.
251 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
252
253 tree
ubsan_instrument_bounds(location_t loc,tree array,tree * index,bool ignore_off_by_one)254 ubsan_instrument_bounds (location_t loc, tree array, tree *index,
255 bool ignore_off_by_one)
256 {
257 tree type = TREE_TYPE (array);
258 tree domain = TYPE_DOMAIN (type);
259
260 if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE)
261 return NULL_TREE;
262
263 tree bound = TYPE_MAX_VALUE (domain);
264 if (ignore_off_by_one)
265 bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound,
266 build_int_cst (TREE_TYPE (bound), 1));
267
268 /* Detect flexible array members and suchlike, unless
269 -fsanitize=bounds-strict. */
270 tree base = get_base_address (array);
271 if ((flag_sanitize & SANITIZE_BOUNDS_STRICT) == 0
272 && TREE_CODE (array) == COMPONENT_REF
273 && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
274 {
275 tree next = NULL_TREE;
276 tree cref = array;
277
278 /* Walk all structs/unions. */
279 while (TREE_CODE (cref) == COMPONENT_REF)
280 {
281 if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE)
282 for (next = DECL_CHAIN (TREE_OPERAND (cref, 1));
283 next && TREE_CODE (next) != FIELD_DECL;
284 next = DECL_CHAIN (next))
285 ;
286 if (next)
287 /* Not a last element. Instrument it. */
288 break;
289 /* Ok, this is the last field of the structure/union. But the
290 aggregate containing the field must be the last field too,
291 recursively. */
292 cref = TREE_OPERAND (cref, 0);
293 }
294 if (!next)
295 /* Don't instrument this flexible array member-like array in non-strict
296 -fsanitize=bounds mode. */
297 return NULL_TREE;
298 }
299
300 /* Don't emit instrumentation in the most common cases. */
301 tree idx = NULL_TREE;
302 if (TREE_CODE (*index) == INTEGER_CST)
303 idx = *index;
304 else if (TREE_CODE (*index) == BIT_AND_EXPR
305 && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST)
306 idx = TREE_OPERAND (*index, 1);
307 if (idx
308 && TREE_CODE (bound) == INTEGER_CST
309 && tree_int_cst_sgn (idx) >= 0
310 && tree_int_cst_le (idx, bound))
311 return NULL_TREE;
312
313 *index = save_expr (*index);
314 /* Create a "(T *) 0" tree node to describe the array type. */
315 tree zero_with_type = build_int_cst (build_pointer_type (type), 0);
316 return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS,
317 void_type_node, 3, zero_with_type,
318 *index, bound);
319 }
320
321 /* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS. */
322
323 bool
ubsan_array_ref_instrumented_p(const_tree t)324 ubsan_array_ref_instrumented_p (const_tree t)
325 {
326 if (TREE_CODE (t) != ARRAY_REF)
327 return false;
328
329 tree op1 = TREE_OPERAND (t, 1);
330 return TREE_CODE (op1) == COMPOUND_EXPR
331 && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR
332 && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE
333 && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS;
334 }
335
336 /* Instrument an ARRAY_REF, if it hasn't already been instrumented.
337 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */
338
339 void
ubsan_maybe_instrument_array_ref(tree * expr_p,bool ignore_off_by_one)340 ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one)
341 {
342 if (!ubsan_array_ref_instrumented_p (*expr_p)
343 && do_ubsan_in_current_function ())
344 {
345 tree op0 = TREE_OPERAND (*expr_p, 0);
346 tree op1 = TREE_OPERAND (*expr_p, 1);
347 tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1,
348 ignore_off_by_one);
349 if (e != NULL_TREE)
350 {
351 tree t = copy_node (*expr_p);
352 TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1),
353 e, op1);
354 *expr_p = t;
355 }
356 }
357 }
358
359 static tree
ubsan_maybe_instrument_reference_or_call(location_t loc,tree op,tree ptype,enum ubsan_null_ckind ckind)360 ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
361 enum ubsan_null_ckind ckind)
362 {
363 if (!do_ubsan_in_current_function ())
364 return NULL_TREE;
365
366 tree type = TREE_TYPE (ptype);
367 tree orig_op = op;
368 bool instrument = false;
369 unsigned int mina = 0;
370
371 if (flag_sanitize & SANITIZE_ALIGNMENT)
372 {
373 mina = min_align_of_type (type);
374 if (mina <= 1)
375 mina = 0;
376 }
377 while ((TREE_CODE (op) == NOP_EXPR
378 || TREE_CODE (op) == NON_LVALUE_EXPR)
379 && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE)
380 op = TREE_OPERAND (op, 0);
381 if (TREE_CODE (op) == NOP_EXPR
382 && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
383 {
384 if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op))))
385 instrument = true;
386 }
387 else
388 {
389 if ((flag_sanitize & SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR)
390 {
391 bool strict_overflow_p = false;
392 /* tree_single_nonzero_warnv_p will not return true for non-weak
393 non-automatic decls with -fno-delete-null-pointer-checks,
394 which is disabled during -fsanitize=null. We don't want to
395 instrument those, just weak vars though. */
396 int save_flag_delete_null_pointer_checks
397 = flag_delete_null_pointer_checks;
398 flag_delete_null_pointer_checks = 1;
399 if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
400 || strict_overflow_p)
401 instrument = true;
402 flag_delete_null_pointer_checks
403 = save_flag_delete_null_pointer_checks;
404 }
405 else if (flag_sanitize & SANITIZE_NULL)
406 instrument = true;
407 if (mina && mina > 1)
408 {
409 if (!POINTER_TYPE_P (TREE_TYPE (op))
410 || mina > get_pointer_alignment (op) / BITS_PER_UNIT)
411 instrument = true;
412 }
413 }
414 if (!instrument)
415 return NULL_TREE;
416 op = save_expr (orig_op);
417 gcc_assert (POINTER_TYPE_P (ptype));
418 if (TREE_CODE (ptype) == REFERENCE_TYPE)
419 ptype = build_pointer_type (TREE_TYPE (ptype));
420 tree kind = build_int_cst (ptype, ckind);
421 tree align = build_int_cst (pointer_sized_int_node, mina);
422 tree call
423 = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node,
424 3, op, kind, align);
425 TREE_SIDE_EFFECTS (call) = 1;
426 return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op);
427 }
428
429 /* Instrument a NOP_EXPR to REFERENCE_TYPE or INTEGER_CST with REFERENCE_TYPE
430 type if needed. */
431
432 void
ubsan_maybe_instrument_reference(tree * stmt_p)433 ubsan_maybe_instrument_reference (tree *stmt_p)
434 {
435 tree stmt = *stmt_p;
436 tree op = stmt;
437 if (TREE_CODE (stmt) == NOP_EXPR)
438 op = TREE_OPERAND (stmt, 0);
439 op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
440 TREE_TYPE (stmt),
441 UBSAN_REF_BINDING);
442 if (op)
443 {
444 if (TREE_CODE (stmt) == NOP_EXPR)
445 TREE_OPERAND (stmt, 0) = op;
446 else
447 *stmt_p = op;
448 }
449 }
450
451 /* Instrument a CALL_EXPR to a method if needed. */
452
453 void
ubsan_maybe_instrument_member_call(tree stmt,bool is_ctor)454 ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor)
455 {
456 if (call_expr_nargs (stmt) == 0)
457 return;
458 tree op = CALL_EXPR_ARG (stmt, 0);
459 if (op == error_mark_node
460 || !POINTER_TYPE_P (TREE_TYPE (op)))
461 return;
462 op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op,
463 TREE_TYPE (op),
464 is_ctor ? UBSAN_CTOR_CALL
465 : UBSAN_MEMBER_CALL);
466 if (op)
467 CALL_EXPR_ARG (stmt, 0) = op;
468 }
469