1*38fd1498Szrj /* Optimize and expand sanitizer functions.
2*38fd1498Szrj Copyright (C) 2014-2018 Free Software Foundation, Inc.
3*38fd1498Szrj Contributed by Marek Polacek <polacek@redhat.com>
4*38fd1498Szrj
5*38fd1498Szrj This file is part of GCC.
6*38fd1498Szrj
7*38fd1498Szrj GCC is free software; you can redistribute it and/or modify it under
8*38fd1498Szrj the terms of the GNU General Public License as published by the Free
9*38fd1498Szrj Software Foundation; either version 3, or (at your option) any later
10*38fd1498Szrj version.
11*38fd1498Szrj
12*38fd1498Szrj GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13*38fd1498Szrj WARRANTY; without even the implied warranty of MERCHANTABILITY or
14*38fd1498Szrj FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15*38fd1498Szrj for more details.
16*38fd1498Szrj
17*38fd1498Szrj You should have received a copy of the GNU General Public License
18*38fd1498Szrj along with GCC; see the file COPYING3. If not see
19*38fd1498Szrj <http://www.gnu.org/licenses/>. */
20*38fd1498Szrj
21*38fd1498Szrj #include "config.h"
22*38fd1498Szrj #include "system.h"
23*38fd1498Szrj #include "coretypes.h"
24*38fd1498Szrj #include "backend.h"
25*38fd1498Szrj #include "tree.h"
26*38fd1498Szrj #include "gimple.h"
27*38fd1498Szrj #include "ssa.h"
28*38fd1498Szrj #include "tree-pass.h"
29*38fd1498Szrj #include "tree-ssa-operands.h"
30*38fd1498Szrj #include "gimple-pretty-print.h"
31*38fd1498Szrj #include "fold-const.h"
32*38fd1498Szrj #include "gimple-iterator.h"
33*38fd1498Szrj #include "stringpool.h"
34*38fd1498Szrj #include "attribs.h"
35*38fd1498Szrj #include "asan.h"
36*38fd1498Szrj #include "ubsan.h"
37*38fd1498Szrj #include "params.h"
38*38fd1498Szrj #include "tree-hash-traits.h"
39*38fd1498Szrj #include "gimple-ssa.h"
40*38fd1498Szrj #include "tree-phinodes.h"
41*38fd1498Szrj #include "ssa-iterators.h"
42*38fd1498Szrj #include "gimplify.h"
43*38fd1498Szrj #include "gimple-iterator.h"
44*38fd1498Szrj #include "gimple-walk.h"
45*38fd1498Szrj #include "cfghooks.h"
46*38fd1498Szrj #include "tree-dfa.h"
47*38fd1498Szrj #include "tree-ssa.h"
48*38fd1498Szrj #include "varasm.h"
49*38fd1498Szrj
50*38fd1498Szrj /* This is used to carry information about basic blocks. It is
51*38fd1498Szrj attached to the AUX field of the standard CFG block. */
52*38fd1498Szrj
53*38fd1498Szrj struct sanopt_info
54*38fd1498Szrj {
55*38fd1498Szrj /* True if this BB might call (directly or indirectly) free/munmap
56*38fd1498Szrj or similar operation. */
57*38fd1498Szrj bool has_freeing_call_p;
58*38fd1498Szrj
59*38fd1498Szrj /* True if HAS_FREEING_CALL_P flag has been computed. */
60*38fd1498Szrj bool has_freeing_call_computed_p;
61*38fd1498Szrj
62*38fd1498Szrj /* True if there is a block with HAS_FREEING_CALL_P flag set
63*38fd1498Szrj on any path between an immediate dominator of BB, denoted
64*38fd1498Szrj imm(BB), and BB. */
65*38fd1498Szrj bool imm_dom_path_with_freeing_call_p;
66*38fd1498Szrj
67*38fd1498Szrj /* True if IMM_DOM_PATH_WITH_FREEING_CALL_P has been computed. */
68*38fd1498Szrj bool imm_dom_path_with_freeing_call_computed_p;
69*38fd1498Szrj
70*38fd1498Szrj /* Number of possibly freeing calls encountered in this bb
71*38fd1498Szrj (so far). */
72*38fd1498Szrj uint64_t freeing_call_events;
73*38fd1498Szrj
74*38fd1498Szrj /* True if BB is currently being visited during computation
75*38fd1498Szrj of IMM_DOM_PATH_WITH_FREEING_CALL_P flag. */
76*38fd1498Szrj bool being_visited_p;
77*38fd1498Szrj
78*38fd1498Szrj /* True if this BB has been visited in the dominator walk. */
79*38fd1498Szrj bool visited_p;
80*38fd1498Szrj };
81*38fd1498Szrj
82*38fd1498Szrj /* If T has a single definition of form T = T2, return T2. */
83*38fd1498Szrj
84*38fd1498Szrj static tree
maybe_get_single_definition(tree t)85*38fd1498Szrj maybe_get_single_definition (tree t)
86*38fd1498Szrj {
87*38fd1498Szrj if (TREE_CODE (t) == SSA_NAME)
88*38fd1498Szrj {
89*38fd1498Szrj gimple *g = SSA_NAME_DEF_STMT (t);
90*38fd1498Szrj if (gimple_assign_single_p (g))
91*38fd1498Szrj return gimple_assign_rhs1 (g);
92*38fd1498Szrj }
93*38fd1498Szrj return NULL_TREE;
94*38fd1498Szrj }
95*38fd1498Szrj
96*38fd1498Szrj /* Tree triplet for vptr_check_map. */
97*38fd1498Szrj struct sanopt_tree_triplet
98*38fd1498Szrj {
99*38fd1498Szrj tree t1, t2, t3;
100*38fd1498Szrj };
101*38fd1498Szrj
102*38fd1498Szrj /* Traits class for tree triplet hash maps below. */
103*38fd1498Szrj
104*38fd1498Szrj struct sanopt_tree_triplet_hash : typed_noop_remove <sanopt_tree_triplet>
105*38fd1498Szrj {
106*38fd1498Szrj typedef sanopt_tree_triplet value_type;
107*38fd1498Szrj typedef sanopt_tree_triplet compare_type;
108*38fd1498Szrj
109*38fd1498Szrj static hashval_t
hashsanopt_tree_triplet_hash110*38fd1498Szrj hash (const sanopt_tree_triplet &ref)
111*38fd1498Szrj {
112*38fd1498Szrj inchash::hash hstate (0);
113*38fd1498Szrj inchash::add_expr (ref.t1, hstate);
114*38fd1498Szrj inchash::add_expr (ref.t2, hstate);
115*38fd1498Szrj inchash::add_expr (ref.t3, hstate);
116*38fd1498Szrj return hstate.end ();
117*38fd1498Szrj }
118*38fd1498Szrj
119*38fd1498Szrj static bool
equalsanopt_tree_triplet_hash120*38fd1498Szrj equal (const sanopt_tree_triplet &ref1, const sanopt_tree_triplet &ref2)
121*38fd1498Szrj {
122*38fd1498Szrj return operand_equal_p (ref1.t1, ref2.t1, 0)
123*38fd1498Szrj && operand_equal_p (ref1.t2, ref2.t2, 0)
124*38fd1498Szrj && operand_equal_p (ref1.t3, ref2.t3, 0);
125*38fd1498Szrj }
126*38fd1498Szrj
127*38fd1498Szrj static void
mark_deletedsanopt_tree_triplet_hash128*38fd1498Szrj mark_deleted (sanopt_tree_triplet &ref)
129*38fd1498Szrj {
130*38fd1498Szrj ref.t1 = reinterpret_cast<tree> (1);
131*38fd1498Szrj }
132*38fd1498Szrj
133*38fd1498Szrj static void
mark_emptysanopt_tree_triplet_hash134*38fd1498Szrj mark_empty (sanopt_tree_triplet &ref)
135*38fd1498Szrj {
136*38fd1498Szrj ref.t1 = NULL;
137*38fd1498Szrj }
138*38fd1498Szrj
139*38fd1498Szrj static bool
is_deletedsanopt_tree_triplet_hash140*38fd1498Szrj is_deleted (const sanopt_tree_triplet &ref)
141*38fd1498Szrj {
142*38fd1498Szrj return ref.t1 == reinterpret_cast<tree> (1);
143*38fd1498Szrj }
144*38fd1498Szrj
145*38fd1498Szrj static bool
is_emptysanopt_tree_triplet_hash146*38fd1498Szrj is_empty (const sanopt_tree_triplet &ref)
147*38fd1498Szrj {
148*38fd1498Szrj return ref.t1 == NULL;
149*38fd1498Szrj }
150*38fd1498Szrj };
151*38fd1498Szrj
152*38fd1498Szrj /* Tree couple for ptr_check_map. */
153*38fd1498Szrj struct sanopt_tree_couple
154*38fd1498Szrj {
155*38fd1498Szrj tree ptr;
156*38fd1498Szrj bool pos_p;
157*38fd1498Szrj };
158*38fd1498Szrj
159*38fd1498Szrj /* Traits class for tree triplet hash maps below. */
160*38fd1498Szrj
161*38fd1498Szrj struct sanopt_tree_couple_hash : typed_noop_remove <sanopt_tree_couple>
162*38fd1498Szrj {
163*38fd1498Szrj typedef sanopt_tree_couple value_type;
164*38fd1498Szrj typedef sanopt_tree_couple compare_type;
165*38fd1498Szrj
166*38fd1498Szrj static hashval_t
hashsanopt_tree_couple_hash167*38fd1498Szrj hash (const sanopt_tree_couple &ref)
168*38fd1498Szrj {
169*38fd1498Szrj inchash::hash hstate (0);
170*38fd1498Szrj inchash::add_expr (ref.ptr, hstate);
171*38fd1498Szrj hstate.add_int (ref.pos_p);
172*38fd1498Szrj return hstate.end ();
173*38fd1498Szrj }
174*38fd1498Szrj
175*38fd1498Szrj static bool
equalsanopt_tree_couple_hash176*38fd1498Szrj equal (const sanopt_tree_couple &ref1, const sanopt_tree_couple &ref2)
177*38fd1498Szrj {
178*38fd1498Szrj return operand_equal_p (ref1.ptr, ref2.ptr, 0)
179*38fd1498Szrj && ref1.pos_p == ref2.pos_p;
180*38fd1498Szrj }
181*38fd1498Szrj
182*38fd1498Szrj static void
mark_deletedsanopt_tree_couple_hash183*38fd1498Szrj mark_deleted (sanopt_tree_couple &ref)
184*38fd1498Szrj {
185*38fd1498Szrj ref.ptr = reinterpret_cast<tree> (1);
186*38fd1498Szrj }
187*38fd1498Szrj
188*38fd1498Szrj static void
mark_emptysanopt_tree_couple_hash189*38fd1498Szrj mark_empty (sanopt_tree_couple &ref)
190*38fd1498Szrj {
191*38fd1498Szrj ref.ptr = NULL;
192*38fd1498Szrj }
193*38fd1498Szrj
194*38fd1498Szrj static bool
is_deletedsanopt_tree_couple_hash195*38fd1498Szrj is_deleted (const sanopt_tree_couple &ref)
196*38fd1498Szrj {
197*38fd1498Szrj return ref.ptr == reinterpret_cast<tree> (1);
198*38fd1498Szrj }
199*38fd1498Szrj
200*38fd1498Szrj static bool
is_emptysanopt_tree_couple_hash201*38fd1498Szrj is_empty (const sanopt_tree_couple &ref)
202*38fd1498Szrj {
203*38fd1498Szrj return ref.ptr == NULL;
204*38fd1498Szrj }
205*38fd1498Szrj };
206*38fd1498Szrj
207*38fd1498Szrj /* This is used to carry various hash maps and variables used
208*38fd1498Szrj in sanopt_optimize_walker. */
209*38fd1498Szrj
210*38fd1498Szrj struct sanopt_ctx
211*38fd1498Szrj {
212*38fd1498Szrj /* This map maps a pointer (the first argument of UBSAN_NULL) to
213*38fd1498Szrj a vector of UBSAN_NULL call statements that check this pointer. */
214*38fd1498Szrj hash_map<tree, auto_vec<gimple *> > null_check_map;
215*38fd1498Szrj
216*38fd1498Szrj /* This map maps a pointer (the second argument of ASAN_CHECK) to
217*38fd1498Szrj a vector of ASAN_CHECK call statements that check the access. */
218*38fd1498Szrj hash_map<tree_operand_hash, auto_vec<gimple *> > asan_check_map;
219*38fd1498Szrj
220*38fd1498Szrj /* This map maps a tree triplet (the first, second and fourth argument
221*38fd1498Szrj of UBSAN_VPTR) to a vector of UBSAN_VPTR call statements that check
222*38fd1498Szrj that virtual table pointer. */
223*38fd1498Szrj hash_map<sanopt_tree_triplet_hash, auto_vec<gimple *> > vptr_check_map;
224*38fd1498Szrj
225*38fd1498Szrj /* This map maps a couple (tree and boolean) to a vector of UBSAN_PTR
226*38fd1498Szrj call statements that check that pointer overflow. */
227*38fd1498Szrj hash_map<sanopt_tree_couple_hash, auto_vec<gimple *> > ptr_check_map;
228*38fd1498Szrj
229*38fd1498Szrj /* Number of IFN_ASAN_CHECK statements. */
230*38fd1498Szrj int asan_num_accesses;
231*38fd1498Szrj
232*38fd1498Szrj /* True when the current functions constains an ASAN_MARK. */
233*38fd1498Szrj bool contains_asan_mark;
234*38fd1498Szrj };
235*38fd1498Szrj
236*38fd1498Szrj /* Return true if there might be any call to free/munmap operation
237*38fd1498Szrj on any path in between DOM (which should be imm(BB)) and BB. */
238*38fd1498Szrj
239*38fd1498Szrj static bool
imm_dom_path_with_freeing_call(basic_block bb,basic_block dom)240*38fd1498Szrj imm_dom_path_with_freeing_call (basic_block bb, basic_block dom)
241*38fd1498Szrj {
242*38fd1498Szrj sanopt_info *info = (sanopt_info *) bb->aux;
243*38fd1498Szrj edge e;
244*38fd1498Szrj edge_iterator ei;
245*38fd1498Szrj
246*38fd1498Szrj if (info->imm_dom_path_with_freeing_call_computed_p)
247*38fd1498Szrj return info->imm_dom_path_with_freeing_call_p;
248*38fd1498Szrj
249*38fd1498Szrj info->being_visited_p = true;
250*38fd1498Szrj
251*38fd1498Szrj FOR_EACH_EDGE (e, ei, bb->preds)
252*38fd1498Szrj {
253*38fd1498Szrj sanopt_info *pred_info = (sanopt_info *) e->src->aux;
254*38fd1498Szrj
255*38fd1498Szrj if (e->src == dom)
256*38fd1498Szrj continue;
257*38fd1498Szrj
258*38fd1498Szrj if ((pred_info->imm_dom_path_with_freeing_call_computed_p
259*38fd1498Szrj && pred_info->imm_dom_path_with_freeing_call_p)
260*38fd1498Szrj || (pred_info->has_freeing_call_computed_p
261*38fd1498Szrj && pred_info->has_freeing_call_p))
262*38fd1498Szrj {
263*38fd1498Szrj info->imm_dom_path_with_freeing_call_computed_p = true;
264*38fd1498Szrj info->imm_dom_path_with_freeing_call_p = true;
265*38fd1498Szrj info->being_visited_p = false;
266*38fd1498Szrj return true;
267*38fd1498Szrj }
268*38fd1498Szrj }
269*38fd1498Szrj
270*38fd1498Szrj FOR_EACH_EDGE (e, ei, bb->preds)
271*38fd1498Szrj {
272*38fd1498Szrj sanopt_info *pred_info = (sanopt_info *) e->src->aux;
273*38fd1498Szrj
274*38fd1498Szrj if (e->src == dom)
275*38fd1498Szrj continue;
276*38fd1498Szrj
277*38fd1498Szrj if (pred_info->has_freeing_call_computed_p)
278*38fd1498Szrj continue;
279*38fd1498Szrj
280*38fd1498Szrj gimple_stmt_iterator gsi;
281*38fd1498Szrj for (gsi = gsi_start_bb (e->src); !gsi_end_p (gsi); gsi_next (&gsi))
282*38fd1498Szrj {
283*38fd1498Szrj gimple *stmt = gsi_stmt (gsi);
284*38fd1498Szrj gasm *asm_stmt;
285*38fd1498Szrj
286*38fd1498Szrj if ((is_gimple_call (stmt) && !nonfreeing_call_p (stmt))
287*38fd1498Szrj || ((asm_stmt = dyn_cast <gasm *> (stmt))
288*38fd1498Szrj && (gimple_asm_clobbers_memory_p (asm_stmt)
289*38fd1498Szrj || gimple_asm_volatile_p (asm_stmt))))
290*38fd1498Szrj {
291*38fd1498Szrj pred_info->has_freeing_call_p = true;
292*38fd1498Szrj break;
293*38fd1498Szrj }
294*38fd1498Szrj }
295*38fd1498Szrj
296*38fd1498Szrj pred_info->has_freeing_call_computed_p = true;
297*38fd1498Szrj if (pred_info->has_freeing_call_p)
298*38fd1498Szrj {
299*38fd1498Szrj info->imm_dom_path_with_freeing_call_computed_p = true;
300*38fd1498Szrj info->imm_dom_path_with_freeing_call_p = true;
301*38fd1498Szrj info->being_visited_p = false;
302*38fd1498Szrj return true;
303*38fd1498Szrj }
304*38fd1498Szrj }
305*38fd1498Szrj
306*38fd1498Szrj FOR_EACH_EDGE (e, ei, bb->preds)
307*38fd1498Szrj {
308*38fd1498Szrj if (e->src == dom)
309*38fd1498Szrj continue;
310*38fd1498Szrj
311*38fd1498Szrj basic_block src;
312*38fd1498Szrj for (src = e->src; src != dom; )
313*38fd1498Szrj {
314*38fd1498Szrj sanopt_info *pred_info = (sanopt_info *) src->aux;
315*38fd1498Szrj if (pred_info->being_visited_p)
316*38fd1498Szrj break;
317*38fd1498Szrj basic_block imm = get_immediate_dominator (CDI_DOMINATORS, src);
318*38fd1498Szrj if (imm_dom_path_with_freeing_call (src, imm))
319*38fd1498Szrj {
320*38fd1498Szrj info->imm_dom_path_with_freeing_call_computed_p = true;
321*38fd1498Szrj info->imm_dom_path_with_freeing_call_p = true;
322*38fd1498Szrj info->being_visited_p = false;
323*38fd1498Szrj return true;
324*38fd1498Szrj }
325*38fd1498Szrj src = imm;
326*38fd1498Szrj }
327*38fd1498Szrj }
328*38fd1498Szrj
329*38fd1498Szrj info->imm_dom_path_with_freeing_call_computed_p = true;
330*38fd1498Szrj info->imm_dom_path_with_freeing_call_p = false;
331*38fd1498Szrj info->being_visited_p = false;
332*38fd1498Szrj return false;
333*38fd1498Szrj }
334*38fd1498Szrj
335*38fd1498Szrj /* Get the first dominating check from the list of stored checks.
336*38fd1498Szrj Non-dominating checks are silently dropped. */
337*38fd1498Szrj
338*38fd1498Szrj static gimple *
maybe_get_dominating_check(auto_vec<gimple * > & v)339*38fd1498Szrj maybe_get_dominating_check (auto_vec<gimple *> &v)
340*38fd1498Szrj {
341*38fd1498Szrj for (; !v.is_empty (); v.pop ())
342*38fd1498Szrj {
343*38fd1498Szrj gimple *g = v.last ();
344*38fd1498Szrj sanopt_info *si = (sanopt_info *) gimple_bb (g)->aux;
345*38fd1498Szrj if (!si->visited_p)
346*38fd1498Szrj /* At this point we shouldn't have any statements
347*38fd1498Szrj that aren't dominating the current BB. */
348*38fd1498Szrj return g;
349*38fd1498Szrj }
350*38fd1498Szrj return NULL;
351*38fd1498Szrj }
352*38fd1498Szrj
353*38fd1498Szrj /* Optimize away redundant UBSAN_NULL calls. */
354*38fd1498Szrj
355*38fd1498Szrj static bool
maybe_optimize_ubsan_null_ifn(struct sanopt_ctx * ctx,gimple * stmt)356*38fd1498Szrj maybe_optimize_ubsan_null_ifn (struct sanopt_ctx *ctx, gimple *stmt)
357*38fd1498Szrj {
358*38fd1498Szrj gcc_assert (gimple_call_num_args (stmt) == 3);
359*38fd1498Szrj tree ptr = gimple_call_arg (stmt, 0);
360*38fd1498Szrj tree cur_align = gimple_call_arg (stmt, 2);
361*38fd1498Szrj gcc_assert (TREE_CODE (cur_align) == INTEGER_CST);
362*38fd1498Szrj bool remove = false;
363*38fd1498Szrj
364*38fd1498Szrj auto_vec<gimple *> &v = ctx->null_check_map.get_or_insert (ptr);
365*38fd1498Szrj gimple *g = maybe_get_dominating_check (v);
366*38fd1498Szrj if (!g)
367*38fd1498Szrj {
368*38fd1498Szrj /* For this PTR we don't have any UBSAN_NULL stmts recorded, so there's
369*38fd1498Szrj nothing to optimize yet. */
370*38fd1498Szrj v.safe_push (stmt);
371*38fd1498Szrj return false;
372*38fd1498Szrj }
373*38fd1498Szrj
374*38fd1498Szrj /* We already have recorded a UBSAN_NULL check for this pointer. Perhaps we
375*38fd1498Szrj can drop this one. But only if this check doesn't specify stricter
376*38fd1498Szrj alignment. */
377*38fd1498Szrj
378*38fd1498Szrj tree align = gimple_call_arg (g, 2);
379*38fd1498Szrj int kind = tree_to_shwi (gimple_call_arg (g, 1));
380*38fd1498Szrj /* If this is a NULL pointer check where we had segv anyway, we can
381*38fd1498Szrj remove it. */
382*38fd1498Szrj if (integer_zerop (align)
383*38fd1498Szrj && (kind == UBSAN_LOAD_OF
384*38fd1498Szrj || kind == UBSAN_STORE_OF
385*38fd1498Szrj || kind == UBSAN_MEMBER_ACCESS))
386*38fd1498Szrj remove = true;
387*38fd1498Szrj /* Otherwise remove the check in non-recovering mode, or if the
388*38fd1498Szrj stmts have same location. */
389*38fd1498Szrj else if (integer_zerop (align))
390*38fd1498Szrj remove = (flag_sanitize_recover & SANITIZE_NULL) == 0
391*38fd1498Szrj || flag_sanitize_undefined_trap_on_error
392*38fd1498Szrj || gimple_location (g) == gimple_location (stmt);
393*38fd1498Szrj else if (tree_int_cst_le (cur_align, align))
394*38fd1498Szrj remove = (flag_sanitize_recover & SANITIZE_ALIGNMENT) == 0
395*38fd1498Szrj || flag_sanitize_undefined_trap_on_error
396*38fd1498Szrj || gimple_location (g) == gimple_location (stmt);
397*38fd1498Szrj
398*38fd1498Szrj if (!remove && gimple_bb (g) == gimple_bb (stmt)
399*38fd1498Szrj && tree_int_cst_compare (cur_align, align) == 0)
400*38fd1498Szrj v.pop ();
401*38fd1498Szrj
402*38fd1498Szrj if (!remove)
403*38fd1498Szrj v.safe_push (stmt);
404*38fd1498Szrj return remove;
405*38fd1498Szrj }
406*38fd1498Szrj
407*38fd1498Szrj /* Return true when pointer PTR for a given CUR_OFFSET is already sanitized
408*38fd1498Szrj in a given sanitization context CTX. */
409*38fd1498Szrj
410*38fd1498Szrj static bool
has_dominating_ubsan_ptr_check(sanopt_ctx * ctx,tree ptr,offset_int & cur_offset)411*38fd1498Szrj has_dominating_ubsan_ptr_check (sanopt_ctx *ctx, tree ptr,
412*38fd1498Szrj offset_int &cur_offset)
413*38fd1498Szrj {
414*38fd1498Szrj bool pos_p = !wi::neg_p (cur_offset);
415*38fd1498Szrj sanopt_tree_couple couple;
416*38fd1498Szrj couple.ptr = ptr;
417*38fd1498Szrj couple.pos_p = pos_p;
418*38fd1498Szrj
419*38fd1498Szrj auto_vec<gimple *> &v = ctx->ptr_check_map.get_or_insert (couple);
420*38fd1498Szrj gimple *g = maybe_get_dominating_check (v);
421*38fd1498Szrj if (!g)
422*38fd1498Szrj return false;
423*38fd1498Szrj
424*38fd1498Szrj /* We already have recorded a UBSAN_PTR check for this pointer. Perhaps we
425*38fd1498Szrj can drop this one. But only if this check doesn't specify larger offset.
426*38fd1498Szrj */
427*38fd1498Szrj tree offset = gimple_call_arg (g, 1);
428*38fd1498Szrj gcc_assert (TREE_CODE (offset) == INTEGER_CST);
429*38fd1498Szrj offset_int ooffset = wi::sext (wi::to_offset (offset), POINTER_SIZE);
430*38fd1498Szrj
431*38fd1498Szrj if (pos_p)
432*38fd1498Szrj {
433*38fd1498Szrj if (wi::les_p (cur_offset, ooffset))
434*38fd1498Szrj return true;
435*38fd1498Szrj }
436*38fd1498Szrj else if (!pos_p && wi::les_p (ooffset, cur_offset))
437*38fd1498Szrj return true;
438*38fd1498Szrj
439*38fd1498Szrj return false;
440*38fd1498Szrj }
441*38fd1498Szrj
442*38fd1498Szrj /* Record UBSAN_PTR check of given context CTX. Register pointer PTR on
443*38fd1498Szrj a given OFFSET that it's handled by GIMPLE STMT. */
444*38fd1498Szrj
445*38fd1498Szrj static void
record_ubsan_ptr_check_stmt(sanopt_ctx * ctx,gimple * stmt,tree ptr,const offset_int & offset)446*38fd1498Szrj record_ubsan_ptr_check_stmt (sanopt_ctx *ctx, gimple *stmt, tree ptr,
447*38fd1498Szrj const offset_int &offset)
448*38fd1498Szrj {
449*38fd1498Szrj sanopt_tree_couple couple;
450*38fd1498Szrj couple.ptr = ptr;
451*38fd1498Szrj couple.pos_p = !wi::neg_p (offset);
452*38fd1498Szrj
453*38fd1498Szrj auto_vec<gimple *> &v = ctx->ptr_check_map.get_or_insert (couple);
454*38fd1498Szrj v.safe_push (stmt);
455*38fd1498Szrj }
456*38fd1498Szrj
457*38fd1498Szrj /* Optimize away redundant UBSAN_PTR calls. */
458*38fd1498Szrj
459*38fd1498Szrj static bool
maybe_optimize_ubsan_ptr_ifn(sanopt_ctx * ctx,gimple * stmt)460*38fd1498Szrj maybe_optimize_ubsan_ptr_ifn (sanopt_ctx *ctx, gimple *stmt)
461*38fd1498Szrj {
462*38fd1498Szrj poly_int64 bitsize, pbitpos;
463*38fd1498Szrj machine_mode mode;
464*38fd1498Szrj int volatilep = 0, reversep, unsignedp = 0;
465*38fd1498Szrj tree offset;
466*38fd1498Szrj
467*38fd1498Szrj gcc_assert (gimple_call_num_args (stmt) == 2);
468*38fd1498Szrj tree ptr = gimple_call_arg (stmt, 0);
469*38fd1498Szrj tree off = gimple_call_arg (stmt, 1);
470*38fd1498Szrj
471*38fd1498Szrj if (TREE_CODE (off) != INTEGER_CST)
472*38fd1498Szrj return false;
473*38fd1498Szrj
474*38fd1498Szrj if (integer_zerop (off))
475*38fd1498Szrj return true;
476*38fd1498Szrj
477*38fd1498Szrj offset_int cur_offset = wi::sext (wi::to_offset (off), POINTER_SIZE);
478*38fd1498Szrj if (has_dominating_ubsan_ptr_check (ctx, ptr, cur_offset))
479*38fd1498Szrj return true;
480*38fd1498Szrj
481*38fd1498Szrj tree base = ptr;
482*38fd1498Szrj if (TREE_CODE (base) == ADDR_EXPR)
483*38fd1498Szrj {
484*38fd1498Szrj base = TREE_OPERAND (base, 0);
485*38fd1498Szrj
486*38fd1498Szrj HOST_WIDE_INT bitpos;
487*38fd1498Szrj base = get_inner_reference (base, &bitsize, &pbitpos, &offset, &mode,
488*38fd1498Szrj &unsignedp, &reversep, &volatilep);
489*38fd1498Szrj if ((offset == NULL_TREE || TREE_CODE (offset) == INTEGER_CST)
490*38fd1498Szrj && DECL_P (base)
491*38fd1498Szrj && !DECL_REGISTER (base)
492*38fd1498Szrj && pbitpos.is_constant (&bitpos))
493*38fd1498Szrj {
494*38fd1498Szrj offset_int expr_offset;
495*38fd1498Szrj if (offset)
496*38fd1498Szrj expr_offset = wi::to_offset (offset) + bitpos / BITS_PER_UNIT;
497*38fd1498Szrj else
498*38fd1498Szrj expr_offset = bitpos / BITS_PER_UNIT;
499*38fd1498Szrj expr_offset = wi::sext (expr_offset, POINTER_SIZE);
500*38fd1498Szrj offset_int total_offset = expr_offset + cur_offset;
501*38fd1498Szrj if (total_offset != wi::sext (total_offset, POINTER_SIZE))
502*38fd1498Szrj {
503*38fd1498Szrj record_ubsan_ptr_check_stmt (ctx, stmt, ptr, cur_offset);
504*38fd1498Szrj return false;
505*38fd1498Szrj }
506*38fd1498Szrj
507*38fd1498Szrj /* If BASE is a fixed size automatic variable or
508*38fd1498Szrj global variable defined in the current TU, we don't have
509*38fd1498Szrj to instrument anything if offset is within address
510*38fd1498Szrj of the variable. */
511*38fd1498Szrj if ((VAR_P (base)
512*38fd1498Szrj || TREE_CODE (base) == PARM_DECL
513*38fd1498Szrj || TREE_CODE (base) == RESULT_DECL)
514*38fd1498Szrj && DECL_SIZE_UNIT (base)
515*38fd1498Szrj && TREE_CODE (DECL_SIZE_UNIT (base)) == INTEGER_CST
516*38fd1498Szrj && (!is_global_var (base) || decl_binds_to_current_def_p (base)))
517*38fd1498Szrj {
518*38fd1498Szrj offset_int base_size = wi::to_offset (DECL_SIZE_UNIT (base));
519*38fd1498Szrj if (!wi::neg_p (expr_offset)
520*38fd1498Szrj && wi::les_p (total_offset, base_size))
521*38fd1498Szrj {
522*38fd1498Szrj if (!wi::neg_p (total_offset)
523*38fd1498Szrj && wi::les_p (total_offset, base_size))
524*38fd1498Szrj return true;
525*38fd1498Szrj }
526*38fd1498Szrj }
527*38fd1498Szrj
528*38fd1498Szrj /* Following expression: UBSAN_PTR (&MEM_REF[ptr + x], y) can be
529*38fd1498Szrj handled as follows:
530*38fd1498Szrj
531*38fd1498Szrj 1) sign (x) == sign (y), then check for dominating check of (x + y)
532*38fd1498Szrj 2) sign (x) != sign (y), then first check if we have a dominating
533*38fd1498Szrj check for ptr + x. If so, then we have 2 situations:
534*38fd1498Szrj a) sign (x) == sign (x + y), here we are done, example:
535*38fd1498Szrj UBSAN_PTR (&MEM_REF[ptr + 100], -50)
536*38fd1498Szrj b) check for dominating check of ptr + x + y.
537*38fd1498Szrj */
538*38fd1498Szrj
539*38fd1498Szrj bool sign_cur_offset = !wi::neg_p (cur_offset);
540*38fd1498Szrj bool sign_expr_offset = !wi::neg_p (expr_offset);
541*38fd1498Szrj
542*38fd1498Szrj tree base_addr
543*38fd1498Szrj = build1 (ADDR_EXPR, build_pointer_type (TREE_TYPE (base)), base);
544*38fd1498Szrj
545*38fd1498Szrj bool add = false;
546*38fd1498Szrj if (sign_cur_offset == sign_expr_offset)
547*38fd1498Szrj {
548*38fd1498Szrj if (has_dominating_ubsan_ptr_check (ctx, base_addr, total_offset))
549*38fd1498Szrj return true;
550*38fd1498Szrj else
551*38fd1498Szrj add = true;
552*38fd1498Szrj }
553*38fd1498Szrj else
554*38fd1498Szrj {
555*38fd1498Szrj if (!has_dominating_ubsan_ptr_check (ctx, base_addr, expr_offset))
556*38fd1498Szrj ; /* Don't record base_addr + expr_offset, it's not a guarding
557*38fd1498Szrj check. */
558*38fd1498Szrj else
559*38fd1498Szrj {
560*38fd1498Szrj bool sign_total_offset = !wi::neg_p (total_offset);
561*38fd1498Szrj if (sign_expr_offset == sign_total_offset)
562*38fd1498Szrj return true;
563*38fd1498Szrj else
564*38fd1498Szrj {
565*38fd1498Szrj if (has_dominating_ubsan_ptr_check (ctx, base_addr,
566*38fd1498Szrj total_offset))
567*38fd1498Szrj return true;
568*38fd1498Szrj else
569*38fd1498Szrj add = true;
570*38fd1498Szrj }
571*38fd1498Szrj }
572*38fd1498Szrj }
573*38fd1498Szrj
574*38fd1498Szrj /* Record a new dominating check for base_addr + total_offset. */
575*38fd1498Szrj if (add && !operand_equal_p (base, base_addr, 0))
576*38fd1498Szrj record_ubsan_ptr_check_stmt (ctx, stmt, base_addr,
577*38fd1498Szrj total_offset);
578*38fd1498Szrj }
579*38fd1498Szrj }
580*38fd1498Szrj
581*38fd1498Szrj /* For this PTR we don't have any UBSAN_PTR stmts recorded, so there's
582*38fd1498Szrj nothing to optimize yet. */
583*38fd1498Szrj record_ubsan_ptr_check_stmt (ctx, stmt, ptr, cur_offset);
584*38fd1498Szrj
585*38fd1498Szrj return false;
586*38fd1498Szrj }
587*38fd1498Szrj
588*38fd1498Szrj /* Optimize away redundant UBSAN_VPTR calls. The second argument
589*38fd1498Szrj is the value loaded from the virtual table, so rely on FRE to find out
590*38fd1498Szrj when we can actually optimize. */
591*38fd1498Szrj
592*38fd1498Szrj static bool
maybe_optimize_ubsan_vptr_ifn(struct sanopt_ctx * ctx,gimple * stmt)593*38fd1498Szrj maybe_optimize_ubsan_vptr_ifn (struct sanopt_ctx *ctx, gimple *stmt)
594*38fd1498Szrj {
595*38fd1498Szrj gcc_assert (gimple_call_num_args (stmt) == 5);
596*38fd1498Szrj sanopt_tree_triplet triplet;
597*38fd1498Szrj triplet.t1 = gimple_call_arg (stmt, 0);
598*38fd1498Szrj triplet.t2 = gimple_call_arg (stmt, 1);
599*38fd1498Szrj triplet.t3 = gimple_call_arg (stmt, 3);
600*38fd1498Szrj
601*38fd1498Szrj auto_vec<gimple *> &v = ctx->vptr_check_map.get_or_insert (triplet);
602*38fd1498Szrj gimple *g = maybe_get_dominating_check (v);
603*38fd1498Szrj if (!g)
604*38fd1498Szrj {
605*38fd1498Szrj /* For this PTR we don't have any UBSAN_VPTR stmts recorded, so there's
606*38fd1498Szrj nothing to optimize yet. */
607*38fd1498Szrj v.safe_push (stmt);
608*38fd1498Szrj return false;
609*38fd1498Szrj }
610*38fd1498Szrj
611*38fd1498Szrj return true;
612*38fd1498Szrj }
613*38fd1498Szrj
614*38fd1498Szrj /* Returns TRUE if ASan check of length LEN in block BB can be removed
615*38fd1498Szrj if preceded by checks in V. */
616*38fd1498Szrj
617*38fd1498Szrj static bool
can_remove_asan_check(auto_vec<gimple * > & v,tree len,basic_block bb)618*38fd1498Szrj can_remove_asan_check (auto_vec<gimple *> &v, tree len, basic_block bb)
619*38fd1498Szrj {
620*38fd1498Szrj unsigned int i;
621*38fd1498Szrj gimple *g;
622*38fd1498Szrj gimple *to_pop = NULL;
623*38fd1498Szrj bool remove = false;
624*38fd1498Szrj basic_block last_bb = bb;
625*38fd1498Szrj bool cleanup = false;
626*38fd1498Szrj
627*38fd1498Szrj FOR_EACH_VEC_ELT_REVERSE (v, i, g)
628*38fd1498Szrj {
629*38fd1498Szrj basic_block gbb = gimple_bb (g);
630*38fd1498Szrj sanopt_info *si = (sanopt_info *) gbb->aux;
631*38fd1498Szrj if (gimple_uid (g) < si->freeing_call_events)
632*38fd1498Szrj {
633*38fd1498Szrj /* If there is a potentially freeing call after g in gbb, we should
634*38fd1498Szrj remove it from the vector, can't use in optimization. */
635*38fd1498Szrj cleanup = true;
636*38fd1498Szrj continue;
637*38fd1498Szrj }
638*38fd1498Szrj
639*38fd1498Szrj tree glen = gimple_call_arg (g, 2);
640*38fd1498Szrj gcc_assert (TREE_CODE (glen) == INTEGER_CST);
641*38fd1498Szrj
642*38fd1498Szrj /* If we've checked only smaller length than we want to check now,
643*38fd1498Szrj we can't remove the current stmt. If g is in the same basic block,
644*38fd1498Szrj we want to remove it though, as the current stmt is better. */
645*38fd1498Szrj if (tree_int_cst_lt (glen, len))
646*38fd1498Szrj {
647*38fd1498Szrj if (gbb == bb)
648*38fd1498Szrj {
649*38fd1498Szrj to_pop = g;
650*38fd1498Szrj cleanup = true;
651*38fd1498Szrj }
652*38fd1498Szrj continue;
653*38fd1498Szrj }
654*38fd1498Szrj
655*38fd1498Szrj while (last_bb != gbb)
656*38fd1498Szrj {
657*38fd1498Szrj /* Paths from last_bb to bb have been checked before.
658*38fd1498Szrj gbb is necessarily a dominator of last_bb, but not necessarily
659*38fd1498Szrj immediate dominator. */
660*38fd1498Szrj if (((sanopt_info *) last_bb->aux)->freeing_call_events)
661*38fd1498Szrj break;
662*38fd1498Szrj
663*38fd1498Szrj basic_block imm = get_immediate_dominator (CDI_DOMINATORS, last_bb);
664*38fd1498Szrj gcc_assert (imm);
665*38fd1498Szrj if (imm_dom_path_with_freeing_call (last_bb, imm))
666*38fd1498Szrj break;
667*38fd1498Szrj
668*38fd1498Szrj last_bb = imm;
669*38fd1498Szrj }
670*38fd1498Szrj if (last_bb == gbb)
671*38fd1498Szrj remove = true;
672*38fd1498Szrj break;
673*38fd1498Szrj }
674*38fd1498Szrj
675*38fd1498Szrj if (cleanup)
676*38fd1498Szrj {
677*38fd1498Szrj unsigned int j = 0, l = v.length ();
678*38fd1498Szrj for (i = 0; i < l; i++)
679*38fd1498Szrj if (v[i] != to_pop
680*38fd1498Szrj && (gimple_uid (v[i])
681*38fd1498Szrj == ((sanopt_info *)
682*38fd1498Szrj gimple_bb (v[i])->aux)->freeing_call_events))
683*38fd1498Szrj {
684*38fd1498Szrj if (i != j)
685*38fd1498Szrj v[j] = v[i];
686*38fd1498Szrj j++;
687*38fd1498Szrj }
688*38fd1498Szrj v.truncate (j);
689*38fd1498Szrj }
690*38fd1498Szrj
691*38fd1498Szrj return remove;
692*38fd1498Szrj }
693*38fd1498Szrj
694*38fd1498Szrj /* Optimize away redundant ASAN_CHECK calls. */
695*38fd1498Szrj
696*38fd1498Szrj static bool
maybe_optimize_asan_check_ifn(struct sanopt_ctx * ctx,gimple * stmt)697*38fd1498Szrj maybe_optimize_asan_check_ifn (struct sanopt_ctx *ctx, gimple *stmt)
698*38fd1498Szrj {
699*38fd1498Szrj gcc_assert (gimple_call_num_args (stmt) == 4);
700*38fd1498Szrj tree ptr = gimple_call_arg (stmt, 1);
701*38fd1498Szrj tree len = gimple_call_arg (stmt, 2);
702*38fd1498Szrj basic_block bb = gimple_bb (stmt);
703*38fd1498Szrj sanopt_info *info = (sanopt_info *) bb->aux;
704*38fd1498Szrj
705*38fd1498Szrj if (TREE_CODE (len) != INTEGER_CST)
706*38fd1498Szrj return false;
707*38fd1498Szrj if (integer_zerop (len))
708*38fd1498Szrj return false;
709*38fd1498Szrj
710*38fd1498Szrj gimple_set_uid (stmt, info->freeing_call_events);
711*38fd1498Szrj
712*38fd1498Szrj auto_vec<gimple *> *ptr_checks = &ctx->asan_check_map.get_or_insert (ptr);
713*38fd1498Szrj
714*38fd1498Szrj tree base_addr = maybe_get_single_definition (ptr);
715*38fd1498Szrj auto_vec<gimple *> *base_checks = NULL;
716*38fd1498Szrj if (base_addr)
717*38fd1498Szrj {
718*38fd1498Szrj base_checks = &ctx->asan_check_map.get_or_insert (base_addr);
719*38fd1498Szrj /* Original pointer might have been invalidated. */
720*38fd1498Szrj ptr_checks = ctx->asan_check_map.get (ptr);
721*38fd1498Szrj }
722*38fd1498Szrj
723*38fd1498Szrj gimple *g = maybe_get_dominating_check (*ptr_checks);
724*38fd1498Szrj gimple *g2 = NULL;
725*38fd1498Szrj
726*38fd1498Szrj if (base_checks)
727*38fd1498Szrj /* Try with base address as well. */
728*38fd1498Szrj g2 = maybe_get_dominating_check (*base_checks);
729*38fd1498Szrj
730*38fd1498Szrj if (g == NULL && g2 == NULL)
731*38fd1498Szrj {
732*38fd1498Szrj /* For this PTR we don't have any ASAN_CHECK stmts recorded, so there's
733*38fd1498Szrj nothing to optimize yet. */
734*38fd1498Szrj ptr_checks->safe_push (stmt);
735*38fd1498Szrj if (base_checks)
736*38fd1498Szrj base_checks->safe_push (stmt);
737*38fd1498Szrj return false;
738*38fd1498Szrj }
739*38fd1498Szrj
740*38fd1498Szrj bool remove = false;
741*38fd1498Szrj
742*38fd1498Szrj if (ptr_checks)
743*38fd1498Szrj remove = can_remove_asan_check (*ptr_checks, len, bb);
744*38fd1498Szrj
745*38fd1498Szrj if (!remove && base_checks)
746*38fd1498Szrj /* Try with base address as well. */
747*38fd1498Szrj remove = can_remove_asan_check (*base_checks, len, bb);
748*38fd1498Szrj
749*38fd1498Szrj if (!remove)
750*38fd1498Szrj {
751*38fd1498Szrj ptr_checks->safe_push (stmt);
752*38fd1498Szrj if (base_checks)
753*38fd1498Szrj base_checks->safe_push (stmt);
754*38fd1498Szrj }
755*38fd1498Szrj
756*38fd1498Szrj return remove;
757*38fd1498Szrj }
758*38fd1498Szrj
759*38fd1498Szrj /* Try to optimize away redundant UBSAN_NULL and ASAN_CHECK calls.
760*38fd1498Szrj
761*38fd1498Szrj We walk blocks in the CFG via a depth first search of the dominator
762*38fd1498Szrj tree; we push unique UBSAN_NULL or ASAN_CHECK statements into a vector
763*38fd1498Szrj in the NULL_CHECK_MAP or ASAN_CHECK_MAP hash maps as we enter the
764*38fd1498Szrj blocks. When leaving a block, we mark the block as visited; then
765*38fd1498Szrj when checking the statements in the vector, we ignore statements that
766*38fd1498Szrj are coming from already visited blocks, because these cannot dominate
767*38fd1498Szrj anything anymore. CTX is a sanopt context. */
768*38fd1498Szrj
769*38fd1498Szrj static void
sanopt_optimize_walker(basic_block bb,struct sanopt_ctx * ctx)770*38fd1498Szrj sanopt_optimize_walker (basic_block bb, struct sanopt_ctx *ctx)
771*38fd1498Szrj {
772*38fd1498Szrj basic_block son;
773*38fd1498Szrj gimple_stmt_iterator gsi;
774*38fd1498Szrj sanopt_info *info = (sanopt_info *) bb->aux;
775*38fd1498Szrj bool asan_check_optimize = (flag_sanitize & SANITIZE_ADDRESS) != 0;
776*38fd1498Szrj
777*38fd1498Szrj for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi);)
778*38fd1498Szrj {
779*38fd1498Szrj gimple *stmt = gsi_stmt (gsi);
780*38fd1498Szrj bool remove = false;
781*38fd1498Szrj
782*38fd1498Szrj if (!is_gimple_call (stmt))
783*38fd1498Szrj {
784*38fd1498Szrj /* Handle asm volatile or asm with "memory" clobber
785*38fd1498Szrj the same as potentionally freeing call. */
786*38fd1498Szrj gasm *asm_stmt = dyn_cast <gasm *> (stmt);
787*38fd1498Szrj if (asm_stmt
788*38fd1498Szrj && asan_check_optimize
789*38fd1498Szrj && (gimple_asm_clobbers_memory_p (asm_stmt)
790*38fd1498Szrj || gimple_asm_volatile_p (asm_stmt)))
791*38fd1498Szrj info->freeing_call_events++;
792*38fd1498Szrj gsi_next (&gsi);
793*38fd1498Szrj continue;
794*38fd1498Szrj }
795*38fd1498Szrj
796*38fd1498Szrj if (asan_check_optimize && !nonfreeing_call_p (stmt))
797*38fd1498Szrj info->freeing_call_events++;
798*38fd1498Szrj
799*38fd1498Szrj /* If __asan_before_dynamic_init ("module"); is followed by
800*38fd1498Szrj __asan_after_dynamic_init (); without intervening memory loads/stores,
801*38fd1498Szrj there is nothing to guard, so optimize both away. */
802*38fd1498Szrj if (asan_check_optimize
803*38fd1498Szrj && gimple_call_builtin_p (stmt, BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT))
804*38fd1498Szrj {
805*38fd1498Szrj use_operand_p use;
806*38fd1498Szrj gimple *use_stmt;
807*38fd1498Szrj if (single_imm_use (gimple_vdef (stmt), &use, &use_stmt))
808*38fd1498Szrj {
809*38fd1498Szrj if (is_gimple_call (use_stmt)
810*38fd1498Szrj && gimple_call_builtin_p (use_stmt,
811*38fd1498Szrj BUILT_IN_ASAN_AFTER_DYNAMIC_INIT))
812*38fd1498Szrj {
813*38fd1498Szrj unlink_stmt_vdef (use_stmt);
814*38fd1498Szrj gimple_stmt_iterator gsi2 = gsi_for_stmt (use_stmt);
815*38fd1498Szrj gsi_remove (&gsi2, true);
816*38fd1498Szrj remove = true;
817*38fd1498Szrj }
818*38fd1498Szrj }
819*38fd1498Szrj }
820*38fd1498Szrj
821*38fd1498Szrj if (gimple_call_internal_p (stmt))
822*38fd1498Szrj switch (gimple_call_internal_fn (stmt))
823*38fd1498Szrj {
824*38fd1498Szrj case IFN_UBSAN_NULL:
825*38fd1498Szrj remove = maybe_optimize_ubsan_null_ifn (ctx, stmt);
826*38fd1498Szrj break;
827*38fd1498Szrj case IFN_UBSAN_VPTR:
828*38fd1498Szrj remove = maybe_optimize_ubsan_vptr_ifn (ctx, stmt);
829*38fd1498Szrj break;
830*38fd1498Szrj case IFN_UBSAN_PTR:
831*38fd1498Szrj remove = maybe_optimize_ubsan_ptr_ifn (ctx, stmt);
832*38fd1498Szrj break;
833*38fd1498Szrj case IFN_ASAN_CHECK:
834*38fd1498Szrj if (asan_check_optimize)
835*38fd1498Szrj remove = maybe_optimize_asan_check_ifn (ctx, stmt);
836*38fd1498Szrj if (!remove)
837*38fd1498Szrj ctx->asan_num_accesses++;
838*38fd1498Szrj break;
839*38fd1498Szrj case IFN_ASAN_MARK:
840*38fd1498Szrj ctx->contains_asan_mark = true;
841*38fd1498Szrj break;
842*38fd1498Szrj default:
843*38fd1498Szrj break;
844*38fd1498Szrj }
845*38fd1498Szrj
846*38fd1498Szrj if (remove)
847*38fd1498Szrj {
848*38fd1498Szrj /* Drop this check. */
849*38fd1498Szrj if (dump_file && (dump_flags & TDF_DETAILS))
850*38fd1498Szrj {
851*38fd1498Szrj fprintf (dump_file, "Optimizing out: ");
852*38fd1498Szrj print_gimple_stmt (dump_file, stmt, 0, dump_flags);
853*38fd1498Szrj }
854*38fd1498Szrj unlink_stmt_vdef (stmt);
855*38fd1498Szrj gsi_remove (&gsi, true);
856*38fd1498Szrj }
857*38fd1498Szrj else
858*38fd1498Szrj {
859*38fd1498Szrj if (dump_file && (dump_flags & TDF_DETAILS))
860*38fd1498Szrj {
861*38fd1498Szrj fprintf (dump_file, "Leaving: ");
862*38fd1498Szrj print_gimple_stmt (dump_file, stmt, 0, dump_flags);
863*38fd1498Szrj }
864*38fd1498Szrj
865*38fd1498Szrj gsi_next (&gsi);
866*38fd1498Szrj }
867*38fd1498Szrj }
868*38fd1498Szrj
869*38fd1498Szrj if (asan_check_optimize)
870*38fd1498Szrj {
871*38fd1498Szrj info->has_freeing_call_p = info->freeing_call_events != 0;
872*38fd1498Szrj info->has_freeing_call_computed_p = true;
873*38fd1498Szrj }
874*38fd1498Szrj
875*38fd1498Szrj for (son = first_dom_son (CDI_DOMINATORS, bb);
876*38fd1498Szrj son;
877*38fd1498Szrj son = next_dom_son (CDI_DOMINATORS, son))
878*38fd1498Szrj sanopt_optimize_walker (son, ctx);
879*38fd1498Szrj
880*38fd1498Szrj /* We're leaving this BB, so mark it to that effect. */
881*38fd1498Szrj info->visited_p = true;
882*38fd1498Szrj }
883*38fd1498Szrj
884*38fd1498Szrj /* Try to remove redundant sanitizer checks in function FUN. */
885*38fd1498Szrj
886*38fd1498Szrj static int
sanopt_optimize(function * fun,bool * contains_asan_mark)887*38fd1498Szrj sanopt_optimize (function *fun, bool *contains_asan_mark)
888*38fd1498Szrj {
889*38fd1498Szrj struct sanopt_ctx ctx;
890*38fd1498Szrj ctx.asan_num_accesses = 0;
891*38fd1498Szrj ctx.contains_asan_mark = false;
892*38fd1498Szrj
893*38fd1498Szrj /* Set up block info for each basic block. */
894*38fd1498Szrj alloc_aux_for_blocks (sizeof (sanopt_info));
895*38fd1498Szrj
896*38fd1498Szrj /* We're going to do a dominator walk, so ensure that we have
897*38fd1498Szrj dominance information. */
898*38fd1498Szrj calculate_dominance_info (CDI_DOMINATORS);
899*38fd1498Szrj
900*38fd1498Szrj /* Recursively walk the dominator tree optimizing away
901*38fd1498Szrj redundant checks. */
902*38fd1498Szrj sanopt_optimize_walker (ENTRY_BLOCK_PTR_FOR_FN (fun), &ctx);
903*38fd1498Szrj
904*38fd1498Szrj free_aux_for_blocks ();
905*38fd1498Szrj
906*38fd1498Szrj *contains_asan_mark = ctx.contains_asan_mark;
907*38fd1498Szrj return ctx.asan_num_accesses;
908*38fd1498Szrj }
909*38fd1498Szrj
910*38fd1498Szrj /* Perform optimization of sanitize functions. */
911*38fd1498Szrj
912*38fd1498Szrj namespace {
913*38fd1498Szrj
914*38fd1498Szrj const pass_data pass_data_sanopt =
915*38fd1498Szrj {
916*38fd1498Szrj GIMPLE_PASS, /* type */
917*38fd1498Szrj "sanopt", /* name */
918*38fd1498Szrj OPTGROUP_NONE, /* optinfo_flags */
919*38fd1498Szrj TV_NONE, /* tv_id */
920*38fd1498Szrj ( PROP_ssa | PROP_cfg | PROP_gimple_leh ), /* properties_required */
921*38fd1498Szrj 0, /* properties_provided */
922*38fd1498Szrj 0, /* properties_destroyed */
923*38fd1498Szrj 0, /* todo_flags_start */
924*38fd1498Szrj TODO_update_ssa, /* todo_flags_finish */
925*38fd1498Szrj };
926*38fd1498Szrj
927*38fd1498Szrj class pass_sanopt : public gimple_opt_pass
928*38fd1498Szrj {
929*38fd1498Szrj public:
pass_sanopt(gcc::context * ctxt)930*38fd1498Szrj pass_sanopt (gcc::context *ctxt)
931*38fd1498Szrj : gimple_opt_pass (pass_data_sanopt, ctxt)
932*38fd1498Szrj {}
933*38fd1498Szrj
934*38fd1498Szrj /* opt_pass methods: */
gate(function *)935*38fd1498Szrj virtual bool gate (function *) { return flag_sanitize; }
936*38fd1498Szrj virtual unsigned int execute (function *);
937*38fd1498Szrj
938*38fd1498Szrj }; // class pass_sanopt
939*38fd1498Szrj
940*38fd1498Szrj /* Sanitize all ASAN_MARK unpoison calls that are not reachable by a BB
941*38fd1498Szrj that contains an ASAN_MARK poison. All these ASAN_MARK unpoison call
942*38fd1498Szrj can be removed as all variables are unpoisoned in a function prologue. */
943*38fd1498Szrj
944*38fd1498Szrj static void
sanitize_asan_mark_unpoison(void)945*38fd1498Szrj sanitize_asan_mark_unpoison (void)
946*38fd1498Szrj {
947*38fd1498Szrj /* 1) Find all BBs that contain an ASAN_MARK poison call. */
948*38fd1498Szrj auto_sbitmap with_poison (last_basic_block_for_fn (cfun) + 1);
949*38fd1498Szrj bitmap_clear (with_poison);
950*38fd1498Szrj basic_block bb;
951*38fd1498Szrj
952*38fd1498Szrj FOR_EACH_BB_FN (bb, cfun)
953*38fd1498Szrj {
954*38fd1498Szrj if (bitmap_bit_p (with_poison, bb->index))
955*38fd1498Szrj continue;
956*38fd1498Szrj
957*38fd1498Szrj gimple_stmt_iterator gsi;
958*38fd1498Szrj for (gsi = gsi_last_bb (bb); !gsi_end_p (gsi); gsi_prev (&gsi))
959*38fd1498Szrj {
960*38fd1498Szrj gimple *stmt = gsi_stmt (gsi);
961*38fd1498Szrj if (asan_mark_p (stmt, ASAN_MARK_POISON))
962*38fd1498Szrj {
963*38fd1498Szrj bitmap_set_bit (with_poison, bb->index);
964*38fd1498Szrj break;
965*38fd1498Szrj }
966*38fd1498Szrj }
967*38fd1498Szrj }
968*38fd1498Szrj
969*38fd1498Szrj auto_sbitmap poisoned (last_basic_block_for_fn (cfun) + 1);
970*38fd1498Szrj bitmap_clear (poisoned);
971*38fd1498Szrj auto_sbitmap worklist (last_basic_block_for_fn (cfun) + 1);
972*38fd1498Szrj bitmap_copy (worklist, with_poison);
973*38fd1498Szrj
974*38fd1498Szrj /* 2) Propagate the information to all reachable blocks. */
975*38fd1498Szrj while (!bitmap_empty_p (worklist))
976*38fd1498Szrj {
977*38fd1498Szrj unsigned i = bitmap_first_set_bit (worklist);
978*38fd1498Szrj bitmap_clear_bit (worklist, i);
979*38fd1498Szrj basic_block bb = BASIC_BLOCK_FOR_FN (cfun, i);
980*38fd1498Szrj gcc_assert (bb);
981*38fd1498Szrj
982*38fd1498Szrj edge e;
983*38fd1498Szrj edge_iterator ei;
984*38fd1498Szrj FOR_EACH_EDGE (e, ei, bb->succs)
985*38fd1498Szrj if (!bitmap_bit_p (poisoned, e->dest->index))
986*38fd1498Szrj {
987*38fd1498Szrj bitmap_set_bit (poisoned, e->dest->index);
988*38fd1498Szrj bitmap_set_bit (worklist, e->dest->index);
989*38fd1498Szrj }
990*38fd1498Szrj }
991*38fd1498Szrj
992*38fd1498Szrj /* 3) Iterate all BBs not included in POISONED BBs and remove unpoison
993*38fd1498Szrj ASAN_MARK preceding an ASAN_MARK poison (which can still happen). */
994*38fd1498Szrj FOR_EACH_BB_FN (bb, cfun)
995*38fd1498Szrj {
996*38fd1498Szrj if (bitmap_bit_p (poisoned, bb->index))
997*38fd1498Szrj continue;
998*38fd1498Szrj
999*38fd1498Szrj gimple_stmt_iterator gsi;
1000*38fd1498Szrj for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi);)
1001*38fd1498Szrj {
1002*38fd1498Szrj gimple *stmt = gsi_stmt (gsi);
1003*38fd1498Szrj if (gimple_call_internal_p (stmt, IFN_ASAN_MARK))
1004*38fd1498Szrj {
1005*38fd1498Szrj if (asan_mark_p (stmt, ASAN_MARK_POISON))
1006*38fd1498Szrj break;
1007*38fd1498Szrj else
1008*38fd1498Szrj {
1009*38fd1498Szrj if (dump_file)
1010*38fd1498Szrj fprintf (dump_file, "Removing ASAN_MARK unpoison\n");
1011*38fd1498Szrj unlink_stmt_vdef (stmt);
1012*38fd1498Szrj release_defs (stmt);
1013*38fd1498Szrj gsi_remove (&gsi, true);
1014*38fd1498Szrj continue;
1015*38fd1498Szrj }
1016*38fd1498Szrj }
1017*38fd1498Szrj
1018*38fd1498Szrj gsi_next (&gsi);
1019*38fd1498Szrj }
1020*38fd1498Szrj }
1021*38fd1498Szrj }
1022*38fd1498Szrj
1023*38fd1498Szrj /* Return true when STMT is either ASAN_CHECK call or a call of a function
1024*38fd1498Szrj that can contain an ASAN_CHECK. */
1025*38fd1498Szrj
1026*38fd1498Szrj static bool
maybe_contains_asan_check(gimple * stmt)1027*38fd1498Szrj maybe_contains_asan_check (gimple *stmt)
1028*38fd1498Szrj {
1029*38fd1498Szrj if (is_gimple_call (stmt))
1030*38fd1498Szrj {
1031*38fd1498Szrj if (gimple_call_internal_p (stmt, IFN_ASAN_MARK))
1032*38fd1498Szrj return false;
1033*38fd1498Szrj else
1034*38fd1498Szrj return !(gimple_call_flags (stmt) & ECF_CONST);
1035*38fd1498Szrj }
1036*38fd1498Szrj else if (is_a<gasm *> (stmt))
1037*38fd1498Szrj return true;
1038*38fd1498Szrj
1039*38fd1498Szrj return false;
1040*38fd1498Szrj }
1041*38fd1498Szrj
1042*38fd1498Szrj /* Sanitize all ASAN_MARK poison calls that are not followed by an ASAN_CHECK
1043*38fd1498Szrj call. These calls can be removed. */
1044*38fd1498Szrj
1045*38fd1498Szrj static void
sanitize_asan_mark_poison(void)1046*38fd1498Szrj sanitize_asan_mark_poison (void)
1047*38fd1498Szrj {
1048*38fd1498Szrj /* 1) Find all BBs that possibly contain an ASAN_CHECK. */
1049*38fd1498Szrj auto_sbitmap with_check (last_basic_block_for_fn (cfun) + 1);
1050*38fd1498Szrj bitmap_clear (with_check);
1051*38fd1498Szrj basic_block bb;
1052*38fd1498Szrj
1053*38fd1498Szrj FOR_EACH_BB_FN (bb, cfun)
1054*38fd1498Szrj {
1055*38fd1498Szrj gimple_stmt_iterator gsi;
1056*38fd1498Szrj for (gsi = gsi_last_bb (bb); !gsi_end_p (gsi); gsi_prev (&gsi))
1057*38fd1498Szrj {
1058*38fd1498Szrj gimple *stmt = gsi_stmt (gsi);
1059*38fd1498Szrj if (maybe_contains_asan_check (stmt))
1060*38fd1498Szrj {
1061*38fd1498Szrj bitmap_set_bit (with_check, bb->index);
1062*38fd1498Szrj break;
1063*38fd1498Szrj }
1064*38fd1498Szrj }
1065*38fd1498Szrj }
1066*38fd1498Szrj
1067*38fd1498Szrj auto_sbitmap can_reach_check (last_basic_block_for_fn (cfun) + 1);
1068*38fd1498Szrj bitmap_clear (can_reach_check);
1069*38fd1498Szrj auto_sbitmap worklist (last_basic_block_for_fn (cfun) + 1);
1070*38fd1498Szrj bitmap_copy (worklist, with_check);
1071*38fd1498Szrj
1072*38fd1498Szrj /* 2) Propagate the information to all definitions blocks. */
1073*38fd1498Szrj while (!bitmap_empty_p (worklist))
1074*38fd1498Szrj {
1075*38fd1498Szrj unsigned i = bitmap_first_set_bit (worklist);
1076*38fd1498Szrj bitmap_clear_bit (worklist, i);
1077*38fd1498Szrj basic_block bb = BASIC_BLOCK_FOR_FN (cfun, i);
1078*38fd1498Szrj gcc_assert (bb);
1079*38fd1498Szrj
1080*38fd1498Szrj edge e;
1081*38fd1498Szrj edge_iterator ei;
1082*38fd1498Szrj FOR_EACH_EDGE (e, ei, bb->preds)
1083*38fd1498Szrj if (!bitmap_bit_p (can_reach_check, e->src->index))
1084*38fd1498Szrj {
1085*38fd1498Szrj bitmap_set_bit (can_reach_check, e->src->index);
1086*38fd1498Szrj bitmap_set_bit (worklist, e->src->index);
1087*38fd1498Szrj }
1088*38fd1498Szrj }
1089*38fd1498Szrj
1090*38fd1498Szrj /* 3) Iterate all BBs not included in CAN_REACH_CHECK BBs and remove poison
1091*38fd1498Szrj ASAN_MARK not followed by a call to function having an ASAN_CHECK. */
1092*38fd1498Szrj FOR_EACH_BB_FN (bb, cfun)
1093*38fd1498Szrj {
1094*38fd1498Szrj if (bitmap_bit_p (can_reach_check, bb->index))
1095*38fd1498Szrj continue;
1096*38fd1498Szrj
1097*38fd1498Szrj gimple_stmt_iterator gsi;
1098*38fd1498Szrj for (gsi = gsi_last_bb (bb); !gsi_end_p (gsi);)
1099*38fd1498Szrj {
1100*38fd1498Szrj gimple *stmt = gsi_stmt (gsi);
1101*38fd1498Szrj if (maybe_contains_asan_check (stmt))
1102*38fd1498Szrj break;
1103*38fd1498Szrj else if (asan_mark_p (stmt, ASAN_MARK_POISON))
1104*38fd1498Szrj {
1105*38fd1498Szrj if (dump_file)
1106*38fd1498Szrj fprintf (dump_file, "Removing ASAN_MARK poison\n");
1107*38fd1498Szrj unlink_stmt_vdef (stmt);
1108*38fd1498Szrj release_defs (stmt);
1109*38fd1498Szrj gimple_stmt_iterator gsi2 = gsi;
1110*38fd1498Szrj gsi_prev (&gsi);
1111*38fd1498Szrj gsi_remove (&gsi2, true);
1112*38fd1498Szrj continue;
1113*38fd1498Szrj }
1114*38fd1498Szrj
1115*38fd1498Szrj gsi_prev (&gsi);
1116*38fd1498Szrj }
1117*38fd1498Szrj }
1118*38fd1498Szrj }
1119*38fd1498Szrj
1120*38fd1498Szrj /* Rewrite all usages of tree OP which is a PARM_DECL with a VAR_DECL
1121*38fd1498Szrj that is it's DECL_VALUE_EXPR. */
1122*38fd1498Szrj
1123*38fd1498Szrj static tree
rewrite_usage_of_param(tree * op,int * walk_subtrees,void *)1124*38fd1498Szrj rewrite_usage_of_param (tree *op, int *walk_subtrees, void *)
1125*38fd1498Szrj {
1126*38fd1498Szrj if (TREE_CODE (*op) == PARM_DECL && DECL_HAS_VALUE_EXPR_P (*op))
1127*38fd1498Szrj {
1128*38fd1498Szrj *op = DECL_VALUE_EXPR (*op);
1129*38fd1498Szrj *walk_subtrees = 0;
1130*38fd1498Szrj }
1131*38fd1498Szrj
1132*38fd1498Szrj return NULL;
1133*38fd1498Szrj }
1134*38fd1498Szrj
1135*38fd1498Szrj /* For a given function FUN, rewrite all addressable parameters so that
1136*38fd1498Szrj a new automatic variable is introduced. Right after function entry
1137*38fd1498Szrj a parameter is assigned to the variable. */
1138*38fd1498Szrj
1139*38fd1498Szrj static void
sanitize_rewrite_addressable_params(function * fun)1140*38fd1498Szrj sanitize_rewrite_addressable_params (function *fun)
1141*38fd1498Szrj {
1142*38fd1498Szrj gimple *g;
1143*38fd1498Szrj gimple_seq stmts = NULL;
1144*38fd1498Szrj bool has_any_addressable_param = false;
1145*38fd1498Szrj auto_vec<tree> clear_value_expr_list;
1146*38fd1498Szrj
1147*38fd1498Szrj for (tree arg = DECL_ARGUMENTS (current_function_decl);
1148*38fd1498Szrj arg; arg = DECL_CHAIN (arg))
1149*38fd1498Szrj {
1150*38fd1498Szrj tree type = TREE_TYPE (arg);
1151*38fd1498Szrj if (TREE_ADDRESSABLE (arg)
1152*38fd1498Szrj && !TREE_ADDRESSABLE (type)
1153*38fd1498Szrj && !TREE_THIS_VOLATILE (arg)
1154*38fd1498Szrj && TREE_CODE (TYPE_SIZE (type)) == INTEGER_CST)
1155*38fd1498Szrj {
1156*38fd1498Szrj TREE_ADDRESSABLE (arg) = 0;
1157*38fd1498Szrj /* The parameter is no longer addressable. */
1158*38fd1498Szrj has_any_addressable_param = true;
1159*38fd1498Szrj
1160*38fd1498Szrj /* Create a new automatic variable. */
1161*38fd1498Szrj tree var = build_decl (DECL_SOURCE_LOCATION (arg),
1162*38fd1498Szrj VAR_DECL, DECL_NAME (arg), type);
1163*38fd1498Szrj TREE_ADDRESSABLE (var) = 1;
1164*38fd1498Szrj DECL_IGNORED_P (var) = 1;
1165*38fd1498Szrj
1166*38fd1498Szrj gimple_add_tmp_var (var);
1167*38fd1498Szrj
1168*38fd1498Szrj if (dump_file)
1169*38fd1498Szrj fprintf (dump_file,
1170*38fd1498Szrj "Rewriting parameter whose address is taken: %s\n",
1171*38fd1498Szrj IDENTIFIER_POINTER (DECL_NAME (arg)));
1172*38fd1498Szrj
1173*38fd1498Szrj gcc_assert (!DECL_HAS_VALUE_EXPR_P (arg));
1174*38fd1498Szrj
1175*38fd1498Szrj SET_DECL_PT_UID (var, DECL_PT_UID (arg));
1176*38fd1498Szrj
1177*38fd1498Szrj /* Assign value of parameter to newly created variable. */
1178*38fd1498Szrj if ((TREE_CODE (type) == COMPLEX_TYPE
1179*38fd1498Szrj || TREE_CODE (type) == VECTOR_TYPE))
1180*38fd1498Szrj {
1181*38fd1498Szrj /* We need to create a SSA name that will be used for the
1182*38fd1498Szrj assignment. */
1183*38fd1498Szrj DECL_GIMPLE_REG_P (arg) = 1;
1184*38fd1498Szrj tree tmp = get_or_create_ssa_default_def (cfun, arg);
1185*38fd1498Szrj g = gimple_build_assign (var, tmp);
1186*38fd1498Szrj gimple_set_location (g, DECL_SOURCE_LOCATION (arg));
1187*38fd1498Szrj gimple_seq_add_stmt (&stmts, g);
1188*38fd1498Szrj }
1189*38fd1498Szrj else
1190*38fd1498Szrj {
1191*38fd1498Szrj g = gimple_build_assign (var, arg);
1192*38fd1498Szrj gimple_set_location (g, DECL_SOURCE_LOCATION (arg));
1193*38fd1498Szrj gimple_seq_add_stmt (&stmts, g);
1194*38fd1498Szrj }
1195*38fd1498Szrj
1196*38fd1498Szrj if (target_for_debug_bind (arg))
1197*38fd1498Szrj {
1198*38fd1498Szrj g = gimple_build_debug_bind (arg, var, NULL);
1199*38fd1498Szrj gimple_seq_add_stmt (&stmts, g);
1200*38fd1498Szrj clear_value_expr_list.safe_push (arg);
1201*38fd1498Szrj }
1202*38fd1498Szrj
1203*38fd1498Szrj DECL_HAS_VALUE_EXPR_P (arg) = 1;
1204*38fd1498Szrj SET_DECL_VALUE_EXPR (arg, var);
1205*38fd1498Szrj }
1206*38fd1498Szrj }
1207*38fd1498Szrj
1208*38fd1498Szrj if (!has_any_addressable_param)
1209*38fd1498Szrj return;
1210*38fd1498Szrj
1211*38fd1498Szrj /* Replace all usages of PARM_DECLs with the newly
1212*38fd1498Szrj created variable VAR. */
1213*38fd1498Szrj basic_block bb;
1214*38fd1498Szrj FOR_EACH_BB_FN (bb, fun)
1215*38fd1498Szrj {
1216*38fd1498Szrj gimple_stmt_iterator gsi;
1217*38fd1498Szrj for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); gsi_next (&gsi))
1218*38fd1498Szrj {
1219*38fd1498Szrj gimple *stmt = gsi_stmt (gsi);
1220*38fd1498Szrj gimple_stmt_iterator it = gsi_for_stmt (stmt);
1221*38fd1498Szrj walk_gimple_stmt (&it, NULL, rewrite_usage_of_param, NULL);
1222*38fd1498Szrj }
1223*38fd1498Szrj for (gsi = gsi_start_phis (bb); !gsi_end_p (gsi); gsi_next (&gsi))
1224*38fd1498Szrj {
1225*38fd1498Szrj gphi *phi = dyn_cast<gphi *> (gsi_stmt (gsi));
1226*38fd1498Szrj for (unsigned i = 0; i < gimple_phi_num_args (phi); ++i)
1227*38fd1498Szrj {
1228*38fd1498Szrj hash_set<tree> visited_nodes;
1229*38fd1498Szrj walk_tree (gimple_phi_arg_def_ptr (phi, i),
1230*38fd1498Szrj rewrite_usage_of_param, NULL, &visited_nodes);
1231*38fd1498Szrj }
1232*38fd1498Szrj }
1233*38fd1498Szrj }
1234*38fd1498Szrj
1235*38fd1498Szrj /* Unset value expr for parameters for which we created debug bind
1236*38fd1498Szrj expressions. */
1237*38fd1498Szrj unsigned i;
1238*38fd1498Szrj tree arg;
1239*38fd1498Szrj FOR_EACH_VEC_ELT (clear_value_expr_list, i, arg)
1240*38fd1498Szrj {
1241*38fd1498Szrj DECL_HAS_VALUE_EXPR_P (arg) = 0;
1242*38fd1498Szrj SET_DECL_VALUE_EXPR (arg, NULL_TREE);
1243*38fd1498Szrj }
1244*38fd1498Szrj
1245*38fd1498Szrj /* Insert default assignments at the beginning of a function. */
1246*38fd1498Szrj basic_block entry_bb = ENTRY_BLOCK_PTR_FOR_FN (fun);
1247*38fd1498Szrj entry_bb = split_edge (single_succ_edge (entry_bb));
1248*38fd1498Szrj
1249*38fd1498Szrj gimple_stmt_iterator gsi = gsi_start_bb (entry_bb);
1250*38fd1498Szrj gsi_insert_seq_before (&gsi, stmts, GSI_NEW_STMT);
1251*38fd1498Szrj }
1252*38fd1498Szrj
1253*38fd1498Szrj unsigned int
execute(function * fun)1254*38fd1498Szrj pass_sanopt::execute (function *fun)
1255*38fd1498Szrj {
1256*38fd1498Szrj basic_block bb;
1257*38fd1498Szrj int asan_num_accesses = 0;
1258*38fd1498Szrj bool contains_asan_mark = false;
1259*38fd1498Szrj
1260*38fd1498Szrj /* Try to remove redundant checks. */
1261*38fd1498Szrj if (optimize
1262*38fd1498Szrj && (flag_sanitize
1263*38fd1498Szrj & (SANITIZE_NULL | SANITIZE_ALIGNMENT
1264*38fd1498Szrj | SANITIZE_ADDRESS | SANITIZE_VPTR | SANITIZE_POINTER_OVERFLOW)))
1265*38fd1498Szrj asan_num_accesses = sanopt_optimize (fun, &contains_asan_mark);
1266*38fd1498Szrj else if (flag_sanitize & SANITIZE_ADDRESS)
1267*38fd1498Szrj {
1268*38fd1498Szrj gimple_stmt_iterator gsi;
1269*38fd1498Szrj FOR_EACH_BB_FN (bb, fun)
1270*38fd1498Szrj for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); gsi_next (&gsi))
1271*38fd1498Szrj {
1272*38fd1498Szrj gimple *stmt = gsi_stmt (gsi);
1273*38fd1498Szrj if (gimple_call_internal_p (stmt, IFN_ASAN_CHECK))
1274*38fd1498Szrj ++asan_num_accesses;
1275*38fd1498Szrj else if (gimple_call_internal_p (stmt, IFN_ASAN_MARK))
1276*38fd1498Szrj contains_asan_mark = true;
1277*38fd1498Szrj }
1278*38fd1498Szrj }
1279*38fd1498Szrj
1280*38fd1498Szrj if (contains_asan_mark)
1281*38fd1498Szrj {
1282*38fd1498Szrj sanitize_asan_mark_unpoison ();
1283*38fd1498Szrj sanitize_asan_mark_poison ();
1284*38fd1498Szrj }
1285*38fd1498Szrj
1286*38fd1498Szrj if (asan_sanitize_stack_p ())
1287*38fd1498Szrj sanitize_rewrite_addressable_params (fun);
1288*38fd1498Szrj
1289*38fd1498Szrj bool use_calls = ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD < INT_MAX
1290*38fd1498Szrj && asan_num_accesses >= ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD;
1291*38fd1498Szrj
1292*38fd1498Szrj hash_map<tree, tree> shadow_vars_mapping;
1293*38fd1498Szrj bool need_commit_edge_insert = false;
1294*38fd1498Szrj FOR_EACH_BB_FN (bb, fun)
1295*38fd1498Szrj {
1296*38fd1498Szrj gimple_stmt_iterator gsi;
1297*38fd1498Szrj for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); )
1298*38fd1498Szrj {
1299*38fd1498Szrj gimple *stmt = gsi_stmt (gsi);
1300*38fd1498Szrj bool no_next = false;
1301*38fd1498Szrj
1302*38fd1498Szrj if (!is_gimple_call (stmt))
1303*38fd1498Szrj {
1304*38fd1498Szrj gsi_next (&gsi);
1305*38fd1498Szrj continue;
1306*38fd1498Szrj }
1307*38fd1498Szrj
1308*38fd1498Szrj if (gimple_call_internal_p (stmt))
1309*38fd1498Szrj {
1310*38fd1498Szrj enum internal_fn ifn = gimple_call_internal_fn (stmt);
1311*38fd1498Szrj switch (ifn)
1312*38fd1498Szrj {
1313*38fd1498Szrj case IFN_UBSAN_NULL:
1314*38fd1498Szrj no_next = ubsan_expand_null_ifn (&gsi);
1315*38fd1498Szrj break;
1316*38fd1498Szrj case IFN_UBSAN_BOUNDS:
1317*38fd1498Szrj no_next = ubsan_expand_bounds_ifn (&gsi);
1318*38fd1498Szrj break;
1319*38fd1498Szrj case IFN_UBSAN_OBJECT_SIZE:
1320*38fd1498Szrj no_next = ubsan_expand_objsize_ifn (&gsi);
1321*38fd1498Szrj break;
1322*38fd1498Szrj case IFN_UBSAN_PTR:
1323*38fd1498Szrj no_next = ubsan_expand_ptr_ifn (&gsi);
1324*38fd1498Szrj break;
1325*38fd1498Szrj case IFN_UBSAN_VPTR:
1326*38fd1498Szrj no_next = ubsan_expand_vptr_ifn (&gsi);
1327*38fd1498Szrj break;
1328*38fd1498Szrj case IFN_ASAN_CHECK:
1329*38fd1498Szrj no_next = asan_expand_check_ifn (&gsi, use_calls);
1330*38fd1498Szrj break;
1331*38fd1498Szrj case IFN_ASAN_MARK:
1332*38fd1498Szrj no_next = asan_expand_mark_ifn (&gsi);
1333*38fd1498Szrj break;
1334*38fd1498Szrj case IFN_ASAN_POISON:
1335*38fd1498Szrj no_next = asan_expand_poison_ifn (&gsi,
1336*38fd1498Szrj &need_commit_edge_insert,
1337*38fd1498Szrj shadow_vars_mapping);
1338*38fd1498Szrj break;
1339*38fd1498Szrj default:
1340*38fd1498Szrj break;
1341*38fd1498Szrj }
1342*38fd1498Szrj }
1343*38fd1498Szrj else if (gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
1344*38fd1498Szrj {
1345*38fd1498Szrj tree callee = gimple_call_fndecl (stmt);
1346*38fd1498Szrj switch (DECL_FUNCTION_CODE (callee))
1347*38fd1498Szrj {
1348*38fd1498Szrj case BUILT_IN_UNREACHABLE:
1349*38fd1498Szrj if (sanitize_flags_p (SANITIZE_UNREACHABLE))
1350*38fd1498Szrj no_next = ubsan_instrument_unreachable (&gsi);
1351*38fd1498Szrj break;
1352*38fd1498Szrj default:
1353*38fd1498Szrj break;
1354*38fd1498Szrj }
1355*38fd1498Szrj }
1356*38fd1498Szrj
1357*38fd1498Szrj if (dump_file && (dump_flags & TDF_DETAILS))
1358*38fd1498Szrj {
1359*38fd1498Szrj fprintf (dump_file, "Expanded: ");
1360*38fd1498Szrj print_gimple_stmt (dump_file, stmt, 0, dump_flags);
1361*38fd1498Szrj }
1362*38fd1498Szrj
1363*38fd1498Szrj if (!no_next)
1364*38fd1498Szrj gsi_next (&gsi);
1365*38fd1498Szrj }
1366*38fd1498Szrj }
1367*38fd1498Szrj
1368*38fd1498Szrj if (need_commit_edge_insert)
1369*38fd1498Szrj gsi_commit_edge_inserts ();
1370*38fd1498Szrj
1371*38fd1498Szrj return 0;
1372*38fd1498Szrj }
1373*38fd1498Szrj
1374*38fd1498Szrj } // anon namespace
1375*38fd1498Szrj
1376*38fd1498Szrj gimple_opt_pass *
make_pass_sanopt(gcc::context * ctxt)1377*38fd1498Szrj make_pass_sanopt (gcc::context *ctxt)
1378*38fd1498Szrj {
1379*38fd1498Szrj return new pass_sanopt (ctxt);
1380*38fd1498Szrj }
1381