- Generated by
1.8.1.1
|
GCC Middle and Back End API Reference
|
Data Structures | |
| struct | asan_mem_ref |
| struct | asan_mem_ref_hasher |
| struct | asan_add_string_csts_data |
Variables | |
| alias_set_type | asan_shadow_set = -1 |
| static tree | shadow_ptr_types [2] |
| static alloc_pool | asan_mem_ref_alloc_pool |
| static hash_table < asan_mem_ref_hasher > | asan_mem_ref_ht |
| static tree | asan_ctor_statements |
|
static |
Called via htab_traverse. Call asan_add_global on emitted STRING_CSTs from the constant hash table.
References asan_add_global(), asan_protect_global(), constant_descriptor_tree::rtl, asan_add_string_csts_data::type, asan_add_string_csts_data::v, and constant_descriptor_tree::value.
Referenced by asan_finish_file().
|
static |
Append description of a single global DECL into vector V. TYPE is __asan_global struct type as returned by asan_global_struct.
References asan_needs_local_alias(), asan_pp_string(), asan_red_zone_size(), assemble_alias(), build_constructor(), build_int_cst(), get_identifier(), HOST_WIDE_INT, pp_string(), pp_tree_identifier(), tree_low_cst(), and vec_safe_length().
Referenced by add_string_csts(), and asan_finish_file().
|
static |
Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here though.
References add_reg_note(), BLOCK_OP_NORMAL, clear_storage(), emit_cmp_and_jump_insns(), emit_insn(), emit_label(), emit_move_insn(), end_sequence(), expand_simple_binop(), force_reg(), gen_label_rtx(), get_insns(), get_last_insn(), OPTAB_LIB_WIDEN, plus_constant(), and start_sequence().
Referenced by asan_emit_stack_protection().
| rtx asan_emit_stack_protection | ( | rtx | base, |
| HOST_WIDE_INT * | offsets, | ||
| tree * | decls, | ||
| int | length | ||
| ) |
Insert code to protect stack vars. The prologue sequence should be emitted directly, epilogue sequence returned. BASE is the register holding the stack base, against which OFFSETS array offsets are relative to, OFFSETS array contains pairs of offsets in reverse order, always the end offset of some gap that needs protection followed by starting offset, and DECLS is an array of representative decls for each var partition. LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1 elements long (OFFSETS include gap before the first variable as well as gaps after each stack variable).
References asan_clear_shadow(), asan_init_shadow_ptr_types(), asan_pp_string(), asan_shadow_cst(), asan_shadow_set, current_function_decl, do_pending_stack_adjust(), emit_move_insn(), end_sequence(), expand_binop(), expand_normal(), gen_rtx_MEM(), get_insns(), HOST_WIDE_INT, HOST_WIDE_INT_1, memset(), offset, OPTAB_DIRECT, pp_string(), pp_tree_identifier(), ptr_mode, set_mem_alias_set(), shadow_ptr_types, start_sequence(), and targetm.
Referenced by expand_used_vars().
| void asan_finish_file | ( | void | ) |
Module-level instrumentation. - Insert __asan_init() into the list of CTORs. - TODO: insert redzones around globals.
References add_string_csts(), append_to_statement_list(), asan_add_global(), asan_global_struct(), asan_init_shadow_ptr_types(), asan_protect_global(), build_array_type_nelts(), build_call_expr(), build_constructor(), build_int_cst(), build_nonstandard_integer_type(), builtin_decl_implicit(), cgraph_build_static_cdtor(), const_desc_htab, constant_pool_htab(), count_string_csts(), symtab_node_base::decl, get_identifier(), HOST_WIDE_INT, shadow_ptr_types, varpool_node::symbol, asan_add_string_csts_data::type, asan_add_string_csts_data::v, varpool_assemble_decl(), varpool_node_for_decl(), and vec_alloc().
Referenced by compile_file().
|
static |
Build
struct __asan_global
{
const void *__beg;
uptr __size;
uptr __size_with_redzone;
const void *__name;
uptr __has_dynamic_init;
} type.
References build_nonstandard_integer_type(), get_identifier(), and layout_type().
Referenced by asan_finish_file().
|
static |
Initialize shadow_ptr_types array.
References asan_shadow_set, build_distinct_type_copy(), build_pointer_type(), initialize_sanitizer_builtins(), new_alias_set(), and shadow_ptr_types.
Referenced by asan_emit_stack_protection(), asan_finish_file(), and asan_instrument().
|
static |
Instrument the current function.
References asan_init_shadow_ptr_types(), shadow_ptr_types, and transform_statements().
|
static |
This creates the alloc pool used to store the instances of asan_mem_ref that are stored in the hash table asan_mem_ref_ht.
References asan_mem_ref_alloc_pool, and create_alloc_pool().
Referenced by asan_mem_ref_new().
| tree asan_mem_ref_get_end | ( | ) |
This builds and returns a pointer to the end of the memory region that starts at START and of length LEN.
Return a tree expression that represents the end of the referenced
memory region. Beware that this function can actually build a new
tree expression.
References integer_zerop().
Referenced by instrument_mem_region_access().
|
static |
Initializes an instance of asan_mem_ref.
References asan_mem_ref::access_size, and asan_mem_ref::start.
Referenced by asan_mem_ref_new(), has_mem_ref_been_instrumented(), has_stmt_been_instrumented_p(), instrument_builtin_call(), and update_mem_ref_hash_table().
|
static |
Allocates memory for an instance of asan_mem_ref into the memory pool returned by asan_mem_ref_get_alloc_pool and initialize it. START is the address of (or the expression pointing to) the beginning of memory reference. ACCESS_SIZE is the size of the access to the referenced memory.
References asan_mem_ref_get_alloc_pool(), asan_mem_ref_init(), and pool_alloc().
Referenced by update_mem_ref_hash_table().
|
static |
Return true if DECL, a global var, might be overridden and needs therefore a local alias.
References targetm.
Referenced by asan_add_global(), and asan_protect_global().
|
static |
Create ADDR_EXPR of STRING_CST with the PP pretty printer text.
References build_array_type(), build_index_type(), build_string(), pp_formatted_text(), shadow_ptr_types, and strlen().
Referenced by asan_add_global(), and asan_emit_stack_protection().
| bool asan_protect_global | ( | ) |
Return true if DECL is a VAR_DECL that should be protected by Address Sanitizer, by appending a red zone with protected shadow memory after it and aligning it to at least ASAN_RED_ZONE_SIZE bytes.
References asan_needs_local_alias(), lookup_attribute(), shadow_ptr_types, and valid_constant_size_p().
Referenced by add_string_csts(), asan_finish_file(), assemble_noswitch_variable(), assemble_variable(), categorize_decl_for_section(), count_string_csts(), get_variable_section(), output_constant_def_contents(), output_object_block(), and place_block_symbol().
|
static |
Return a CONST_INT representing 4 subsequent shadow memory bytes.
References HOST_WIDE_INT, and trunc_int_for_mode().
Referenced by asan_emit_stack_protection().
|
static |
Instrument the memory access instruction BASE. Insert new statements before or after ITER. Note that the memory access represented by BASE can be either an SSA_NAME, or a non-SSA expression. LOCATION is the source code location. IS_STORE is TRUE for a store, FALSE for a load. BEFORE_P is TRUE for inserting the instrumentation code before ITER, FALSE for inserting it after ITER. SIZE_IN_BYTES is one of 1, 2, 4, 8, 16. If BEFORE_P is TRUE, *ITER is arranged to still point to the statement it was pointing to prior to calling this function, otherwise, it points to the statement logically following it.
References build_assign(), build_int_cst(), build_nonstandard_integer_type(), build_type_cast(), create_cond_insert_point(), g, gimple_assign_lhs(), gimple_build_assign_with_ops(), gimple_build_call(), gimple_build_cond(), gimple_seq_add_stmt(), gimple_seq_last(), gimple_seq_set_location(), gimple_set_location(), GSI_CONTINUE_LINKING, gsi_insert_after(), gsi_insert_seq_after(), GSI_NEW_STMT, gsi_start_bb(), make_ssa_name(), report_error_func(), shadow_ptr_types, targetm, and unshare_expr().
Referenced by instrument_derefs(), instrument_mem_region_access(), and instrument_strlen_call().
|
static |
Called via htab_traverse. Count number of emitted STRING_CSTs in the constant hash table.
References asan_protect_global(), HOST_WIDE_INT, and constant_descriptor_tree::value.
Referenced by asan_finish_file().
|
static |
Split the current basic block and create a condition statement
insertion point right before or after the statement pointed to by
ITER. Return an iterator to the point at which the caller might
safely insert the condition statement.
THEN_BLOCK must be set to the address of an uninitialized instance
of basic_block. The function will then set *THEN_BLOCK to the
'then block' of the condition statement to be inserted by the
caller.
If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
*THEN_BLOCK to *FALLTHROUGH_BLOCK.
Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
block' of the condition statement to be inserted by the caller.
Note that *FALLTHROUGH_BLOCK is a new block that contains the
statements starting from *ITER, and *THEN_BLOCK is a new empty
block.
*ITER is adjusted to point to always point to the first statement
of the basic block * FALLTHROUGH_BLOCK. That statement is the
same as what ITER was pointing to prior to calling this function,
if BEFORE_P is true; otherwise, it is its following statement.
References add_bb_to_loop(), CDI_DOMINATORS, edge_def::count, basic_block_def::count, create_empty_bb(), edge_def::dest, dom_info_available_p(), find_edge(), edge_def::flags, gsi_bb(), gsi_end_p(), gsi_last_bb(), gsi_prev(), gsi_start_bb(), gsi_stmt(), basic_block_def::loop_father, LOOPS_NEED_FIXUP, loops_state_set(), make_edge(), make_single_succ_edge(), edge_def::probability, set_immediate_dominator(), split_block(), and edge_def::src.
Referenced by build_check_stmt(), and insert_if_then_before_iter().
|
static |
Clear all entries from the memory references hash table.
References hash_table< Descriptor, Allocator >::empty(), and hash_table< Descriptor, Allocator >::is_created().
Referenced by transform_statements().
|
static |
Free the memory references hash table.
References hash_table< Descriptor, Allocator >::dispose(), free_alloc_pool(), and hash_table< Descriptor, Allocator >::is_created().
Referenced by transform_statements().
|
static |
References current_function_decl, and lookup_attribute().
Referenced by gate_asan_O0().
|
static |
References gate_asan().
|
static |
Returns a reference to the hash table containing memory references. This function ensures that the hash table is created. Note that this hash table is updated by the function update_mem_ref_hash_table.
References asan_mem_ref_ht, hash_table< Descriptor, Allocator >::create(), and hash_table< Descriptor, Allocator >::is_created().
Referenced by has_mem_ref_been_instrumented(), and update_mem_ref_hash_table().
|
static |
Set REF to the memory reference present in a gimple assignment ASSIGNMENT. Return true upon successful completion, false otherwise.
References asan_mem_ref::access_size, gimple_assign_lhs(), gimple_assign_load_p(), gimple_assign_rhs1(), gimple_assign_single_p(), gimple_clobber_p(), gimple_store_p(), int_size_in_bytes(), and asan_mem_ref::start.
Referenced by has_stmt_been_instrumented_p().
|
static |
Return the memory references contained in a gimple statement representing a builtin call that has to do with memory access.
References asan_mem_ref::access_size, build_int_cst(), BUILT_IN_NORMAL, gimple_call_arg(), gimple_call_builtin_p(), gimple_call_fndecl(), gimple_call_lhs(), int_size_in_bytes(), len, and asan_mem_ref::start.
Referenced by has_stmt_been_instrumented_p(), and instrument_builtin_call().
|
static |
Return true iff the memory reference REF has been instrumented.
Return true iff access to memory region starting at REF and of length LEN has been instrumented.
References asan_mem_ref_init(), find(), and get_mem_ref_hash_table().
Referenced by has_stmt_been_instrumented_p(), instrument_derefs(), and instrument_mem_region_access().
|
static |
Return true iff a given gimple statement has been instrumented. Note that the statement is "defined" by the memory references it contains.
References asan_mem_ref_init(), BUILT_IN_NORMAL, get_mem_ref_of_assignment(), get_mem_refs_of_builtin_call(), gimple_assign_single_p(), gimple_call_builtin_p(), has_mem_ref_been_instrumented(), and asan_mem_ref::start.
Referenced by transform_statements().
| void initialize_sanitizer_builtins | ( | void | ) |
Initialize sanitizer.def builtins if the FE hasn't initialized them.
References build_function_type_list(), build_nonstandard_integer_type(), build_pointer_type(), build_qualified_type(), builtin_decl_implicit_p(), lang_hooks_for_types::type_for_size, TYPE_QUAL_CONST, TYPE_QUAL_VOLATILE, and lang_hooks::types.
Referenced by asan_init_shadow_ptr_types(), tsan_finish_file(), and tsan_pass().
|
static |
Insert an if condition followed by a 'then block' right before the statement pointed to by ITER. The fallthrough block -- which is the else block of the condition as well as the destination of the outcoming edge of the 'then block' -- starts with the statement pointed to by ITER. COND is the condition of the if. If THEN_MORE_LIKELY_P is true, the probability of the edge to the 'then block' is higher than the probability of the edge to the fallthrough block. Upon completion of the function, *THEN_BB is set to the newly inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the fallthrough block. *ITER is adjusted to still point to the same statement it was pointing to initially.
References create_cond_insert_point(), gsi_insert_after(), and GSI_NEW_STMT.
Referenced by instrument_mem_region_access().
|
static |
Instrument the call to a built-in memory access function that is pointed to by the iterator ITER. Upon completion, return TRUE iff *ITER has been advanced to the statement following the one it was originally pointing to.
References asan_mem_ref_init(), BUILT_IN_NORMAL, get_mem_refs_of_builtin_call(), gimple_call_builtin_p(), gimple_call_fndecl(), gimple_location(), gsi_for_stmt(), gsi_next(), gsi_stmt(), instrument_derefs(), instrument_mem_region_access(), instrument_strlen_call(), and asan_mem_ref::start.
Referenced by maybe_instrument_call().
|
static |
If T represents a memory access, add instrumentation code before ITER. LOCATION is source code location. IS_STORE is either TRUE (for a store) or FALSE (for a load).
References build_check_stmt(), get_inner_reference(), has_mem_ref_been_instrumented(), HOST_WIDE_INT, int_size_in_bytes(), offset, size_in_bytes(), type(), and update_mem_ref_hash_table().
Referenced by instrument_builtin_call(), and maybe_instrument_assignment().
|
static |
Instrument an access to a contiguous memory region that starts at the address pointed to by BASE, over a length of LEN (expressed in the sizeof (*BASE) bytes). ITER points to the instruction before which the instrumentation instructions must be inserted. LOCATION is the source location that the instrumentation instructions must have. If IS_STORE is true, then the memory access is a store; otherwise, it's a load.
References asan_mem_ref_get_end(), build_check_stmt(), build_int_cst(), g, gimple_assign_lhs(), gimple_build_assign_with_ops(), gimple_build_cond(), gimple_seq_add_stmt_without_update(), gimple_set_location(), gsi_for_stmt(), gsi_insert_seq_before(), gsi_last_bb(), GSI_SAME_STMT, gsi_stmt(), has_mem_ref_been_instrumented(), insert_if_then_before_iter(), integer_zerop(), is_gimple_constant(), make_ssa_name(), offset, unshare_expr(), update_mem_ref_hash_table(), and useless_type_conversion_p().
Referenced by instrument_builtin_call().
|
static |
Instrument the call (to the builtin strlen function) pointed to by ITER. This function instruments the access to the first byte of the argument, right before the call. After the call it instruments the access to the last byte of the argument; it uses the result of the call to deduce the offset of that last byte. Upon completion, iff the call has actually been instrumented, this function returns TRUE and *ITER points to the statement logically following the built-in strlen function call *ITER was initially pointing to. Otherwise, the function returns FALSE and *ITER remains unchanged.
References build_check_stmt(), build_pointer_type(), BUILT_IN_NORMAL, gimple_assign_lhs(), gimple_build_assign_with_ops(), gimple_call_arg(), gimple_call_fndecl(), gimple_call_lhs(), gimple_location(), gimple_set_location(), gsi_insert_after(), gsi_insert_before(), GSI_NEW_STMT, gsi_stmt(), is_builtin_fn(), is_gimple_call(), and make_ssa_name().
Referenced by instrument_builtin_call().
| gimple_opt_pass* make_pass_asan | ( | ) |
| gimple_opt_pass* make_pass_asan_O0 | ( | ) |
|
static |
Instrument the assignment statement ITER if it is subject to
instrumentation. Return TRUE iff instrumentation actually
happened. In that case, the iterator ITER is advanced to the next
logical expression following the one initially pointed to by ITER,
and the relevant memory reference that which access has been
instrumented is added to the memory references hash table.
References gimple_assign_lhs(), gimple_assign_load_p(), gimple_assign_rhs1(), gimple_assign_single_p(), gimple_location(), gimple_store_p(), gsi_next(), gsi_stmt(), and instrument_derefs().
Referenced by transform_statements().
|
static |
Instrument the function call pointed to by the iterator ITER, if it is subject to instrumentation. At the moment, the only function calls that are instrumented are some built-in functions that access memory. Look at instrument_builtin_call to learn more. Upon completion return TRUE iff *ITER was advanced to the statement following the one it was originally pointing to.
References BUILT_IN_NORMAL, builtin_decl_implicit(), g, gimple_build_call(), gimple_call_builtin_p(), gimple_call_fndecl(), gimple_call_noreturn_p(), gimple_location(), gimple_set_location(), gsi_insert_before(), GSI_SAME_STMT, gsi_stmt(), and instrument_builtin_call().
Referenced by transform_statements().
|
static |
Construct a function tree for __asan_report_{load,store}{1,2,4,8,16}.
IS_STORE is either 1 (for a store) or 0 (for a load).
SIZE_IN_BYTES is one of 1, 2, 4, 8, 16.
References builtin_decl_implicit(), and exact_log2().
Referenced by build_check_stmt().
|
static |
Walk each instruction of all basic block and instrument those that represent memory references: loads, stores, or function calls. In a given basic block, this function avoids instrumenting memory references that have already been instrumented.
References empty_mem_ref_hash_table(), free_mem_ref_resources(), gimple_assign_single_p(), gsi_end_p(), gsi_next(), gsi_start_bb(), gsi_stmt(), has_stmt_been_instrumented_p(), basic_block_def::index, is_gimple_call(), last_bb, maybe_instrument_assignment(), maybe_instrument_call(), nonfreeing_call_p(), single_pred(), and single_pred_p().
Referenced by asan_instrument().
|
static |
Insert a memory reference into the hash table.
References asan_mem_ref_init(), asan_mem_ref_new(), hash_table< Descriptor, Allocator >::find_slot(), and get_mem_ref_hash_table().
Referenced by instrument_derefs(), and instrument_mem_region_access().
|
static |
Needs to be , because cgraph_build_static_cdtor may invoke ggc_collect.
|
static |
Referenced by asan_mem_ref_get_alloc_pool().
|
static |
Referenced by get_mem_ref_hash_table().
| alias_set_type asan_shadow_set = -1 |
@verbatim AddressSanitizer, a fast memory error detector.
Copyright (C) 2012-2013 Free Software Foundation, Inc. Contributed by Kostya Serebryany kcc@google.com
This file is part of GCC.
GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version.
GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see http://www.gnu.org/licenses/.
AddressSanitizer finds out-of-bounds and use-after-free bugs
with <2x slowdown on average.
The tool consists of two parts:
instrumentation module (this file) and a run-time library.
The instrumentation module adds a run-time check before every memory insn.
For a 8- or 16- byte load accessing address X:
ShadowAddr = (X >> 3) + Offset
ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
if (ShadowValue)
__asan_report_load8(X);
For a load of N bytes (N=1, 2 or 4) from address X:
ShadowAddr = (X >> 3) + Offset
ShadowValue = *(char*)ShadowAddr;
if (ShadowValue)
if ((X & 7) + N - 1 > ShadowValue)
__asan_report_loadN(X);
Stores are instrumented similarly, but using __asan_report_storeN functions.
A call too __asan_init() is inserted to the list of module CTORs.
The run-time library redefines malloc (so that redzone are inserted around
the allocated memory) and free (so that reuse of free-ed memory is delayed),
provides __asan_report* and __asan_init functions.
Read more:
http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
The current implementation supports detection of out-of-bounds and
use-after-free in the heap, on the stack and for global variables.
[Protection of stack variables]
To understand how detection of out-of-bounds and use-after-free works
for stack variables, lets look at this example on x86_64 where the
stack grows downward:
int
foo ()
{
char a[23] = {0};
int b[2] = {0};
a[5] = 1;
b[1] = 2;
return a[5] + b[1];
}
For this function, the stack protected by asan will be organized as
follows, from the top of the stack to the bottom:
Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
the next slot be 32 bytes aligned; this one is called Partial
Redzone; this 32 bytes alignment is an asan constraint]
Slot 3/ [24 bytes for variable 'a']
Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
Slot 6/ [8 bytes for variable 'b']
Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
'LEFT RedZone']
The 32 bytes of LEFT red zone at the bottom of the stack can be
decomposed as such:
1/ The first 8 bytes contain a magical asan number that is always
0x41B58AB3.
2/ The following 8 bytes contains a pointer to a string (to be
parsed at runtime by the runtime asan library), which format is
the following:
"<function-name> <space> <num-of-variables-on-the-stack>
(<32-bytes-aligned-offset-in-bytes-of-variable> <space>
<length-of-var-in-bytes> ){n} "
where '(...){n}' means the content inside the parenthesis occurs 'n'
times, with 'n' being the number of variables on the stack.
3/ The following 16 bytes of the red zone have no particular
format.
The shadow memory for that stack layout is going to look like this:
- content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
The F1 byte pattern is a magic number called
ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
the memory for that shadow byte is part of a the LEFT red zone
intended to seat at the bottom of the variables on the stack.
- content of shadow memory 8 bytes for slots 6 and 5:
0xF4F4F400. The F4 byte pattern is a magic number
called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
memory region for this shadow byte is a PARTIAL red zone
intended to pad a variable A, so that the slot following
{A,padding} is 32 bytes aligned.
Note that the fact that the least significant byte of this
shadow memory content is 00 means that 8 bytes of its
corresponding memory (which corresponds to the memory of
variable 'b') is addressable.
- content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
The F2 byte pattern is a magic number called
ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
region for this shadow byte is a MIDDLE red zone intended to
seat between two 32 aligned slots of {variable,padding}.
- content of shadow memory 8 bytes for slot 3 and 2:
0xF4000000. This represents is the concatenation of
variable 'a' and the partial red zone following it, like what we
had for variable 'b'. The least significant 3 bytes being 00
means that the 3 bytes of variable 'a' are addressable.
- content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
The F3 byte pattern is a magic number called
ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
region for this shadow byte is a RIGHT red zone intended to seat
at the top of the variables of the stack.
Note that the real variable layout is done in expand_used_vars in
cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
stack variables as well as the different red zones, emits some
prologue code to populate the shadow memory as to poison (mark as
non-accessible) the regions of the red zones and mark the regions of
stack variables as accessible, and emit some epilogue code to
un-poison (mark as accessible) the regions of red zones right before
the function exits.
[Protection of global variables]
The basic idea is to insert a red zone between two global variables
and install a constructor function that calls the asan runtime to do
the populating of the relevant shadow memory regions at load time.
So the global variables are laid out as to insert a red zone between
them. The size of the red zones is so that each variable starts on a
32 bytes boundary.
Then a constructor function is installed so that, for each global
variable, it calls the runtime asan library function
__asan_register_globals_with an instance of this type:
struct __asan_global
{
// Address of the beginning of the global variable.
const void *__beg;
// Initial size of the global variable.
uptr __size;
// Size of the global variable + size of the red zone. This
// size is 32 bytes aligned.
uptr __size_with_redzone;
// Name of the global variable.
const void *__name;
// This is always set to NULL for now.
uptr __has_dynamic_init;
}
A destructor function that calls the runtime asan library function
_asan_unregister_globals is also installed.
Referenced by asan_emit_stack_protection(), and asan_init_shadow_ptr_types().
|
static |
Pointer types to 1 resp. 2 byte integers in shadow memory. A separate alias set is used for all shadow memory accesses.
Referenced by asan_emit_stack_protection(), asan_finish_file(), asan_init_shadow_ptr_types(), asan_instrument(), asan_pp_string(), asan_protect_global(), and build_check_stmt().
1.8.1.1