c-ubsan.c revision 1.5
1/* UndefinedBehaviorSanitizer, undefined behavior detector. 2 Copyright (C) 2013-2019 Free Software Foundation, Inc. 3 Contributed by Marek Polacek <polacek@redhat.com> 4 5This file is part of GCC. 6 7GCC is free software; you can redistribute it and/or modify it under 8the terms of the GNU General Public License as published by the Free 9Software Foundation; either version 3, or (at your option) any later 10version. 11 12GCC is distributed in the hope that it will be useful, but WITHOUT ANY 13WARRANTY; without even the implied warranty of MERCHANTABILITY or 14FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 15for more details. 16 17You should have received a copy of the GNU General Public License 18along with GCC; see the file COPYING3. If not see 19<http://www.gnu.org/licenses/>. */ 20 21#include "config.h" 22#include "system.h" 23#include "coretypes.h" 24#include "tm.h" 25#include "c-family/c-common.h" 26#include "ubsan.h" 27#include "c-family/c-ubsan.h" 28#include "stor-layout.h" 29#include "builtins.h" 30#include "gimplify.h" 31#include "stringpool.h" 32#include "attribs.h" 33#include "asan.h" 34#include "langhooks.h" 35 36/* Instrument division by zero and INT_MIN / -1. If not instrumenting, 37 return NULL_TREE. */ 38 39tree 40ubsan_instrument_division (location_t loc, tree op0, tree op1) 41{ 42 tree t, tt; 43 tree type = TREE_TYPE (op0); 44 45 /* At this point both operands should have the same type, 46 because they are already converted to RESULT_TYPE. 47 Use TYPE_MAIN_VARIANT since typedefs can confuse us. */ 48 tree top0 = TYPE_MAIN_VARIANT (type); 49 tree top1 = TYPE_MAIN_VARIANT (TREE_TYPE (op1)); 50 gcc_checking_assert (lang_hooks.types_compatible_p (top0, top1)); 51 52 op0 = unshare_expr (op0); 53 op1 = unshare_expr (op1); 54 55 if (TREE_CODE (type) == INTEGER_TYPE 56 && sanitize_flags_p (SANITIZE_DIVIDE)) 57 t = fold_build2 (EQ_EXPR, boolean_type_node, 58 op1, build_int_cst (type, 0)); 59 else if (TREE_CODE (type) == REAL_TYPE 60 && sanitize_flags_p (SANITIZE_FLOAT_DIVIDE)) 61 t = fold_build2 (EQ_EXPR, boolean_type_node, 62 op1, build_real (type, dconst0)); 63 else 64 return NULL_TREE; 65 66 /* We check INT_MIN / -1 only for signed types. */ 67 if (TREE_CODE (type) == INTEGER_TYPE 68 && sanitize_flags_p (SANITIZE_DIVIDE) 69 && !TYPE_UNSIGNED (type)) 70 { 71 tree x; 72 tt = fold_build2 (EQ_EXPR, boolean_type_node, unshare_expr (op1), 73 build_int_cst (type, -1)); 74 x = fold_build2 (EQ_EXPR, boolean_type_node, op0, 75 TYPE_MIN_VALUE (type)); 76 x = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, x, tt); 77 t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, x); 78 } 79 80 /* If the condition was folded to 0, no need to instrument 81 this expression. */ 82 if (integer_zerop (t)) 83 return NULL_TREE; 84 85 /* In case we have a SAVE_EXPR in a conditional context, we need to 86 make sure it gets evaluated before the condition. */ 87 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t); 88 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t); 89 if (flag_sanitize_undefined_trap_on_error) 90 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0); 91 else 92 { 93 tree data = ubsan_create_data ("__ubsan_overflow_data", 1, &loc, 94 ubsan_type_descriptor (type), NULL_TREE, 95 NULL_TREE); 96 data = build_fold_addr_expr_loc (loc, data); 97 enum built_in_function bcode 98 = (flag_sanitize_recover & SANITIZE_DIVIDE) 99 ? BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW 100 : BUILT_IN_UBSAN_HANDLE_DIVREM_OVERFLOW_ABORT; 101 tt = builtin_decl_explicit (bcode); 102 op0 = unshare_expr (op0); 103 op1 = unshare_expr (op1); 104 tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0), 105 ubsan_encode_value (op1)); 106 } 107 t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node); 108 109 return t; 110} 111 112/* Instrument left and right shifts. */ 113 114tree 115ubsan_instrument_shift (location_t loc, enum tree_code code, 116 tree op0, tree op1) 117{ 118 tree t, tt = NULL_TREE; 119 tree type0 = TREE_TYPE (op0); 120 tree type1 = TREE_TYPE (op1); 121 if (!INTEGRAL_TYPE_P (type0)) 122 return NULL_TREE; 123 124 tree op1_utype = unsigned_type_for (type1); 125 HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0); 126 tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1); 127 128 op0 = unshare_expr (op0); 129 op1 = unshare_expr (op1); 130 131 t = fold_convert_loc (loc, op1_utype, op1); 132 t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1); 133 134 /* If this is not a signed operation, don't perform overflow checks. 135 Also punt on bit-fields. */ 136 if (TYPE_OVERFLOW_WRAPS (type0) 137 || maybe_ne (GET_MODE_BITSIZE (TYPE_MODE (type0)), 138 TYPE_PRECISION (type0)) 139 || !sanitize_flags_p (SANITIZE_SHIFT_BASE) 140 /* In C++2a and later, shifts are well defined except when 141 the second operand is not within bounds. */ 142 || cxx_dialect >= cxx2a) 143 ; 144 145 /* For signed x << y, in C99/C11, the following: 146 (unsigned) x >> (uprecm1 - y) 147 if non-zero, is undefined. */ 148 else if (code == LSHIFT_EXPR && flag_isoc99 && cxx_dialect < cxx11) 149 { 150 tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1, 151 fold_convert (op1_utype, unshare_expr (op1))); 152 tt = fold_convert_loc (loc, unsigned_type_for (type0), op0); 153 tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x); 154 tt = fold_build2 (NE_EXPR, boolean_type_node, tt, 155 build_int_cst (TREE_TYPE (tt), 0)); 156 } 157 158 /* For signed x << y, in C++11 and later, the following: 159 x < 0 || ((unsigned) x >> (uprecm1 - y)) 160 if > 1, is undefined. */ 161 else if (code == LSHIFT_EXPR && cxx_dialect >= cxx11) 162 { 163 tree x = fold_build2 (MINUS_EXPR, op1_utype, uprecm1, 164 fold_convert (op1_utype, unshare_expr (op1))); 165 tt = fold_convert_loc (loc, unsigned_type_for (type0), 166 unshare_expr (op0)); 167 tt = fold_build2 (RSHIFT_EXPR, TREE_TYPE (tt), tt, x); 168 tt = fold_build2 (GT_EXPR, boolean_type_node, tt, 169 build_int_cst (TREE_TYPE (tt), 1)); 170 x = fold_build2 (LT_EXPR, boolean_type_node, unshare_expr (op0), 171 build_int_cst (type0, 0)); 172 tt = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, x, tt); 173 } 174 175 /* If the condition was folded to 0, no need to instrument 176 this expression. */ 177 if (integer_zerop (t) && (tt == NULL_TREE || integer_zerop (tt))) 178 return NULL_TREE; 179 180 /* In case we have a SAVE_EXPR in a conditional context, we need to 181 make sure it gets evaluated before the condition. */ 182 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op0), t); 183 t = fold_build2 (COMPOUND_EXPR, TREE_TYPE (t), unshare_expr (op1), t); 184 185 enum sanitize_code recover_kind = SANITIZE_SHIFT_EXPONENT; 186 tree else_t = void_node; 187 if (tt) 188 { 189 if (!sanitize_flags_p (SANITIZE_SHIFT_EXPONENT)) 190 { 191 t = fold_build1 (TRUTH_NOT_EXPR, boolean_type_node, t); 192 t = fold_build2 (TRUTH_AND_EXPR, boolean_type_node, t, tt); 193 recover_kind = SANITIZE_SHIFT_BASE; 194 } 195 else 196 { 197 if (flag_sanitize_undefined_trap_on_error 198 || ((!(flag_sanitize_recover & SANITIZE_SHIFT_EXPONENT)) 199 == (!(flag_sanitize_recover & SANITIZE_SHIFT_BASE)))) 200 t = fold_build2 (TRUTH_OR_EXPR, boolean_type_node, t, tt); 201 else 202 else_t = tt; 203 } 204 } 205 206 if (flag_sanitize_undefined_trap_on_error) 207 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0); 208 else 209 { 210 tree data = ubsan_create_data ("__ubsan_shift_data", 1, &loc, 211 ubsan_type_descriptor (type0), 212 ubsan_type_descriptor (type1), NULL_TREE, 213 NULL_TREE); 214 data = build_fold_addr_expr_loc (loc, data); 215 216 enum built_in_function bcode 217 = (flag_sanitize_recover & recover_kind) 218 ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS 219 : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT; 220 tt = builtin_decl_explicit (bcode); 221 op0 = unshare_expr (op0); 222 op1 = unshare_expr (op1); 223 tt = build_call_expr_loc (loc, tt, 3, data, ubsan_encode_value (op0), 224 ubsan_encode_value (op1)); 225 if (else_t != void_node) 226 { 227 bcode = (flag_sanitize_recover & SANITIZE_SHIFT_BASE) 228 ? BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS 229 : BUILT_IN_UBSAN_HANDLE_SHIFT_OUT_OF_BOUNDS_ABORT; 230 tree else_tt = builtin_decl_explicit (bcode); 231 op0 = unshare_expr (op0); 232 op1 = unshare_expr (op1); 233 else_tt = build_call_expr_loc (loc, else_tt, 3, data, 234 ubsan_encode_value (op0), 235 ubsan_encode_value (op1)); 236 else_t = fold_build3 (COND_EXPR, void_type_node, else_t, 237 else_tt, void_node); 238 } 239 } 240 t = fold_build3 (COND_EXPR, void_type_node, t, tt, else_t); 241 242 return t; 243} 244 245/* Instrument variable length array bound. */ 246 247tree 248ubsan_instrument_vla (location_t loc, tree size) 249{ 250 tree type = TREE_TYPE (size); 251 tree t, tt; 252 253 t = fold_build2 (LE_EXPR, boolean_type_node, size, build_int_cst (type, 0)); 254 if (flag_sanitize_undefined_trap_on_error) 255 tt = build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0); 256 else 257 { 258 tree data = ubsan_create_data ("__ubsan_vla_data", 1, &loc, 259 ubsan_type_descriptor (type), NULL_TREE, 260 NULL_TREE); 261 data = build_fold_addr_expr_loc (loc, data); 262 enum built_in_function bcode 263 = (flag_sanitize_recover & SANITIZE_VLA) 264 ? BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE 265 : BUILT_IN_UBSAN_HANDLE_VLA_BOUND_NOT_POSITIVE_ABORT; 266 tt = builtin_decl_explicit (bcode); 267 tt = build_call_expr_loc (loc, tt, 2, data, ubsan_encode_value (size)); 268 } 269 t = fold_build3 (COND_EXPR, void_type_node, t, tt, void_node); 270 271 return t; 272} 273 274/* Instrument missing return in C++ functions returning non-void. */ 275 276tree 277ubsan_instrument_return (location_t loc) 278{ 279 if (flag_sanitize_undefined_trap_on_error) 280 return build_call_expr_loc (loc, builtin_decl_explicit (BUILT_IN_TRAP), 0); 281 282 tree data = ubsan_create_data ("__ubsan_missing_return_data", 1, &loc, 283 NULL_TREE, NULL_TREE); 284 tree t = builtin_decl_explicit (BUILT_IN_UBSAN_HANDLE_MISSING_RETURN); 285 return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data)); 286} 287 288/* Instrument array bounds for ARRAY_REFs. We create special builtin, 289 that gets expanded in the sanopt pass, and make an array dimension 290 of it. ARRAY is the array, *INDEX is an index to the array. 291 Return NULL_TREE if no instrumentation is emitted. 292 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */ 293 294tree 295ubsan_instrument_bounds (location_t loc, tree array, tree *index, 296 bool ignore_off_by_one) 297{ 298 tree type = TREE_TYPE (array); 299 tree domain = TYPE_DOMAIN (type); 300 301 if (domain == NULL_TREE || TYPE_MAX_VALUE (domain) == NULL_TREE) 302 return NULL_TREE; 303 304 tree bound = TYPE_MAX_VALUE (domain); 305 if (ignore_off_by_one) 306 bound = fold_build2 (PLUS_EXPR, TREE_TYPE (bound), bound, 307 build_int_cst (TREE_TYPE (bound), 1)); 308 309 /* Detect flexible array members and suchlike, unless 310 -fsanitize=bounds-strict. */ 311 tree base = get_base_address (array); 312 if (!sanitize_flags_p (SANITIZE_BOUNDS_STRICT) 313 && TREE_CODE (array) == COMPONENT_REF 314 && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF)) 315 { 316 tree next = NULL_TREE; 317 tree cref = array; 318 319 /* Walk all structs/unions. */ 320 while (TREE_CODE (cref) == COMPONENT_REF) 321 { 322 if (TREE_CODE (TREE_TYPE (TREE_OPERAND (cref, 0))) == RECORD_TYPE) 323 for (next = DECL_CHAIN (TREE_OPERAND (cref, 1)); 324 next && TREE_CODE (next) != FIELD_DECL; 325 next = DECL_CHAIN (next)) 326 ; 327 if (next) 328 /* Not a last element. Instrument it. */ 329 break; 330 /* Ok, this is the last field of the structure/union. But the 331 aggregate containing the field must be the last field too, 332 recursively. */ 333 cref = TREE_OPERAND (cref, 0); 334 } 335 if (!next) 336 /* Don't instrument this flexible array member-like array in non-strict 337 -fsanitize=bounds mode. */ 338 return NULL_TREE; 339 } 340 341 /* Don't emit instrumentation in the most common cases. */ 342 tree idx = NULL_TREE; 343 if (TREE_CODE (*index) == INTEGER_CST) 344 idx = *index; 345 else if (TREE_CODE (*index) == BIT_AND_EXPR 346 && TREE_CODE (TREE_OPERAND (*index, 1)) == INTEGER_CST) 347 idx = TREE_OPERAND (*index, 1); 348 if (idx 349 && TREE_CODE (bound) == INTEGER_CST 350 && tree_int_cst_sgn (idx) >= 0 351 && tree_int_cst_le (idx, bound)) 352 return NULL_TREE; 353 354 *index = save_expr (*index); 355 /* Create a "(T *) 0" tree node to describe the array type. */ 356 tree zero_with_type = build_int_cst (build_pointer_type (type), 0); 357 return build_call_expr_internal_loc (loc, IFN_UBSAN_BOUNDS, 358 void_type_node, 3, zero_with_type, 359 *index, bound); 360} 361 362/* Return true iff T is an array that was instrumented by SANITIZE_BOUNDS. */ 363 364bool 365ubsan_array_ref_instrumented_p (const_tree t) 366{ 367 if (TREE_CODE (t) != ARRAY_REF) 368 return false; 369 370 tree op1 = TREE_OPERAND (t, 1); 371 return TREE_CODE (op1) == COMPOUND_EXPR 372 && TREE_CODE (TREE_OPERAND (op1, 0)) == CALL_EXPR 373 && CALL_EXPR_FN (TREE_OPERAND (op1, 0)) == NULL_TREE 374 && CALL_EXPR_IFN (TREE_OPERAND (op1, 0)) == IFN_UBSAN_BOUNDS; 375} 376 377/* Instrument an ARRAY_REF, if it hasn't already been instrumented. 378 IGNORE_OFF_BY_ONE is true if the ARRAY_REF is inside a ADDR_EXPR. */ 379 380void 381ubsan_maybe_instrument_array_ref (tree *expr_p, bool ignore_off_by_one) 382{ 383 if (!ubsan_array_ref_instrumented_p (*expr_p) 384 && sanitize_flags_p (SANITIZE_BOUNDS | SANITIZE_BOUNDS_STRICT) 385 && current_function_decl != NULL_TREE) 386 { 387 tree op0 = TREE_OPERAND (*expr_p, 0); 388 tree op1 = TREE_OPERAND (*expr_p, 1); 389 tree e = ubsan_instrument_bounds (EXPR_LOCATION (*expr_p), op0, &op1, 390 ignore_off_by_one); 391 if (e != NULL_TREE) 392 { 393 tree t = copy_node (*expr_p); 394 TREE_OPERAND (t, 1) = build2 (COMPOUND_EXPR, TREE_TYPE (op1), 395 e, op1); 396 *expr_p = t; 397 } 398 } 399} 400 401static tree 402ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype, 403 enum ubsan_null_ckind ckind) 404{ 405 if (!sanitize_flags_p (SANITIZE_ALIGNMENT | SANITIZE_NULL) 406 || current_function_decl == NULL_TREE) 407 return NULL_TREE; 408 409 tree type = TREE_TYPE (ptype); 410 tree orig_op = op; 411 bool instrument = false; 412 unsigned int mina = 0; 413 414 if (sanitize_flags_p (SANITIZE_ALIGNMENT)) 415 { 416 mina = min_align_of_type (type); 417 if (mina <= 1) 418 mina = 0; 419 } 420 while ((TREE_CODE (op) == NOP_EXPR 421 || TREE_CODE (op) == NON_LVALUE_EXPR) 422 && TREE_CODE (TREE_TYPE (op)) == POINTER_TYPE) 423 op = TREE_OPERAND (op, 0); 424 if (TREE_CODE (op) == NOP_EXPR 425 && TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE) 426 { 427 if (mina && mina > min_align_of_type (TREE_TYPE (TREE_TYPE (op)))) 428 instrument = true; 429 } 430 else 431 { 432 if (sanitize_flags_p (SANITIZE_NULL) && TREE_CODE (op) == ADDR_EXPR) 433 { 434 bool strict_overflow_p = false; 435 /* tree_single_nonzero_warnv_p will not return true for non-weak 436 non-automatic decls with -fno-delete-null-pointer-checks, 437 which is disabled during -fsanitize=null. We don't want to 438 instrument those, just weak vars though. */ 439 int save_flag_delete_null_pointer_checks 440 = flag_delete_null_pointer_checks; 441 flag_delete_null_pointer_checks = 1; 442 if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p) 443 || strict_overflow_p) 444 instrument = true; 445 flag_delete_null_pointer_checks 446 = save_flag_delete_null_pointer_checks; 447 } 448 else if (sanitize_flags_p (SANITIZE_NULL)) 449 instrument = true; 450 if (mina && mina > 1) 451 { 452 if (!POINTER_TYPE_P (TREE_TYPE (op)) 453 || mina > get_pointer_alignment (op) / BITS_PER_UNIT) 454 instrument = true; 455 } 456 } 457 if (!instrument) 458 return NULL_TREE; 459 op = save_expr (orig_op); 460 gcc_assert (POINTER_TYPE_P (ptype)); 461 if (TREE_CODE (ptype) == REFERENCE_TYPE) 462 ptype = build_pointer_type (TREE_TYPE (ptype)); 463 tree kind = build_int_cst (ptype, ckind); 464 tree align = build_int_cst (pointer_sized_int_node, mina); 465 tree call 466 = build_call_expr_internal_loc (loc, IFN_UBSAN_NULL, void_type_node, 467 3, op, kind, align); 468 TREE_SIDE_EFFECTS (call) = 1; 469 return fold_build2 (COMPOUND_EXPR, TREE_TYPE (op), call, op); 470} 471 472/* Instrument a NOP_EXPR to REFERENCE_TYPE or INTEGER_CST with REFERENCE_TYPE 473 type if needed. */ 474 475void 476ubsan_maybe_instrument_reference (tree *stmt_p) 477{ 478 tree stmt = *stmt_p; 479 tree op = stmt; 480 if (TREE_CODE (stmt) == NOP_EXPR) 481 op = TREE_OPERAND (stmt, 0); 482 op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op, 483 TREE_TYPE (stmt), 484 UBSAN_REF_BINDING); 485 if (op) 486 { 487 if (TREE_CODE (stmt) == NOP_EXPR) 488 TREE_OPERAND (stmt, 0) = op; 489 else 490 *stmt_p = op; 491 } 492} 493 494/* Instrument a CALL_EXPR to a method if needed. */ 495 496void 497ubsan_maybe_instrument_member_call (tree stmt, bool is_ctor) 498{ 499 if (call_expr_nargs (stmt) == 0) 500 return; 501 tree op = CALL_EXPR_ARG (stmt, 0); 502 if (op == error_mark_node 503 || !POINTER_TYPE_P (TREE_TYPE (op))) 504 return; 505 op = ubsan_maybe_instrument_reference_or_call (EXPR_LOCATION (stmt), op, 506 TREE_TYPE (op), 507 is_ctor ? UBSAN_CTOR_CALL 508 : UBSAN_MEMBER_CALL); 509 if (op) 510 CALL_EXPR_ARG (stmt, 0) = op; 511} 512