Implement -fsanitize=null + new sanopt pass

Hi!

Lately I've been working on the ubsan NULL pointer checking.  Its
purpose is to detect load from/store to NULL pointer.  So, e.g.,

  int *p = NULL;
  struct S *s = NULL;

  if (*p) { ... }
  x = struct s->i;

etc.

I should explain a bit here about the implementation of it.  Firstly,
I wanted to implement it in the FEs, but that proved impossible,
or at least too hard: there is no sure-fire how to distinguish
between loads and stores from/to pointers, while on GIMPLE,
walk_gimple_op will compute is_lhs for us.  So I've resorted to
make use of that.

There are two new passes: ubsan and sanopt.  The ubsan pass is run
very early, and its purpose is merely to insert the UBSAN_NULL internal
function calls before load/stores, that is:

  p_1 = 0B; 
  UBSAN_NULL (p_1, 0); 
  _3 = *p_1;

The first argument of the UBSAN_NULL is the pointer itself; the second
argument is just a value that says whether it is actually a store, a
load, a member access, etc.

Now, the second new pass, sanopt, is run very late.  This pass is 
implemented in asan.c and is not designed only for ubsan, we will use
it for asan/tsan/whatever_might_crop_up_in_the_future as well.  The idea
behind the sanopt pass is simple: walk the statements and expand the
UBSAN_NULL calls.  What we expand this call to is roughly the
following:

  if (p_1 == 0B) 
    goto <bb 4>; 
  else
    goto <bb 3>; 

  <bb 4>: 
  __builtin___ubsan_handle_type_mismatch (&*.Lubsan_data0, 0); 

  <bb 3>: 
  _2 = *p_1;

(With optimizations on this will look slightly different, as CCP does its job,
etc.)
The fact that we're always splitting the BBs, thus this might be
rather expensive on large TUs, is plain to see.  But I think the
basic idea is sound.

The fact that in sanopt pass we're creating a new internal structure
proved to be particularly arduous, since on -O0, cgraph stuff refused
to actually emit this structure.  The problem was that
varpool_assemble_decl wasn't properly called when flag_toplevel_reorder
wasn't in effect.  Hence the cgraphunit.c hunk.  Honza, does it look sane to
you?

There are a few issues that are vying for our/my attention:

1) I'm getting an ICE with -flto in lto_output_edge, it doesn't like
   the fact that internal call is a leaf function.  So, I disabled
   ubsan tests with lto, since I don't readily see how to solve this.
2) bootstrap-ubsan almost passes, but the bootstrap fails when building
   all-fixincludes.  The problem here is that libiberty.a is built
   with -fsanitize=undefined, but fixincludes, when linking,
   don't link libubsan in.  My attemps to tweak
   FIXINC_CFLAGS/LDFLAGS/BOOT_LDFLAGS and whatnot weren't successfull.
3) Member call instrumentation (*) doesn't work with SRA turned on.
4) int &r = 0; sanitization is not implemented yet.  But this will have
   to be done in the C++ FE.

(*) By this I mean:

struct S { int f (void) { return 0; } };
struct S *s = NULL;
s->f();

Currently this will not fail, only the 'this' pointer will be bogus.

So, how does this look like?

Regtested/bootstrapped on x86_64-linux.

2013-11-12  Marek Polacek  <polacek@redhat.com>

config/
	* bootstrap-ubsan.mk (POSTSTAGE1_LDFLAGS): Add -ldl.
gcc/c-family/
	* c-ubsan.c (ubsan_instrument_division): Adjust ubsan_create_data
	call.
	(ubsan_instrument_shift): Likewise.
	(ubsan_instrument_vla): Likewise.
gcc/
	* opts.c (common_handle_option): Add -fsanitize=null option.
	Turn off -fdelete-null-pointer-checks option when doing the
	NULL pointer checking.
	* sanitizer.def (BUILT_IN_UBSAN_HANDLE_TYPE_MISMATCH): Add.
	* tree-pass.h (make_pass_ubsan): Declare.
	(make_pass_sanopt): Declare.
	* timevar.def (TV_TREE_UBSAN): New timevar.
	* passes.def: Add pass_sanopt and pass_ubsan.
	* ubsan.h (ubsan_null_ckind): New enum.
	(ubsan_mismatch_data): New struct.
	(ubsan_expand_null_ifn): Declare.
	(ubsan_create_data): Adjust declaration.
	(ubsan_type_descriptor): Likewise.
	* asan.c: Include "ubsan.h".
	(pass_data_sanopt): New pass.
	(execute_sanopt): New function.
	(gate_sanopt): Likewise.
	(make_pass_sanopt): Likewise.
	(class pass_sanopt): New class.
	* ubsan.c: Include "tree-pass.h", "gimple-ssa.h" and "cfgloop.h". 
	(PROB_VERY_UNLIKELY): Define.
	(tree_type_map_hash): New function.
	(ubsan_type_descriptor): Add new parameter.
	Improve type name generation.
	(ubsan_create_data): Add new parameter.  Add pointer data into
	ubsan structure.
	(ubsan_expand_null_ifn): New function.
	(instrument_member_call): Likewise.
	(instrument_mem_ref): Likewise.
	(instrument_null): Likewise.
	(ubsan_pass): Likewise.
	(gate_ubsan): Likewise.
	(make_pass_ubsan): Likewise.
	(ubsan_instrument_unreachable): Adjust ubsan_create_data call.
	(class pass_ubsan): New class.
	(pass_data_ubsan): New pass.
	* flag-types.h (enum sanitize_code): Add SANITIZE_NULL.
	* internal-fn.c (expand_UBSAN_NULL): New function.
	* cgraphunit.c (varpool_finalize_decl): Call varpool_assemble_decl
	even when !flag_toplevel_reorder.
	* internal-fn.def (UBSAN_NULL): New.
gcc/testsuite/
	* c-c++-common/ubsan/null-1.c: New test.
	* c-c++-common/ubsan/null-2.c: New test.
	* c-c++-common/ubsan/null-3.c: New test.
	* c-c++-common/ubsan/null-4.c: New test.
	* c-c++-common/ubsan/null-5.c: New test.
	* c-c++-common/ubsan/null-6.c: New test.
	* c-c++-common/ubsan/null-7.c: New test.
	* c-c++-common/ubsan/null-8.c: New test.
	* c-c++-common/ubsan/null-9.c: New test.
	* c-c++-common/ubsan/null-10.c: New test.
	* c-c++-common/ubsan/null-11.c: New test.
	* gcc.dg/ubsan/c99-shift-2.c: Adjust dg-output.
	* c-c++-common/ubsan/shift-1.c: Likewise.
	* c-c++-common/ubsan/div-by-zero-3.c: Likewise.

	Marek

Implement -fsanitize=null + new sanopt pass

Commit Message

Comments

Patch