[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen added a comment. ping but will be for 8.0 :) https://reviews.llvm.org/D49722 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen updated this revision to Diff 160272. https://reviews.llvm.org/D49722 Files: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp test/Analysis/cstring-syntax.c Index: test/Analysis/cstring-syntax.c === --- test/Analysis/cstring-syntax.c +++ test/Analysis/cstring-syntax.c @@ -7,6 +7,7 @@ char *strncat(char *, const char *, size_t); size_t strlen (const char *s); size_t strlcpy(char *, const char *, size_t); +size_t strlcat(char *, const char *, size_t); void testStrncat(const char *src) { char dest[10]; @@ -33,3 +34,19 @@ strlcpy(dest + 5, src, 5); strlcpy(dest + 5, src, 10); // expected-warning {{The third argument is larger than the size of the input buffer.}} } + +void testStrlcat(const char *src) { + char dest[10]; + size_t badlen = 10; + size_t ulen; + strlcpy(dest, "a", sizeof("a") - 1); + strlcat(dest, "", (sizeof("") - 1) - sizeof(dest) - 1); + strlcpy(dest, "012345678", sizeof(dest)); + strlcat(dest, "910", sizeof(dest)); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value- strlen(dest) - 1 or lower}} + strlcpy(dest, "0123456789", sizeof(dest)); + strlcat(dest, "0123456789", badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen(dest) - 1 or lower}} + strlcat(dest, "0123456789", badlen - strlen(dest) - 1); + strlcat(dest, src, ulen); + strlcpy(dest, src, 5); + strlcat(dest + 5, src, badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen() - 1 or lower}} +} Index: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp @@ -90,7 +90,16 @@ /// strlcpy(dst, "abcd", 4); /// strlcpy(dst + 3, "abcd", 2); /// strlcpy(dst, "abcd", cpy); - bool containsBadStrlcpyPattern(const CallExpr *CE); + /// Identify erroneous patterns in the last argument to strlcat - the number + /// of bytes to copy. + /// The bad pattern checked is when the last argument is basically + /// pointing to the destination buffer size or argument larger or + /// equal to. + /// char dst[2]; + /// strlcat(dst, src2, sizeof(dst)); + /// strlcat(dst, src2, 2); + /// strlcat(dst, src2, 10); + bool containsBadStrlcpyStrlcatPattern(const CallExpr *CE); public: WalkAST(const CheckerBase *Checker, BugReporter &BR, AnalysisDeclContext *AC) @@ -142,15 +151,21 @@ return false; } -bool WalkAST::containsBadStrlcpyPattern(const CallExpr *CE) { +bool WalkAST::containsBadStrlcpyStrlcatPattern(const CallExpr *CE) { if (CE->getNumArgs() != 3) return false; + const FunctionDecl *FD = CE->getDirectCallee(); + bool Append = CheckerContext::isCLibraryFunction(FD, "strlcat"); const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); const auto *DstArgDecl = dyn_cast(DstArg->IgnoreParenImpCasts()); const auto *LenArgDecl = dyn_cast(LenArg->IgnoreParenLValueCasts()); uint64_t DstOff = 0; + // - sizeof(dst) + // strlcat appends at most size - strlen(dst) - 1 + if (Append && isSizeof(LenArg, DstArg)) +return true; // - size_t dstlen = sizeof(dst) if (LenArgDecl) { const auto *LenArgVal = dyn_cast(LenArgDecl->getDecl()); @@ -181,7 +196,10 @@ if (const auto *Buffer = dyn_cast(DstArgDecl->getType())) { ASTContext &C = BR.getContext(); uint64_t BufferLen = C.getTypeSize(Buffer) / 8; -if ((BufferLen - DstOff) < ILRawVal) +auto RemainingBufferLen = BufferLen - DstOff; +if (Append) + RemainingBufferLen -= 1; +if (RemainingBufferLen < ILRawVal) return true; } } @@ -220,7 +238,7 @@ LenArg->getSourceRange()); } } else if (CheckerContext::isCLibraryFunction(FD, "strlcpy")) { -if (containsBadStrlcpyPattern(CE)) { +if (containsBadStrlcpyStrlcatPattern(CE)) { const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); PathDiagnosticLocation Loc = @@ -234,6 +252,34 @@ if (!DstName.empty()) os << "Replace with the value 'sizeof(" << DstName << ")` or lower"; + BR.EmitBasicReport(FD, Checker, "Anti-pattern in the argument", + "C String API", os.str(), Loc, + LenArg->getSourceRange()); +} + } else if (CheckerContext::isCLibraryFunction(FD, "strlcat")) { +if (containsBadStrlcpyStrlcatPattern(CE)) { + const Expr *DstArg = CE->getArg(0); + const Expr *LenArg = CE->getArg(2); + PathDiagnosticLocation Loc = +PathDiagnosticLocation::createBegin(LenArg, BR.getSourceManager(), A
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
This revision was automatically updated to reflect the committed changes. Closed by commit rL339641: [CStringSyntaxChecker] Check strlcat sizeof check (authored by devnexen, committed by ). Herald added a subscriber: llvm-commits. Changed prior to commit: https://reviews.llvm.org/D49722?vs=160272&id=160513#toc Repository: rL LLVM https://reviews.llvm.org/D49722 Files: cfe/trunk/lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp cfe/trunk/test/Analysis/cstring-syntax.c Index: cfe/trunk/test/Analysis/cstring-syntax.c === --- cfe/trunk/test/Analysis/cstring-syntax.c +++ cfe/trunk/test/Analysis/cstring-syntax.c @@ -7,6 +7,7 @@ char *strncat(char *, const char *, size_t); size_t strlen (const char *s); size_t strlcpy(char *, const char *, size_t); +size_t strlcat(char *, const char *, size_t); void testStrncat(const char *src) { char dest[10]; @@ -33,3 +34,19 @@ strlcpy(dest + 5, src, 5); strlcpy(dest + 5, src, 10); // expected-warning {{The third argument is larger than the size of the input buffer.}} } + +void testStrlcat(const char *src) { + char dest[10]; + size_t badlen = 10; + size_t ulen; + strlcpy(dest, "a", sizeof("a") - 1); + strlcat(dest, "", (sizeof("") - 1) - sizeof(dest) - 1); + strlcpy(dest, "012345678", sizeof(dest)); + strlcat(dest, "910", sizeof(dest)); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value- strlen(dest) - 1 or lower}} + strlcpy(dest, "0123456789", sizeof(dest)); + strlcat(dest, "0123456789", badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen(dest) - 1 or lower}} + strlcat(dest, "0123456789", badlen - strlen(dest) - 1); + strlcat(dest, src, ulen); + strlcpy(dest, src, 5); + strlcat(dest + 5, src, badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen() - 1 or lower}} +} Index: cfe/trunk/lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp === --- cfe/trunk/lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp +++ cfe/trunk/lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp @@ -90,7 +90,16 @@ /// strlcpy(dst, "abcd", 4); /// strlcpy(dst + 3, "abcd", 2); /// strlcpy(dst, "abcd", cpy); - bool containsBadStrlcpyPattern(const CallExpr *CE); + /// Identify erroneous patterns in the last argument to strlcat - the number + /// of bytes to copy. + /// The bad pattern checked is when the last argument is basically + /// pointing to the destination buffer size or argument larger or + /// equal to. + /// char dst[2]; + /// strlcat(dst, src2, sizeof(dst)); + /// strlcat(dst, src2, 2); + /// strlcat(dst, src2, 10); + bool containsBadStrlcpyStrlcatPattern(const CallExpr *CE); public: WalkAST(const CheckerBase *Checker, BugReporter &BR, AnalysisDeclContext *AC) @@ -142,15 +151,21 @@ return false; } -bool WalkAST::containsBadStrlcpyPattern(const CallExpr *CE) { +bool WalkAST::containsBadStrlcpyStrlcatPattern(const CallExpr *CE) { if (CE->getNumArgs() != 3) return false; + const FunctionDecl *FD = CE->getDirectCallee(); + bool Append = CheckerContext::isCLibraryFunction(FD, "strlcat"); const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); const auto *DstArgDecl = dyn_cast(DstArg->IgnoreParenImpCasts()); const auto *LenArgDecl = dyn_cast(LenArg->IgnoreParenLValueCasts()); uint64_t DstOff = 0; + // - sizeof(dst) + // strlcat appends at most size - strlen(dst) - 1 + if (Append && isSizeof(LenArg, DstArg)) +return true; // - size_t dstlen = sizeof(dst) if (LenArgDecl) { const auto *LenArgVal = dyn_cast(LenArgDecl->getDecl()); @@ -181,7 +196,10 @@ if (const auto *Buffer = dyn_cast(DstArgDecl->getType())) { ASTContext &C = BR.getContext(); uint64_t BufferLen = C.getTypeSize(Buffer) / 8; -if ((BufferLen - DstOff) < ILRawVal) +auto RemainingBufferLen = BufferLen - DstOff; +if (Append) + RemainingBufferLen -= 1; +if (RemainingBufferLen < ILRawVal) return true; } } @@ -220,7 +238,7 @@ LenArg->getSourceRange()); } } else if (CheckerContext::isCLibraryFunction(FD, "strlcpy")) { -if (containsBadStrlcpyPattern(CE)) { +if (containsBadStrlcpyStrlcatPattern(CE)) { const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); PathDiagnosticLocation Loc = @@ -238,6 +256,34 @@ "C String API", os.str(), Loc, LenArg->getSourceRange()); } + } else if (CheckerContext::isCLibraryFunction(FD, "strlcat")) { +if (containsBadStrlcpyStrlcatPattern(CE)) { +
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen updated this revision to Diff 162139. devnexen added a comment. - Returns immediately for both case when sizeof destination. - Adding few more cases. https://reviews.llvm.org/D49722 Files: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp test/Analysis/cstring-syntax.c Index: test/Analysis/cstring-syntax.c === --- test/Analysis/cstring-syntax.c +++ test/Analysis/cstring-syntax.c @@ -7,6 +7,7 @@ char *strncat(char *, const char *, size_t); size_t strlen (const char *s); size_t strlcpy(char *, const char *, size_t); +size_t strlcat(char *, const char *, size_t); void testStrncat(const char *src) { char dest[10]; @@ -33,3 +34,21 @@ strlcpy(dest + 5, src, 5); strlcpy(dest + 5, src, 10); // expected-warning {{The third argument is larger than the size of the input buffer.}} } + +void testStrlcat(const char *src) { + char dest[10]; + size_t badlen = 20; + size_t ulen; + strlcpy(dest, "a", sizeof("a") - 1); + strlcat(dest, "", (sizeof("") - 1) - sizeof(dest) - 1); + strlcpy(dest, "012345678", sizeof(dest)); + strlcat(dest, "910", sizeof(dest)); + strlcpy(dest, "0123456789", sizeof(dest)); + strlcpy(dest, "0123456789", sizeof(dest)); + strlcat(dest, "0123456789", badlen / 2); + strlcat(dest, "0123456789", badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen(dest) - 1 or lower}} + strlcat(dest, "0123456789", badlen - strlen(dest) - 1); + strlcat(dest, src, ulen); + strlcpy(dest, src, 5); + strlcat(dest + 5, src, badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen() - 1 or lower}} +} Index: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp @@ -90,7 +90,16 @@ /// strlcpy(dst, "abcd", 4); /// strlcpy(dst + 3, "abcd", 2); /// strlcpy(dst, "abcd", cpy); - bool containsBadStrlcpyPattern(const CallExpr *CE); + /// Identify erroneous patterns in the last argument to strlcat - the number + /// of bytes to copy. + /// The bad pattern checked is when the last argument is basically + /// pointing to the destination buffer size or argument larger or + /// equal to. + /// char dst[2]; + /// strlcat(dst, src2, sizeof(dst)); + /// strlcat(dst, src2, 2); + /// strlcat(dst, src2, 10); + bool containsBadStrlcpyStrlcatPattern(const CallExpr *CE); public: WalkAST(const CheckerBase *Checker, BugReporter &BR, AnalysisDeclContext *AC) @@ -142,15 +151,19 @@ return false; } -bool WalkAST::containsBadStrlcpyPattern(const CallExpr *CE) { +bool WalkAST::containsBadStrlcpyStrlcatPattern(const CallExpr *CE) { if (CE->getNumArgs() != 3) return false; + const FunctionDecl *FD = CE->getDirectCallee(); + bool Append = CheckerContext::isCLibraryFunction(FD, "strlcat"); const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); const auto *DstArgDecl = dyn_cast(DstArg->IgnoreParenImpCasts()); const auto *LenArgDecl = dyn_cast(LenArg->IgnoreParenLValueCasts()); uint64_t DstOff = 0; + if (isSizeof(LenArg, DstArg)) +return false; // - size_t dstlen = sizeof(dst) if (LenArgDecl) { const auto *LenArgVal = dyn_cast(LenArgDecl->getDecl()); @@ -181,7 +194,10 @@ if (const auto *Buffer = dyn_cast(DstArgDecl->getType())) { ASTContext &C = BR.getContext(); uint64_t BufferLen = C.getTypeSize(Buffer) / 8; -if ((BufferLen - DstOff) < ILRawVal) +auto RemainingBufferLen = BufferLen - DstOff; +if (Append) + RemainingBufferLen -= 1; +if (RemainingBufferLen < ILRawVal) return true; } } @@ -220,7 +236,7 @@ LenArg->getSourceRange()); } } else if (CheckerContext::isCLibraryFunction(FD, "strlcpy")) { -if (containsBadStrlcpyPattern(CE)) { +if (containsBadStrlcpyStrlcatPattern(CE)) { const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); PathDiagnosticLocation Loc = @@ -234,6 +250,34 @@ if (!DstName.empty()) os << "Replace with the value 'sizeof(" << DstName << ")` or lower"; + BR.EmitBasicReport(FD, Checker, "Anti-pattern in the argument", + "C String API", os.str(), Loc, + LenArg->getSourceRange()); +} + } else if (CheckerContext::isCLibraryFunction(FD, "strlcat")) { +if (containsBadStrlcpyStrlcatPattern(CE)) { + const Expr *DstArg = CE->getArg(0); + const Expr *LenArg = CE->getArg(2); + PathDiagnosticLocation Loc = +PathDiagnosticLocation::createBegin(LenArg, BR.getSourceManager(), AC); + + StringRef DstNam
[PATCH] D45177: CStringChecker, check strlcpy/strlcat
devnexen added a comment. ping https://reviews.llvm.org/D45177 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D45177: CStringChecker, check strlcpy/strlcat
devnexen added a comment. Thanks ! I would be grateful if anybody could land it for me. https://reviews.llvm.org/D45177 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D45177: CStringChecker, check strlcpy/strlcat
devnexen added inline comments. Comment at: lib/StaticAnalyzer/Checkers/CStringChecker.cpp:1560-1566 // If the size is known to be zero, we're done. if (StateZeroSize && !StateNonZeroSize) { StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal); C.addTransition(StateZeroSize); return; } NoQ wrote: > One more cornercase where the return value needs to be corrected. It'd be > great to de-duplicate this code to avoid similar problems in the future. > > Test case: > ``` > int foo(char *dst, const char *src) { > return strlcpy(dst, src, 0); // no-crash > } > ``` Thanks for the hint ! will do a separate "PR". Repository: rC Clang https://reviews.llvm.org/D45177 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D47007: [Sanitizer] CStringChecker fix for strlcpy when no bytes are copied to the dest buffer
devnexen created this revision. devnexen added reviewers: NoQ, george.karpenkov. devnexen created this object with visibility "All Users". Herald added a subscriber: cfe-commits. Again strlc* does not return a pointer so the zero size case does not fit. Repository: rC Clang https://reviews.llvm.org/D47007 Files: lib/StaticAnalyzer/Checkers/CStringChecker.cpp test/Analysis/bsd-string.c Index: test/Analysis/bsd-string.c === --- test/Analysis/bsd-string.c +++ test/Analysis/bsd-string.c @@ -38,3 +38,8 @@ size_t len = strlcat(buf, "defg", 4); clang_analyzer_eval(len == 7); // expected-warning{{TRUE}} } + +int f7() { + char buf[8]; + return strlcpy(buf, "1234567", 0); // no-crash +} Index: lib/StaticAnalyzer/Checkers/CStringChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringChecker.cpp @@ -1652,7 +1652,11 @@ // If the size is known to be zero, we're done. if (StateZeroSize && !StateNonZeroSize) { - StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal); + if (returnPtr) { +StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal); + } else { +StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, *lenValNL); + } C.addTransition(StateZeroSize); return; } Index: test/Analysis/bsd-string.c === --- test/Analysis/bsd-string.c +++ test/Analysis/bsd-string.c @@ -38,3 +38,8 @@ size_t len = strlcat(buf, "defg", 4); clang_analyzer_eval(len == 7); // expected-warning{{TRUE}} } + +int f7() { + char buf[8]; + return strlcpy(buf, "1234567", 0); // no-crash +} Index: lib/StaticAnalyzer/Checkers/CStringChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringChecker.cpp @@ -1652,7 +1652,11 @@ // If the size is known to be zero, we're done. if (StateZeroSize && !StateNonZeroSize) { - StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal); + if (returnPtr) { +StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal); + } else { +StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, *lenValNL); + } C.addTransition(StateZeroSize); return; } ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D45177: CStringChecker, check strlcpy/strlcat
devnexen added a comment. In https://reviews.llvm.org/D45177#1102887, @alexfh wrote: > This is reproducible in r332425. I posted this PR https://reviews.llvm.org/D47007 hopes it helps. Repository: rC Clang https://reviews.llvm.org/D45177 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D47007: [Sanitizer] CStringChecker fix for strlcpy when no bytes are copied to the dest buffer
devnexen added a comment. In https://reviews.llvm.org/D47007#1103551, @george.karpenkov wrote: > Is it a fix for https://bugs.llvm.org/show_bug.cgi?id=37503 ? Nope. more for last NoQ comment. Will try for this one once I finish setting it up. Repository: rC Clang https://reviews.llvm.org/D47007 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D45177: CStringChecker, check strlcpy/strlcat
devnexen added a comment. In https://reviews.llvm.org/D45177#1103162, @alexfh wrote: > See https://bugs.llvm.org/show_bug.cgi?id=37503 for a test case. I was unable to reproduce both FreeBSD and Linux. Plus my changes come after checkNonNull. Repository: rC Clang https://reviews.llvm.org/D45177 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D45177: CStringChecker, check strlcpy/strlcat
devnexen added a comment. I admit I do not due to much longer compilation time, I ll recompile all with and will see tomorrow if I can reproduce. Repository: rC Clang https://reviews.llvm.org/D45177 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D45177: CStringChecker, check strlcpy/strlcat
devnexen added a comment. In https://reviews.llvm.org/D45177#1103781, @alexfh wrote: > In https://reviews.llvm.org/D45177#1103774, @devnexen wrote: > > > In https://reviews.llvm.org/D45177#1103162, @alexfh wrote: > > > > > See https://bugs.llvm.org/show_bug.cgi?id=37503 for a test case. > > > > > > I was unable to reproduce both FreeBSD and Linux. Plus my changes come > > after checkNonNull. > > > I'm not 100% sure this was caused by your patch, but the stack trace looks > suspiciously similar to what was changed here. As for not being able to > reproduce: do you build Clang with assertions enabled? I was able to reproduce but also with the revision before when it has been reverted. Repository: rC Clang https://reviews.llvm.org/D45177 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D47007: [analyzer] CStringChecker fix for strlcpy when no bytes are copied to the dest buffer
This revision was automatically updated to reflect the committed changes. Closed by commit rC333060: [analyzer] CStringChecker fix for strlcpy when no bytes are copied to the dest… (authored by devnexen, committed by ). Repository: rC Clang https://reviews.llvm.org/D47007 Files: lib/StaticAnalyzer/Checkers/CStringChecker.cpp test/Analysis/bsd-string.c Index: lib/StaticAnalyzer/Checkers/CStringChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringChecker.cpp @@ -1652,7 +1652,11 @@ // If the size is known to be zero, we're done. if (StateZeroSize && !StateNonZeroSize) { - StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal); + if (returnPtr) { +StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal); + } else { +StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, *lenValNL); + } C.addTransition(StateZeroSize); return; } Index: test/Analysis/bsd-string.c === --- test/Analysis/bsd-string.c +++ test/Analysis/bsd-string.c @@ -38,3 +38,8 @@ size_t len = strlcat(buf, "defg", 4); clang_analyzer_eval(len == 7); // expected-warning{{TRUE}} } + +int f7() { + char buf[8]; + return strlcpy(buf, "1234567", 0); // no-crash +} Index: lib/StaticAnalyzer/Checkers/CStringChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringChecker.cpp @@ -1652,7 +1652,11 @@ // If the size is known to be zero, we're done. if (StateZeroSize && !StateNonZeroSize) { - StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal); + if (returnPtr) { +StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, DstVal); + } else { +StateZeroSize = StateZeroSize->BindExpr(CE, LCtx, *lenValNL); + } C.addTransition(StateZeroSize); return; } Index: test/Analysis/bsd-string.c === --- test/Analysis/bsd-string.c +++ test/Analysis/bsd-string.c @@ -38,3 +38,8 @@ size_t len = strlcat(buf, "defg", 4); clang_analyzer_eval(len == 7); // expected-warning{{TRUE}} } + +int f7() { + char buf[8]; + return strlcpy(buf, "1234567", 0); // no-crash +} ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D51269: [Xray] Enable in the driver side
devnexen created this revision. devnexen added a reviewer: dberris. devnexen created this object with visibility "All Users". Herald added a subscriber: cfe-commits. Repository: rC Clang https://reviews.llvm.org/D51269 Files: lib/Driver/ToolChains/Darwin.cpp lib/Driver/ToolChains/Darwin.h lib/Driver/XRayArgs.cpp Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -52,7 +52,8 @@ } } else if (Triple.getOS() == llvm::Triple::FreeBSD || Triple.getOS() == llvm::Triple::OpenBSD || - Triple.getOS() == llvm::Triple::NetBSD) { + Triple.getOS() == llvm::Triple::NetBSD || + Triple.getOS() == llvm::Triple::Darwin) { if (Triple.getArch() != llvm::Triple::x86_64) { D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); Index: lib/Driver/ToolChains/Darwin.h === --- lib/Driver/ToolChains/Darwin.h +++ lib/Driver/ToolChains/Darwin.h @@ -11,6 +11,7 @@ #define LLVM_CLANG_LIB_DRIVER_TOOLCHAINS_DARWIN_H #include "Cuda.h" +#include "clang/Driver/XRayArgs.h" #include "clang/Driver/Tool.h" #include "clang/Driver/ToolChain.h" Index: lib/Driver/ToolChains/Darwin.cpp === --- lib/Driver/ToolChains/Darwin.cpp +++ lib/Driver/ToolChains/Darwin.cpp @@ -1105,6 +1105,13 @@ if (Sanitize.needsEsanRt()) AddLinkSanitizerLibArgs(Args, CmdArgs, "esan"); + const XRayArgs &XRay = getXRayArgs(); + if (XRay.needsXRayRt()) { +AddLinkRuntimeLib(Args, CmdArgs, "xray"); +AddLinkRuntimeLib(Args, CmdArgs, "xray-basic"); +AddLinkRuntimeLib(Args, CmdArgs, "xray-fdr"); + } + // Otherwise link libSystem, then the dynamic runtime library, and finally any // target specific static runtime library. CmdArgs.push_back("-lSystem"); Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -52,7 +52,8 @@ } } else if (Triple.getOS() == llvm::Triple::FreeBSD || Triple.getOS() == llvm::Triple::OpenBSD || - Triple.getOS() == llvm::Triple::NetBSD) { + Triple.getOS() == llvm::Triple::NetBSD || + Triple.getOS() == llvm::Triple::Darwin) { if (Triple.getArch() != llvm::Triple::x86_64) { D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); Index: lib/Driver/ToolChains/Darwin.h === --- lib/Driver/ToolChains/Darwin.h +++ lib/Driver/ToolChains/Darwin.h @@ -11,6 +11,7 @@ #define LLVM_CLANG_LIB_DRIVER_TOOLCHAINS_DARWIN_H #include "Cuda.h" +#include "clang/Driver/XRayArgs.h" #include "clang/Driver/Tool.h" #include "clang/Driver/ToolChain.h" Index: lib/Driver/ToolChains/Darwin.cpp === --- lib/Driver/ToolChains/Darwin.cpp +++ lib/Driver/ToolChains/Darwin.cpp @@ -1105,6 +1105,13 @@ if (Sanitize.needsEsanRt()) AddLinkSanitizerLibArgs(Args, CmdArgs, "esan"); + const XRayArgs &XRay = getXRayArgs(); + if (XRay.needsXRayRt()) { +AddLinkRuntimeLib(Args, CmdArgs, "xray"); +AddLinkRuntimeLib(Args, CmdArgs, "xray-basic"); +AddLinkRuntimeLib(Args, CmdArgs, "xray-fdr"); + } + // Otherwise link libSystem, then the dynamic runtime library, and finally any // target specific static runtime library. CmdArgs.push_back("-lSystem"); ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D51269: [Xray] Darwin - Enable in the driver side
This revision was automatically updated to reflect the committed changes. Closed by commit rL340712: [Xray] Darwin - Enable in the driver side (authored by devnexen, committed by ). Herald added a subscriber: llvm-commits. Changed prior to commit: https://reviews.llvm.org/D51269?vs=162583&id=162610#toc Repository: rL LLVM https://reviews.llvm.org/D51269 Files: cfe/trunk/lib/Driver/ToolChains/Darwin.cpp cfe/trunk/lib/Driver/ToolChains/Darwin.h cfe/trunk/lib/Driver/XRayArgs.cpp cfe/trunk/test/Driver/XRay/lit.local.cfg cfe/trunk/test/Driver/XRay/xray-instrument-os.c Index: cfe/trunk/lib/Driver/XRayArgs.cpp === --- cfe/trunk/lib/Driver/XRayArgs.cpp +++ cfe/trunk/lib/Driver/XRayArgs.cpp @@ -52,7 +52,8 @@ } } else if (Triple.getOS() == llvm::Triple::FreeBSD || Triple.getOS() == llvm::Triple::OpenBSD || - Triple.getOS() == llvm::Triple::NetBSD) { + Triple.getOS() == llvm::Triple::NetBSD || + Triple.getOS() == llvm::Triple::Darwin) { if (Triple.getArch() != llvm::Triple::x86_64) { D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); Index: cfe/trunk/lib/Driver/ToolChains/Darwin.cpp === --- cfe/trunk/lib/Driver/ToolChains/Darwin.cpp +++ cfe/trunk/lib/Driver/ToolChains/Darwin.cpp @@ -1105,6 +1105,13 @@ if (Sanitize.needsEsanRt()) AddLinkSanitizerLibArgs(Args, CmdArgs, "esan"); + const XRayArgs &XRay = getXRayArgs(); + if (XRay.needsXRayRt()) { +AddLinkRuntimeLib(Args, CmdArgs, "xray"); +AddLinkRuntimeLib(Args, CmdArgs, "xray-basic"); +AddLinkRuntimeLib(Args, CmdArgs, "xray-fdr"); + } + // Otherwise link libSystem, then the dynamic runtime library, and finally any // target specific static runtime library. CmdArgs.push_back("-lSystem"); Index: cfe/trunk/lib/Driver/ToolChains/Darwin.h === --- cfe/trunk/lib/Driver/ToolChains/Darwin.h +++ cfe/trunk/lib/Driver/ToolChains/Darwin.h @@ -11,6 +11,7 @@ #define LLVM_CLANG_LIB_DRIVER_TOOLCHAINS_DARWIN_H #include "Cuda.h" +#include "clang/Driver/XRayArgs.h" #include "clang/Driver/Tool.h" #include "clang/Driver/ToolChain.h" Index: cfe/trunk/test/Driver/XRay/xray-instrument-os.c === --- cfe/trunk/test/Driver/XRay/xray-instrument-os.c +++ cfe/trunk/test/Driver/XRay/xray-instrument-os.c @@ -1,4 +1,4 @@ // RUN: not %clang -o /dev/null -v -fxray-instrument -c %s -// XFAIL: -linux-, -freebsd +// XFAIL: -linux-, -freebsd, -darwin // REQUIRES-ANY: amd64, x86_64, x86_64h, arm, aarch64, arm64 typedef int a; Index: cfe/trunk/test/Driver/XRay/lit.local.cfg === --- cfe/trunk/test/Driver/XRay/lit.local.cfg +++ cfe/trunk/test/Driver/XRay/lit.local.cfg @@ -10,7 +10,7 @@ # Only on platforms we support. supported_oses = [ -'Linux', 'FreeBSD' +'Linux', 'FreeBSD', 'Darwin' ] triple_set = set(target_triple_components) Index: cfe/trunk/lib/Driver/XRayArgs.cpp === --- cfe/trunk/lib/Driver/XRayArgs.cpp +++ cfe/trunk/lib/Driver/XRayArgs.cpp @@ -52,7 +52,8 @@ } } else if (Triple.getOS() == llvm::Triple::FreeBSD || Triple.getOS() == llvm::Triple::OpenBSD || - Triple.getOS() == llvm::Triple::NetBSD) { + Triple.getOS() == llvm::Triple::NetBSD || + Triple.getOS() == llvm::Triple::Darwin) { if (Triple.getArch() != llvm::Triple::x86_64) { D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); Index: cfe/trunk/lib/Driver/ToolChains/Darwin.cpp === --- cfe/trunk/lib/Driver/ToolChains/Darwin.cpp +++ cfe/trunk/lib/Driver/ToolChains/Darwin.cpp @@ -1105,6 +1105,13 @@ if (Sanitize.needsEsanRt()) AddLinkSanitizerLibArgs(Args, CmdArgs, "esan"); + const XRayArgs &XRay = getXRayArgs(); + if (XRay.needsXRayRt()) { +AddLinkRuntimeLib(Args, CmdArgs, "xray"); +AddLinkRuntimeLib(Args, CmdArgs, "xray-basic"); +AddLinkRuntimeLib(Args, CmdArgs, "xray-fdr"); + } + // Otherwise link libSystem, then the dynamic runtime library, and finally any // target specific static runtime library. CmdArgs.push_back("-lSystem"); Index: cfe/trunk/lib/Driver/ToolChains/Darwin.h === --- cfe/trunk/lib/Driver/ToolChains/Darwin.h +++ cfe/trunk/lib/Driver/ToolChains/Darwin.h @@ -11,6 +11,7 @@ #define LLVM_CLANG_LIB_DRIVER_TOOLCHAINS_DARWIN_H #include "Cuda.h" +#include "clang/Driver/XRayArgs.h" #include "clang/Driver/Tool.h" #include "c
[PATCH] D51269: [Xray] Darwin - Enable in the driver side
devnexen added a comment. Good point :-) Repository: rL LLVM https://reviews.llvm.org/D51269 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen added a comment. ping https://reviews.llvm.org/D49722 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen added a comment. ping https://reviews.llvm.org/D49722 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen added a comment. ping @george.karpenkov after that I won t bother you for a long time :) https://reviews.llvm.org/D49722 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen added inline comments. Comment at: test/Analysis/cstring-syntax.c:49 + strlcat(dest, "0123456789", badlen / 2); + strlcat(dest, "0123456789", badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen(dest) - 1 or lower}} + strlcat(dest, "0123456789", badlen - strlen(dest) - 1); NoQ wrote: > The suggested fix is a bit weird. > > The correct code for appending `src` to `dst` is either `strlcat(dst, src, > sizeof(dst));` (the approach suggested by the man page) or `strlcat(dst + > strlen(dst) + 1, src, sizeof(dst) - strlen(dst) - 1)` (which is equivalent > but faster if you already know `strlen(dst)`). In both cases you can specify > a smaller value but not a larger value. In fact in this case the message is misleading/a bit wrong. https://reviews.llvm.org/D49722 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen updated this revision to Diff 164355. devnexen added a comment. - Correcting misleading message and advising proper fix. https://reviews.llvm.org/D49722 Files: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp test/Analysis/cstring-syntax.c Index: test/Analysis/cstring-syntax.c === --- test/Analysis/cstring-syntax.c +++ test/Analysis/cstring-syntax.c @@ -7,6 +7,7 @@ char *strncat(char *, const char *, size_t); size_t strlen (const char *s); size_t strlcpy(char *, const char *, size_t); +size_t strlcat(char *, const char *, size_t); void testStrncat(const char *src) { char dest[10]; @@ -33,3 +34,21 @@ strlcpy(dest + 5, src, 5); strlcpy(dest + 5, src, 10); // expected-warning {{The third argument is larger than the size of the input buffer.}} } + +void testStrlcat(const char *src) { + char dest[10]; + size_t badlen = 20; + size_t ulen; + strlcpy(dest, "a", sizeof("a") - 1); + strlcat(dest, "", (sizeof("") - 1) - sizeof(dest) - 1); + strlcpy(dest, "012345678", sizeof(dest)); + strlcat(dest, "910", sizeof(dest)); + strlcpy(dest, "0123456789", sizeof(dest)); + strlcpy(dest, "0123456789", sizeof(dest)); + strlcat(dest, "0123456789", badlen / 2); + strlcat(dest, "0123456789", badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value sizeof(dest) - strlen(dest) - 1 or lower}} + strlcat(dest, "0123456789", badlen - strlen(dest) - 1); + strlcat(dest, src, ulen); + strlcpy(dest, src, 5); + strlcat(dest + 5, src, badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value sizeof() - strlen() - 1 or lower}} +} Index: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp @@ -90,7 +90,16 @@ /// strlcpy(dst, "abcd", 4); /// strlcpy(dst + 3, "abcd", 2); /// strlcpy(dst, "abcd", cpy); - bool containsBadStrlcpyPattern(const CallExpr *CE); + /// Identify erroneous patterns in the last argument to strlcat - the number + /// of bytes to copy. + /// The bad pattern checked is when the last argument is basically + /// pointing to the destination buffer size or argument larger or + /// equal to. + /// char dst[2]; + /// strlcat(dst, src2, sizeof(dst)); + /// strlcat(dst, src2, 2); + /// strlcat(dst, src2, 10); + bool containsBadStrlcpyStrlcatPattern(const CallExpr *CE); public: WalkAST(const CheckerBase *Checker, BugReporter &BR, AnalysisDeclContext *AC) @@ -142,15 +151,19 @@ return false; } -bool WalkAST::containsBadStrlcpyPattern(const CallExpr *CE) { +bool WalkAST::containsBadStrlcpyStrlcatPattern(const CallExpr *CE) { if (CE->getNumArgs() != 3) return false; + const FunctionDecl *FD = CE->getDirectCallee(); + bool Append = CheckerContext::isCLibraryFunction(FD, "strlcat"); const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); const auto *DstArgDecl = dyn_cast(DstArg->IgnoreParenImpCasts()); const auto *LenArgDecl = dyn_cast(LenArg->IgnoreParenLValueCasts()); uint64_t DstOff = 0; + if (isSizeof(LenArg, DstArg)) +return false; // - size_t dstlen = sizeof(dst) if (LenArgDecl) { const auto *LenArgVal = dyn_cast(LenArgDecl->getDecl()); @@ -181,7 +194,10 @@ if (const auto *Buffer = dyn_cast(DstArgDecl->getType())) { ASTContext &C = BR.getContext(); uint64_t BufferLen = C.getTypeSize(Buffer) / 8; -if ((BufferLen - DstOff) < ILRawVal) +auto RemainingBufferLen = BufferLen - DstOff; +if (Append) + RemainingBufferLen -= 1; +if (RemainingBufferLen < ILRawVal) return true; } } @@ -220,7 +236,7 @@ LenArg->getSourceRange()); } } else if (CheckerContext::isCLibraryFunction(FD, "strlcpy")) { -if (containsBadStrlcpyPattern(CE)) { +if (containsBadStrlcpyStrlcatPattern(CE)) { const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); PathDiagnosticLocation Loc = @@ -234,6 +250,29 @@ if (!DstName.empty()) os << "Replace with the value 'sizeof(" << DstName << ")` or lower"; + BR.EmitBasicReport(FD, Checker, "Anti-pattern in the argument", + "C String API", os.str(), Loc, + LenArg->getSourceRange()); +} + } else if (CheckerContext::isCLibraryFunction(FD, "strlcat")) { +if (containsBadStrlcpyStrlcatPattern(CE)) { + const Expr *DstArg = CE->getArg(0); + const Expr *LenArg = CE->getArg(2); + PathDiagnosticLocation Loc = +PathDiagnosticLocation::createBegin(LenArg, BR.getSourceManager(), AC); + + StringRef DstName = getPrintableName(DstArg
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen added inline comments. Comment at: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp:199 +if (Append) + RemainingBufferLen -= 1; +if (RemainingBufferLen < ILRawVal) MaskRay wrote: > `RemainingBufferLen` is `uint64_t`. Can the `-= 1` overflow? That s a good point. I may redo as it was before. https://reviews.llvm.org/D49722 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen updated this revision to Diff 165604. https://reviews.llvm.org/D49722 Files: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp test/Analysis/cstring-syntax.c Index: test/Analysis/cstring-syntax.c === --- test/Analysis/cstring-syntax.c +++ test/Analysis/cstring-syntax.c @@ -7,6 +7,7 @@ char *strncat(char *, const char *, size_t); size_t strlen (const char *s); size_t strlcpy(char *, const char *, size_t); +size_t strlcat(char *, const char *, size_t); void testStrncat(const char *src) { char dest[10]; @@ -33,3 +34,21 @@ strlcpy(dest + 5, src, 5); strlcpy(dest + 5, src, 10); // expected-warning {{The third argument is larger than the size of the input buffer.}} } + +void testStrlcat(const char *src) { + char dest[10]; + size_t badlen = 20; + size_t ulen; + strlcpy(dest, "a", sizeof("a") - 1); + strlcat(dest, "", (sizeof("") - 1) - sizeof(dest) - 1); + strlcpy(dest, "012345678", sizeof(dest)); + strlcat(dest, "910", sizeof(dest)); + strlcpy(dest, "0123456789", sizeof(dest)); + strlcpy(dest, "0123456789", sizeof(dest)); + strlcat(dest, "0123456789", badlen / 2); + strlcat(dest, "0123456789", badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value sizeof(dest) or lower}} + strlcat(dest, "0123456789", badlen - strlen(dest) - 1); + strlcat(dest, src, ulen); + strlcpy(dest, src, 5); + strlcat(dest + 5, src, badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value sizeof() or lower}} +} Index: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp @@ -90,7 +90,16 @@ /// strlcpy(dst, "abcd", 4); /// strlcpy(dst + 3, "abcd", 2); /// strlcpy(dst, "abcd", cpy); - bool containsBadStrlcpyPattern(const CallExpr *CE); + /// Identify erroneous patterns in the last argument to strlcat - the number + /// of bytes to copy. + /// The bad pattern checked is when the last argument is basically + /// pointing to the destination buffer size or argument larger or + /// equal to. + /// char dst[2]; + /// strlcat(dst, src2, sizeof(dst)); + /// strlcat(dst, src2, 2); + /// strlcat(dst, src2, 10); + bool containsBadStrlcpyStrlcatPattern(const CallExpr *CE); public: WalkAST(const CheckerBase *Checker, BugReporter &BR, AnalysisDeclContext *AC) @@ -142,15 +151,19 @@ return false; } -bool WalkAST::containsBadStrlcpyPattern(const CallExpr *CE) { +bool WalkAST::containsBadStrlcpyStrlcatPattern(const CallExpr *CE) { if (CE->getNumArgs() != 3) return false; + const FunctionDecl *FD = CE->getDirectCallee(); + bool Append = CheckerContext::isCLibraryFunction(FD, "strlcat"); const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); const auto *DstArgDecl = dyn_cast(DstArg->IgnoreParenImpCasts()); const auto *LenArgDecl = dyn_cast(LenArg->IgnoreParenLValueCasts()); uint64_t DstOff = 0; + if (isSizeof(LenArg, DstArg)) +return false; // - size_t dstlen = sizeof(dst) if (LenArgDecl) { const auto *LenArgVal = dyn_cast(LenArgDecl->getDecl()); @@ -181,8 +194,14 @@ if (const auto *Buffer = dyn_cast(DstArgDecl->getType())) { ASTContext &C = BR.getContext(); uint64_t BufferLen = C.getTypeSize(Buffer) / 8; -if ((BufferLen - DstOff) < ILRawVal) - return true; +auto RemainingBufferLen = BufferLen - DstOff; +if (Append) { + if (RemainingBufferLen <= ILRawVal) +return true; +} else { + if (RemainingBufferLen < ILRawVal) +return true; +} } } } @@ -220,7 +239,7 @@ LenArg->getSourceRange()); } } else if (CheckerContext::isCLibraryFunction(FD, "strlcpy")) { -if (containsBadStrlcpyPattern(CE)) { +if (containsBadStrlcpyStrlcatPattern(CE)) { const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); PathDiagnosticLocation Loc = @@ -234,6 +253,29 @@ if (!DstName.empty()) os << "Replace with the value 'sizeof(" << DstName << ")` or lower"; + BR.EmitBasicReport(FD, Checker, "Anti-pattern in the argument", + "C String API", os.str(), Loc, + LenArg->getSourceRange()); +} + } else if (CheckerContext::isCLibraryFunction(FD, "strlcat")) { +if (containsBadStrlcpyStrlcatPattern(CE)) { + const Expr *DstArg = CE->getArg(0); + const Expr *LenArg = CE->getArg(2); + PathDiagnosticLocation Loc = +PathDiagnosticLocation::createBegin(LenArg, BR.getSourceManager(), AC); + + StringRef DstName = getPrintableName(DstArg); + + SmallS
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen created this revision. devnexen added reviewers: george.karpenkov, NoQ. devnexen created this object with visibility "All Users". Herald added a subscriber: cfe-commits. - Assuming strlcat is used with strlcpy we check as we can if the last argument does not equal os not larger than the buffer. - Advising the proper usual pattern. Repository: rC Clang https://reviews.llvm.org/D49722 Files: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp test/Analysis/cstring-syntax.c Index: test/Analysis/cstring-syntax.c === --- test/Analysis/cstring-syntax.c +++ test/Analysis/cstring-syntax.c @@ -7,6 +7,7 @@ char *strncat(char *, const char *, size_t); size_t strlen (const char *s); size_t strlcpy(char *, const char *, size_t); +size_t strlcat(char *, const char *, size_t); void testStrncat(const char *src) { char dest[10]; @@ -33,3 +34,19 @@ strlcpy(dest + 5, src, 5); strlcpy(dest + 5, src, 10); // expected-warning {{The third argument is larger than the size of the input buffer.}} } + +void testStrlcat(const char *src) { + char dest[10]; + size_t badlen = 10; + size_t ulen; + strlcpy(dest, "a", sizeof("a") - 1); + strlcat(dest, "", (sizeof("") - 1) - sizeof(dest) - 1); + strlcpy(dest, "012345678", sizeof(dest)); + strlcat(dest, "910", sizeof(dest)); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value- strlen(dest) - 1 or lower}} + strlcpy(dest, "0123456789", sizeof(dest)); + strlcat(dest, "0123456789", badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen(dest) - 1 or lower}} + strlcat(dest, "0123456789", badlen - strlen(dest) - 1); + strlcat(dest, src, ulen); + strlcpy(dest, src, 5); + strlcat(dest + 5, src, badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen() - 1 or lower}} +} Index: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp @@ -92,6 +92,17 @@ /// strlcpy(dst, "abcd", cpy); bool containsBadStrlcpyPattern(const CallExpr *CE); + /// Identify erroneous patterns in the last argument to strlcat - the number + /// of bytes to copy. + /// The bad pattern checked is when the last argument is basically + /// pointing to the destination buffer size or argument larger or + /// equal to. + /// char dst[2]; + /// strlcat(dst, src2, sizeof(dst)); + /// strlcat(dst, src2, 2); + /// strlcat(dst, src2, 10); + bool containsBadStrlcatPattern(const CallExpr *CE); + public: WalkAST(const CheckerBase *Checker, BugReporter &BR, AnalysisDeclContext *AC) : Checker(Checker), BR(BR), AC(AC) {} @@ -190,6 +201,57 @@ return false; } +bool WalkAST::containsBadStrlcatPattern(const CallExpr *CE) { + if (CE->getNumArgs() != 3) +return false; + const Expr *DstArg = CE->getArg(0); + const Expr *LenArg = CE->getArg(2); + + const auto *DstArgDecl = dyn_cast(DstArg->IgnoreParenImpCasts()); + const auto *LenArgDecl = dyn_cast(LenArg->IgnoreParenLValueCasts()); + uint64_t DstOff = 0; + // - sizeof(dst) + if (isSizeof(LenArg, DstArg)) +return true; + // - size_t dstlen = sizeof(dst) + if (LenArgDecl) { +const auto *LenArgVal = dyn_cast(LenArgDecl->getDecl()); +if (LenArgVal->getInit()) + LenArg = LenArgVal->getInit(); + } + + // - integral value + // We try to figure out if the last argument is possibly longer or equal + // than the destination can possibly handle if its size can be defined. + if (const auto *IL = dyn_cast(LenArg->IgnoreParenImpCasts())) { +uint64_t ILRawVal = IL->getValue().getZExtValue(); + +// Case when there is pointer arithmetic on the destination buffer +// especially when we offset from the base decreasing the +// buffer length accordingly. +if (!DstArgDecl) { + if (const auto *BE = dyn_cast(DstArg->IgnoreParenImpCasts())) { +DstArgDecl = dyn_cast(BE->getLHS()->IgnoreParenImpCasts()); +if (BE->getOpcode() == BO_Add) { + if ((IL = dyn_cast(BE->getRHS()->IgnoreParenImpCasts( { +DstOff = IL->getValue().getZExtValue(); + } +} + } +} +if (DstArgDecl) { + if (const auto *Buffer = dyn_cast(DstArgDecl->getType())) { +ASTContext &C = BR.getContext(); +uint64_t BufferLen = C.getTypeSize(Buffer) / 8; +if ((BufferLen - DstOff) <= ILRawVal) + return true; + } +} + } + + return false; +} + void WalkAST::VisitCallExpr(CallExpr *CE) { const FunctionDecl *FD = CE->getDirectCallee(); if (!FD) @@ -234,6 +296,34 @@ if (!DstName.empty())
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen added a comment. Hopefully will try to push it before the freeze just announced, that s my last change in this area (except potential fixes) :) Repository: rC Clang https://reviews.llvm.org/D49722 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49788: [Docs] Update supported oses for ubsan, asan and msan
devnexen created this revision. devnexen added reviewers: morehouse, krytarowski. devnexen created this object with visibility "All Users". Herald added a subscriber: cfe-commits. Repository: rC Clang https://reviews.llvm.org/D49788 Files: docs/AddressSanitizer.rst docs/MemorySanitizer.rst docs/UndefinedBehaviorSanitizer.rst Index: docs/UndefinedBehaviorSanitizer.rst === --- docs/UndefinedBehaviorSanitizer.rst +++ docs/UndefinedBehaviorSanitizer.rst @@ -253,6 +253,7 @@ * Android * Linux * FreeBSD +* OpenBSD * OS X 10.6 onwards and for the following architectures: Index: docs/MemorySanitizer.rst === --- docs/MemorySanitizer.rst +++ docs/MemorySanitizer.rst @@ -185,7 +185,15 @@ Supported Platforms === -MemorySanitizer is supported on Linux x86\_64/MIPS64/AArch64. +MemorySanitizer is supported on the following OS: + +* Linux +* NetBSD +* FreeBSD + +and for the following architectures: + +* x86\_64/MIPS64/AArch64. Limitations === Index: docs/AddressSanitizer.rst === --- docs/AddressSanitizer.rst +++ docs/AddressSanitizer.rst @@ -276,6 +276,7 @@ * OS X 10.7 - 10.11 (i386/x86\_64) * iOS Simulator * Android ARM +* NetBSD i386/x86\_64 * FreeBSD i386/x86\_64 (tested on FreeBSD 11-current) Ports to various other platforms are in progress. Index: docs/UndefinedBehaviorSanitizer.rst === --- docs/UndefinedBehaviorSanitizer.rst +++ docs/UndefinedBehaviorSanitizer.rst @@ -253,6 +253,7 @@ * Android * Linux * FreeBSD +* OpenBSD * OS X 10.6 onwards and for the following architectures: Index: docs/MemorySanitizer.rst === --- docs/MemorySanitizer.rst +++ docs/MemorySanitizer.rst @@ -185,7 +185,15 @@ Supported Platforms === -MemorySanitizer is supported on Linux x86\_64/MIPS64/AArch64. +MemorySanitizer is supported on the following OS: + +* Linux +* NetBSD +* FreeBSD + +and for the following architectures: + +* x86\_64/MIPS64/AArch64. Limitations === Index: docs/AddressSanitizer.rst === --- docs/AddressSanitizer.rst +++ docs/AddressSanitizer.rst @@ -276,6 +276,7 @@ * OS X 10.7 - 10.11 (i386/x86\_64) * iOS Simulator * Android ARM +* NetBSD i386/x86\_64 * FreeBSD i386/x86\_64 (tested on FreeBSD 11-current) Ports to various other platforms are in progress. ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49788: [Docs] Update supported oses for ubsan, asan and msan
devnexen added a comment. This is the first time I m involved into a release so I do not know if it s too early to update those docs but with the freeze incoming, I thought it was worth before it get forgotten. Repository: rC Clang https://reviews.llvm.org/D49788 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49788: [Docs] Update supported oses for ubsan, asan and msan
devnexen added a comment. Ah I forgot NetBSD sorry yes you re right. Repository: rC Clang https://reviews.llvm.org/D49788 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49788: [Docs] Update supported oses for ubsan, asan and msan
devnexen updated this revision to Diff 157237. https://reviews.llvm.org/D49788 Files: docs/AddressSanitizer.rst docs/MemorySanitizer.rst docs/SafeStack.rst docs/ThreadSanitizer.rst docs/UndefinedBehaviorSanitizer.rst Index: docs/UndefinedBehaviorSanitizer.rst === --- docs/UndefinedBehaviorSanitizer.rst +++ docs/UndefinedBehaviorSanitizer.rst @@ -252,17 +252,11 @@ * Android * Linux +* NetBSD * FreeBSD +* OpenBSD * OS X 10.6 onwards -and for the following architectures: - -* i386/x86\_64 -* ARM -* AArch64 -* PowerPC64 -* MIPS/MIPS64 - Current Status == Index: docs/ThreadSanitizer.rst === --- docs/ThreadSanitizer.rst +++ docs/ThreadSanitizer.rst @@ -17,7 +17,11 @@ Supported Platforms --- -ThreadSanitizer is supported on Linux x86_64 (tested on Ubuntu 12.04). +ThreadSanitizer is supported on the following OS: + +* Linux +* NetBSD +* FreeBSD Support for other 64-bit architectures is possible, contributions are welcome. Support for 32-bit platforms is problematic and is not planned. Index: docs/SafeStack.rst === --- docs/SafeStack.rst +++ docs/SafeStack.rst @@ -126,7 +126,7 @@ Supported Platforms --- -SafeStack was tested on Linux, FreeBSD and MacOSX. +SafeStack was tested on Linux, NetBSD, FreeBSD and MacOSX. Low-level API - Index: docs/MemorySanitizer.rst === --- docs/MemorySanitizer.rst +++ docs/MemorySanitizer.rst @@ -185,7 +185,11 @@ Supported Platforms === -MemorySanitizer is supported on Linux x86\_64/MIPS64/AArch64. +MemorySanitizer is supported on the following OS: + +* Linux +* NetBSD +* FreeBSD Limitations === Index: docs/AddressSanitizer.rst === --- docs/AddressSanitizer.rst +++ docs/AddressSanitizer.rst @@ -276,6 +276,7 @@ * OS X 10.7 - 10.11 (i386/x86\_64) * iOS Simulator * Android ARM +* NetBSD i386/x86\_64 * FreeBSD i386/x86\_64 (tested on FreeBSD 11-current) Ports to various other platforms are in progress. Index: docs/UndefinedBehaviorSanitizer.rst === --- docs/UndefinedBehaviorSanitizer.rst +++ docs/UndefinedBehaviorSanitizer.rst @@ -252,17 +252,11 @@ * Android * Linux +* NetBSD * FreeBSD +* OpenBSD * OS X 10.6 onwards -and for the following architectures: - -* i386/x86\_64 -* ARM -* AArch64 -* PowerPC64 -* MIPS/MIPS64 - Current Status == Index: docs/ThreadSanitizer.rst === --- docs/ThreadSanitizer.rst +++ docs/ThreadSanitizer.rst @@ -17,7 +17,11 @@ Supported Platforms --- -ThreadSanitizer is supported on Linux x86_64 (tested on Ubuntu 12.04). +ThreadSanitizer is supported on the following OS: + +* Linux +* NetBSD +* FreeBSD Support for other 64-bit architectures is possible, contributions are welcome. Support for 32-bit platforms is problematic and is not planned. Index: docs/SafeStack.rst === --- docs/SafeStack.rst +++ docs/SafeStack.rst @@ -126,7 +126,7 @@ Supported Platforms --- -SafeStack was tested on Linux, FreeBSD and MacOSX. +SafeStack was tested on Linux, NetBSD, FreeBSD and MacOSX. Low-level API - Index: docs/MemorySanitizer.rst === --- docs/MemorySanitizer.rst +++ docs/MemorySanitizer.rst @@ -185,7 +185,11 @@ Supported Platforms === -MemorySanitizer is supported on Linux x86\_64/MIPS64/AArch64. +MemorySanitizer is supported on the following OS: + +* Linux +* NetBSD +* FreeBSD Limitations === Index: docs/AddressSanitizer.rst === --- docs/AddressSanitizer.rst +++ docs/AddressSanitizer.rst @@ -276,6 +276,7 @@ * OS X 10.7 - 10.11 (i386/x86\_64) * iOS Simulator * Android ARM +* NetBSD i386/x86\_64 * FreeBSD i386/x86\_64 (tested on FreeBSD 11-current) Ports to various other platforms are in progress. ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49788: [Docs] Update supported oses for ubsan, asan and msan
devnexen closed this revision. devnexen added a comment. Exited too early fro the editor ,.. did not write all the lines but commited with https://reviews.llvm.org/rC337926 https://reviews.llvm.org/D49788 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen updated this revision to Diff 157381. https://reviews.llvm.org/D49722 Files: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp test/Analysis/cstring-syntax.c Index: test/Analysis/cstring-syntax.c === --- test/Analysis/cstring-syntax.c +++ test/Analysis/cstring-syntax.c @@ -7,6 +7,7 @@ char *strncat(char *, const char *, size_t); size_t strlen (const char *s); size_t strlcpy(char *, const char *, size_t); +size_t strlcat(char *, const char *, size_t); void testStrncat(const char *src) { char dest[10]; @@ -33,3 +34,19 @@ strlcpy(dest + 5, src, 5); strlcpy(dest + 5, src, 10); // expected-warning {{The third argument is larger than the size of the input buffer.}} } + +void testStrlcat(const char *src) { + char dest[10]; + size_t badlen = 10; + size_t ulen; + strlcpy(dest, "a", sizeof("a") - 1); + strlcat(dest, "", (sizeof("") - 1) - sizeof(dest) - 1); + strlcpy(dest, "012345678", sizeof(dest)); + strlcat(dest, "910", sizeof(dest)); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value- strlen(dest) - 1 or lower}} + strlcpy(dest, "0123456789", sizeof(dest)); + strlcat(dest, "0123456789", badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen(dest) - 1 or lower}} + strlcat(dest, "0123456789", badlen - strlen(dest) - 1); + strlcat(dest, src, ulen); + strlcpy(dest, src, 5); + strlcat(dest + 5, src, badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen() - 1 or lower}} +} Index: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp @@ -90,7 +90,16 @@ /// strlcpy(dst, "abcd", 4); /// strlcpy(dst + 3, "abcd", 2); /// strlcpy(dst, "abcd", cpy); - bool containsBadStrlcpyPattern(const CallExpr *CE); + /// Identify erroneous patterns in the last argument to strlcat - the number + /// of bytes to copy. + /// The bad pattern checked is when the last argument is basically + /// pointing to the destination buffer size or argument larger or + /// equal to. + /// char dst[2]; + /// strlcat(dst, src2, sizeof(dst)); + /// strlcat(dst, src2, 2); + /// strlcat(dst, src2, 10); + bool containsBadStrlcpyStrlcatPattern(const CallExpr *CE, bool Append = false); public: WalkAST(const CheckerBase *Checker, BugReporter &BR, AnalysisDeclContext *AC) @@ -142,15 +151,18 @@ return false; } -bool WalkAST::containsBadStrlcpyPattern(const CallExpr *CE) { +bool WalkAST::containsBadStrlcpyStrlcatPattern(const CallExpr *CE, bool Append) { if (CE->getNumArgs() != 3) return false; const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); const auto *DstArgDecl = dyn_cast(DstArg->IgnoreParenImpCasts()); const auto *LenArgDecl = dyn_cast(LenArg->IgnoreParenLValueCasts()); uint64_t DstOff = 0; + // - sizeof(dst) + if (Append && isSizeof(LenArg, DstArg)) +return true; // - size_t dstlen = sizeof(dst) if (LenArgDecl) { const auto *LenArgVal = dyn_cast(LenArgDecl->getDecl()); @@ -181,8 +193,14 @@ if (const auto *Buffer = dyn_cast(DstArgDecl->getType())) { ASTContext &C = BR.getContext(); uint64_t BufferLen = C.getTypeSize(Buffer) / 8; -if ((BufferLen - DstOff) < ILRawVal) - return true; +BufferLen -= DstOff; +if (Append) { + if (BufferLen <= ILRawVal) +return true; +} else { + if (BufferLen < ILRawVal) +return true; +} } } } @@ -220,7 +238,7 @@ LenArg->getSourceRange()); } } else if (CheckerContext::isCLibraryFunction(FD, "strlcpy")) { -if (containsBadStrlcpyPattern(CE)) { +if (containsBadStrlcpyStrlcatPattern(CE)) { const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); PathDiagnosticLocation Loc = @@ -234,6 +252,34 @@ if (!DstName.empty()) os << "Replace with the value 'sizeof(" << DstName << ")` or lower"; + BR.EmitBasicReport(FD, Checker, "Anti-pattern in the argument", + "C String API", os.str(), Loc, + LenArg->getSourceRange()); +} + } else if (CheckerContext::isCLibraryFunction(FD, "strlcat")) { +if (containsBadStrlcpyStrlcatPattern(CE, true)) { + const Expr *DstArg = CE->getArg(0); + const Expr *LenArg = CE->getArg(2); + PathDiagnosticLocation Loc = +PathDiagnosticLocation::createBegin(LenArg, BR.getSourceManager(), AC); + + StringRef DstName = getPrintableName(DstArg); + StringRe
[PATCH] D49873: [Docs] ReleasesNotes update / Static analyser
devnexen created this revision. devnexen added a reviewer: pcc. devnexen created this object with visibility "All Users". Herald added a subscriber: cfe-commits. Repository: rC Clang https://reviews.llvm.org/D49873 Files: docs/ReleaseNotes.rst Index: docs/ReleaseNotes.rst === --- docs/ReleaseNotes.rst +++ docs/ReleaseNotes.rst @@ -262,7 +262,8 @@ Static Analyzer --- -- ... +- The new `MmapWriteExec` checker had been introduced to detect attempts to map pages +both writable and executable. ... Index: docs/ReleaseNotes.rst === --- docs/ReleaseNotes.rst +++ docs/ReleaseNotes.rst @@ -262,7 +262,8 @@ Static Analyzer --- -- ... +- The new `MmapWriteExec` checker had been introduced to detect attempts to map pages +both writable and executable. ... ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49906: [Docs] Sanitizer update
devnexen created this revision. devnexen added a reviewer: eugenis. devnexen created this object with visibility "All Users". Herald added a subscriber: cfe-commits. - Adding new option detect_write_exec=1 available. Repository: rC Clang https://reviews.llvm.org/D49906 Files: docs/AddressSanitizer.rst docs/MemorySanitizer.rst Index: docs/MemorySanitizer.rst === --- docs/MemorySanitizer.rst +++ docs/MemorySanitizer.rst @@ -165,6 +165,13 @@ #. Set environment variable `MSAN_OPTIONS=poison_in_dtor=1` before running the program. +Writable/Executable paging detection + + +You can eable writable-executable page detection in MemorySanitizer by +setting the environment variable `MSAN_OPTIONS=detect_write_exec=1` before +running the program. + Handling external code == Index: docs/AddressSanitizer.rst === --- docs/AddressSanitizer.rst +++ docs/AddressSanitizer.rst @@ -144,6 +144,12 @@ and can be enabled using ``ASAN_OPTIONS=detect_leaks=1`` on OS X; however, it is not yet supported on other platforms. +Writable/Executable paging detection + + +The W^X detection is disabled by default and can be enabled using +``ASAN_OPTIONS=detect_write_exec=1``. + Issue Suppression = Index: docs/MemorySanitizer.rst === --- docs/MemorySanitizer.rst +++ docs/MemorySanitizer.rst @@ -165,6 +165,13 @@ #. Set environment variable `MSAN_OPTIONS=poison_in_dtor=1` before running the program. +Writable/Executable paging detection + + +You can eable writable-executable page detection in MemorySanitizer by +setting the environment variable `MSAN_OPTIONS=detect_write_exec=1` before +running the program. + Handling external code == Index: docs/AddressSanitizer.rst === --- docs/AddressSanitizer.rst +++ docs/AddressSanitizer.rst @@ -144,6 +144,12 @@ and can be enabled using ``ASAN_OPTIONS=detect_leaks=1`` on OS X; however, it is not yet supported on other platforms. +Writable/Executable paging detection + + +The W^X detection is disabled by default and can be enabled using +``ASAN_OPTIONS=detect_write_exec=1``. + Issue Suppression = ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen added a comment. ping :) https://reviews.llvm.org/D49722 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen updated this revision to Diff 158062. https://reviews.llvm.org/D49722 Files: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp test/Analysis/cstring-syntax.c Index: test/Analysis/cstring-syntax.c === --- test/Analysis/cstring-syntax.c +++ test/Analysis/cstring-syntax.c @@ -7,6 +7,7 @@ char *strncat(char *, const char *, size_t); size_t strlen (const char *s); size_t strlcpy(char *, const char *, size_t); +size_t strlcat(char *, const char *, size_t); void testStrncat(const char *src) { char dest[10]; @@ -33,3 +34,19 @@ strlcpy(dest + 5, src, 5); strlcpy(dest + 5, src, 10); // expected-warning {{The third argument is larger than the size of the input buffer.}} } + +void testStrlcat(const char *src) { + char dest[10]; + size_t badlen = 10; + size_t ulen; + strlcpy(dest, "a", sizeof("a") - 1); + strlcat(dest, "", (sizeof("") - 1) - sizeof(dest) - 1); + strlcpy(dest, "012345678", sizeof(dest)); + strlcat(dest, "910", sizeof(dest)); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value- strlen(dest) - 1 or lower}} + strlcpy(dest, "0123456789", sizeof(dest)); + strlcat(dest, "0123456789", badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen(dest) - 1 or lower}} + strlcat(dest, "0123456789", badlen - strlen(dest) - 1); + strlcat(dest, src, ulen); + strlcpy(dest, src, 5); + strlcat(dest + 5, src, badlen); // expected-warning {{The third argument allows to potentially copy more bytes than it should. Replace with the value 'badlen' - strlen() - 1 or lower}} +} Index: lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp === --- lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp +++ lib/StaticAnalyzer/Checkers/CStringSyntaxChecker.cpp @@ -90,7 +90,16 @@ /// strlcpy(dst, "abcd", 4); /// strlcpy(dst + 3, "abcd", 2); /// strlcpy(dst, "abcd", cpy); - bool containsBadStrlcpyPattern(const CallExpr *CE); + /// Identify erroneous patterns in the last argument to strlcat - the number + /// of bytes to copy. + /// The bad pattern checked is when the last argument is basically + /// pointing to the destination buffer size or argument larger or + /// equal to. + /// char dst[2]; + /// strlcat(dst, src2, sizeof(dst)); + /// strlcat(dst, src2, 2); + /// strlcat(dst, src2, 10); + bool containsBadStrlcpyStrlcatPattern(const CallExpr *CE); public: WalkAST(const CheckerBase *Checker, BugReporter &BR, AnalysisDeclContext *AC) @@ -142,15 +151,21 @@ return false; } -bool WalkAST::containsBadStrlcpyPattern(const CallExpr *CE) { +bool WalkAST::containsBadStrlcpyStrlcatPattern(const CallExpr *CE) { if (CE->getNumArgs() != 3) return false; + const FunctionDecl *FD = CE->getDirectCallee(); + bool Append = CheckerContext::isCLibraryFunction(FD, "strlcat"); const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); const auto *DstArgDecl = dyn_cast(DstArg->IgnoreParenImpCasts()); const auto *LenArgDecl = dyn_cast(LenArg->IgnoreParenLValueCasts()); uint64_t DstOff = 0; + // - sizeof(dst) + // strlcat appends at most size - strlen(dst) - 1 + if (Append && isSizeof(LenArg, DstArg)) +return true; // - size_t dstlen = sizeof(dst) if (LenArgDecl) { const auto *LenArgVal = dyn_cast(LenArgDecl->getDecl()); @@ -181,8 +196,14 @@ if (const auto *Buffer = dyn_cast(DstArgDecl->getType())) { ASTContext &C = BR.getContext(); uint64_t BufferLen = C.getTypeSize(Buffer) / 8; -if ((BufferLen - DstOff) < ILRawVal) - return true; +auto RemainingBufferLen = BufferLen - DstOff; +if (Append) { + if (RemainingBufferLen <= ILRawVal) +return true; +} else { + if (RemainingBufferLen < ILRawVal) +return true; +} } } } @@ -220,7 +241,7 @@ LenArg->getSourceRange()); } } else if (CheckerContext::isCLibraryFunction(FD, "strlcpy")) { -if (containsBadStrlcpyPattern(CE)) { +if (containsBadStrlcpyStrlcatPattern(CE)) { const Expr *DstArg = CE->getArg(0); const Expr *LenArg = CE->getArg(2); PathDiagnosticLocation Loc = @@ -234,6 +255,34 @@ if (!DstName.empty()) os << "Replace with the value 'sizeof(" << DstName << ")` or lower"; + BR.EmitBasicReport(FD, Checker, "Anti-pattern in the argument", + "C String API", os.str(), Loc, + LenArg->getSourceRange()); +} + } else if (CheckerContext::isCLibraryFunction(FD, "strlcat")) { +if (containsBadStrlcpyStrlcatPattern(CE)) { + const Expr *DstArg = CE->getArg(0); + const Expr *LenArg = CE->getArg(2); + PathD
[PATCH] D49722: [CStringSyntaxChecker] Check strlcat sizeof check
devnexen added a comment. ping :) https://reviews.llvm.org/D49722 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49873: [Docs] ReleasesNotes update / Static analyser
devnexen added a comment. ping :) Repository: rC Clang https://reviews.llvm.org/D49873 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49906: [Docs] Sanitizer update
devnexen added a comment. ping :) Repository: rC Clang https://reviews.llvm.org/D49906 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49906: [Docs] Sanitizer update
devnexen abandoned this revision. devnexen added a comment. Commited in the branch. Repository: rC Clang https://reviews.llvm.org/D49906 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D49873: [Docs] ReleasesNotes update / Static analyser
devnexen abandoned this revision. devnexen added a comment. Committed in the branch. Repository: rC Clang https://reviews.llvm.org/D49873 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D42645: New simple Checker for mmap calls
devnexen updated this revision to Diff 132873. Repository: rC Clang https://reviews.llvm.org/D42645 Files: include/clang/StaticAnalyzer/Checkers/Checkers.td lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -0,0 +1,31 @@ +// RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=security.MmapWriteExec -verify %s +// RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=security.MmapWriteExec -verify %s + +#define PROT_READ 0x01 +#define PROT_WRITE 0x02 +#define PROT_EXEC 0x04 +#define MAP_PRIVATE 0x0002 +#define MAP_ANON0x1000 +#define MAP_FIXED 0x0010 +#define NULL((void *)0) + +typedef __typeof(sizeof(int)) size_t; +void *mmap(void *, size_t, int, int, int, long); + +void f1() +{ + void *a = mmap(NULL, 16, PROT_READ | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + void *b = mmap(a, 16, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning + void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)a; + (void)b; + (void)c; +} + +void f2() +{ + void *(*callm)(void *, size_t, int, int, int, long); + callm = mmap; + int prot = PROT_WRITE | PROT_EXEC; + (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -0,0 +1,75 @@ +// MmapWriteExecChecker.cpp - Check for the prot argument -===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===--===// +// +// This checker tests the 3rd argument of mmap's calls to check if +// it is writable and executable in the same time. It's somehow +// an optional checker since for example in JIT libraries it is pretty common. +// +//===--===// + +#include "ClangSACheckers.h" + +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; +using llvm::APSInt; + +namespace { +class MmapWriteExecChecker : public Checker { + CallDescription MmapFn; + static int ProtWrite; + static int ProtExec; + mutable std::unique_ptr BT; +public: + MmapWriteExecChecker() : MmapFn("mmap", 6) {} + void checkPreCall(const CallEvent &Call, CheckerContext &C) const; +}; +} + +int MmapWriteExecChecker::ProtWrite = 0x02; +int MmapWriteExecChecker::ProtExec = 0x04; + +void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + if (Call.isCalled(MmapFn)) { +llvm::Triple Triple = C.getASTContext().getTargetInfo().getTriple(); + +if (Triple.isOSGlibc()) + ProtExec = 0x01; + +SVal ProtVal = Call.getArgSVal(2); +Optional ProtLoc = ProtVal.getAs(); +int64_t Prot = ProtLoc->getValue().getSExtValue(); + +if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) { + if (!BT) +BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security")); + + ExplodedNode *N = C.generateNonFatalErrorNode(); + if (!N) +return; + + auto Report = llvm::make_unique( + *BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can " + "lead to exploitable memory regions, which could be overwritten " + "with malicious code", N); + Report->addRange(Call.getArgSourceRange(2)); + C.emitReport(std::move(Report)); +} + } +} + +void ento::registerMmapWriteExecChecker(CheckerManager &mgr) { + mgr.registerChecker(); +} Index: lib/StaticAnalyzer/Checkers/CMakeLists.txt === --- lib/StaticAnalyzer/Checkers/CMakeLists.txt +++ lib/StaticAnalyzer/Checkers/CMakeLists.txt @@ -49,6 +49,7 @@ MallocChecker.cpp MallocOverfl
[PATCH] D42645: New simple Checker for mmap calls
devnexen added a comment. In https://reviews.llvm.org/D42645#998732, @a.sidorin wrote: > Hello David, > > I have looked into mmap constant definitions in different implementations and > found them pretty inconsistent. For example, MMAP_EXEC can be 0x01, 0x04 and > I even found 0x00 in some file > (https://www.cs.cmu.edu/~dga/crypto/priveth/libethash/mmap.h). Therefore, we > should clearly state how do we predict these values. Are you sure that > checking `isOSGlibc()` is enough? > > Also, could you please explain me how the test works? If I understand > correctly, for all platforms we manually define the constants in the test. > Then, we check if `PROT_WRITE | PROT_EXEC` is set. For OSGlibc, PROT_EXEC > is defined as 0x01 in the checker. This means that if isOSGlibc branch is > covered, we should not get any warnings for one of test launches because > `PROT_WRITE | PROT_EXEC` is 0x03 in the checker and is 0x06 in the test file. Yes maybe in the test glibc constants should be defined as well (I develop mainly on *BSD variants I missed that for the test case you re right). Repository: rC Clang https://reviews.llvm.org/D42645 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D42645: New simple Checker for mmap calls
devnexen updated this revision to Diff 132969. Herald added a subscriber: emaste. Repository: rC Clang https://reviews.llvm.org/D42645 Files: include/clang/StaticAnalyzer/Checkers/Checkers.td lib/Driver/ToolChains/FreeBSD.cpp lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -0,0 +1,36 @@ +// RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=security.MmapWriteExec -verify %s +// RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=security.MmapWriteExec -verify %s + +#define PROT_WRITE 0x02 +#ifdef __GLIBC__ +#define PROT_READ 0x04 +#define PROT_EXEC 0x01 +#else +#define PROT_READ 0x01 +#define PROT_EXEC 0x04 +#endif +#define MAP_PRIVATE 0x0002 +#define MAP_ANON0x1000 +#define MAP_FIXED 0x0010 +#define NULL((void *)0) + +typedef __typeof(sizeof(int)) size_t; +void *mmap(void *, size_t, int, int, int, long); + +void f1() +{ + void *a = mmap(NULL, 16, PROT_READ | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + void *b = mmap(a, 16, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning + void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)a; + (void)b; + (void)c; +} + +void f2() +{ + void *(*callm)(void *, size_t, int, int, int, long); + callm = mmap; + int prot = PROT_WRITE | PROT_EXEC; + (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -0,0 +1,75 @@ +// MmapWriteExecChecker.cpp - Check for the prot argument -===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===--===// +// +// This checker tests the 3rd argument of mmap's calls to check if +// it is writable and executable in the same time. It's somehow +// an optional checker since for example in JIT libraries it is pretty common. +// +//===--===// + +#include "ClangSACheckers.h" + +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; +using llvm::APSInt; + +namespace { +class MmapWriteExecChecker : public Checker { + CallDescription MmapFn; + static int ProtWrite; + static int ProtExec; + mutable std::unique_ptr BT; +public: + MmapWriteExecChecker() : MmapFn("mmap", 6) {} + void checkPreCall(const CallEvent &Call, CheckerContext &C) const; +}; +} + +int MmapWriteExecChecker::ProtWrite = 0x02; +int MmapWriteExecChecker::ProtExec = 0x04; + +void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + if (Call.isCalled(MmapFn)) { +llvm::Triple Triple = C.getASTContext().getTargetInfo().getTriple(); + +if (Triple.isOSGlibc()) + ProtExec = 0x01; + +SVal ProtVal = Call.getArgSVal(2); +Optional ProtLoc = ProtVal.getAs(); +int64_t Prot = ProtLoc->getValue().getSExtValue(); + +if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) { + if (!BT) +BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security")); + + ExplodedNode *N = C.generateNonFatalErrorNode(); + if (!N) +return; + + auto Report = llvm::make_unique( + *BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can " + "lead to exploitable memory regions, which could be overwritten" + " with malicious code", N); + Report->addRange(Call.getArgSourceRange(2)); + C.emitReport(std::move(Report)); +} + } +} + +void ento::registerMmapWriteExecChecker(CheckerManager &mgr) { + mgr.registerChecker(); +} Index: lib/StaticAnalyzer/Checkers/CMakeLists.txt
[PATCH] D42645: New simple Checker for mmap calls
devnexen updated this revision to Diff 133008. devnexen added a comment. Both Linux/Darwin unit tests passed. Repository: rC Clang https://reviews.llvm.org/D42645 Files: include/clang/StaticAnalyzer/Checkers/Checkers.td lib/Driver/ToolChains/FreeBSD.cpp lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -0,0 +1,30 @@ +// RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=security.MmapWriteExec -verify %s +// RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=security.MmapWriteExec -verify %s + +#define PROT_WRITE 0x02 +#define PROT_EXEC 0x04 +#define MAP_PRIVATE 0x0002 +#define MAP_ANON0x1000 +#define MAP_FIXED 0x0010 +#define NULL((void *)0) + +typedef __typeof(sizeof(int)) size_t; +void *mmap(void *, size_t, int, int, int, long); + +void f1() +{ + void *a = mmap(NULL, 16, PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + void *b = mmap(a, 16, PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning + void *c = mmap(NULL, 32, PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)a; + (void)b; + (void)c; +} + +void f2() +{ + void *(*callm)(void *, size_t, int, int, int, long); + callm = mmap; + int prot = PROT_WRITE | PROT_EXEC; + (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -0,0 +1,72 @@ +// MmapWriteExecChecker.cpp - Check for the prot argument -===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===--===// +// +// This checker tests the 3rd argument of mmap's calls to check if +// it is writable and executable in the same time. It's somehow +// an optional checker since for example in JIT libraries it is pretty common. +// +//===--===// + +#include "ClangSACheckers.h" + +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; +using llvm::APSInt; + +namespace { +class MmapWriteExecChecker : public Checker { + CallDescription MmapFn; + static int ProtWrite; + static int ProtExec; + mutable std::unique_ptr BT; +public: + MmapWriteExecChecker() : MmapFn("mmap", 6) {} + void checkPreCall(const CallEvent &Call, CheckerContext &C) const; +}; +} + +int MmapWriteExecChecker::ProtWrite = 0x02; +int MmapWriteExecChecker::ProtExec = 0x04; + +void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + if (Call.isCalled(MmapFn)) { +llvm::Triple Triple = C.getASTContext().getTargetInfo().getTriple(); + +SVal ProtVal = Call.getArgSVal(2); +Optional ProtLoc = ProtVal.getAs(); +int64_t Prot = ProtLoc->getValue().getSExtValue(); + +if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) { + if (!BT) +BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security")); + + ExplodedNode *N = C.generateNonFatalErrorNode(); + if (!N) +return; + + auto Report = llvm::make_unique( + *BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can " + "lead to exploitable memory regions, which could be overwritten" + " with malicious code", N); + Report->addRange(Call.getArgSourceRange(2)); + C.emitReport(std::move(Report)); +} + } +} + +void ento::registerMmapWriteExecChecker(CheckerManager &mgr) { + mgr.registerChecker(); +} Index: lib/StaticAnalyzer/Checkers/CMakeLists.txt === --- lib/StaticAnalyzer/Checkers/CMakeLists.txt +++ lib/StaticAnalyzer/Checkers/CMakeLists.txt @@ -49,6 +49,7 @@ MallocChecker.cpp MallocOverflowSecurityChecke
[PATCH] D42645: New simple Checker for mmap calls
devnexen updated this revision to Diff 133010. devnexen added a comment. Will work on most modern Linux/Glibc versions, BSD variants and Illumos. Repository: rC Clang https://reviews.llvm.org/D42645 Files: include/clang/StaticAnalyzer/Checkers/Checkers.td lib/Driver/ToolChains/FreeBSD.cpp lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -0,0 +1,30 @@ +// RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=security.MmapWriteExec -verify %s +// RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=security.MmapWriteExec -verify %s + +#define PROT_WRITE 0x02 +#define PROT_EXEC 0x04 +#define MAP_PRIVATE 0x0002 +#define MAP_ANON0x1000 +#define MAP_FIXED 0x0010 +#define NULL((void *)0) + +typedef __typeof(sizeof(int)) size_t; +void *mmap(void *, size_t, int, int, int, long); + +void f1() +{ + void *a = mmap(NULL, 16, PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + void *b = mmap(a, 16, PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning + void *c = mmap(NULL, 32, PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)a; + (void)b; + (void)c; +} + +void f2() +{ + void *(*callm)(void *, size_t, int, int, int, long); + callm = mmap; + int prot = PROT_WRITE | PROT_EXEC; + (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -0,0 +1,70 @@ +// MmapWriteExecChecker.cpp - Check for the prot argument -===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===--===// +// +// This checker tests the 3rd argument of mmap's calls to check if +// it is writable and executable in the same time. It's somehow +// an optional checker since for example in JIT libraries it is pretty common. +// +//===--===// + +#include "ClangSACheckers.h" + +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; +using llvm::APSInt; + +namespace { +class MmapWriteExecChecker : public Checker { + CallDescription MmapFn; + static int ProtWrite; + static int ProtExec; + mutable std::unique_ptr BT; +public: + MmapWriteExecChecker() : MmapFn("mmap", 6) {} + void checkPreCall(const CallEvent &Call, CheckerContext &C) const; +}; +} + +int MmapWriteExecChecker::ProtWrite = 0x02; +int MmapWriteExecChecker::ProtExec = 0x04; + +void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + if (Call.isCalled(MmapFn)) { +SVal ProtVal = Call.getArgSVal(2); +Optional ProtLoc = ProtVal.getAs(); +int64_t Prot = ProtLoc->getValue().getSExtValue(); + +if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) { + if (!BT) +BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security")); + + ExplodedNode *N = C.generateNonFatalErrorNode(); + if (!N) +return; + + auto Report = llvm::make_unique( + *BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can " + "lead to exploitable memory regions, which could be overwritten" + " with malicious code", N); + Report->addRange(Call.getArgSourceRange(2)); + C.emitReport(std::move(Report)); +} + } +} + +void ento::registerMmapWriteExecChecker(CheckerManager &mgr) { + mgr.registerChecker(); +} Index: lib/StaticAnalyzer/Checkers/CMakeLists.txt === --- lib/StaticAnalyzer/Checkers/CMakeLists.txt +++ lib/StaticAnalyzer/Checkers/CMakeLists.txt @@ -49,6 +49,7 @@ MallocChecker.cpp MallocOverflowSecurityChecker.cpp MallocSizeofChecker.cpp + Mmap
[PATCH] D42645: New simple Checker for mmap calls
devnexen added a comment. Repository: rC Clang https://reviews.llvm.org/D42645 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D42645: New simple Checker for mmap calls
devnexen updated this revision to Diff 133164. Repository: rC Clang https://reviews.llvm.org/D42645 Files: include/clang/StaticAnalyzer/Checkers/Checkers.td lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -0,0 +1,35 @@ +// RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=security.MmapWriteExec -analyzer-config security.MmapWriteExec:MmapProtExec=1 -DPROT_EXEC=1 -verify %s +// RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=security.MmapWriteExec -verify %s + +#define PROT_WRITE 0x02 +#ifndef PROT_EXEC +#define PROT_EXEC 0x04 +#define PROT_READ 0x01 +#else +#define PROT_READ 0x04 +#endif +#define MAP_PRIVATE 0x0002 +#define MAP_ANON0x1000 +#define MAP_FIXED 0x0010 +#define NULL((void *)0) + +typedef __typeof(sizeof(int)) size_t; +void *mmap(void *, size_t, int, int, int, long); + +void f1() +{ + void *a = mmap(NULL, 16, PROT_READ | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + void *b = mmap(a, 16, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning + void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)a; + (void)b; + (void)c; +} + +void f2() +{ + void *(*callm)(void *, size_t, int, int, int, long); + callm = mmap; + int prot = PROT_WRITE | PROT_EXEC; + (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -0,0 +1,76 @@ +// MmapWriteExecChecker.cpp - Check for the prot argument -===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===--===// +// +// This checker tests the 3rd argument of mmap's calls to check if +// it is writable and executable in the same time. It's somehow +// an optional checker since for example in JIT libraries it is pretty common. +// +//===--===// + +#include "ClangSACheckers.h" + +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; +using llvm::APSInt; + +namespace { +class MmapWriteExecChecker : public Checker { + CallDescription MmapFn; + static int ProtWrite; + static int ProtExec; + mutable std::unique_ptr BT; +public: + MmapWriteExecChecker() : MmapFn("mmap", 6) {} + void checkPreCall(const CallEvent &Call, CheckerContext &C) const; + int ProtExecOv; +}; +} + +int MmapWriteExecChecker::ProtWrite = 0x02; +int MmapWriteExecChecker::ProtExec = 0x04; + +void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + if (Call.isCalled(MmapFn)) { +SVal ProtVal = Call.getArgSVal(2); +Optional ProtLoc = ProtVal.getAs(); +int64_t Prot = ProtLoc->getValue().getSExtValue(); +if (ProtExecOv != ProtExec) + ProtExec = ProtExecOv; + +if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) { + if (!BT) +BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security")); + + ExplodedNode *N = C.generateNonFatalErrorNode(); + if (!N) +return; + + auto Report = llvm::make_unique( + *BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can " + "lead to exploitable memory regions, which could be overwritten " + "with malicious code", N); + Report->addRange(Call.getArgSourceRange(2)); + C.emitReport(std::move(Report)); +} + } +} + +void ento::registerMmapWriteExecChecker(CheckerManager &mgr) { + MmapWriteExecChecker *Mwec = + mgr.registerChecker(); + Mwec->ProtExecOv = +mgr.getAnalyzerOptions().getOptionAsInteger("MmapProtExec", 0x04, Mwec); +} Index: lib/StaticAnalyzer/Checkers/CMakeLists.txt
[PATCH] D42645: New simple Checker for mmap calls
devnexen added a comment. None of the possible solutions are ideal, but I think I chose the least complex (e.g. via analyzer-config), less edgy one, and 4 is the most common value I ve found so far for PROT_EXEC. Repository: rC Clang https://reviews.llvm.org/D42645 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D42645: New simple Checker for mmap calls
devnexen updated this revision to Diff 133564. Repository: rC Clang https://reviews.llvm.org/D42645 Files: include/clang/StaticAnalyzer/Checkers/Checkers.td lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -0,0 +1,36 @@ +// RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=security.MmapWriteExec -analyzer-config security.MmapWriteExec:MmapProtExec=1 -analyzer-config security.MmapWriteExec:MmapProtRead=4 -DUSE_ALTERNATIVE_PROT_EXEC_DEFINITION -verify %s +// RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=security.MmapWriteExec -verify %s + +#define PROT_WRITE 0x02 +#ifndef USE_ALTERNATIVE_PROT_EXEC_DEFINITION +#define PROT_EXEC 0x04 +#define PROT_READ 0x01 +#else +#define PROT_EXEC 0x01 +#define PROT_READ 0x04 +#endif +#define MAP_PRIVATE 0x0002 +#define MAP_ANON0x1000 +#define MAP_FIXED 0x0010 +#define NULL((void *)0) + +typedef __typeof(sizeof(int)) size_t; +void *mmap(void *, size_t, int, int, int, long); + +void f1() +{ + void *a = mmap(NULL, 16, PROT_READ | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + void *b = mmap(a, 16, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning + void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)a; + (void)b; + (void)c; +} + +void f2() +{ + void *(*callm)(void *, size_t, int, int, int, long); + callm = mmap; + int prot = PROT_WRITE | PROT_EXEC; + (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -0,0 +1,87 @@ +// MmapWriteExecChecker.cpp - Check for the prot argument -===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===--===// +// +// This checker tests the 3rd argument of mmap's calls to check if +// it is writable and executable in the same time. It's somehow +// an optional checker since for example in JIT libraries it is pretty common. +// +//===--===// + +#include "ClangSACheckers.h" + +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; +using llvm::APSInt; + +namespace { +class MmapWriteExecChecker : public Checker { + CallDescription MmapFn; + static int ProtWrite; + static int ProtExec; + static int ProtRead; + mutable std::unique_ptr BT; +public: + MmapWriteExecChecker() : MmapFn("mmap", 6) {} + void checkPreCall(const CallEvent &Call, CheckerContext &C) const; + int ProtExecOv; + int ProtReadOv; +}; +} + +int MmapWriteExecChecker::ProtWrite = 0x02; +int MmapWriteExecChecker::ProtExec = 0x04; +int MmapWriteExecChecker::ProtRead = 0x01; + +void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + if (Call.isCalled(MmapFn)) { +SVal ProtVal = Call.getArgSVal(2); +Optional ProtLoc = ProtVal.getAs(); +int64_t Prot = ProtLoc->getValue().getSExtValue(); +if (ProtExecOv != ProtExec) + ProtExec = ProtExecOv; +if (ProtReadOv != ProtRead) + ProtRead = ProtReadOv; + +// Wrong settings +if (ProtRead == ProtExec) + return; + +if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) { + if (!BT) +BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security")); + + ExplodedNode *N = C.generateNonFatalErrorNode(); + if (!N) +return; + + auto Report = llvm::make_unique( + *BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can " + "lead to exploitable memory regions, which could be overwritten " + "with malicious code", N); + Report->addRange(Call.getA
[PATCH] D43148: Adding msan support for FreeBSD
devnexen created this revision. devnexen added a reviewer: krytarowski. devnexen created this object with visibility "All Users". Herald added subscribers: cfe-commits, emaste. Enabling memory sanitiser for X86_64 arch only. To match the sanitiser counterpart. Repository: rC Clang https://reviews.llvm.org/D43148 Files: FreeBSD.cpp Index: FreeBSD.cpp === --- FreeBSD.cpp +++ FreeBSD.cpp @@ -394,6 +394,8 @@ Res |= SanitizerKind::SafeStack; Res |= SanitizerKind::Fuzzer; Res |= SanitizerKind::FuzzerNoLink; +if (IsX86_64) +Res |= SanitizerKind::Memory; } return Res; } Index: FreeBSD.cpp === --- FreeBSD.cpp +++ FreeBSD.cpp @@ -394,6 +394,8 @@ Res |= SanitizerKind::SafeStack; Res |= SanitizerKind::Fuzzer; Res |= SanitizerKind::FuzzerNoLink; +if (IsX86_64) +Res |= SanitizerKind::Memory; } return Res; } ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43279: Add Xray instrumentation compile-time/link-time support to FreeBSD
devnexen created this revision. devnexen added reviewers: vitalybuka, krytarowski. devnexen created this object with visibility "All Users". Herald added subscribers: cfe-commits, dberris, emaste. Similarly to the GNU driver version, adding proper compile and linker flags. Repository: rC Clang https://reviews.llvm.org/D43279 Files: FreeBSD.cpp Index: FreeBSD.cpp === --- FreeBSD.cpp +++ FreeBSD.cpp @@ -117,6 +117,30 @@ C.addCommand(llvm::make_unique(JA, *this, Exec, CmdArgs, Inputs)); } +static bool addXRayRuntime(const ToolChain &TC, const ArgList &Args, + ArgStringList &CmdArgs) { + if (Args.hasArg(options::OPT_shared)) +return false; + + if (Args.hasFlag(options::OPT_fxray_instrument, + options::OPT_fnoxray_instrument, false)) { +CmdArgs.push_back("-whole-archive"); +CmdArgs.push_back(TC.getCompilerRTArgString(Args, "xray", false)); +CmdArgs.push_back("-no-whole-archive"); +return true; + } + + return false; +} + +static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, +ArgStringList &CmdArgs) { + CmdArgs.push_back("--no-as-needed"); + CmdArgs.push_back("-lpthread"); + CmdArgs.push_back("-lrt"); + CmdArgs.push_back("-lm"); +} + void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, const InputInfo &Output, const InputInfoList &Inputs, @@ -235,6 +259,7 @@ AddGoldPlugin(ToolChain, Args, CmdArgs, D.getLTOMode() == LTOK_Thin, D); bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs); + bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs); AddLinkerInputs(ToolChain, Inputs, Args, CmdArgs, JA); if (!Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) { @@ -249,6 +274,8 @@ } if (NeedsSanitizerDeps) linkSanitizerRuntimeDeps(ToolChain, CmdArgs); +if (NeedsXRayDeps) + linkXRayRuntimeDeps(ToolChain, Args, CmdArgs); // FIXME: For some reason GCC passes -lgcc and -lgcc_s before adding // the default system libraries. Just mimic this for now. if (Args.hasArg(options::OPT_pg)) Index: FreeBSD.cpp === --- FreeBSD.cpp +++ FreeBSD.cpp @@ -117,6 +117,30 @@ C.addCommand(llvm::make_unique(JA, *this, Exec, CmdArgs, Inputs)); } +static bool addXRayRuntime(const ToolChain &TC, const ArgList &Args, + ArgStringList &CmdArgs) { + if (Args.hasArg(options::OPT_shared)) +return false; + + if (Args.hasFlag(options::OPT_fxray_instrument, + options::OPT_fnoxray_instrument, false)) { +CmdArgs.push_back("-whole-archive"); +CmdArgs.push_back(TC.getCompilerRTArgString(Args, "xray", false)); +CmdArgs.push_back("-no-whole-archive"); +return true; + } + + return false; +} + +static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, +ArgStringList &CmdArgs) { + CmdArgs.push_back("--no-as-needed"); + CmdArgs.push_back("-lpthread"); + CmdArgs.push_back("-lrt"); + CmdArgs.push_back("-lm"); +} + void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, const InputInfo &Output, const InputInfoList &Inputs, @@ -235,6 +259,7 @@ AddGoldPlugin(ToolChain, Args, CmdArgs, D.getLTOMode() == LTOK_Thin, D); bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs); + bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs); AddLinkerInputs(ToolChain, Inputs, Args, CmdArgs, JA); if (!Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) { @@ -249,6 +274,8 @@ } if (NeedsSanitizerDeps) linkSanitizerRuntimeDeps(ToolChain, CmdArgs); +if (NeedsXRayDeps) + linkXRayRuntimeDeps(ToolChain, Args, CmdArgs); // FIXME: For some reason GCC passes -lgcc and -lgcc_s before adding // the default system libraries. Just mimic this for now. if (Args.hasArg(options::OPT_pg)) ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43279: Add Xray instrumentation compile-time/link-time support to FreeBSD
devnexen added a comment. Counterpart of the compiler-rt work here https://reviews.llvm.org/D43278 Repository: rC Clang https://reviews.llvm.org/D43279 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43279: Add Xray instrumentation compile-time/link-time support to FreeBSD
devnexen added inline comments. Comment at: FreeBSD.cpp:139 + CmdArgs.push_back("--no-as-needed"); + CmdArgs.push_back("-lpthread"); + CmdArgs.push_back("-lrt"); krytarowski wrote: > `-pthread`? Did not seem needed maybe it s different for NetBSD ? Repository: rC Clang https://reviews.llvm.org/D43279 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43279: Add Xray instrumentation compile-time/link-time support to FreeBSD
devnexen updated this revision to Diff 134244. devnexen added a comment. Changing to pthread flag. https://reviews.llvm.org/D43279 Files: lib/Driver/ToolChains/FreeBSD.cpp Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -117,6 +117,30 @@ C.addCommand(llvm::make_unique(JA, *this, Exec, CmdArgs, Inputs)); } +static bool addXRayRuntime(const ToolChain &TC, const ArgList &Args, + ArgStringList &CmdArgs) { + if (Args.hasArg(options::OPT_shared)) +return false; + + if (Args.hasFlag(options::OPT_fxray_instrument, + options::OPT_fnoxray_instrument, false)) { +CmdArgs.push_back("-whole-archive"); +CmdArgs.push_back(TC.getCompilerRTArgString(Args, "xray", false)); +CmdArgs.push_back("-no-whole-archive"); +return true; + } + + return false; +} + +static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, +ArgStringList &CmdArgs) { + CmdArgs.push_back("--no-as-needed"); + CmdArgs.push_back("-pthread"); + CmdArgs.push_back("-lrt"); + CmdArgs.push_back("-lm"); +} + void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, const InputInfo &Output, const InputInfoList &Inputs, @@ -235,6 +259,7 @@ AddGoldPlugin(ToolChain, Args, CmdArgs, D.getLTOMode() == LTOK_Thin, D); bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs); + bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs); AddLinkerInputs(ToolChain, Inputs, Args, CmdArgs, JA); if (!Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) { @@ -249,6 +274,8 @@ } if (NeedsSanitizerDeps) linkSanitizerRuntimeDeps(ToolChain, CmdArgs); +if (NeedsXRayDeps) + linkXRayRuntimeDeps(ToolChain, Args, CmdArgs); // FIXME: For some reason GCC passes -lgcc and -lgcc_s before adding // the default system libraries. Just mimic this for now. if (Args.hasArg(options::OPT_pg)) Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -117,6 +117,30 @@ C.addCommand(llvm::make_unique(JA, *this, Exec, CmdArgs, Inputs)); } +static bool addXRayRuntime(const ToolChain &TC, const ArgList &Args, + ArgStringList &CmdArgs) { + if (Args.hasArg(options::OPT_shared)) +return false; + + if (Args.hasFlag(options::OPT_fxray_instrument, + options::OPT_fnoxray_instrument, false)) { +CmdArgs.push_back("-whole-archive"); +CmdArgs.push_back(TC.getCompilerRTArgString(Args, "xray", false)); +CmdArgs.push_back("-no-whole-archive"); +return true; + } + + return false; +} + +static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, +ArgStringList &CmdArgs) { + CmdArgs.push_back("--no-as-needed"); + CmdArgs.push_back("-pthread"); + CmdArgs.push_back("-lrt"); + CmdArgs.push_back("-lm"); +} + void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, const InputInfo &Output, const InputInfoList &Inputs, @@ -235,6 +259,7 @@ AddGoldPlugin(ToolChain, Args, CmdArgs, D.getLTOMode() == LTOK_Thin, D); bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs); + bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs); AddLinkerInputs(ToolChain, Inputs, Args, CmdArgs, JA); if (!Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) { @@ -249,6 +274,8 @@ } if (NeedsSanitizerDeps) linkSanitizerRuntimeDeps(ToolChain, CmdArgs); +if (NeedsXRayDeps) + linkXRayRuntimeDeps(ToolChain, Args, CmdArgs); // FIXME: For some reason GCC passes -lgcc and -lgcc_s before adding // the default system libraries. Just mimic this for now. if (Args.hasArg(options::OPT_pg)) ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43148: Adding msan support for FreeBSD
devnexen updated this revision to Diff 134331. https://reviews.llvm.org/D43148 Files: lib/Driver/ToolChains/FreeBSD.cpp Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -397,5 +424,7 @@ Res |= SanitizerKind::Fuzzer; Res |= SanitizerKind::FuzzerNoLink; } + if (IsX86_64) +Res |= SanitizerKind::Memory; return Res; } Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -397,5 +424,7 @@ Res |= SanitizerKind::Fuzzer; Res |= SanitizerKind::FuzzerNoLink; } + if (IsX86_64) +Res |= SanitizerKind::Memory; return Res; } ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen created this revision. devnexen added reviewers: krytarowski, vitalybuka, dberris. devnexen created this object with visibility "All Users". Herald added subscribers: cfe-commits, emaste. devnexen edited the summary of this revision. -pthread was into linkage step. -Warning about the -fxray-instrument usage outside of the working cases. Repository: rC Clang https://reviews.llvm.org/D43378 Files: lib/Driver/ToolChains/FreeBSD.cpp lib/Driver/XRayArgs.cpp Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,7 +49,13 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { +D.Diag(diag::err_drv_clang_unsupported) +<< (std::string(XRayInstrumentOption) + " only on " +"FreeBSD x86_64"); +} +} else D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); XRayInstrument = true; Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -124,6 +124,7 @@ if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { +CmdArgs.push_back("-pthread"); CmdArgs.push_back("-whole-archive"); CmdArgs.push_back(TC.getCompilerRTArgString(Args, "xray", false)); CmdArgs.push_back("-no-whole-archive"); @@ -136,7 +137,6 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); } Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,7 +49,13 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { +D.Diag(diag::err_drv_clang_unsupported) +<< (std::string(XRayInstrumentOption) + " only on " +"FreeBSD x86_64"); +} +} else D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); XRayInstrument = true; Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -124,6 +124,7 @@ if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { +CmdArgs.push_back("-pthread"); CmdArgs.push_back("-whole-archive"); CmdArgs.push_back(TC.getCompilerRTArgString(Args, "xray", false)); CmdArgs.push_back("-no-whole-archive"); @@ -136,7 +137,6 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); } ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen updated this revision to Diff 134586. devnexen edited the summary of this revision. https://reviews.llvm.org/D43378 Files: lib/Driver/ToolChains/FreeBSD.cpp lib/Driver/XRayArgs.cpp Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,7 +49,13 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { +D.Diag(diag::err_drv_clang_unsupported) +<< (std::string(XRayInstrumentOption) + " only on " +"FreeBSD x86_64"); +} +} else D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); XRayInstrument = true; Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -136,9 +136,9 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); + CmdArgs.push_back("-lpthread"); } void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,7 +49,13 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { +D.Diag(diag::err_drv_clang_unsupported) +<< (std::string(XRayInstrumentOption) + " only on " +"FreeBSD x86_64"); +} +} else D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); XRayInstrument = true; Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -136,9 +136,9 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); + CmdArgs.push_back("-lpthread"); } void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen updated this revision to Diff 134605. devnexen added a comment. Updating the warning messages. https://reviews.llvm.org/D43378 Files: lib/Driver/ToolChains/FreeBSD.cpp lib/Driver/XRayArgs.cpp Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,9 +49,15 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { +D.Diag(diag::err_drv_clang_unsupported) +<< (std::string(XRayInstrumentOption) + " only on " +"FreeBSD supported architectures"); +} +} else D.Diag(diag::err_drv_clang_unsupported) - << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); + << (std::string(XRayInstrumentOption) + " on non-supported target OS"); XRayInstrument = true; if (const Arg *A = Args.getLastArg(options::OPT_fxray_instruction_threshold_, Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -136,9 +136,9 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); + CmdArgs.push_back("-lpthread"); } void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,9 +49,15 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { +D.Diag(diag::err_drv_clang_unsupported) +<< (std::string(XRayInstrumentOption) + " only on " +"FreeBSD supported architectures"); +} +} else D.Diag(diag::err_drv_clang_unsupported) - << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); + << (std::string(XRayInstrumentOption) + " on non-supported target OS"); XRayInstrument = true; if (const Arg *A = Args.getLastArg(options::OPT_fxray_instruction_threshold_, Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -136,9 +136,9 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); + CmdArgs.push_back("-lpthread"); } void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen added inline comments. Comment at: lib/Driver/XRayArgs.cpp:56 +<< (std::string(XRayInstrumentOption) + " only on " +"FreeBSD x86_64"); +} krytarowski wrote: > krytarowski wrote: > > I think it's better to not hardcode `x86_64` here in a message, we will > > need change it with new CPUs. > I think we can reuse the existing above code here as well: > > `<< (std::string(XRayInstrumentOption) + " on " + Triple.str());` True https://reviews.llvm.org/D43378 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen updated this revision to Diff 134622. devnexen added a comment. Reusing generic message/reformating. https://reviews.llvm.org/D43378 Files: lib/Driver/ToolChains/FreeBSD.cpp lib/Driver/XRayArgs.cpp Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,9 +49,15 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { + D.Diag(diag::err_drv_clang_unsupported) + << (std::string(XRayInstrumentOption) + " on " + Triple.str()); +} +} else { D.Diag(diag::err_drv_clang_unsupported) - << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); + << (std::string(XRayInstrumentOption) + " on non-supported target OS"); +} XRayInstrument = true; if (const Arg *A = Args.getLastArg(options::OPT_fxray_instruction_threshold_, Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -136,9 +136,9 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); + CmdArgs.push_back("-lpthread"); } void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,9 +49,15 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { + D.Diag(diag::err_drv_clang_unsupported) + << (std::string(XRayInstrumentOption) + " on " + Triple.str()); +} +} else { D.Diag(diag::err_drv_clang_unsupported) - << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); + << (std::string(XRayInstrumentOption) + " on non-supported target OS"); +} XRayInstrument = true; if (const Arg *A = Args.getLastArg(options::OPT_fxray_instruction_threshold_, Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -136,9 +136,9 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); + CmdArgs.push_back("-lpthread"); } void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen updated this revision to Diff 134628. devnexen added a comment. Herald added a subscriber: srhines. Enabling one test for FreeBSD https://reviews.llvm.org/D43378 Files: lib/Driver/ToolChains/FreeBSD.cpp lib/Driver/XRayArgs.cpp test/Driver/XRay/lit.local.cfg test/Driver/XRay/xray-shared-noxray.cpp Index: test/Driver/XRay/xray-shared-noxray.cpp === --- test/Driver/XRay/xray-shared-noxray.cpp +++ test/Driver/XRay/xray-shared-noxray.cpp @@ -8,7 +8,7 @@ // SHARED-NOT: {{clang_rt\.xray-}} // STATIC: {{clang_rt\.xray-}} // -// REQUIRES: linux, enable_shared +// REQUIRES: enable_shared int foo() { return 42; } #ifdef MAIN Index: test/Driver/XRay/lit.local.cfg === --- test/Driver/XRay/lit.local.cfg +++ test/Driver/XRay/lit.local.cfg @@ -1,23 +1,24 @@ +import platform target_triple_components = config.target_triple.split('-') config.available_features.update(target_triple_components) # Only run the tests in platforms where XRay instrumentation is supported. supported_targets = [ 'x86_64', 'x86_64h', 'arm', 'aarch64', 'arm64', 'powerpc64le', 'mips', -'mipsel', 'mips64', 'mips64el' +'mipsel', 'mips64', 'mips64el', 'amd64' ] # Only on platforms we support. supported_oses = [ -'linux' +'Linux', 'FreeBSD' ] triple_set = set(target_triple_components) if len(triple_set.intersection(supported_targets)) == 0: config.unsupported = True # Do not run for 'android' despite being linux. -if len(triple_set.intersection(supported_oses)) == 0 or 'android' in triple_set: +if platform.system() not in supported_oses or 'android' in triple_set: config.unsupported = True if config.enable_shared: Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,9 +49,15 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { + D.Diag(diag::err_drv_clang_unsupported) + << (std::string(XRayInstrumentOption) + " on " + Triple.str()); +} +} else { D.Diag(diag::err_drv_clang_unsupported) - << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); + << (std::string(XRayInstrumentOption) + " on non-supported target OS"); +} XRayInstrument = true; if (const Arg *A = Args.getLastArg(options::OPT_fxray_instruction_threshold_, Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -136,9 +136,9 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); + CmdArgs.push_back("-lpthread"); } void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, Index: test/Driver/XRay/xray-shared-noxray.cpp === --- test/Driver/XRay/xray-shared-noxray.cpp +++ test/Driver/XRay/xray-shared-noxray.cpp @@ -8,7 +8,7 @@ // SHARED-NOT: {{clang_rt\.xray-}} // STATIC: {{clang_rt\.xray-}} // -// REQUIRES: linux, enable_shared +// REQUIRES: enable_shared int foo() { return 42; } #ifdef MAIN Index: test/Driver/XRay/lit.local.cfg === --- test/Driver/XRay/lit.local.cfg +++ test/Driver/XRay/lit.local.cfg @@ -1,23 +1,24 @@ +import platform target_triple_components = config.target_triple.split('-') config.available_features.update(target_triple_components) # Only run the tests in platforms where XRay instrumentation is supported. supported_targets = [ 'x86_64', 'x86_64h', 'arm', 'aarch64', 'arm64', 'powerpc64le', 'mips', -'mipsel', 'mips64', 'mips64el' +'mipsel', 'mips64', 'mips64el', 'amd64' ] # Only on platforms we support. supported_oses = [ -'linux' +'Linux', 'FreeBSD' ] triple_set = set(target_triple_components) if len(triple_set.intersection(supported_targets)) == 0: config.unsupported = True # Do not run for 'android' despite being linux. -if len(triple_set.intersection(suppo
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen updated this revision to Diff 134634. https://reviews.llvm.org/D43378 Files: lib/Driver/ToolChains/FreeBSD.cpp lib/Driver/XRayArgs.cpp test/Driver/XRay/lit.local.cfg test/Driver/XRay/xray-instrument-os.c test/Driver/XRay/xray-shared-noxray.cpp Index: test/Driver/XRay/xray-shared-noxray.cpp === --- test/Driver/XRay/xray-shared-noxray.cpp +++ test/Driver/XRay/xray-shared-noxray.cpp @@ -8,7 +8,7 @@ // SHARED-NOT: {{clang_rt\.xray-}} // STATIC: {{clang_rt\.xray-}} // -// REQUIRES: linux, enable_shared +// REQUIRES: enable_shared int foo() { return 42; } #ifdef MAIN Index: test/Driver/XRay/xray-instrument-os.c === --- test/Driver/XRay/xray-instrument-os.c +++ test/Driver/XRay/xray-instrument-os.c @@ -1,4 +1,4 @@ // RUN: not %clang -o /dev/null -v -fxray-instrument -c %s -// XFAIL: -linux- +// REQUIRES: linux // REQUIRES-ANY: amd64, x86_64, x86_64h, arm, aarch64, arm64 typedef int a; Index: test/Driver/XRay/lit.local.cfg === --- test/Driver/XRay/lit.local.cfg +++ test/Driver/XRay/lit.local.cfg @@ -1,23 +1,24 @@ +import platform target_triple_components = config.target_triple.split('-') config.available_features.update(target_triple_components) # Only run the tests in platforms where XRay instrumentation is supported. supported_targets = [ 'x86_64', 'x86_64h', 'arm', 'aarch64', 'arm64', 'powerpc64le', 'mips', -'mipsel', 'mips64', 'mips64el' +'mipsel', 'mips64', 'mips64el', 'amd64' ] # Only on platforms we support. supported_oses = [ -'linux' +'Linux', 'FreeBSD' ] triple_set = set(target_triple_components) if len(triple_set.intersection(supported_targets)) == 0: config.unsupported = True # Do not run for 'android' despite being linux. -if len(triple_set.intersection(supported_oses)) == 0 or 'android' in triple_set: +if platform.system() not in supported_oses or 'android' in triple_set: config.unsupported = True if config.enable_shared: Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,9 +49,15 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { + D.Diag(diag::err_drv_clang_unsupported) + << (std::string(XRayInstrumentOption) + " on " + Triple.str()); +} +} else { D.Diag(diag::err_drv_clang_unsupported) - << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); + << (std::string(XRayInstrumentOption) + " on non-supported target OS"); +} XRayInstrument = true; if (const Arg *A = Args.getLastArg(options::OPT_fxray_instruction_threshold_, Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -136,9 +136,9 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); + CmdArgs.push_back("-lpthread"); } void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen added inline comments. Comment at: lib/Driver/XRayArgs.cpp:54 +if (Triple.getArch() != llvm::Triple::x86_64) { + D.Diag(diag::err_drv_clang_unsupported) + << (std::string(XRayInstrumentOption) + " on " + Triple.str()); krytarowski wrote: > Missing: > > ``` > break; > default: > ``` It s a simple if above https://reviews.llvm.org/D43378 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D42645: New simple Checker for mmap calls
devnexen added a comment. ping Repository: rC Clang https://reviews.llvm.org/D42645 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen updated this revision to Diff 134659. https://reviews.llvm.org/D43378 Files: lib/Driver/ToolChains/FreeBSD.cpp lib/Driver/XRayArgs.cpp test/Driver/XRay/lit.local.cfg test/Driver/XRay/xray-instrument-os.c test/Driver/XRay/xray-shared-noxray.cpp Index: lib/Driver/XRayArgs.cpp === --- lib/Driver/XRayArgs.cpp +++ lib/Driver/XRayArgs.cpp @@ -34,7 +34,7 @@ const llvm::Triple &Triple = TC.getTriple(); if (Args.hasFlag(options::OPT_fxray_instrument, options::OPT_fnoxray_instrument, false)) { -if (Triple.getOS() == llvm::Triple::Linux) +if (Triple.getOS() == llvm::Triple::Linux) { switch (Triple.getArch()) { case llvm::Triple::x86_64: case llvm::Triple::arm: @@ -49,9 +49,15 @@ D.Diag(diag::err_drv_clang_unsupported) << (std::string(XRayInstrumentOption) + " on " + Triple.str()); } -else +} else if (Triple.getOS() == llvm::Triple::FreeBSD) { +if (Triple.getArch() != llvm::Triple::x86_64) { + D.Diag(diag::err_drv_clang_unsupported) + << (std::string(XRayInstrumentOption) + " on " + Triple.str()); +} +} else { D.Diag(diag::err_drv_clang_unsupported) - << (std::string(XRayInstrumentOption) + " on non-Linux target OS"); + << (std::string(XRayInstrumentOption) + " on non-supported target OS"); +} XRayInstrument = true; if (const Arg *A = Args.getLastArg(options::OPT_fxray_instruction_threshold_, Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -136,9 +136,9 @@ static void linkXRayRuntimeDeps(const ToolChain &TC, const ArgList &Args, ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); - CmdArgs.push_back("-pthread"); CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); + CmdArgs.push_back("-lpthread"); } void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA, Index: test/Driver/XRay/xray-shared-noxray.cpp === --- test/Driver/XRay/xray-shared-noxray.cpp +++ test/Driver/XRay/xray-shared-noxray.cpp @@ -8,7 +8,7 @@ // SHARED-NOT: {{clang_rt\.xray-}} // STATIC: {{clang_rt\.xray-}} // -// REQUIRES: linux, enable_shared +// REQUIRES: enable_shared int foo() { return 42; } #ifdef MAIN Index: test/Driver/XRay/xray-instrument-os.c === --- test/Driver/XRay/xray-instrument-os.c +++ test/Driver/XRay/xray-instrument-os.c @@ -1,4 +1,4 @@ // RUN: not %clang -o /dev/null -v -fxray-instrument -c %s -// XFAIL: -linux- +// REQUIRES: linux // REQUIRES-ANY: amd64, x86_64, x86_64h, arm, aarch64, arm64 typedef int a; Index: test/Driver/XRay/lit.local.cfg === --- test/Driver/XRay/lit.local.cfg +++ test/Driver/XRay/lit.local.cfg @@ -1,23 +1,24 @@ +import platform target_triple_components = config.target_triple.split('-') config.available_features.update(target_triple_components) # Only run the tests in platforms where XRay instrumentation is supported. supported_targets = [ -'x86_64', 'x86_64h', 'arm', 'aarch64', 'arm64', 'powerpc64le', 'mips', +'amd64', 'x86_64', 'x86_64h', 'arm', 'aarch64', 'arm64', 'powerpc64le', 'mips', 'mipsel', 'mips64', 'mips64el' ] # Only on platforms we support. supported_oses = [ -'linux' +'Linux', 'FreeBSD' ] triple_set = set(target_triple_components) if len(triple_set.intersection(supported_targets)) == 0: config.unsupported = True # Do not run for 'android' despite being linux. -if len(triple_set.intersection(supported_oses)) == 0 or 'android' in triple_set: +if platform.system() not in supported_oses or 'android' in triple_set: config.unsupported = True if config.enable_shared: ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43378: FreeBSD driver / Xray flags moving pthread to compile flags.
devnexen added a comment. In https://reviews.llvm.org/D43378#1010464, @emaste wrote: > LGTM with one small note. > > What will it take for us to enable this on the rest of the platforms > Clang/FreeBSD supports? As I see only x86_64 arch implements everything (e.g. custom event), making things easier maybe. arm family might be enabled, power pc might need to rewrite as x86_64 arch some linux-ism ... might be doable in a timely manner I'd say (to take with a grain of salt though). https://reviews.llvm.org/D43378 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D42645: New simple Checker for mmap calls
devnexen updated this revision to Diff 135027. devnexen added a comment. Moving back the checker to alpha.security level. https://reviews.llvm.org/D42645 Files: include/clang/StaticAnalyzer/Checkers/Checkers.td lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -0,0 +1,36 @@ +// RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=security.MmapWriteExec -analyzer-config security.MmapWriteExec:MmapProtExec=1 -analyzer-config security.MmapWriteExec:MmapProtRead=4 -DUSE_ALTERNATIVE_PROT_EXEC_DEFINITION -verify %s +// RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=security.MmapWriteExec -verify %s + +#define PROT_WRITE 0x02 +#ifndef USE_ALTERNATIVE_PROT_EXEC_DEFINITION +#define PROT_EXEC 0x04 +#define PROT_READ 0x01 +#else +#define PROT_EXEC 0x01 +#define PROT_READ 0x04 +#endif +#define MAP_PRIVATE 0x0002 +#define MAP_ANON0x1000 +#define MAP_FIXED 0x0010 +#define NULL((void *)0) + +typedef __typeof(sizeof(int)) size_t; +void *mmap(void *, size_t, int, int, int, long); + +void f1() +{ + void *a = mmap(NULL, 16, PROT_READ | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + void *b = mmap(a, 16, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning + void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)a; + (void)b; + (void)c; +} + +void f2() +{ + void *(*callm)(void *, size_t, int, int, int, long); + callm = mmap; + int prot = PROT_WRITE | PROT_EXEC; + (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -0,0 +1,87 @@ +// MmapWriteExecChecker.cpp - Check for the prot argument -===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===--===// +// +// This checker tests the 3rd argument of mmap's calls to check if +// it is writable and executable in the same time. It's somehow +// an optional checker since for example in JIT libraries it is pretty common. +// +//===--===// + +#include "ClangSACheckers.h" + +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; +using llvm::APSInt; + +namespace { +class MmapWriteExecChecker : public Checker { + CallDescription MmapFn; + static int ProtWrite; + static int ProtExec; + static int ProtRead; + mutable std::unique_ptr BT; +public: + MmapWriteExecChecker() : MmapFn("mmap", 6) {} + void checkPreCall(const CallEvent &Call, CheckerContext &C) const; + int ProtExecOv; + int ProtReadOv; +}; +} + +int MmapWriteExecChecker::ProtWrite = 0x02; +int MmapWriteExecChecker::ProtExec = 0x04; +int MmapWriteExecChecker::ProtRead = 0x01; + +void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + if (Call.isCalled(MmapFn)) { +SVal ProtVal = Call.getArgSVal(2); +Optional ProtLoc = ProtVal.getAs(); +int64_t Prot = ProtLoc->getValue().getSExtValue(); +if (ProtExecOv != ProtExec) + ProtExec = ProtExecOv; +if (ProtReadOv != ProtRead) + ProtRead = ProtReadOv; + +// Wrong settings +if (ProtRead == ProtExec) + return; + +if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) { + if (!BT) +BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security")); + + ExplodedNode *N = C.generateNonFatalErrorNode(); + if (!N) +return; + + auto Report = llvm::make_unique( + *BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can " + "lead to exploitable memory regions, which could be overwritten " + "with m
[PATCH] D42645: New simple Checker for mmap calls
devnexen updated this revision to Diff 135067. devnexen added a comment. Updating tests accordingly https://reviews.llvm.org/D42645 Files: include/clang/StaticAnalyzer/Checkers/Checkers.td lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -0,0 +1,36 @@ +// RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=alpha.security.MmapWriteExec -analyzer-config alpha.security.MmapWriteExec:MmapProtExec=1 -analyzer-config alpha.security.MmapWriteExec:MmapProtRead=4 -DUSE_ALTERNATIVE_PROT_EXEC_DEFINITION -verify %s +// RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=alpha.security.MmapWriteExec -verify %s + +#define PROT_WRITE 0x02 +#ifndef USE_ALTERNATIVE_PROT_EXEC_DEFINITION +#define PROT_EXEC 0x04 +#define PROT_READ 0x01 +#else +#define PROT_EXEC 0x01 +#define PROT_READ 0x04 +#endif +#define MAP_PRIVATE 0x0002 +#define MAP_ANON0x1000 +#define MAP_FIXED 0x0010 +#define NULL((void *)0) + +typedef __typeof(sizeof(int)) size_t; +void *mmap(void *, size_t, int, int, int, long); + +void f1() +{ + void *a = mmap(NULL, 16, PROT_READ | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + void *b = mmap(a, 16, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning + void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)a; + (void)b; + (void)c; +} + +void f2() +{ + void *(*callm)(void *, size_t, int, int, int, long); + callm = mmap; + int prot = PROT_WRITE | PROT_EXEC; + (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} +} Index: include/clang/StaticAnalyzer/Checkers/Checkers.td === --- include/clang/StaticAnalyzer/Checkers/Checkers.td +++ include/clang/StaticAnalyzer/Checkers/Checkers.td @@ -414,6 +414,13 @@ HelpText<"Check for overflows in the arguments to malloc()">, DescFile<"MallocOverflowSecurityChecker.cpp">; +// Operating systems specific PROT_READ/PROT_WRITE values is not implemented, +// thus ought to be overriden with the proper analyser-config variables +// remain in alpha until the state changes +def MmapWriteExecChecker : Checker<"MmapWriteExec">, + HelpText<"Warn on mmap() calls that are both writable and executable">, + DescFile<"MmapWriteExecChecker.cpp">; + } // end "alpha.security" //===--===// Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -0,0 +1,87 @@ +// MmapWriteExecChecker.cpp - Check for the prot argument -===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===--===// +// +// This checker tests the 3rd argument of mmap's calls to check if +// it is writable and executable in the same time. It's somehow +// an optional checker since for example in JIT libraries it is pretty common. +// +//===--===// + +#include "ClangSACheckers.h" + +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; +using llvm::APSInt; + +namespace { +class MmapWriteExecChecker : public Checker { + CallDescription MmapFn; + static int ProtWrite; + static int ProtExec; + static int ProtRead; + mutable std::unique_ptr BT; +public: + MmapWriteExecChecker() : MmapFn("mmap", 6) {} + void checkPreCall(const CallEvent &Call, CheckerContext &C) const; + int ProtExecOv; + int ProtReadOv; +}; +} + +int MmapWriteExecChecker::ProtWrite = 0x02; +int MmapWriteExecChecker::ProtExec = 0x04; +int MmapWriteExecChecker::ProtRead = 0x01; + +void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + if (Ca
[PATCH] D42645: New simple Checker for mmap calls
devnexen added inline comments. Comment at: include/clang/StaticAnalyzer/Checkers/Checkers.td:417-419 +// Operating systems specific PROT_READ/PROT_WRITE values is not implemented, +// thus ought to be overriden with the proper analyser-config variables +// remain in alpha until the state changes emaste wrote: > I'm a bit confused by this comment; this checker works as-is for most common > operating system cases, correct? Most of them yes, at least Muslc linux most of glibc I tested too. Not to mention *BSD ... But might be safer to put it as alpha for a start. Comment at: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp:64 + if (!BT) +BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security")); + emaste wrote: > `Write & Exec` (or `Write and Exec`) perhaps (assuming it doesn't become > over-long then)? I kept short intentionally indeed we can always change but the user in order to use it needs to enable it willingly so I assumed the user might know enough about the topic in question. https://reviews.llvm.org/D42645 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D42645: New simple Checker for mmap calls
devnexen added inline comments. Comment at: include/clang/StaticAnalyzer/Checkers/Checkers.td:417-419 +// Operating systems specific PROT_READ/PROT_WRITE values is not implemented, +// thus ought to be overriden with the proper analyser-config variables +// remain in alpha until the state changes emaste wrote: > devnexen wrote: > > emaste wrote: > > > I'm a bit confused by this comment; this checker works as-is for most > > > common operating system cases, correct? > > Most of them yes, at least Muslc linux most of glibc I tested too. Not to > > mention *BSD ... But might be safer to put it as alpha for a start. > OK - to me it implies that the checker only works (anywhere) if the user > provides the flag values. Maybe something like "the defaults are correct for > several common operating systems, but may need to be overridden " Fair point, I ll rephrase a bit. https://reviews.llvm.org/D42645 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D42645: New simple Checker for mmap calls
devnexen updated this revision to Diff 135258. devnexen added a comment. Rephrasing Checkers.td comment https://reviews.llvm.org/D42645 Files: include/clang/StaticAnalyzer/Checkers/Checkers.td lib/StaticAnalyzer/Checkers/CMakeLists.txt lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -0,0 +1,36 @@ +// RUN: %clang_analyze_cc1 -triple i686-unknown-linux -analyzer-checker=alpha.security.MmapWriteExec -analyzer-config alpha.security.MmapWriteExec:MmapProtExec=1 -analyzer-config alpha.security.MmapWriteExec:MmapProtRead=4 -DUSE_ALTERNATIVE_PROT_EXEC_DEFINITION -verify %s +// RUN: %clang_analyze_cc1 -triple x86_64-unknown-apple-darwin10 -analyzer-checker=alpha.security.MmapWriteExec -verify %s + +#define PROT_WRITE 0x02 +#ifndef USE_ALTERNATIVE_PROT_EXEC_DEFINITION +#define PROT_EXEC 0x04 +#define PROT_READ 0x01 +#else +#define PROT_EXEC 0x01 +#define PROT_READ 0x04 +#endif +#define MAP_PRIVATE 0x0002 +#define MAP_ANON0x1000 +#define MAP_FIXED 0x0010 +#define NULL((void *)0) + +typedef __typeof(sizeof(int)) size_t; +void *mmap(void *, size_t, int, int, int, long); + +void f1() +{ + void *a = mmap(NULL, 16, PROT_READ | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + void *b = mmap(a, 16, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANON, -1, 0); // no-warning + void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)a; + (void)b; + (void)c; +} + +void f2() +{ + void *(*callm)(void *, size_t, int, int, int, long); + callm = mmap; + int prot = PROT_WRITE | PROT_EXEC; + (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -0,0 +1,87 @@ +// MmapWriteExecChecker.cpp - Check for the prot argument -===// +// +// The LLVM Compiler Infrastructure +// +// This file is distributed under the University of Illinois Open Source +// License. See LICENSE.TXT for details. +// +//===--===// +// +// This checker tests the 3rd argument of mmap's calls to check if +// it is writable and executable in the same time. It's somehow +// an optional checker since for example in JIT libraries it is pretty common. +// +//===--===// + +#include "ClangSACheckers.h" + +#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" +#include "clang/StaticAnalyzer/Core/Checker.h" +#include "clang/StaticAnalyzer/Core/CheckerManager.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" + +using namespace clang; +using namespace ento; +using llvm::APSInt; + +namespace { +class MmapWriteExecChecker : public Checker { + CallDescription MmapFn; + static int ProtWrite; + static int ProtExec; + static int ProtRead; + mutable std::unique_ptr BT; +public: + MmapWriteExecChecker() : MmapFn("mmap", 6) {} + void checkPreCall(const CallEvent &Call, CheckerContext &C) const; + int ProtExecOv; + int ProtReadOv; +}; +} + +int MmapWriteExecChecker::ProtWrite = 0x02; +int MmapWriteExecChecker::ProtExec = 0x04; +int MmapWriteExecChecker::ProtRead = 0x01; + +void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, + CheckerContext &C) const { + if (Call.isCalled(MmapFn)) { +SVal ProtVal = Call.getArgSVal(2); +Optional ProtLoc = ProtVal.getAs(); +int64_t Prot = ProtLoc->getValue().getSExtValue(); +if (ProtExecOv != ProtExec) + ProtExec = ProtExecOv; +if (ProtReadOv != ProtRead) + ProtRead = ProtReadOv; + +// Wrong settings +if (ProtRead == ProtExec) + return; + +if ((Prot & (ProtWrite | ProtExec)) == (ProtWrite | ProtExec)) { + if (!BT) +BT.reset(new BugType(this, "W^X check fails, Write Exec prot flags set", "Security")); + + ExplodedNode *N = C.generateNonFatalErrorNode(); + if (!N) +return; + + auto Report = llvm::make_unique( + *BT, "Both PROT_WRITE and PROT_EXEC flags are set. This can " + "lead to exploitable memory regions, which could be overwritten " + "
[PATCH] D41809: Clang counterpart change for buzzer FreeBSD support
devnexen created this revision. Herald added subscribers: cfe-commits, emaste. Repository: rC Clang https://reviews.llvm.org/D41809 Files: lib/Driver/ToolChains/FreeBSD.cpp Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -386,6 +386,8 @@ SanitizerMask Res = ToolChain::getSupportedSanitizers(); Res |= SanitizerKind::Address; Res |= SanitizerKind::Vptr; + Res |= SanitizerKind::Fuzzer; + Res |= SanitizerKind::FuzzerNoLink; if (IsX86_64 || IsMIPS64) { Res |= SanitizerKind::Leak; Res |= SanitizerKind::Thread; Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -386,6 +386,8 @@ SanitizerMask Res = ToolChain::getSupportedSanitizers(); Res |= SanitizerKind::Address; Res |= SanitizerKind::Vptr; + Res |= SanitizerKind::Fuzzer; + Res |= SanitizerKind::FuzzerNoLink; if (IsX86_64 || IsMIPS64) { Res |= SanitizerKind::Leak; Res |= SanitizerKind::Thread; ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D41809: Clang counterpart change for fuzzer FreeBSD support
devnexen updated this revision to Diff 129329. https://reviews.llvm.org/D41809 Files: lib/Driver/ToolChains/FreeBSD.cpp Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -392,6 +392,8 @@ } if (IsX86 || IsX86_64) { Res |= SanitizerKind::SafeStack; +Res |= SanitizerKind::Fuzzer; +Res |= SanitizerKind::FuzzerNoLink; } return Res; } Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -392,6 +392,8 @@ } if (IsX86 || IsX86_64) { Res |= SanitizerKind::SafeStack; +Res |= SanitizerKind::Fuzzer; +Res |= SanitizerKind::FuzzerNoLink; } return Res; } ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D41809: Clang counterpart change for fuzzer FreeBSD support
devnexen updated this revision to Diff 129364. https://reviews.llvm.org/D41809 Files: lib/Driver/ToolChains/FreeBSD.cpp Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -392,6 +392,8 @@ } if (IsX86 || IsX86_64) { Res |= SanitizerKind::SafeStack; +Res |= SanitizerKind::Fuzzer; +Res |= SanitizerKind::FuzzerNoLink; } return Res; } Index: lib/Driver/ToolChains/FreeBSD.cpp === --- lib/Driver/ToolChains/FreeBSD.cpp +++ lib/Driver/ToolChains/FreeBSD.cpp @@ -392,6 +392,8 @@ } if (IsX86 || IsX86_64) { Res |= SanitizerKind::SafeStack; +Res |= SanitizerKind::Fuzzer; +Res |= SanitizerKind::FuzzerNoLink; } return Res; } ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43818: Better OpenBSD frontend support
devnexen created this revision. devnexen created this object with visibility "All Users". Herald added subscribers: cfe-commits, krytarowski. devnexen added reviewers: dlj, krytarowski. - Like other *BSD, conditioning certain flags to pass - To prepare future OpenBSD sanitisers. Repository: rC Clang https://reviews.llvm.org/D43818 Files: lib/Driver/ToolChain.cpp lib/Driver/ToolChains/CommonArgs.cpp lib/Driver/ToolChains/Gnu.cpp Index: lib/Driver/ToolChains/Gnu.cpp === --- lib/Driver/ToolChains/Gnu.cpp +++ lib/Driver/ToolChains/Gnu.cpp @@ -242,11 +242,13 @@ ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); CmdArgs.push_back("-lpthread"); - CmdArgs.push_back("-lrt"); + if (TC.getTriple().getOS() != llvm::Triple::OpenBSD) +CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); if (TC.getTriple().getOS() != llvm::Triple::FreeBSD && - TC.getTriple().getOS() != llvm::Triple::NetBSD) + TC.getTriple().getOS() != llvm::Triple::NetBSD && + TC.getTriple().getOS() != llvm::Triple::OpenBSD) CmdArgs.push_back("-ldl"); } Index: lib/Driver/ToolChains/CommonArgs.cpp === --- lib/Driver/ToolChains/CommonArgs.cpp +++ lib/Driver/ToolChains/CommonArgs.cpp @@ -542,16 +542,19 @@ // There's no libpthread or librt on RTEMS. if (TC.getTriple().getOS() != llvm::Triple::RTEMS) { CmdArgs.push_back("-lpthread"); -CmdArgs.push_back("-lrt"); +if (TC.getTriple().getOS() != llvm::Triple::OpenBSD) + CmdArgs.push_back("-lrt"); } CmdArgs.push_back("-lm"); // There's no libdl on all OSes. if (TC.getTriple().getOS() != llvm::Triple::FreeBSD && TC.getTriple().getOS() != llvm::Triple::NetBSD && + TC.getTriple().getOS() != llvm::Triple::OpenBSD && TC.getTriple().getOS() != llvm::Triple::RTEMS) CmdArgs.push_back("-ldl"); // Required for backtrace on some OSes if (TC.getTriple().getOS() == llvm::Triple::NetBSD || + TC.getTriple().getOS() == llvm::Triple::OpenBSD || TC.getTriple().getOS() == llvm::Triple::FreeBSD) CmdArgs.push_back("-lexecinfo"); } Index: lib/Driver/ToolChain.cpp === --- lib/Driver/ToolChain.cpp +++ lib/Driver/ToolChain.cpp @@ -327,6 +327,8 @@ switch (Triple.getOS()) { case llvm::Triple::FreeBSD: return "freebsd"; + case llvm::Triple::OpenBSD: +return "openbsd"; case llvm::Triple::Solaris: return "sunos"; default: Index: lib/Driver/ToolChains/Gnu.cpp === --- lib/Driver/ToolChains/Gnu.cpp +++ lib/Driver/ToolChains/Gnu.cpp @@ -242,11 +242,13 @@ ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); CmdArgs.push_back("-lpthread"); - CmdArgs.push_back("-lrt"); + if (TC.getTriple().getOS() != llvm::Triple::OpenBSD) +CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); if (TC.getTriple().getOS() != llvm::Triple::FreeBSD && - TC.getTriple().getOS() != llvm::Triple::NetBSD) + TC.getTriple().getOS() != llvm::Triple::NetBSD && + TC.getTriple().getOS() != llvm::Triple::OpenBSD) CmdArgs.push_back("-ldl"); } Index: lib/Driver/ToolChains/CommonArgs.cpp === --- lib/Driver/ToolChains/CommonArgs.cpp +++ lib/Driver/ToolChains/CommonArgs.cpp @@ -542,16 +542,19 @@ // There's no libpthread or librt on RTEMS. if (TC.getTriple().getOS() != llvm::Triple::RTEMS) { CmdArgs.push_back("-lpthread"); -CmdArgs.push_back("-lrt"); +if (TC.getTriple().getOS() != llvm::Triple::OpenBSD) + CmdArgs.push_back("-lrt"); } CmdArgs.push_back("-lm"); // There's no libdl on all OSes. if (TC.getTriple().getOS() != llvm::Triple::FreeBSD && TC.getTriple().getOS() != llvm::Triple::NetBSD && + TC.getTriple().getOS() != llvm::Triple::OpenBSD && TC.getTriple().getOS() != llvm::Triple::RTEMS) CmdArgs.push_back("-ldl"); // Required for backtrace on some OSes if (TC.getTriple().getOS() == llvm::Triple::NetBSD || + TC.getTriple().getOS() == llvm::Triple::OpenBSD || TC.getTriple().getOS() == llvm::Triple::FreeBSD) CmdArgs.push_back("-lexecinfo"); } Index: lib/Driver/ToolChain.cpp === --- lib/Driver/ToolChain.cpp +++ lib/Driver/ToolChain.cpp @@ -327,6 +327,8 @@ switch (Triple.getOS()) { case llvm::Triple::FreeBSD: return "freebsd"; + case llvm::Triple::OpenBSD: +return "openbsd"; case llvm::Triple::Solaris: return "sunos"; default: ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43818: Better OpenBSD frontend support
devnexen added a comment. In https://reviews.llvm.org/D43818#1020577, @krytarowski wrote: > OpenBSD ships with an aggressive ASLR (or ASR) implementation with > fragmentation of user address space. As far as I can tell, it's not possible > to disable it. This means that you are restricted to UBSan. True I planned ubsan with asan to start then realised I can only do ubsan (still work in progress but workable). Repository: rC Clang https://reviews.llvm.org/D43818 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43818: Better OpenBSD frontend support
devnexen added a comment. Also true ... on OpenBSD the number of sanitisers support list won t be enormous ... ubsan maybe tsan ... the xray instrumentation perharps ... Repository: rC Clang https://reviews.llvm.org/D43818 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43818: Better OpenBSD frontend support
devnexen added a comment. Alright then. I ll probably try to push the compiler-rt counterpart (for only ubsan) within the week, it can detects integer overflow already rightfully. Repository: rC Clang https://reviews.llvm.org/D43818 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43818: Better OpenBSD frontend support
devnexen added inline comments. Comment at: lib/Driver/ToolChains/CommonArgs.cpp:545 CmdArgs.push_back("-lpthread"); -CmdArgs.push_back("-lrt"); +if (TC.getTriple().getOS() != llvm::Triple::OpenBSD) + CmdArgs.push_back("-lrt"); krytarowski wrote: > It's a matter of taste, but I would try to omit nested `if`. I just went to the "lesser changes" route as the case here is pretty simple. Repository: rC Clang https://reviews.llvm.org/D43818 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D42645: New simple Checker for mmap calls
devnexen added a comment. ping :) https://reviews.llvm.org/D42645 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D43961: OpenBSD Driver basic sanitiser support
devnexen created this revision. devnexen added reviewers: krytarowski, vitalybuka, kettenis. devnexen created this object with visibility "All Users". Herald added a subscriber: cfe-commits. Basic support of Sanitiser to follow-up ubsan support in compiler-rt. Needs to use lld instead of base ld to be fully workable. Repository: rC Clang https://reviews.llvm.org/D43961 Files: lib/Driver/ToolChains/OpenBSD.cpp lib/Driver/ToolChains/OpenBSD.h Index: lib/Driver/ToolChains/OpenBSD.h === --- lib/Driver/ToolChains/OpenBSD.h +++ lib/Driver/ToolChains/OpenBSD.h @@ -64,6 +64,8 @@ } unsigned GetDefaultDwarfVersion() const override { return 2; } + SanitizerMask getSupportedSanitizers() const override; + protected: Tool *buildAssembler() const override; Tool *buildLinker() const override; Index: lib/Driver/ToolChains/OpenBSD.cpp === --- lib/Driver/ToolChains/OpenBSD.cpp +++ lib/Driver/ToolChains/OpenBSD.cpp @@ -13,6 +13,7 @@ #include "CommonArgs.h" #include "clang/Driver/Compilation.h" #include "clang/Driver/Options.h" +#include "clang/Driver/SanitizerArgs.h" #include "llvm/Option/ArgList.h" using namespace clang::driver; @@ -97,6 +98,8 @@ const InputInfoList &Inputs, const ArgList &Args, const char *LinkingOutput) const { + const toolchains::OpenBSD &ToolChain = + static_cast(getToolChain()); const Driver &D = getToolChain().getDriver(); ArgStringList CmdArgs; @@ -170,11 +173,13 @@ Triple.replace(0, 6, "amd64"); CmdArgs.push_back( Args.MakeArgString("-L/usr/lib/gcc-lib/" + Triple + "/4.2.1")); + CmdArgs.push_back(Args.MakeArgString("-L/usr/lib")); Args.AddAllArgs(CmdArgs, {options::OPT_L, options::OPT_T_Group, options::OPT_e, options::OPT_s, options::OPT_t, options::OPT_Z_Flag, options::OPT_r}); + bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs); AddLinkerInputs(getToolChain(), Inputs, Args, CmdArgs, JA); if (!Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) { @@ -186,7 +191,10 @@ else CmdArgs.push_back("-lm"); } - +if (NeedsSanitizerDeps) { + CmdArgs.push_back(ToolChain.getCompilerRTArgString(Args, "builtins", false)); + linkSanitizerRuntimeDeps(ToolChain, CmdArgs); +} // FIXME: For some reason GCC passes -lgcc before adding // the default system libraries. Just mimic this for now. CmdArgs.push_back("-lgcc"); @@ -221,6 +229,19 @@ C.addCommand(llvm::make_unique(JA, *this, Exec, CmdArgs, Inputs)); } +SanitizerMask OpenBSD::getSupportedSanitizers() const { + const bool IsX86 = getTriple().getArch() == llvm::Triple::x86; + const bool IsX86_64 = getTriple().getArch() == llvm::Triple::x86_64; + + // For future use, only UBsan at the moment + SanitizerMask Res = ToolChain::getSupportedSanitizers(); + + if (IsX86 || IsX86_64) +Res |= SanitizerKind::Vptr; + + return Res; +} + /// OpenBSD - OpenBSD tool chain which can call as(1) and ld(1) directly. OpenBSD::OpenBSD(const Driver &D, const llvm::Triple &Triple, Index: lib/Driver/ToolChains/OpenBSD.h === --- lib/Driver/ToolChains/OpenBSD.h +++ lib/Driver/ToolChains/OpenBSD.h @@ -64,6 +64,8 @@ } unsigned GetDefaultDwarfVersion() const override { return 2; } + SanitizerMask getSupportedSanitizers() const override; + protected: Tool *buildAssembler() const override; Tool *buildLinker() const override; Index: lib/Driver/ToolChains/OpenBSD.cpp === --- lib/Driver/ToolChains/OpenBSD.cpp +++ lib/Driver/ToolChains/OpenBSD.cpp @@ -13,6 +13,7 @@ #include "CommonArgs.h" #include "clang/Driver/Compilation.h" #include "clang/Driver/Options.h" +#include "clang/Driver/SanitizerArgs.h" #include "llvm/Option/ArgList.h" using namespace clang::driver; @@ -97,6 +98,8 @@ const InputInfoList &Inputs, const ArgList &Args, const char *LinkingOutput) const { + const toolchains::OpenBSD &ToolChain = + static_cast(getToolChain()); const Driver &D = getToolChain().getDriver(); ArgStringList CmdArgs; @@ -170,11 +173,13 @@ Triple.replace(0, 6, "amd64"); CmdArgs.push_back( Args.MakeArgString("-L/usr/lib/gcc-lib/" + Triple + "/4.2.1")); + CmdArgs.push_back(Args.MakeArgString("-L/usr/lib")); Args.AddAllArgs(CmdArgs, {options::OPT_L, options::OPT_T_Group, options::OPT_e, options::OPT_s, options::OPT_t, options::OPT_Z_Flag, options::OPT_r}); + bool NeedsSanitizerDeps = addSanitizerR
[PATCH] D43818: Better OpenBSD frontend support
devnexen updated this revision to Diff 136804. devnexen added a comment. backtrace on OpenBSD is not base library but a package. Plus not needed for the UBsan subset. https://reviews.llvm.org/D43818 Files: lib/Driver/ToolChain.cpp lib/Driver/ToolChains/CommonArgs.cpp lib/Driver/ToolChains/Gnu.cpp Index: lib/Driver/ToolChains/Gnu.cpp === --- lib/Driver/ToolChains/Gnu.cpp +++ lib/Driver/ToolChains/Gnu.cpp @@ -242,11 +242,13 @@ ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); CmdArgs.push_back("-lpthread"); - CmdArgs.push_back("-lrt"); + if (TC.getTriple().getOS() != llvm::Triple::OpenBSD) +CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); if (TC.getTriple().getOS() != llvm::Triple::FreeBSD && - TC.getTriple().getOS() != llvm::Triple::NetBSD) + TC.getTriple().getOS() != llvm::Triple::NetBSD && + TC.getTriple().getOS() != llvm::Triple::OpenBSD) CmdArgs.push_back("-ldl"); } Index: lib/Driver/ToolChains/CommonArgs.cpp === --- lib/Driver/ToolChains/CommonArgs.cpp +++ lib/Driver/ToolChains/CommonArgs.cpp @@ -542,12 +542,14 @@ // There's no libpthread or librt on RTEMS. if (TC.getTriple().getOS() != llvm::Triple::RTEMS) { CmdArgs.push_back("-lpthread"); -CmdArgs.push_back("-lrt"); +if (TC.getTriple().getOS() != llvm::Triple::OpenBSD) + CmdArgs.push_back("-lrt"); } CmdArgs.push_back("-lm"); // There's no libdl on all OSes. if (TC.getTriple().getOS() != llvm::Triple::FreeBSD && TC.getTriple().getOS() != llvm::Triple::NetBSD && + TC.getTriple().getOS() != llvm::Triple::OpenBSD && TC.getTriple().getOS() != llvm::Triple::RTEMS) CmdArgs.push_back("-ldl"); // Required for backtrace on some OSes Index: lib/Driver/ToolChain.cpp === --- lib/Driver/ToolChain.cpp +++ lib/Driver/ToolChain.cpp @@ -329,6 +329,8 @@ return "freebsd"; case llvm::Triple::NetBSD: return "netbsd"; + case llvm::Triple::OpenBSD: +return "openbsd"; case llvm::Triple::Solaris: return "sunos"; default: Index: lib/Driver/ToolChains/Gnu.cpp === --- lib/Driver/ToolChains/Gnu.cpp +++ lib/Driver/ToolChains/Gnu.cpp @@ -242,11 +242,13 @@ ArgStringList &CmdArgs) { CmdArgs.push_back("--no-as-needed"); CmdArgs.push_back("-lpthread"); - CmdArgs.push_back("-lrt"); + if (TC.getTriple().getOS() != llvm::Triple::OpenBSD) +CmdArgs.push_back("-lrt"); CmdArgs.push_back("-lm"); if (TC.getTriple().getOS() != llvm::Triple::FreeBSD && - TC.getTriple().getOS() != llvm::Triple::NetBSD) + TC.getTriple().getOS() != llvm::Triple::NetBSD && + TC.getTriple().getOS() != llvm::Triple::OpenBSD) CmdArgs.push_back("-ldl"); } Index: lib/Driver/ToolChains/CommonArgs.cpp === --- lib/Driver/ToolChains/CommonArgs.cpp +++ lib/Driver/ToolChains/CommonArgs.cpp @@ -542,12 +542,14 @@ // There's no libpthread or librt on RTEMS. if (TC.getTriple().getOS() != llvm::Triple::RTEMS) { CmdArgs.push_back("-lpthread"); -CmdArgs.push_back("-lrt"); +if (TC.getTriple().getOS() != llvm::Triple::OpenBSD) + CmdArgs.push_back("-lrt"); } CmdArgs.push_back("-lm"); // There's no libdl on all OSes. if (TC.getTriple().getOS() != llvm::Triple::FreeBSD && TC.getTriple().getOS() != llvm::Triple::NetBSD && + TC.getTriple().getOS() != llvm::Triple::OpenBSD && TC.getTriple().getOS() != llvm::Triple::RTEMS) CmdArgs.push_back("-ldl"); // Required for backtrace on some OSes Index: lib/Driver/ToolChain.cpp === --- lib/Driver/ToolChain.cpp +++ lib/Driver/ToolChain.cpp @@ -329,6 +329,8 @@ return "freebsd"; case llvm::Triple::NetBSD: return "netbsd"; + case llvm::Triple::OpenBSD: +return "openbsd"; case llvm::Triple::Solaris: return "sunos"; default: ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen created this revision. devnexen added a reviewer: krytarowski. devnexen created this object with visibility "All Users". Herald added a subscriber: cfe-commits. OpenBSD supporting only UBsan unsupported this particular test Repository: rC Clang https://reviews.llvm.org/D44069 Files: test/Driver/fsanitize.c Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -649,3 +649,4 @@ // RUN: %clang -target x86_64-linux-gnu -fsanitize=hwaddress %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-SANHA-X86_64 // CHECK-SANHA-X86_64: unsupported option '-fsanitize=hwaddress' for target +// UNSUPPORTED: openbsd Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -649,3 +649,4 @@ // RUN: %clang -target x86_64-linux-gnu -fsanitize=hwaddress %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-SANHA-X86_64 // CHECK-SANHA-X86_64: unsupported option '-fsanitize=hwaddress' for target +// UNSUPPORTED: openbsd ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen added a comment. In https://reviews.llvm.org/D44069#1026551, @krytarowski wrote: > This is not breaking (only?) on OpenBSD, but the triple is breaking all > tested platforms. > Please support it properly. What needs to be done ? I mean I have all OpenBSD compiler-rt code in my side not all is committed. Repository: rC Clang https://reviews.llvm.org/D44069 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen updated this revision to Diff 136919. devnexen added a comment. - Only Asan is not working under OpenBSD - unknown-arg test fails under OpenBSD https://reviews.llvm.org/D44069 Files: test/Driver/fsanitize.c test/Driver/unknown-arg.c Index: test/Driver/unknown-arg.c === --- test/Driver/unknown-arg.c +++ test/Driver/unknown-arg.c @@ -57,3 +57,4 @@ // RUN: %clang -S %s -o %t.s -Wunknown-to-clang-option 2>&1 | FileCheck --check-prefix=IGNORED %s // IGNORED: warning: unknown warning option '-Wunknown-to-clang-option' +// XFAIL: openbsd Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,9 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option Index: test/Driver/unknown-arg.c === --- test/Driver/unknown-arg.c +++ test/Driver/unknown-arg.c @@ -57,3 +57,4 @@ // RUN: %clang -S %s -o %t.s -Wunknown-to-clang-option 2>&1 | FileCheck --check-prefix=IGNORED %s // IGNORED: warning: unknown warning option '-Wunknown-to-clang-option' +// XFAIL: openbsd Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,9 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen added a comment. In https://reviews.llvm.org/D44069#1026563, @krytarowski wrote: > Revert: http://llvm.org/viewvc/llvm-project?revision=326652&view=revision > > And fix. I launched llvm-lit to the whole directory and this is the fixes. https://reviews.llvm.org/D44069 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen updated this revision to Diff 136924. devnexen added a comment. Enable UBsan test https://reviews.llvm.org/D44069 Files: test/Driver/fsanitize.c test/Driver/unknown-arg.c Index: test/Driver/unknown-arg.c === --- test/Driver/unknown-arg.c +++ test/Driver/unknown-arg.c @@ -57,3 +57,4 @@ // RUN: %clang -S %s -o %t.s -Wunknown-to-clang-option 2>&1 | FileCheck --check-prefix=IGNORED %s // IGNORED: warning: unknown warning option '-Wunknown-to-clang-option' +// XFAIL: openbsd Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,12 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN %clang -target i386-pc-openbsd -fsanitize=undefined %s -### 2>&1 | FileCheck --check-prefix=CHECK_UBSAN-OPENBSD +// CHECK-UBSAN-OPENBSD: -fsanitize=undefined + +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option Index: test/Driver/unknown-arg.c === --- test/Driver/unknown-arg.c +++ test/Driver/unknown-arg.c @@ -57,3 +57,4 @@ // RUN: %clang -S %s -o %t.s -Wunknown-to-clang-option 2>&1 | FileCheck --check-prefix=IGNORED %s // IGNORED: warning: unknown warning option '-Wunknown-to-clang-option' +// XFAIL: openbsd Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,12 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN %clang -target i386-pc-openbsd -fsanitize=undefined %s -### 2>&1 | FileCheck --check-prefix=CHECK_UBSAN-OPENBSD +// CHECK-UBSAN-OPENBSD: -fsanitize=undefined + +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen updated this revision to Diff 137284. https://reviews.llvm.org/D44069 Files: test/Driver/fsanitize.c Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,12 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN %clang -target i386-pc-openbsd -fsanitize=undefined %s -### 2>&1 | FileCheck --check-prefix=CHECK-UBSAN-OPENBSD +// CHECK-UBSAN-OPENBSD: -fsanitize=undefined + +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,12 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN %clang -target i386-pc-openbsd -fsanitize=undefined %s -### 2>&1 | FileCheck --check-prefix=CHECK-UBSAN-OPENBSD +// CHECK-UBSAN-OPENBSD: -fsanitize=undefined + +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen added inline comments. Comment at: test/Driver/fsanitize.c:392 +// RUN %clang -target i386-pc-openbsd -fsanitize=undefined %s -### 2>&1 | FileCheck --check-prefix=CHECK_UBSAN-OPENBSD +// CHECK-UBSAN-OPENBSD: -fsanitize=undefined + vsk wrote: > Why does this work? The -check-prefix is "CHECK_UBSAN-OPENBSD", but there's > no underscore here. Good catch Comment at: test/Driver/unknown-arg.c:60 // IGNORED: warning: unknown warning option '-Wunknown-to-clang-option' +// XFAIL: openbsd vsk wrote: > This test should not be expected to fail on openbsd. Whatever it is that > you're checking for, please create a narrower test just for openbsd, and add > your checks there. It works finally ... Dunno why I set it as XFAIL originally... https://reviews.llvm.org/D44069 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen updated this revision to Diff 137447. https://reviews.llvm.org/D44069 Files: test/Driver/fsanitize.c Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,21 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN %clang -target i386-pc-openbsd -fsanitize=undefined %s -### 2>&1 | FileCheck --check-prefix=CHECK-UBSAN-OPENBSD +// CHECK-UBSAN-OPENBSD: -fsanitize=undefined + +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-OPENBSD +// CHECK-LSAN-OPENBSD: unsupported option '-fsanitize=leak' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=thread %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TSAN-OPENBSD +// CHECK-TSAN-OPENBSD: unsupported option '-fsanitize=thread' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=memory %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-MSAN-OPENBSD +// CHECK-MSAN-OPENBSD: unsupported option '-fsanitize=memory' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,21 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN %clang -target i386-pc-openbsd -fsanitize=undefined %s -### 2>&1 | FileCheck --check-prefix=CHECK-UBSAN-OPENBSD +// CHECK-UBSAN-OPENBSD: -fsanitize=undefined + +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-OPENBSD +// CHECK-LSAN-OPENBSD: unsupported option '-fsanitize=leak' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=thread %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TSAN-OPENBSD +// CHECK-TSAN-OPENBSD: unsupported option '-fsanitize=thread' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=memory %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-MSAN-OPENBSD +// CHECK-MSAN-OPENBSD: unsupported option '-fsanitize=memory' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen updated this revision to Diff 137448. https://reviews.llvm.org/D44069 Files: test/Driver/fsanitize.c Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,25 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN %clang -target i386-pc-openbsd -fsanitize=undefined %s -### 2>&1 | FileCheck --check-prefix=CHECK-UBSAN-OPENBSD +// CHECK-UBSAN-OPENBSD: -fsanitize=undefined + +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-OPENBSD +// CHECK-LSAN-OPENBSD: unsupported option '-fsanitize=leak' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=thread %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TSAN-OPENBSD +// CHECK-TSAN-OPENBSD: unsupported option '-fsanitize=thread' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=memory %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-MSAN-OPENBSD +// CHECK-MSAN-OPENBSD: unsupported option '-fsanitize=memory' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=efficiency-cache-frag %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ESAN-OPENBSD +// RUN: %clang -target i386-pc-openbsd -fsanitize=efficiency-working-set %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ESAN-OPENBSD +// CHECK-ESAN-OPENBSD: error: unsupported option '-fsanitize=efficiency-{{.*}}' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option Index: test/Driver/fsanitize.c === --- test/Driver/fsanitize.c +++ test/Driver/fsanitize.c @@ -388,6 +388,25 @@ // RUN: %clang -target armv7-apple-ios7 -miphoneos-version-min=7.0 -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-IOS // CHECK-ASAN-IOS: -fsanitize=address +// RUN %clang -target i386-pc-openbsd -fsanitize=undefined %s -### 2>&1 | FileCheck --check-prefix=CHECK-UBSAN-OPENBSD +// CHECK-UBSAN-OPENBSD: -fsanitize=undefined + +// RUN: %clang -target i386-pc-openbsd -fsanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ASAN-OPENBSD +// CHECK-ASAN-OPENBSD: unsupported option '-fsanitize=address' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-OPENBSD +// CHECK-LSAN-OPENBSD: unsupported option '-fsanitize=leak' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=thread %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TSAN-OPENBSD +// CHECK-TSAN-OPENBSD: unsupported option '-fsanitize=thread' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=memory %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-MSAN-OPENBSD +// CHECK-MSAN-OPENBSD: unsupported option '-fsanitize=memory' for target 'i386-pc-openbsd' + +// RUN: %clang -target i386-pc-openbsd -fsanitize=efficiency-cache-frag %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ESAN-OPENBSD +// RUN: %clang -target i386-pc-openbsd -fsanitize=efficiency-working-set %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-ESAN-OPENBSD +// CHECK-ESAN-OPENBSD: error: unsupported option '-fsanitize=efficiency-{{.*}}' for target 'i386-pc-openbsd' + // RUN: %clang -target x86_64-apple-darwin -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-X86-64-DARWIN // CHECK-LSAN-X86-64-DARWIN-NOT: unsupported option ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44250: MmapWriteExecChecker supporting mprotect call
devnexen created this revision. devnexen added a reviewer: dergachev.a. Herald added a subscriber: cfe-commits. In addition of checking mmap call, checking as well mprotect to detect possible writable-executable promotions. Repository: rC Clang https://reviews.llvm.org/D44250 Files: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp test/Analysis/mmap-writeexec.c Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -16,6 +16,7 @@ typedef __typeof(sizeof(int)) size_t; void *mmap(void *, size_t, int, int, int, long); +int mprotect(void *, size_t, int); void f1() { @@ -34,3 +35,10 @@ int prot = PROT_WRITE | PROT_EXEC; (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} } + +void f3() +{ + void *p = mmap(NULL, 1024, PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + int m = mprotect(p, 1024, PROT_WRITE | PROT_EXEC); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)m; +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -28,12 +28,13 @@ namespace { class MmapWriteExecChecker : public Checker { CallDescription MmapFn; + CallDescription MprotectFn; static int ProtWrite; static int ProtExec; static int ProtRead; mutable std::unique_ptr BT; public: - MmapWriteExecChecker() : MmapFn("mmap", 6) {} + MmapWriteExecChecker() : MmapFn("mmap", 6), MprotectFn("mprotect", 3) {} void checkPreCall(const CallEvent &Call, CheckerContext &C) const; int ProtExecOv; int ProtReadOv; @@ -46,8 +47,8 @@ void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, CheckerContext &C) const { - if (Call.isCalled(MmapFn)) { -SVal ProtVal = Call.getArgSVal(2); + if (Call.isCalled(MmapFn) || Call.isCalled(MprotectFn)) { +SVal ProtVal = Call.getArgSVal(2); Optional ProtLoc = ProtVal.getAs(); int64_t Prot = ProtLoc->getValue().getSExtValue(); if (ProtExecOv != ProtExec) Index: test/Analysis/mmap-writeexec.c === --- test/Analysis/mmap-writeexec.c +++ test/Analysis/mmap-writeexec.c @@ -16,6 +16,7 @@ typedef __typeof(sizeof(int)) size_t; void *mmap(void *, size_t, int, int, int, long); +int mprotect(void *, size_t, int); void f1() { @@ -34,3 +35,10 @@ int prot = PROT_WRITE | PROT_EXEC; (void)callm(NULL, 1024, prot, MAP_PRIVATE | MAP_ANON, -1, 0); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} } + +void f3() +{ + void *p = mmap(NULL, 1024, PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); // no-warning + int m = mprotect(p, 1024, PROT_WRITE | PROT_EXEC); // expected-warning{{Both PROT_WRITE and PROT_EXEC flags are set. This can lead to exploitable memory regions, which could be overwritten with malicious code}} + (void)m; +} Index: lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp === --- lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp +++ lib/StaticAnalyzer/Checkers/MmapWriteExecChecker.cpp @@ -28,12 +28,13 @@ namespace { class MmapWriteExecChecker : public Checker { CallDescription MmapFn; + CallDescription MprotectFn; static int ProtWrite; static int ProtExec; static int ProtRead; mutable std::unique_ptr BT; public: - MmapWriteExecChecker() : MmapFn("mmap", 6) {} + MmapWriteExecChecker() : MmapFn("mmap", 6), MprotectFn("mprotect", 3) {} void checkPreCall(const CallEvent &Call, CheckerContext &C) const; int ProtExecOv; int ProtReadOv; @@ -46,8 +47,8 @@ void MmapWriteExecChecker::checkPreCall(const CallEvent &Call, CheckerContext &C) const { - if (Call.isCalled(MmapFn)) { -SVal ProtVal = Call.getArgSVal(2); + if (Call.isCalled(MmapFn) || Call.isCalled(MprotectFn)) { +SVal ProtVal = Call.getArgSVal(2); Optional ProtLoc = ProtVal.getAs(); int64_t Prot = ProtLoc->getValue().getSExtValue(); if (ProtExecOv != ProtExec) ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen added a comment. ping would be nice if it was commited this week :-) especially the other bits are already https://reviews.llvm.org/D44069 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D44069: Test Driver sanitise, unsupported on OpenBSD
devnexen added a comment. Yes I do ☺ thanks. https://reviews.llvm.org/D44069 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D52610: [Esan] Port cache frag to FreeBSD
devnexen added inline comments. Comment at: lib/CodeGen/BackendUtil.cpp:323 Opts.ToolType = EfficiencySanitizerOptions::ESAN_CacheFrag; - else if (LangOpts.Sanitize.has(SanitizerKind::EfficiencyWorkingSet)) + else if (T.getOS() == Triple::Linux && +LangOpts.Sanitize.has(SanitizerKind::EfficiencyWorkingSet)) krytarowski wrote: > Is it possible to port it to FreeBSD and skip some conditions in generic code? Not for now, working-set hangs at init time on FreeBSD and unit tests had been disabled in the compiler-rt part. Repository: rC Clang https://reviews.llvm.org/D52610 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D52610: [Esan] Port cache frag to FreeBSD
devnexen added inline comments. Comment at: lib/CodeGen/BackendUtil.cpp:323 Opts.ToolType = EfficiencySanitizerOptions::ESAN_CacheFrag; - else if (LangOpts.Sanitize.has(SanitizerKind::EfficiencyWorkingSet)) + else if (T.getOS() == Triple::Linux && +LangOpts.Sanitize.has(SanitizerKind::EfficiencyWorkingSet)) krytarowski wrote: > devnexen wrote: > > krytarowski wrote: > > > Is it possible to port it to FreeBSD and skip some conditions in generic > > > code? > > Not for now, working-set hangs at init time on FreeBSD and unit tests had > > been disabled in the compiler-rt part. > So can the support be extended in compiler-rt? I would find it more useful to > handle featured sanitizer in the first place. Not sure of the feasibility yet, let s say for now it s just a starting point. Repository: rC Clang https://reviews.llvm.org/D52610 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D52610: [Esan] Port cache frag to FreeBSD
devnexen added a comment. ping working-set on FreeBSD does not seem doable. Repository: rC Clang https://reviews.llvm.org/D52610 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D52610: [Esan] Port cache frag to FreeBSD
devnexen added a comment. - FreeBSD does not have real Linux's clone equivalent. - Hangs or crashes during the final report (the shadow mapping is similar as Linux's though). Repository: rC Clang https://reviews.llvm.org/D52610 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
[PATCH] D52610: [Esan] Port cache frag to FreeBSD
devnexen added a comment. Things might differ between NetBSD and FreeBSD about the feasibility. So maybe for the former it is more reachable (only would need to set specific application mappings maybe ?). - So once the non writable addresses are created, it processes the working sets to make it world aligned => One of the points of failure. - The segfault handler does not work or can't be instrumented because not initialised yet at this stage. The caching frag works because there is no shadow mapping (yet?). Repository: rC Clang https://reviews.llvm.org/D52610 ___ cfe-commits mailing list cfe-commits@lists.llvm.org http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits