222 lines · plain
1; Test basic address sanitizer instrumentation.2;3 4; RUN: opt < %s -passes=asan -S | FileCheck --check-prefixes=CHECK,CHECK-S3 %s5; RUN: opt < %s -passes=asan -asan-mapping-scale=5 -S | FileCheck --check-prefixes=CHECK,CHECK-S5 %s6 7target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"8target triple = "x86_64-unknown-linux-gnu"9; CHECK: @llvm.used = appending global [1 x ptr] [ptr @asan.module_ctor]10; CHECK: @llvm.global_ctors = {{.*}}{ i32 1, ptr @asan.module_ctor, ptr @asan.module_ctor }11 12define i32 @test_load(ptr %a) sanitize_address {13; CHECK-LABEL: @test_load14; CHECK-NOT: load15; CHECK: %[[LOAD_ADDR:[^ ]*]] = ptrtoint ptr %a to i6416; CHECK-S3: lshr i64 %[[LOAD_ADDR]], 317; CHECK-S5: lshr i64 %[[LOAD_ADDR]], 518; CHECK: {{or|add}}19; CHECK: %[[LOAD_SHADOW_PTR:[^ ]*]] = inttoptr20; CHECK: %[[LOAD_SHADOW:[^ ]*]] = load i8, ptr %[[LOAD_SHADOW_PTR]]21; CHECK: icmp ne i822; CHECK: br i1 %{{.*}}, label %{{.*}}, label %{{.*}}!prof ![[PROF:[0-9]+]]23;24; First instrumentation block refines the shadow test.25; CHECK-S3: and i64 %[[LOAD_ADDR]], 726; CHECK-S5: and i64 %[[LOAD_ADDR]], 3127; CHECK: add i64 %{{.*}}, 328; CHECK: trunc i64 %{{.*}} to i829; CHECK: icmp sge i8 %{{.*}}, %[[LOAD_SHADOW]]30; CHECK: br i1 %{{.*}}, label %{{.*}}, label %{{.*}}31;32; The crash block reports the error.33; CHECK: call void @__asan_report_load4(i64 %[[LOAD_ADDR]])34; CHECK: unreachable35;36; The actual load.37; CHECK: %tmp1 = load i32, ptr %a38; CHECK: ret i32 %tmp139 40 41 42entry:43 %tmp1 = load i32, ptr %a, align 444 ret i32 %tmp145}46 47define void @test_store(ptr %a) sanitize_address {48; CHECK-LABEL: @test_store49; CHECK-NOT: store50; CHECK: %[[STORE_ADDR:[^ ]*]] = ptrtoint ptr %a to i6451; CHECK-S3: lshr i64 %[[STORE_ADDR]], 352; CHECK-S5: lshr i64 %[[STORE_ADDR]], 553; CHECK: {{or|add}}54; CHECK: %[[STORE_SHADOW_PTR:[^ ]*]] = inttoptr55; CHECK: %[[STORE_SHADOW:[^ ]*]] = load i8, ptr %[[STORE_SHADOW_PTR]]56; CHECK: icmp ne i857; CHECK: br i1 %{{.*}}, label %{{.*}}, label %{{.*}}58;59; First instrumentation block refines the shadow test.60; CHECK-S3: and i64 %[[STORE_ADDR]], 761; CHECK-S5: and i64 %[[STORE_ADDR]], 3162; CHECK: add i64 %{{.*}}, 363; CHECK: trunc i64 %{{.*}} to i864; CHECK: icmp sge i8 %{{.*}}, %[[STORE_SHADOW]]65; CHECK: br i1 %{{.*}}, label %{{.*}}, label %{{.*}}66;67; The crash block reports the error.68; CHECK: call void @__asan_report_store4(i64 %[[STORE_ADDR]])69; CHECK: unreachable70;71; The actual load.72; CHECK: store i32 42, ptr %a73; CHECK: ret void74;75 76entry:77 store i32 42, ptr %a, align 478 ret void79}80 81; Check that asan leaves just one alloca.82 83declare void @alloca_test_use(ptr)84define void @alloca_test() sanitize_address {85entry:86 %x = alloca [10 x i8], align 187 %y = alloca [10 x i8], align 188 %z = alloca [10 x i8], align 189 call void @alloca_test_use(ptr %x)90 call void @alloca_test_use(ptr %y)91 call void @alloca_test_use(ptr %z)92 ret void93}94 95; CHECK-LABEL: define void @alloca_test()96; CHECK: %asan_local_stack_base = alloca97; CHECK: = alloca98; CHECK-NOT: = alloca99; CHECK: ret void100 101define void @LongDoubleTest(ptr nocapture %a) nounwind uwtable sanitize_address {102entry:103 store x86_fp80 0xK3FFF8000000000000000, ptr %a, align 16104 ret void105}106 107; CHECK-LABEL: LongDoubleTest108; CHECK: __asan_report_store_n109; CHECK: __asan_report_store_n110; CHECK: ret void111 112 113define void @i40test(ptr %a, ptr %b) nounwind uwtable sanitize_address {114 entry:115 %t = load i40, ptr %a116 store i40 %t, ptr %b, align 8117 ret void118}119 120; CHECK-LABEL: i40test121; CHECK: __asan_report_load_n{{.*}}, i64 5)122; CHECK: __asan_report_load_n{{.*}}, i64 5)123; CHECK: __asan_report_store_n{{.*}}, i64 5)124; CHECK: __asan_report_store_n{{.*}}, i64 5)125; CHECK: ret void126 127define void @i64test_align1(ptr %b) nounwind uwtable sanitize_address {128 entry:129 store i64 0, ptr %b, align 1130 ret void131}132 133; CHECK-LABEL: i64test_align1134; CHECK: __asan_report_store_n{{.*}}, i64 8)135; CHECK: __asan_report_store_n{{.*}}, i64 8)136; CHECK: ret void137 138define void @i128test_align8(ptr %a) nounwind uwtable sanitize_address {139entry:140 store i128 0, ptr %a, align 8141 ret void142}143; CHECK-LABEL: define {{[^@]+}}@i128test_align8(144; CHECK-S3: load i16, ptr %[[#]], align 1145; CHECK-S3-NEXT: icmp ne i16 %[[#]], 0146; CHECK-S5: load i8, ptr %[[#]], align 1147; CHECK-S5: load i8, ptr %[[#]], align 1148 149define void @i128test_align16(ptr %a) nounwind uwtable sanitize_address {150entry:151 store i128 0, ptr %a, align 16152 ret void153}154; CHECK-LABEL: define {{[^@]+}}@i128test_align16(155; CHECK-S3: load i16, ptr %[[#]], align 2156; CHECK-S3-NEXT: icmp ne i16 %[[#]], 0157; CHECK-S5: load i8, ptr %[[#]], align 1158; CHECK-S5-NEXT: icmp ne i8 %[[#]], 0159 160define void @i80test(ptr %a, ptr %b) nounwind uwtable sanitize_address {161 entry:162 %t = load i80, ptr %a163 store i80 %t, ptr %b, align 8164 ret void165}166 167; CHECK-LABEL: i80test168; CHECK: __asan_report_load_n{{.*}}, i64 10)169; CHECK: __asan_report_load_n{{.*}}, i64 10)170; CHECK: __asan_report_store_n{{.*}}, i64 10)171; CHECK: __asan_report_store_n{{.*}}, i64 10)172; CHECK: ret void173 174; asan should not instrument functions with available_externally linkage.175define available_externally i32 @f_available_externally(ptr %a) sanitize_address {176entry:177 %tmp1 = load i32, ptr %a178 ret i32 %tmp1179}180; CHECK-LABEL: @f_available_externally181; CHECK-NOT: __asan_report182; CHECK: ret i32183 184 185; CHECK-LABEL: @test_swifterror186; CHECK-NOT: __asan_report_load187; CHECK: ret void188define void @test_swifterror(ptr swifterror) sanitize_address {189 %swifterror_ptr_value = load ptr, ptr %0190 ret void191}192 193; CHECK-LABEL: @test_swifterror_2194; CHECK-NOT: __asan_report_store195; CHECK: ret void196define void @test_swifterror_2(ptr swifterror) sanitize_address {197 store ptr null, ptr %0198 ret void199}200 201; CHECK-LABEL: @test_swifterror_3202; CHECK-NOT: __asan_report_store203; CHECK: ret void204define void @test_swifterror_3() sanitize_address {205 %swifterror_addr = alloca swifterror ptr206 store ptr null, ptr %swifterror_addr207 call void @test_swifterror_2(ptr swifterror %swifterror_addr)208 ret void209}210 211;; ctor/dtor have the nounwind attribute. See uwtable.ll, they additionally have212;; the uwtable attribute with the module flag "uwtable".213; CHECK: define internal void @asan.module_ctor() #[[#ATTR:]] comdat {214; CHECK: call void @__asan_init()215;; __asan_register_elf_globals is called even if this module does not contain instrumented global variables.216; CHECK: call void @__asan_register_elf_globals(i64 ptrtoint (ptr @___asan_globals_registered to i64), i64 ptrtoint (ptr @__start_asan_globals to i64), i64 ptrtoint (ptr @__stop_asan_globals to i64))217 218; CHECK: attributes #[[#ATTR]] = { nounwind }219 220; PROF221; CHECK: ![[PROF]] = !{!"branch_weights", i32 1, i32 1048575}222