[hwasan] Stack instrumentation.

Summary:
Very basic stack instrumentation using tagged pointers.
Tag for N'th alloca in a function is built as XOR of:
 * base tag for the function, which is just some bits of SP (poor
   man's random)
 * small constant which is a function of N.

Allocas are aligned to 16 bytes. On every ReturnInst allocas are
re-tagged to catch use-after-return.

This implementation has a bunch of issues that will be taken care of
later:
1. lifetime intrinsics referring to tagged pointers are not
   recognized in SDAG. This effectively disables stack coloring.
2. Generated code is quite inefficient. There is one extra
   instruction at each memory access that adds the base tag to the
   untagged alloca address. It would be better to keep tagged SP in a
   callee-saved register and address allocas as an offset of that XOR
   retag, but that needs better coordination between hwasan
   instrumentation pass and prologue/epilogue insertion.
3. Lifetime instrinsics are ignored and use-after-scope is not
   implemented. This would be harder to do than in ASan, because we
   need to use a differently tagged pointer depending on which
   lifetime.start / lifetime.end the current instruction is dominated
   / post-dominated.

Reviewers: kcc, alekseyshl

Subscribers: srhines, kubamracek, javed.absar, hiraditya, llvm-commits

Differential Revision: https://reviews.llvm.org/D41602

git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@322324 91177308-0d34-0410-b5e6-96231b3b80d8

2 files changed, 48 insertions, 0 deletions

diff --git a/test/hwasan/TestCases/stack-oob.cc b/test/hwasan/TestCases/stack-oob.cc
new file mode 100644
index 000000000..60b9a6295
--- /dev/null
+++ b/test/hwasan/TestCases/stack-oob.cc
@@ -0,0 +1,25 @@
+// RUN: %clangxx_hwasan -DSIZE=16 -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_hwasan -DSIZE=64 -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_hwasan -DSIZE=0x1000 -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+// REQUIRES: stable-runtime
+
+#include <stdlib.h>
+#include <sanitizer/hwasan_interface.h>
+
+__attribute__((noinline))
+int f() {
+  char z[SIZE];
+  char *volatile p = z;
+  return p[SIZE];
+}
+
+int main() {
+  return f();
+  // CHECK: READ of size 1 at
+  // CHECK: #0 {{.*}} in f{{.*}}stack-oob.cc:14
+
+  // CHECK: HWAddressSanitizer can not describe address in more detail.
+
+  // CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in f
+}
diff --git a/test/hwasan/TestCases/stack-uar.cc b/test/hwasan/TestCases/stack-uar.cc
new file mode 100644
index 000000000..e99dcceed
--- /dev/null
+++ b/test/hwasan/TestCases/stack-uar.cc
@@ -0,0 +1,23 @@
+// RUN: %clangxx_hwasan -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+// REQUIRES: stable-runtime
+
+#include <stdlib.h>
+#include <sanitizer/hwasan_interface.h>
+
+__attribute__((noinline))
+char *f() {
+  char z[0x1000];
+  char *volatile p = z;
+  return p;
+}
+
+int main() {
+  return *f();
+  // CHECK: READ of size 1 at
+  // CHECK: #0 {{.*}} in main{{.*}}stack-uar.cc:16
+
+  // CHECK: HWAddressSanitizer can not describe address in more detail.
+
+  // CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in main
+}