1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
| ; RUN: opt < %s -stack-tagging -S -o - | FileCheck %s
target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
target triple = "aarch64--linux-android"
declare void @use8(i8*)
declare void @use32(i32*)
declare void @llvm.lifetime.start.p0i8(i64, i8* nocapture)
declare void @llvm.lifetime.end.p0i8(i64, i8* nocapture)
define void @OneVar() sanitize_memtag {
entry:
%x = alloca i32, align 4
call void @use32(i32* %x)
ret void
}
; CHECK-LABEL: define void @OneVar(
; CHECK: [[BASE:%.*]] = call i8* @llvm.aarch64.irg.sp(i64 0)
; CHECK: [[X:%.*]] = alloca { i32, [12 x i8] }, align 16
; CHECK: [[TX:%.*]] = call { i32, [12 x i8] }* @llvm.aarch64.tagp.{{.*}}({ i32, [12 x i8] }* [[X]], i8* [[BASE]], i64 0)
; CHECK: [[TX8:%.*]] = bitcast { i32, [12 x i8] }* [[TX]] to i8*
; CHECK: call void @llvm.aarch64.settag(i8* [[TX8]], i64 16)
; CHECK: [[GEP32:%.*]] = bitcast { i32, [12 x i8] }* [[TX]] to i32*
; CHECK: call void @use32(i32* [[GEP32]])
; CHECK: [[GEP8:%.*]] = bitcast { i32, [12 x i8] }* [[X]] to i8*
; CHECK: call void @llvm.aarch64.settag(i8* [[GEP8]], i64 16)
; CHECK: ret void
define void @ManyVars() sanitize_memtag {
entry:
%x1 = alloca i32, align 4
%x2 = alloca i8, align 4
%x3 = alloca i32, i32 11, align 4
call void @use32(i32* %x1)
call void @use8(i8* %x2)
call void @use32(i32* %x3)
ret void
}
; CHECK-LABEL: define void @ManyVars(
; CHECK: alloca { i32, [12 x i8] }, align 16
; CHECK: call { i32, [12 x i8] }* @llvm.aarch64.tagp.{{.*}}({ i32, [12 x i8] }* {{.*}}, i64 0)
; CHECK: call void @llvm.aarch64.settag(i8* {{.*}}, i64 16)
; CHECK: alloca { i8, [15 x i8] }, align 16
; CHECK: call { i8, [15 x i8] }* @llvm.aarch64.tagp.{{.*}}({ i8, [15 x i8] }* {{.*}}, i64 1)
; CHECK: call void @llvm.aarch64.settag(i8* {{.*}}, i64 16)
; CHECK: alloca { [11 x i32], [4 x i8] }, align 16
; CHECK: call { [11 x i32], [4 x i8] }* @llvm.aarch64.tagp.{{.*}}({ [11 x i32], [4 x i8] }* {{.*}}, i64 2)
; CHECK: call void @llvm.aarch64.settag(i8* {{.*}}, i64 48)
; CHECK: call void @use32(
; CHECK: call void @use8(
; CHECK: call void @use32(
; CHECK: call void @llvm.aarch64.settag(i8* {{.*}}, i64 16)
; CHECK: call void @llvm.aarch64.settag(i8* {{.*}}, i64 16)
; CHECK: call void @llvm.aarch64.settag(i8* {{.*}}, i64 48)
; CHECK-NEXT: ret void
define void @Scope(i32 %b) sanitize_memtag {
entry:
%x = alloca i32, align 4
%tobool = icmp eq i32 %b, 0
br i1 %tobool, label %if.end, label %if.then
if.then:
%0 = bitcast i32* %x to i8*
call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %0)
call void @use8(i8* %0) #3
call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %0)
br label %if.end
if.end:
ret void
}
; CHECK-LABEL: define void @Scope(
; CHECK: br i1
; CHECK: call void @llvm.lifetime.start.p0i8(
; CHECK: call void @llvm.aarch64.settag(
; CHECK: call void @use8(
; CHECK: call void @llvm.aarch64.settag(
; CHECK: call void @llvm.lifetime.end.p0i8(
; CHECK: br label
; CHECK: ret void
; Spooked by the multiple lifetime ranges, StackTagging remove all of them and sets tags on entry and exit.
define void @BadScope(i32 %b) sanitize_memtag {
entry:
%x = alloca i32, align 4
%tobool = icmp eq i32 %b, 0
br i1 %tobool, label %if.end, label %if.then
if.then:
%0 = bitcast i32* %x to i8*
call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %0)
call void @use8(i8* %0) #3
call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %0)
call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %0)
call void @use8(i8* %0) #3
call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %0)
br label %if.end
if.end:
ret void
}
; CHECK-LABEL: define void @BadScope(
; CHECK: call void @llvm.aarch64.settag(i8* {{.*}}, i64 16)
; CHECK: br i1
; CHECK: call void @use8(i8*
; CHECK-NEXT: call void @use8(i8*
; CHECK: br label
; CHECK: call void @llvm.aarch64.settag(i8* {{.*}}, i64 16)
; CHECK-NEXT: ret void
define void @DynamicAllocas(i32 %cnt) sanitize_memtag {
entry:
%x = alloca i32, i32 %cnt, align 4
br label %l
l:
%y = alloca i32, align 4
call void @use32(i32* %x)
call void @use32(i32* %y)
ret void
}
; CHECK-LABEL: define void @DynamicAllocas(
; CHECK-NOT: @llvm.aarch64.irg.sp
; CHECK: %x = alloca i32, i32 %cnt, align 4
; CHECK-NOT: @llvm.aarch64.irg.sp
; CHECK: alloca i32, align 4
; CHECK-NOT: @llvm.aarch64.irg.sp
; CHECK: ret void
; If we can't trace one of the lifetime markers to a single alloca, fall back
; to poisoning all allocas at the beginning of the function.
; Each alloca must be poisoned only once.
define void @UnrecognizedLifetime(i8 %v) sanitize_memtag {
entry:
%x = alloca i32, align 4
%y = alloca i32, align 4
%z = alloca i32, align 4
%cx = bitcast i32* %x to i8*
%cy = bitcast i32* %y to i8*
%cz = bitcast i32* %z to i8*
%tobool = icmp eq i8 %v, 0
%xy = select i1 %tobool, i32* %x, i32* %y
%cxcy = select i1 %tobool, i8* %cx, i8* %cy
br label %another_bb
another_bb:
call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %cz)
store i32 7, i32* %z
call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %cz)
call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %cz)
store i32 7, i32* %z
call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %cz)
call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %cxcy)
store i32 8, i32* %xy
call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %cxcy)
ret void
}
; CHECK-LABEL: define void @UnrecognizedLifetime(
; CHECK: call i8* @llvm.aarch64.irg.sp(i64 0)
; CHECK: alloca { i32, [12 x i8] }, align 16
; CHECK: call { i32, [12 x i8] }* @llvm.aarch64.tagp
; CHECK: call void @llvm.aarch64.settag(
; CHECK: alloca { i32, [12 x i8] }, align 16
; CHECK: call { i32, [12 x i8] }* @llvm.aarch64.tagp
; CHECK: call void @llvm.aarch64.settag(
; CHECK: alloca { i32, [12 x i8] }, align 16
; CHECK: call { i32, [12 x i8] }* @llvm.aarch64.tagp
; CHECK: call void @llvm.aarch64.settag(
; CHECK: store i32
; CHECK: store i32
; CHECK: store i32
; CHECK: call void @llvm.aarch64.settag(
; CHECK: call void @llvm.aarch64.settag(
; CHECK: call void @llvm.aarch64.settag(
; CHECK: ret void
|