cisco-open / llvm-crash-analyzer

llvm crash analysis
Apache License 2.0
40 stars 17 forks source link

[TA] Handle global variables as Src operand #39

Closed niktesic closed 1 year ago

niktesic commented 1 year ago

The patch in covers cases where Source operand of the Machine Instruction is an immediate value, which corresponds to the address of the global variable symbol in the Symbol Table.

Please, consider the following MIR from test/Analysis/global-0.mir:

    MOV64mi32 $noreg, 1, $noreg, 6295592, $noreg, 0, debug-location !DILocation(line: 18, column: 6, scope: !2)
    MOV64mi32 $noreg, 1, $noreg, 6295600, $noreg, 0, debug-location !DILocation(line: 19, column: 7, scope: !2)
    $rdi = MOV64ri 6295592, debug-location !DILocation(line: 20, column: 1, scope: !2)

The immediate Machine Operand, with value 6295592, represents a global variable, which address in the symbol table is 6295592 (or 0x601028).

$ llvm-readelf -s ./glob | grep "601028"
   Num:    Value          Size Type    Bind   Vis       Ndx Name
    90: 0000000000601028     8 OBJECT  GLOBAL DEFAULT    23 p

Without this patch, MI $rdi = MOV64ri 6295592 is treated like a constant loading instruction, which would terminate the Taint Analysis path. Additionally, the TA cannot recognize that constant {imm: 6295592} describes the same location as {reg:$noreg; off:6295592} (global variable p).

This patch adds support for global variables in two steps:

  1. Detection of global variables, by a symbol table lookup
  2. Representation of all global variable locations as {reg:$noreg; off:SYM_TAB_ADDR}

TODOs: