Skip to content

Conversation

melver
Copy link
Contributor

@melver melver commented Sep 4, 2025

For the AllocToken pass to accurately calculate token ID hints, we
should attach !alloc_token_hint metadata for allocation calls to avoid
reverting to LLVM IR-type based hints (which depends on later "uses" and
is rather imprecise).

Unlike new expressions, untyped allocation calls (like malloc,
calloc, ::operator new(..), __builtin_operator_new, etc.) have no
syntactic type associated with them. For -fsanitize=alloc-token, type
hints are sufficient, and we can attempt to infer the type based on
common idioms.

When encountering allocation calls (with __attribute__((malloc)) or
__attribute__((alloc_size(..))), attach !alloc_token_hint by
inferring the allocated type from (a) sizeof argument expressions such
as malloc(sizeof(MyType)), and (b) casts such as (MyType*)malloc(4096).

Note that non-standard allocation functions with these attributes are
not instrumented by default. Use -fsanitize-alloc-token-extended to
instrument them as well.

Link: https://discourse.llvm.org/t/rfc-a-framework-for-allocator-partitioning-hints/87434


This change is part of the following series:

  1. [AllocToken] Introduce AllocToken instrumentation pass #156838
  2. [Clang] Introduce -fsanitize=alloc-token #156839
  3. [AllocToken, Clang] Implement TypeHashPointerSplit mode #156840
  4. [AllocToken, Clang] Infer type hints from sizeof expressions and casts #156841
  5. [AllocToken, Clang] Implement __builtin_alloc_token_infer() and llvm.alloc.token.id #156842

Created using spr 1.3.8-beta.1
Created using spr 1.3.8-beta.1
melver added a commit to melver/llvm-project that referenced this pull request Sep 5, 2025
For the AllocToken pass to accurately calculate token ID hints, we
should attach `!alloc_token_hint` metadata for allocation calls to avoid
reverting to LLVM IR-type based hints (which depends on later "uses" and
is rather imprecise).

Unlike new expressions, untyped allocation calls (like `malloc`,
`calloc`, `::operator new(..)`, `__builtin_operator_new`, etc.) have no
syntactic type associated with them. For -fsanitize=alloc-token, type
hints are sufficient, and we can attempt to infer the type based on
common idioms.

When encountering allocation calls (with `__attribute__((malloc))` or
`__attribute__((alloc_size(..))`), attach `!alloc_token_hint` by
inferring the allocated type from (a) sizeof argument expressions such
as `malloc(sizeof(MyType))`, and (b) casts such as `(MyType*)malloc(4096)`.

Note that non-standard allocation functions with these attributes are
not instrumented by default. Use `-fsanitize-alloc-token-extended` to
instrument them as well.

Link: https://discourse.llvm.org/t/rfc-a-framework-for-allocator-partitioning-hints/87434
Pull Request: llvm#156841
Created using spr 1.3.8-beta.1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant