FreeChainXenon/gcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ubsan: Use right address space for MEM_REF created for bool/enum sanitization [PR115172]

Browse source 
The following testcase is miscompiled, because -fsanitize=bool,enum
creates a MEM_REF without propagating there address space qualifiers,
so what should be normally loaded using say %gs:/%fs: segment prefix
isn't.  Together with asan it then causes that load to be sanitized.

2024-05-22  Jakub Jelinek  <jakub@redhat.com>

	PR sanitizer/115172
	* ubsan.cc (instrument_bool_enum_load): If rhs is not in generic
	address space, use qualified version of utype with the right
	address space.  Formatting fix.

	* gcc.dg/asan/pr115172.c: New test.

(cherry picked from commit d3c506eff54fcbac389a529c2e98da108a410b7f)
This commit is contained in:
Jakub Jelinek 2024-05-22 09:12:28 +02:00
parent 1ad5c9d524
commit d224c7d8d8
2 changed files with 25 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
gcc/testsuite/gcc.dg/asan/pr115172.c Normal file
View file

@ -0,0 +1,20 @@
/* PR sanitizer/115172 */
/* { dg-do compile { target i?86-*-* x86_64-*-* } } */
/* { dg-options "-O2 -fsanitize=address,bool -ffat-lto-objects -fdump-tree-asan1" } */
/* { dg-final { scan-tree-dump-not "\.ASAN_CHECK " "asan1" } } */
#ifdef __x86_64__
#define SEG __seg_gs
#else
#define SEG __seg_fs
#endif
extern struct S { _Bool b; } s;
void bar (void);
void
foo (void)
{
if (*(volatile _Bool SEG *) (__UINTPTR_TYPE__) &s.b)
bar ();
}

4
gcc/ubsan.cc
View file

@ -1776,6 +1776,10 @@ instrument_bool_enum_load (gimple_stmt_iterator *gsi)
|| TREE_CODE (gimple_assign_lhs (stmt)) != SSA_NAME)
return;
addr_space_t as = TYPE_ADDR_SPACE (TREE_TYPE (rhs));
if (as != TYPE_ADDR_SPACE (utype))
utype = build_qualified_type (utype, TYPE_QUALS (utype)
| ENCODE_QUAL_ADDR_SPACE (as));
bool ends_bb = stmt_ends_bb_p (stmt);
location_t loc = gimple_location (stmt);
tree lhs = gimple_assign_lhs (stmt);