diff options
| author | Jakub Jelinek <jakub@redhat.com> | 2024-05-22 09:12:28 +0200 |
|---|---|---|
| committer | Jakub Jelinek <jakub@redhat.com> | 2024-05-22 09:12:28 +0200 |
| commit | d3c506eff54fcbac389a529c2e98da108a410b7f (patch) | |
| tree | bd6c9eabf320895944687f0defa001963259263e | |
| parent | 73a167cfa225d5ee7092d41596b9fea1719898ff (diff) | |
| download | gcc-d3c506eff54fcbac389a529c2e98da108a410b7f.zip gcc-d3c506eff54fcbac389a529c2e98da108a410b7f.tar.gz gcc-d3c506eff54fcbac389a529c2e98da108a410b7f.tar.bz2 | |
ubsan: Use right address space for MEM_REF created for bool/enum sanitization [PR115172]
The following testcase is miscompiled, because -fsanitize=bool,enum
creates a MEM_REF without propagating there address space qualifiers,
so what should be normally loaded using say %gs:/%fs: segment prefix
isn't. Together with asan it then causes that load to be sanitized.
2024-05-22 Jakub Jelinek <jakub@redhat.com>
PR sanitizer/115172
* ubsan.cc (instrument_bool_enum_load): If rhs is not in generic
address space, use qualified version of utype with the right
address space. Formatting fix.
* gcc.dg/asan/pr115172.c: New test.
| -rw-r--r-- | gcc/testsuite/gcc.dg/asan/pr115172.c | 20 | ||||
| -rw-r--r-- | gcc/ubsan.cc | 6 |
2 files changed, 25 insertions, 1 deletions
diff --git a/gcc/testsuite/gcc.dg/asan/pr115172.c b/gcc/testsuite/gcc.dg/asan/pr115172.c new file mode 100644 index 0000000..8707e61 --- /dev/null +++ b/gcc/testsuite/gcc.dg/asan/pr115172.c @@ -0,0 +1,20 @@ +/* PR sanitizer/115172 */ +/* { dg-do compile { target i?86-*-* x86_64-*-* } } */ +/* { dg-options "-O2 -fsanitize=address,bool -ffat-lto-objects -fdump-tree-asan1" } */ +/* { dg-final { scan-tree-dump-not "\.ASAN_CHECK " "asan1" } } */ + +#ifdef __x86_64__ +#define SEG __seg_gs +#else +#define SEG __seg_fs +#endif + +extern struct S { _Bool b; } s; +void bar (void); + +void +foo (void) +{ + if (*(volatile _Bool SEG *) (__UINTPTR_TYPE__) &s.b) + bar (); +} diff --git a/gcc/ubsan.cc b/gcc/ubsan.cc index fb00dc2..76ca7a0 100644 --- a/gcc/ubsan.cc +++ b/gcc/ubsan.cc @@ -1776,13 +1776,17 @@ instrument_bool_enum_load (gimple_stmt_iterator *gsi) || TREE_CODE (gimple_assign_lhs (stmt)) != SSA_NAME) return; + addr_space_t as = TYPE_ADDR_SPACE (TREE_TYPE (rhs)); + if (as != TYPE_ADDR_SPACE (utype)) + utype = build_qualified_type (utype, TYPE_QUALS (utype) + | ENCODE_QUAL_ADDR_SPACE (as)); bool ends_bb = stmt_ends_bb_p (stmt); location_t loc = gimple_location (stmt); tree lhs = gimple_assign_lhs (stmt); tree ptype = build_pointer_type (TREE_TYPE (rhs)); tree atype = reference_alias_ptr_type (rhs); gimple *g = gimple_build_assign (make_ssa_name (ptype), - build_fold_addr_expr (rhs)); + build_fold_addr_expr (rhs)); gimple_set_location (g, loc); gsi_insert_before (gsi, g, GSI_SAME_STMT); tree mem = build2 (MEM_REF, utype, gimple_assign_lhs (g), |