diff options
author | Anatoly Trosinenko <atrosinenko@accesssoftek.com> | 2025-08-25 14:24:19 +0300 |
---|---|---|
committer | GitHub <noreply@github.com> | 2025-08-25 14:24:19 +0300 |
commit | 58edd2767097cfcbeb4a076ca51b379e307a3573 (patch) | |
tree | aef26d6bfd5b8b2ba7279ffd09100888be5aa1d8 /clang/lib/CodeGen/CodeGenFunction.cpp | |
parent | f8f6965ceece9e330ddb66db5f402ecfb5e3ad34 (diff) | |
download | llvm-58edd2767097cfcbeb4a076ca51b379e307a3573.zip llvm-58edd2767097cfcbeb4a076ca51b379e307a3573.tar.gz llvm-58edd2767097cfcbeb4a076ca51b379e307a3573.tar.bz2 |
[BOLT] Gadget scanner: account for BRK when searching for auth oracles (#137975)
An authenticated pointer can be explicitly checked by the compiler via a
sequence of instructions that executes BRK on failure. It is important
to recognize such BRK instruction as checking every register (as it is
expected to immediately trigger an abnormal program termination) to
prevent false positive reports about authentication oracles:
autia x2, x3
autia x0, x1
; neither x0 nor x2 are checked at this point
eor x16, x0, x0, lsl #1
tbz x16, #62, on_success ; marks x0 as checked
; end of BB: for x2 to be checked here, it must be checked in both
; successor basic blocks
on_failure:
brk 0xc470
on_success:
; x2 is checked
ldr x1, [x2] ; marks x2 as checked
Diffstat (limited to 'clang/lib/CodeGen/CodeGenFunction.cpp')
0 files changed, 0 insertions, 0 deletions