RPCS3/llvm
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm.git synced 2025-02-15 08:19:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[MSan] Move the access address check before the shadow access for that address

Browse Source 
MSan used to insert the shadow check of the store pointer operand
_after_ the shadow of the value operand has been written.
This happens to work in the userspace, as the whole shadow range is
always mapped. However in the kernel the shadow page may not exist, so
the bug may cause a crash.

This patch moves the address check in front of the shadow access.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@318901 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Alexander Potapenko 2017-11-23 08:34:32 +00:00
parent 9052cc8ec7
commit a99f2a1277
2 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/Transforms/Instrumentation/MemorySanitizer.cpp
View File

@ -830,10 +830,9 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
StoreInst *NewSI =
IRB.CreateAlignedStore(Shadow, ShadowPtr, SI->getAlignment());
DEBUG(dbgs() << " STORE: " << *NewSI << "\n");
(void)NewSI;
if (ClCheckAccessAddress)
insertShadowCheck(Addr, SI);
insertShadowCheck(Addr, NewSI);
if (SI->isAtomic())
SI->setOrdering(addReleaseOrdering(SI->getOrdering()));

22
test/Instrumentation/MemorySanitizer/check_access_address.ll
View File

@ -26,3 +26,25 @@ entry:
; CHECK-LABEL: @ByValArgumentShadowSmallAlignment
; CHECK: call void @llvm.memcpy.p0i8.p0i8.i64(i8* {{.*}}, i8* {{.*}}, i64 2, i32 2, i1 false)
; CHECK: ret i16
; Check instrumentation of stores. The check must precede the shadow store.
define void @Store(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
entry:
store i32 %x, i32* %p, align 4
ret void
}
; CHECK-LABEL: @Store
; CHECK: load {{.*}} @__msan_param_tls
; CHECK: icmp
; CHECK: br i1
; CHECK: <label>
; CHECK: call void @__msan_warning_noreturn
; CHECK: <label>
; CHECK: store
; CHECK: store i32 %x
; CHECK: ret void