Sid,
Thanks a lot for the review.
> On Apr 10, 2024, at 17:46, Siddhesh Poyarekar <siddh...@gotplt.org> wrote:
>
> On 2024-03-29 12:07, Qing Zhao wrote:
>> gcc/c-family/ChangeLog:
>> * c-ubsan.cc (get_bound_from_access_with_size): New function.
>> (ubsan_instrument_bounds): Handle call to .ACCESS_WITH_SIZE.
>> gcc/testsuite/ChangeLog:
>> * gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test.
>> * gcc.dg/ubsan/flex-array-counted-by-bounds-3.c: New test.
>> * gcc.dg/ubsan/flex-array-counted-by-bounds-4.c: New test.
>> * gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test.
>> ---
>
> This version looks fine to me for stage 1, but I'm not a maintainer so you'll
> need an ack from one to commit.
This patch is purely C FE changes. Joseph already approved it.
thanks.
Qing
>
> Thanks,
> Sid
>
>> gcc/c-family/c-ubsan.cc | 42 +++++++++++++++++
>> .../ubsan/flex-array-counted-by-bounds-2.c | 45 ++++++++++++++++++
>> .../ubsan/flex-array-counted-by-bounds-3.c | 34 ++++++++++++++
>> .../ubsan/flex-array-counted-by-bounds-4.c | 34 ++++++++++++++
>> .../ubsan/flex-array-counted-by-bounds.c | 46 +++++++++++++++++++
>> 5 files changed, 201 insertions(+)
>> create mode 100644
>> gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
>> create mode 100644
>> gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
>> create mode 100644
>> gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
>> create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
>> diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc
>> index 940982819ddf..7cd3c6aa5b88 100644
>> --- a/gcc/c-family/c-ubsan.cc
>> +++ b/gcc/c-family/c-ubsan.cc
>> @@ -376,6 +376,40 @@ ubsan_instrument_return (location_t loc)
>> return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc,
>> data));
>> }
>> +/* Get the tree that represented the number of counted_by, i.e, the maximum
>> + number of the elements of the object that the call to .ACCESS_WITH_SIZE
>> + points to, this number will be the bound of the corresponding array. */
>> +static tree
>> +get_bound_from_access_with_size (tree call)
>> +{
>> + if (!is_access_with_size_p (call))
>> + return NULL_TREE;
>> +
>> + tree ref_to_size = CALL_EXPR_ARG (call, 1);
>> + unsigned int class_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2));
>> + tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3));
>> + tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size),
>> + build_int_cst (ptr_type_node, 0));
>> + /* If size is negative value, treat it as zero. */
>> + if (!TYPE_UNSIGNED (type))
>> + {
>> + tree cond = fold_build2 (LT_EXPR, boolean_type_node,
>> + unshare_expr (size), build_zero_cst (type));
>> + size = fold_build3 (COND_EXPR, type, cond,
>> + build_zero_cst (type), size);
>> + }
>> +
>> + /* Only when class_of_size is 1, i.e, the number of the elements of
>> + the object type, return the size. */
>> + if (class_of_size != 1)
>> + return NULL_TREE;
>> + else
>> + size = fold_convert (sizetype, size);
>> +
>> + return size;
>> +}
>> +
>> +
>> /* Instrument array bounds for ARRAY_REFs. We create special builtin,
>> that gets expanded in the sanopt pass, and make an array dimension
>> of it. ARRAY is the array, *INDEX is an index to the array.
>> @@ -401,6 +435,14 @@ ubsan_instrument_bounds (location_t loc, tree array,
>> tree *index,
>> && COMPLETE_TYPE_P (type)
>> && integer_zerop (TYPE_SIZE (type)))
>> bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1);
>> + else if (INDIRECT_REF_P (array)
>> + && is_access_with_size_p ((TREE_OPERAND (array, 0))))
>> + {
>> + bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0)));
>> + bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound),
>> + bound,
>> + build_int_cst (TREE_TYPE (bound), 1));
>> + }
>> else
>> return NULL_TREE;
>> }
>> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
>> b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
>> new file mode 100644
>> index 000000000000..b503320628d2
>> --- /dev/null
>> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
>> @@ -0,0 +1,45 @@
>> +/* Test the attribute counted_by and its usage in
>> + bounds sanitizer combined with VLA. */
>> +/* { dg-do run } */
>> +/* { dg-options "-fsanitize=bounds" } */
>> +/* { dg-output "index 11 out of bounds for type 'int
>> \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
>> +/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int
>> \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
>> +/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int
>> \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
>> +/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int
>> \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */
>> +
>> +
>> +#include <stdlib.h>
>> +
>> +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m)
>> +{
>> + struct foo {
>> + int n;
>> + int p[][n] __attribute__((counted_by(n)));
>> + } *f;
>> +
>> + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n]));
>> + f->n = m;
>> + f->p[m][n-1]=1;
>> + return;
>> +}
>> +
>> +void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2,
>> int m)
>> +{
>> + struct foo {
>> + int n;
>> + int p[][n2][n1] __attribute__((counted_by(n)));
>> + } *f;
>> +
>> + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1]));
>> + f->n = m;
>> + f->p[m][n2][n1]=1;
>> + return;
>> +}
>> +
>> +int main(int argc, char *argv[])
>> +{
>> + setup_and_test_vla (10, 11);
>> + setup_and_test_vla_1 (10, 11, 20);
>> + return 0;
>> +}
>> +
>> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
>> b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
>> new file mode 100644
>> index 000000000000..9da25644af3e
>> --- /dev/null
>> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c
>> @@ -0,0 +1,34 @@
>> +/* Test the attribute counted_by and its usage in bounds
>> + sanitizer. when counted_by field is negative value. */
>> +/* { dg-do run } */
>> +/* { dg-options "-fsanitize=bounds" } */
>> +
>> +#include <stdlib.h>
>> +
>> +struct annotated {
>> + int b;
>> + int c[] __attribute__ ((counted_by (b)));
>> +} *array_annotated;
>> +
>> +void __attribute__((__noinline__)) setup (int annotated_count)
>> +{
>> + array_annotated
>> + = (struct annotated *)malloc (sizeof (struct annotated));
>> + array_annotated->b = annotated_count;
>> +
>> + return;
>> +}
>> +
>> +void __attribute__((__noinline__)) test (int annotated_index)
>> +{
>> + array_annotated->c[annotated_index] = 2;
>> +}
>> +
>> +int main(int argc, char *argv[])
>> +{
>> + setup (-3);
>> + test (2);
>> + return 0;
>> +}
>> +
>> +/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */
>> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
>> b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
>> new file mode 100644
>> index 000000000000..bd7e144274fc
>> --- /dev/null
>> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c
>> @@ -0,0 +1,34 @@
>> +/* Test the attribute counted_by and its usage in bounds
>> + sanitizer. when counted_by field is zero value. */
>> +/* { dg-do run } */
>> +/* { dg-options "-fsanitize=bounds" } */
>> +
>> +#include <stdlib.h>
>> +
>> +struct annotated {
>> + int b;
>> + int c[] __attribute__ ((counted_by (b)));
>> +} *array_annotated;
>> +
>> +void __attribute__((__noinline__)) setup (int annotated_count)
>> +{
>> + array_annotated
>> + = (struct annotated *)malloc (sizeof (struct annotated));
>> + array_annotated->b = annotated_count;
>> +
>> + return;
>> +}
>> +
>> +void __attribute__((__noinline__)) test (int annotated_index)
>> +{
>> + array_annotated->c[annotated_index] = 2;
>> +}
>> +
>> +int main(int argc, char *argv[])
>> +{
>> + setup (0);
>> + test (1);
>> + return 0;
>> +}
>> +
>> +/* { dg-output "24:21: runtime error: index 1 out of bounds for type" } */
>> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
>> b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
>> new file mode 100644
>> index 000000000000..e2b911dde626
>> --- /dev/null
>> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
>> @@ -0,0 +1,46 @@
>> +/* Test the attribute counted_by and its usage in
>> + bounds sanitizer. */
>> +/* { dg-do run } */
>> +/* { dg-options "-fsanitize=bounds" } */
>> +
>> +#include <stdlib.h>
>> +
>> +struct flex {
>> + int b;
>> + int c[];
>> +} *array_flex;
>> +
>> +struct annotated {
>> + int b;
>> + int c[] __attribute__ ((counted_by (b)));
>> +} *array_annotated;
>> +
>> +void __attribute__((__noinline__)) setup (int normal_count, int
>> annotated_count)
>> +{
>> + array_flex
>> + = (struct flex *)malloc (sizeof (struct flex)
>> + + normal_count * sizeof (int));
>> + array_flex->b = normal_count;
>> +
>> + array_annotated
>> + = (struct annotated *)malloc (sizeof (struct annotated)
>> + + annotated_count * sizeof (int));
>> + array_annotated->b = annotated_count;
>> +
>> + return;
>> +}
>> +
>> +void __attribute__((__noinline__)) test (int normal_index, int
>> annotated_index)
>> +{
>> + array_flex->c[normal_index] = 1;
>> + array_annotated->c[annotated_index] = 2;
>> +}
>> +
>> +int main(int argc, char *argv[])
>> +{
>> + setup (10, 10);
>> + test (10, 10);
>> + return 0;
>> +}
>> +
>> +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */
