https://github.com/atrosinenko updated
https://github.com/llvm/llvm-project/pull/136151
>From f81401c81dfcb247cc8b5c08b9594bf78ef0af1e Mon Sep 17 00:00:00 2001
From: Anatoly Trosinenko <atrosine...@accesssoftek.com>
Date: Tue, 15 Apr 2025 21:47:18 +0300
Subject: [PATCH] [BOLT] Gadget scanner: do not crash on debug-printing CFI
instructions
Some instruction-printing code used under LLVM_DEBUG does not handle CFI
instructions well. While CFI instructions seem to be harmless for the
correctness of the analysis results, they do not convey any useful
information to the analysis either, so skip them early.
---
bolt/lib/Passes/PAuthGadgetScanner.cpp | 16 ++++++++++
.../AArch64/gs-pauth-debug-output.s | 32 +++++++++++++++++++
2 files changed, 48 insertions(+)
diff --git a/bolt/lib/Passes/PAuthGadgetScanner.cpp
b/bolt/lib/Passes/PAuthGadgetScanner.cpp
index c18829bc313a8..cd7c077a6412e 100644
--- a/bolt/lib/Passes/PAuthGadgetScanner.cpp
+++ b/bolt/lib/Passes/PAuthGadgetScanner.cpp
@@ -431,6 +431,9 @@ class SrcSafetyAnalysis {
}
SrcState computeNext(const MCInst &Point, const SrcState &Cur) {
+ if (BC.MIB->isCFI(Point))
+ return Cur;
+
SrcStatePrinter P(BC);
LLVM_DEBUG({
dbgs() << " SrcSafetyAnalysis::ComputeNext(";
@@ -674,6 +677,8 @@ class CFGUnawareSrcSafetyAnalysis : public
SrcSafetyAnalysis {
SrcState S = createEntryState();
for (auto &I : BF.instrs()) {
MCInst &Inst = I.second;
+ if (BC.MIB->isCFI(Inst))
+ continue;
// If there is a label before this instruction, it is possible that it
// can be jumped-to, thus conservatively resetting S. As an exception,
@@ -959,6 +964,9 @@ class DstSafetyAnalysis {
}
DstState computeNext(const MCInst &Point, const DstState &Cur) {
+ if (BC.MIB->isCFI(Point))
+ return Cur;
+
DstStatePrinter P(BC);
LLVM_DEBUG({
dbgs() << " DstSafetyAnalysis::ComputeNext(";
@@ -1135,6 +1143,8 @@ class CFGUnawareDstSafetyAnalysis : public
DstSafetyAnalysis {
DstState S = createUnsafeState();
for (auto &I : llvm::reverse(BF.instrs())) {
MCInst &Inst = I.second;
+ if (BC.MIB->isCFI(Inst))
+ continue;
// If Inst can change the control flow, we cannot be sure that the next
// instruction (to be executed in analyzed program) is the one processed
@@ -1333,6 +1343,9 @@ void FunctionAnalysisContext::findUnsafeUses(
});
iterateOverInstrs(BF, [&](MCInstReference Inst) {
+ if (BC.MIB->isCFI(Inst))
+ return;
+
const SrcState &S = Analysis->getStateBefore(Inst);
// If non-empty state was never propagated from the entry basic block
@@ -1396,6 +1409,9 @@ void FunctionAnalysisContext::findUnsafeDefs(
});
iterateOverInstrs(BF, [&](MCInstReference Inst) {
+ if (BC.MIB->isCFI(Inst))
+ return;
+
const DstState &S = Analysis->getStateAfter(Inst);
if (auto Report = shouldReportAuthOracle(BC, Inst, S))
diff --git a/bolt/test/binary-analysis/AArch64/gs-pauth-debug-output.s
b/bolt/test/binary-analysis/AArch64/gs-pauth-debug-output.s
index 61aa84377b88e..5aec945621987 100644
--- a/bolt/test/binary-analysis/AArch64/gs-pauth-debug-output.s
+++ b/bolt/test/binary-analysis/AArch64/gs-pauth-debug-output.s
@@ -329,6 +329,38 @@ auth_oracle:
// PAUTH-EMPTY:
// PAUTH-NEXT: Attaching leakage info to: 00000000: autia x0, x1
# DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts:
[0](0x{{[0-9a-f]+}} )>
+// Gadget scanner should not crash on CFI instructions, including when
debug-printing them.
+// Note that the particular debug output is not checked, but BOLT should be
+// compiled with assertions enabled to support -debug-only argument.
+
+ .globl cfi_inst_df
+ .type cfi_inst_df,@function
+cfi_inst_df:
+ .cfi_startproc
+ sub sp, sp, #16
+ .cfi_def_cfa_offset 16
+ add sp, sp, #16
+ .cfi_def_cfa_offset 0
+ ret
+ .size cfi_inst_df, .-cfi_inst_df
+ .cfi_endproc
+
+ .globl cfi_inst_nocfg
+ .type cfi_inst_nocfg,@function
+cfi_inst_nocfg:
+ .cfi_startproc
+ sub sp, sp, #16
+ .cfi_def_cfa_offset 16
+
+ adr x0, 1f
+ br x0
+1:
+ add sp, sp, #16
+ .cfi_def_cfa_offset 0
+ ret
+ .size cfi_inst_nocfg, .-cfi_inst_nocfg
+ .cfi_endproc
+
// CHECK-LABEL:Analyzing function main, AllocatorId = 1
.globl main
.type main,@function
_______________________________________________
llvm-branch-commits mailing list
llvm-branch-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-branch-commits
