https://github.com/vabridgers created https://github.com/llvm/llvm-project/pull/115791
Fixes https://github.com/llvm/llvm-project/issues/48168 Under certain conditions, the front end does not detect a possible overflow address calculations until codegen. This change emits a warning instead of allowing the compiler to crash. ``` clang: <root>/clang/lib/CodeGen/CGExprScalar.cpp:5834: llvm::Value* clang::CodeGen::CodeGenFunction::EmitCheckedInBoundsGEP( llvm::Type*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, bool, bool, clang::SourceLocation, const llvm::Twine&): Assertion `(!isa<llvm::Constant>(EvaluatedGEP.TotalOffset) || EvaluatedGEP.OffsetOverflows == Builder.getFalse()) && "If the offset got constant-folded, we don't expect that there was an " "overflow."' failed. 0. Program arguments: clang -c --target=x86_64-- -fsanitize=undefined ubsan-emit-bounds-check-crash-x86.c 1. <eof> parser at end of file 2. ubsan-emit-bounds-check-crash-x86.c:4:5: LLVM IR generation of declaration 'main' 3. ubsan-emit-bounds-check-crash-x86.c:4:5: Generating code for declaration 'main' ... #9 <addr> clang::CodeGen::CodeGenFunction::EmitCheckedInBoundsGEP(clang::CodeGen::Address, llvm::ArrayRef<llvm::Value*>, llvm::Type*, bool, bool, clang::SourceLocation, clang::CharUnits, llvm::Twine const&) llvm::ArrayRef<llvm::Value*>, clang::QualType, bool, bool, clang::SourceLocation, clang::QualType*, clang::Expr const*, llvm::Twine const&) CGExpr.cpp:0:0 bool) ``` >From 90d95dd89a9c2f7b8c8b71c1042ad61d0a6e6729 Mon Sep 17 00:00:00 2001 From: Vince Bridgers <vince.a.bridg...@ericsson.com> Date: Tue, 12 Nov 2024 00:56:14 +0100 Subject: [PATCH] [codegen] Fix crash in codegan caused by pointer calculation overflow Fixes https://github.com/llvm/llvm-project/issues/48168 Under certain conditions, the front end does not detect a possible overflow address calculations until codegen. This change emits a warning instead of allowing the compiler to crash. clang: <root>/clang/lib/CodeGen/CGExprScalar.cpp:5834: llvm::Value* clang::CodeGen::CodeGenFunction::EmitCheckedInBoundsGEP( llvm::Type*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, bool, bool, clang::SourceLocation, const llvm::Twine&): Assertion `(!isa<llvm::Constant>(EvaluatedGEP.TotalOffset) || EvaluatedGEP.OffsetOverflows == Builder.getFalse()) && "If the offset got constant-folded, we don't expect that there was an " "overflow."' failed. 0. Program arguments: clang -c --target=x86_64-- -fsanitize=undefined ubsan-emit-bounds-check-crash-x86.c 1. <eof> parser at end of file 2. ubsan-emit-bounds-check-crash-x86.c:4:5: LLVM IR generation of declaration 'main' 3. ubsan-emit-bounds-check-crash-x86.c:4:5: Generating code for declaration 'main' ... #9 <addr> clang::CodeGen::CodeGenFunction::EmitCheckedInBoundsGEP(clang::CodeGen::Address, llvm::ArrayRef<llvm::Value*>, llvm::Type*, bool, bool, clang::SourceLocation, clang::CharUnits, llvm::Twine const&) llvm::ArrayRef<llvm::Value*>, clang::QualType, bool, bool, clang::SourceLocation, clang::QualType*, clang::Expr const*, llvm::Twine const&) CGExpr.cpp:0:0 bool) --- clang/lib/CodeGen/CGExprScalar.cpp | 13 +++++++++---- .../CodeGen/ubsan-emit-bounds-check-crash-msp.c | 7 +++++++ .../CodeGen/ubsan-emit-bounds-check-crash-x86.c | 7 +++++++ 3 files changed, 23 insertions(+), 4 deletions(-) create mode 100644 clang/test/CodeGen/ubsan-emit-bounds-check-crash-msp.c create mode 100644 clang/test/CodeGen/ubsan-emit-bounds-check-crash-x86.c diff --git a/clang/lib/CodeGen/CGExprScalar.cpp b/clang/lib/CodeGen/CGExprScalar.cpp index 287d911e10ba58..5ed865820a9151 100644 --- a/clang/lib/CodeGen/CGExprScalar.cpp +++ b/clang/lib/CodeGen/CGExprScalar.cpp @@ -5831,10 +5831,15 @@ CodeGenFunction::EmitCheckedInBoundsGEP(llvm::Type *ElemTy, Value *Ptr, GEPOffsetAndOverflow EvaluatedGEP = EmitGEPOffsetInBytes(Ptr, GEPVal, getLLVMContext(), CGM, Builder); - assert((!isa<llvm::Constant>(EvaluatedGEP.TotalOffset) || - EvaluatedGEP.OffsetOverflows == Builder.getFalse()) && - "If the offset got constant-folded, we don't expect that there was an " - "overflow."); + if (!(!isa<llvm::Constant>(EvaluatedGEP.TotalOffset) || + EvaluatedGEP.OffsetOverflows == Builder.getFalse())) { + DiagnosticsEngine &Diags = CGM.getDiags(); + unsigned DiagID = Diags.getCustomDiagID( + DiagnosticsEngine::Error, "Expression caused pointer calculation " + "overflow during code generation"); + Diags.Report(Loc, DiagID); + return GEPVal; + } auto *Zero = llvm::ConstantInt::getNullValue(IntPtrTy); diff --git a/clang/test/CodeGen/ubsan-emit-bounds-check-crash-msp.c b/clang/test/CodeGen/ubsan-emit-bounds-check-crash-msp.c new file mode 100644 index 00000000000000..b4da2f2b7ee720 --- /dev/null +++ b/clang/test/CodeGen/ubsan-emit-bounds-check-crash-msp.c @@ -0,0 +1,7 @@ +// REQUIRES: msp430-registered-target +// RUN: %clang -c -fsanitize=undefined -Wno-tentative-definition-array -Wno-return-type -Wno-unused-value -Wno-array-bounds -Xclang -verify --target=msp430-- %s +int a; +_Complex double b[1][1]; +void c(void) { + b[a][8920]; // expected-error {{Expression caused pointer calculation overflow during code generation}} +} diff --git a/clang/test/CodeGen/ubsan-emit-bounds-check-crash-x86.c b/clang/test/CodeGen/ubsan-emit-bounds-check-crash-x86.c new file mode 100644 index 00000000000000..63bda82c14ae20 --- /dev/null +++ b/clang/test/CodeGen/ubsan-emit-bounds-check-crash-x86.c @@ -0,0 +1,7 @@ +// REQUIRES: x86-registered-target +// RUN: %clang -c -Wno-tentative-definition-array -Wno-return-type -Wno-unused-value -Wno-array-bounds -Xclang -verify --target=x86_64-- -fsanitize=undefined %s +int **a[]; +int main() { + (*a)[3300220222222200000]; // expected-error {{Expression caused pointer calculation overflow during code generation}} + return 0; +} _______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
