https://bugs.llvm.org/show_bug.cgi?id=46990
Bug ID: 46990
Summary: [coroutines] Use-after-free by access to coroutine
frame after await_suspend()
Product: clang
Version: 11.0
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P
Component: C2x
Assignee: unassignedclangb...@nondot.org
Reporter: alexander.vandergrin...@gmail.com
CC: blitzrak...@gmail.com, erik.pilking...@gmail.com,
llvm-bugs@lists.llvm.org, richard-l...@metafoo.co.uk
Created attachment 23813
--> https://bugs.llvm.org/attachment.cgi?id=23813&action=edit
Preprocessed source code
With some optimization options (-O2 and -fsanitize=undefined in this case),
LLVM generates instructions that access coroutine frames after calling
await_suspend() but before returning to the caller/resumer of a coroutine. This
leads to use-after-free if the coroutine is freed before control returns to the
caller. Below is a snippet of LLVM code that demonstrates this; the GEP
instructions cause a bogus access.
The preprocessed source is attached (but unfortunately, I was unable to reduce
the bug to a toy example). Compile with:
clang++ -std=c++20 -O2 -fsanitize=undefined -S -emit-llvm -o out.S out.cpp
This bug happens both with Clang 10.0.1 and 11.0.0-rc1.
Relevant LLVM code:
-------------------
invoke void
@_ZN5async14sender_awaiterIN4thor18CopyFromViewSenderEvE13await_suspendENSt12experimental16coroutine_handleIvEE(%"struct.async::sender_awaiter.44"*
nonnull %31, i8* nonnull %2)
to label %725 unwind label %745
725: ; preds = %723
%726 = getelementptr inbounds
%_ZN4thor15loadModuleImageEN7smarter10shared_ptrINS_12AddressSpaceE14BindableHandleEEmN5frigg9SharedPtrINS_10MemoryViewENS5_13SharedControlEEE.Frame,
%_ZN4thor15loadModuleImageEN7smarter10shared_ptrINS_12AddressSpaceE14BindableHandleEEmN5frigg9SharedPtrINS_10MemoryViewENS5_13SharedControlEEE.Frame*
%0, i64 0, i32 32
%727 = getelementptr inbounds
%_ZN4thor15loadModuleImageEN7smarter10shared_ptrINS_12AddressSpaceE14BindableHandleEEmN5frigg9SharedPtrINS_10MemoryViewENS5_13SharedControlEEE.Frame,
%_ZN4thor15loadModuleImageEN7smarter10shared_ptrINS_12AddressSpaceE14BindableHandleEEmN5frigg9SharedPtrINS_10MemoryViewENS5_13SharedControlEEE.Frame*
%0, i64 0, i32 31
br label %856
--
You are receiving this mail because:
You are on the CC list for the bug._______________________________________________
llvm-bugs mailing list
llvm-bugs@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
