From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from rusty.tulip.relay.mailchannels.net (rusty.tulip.relay.mailchannels.net [23.83.218.252]) by sourceware.org (Postfix) with ESMTPS id A9C2E386F443 for ; Wed, 10 Apr 2024 21:46:38 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org A9C2E386F443 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=gotplt.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gotplt.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org A9C2E386F443 Authentication-Results: server2.sourceware.org; arc=pass smtp.remote-ip=23.83.218.252 ARC-Seal: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1712785609; cv=pass; b=YOU2afqB+IXnMVTcIPTdhkUSFVTXrjpPXSTDcDo62kGDvCtMn07tfPVeOsQWDisjMZ2BMNTRt07N7o+5nfb55ZyHMNSwah7dydoDz9PWtZTc7+AK2xAkKOfmgU+C7+k+2ftY+Tw2GWVYCiJfNVqpWA8F7tjj9dUR+syyKx+C0wc= ARC-Message-Signature: i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1712785609; c=relaxed/simple; bh=hW80Hk2bYmNkP3tzI1USvlsNNzKzCbVkTCUU9kBsq1s=; h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From; b=Lu0loF+qqORbSzx6N6A3ogrtQ2191p5z3PVzRAi6hbcpm2ngMzagtENpLwhvqD7S/ohAC1Uxy+reQm3C1vToIokHVuQP4NHaaGRxVJsBx198TBqf4k1VTZJdb4v7xI1RN3D+LoIGK9s+mLEG9XFZbVZTWct6z64W/JiWHmYBNj4= ARC-Authentication-Results: i=2; server2.sourceware.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 1C74D7A16E3; Wed, 10 Apr 2024 21:46:37 +0000 (UTC) Received: from pdx1-sub0-mail-a300.dreamhost.com (unknown [127.0.0.6]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id ABEE87A10A0; Wed, 10 Apr 2024 21:46:36 +0000 (UTC) ARC-Seal: i=1; s=arc-2022; d=mailchannels.net; t=1712785596; a=rsa-sha256; cv=none; b=Zu2+NLN6HjIeUnUf+HgaK6giA1RytKW7RQ2IsUvLVcCXn2Q89pd/9uhYZW+Hr4qqESiS8W TTQwdbamZdnOdILkIXexFzr6CpUVv1yWDfrKy8NKjVlfrSblxjpEbAAAQ8JghsKJ7knUYH uQQukUMB1ioOrkwrR9vVCYWqlQN6/kekK9sMtwlKczw9ma3boUyqqsBgbXvPprciY40oB+ Z31JsxQM/RJD3xTqLVvvGfKFNOWF/fPBxtSNUPyYtYKwaDTFRgl0HRYPcLFwK4gfSUwTx1 wArFC7FOpP01QoDJ3YP2bUb3HTiNy3nkY1l0c8l6lgyz9upNbFYWxBM4q4FL3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1712785596; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=fr16g0nL6WS58OAV+rNQ2YdNcVEMGxjKfguaevN8JFk=; b=4GpyzTLk1qoobXW04Iefv+KNbG9eLU8EAceg2WytAZt1cO5EBaOCzaypsKwZRl12Iasude /xuz9CiWh6I1Iv17X5nY9g4C7bzd5wr9ABkFJs1EFpjgSvkRSg8pddcWI2h7LNZ9PX/E9O uGKONjpPJHI8PAShLLrGLb2unYda6JBjulKaS77Wrr5dgGSmW3WJu3rxZ0Ui5DV+wJvonl yXOoyOGMTOE+CdKi8LR1Tq+P6cR5dEmVO9K6wgSHjZpzYT86y8vTidbrAWno3ygbI+9vrE n8Owj+yzBjG1dulkRo9OULPp1krRniKOWx6Ugc+zE/ZBeHMaQ+cm7u9CVUyQ8Q== ARC-Authentication-Results: i=1; rspamd-878bcf566-kjpw6; auth=pass smtp.auth=dreamhost smtp.mailfrom=siddhesh@gotplt.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|siddhesh@gotplt.org X-MailChannels-Auth-Id: dreamhost X-Hysterical-Descriptive: 3cc04a5349131190_1712785596994_1333307587 X-MC-Loop-Signature: 1712785596994:1144136267 X-MC-Ingress-Time: 1712785596994 Received: from pdx1-sub0-mail-a300.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.105.166.229 (trex/6.9.2); Wed, 10 Apr 2024 21:46:36 +0000 Received: from [192.168.0.182] (bras-base-toroon4859w-grc-87-216-209-248-251.dsl.bell.ca [216.209.248.251]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: siddhesh@gotplt.org) by pdx1-sub0-mail-a300.dreamhost.com (Postfix) with ESMTPSA id 4VFGcW5nyFz12x; Wed, 10 Apr 2024 14:46:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gotplt.org; s=dreamhost; t=1712785596; bh=fr16g0nL6WS58OAV+rNQ2YdNcVEMGxjKfguaevN8JFk=; h=Date:Subject:To:Cc:From:Content-Type:Content-Transfer-Encoding; b=mUnmoYs0mPb4qSOKKwypjyoyuoOJp/USQo2rrbaV9hpj8Dk0atlxifPGT5kKYqs4E SQdVJRObVCTQOH+xK1gBl+Z3nsuFyKqklUSoYQMluixpG6J4v085buAoEYhfMBIRDK mhz7cMWCcs0QQumViPmFT7uLvMuh1vEjuiUdorsyILyBxBnDZ90HByHvMtkocPOiGF I9F4LEE+NLzpLcxCw8Fevb02mxE7CFaga7bhD2d9UcztLXUqIJid2PX0LLUyvl4jRH PKHkt704gZfUJ8mzi5Ime21Rvn96IDs9eTrhuJNpc4JXi0AiPAPEo7uKoEpPNCa6Td LOWiEiEH4Vsow== Message-ID: <32312936-4cae-444c-8fab-1f6f81bbb86d@gotplt.org> Date: Wed, 10 Apr 2024 17:46:34 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v8 4/5] Use the .ACCESS_WITH_SIZE in bound sanitizer. To: Qing Zhao , josmyers@redhat.com, richard.guenther@gmail.com, uecker@tugraz.at Cc: keescook@chromium.org, isanbard@gmail.com, gcc-patches@gcc.gnu.org References: <20240329160703.4012941-1-qing.zhao@oracle.com> <20240329160703.4012941-5-qing.zhao@oracle.com> Content-Language: en-US From: Siddhesh Poyarekar In-Reply-To: <20240329160703.4012941-5-qing.zhao@oracle.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-3036.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On 2024-03-29 12:07, Qing Zhao wrote: > gcc/c-family/ChangeLog: > > * c-ubsan.cc (get_bound_from_access_with_size): New function. > (ubsan_instrument_bounds): Handle call to .ACCESS_WITH_SIZE. > > gcc/testsuite/ChangeLog: > > * gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test. > * gcc.dg/ubsan/flex-array-counted-by-bounds-3.c: New test. > * gcc.dg/ubsan/flex-array-counted-by-bounds-4.c: New test. > * gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test. > --- This version looks fine to me for stage 1, but I'm not a maintainer so you'll need an ack from one to commit. Thanks, Sid > gcc/c-family/c-ubsan.cc | 42 +++++++++++++++++ > .../ubsan/flex-array-counted-by-bounds-2.c | 45 ++++++++++++++++++ > .../ubsan/flex-array-counted-by-bounds-3.c | 34 ++++++++++++++ > .../ubsan/flex-array-counted-by-bounds-4.c | 34 ++++++++++++++ > .../ubsan/flex-array-counted-by-bounds.c | 46 +++++++++++++++++++ > 5 files changed, 201 insertions(+) > create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c > create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c > create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c > create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c > > diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc > index 940982819ddf..7cd3c6aa5b88 100644 > --- a/gcc/c-family/c-ubsan.cc > +++ b/gcc/c-family/c-ubsan.cc > @@ -376,6 +376,40 @@ ubsan_instrument_return (location_t loc) > return build_call_expr_loc (loc, t, 1, build_fold_addr_expr_loc (loc, data)); > } > > +/* Get the tree that represented the number of counted_by, i.e, the maximum > + number of the elements of the object that the call to .ACCESS_WITH_SIZE > + points to, this number will be the bound of the corresponding array. */ > +static tree > +get_bound_from_access_with_size (tree call) > +{ > + if (!is_access_with_size_p (call)) > + return NULL_TREE; > + > + tree ref_to_size = CALL_EXPR_ARG (call, 1); > + unsigned int class_of_size = TREE_INT_CST_LOW (CALL_EXPR_ARG (call, 2)); > + tree type = TREE_TYPE (CALL_EXPR_ARG (call, 3)); > + tree size = fold_build2 (MEM_REF, type, unshare_expr (ref_to_size), > + build_int_cst (ptr_type_node, 0)); > + /* If size is negative value, treat it as zero. */ > + if (!TYPE_UNSIGNED (type)) > + { > + tree cond = fold_build2 (LT_EXPR, boolean_type_node, > + unshare_expr (size), build_zero_cst (type)); > + size = fold_build3 (COND_EXPR, type, cond, > + build_zero_cst (type), size); > + } > + > + /* Only when class_of_size is 1, i.e, the number of the elements of > + the object type, return the size. */ > + if (class_of_size != 1) > + return NULL_TREE; > + else > + size = fold_convert (sizetype, size); > + > + return size; > +} > + > + > /* Instrument array bounds for ARRAY_REFs. We create special builtin, > that gets expanded in the sanopt pass, and make an array dimension > of it. ARRAY is the array, *INDEX is an index to the array. > @@ -401,6 +435,14 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index, > && COMPLETE_TYPE_P (type) > && integer_zerop (TYPE_SIZE (type))) > bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1); > + else if (INDIRECT_REF_P (array) > + && is_access_with_size_p ((TREE_OPERAND (array, 0)))) > + { > + bound = get_bound_from_access_with_size ((TREE_OPERAND (array, 0))); > + bound = fold_build2 (MINUS_EXPR, TREE_TYPE (bound), > + bound, > + build_int_cst (TREE_TYPE (bound), 1)); > + } > else > return NULL_TREE; > } > diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c > new file mode 100644 > index 000000000000..b503320628d2 > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c > @@ -0,0 +1,45 @@ > +/* Test the attribute counted_by and its usage in > + bounds sanitizer combined with VLA. */ > +/* { dg-do run } */ > +/* { dg-options "-fsanitize=bounds" } */ > +/* { dg-output "index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ > +/* { dg-output "\[^\n\r]*index 20 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ > +/* { dg-output "\[^\n\r]*index 11 out of bounds for type 'int \\\[\\\*\\\]\\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ > +/* { dg-output "\[^\n\r]*index 10 out of bounds for type 'int \\\[\\\*\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ > + > + > +#include > + > +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m) > +{ > + struct foo { > + int n; > + int p[][n] __attribute__((counted_by(n))); > + } *f; > + > + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n])); > + f->n = m; > + f->p[m][n-1]=1; > + return; > +} > + > +void __attribute__((__noinline__)) setup_and_test_vla_1 (int n1, int n2, int m) > +{ > + struct foo { > + int n; > + int p[][n2][n1] __attribute__((counted_by(n))); > + } *f; > + > + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n2][n1])); > + f->n = m; > + f->p[m][n2][n1]=1; > + return; > +} > + > +int main(int argc, char *argv[]) > +{ > + setup_and_test_vla (10, 11); > + setup_and_test_vla_1 (10, 11, 20); > + return 0; > +} > + > diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c > new file mode 100644 > index 000000000000..9da25644af3e > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-3.c > @@ -0,0 +1,34 @@ > +/* Test the attribute counted_by and its usage in bounds > + sanitizer. when counted_by field is negative value. */ > +/* { dg-do run } */ > +/* { dg-options "-fsanitize=bounds" } */ > + > +#include > + > +struct annotated { > + int b; > + int c[] __attribute__ ((counted_by (b))); > +} *array_annotated; > + > +void __attribute__((__noinline__)) setup (int annotated_count) > +{ > + array_annotated > + = (struct annotated *)malloc (sizeof (struct annotated)); > + array_annotated->b = annotated_count; > + > + return; > +} > + > +void __attribute__((__noinline__)) test (int annotated_index) > +{ > + array_annotated->c[annotated_index] = 2; > +} > + > +int main(int argc, char *argv[]) > +{ > + setup (-3); > + test (2); > + return 0; > +} > + > +/* { dg-output "24:21: runtime error: index 2 out of bounds for type" } */ > diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c > new file mode 100644 > index 000000000000..bd7e144274fc > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-4.c > @@ -0,0 +1,34 @@ > +/* Test the attribute counted_by and its usage in bounds > + sanitizer. when counted_by field is zero value. */ > +/* { dg-do run } */ > +/* { dg-options "-fsanitize=bounds" } */ > + > +#include > + > +struct annotated { > + int b; > + int c[] __attribute__ ((counted_by (b))); > +} *array_annotated; > + > +void __attribute__((__noinline__)) setup (int annotated_count) > +{ > + array_annotated > + = (struct annotated *)malloc (sizeof (struct annotated)); > + array_annotated->b = annotated_count; > + > + return; > +} > + > +void __attribute__((__noinline__)) test (int annotated_index) > +{ > + array_annotated->c[annotated_index] = 2; > +} > + > +int main(int argc, char *argv[]) > +{ > + setup (0); > + test (1); > + return 0; > +} > + > +/* { dg-output "24:21: runtime error: index 1 out of bounds for type" } */ > diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c > new file mode 100644 > index 000000000000..e2b911dde626 > --- /dev/null > +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c > @@ -0,0 +1,46 @@ > +/* Test the attribute counted_by and its usage in > + bounds sanitizer. */ > +/* { dg-do run } */ > +/* { dg-options "-fsanitize=bounds" } */ > + > +#include > + > +struct flex { > + int b; > + int c[]; > +} *array_flex; > + > +struct annotated { > + int b; > + int c[] __attribute__ ((counted_by (b))); > +} *array_annotated; > + > +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count) > +{ > + array_flex > + = (struct flex *)malloc (sizeof (struct flex) > + + normal_count * sizeof (int)); > + array_flex->b = normal_count; > + > + array_annotated > + = (struct annotated *)malloc (sizeof (struct annotated) > + + annotated_count * sizeof (int)); > + array_annotated->b = annotated_count; > + > + return; > +} > + > +void __attribute__((__noinline__)) test (int normal_index, int annotated_index) > +{ > + array_flex->c[normal_index] = 1; > + array_annotated->c[annotated_index] = 2; > +} > + > +int main(int argc, char *argv[]) > +{ > + setup (10, 10); > + test (10, 10); > + return 0; > +} > + > +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */