From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mailrelay.tugraz.at (mailrelay.tugraz.at [129.27.2.202]) by sourceware.org (Postfix) with ESMTPS id 1CDDE388301A for ; Mon, 29 May 2023 10:22:59 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 1CDDE388301A Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=tugraz.at Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=tugraz.at Received: from vra-168-41.tugraz.at (vra-168-41.tugraz.at [129.27.168.41]) by mailrelay.tugraz.at (Postfix) with ESMTPSA id 4QVBRz2M0Vz3wD0; Mon, 29 May 2023 12:22:55 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tugraz.at; s=mailrelay; t=1685355775; bh=dK9GKOkhQMceH9JwzpW1PEyK836fTL66dbcHcHesV48=; h=Subject:From:To:Cc:Date:In-Reply-To:References; b=eJvV/NL2WsgHAslilxmauV3VwWAsTwr87HBh551epZRxayTMAnQM0yUmSrh1U/TLe plP5XOLNtwqh68Mw9tcDeiVHaK5vU9HisbCj6c7YKUari8U4jxKDH6RXWiSzt0dnlm pYMvG4F7KEGXyfC9WXX7Mb4lOOlEGQ8if3X7JFt0= Message-ID: <6bfaa47c2df3f2bf89ca7f98f9b56d537ed31f47.camel@tugraz.at> Subject: Re: [C PATCH 4/4] introduce ubsan checking for assigment of VM types 4/4 From: Martin Uecker To: gcc-patches@gcc.gnu.org Cc: Joseph Myers , Martin =?UTF-8?Q?Li=C5=A1ka?= Date: Mon, 29 May 2023 12:22:54 +0200 In-Reply-To: <93a1692e7f0e895379cb6847bfcb6e6d3dafadc3.camel@tugraz.at> References: <93a1692e7f0e895379cb6847bfcb6e6d3dafadc3.camel@tugraz.at> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.38.3-1+deb11u1 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-TUG-Backscatter-control: G/VXY7/6zeyuAY/PU2/0qw X-Spam-Scanner: SpamAssassin 3.003001 X-Spam-Score-relay: -1.9 X-Scanned-By: MIMEDefang 2.74 on 129.27.10.117 X-Spam-Status: No, score=-12.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,KAM_NUMSUBJECT,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: c: introduce ubsan checking for assigment of VM types 4/4 Support instrumentation of functions called via pointers. To do so, record the declaration with the parameter types, so that it can be retrieved later. gcc/c: c-decl.cc (get_parm_info): Record function declaration for arguments. c-type.cc (process_vm_constraints): Instrument functions called via pointers. gcc/testsuide/gcc.dg: * ubsan/vm-bounds-2.c: Add warning. * ubsan/vm-bounds-5.c: New test. diff --git a/gcc/c/c-decl.cc b/gcc/c/c-decl.cc index 1af51c4acfc..c33adf7e5fe 100644 --- a/gcc/c/c-decl.cc +++ b/gcc/c/c-decl.cc @@ -8410,6 +8410,9 @@ get_parm_info (bool ellipsis, tree expr) declared types. The back end may override this later. */ DECL_ARG_TYPE (decl) = type; types = tree_cons (0, type, types); + + /* Record the decl for use of UBSan bounds checking. */ + TREE_PURPOSE (types) = decl; } break; diff --git a/gcc/c/c-typeck.cc b/gcc/c/c-typeck.cc index aeddac315fc..43e7b96a55f 100644 --- a/gcc/c/c-typeck.cc +++ b/gcc/c/c-typeck.cc @@ -3601,9 +3601,20 @@ process_vm_constraints (location_t location, } else { - /* Functions called via pointers are not yet supported. */ - return void_node; + while (FUNCTION_TYPE != TREE_CODE (function)) + function = TREE_TYPE (function); + + args = TREE_PURPOSE (TYPE_ARG_TYPES (function)); + + if (!args) + { + /* FIXME: this can happen when forming composite types for the + conditional operator. */ + warning_at (location, 0, "Function call not instrumented."); + return void_node; + } } + gcc_assert (PARM_DECL == TREE_CODE (args)); } FOR_EACH_VEC_SAFE_ELT (instr_vec, i, d) diff --git a/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c index 22f06231eaa..093cbddd2ea 100644 --- a/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c +++ b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-2.c @@ -31,7 +31,7 @@ void f(void) int u = 3; int v = 4; char a[u][v]; - (1 ? f1 : f2)(u, v, a); + (1 ? f1 : f2)(u, v, a); /* { dg-warning "Function call not instrumented." } */ } /* size expression in parameter */ diff --git a/gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c new file mode 100644 index 00000000000..1a251e39deb --- /dev/null +++ b/gcc/testsuite/gcc.dg/ubsan/vm-bounds-5.c @@ -0,0 +1,72 @@ +/* { dg-do run } */ +/* { dg-options "-fsanitize=vla-bound" } */ + + +void foo1(void (*p)(int n, char (*a)[n])) +{ + char A0[3]; + (*p)(3, &A0); + (*p)(4, &A0); /* */ + /* { dg-output "bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +} + +void b0(int n, char (*a)[n]) { } + + +int n; + +void foo2(void (*p)(int n, char (*a)[n])) +{ + n = 4; + char A0[3]; + (*p)(3, &A0); + (*p)(4, &A0); + /* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +} + +void foo3(void (*p)(int n0, char (*a)[n])) +{ + n = 4; + char A0[3]; + (*p)(3, &A0); /* */ + /* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ + (*p)(4, &A0); /* */ + /* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'\[^\n\r]*(\n|\r\n|\r)" } */ +} + +void foo4(void (*p)(int n, char (*a)[n])) +{ + n = 3; + char A0[3]; + (*p)(3, &A0); + (*p)(4, &A0); /* */ + /* { dg-output "\[^\n\r]*bound 4 of type 'char \\\[\\\*\\\]' does not match bound 3 of type 'char \\\[3\\\]'" } */ +} + + +void foo5(void (*p)(int n0, char (*a)[n])) +{ + n = 3; + char A0[3]; + (*p)(3, &A0); + (*p)(4, &A0); +} + + +void b1(int n0, char (*a)[n]) { } + + + +int main() +{ + foo1(&b0); + + foo2(&b1); + foo3(&b1); // we should diagnose mismatch and run-time discrepancies + + foo4(&b1); + foo5(&b1); // we should diagnose mismatch and run-time discrepancies +} + + +