https://gcc.gnu.org/g:d224c7d8d8b49daab54a977a4f2217423d3d12a0
commit r14-10230-gd224c7d8d8b49daab54a977a4f2217423d3d12a0
Author: Jakub Jelinek <ja...@redhat.com>
Date: Wed May 22 09:12:28 2024 +0200
ubsan: Use right address space for MEM_REF created for bool/enum
sanitization [PR115172]
The following testcase is miscompiled, because -fsanitize=bool,enum
creates a MEM_REF without propagating there address space qualifiers,
so what should be normally loaded using say %gs:/%fs: segment prefix
isn't. Together with asan it then causes that load to be sanitized.
2024-05-22 Jakub Jelinek <ja...@redhat.com>
PR sanitizer/115172
* ubsan.cc (instrument_bool_enum_load): If rhs is not in generic
address space, use qualified version of utype with the right
address space. Formatting fix.
* gcc.dg/asan/pr115172.c: New test.
(cherry picked from commit d3c506eff54fcbac389a529c2e98da108a410b7f)
Diff:
---
gcc/testsuite/gcc.dg/asan/pr115172.c | 20 ++++++++++++++++++++
gcc/ubsan.cc | 6 +++++-
2 files changed, 25 insertions(+), 1 deletion(-)
diff --git a/gcc/testsuite/gcc.dg/asan/pr115172.c
b/gcc/testsuite/gcc.dg/asan/pr115172.c
new file mode 100644
index 00000000000..8707e615733
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/asan/pr115172.c
@@ -0,0 +1,20 @@
+/* PR sanitizer/115172 */
+/* { dg-do compile { target i?86-*-* x86_64-*-* } } */
+/* { dg-options "-O2 -fsanitize=address,bool -ffat-lto-objects
-fdump-tree-asan1" } */
+/* { dg-final { scan-tree-dump-not "\.ASAN_CHECK " "asan1" } } */
+
+#ifdef __x86_64__
+#define SEG __seg_gs
+#else
+#define SEG __seg_fs
+#endif
+
+extern struct S { _Bool b; } s;
+void bar (void);
+
+void
+foo (void)
+{
+ if (*(volatile _Bool SEG *) (__UINTPTR_TYPE__) &s.b)
+ bar ();
+}
diff --git a/gcc/ubsan.cc b/gcc/ubsan.cc
index fb00dc24bf6..76ca7a04265 100644
--- a/gcc/ubsan.cc
+++ b/gcc/ubsan.cc
@@ -1776,13 +1776,17 @@ instrument_bool_enum_load (gimple_stmt_iterator *gsi)
|| TREE_CODE (gimple_assign_lhs (stmt)) != SSA_NAME)
return;
+ addr_space_t as = TYPE_ADDR_SPACE (TREE_TYPE (rhs));
+ if (as != TYPE_ADDR_SPACE (utype))
+ utype = build_qualified_type (utype, TYPE_QUALS (utype)
+ | ENCODE_QUAL_ADDR_SPACE (as));
bool ends_bb = stmt_ends_bb_p (stmt);
location_t loc = gimple_location (stmt);
tree lhs = gimple_assign_lhs (stmt);
tree ptype = build_pointer_type (TREE_TYPE (rhs));
tree atype = reference_alias_ptr_type (rhs);
gimple *g = gimple_build_assign (make_ssa_name (ptype),
- build_fold_addr_expr (rhs));
+ build_fold_addr_expr (rhs));
gimple_set_location (g, loc);
gsi_insert_before (gsi, g, GSI_SAME_STMT);
tree mem = build2 (MEM_REF, utype, gimple_assign_lhs (g),
