[V3,3/3] Use the counted_by attribute information in bound sanitizer[PR108896]
Checks
Commit Message
Use the counted_by attribute information in bound sanitizer.
gcc/c-family/ChangeLog:
PR C/108896
* c-ubsan.cc (ubsan_instrument_bounds): Use counted_by attribute
information.
gcc/testsuite/ChangeLog:
PR C/108896
* gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test.
* gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test.
---
gcc/c-family/c-ubsan.cc | 16 +++++++
.../ubsan/flex-array-counted-by-bounds-2.c | 27 +++++++++++
.../ubsan/flex-array-counted-by-bounds.c | 46 +++++++++++++++++++
3 files changed, 89 insertions(+)
create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
Comments
Ping.
thanks.
Qing
> On Aug 25, 2023, at 11:24 AM, Qing Zhao <qing.zhao@oracle.com> wrote:
>
> Use the counted_by attribute information in bound sanitizer.
>
> gcc/c-family/ChangeLog:
>
> PR C/108896
> * c-ubsan.cc (ubsan_instrument_bounds): Use counted_by attribute
> information.
>
> gcc/testsuite/ChangeLog:
>
> PR C/108896
> * gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test.
> * gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test.
> ---
> gcc/c-family/c-ubsan.cc | 16 +++++++
> .../ubsan/flex-array-counted-by-bounds-2.c | 27 +++++++++++
> .../ubsan/flex-array-counted-by-bounds.c | 46 +++++++++++++++++++
> 3 files changed, 89 insertions(+)
> create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
> create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
>
> diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc
> index 51aa83a378d2..a99e8433069f 100644
> --- a/gcc/c-family/c-ubsan.cc
> +++ b/gcc/c-family/c-ubsan.cc
> @@ -362,6 +362,10 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
> {
> tree type = TREE_TYPE (array);
> tree domain = TYPE_DOMAIN (type);
> + /* whether the array ref is a flexible array member with valid counted_by
> + attribute. */
> + bool fam_has_count_attr = false;
> + tree counted_by = NULL_TREE;
>
> if (domain == NULL_TREE)
> return NULL_TREE;
> @@ -375,6 +379,17 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
> && COMPLETE_TYPE_P (type)
> && integer_zerop (TYPE_SIZE (type)))
> bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1);
> + /* If the array ref is to flexible array member field which has
> + counted_by attribute. We can use the information from the
> + attribute as the bound to instrument the reference. */
> + else if ((counted_by = component_ref_get_counted_by (array))
> + != NULL_TREE)
> + {
> + fam_has_count_attr = true;
> + bound = fold_build2 (MINUS_EXPR, TREE_TYPE (counted_by),
> + counted_by,
> + build_int_cst (TREE_TYPE (counted_by), 1));
> + }
> else
> return NULL_TREE;
> }
> @@ -387,6 +402,7 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
> -fsanitize=bounds-strict. */
> tree base = get_base_address (array);
> if (!sanitize_flags_p (SANITIZE_BOUNDS_STRICT)
> + && !fam_has_count_attr
> && TREE_CODE (array) == COMPONENT_REF
> && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
> {
> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
> new file mode 100644
> index 000000000000..77ec333509d0
> --- /dev/null
> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
> @@ -0,0 +1,27 @@
> +/* test the attribute counted_by and its usage in
> + bounds sanitizer combined with VLA. */
> +/* { dg-do run } */
> +/* { dg-options "-fsanitize=bounds" } */
> +
> +#include <stdlib.h>
> +
> +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m)
> +{
> + struct foo {
> + int n;
> + int p[][n] __attribute__((counted_by(n)));
> + } *f;
> +
> + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n]));
> + f->n = m;
> + f->p[m][n-1]=1;
> + return;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> + setup_and_test_vla (10, 11);
> + return 0;
> +}
> +
> +/* { dg-output "17:8: runtime error: index 11 out of bounds for type" } */
> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
> new file mode 100644
> index 000000000000..81eaeb3f2681
> --- /dev/null
> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
> @@ -0,0 +1,46 @@
> +/* test the attribute counted_by and its usage in
> + bounds sanitizer. */
> +/* { dg-do run } */
> +/* { dg-options "-fsanitize=bounds" } */
> +
> +#include <stdlib.h>
> +
> +struct flex {
> + int b;
> + int c[];
> +} *array_flex;
> +
> +struct annotated {
> + int b;
> + int c[] __attribute__ ((counted_by (b)));
> +} *array_annotated;
> +
> +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count)
> +{
> + array_flex
> + = (struct flex *)malloc (sizeof (struct flex)
> + + normal_count * sizeof (int));
> + array_flex->b = normal_count;
> +
> + array_annotated
> + = (struct annotated *)malloc (sizeof (struct annotated)
> + + annotated_count * sizeof (int));
> + array_annotated->b = annotated_count;
> +
> + return;
> +}
> +
> +void __attribute__((__noinline__)) test (int normal_index, int annotated_index)
> +{
> + array_flex->c[normal_index] = 1;
> + array_annotated->c[annotated_index] = 2;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> + setup (10, 10);
> + test (10, 10);
> + return 0;
> +}
> +
> +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */
> --
> 2.31.1
>
Hi,
I’d like to ping this patch set one more time.
Thanks
Qing
> On Aug 25, 2023, at 11:24 AM, Qing Zhao <qing.zhao@oracle.com> wrote:
>
> Use the counted_by attribute information in bound sanitizer.
>
> gcc/c-family/ChangeLog:
>
> PR C/108896
> * c-ubsan.cc (ubsan_instrument_bounds): Use counted_by attribute
> information.
>
> gcc/testsuite/ChangeLog:
>
> PR C/108896
> * gcc.dg/ubsan/flex-array-counted-by-bounds.c: New test.
> * gcc.dg/ubsan/flex-array-counted-by-bounds-2.c: New test.
> ---
> gcc/c-family/c-ubsan.cc | 16 +++++++
> .../ubsan/flex-array-counted-by-bounds-2.c | 27 +++++++++++
> .../ubsan/flex-array-counted-by-bounds.c | 46 +++++++++++++++++++
> 3 files changed, 89 insertions(+)
> create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
> create mode 100644 gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
>
> diff --git a/gcc/c-family/c-ubsan.cc b/gcc/c-family/c-ubsan.cc
> index 51aa83a378d2..a99e8433069f 100644
> --- a/gcc/c-family/c-ubsan.cc
> +++ b/gcc/c-family/c-ubsan.cc
> @@ -362,6 +362,10 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
> {
> tree type = TREE_TYPE (array);
> tree domain = TYPE_DOMAIN (type);
> + /* whether the array ref is a flexible array member with valid counted_by
> + attribute. */
> + bool fam_has_count_attr = false;
> + tree counted_by = NULL_TREE;
>
> if (domain == NULL_TREE)
> return NULL_TREE;
> @@ -375,6 +379,17 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
> && COMPLETE_TYPE_P (type)
> && integer_zerop (TYPE_SIZE (type)))
> bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1);
> + /* If the array ref is to flexible array member field which has
> + counted_by attribute. We can use the information from the
> + attribute as the bound to instrument the reference. */
> + else if ((counted_by = component_ref_get_counted_by (array))
> + != NULL_TREE)
> + {
> + fam_has_count_attr = true;
> + bound = fold_build2 (MINUS_EXPR, TREE_TYPE (counted_by),
> + counted_by,
> + build_int_cst (TREE_TYPE (counted_by), 1));
> + }
> else
> return NULL_TREE;
> }
> @@ -387,6 +402,7 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
> -fsanitize=bounds-strict. */
> tree base = get_base_address (array);
> if (!sanitize_flags_p (SANITIZE_BOUNDS_STRICT)
> + && !fam_has_count_attr
> && TREE_CODE (array) == COMPONENT_REF
> && base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
> {
> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
> new file mode 100644
> index 000000000000..77ec333509d0
> --- /dev/null
> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds-2.c
> @@ -0,0 +1,27 @@
> +/* test the attribute counted_by and its usage in
> + bounds sanitizer combined with VLA. */
> +/* { dg-do run } */
> +/* { dg-options "-fsanitize=bounds" } */
> +
> +#include <stdlib.h>
> +
> +void __attribute__((__noinline__)) setup_and_test_vla (int n, int m)
> +{
> + struct foo {
> + int n;
> + int p[][n] __attribute__((counted_by(n)));
> + } *f;
> +
> + f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n]));
> + f->n = m;
> + f->p[m][n-1]=1;
> + return;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> + setup_and_test_vla (10, 11);
> + return 0;
> +}
> +
> +/* { dg-output "17:8: runtime error: index 11 out of bounds for type" } */
> diff --git a/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
> new file mode 100644
> index 000000000000..81eaeb3f2681
> --- /dev/null
> +++ b/gcc/testsuite/gcc.dg/ubsan/flex-array-counted-by-bounds.c
> @@ -0,0 +1,46 @@
> +/* test the attribute counted_by and its usage in
> + bounds sanitizer. */
> +/* { dg-do run } */
> +/* { dg-options "-fsanitize=bounds" } */
> +
> +#include <stdlib.h>
> +
> +struct flex {
> + int b;
> + int c[];
> +} *array_flex;
> +
> +struct annotated {
> + int b;
> + int c[] __attribute__ ((counted_by (b)));
> +} *array_annotated;
> +
> +void __attribute__((__noinline__)) setup (int normal_count, int annotated_count)
> +{
> + array_flex
> + = (struct flex *)malloc (sizeof (struct flex)
> + + normal_count * sizeof (int));
> + array_flex->b = normal_count;
> +
> + array_annotated
> + = (struct annotated *)malloc (sizeof (struct annotated)
> + + annotated_count * sizeof (int));
> + array_annotated->b = annotated_count;
> +
> + return;
> +}
> +
> +void __attribute__((__noinline__)) test (int normal_index, int annotated_index)
> +{
> + array_flex->c[normal_index] = 1;
> + array_annotated->c[annotated_index] = 2;
> +}
> +
> +int main(int argc, char *argv[])
> +{
> + setup (10, 10);
> + test (10, 10);
> + return 0;
> +}
> +
> +/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */
> --
> 2.31.1
>
@@ -362,6 +362,10 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
{
tree type = TREE_TYPE (array);
tree domain = TYPE_DOMAIN (type);
+ /* whether the array ref is a flexible array member with valid counted_by
+ attribute. */
+ bool fam_has_count_attr = false;
+ tree counted_by = NULL_TREE;
if (domain == NULL_TREE)
return NULL_TREE;
@@ -375,6 +379,17 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
&& COMPLETE_TYPE_P (type)
&& integer_zerop (TYPE_SIZE (type)))
bound = build_int_cst (TREE_TYPE (TYPE_MIN_VALUE (domain)), -1);
+ /* If the array ref is to flexible array member field which has
+ counted_by attribute. We can use the information from the
+ attribute as the bound to instrument the reference. */
+ else if ((counted_by = component_ref_get_counted_by (array))
+ != NULL_TREE)
+ {
+ fam_has_count_attr = true;
+ bound = fold_build2 (MINUS_EXPR, TREE_TYPE (counted_by),
+ counted_by,
+ build_int_cst (TREE_TYPE (counted_by), 1));
+ }
else
return NULL_TREE;
}
@@ -387,6 +402,7 @@ ubsan_instrument_bounds (location_t loc, tree array, tree *index,
-fsanitize=bounds-strict. */
tree base = get_base_address (array);
if (!sanitize_flags_p (SANITIZE_BOUNDS_STRICT)
+ && !fam_has_count_attr
&& TREE_CODE (array) == COMPONENT_REF
&& base && (INDIRECT_REF_P (base) || TREE_CODE (base) == MEM_REF))
{
new file mode 100644
@@ -0,0 +1,27 @@
+/* test the attribute counted_by and its usage in
+ bounds sanitizer combined with VLA. */
+/* { dg-do run } */
+/* { dg-options "-fsanitize=bounds" } */
+
+#include <stdlib.h>
+
+void __attribute__((__noinline__)) setup_and_test_vla (int n, int m)
+{
+ struct foo {
+ int n;
+ int p[][n] __attribute__((counted_by(n)));
+ } *f;
+
+ f = (struct foo *) malloc (sizeof(struct foo) + m*sizeof(int[n]));
+ f->n = m;
+ f->p[m][n-1]=1;
+ return;
+}
+
+int main(int argc, char *argv[])
+{
+ setup_and_test_vla (10, 11);
+ return 0;
+}
+
+/* { dg-output "17:8: runtime error: index 11 out of bounds for type" } */
new file mode 100644
@@ -0,0 +1,46 @@
+/* test the attribute counted_by and its usage in
+ bounds sanitizer. */
+/* { dg-do run } */
+/* { dg-options "-fsanitize=bounds" } */
+
+#include <stdlib.h>
+
+struct flex {
+ int b;
+ int c[];
+} *array_flex;
+
+struct annotated {
+ int b;
+ int c[] __attribute__ ((counted_by (b)));
+} *array_annotated;
+
+void __attribute__((__noinline__)) setup (int normal_count, int annotated_count)
+{
+ array_flex
+ = (struct flex *)malloc (sizeof (struct flex)
+ + normal_count * sizeof (int));
+ array_flex->b = normal_count;
+
+ array_annotated
+ = (struct annotated *)malloc (sizeof (struct annotated)
+ + annotated_count * sizeof (int));
+ array_annotated->b = annotated_count;
+
+ return;
+}
+
+void __attribute__((__noinline__)) test (int normal_index, int annotated_index)
+{
+ array_flex->c[normal_index] = 1;
+ array_annotated->c[annotated_index] = 2;
+}
+
+int main(int argc, char *argv[])
+{
+ setup (10, 10);
+ test (10, 10);
+ return 0;
+}
+
+/* { dg-output "36:21: runtime error: index 10 out of bounds for type" } */