Skip to content

Commit d961f66

Browse files
committed
[hwasan] fix false positive when hwasan-match-all-tag flag is enabled and short granules are used
When hwasan-match-all-tag flag is enabled and short granules are used, at the point checking if this is a short tag case, the tag from pointer is stored in X16 register, which breaks the assumption that tag from shadow memory is stored in X16 register, this will cause a false positive. Reviewed By: vitalybuka Differential Revision: https://reviews.llvm.org/D149252
1 parent 9baa852 commit d961f66

File tree

3 files changed

+18
-6
lines changed

3 files changed

+18
-6
lines changed
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// RUN: %clang_hwasan -mllvm -hwasan-match-all-tag=0 %s -o %t && %run %t
2+
3+
#include <sanitizer/hwasan_interface.h>
4+
#include <stdlib.h>
5+
6+
int main() {
7+
__hwasan_enable_allocator_tagging();
8+
char *x = (char *)malloc(40);
9+
char volatile z = *x;
10+
free(x);
11+
return 0;
12+
}

llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -531,14 +531,14 @@ void AArch64AsmPrinter::emitHwasanMemaccessSymbols(Module &M) {
531531

532532
if (HasMatchAllTag) {
533533
OutStreamer->emitInstruction(MCInstBuilder(AArch64::UBFMXri)
534-
.addReg(AArch64::X16)
534+
.addReg(AArch64::X17)
535535
.addReg(Reg)
536536
.addImm(56)
537537
.addImm(63),
538538
*STI);
539539
OutStreamer->emitInstruction(MCInstBuilder(AArch64::SUBSXri)
540540
.addReg(AArch64::XZR)
541-
.addReg(AArch64::X16)
541+
.addReg(AArch64::X17)
542542
.addImm(MatchAllTag)
543543
.addImm(0),
544544
*STI);

llvm/test/CodeGen/AArch64/hwasan-check-memaccess.ll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,8 +104,8 @@ declare void @llvm.hwasan.check.memaccess.shortgranules(ptr, ptr, i32)
104104
; CHECK-NEXT: .Ltmp6:
105105
; CHECK-NEXT: ret
106106
; CHECK-NEXT: .Ltmp5:
107-
; CHECK-NEXT: lsr x16, x1, #56
108-
; CHECK-NEXT: cmp x16, #255
107+
; CHECK-NEXT: lsr x17, x1, #56
108+
; CHECK-NEXT: cmp x17, #255
109109
; CHECK-NEXT: b.eq .Ltmp6
110110
; CHECK-NEXT: stp x0, x1, [sp, #-256]!
111111
; CHECK-NEXT: stp x29, x30, [sp, #232]
@@ -121,8 +121,8 @@ declare void @llvm.hwasan.check.memaccess.shortgranules(ptr, ptr, i32)
121121
; CHECK-NEXT: .Ltmp8:
122122
; CHECK-NEXT: ret
123123
; CHECK-NEXT: .Ltmp7:
124-
; CHECK-NEXT: lsr x16, x1, #56
125-
; CHECK-NEXT: cmp x16, #0
124+
; CHECK-NEXT: lsr x17, x1, #56
125+
; CHECK-NEXT: cmp x17, #0
126126
; CHECK-NEXT: b.eq .Ltmp8
127127
; CHECK-NEXT: cmp w16, #15
128128
; CHECK-NEXT: b.hi .Ltmp9

0 commit comments

Comments
 (0)