Skip to content

Commit 33a92af

Browse files
authored
[msan] Add off-by-default flag to fix false negatives from partially undefined constant fixed-length vectors (llvm#143837)
This patch adds an off-by-default flag which, when enabled via `-mllvm -msan-poison-undef-vectors=true`, fixes a false negative in MSan (partially-undefined constant fixed-length vectors). It is currently off by default since, by fixing the false positive, code/tests that previously passed MSan may start failing. The default will be changed in a future patch. Prior to this patch, MSan computes that partially-undefined constant fixed-length vectors are fully initialized, which leads to false negatives; moreover, benign vector rewriting could theoretically flip MSan's shadow computation from initialized to uninitialized or vice-versa (*). `-msan-poison-undef-vectors=true` calculates the shadow precisely: for each element of the vector, the corresponding shadow is fully uninitialized if the element is undefined/poisoned, otherwise it is fully initialized. Updates the test from llvm#143823 (*) For example: ``` %x = insertelement <2 x i64> <i64 0, i64 poison>, i64 42, i64 0 %y = insertelement <2 x i64> <i64 poison, i64 poison>, i64 42, i64 0 ``` %x and %y are equivalent but, prior to this patch, MSan incorrectly computes the shadow of %x as <0, 0> rather than <0, -1>.
1 parent f8ee577 commit 33a92af

File tree

2 files changed

+73
-12
lines changed

2 files changed

+73
-12
lines changed

llvm/lib/Transforms/Instrumentation/MemorySanitizer.cpp

Lines changed: 41 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -265,9 +265,22 @@ static cl::opt<bool>
265265
cl::desc("Print name of local stack variable"),
266266
cl::Hidden, cl::init(true));
267267

268-
static cl::opt<bool> ClPoisonUndef("msan-poison-undef",
269-
cl::desc("poison undef temps"), cl::Hidden,
270-
cl::init(true));
268+
static cl::opt<bool>
269+
ClPoisonUndef("msan-poison-undef",
270+
cl::desc("Poison fully undef temporary values. "
271+
"Partially undefined constant vectors "
272+
"are unaffected by this flag (see "
273+
"-msan-poison-undef-vectors)."),
274+
cl::Hidden, cl::init(true));
275+
276+
static cl::opt<bool> ClPoisonUndefVectors(
277+
"msan-poison-undef-vectors",
278+
cl::desc("Precisely poison partially undefined constant vectors. "
279+
"If false (legacy behavior), the entire vector is "
280+
"considered fully initialized, which may lead to false "
281+
"negatives. Fully undefined constant vectors are "
282+
"unaffected by this flag (see -msan-poison-undef)."),
283+
cl::Hidden, cl::init(false));
271284

272285
static cl::opt<bool>
273286
ClHandleICmp("msan-handle-icmp",
@@ -1181,6 +1194,7 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
11811194
bool PropagateShadow;
11821195
bool PoisonStack;
11831196
bool PoisonUndef;
1197+
bool PoisonUndefVectors;
11841198

11851199
struct ShadowOriginAndInsertPoint {
11861200
Value *Shadow;
@@ -1207,6 +1221,7 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
12071221
PropagateShadow = SanitizeFunction;
12081222
PoisonStack = SanitizeFunction && ClPoisonStack;
12091223
PoisonUndef = SanitizeFunction && ClPoisonUndef;
1224+
PoisonUndefVectors = SanitizeFunction && ClPoisonUndefVectors;
12101225

12111226
// In the presence of unreachable blocks, we may see Phi nodes with
12121227
// incoming nodes from such blocks. Since InstVisitor skips unreachable
@@ -1989,6 +2004,8 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
19892004
}
19902005
return Shadow;
19912006
}
2007+
// Handle fully undefined values
2008+
// (partially undefined constant vectors are handled later)
19922009
if (UndefValue *U = dyn_cast<UndefValue>(V)) {
19932010
Value *AllOnes = (PropagateShadow && PoisonUndef) ? getPoisonedShadow(V)
19942011
: getCleanShadow(V);
@@ -2086,8 +2103,27 @@ struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
20862103
return ShadowPtr;
20872104
}
20882105

2089-
// TODO: Partially undefined vectors are handled by the fall-through case
2090-
// below (see partial-poison.ll); this causes false negatives.
2106+
// Check for partially-undefined constant vectors
2107+
// TODO: scalable vectors (this is hard because we do not have IRBuilder)
2108+
if (isa<FixedVectorType>(V->getType()) && isa<Constant>(V) &&
2109+
cast<Constant>(V)->containsUndefOrPoisonElement() && PropagateShadow &&
2110+
PoisonUndefVectors) {
2111+
unsigned NumElems = cast<FixedVectorType>(V->getType())->getNumElements();
2112+
SmallVector<Constant *, 32> ShadowVector(NumElems);
2113+
for (unsigned i = 0; i != NumElems; ++i) {
2114+
Constant *Elem = cast<Constant>(V)->getAggregateElement(i);
2115+
ShadowVector[i] = isa<UndefValue>(Elem) ? getPoisonedShadow(Elem)
2116+
: getCleanShadow(Elem);
2117+
}
2118+
2119+
Value *ShadowConstant = ConstantVector::get(ShadowVector);
2120+
LLVM_DEBUG(dbgs() << "Partial undef constant vector: " << *V << " ==> "
2121+
<< *ShadowConstant << "\n");
2122+
2123+
return ShadowConstant;
2124+
}
2125+
2126+
// TODO: partially-undefined constant arrays, structures, and nested types
20912127

20922128
// For everything else the shadow is zero.
20932129
return getCleanShadow(V);

llvm/test/Instrumentation/MemorySanitizer/partial-poison.ll

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 5
2-
; RUN: opt < %s -S -passes='msan' 2>&1 | FileCheck %s
2+
; RUN: opt < %s -S -passes='msan' -msan-poison-undef-vectors=true 2>&1 | FileCheck %s --check-prefixes=CHECK,CHECK-PRECISE
3+
; RUN: opt < %s -S -passes='msan' -msan-poison-undef-vectors=false 2>&1 | FileCheck %s --check-prefixes=CHECK,CHECK-IMPRECISE
34
;
4-
; Test case to show that MSan computes shadows for partially poisoned vectors
5-
; as fully initialized, resulting in false negatives.
5+
; Regression test case for computing shadows of partially poisoned vectors.
6+
; Partially poisoned structs and arrays are not correctly implemented.
67

78
target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
89
target triple = "x86_64-unknown-linux-gnu"
@@ -11,7 +12,8 @@ define <2 x i64> @left_poison(ptr %add.ptr) sanitize_memory {
1112
; CHECK-LABEL: define <2 x i64> @left_poison(
1213
; CHECK-SAME: ptr [[ADD_PTR:%.*]]) #[[ATTR0:[0-9]+]] {
1314
; CHECK-NEXT: call void @llvm.donothing()
14-
; CHECK-NEXT: store <2 x i64> zeroinitializer, ptr @__msan_retval_tls, align 8
15+
; CHECK-PRECISE: store <2 x i64> <i64 -1, i64 0>, ptr @__msan_retval_tls, align 8
16+
; CHECK-IMPRECISE: store <2 x i64> zeroinitializer, ptr @__msan_retval_tls, align 8
1517
; CHECK-NEXT: ret <2 x i64> <i64 poison, i64 42>
1618
;
1719
ret <2 x i64> <i64 poison, i64 42>
@@ -21,7 +23,8 @@ define <2 x i64> @right_poison(ptr %add.ptr) sanitize_memory {
2123
; CHECK-LABEL: define <2 x i64> @right_poison(
2224
; CHECK-SAME: ptr [[ADD_PTR:%.*]]) #[[ATTR0]] {
2325
; CHECK-NEXT: call void @llvm.donothing()
24-
; CHECK-NEXT: store <2 x i64> zeroinitializer, ptr @__msan_retval_tls, align 8
26+
; CHECK-PRECISE: store <2 x i64> <i64 0, i64 -1>, ptr @__msan_retval_tls, align 8
27+
; CHECK-IMPRECISE: store <2 x i64> zeroinitializer, ptr @__msan_retval_tls, align 8
2528
; CHECK-NEXT: ret <2 x i64> <i64 42, i64 poison>
2629
;
2730
ret <2 x i64> <i64 42, i64 poison>
@@ -51,7 +54,8 @@ define <2 x i64> @left_undef(ptr %add.ptr) sanitize_memory {
5154
; CHECK-LABEL: define <2 x i64> @left_undef(
5255
; CHECK-SAME: ptr [[ADD_PTR:%.*]]) #[[ATTR0]] {
5356
; CHECK-NEXT: call void @llvm.donothing()
54-
; CHECK-NEXT: store <2 x i64> zeroinitializer, ptr @__msan_retval_tls, align 8
57+
; CHECK-PRECISE: store <2 x i64> <i64 -1, i64 0>, ptr @__msan_retval_tls, align 8
58+
; CHECK-IMPRECISE: store <2 x i64> zeroinitializer, ptr @__msan_retval_tls, align 8
5559
; CHECK-NEXT: ret <2 x i64> <i64 undef, i64 42>
5660
;
5761
ret <2 x i64> <i64 undef, i64 42>
@@ -61,7 +65,8 @@ define <2 x i64> @right_undef(ptr %add.ptr) sanitize_memory {
6165
; CHECK-LABEL: define <2 x i64> @right_undef(
6266
; CHECK-SAME: ptr [[ADD_PTR:%.*]]) #[[ATTR0]] {
6367
; CHECK-NEXT: call void @llvm.donothing()
64-
; CHECK-NEXT: store <2 x i64> zeroinitializer, ptr @__msan_retval_tls, align 8
68+
; CHECK-PRECISE: store <2 x i64> <i64 0, i64 -1>, ptr @__msan_retval_tls, align 8
69+
; CHECK-IMPRECISE: store <2 x i64> zeroinitializer, ptr @__msan_retval_tls, align 8
6570
; CHECK-NEXT: ret <2 x i64> <i64 42, i64 undef>
6671
;
6772
ret <2 x i64> <i64 42, i64 undef>
@@ -76,3 +81,23 @@ define <2 x i64> @full_undef(ptr %add.ptr) sanitize_memory {
7681
;
7782
ret <2 x i64> <i64 undef, i64 undef>
7883
}
84+
85+
define {i64, i64} @struct_left_undef() sanitize_memory {
86+
; CHECK-LABEL: define { i64, i64 } @struct_left_undef(
87+
; CHECK-SAME: ) #[[ATTR0]] {
88+
; CHECK-NEXT: call void @llvm.donothing()
89+
; CHECK-NEXT: store { i64, i64 } zeroinitializer, ptr @__msan_retval_tls, align 8
90+
; CHECK-NEXT: ret { i64, i64 } { i64 undef, i64 42 }
91+
;
92+
ret {i64, i64} { i64 undef, i64 42 }
93+
}
94+
95+
define [2x i64] @array_right_undef() sanitize_memory {
96+
; CHECK-LABEL: define [2 x i64] @array_right_undef(
97+
; CHECK-SAME: ) #[[ATTR0]] {
98+
; CHECK-NEXT: call void @llvm.donothing()
99+
; CHECK-NEXT: store [2 x i64] zeroinitializer, ptr @__msan_retval_tls, align 8
100+
; CHECK-NEXT: ret [2 x i64] [i64 42, i64 undef]
101+
;
102+
ret [2x i64] [ i64 42, i64 undef ]
103+
}

0 commit comments

Comments
 (0)