From patchwork Tue Oct 25 11:40:03 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?q?Martin_Li=C5=A1ka?= X-Patchwork-Id: 79152 Delivered-To: patch@linaro.org Received: by 10.140.97.247 with SMTP id m110csp3063120qge; Tue, 25 Oct 2016 04:40:38 -0700 (PDT) X-Received: by 10.98.159.130 with SMTP id v2mr39043411pfk.48.1477395638626; Tue, 25 Oct 2016 04:40:38 -0700 (PDT) Return-Path: Received: from sourceware.org (server1.sourceware.org. [209.132.180.131]) by mx.google.com with ESMTPS id r5si20267897pgj.125.2016.10.25.04.40.38 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 25 Oct 2016 04:40:38 -0700 (PDT) Received-SPF: pass (google.com: domain of gcc-patches-return-439491-patch=linaro.org@gcc.gnu.org designates 209.132.180.131 as permitted sender) client-ip=209.132.180.131; Authentication-Results: mx.google.com; dkim=pass header.i=@gcc.gnu.org; spf=pass (google.com: domain of gcc-patches-return-439491-patch=linaro.org@gcc.gnu.org designates 209.132.180.131 as permitted sender) smtp.mailfrom=gcc-patches-return-439491-patch=linaro.org@gcc.gnu.org DomainKey-Signature: a=rsa-sha1; c=nofws; d=gcc.gnu.org; h=list-id :list-unsubscribe:list-archive:list-post:list-help:sender:to :from:subject:message-id:date:mime-version:content-type; q=dns; s=default; b=gL3e/V1xc+C6bEPnmG+bV+ItEgsAYo+IMvqvFGv9bDJtyVmmjP MJeP9lCREBLp3vQFRsozXAvKdwVX09bSh4AA6pcgMihVkfYwuX2+Lnw1gwQJCUQF yyfQp/XjYTQLQ7/974bM6toRGDLxMbTe/t91h1SmWSFpxmYxJR/Xxyuw8= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=gcc.gnu.org; h=list-id :list-unsubscribe:list-archive:list-post:list-help:sender:to :from:subject:message-id:date:mime-version:content-type; s= default; bh=oGpnZPXO8BOxfcLUMbaSBTTtRaw=; b=yqfvgMWETcL/DHrHX8gl SQItG19Ocmni7J8vBz2/OIukZNIzPJV7aoVNgJH/muP7ZObAqNRTA2lU4Nx7Zy7o oJ4ASsjTquYu0YU+G7MVjR3jgbDJZDwYA1QInZa07SoUSfnN53RbTwgbzfZ8L/cP MD3nQclcrsAB1KOA9x8SRyk= Received: (qmail 87380 invoked by alias); 25 Oct 2016 11:40:17 -0000 Mailing-List: contact gcc-patches-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Archive: List-Post: List-Help: Sender: gcc-patches-owner@gcc.gnu.org Delivered-To: mailing list gcc-patches@gcc.gnu.org Received: (qmail 87369 invoked by uid 89); 25 Oct 2016 11:40:16 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.9 required=5.0 tests=BAYES_00, SPF_PASS autolearn=ham version=3.3.2 spammy= X-HELO: mx2.suse.de Received: from mx2.suse.de (HELO mx2.suse.de) (195.135.220.15) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Tue, 25 Oct 2016 11:40:06 +0000 Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 2577CAAB9; Tue, 25 Oct 2016 11:40:04 +0000 (UTC) To: GCC Patches , Jakub Jelinek From: =?UTF-8?Q?Martin_Li=c5=a1ka?= Subject: [PATCH] Fix not caught use-after-scope with -O1 (PR sanitize/78106) Message-ID: <8fb63eca-0d92-efc1-8497-d3e2c8e14e07@suse.cz> Date: Tue, 25 Oct 2016 13:40:03 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.4.0 MIME-Version: 1.0 X-IsSubscribed: yes Hello. While reading and trying to understand sanopt code, I've noticed that we can possibly optimize out a ASAN_CHECK when there's a BB in between DOM(BB) and BB which can call a freeing function. Ready to be installed after it survives regression tests? Martin >From d8ed43c1f8e29cfe63ebd7c40a76715c9c644522 Mon Sep 17 00:00:00 2001 From: marxin Date: Tue, 25 Oct 2016 13:29:47 +0200 Subject: [PATCH] Fix not caught use-after-scope with -O1 (PR sanitize/78106) gcc/ChangeLog: 2016-10-25 Martin Liska PR sanitizer/78106 * sanopt.c (imm_dom_path_with_freeing_call): Handle gasm statements as they can also contain possibly a freeing call. gcc/testsuite/ChangeLog: 2016-10-25 Martin Liska PR sanitizer/78106 * gcc.dg/asan/pr78106.c: New test. --- gcc/sanopt.c | 6 +++++- gcc/testsuite/gcc.dg/asan/pr78106.c | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 gcc/testsuite/gcc.dg/asan/pr78106.c diff --git a/gcc/sanopt.c b/gcc/sanopt.c index 27c43da..8a6fbe9 100644 --- a/gcc/sanopt.c +++ b/gcc/sanopt.c @@ -211,8 +211,12 @@ imm_dom_path_with_freeing_call (basic_block bb, basic_block dom) for (gsi = gsi_start_bb (e->src); !gsi_end_p (gsi); gsi_next (&gsi)) { gimple *stmt = gsi_stmt (gsi); + gasm *asm_stmt; - if (is_gimple_call (stmt) && !nonfreeing_call_p (stmt)) + if ((is_gimple_call (stmt) && !nonfreeing_call_p (stmt)) + || ((asm_stmt = dyn_cast (stmt)) + && (gimple_asm_clobbers_memory_p (asm_stmt) + || gimple_asm_volatile_p (asm_stmt)))) { pred_info->has_freeing_call_p = true; break; diff --git a/gcc/testsuite/gcc.dg/asan/pr78106.c b/gcc/testsuite/gcc.dg/asan/pr78106.c new file mode 100644 index 0000000..7c0e05e --- /dev/null +++ b/gcc/testsuite/gcc.dg/asan/pr78106.c @@ -0,0 +1,34 @@ +/* PR sanitizer/78106 */ +/* { dg-do run } */ +/* { dg-options "-fsanitize=address" } */ +/* { dg-shouldfail "asan" } */ + +int *variable; + +void __attribute__((used)) release() +{ + __builtin_free (variable); +} + +int main2(int argc) +{ + *variable = 2; + + if (argc <= 5) + asm volatile ("call release"); + + *variable = 2; + __builtin_abort (); + + return 0; +} + +int main(int argc, char **argv) +{ + variable = __builtin_malloc (sizeof(int)); + return main2(argc); +} + +/* { dg-output "ERROR: AddressSanitizer:? heap-use-after-free on address.*(\n|\r\n|\r)" } */ +/* { dg-output "WRITE of size 4 at.*" } */ +/* { dg-output " #0 0x\[0-9a-f\]+ +in _*main2 .*" } */ -- 2.10.1