Skip to content

Commit a5dd6c7

Browse files
committed
[ASan] Fixed null pointer bug introduced in D112098.
Also added some more test to cover the "else if" part. Reviewed By: RKSimon Differential Revision: https://reviews.llvm.org/D118645
1 parent b79e2a1 commit a5dd6c7

File tree

2 files changed

+35
-7
lines changed

2 files changed

+35
-7
lines changed

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1527,22 +1527,22 @@ void AddressSanitizer::getInterestingMemoryOperands(
15271527
return;
15281528

15291529
if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
1530-
if (!ClInstrumentReads || ignoreAccess(LI, LI->getPointerOperand()))
1530+
if (!ClInstrumentReads || ignoreAccess(I, LI->getPointerOperand()))
15311531
return;
15321532
Interesting.emplace_back(I, LI->getPointerOperandIndex(), false,
15331533
LI->getType(), LI->getAlign());
15341534
} else if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
1535-
if (!ClInstrumentWrites || ignoreAccess(LI, SI->getPointerOperand()))
1535+
if (!ClInstrumentWrites || ignoreAccess(I, SI->getPointerOperand()))
15361536
return;
15371537
Interesting.emplace_back(I, SI->getPointerOperandIndex(), true,
15381538
SI->getValueOperand()->getType(), SI->getAlign());
15391539
} else if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) {
1540-
if (!ClInstrumentAtomics || ignoreAccess(LI, RMW->getPointerOperand()))
1540+
if (!ClInstrumentAtomics || ignoreAccess(I, RMW->getPointerOperand()))
15411541
return;
15421542
Interesting.emplace_back(I, RMW->getPointerOperandIndex(), true,
15431543
RMW->getValOperand()->getType(), None);
15441544
} else if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) {
1545-
if (!ClInstrumentAtomics || ignoreAccess(LI, XCHG->getPointerOperand()))
1545+
if (!ClInstrumentAtomics || ignoreAccess(I, XCHG->getPointerOperand()))
15461546
return;
15471547
Interesting.emplace_back(I, XCHG->getPointerOperandIndex(), true,
15481548
XCHG->getCompareOperand()->getType(), None);
@@ -1556,7 +1556,7 @@ void AddressSanitizer::getInterestingMemoryOperands(
15561556
return;
15571557

15581558
auto BasePtr = CI->getOperand(OpOffset);
1559-
if (ignoreAccess(LI, BasePtr))
1559+
if (ignoreAccess(I, BasePtr))
15601560
return;
15611561
Type *Ty = IsWrite ? CI->getArgOperand(0)->getType() : CI->getType();
15621562
MaybeAlign Alignment = Align(1);
@@ -1568,7 +1568,7 @@ void AddressSanitizer::getInterestingMemoryOperands(
15681568
} else {
15691569
for (unsigned ArgNo = 0; ArgNo < CI->arg_size(); ArgNo++) {
15701570
if (!ClInstrumentByval || !CI->isByValArgument(ArgNo) ||
1571-
ignoreAccess(LI, CI->getArgOperand(ArgNo)))
1571+
ignoreAccess(I, CI->getArgOperand(ArgNo)))
15721572
continue;
15731573
Type *Ty = CI->getParamByValType(ArgNo);
15741574
Interesting.emplace_back(I, ArgNo, false, Ty, Align(1));

llvm/test/Instrumentation/AddressSanitizer/asan-stack-safety.ll

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,39 @@
99
; RUN: opt < %s -S -enable-new-pm=1 -asan-instrumentation-with-call-threshold=0 \
1010
; RUN: -passes='asan-pipeline' -asan-use-stack-safety=1 -o - | FileCheck %s --check-prefixes=SAFETY
1111
; NOSAFETY: call void @__asan_load1
12+
; NOSAFETY: call void @__asan_store1
13+
; NOSAFETY: call void @__asan_store1
14+
; NOSAFETY: call void @__asan_store1
1215
; SAFETY-NOT: call void @__asan_load1
16+
; SAFETY-NOT: call void @__asan_store1
17+
; SAFETY-NOT: call void @__asan_store1
18+
; SAFETY-NOT: call void @__asan_store1
1319

14-
define i32 @stack-safety() sanitize_address {
20+
define i32 @load() sanitize_address {
1521
%buf = alloca [10 x i8], align 1
1622
%arrayidx = getelementptr inbounds [10 x i8], [10 x i8]* %buf, i64 0, i64 0
1723
%1 = load i8, i8* %arrayidx, align 1
1824
ret i32 0
1925
}
26+
27+
define i32 @store() sanitize_address {
28+
%buf = alloca [10 x i8], align 1
29+
%arrayidx = getelementptr inbounds [10 x i8], [10 x i8]* %buf, i64 0, i64 0
30+
store i8 0, i8* %arrayidx
31+
ret i32 0
32+
}
33+
34+
35+
define void @atomicrmw() sanitize_address {
36+
%buf = alloca [10 x i8], align 1
37+
%arrayidx = getelementptr inbounds [10 x i8], [10 x i8]* %buf, i64 0, i64 0
38+
%1 = atomicrmw add i8* %arrayidx, i8 1 seq_cst
39+
ret void
40+
}
41+
42+
define void @cmpxchg(i8 %compare_to, i8 %new_value) sanitize_address {
43+
%buf = alloca [10 x i8], align 1
44+
%arrayidx = getelementptr inbounds [10 x i8], [10 x i8]* %buf, i64 0, i64 0
45+
%1 = cmpxchg i8* %arrayidx, i8 %compare_to, i8 %new_value seq_cst seq_cst
46+
ret void
47+
}

0 commit comments

Comments
 (0)