Skip to content

Commit a5f1cf3

Browse files
atrosinenkoatrosinenko
committed
Fix handling of DstState::FirstInstLeakingReg
1 parent 05e8765 commit a5f1cf3

File tree

3 files changed

+39
-29
lines changed

3 files changed

+39
-29
lines changed

‎bolt/lib/Passes/PAuthGadgetScanner.cpp

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -232,12 +232,11 @@ struct SrcState {
232232
bool operator!=(const SrcState &RHS) const { return !((*this) == RHS); }
233233
};
234234

235-
static void
236-
printLastInsts(raw_ostream &OS,
237-
ArrayRef<SmallPtrSet<const MCInst *, 4>> LastInstWritingReg) {
235+
static void printInstsShort(raw_ostream &OS,
236+
ArrayRef<SmallPtrSet<const MCInst *, 4>> Insts) {
238237
OS << "Insts: ";
239-
for (unsigned I = 0; I < LastInstWritingReg.size(); ++I) {
240-
auto &Set = LastInstWritingReg[I];
238+
for (unsigned I = 0; I < Insts.size(); ++I) {
239+
auto &Set = Insts[I];
241240
OS << "[" << I << "](";
242241
for (const MCInst *MCInstP : Set)
243242
OS << MCInstP << " ";
@@ -252,7 +251,7 @@ raw_ostream &operator<<(raw_ostream &OS, const SrcState &S) {
252251
} else {
253252
OS << "SafeToDerefRegs: " << S.SafeToDerefRegs << ", ";
254253
OS << "TrustedRegs: " << S.TrustedRegs << ", ";
255-
printLastInsts(OS, S.LastInstWritingReg);
254+
printInstsShort(OS, S.LastInstWritingReg);
256255
}
257256
OS << ">";
258257
return OS;
@@ -281,7 +280,7 @@ void SrcStatePrinter::print(raw_ostream &OS, const SrcState &S) const {
281280
OS << ", TrustedRegs: ";
282281
RegStatePrinter.print(OS, S.TrustedRegs);
283282
OS << ", ";
284-
printLastInsts(OS, S.LastInstWritingReg);
283+
printInstsShort(OS, S.LastInstWritingReg);
285284
}
286285
OS << ">";
287286
}
@@ -754,7 +753,7 @@ SrcSafetyAnalysis::create(BinaryFunction &BF,
754753
struct DstState {
755754
/// The set of registers whose values cannot be inspected by an attacker in
756755
/// a way usable as an authentication oracle. The results of authentication
757-
/// instructions should be written to such registers.
756+
/// instructions should only be written to such registers.
758757
BitVector CannotEscapeUnchecked;
759758

760759
std::vector<SmallPtrSet<const MCInst *, 4>> FirstInstLeakingReg;
@@ -772,6 +771,9 @@ struct DstState {
772771
return (*this = StateIn);
773772

774773
CannotEscapeUnchecked &= StateIn.CannotEscapeUnchecked;
774+
for (unsigned I = 0; I < FirstInstLeakingReg.size(); ++I)
775+
for (const MCInst *J : StateIn.FirstInstLeakingReg[I])
776+
FirstInstLeakingReg[I].insert(J);
775777
return *this;
776778
}
777779

@@ -780,7 +782,8 @@ struct DstState {
780782
bool empty() const { return CannotEscapeUnchecked.empty(); }
781783

782784
bool operator==(const DstState &RHS) const {
783-
return CannotEscapeUnchecked == RHS.CannotEscapeUnchecked;
785+
return CannotEscapeUnchecked == RHS.CannotEscapeUnchecked &&
786+
FirstInstLeakingReg == RHS.FirstInstLeakingReg;
784787
}
785788
bool operator!=(const DstState &RHS) const { return !((*this) == RHS); }
786789
};
@@ -790,7 +793,8 @@ raw_ostream &operator<<(raw_ostream &OS, const DstState &S) {
790793
if (S.empty()) {
791794
OS << "empty";
792795
} else {
793-
OS << "CannotEscapeUnchecked: " << S.CannotEscapeUnchecked;
796+
OS << "CannotEscapeUnchecked: " << S.CannotEscapeUnchecked << ", ";
797+
printInstsShort(OS, S.FirstInstLeakingReg);
794798
}
795799
OS << ">";
796800
return OS;
@@ -810,10 +814,13 @@ void DstStatePrinter::print(raw_ostream &OS, const DstState &S) const {
810814
OS << "dst-state<";
811815
if (S.empty()) {
812816
assert(S.CannotEscapeUnchecked.empty());
817+
assert(S.FirstInstLeakingReg.empty());
813818
OS << "empty";
814819
} else {
815820
OS << "CannotEscapeUnchecked: ";
816821
RegStatePrinter.print(OS, S.CannotEscapeUnchecked);
822+
OS << ", ";
823+
printInstsShort(OS, S.FirstInstLeakingReg);
817824
}
818825
OS << ">";
819826
}
@@ -843,6 +850,7 @@ class DstSafetyAnalysis {
843850
const unsigned NumRegs;
844851

845852
const TrackedRegisters RegsToTrackInstsFor;
853+
846854
/// Stores information about the detected instruction sequences emitted to
847855
/// check an authenticated pointer. Specifically, if such sequence is detected
848856
/// in a basic block, it maps the first instruction of that sequence to the
@@ -899,7 +907,6 @@ class DstSafetyAnalysis {
899907
const BitVector &LeakedRegs,
900908
const DstState &Cur) const {
901909
SmallVector<MCPhysReg> Regs;
902-
const MCPhysReg NoReg = BC.MIB->getNoRegister();
903910

904911
// A pointer can be checked, or
905912
if (auto CheckedReg =
@@ -913,7 +920,7 @@ class DstSafetyAnalysis {
913920
bool IsAuthenticated;
914921
MCPhysReg BranchDestReg =
915922
BC.MIB->getRegUsedAsIndirectBranchDest(Inst, IsAuthenticated);
916-
assert(BranchDestReg != NoReg);
923+
assert(BranchDestReg != BC.MIB->getNoRegister());
917924
if (!IsAuthenticated)
918925
Regs.push_back(BranchDestReg);
919926
}

‎bolt/test/binary-analysis/AArch64/gs-pauth-authentication-oracles.s

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -350,7 +350,8 @@ bad_leaked_to_subroutine_multi_bb:
350350
bad_unknown_usage_read_multi_bb:
351351
// CHECK-LABEL: GS-PAUTH: authentication oracle found in function bad_unknown_usage_read_multi_bb, basic block {{[^,]+}}, at address
352352
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: autia x0, x1
353-
// CHECK-NEXT: The 0 instructions that leak the affected registers are:
353+
// CHECK-NEXT: The 1 instructions that leak the affected registers are:
354+
// CHECK-NEXT: 1. {{[0-9a-f]+}}: mul x3, x0, x1
354355
autia x0, x1
355356
cbz x3, 1f
356357
mul x3, x0, x1
@@ -364,7 +365,8 @@ bad_unknown_usage_read_multi_bb:
364365
bad_unknown_usage_subreg_read_multi_bb:
365366
// CHECK-LABEL: GS-PAUTH: authentication oracle found in function bad_unknown_usage_subreg_read_multi_bb, basic block {{[^,]+}}, at address
366367
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: autia x0, x1
367-
// CHECK-NEXT: The 0 instructions that leak the affected registers are:
368+
// CHECK-NEXT: The 1 instructions that leak the affected registers are:
369+
// CHECK-NEXT: 1. {{[0-9a-f]+}}: mul w3, w0, w1
368370
autia x0, x1
369371
cbz x3, 1f
370372
mul w3, w0, w1
@@ -378,7 +380,8 @@ bad_unknown_usage_subreg_read_multi_bb:
378380
bad_unknown_usage_update_multi_bb:
379381
// CHECK-LABEL: GS-PAUTH: authentication oracle found in function bad_unknown_usage_update_multi_bb, basic block {{[^,]+}}, at address
380382
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: autia x0, x1
381-
// CHECK-NEXT: The 0 instructions that leak the affected registers are:
383+
// CHECK-NEXT: The 1 instructions that leak the affected registers are:
384+
// CHECK-NEXT: 1. {{[0-9a-f]+}}: movk x0, #0x2a, lsl #16
382385
autia x0, x1
383386
cbz x3, 1f
384387
movk x0, #42, lsl #16 // does not overwrite x0 completely

‎bolt/test/binary-analysis/AArch64/gs-pauth-debug-output.s

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -282,10 +282,10 @@ auth_oracle:
282282
// CHECK: End of Function "auth_oracle"
283283
// ...
284284
// PAUTH: Running dst register safety analysis...
285-
// PAUTH-NEXT: DstSafetyAnalysis::ComputeNext( ret x30, dst-state<CannotEscapeUnchecked: >)
286-
// PAUTH-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI >)
287-
// PAUTH-NEXT: DstSafetyAnalysis::ComputeNext( autia x0, x1, dst-state<CannotEscapeUnchecked: LR W30 W30_HI >)
288-
// PAUTH-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI >)
285+
// PAUTH-NEXT: DstSafetyAnalysis::ComputeNext( ret x30, dst-state<CannotEscapeUnchecked: , Insts: >)
286+
// PAUTH-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: >)
287+
// PAUTH-NEXT: DstSafetyAnalysis::ComputeNext( autia x0, x1, dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: >)
288+
// PAUTH-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: >)
289289
// PAUTH-NEXT: After dst register safety analysis:
290290
// PAUTH-NEXT: Binary Function "auth_oracle" {
291291
// PAUTH-NEXT: Number : 4
@@ -295,22 +295,22 @@ auth_oracle:
295295
// PAUTH-NEXT: }
296296
// PAUTH-NEXT: [[BB0]] (2 instructions, align : 1)
297297
// PAUTH-NEXT: Entry Point
298-
// PAUTH-NEXT: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector>
299-
// PAUTH-NEXT: 00000004: ret # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector>
298+
// PAUTH-NEXT: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: >
299+
// PAUTH-NEXT: 00000004: ret # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: >
300300
// PAUTH-EMPTY:
301301
// PAUTH-NEXT: DWARF CFI Instructions:
302302
// PAUTH-NEXT: <empty>
303303
// PAUTH-NEXT: End of Function "auth_oracle"
304304
// PAUTH-EMPTY:
305-
// PAUTH-NEXT: Found auth inst: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector>
305+
// PAUTH-NEXT: Found auth inst: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: >
306306
// PAUTH-NEXT: Authenticated reg: X0
307307
// PAUTH-NEXT: safe output registers: LR W30 W30_HI
308308
// PAUTH-EMPTY:
309309
// PAUTH-NEXT: Running detailed dst register safety analysis...
310-
// PAUTH-NEXT: DstSafetyAnalysis::ComputeNext( ret x30, dst-state<CannotEscapeUnchecked: >)
311-
// PAUTH-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI >)
312-
// PAUTH-NEXT: DstSafetyAnalysis::ComputeNext( autia x0, x1, dst-state<CannotEscapeUnchecked: LR W30 W30_HI >)
313-
// PAUTH-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI >)
310+
// PAUTH-NEXT: DstSafetyAnalysis::ComputeNext( ret x30, dst-state<CannotEscapeUnchecked: , Insts: [0]()>)
311+
// PAUTH-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: [0]()>)
312+
// PAUTH-NEXT: DstSafetyAnalysis::ComputeNext( autia x0, x1, dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: [0]()>)
313+
// PAUTH-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: [0](0x{{[0-9a-f]+}} )>)
314314
// PAUTH-NEXT: After detailed dst register safety analysis:
315315
// PAUTH-NEXT: Binary Function "auth_oracle" {
316316
// PAUTH-NEXT: Number : 4
@@ -320,14 +320,14 @@ auth_oracle:
320320
// PAUTH-NEXT: }
321321
// PAUTH-NEXT: [[BB0]] (2 instructions, align : 1)
322322
// PAUTH-NEXT: Entry Point
323-
// PAUTH-NEXT: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector>
324-
// PAUTH-NEXT: 00000004: ret # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector>
323+
// PAUTH-NEXT: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: [0](0x{{[0-9a-f]+}} )>
324+
// PAUTH-NEXT: 00000004: ret # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: [0]()>
325325
// PAUTH-EMPTY:
326326
// PAUTH-NEXT: DWARF CFI Instructions:
327327
// PAUTH-NEXT: <empty>
328328
// PAUTH-NEXT: End of Function "auth_oracle"
329329
// PAUTH-EMPTY:
330-
// PAUTH-NEXT: Attaching leakage info to: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector>
330+
// PAUTH-NEXT: Attaching leakage info to: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: [0](0x{{[0-9a-f]+}} )>
331331

332332
// CHECK-LABEL:Analyzing function main, AllocatorId = 1
333333
.globl main

0 commit comments

Comments
 (0)