Skip to content

Commit

Permalink
JIT: Fix invalid containment of vector broadcasts (#92333)
Browse files Browse the repository at this point in the history
The containment checks for vector broadcasts were missing a size check,
meaning that a uint broadcast could contain a ubyte/ushort indirection.
That would lead to out-of-bounds reads.

Fix #83387
  • Loading branch information
jakobbotsch authored Sep 20, 2023
1 parent 614d864 commit a5b75b8
Show file tree
Hide file tree
Showing 4 changed files with 32 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/coreclr/jit/gentree.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -19636,8 +19636,8 @@ GenTree* Compiler::gtNewSimdBinOpNode(
}
else
{
assert(op2->TypeIs(type, simdBaseType, genActualType(simdBaseType)) ||
(op2->TypeIs(TYP_SIMD12) && type == TYP_SIMD16));
assert((genActualType(op2) == genActualType(type)) || (genActualType(op2) == genActualType(simdBaseType)) ||
(op2->TypeIs(TYP_SIMD12) && (type == TYP_SIMD16)));
}

NamedIntrinsic intrinsic = NI_Illegal;
Expand Down
3 changes: 3 additions & 0 deletions src/coreclr/jit/lowerxarch.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -7956,6 +7956,9 @@ bool Lowering::IsContainableHWIntrinsicOp(GenTreeHWIntrinsic* parentNode, GenTre
// The memory form of this already takes a pointer and should be treated like a MemoryLoad
supportsGeneralLoads = !childNode->OperIsHWIntrinsic();
}

supportsGeneralLoads =
supportsGeneralLoads && (genTypeSize(childNode) >= genTypeSize(parentNode->GetSimdBaseType()));
break;
}

Expand Down
19 changes: 19 additions & 0 deletions src/tests/JIT/Regression/JitBlue/Runtime_83387/Runtime_83387.cs
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using System.Runtime.CompilerServices;
using System.Runtime.Intrinsics;
using Xunit;

public class Runtime_83387
{
[MethodImpl(MethodImplOptions.NoOptimization)]
[Fact]
public static int TestEntryPoint()
{
(ushort A, ushort R) c = (1, 65535);
Vector128<uint> v1 = Vector128.Create((uint)100);
v1 = v1 * c.A;
return (int)v1.ToScalar();
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<Optimize>True</Optimize>
</PropertyGroup>
<ItemGroup>
<Compile Include="$(MSBuildProjectName).cs" />
</ItemGroup>
</Project>

0 comments on commit a5b75b8

Please sign in to comment.