[UBSan] Runtime Executable Only violation hit when checking the function pointer on an execute-only target. #64931
Assignees
Labels
clang:driver
'clang' and 'clang++' user-facing binaries. Not 'clang-cl'
clang:frontend
Language frontend issues, e.g. anything involving "Sema"
compiler-rt:ubsan
Undefined behavior sanitizer
release:backport
release:fixed-in-main
release:merged
Milestone
Comments
MaggieYingYi
added
clang:driver
|
@llvm/issue-subscribers-clang-driver |
|
@llvm/issue-subscribers-clang-frontend |
|
D158614 is created for code review. |
|
/cherry-pick 9ef536a |
|
/branch llvm/llvm-project-release-prs/issue64931 |
llvmbot
pushed a commit
to llvm/llvm-project-release-prs
that referenced
this issue
Aug 31, 2023
…arget. An execute-only target disallows data access to code sections. -fsanitize=function and -fsanitize=kcfi instrument indirect function calls to load a type hash before the function label. This results in a non-execute access to the code section and a runtime error. To solve the issue, -fsanitize=function should not be included in any check group (e.g. undefined) on an execute-only target. If a user passes -fsanitize=undefined, there is no error and no warning. However, if the user explicitly passes -fsanitize=function or -fsanitize=kcfi on an execute-only target, an error will be emitted. Fixes: llvm/llvm-project#64931. Reviewed By: MaskRay, probinson, simon_tatham Differential Revision: https://reviews.llvm.org/D158614 (cherry picked from commit 9ef536a12ea65a2b9e2511936327c7b621af38fb)
|
/pull-request llvm/llvm-project-release-prs#671 |
|
/branch llvm/llvm-project-release-prs/issue64931 |
llvmbot
pushed a commit
to llvm/llvm-project-release-prs
that referenced
this issue
Aug 31, 2023
…arget. An execute-only target disallows data access to code sections. -fsanitize=function and -fsanitize=kcfi instrument indirect function calls to load a type hash before the function label. This results in a non-execute access to the code section and a runtime error. To solve the issue, -fsanitize=function should not be included in any check group (e.g. undefined) on an execute-only target. If a user passes -fsanitize=undefined, there is no error and no warning. However, if the user explicitly passes -fsanitize=function or -fsanitize=kcfi on an execute-only target, an error will be emitted. Fixes: llvm/llvm-project#64931. Reviewed By: MaskRay, probinson, simon_tatham Differential Revision: https://reviews.llvm.org/D158614 (cherry picked from commit 9ef536a12ea65a2b9e2511936327c7b621af38fb)
MaskRay
pushed a commit
to MaskRay/llvm-project
that referenced
this issue
Aug 31, 2023
…arget. An execute-only target disallows data access to code sections. -fsanitize=function and -fsanitize=kcfi instrument indirect function calls to load a type hash before the function label. This results in a non-execute access to the code section and a runtime error. To solve the issue, -fsanitize=function should not be included in any check group (e.g. undefined) on an execute-only target. If a user passes -fsanitize=undefined, there is no error and no warning. However, if the user explicitly passes -fsanitize=function or -fsanitize=kcfi on an execute-only target, an error will be emitted. Fixes: llvm#64931. Reviewed By: MaskRay, probinson, simon_tatham Differential Revision: https://reviews.llvm.org/D158614
|
Here is a modified fix: /branch MaskRay/llvm-project/17.x-mexecute-only |
|
I merged your branch manually @MaskRay |
AlexisPerry
pushed a commit
to AlexisPerry/kitsune-1
that referenced
this issue
Jul 23, 2024
…arget. An execute-only target disallows data access to code sections. -fsanitize=function and -fsanitize=kcfi instrument indirect function calls to load a type hash before the function label. This results in a non-execute access to the code section and a runtime error. To solve the issue, -fsanitize=function should not be included in any check group (e.g. undefined) on an execute-only target. If a user passes -fsanitize=undefined, there is no error and no warning. However, if the user explicitly passes -fsanitize=function or -fsanitize=kcfi on an execute-only target, an error will be emitted. Fixes: llvm#64931. Reviewed By: MaskRay, probinson, simon_tatham Differential Revision: https://reviews.llvm.org/D158614
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
An execute-only target disallows data access to code sections.
The commit rG279a4d causes the generated code to read text section data which is not allowed on an execute-only target.
When enabling the function sanitizer (
-fsanitize=function), UBSan function signatures and type hashes are emitted within the function's prologue data to check the function type. This results in the non-execute access and a runtime error.The text was updated successfully, but these errors were encountered: