[UBSAN] add null and alignment checks for aggregates #164548
Conversation
|
Thank you for submitting a Pull Request (PR) to the LLVM Project! This PR will be automatically labeled and the relevant teams will be notified. If you wish to, you can add reviewers by using the "Reviewers" section on this page. If this is not working for you, it is probably because you do not have write permissions for the repository. In which case you can instead tag reviewers by name in a comment by using If you have received no comments on your PR for a week, you can request a review by "ping"ing the PR by adding a comment “Ping”. The common courtesy "ping" rate is once a week. Please remember that you are asking for valuable time from other developers. If you have further questions, they may be answered by the LLVM GitHub User Guide. You can also ask questions in a comment on this PR, on the LLVM Discord or on the forums. |
llvmbot
added
clang
|
@llvm/pr-subscribers-compiler-rt-sanitizer @llvm/pr-subscribers-clang Author: VASU SHARMA (vasu-the-sharma) ChangesThis PR adds Full diff: https://github.com/llvm/llvm-project/pull/164548.diff 1 Files Affected:
diff --git a/clang/lib/CodeGen/CGExprAgg.cpp b/clang/lib/CodeGen/CGExprAgg.cpp
index eee397f1f3d19..de6d80a273dbd 100644
--- a/clang/lib/CodeGen/CGExprAgg.cpp
+++ b/clang/lib/CodeGen/CGExprAgg.cpp
@@ -2249,6 +2249,21 @@ void CodeGenFunction::EmitAggregateCopy(LValue Dest, LValue Src, QualType Ty,
bool isVolatile) {
assert(!Ty->isAnyComplexType() && "Shouldn't happen for complex");
+ if (SanOpts.hasOneOf(SanitizerKind::Null | SanitizerKind::Alignment)) {
+ Address SrcAddr = Src.getAddress();
+ Address DestAddr = Dest.getAddress();
+
+ // Check source pointer for null and alignment violations
+ EmitTypeCheck(TCK_Load, SourceLocation(),
+ SrcAddr.emitRawPointer(*this), Ty, SrcAddr.getAlignment(),
+ SanitizerSet());
+
+ // Check destination pointer for null and alignment violations
+ EmitTypeCheck(TCK_Store, SourceLocation(),
+ DestAddr.emitRawPointer(*this), Ty, DestAddr.getAlignment(),
+ SanitizerSet());
+ }
+
Address DestPtr = Dest.getAddress();
Address SrcPtr = Src.getAddress();
|
You can test this locally with the following command:git-clang-format --diff origin/main HEAD --extensions cpp -- clang/lib/CodeGen/CGExprAgg.cpp --diff_from_common_commit
View the diff from clang-format here.diff --git a/clang/lib/CodeGen/CGExprAgg.cpp b/clang/lib/CodeGen/CGExprAgg.cpp
index de6d80a27..1d6e3c101 100644
--- a/clang/lib/CodeGen/CGExprAgg.cpp
+++ b/clang/lib/CodeGen/CGExprAgg.cpp
@@ -2254,14 +2254,12 @@ void CodeGenFunction::EmitAggregateCopy(LValue Dest, LValue Src, QualType Ty,
Address DestAddr = Dest.getAddress();
// Check source pointer for null and alignment violations
- EmitTypeCheck(TCK_Load, SourceLocation(),
- SrcAddr.emitRawPointer(*this), Ty, SrcAddr.getAlignment(),
- SanitizerSet());
+ EmitTypeCheck(TCK_Load, SourceLocation(), SrcAddr.emitRawPointer(*this), Ty,
+ SrcAddr.getAlignment(), SanitizerSet());
// Check destination pointer for null and alignment violations
- EmitTypeCheck(TCK_Store, SourceLocation(),
- DestAddr.emitRawPointer(*this), Ty, DestAddr.getAlignment(),
- SanitizerSet());
+ EmitTypeCheck(TCK_Store, SourceLocation(), DestAddr.emitRawPointer(*this),
+ Ty, DestAddr.getAlignment(), SanitizerSet());
}
Address DestPtr = Dest.getAddress();
|
llvmbot
added
compiler-rt
compiler-rt:ubsan
clang/lib/CodeGen/CGExprAgg.cpp
Outdated
| Address DestAddr = Dest.getAddress(); | ||
|
|
||
| // Check source pointer for null and alignment violations | ||
| EmitTypeCheck(TCK_Load, SourceLocation(), |
There was a problem hiding this comment.
I think the scope should be expanded to other cases covered by EmitCheckedLValue.
There was a problem hiding this comment.
Thanks for the suggestion @hubert-reinterpretcast
I've reviewed the two EmitCheckedLValue usage sites in CGExprAgg.cpp:
Line 802 (VisitCastExpr): Uses EmitCheckedLValue with TCK_Load for dynamic_cast operations
Line 1313 (VisitBinAssign): Uses EmitCheckedLValue with TCK_Store, then calls EmitCopy which delegates to EmitAggregateCopy
Both cases are already covered:
EmitCheckedLValue performs type checking on the LValue expression itself
My changes to EmitAggregateCopy add sanitizer checks at the actual copy operation (the memcpy call)
These checks are complementary rather than redundant:
EmitCheckedLValue: Validates the expression evaluation produces a valid LValue
EmitAggregateCopy: Validates the source and destination pointers during the memory copy operation
The EmitAggregateCopy checks catch cases where pointers might become invalid between LValue emission and the actual copy (like array indexing or pointer arithmetic).
Do you see other specific cases in EmitCheckedLValue usage that would benefit from additional instrumentation?
4 participants
Description
This PR adds sanitizer checks for null pointers and misalignment during aggregate copy operations in EmitAggregateCopy.
Current State
When copying aggregates (structs), the compiler does not validate that source and destination pointers are non-null or properly aligned when sanitizers are enabled. This allows undefined behavior from invalid pointers to go undetected at runtime.
Solution
When null or alignment sanitizers are active, this change:
This ensures memory safety violations are caught early, preventing crashes and corruption from invalid aggregate copies.
Testing
Added comprehensive test cases covering:
Screenshots