From dfcf69770bc522b9e411c66454934a37c1f35332 Mon Sep 17 00:00:00 2001 From: Joao Moreira Date: Tue, 7 Dec 2021 10:34:37 +0800 Subject: [PATCH] [X86] Fix fentry handling in X86IndirectBranchTracking.cpp When compiling with indirect branch tracking and fentry (-fcf-protection=branch -mfentry -pg) the X86IndirectBranchTrackingPass will attempt to place endbr in basic blocks, checking for Calls/IsCallReturnTwice. For calling the function IsCallReturnTwice(), the pass attempts to retrieve the first operand of the respective machine instruction. Since FENTRY_CALL is considered a call, and it does not have any argument, the condition inside the pass will attempt to call IsCallReturnTwice on the machine instruction, but since it does not have operands, it will lead into a crash. Kudos to Alyssa Milburn for helping in the issue triage. The diff brings a test, but to reproduce the problem, follow the steps below. ``` echo "int main() {};" > repro.c clang repro.c -fcf-protection=branch -mfentry -pg ``` Reviewed By: craig.topper Differential Revision: https://reviews.llvm.org/D111108 --- llvm/lib/Target/X86/X86IndirectBranchTracking.cpp | 4 +++- llvm/test/CodeGen/X86/fentry-ibt.ll | 17 +++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 llvm/test/CodeGen/X86/fentry-ibt.ll diff --git a/llvm/lib/Target/X86/X86IndirectBranchTracking.cpp b/llvm/lib/Target/X86/X86IndirectBranchTracking.cpp index 732b2b1..6642f46 100644 --- a/llvm/lib/Target/X86/X86IndirectBranchTracking.cpp +++ b/llvm/lib/Target/X86/X86IndirectBranchTracking.cpp @@ -137,8 +137,10 @@ bool X86IndirectBranchTrackingPass::runOnMachineFunction(MachineFunction &MF) { Changed |= addENDBR(MBB, MBB.begin()); for (MachineBasicBlock::iterator I = MBB.begin(); I != MBB.end(); ++I) { - if (I->isCall() && IsCallReturnTwice(I->getOperand(0))) + if (I->isCall() && I->getNumOperands() > 0 && + IsCallReturnTwice(I->getOperand(0))) { Changed |= addENDBR(MBB, std::next(I)); + } } // Exception handle may indirectly jump to catch pad, So we should add diff --git a/llvm/test/CodeGen/X86/fentry-ibt.ll b/llvm/test/CodeGen/X86/fentry-ibt.ll new file mode 100644 index 0000000..8285f4d --- /dev/null +++ b/llvm/test/CodeGen/X86/fentry-ibt.ll @@ -0,0 +1,17 @@ +; RUN: llc %s -o - -verify-machineinstrs | FileCheck %s + +define void @test1() #0 { +entry: + ret void + +; CHECK-LABEL: @test1 +; CHECK: endbr64 +; CHECK: callq __fentry__ +; CHECK-NOT: mcount +; CHECK: retq +} + +!llvm.module.flags = !{!0} + +attributes #0 = { "fentry-call"="true" } +!0 = !{i32 4, !"cf-protection-branch", i32 1} -- 2.7.4