CFI: blacklist STL allocate() from unrelated-casts

[vlad.tsyrklevich]

Summary

Previously, STL allocators were blacklisted in compiler_rt's
cfi_blacklist.txt because they mandated a cast from void* to T* before
object initialization completed. This change moves that logic into the
front end because C++ name mangling supports a substitution compression
mechanism for symbols that makes it difficult to blacklist the mangled
symbol for allocate() using a regular expression.

Motivated by crbug.com/751385.

[pcc]

lib/CodeGen/CodeGenFunction.cpp

785 ↗

(On Diff #109652)

The comment should explain why.

789 ↗

(On Diff #109652)

Should this also match the C++17 allocate function which takes a single argument?

794 ↗

(On Diff #109652)

Maybe better to compare against ASTContext::getSizeType(), which should return the builtin type that corresponds to size_t.

[vlad.tsyrklevich]

Address pcc's comments

[vlad.tsyrklevich]

lib/CodeGen/CodeGenFunction.cpp

789 ↗

(On Diff #109652)

absolutely, thanks for catching this!

[pcc]

LGTM

cfe/trunk/lib/CodeGen/CodeGenFunction.cpp

static bool endsWithReturn(const Decl* F) {
   return false;
 }
 
 static void markAsIgnoreThreadCheckingAtRuntime(llvm::Function *Fn) {
   Fn->addFnAttr("sanitize_thread_no_checking_at_run_time");
   Fn->removeFnAttr(llvm::Attribute::SanitizeThread);
 }
 
+static bool matchesStlAllocatorFn(const Decl *D, const ASTContext &Ctx) {
+  auto *MD = dyn_cast_or_null<CXXMethodDecl>(D);
+  if (!MD || !MD->getName().equals("allocate") ||
+      (MD->getNumParams() != 1 && MD->getNumParams() != 2))
+    return false;
+
+  if (MD->parameters()[0]->getType().getCanonicalType() != Ctx.getSizeType())
+    return false;
+
+  if (MD->getNumParams() == 2) {
+    auto *PT = MD->parameters()[1]->getType()->getAs<PointerType>();
+    if (!PT || !PT->isVoidPointerType() ||
+        !PT->getPointeeType().isConstQualified())
+      return false;
+  }
+
+  return true;
+}
+
 void CodeGenFunction::StartFunction(GlobalDecl GD,
                                     QualType RetTy,
                                     llvm::Function *Fn,
                                     const CGFunctionInfo &FnInfo,
                                     const FunctionArgList &Args,
                                     SourceLocation Loc,
                                     SourceLocation StartLoc) {
   assert(!CurFn &&
if (const auto *OMD = dyn_cast_or_null<ObjCMethodDecl>(D)) {
       }
     } else if (const auto *FD = dyn_cast_or_null<FunctionDecl>(D)) {
       IdentifierInfo *II = FD->getIdentifier();
       if (II && II->isStr("__destroy_helper_block_"))
         markAsIgnoreThreadCheckingAtRuntime(Fn);
     }
   }
 
+  // Ignore unrelated casts in STL allocate() since the allocator must cast
+  // from void* to T* before object initialization completes. Don't match on the
+  // namespace because not all allocators are in std::
+  if (D && SanOpts.has(SanitizerKind::CFIUnrelatedCast)) {
+    if (matchesStlAllocatorFn(D, getContext()))
+      SanOpts.Mask &= ~SanitizerKind::CFIUnrelatedCast;
+  }
+
   // Apply xray attributes to the function (as a string, for now)
   if (D && ShouldXRayInstrumentFunction()) {
     if (const auto *XRayAttr = D->getAttr<XRayInstrumentAttr>()) {
       if (XRayAttr->alwaysXRayInstrument())
         Fn->addFnAttr("function-instrument", "xray-always");
       if (XRayAttr->neverXRayInstrument())
         Fn->addFnAttr("function-instrument", "xray-never");
       if (const auto *LogArgs = D->getAttr<XRayLogArgsAttr>()) {

cfe/trunk/test/CodeGen/cfi-unrelated-cast.cpp

+// STL allocators should not have unrelated-cast tests applied
+// RUN: %clang_cc1 -flto -fvisibility hidden -fsanitize=cfi-unrelated-cast -emit-llvm -o - %s | FileCheck %s
+
+#include <stddef.h>
+
+template<class T>
+class myalloc {
+ public:
+  // CHECK: define{{.*}}allocateE{{.}}
+  // CHECK-NOT: llvm.type.test
+  T *allocate(size_t sz) {
+    return (T*)::operator new(sz);
+  }
+
+  // CHECK: define{{.*}}allocateE{{.}}PKv
+  // CHECK-NOT: llvm.type.test
+  T *allocate(size_t sz, const void *ptr) {
+    return (T*)::operator new(sz);
+  }
+
+  // CHECK: define{{.*}}differentName
+  // CHECK: llvm.type.test
+  T *differentName(size_t sz, const void *ptr) {
+    return (T*)::operator new(sz);
+  }
+};
+
+class C1 {
+  virtual void f() {}
+};
+
+C1 *f1() {
+  myalloc<C1> allocator;
+  (void)allocator.allocate(16);
+  (void)allocator.allocate(16, 0);
+  (void)allocator.differentName(16, 0);
+}