This is an archive of the discontinued LLVM Phabricator instance.

[dfsan] Conservative solution to atomic load/store
ClosedPublic

Authored by stephan.yichao.zhao on Feb 23 2021, 11:31 AM.

Details

Summary

DFSan at store does store shadow data; store app data; and at load does
load shadow data; load app data.

When an application data is atomic, one overtainting case is

thread A: load shadow
thread B: store shadow
thread B: store app
thread A: load app

If the application address had been used by other flows, thread A reads
previous shadow, causing overtainting.

The change is similar to MSan's solution.

  1. enforce ordering of app load/store
  2. load shadow after load app; store shadow before shadow app
  3. do not track atomic store by reseting its shadow to be 0.

The last one is to address a case like this.

Thread A: load app
Thread B: store shadow
Thread A: load shadow
Thread B: store app

This approach eliminates overtainting as a trade-off between undertainting
flows via shadow data race.

Note that this change addresses only native atomic instructions, but
does not support builtin atomic libcalls yet.

Diff Detail

Event Timeline

stephan.yichao.zhao requested review of this revision.Feb 23 2021, 11:31 AM
Herald added projects: Restricted Project, Restricted Project. · View Herald TranscriptFeb 23 2021, 11:31 AM
Herald added subscribers: llvm-commits, Restricted Project. · View Herald Transcript
stephan.yichao.zhao edited the summary of this revision. (Show Details)Feb 23 2021, 11:35 AM
stephan.yichao.zhao edited the summary of this revision. (Show Details)

fixed test failures

use -fno-exceptions to avoid instrumenting some C++ exception
handling functions in the test.

Removed testing about origin-tracking from atomics.ll.
It cannot be tested until the origin tracking is complete.

Please fix lints.

compiler-rt/test/dfsan/atomic.cpp
38

This test seems to miss the mark. All it checks is that atomic stores set shadow to 0, and all the thread stuff is unnecessary to check this.

But where multiple threads *would* be helpful is to write a test where overtainting would occur before this change, but not after.

40
llvm/lib/Transforms/Instrumentation/DataFlowSanitizer.cpp
2009

Any reason not to use the load app, load shadow ordering always?

2041

Should we call this function storeZeroPrimitiveShadow then?

2174

Please add comments to visitAtomicRMWInst and visitAtomicCmpXchgInst explaining why we modify the atomic orderings.

llvm/test/Instrumentation/DataFlowSanitizer/atomics.ll
55

I don't see %a's shadow being checked anywhere.

stephan.yichao.zhao marked 5 inline comments as done.

update

stephan.yichao.zhao added inline comments.
compiler-rt/test/dfsan/atomic.cpp
38

Updated the test case. Set atomic_i with an initial label to ensure load can get only initial labels or zeros.

40

Yes.

DFSan needs some extension to work with Builtins. MSan uses a function pass TargetLibraryInfoWrapperPass to identify builtin calls, while DFSan is a module pass.
And DFSan's ABI does not work with builtins because builtins do not have C libcalls.

Our current internal use cases do not support Builtins. But we need to support them in the next step.

llvm/lib/Transforms/Instrumentation/DataFlowSanitizer.cpp
2009

This code could seem confusing. Actually it does not skip a line. It sets the code insertion point after app atomic load. None-atomic load still inserts instrumented code before them. Actually they can be the same but that would require updating a lot of tests...

2041

done. Thank you.

2174

This is a good point. Since we always use 0 shadows, what their orderings are does not matter.

@evghenii, this followed MSan. Do you think it is fine not to change their orderings?

llvm/test/Instrumentation/DataFlowSanitizer/atomics.ll
55

updated comments.

morehouse accepted this revision.Feb 24 2021, 3:15 PM
morehouse added inline comments.
compiler-rt/test/dfsan/atomic.cpp
40

Please add a TODO for this.

This revision is now accepted and ready to land.Feb 24 2021, 3:15 PM
stephan.yichao.zhao marked an inline comment as done.

added TODO

added comments to RMW and ChmpXchg.

stephan.yichao.zhao marked an inline comment as done.Feb 25 2021, 2:40 PM
This revision was landed with ongoing or failed builds.Feb 25 2021, 3:35 PM
This revision was automatically updated to reflect the committed changes.