<html>
<head>
<base href="http://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - MemorySanitizer false negatives on comparisons"
href="http://bugs.llvm.org/show_bug.cgi?id=32842">32842</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>MemorySanitizer false negatives on comparisons
</td>
</tr>
<tr>
<th>Product</th>
<td>clang
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>LLVM Codegen
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedclangbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>glider@google.com
</td>
</tr>
<tr>
<th>CC</th>
<td>dvyukov@google.com, eugeni.stepanov@gmail.com, kcc@google.com, llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=18378" name="attach_18378" title="Reproducer">attachment 18378</a> <a href="attachment.cgi?id=18378&action=edit" title="Reproducer">[details]</a></span>
Reproducer
For the attached program MSan generates code that produces a false negative
when comparing two integers.
Consider iphdr is declared as:
5 struct iphdr {
6 u8 ihl:4, version: 4;
..
12 };
And in the following code iph->ihl is uninitialized (see ub.c for full code):
15 int raw_send_hdrinc(unsigned long int length) {
16 struct iphdr *iph;
17 unsigned int iphlen;
18 int err = 0;
19 iph = get_iphdr();
20 iphlen = iph->ihl * 4;
21 printf("&iphlen: %p\n", &iphlen);
22 err = -1;
23 if (iphlen > length) {
24 printf("error!\n");
25 goto error_free;
26 }
Looking at the IR built with the default flags I see the following
chunk corresponding to the comparison:
90 %27 = load i32, i32* %iphlen, align 4, !tbaa !2
91 %_msld6 = load i32, i32* %21, align 4
92 %_msprop7 = zext i32 %_msld6 to i64
93 %conv2 = zext i32 %27 to i64
94 %_msprop8 = or i64 %1, %_msprop7
95 %28 = and i64 %_msprop8, 1
96 %29 = icmp eq i64 %28, 0
97 %cmp = icmp ugt i64 %conv2, %length
98 br i1 %29, label %34, label %30, !prof !1
Here %1 is the shadow for |length| and %_msld6 is the shadow for |iphlen|.
In the case |length| is fully initialized, the lowest bit of %_msprop8 is zero
(because the two lowest bits of iphlen are initialized).
Then despite the result of comparison is uninitialized and %_msprop8 is
non-zero, it's truncated to a zero bit, so the uninitializedness is lost.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>