<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - LLD's /GUARD:CF relocation scanning heuristic ignores address-taken import thunks"
href="https://bugs.llvm.org/show_bug.cgi?id=39799">39799</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>LLD's /GUARD:CF relocation scanning heuristic ignores address-taken import thunks
</td>
</tr>
<tr>
<th>Product</th>
<td>lld
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Windows NT
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>COFF
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>rnk@google.com
</td>
</tr>
<tr>
<th>CC</th>
<td>alex.gaynor@gmail.com, amccarth@google.com, hans@chromium.org, llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>We use relocation scanning as a heuristic for computing the set of
address-taken things. We only want to add functions to the table, and we try to
do that like this:
// Given a symbol, add it to the GFIDs table if it is a live, defined, function
// symbol in an executable section.
static void maybeAddAddressTakenFunction(SymbolRVASet &AddressTakenSyms,
Symbol *S) {
auto *D = dyn_cast_or_null<DefinedCOFF>(S);
// Ignore undefined symbols and references to non-functions (e.g. globals and
// labels).
if (!D ||
D->getCOFFSymbol().getComplexType() != COFF::IMAGE_SYM_DTYPE_FUNCTION)
return;
// Mark the symbol as address taken if it's in an executable section.
Chunk *RefChunk = D->getChunk();
OutputSection *OS = RefChunk ? RefChunk->getOutputSection() : nullptr;
if (OS && OS->Header.Characteristics & IMAGE_SCN_MEM_EXECUTE)
addSymbolToRVASet(AddressTakenSyms, D);
}
However, not all function symbols are DefinedCOFF symbols. In particular,
DefinedImportThunk is a good example. Here's how to get one that we miss:
// t.c
int g(void);
void *f(void) { return (void *)&g; }
// a.c
int __declspec(dllexport) g(void) { return 42; }
// lcfg.s
.section .rdata,"dr"
.globl _load_config_used
_load_config_used:
.long 256
.fill 124, 1, 0
.quad __guard_fids_table
.quad __guard_fids_count
.long __guard_flags
.fill 128, 1, 0
$ cl -LD a.c # make a.dll and a.lib
$ cl -c t.c
$ clang -c lcfg.s -o lcfg.obj # get a _load_config_used struct without CRT
$ link t.obj lcfg.obj -export:f a.lib -nodefaultlib -noentry -dll -out:t.dll
-guard:cf
$ llvm-readobj
-coff-load-config t.dll
link.exe makes a two entry table for gfids:
GuardFidTable [
0x180001000 flags 2
0x180001010
]
LLD doesn't include the 'g' import thunk.
We might want to rewrite this code to use a fully covered switch instead of a
dyn_cast so we don't gloss over any cases.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>