<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;"><br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div id="divRpF652106" style="direction: ltr; "><font face="Tahoma" size="2" color="#000000"><b>From:</b> Kostya Serebryany [kcc@google.com]<br>
<b>Sent:</b> Wednesday, December 28, 2011 2:46 PM<br>
<b>To:</b> Criswell, John T<br>
<b>Cc:</b> llvmdev@cs.uiuc.edu<br>
<b>Subject:</b> Re: [LLVMdev] load widening conflicts with AddressSanitizer<br>
</font><br>
</div>
<div></div>
<div><br>
<br>
<div class="gmail_quote">On Wed, Dec 28, 2011 at 12:40 PM, Criswell, John T <span dir="ltr">
<<a href="mailto:criswell@illinois.edu" target="_blank">criswell@illinois.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>
<div style="direction:ltr; font-size:10pt; font-family:Tahoma">Dear All,
<div><br>
</div>
<div>I think adding metadata and expecting transforms to repect it is a bad idea. It is just too easy for someone who does not know about the metadata to add a transform that ignores it.</div>
<div><br>
</div>
<div>As for SAFECode, I think we have one of several options for handling load-widening. The most obvious one is to have a pass that just boosts the allocation size of any alloca with an align 16 attribute;
</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>This may lead to real bugs being lost (false negatives).</div>
<div><br>
</div>
<div>I believe it would remove memory unsafe behavior from the program (so the program is still functionally incorrect, but it would not violate memory safety, making memory safety attacks impossible).</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>
<div style="direction:ltr; font-size:10pt; font-family:Tahoma">
<div>this pass would only be scheduled to execute when the other SAFECode instrumentation passes are scheduled to execute. Another option would be to just disable the load-widening transform or to use a specialized version that only widens when the allocation
size does not cause a problem.</div>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>To disable load widening you need to pass some flag to the load widening phase. </div>
<div>Passing it through metadata is one of the possible solutions. </div>
<div><br>
</div>
<div>Or we can disable load widening from the clang driver, but then we will need a flag for that (do we have it now?)</div>
<div><br>
</div>
<div>If you have modified the clang driver with a -fasn option, then you could also modify the driver so that it does not run the load-widening pass when the -fasn option is given on the command-line.</div>
<div><br>
</div>
<div>This assumes, of course, that the load-widening transform is not part of some other transform (like instcombine). If it is part of another transform, it would be split out into its own transform (separation of concerns and all that).</div>
<div><br>
</div>
<div>-- John T.</div>
<div><br>
</div>
<div><br>
</div>
<div>--kcc </div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div>
<div style="direction:ltr; font-size:10pt; font-family:Tahoma">
<div><br>
</div>
<div>-- John T.</div>
<div><br>
<div style="font-size:16px; font-family:Times New Roman">
<hr>
<div style="direction:ltr"><font face="Tahoma" color="#000000"><b>From:</b> <a href="mailto:llvmdev-bounces@cs.uiuc.edu" target="_blank">
llvmdev-bounces@cs.uiuc.edu</a> [<a href="mailto:llvmdev-bounces@cs.uiuc.edu" target="_blank">llvmdev-bounces@cs.uiuc.edu</a>] on behalf of Kostya Serebryany [<a href="mailto:kcc@google.com" target="_blank">kcc@google.com</a>]<br>
<b>Sent:</b> Tuesday, December 27, 2011 12:57 PM<br>
<b>To:</b> Chris Lattner<br>
<b>Cc:</b> <a href="mailto:llvmdev@cs.uiuc.edu" target="_blank">llvmdev@cs.uiuc.edu</a><br>
<b>Subject:</b> Re: [LLVMdev] load widening conflicts with AddressSanitizer<br>
</font><br>
</div>
<div>
<div class="h5">
<div></div>
<div><br>
<br>
<div class="gmail_quote">On Mon, Dec 19, 2011 at 4:27 PM, Chris Lattner <span dir="ltr">
<<a href="mailto:clattner@apple.com" target="_blank">clattner@apple.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div><br>
On Dec 17, 2011, at 7:40 AM, Rafael Ávila de Espíndola wrote:<br>
<br>
> On 16/12/11 08:46 PM, Chris Lattner wrote:<br>
>> I'm not opposed to disabling this transformation when asan is on, we just need a clean way to express this in the IR.<br>
><br>
> Could clang be aware of asan being on and introduce a "please don't<br>
> widen" metadata on local variable accesses?<br>
<br>
</div>
Yes, "we just need a clean way to express this in the IR."<br>
<br>
LLVM can't have a global "bool ASANIsOn;" that the optimizers listen to.<br>
</blockquote>
<div><br>
</div>
<div><br>
</div>
<div>A global is bad.</div>
<div>What about a metadata attached to a Function saying that transformations which will read out of bounds (even "safely") are illegal? </div>
<div>asan and SAFEcode will add this metadata, optimizers will listen to it. </div>
<div><br>
</div>
<div>Any other suggestion? </div>
<div><br>
</div>
<div><br>
</div>
<div>--kcc </div>
<div> </div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>