[PATCH] D67122: [UBSan][clang][compiler-rt] Applying non-zero offset to nullptr is undefined behaviour

[Roman Lebedev via Phabricator via cfe-commits]

lebedev.ri created this revision.
lebedev.ri added reviewers: vsk, filcab, rsmith, aaron.ballman, vitalybuka, rjmccall, Sanitizers.
lebedev.ri added projects: clang, Sanitizers.
Herald added subscribers: arphaman, dberris.
Herald added a project: LLVM.

Quote from http://eel.is/c++draft/expr.add#4:

  4     When an expression J that has integral type is added to or subtracted
        from an expression P of pointer type, the result has the type of P.
  (4.1) If P evaluates to a null pointer value and J evaluates to 0,
        the result is a null pointer value.
  (4.2) Otherwise, if P points to an array element i of an array object x with n
        elements ([dcl.array]), the expressions P + J and J + P
        (where J has the value j) point to the (possibly-hypothetical) array
        element i+j of x if 0≤i+j≤n and the expression P - J points to the 
        (possibly-hypothetical) array element i−j of x if 0≤i−j≤n.
  (4.3) Otherwise, the behavior is undefined.

Therefore, as per the standard, applying non-zero offset to `nullptr`
(or making non-`nullptr` a `nullptr`, by subtracting pointer's integral value
from the pointer itself) is undefined behavior. (*if* `nullptr` is not defined,
i.e. e.g. `-fno-delete-null-pointer-checks` was *not* specified.)

Since rL369789 <https://reviews.llvm.org/rL369789> (D66608 <https://reviews.llvm.org/D66608> `[InstCombine] icmp eq/ne (gep inbounds P, Idx..), null -> icmp eq/ne P, null`)
LLVM middle-end uses those guarantees for transformations.
If the source contains such UB's, said code may now be miscompiled.
Such miscompilations were already observed:

- https://lists.llvm.org/pipermail/llvm-commits/Week-of-Mon-20190826/687838.html
- https://github.com/google/filament/pull/1566

Surprizingly, UBSan does not catch those issues
... until now. This diff teaches UBSan about these UB's.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D67122

Files:
  clang/docs/ReleaseNotes.rst
  clang/docs/UndefinedBehaviorSanitizer.rst
  clang/include/clang/Basic/Sanitizers.def
  clang/lib/CodeGen/CGExprScalar.cpp
  clang/lib/CodeGen/CodeGenFunction.h
  clang/test/CodeGen/catch-nullptr-and-nonzero-offset-blacklist.c
  clang/test/CodeGen/catch-nullptr-and-nonzero-offset.c
  clang/test/CodeGen/catch-pointer-offsetting.c
  clang/test/CodeGen/catch-pointer-overflow.c
  clang/test/Driver/fsanitize.c
  compiler-rt/lib/ubsan/ubsan_checks.inc
  compiler-rt/lib/ubsan/ubsan_handlers.cpp
  compiler-rt/test/ubsan/TestCases/Pointer/index-overflow.cpp
  compiler-rt/test/ubsan/TestCases/Pointer/nullptr-and-nonzero-offset-constants.cpp
  compiler-rt/test/ubsan/TestCases/Pointer/nullptr-and-nonzero-offset-summary.cpp
  compiler-rt/test/ubsan/TestCases/Pointer/nullptr-and-nonzero-offset-variable.cpp
  compiler-rt/test/ubsan/TestCases/Pointer/unsigned-index-expression.cpp
  compiler-rt/test/ubsan_minimal/TestCases/nullptr-and-nonzero-offset.c
  llvm/docs/ReleaseNotes.rst

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D67122.218504.patch
Type: text/x-patch
Size: 79579 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20190903/b9d0c393/attachment-0001.bin>