[PATCH] D119296: KCFI sanitizer
Peter Collingbourne via Phabricator via cfe-commits
cfe-commits at lists.llvm.org
Tue Feb 8 16:05:20 PST 2022
pcc added inline comments.
Comment at: clang/lib/CodeGen/CGExpr.cpp:3168
+ llvm::Value *Test = Builder.CreateICmpEQ(Builder.CreateLoad(HashPtr), Hash);
+ llvm::BasicBlock *ContBB = createBasicBlock("kcfi.cont");
We considered a scheme like this before and one problem that we discovered with comparing the hash in this way is that it can produce gadgets, e.g.
movabs $0x0123456789abcdef, %rax
cmp %rax, ...
the `cmp`instruction ends up being a valid target address because the `movabs` instruction ends in the hash. The way we thought about solving this was to introduce a new intrinsic that would materialize the constant without these gadgets (e.g. invert the `movabs` operand and follow it by a `not`).
rG LLVM Github Monorepo
CHANGES SINCE LAST ACTION
More information about the cfe-commits