[clang] [BoundsSafety][NFC] Specify taking address of a variable referred to by '__counted_by' is forbidden (PR #106147)
via cfe-commits
cfe-commits at lists.llvm.org
Mon Aug 26 14:40:29 PDT 2024
llvmbot wrote:
<!--LLVM PR SUMMARY COMMENT-->
@llvm/pr-subscribers-clang
Author: Yeoul Na (rapidsna)
<details>
<summary>Changes</summary>
`-fbounds-safety` doesn't allow taking address of a variable referred to by `__counted_by`, in order to prevent code from using the pointer to update the variable without necessary checks to keep the invariant of `__counted_by`.
As shown in the example below, with -fbounds-safety the compiler ensures that the `__counted_by` pointer/or array has at least as many as elements that the attribute indicates, by requiring the count and the buf are always updated side by side and emitting run-time checks to ensure the new values are valid.
```
struct counted_buf {
sized_t count;
int *__counted_by(count) buf;
};
// BEFORE FIX
void foo(struct counted_buf *p) {
p->count = 10; // error: assignment to 'count' requires corresponding assignment to 'int *__counted_by(count) buf')
}
// FIXED by adding assignment to `p->buf`
void foo(struct counted_buf *p) {
// The compiler is now happy because
p->buf = (int *)malloc(sizeof(int) *5); // run-time checks are emitted to make sure new buf has at least `10` elements.
p->count = 10;
}
```
Consequently, `-fbounds-safety` prevents taking address of a variable referred to by `__counted_by`, because otherwise, the compiler cannot check the updates through the pointer pointing to the count:
```
void foo(struct counted_buf *p) {
int *count_p = &p->count; // error: variable referred to by '__counted_by' cannot be pointed to by any other variable
*count_p = 10; // without the above error, `count_p` is a normal `int *` so the compiler cannot check the value it updates against `__counted_by`
}
```
This PR is to explicitly specify this restriction and avoid future conflicts.
---
Full diff: https://github.com/llvm/llvm-project/pull/106147.diff
1 Files Affected:
- (modified) clang/docs/BoundsSafety.rst (+18-1)
``````````diff
diff --git a/clang/docs/BoundsSafety.rst b/clang/docs/BoundsSafety.rst
index 8fd655663edb00..e4ddd3c62db65d 100644
--- a/clang/docs/BoundsSafety.rst
+++ b/clang/docs/BoundsSafety.rst
@@ -759,7 +759,24 @@ relationship must hold even after any of these related variables are updated. To
this end, the model requires that assignments to ``buf`` and ``count`` must be
side by side, with no side effects between them. This prevents ``buf`` and
``count`` from temporarily falling out of sync due to updates happening at a
-distance.
+distance. In addition, taking address of ``count`` is not allowed in order to
+prevent the programmers from updating the ``count`` through the pointer, which
+will evade the necessary checks to make ``count`` and ``buf`` in sync.
+
+.. code-block:: c
+
+ struct counted_buf {
+ int *__counted_by(count) buf;
+ size_t count;
+ };
+
+ void foo(struct counted_buf *p) {
+ int *pointer_to_count = &p->count; // error: variable referred to by
+ // '__counted_by' cannot be pointed to by any other variable; exception is
+ // when the pointer is passed as a compatible argument to a function.
+ *pointer_to_count = SIZE_MAX; // Without reporting the error above, the
+ // compiler cannot prevent count from getting an invalid value.
+ }
The example below shows a function ``alloc_buf`` that initializes a struct that
members that use the ``__counted_by`` annotation. The compiler allows these
``````````
</details>
https://github.com/llvm/llvm-project/pull/106147
More information about the cfe-commits
mailing list