[llvm-bugs] [Bug 35350] New: [CFI] Pointer-to-member-function calls are uninstrumented.

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=35350

            Bug ID: 35350
           Summary: [CFI] Pointer-to-member-function calls are
                    uninstrumented.
           Product: clang
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: LLVM Codegen
          Assignee: unassignedclangbugs at nondot.org
          Reporter: mitchphillips at outlook.com
                CC: llvm-bugs at lists.llvm.org

icalls made through the pointer-to-member-function operators (both operator.*
and operator->*) are uninstrumented by CFI, meaning that the virtual call is
unprotected.

As a conservative estimate, this bug is causing ~15% (2,608 individual
instructions) of total "unexpected unprotected" indirect control flow
instructions in the Chrome browser.

This problem is easily revealed by llvm-cfi-verify. See below for a minimised
testcase:

$ clang++ -flto -fsanitize=cfi -fvisibility=hidden -g a.cc
$ llvm-cfi-verify a.out
    U [FAIL_BAD_CONDITIONAL_BRANCH] 0x4005b5 |  callq *%rax 
      0x4005b5 = /tmp/a.cc:8:3 (main)
    Expected Protected: 0 (0.00%)
    Unexpected Protected: 0 (0.00%)
    Expected Unprotected: 0 (0.00%)
    Unexpected Unprotected (BAD): 1 (100.00%)

$ cat a.cc
struct A {
  virtual void f() {}
};

int main() {
  A a;
  void (A::* ptr)() = &A::f;
  (a.*ptr)();  // Unprotected by cfi.
}

$ objdump -d a.out
<..snip..>
  4005a3:       74 0d                   je     4005b2 <main+0x52>
  4005a5:       48 8b 0b                mov    (%rbx),%rcx
  4005a8:       48 83 e8 01             sub    $0x1,%rax
  4005ac:       48 8b 04 01             mov    (%rcx,%rax,1),%rax
  4005b0:       eb 00                   jmp    4005b2 <main+0x52>
  4005b2:       48 89 df                mov    %rbx,%rdi
  4005b5:       ff d0                   callq  *%rax
  4005b7:       8b 45 f4                mov    -0xc(%rbp),%eax
  4005ba:       48 83 c4 28             add    $0x28,%rsp
<..snip..>

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20171117/a03b2228/attachment.html>