[llvm-bugs] [Bug 39799] New: LLD's /GUARD:CF relocation scanning heuristic ignores address-taken import thunks

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=39799

            Bug ID: 39799
           Summary: LLD's /GUARD:CF relocation scanning heuristic ignores
                    address-taken import thunks
           Product: lld
           Version: unspecified
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: COFF
          Assignee: unassignedbugs at nondot.org
          Reporter: rnk at google.com
                CC: alex.gaynor at gmail.com, amccarth at google.com,
                    hans at chromium.org, llvm-bugs at lists.llvm.org

We use relocation scanning as a heuristic for computing the set of
address-taken things. We only want to add functions to the table, and we try to
do that like this:

// Given a symbol, add it to the GFIDs table if it is a live, defined, function
// symbol in an executable section.
static void maybeAddAddressTakenFunction(SymbolRVASet &AddressTakenSyms,
                                         Symbol *S) {
  auto *D = dyn_cast_or_null<DefinedCOFF>(S);

  // Ignore undefined symbols and references to non-functions (e.g. globals and
  // labels).
  if (!D ||
      D->getCOFFSymbol().getComplexType() != COFF::IMAGE_SYM_DTYPE_FUNCTION)
    return;

  // Mark the symbol as address taken if it's in an executable section.
  Chunk *RefChunk = D->getChunk();
  OutputSection *OS = RefChunk ? RefChunk->getOutputSection() : nullptr;
  if (OS && OS->Header.Characteristics & IMAGE_SCN_MEM_EXECUTE)
    addSymbolToRVASet(AddressTakenSyms, D);
}

However, not all function symbols are DefinedCOFF symbols. In particular,
DefinedImportThunk is a good example. Here's how to get one that we miss:

// t.c
int g(void);
void *f(void) { return (void *)&g; }

// a.c
int __declspec(dllexport) g(void) { return 42; }

// lcfg.s
        .section .rdata,"dr"
.globl _load_config_used
_load_config_used:
        .long 256
        .fill 124, 1, 0
        .quad __guard_fids_table
        .quad __guard_fids_count
        .long __guard_flags
        .fill 128, 1, 0

$ cl -LD a.c # make a.dll and a.lib
$ cl -c t.c
$ clang -c lcfg.s -o lcfg.obj # get a _load_config_used struct without CRT
$ link t.obj lcfg.obj -export:f a.lib -nodefaultlib -noentry -dll -out:t.dll
-guard:cf
$ llvm-readobj
-coff-load-config t.dll

link.exe makes a two entry table for gfids:

GuardFidTable [
  0x180001000 flags 2
  0x180001010
]

LLD doesn't include the 'g' import thunk.

We might want to rewrite this code to use a fully covered switch instead of a
dyn_cast so we don't gloss over any cases.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20181127/1b2033bc/attachment.html>