[llvm-bugs] [Bug 46990] New: [coroutines] Use-after-free by access to coroutine frame after await_suspend()

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=46990

            Bug ID: 46990
           Summary: [coroutines] Use-after-free by access to coroutine
                    frame after await_suspend()
           Product: clang
           Version: 11.0
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: C2x
          Assignee: unassignedclangbugs at nondot.org
          Reporter: alexander.vandergrinten at gmail.com
                CC: blitzrakete at gmail.com, erik.pilkington at gmail.com,
                    llvm-bugs at lists.llvm.org, richard-llvm at metafoo.co.uk

Created attachment 23813
  --> https://bugs.llvm.org/attachment.cgi?id=23813&action=edit
Preprocessed source code

With some optimization options (-O2 and -fsanitize=undefined in this case),
LLVM generates instructions that access coroutine frames after calling
await_suspend() but before returning to the caller/resumer of a coroutine. This
leads to use-after-free if the coroutine is freed before control returns to the
caller. Below is a snippet of LLVM code that demonstrates this; the GEP
instructions cause a bogus access.

The preprocessed source is attached (but unfortunately, I was unable to reduce
the bug to a toy example). Compile with:
clang++ -std=c++20 -O2 -fsanitize=undefined -S -emit-llvm -o out.S out.cpp

This bug happens both with Clang 10.0.1 and 11.0.0-rc1.

Relevant LLVM code:
-------------------
  invoke void
@_ZN5async14sender_awaiterIN4thor18CopyFromViewSenderEvE13await_suspendENSt12experimental16coroutine_handleIvEE(%"struct.async::sender_awaiter.44"*
nonnull %31, i8* nonnull %2)
          to label %725 unwind label %745

725:                                              ; preds = %723
  %726 = getelementptr inbounds
%_ZN4thor15loadModuleImageEN7smarter10shared_ptrINS_12AddressSpaceE14BindableHandleEEmN5frigg9SharedPtrINS_10MemoryViewENS5_13SharedControlEEE.Frame,
%_ZN4thor15loadModuleImageEN7smarter10shared_ptrINS_12AddressSpaceE14BindableHandleEEmN5frigg9SharedPtrINS_10MemoryViewENS5_13SharedControlEEE.Frame*
%0, i64 0, i32 32
  %727 = getelementptr inbounds
%_ZN4thor15loadModuleImageEN7smarter10shared_ptrINS_12AddressSpaceE14BindableHandleEEmN5frigg9SharedPtrINS_10MemoryViewENS5_13SharedControlEEE.Frame,
%_ZN4thor15loadModuleImageEN7smarter10shared_ptrINS_12AddressSpaceE14BindableHandleEEmN5frigg9SharedPtrINS_10MemoryViewENS5_13SharedControlEEE.Frame*
%0, i64 0, i32 31
  br label %856

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200804/d8a6e096/attachment.html>