[PATCH] D132634: [AArch64 SelectionDAG] Add index check before lowerInterleavedStore() uses ShuffleVectorInst's mask

[Peter Rong via Phabricator via llvm-commits]

Peter created this revision.
Herald added subscribers: arphaman, hiraditya, kristof.beyls.
Herald added a project: All.
Peter requested review of this revision.
Herald added a project: LLVM.
Herald added a subscriber: llvm-commits.

This commit fixes https://github.com/llvm/llvm-project/issues/57326.

Currently we would take a Mask out and directly use it by doing `auto Mask = SVI->getShuffleMask();`
However, if the mask is `undef`, this Mask is not initialized. It might be a vector of -1 or random integers.
This would cause an Out-of-bound read laterwhen trying to find a `StartMask`.

This change checks if all indices in the `Mask` is in the allowed range. If not, we would early abort.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D132634

Files:
  llvm/lib/Target/AArch64/AArch64ISelLowering.cpp
  llvm/test/CodeGen/AArch64/aarch64-shuffle-undef.ll


Index: llvm/test/CodeGen/AArch64/aarch64-shuffle-undef.ll
===================================================================
--- /dev/null
+++ llvm/test/CodeGen/AArch64/aarch64-shuffle-undef.ll
@@ -0,0 +1,27 @@
+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc -mtriple=aarch64-linux-gnu < %s | FileCheck %s
+
+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
+target triple = "aarch64-unknown-linux-gnu"
+
+define void @f() {
+; CHECK-LABEL: f:
+; CHECK:       // %bb.0: // %BB
+; CHECK-NEXT:    stp x29, x30, [sp, #-16]! // 16-byte Folded Spill
+; CHECK-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-NEXT:    mov x29, sp
+; CHECK-NEXT:    .cfi_def_cfa w29, 16
+; CHECK-NEXT:    .cfi_offset w30, -8
+; CHECK-NEXT:    .cfi_offset w29, -16
+; CHECK-NEXT:    sub x9, sp, #112
+; CHECK-NEXT:    and sp, x9, #0xffffffffffffffc0
+; CHECK-NEXT:    mov sp, x29
+; CHECK-NEXT:    ldp x29, x30, [sp], #16 // 16-byte Folded Reload
+; CHECK-NEXT:    ret
+BB:
+  %A2 = alloca <32 x i16>, align 64
+  %B = urem <32 x i16> <i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1>, <i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1>
+  %S = shufflevector <32 x i16> %B, <32 x i16> %B, <32 x i32> undef
+  store <32 x i16> %S, <32 x i16>* %A2, align 64
+  ret void
+}
Index: llvm/lib/Target/AArch64/AArch64ISelLowering.cpp
===================================================================
--- llvm/lib/Target/AArch64/AArch64ISelLowering.cpp
+++ llvm/lib/Target/AArch64/AArch64ISelLowering.cpp
@@ -13363,6 +13363,15 @@
 
   auto Mask = SVI->getShuffleMask();
 
+  // Sanity check if all the indices are in range.
+  // If mask is `undef`, `Mask` may contain uninitialized integers and cause OOB
+  // later.
+  for (unsigned Idx : Mask) {
+    if (Idx >= VecTy->getNumElements() * 2) {
+      return false;
+    }
+  }
+
   Type *PtrTy =
       UseScalable
           ? STVTy->getElementType()->getPointerTo(SI->getPointerAddressSpace())


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D132634.455476.patch
Type: text/x-patch
Size: 2391 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20220825/ed218e39/attachment.bin>