[llvm] [GlobalISel] Fix null deref when target has no stack guard variable (PR #224252)
via llvm-commits
llvm-commits at lists.llvm.org
Fri Sep 25 05:16:23 PDT 2026
https://github.com/tfzee updated https://github.com/llvm/llvm-project/pull/224252
>From dd73780a7e2e966845dff88cef03fe387b3ec493 Mon Sep 17 00:00:00 2001
From: "Ziegler, Tim" <tim.ziegler at intel.com>
Date: Thu, 17 Sep 2026 11:36:02 +0200
Subject: [PATCH 1/7] Add nullptr check
---
llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
index c491a8812e697..4e1046f7539d5 100644
--- a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
+++ b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
@@ -4907,8 +4907,11 @@ bool IRTranslatorImpl::emitSPDescriptorParent(StackProtectorDescriptor &SPD,
} else {
// TODO: test using android subtarget when we support @llvm.thread.pointer.
const Value *IRGuard = TLI->getSDagStackGuard(M, *Libcalls);
+ if(!IRGuard) {
+ LLVM_DEBUG(dbgs() << "Failed to lower call to stack protector check\n");
+ return false;
+ }
Register GuardPtr = getOrCreateVReg(*IRGuard);
-
Guard = CurBuilder
->buildLoad(PtrMemTy, GuardPtr,
MachinePointerInfo::getFixedStack(*MF, FI), Align,
>From 2f5786759dcd24a386f765b88cf5873b854f2a12 Mon Sep 17 00:00:00 2001
From: "Ziegler, Tim" <tim.ziegler at intel.com>
Date: Thu, 17 Sep 2026 11:59:19 +0200
Subject: [PATCH 2/7] Clean unneeded edit
---
llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp | 1 +
1 file changed, 1 insertion(+)
diff --git a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
index 4e1046f7539d5..42cf2c8f700aa 100644
--- a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
+++ b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
@@ -4912,6 +4912,7 @@ bool IRTranslatorImpl::emitSPDescriptorParent(StackProtectorDescriptor &SPD,
return false;
}
Register GuardPtr = getOrCreateVReg(*IRGuard);
+
Guard = CurBuilder
->buildLoad(PtrMemTy, GuardPtr,
MachinePointerInfo::getFixedStack(*MF, FI), Align,
>From bbceeaf898427f709ddad2804d139a035f0eacbf Mon Sep 17 00:00:00 2001
From: "Ziegler, Tim" <tim.ziegler at intel.com>
Date: Thu, 17 Sep 2026 12:00:26 +0200
Subject: [PATCH 3/7] Fix formatting
---
llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
index 42cf2c8f700aa..52731edb366aa 100644
--- a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
+++ b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
@@ -4907,7 +4907,7 @@ bool IRTranslatorImpl::emitSPDescriptorParent(StackProtectorDescriptor &SPD,
} else {
// TODO: test using android subtarget when we support @llvm.thread.pointer.
const Value *IRGuard = TLI->getSDagStackGuard(M, *Libcalls);
- if(!IRGuard) {
+ if (!IRGuard) {
LLVM_DEBUG(dbgs() << "Failed to lower call to stack protector check\n");
return false;
}
>From a41568cc6f35da8af03a64916379dd3312eae893 Mon Sep 17 00:00:00 2001
From: "Ziegler, Tim" <tim.ziegler at intel.com>
Date: Thu, 17 Sep 2026 15:55:55 +0200
Subject: [PATCH 4/7] Added spirv test
---
llvm/test/CodeGen/SPIRV/stack-protector.ll | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
create mode 100644 llvm/test/CodeGen/SPIRV/stack-protector.ll
diff --git a/llvm/test/CodeGen/SPIRV/stack-protector.ll b/llvm/test/CodeGen/SPIRV/stack-protector.ll
new file mode 100644
index 0000000000000..1b35cad3248cd
--- /dev/null
+++ b/llvm/test/CodeGen/SPIRV/stack-protector.ll
@@ -0,0 +1,17 @@
+; RUN: not --crash llc -mtriple=spirv64-unknown-unknown -filetype=null %s 2>&1 | FileCheck %s
+; RUN: not --crash llc -mtriple=spirv32-unknown-unknown -filetype=null %s 2>&1 | FileCheck %s
+
+; SPIRV has no STACK_CHECK_GUARD libcall impl, so getSDagStackGuard() returns
+; nullptr. The stack protector check must report a failure to translate instead
+; of dereferencing the null guard value.
+
+; CHECK: error: unable to lower stackguard
+; CHECK: LLVM ERROR: unable to translate basic block
+
+define void @func() sspreq nounwind {
+ %alloca = alloca i32, align 4
+ call void @capture(ptr %alloca)
+ ret void
+}
+
+declare void @capture(ptr)
>From 4875c012bf0295c106a25090156c35631838b741 Mon Sep 17 00:00:00 2001
From: "Ziegler, Tim" <tim.ziegler at intel.com>
Date: Fri, 18 Sep 2026 10:59:48 +0200
Subject: [PATCH 5/7] Change to fatal error
---
llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
index 52731edb366aa..84a73a0f4dd76 100644
--- a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
+++ b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
@@ -4907,10 +4907,9 @@ bool IRTranslatorImpl::emitSPDescriptorParent(StackProtectorDescriptor &SPD,
} else {
// TODO: test using android subtarget when we support @llvm.thread.pointer.
const Value *IRGuard = TLI->getSDagStackGuard(M, *Libcalls);
- if (!IRGuard) {
- LLVM_DEBUG(dbgs() << "Failed to lower call to stack protector check\n");
- return false;
- }
+ if (!IRGuard)
+ reportFatalUsageError("unable to lower stackguard for this backend");
+
Register GuardPtr = getOrCreateVReg(*IRGuard);
Guard = CurBuilder
>From c4a1b3b5ba8f3d9b36788b6daf4a938654e18630 Mon Sep 17 00:00:00 2001
From: "Ziegler, Tim" <tim.ziegler at intel.com>
Date: Fri, 18 Sep 2026 11:00:13 +0200
Subject: [PATCH 6/7] Update test
---
llvm/test/CodeGen/SPIRV/stack-protector.ll | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/llvm/test/CodeGen/SPIRV/stack-protector.ll b/llvm/test/CodeGen/SPIRV/stack-protector.ll
index 1b35cad3248cd..dab5f8d230928 100644
--- a/llvm/test/CodeGen/SPIRV/stack-protector.ll
+++ b/llvm/test/CodeGen/SPIRV/stack-protector.ll
@@ -1,12 +1,11 @@
-; RUN: not --crash llc -mtriple=spirv64-unknown-unknown -filetype=null %s 2>&1 | FileCheck %s
-; RUN: not --crash llc -mtriple=spirv32-unknown-unknown -filetype=null %s 2>&1 | FileCheck %s
+; RUN: not llc -mtriple=spirv64-unknown-unknown -filetype=null %s 2>&1 | FileCheck %s
; SPIRV has no STACK_CHECK_GUARD libcall impl, so getSDagStackGuard() returns
-; nullptr. The stack protector check must report a failure to translate instead
-; of dereferencing the null guard value.
+; nullptr. The stack protector check must report an error instead of
+; dereferencing the null guard value.
; CHECK: error: unable to lower stackguard
-; CHECK: LLVM ERROR: unable to translate basic block
+; CHECK: LLVM ERROR: unable to lower stackguard for this backend
define void @func() sspreq nounwind {
%alloca = alloca i32, align 4
>From 033a12a5b9d8d88cce20e04110466304eff1d078 Mon Sep 17 00:00:00 2001
From: "Ziegler, Tim" <tim.ziegler at intel.com>
Date: Fri, 25 Sep 2026 14:16:01 +0200
Subject: [PATCH 7/7] Replace hard crash with undef reg
---
llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp | 25 +++++++++++---------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
index 84a73a0f4dd76..3626998c77f12 100644
--- a/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
+++ b/llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp
@@ -4907,17 +4907,20 @@ bool IRTranslatorImpl::emitSPDescriptorParent(StackProtectorDescriptor &SPD,
} else {
// TODO: test using android subtarget when we support @llvm.thread.pointer.
const Value *IRGuard = TLI->getSDagStackGuard(M, *Libcalls);
- if (!IRGuard)
- reportFatalUsageError("unable to lower stackguard for this backend");
-
- Register GuardPtr = getOrCreateVReg(*IRGuard);
-
- Guard = CurBuilder
- ->buildLoad(PtrMemTy, GuardPtr,
- MachinePointerInfo::getFixedStack(*MF, FI), Align,
- MachineMemOperand::MOLoad |
- MachineMemOperand::MOVolatile)
- .getReg(0);
+ if (IRGuard) {
+ Register GuardPtr = getOrCreateVReg(*IRGuard);
+
+ Guard = CurBuilder
+ ->buildLoad(PtrMemTy, GuardPtr,
+ MachinePointerInfo::getFixedStack(*MF, FI), Align,
+ MachineMemOperand::MOLoad |
+ MachineMemOperand::MOVolatile)
+ .getReg(0);
+ } else {
+ LLVMContext &Ctx = CurBuilder->getContext();
+ Ctx.diagnose(DiagnosticInfoGeneric("unable to lower stackguard"));
+ Guard = CurBuilder->buildUndef(PtrMemTy).getReg(0);
+ }
}
// Perform the comparison.
More information about the llvm-commits
mailing list