Messages in this thread | | | Date | Mon, 28 Mar 2022 13:54:26 +0200 | From | Peter Zijlstra <> | Subject | Re: clang memcpy calls |
| |
On Mon, Mar 28, 2022 at 12:20:39PM +0200, Jakub Jelinek wrote: > On Mon, Mar 28, 2022 at 10:52:54AM +0100, Mark Rutland wrote: > > I think we're talking past each other here, so let me be more precise. :) > > > > The key thing is that when the user passes `-fsantize=address`, instrumentation > > is added by (a part of) the compiler. That instrumentation is added under some > > assumptions as to how the compiler as a whole will behave. > > > > With that in mind, the question is how is __attribute__((no_sanitize_address)) > > intended to work when considering all the usual expectations around how the > > compiler can play with memcpy and similar? > > no_sanitize_address or lack thereof is whether the current function > shouldn't be or should be ASan instrumented, not on whether other functions > it calls are instrumented or not. memcpy/memmove/memset are just a tiny bit > special case because the compiler can add them on their own even if they > aren't present in the source (there are a few others the compiler can > pattern match too) and various builtins can be on the other side expanded > inline instead of called, so one then gets the sanitization status of the > function in which it is used rather than whether the out of line > implementation of the function is sanitized. > > If coexistence of instrumented and non-instrumented memcpy etc. was the goal > (it clearly wasn't), then the sanitizer libraries wouldn't be overriding > memcpy calls, but instead the compiler would redirect calls to memcpy in > instrumented functions to say __asan_memcpy which then would be > instrumented.
This then leaves us holding the pieces because this behaviour is actively wrong.
A non-instrumented function *MUST*NOT* call an instrumented function, ever. This very much violates how we use/expect __attribute__((no_sanitize_address)) to work.
If we use that on a function, we expect/rely on that function (nor any compiler tranformation thereof) to *NOT* have instrumentation. This is a hard correctness requirement that cannot be argued with.
So there's two options:
A) compiler generates implicit mem*() calls with the knowledge that mem*() is not instrumentet, and as such will also emit instrumentation for it when so required (or calls mem*_asan() like functions.
B) compiler knows mem*() are instrumented, at which point the implicit mem*() calls are no longer equivalent under __attribute__((no_sanitize_address)) and will no longer perform these substitutions.
At some point this becomes a choice between being able to boot or having KASAN, choice is simple.
| |