llvm-project

shylie/llvm-project

Fork 0

Commit Graph

Author	SHA1	Message	Date
Markus Böck	78c033b541	[sanitizers][windows] Correctly override functions with backward jmps To reproduce: Download and run the latest Firefox ASAN build (https://firefox-ci-tc.services.mozilla.com/api/index/v1/task/gecko.v2.mozilla-central.latest.firefox.win64-asan-opt/artifacts/public/build/target.zip) on Windows 11 (version 10.0.22621 Build 22621); it will crash on launch. Note that this doesn't seem to crash on another Windows 11 VM I've tried, so I'm not sure how reproducible it is across machines, but it reproduces on my machine every time. The problem seems to be that when overriding the memset function in OverrideFunctionWithRedirectJump(), the relative_offset is stored as a uptr. Per the Intel x64 instruction set reference (https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf - warning: large PDF), on page 646 the jmp instruction (specifically the near jump flavors that start with E9, which are the ones the OverrideFunctionWithRedirectJump() considers) treats the offset as a signed displacement. This causes an incorrect value to be stored for REAL(memset) which points to uninitialized memory, and a crash the next time that gets called. The fix is to simply treat that offset as signed. I have also added a test case. Fixes https://github.com/llvm/llvm-project/issues/58846 Differential Revision: https://reviews.llvm.org/D137788	2022-12-12 11:45:43 +01:00
Toshihito Kikuchi	22ea0cea59	[compiler-rt] [windows] Add more assembly patterns for interception To intercept the functions in Win11's ntdll.dll, we need to use the trampoline technique because there are bytes other than 0x90 or 0xcc in the gaps between exported functions. This patch adds more patterns that appear in ntdll's functions. Bug: https://bugs.llvm.org/show_bug.cgi?id=51721 Reviewed By: rnk Differential Revision: https://reviews.llvm.org/D109941	2021-09-21 15:51:58 -07:00
Nico Weber	9642e337eb	compiler-rt: Rename .cc file in lib/{interception/tests,safestack} to .cpp Like r367463, but for interception/tests and safestack. llvm-svn: 367560	2019-08-01 13:56:52 +00:00

Author

SHA1

Message

Date

Markus Böck

78c033b541

[sanitizers][windows] Correctly override functions with backward jmps

To reproduce: Download and run the latest Firefox ASAN build (https://firefox-ci-tc.services.mozilla.com/api/index/v1/task/gecko.v2.mozilla-central.latest.firefox.win64-asan-opt/artifacts/public/build/target.zip) on Windows 11 (version 10.0.22621 Build 22621); it will crash on launch. Note that this doesn't seem to crash on another Windows 11 VM I've tried, so I'm not sure how reproducible it is across machines, but it reproduces on my machine every time.

The problem seems to be that when overriding the memset function in OverrideFunctionWithRedirectJump(), the relative_offset is stored as a uptr. Per the Intel x64 instruction set reference (https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf - warning: large PDF), on page 646 the jmp instruction (specifically the near jump flavors that start with E9, which are the ones the OverrideFunctionWithRedirectJump() considers) treats the offset as a signed displacement. This causes an incorrect value to be stored for REAL(memset) which points to uninitialized memory, and a crash the next time that gets called.

The fix is to simply treat that offset as signed. I have also added a test case.

Fixes https://github.com/llvm/llvm-project/issues/58846

Differential Revision: https://reviews.llvm.org/D137788

2022-12-12 11:45:43 +01:00

Toshihito Kikuchi

22ea0cea59

[compiler-rt] [windows] Add more assembly patterns for interception

To intercept the functions in Win11's ntdll.dll, we need to use the trampoline
technique because there are bytes other than 0x90 or 0xcc in the gaps between
exported functions.  This patch adds more patterns that appear in ntdll's
functions.

Bug: https://bugs.llvm.org/show_bug.cgi?id=51721

Reviewed By: rnk

Differential Revision: https://reviews.llvm.org/D109941

2021-09-21 15:51:58 -07:00

Nico Weber

9642e337eb

compiler-rt: Rename .cc file in lib/{interception/tests,safestack} to .cpp

Like r367463, but for interception/tests and safestack.

llvm-svn: 367560

2019-08-01 13:56:52 +00:00

3 Commits