Skip to content

Commit e36a30e

Browse files
andreafioraldiandreafioraldi
committed
AFL_G2h default to g2h_untagged as workaround
1 parent 3e13e0e commit e36a30e

File tree

5 files changed

+39
-36
lines changed

5 files changed

+39
-36
lines changed

‎accel/tcg/cpu-exec.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ static void collect_memory_snapshot(void) {
209209

210210
int flags = page_get_flags(h2g(min));
211211

212-
max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX) + 1;
212+
max = h2g_valid(max - 1) ? max : (uintptr_t)AFL_G2H(GUEST_ADDR_MAX) + 1;
213213
if (page_check_range(h2g(min), max - min, flags) == -1)
214214
continue;
215215

@@ -436,7 +436,7 @@ void afl_setup(void) {
436436

437437
int flags = page_get_flags(h2g(min));
438438

439-
max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX) + 1;
439+
max = h2g_valid(max - 1) ? max : (uintptr_t)AFL_G2H(GUEST_ADDR_MAX) + 1;
440440
if (page_check_range(h2g(min), max - min, flags) == -1)
441441
continue;
442442

‎accel/tcg/tcg-runtime.c

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -206,18 +206,18 @@ void HELPER(afl_cmplog_rtn)(CPUArchState *env) {
206206

207207
#if defined(TARGET_X86_64)
208208

209-
void *ptr1 = g2h(env->regs[R_EDI]);
210-
void *ptr2 = g2h(env->regs[R_ESI]);
209+
void *ptr1 = AFL_G2H(env->regs[R_EDI]);
210+
void *ptr2 = AFL_G2H(env->regs[R_ESI]);
211211

212212
#elif defined(TARGET_I386)
213213

214-
target_ulong *stack = g2h(env->regs[R_ESP]);
214+
target_ulong *stack = AFL_G2H(env->regs[R_ESP]);
215215

216216
if (!area_is_mapped(stack, sizeof(target_ulong) * 2)) return;
217217

218218
// when this hook is executed, the retaddr is not on stack yet
219-
void * ptr1 = g2h(stack[0]);
220-
void * ptr2 = g2h(stack[1]);
219+
void * ptr1 = AFL_G2H(stack[0]);
220+
void * ptr2 = AFL_G2H(stack[1]);
221221

222222
#else
223223

@@ -531,7 +531,7 @@ char* asan_giovese_printaddr(target_ulong guest_addr) {
531531
if (h2g_valid(min)) {
532532

533533
int flags = page_get_flags(h2g(min));
534-
max = h2g_valid(max - 1) ? max : (uintptr_t)g2h(GUEST_ADDR_MAX) + 1;
534+
max = h2g_valid(max - 1) ? max : (uintptr_t)AFL_G2H(GUEST_ADDR_MAX) + 1;
535535
if (page_check_range(h2g(min), max - min, flags) == -1)
536536
continue;
537537

@@ -716,27 +716,27 @@ target_long qasan_actions_dispatcher(void *cpu_env,
716716
}
717717
#else
718718
case QASAN_ACTION_CHECK_LOAD:
719-
__asan_loadN(g2h(arg1), arg2);
719+
__asan_loadN(AFL_G2H(arg1), arg2);
720720
break;
721721

722722
case QASAN_ACTION_CHECK_STORE:
723-
__asan_storeN(g2h(arg1), arg2);
723+
__asan_storeN(AFL_G2H(arg1), arg2);
724724
break;
725725

726726
case QASAN_ACTION_POISON:
727-
__asan_poison_memory_region(g2h(arg1), arg2);
727+
__asan_poison_memory_region(AFL_G2H(arg1), arg2);
728728
break;
729729

730730
case QASAN_ACTION_USER_POISON:
731-
__asan_poison_memory_region(g2h(arg1), arg2);
731+
__asan_poison_memory_region(AFL_G2H(arg1), arg2);
732732
break;
733733

734734
case QASAN_ACTION_UNPOISON:
735-
__asan_unpoison_memory_region(g2h(arg1), arg2);
735+
__asan_unpoison_memory_region(AFL_G2H(arg1), arg2);
736736
break;
737737

738738
case QASAN_ACTION_IS_POISON:
739-
return __asan_region_is_poisoned(g2h(arg1), arg2) != NULL;
739+
return __asan_region_is_poisoned(AFL_G2H(arg1), arg2) != NULL;
740740

741741
case QASAN_ACTION_ALLOC:
742742
break;
@@ -779,7 +779,7 @@ void HELPER(qasan_load1)(CPUArchState *env, target_ulong addr) {
779779

780780
if (qasan_disabled) return;
781781

782-
void* ptr = (void*)g2h(addr);
782+
void* ptr = (void*)AFL_G2H(addr);
783783

784784
#ifdef ASAN_GIOVESE
785785
if (asan_giovese_load1(ptr)) {
@@ -795,7 +795,7 @@ void HELPER(qasan_load2)(CPUArchState *env, target_ulong addr) {
795795

796796
if (qasan_disabled) return;
797797

798-
void* ptr = (void*)g2h(addr);
798+
void* ptr = (void*)AFL_G2H(addr);
799799

800800
#ifdef ASAN_GIOVESE
801801
if (asan_giovese_load2(ptr)) {
@@ -811,7 +811,7 @@ void HELPER(qasan_load4)(CPUArchState *env, target_ulong addr) {
811811

812812
if (qasan_disabled) return;
813813

814-
void* ptr = (void*)g2h(addr);
814+
void* ptr = (void*)AFL_G2H(addr);
815815

816816
#ifdef ASAN_GIOVESE
817817
if (asan_giovese_load4(ptr)) {
@@ -827,7 +827,7 @@ void HELPER(qasan_load8)(CPUArchState *env, target_ulong addr) {
827827

828828
if (qasan_disabled) return;
829829

830-
void* ptr = (void*)g2h(addr);
830+
void* ptr = (void*)AFL_G2H(addr);
831831

832832
#ifdef ASAN_GIOVESE
833833
if (asan_giovese_load8(ptr)) {
@@ -843,7 +843,7 @@ void HELPER(qasan_store1)(CPUArchState *env, target_ulong addr) {
843843

844844
if (qasan_disabled) return;
845845

846-
void* ptr = (void*)g2h(addr);
846+
void* ptr = (void*)AFL_G2H(addr);
847847

848848
#ifdef ASAN_GIOVESE
849849
if (asan_giovese_store1(ptr)) {
@@ -859,7 +859,7 @@ void HELPER(qasan_store2)(CPUArchState *env, target_ulong addr) {
859859

860860
if (qasan_disabled) return;
861861

862-
void* ptr = (void*)g2h(addr);
862+
void* ptr = (void*)AFL_G2H(addr);
863863

864864
#ifdef ASAN_GIOVESE
865865
if (asan_giovese_store2(ptr)) {
@@ -875,7 +875,7 @@ void HELPER(qasan_store4)(CPUArchState *env, target_ulong addr) {
875875

876876
if (qasan_disabled) return;
877877

878-
void* ptr = (void*)g2h(addr);
878+
void* ptr = (void*)AFL_G2H(addr);
879879

880880
#ifdef ASAN_GIOVESE
881881
if (asan_giovese_store4(ptr)) {
@@ -891,7 +891,7 @@ void HELPER(qasan_store8)(CPUArchState *env, target_ulong addr) {
891891

892892
if (qasan_disabled) return;
893893

894-
void* ptr = (void*)g2h(addr);
894+
void* ptr = (void*)AFL_G2H(addr);
895895

896896
#ifdef ASAN_GIOVESE
897897
if (asan_giovese_store8(ptr)) {

‎qemuafl/asan-giovese-inl.h

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -319,14 +319,14 @@ int asan_giovese_guest_loadN(target_ulong addr, size_t n) {
319319

320320
if (n <= first_size) {
321321

322-
uintptr_t h = (uintptr_t)g2h(start);
322+
uintptr_t h = (uintptr_t)AFL_G2H(start);
323323
int8_t* shadow_addr = (int8_t*)(h >> 3) + SHADOW_OFFSET;
324324
int8_t k = *shadow_addr;
325325
return k != 0 && ((intptr_t)((h & 7) + n) > k);
326326

327327
}
328328

329-
uintptr_t h = (uintptr_t)g2h(start);
329+
uintptr_t h = (uintptr_t)AFL_G2H(start);
330330
int8_t* shadow_addr = (int8_t*)(h >> 3) + SHADOW_OFFSET;
331331
int8_t k = *shadow_addr;
332332
if (k != 0 && ((intptr_t)((h & 7) + first_size) > k)) return 1;
@@ -337,7 +337,7 @@ int asan_giovese_guest_loadN(target_ulong addr, size_t n) {
337337

338338
while (start < last_8) {
339339

340-
uintptr_t h = (uintptr_t)g2h(start);
340+
uintptr_t h = (uintptr_t)AFL_G2H(start);
341341
int8_t* shadow_addr = (int8_t*)(h >> 3) + SHADOW_OFFSET;
342342
if (*shadow_addr) return 1;
343343
start += 8;
@@ -346,7 +346,7 @@ int asan_giovese_guest_loadN(target_ulong addr, size_t n) {
346346

347347
if (last_8 != end) {
348348

349-
uintptr_t h = (uintptr_t)g2h(start);
349+
uintptr_t h = (uintptr_t)AFL_G2H(start);
350350
size_t last_size = end - last_8;
351351
int8_t* shadow_addr = (int8_t*)(h >> 3) + SHADOW_OFFSET;
352352
int8_t k = *shadow_addr;
@@ -373,14 +373,14 @@ int asan_giovese_guest_storeN(target_ulong addr, size_t n) {
373373

374374
if (n <= first_size) {
375375

376-
uintptr_t h = (uintptr_t)g2h(start);
376+
uintptr_t h = (uintptr_t)AFL_G2H(start);
377377
int8_t* shadow_addr = (int8_t*)(h >> 3) + SHADOW_OFFSET;
378378
int8_t k = *shadow_addr;
379379
return k != 0 && ((intptr_t)((h & 7) + n) > k);
380380

381381
}
382382

383-
uintptr_t h = (uintptr_t)g2h(start);
383+
uintptr_t h = (uintptr_t)AFL_G2H(start);
384384
int8_t* shadow_addr = (int8_t*)(h >> 3) + SHADOW_OFFSET;
385385
int8_t k = *shadow_addr;
386386
if (k != 0 && ((intptr_t)((h & 7) + first_size) > k)) return 1;
@@ -391,7 +391,7 @@ int asan_giovese_guest_storeN(target_ulong addr, size_t n) {
391391

392392
while (start < last_8) {
393393

394-
uintptr_t h = (uintptr_t)g2h(start);
394+
uintptr_t h = (uintptr_t)AFL_G2H(start);
395395
int8_t* shadow_addr = (int8_t*)(h >> 3) + SHADOW_OFFSET;
396396
if (*shadow_addr) return 1;
397397
start += 8;
@@ -400,7 +400,7 @@ int asan_giovese_guest_storeN(target_ulong addr, size_t n) {
400400

401401
if (last_8 != end) {
402402

403-
uintptr_t h = (uintptr_t)g2h(start);
403+
uintptr_t h = (uintptr_t)AFL_G2H(start);
404404
size_t last_size = end - last_8;
405405
int8_t* shadow_addr = (int8_t*)(h >> 3) + SHADOW_OFFSET;
406406
int8_t k = *shadow_addr;
@@ -493,7 +493,7 @@ int asan_giovese_poison_guest_region(target_ulong addr, size_t n,
493493

494494
if (n < first_size) return 0;
495495

496-
uintptr_t h = (uintptr_t)g2h(start);
496+
uintptr_t h = (uintptr_t)AFL_G2H(start);
497497
uint8_t* shadow_addr = (uint8_t*)(h >> 3) + SHADOW_OFFSET;
498498
*shadow_addr = 8 - first_size;
499499

@@ -503,7 +503,7 @@ int asan_giovese_poison_guest_region(target_ulong addr, size_t n,
503503

504504
while (start < last_8) {
505505

506-
uintptr_t h = (uintptr_t)g2h(start);
506+
uintptr_t h = (uintptr_t)AFL_G2H(start);
507507
uint8_t* shadow_addr = (uint8_t*)(h >> 3) + SHADOW_OFFSET;
508508
*shadow_addr = poison_byte;
509509
start += 8;
@@ -527,7 +527,7 @@ int asan_giovese_unpoison_guest_region(target_ulong addr, size_t n) {
527527

528528
while (start < end) {
529529

530-
uintptr_t h = (uintptr_t)g2h(start);
530+
uintptr_t h = (uintptr_t)AFL_G2H(start);
531531
uint8_t* shadow_addr = (uint8_t*)(h >> 3) + SHADOW_OFFSET;
532532
*shadow_addr = 0;
533533
start += 8;
@@ -856,7 +856,7 @@ static int poisoned_find_error(target_ulong addr, size_t n,
856856

857857
while (start < end) {
858858

859-
uintptr_t rs = (uintptr_t)g2h(start);
859+
uintptr_t rs = (uintptr_t)AFL_G2H(start);
860860
int8_t* shadow_addr = (int8_t*)(rs >> 3) + SHADOW_OFFSET;
861861
switch (*shadow_addr) {
862862

@@ -892,7 +892,7 @@ static int poisoned_find_error(target_ulong addr, size_t n,
892892

893893
if (have_partials) {
894894

895-
uintptr_t rs = (uintptr_t)g2h((end & ~7) + 8);
895+
uintptr_t rs = (uintptr_t)AFL_G2H((end & ~7) + 8);
896896
uint8_t* last_shadow_addr = (uint8_t*)(rs >> 3) + SHADOW_OFFSET;
897897
*err_string = poisoned_strerror(*last_shadow_addr);
898898
return 1;
@@ -905,7 +905,7 @@ static int poisoned_find_error(target_ulong addr, size_t n,
905905

906906
}
907907

908-
#define _MEM2SHADOW(x) ((uint8_t*)((uintptr_t)g2h(x) >> 3) + SHADOW_OFFSET)
908+
#define _MEM2SHADOW(x) ((uint8_t*)((uintptr_t)AFL_G2H(x) >> 3) + SHADOW_OFFSET)
909909

910910
#define _MEM2SHADOWPRINT(x) shadow_color_map[*_MEM2SHADOW(x)], *_MEM2SHADOW(x)
911911

‎qemuafl/asan-giovese.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
3232
#include <stdint.h>
3333
#include <inttypes.h>
3434
#include <stdlib.h>
35+
#include "common.h"
3536

3637
#ifndef ASAN_NAME_STR
3738
#define ASAN_NAME_STR "AddressSanitizer"

‎qemuafl/common.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@
4040

4141
#include "api.h"
4242

43+
#define AFL_G2H g2h_untagged
44+
4345
#if defined(TARGET_X86_64)
4446
#define api_regs x86_64_regs
4547
#elif defined(TARGET_I386)

0 commit comments

Comments
 (0)