Skip to content

Fixed a bug in -fsanitize-kcfi-arity #142867

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 18, 2025
Merged

Fixed a bug in -fsanitize-kcfi-arity #142867

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 18 additions & 5 deletions llvm/lib/Target/X86/X86AsmPrinter.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,14 +198,27 @@ void X86AsmPrinter::emitKCFITypeId(const MachineFunction &MF) {
// Determine the function's arity (i.e., the number of arguments) at the ABI
// level by counting the number of parameters that are passed
// as registers, such as pointers and 64-bit (or smaller) integers. The
// Linux x86-64 ABI allows up to 6 parameters to be passed in GPRs.
// Linux x86-64 ABI allows up to 6 integer parameters to be passed in GPRs.
// Additional parameters or parameters larger than 64 bits may be passed on
// the stack, in which case the arity is denoted as 7.
// the stack, in which case the arity is denoted as 7. Floating-point
// arguments passed in XMM0-XMM7 are not counted toward arity because
// floating-point values are not relevant to enforcing kCFI at this time.
const unsigned ArityToRegMap[8] = {X86::EAX, X86::ECX, X86::EDX, X86::EBX,
X86::ESP, X86::EBP, X86::ESI, X86::EDI};
int Arity = MF.getInfo<X86MachineFunctionInfo>()->getArgumentStackSize() > 0
? 7
: MF.getRegInfo().liveins().size();
int Arity;
if (MF.getInfo<X86MachineFunctionInfo>()->getArgumentStackSize() > 0) {
Arity = 7;
} else {
Arity = 0;
for (const auto &LI : MF.getRegInfo().liveins()) {
auto Reg = LI.first;
if (X86::GR8RegClass.contains(Reg) || X86::GR16RegClass.contains(Reg) ||
X86::GR32RegClass.contains(Reg) ||
X86::GR64RegClass.contains(Reg)) {
++Arity;
}
}
}
DestReg = ArityToRegMap[Arity];
}

Expand Down
29 changes: 27 additions & 2 deletions llvm/test/CodeGen/X86/kcfi-arity.ll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,14 +192,39 @@ entry:
ret void
}

;; Ensure that floating-point values are not counted toward the arity
; ASM-LABEL: __cfi_f12:
; ASM: movl $2253188362, %ebp
define dso_local void @f12(i32 noundef %v1, i32 noundef %v2, float noundef %v3, double noundef %v4, float noundef %v5, i32 noundef %v6, i32 noundef %v7, i32 noundef %v8) #0 !kcfi_type !7 {
entry:
%v1.addr = alloca i32, align 4
%v2.addr = alloca i32, align 4
%v3.addr = alloca float, align 4
%v4.addr = alloca double, align 4
%v5.addr = alloca float, align 4
%v6.addr = alloca i32, align 4
%v7.addr = alloca i32, align 4
%v8.addr = alloca i32, align 4
store i32 %v1, ptr %v1.addr, align 4
store i32 %v2, ptr %v2.addr, align 4
store float %v3, ptr %v3.addr, align 4
store double %v4, ptr %v4.addr, align 4
store float %v5, ptr %v5.addr, align 4
store i32 %v6, ptr %v6.addr, align 4
store i32 %v7, ptr %v7.addr, align 4
store i32 %v8, ptr %v8.addr, align 4
ret void
}

attributes #0 = { "target-features"="+retpoline-indirect-branches,+retpoline-indirect-calls" }

!llvm.module.flags = !{!0, !7}
!llvm.module.flags = !{!0, !8}
!0 = !{i32 4, !"kcfi", i32 1}
!1 = !{i32 12345678}
!2 = !{i32 4196274163}
!3 = !{i32 98693133}
!4 = !{i32 199571451}
!5 = !{i32 1046421190}
!6 = !{i32 1342488295}
!7 = !{i32 4, !"kcfi-arity", i32 1}
!7 = !{i32 2253188362}
!8 = !{i32 4, !"kcfi-arity", i32 1}