From nobody Thu May 30 15:35:43 2024 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Vqr1W39Qzz5Mqs0; Thu, 30 May 2024 15:35:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Vqr1W2L9gz4v3q; Thu, 30 May 2024 15:35:43 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1717083343; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Q/AJPgxDPTKW2foznqpuoGST/cqz+PrjigCD7v6f0pw=; b=I+/PvGbAMXbnlsdKl9UBg3VFx9IFa8Wtk0p5I8Gf7CgalEpG8QdVJhxPTMVLi28B/i/yA7 wqExDT2/LyIuYCU5+vDPP4tLOiNTKzqOjXdijThXgfHbUda6DK2AQTwZ10v47mcYBAHU/i mKo+9BMlq7idZQgpTWcKdvUCHEHUZk9QLiCFdm/bvGFXHmFSOTN5Vi6+jkb5YrBZx9ZS97 dahRcMBTarzPKDls2k263G1w39gXSFBJtJTcVS7NpWXc0UistIffxM6ftG196W7dydOsbB O7N6OfgT6hmykd9I0LolLTd597bM1jZu1+ZfyTwvyzHNmsd+PvlIdcxBS46YdQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1717083343; a=rsa-sha256; cv=none; b=NcE6SH3nTCSceXLTTkqwApEej/VIfYeuXjedOLjU4weo1f+dHbw3rtdCZAJQR7yfkzE37P P3fpYsCIh+kv24FNZxpaFKHidGxzfGiHy3BIdxHqeiYjkS7T96O+nDXdi+AAf8/W0BWMdA 5TGdxCUtyRedZpNztTLoWOBMpKpNqGn/DUi3xDA8BViYs14FqlEQftEi7SB84kTR/Tliny K89pjAcqlUJJqs7r1awE4KdrP7gR48XGs/LfeTDgfensURwovS9n/elaVb54UC96k2sqNS TprhisrbgJe++OK/WmIFUat1yuhW2P0wN9Jh8qZyDJKVRGkYve7pNAD8bOhKDA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1717083343; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Q/AJPgxDPTKW2foznqpuoGST/cqz+PrjigCD7v6f0pw=; b=bwkZ4PjipbMNyMUWp09dBM1GgjxRrUuGQ+T/mpiz83LVlcPLqKW+itcjbbmUPFD7Plp7r1 T1xVO5lEHJ4j5BXCV7ErzsUDEBo+kv5IpiyavhpUqPhoD0B03n+JYdwEeoLMUY4A5FG+nl GMl4YuTzG2P521qE40mqSvD+EA9zureuRhGCelZw7orEnlAqYJCaFkujGJyhPtczsc2Qco Sh/gpyzuHFHs533pDxnqlpioiMVN2bijJOoydhA9UCz3fqRyzuitxKSd046b7ol0dlpYxX FV0VUFVu6YS9Gn++dHk0DZmOq66PTxSKlWB/Zo9QiMSLLXRFaMDQCi46SNfqsA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Vqr1W1xbdzmCk; Thu, 30 May 2024 15:35:43 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 44UFZhTN034326; Thu, 30 May 2024 15:35:43 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 44UFZhot034324; Thu, 30 May 2024 15:35:43 GMT (envelope-from git) Date: Thu, 30 May 2024 15:35:43 GMT Message-Id: <202405301535.44UFZhot034324@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Dimitry Andric Subject: git: f30188c4680a - main - Merge commit 9f85bc834b07 from llvm-project (by Nikita Popov): List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dim X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f30188c4680a85126e793de157b851bf5ee47529 Auto-Submitted: auto-generated The branch main has been updated by dim: URL: https://cgit.FreeBSD.org/src/commit/?id=f30188c4680a85126e793de157b851bf5ee47529 commit f30188c4680a85126e793de157b851bf5ee47529 Author: Dimitry Andric AuthorDate: 2024-05-30 15:35:15 +0000 Commit: Dimitry Andric CommitDate: 2024-05-30 15:35:15 +0000 Merge commit 9f85bc834b07 from llvm-project (by Nikita Popov): [PPCMergeStringPool] Only replace constant once (#92996) In #88846 I changed this code to use RAUW to perform the replacement instead of manual updates -- but kept the outer loop, which means we try to perform RAUW once per user. However, some of the users might be freed by the RAUW operation, resulting in use-after-free. The case where this happens is constant users where the replacement might result in the destruction of the original constant. Fixes https://github.com/llvm/llvm-project/issues/92991. This fixes a possible crash when building crypto/openssh/sshkey.c for PowerPC targets. Reported by: cperciva PR: 276104 MFC after: 3 days --- .../llvm/lib/Target/PowerPC/PPCMergeStringPool.cpp | 37 ++++------------------ 1 file changed, 7 insertions(+), 30 deletions(-) diff --git a/contrib/llvm-project/llvm/lib/Target/PowerPC/PPCMergeStringPool.cpp b/contrib/llvm-project/llvm/lib/Target/PowerPC/PPCMergeStringPool.cpp index ebd876d50c44..0830b02370cd 100644 --- a/contrib/llvm-project/llvm/lib/Target/PowerPC/PPCMergeStringPool.cpp +++ b/contrib/llvm-project/llvm/lib/Target/PowerPC/PPCMergeStringPool.cpp @@ -290,13 +290,6 @@ bool PPCMergeStringPool::mergeModuleStringPool(Module &M) { return true; } -static bool userHasOperand(User *TheUser, GlobalVariable *GVOperand) { - for (Value *Op : TheUser->operands()) - if (Op == GVOperand) - return true; - return false; -} - // For pooled strings we need to add the offset into the pool for each string. // This is done by adding a Get Element Pointer (GEP) before each user. This // function adds the GEP. @@ -307,29 +300,13 @@ void PPCMergeStringPool::replaceUsesWithGEP(GlobalVariable *GlobalToReplace, Indices.push_back(ConstantInt::get(Type::getInt32Ty(*Context), 0)); Indices.push_back(ConstantInt::get(Type::getInt32Ty(*Context), ElementIndex)); - // Need to save a temporary copy of each user list because we remove uses - // as we replace them. - SmallVector Users; - for (User *CurrentUser : GlobalToReplace->users()) - Users.push_back(CurrentUser); - - for (User *CurrentUser : Users) { - // The user was not found so it must have been replaced earlier. - if (!userHasOperand(CurrentUser, GlobalToReplace)) - continue; - - // We cannot replace operands in globals so we ignore those. - if (isa(CurrentUser)) - continue; - - Constant *ConstGEP = ConstantExpr::getInBoundsGetElementPtr( - PooledStructType, GPool, Indices); - LLVM_DEBUG(dbgs() << "Replacing this global:\n"); - LLVM_DEBUG(GlobalToReplace->dump()); - LLVM_DEBUG(dbgs() << "with this:\n"); - LLVM_DEBUG(ConstGEP->dump()); - GlobalToReplace->replaceAllUsesWith(ConstGEP); - } + Constant *ConstGEP = + ConstantExpr::getInBoundsGetElementPtr(PooledStructType, GPool, Indices); + LLVM_DEBUG(dbgs() << "Replacing this global:\n"); + LLVM_DEBUG(GlobalToReplace->dump()); + LLVM_DEBUG(dbgs() << "with this:\n"); + LLVM_DEBUG(ConstGEP->dump()); + GlobalToReplace->replaceAllUsesWith(ConstGEP); } } // namespace