RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2024-11-25 04:02:41 +01:00
Code Issues Projects Releases Wiki Activity

[MCA][LSUnit] Fix a potential use after free in the logic that updates memory groups.

Browse Source 
Make sure that the `CriticalMemoryInstruction` of a memory group is invalidated
if it references an already executed instruction.  This avoids a potential
use-after-free if the critical memory info becomes stale, and the value is
read after the instruction has executed.
This commit is contained in:
Andrea Di Biagio 2021-04-20 12:57:20 +01:00
parent 9a29810062
commit f4f953260a
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
include/llvm/MCA/HardwareUnits/LSUnit.h
View File

@ -160,11 +160,16 @@ public:
MG->onGroupIssued(CriticalMemoryInstruction, true);
}
void onInstructionExecuted() {
void onInstructionExecuted(const InstRef &IR) {
assert(isReady() && !isExecuted() && "Invalid internal state!");
--NumExecuting;
++NumExecuted;
if (CriticalMemoryInstruction &&
CriticalMemoryInstruction.getSourceIndex() == IR.getSourceIndex()) {
CriticalMemoryInstruction.invalidate();
}
if (!isExecuted())
return;

2
lib/MCA/HardwareUnits/LSUnit.cpp
View File

@ -205,7 +205,7 @@ void LSUnitBase::onInstructionExecuted(const InstRef &IR) {
unsigned GroupID = IR.getInstruction()->getLSUTokenID();
auto It = Groups.find(GroupID);
assert(It != Groups.end() && "Instruction not dispatched to the LS unit");
It->second->onInstructionExecuted();
It->second->onInstructionExecuted(IR);
if (It->second->isExecuted())
Groups.erase(It);
}