Changeset 270686 in webkit

Timestamp:

Dec 11, 2020 10:49:31 AM (3 years ago)

Author:

mark.lam@apple.com

Message:

Add extra validation after untagging code pointers.
​https://bugs.webkit.org/show_bug.cgi?id=219765
rdar://72069920

Reviewed by Robin Morisset.

• assembler/AbstractMacroAssembler.h:

(JSC::AbstractMacroAssembler::untagReturnAddress):
(JSC::AbstractMacroAssembler::validateUntaggedPtr):

• assembler/MacroAssemblerARM64E.h:

(JSC::MacroAssemblerARM64E::untagReturnAddress):
(JSC::MacroAssemblerARM64E::validateUntaggedPtr):

• dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::reifyInlinedCallFrames):

• ftl/FTLThunks.cpp:

(JSC::FTL::genericGenerationThunkGenerator):

• jit/CCallHelpers.h:

(JSC::CCallHelpers::prepareForTailCallSlow):

• jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::prepareForTailCall):

• jit/ThunkGenerators.cpp:

(JSC::emitPointerValidation):
(JSC::arityFixupGenerator):

• llint/LLIntThunks.cpp:

(JSC::LLInt::createTailCallGate):
(JSC::LLInt::untagGateThunk):

• wasm/js/WebAssemblyFunction.cpp:

(JSC::WebAssemblyFunction::jsCallEntrypointSlow):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• assembler/AbstractMacroAssembler.h (modified) (3 diffs)
• assembler/MacroAssemblerARM64E.h (modified) (3 diffs)
• dfg/DFGOSRExitCompilerCommon.cpp (modified) (1 diff)
• ftl/FTLThunks.cpp (modified) (2 diffs)
• jit/CCallHelpers.h (modified) (2 diffs)
• jit/CallFrameShuffler.cpp (modified) (2 diffs)
• jit/ThunkGenerators.cpp (modified) (3 diffs)
• llint/LLIntThunks.cpp (modified) (3 diffs)
• wasm/js/WebAssemblyFunction.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-12-11  Mark Lam  <mark.lam@apple.com>
+
+        Add extra validation after untagging code pointers.
+        https://bugs.webkit.org/show_bug.cgi?id=219765
+        rdar://72069920
+
+        Reviewed by Robin Morisset.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::untagReturnAddress):
+        (JSC::AbstractMacroAssembler::validateUntaggedPtr):
+        * assembler/MacroAssemblerARM64E.h:
+        (JSC::MacroAssemblerARM64E::untagReturnAddress):
+        (JSC::MacroAssemblerARM64E::validateUntaggedPtr):
+        * dfg/DFGOSRExitCompilerCommon.cpp:
+        (JSC::DFG::reifyInlinedCallFrames):
+        * ftl/FTLThunks.cpp:
+        (JSC::FTL::genericGenerationThunkGenerator):
+        * jit/CCallHelpers.h:
+        (JSC::CCallHelpers::prepareForTailCallSlow):
+        * jit/CallFrameShuffler.cpp:
+        (JSC::CallFrameShuffler::prepareForTailCall):
+        * jit/ThunkGenerators.cpp:
+        (JSC::emitPointerValidation):
+        (JSC::arityFixupGenerator):
+        * llint/LLIntThunks.cpp:
+        (JSC::LLInt::createTailCallGate):
+        (JSC::LLInt::untagGateThunk):
+        * wasm/js/WebAssemblyFunction.cpp:
+        (JSC::WebAssemblyFunction::jsCallEntrypointSlow):
+
 2020-12-10  Tadeu Zagallo  <tzagallo@apple.com>
 

trunk/Source/JavaScriptCore/assembler/AbstractMacroAssembler.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2008-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -995 +995 @@
 
     ALWAYS_INLINE void tagReturnAddress() { }
-    ALWAYS_INLINE void untagReturnAddress() { }
+    ALWAYS_INLINE void untagReturnAddress(RegisterID = RegisterID::InvalidGPRReg) { }
 
     ALWAYS_INLINE void tagPtr(PtrTag, RegisterID) { }
@@ -1002 +1002 @@
     ALWAYS_INLINE void untagPtr(RegisterID, RegisterID) { }
     ALWAYS_INLINE void removePtrTag(RegisterID) { }
+    ALWAYS_INLINE void validateUntaggedPtr(RegisterID, RegisterID = RegisterID::InvalidGPRReg) { }
 
 protected:

trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2018-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2018-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -51 +51 @@
     }
 
-    ALWAYS_INLINE void untagReturnAddress()
+    ALWAYS_INLINE void untagReturnAddress(RegisterID scratch = InvalidGPR)
     {
         untagPtr(ARM64Registers::sp, ARM64Registers::lr);
+        validateUntaggedPtr(ARM64Registers::lr, scratch);
     }
 
@@ -77 +78 @@
         move(TrustedImm64(tag), tagGPR);
         m_assembler.autib(target, tagGPR);
+    }
+
+    ALWAYS_INLINE void validateUntaggedPtr(RegisterID target, RegisterID scratch = InvalidGPR)
+    {
+        if (scratch == InvalidGPR)
+            scratch = getCachedDataTempRegisterIDAndInvalidate();
+        load8(Address(target), scratch);
     }
 

trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp

@@ -285 +285 @@
             jit.untagPtr(GPRInfo::regT2, GPRInfo::regT3);
             jit.addPtr(AssemblyHelpers::TrustedImm32(inlineCallFrame->returnPCOffset() + sizeof(void*)), GPRInfo::callFrameRegister, GPRInfo::regT2);
+            jit.validateUntaggedPtr(GPRInfo::regT3, GPRInfo::nonArgGPR0);
             jit.tagPtr(GPRInfo::regT2, GPRInfo::regT3);
 #endif

trunk/Source/JavaScriptCore/ftl/FTLThunks.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -118 +118 @@
 #if CPU(ARM64E)
     jit.untagPtr(resultTag, AssemblyHelpers::linkRegister);
+    jit.validateUntaggedPtr(AssemblyHelpers::linkRegister);
     jit.tagReturnAddress();
 #else

trunk/Source/JavaScriptCore/jit/CCallHelpers.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2011-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2011-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -783 +783 @@
         addPtr(TrustedImm32(sizeof(CallerFrameAndPC)), MacroAssembler::framePointerRegister, tempGPR);
         untagPtr(tempGPR, linkRegister);
+        validateUntaggedPtr(linkRegister, tempGPR);
 #endif
 #elif CPU(MIPS)

trunk/Source/JavaScriptCore/jit/CallFrameShuffler.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -447 +447 @@
     m_jit.untagPtr(MacroAssembler::framePointerRegister, MacroAssembler::linkRegister);
     m_jit.subPtr(MacroAssembler::TrustedImm32(sizeof(CallerFrameAndPC)), MacroAssembler::framePointerRegister);
+    m_jit.validateUntaggedPtr(MacroAssembler::linkRegister);
 #endif
 

trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

@@ -51 +51 @@
         jit.pushToSave(pointerGPR);
         jit.untagPtr(tag, pointerGPR);
-        jit.load8(pointerGPR, pointerGPR);
+        jit.validateUntaggedPtr(pointerGPR, pointerGPR);
         jit.popToRestore(pointerGPR);
     }
@@ -397 +397 @@
     jit.addPtr(JSInterfaceJIT::TrustedImm32(sizeof(CallerFrameAndPC)), GPRInfo::callFrameRegister, extraTemp);
     jit.untagPtr(extraTemp, GPRInfo::regT3);
+    jit.validateUntaggedPtr(GPRInfo::regT3, extraTemp);
     PtrTag tempReturnPCTag = static_cast<PtrTag>(random());
     jit.move(JSInterfaceJIT::TrustedImmPtr(tempReturnPCTag), extraTemp);
@@ -453 +454 @@
     jit.move(JSInterfaceJIT::TrustedImmPtr(tempReturnPCTag), extraTemp);
     jit.untagPtr(extraTemp, GPRInfo::regT3);
+    jit.validateUntaggedPtr(GPRInfo::regT3, extraTemp);
     jit.addPtr(JSInterfaceJIT::TrustedImm32(sizeof(CallerFrameAndPC)), GPRInfo::callFrameRegister, extraTemp);
     jit.tagPtr(extraTemp, GPRInfo::regT3);

trunk/Source/JavaScriptCore/llint/LLIntThunks.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2012-2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -374 +374 @@
 
     jit.untagPtr(GPRInfo::argumentGPR2, ARM64Registers::lr);
+    jit.validateUntaggedPtr(ARM64Registers::lr, GPRInfo::argumentGPR2);
     jit.farJump(GPRInfo::regT0, tag);
 
@@ -478 +479 @@
     jit.addPtr(CCallHelpers::TrustedImm32(16), GPRInfo::callFrameRegister, GPRInfo::regT3);
     jit.untagPtr(GPRInfo::regT3, ARM64Registers::lr);
+    jit.validateUntaggedPtr(ARM64Registers::lr, GPRInfo::regT3);
     jit.move(CCallHelpers::TrustedImmPtr(pointer), GPRInfo::regT3);
     jit.farJump(GPRInfo::regT3, OperationPtrTag);

trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2016-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -417 +417 @@
     jit.emitFunctionEpilogue();
 #if CPU(ARM64E)
-    jit.untagReturnAddress();
+    jit.untagReturnAddress(scratchGPR);
 #endif
     auto jumpToHostCallThunk = jit.jump();