pthreadpool cfi-icall check failure for XNNPACK function pointers casting
- Dominant language
- C
- Stars
- 2.5k
- Forks
- 560
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 163
Description
This issue was raised when integrating XNNPACK and pthreadpool into Chromium ([CL-4608520](https://chromium-review.googlesource.com/c/chromium/src/+/4608520/comments/80ec8200_7d0bd6d6)) where Chromium has cfi ([control-flow-integrity](https://www.chromium.org/developers/testing/control-flow-integrity/)) enabled build that also checks any cfi-icall (indirect call) issues.
For example, the error message could be:
```
$ out/cfi/components_unittests --gtest_filter=TFLiteModelExecutorTest.ExecuteWithLoadedModel
IMPORTANT DEBUGGING NOTE: batches of tests are run inside their
own process. For debugging a test inside a debugger, use the
--gtest_filter= flag along with
--single-process-tests.
Using sharding settings from environment. This is shard 0/1
Using 1 parallel jobs.
Note: Google Test filter = TFLiteModelExecutorTest.ExecuteWithLoadedModel
[==========] Running 1 test from 1 test suite.
[----------] Global test environment set-up.
[----------] 1 test from TFLiteModelExecutorTest
[ RUN ] TFLiteModelExecutorTest.ExecuteWithLoadedModel
INFO: Created TensorFlow Lite XNNPACK delegate for CPU.
../../third_party/pthreadpool/src/src/portable-api.c:1465:5: runtime error: control flow integrity check for type 'void (void *, unsigned long, unsigned long, unsigned long, unsigned long)' failed during indirect function call
../../third_party/xnnpack/src/src/operator-run.c:468: note: xnn_compute_igemm defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../third_party/pthreadpool/src/src/portable-api.c:1465:5 in
[1/1] TFLiteModelExecutorTest.ExecuteWithLoadedModel (CRASHED)
1 test crashed:
TFLiteModelExecutorTest.ExecuteWithLoadedModel (../../components/optimization_guide/core/tflite_model_executor_unittest.cc:255)
Tests took 4 seconds.
```
The root cause is that XNNPACK [casts](https://github.com/google/XNNPACK/blob/9ffb7f8f52a091de667ff21795d674b821b3506c/src/operators/convolution-nhwc.c#L1804) [`xnn_compute_igemm()`](https://github.com/google/XNNPACK/blob/9ffb7f8f52a091de667ff21795d674b821b3506c/src/operator-run.c#L462) to pthreadpool's [`pthreadpool_task_2d_tile_2d_t`](https://github.com/Maratyszcza/pthreadpool/blob/edeb5d6b967bef092ff195ab40e216fa5ac11f61/include/pthreadpool.h#L13) type:
```
void xnn_compute_igemm(
const struct igemm_context context[restrict XNN_MIN_ELEMENTS(1)],
size_t mr_block_start,
size_t nr_block_start,
size_t mr_block_size,
size_t nr_block_size)
```
```
typedef void (*pthreadpool_task_2d_tile_2d_t)(void*, size_t, size_t, size_t, size_t);
```
The cfi-icall check at pthreadpool's [`pthreadpool_parallelize_2d_tile_2d`](https://github.com/Maratyszcza/pthreadpool/blob/edeb5d6b967bef092ff195ab40e216fa5ac11f61/src/portable-api.c#L1465) would fail because it expects the first argument is `void*` but it was `const struct igemm_context context[restrict XNN_MIN_ELEMENTS(1)]`.
Contributor guide
Assessment
This issue has not been assessed yet.