llvm / llvm/llvm-project

[BOLT] Explicitly check for unreachable basic blocks in gadget scanner

Open
#178,270 1 comment 0 reactions 1 assignee Claimed by @hvdijk View on GitHub
BOLT
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

In an optimized code, unreachable basic block is likely to indicate an error in CFG reconstruction performed by BOLT's core. As this can degrade analysis quality, PtrAuth analyses implemented in `llvm-bolt-binary-analysis` warn the user about such conditions in `FunctionAnalysisContext::findUnsafeUses()` along other preparations to running gadget detectors.

As soon as #170973 is resolved (either by #176135 or by any other patch), it seems natural to skip `findUnsafeUses` altogether if only authentication oracles are searched for. In that case it would be reasonable to implement this check for unreachable basic blocks as a yet another option for `--scanners=...` argument - instead of a full-blown dataflow analysis, a simple BFS should be enough to identify exactly the same set of basic blocks (those having no predecessors at all, as well as those belonging to an unreachable loop).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.