trailofbits / vast

VAST is an experimental compiler pipeline designed for program analysis of C and C++. It provides a tower of IRs as MLIR dialects to choose the best fit representations for a program analysis or further program abstraction.
https://trailofbits.github.io/vast/
Apache License 2.0
396 stars 25 forks source link

Missing function pointer typedef from the module #213

Open kumarak opened 1 year ago

kumarak commented 1 year ago

The lower of an indirect call expr hits VAST_UNREACHABLE because the typedef type is not present in the module. The error occurs while lowering the function sc_unlock_mutex that has indirect call expr to UnlockMutex. Below is the code snippet that defines UnlockMutex.

...
#define ck_unlockmutex_t CK_UNLOCKMUTEX
...
#define ck_c_initialize_args _CK_C_INITIALIZE_ARGS
...
#define unlock_mutex UnlockMutex
...
typedef ck_rv_t (*ck_unlockmutex_t) (void *mutex);
...
struct ck_c_initialize_args
{
  ck_createmutex_t create_mutex;
  ck_destroymutex_t destroy_mutex;
  ck_lockmutex_t lock_mutex;
  ck_unlockmutex_t unlock_mutex;
  ck_flags_t flags;
  void *reserved;
};
...
typedef struct ck_c_initialize_args *CK_C_INITIALIZE_ARGS_PTR;
static CK_C_INITIALIZE_ARGS_PTR global_locking;
...
static int sc_unlock_mutex(void *m)
{       
        if (global_locking == NULL)
                return SC_SUCCESS;
        if (global_locking->UnlockMutex(m) == CKR_OK)
                return SC_SUCCESS;
        else
                return SC_ERROR_INTERNAL; 
}

It is looking for the following typedef expression that is missing from the module:

!hl.typedef<"CK_UNLOCKMUTEX">

Callstack:

frame #3: 0x000000010a5e3d00 mx-index`llvm::llvm_unreachable_internal(msg="unknown typedef name", file="/Users/akkumar/Documents/workspace/src/vast/lib/vast/Dialect/HighLevel/HighLevelTypes.cpp", line=51) at ErrorHandling.cpp:212:3
    frame #4: 0x00000001071268bd mx-index`vast::hl::getTypedefType(type=TypedefType @ 0x000070000a969108, mod=vast::Module @ 0x000070000a969100) at HighLevelTypes.cpp:51:9
    frame #5: 0x0000000107126bbd mx-index`vast::hl::getFunctionType(type=vast::hl::Type @ 0x000070000a969218, mod=vast::Module @ 0x000070000a969210) at HighLevelTypes.cpp:64:36
  * frame #6: 0x000000010010cfff mx-index`vast::hl::CodeGenStmtVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>>::VisitIndirectCall(this=0x0000600000cfe3a0, expr=0x000000012f9f6290) at CodeGenStmtVisitor.hpp:757:27
    frame #7: 0x00000001000e747e mx-index`vast::hl::CodeGenStmtVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>>::VisitCallExpr(this=0x0000600000cfe3a0, expr=0x000000012f9f6290) at CodeGenStmtVisitor.hpp:766:20
    frame #8: 0x00000001000e3a67 mx-index`clang::StmtVisitorBase<llvm::make_const_ptr, vast::hl::CodeGenStmtVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>>, mlir::Operation*>::Visit(this=0x0000600000cfe3a0, S=0x000000012f9f6290) at StmtNodes.inc:931:1
    frame #9: 0x00000001000e2911 mx-index`auto vast::hl::CodeGenFallBackVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>, vast::hl::DefaultCodeGenVisitorMixin, indexer::FallBackVisitor>::VisitWithFallBack<clang::Stmt const*>(this=0x0000600000cfe3a0, token=0x000000012f9f6290) at CodeGenFallBackVisitor.hpp:73:52
    frame #10: 0x00000001000e28dd mx-index`vast::hl::CodeGenFallBackVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>, vast::hl::DefaultCodeGenVisitorMixin, indexer::FallBackVisitor>::Visit(this=0x0000600000cfe3a0, stmt=0x000000012f9f6290) at CodeGenFallBackVisitor.hpp:67:60
    frame #11: 0x00000001000e9195 mx-index`auto vast::hl::CodeGenVisitorLens<vast::hl::CodeGenStmtVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>>, vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>>::visit<clang::Expr*>(this=0x0000600000cfe3a0, token=0x000000012f9f6290) at CodeGenVisitorLens.hpp:52:52
    frame #12: 0x00000001000efa31 mx-index`mlir::Operation* vast::hl::CodeGenStmtVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>>::VisitCmp<(this=0x0000600000cfe3a0, op=0x000000012f9f6310)1>(clang::BinaryOperator const*) at CodeGenStmtVisitor.hpp:93:24
    frame #13: 0x00000001000e49ed mx-index`vast::hl::CodeGenStmtVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>>::VisitBinNE(this=0x0000600000cfe3a0, op=0x000000012f9f6310) at CodeGenStmtVisitor.hpp:161:20
    frame #14: 0x00000001000e2aed mx-index`clang::StmtVisitorBase<llvm::make_const_ptr, vast::hl::CodeGenStmtVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>>, mlir::Operation*>::Visit(this=0x0000600000cfe3a0, S=0x000000012f9f6310) at StmtVisitor.h:64:26
    frame #15: 0x00000001000e2911 mx-index`auto vast::hl::CodeGenFallBackVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>, vast::hl::DefaultCodeGenVisitorMixin, indexer::FallBackVisitor>::VisitWithFallBack<clang::Stmt const*>(this=0x0000600000cfe3a0, token=0x000000012f9f6310) at CodeGenFallBackVisitor.hpp:73:52
    frame #16: 0x00000001000e28dd mx-index`vast::hl::CodeGenFallBackVisitorMixin<vast::hl::CodeGenVisitor<indexer::CodeGeneratorVisitor::VisitorConfig, indexer::MetaGenerator>, vast::hl::DefaultCodeGenVisitorMixin, indexer::FallBackVisitor>::Visit(this=0x0000600000cfe3a0, stmt=0x000000012f9f6310) at CodeGenFallBackVisitor.hpp:67:60
kumarak commented 1 year ago

@xlauko, It seems the new changes related to visit indirect call is causing this issue. Could you review how a typedef type is getting lowered into MLIR module for indirect calls?

kumarak commented 1 year ago

I stripped the c file to generate a small test case to reproduce the same issue but it seems vast-cc is able to lower the indirect call expression correctly. It seems the bug is in the integration to multiplier because of the missing typedef decl from the module that include only top-level declaration. pkcs11-global_bug.c.gz