[msan] Unpoison indirect outputs for userspace when...
[msan] Unpoison indirect outputs for userspace when -msan-handle-asm-conservative is specified (#77393) KMSAN defaults to `msan-handle-asm-conservative`, which inserts `__msan_instrument_asm_store` calls to unpoison indirect outputs in inline assembly (e.g. `=m` constraints in source). ```c unsigned f() { unsigned v; // __msan_instrument_asm_store unpoisons v before invoking the asm. asm("movl $1,%0" : "=m"(v)); return v; } ``` Extend the mechanism to userspace, but require explicit `-mllvm -msan-handle-asm-conservative` for experiments for now. As https://docs.kernel.org/dev-tools/kmsan.html#inline-assembly-instrumentation says, this approach may mask certain errors (an indirect output may not actually be initialized), but it also helps to avoid a lot of false positives. Link: https://github.com/google/sanitizers/issues/192
Loading
Please sign in to comment