Skip to content

Commit

Permalink
[ThinLTO] Fix memory corruption in ThinLTOCodeGenerator when CodeGenO…
Browse files Browse the repository at this point in the history
…nly was specified

Summary:
Issue occurs when doing ThinLTO with CodeGenOnly flag.
TMBuilder.TheTriple is assigned to by multiple threads in an unsafe way resulting in double-free of std::string memory.

Pseudocode:
if (CodeGenOnly) {
  // Perform only parallel codegen and return.
  ThreadPool Pool;
  int count = 0;
  for (auto &ModuleBuffer : Modules) {
    Pool.async([&](int count) {
    ...
      /// Now call OutputBuffer = codegen(*TheModule);
      /// Which turns into initTMBuilder(moduleTMBuilder, Triple(TheModule.getTargetTriple()));
      /// Which turns into

      TMBuilder.TheTriple = std::move(TheTriple);   // std::string = "....."
      /// So, basically std::string assignment to same string on multiple threads = memory corruption

  }

  return;
}

Patch by Alex Borcan

Reviewers: llvm-commits, steven_wu

Reviewed By: steven_wu

Subscribers: mehdi_amini, inglorion, eraman, steven_wu, dexonsmith, llvm-commits

Differential Revision: https://reviews.llvm.org/D51651

llvm-svn: 341422
  • Loading branch information
cachemeifyoucan committed Sep 4, 2018
1 parent 22ddc28 commit cf90203
Show file tree
Hide file tree
Showing 2 changed files with 1 addition and 14 deletions.
5 changes: 0 additions & 5 deletions llvm/include/llvm/LTO/legacy/ThinLTOCodeGenerator.h
Expand Up @@ -299,11 +299,6 @@ class ThinLTOCodeGenerator {
*/
void optimize(Module &Module);

/**
* Perform ThinLTO CodeGen.
*/
std::unique_ptr<MemoryBuffer> codegen(Module &Module);

/**@}*/

private:
Expand Down
10 changes: 1 addition & 9 deletions llvm/lib/LTO/ThinLTOCodeGenerator.cpp
Expand Up @@ -818,14 +818,6 @@ void ThinLTOCodeGenerator::optimize(Module &TheModule) {
optimizeModule(TheModule, *TMBuilder.create(), OptLevel, Freestanding);
}

/**
* Perform ThinLTO CodeGen.
*/
std::unique_ptr<MemoryBuffer> ThinLTOCodeGenerator::codegen(Module &TheModule) {
initTMBuilder(TMBuilder, Triple(TheModule.getTargetTriple()));
return codegenModule(TheModule, *TMBuilder.create());
}

/// Write out the generated object file, either from CacheEntryPath or from
/// OutputBuffer, preferring hard-link when possible.
/// Returns the path to the generated file in SavedObjectsDirectoryPath.
Expand Down Expand Up @@ -893,7 +885,7 @@ void ThinLTOCodeGenerator::run() {
/*IsImporting*/ false);

// CodeGen
auto OutputBuffer = codegen(*TheModule);
auto OutputBuffer = codegenModule(*TheModule, *TMBuilder.create());
if (SavedObjectsDirectoryPath.empty())
ProducedBinaries[count] = std::move(OutputBuffer);
else
Expand Down

0 comments on commit cf90203

Please sign in to comment.