Skip to content

Fix misaligned memory writes in i386 and amd64 dynamic helper code generation #118680

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Aug 13, 2025
Merged

Fix misaligned memory writes in i386 and amd64 dynamic helper code generation #118680

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ccb2c59
Initial plan
Copilot Aug 13, 2025
19f0650
Fix misaligned memory writes in i386 code generation
Copilot Aug 13, 2025
dd5087a
Fix misaligned memory writes in amd64 dynamic helper code generation
Copilot Aug 13, 2025
da21b06
Fix additional misaligned memory writes in CreateDictionaryLookupHelper
Copilot Aug 13, 2025
4445c83
Use SET_UNALIGNED_64 instead of UINT64 UNALIGNED pointer casts
Copilot Aug 13, 2025
6d2079b
Merge branch 'main' into copilot/fix-118602
jkotas Aug 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
108 changes: 54 additions & 54 deletions src/coreclr/vm/amd64/cgenamd64.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -388,14 +388,14 @@ void EncodeLoadAndJumpThunk (LPBYTE pBuffer, LPVOID pv, LPVOID pTarget)
pBuffer[0] = 0x49;
pBuffer[1] = 0xBA;

*((UINT64 UNALIGNED *)&pBuffer[2]) = (UINT64)pv;
SET_UNALIGNED_64(&pBuffer[2], pv);

// mov rax, pTarget 48 b8 xx xx xx xx xx xx xx xx

pBuffer[10] = 0x48;
pBuffer[11] = 0xB8;

*((UINT64 UNALIGNED *)&pBuffer[12]) = (UINT64)pTarget;
SET_UNALIGNED_64(&pBuffer[12], pTarget);

// jmp rax ff e0

Expand Down Expand Up @@ -427,7 +427,7 @@ void emitCOMStubCall (ComCallMethodDesc *pCOMMethodRX, ComCallMethodDesc *pCOMMe
// nop 90
// call [$ - 10] ff 15 f0 ff ff ff

*((UINT64 *)&pBufferRW[COMMETHOD_CALL_PRESTUB_ADDRESS_OFFSET]) = (UINT64)target;
SET_UNALIGNED_64(&pBufferRW[COMMETHOD_CALL_PRESTUB_ADDRESS_OFFSET], target);

pBufferRW[-2] = 0x90;
pBufferRW[-1] = 0x90;
Expand Down Expand Up @@ -459,7 +459,7 @@ void emitJump(LPBYTE pBufferRX, LPBYTE pBufferRW, LPVOID target)
pBufferRW[0] = 0x48;
pBufferRW[1] = 0xB8;

*((UINT64 UNALIGNED *)&pBufferRW[2]) = (UINT64)target;
SET_UNALIGNED_64(&pBufferRW[2], target);

pBufferRW[10] = 0xFF;
pBufferRW[11] = 0xE0;
Expand Down Expand Up @@ -638,16 +638,16 @@ PCODE DynamicHelpers::CreateHelper(LoaderAllocator * pAllocator, TADDR arg, PCOD
BEGIN_DYNAMIC_HELPER_EMIT(15);

#ifdef UNIX_AMD64_ABI
*(UINT16 *)p = 0xBF48; // mov rdi, XXXXXX
SET_UNALIGNED_16(p, 0xBF48); // mov rdi, XXXXXX
#else
*(UINT16 *)p = 0xB948; // mov rcx, XXXXXX
SET_UNALIGNED_16(p, 0xB948); // mov rcx, XXXXXX
#endif
p += 2;
*(TADDR *)p = arg;
SET_UNALIGNED_64(p, arg);
p += 8;

*p++ = X86_INSTR_JMP_REL32; // jmp rel32
*(INT32 *)p = rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator);
SET_UNALIGNED_32(p, rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator));
p += 4;

END_DYNAMIC_HELPER_EMIT();
Expand All @@ -665,16 +665,16 @@ void DynamicHelpers::EmitHelperWithArg(BYTE*& p, size_t rxOffset, LoaderAllocato
// Move an argument into the second argument register and jump to a target function.

#ifdef UNIX_AMD64_ABI
*(UINT16 *)p = 0xBE48; // mov rsi, XXXXXX
SET_UNALIGNED_16(p, 0xBE48); // mov rsi, XXXXXX
#else
*(UINT16 *)p = 0xBA48; // mov rdx, XXXXXX
SET_UNALIGNED_16(p, 0xBA48); // mov rdx, XXXXXX
#endif
p += 2;
*(TADDR *)p = arg;
SET_UNALIGNED_64(p, arg);
p += 8;

*p++ = X86_INSTR_JMP_REL32; // jmp rel32
*(INT32 *)p = rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator);
SET_UNALIGNED_32(p, rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator));
p += 4;
}

Expand All @@ -692,25 +692,25 @@ PCODE DynamicHelpers::CreateHelper(LoaderAllocator * pAllocator, TADDR arg, TADD
BEGIN_DYNAMIC_HELPER_EMIT(25);

#ifdef UNIX_AMD64_ABI
*(UINT16 *)p = 0xBF48; // mov rdi, XXXXXX
SET_UNALIGNED_16(p, 0xBF48); // mov rdi, XXXXXX
#else
*(UINT16 *)p = 0xB948; // mov rcx, XXXXXX
SET_UNALIGNED_16(p, 0xB948); // mov rcx, XXXXXX
#endif
p += 2;
*(TADDR *)p = arg;
SET_UNALIGNED_64(p, arg);
p += 8;

#ifdef UNIX_AMD64_ABI
*(UINT16 *)p = 0xBE48; // mov rsi, XXXXXX
SET_UNALIGNED_16(p, 0xBE48); // mov rsi, XXXXXX
#else
*(UINT16 *)p = 0xBA48; // mov rdx, XXXXXX
SET_UNALIGNED_16(p, 0xBA48); // mov rdx, XXXXXX
#endif
p += 2;
*(TADDR *)p = arg2;
SET_UNALIGNED_64(p, arg2);
p += 8;

*p++ = X86_INSTR_JMP_REL32; // jmp rel32
*(INT32 *)p = rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator);
SET_UNALIGNED_32(p, rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator));
p += 4;

END_DYNAMIC_HELPER_EMIT();
Expand All @@ -722,24 +722,24 @@ PCODE DynamicHelpers::CreateHelperArgMove(LoaderAllocator * pAllocator, TADDR ar

#ifdef UNIX_AMD64_ABI
*p++ = 0x48; // mov rsi, rdi
*(UINT16 *)p = 0xF78B;
SET_UNALIGNED_16(p, 0xF78B);
#else
*p++ = 0x48; // mov rdx, rcx
*(UINT16 *)p = 0xD18B;
SET_UNALIGNED_16(p, 0xD18B);
#endif
p += 2;

#ifdef UNIX_AMD64_ABI
*(UINT16 *)p = 0xBF48; // mov rdi, XXXXXX
SET_UNALIGNED_16(p, 0xBF48); // mov rdi, XXXXXX
#else
*(UINT16 *)p = 0xB948; // mov rcx, XXXXXX
SET_UNALIGNED_16(p, 0xB948); // mov rcx, XXXXXX
#endif
p += 2;
*(TADDR *)p = arg;
SET_UNALIGNED_64(p, arg);
p += 8;

*p++ = X86_INSTR_JMP_REL32; // jmp rel32
*(INT32 *)p = rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator);
SET_UNALIGNED_32(p, rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator));
p += 4;

END_DYNAMIC_HELPER_EMIT();
Expand All @@ -758,9 +758,9 @@ PCODE DynamicHelpers::CreateReturnConst(LoaderAllocator * pAllocator, TADDR arg)
{
BEGIN_DYNAMIC_HELPER_EMIT(11);

*(UINT16 *)p = 0xB848; // mov rax, XXXXXX
SET_UNALIGNED_16(p, 0xB848); // mov rax, XXXXXX
p += 2;
*(TADDR *)p = arg;
SET_UNALIGNED_64(p, arg);
p += 8;

*p++ = 0xC3; // ret
Expand All @@ -772,9 +772,9 @@ PCODE DynamicHelpers::CreateReturnIndirConst(LoaderAllocator * pAllocator, TADDR
{
BEGIN_DYNAMIC_HELPER_EMIT((offset != 0) ? 15 : 11);

*(UINT16 *)p = 0xA148; // mov rax, [XXXXXX]
SET_UNALIGNED_16(p, 0xA148); // mov rax, [XXXXXX]
p += 2;
*(TADDR *)p = arg;
SET_UNALIGNED_64(p, arg);
p += 8;

if (offset != 0)
Expand All @@ -796,16 +796,16 @@ PCODE DynamicHelpers::CreateHelperWithTwoArgs(LoaderAllocator * pAllocator, TADD
BEGIN_DYNAMIC_HELPER_EMIT(15);

#ifdef UNIX_AMD64_ABI
*(UINT16 *)p = 0xBA48; // mov rdx, XXXXXX
SET_UNALIGNED_16(p, 0xBA48); // mov rdx, XXXXXX
#else
*(UINT16 *)p = 0xB849; // mov r8, XXXXXX
SET_UNALIGNED_16(p, 0xB849); // mov r8, XXXXXX
#endif
p += 2;
*(TADDR *)p = arg;
SET_UNALIGNED_64(p, arg);
p += 8;

*p++ = X86_INSTR_JMP_REL32; // jmp rel32
*(INT32 *)p = rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator);
SET_UNALIGNED_32(p, rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator));
p += 4;

END_DYNAMIC_HELPER_EMIT();
Expand All @@ -816,25 +816,25 @@ PCODE DynamicHelpers::CreateHelperWithTwoArgs(LoaderAllocator * pAllocator, TADD
BEGIN_DYNAMIC_HELPER_EMIT(25);

#ifdef UNIX_AMD64_ABI
*(UINT16 *)p = 0xBA48; // mov rdx, XXXXXX
SET_UNALIGNED_16(p, 0xBA48); // mov rdx, XXXXXX
#else
*(UINT16 *)p = 0xB849; // mov r8, XXXXXX
SET_UNALIGNED_16(p, 0xB849); // mov r8, XXXXXX
#endif
p += 2;
*(TADDR *)p = arg;
SET_UNALIGNED_64(p, arg);
p += 8;

#ifdef UNIX_AMD64_ABI
*(UINT16 *)p = 0xB948; // mov rcx, XXXXXX
SET_UNALIGNED_16(p, 0xB948); // mov rcx, XXXXXX
#else
*(UINT16 *)p = 0xB949; // mov r9, XXXXXX
SET_UNALIGNED_16(p, 0xB949); // mov r9, XXXXXX
#endif
p += 2;
*(TADDR *)p = arg2;
SET_UNALIGNED_64(p, arg2);
p += 8;

*p++ = X86_INSTR_JMP_REL32; // jmp rel32
*(INT32 *)p = rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator);
SET_UNALIGNED_32(p, rel32UsingJumpStub((INT32 *)(p + rxOffset), target, NULL, pAllocator));
p += 4;

END_DYNAMIC_HELPER_EMIT();
Expand Down Expand Up @@ -885,9 +885,9 @@ PCODE DynamicHelpers::CreateDictionaryLookupHelper(LoaderAllocator * pAllocator,
_ASSERTE(pLookup->testForNull && i > 0);

// cmp qword ptr[rax + sizeOffset],slotOffset
*(UINT32*)p = 0x00b88148; p += 3;
*(UINT32*)p = (UINT32)pLookup->sizeOffset; p += 4;
*(UINT32*)p = (UINT32)slotOffset; p += 4;
SET_UNALIGNED_32(p, 0x00b88148); p += 3;
SET_UNALIGNED_32(p, (UINT32)pLookup->sizeOffset); p += 4;
SET_UNALIGNED_32(p, (UINT32)slotOffset); p += 4;

// jle 'HELPER CALL'
*p++ = 0x7e;
Expand All @@ -901,24 +901,24 @@ PCODE DynamicHelpers::CreateDictionaryLookupHelper(LoaderAllocator * pAllocator,
// mov rax,qword ptr [rdi+offset]
if (pLookup->offsets[i] >= 0x80)
{
*(UINT32*)p = 0x00878b48; p += 3;
*(UINT32*)p = (UINT32)pLookup->offsets[i]; p += 4;
SET_UNALIGNED_32(p, 0x00878b48); p += 3;
SET_UNALIGNED_32(p, (UINT32)pLookup->offsets[i]); p += 4;
}
else
{
*(UINT32*)p = 0x00478b48; p += 3;
SET_UNALIGNED_32(p, 0x00478b48); p += 3;
*p++ = (BYTE)pLookup->offsets[i];
}
#else
// mov rax,qword ptr [rcx+offset]
if (pLookup->offsets[i] >= 0x80)
{
*(UINT32*)p = 0x00818b48; p += 3;
*(UINT32*)p = (UINT32)pLookup->offsets[i]; p += 4;
SET_UNALIGNED_32(p, 0x00818b48); p += 3;
SET_UNALIGNED_32(p, (UINT32)pLookup->offsets[i]); p += 4;
}
else
{
*(UINT32*)p = 0x00418b48; p += 3;
SET_UNALIGNED_32(p, 0x00418b48); p += 3;
*p++ = (BYTE)pLookup->offsets[i];
}
#endif
Expand All @@ -928,12 +928,12 @@ PCODE DynamicHelpers::CreateDictionaryLookupHelper(LoaderAllocator * pAllocator,
// mov rax,qword ptr [rax+offset]
if (pLookup->offsets[i] >= 0x80)
{
*(UINT32*)p = 0x00808b48; p += 3;
*(UINT32*)p = (UINT32)pLookup->offsets[i]; p += 4;
SET_UNALIGNED_32(p, 0x00808b48); p += 3;
SET_UNALIGNED_32(p, (UINT32)pLookup->offsets[i]); p += 4;
}
else
{
*(UINT32*)p = 0x00408b48; p += 3;
SET_UNALIGNED_32(p, 0x00408b48); p += 3;
*p++ = (BYTE)pLookup->offsets[i];
}
}
Expand All @@ -953,10 +953,10 @@ PCODE DynamicHelpers::CreateDictionaryLookupHelper(LoaderAllocator * pAllocator,

_ASSERTE(pLookup->indirections != 0);

*(UINT32*)p = 0x00c08548; p += 3; // test rax,rax
SET_UNALIGNED_32(p, 0x00c08548); p += 3; // test rax,rax

// je 'HELPER_CALL' (a jump of 1 byte)
*(UINT16*)p = 0x0174; p += 2;
SET_UNALIGNED_16(p, 0x0174); p += 2;

*p++ = 0xC3; // ret

Expand Down
Loading
Loading