mirrors/yosys
3
0
Fork 0
mirror of https://github.com/YosysHQ/yosys synced 2025-06-23 06:13:41 +00:00
Code Activity

Merge pull request #5165 from georgerennie/george/opt_dff_uaf

Browse source 
opt_dff: don't remove cells until all have been visited to prevent UAF
This commit is contained in:
George Rennie 2025-06-20 23:33:26 +01:00 • committed by GitHub
commit 170933ecb0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 71 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
passes/opt/opt_dff.cc
View file

@ -738,7 +738,11 @@ struct OptDffWorker
ModWalker modwalker(module->design, module);
QuickConeSat qcsat(modwalker);
// Run as a separate sub-pass, so that we don't mutate (non-FF) cells under ModWalker.
// Defer mutating cells by removing them/emiting new flip flops so that
// cell references in modwalker are not invalidated
std::vector<RTLIL::Cell*> cells_to_remove;
std::vector<FfData> ffs_to_emit;
bool did_something = false;
for (auto cell : module->selected_cells()) {
if (!RTLIL::builtin_ff_cell_types().count(cell->type))
@ -830,16 +834,20 @@ struct OptDffWorker
if (!removed_sigbits.count(i))
keep_bits.push_back(i);
if (keep_bits.empty()) {
module->remove(cell);
cells_to_remove.emplace_back(cell);
did_something = true;
continue;
}
ff = ff.slice(keep_bits);
ff.cell = cell;
ff.emit();
ffs_to_emit.emplace_back(ff);
did_something = true;
}
}
for (auto* cell : cells_to_remove)
module->remove(cell);
for (auto& ff : ffs_to_emit)
ff.emit();
return did_something;
}
};