[llvm-bugs] [Bug 47787] New: ASAN does not consider alloca offset when handling lifetime markers

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=47787

            Bug ID: 47787
           Summary: ASAN does not consider alloca offset when handling
                    lifetime markers
           Product: compiler-rt
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: asan
          Assignee: unassignedbugs at nondot.org
          Reporter: lxfind at gmail.com
                CC: llvm-bugs at lists.llvm.org

The current ASAN implementation assumes that lifetime intrinsics always point
to the beginning of an alloca, which is not always the case.

I made a full test case IR, where the lifetime marker points to %x which is an
offset within %0. ASAN would store 0 to the wrong spot when processing lifetime
start (it would instrument the beginning of %0, instead of %x).

; RUN: opt < %s --asan --asan-use-after-scope -S | FileCheck %s

target datalayout =
"e-m:o-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-apple-macosx10.15.0"

%t = type { void (%t*)*, void (%t*)*, %sub, i64 }
%sub = type { i32 }

define void @foo() sanitize_address {
entry:
  %0 = alloca %t, align 8
  %x = getelementptr inbounds %t, %t* %0, i64 0, i32 2
  %1 = bitcast %sub* %x to i8*
  call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %1)
  call void @bar(%sub* nonnull %x)
  call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %1) #3
  ret void
}

declare void @llvm.lifetime.start.p0i8(i64 immarg, i8* nocapture)
declare void @bar(%sub*)
declare void @llvm.lifetime.end.p0i8(i64 immarg, i8* nocapture)

; CHECK: store i64 %[[STACK_BASE:.+]], i64* %asan_local_stack_base, align 8
; CHECK: %[[FRAME_BASE:.+]] = add i64 %[[STACK_BASE]], 32
; CHECK: %[[SHIFT:.+]] = lshr i64 %[[STACK_BASE]], 3
; CHECK-NEXT: %[[SHADOW_BASE:.+]] = or i64 %[[SHIFT]], 17592186044416
; CHECK: %[[X_SHADOW:.+]] = add i64 %[SHADOW_BASE], 6
; CHECK-NEXT: %[[X_SHADOW_PTR:.+]] = inttoptr i64 %[[X_SHADOW]] to i8*
; CHECK-NEXT: store i8 0, i8* %[[X_SHADOW_PTR]], align 1

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20201010/93bd6d86/attachment-0001.html>