<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - ASAN does not consider alloca offset when handling lifetime markers"
href="https://bugs.llvm.org/show_bug.cgi?id=47787">47787</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>ASAN does not consider alloca offset when handling lifetime markers
</td>
</tr>
<tr>
<th>Product</th>
<td>compiler-rt
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>asan
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>lxfind@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>The current ASAN implementation assumes that lifetime intrinsics always point
to the beginning of an alloca, which is not always the case.
I made a full test case IR, where the lifetime marker points to %x which is an
offset within %0. ASAN would store 0 to the wrong spot when processing lifetime
start (it would instrument the beginning of %0, instead of %x).
; RUN: opt < %s --asan --asan-use-after-scope -S | FileCheck %s
target datalayout =
"e-m:o-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-apple-macosx10.15.0"
%t = type { void (%t*)*, void (%t*)*, %sub, i64 }
%sub = type { i32 }
define void @foo() sanitize_address {
entry:
%0 = alloca %t, align 8
%x = getelementptr inbounds %t, %t* %0, i64 0, i32 2
%1 = bitcast %sub* %x to i8*
call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %1)
call void @bar(%sub* nonnull %x)
call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %1) #3
ret void
}
declare void @llvm.lifetime.start.p0i8(i64 immarg, i8* nocapture)
declare void @bar(%sub*)
declare void @llvm.lifetime.end.p0i8(i64 immarg, i8* nocapture)
; CHECK: store i64 %[[STACK_BASE:.+]], i64* %asan_local_stack_base, align 8
; CHECK: %[[FRAME_BASE:.+]] = add i64 %[[STACK_BASE]], 32
; CHECK: %[[SHIFT:.+]] = lshr i64 %[[STACK_BASE]], 3
; CHECK-NEXT: %[[SHADOW_BASE:.+]] = or i64 %[[SHIFT]], 17592186044416
; CHECK: %[[X_SHADOW:.+]] = add i64 %[SHADOW_BASE], 6
; CHECK-NEXT: %[[X_SHADOW_PTR:.+]] = inttoptr i64 %[[X_SHADOW]] to i8*
; CHECK-NEXT: store i8 0, i8* %[[X_SHADOW_PTR]], align 1</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>