[llvm-commits] [PATCH] AddressSanitizer: runtime support for use-after-scope bugs.

[Alexey Samsonov]

  Address kcc's comments.

Hi kcc,

http://llvm-reviews.chandlerc.com/D141

CHANGE SINCE LAST DIFF
  http://llvm-reviews.chandlerc.com/D141?vs=367&id=374#toc

Files:
  include/sanitizer/asan_interface.h
  lib/asan/lit_tests/use-after-scope-inlined.cc
  lib/asan/asan_rtl.cc
  lib/asan/asan_poisoning.cc
  lib/asan/asan_report.cc
  lib/asan/asan_internal.h

Index: include/sanitizer/asan_interface.h
===================================================================
--- include/sanitizer/asan_interface.h
+++ include/sanitizer/asan_interface.h
@@ -66,6 +66,15 @@
   void __asan_stack_free(uptr ptr, uptr size, uptr real_stack)
       SANITIZER_INTERFACE_ATTRIBUTE;
 
+  // These two functions are used by instrumented code in the
+  // use-after-scope mode. They mark memory for local variables as
+  // unaddressable when they leave scope and addressable before the
+  // function exits.
+  void __asan_poison_stack_memory(uptr addr, uptr size)
+      SANITIZER_INTERFACE_ATTRIBUTE;
+  void __asan_unpoison_stack_memory(uptr addr, uptr size)
+      SANITIZER_INTERFACE_ATTRIBUTE;
+
   // Marks memory region [addr, addr+size) as unaddressable.
   // This memory must be previously allocated by the user program. Accessing
   // addresses in this region from instrumented code is forbidden until
Index: lib/asan/lit_tests/use-after-scope-inlined.cc
===================================================================
--- /dev/null
+++ lib/asan/lit_tests/use-after-scope-inlined.cc
@@ -0,0 +1,27 @@
+// Test with "-O2" only to make sure inlining (leading to use-after-scope)
+// happens. "always_inline" is not enough, as Clang doesn't emit
+// llvm.lifetime intrinsics at -O0.
+//
+// RUN: %clangxx_asan -m64 -O2 -mllvm -asan-check-lifetime %s -o %t && \
+// RUN:     %t 2>&1 | %symbolize | FileCheck %s
+// RUN: %clangxx_asan -m32 -O2 -mllvm -asan-check-lifetime %s -o %t && \
+// RUN:     %t 2>&1 | %symbolize | FileCheck %s
+
+int *arr;
+
+__attribute__((always_inline))
+void inlined(int arg) {
+  int x[5];
+  for (int i = 0; i < arg; i++) x[i] = i;
+  arr = x;
+}
+
+int main(int argc, char *argv[]) {
+  inlined(argc);
+  return arr[argc - 1];  // BOOM
+  // CHECK: ERROR: AddressSanitizer: stack-use-after-scope
+  // CHECK: READ of size 4 at 0x{{.*}} thread T0
+  // CHECK:   #0 0x{{.*}} in {{_?}}main {{.*}}use-after-scope-inlined.cc:[[@LINE-3]]
+  // CHECK: Address 0x{{.*}} is located at offset [[OFFSET:[^ ]*]] in frame <main> of T0's stack:
+  // CHECK:   {{\[}}[[OFFSET]], {{.*}}) 'x.i'
+}
Index: lib/asan/asan_rtl.cc
===================================================================
--- lib/asan/asan_rtl.cc
+++ lib/asan/asan_rtl.cc
@@ -248,6 +248,8 @@
     case 34: __asan_malloc_hook(0, 0); break;
     case 35: __asan_free_hook(0); break;
     case 36: __asan_symbolize(0, 0, 0); break;
+    case 37: __asan_poison_stack_memory(0, 0); break;
+    case 38: __asan_unpoison_stack_memory(0, 0); break;
   }
 }
 
Index: lib/asan/asan_poisoning.cc
===================================================================
--- lib/asan/asan_poisoning.cc
+++ lib/asan/asan_poisoning.cc
@@ -151,3 +151,36 @@
 bool __asan_address_is_poisoned(void const volatile *addr) {
   return __asan::AddressIsPoisoned((uptr)addr);
 }
+
+// This is a simplified version of __asan_(un)poison_memory_region, which
+// assumes that left border of region to be poisoned is properly aligned.
+static void PoisonAlignedStackMemory(uptr addr, uptr size, bool do_poison) {
+  if (size == 0) return;
+  uptr aligned_size = size & ~(SHADOW_GRANULARITY - 1);
+  PoisonShadow(addr, aligned_size,
+               do_poison ? kAsanStackUseAfterScopeMagic : 0);
+  if (size == aligned_size)
+    return;
+  s8 end_offset = (s8)(size - aligned_size);
+  s8* shadow_end = (s8*)MemToShadow(addr + aligned_size);
+  s8 end_value = *shadow_end;
+  if (do_poison) {
+    // If possible, mark all the bytes mapping to last shadow byte as
+    // unaddressable.
+    if (end_value > 0 && end_value <= end_offset)
+      *shadow_end = kAsanStackUseAfterScopeMagic;
+  } else {
+    // If necessary, mark few first bytes mapping to last shadow byte
+    // as addressable
+    if (end_value != 0)
+      *shadow_end = Max(end_value, end_offset);
+  }
+}
+
+void __asan_poison_stack_memory(uptr addr, uptr size) {
+  PoisonAlignedStackMemory(addr, size, true);
+}
+
+void __asan_unpoison_stack_memory(uptr addr, uptr size) {
+  PoisonAlignedStackMemory(addr, size, false);
+}
Index: lib/asan/asan_report.cc
===================================================================
--- lib/asan/asan_report.cc
+++ lib/asan/asan_report.cc
@@ -457,6 +457,9 @@
       case kAsanUserPoisonedMemoryMagic:
         bug_descr = "use-after-poison";
         break;
+      case kAsanStackUseAfterScopeMagic:
+        bug_descr = "stack-use-after-scope";
+        break;
       case kAsanGlobalRedzoneMagic:
         bug_descr = "global-buffer-overflow";
         break;
Index: lib/asan/asan_internal.h
===================================================================
--- lib/asan/asan_internal.h
+++ lib/asan/asan_internal.h
@@ -161,6 +161,7 @@
 const int kAsanStackAfterReturnMagic = 0xf5;
 const int kAsanInitializationOrderMagic = 0xf6;
 const int kAsanUserPoisonedMemoryMagic = 0xf7;
+const int kAsanStackUseAfterScopeMagic = 0xf8;
 const int kAsanGlobalRedzoneMagic = 0xf9;
 const int kAsanInternalHeapMagic = 0xfe;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D141.3.patch
Type: text/x-patch
Size: 5022 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20121129/7199245f/attachment.bin>