[compiler-rt] r226674 - [msan] Fix origins in realloc.
Evgeniy Stepanov
eugeni.stepanov at gmail.com
Wed Jan 21 08:48:30 PST 2015
Author: eugenis
Date: Wed Jan 21 10:48:29 2015
New Revision: 226674
URL: http://llvm.org/viewvc/llvm-project?rev=226674&view=rev
Log:
[msan] Fix origins in realloc.
Fixes 2 issues in origins arising from realloc() calls:
* In the in-place grow case origin for the new memory is not set at all.
* In the copy-realloc case __msan_memcpy is used, which unwinds stack from
inside the MSan runtime. This does not generally work (as we may be built
w/o frame pointers), and produces "bad" stack trace anyway, with several
uninteresting (internal) frames on top.
This change also makes realloc() honor "zeroise" and "poison_in_malloc" flags.
See https://code.google.com/p/memory-sanitizer/issues/detail?id=73.
Added:
compiler-rt/trunk/test/msan/realloc-large-origin.cc (with props)
compiler-rt/trunk/test/msan/realloc-origin.cc (with props)
Modified:
compiler-rt/trunk/lib/msan/msan_allocator.cc
Modified: compiler-rt/trunk/lib/msan/msan_allocator.cc
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/msan/msan_allocator.cc?rev=226674&r1=226673&r2=226674&view=diff
==============================================================================
--- compiler-rt/trunk/lib/msan/msan_allocator.cc (original)
+++ compiler-rt/trunk/lib/msan/msan_allocator.cc Wed Jan 21 10:48:29 2015
@@ -18,6 +18,7 @@
#include "msan_allocator.h"
#include "msan_origin.h"
#include "msan_thread.h"
+#include "msan_poisoning.h"
namespace __msan {
@@ -168,15 +169,21 @@ void *MsanReallocate(StackTrace *stack,
if (new_size <= actually_allocated_size) {
// We are not reallocating here.
meta->requested_size = new_size;
- if (new_size > old_size)
- __msan_poison((char*)old_p + old_size, new_size - old_size);
+ if (new_size > old_size) {
+ if (zeroise) {
+ __msan_clear_and_unpoison((char *)old_p + old_size,
+ new_size - old_size);
+ } else if (flags()->poison_in_malloc) {
+ PoisonMemory((char *)old_p + old_size, new_size - old_size, stack);
+ }
+ }
return old_p;
}
uptr memcpy_size = Min(new_size, old_size);
void *new_p = MsanAllocate(stack, new_size, alignment, zeroise);
// Printf("realloc: old_size %zd new_size %zd\n", old_size, new_size);
if (new_p) {
- __msan_memcpy(new_p, old_p, memcpy_size);
+ CopyMemory(new_p, old_p, memcpy_size, stack);
MsanDeallocate(stack, old_p);
}
return new_p;
Added: compiler-rt/trunk/test/msan/realloc-large-origin.cc
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/msan/realloc-large-origin.cc?rev=226674&view=auto
==============================================================================
--- compiler-rt/trunk/test/msan/realloc-large-origin.cc (added)
+++ compiler-rt/trunk/test/msan/realloc-large-origin.cc Wed Jan 21 10:48:29 2015
@@ -0,0 +1,30 @@
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -m64 -O0 %s -o %t && not %run %t >%t.out 2>&1
+// RUN: FileCheck %s < %t.out
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -m64 -O2 %s -o %t && not %run %t >%t.out 2>&1
+// RUN: FileCheck %s < %t.out
+
+// This is a regression test: there used to be broken "stored to memory at"
+// stacks with
+// in __msan_memcpy
+// in __msan::MsanReallocate
+// and nothing below that.
+
+#include <stdlib.h>
+int main(int argc, char **argv) {
+ char *p = (char *)malloc(100);
+ p = (char *)realloc(p, 10000);
+ char x = p[50];
+ free(p);
+ return x;
+
+// CHECK: WARNING: MemorySanitizer: use-of-uninitialized-value
+// CHECK: {{#0 0x.* in main .*realloc-large-origin.cc:}}[[@LINE-3]]
+
+// CHECK: Uninitialized value was stored to memory at
+// CHECK: {{#0 0x.* in realloc}}
+// CHECK: {{#1 0x.* in main .*realloc-large-origin.cc:}}[[@LINE-10]]
+
+// CHECK: Uninitialized value was created by a heap allocation
+// CHECK: {{#0 0x.* in malloc}}
+// CHECK: {{#1 0x.* in main .*realloc-large-origin.cc:}}[[@LINE-15]]
+}
Propchange: compiler-rt/trunk/test/msan/realloc-large-origin.cc
------------------------------------------------------------------------------
svn:eol-style = LF
Added: compiler-rt/trunk/test/msan/realloc-origin.cc
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/msan/realloc-origin.cc?rev=226674&view=auto
==============================================================================
--- compiler-rt/trunk/test/msan/realloc-origin.cc (added)
+++ compiler-rt/trunk/test/msan/realloc-origin.cc Wed Jan 21 10:48:29 2015
@@ -0,0 +1,21 @@
+// RUN: %clangxx_msan -fsanitize-memory-track-origins -m64 -O0 %s -o %t && not %run %t >%t.out 2>&1
+// RUN: FileCheck %s < %t.out
+// RUN: %clangxx_msan -fsanitize-memory-track-origins -m64 -O2 %s -o %t && not %run %t >%t.out 2>&1
+// RUN: FileCheck %s < %t.out
+
+// This test relies on realloc from 100 to 101 being done in-place.
+
+#include <stdlib.h>
+int main(int argc, char **argv) {
+ char *p = (char *)malloc(100);
+ p = (char *)realloc(p, 101);
+ char x = p[100];
+ free(p);
+ return x;
+ // CHECK: WARNING: MemorySanitizer: use-of-uninitialized-value
+ // CHECK: {{#0 0x.* in main .*realloc-origin.cc:}}[[@LINE-2]]
+
+ // CHECK: Uninitialized value was created by a heap allocation
+ // CHECK: {{#0 0x.* in realloc}}
+ // CHECK: {{#1 0x.* in main .*realloc-origin.cc:}}[[@LINE-9]]
+}
Propchange: compiler-rt/trunk/test/msan/realloc-origin.cc
------------------------------------------------------------------------------
svn:eol-style = LF
More information about the llvm-commits
mailing list