21f72c05c4
Hwasan includes instructions in the prologue that mix the PC and SP and store it into the stack ring buffer stored at __hwasan_tls. This is a thread_local global exposed from the hwasan runtime. However, if TLS-mechanisms or the hwasan runtime haven't been setup yet, it will be invalid to access __hwasan_tls. This is the case for Fuchsia where we instrument libc, so some functions that are instrumented but can run before hwasan initialization will incorrectly access this global. Additionally, libc cannot have any TLS variables, so we cannot weakly define __hwasan_tls until the runtime is loaded. A way we can work around this is by moving the instructions into a hwasan function that does the store into the ring buffer and creating a weak definition of that function locally in libc. This way __hwasan_tls will not actually be referenced. This is not our long-term solution, but this will allow us to roll out hwasan in the meantime. This patch includes: - A new llvm flag for choosing to emit a libcall rather than instructions in the prologue (off by default) - The libcall for storing into the ringbuffer (__hwasan_add_frame_record) Differential Revision: https://reviews.llvm.org/D128387
52 lines
2.0 KiB
C
52 lines
2.0 KiB
C
// Tests use-after-return detection and reporting.
|
|
// RUN: %clang_hwasan -g %s -o %t && not %run %t 2>&1 | FileCheck %s
|
|
// RUN: %clang_hwasan -g %s -o %t && not %env_hwasan_opts=symbolize=0 %run %t 2>&1 | FileCheck %s --check-prefix=NOSYM
|
|
|
|
// Run the same test as above, but using the __hwasan_add_frame_record libcall.
|
|
// The output should be the exact same.
|
|
// RUN: %clang_hwasan -g %s -o %t -mllvm -hwasan-record-stack-history=libcall && not %env_hwasan_opts=symbolize=0 %run %t 2>&1 | FileCheck %s --check-prefix=NOSYM
|
|
|
|
// REQUIRES: stable-runtime
|
|
|
|
// Stack histories currently are not recorded on x86.
|
|
// XFAIL: x86_64
|
|
|
|
void USE(void *x) { // pretend_to_do_something(void *x)
|
|
__asm__ __volatile__("" : : "r" (x) : "memory");
|
|
}
|
|
|
|
__attribute__((noinline))
|
|
char *buggy() {
|
|
char zzz[0x1000];
|
|
char *volatile p = zzz;
|
|
return p;
|
|
}
|
|
|
|
__attribute__((noinline)) void Unrelated1() { int A[2]; USE(&A[0]); }
|
|
__attribute__((noinline)) void Unrelated2() { int BB[3]; USE(&BB[0]); }
|
|
__attribute__((noinline)) void Unrelated3() { int CCC[4]; USE(&CCC[0]); }
|
|
|
|
int main() {
|
|
char *p = buggy();
|
|
Unrelated1();
|
|
Unrelated2();
|
|
Unrelated3();
|
|
return *p;
|
|
// CHECK: READ of size 1 at
|
|
// CHECK: #0 {{.*}} in main{{.*}}stack-uar.c:[[@LINE-2]]
|
|
// CHECK: Cause: stack tag-mismatch
|
|
// CHECK: is located in stack of thread
|
|
// CHECK: Potentially referenced stack objects:
|
|
// CHECK-NEXT: zzz in buggy {{.*}}stack-uar.c:[[@LINE-20]]
|
|
// CHECK-NEXT: Memory tags around the buggy address
|
|
|
|
// NOSYM: Previously allocated frames:
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uar.c.tmp+0x{{.*}}){{$}}
|
|
// NOSYM-NEXT: Memory tags around the buggy address
|
|
|
|
// CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in main
|
|
}
|