[ASan] Introduce the dump_instruction_bytes flag to print the faulting instruction upon SIGSEGV

[glider]

Summary

When dump_instruction_bytes=1 and the instruction pointer doesn't point to the zero page, ASan prints 16 bytes starting at the instruction point.
When the instruction pointer points to the zero page, print a warning about that.
Also allow deadly signals to be received in signal handlers (previously ASan would just crash upon the second SEGV)

[samsonov]

What if instruction pc points to is not in the zero page, but is inaccessible? It would be sad to crash the program while printing ASan error report in this case.

lib/asan/asan_report.cc

162

You may check that pc < GetPageSizeCached() here.

658

We print pc above... do you really need this?

lib/asan/asan_rtl.cc

234

Wait, where is the default value for this flag?

lib/sanitizer_common/sanitizer_posix_libcdep.cc

151 ↗

(On Diff #13201)

Can this go as a separate change?

[samsonov]

What if instruction pc points to is not in the zero page, but is inaccessible? It would be sad to crash the program while printing ASan error report in this case.

[glider]

What if instruction pc points to is not in the zero page, but is inaccessible? It would be sad to crash the program while printing ASan error report in this case.

If pc points to inaccessible page, then we're in a SEGV handler caused by this. We can't print anything meaningful besides the stack, and _Unwind_Backtrace() will crash on this pc right away.

lib/asan/asan_report.cc

162

Done.

658

Many people do not understand that this is just a SEGV handler, so they keep asking whether this crash is a false positive and why ASan doesn't print more info about it.
I'm not insisting on this piece, however.

lib/asan/asan_rtl.cc

234

Done.

lib/sanitizer_common/sanitizer_posix_libcdep.cc

151 ↗

(On Diff #13201)

Done.

[glider]

Addressed Alexey's comments

[samsonov]

Alright, let's do this if you feel it would improve user experience in certain cases.

[glider]

I take back my argument about crashes in _Unwind_Backtrace.
Apparently at least on OSX unwinding the stack from the unmapped page doesn't necessarily crash the unwinder. Thus we probably need to unprotect the faulting page before trying to dump instruction bytes.

[glider]

Meanwhile I'll land the "zero page" hint separately.

[glider]

Call IsAccessibleMemoryRange() to make sure we don't step on unaccessible memory.
Disable the test on ARM.

[samsonov]

LGTM

lib/asan/asan_report.cc

168

s/char/u8 ?

[glider]

r218243, thanks!

lib/asan/asan_flags.h

struct Flags {
   bool alloc_dealloc_mismatch;
   bool new_delete_type_mismatch;
   bool strict_memcmp;
   bool strict_init_order;
   bool start_deactivated;
   int detect_invalid_pointer_pairs;
   bool detect_container_overflow;
   int detect_odr_violation;
+  bool dump_instruction_bytes;
 };
 
 extern Flags asan_flags_dont_use_directly;
 inline Flags *flags() {
   return &asan_flags_dont_use_directly;
 }
 void InitializeFlags(Flags *f, const char *env);
 
 }  // namespace __asan
 
 #endif  // ASAN_FLAGS_H

lib/asan/asan_report.cc

switch (byte) {
         return Red();
       case kAsanInternalHeapMagic:
         return Yellow();
       default:
         return Default();
     }
   }
   const char *EndShadowByte() { return Default(); }
+  const char *MemoryByte() { return Magenta(); }
+  const char *EndMemoryByte() { return Default(); }
 };
 
 // ---------------------- Helper functions ----------------------- {{{1
 
+static void PrintMemoryByte(InternalScopedString *str, const char *before,
+    u8 byte, bool in_shadow, const char *after = "\n") {
+  Decorator d;
+  str->append("%s%s%x%x%s%s", before,
+              in_shadow ? d.ShadowByte(byte) : d.MemoryByte(),
+              byte >> 4, byte & 15,
+              in_shadow ? d.EndShadowByte() : d.EndMemoryByte(), after);
+}
+
 static void PrintShadowByte(InternalScopedString *str, const char *before,
-                            u8 byte, const char *after = "\n") {
-  Decorator d;
-  str->append("%s%s%x%x%s%s", before, d.ShadowByte(byte), byte >> 4, byte & 15,
-              d.EndShadowByte(), after);
+  PrintMemoryByte(str, before, byte, /*in_shadow*/true, after);
 }
 
 static void PrintShadowBytes(InternalScopedString *str, const char *before,
                              u8 *bytes, u8 *guilty, uptr n) {
   Decorator d;
   if (before) str->append("%s%p:", before, bytes);
   for (uptr i = 0; i < n; i++) {
     u8 *p = bytes + i;
PrintShadowByte(str, "  Poisoned by user:        ",
                   kAsanUserPoisonedMemoryMagic);
   PrintShadowByte(str, "  Container overflow:      ",
                   kAsanContiguousContainerOOBMagic);
   PrintShadowByte(str, "  Array cookie:            ",
                   kAsanArrayCookieMagic);
   PrintShadowByte(str, "  ASan internal:           ", kAsanInternalHeapMagic);
 }
 
+void MaybeDumpInstructionBytes(uptr pc) {
+  if (!flags()->dump_instruction_bytes || (pc < GetPageSizeCached()))
+    return;
+  InternalScopedString str(1024);
+  str.append("First 16 instruction bytes at pc: ");
+  if (IsAccessibleMemoryRange(pc, 16)) {
+    for (int i = 0; i < 16; ++i) {
+      PrintMemoryByte(&str, "", ((char *)pc)[i], /*in_shadow*/false, " ");
+    }
+    str.append("\n");
+  } else {
+    str.append("unaccessible\n");
+  }
+  Report("%s", str.data());
+}
+
 static void PrintShadowMemoryForAddress(uptr addr) {
   if (!AddrIsInMem(addr)) return;
   uptr shadow_addr = MemToShadow(addr);
   const uptr n_bytes_per_row = 16;
   uptr aligned_shadow = shadow_addr & ~(n_bytes_per_row - 1);
   InternalScopedString str(4096 * 8);
   str.append("Shadow bytes around the buggy address:\n");
   for (int i = -5; i <= 5; i++) {
void ReportSIGSEGV(const char *description, uptr pc, uptr sp, uptr bp,
   ScopedInErrorReport in_report;
   Decorator d;
   Printf("%s", d.Warning());
   Report(
       "ERROR: AddressSanitizer: %s on unknown address %p"
       " (pc %p bp %p sp %p T%d)\n",
       description, (void *)addr, (void *)pc, (void *)bp, (void *)sp,
       GetCurrentTidOrInvalid());
   if (pc < GetPageSizeCached()) {
     Report("Hint: pc points to the zero page.\n");
   }
   Printf("%s", d.EndWarning());
   GET_STACK_TRACE_SIGNAL(pc, bp, context);
   stack.Print();
+  MaybeDumpInstructionBytes(pc);
   Printf("AddressSanitizer can not provide additional info.\n");
   ReportErrorSummary("SEGV", &stack);
 }
 
 void ReportDoubleFree(uptr addr, StackTrace *free_stack) {
   ScopedInErrorReport in_report;
   Decorator d;
   Printf("%s", d.Warning());

lib/asan/asan_rtl.cc

ParseFlag(str, &f->detect_container_overflow,
       "detect_container_overflow",
       "If true, honor the container overflow  annotations. "
       "See https://code.google.com/p/address-sanitizer/wiki/ContainerOverflow");
 
   ParseFlag(str, &f->detect_odr_violation, "detect_odr_violation",
             "If >=2, detect violation of One-Definition-Rule (ODR); "
             "If ==1, detect ODR-violation only if the two variables "
             "have different sizes");
+
+  ParseFlag(str, &f->dump_instruction_bytes, "dump_instruction_bytes",
+      "If true, dump 16 bytes starting at the instruction that caused SEGV");
 }
 
 void InitializeFlags(Flags *f, const char *env) {
   CommonFlags *cf = common_flags();
   SetCommonFlagsDefaults(cf);
   cf->detect_leaks = CAN_SANITIZE_LEAKS;
   cf->external_symbolizer_path = GetEnv("ASAN_SYMBOLIZER_PATH");
   cf->malloc_context_size = kDefaultMallocContextSize;
void InitializeFlags(Flags *f, const char *env) {
   f->alloc_dealloc_mismatch = (SANITIZER_MAC == 0) && (SANITIZER_WINDOWS == 0);
   f->new_delete_type_mismatch = true;
   f->strict_memcmp = true;
   f->strict_init_order = false;
   f->start_deactivated = false;
   f->detect_invalid_pointer_pairs = 0;
   f->detect_container_overflow = true;
   f->detect_odr_violation = 2;
+  f->dump_instruction_bytes = false;
 
   // Override from compile definition.
   ParseFlagsFromString(f, MaybeUseAsanDefaultOptionsCompileDefinition());
 
   // Override from user-specified string.
   ParseFlagsFromString(f, MaybeCallAsanDefaultOptions());
   VReport(1, "Using the defaults from __asan_default_options: %s\n",
           MaybeCallAsanDefaultOptions());

test/asan/TestCases/dump_instruction_bytes.cc

+// Check that ASan prints the faulting instruction bytes on
+// dump_instruction_bytes=1
+// RUN: %clangxx_asan  %s -o %t
+// RUN: env ASAN_OPTIONS=dump_instruction_bytes=1 not %run %t 2>&1 | FileCheck %s --check-prefix=CHECK-DUMP
+// RUN: not %run %t 2>&1 | FileCheck %s --check-prefix=CHECK-NODUMP
+
+int main() {
+#if defined(__x86_64__)
+  asm("movq $0, %rax");
+  asm("movl $0xcafebabe, 0x0(%rax)");
+#elif defined(i386)
+  asm("movl $0, %eax");
+  asm("movl $0xcafebabe, 0x0(%eax)");
+#endif
+  // CHECK-DUMP: First 16 instruction bytes at pc: c7 00 be ba fe ca
+  // CHECK-NODUMP-NOT: First 16 instruction bytes
+  return 0;
+}
+
+// XFAIL: arm