[ASan] Get fake stack code working with GCC 4.8.2.

[foad]

Summary

TestCases/Linux/heavy_uar_test.cc was failing on my
PowerPC64 box with GCC 4.8.2, because the compiler recognised
a memset-like loop and turned it into a call to memset, which
got intercepted by __asan_memset, which got upset because it was
being called on an address in high shadow memory.

Use break_optimization to stop the compiler from doing this.

[kcc]

I think that instead of adding an option to one of N supported build systems we need to make the code more compiler-resistant

[foad]

In D6266#4, @kcc wrote:

I think that instead of adding an option to one of N supported build systems we need to make the code more compiler-resistant

Do you mean changing the code in SetShadow? I suppose I could try adding "volatile" or something. (Yuck!)

The only other approach I can think of is for __asan_memset to detect whether it has been called from the application or from libasan itself; either by looking at the return address, or by changing every entry point in the sanitizer to set some "in asan" flag.

[kcc]

In D6266#5, @foad wrote:

In D6266#4, @kcc wrote:

I think that instead of adding an option to one of N supported build systems we need to make the code more compiler-resistant

Do you mean changing the code in SetShadow? I suppose I could try adding "volatile" or something. (Yuck!)

Slightly better way is to move break_optimization from sanitizer_common/sanitizer_libc.cc
to sanitizer_common/sanitizer_common.h and use it inside the loop.

It's not perfect either, because this will not let the compiler use wider stores.

Ideally, I would introduce internal_memset_aligned64, similar to internal_bzero_aligned16 in sanitizer_common/sanitizer_libc.cc.
Then for small class_id (0, 1, 2) use explicit assignments and for large ones (3, 4, 5, 6) use internal_memset_aligned64

The only other approach I can think of is for __asan_memset to detect whether it has been called from the application or from libasan itself; either by looking at the return address, or by changing every entry point in the sanitizer to set some "in asan" flag.

God forbid :)

[foad]

Use break_optimisation instead of compiler flags.

[foad]

Fix build failure by removing another competing definition of
break_optimization.

[samsonov]

Did you try -ffreestanding flag?

[foad]

In D6266#12, @samsonov wrote:

Did you try -ffreestanding flag?

Yes. It doesn't help.

To quote the GCC bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56888
"Thus, from 4.8.3, 4.9.1 and 4.10.0 on -ffreestanding, -fno-hosted and -fno-builtin
will cause -ftree-loop-distribute-patterns to _not_ be enabled by default
with -O3+ (you can still enable it manually)."

[kcc]

LGTM

[foad]

Unfortunately the current patch still doesn't build cleanly.

The problem is that I'm trying to move the definition of break_optimization into lib/sanitizer_common/sanitizer_common.h, but there is already another definition of break_optimization in lib/sanitizer_common/tests/sanitizer_test_utils.h.

Some tests, like lib/sanitizer_common/tests/sanitizer_allocator_test.cc, include both of these headers.

Others, like lib/asan/tests/asan_test.cc, only include sanitizer_test_utils.h.

I tried including sanitizer_common.h from sanitizer_test_utils.h but I ran into this, and I don't know how to fix it:

In file included from /home/jay/svn/llvm-project/compiler-rt/trunk/lib/asan/tests/asan_interface_test.cc:15:
In file included from /home/jay/svn/llvm-project/llvm/trunk/projects/compiler-rt/include/sanitizer/asan_interface.h:17:
/home/jay/svn/llvm-project/llvm/trunk/projects/compiler-rt/include/sanitizer/common_interface_defs.h:40:5: error: typedef redefinition with different types ('struct __sanitizer_sandbox_arguments' vs 'struct __sanitizer_sandbox_arguments')
  } __sanitizer_sandbox_arguments;
    ^
/home/jay/svn/llvm-project/llvm/trunk/projects/compiler-rt/lib/sanitizer_common/sanitizer_internal_defs.h:109:5: note: previous definition is here
  } __sanitizer_sandbox_arguments;
    ^

[kcc]

leave sanitizer_test_utils.h unchanged, remove break_optimization from sanitizer_libc.cc,
introduce SanitizerBreakOptimization or some such to sanitizer_common.h

[foad]

Follow Kostya's advice.

[kcc]

LGTM, thanks!

lib/asan/asan_fake_stack.cc

 static const u64 kMagic4 = (kMagic2 << 16) | kMagic2;
 static const u64 kMagic8 = (kMagic4 << 32) | kMagic4;
 
 // For small size classes inline PoisonShadow for better performance.
 ALWAYS_INLINE void SetShadow(uptr ptr, uptr size, uptr class_id, u64 magic) {
   CHECK_EQ(SHADOW_SCALE, 3);  // This code expects SHADOW_SCALE=3.
   u64 *shadow = reinterpret_cast<u64*>(MemToShadow(ptr));
   if (class_id <= 6) {
-    for (uptr i = 0; i < (1U << class_id); i++)
+    for (uptr i = 0; i < (1U << class_id); i++) {
       shadow[i] = magic;
+      SanitizerBreakOptimization(0);  // Make sure this does not become memset.
+    }
   } else {
     // The size class is too big, it's cheaper to poison only size bytes.
     PoisonShadow(ptr, size, static_cast<u8>(magic));
   }
 }
 
 FakeStack *FakeStack::Create(uptr stack_size_log) {
   static uptr kMinStackSizeLog = 16;

lib/sanitizer_common/sanitizer_common.h

 void GetExtraActivationFlags(char *buf, uptr size);
 void SanitizerInitializeUnwinder();
 #else
 INLINE void AndroidLogInit() {}
 INLINE void AndroidLogWrite(const char *buffer_unused) {}
 INLINE void GetExtraActivationFlags(char *buf, uptr size) { *buf = '\0'; }
 INLINE void SanitizerInitializeUnwinder() {}
 #endif
+
+// Make the compiler think that something is going on there.
+// Use this inside a loop that looks like memset/memcpy/etc to prevent the
+// compiler from recognising it and turning it into an actual call to
+// memset/memcpy/etc.
+static inline void SanitizerBreakOptimization(void *arg) {
+#if _MSC_VER
+  // FIXME: make sure this is actually enough.
+  __asm;
+#else
+  __asm__ __volatile__("" : : "r" (arg) : "memory");
+#endif
+}
+
 }  // namespace __sanitizer
 
 inline void *operator new(__sanitizer::operator_new_size_type size,
                           __sanitizer::LowLevelAllocator &alloc) {
   return alloc.Allocate(size);
 }
 
 struct StackDepotStats {
   uptr n_uniq_ids;
   uptr allocated;
 };
 
 #endif  // SANITIZER_COMMON_H

lib/sanitizer_common/sanitizer_libc.cc

 // run-time libraries. See sanitizer_libc.h for details.
 //===----------------------------------------------------------------------===//
 #include "sanitizer_allocator_internal.h"
 #include "sanitizer_common.h"
 #include "sanitizer_libc.h"
 
 namespace __sanitizer {
 
-// Make the compiler think that something is going on there.
-static inline void break_optimization(void *arg) {
-#if _MSC_VER
-  // FIXME: make sure this is actually enough.
-  __asm;
-#else
-  __asm__ __volatile__("" : : "r" (arg) : "memory");
-#endif
-}
-
 s64 internal_atoll(const char *nptr) {
   return internal_simple_strtoll(nptr, (char**)0, 10);
 }
 
 void *internal_memchr(const void *s, int c, uptr n) {
   const char *t = (const char *)s;
   for (uptr i = 0; i < n; ++i, ++t)
     if (*t == c)

 }
 
 // Semi-fast bzero for 16-aligned data. Still far from peak performance.
 void internal_bzero_aligned16(void *s, uptr n) {
   struct S16 { u64 a, b; } ALIGNED(16);
   CHECK_EQ((reinterpret_cast<uptr>(s) | n) & 15, 0);
   for (S16 *p = reinterpret_cast<S16*>(s), *end = p + n / 16; p < end; p++) {
     p->a = p->b = 0;
-    break_optimization(0);  // Make sure this does not become memset.
+    SanitizerBreakOptimization(0);  // Make sure this does not become memset.
   }
 }
 
 void *internal_memset(void* s, int c, uptr n) {
   // The next line prevents Clang from making a call to memset() instead of the
   // loop below.
   // FIXME: building the runtime with -ffreestanding is a better idea. However
   // there currently are linktime problems due to PR12396.