[hwasan] Check for overflow when searching candidates.

[fmayer]

Summary

If the fault address is at the boundary of memory regions, this could
cause us to segfault otherwise.

Ran test with old compiler_rt to make sure it fails.

[eugenis]

compiler-rt/lib/hwasan/hwasan_report.cpp

299

There is MemIsApp in hwasan_linux.cpp. Rename this one to MemIsShadow, and maybe move both definitions to hwasan_mapping.h.

300

kLowShadowEnd and kHighShadowEnd are inclusive - a bit unusual but consider that on 32-bit (in other sanitizers) ex. kHighMemEnd may be 0xffffffff, and kHighMemEnd+1 is not representable in uptr.

[fmayer]

Rename & move IsShadow(...)

[fmayer]

compiler-rt/lib/hwasan/hwasan_report.cpp

299

Left MemIsApp in the old place, as it uses a function defined in hwasan.h, which I guess is the reason it is there in the first place.

[eugenis]

LGTM

compiler-rt/lib/hwasan/hwasan_report.cpp

static uptr GetGlobalSizeFromDescriptor(uptr ptr) {
   for (const hwasan_global &global :
        HwasanGlobalsFor(load_bias, phdr_begin, ehdr->e_phnum))
     if (global.addr() <= ptr && ptr < global.addr() + global.size())
       return global.size();
 
   return 0;
 }
 
+static bool IsShadow(uptr p) {
+  return (kLowShadowStart <= p && p < kLowShadowEnd) ||
+         (kHighShadowStart <= p && p < kHighShadowEnd);
+}
+
 void PrintAddressDescription(
     uptr tagged_addr, uptr access_size,
     StackAllocationsRingBuffer *current_stack_allocations) {
   Decorator d;
   int num_descriptions_printed = 0;
   uptr untagged_addr = UntagAddr(tagged_addr);
 
   // Print some very basic information about the address, if it's a heap.
void PrintAddressDescription(
   // Check if this looks like a heap buffer overflow by scanning
   // the shadow left and right and looking for the first adjacent
   // object with a different memory tag. If that tag matches addr_tag,
   // check the allocator if it has a live chunk there.
   tag_t addr_tag = GetTagFromPointer(tagged_addr);
   tag_t *tag_ptr = reinterpret_cast<tag_t*>(MemToShadow(untagged_addr));
   tag_t *candidate = nullptr, *left = tag_ptr, *right = tag_ptr;
   for (int i = 0; i < 1000; i++) {
-    if (TagsEqual(addr_tag, left)) {
+    if (IsShadow(reinterpret_cast<uptr>(left)) && TagsEqual(addr_tag, left)) {
       candidate = left;
       break;
     }
     --left;
-    if (TagsEqual(addr_tag, right)) {
+    if (IsShadow(reinterpret_cast<uptr>(right)) && TagsEqual(addr_tag, right)) {
       candidate = right;
       break;
     }
     ++right;
   }
 
   if (candidate) {
     uptr mem = ShadowToMem(reinterpret_cast<uptr>(candidate));

compiler-rt/test/hwasan/TestCases/tag-mismatch-border-address.c

+// Make sure we do not segfault when checking an address close to kLowMemEnd.
+// RUN: %clang_hwasan  %s -o %t
+// RUN: not %run %t 2>&1 | FileCheck %s --check-prefix=CHECK
+
+// REQUIRES: stable-runtime
+// REQUIRES: aarch64-target-arch
+
+#include <sanitizer/hwasan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+
+static volatile char sink;
+extern void *__hwasan_shadow_memory_dynamic_address;
+
+int main(int argc, char **argv) {
+  void *high_addr = (char *)__hwasan_shadow_memory_dynamic_address - 0x1000;
+  void *r = mmap(high_addr, 4096, PROT_READ, MAP_FIXED | MAP_ANON | MAP_PRIVATE,
+                 -1, 0);
+  if (r == MAP_FAILED) {
+    fprintf(stderr, "Failed to mmap\n");
+    abort();
+  }
+  volatile char *x = (char *)__hwasan_tag_pointer(r, 4);
+  sink = *x;
+}
+
+// CHECK-NOT: Failed to mmap
+// CHECK-NOT: Segmentation fault
+// CHECK-NOT: SEGV