[ASan] Removed code from unaligned case which was causing wrong reporting.

[kstoimenov]

Summary

The instrumentUnusualSizeOrAlignment was originally refactored out in D8198. At that time callbacks probably handled the unaligned case properly? Now it is causing a wrong "unknown-crash" message instead of 'global-buffer-overflow' because it is looking at the wrong place in shadow memory.

[eugenis]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

1874

I'm confused - AsanMemoryAccessCallbackSized callbacks go to __asan_loadN / __asan_storeN versions which should handle unaligned properly.

compiler-rt/lib/asan/tests/asan_test.cpp

TEST(AddressSanitizer, UAF_char) {
   EXPECT_DEATH(uaf_test<U1>(10, 10), uaf_string);
   EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, 0), uaf_string);
   EXPECT_DEATH(uaf_test<U1>(kLargeMalloc, kLargeMalloc / 2), uaf_string);
 }
 
 TEST(AddressSanitizer, UAF_long_double) {
   if (sizeof(long double) == sizeof(double)) return;
   long double *p = Ident(new long double[10]);
-  EXPECT_DEATH(Ident(p)[12] = 0, "WRITE of size 1[026]");
-  EXPECT_DEATH(Ident(p)[0] = Ident(p)[12], "READ of size 1[026]");
+  EXPECT_DEATH(Ident(p)[12] = 0, "WRITE of size 1");
+  EXPECT_DEATH(Ident(p)[0] = Ident(p)[12], "READ of size 1");
   delete [] Ident(p);
 }
 
 #if !defined(_WIN32)
 struct Packed5 {
   int x;
   char c;
 } __attribute__((packed));

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

 // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able
 // to report the actual access size.
 void AddressSanitizer::instrumentUnusualSizeOrAlignment(
     Instruction *I, Instruction *InsertBefore, Value *Addr, uint32_t TypeSize,
     bool IsWrite, Value *SizeArgument, bool UseCalls, uint32_t Exp) {
   IRBuilder<> IRB(InsertBefore);
   Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8);
   Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
-  if (UseCalls) {
-    if (Exp == 0)
-      IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][0],
-                     {AddrLong, Size});
-    else
-      IRB.CreateCall(AsanMemoryAccessCallbackSized[IsWrite][1],
-                     {AddrLong, Size, ConstantInt::get(IRB.getInt32Ty(), Exp)});
-  } else {
-    Value *LastByte = IRB.CreateIntToPtr(
-        IRB.CreateAdd(AddrLong, ConstantInt::get(IntptrTy, TypeSize / 8 - 1)),
-        Addr->getType());
-    instrumentAddress(I, InsertBefore, Addr, 8, IsWrite, Size, false, Exp);
-    instrumentAddress(I, InsertBefore, LastByte, 8, IsWrite, Size, false, Exp);
-  }
+  instrumentAddress(I, InsertBefore, Addr, 8, IsWrite, Size, UseCalls, Exp);
+  instrumentAddress(I, InsertBefore, LastByte, 8, IsWrite, Size, UseCalls, Exp);
 }
 
 void ModuleAddressSanitizer::poisonOneInitializer(Function &GlobalInit,
                                                   GlobalValue *ModuleName) {
   // Set up the arguments to our poison/unpoison functions.
   IRBuilder<> IRB(&GlobalInit.front(),
                   GlobalInit.front().getFirstInsertionPt());
 

llvm/test/Instrumentation/AddressSanitizer/experiment-call.ll

 ; CHECK: ret void
 }
 
 define void @loadN(i48* %p) sanitize_address {
 entry:
   %t = load i48, i48* %p, align 1
   ret void
 ; CHECK-LABEL: define void @loadN
-; CHECK: __asan_exp_loadN{{.*}} i32 42
+; CHECK: __asan_exp_load1{{.*}} i32 42
 ; CHECK: ret void
 }
 
 define void @store1(i8* %p) sanitize_address {
 entry:
   store i8 1, i8* %p, align 1
   ret void
 ; CHECK-LABEL: define void @store1

 ; CHECK: ret void
 }
 
 define void @storeN(i48* %p) sanitize_address {
 entry:
   store i48 1, i48* %p, align 1
   ret void
 ; CHECK-LABEL: define void @storeN
-; CHECK: __asan_exp_storeN{{.*}} i32 42
+; CHECK: __asan_exp_store1{{.*}} i32 42
 ; CHECK: ret void
 }

llvm/test/Instrumentation/AddressSanitizer/instrumentation-with-call-threshold.ll

 ; Test asan internal compiler flags:
 ;   -asan-instrumentation-with-call-threshold
 ;   -asan-memory-access-callback-prefix
 
 ; RUN: opt < %s -passes='asan-pipeline' -asan-instrumentation-with-call-threshold=1 -S | FileCheck %s --check-prefix=CHECK-CALL
 ; RUN: opt < %s -passes='asan-pipeline' -asan-instrumentation-with-call-threshold=0 -S | FileCheck %s --check-prefix=CHECK-CALL
 ; RUN: opt < %s -passes='asan-pipeline' -asan-instrumentation-with-call-threshold=0 -asan-memory-access-callback-prefix=__foo_ -S | FileCheck %s --check-prefix=CHECK-CUSTOM-PREFIX
 ; RUN: opt < %s -passes='asan-pipeline' -asan-instrumentation-with-call-threshold=5 -S | FileCheck %s --check-prefix=CHECK-INLINE
 ; RUN: opt < %s -passes='asan-pipeline'  -S | FileCheck %s --check-prefix=CHECK-INLINE
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
 target triple = "x86_64-unknown-linux-gnu"
 
 define void @test_load(i32* %a, i64* %b, i512* %c, i80* %d) sanitize_address {
 entry:
 ; CHECK-CALL: call void @__asan_load4
 ; CHECK-CALL: call void @__asan_load8
-; CHECK-CALL: call void @__asan_loadN{{.*}}i64 64)
-; CHECK-CALL: call void @__asan_loadN{{.*}}i64 10)
+; CHECK-CALL: call void @__asan_load1
+; CHECK-CALL: call void @__asan_load1
+; CHECK-CALL: call void @__asan_load1
+; CHECK-CALL: call void @__asan_load1
 ; CHECK-CUSTOM-PREFIX: call void @__foo_load4
 ; CHECK-CUSTOM-PREFIX: call void @__foo_load8
-; CHECK-CUSTOM-PREFIX: call void @__foo_loadN
+; CHECK-CUSTOM-PREFIX: call void @__foo_load1
 ; CHECK-INLINE-NOT: call void @__asan_load
   %tmp1 = load i32, i32* %a, align 4
   %tmp2 = load i64, i64* %b, align 8
   %tmp3 = load i512, i512* %c, align 32
   %tmp4 = load i80, i80* %d, align 8
   ret void
 }
 
 

llvm/test/Instrumentation/HWAddressSanitizer/kernel-inline.ll

entry:
   %tmp4 = load i80, i80* %d, align 8
   ret void
 }
 ; CHECK-INLINE: call void @__asan_report_load4_noabort
 ; CHECK-INLINE: call void @__asan_report_load8_noabort
 ; CHECK-INLINE: call void @__asan_report_load_n_noabort
 ; CHECK-INLINE-NOT: call void @__asan_load4_noabort
 ; CHECK-INLINE-NOT: call void @__asan_load8_noabort
-; CHECK-INLINE-NOT: call void @__asan_loadN_noabort
+; CHECK-INLINE-NOT: call void @__asan_load1_noabort
 ; CHECK-CALLBACK: call void @__asan_load4_noabort
 ; CHECK-CALLBACK: call void @__asan_load8_noabort
-; CHECK-CALLBACK: call void @__asan_loadN_noabort
+; CHECK-CALLBACK: call void @__asan_load1_noabort
 ; CHECK-CALLBACK-NOT: call void @__asan_report_load4_noabort
 ; CHECK-CALLBACK-NOT: call void @__asan_report_load8_noabort
 ; CHECK-CALLBACK-NOT: call void @__asan_report_load_n_noabort