[asan] Enable detect_stack_use_after_return=1 by default on Linux

[vitalybuka]

Summary

By default -fsanitize=address already compiles with this check, why not use it.
For compatibly it can be disabled with env ASAN_OPTIONS=detect_stack_use_after_return=0.

[hans]

Sounds good to me.

Worth a release note maybe?

[vitalybuka]

add release note

[vitalybuka]

clang/docs/ReleaseNotes.rst

175 ↗

(On Diff #424291)

@hans PTAL

175 ↗

(On Diff #424291)

I'll move MSAN_OPTIONS into a separate patch if this format is OK

[hans]

clang/docs/ReleaseNotes.rst

175 ↗

(On Diff #424291)

lgtm

[vitalybuka]

redo

clang/docs/AddressSanitizer.rst

 
 AddressSanitizer is a fast memory error detector. It consists of a compiler
 instrumentation module and a run-time library. The tool can detect the
 following types of bugs:
 
 * Out-of-bounds accesses to heap, stack and globals
 * Use-after-free
 * Use-after-return (clang flag ``-fsanitize-address-use-after-return=(never|runtime|always)`` default: ``runtime``)
-    * Enable ``runtime`` with: ``ASAN_OPTIONS=detect_stack_use_after_return=1``
+    * Disable ``runtime`` with: ``ASAN_OPTIONS=detect_stack_use_after_return=0``
 * Use-after-scope (clang flag ``-fsanitize-address-use-after-scope``)
 * Double-free, invalid free
 * Memory leaks (experimental)
 
 Typical slowdown introduced by AddressSanitizer is **2x**.
 
 How to build
 ============

 Note that this option is not supported on macOS.
 
 Stack Use After Return (UAR)
 ----------------------------
 
 AddressSanitizer can optionally detect stack use after return problems.
 This is available by default, or explicitly
 (``-fsanitize-address-use-after-return=runtime``).
-To enable this check at runtime, set the environment variable
-``ASAN_OPTIONS=detect_stack_use_after_return=1``.
+To disable this check at runtime, set the environment variable
+``ASAN_OPTIONS=detect_stack_use_after_return=0``.
 
 Enabling this check (``-fsanitize-address-use-after-return=always``) will
 reduce code size.  The code size may be reduced further by completely
 eliminating this check (``-fsanitize-address-use-after-return=never``).
 
 To summarize: ``-fsanitize-address-use-after-return=<mode>``
   * ``never``: Completely disables detection of UAR errors (reduces code size).
-  * ``runtime``: Adds the code for detection, but must be enabled via the
-    runtime environment (``ASAN_OPTIONS=detect_stack_use_after_return=1``).
+  * ``runtime``: Adds the code for detection, but it can be disable via the
+    runtime environment (``ASAN_OPTIONS=detect_stack_use_after_return=0``).
   * ``always``: Enables detection of UAR errors in all cases. (reduces code
     size, but not as much as ``never``).
 
 Memory leak detection
 ---------------------
 
 For more information on leak detector in AddressSanitizer, see
 :doc:`LeakSanitizer`. The leak detection is turned on by default on Linux,

compiler-rt/lib/asan/asan_flags.inc

 ASAN_FLAG(bool, check_initialization_order, false,
           "If set, attempts to catch initialization order issues.")
 ASAN_FLAG(
     bool, replace_str, true,
     "If set, uses custom wrappers and replacements for libc string functions "
     "to find more errors.")
 ASAN_FLAG(bool, replace_intrin, true,
           "If set, uses custom wrappers for memset/memcpy/memmove intrinsics.")
-ASAN_FLAG(bool, detect_stack_use_after_return, false,
+ASAN_FLAG(bool, detect_stack_use_after_return, true,
           "Enables stack-use-after-return checking at run-time.")
 ASAN_FLAG(int, min_uar_stack_size_log, 16, // We can't do smaller anyway.
           "Minimum fake stack size log.")
 ASAN_FLAG(int, max_uar_stack_size_log,
           20, // 1Mb per size class, i.e. ~11Mb per thread
           "Maximum fake stack size log.")
 ASAN_FLAG(bool, uar_noreserve, false,
           "Use mmap with 'noreserve' flag to allocate fake stack.")

compiler-rt/lib/asan/tests/asan_interface_test.cpp

for (size_t i = 0, n = pointers.size(); i < n; i++)
     free(pointers[i]);
 }
 
 TEST(AddressSanitizerInterface, HandleNoReturnTest) {
   char array[40];
   __asan_poison_memory_region(array, sizeof(array));
   BAD_ACCESS(array, 20);
   __asan_handle_no_return();
+  // Fake stack does not need to be unpoisoned.
+  if (__asan_get_current_fake_stack())
+    return;
   // It unpoisons the whole thread stack.
   GOOD_ACCESS(array, 20);
 }

compiler-rt/test/asan/TestCases/Posix/gc-test.cpp

 // RUN: %clangxx_asan %s -pthread -o %t
 // RUN: %env_asan_opts=detect_stack_use_after_return=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK1
 // RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK0
+// RUN: %run %t 2>&1 | FileCheck %s --check-prefix=CHECK1
 // RUN: %clangxx_asan -O3 %s -pthread -o %t
 // RUN: %env_asan_opts=detect_stack_use_after_return=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK1
 // RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK0
+// RUN: %run %t 2>&1 | FileCheck %s --check-prefix=CHECK1
 // REQUIRES: stable-runtime
 
 #include <assert.h>
 #include <stdio.h>
 #include <pthread.h>
 #include <sanitizer/asan_interface.h>
 
 static const int kNumThreads = 2;

compiler-rt/test/asan/TestCases/Posix/stack-use-after-return.cpp

 // RUN: %clangxx_asan  -O0 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O1 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O2 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O3 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
+// RUN: not %run %t 2>&1 | FileCheck %s
 // RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t
 // RUN: %clangxx_asan  -O0 %s -pthread -o %t -fsanitize-address-use-after-return=always && not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O1 %s -pthread -o %t -fsanitize-address-use-after-return=always && not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O2 %s -pthread -o %t -fsanitize-address-use-after-return=always && not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O3 %s -pthread -o %t -fsanitize-address-use-after-return=always && not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O3 %s -pthread -o %t -fsanitize-address-use-after-return=never && %run %t
 // Regression test for a CHECK failure with small stack size and large frame.
 // RUN: %clangxx_asan  -O3 %s -pthread -o %t -DkSize=10000 -DUseThread -DkStackSize=131072 && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck --check-prefix=THREAD %s

compiler-rt/test/asan/TestCases/Posix/unpoison-alternate-stack.cpp

 // Tests that __asan_handle_no_return properly unpoisons the signal alternate
 // stack.
 
 // Don't optimize, otherwise the variables which create redzones might be
 // dropped.
 // RUN: %clangxx_asan -fexceptions -O0 %s -o %t -pthread
-// RUN: %run %t
+// RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t
 
 #include <algorithm>
 #include <cassert>
 #include <cerrno>
 #include <csetjmp>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>

compiler-rt/test/asan/TestCases/Windows/stack_use_after_return.cpp

 // RUN: %clang_cl_asan -Od %s -Fe%t
 // RUN: %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
+// RUN: not %run %t 2>&1 | FileCheck %s
 // RUN: %clang_cl_asan -Od %s -Fe%t -fsanitize-address-use-after-return=always
 // RUN: not %run %t 2>&1 | FileCheck %s
 
 char *x;
 
 void foo() {
   char stack_buffer[42];
   x = &stack_buffer[13];

compiler-rt/test/asan/TestCases/alloca_loop_unpoisoning.cpp

 // RUN: %clangxx_asan -O0 -mllvm -asan-instrument-dynamic-allocas %s -o %t
-// RUN: %run %t 2>&1
+// RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t 2>&1
 //
 // REQUIRES: stable-runtime
 
 // This testcase checks that allocas and VLAs inside loop are correctly unpoisoned.
 
 #include <assert.h>
 #include <stdint.h>
 #include <stdlib.h>

compiler-rt/test/asan/TestCases/contiguous_container.cpp

-// RUN: %clangxx_asan -fexceptions -O %s -o %t && %run %t
+// RUN: %clangxx_asan -fexceptions -O %s -o %t && %env_asan_opts=detect_stack_use_after_return=0 %run %t
 //
 // Test __sanitizer_annotate_contiguous_container.
 
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 #include <assert.h>
 #include <sanitizer/asan_interface.h>

compiler-rt/test/asan/TestCases/handle_noreturn_bug.cpp

 // Regression test: __asan_handle_no_return should unpoison stack even with poison_heap=0.
 // Fails with debug checks: https://bugs.llvm.org/show_bug.cgi?id=46862
 // XFAIL: !compiler-rt-optimized
-// RUN: %clangxx_asan -O0 %s -o %t && \
-// RUN: %env_asan_opts=poison_heap=1 %run %t && \
-// RUN: %env_asan_opts=poison_heap=0 %run %t
+// RUN: %clangxx_asan -O0 %s -o %t
+// RUN: %env_asan_opts=detect_stack_use_after_return=0:poison_heap=1 %run %t
+// RUN: %env_asan_opts=detect_stack_use_after_return=0:poison_heap=0 %run %t
 
 #include <sanitizer/asan_interface.h>
 
 int main(int argc, char **argv) {
   int x[2];
   int * volatile p = &x[0];
   __asan_handle_no_return();
   int volatile z = p[2];
 }

compiler-rt/test/asan/TestCases/heavy_uar_test.cpp

-// RUN: %clangxx_asan -O0 %s -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
-// RUN: %clangxx_asan -O2 %s -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s
+// RUN: %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan -O2 %s -o %t && not %run %t 2>&1 | FileCheck %s
+// RUN: %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan -O0 %s -o %t -fsanitize-address-use-after-return=always && not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan -O2 %s -o %t -fsanitize-address-use-after-return=always && not %run %t 2>&1 | FileCheck %s
 // XFAIL: windows-msvc
 
 // FIXME: Fix this test under GCC.
 // REQUIRES: Clang
 
 // FIXME: Fix this test for dynamic runtime on arm linux.

compiler-rt/test/asan/TestCases/intercept-rethrow-exception.cpp

 // Regression test for
 // https://bugs.llvm.org/show_bug.cgi?id=32434
 
 // REQUIRES: shared_cxxabi
 
 // RUN: %clangxx_asan -fexceptions -O0 %s -o %t
-// RUN: %run %t
+// RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t
 
 // The current implementation of this functionality requires special
 // combination of libraries that are not used by default on NetBSD
 // XFAIL: netbsd
 // FIXME: Bug 42703
 // XFAIL: solaris
 
 // https://reviews.llvm.org/D111703 made compiler incompatible with released NDK.

compiler-rt/test/asan/TestCases/invalid-pointer-pairs-subtract-success.cpp

 // RUN: %clangxx_asan -O0 %s -o %t -mllvm -asan-detect-invalid-pointer-pair
 
 // RUN: %env_asan_opts=detect_invalid_pointer_pairs=2 %run %t
-// RUN: %env_asan_opts=detect_invalid_pointer_pairs=2,detect_stack_use_after_return=1 %run %t
+// RUN: %env_asan_opts=detect_invalid_pointer_pairs=2,detect_stack_use_after_return=0 %run %t
 
 #include <assert.h>
 #include <stdlib.h>
 
 int bar(char *p, char *q) {
   return p - q;
 }
 

llvm/include/llvm/Transforms/Instrumentation/AddressSanitizerOptions.h

enum class AsanDtorKind {
   None,    ///< Do not emit any destructors for ASan
   Global,  ///< Append to llvm.global_dtors
   Invalid, ///< Not a valid destructor Kind.
 };
 
 /// Mode of ASan detect stack use after return
 enum class AsanDetectStackUseAfterReturnMode {
   Never,   ///< Never detect stack use after return.
-  Runtime, ///< Detect stack use after return if runtime flag is enabled
-           ///< (ASAN_OPTIONS=detect_stack_use_after_return=1)
+  Runtime, ///< Detect stack use after return if not disabled runtime with
+           ///< (ASAN_OPTIONS=detect_stack_use_after_return=0).
   Always,  ///< Always detect stack use after return.
   Invalid, ///< Not a valid detect mode.
 };
 
 } // namespace llvm
 
 #endif