[HWASan] rename left/right to before/after.

[fmayer]

Summary

left/right is a weird way to refer to address ordering.

[fmayer]

This comment was removed by fmayer.

[fmayer]

Ping

[eugenis]

LGTM

compiler-rt/lib/hwasan/hwasan_flags.inc

 
 HWASAN_FLAG(
     int, max_malloc_fill_size, 0,
     "HWASan allocator flag. max_malloc_fill_size is the maximal amount of "
     "bytes that will be filled with malloc_fill_byte on malloc.")
 
 HWASAN_FLAG(bool, free_checks_tail_magic, 1,
     "If set, free() will check the magic values "
-    "to the right of the allocated object "
+    "after the allocated object "
     "if the allocation size is not a divident of the granule size")
 HWASAN_FLAG(
     int, max_free_fill_size, 0,
     "HWASan allocator flag. max_free_fill_size is the maximal amount of "
     "bytes that will be filled with free_fill_byte during free.")
 HWASAN_FLAG(int, malloc_fill_byte, 0xbe,
           "Value used to fill the newly allocated memory.")
 HWASAN_FLAG(int, free_fill_byte, 0x55,

compiler-rt/lib/hwasan/hwasan_report.cpp

static void ShowHeapOrGlobalCandidate(uptr untagged_addr, tag_t *candidate,
   if (chunk.IsAllocated()) {
     uptr offset;
     const char *whence;
     if (untagged_addr < chunk.End() && untagged_addr >= chunk.Beg()) {
       offset = untagged_addr - chunk.Beg();
       whence = "inside";
     } else if (candidate == left) {
       offset = untagged_addr - chunk.End();
-      whence = "to the right of";
+      whence = "after";
     } else {
       offset = chunk.Beg() - untagged_addr;
-      whence = "to the left of";
+      whence = "before";
     }
     Printf("%s", d.Error());
     Printf("\nCause: heap-buffer-overflow\n");
     Printf("%s", d.Default());
     Printf("%s", d.Location());
-    Printf("%p is located %zd bytes %s %zd-byte region [%p,%p)\n",
+    Printf("%p is located %zd bytes %s a %zd-byte region [%p,%p)\n",
            untagged_addr, offset, whence, chunk.UsedSize(), chunk.Beg(),
            chunk.End());
     Printf("%s", d.Allocation());
     Printf("allocated here:\n");
     Printf("%s", d.Default());
     GetStackTraceFromId(chunk.GetAllocStackId()).Print();
     return;
   }
   // Check whether the address points into a loaded library. If so, this is
   // most likely a global variable.
   const char *module_name;
   uptr module_address;
   Symbolizer *sym = Symbolizer::GetOrInit();
   if (sym->GetModuleNameAndOffsetForPC(mem, &module_name, &module_address)) {
     Printf("%s", d.Error());
     Printf("\nCause: global-overflow\n");
     Printf("%s", d.Default());
     DataInfo info;
     Printf("%s", d.Location());
     if (sym->SymbolizeData(mem, &info) && info.start) {
       Printf(
-          "%p is located %zd bytes to the %s of %zd-byte global variable "
+          "%p is located %zd bytes %s a %zd-byte global variable "
           "%s [%p,%p) in %s\n",
           untagged_addr,
           candidate == left ? untagged_addr - (info.start + info.size)
                             : info.start - untagged_addr,
-          candidate == left ? "right" : "left", info.size, info.name,
+          candidate == left ? "after" : "before", info.size, info.name,
           info.start, info.start + info.size, module_name);
     } else {
       uptr size = GetGlobalSizeFromDescriptor(mem);
       if (size == 0)
         // We couldn't find the size of the global from the descriptors.
         Printf(
-            "%p is located to the %s of a global variable in "
+            "%p is located %s a global variable in "
             "\n    #0 0x%x (%s+0x%x)\n",
-            untagged_addr, candidate == left ? "right" : "left", mem,
+            untagged_addr, candidate == left ? "after" : "before", mem,
             module_name, module_address);
       else
         Printf(
-            "%p is located to the %s of a %zd-byte global variable in "
+            "%p is located %s a %zd-byte global variable in "
             "\n    #0 0x%x (%s+0x%x)\n",
-            untagged_addr, candidate == left ? "right" : "left", size, mem,
+            untagged_addr, candidate == left ? "after" : "before", size, mem,
             module_name, module_address);
     }
     Printf("%s", d.Default());
   }
 }
 
 void PrintAddressDescription(
     uptr tagged_addr, uptr access_size,
hwasanThreadList().VisitAllLiveThreads([&](Thread *t) {
     HeapAllocationRecord har;
     uptr ring_index, num_matching_addrs, num_matching_addrs_4b;
     if (FindHeapAllocation(t->heap_allocations(), tagged_addr, &har,
                            &ring_index, &num_matching_addrs,
                            &num_matching_addrs_4b)) {
       Printf("%s", d.Error());
       Printf("\nCause: use-after-free\n");
       Printf("%s", d.Location());
-      Printf("%p is located %zd bytes inside of %zd-byte region [%p,%p)\n",
+      Printf("%p is located %zd bytes inside a %zd-byte region [%p,%p)\n",
              untagged_addr, untagged_addr - UntagAddr(har.tagged_addr),
              har.requested_size, UntagAddr(har.tagged_addr),
              UntagAddr(har.tagged_addr) + har.requested_size);
       Printf("%s", d.Allocation());
       Printf("freed by thread T%zd here:\n", t->unique_id());
       Printf("%s", d.Default());
       GetStackTraceFromId(har.free_context_id).Print();
 
void ReportTailOverwritten(StackTrace *stack, uptr tagged_addr, uptr orig_size,
   s.append("\n");
   s.append("               ");
   for (uptr i = 0; i < kShadowAlignment - tail_size; i++)
     s.append("   ");
   for (uptr i = 0; i < tail_size; i++)
     s.append("%s ", actual_expected[i] != tail[i] ? "^^" : "  ");
 
   s.append("\nThis error occurs when a buffer overflow overwrites memory\n"
-    "to the right of a heap object, but within the %zd-byte granule, e.g.\n"
+    "after a heap object, but within the %zd-byte granule, e.g.\n"
     "   char *x = new char[20];\n"
     "   x[25] = 42;\n"
     "%s does not detect such bugs in uninstrumented code at the time of write,"
     "\nbut can detect them at the time of free/delete.\n"
     "To disable this feature set HWASAN_OPTIONS=free_checks_tail_magic=0\n",
     kShadowAlignment, SanitizerToolName);
   Printf("%s", s.data());
   GetCurrentThread()->Announce();

compiler-rt/lib/hwasan/scripts/hwasan_symbolize

if match:
         obj_offset = (self.__last_access_address - fp - frame_offset) & fp_mask
         if obj_offset >= size:
           continue
         tag_offset = local[5]
         if not ignore_tags and (tag_offset is None or base_tag ^ tag_offset != self.__last_access_tag):
           continue
         self.print('')
         self.print('Potentially referenced stack object:')
-        self.print('  %d bytes inside variable "%s" in stack frame of function "%s"' % (obj_offset, local[2], local[0]))
+        self.print('  %d bytes inside a variable "%s" in stack frame of function "%s"' % (obj_offset, local[2], local[0]))
         self.print('  at %s' % (local[1],))
       return True
     return False
 
 def extract_version(s):
   idx = s.rfind('-')
   if idx == -1:
     return 0

compiler-rt/test/hwasan/TestCases/global-with-reduction.c

#else // USE_NOSANITIZE
   static int x = 1;
 #endif // USE_NOSANITIZE
   if (x == 1) x = 0;
   return &x;
 }
 
 int main(int argc, char **argv) {
   // CHECK: Cause: global-overflow
-  // RSYM: is located 0 bytes to the right of 4-byte global variable f.x {{.*}} in {{.*}}global-with-reduction.c.tmp
-  // RNOSYM: is located to the right of a 4-byte global variable in
+  // RSYM: is located 0 bytes after a 4-byte global variable f.x {{.*}} in {{.*}}global-with-reduction.c.tmp
+  // RNOSYM: is located after a 4-byte global variable in
   // RNOSYM-NEXT: #0 0x{{.*}} ({{.*}}global-with-reduction.c.tmp+{{.*}})
-  // LSYM: is located 4 bytes to the left of 4-byte global variable f.x {{.*}} in {{.*}}global-with-reduction.c.tmp
-  // LNOSYM: is located to the left of a 4-byte global variable in
+  // LSYM: is located 4 bytes before a 4-byte global variable f.x {{.*}} in {{.*}}global-with-reduction.c.tmp
+  // LNOSYM: is located before a 4-byte global variable in
   // LNOSYM-NEXT: #0 0x{{.*}} ({{.*}}global-with-reduction.c.tmp+{{.*}})
   // CHECK-NOT: can not describe
   f()[atoi(argv[1])] = 1;
 }

compiler-rt/test/hwasan/TestCases/global.c

 int x = 1;
 #endif // USE_NOSANITIZE
 int b = 1;
 
 int atoi(const char *);
 
 int main(int argc, char **argv) {
   // CHECK: Cause: global-overflow
-  // RSYM: is located 0 bytes to the right of 4-byte global variable x {{.*}} in {{.*}}global.c.tmp
-  // RNOSYM: is located to the right of a 4-byte global variable in
+  // RSYM: is located 0 bytes after a 4-byte global variable x {{.*}} in {{.*}}global.c.tmp
+  // RNOSYM: is located after a 4-byte global variable in
   // RNOSYM-NEXT: #0 0x{{.*}} ({{.*}}global.c.tmp+{{.*}})
-  // LSYM: is located 4 bytes to the left of 4-byte global variable x {{.*}} in {{.*}}global.c.tmp
-  // LNOSYM: is located to the left of a 4-byte global variable in
+  // LSYM: is located 4 bytes before a 4-byte global variable x {{.*}} in {{.*}}global.c.tmp
+  // LNOSYM: is located before a 4-byte global variable in
   // LNOSYM-NEXT: #0 0x{{.*}} ({{.*}}global.c.tmp+{{.*}})
   // CHECK-NOT: can not describe
   (&x)[atoi(argv[1])] = 1;
 }

compiler-rt/test/hwasan/TestCases/heap-buffer-overflow-into.c

if (argc < 2) {
     fprintf(stderr, "Invalid number of arguments.");
     abort();
   }
   int read_offset = argc < 2 ? 5 : atoi(argv[1]);
   int size = argc < 3 ? 10 : atoi(argv[2]);
   char *volatile x = (char *)malloc(size);
   memset(x + read_offset, 0, 26);
   // CHECK5: Invalid access starting at offset 5
-  // CHECK5: is located 5 bytes inside 10-byte region
+  // CHECK5: is located 5 bytes inside a 10-byte region
   // CHECK7: Invalid access starting at offset 3
-  // CHECK7: is located 7 bytes inside 10-byte region
+  // CHECK7: is located 7 bytes inside a 10-byte region
   // CHECK8: Invalid access starting at offset 12
-  // CHECK8: is located 8 bytes inside 20-byte region
-  // CHECK32: is located 12 bytes to the right of 20-byte region
+  // CHECK8: is located 8 bytes inside a 20-byte region
+  // CHECK32: is located 12 bytes after a 20-byte region
   free(x);
 }

compiler-rt/test/hwasan/TestCases/heap-buffer-overflow.c

if (size == 1000000) {
     fprintf(stderr, "is located %s of 1000000-byte region\n",
             offset == -30 ? "30 bytes to the left" : "0 bytes to the right");
     return -1;
   }
 #endif
 
 // CHECK40: allocated heap chunk; size: 32 offset: 8
 // CHECK40: Cause: heap-buffer-overflow
-// CHECK40: is located 10 bytes to the right of 30-byte region
+// CHECK40: is located 10 bytes after a 30-byte region
 //
 // CHECK80: allocated heap chunk; size: 32 offset: 16
 // CHECK80: Cause: heap-buffer-overflow
-// CHECK80: is located 50 bytes to the right of 30-byte region
+// CHECK80: is located 50 bytes after a 30-byte region
 //
 // CHECKm30: Cause: heap-buffer-overflow
-// CHECKm30: is located 30 bytes to the left of 30-byte region
+// CHECKm30: is located 30 bytes before a 30-byte region
 //
 // CHECKMm30: is a large allocated heap chunk; size: 1003520 offset: -30
 // CHECKMm30: Cause: heap-buffer-overflow
-// CHECKMm30: is located 30 bytes to the left of 1000000-byte region
+// CHECKMm30: is located 30 bytes before a 1000000-byte region
 //
 // CHECKM: is a large allocated heap chunk; size: 1003520 offset: 1000000
 // CHECKM: Cause: heap-buffer-overflow
-// CHECKM: is located 0 bytes to the right of 1000000-byte region
+// CHECKM: is located 0 bytes after a 1000000-byte region
 //
 // CHECK31: tags: [[TAG:..]]/0e([[TAG]]) (ptr/mem)
 // CHECK31-NOT: Invalid access starting at offset
 // CHECK31: Cause: heap-buffer-overflow
-// CHECK31: is located 1 bytes to the right of 30-byte region
+// CHECK31: is located 1 bytes after a 30-byte region
 // CHECK31: Memory tags around the buggy address
 // CHECK31: [0e]
 // CHECK31: Tags for short granules around the buggy address
 // CHECK31: {{\[}}[[TAG]]]
 //
 // CHECK20-NOT: Invalid access starting at offset
 // CHECK20: Cause: heap-buffer-overflow
-// CHECK20: is located 10 bytes to the right of 20-byte region [0x{{.*}}0,0x{{.*}}4)
+// CHECK20: is located 10 bytes after a 20-byte region [0x{{.*}}0,0x{{.*}}4)
   free(x);
 }

compiler-rt/test/hwasan/TestCases/lto.c

 // Test globals with LTO, since it invokes the integrated assembler separately.
 // RUN: %clang_hwasan -flto %s -o %t
 // RUN: not %run %t 1 2>&1 | FileCheck %s
 
 // REQUIRES: pointer-tagging, x86_64-target-arch
 
 #include <stdlib.h>
 
 int x = 1;
 
 int main(int argc, char **argv) {
   // CHECK: Cause: global-overflow
-  // CHECK: is located 0 bytes to the right of 4-byte global variable x {{.*}} in {{.*}}lto.c.tmp
+  // CHECK: is located 0 bytes after a 4-byte global variable x {{.*}} in {{.*}}lto.c.tmp
   // CHECK-NOT: can not describe
   (&x)[atoi(argv[1])] = 1;
 }

compiler-rt/test/hwasan/TestCases/tag_in_free.c

int main() {
   for (int i = 0; i < 100; ++i) {
     char * volatile p = (char*)malloc(10);
     free(p);
   }
 
   char * volatile p = (char*)malloc(10);
 #ifdef MALLOC
   // MALLOC: READ of size 1 at
-  // MALLOC: is located 6 bytes to the right of 10-byte region
+  // MALLOC: is located 6 bytes after a 10-byte region
   // MALLOC: allocated here:
   char volatile x = p[16];
 #endif
   free(p);
 #ifdef FREE
   // FREE: READ of size 1 at
-  // FREE: is located 0 bytes inside of 10-byte region
+  // FREE: is located 0 bytes inside a 10-byte region
   // FREE: freed by thread T0 here:
   // FREE: previously allocated here:
   char volatile y = p[0];
 #endif
 
   __hwasan_disable_allocator_tagging();
 
   return 0;
 }

compiler-rt/test/hwasan/TestCases/use-after-free.c

int main() {
   // CHECK: [[TYPE]] of size 1 at {{.*}} tags: [[PTR_TAG:[0-9a-f][0-9a-f]]]/[[MEM_TAG:[0-9a-f][0-9a-f]]] (ptr/mem)
   // CHECK: #{{[0-9]}} {{[0-9]+}}{{.*}}[[PC]]
   // If we instrument using calls (default on x86), main is not the top frame
   // of the fault.
   // CHECK: in main {{.*}}use-after-free.c:[[@LINE-6]]
   // Offset is 5 or 11 depending on left/right alignment.
   // CHECK: is a small unallocated heap chunk; size: 32 offset: {{5|11}}
   // CHECK: Cause: use-after-free
-  // CHECK: is located 5 bytes inside of 10-byte region
+  // CHECK: is located 5 bytes inside a 10-byte region
   //
   // CHECK: freed by thread {{.*}} here:
   // CHECK: #0 {{.*}} in {{.*}}free{{.*}} {{.*}}hwasan_allocation_functions.cpp
   // CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-19]]
 
   // CHECK: previously allocated here:
   // CHECK: #0 {{.*}} in {{.*}}malloc{{.*}} {{.*}}hwasan_allocation_functions.cpp
   // CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-24]]
   // CHECK: Memory tags around the buggy address (one tag corresponds to 16 bytes):
   // CHECK: =>{{.*}}[[MEM_TAG]]
   // CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch
   return r;
 }

compiler-rt/test/hwasan/TestCases/wild-free-close.c

 // RUN: %clang_hwasan %s -o %t && not %run %t 2>&1 | FileCheck %s
 
 #include <stdio.h>
 #include <stdlib.h>
 
 #include <sanitizer/hwasan_interface.h>
 
 int main() {
   __hwasan_enable_allocator_tagging();
   char *p = (char *)malloc(1);
   fprintf(stderr, "ALLOC %p\n", __hwasan_tag_pointer(p, 0));
   // CHECK: ALLOC {{[0x]+}}[[ADDR:.*]]
   free(p - 8);
   // CHECK: ERROR: HWAddressSanitizer: invalid-free on address {{.*}} at pc {{[0x]+}}[[PC:.*]] on thread T{{[0-9]+}}
   // CHECK: #0 {{[0x]+}}{{.*}}[[PC]] in {{.*}}free
   // CHECK: #1 {{.*}} in main {{.*}}wild-free-close.c:[[@LINE-3]]
-  // CHECK: is located 8 bytes to the left of 1-byte region [{{[0x]+}}{{.*}}[[ADDR]]
+  // CHECK: is located 8 bytes before a 1-byte region [{{[0x]+}}{{.*}}[[ADDR]]
   // CHECK-NOT: Segmentation fault
   // CHECK-NOT: SIGSEGV
   return 0;
 }