[asan] Add unaligned double ended container support

[vitalybuka]

rebase

[kstoimenov]

compiler-rt/test/asan/TestCases/contiguous_container.cpp

1

Should we also turn on explicitly -fsanitize=alignment to make sure that it works when alignment checks are on? Also make sure that the data that we are passing in is not aligned?

[vitalybuka]

compiler-rt/test/asan/TestCases/contiguous_container.cpp

1

Probably no, I don't expect anything special from alignment checks.

[AdvenamTacet]

D138771 LGTM; I was looking on a support for unaligned double ended containers (with shared granules) in parallel, so I tested that implementation on an alternative test case I wrote independently.

Btw. I think compiler-rt/test/asan/TestCases/contiguous_container.cpp deserves a variable name refactor, but that's for another patch/revision.

compiler-rt/lib/asan/asan_poisoning.cpp

 }
 
 void __asan_unpoison_stack_memory(uptr addr, uptr size) {
   VReport(1, "unpoisoning: %p %zx\n", (void *)addr, size);
   PoisonAlignedStackMemory(addr, size, false);
 }
 
 static void FixUnalignedStorage(uptr storage_beg, uptr storage_end,
-                                uptr &old_end, uptr &new_end) {
+                                uptr &old_beg, uptr &old_end, uptr &new_beg,
+                                uptr &new_end) {
   constexpr uptr granularity = ASAN_SHADOW_GRANULARITY;
   if (UNLIKELY(!AddrIsAlignedByGranularity(storage_end))) {
     uptr end_down = RoundDownTo(storage_end, granularity);
     // Ignore the last unaligned granule if the storage is followed by
     // unpoisoned byte, because we can't poison the prefix anyway. Don't call
     // AddressIsPoisoned at all if container changes does not affect the last
     // granule at all.
-    if (Max(old_end, new_end) > end_down && !AddressIsPoisoned(storage_end)) {
+    if ((((old_end != new_end) && Max(old_end, new_end) > end_down) ||
+         ((old_beg != new_beg) && Max(old_beg, new_beg) > end_down)) &&
+        !AddressIsPoisoned(storage_end)) {
+      old_beg = Min(end_down, old_beg);
       old_end = Min(end_down, old_end);
+      new_beg = Min(end_down, new_beg);
       new_end = Min(end_down, new_end);
     }
   }
 
   // Handle misaligned begin and cut it off.
   if (UNLIKELY(!AddrIsAlignedByGranularity(storage_beg))) {
     uptr beg_up = RoundUpTo(storage_beg, granularity);
     // The first unaligned granule needs special handling only if we had bytes
     // there before and will have none after.
-    if (storage_beg == new_end && storage_beg != old_end &&
-        storage_beg < beg_up) {
+    if ((new_beg == new_end || new_beg >= beg_up) && old_beg != old_end &&
+        old_beg < beg_up) {
       // Keep granule prefix outside of the storage unpoisoned.
       uptr beg_down = RoundDownTo(storage_beg, granularity);
       *(u8 *)MemToShadow(beg_down) = storage_beg - beg_down;
+      old_beg = Max(beg_up, old_beg);
       old_end = Max(beg_up, old_end);
+      new_beg = Max(beg_up, new_beg);
       new_end = Max(beg_up, new_end);
     }
   }
 }
 
 void __sanitizer_annotate_contiguous_container(const void *beg_p,
                                                const void *end_p,
                                                const void *old_mid_p,
                                                const void *new_mid_p) {
   if (!flags()->detect_container_overflow)
     return;
   VPrintf(2, "contiguous_container: %p %p %p %p\n", beg_p, end_p, old_mid_p,
           new_mid_p);
   uptr storage_beg = reinterpret_cast<uptr>(beg_p);
   uptr storage_end = reinterpret_cast<uptr>(end_p);
   uptr old_end = reinterpret_cast<uptr>(old_mid_p);
   uptr new_end = reinterpret_cast<uptr>(new_mid_p);
+  uptr old_beg = storage_beg;
+  uptr new_beg = storage_beg;
   uptr granularity = ASAN_SHADOW_GRANULARITY;
   if (!(storage_beg <= old_end && storage_beg <= new_end &&
         old_end <= storage_end && new_end <= storage_end)) {
     GET_STACK_TRACE_FATAL_HERE;
     ReportBadParamsToAnnotateContiguousContainer(storage_beg, storage_end,
                                                  old_end, new_end, &stack);
   }
   CHECK_LE(storage_end - storage_beg,
            FIRST_32_SECOND_64(1UL << 30, 1ULL << 40));  // Sanity check.
 
   if (old_end == new_end)
     return;  // Nothing to do here.
 
-  FixUnalignedStorage(storage_beg, storage_end, old_end, new_end);
+  FixUnalignedStorage(storage_beg, storage_end, old_beg, old_end, new_beg,
+                      new_end);
 
   uptr a = RoundDownTo(Min(old_end, new_end), granularity);
   uptr c = RoundUpTo(Max(old_end, new_end), granularity);
   uptr d1 = RoundDownTo(old_end, granularity);
   // uptr d2 = RoundUpTo(old_mid, granularity);
   // Currently we should be in this state:
   // [a, d1) is good, [d2, c) is bad, [d1, d2) is partially good.
   // Make a quick sanity check that we are indeed in this state.
void __sanitizer_annotate_double_ended_contiguous_container(
   }
   CHECK_LE(storage_end - storage_beg,
            FIRST_32_SECOND_64(1UL << 30, 1ULL << 40));  // Sanity check.
 
   if ((old_beg == old_end && new_beg == new_end) ||
       (old_beg == new_beg && old_end == new_end))
     return;  // Nothing to do here.
 
-  // Right now, the function does not support:
-  // - unaligned storage beginning
-  // - situations when container ends in the middle of granule
-  // (storage_end is unaligned by granularity)
-  //  and shares that granule with a different object.
-  if (!AddrIsAlignedByGranularity(storage_beg))
-    return;
+  FixUnalignedStorage(storage_beg, storage_end, old_beg, old_end, new_beg,
+                      new_end);
 
   if (old_beg == old_end) {
     old_beg = old_end = new_beg;
   } else if (new_end <= old_beg || old_end <= new_beg || new_beg == new_end) {
     // Poisoining whole memory.
     uptr a = RoundDownTo(old_beg, granularity);
     uptr b = RoundUpTo(old_end, granularity);
     PoisonShadow(a, b - a, kAsanContiguousContainerOOBMagic);

compiler-rt/test/asan/TestCases/contiguous_container.cpp

 // RUN: %clangxx_asan -fexceptions -O %s -o %t && %env_asan_opts=detect_stack_use_after_return=0 %run %t
 //
 // Test __sanitizer_annotate_contiguous_container.
 
 #include <algorithm>
 #include <vector>
 
 #include <assert.h>
 #include <sanitizer/asan_interface.h>
for (int j = i; j <= capacity; j++) {
       char *cur_last = std::min(end + 2 * kGranularity, st_end);
       for (char *cur = cur_first; cur <= cur_last; ++cur) {
         bool is_valid = __sanitizer_verify_double_ended_contiguous_container(
             st_beg, beg, cur, st_end);
         const void *bad_address =
             __sanitizer_double_ended_contiguous_container_find_bad_address(
                 st_beg, beg, cur, st_end);
 
-        if (cur == end) {
+        if (cur == end ||
+            // The last unaligned granule of the storage followed by unpoisoned
+            // bytes looks the same.
+            (!poison_buffer && RoundDown(st_end) <= std::min(cur, end))) {
           assert(is_valid);
           assert(!bad_address);
           continue;
         }
 
         assert(!is_valid);
         assert(bad_address);
         assert(bad_address ==
                st_beg + GetFirstMissmatch(masks[i][j], masks[i][cur - st_beg]));
       }
 
       // Try to missmatch the begin of the container.
       cur_first = std::max(beg - 2 * kGranularity, st_beg);
       cur_last = std::min(beg + 2 * kGranularity, end);
       for (char *cur = cur_first; cur <= cur_last; ++cur) {
         bool is_valid = __sanitizer_verify_double_ended_contiguous_container(
             st_beg, cur, end, st_end);
         const void *bad_address =
             __sanitizer_double_ended_contiguous_container_find_bad_address(
                 st_beg, cur, end, st_end);
 
         if (cur == beg ||
+            // The last unaligned granule of the storage followed by unpoisoned
+            // bytes looks the same.
+            (!poison_buffer && RoundDown(st_end) <= std::min(cur, beg) ||
              // The first unaligned granule of non-empty container looks the
              // same.
-            (std::max(beg, cur) < end && RoundDown(beg) == RoundDown(cur))) {
+             (std::max(beg, cur) < end && RoundDown(beg) == RoundDown(cur)))) {
           assert(is_valid);
           assert(!bad_address);
           continue;
         }
         assert(!is_valid);
         assert(bad_address);
         assert(bad_address ==
                st_beg + GetFirstMissmatch(masks[i][j], masks[cur - st_beg][j]));

 }
 
 int main(int argc, char **argv) {
   int n = argc == 1 ? 64 : atoi(argv[1]);
   for (int i = 0; i <= n; i++) {
     for (int j = 0; j < kGranularity * 2; j++) {
       for (int poison = 0; poison < 2; ++poison) {
         TestContainer(i, j, poison);
-        TestDoubleEndedContainer(i, 0, true);
+        TestDoubleEndedContainer(i, j, poison);
       }
     }
   }
   TestThrow();
 }