[asan] Allow reallocating uninstrumented pointers on Windows

[alvinhochun]

Summary

Asan have been ignoring deallocation of uninstrumented pointers since
https://reviews.llvm.org/D25946, but it did not do the same with
reallocation. Sometimes DLLs may reallocate memory allocated before asan
has been initialized, which can cause false asan reports, as stated in
https://github.com/llvm/llvm-project/issues/61685.

This change makes asan reallocation on Windows ignore pointers not
allocated by asan itself in the same way as deallocation does, for the
sake of consistency.

[alvinhochun]

WIP: Add test and make it work

[mstorsjo]

A couple issues with this patch...

When building for i386, I get the following build errors:

/home/martin/code/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_malloc_win.cpp:67:1: error: typedef redefinition with different types ('size_t (*)(void *)' (aka 'unsigned int (*)(void *)') vs 'SIZE_T (*)(void *)' (aka 'unsigned long (*)(void *)'))
DEFINE_REAL(size_t, _msize, void *ptr)
^
/home/martin/code/llvm-mingw/llvm-project/compiler-rt/lib/asan/../interception/interception.h:198:24: note: expanded from macro 'DEFINE_REAL'
    typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \
                       ^
/home/martin/code/llvm-mingw/llvm-project/compiler-rt/lib/asan/../interception/interception.h:163:23: note: expanded from macro 'FUNC_TYPE'
# define FUNC_TYPE(x) x##_type
                      ^
<scratch space>:103:1: note: expanded from here
_msize_type
^
/home/martin/code/llvm-mingw/llvm-project/compiler-rt/lib/asan/asan_interceptors.h:137:1: note: previous definition is here
DECLARE_REAL(SIZE_T, _msize, void *ptr)
^
/home/martin/code/llvm-mingw/llvm-project/compiler-rt/lib/asan/../interception/interception.h:166:24: note: expanded from macro 'DECLARE_REAL'
    typedef ret_type (*FUNC_TYPE(func))(__VA_ARGS__); \
                       ^
/home/martin/code/llvm-mingw/llvm-project/compiler-rt/lib/asan/../interception/interception.h:163:23: note: expanded from macro 'FUNC_TYPE'
# define FUNC_TYPE(x) x##_type
                      ^
<scratch space>:45:1: note: expanded from here
_msize_type
^
1 error generated.

When running tests with MSVC, I get the following failure:

$ ":" "RUN: at line 1"
$ "C:/code/llvm-mingw/llvm-project/llvm/build-msvc/./bin/clang.exe" "-g" "-shared" "C:\code\llvm-mingw\llvm-project\compiler-rt\test\asan\TestCases\Windows\dll_heap_allocation_realloc.cpp" "-o" "C:\code\llvm-mingw\llvm-project\llvm\build-msvc\projects\compiler-rt\test\asan\X86_64WindowsDynamicConfig\TestCases\Windows\Output\dll_heap_allocation_realloc.cpp.tmp-1.dll" "-DHEAP_LIBRARY=1" "-Wl,--exclude-all-symbols" "-Wl,--out-implib,C:\code\llvm-mingw\llvm-project\llvm\build-msvc\projects\compiler-rt\test\asan\X86_64WindowsDynamicConfig\TestCases\Windows\Output\dll_heap_allocation_realloc.cpp.tmp-1.dll.a"
# command output:
LINK : warning LNK4044: unrecognized option '/-exclude-all-symbols'; ignored
LINK : warning LNK4044: unrecognized option '/-out-implib'; ignored
LINK : fatal error LNK1104: cannot open file 'C:\code\llvm-mingw\llvm-project\llvm\build-msvc\projects\compiler-rt\test\asan\X86_64WindowsDynamicConfig\TestCases\Windows\Output\dll_heap_allocation_realloc.cpp.tmp-1.dll.a'

# command stderr:
clang: error: linker command failed with exit code 1104 (use -v to see invocation)

error: command failed with exit status: 0x450

[alvinhochun]

Fix test

[alvinhochun]

Fix non-Windows builds and try to "fix" tests for msvc

compiler-rt/lib/asan/asan_allocator.cpp

void *Reallocate(void *old_ptr, uptr new_size, BufferedStackTrace *stack) {
     AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg);
 
     AsanStats &thread_stats = GetCurrentThreadStats();
     thread_stats.reallocs++;
     thread_stats.realloced += new_size;
 
     void *new_ptr = Allocate(new_size, 8, stack, FROM_MALLOC, true);
     if (new_ptr) {
+#if SANITIZER_WINDOWS
+      // On Windows, uninstrumented DLLs may allocate memory before ASan hooks
+      // malloc. Don't report an invalid free in this case.
+      if (!get_allocator().PointerIsMine(old_ptr)) {
+        if (!IsSystemHeapAddress(p))
+          ReportFreeNotMalloced(p, stack);
+        CHECK_NE(REAL(memcpy), nullptr);
+        CHECK_NE(REAL(_msize), nullptr);
+        CHECK_NE(REAL(free), nullptr);
+        uptr memcpy_size = Min(new_size, REAL(_msize)(old_ptr));
+        REAL(memcpy)(new_ptr, old_ptr, memcpy_size);
+        REAL(free)(old_ptr);
+      } else
+#endif
+      {
         u8 chunk_state = atomic_load(&m->chunk_state, memory_order_acquire);
         if (chunk_state != CHUNK_ALLOCATED)
           ReportInvalidFree(old_ptr, chunk_state, stack);
         CHECK_NE(REAL(memcpy), nullptr);
         uptr memcpy_size = Min(new_size, m->UsedSize());
         // If realloc() races with free(), we may start copying freed memory.
         // However, we will report racy double-free later anyway.
         REAL(memcpy)(new_ptr, old_ptr, memcpy_size);
         Deallocate(old_ptr, 0, 0, stack, FROM_MALLOC);
       }
+    }
     return new_ptr;
   }
 
   void *Calloc(uptr nmemb, uptr size, BufferedStackTrace *stack) {
     if (UNLIKELY(CheckForCallocOverflow(size, nmemb))) {
       if (AllocatorMayReturnNull())
         return nullptr;
       ReportCallocOverflow(nmemb, size, stack);

compiler-rt/lib/asan/asan_interceptors.h

 
 DECLARE_REAL(int, memcmp, const void *a1, const void *a2, uptr size)
 DECLARE_REAL(char*, strchr, const char *str, int c)
 DECLARE_REAL(SIZE_T, strlen, const char *s)
 DECLARE_REAL(char*, strncpy, char *to, const char *from, uptr size)
 DECLARE_REAL(uptr, strnlen, const char *s, uptr maxlen)
 DECLARE_REAL(char*, strstr, const char *s1, const char *s2)
 
+#  if SANITIZER_WINDOWS
+DECLARE_REAL(SIZE_T, _msize, void *ptr)
+DECLARE_REAL(void, free, void *ptr)
+#  endif
+
 #  if !SANITIZER_APPLE
 #    define ASAN_INTERCEPT_FUNC(name)                                        \
       do {                                                                   \
         if (!INTERCEPT_FUNCTION(name))                                       \
           VReport(1, "AddressSanitizer: failed to intercept '%s'\n", #name); \
       } while (0)
 #    define ASAN_INTERCEPT_FUNC_VER(name, ver)                           \
       do {                                                               \

compiler-rt/lib/asan/asan_malloc_win.cpp

 // so we have to intercept them before they are called for the first time.
 
 #if ASAN_DYNAMIC
 # define ALLOCATION_FUNCTION_ATTRIBUTE
 #else
 # define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
 #endif
 
+DEFINE_REAL(SIZE_T, _msize, void *ptr)
+DEFINE_REAL(void, free, void *ptr)
+
 extern "C" {
 ALLOCATION_FUNCTION_ATTRIBUTE
 size_t _msize(void *ptr) {
   GET_CURRENT_PC_BP_SP;
   (void)sp;
   return asan_malloc_usable_size(ptr, pc, bp);
 }
 
INTERCEPTOR_WINAPI(size_t, HeapSize, HANDLE hHeap, DWORD dwFlags,
   // If the RTL allocators are hooked we need to check whether the ASAN
   // allocator owns the pointer we're about to use. Allocations occur before
   // interception takes place, so if it is not owned by the RTL heap we can
   // pass it to the ASAN heap for inspection.
   if (flags()->windows_hook_rtl_allocators) {
     if (!asan_inited || OWNED_BY_RTL(hHeap, lpMem))
       return REAL(HeapSize)(hHeap, dwFlags, lpMem);
   } else {
+    if (!__sanitizer_get_ownership(lpMem))
+      return REAL(HeapSize)(hHeap, dwFlags, lpMem);
     CHECK(dwFlags == 0 && "unsupported heap flags");
   }
   GET_CURRENT_PC_BP_SP;
   (void)sp;
   return asan_malloc_usable_size(lpMem, pc, bp);
 }
 
 INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags,
INTERCEPTOR_WINAPI(void*, RtlReAllocateHeap, HANDLE HeapHandle, DWORD Flags,
 
   return SharedReAlloc(REAL(RtlReAllocateHeap), REAL(RtlSizeHeap),
                        REAL(RtlFreeHeap), REAL(RtlAllocateHeap), HeapHandle,
                        Flags, BaseAddress, Size);
 }
 
 namespace __asan {
 
-static void TryToOverrideFunction(const char *fname, uptr new_func) {
+static void TryToOverrideFunction(const char *fname, uptr new_func, uptr *orig_old_func = 0) {
   // Failure here is not fatal. The CRT may not be present, and different CRT
   // versions use different symbols.
-  if (!__interception::OverrideFunction(fname, new_func))
+  if (!__interception::OverrideFunction(fname, new_func, orig_old_func))
     VPrintf(2, "Failed to override function %s\n", fname);
 }
 
 void ReplaceSystemMalloc() {
 #if defined(ASAN_DYNAMIC)
-  TryToOverrideFunction("free", (uptr)free);
+  TryToOverrideFunction("free", (uptr)free, (uptr *)&REAL(free));
   TryToOverrideFunction("_free_base", (uptr)free);
   TryToOverrideFunction("malloc", (uptr)malloc);
   TryToOverrideFunction("_malloc_base", (uptr)malloc);
   TryToOverrideFunction("_malloc_crt", (uptr)malloc);
   TryToOverrideFunction("calloc", (uptr)calloc);
   TryToOverrideFunction("_calloc_base", (uptr)calloc);
   TryToOverrideFunction("_calloc_crt", (uptr)calloc);
   TryToOverrideFunction("realloc", (uptr)realloc);
   TryToOverrideFunction("_realloc_base", (uptr)realloc);
   TryToOverrideFunction("_realloc_crt", (uptr)realloc);
   TryToOverrideFunction("_recalloc", (uptr)_recalloc);
   TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);
   TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);
-  TryToOverrideFunction("_msize", (uptr)_msize);
+  TryToOverrideFunction("_msize", (uptr)_msize, (uptr *)&REAL(_msize));
   TryToOverrideFunction("_msize_base", (uptr)_msize);
   TryToOverrideFunction("_expand", (uptr)_expand);
   TryToOverrideFunction("_expand_base", (uptr)_expand);
 
   if (flags()->windows_hook_rtl_allocators) {
     INTERCEPT_FUNCTION(HeapSize);
     INTERCEPT_FUNCTION(HeapFree);
     INTERCEPT_FUNCTION(HeapReAlloc);

compiler-rt/test/asan/TestCases/Windows/dll_heap_allocation_realloc.cpp

+// RUN: %clangxx -g -shared %s -o %t-1.dll -DHEAP_LIBRARY=1 -Wl,--exclude-all-symbols -Wl,--out-implib,%t-1.dll.a \
+// RUN: || %clang_cl -LD %s -Fe%t-1.dll -DHEAP_LIBRARY=1 -MD
+// RUN: %clangxx_asan -shared %s -o %t-2.dll -DHEAP_LIBRARY=2 -Wl,--exclude-all-symbols -Wl,--out-implib,%t-2.dll.a \
+// RUN: || %clang_cl -LD %s -Fe%t-2.dll -DHEAP_LIBRARY=2 -fsanitize=address -MD
+// RUN: %clangxx -g %s %t-1.dll.a %t-2.dll.a -o %t \
+// RUN: || %clang_cl %s %t-1.lib %t-2.lib -Fe%t -MT
+// RUN: %run %t 2>&1 | FileCheck %s
+
+// Check that ASan does not fail when realloc-ing allocations that occurred
+// within an uninstrumented DLL.
+
+#if HEAP_LIBRARY == 1
+
+#  include <stdlib.h>
+#  include <windows.h>
+
+__declspec(dllexport) int *myglobal = [] {
+  auto *p = reinterpret_cast<int *>(malloc(sizeof(int)));
+  *p = 42;
+  return p;
+}();
+BOOL WINAPI DllMain(PVOID h, DWORD reason, PVOID reserved) { return TRUE; }
+
+#elif HEAP_LIBRARY == 2
+
+#  include <windows.h>
+
+// This export is only to force linking of the DLL.
+__declspec(dllexport) int g_heap_library_2 = 0;
+BOOL WINAPI DllMain(PVOID h, DWORD reason, PVOID reserved) { return TRUE; }
+
+#else
+
+#  include <stdio.h>
+#  include <stdlib.h>
+
+__declspec(dllimport) extern int *myglobal;
+__declspec(dllimport) int g_heap_library_2;
+int main(int argc, char **argv) {
+  g_heap_library_2++;
+  myglobal = reinterpret_cast<int *>(realloc(myglobal, sizeof(int) * 2));
+  printf("myglobal: %d\n", *myglobal);
+  return 0;
+}
+
+#endif
+
+// CHECK-NOT: ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed
+// CHECK: myglobal: 42