[hwasan] fix false positive when hwasan-match-all-tag flag is enabled and short granules are used

[Enna1]

Summary

When hwasan-match-all-tag flag is enabled and short granules are used, at the point checking if this is a short tag case, the tag from pointer is stored in X16 register,
which breaks the assumption that tag from shadow memory is stored in X16 register, this will cause a false positive.

[Enna1]

update

[Enna1]

update

[Enna1]

update

[vitalybuka]

compiler-rt/test/hwasan/TestCases/short-granule-and-match-all-tag.cpp

2–19

exit 0 is enough for this test

llvm/test/CodeGen/AArch64/hwasan-check-memaccess.ll

115

can you please precommit this test with the current state of HWASAN, so we can see a difference here

[Enna1]

• only test

[Enna1]

UNSUPPORTED: HWAddressSanitizer-x86_64 :: TestCases/short-granule-and-match-all-tag.cpp (19669 of 70430)

Pre-merge checks buildbot does not support HWASAN test, so we can not see this test failure in premerge checks .
Do you mean I create another differential only containing this testcase, commit it to llvm trunk and check if sanitizer-aarch64-linux-bootstrap-hwasan(https://lab.llvm.org/buildbot/#/builders/236) will fail?

[vitalybuka]

In D149252#4301314, @Enna1 wrote:

UNSUPPORTED: HWAddressSanitizer-x86_64 :: TestCases/short-granule-and-match-all-tag.cpp (19669 of 70430)

Pre-merge checks buildbot does not support HWASAN test, so we can not see this test failure in premerge checks .
Do you mean I create another differential only containing this testcase, commit it to llvm trunk and check if sanitizer-aarch64-linux-bootstrap-hwasan(https://lab.llvm.org/buildbot/#/builders/236) will fail?

Sorry, I was asking to precommit hwasan-check-accessible with checks generated for that current state of LLVM
short-granule-and-match-all-tag.cpp should stay in the main patch

[Enna1]

update

[Enna1]

update

compiler-rt/test/hwasan/TestCases/short-granule-and-match-all-tag.cpp

+// RUN: %clang_hwasan %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+#include <sanitizer/hwasan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+  __hwasan_enable_allocator_tagging();
+  fprintf(stderr, "main\n");
+  char *x = (char *)malloc(40);
+  char volatile z = *x;
+  free(x);
+  return 0;
+}
+
+// CHECK: main
+// CHECK-NOT: ERROR: HWAddressSanitizer: tag-mismatch on address {{.*}} at pc {{[0x]+}}
+// CHECK-NOT: WRITE of size 1 {{.*}} in thread T0

llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp

for (auto &P : HwasanMemaccessSymbols) {
     MCSymbol *ReturnSym = OutContext.createTempSymbol();
     OutStreamer->emitLabel(ReturnSym);
     OutStreamer->emitInstruction(
         MCInstBuilder(AArch64::RET).addReg(AArch64::LR), *STI);
     OutStreamer->emitLabel(HandleMismatchOrPartialSym);
 
     if (HasMatchAllTag) {
       OutStreamer->emitInstruction(MCInstBuilder(AArch64::UBFMXri)
-                                       .addReg(AArch64::X16)
+                                       .addReg(AArch64::X17)
                                        .addReg(Reg)
                                        .addImm(56)
                                        .addImm(63),
                                    *STI);
       OutStreamer->emitInstruction(MCInstBuilder(AArch64::SUBSXri)
                                        .addReg(AArch64::XZR)
-                                       .addReg(AArch64::X16)
+                                       .addReg(AArch64::X17)
                                        .addImm(MatchAllTag)
                                        .addImm(0),
                                    *STI);
       OutStreamer->emitInstruction(
           MCInstBuilder(AArch64::Bcc)
               .addImm(AArch64CC::EQ)
               .addExpr(MCSymbolRefExpr::create(ReturnSym, OutContext)),
           *STI);

llvm/test/CodeGen/AArch64/hwasan-check-memaccess.ll

 }
 
 define void @f3(ptr %x0, ptr %x1) {
   ; 0x3ff0000 (kernel, match-all = 0xff)
   call void @llvm.hwasan.check.memaccess(ptr %x0, ptr %x1, i32 67043328)
   ret void
 }
 
+define void @f4(ptr %x0, ptr %x1) {
+  ; 0x1000010 (access-size-index = 0, is-write = 1, match-all = 0x0)
+  call void @llvm.hwasan.check.memaccess.shortgranules(ptr %x0, ptr %x1, i32 16777232)
+  ret void
+}
+
 declare void @llvm.hwasan.check.memaccess(ptr, ptr, i32)
 declare void @llvm.hwasan.check.memaccess.shortgranules(ptr, ptr, i32)
 
 ; CHECK:      .section .text.hot,"axG",@progbits,__hwasan_check_x0_2_short_v2,comdat
 ; CHECK-NEXT: .type __hwasan_check_x0_2_short_v2,@function
 ; CHECK-NEXT: .weak __hwasan_check_x0_2_short_v2
 ; CHECK-NEXT: .hidden __hwasan_check_x0_2_short_v2
 ; CHECK-NEXT: __hwasan_check_x0_2_short_v2:

 ; CHECK:      __hwasan_check_x1_67043328:
 ; CHECK-NEXT: sbfx x16, x1, #4, #52
 ; CHECK-NEXT: ldrb w16, [x9, x16]
 ; CHECK-NEXT: cmp x16, x1, lsr #56
 ; CHECK-NEXT: b.ne .Ltmp5
 ; CHECK-NEXT: .Ltmp6:
 ; CHECK-NEXT: ret
 ; CHECK-NEXT: .Ltmp5:
-; CHECK-NEXT: lsr x16, x1, #56
-; CHECK-NEXT: cmp x16, #255
+; CHECK-NEXT: lsr x17, x1, #56
+; CHECK-NEXT: cmp x17, #255
 ; CHECK-NEXT: b.eq .Ltmp6
 ; CHECK-NEXT: stp x0, x1, [sp, #-256]!
 ; CHECK-NEXT: stp x29, x30, [sp, #232]
 ; CHECK-NEXT: mov x0, x1
 ; CHECK-NEXT: mov x1, #0
 ; CHECK-NEXT: b __hwasan_tag_mismatch
+
+; CHECK:      __hwasan_check_x1_16777232_short_v2:
+; CHECK-NEXT: sbfx  x16, x1, #4, #52
+; CHECK-NEXT: ldrb  w16, [x20, x16]
+; CHECK-NEXT: cmp x16, x1, lsr #56
+; CHECK-NEXT: b.ne  .Ltmp7
+; CHECK-NEXT: .Ltmp8:
+; CHECK-NEXT: ret
+; CHECK-NEXT: .Ltmp7:
+; CHECK-NEXT: lsr x17, x1, #56
+; CHECK-NEXT: cmp x17, #0
+; CHECK-NEXT: b.eq  .Ltmp8
+; CHECK-NEXT: cmp w16, #15
+; CHECK-NEXT: b.hi  .Ltmp9
+; CHECK-NEXT: and x17, x1, #0xf
+; CHECK-NEXT: cmp w16, w17
+; CHECK-NEXT: b.ls  .Ltmp9
+; CHECK-NEXT: orr x16, x1, #0xf
+; CHECK-NEXT: ldrb  w16, [x16]
+; CHECK-NEXT: cmp x16, x1, lsr #56
+; CHECK-NEXT: b.eq  .Ltmp8
+; CHECK-NEXT: .Ltmp9:
+; CHECK-NEXT: stp x0, x1, [sp, #-256]!
+; CHECK-NEXT: stp x29, x30, [sp, #232]
+; CHECK-NEXT: mov x0, x1
+; CHECK-NEXT: mov x1, #16
+; CHECK-NEXT: adrp  x16, :got:__hwasan_tag_mismatch_v2
+; CHECK-NEXT: ldr x16, [x16, :got_lo12:__hwasan_tag_mismatch_v2]
+; CHECK-NEXT: br  x16