[lsan] Invoke hooks on realloc

[Northbadge]

Summary

Previously lsan would not invoke hooks on reallocations.
An accompanying regression test is included in sanitizer_common.

This change also moves hook calls to a location where subsequent
calls (via an external caller) to __sanitizer_get_allocated_size
via hooks will return a valid size.

This allows a faster version of __sanitizer_get_allocated_size
to be implemented, which can skip checks.

Test to ensure RunFreeHooks' call order will come with
__sanitizer_get_allocated_size_fast

[Northbadge]

compiler-rt/test/sanitizer_common/TestCases/malloc_hook.cpp

45

this is to avoid asan complaining of non-matching alloc-dealloc calls. e.g. it was doing new-free(from realloc) before.

[usama54321]

Hi. This is breaking malloc_hook.cpp test. Can you please revert or fix this? Thanks

https://green.lab.llvm.org/green/job/clang-stage1-RA/34460/testReport/junit/SanitizerCommon-tsan-x86_64-Darwin/SanitizerCommon-tsan-x86_64-Darwin/malloc_hook_cpp/

[usama54321]

Also breaking https://green.lab.llvm.org/green/job/clang-stage1-RA/34460/testReport/SanitizerCommon-tsan-x86_64-Darwin/SanitizerCommon-tsan-x86_64-Darwin/malloc_hook_get_allocated_size_fast_cpp/

[Northbadge]

In D151175#4385784, @usama54321 wrote:

Also breaking https://green.lab.llvm.org/green/job/clang-stage1-RA/34460/testReport/SanitizerCommon-tsan-x86_64-Darwin/SanitizerCommon-tsan-x86_64-Darwin/malloc_hook_get_allocated_size_fast_cpp/

Thanks! I sent over D151860 to disable the tests on tsan & darwin for now

[zequanwu]

It looks like also failing in chromium mac bots. I haven't confirmed, but it's very likely.
Build: https://logs.chromium.org/logs/chromium/buildbucket/cr-buildbucket/8780155112582797025/+/u/package_clang/stdout?format=raw

FAIL: SanitizerCommon-tsan-x86_64-Darwin :: malloc_hook.cpp (67438 of 71222)
 ******************** TEST 'SanitizerCommon-tsan-x86_64-Darwin :: malloc_hook.cpp' FAILED ********************
 Script:
 --
 : 'RUN: at line 1';      /opt/s/w/ir/cache/builder/src/third_party/llvm-build/Release+Asserts/./bin/clang  --driver-mode=g++ -gline-tables-only -fsanitize=thread  -arch x86_64 -stdlib=libc++ -mmacosx-version-min=10.12 -isysroot /opt/s/w/ir/cache/osx_sdk/XCode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk  -I/opt/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/test -O2 /opt/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/test/sanitizer_common/TestCases/malloc_hook.cpp -o /opt/s/w/ir/cache/builder/src/third_party/llvm-build/Release+Asserts/runtimes/runtimes-bins/compiler-rt/test/sanitizer_common/tsan-x86_64-Darwin/Output/malloc_hook.cpp.tmp &&  /opt/s/w/ir/cache/builder/src/third_party/llvm-build/Release+Asserts/runtimes/runtimes-bins/compiler-rt/test/sanitizer_common/tsan-x86_64-Darwin/Output/malloc_hook.cpp.tmp 2>&1 | FileCheck /opt/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/test/sanitizer_common/TestCases/malloc_hook.cpp
 --
 Exit Code: 2
 
 Command Output (stderr):
 --
 FileCheck error: '<stdin>' is empty.
 FileCheck command line:  FileCheck /opt/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/test/sanitizer_common/TestCases/malloc_hook.cpp
 
 --

[Northbadge]

Test failures on darwin should be resolved past https://github.com/llvm/llvm-project/commit/2de54b919ba5fd9ccf37038cddfc36e97eb480af , sorry for the trouble!

compiler-rt/lib/lsan/lsan_allocator.cpp

 static void RegisterAllocation(const StackTrace &stack, void *p, uptr size) {
   if (!p) return;
   ChunkMetadata *m = Metadata(p);
   CHECK(m);
   m->tag = DisabledInThisThread() ? kIgnored : kDirectlyLeaked;
   m->stack_trace_id = StackDepotPut(stack);
   m->requested_size = size;
   atomic_store(reinterpret_cast<atomic_uint8_t *>(m), 1, memory_order_relaxed);
+  RunMallocHooks(p, size);
 }
 
 static void RegisterDeallocation(void *p) {
   if (!p) return;
   ChunkMetadata *m = Metadata(p);
   CHECK(m);
+  RunFreeHooks(p);
   atomic_store(reinterpret_cast<atomic_uint8_t *>(m), 0, memory_order_relaxed);
 }
 
 static void *ReportAllocationSizeTooBig(uptr size, const StackTrace &stack) {
   if (AllocatorMayReturnNull()) {
     Report("WARNING: LeakSanitizer failed to allocate 0x%zx bytes\n", size);
     return nullptr;
   }
if (UNLIKELY(!p)) {
     if (AllocatorMayReturnNull())
       return nullptr;
     ReportOutOfMemory(size, &stack);
   }
   // Do not rely on the allocator to clear the memory (it's slow).
   if (cleared && allocator.FromPrimary(p))
     memset(p, 0, size);
   RegisterAllocation(stack, p, size);
-  RunMallocHooks(p, size);
   return p;
 }
 
 static void *Calloc(uptr nmemb, uptr size, const StackTrace &stack) {
   if (UNLIKELY(CheckForCallocOverflow(size, nmemb))) {
     if (AllocatorMayReturnNull())
       return nullptr;
     ReportCallocOverflow(nmemb, size, &stack);
   }
   size *= nmemb;
   return Allocate(stack, size, 1, true);
 }
 
 void Deallocate(void *p) {
-  RunFreeHooks(p);
   RegisterDeallocation(p);
   allocator.Deallocate(GetAllocatorCache(), p);
 }
 
 void *Reallocate(const StackTrace &stack, void *p, uptr new_size,
                  uptr alignment) {
   if (new_size > max_malloc_size) {
     ReportAllocationSizeTooBig(new_size, stack);

compiler-rt/test/sanitizer_common/TestCases/malloc_hook.cpp

 extern "C" {
 const volatile void *global_ptr;
 
 #define WRITE(s) write(1, s, sizeof(s))
 
 // Note: avoid calling functions that allocate memory in malloc/free
 // to avoid infinite recursion.
 void __sanitizer_malloc_hook(const volatile void *ptr, size_t sz) {
-  if (__sanitizer_get_ownership(ptr) && sz == 4) {
+  if (__sanitizer_get_ownership(ptr) && sz == sizeof(int)) {
     WRITE("MallocHook\n");
     global_ptr = ptr;
   }
 }
 void __sanitizer_free_hook(const volatile void *ptr) {
   if (__sanitizer_get_ownership(ptr) && ptr == global_ptr)
     WRITE("FreeHook\n");
 }
 }  // extern "C"
 
 volatile int *x;
 
 void MallocHook1(const volatile void *ptr, size_t sz) { WRITE("MH1\n"); }
 void MallocHook2(const volatile void *ptr, size_t sz) { WRITE("MH2\n"); }
 void FreeHook1(const volatile void *ptr) { WRITE("FH1\n"); }
 void FreeHook2(const volatile void *ptr) { WRITE("FH2\n"); }
 // Call this function with uninitialized arguments to poison
 // TLS shadow for function parameters before calling operator
 // new and, eventually, user-provided hook.
 __attribute__((noinline)) void allocate(int *unused1, int *unused2) {
-  x = new int;
+  x = reinterpret_cast<int *>(malloc(sizeof(int)));
 }
 
 int main() {
   __sanitizer_install_malloc_and_free_hooks(MallocHook1, FreeHook1);
   __sanitizer_install_malloc_and_free_hooks(MallocHook2, FreeHook2);
   int *undef1, *undef2;
   allocate(undef1, undef2);
   // CHECK: MallocHook
   // CHECK: MH1
   // CHECK: MH2
   // Check that malloc hook was called with correct argument.
   if (global_ptr != (void*)x) {
     _exit(1);
   }
-  *x = 0;
-  delete x;
-  // CHECK: FreeHook
+
+  // Check that realloc invokes hooks
+  // We realloc to 128 here to avoid potential oversizing by allocators
+  // making this a no-op.
+  x = reinterpret_cast<int *>(realloc((int *)x, sizeof(int) * 128));
+  // CHECK-DAG: FreeHook{{[[:space:]].*}}FH1{{[[:space:]].*}}FH2
+  // CHECK-DAG: MH1{{[[:space:]].*}}MH2
+
+  x[0] = 0;
+  x[127] = -1;
+  free((void *)x);
   // CHECK: FH1
   // CHECK: FH2
   return 0;
 }