[cfi] Cross-DSO CFI diagnostic mode (compiler-rt part)

[eugenis]

Summary

• add __cfi_slowpath_diag with a 3rd parameter which a pointer to the diagnostic info for the ubsan handlers.
• __cfi_check gets a 3rd parameter as well.
• unify vcall/cast/etc and icall diagnostic info format, and merge the handlers to have a single entry point (actually two points due to abort/noabort variants).
• tests

Note that this comes with a tiny overhead in the non-diag mode: cfi_slowpath must pass 0 as the 3rd argument to cfi_check.

[pcc]

lib/ubsan/ubsan_handlers.cc

551

Move to the reserved namespace.

[pcc]

LGTM

lib/ubsan/ubsan_handlers.h

152

Rename this one as well.

[eugenis]

http://reviews.llvm.org/rL258744

lib/cfi/CMakeLists.txt

foreach(arch ${CFI_SUPPORTED_ARCH})
   add_compiler_rt_runtime(clang_rt.cfi_diag
     STATIC
     ARCHS ${arch}
     SOURCES ${CFI_SOURCES}
     OBJECT_LIBS RTInterception
                 RTSanitizerCommon
                 RTSanitizerCommonLibc
     RTUbsan
-    RTUbsan_cxx
     CFLAGS ${CFI_CFLAGS} ${CFI_DIAG_CFLAGS}
     PARENT_TARGET cfi)
 endforeach()
 
 add_compiler_rt_resource_file(cfi_blacklist cfi_blacklist.txt)
 add_dependencies(cfi cfi_blacklist)
 add_dependencies(compiler-rt cfi)

lib/cfi/cfi.cc

 
 static constexpr uint16_t kInvalidShadow = 0;
 static constexpr uint16_t kUncheckedShadow = 0xFFFFU;
 
 static uint16_t *mem_to_shadow(uptr x) {
   return (uint16_t *)(__cfi_shadow + ((x >> kShadowGranularity) << 1));
 }
 
-typedef int (*CFICheckFn)(u64, void *);
+typedef int (*CFICheckFn)(u64, void *, void *);
 
 class ShadowValue {
   uptr addr;
   uint16_t v;
   explicit ShadowValue(uptr addr, uint16_t v) : addr(addr), v(v) {}
 
 public:
   bool is_invalid() const { return v == kInvalidShadow; }
static int dl_iterate_phdr_cb(dl_phdr_info *info, size_t size, void *data) {
   return 0;
 }
 
 // Fill shadow for the initial libraries.
 static void init_shadow() {
   dl_iterate_phdr(dl_iterate_phdr_cb, nullptr);
 }
 
-extern "C" SANITIZER_INTERFACE_ATTRIBUTE
-void __cfi_slowpath(u64 CallSiteTypeId, void *Ptr) {
+static ALWAYS_INLINE void CfiSlowPathCommon(u64 CallSiteTypeId, void *Ptr,
+                                            void *DiagData) {
   uptr Addr = (uptr)Ptr;
   VReport(3, "__cfi_slowpath: %llx, %p\n", CallSiteTypeId, Ptr);
   ShadowValue sv = ShadowValue::load(Addr);
   if (sv.is_invalid()) {
-    VReport(2, "CFI: invalid memory region for a function pointer (shadow==0): %p\n", Ptr);
+    // FIXME: call the ubsan handler if DiagData != nullptr?
+    Report(
+        "CFI: invalid memory region for a function pointer (shadow==0): %p\n",
+        Ptr);
+    if (DiagData)
+      return;
+    else
       Die();
   }
   if (sv.is_unchecked()) {
     VReport(2, "CFI: unchecked call (shadow=FFFF): %p\n", Ptr);
     return;
   }
   CFICheckFn cfi_check = sv.get_cfi_check();
   VReport(2, "__cfi_check at %p\n", cfi_check);
-  cfi_check(CallSiteTypeId, Ptr);
+  cfi_check(CallSiteTypeId, Ptr, DiagData);
+}
+
+extern "C" SANITIZER_INTERFACE_ATTRIBUTE void
+__cfi_slowpath(u64 CallSiteTypeId, void *Ptr) {
+  CfiSlowPathCommon(CallSiteTypeId, Ptr, nullptr);
+}
+
+extern "C" SANITIZER_INTERFACE_ATTRIBUTE void
+__cfi_slowpath_diag(u64 CallSiteTypeId, void *Ptr, void *DiagData) {
+  CfiSlowPathCommon(CallSiteTypeId, Ptr, DiagData);
 }
 
 static void InitializeFlags() {
   SetCommonFlagsDefaults();
 #ifdef CFI_ENABLE_DIAG
   __ubsan::Flags *uf = __ubsan::flags();
   uf->SetDefaults();
 #endif

lib/ubsan/ubsan_handlers.h

struct NonNullArgData {
   SourceLocation Loc;
   SourceLocation AttrLoc;
   int ArgIndex;
 };
 
 /// \brief Handle passing null pointer to function with nonnull attribute.
 RECOVERABLE(nonnull_arg, NonNullArgData *Data)
 
-struct CFIBadIcallData {
+/// \brief Known CFI check kinds.
+/// Keep in sync with the enum of the same name in CodeGenFunction.h
+enum CFICheckKind : unsigned char {
+  CFITCK_VCall,
+  CFITCK_NVCall,
+  CFITCK_DerivedCast,
+  CFITCK_UnrelatedCast,
+  CFITCK_ICall,
+};
+
+struct CFICheckFailData {
+  CFICheckKind CheckKind;
   SourceLocation Loc;
   const TypeDescriptor &Type;
 };
 
-/// \brief Handle control flow integrity failure for indirect function calls.
-RECOVERABLE(cfi_bad_icall, CFIBadIcallData *Data, ValueHandle Function)
+/// \brief Handle control flow integrity failures.
+RECOVERABLE(cfi_check_fail, CFICheckFailData *Data, ValueHandle Function)
 
 }
 
 #endif // UBSAN_HANDLERS_H

lib/ubsan/ubsan_handlers.cc

 }
 
 void __ubsan::__ubsan_handle_nonnull_arg_abort(NonNullArgData *Data) {
   GET_REPORT_OPTIONS(true);
   handleNonNullArg(Data, Opts);
   Die();
 }
 
-static void handleCFIBadIcall(CFIBadIcallData *Data, ValueHandle Function,
+static void handleCFIBadIcall(CFICheckFailData *Data, ValueHandle Function,
                               ReportOptions Opts) {
+  if (Data->CheckKind != CFITCK_ICall)
+    Die();
+
   SourceLocation Loc = Data->Loc.acquire();
   ErrorType ET = ErrorType::CFIBadType;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
   Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
                       "indirect function call")
       << Data->Type;
 
   SymbolizedStackHolder FLoc(getSymbolizedLocation(Function));
   const char *FName = FLoc.get()->info.function;
   if (!FName)
     FName = "(unknown)";
   Diag(FLoc, DL_Note, "%0 defined here") << FName;
 }
 
-void __ubsan::__ubsan_handle_cfi_bad_icall(CFIBadIcallData *Data,
-                                           ValueHandle Function) {
+namespace __ubsan {
+SANITIZER_WEAK_ATTRIBUTE
+void HandleCFIBadType(CFICheckFailData *Data, ValueHandle Vtable,
+                      ReportOptions Opts);
+}  // namespace __ubsan
+
+void __ubsan::__ubsan_handle_cfi_check_fail(CFICheckFailData *Data,
+                                           ValueHandle Value) {
   GET_REPORT_OPTIONS(false);
-  handleCFIBadIcall(Data, Function, Opts);
+  if (Data->CheckKind == CFITCK_ICall)
+    handleCFIBadIcall(Data, Value, Opts);
+  else
+    HandleCFIBadType(Data, Value, Opts);
 }
 
-void __ubsan::__ubsan_handle_cfi_bad_icall_abort(CFIBadIcallData *Data,
-                                                 ValueHandle Function) {
+void __ubsan::__ubsan_handle_cfi_check_fail_abort(CFICheckFailData *Data,
+                                                 ValueHandle Value) {
   GET_REPORT_OPTIONS(true);
-  handleCFIBadIcall(Data, Function, Opts);
+  if (Data->CheckKind == CFITCK_ICall)
+    handleCFIBadIcall(Data, Value, Opts);
+  else
+    HandleCFIBadType(Data, Value, Opts);
   Die();
 }
 
 #endif  // CAN_SANITIZE_UB

lib/ubsan/ubsan_handlers_cxx.h

 
 struct DynamicTypeCacheMissData {
   SourceLocation Loc;
   const TypeDescriptor &Type;
   void *TypeInfo;
   unsigned char TypeCheckKind;
 };
 
-struct CFIBadTypeData {
-  SourceLocation Loc;
-  const TypeDescriptor &Type;
-  unsigned char TypeCheckKind;
-};
-
 /// \brief Handle a runtime type check failure, caused by an incorrect vptr.
 /// When this handler is called, all we know is that the type was not in the
 /// cache; this does not necessarily imply the existence of a bug.
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE
 void __ubsan_handle_dynamic_type_cache_miss(
   DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash);
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE
 void __ubsan_handle_dynamic_type_cache_miss_abort(
   DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash);
-
-/// \brief Handle a control flow integrity check failure by printing a
-/// diagnostic.
-extern "C" SANITIZER_INTERFACE_ATTRIBUTE void
-__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data, ValueHandle Vtable);
-extern "C" SANITIZER_INTERFACE_ATTRIBUTE void
-__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data, ValueHandle Vtable);
-
 }
 
 #endif // UBSAN_HANDLERS_H

lib/ubsan/ubsan_handlers_cxx.cc

 // Error logging entry points for the UBSan runtime, which are only used for C++
 // compilations. This file is permitted to use language features which require
 // linking against a C++ ABI library.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ubsan_platform.h"
 #if CAN_SANITIZE_UB
+#include "ubsan_handlers.h"
 #include "ubsan_handlers_cxx.h"
 #include "ubsan_diag.h"
 #include "ubsan_type_hash.h"
 
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_suppressions.h"
 
 using namespace __sanitizer;

 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
   // Note: -fsanitize=vptr is always recoverable.
   GET_REPORT_OPTIONS(false);
   if (HandleDynamicTypeCacheMiss(Data, Pointer, Hash, Opts))
     Die();
 }
 
-static void HandleCFIBadType(CFIBadTypeData *Data, ValueHandle Vtable,
-                             ReportOptions Opts) {
+namespace __ubsan {
+void HandleCFIBadType(CFICheckFailData *Data, ValueHandle Vtable,
   SourceLocation Loc = Data->Loc.acquire();
   ErrorType ET = ErrorType::CFIBadType;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
-  DynamicTypeInfo DTI = getDynamicTypeInfoFromVtable((void*)Vtable);
+  DynamicTypeInfo DTI = getDynamicTypeInfoFromVtable((void *)Vtable);
 
-  static const char *TypeCheckKinds[] = {
-    "virtual call",
-    "non-virtual call",
-    "base-to-derived cast",
-    "cast to unrelated type",
-  };
+  const char *CheckKindStr;
+  switch (Data->CheckKind) {
+  case CFITCK_VCall:
+    CheckKindStr = "virtual call";
+    break;
+  case CFITCK_NVCall:
+    CheckKindStr = "non-virtual call";
+    break;
+  case CFITCK_DerivedCast:
+    CheckKindStr = "base-to-derived cast";
+    break;
+  case CFITCK_UnrelatedCast:
+    CheckKindStr = "cast to unrelated type";
+    break;
+  case CFITCK_ICall:
+    Die();
+  }
 
   Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
                       "%1 (vtable address %2)")
-      << Data->Type << TypeCheckKinds[Data->TypeCheckKind] << (void *)Vtable;
+      << Data->Type << CheckKindStr << (void *)Vtable;
 
   // If possible, say what type it actually points to.
   if (!DTI.isValid())
     Diag(Vtable, DL_Note, "invalid vtable");
   else
     Diag(Vtable, DL_Note, "vtable is of type %0")
         << TypeName(DTI.getMostDerivedTypeName());
 }
-
-void __ubsan::__ubsan_handle_cfi_bad_type(CFIBadTypeData *Data,
-                                          ValueHandle Vtable) {
-  GET_REPORT_OPTIONS(false);
-  HandleCFIBadType(Data, Vtable, Opts);
-}
-
-void __ubsan::__ubsan_handle_cfi_bad_type_abort(CFIBadTypeData *Data,
-                                                ValueHandle Vtable) {
-  GET_REPORT_OPTIONS(true);
-  HandleCFIBadType(Data, Vtable, Opts);
-  Die();
-}
+}  // namespace __ubsan
 
-#endif  // CAN_SANITIZE_UB
+#endif // CAN_SANITIZE_UB

test/cfi/cross-dso/icall/diag.cpp

+// Cross-DSO diagnostics.
+// The rules are:
+// * If the library needs diagnostics, the main executable must request at
+//   least some diagnostics as well (to link the diagnostic runtime).
+// * -fsanitize-trap on the caller side overrides everything.
+// * otherwise, the callee decides between trap/recover/norecover.
+
+// Full-recover.
+// RUN: %clangxx_cfi_dso_diag -g -DSHARED_LIB %s -fPIC -shared -o %t-so.so
+// RUN: %clangxx_cfi_dso_diag -g %s -o %t %t-so.so
+
+// RUN: %t icv 2>&1 | FileCheck %s --check-prefix=ICALL-DIAG --check-prefix=CAST-DIAG \
+// RUN:                            --check-prefix=VCALL-DIAG --check-prefix=ALL-RECOVER
+
+// RUN: %t i_v 2>&1 | FileCheck %s --check-prefix=ICALL-DIAG --check-prefix=CAST-NODIAG \
+// RUN:                            --check-prefix=VCALL-DIAG --check-prefix=ALL-RECOVER
+
+// RUN: %t _cv 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-DIAG \
+// RUN:                            --check-prefix=VCALL-DIAG --check-prefix=ALL-RECOVER
+
+// RUN: %t ic_ 2>&1 | FileCheck %s --check-prefix=ICALL-DIAG --check-prefix=CAST-DIAG \
+// RUN:                            --check-prefix=VCALL-NODIAG --check-prefix=ALL-RECOVER
+
+// Trap on icall, no-recover on cast.
+// RUN: %clangxx_cfi_dso_diag -fsanitize-trap=cfi-icall -fno-sanitize-recover=cfi-unrelated-cast \
+// RUN:     -g -DSHARED_LIB %s -fPIC -shared -o %t-so.so
+// RUN: %clangxx_cfi_dso_diag -fsanitize-trap=cfi-icall -fno-sanitize-recover=cfi-unrelated-cast \
+// RUN:     -g %s -o %t %t-so.so
+
+// RUN: %expect_crash %t icv 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-NODIAG \
+// RUN:                                          --check-prefix=VCALL-NODIAG --check-prefix=ICALL-FATAL
+
+// RUN: not %t _cv 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-DIAG \
+// RUN:                                --check-prefix=VCALL-NODIAG --check-prefix=CAST-FATAL
+
+// RUN: %t __v 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-NODIAG \
+// RUN:                            --check-prefix=VCALL-DIAG
+
+// Callee: trap on icall, no-recover on cast.
+// Caller: recover on everything.
+// The same as in the previous case, behaviour is decided by the callee.
+// RUN: %clangxx_cfi_dso_diag -fsanitize-trap=cfi-icall -fno-sanitize-recover=cfi-unrelated-cast \
+// RUN:     -g -DSHARED_LIB %s -fPIC -shared -o %t-so.so
+// RUN: %clangxx_cfi_dso_diag \
+// RUN:     -g %s -o %t %t-so.so
+
+// RUN: %expect_crash %t icv 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-NODIAG \
+// RUN:                                          --check-prefix=VCALL-NODIAG --check-prefix=ICALL-FATAL
+
+// RUN: not %t _cv 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-DIAG \
+// RUN:                                --check-prefix=VCALL-NODIAG --check-prefix=CAST-FATAL
+
+// RUN: %t __v 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-NODIAG \
+// RUN:                            --check-prefix=VCALL-DIAG
+
+// Caller in trapping mode, callee with full diagnostic+recover.
+// Caller wins.
+// cfi-nvcall is non-trapping in the main executable to link the diagnostic runtime library.
+// RUN: %clangxx_cfi_dso_diag \
+// RUN:     -g -DSHARED_LIB %s -fPIC -shared -o %t-so.so
+// RUN: %clangxx_cfi_dso -fno-sanitize-trap=cfi-nvcall \
+// RUN:     -g %s -o %t %t-so.so
+
+// RUN: %expect_crash %t icv 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-NODIAG \
+// RUN:                                          --check-prefix=VCALL-NODIAG --check-prefix=ICALL-FATAL
+
+// RUN: %expect_crash %t _cv 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-NODIAG \
+// RUN:                                          --check-prefix=VCALL-NODIAG --check-prefix=CAST-FATAL
+
+// RUN: %expect_crash %t __v 2>&1 | FileCheck %s --check-prefix=ICALL-NODIAG --check-prefix=CAST-NODIAG \
+// RUN:                                          --check-prefix=VCALL-NODIAG --check-prefix=VCALL-FATAL
+
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+
+struct A {
+  virtual void f();
+};
+
+void *create_B();
+
+#ifdef SHARED_LIB
+
+#include "../../utils.h"
+struct B {
+  virtual void f();
+};
+void B::f() {}
+
+void *create_B() {
+  create_derivers<B>();
+  return (void *)(new B());
+}
+
+#else
+
+void A::f() {}
+
+int main(int argc, char *argv[]) {
+  assert(argc == 2);
+  assert(strlen(argv[1]) == 3);
+
+  // ICALL-FATAL: =0=
+  // CAST-FATAL:  =0=
+  // VCALL-FATAL: =0=
+  // ALL-RECOVER: =0=
+  fprintf(stderr, "=0=\n");
+
+  void *p;
+  if (argv[1][0] == 'i') {
+    // ICALL-DIAG: runtime error: control flow integrity check for type 'void *(int)' failed during indirect function call
+    // ICALL-DIAG-NEXT: note: create_B() defined here
+    // ICALL-NODIAG-NOT: runtime error: control flow integrity check {{.*}} during indirect function call
+    p = ((void *(*)(int))create_B)(42);
+  } else {
+    p = create_B();
+  }
+
+  // ICALL-FATAL-NOT: =1=
+  // CAST-FATAL:      =1=
+  // VCALL-FATAL:     =1=
+  // ALL-RECOVER:     =1=
+  fprintf(stderr, "=1=\n");
+
+  A *a;
+  if (argv[1][1] == 'c') {
+    // CAST-DIAG: runtime error: control flow integrity check for type 'A' failed during cast to unrelated type
+    // CAST-DIAG-NEXT: note: vtable is of type '{{(struct )?}}B'
+    // CAST-NODIAG-NOT: runtime error: control flow integrity check {{.*}} during cast to unrelated type
+    a = (A*)p;
+  } else {
+    // Invisible to CFI.
+    memcpy(&a, &p, sizeof(a));
+  }
+
+  // ICALL-FATAL-NOT: =2=
+  // CAST-FATAL-NOT:  =2=
+  // VCALL-FATAL:     =2=
+  // ALL-RECOVER:     =2=
+  fprintf(stderr, "=2=\n");
+
+  // VCALL-DIAG: runtime error: control flow integrity check for type 'A' failed during virtual call
+  // VCALL-DIAG-NEXT: note: vtable is of type '{{(struct )?}}B'
+  // VCALL-NODIAG-NOT: runtime error: control flow integrity check {{.*}} during virtual call
+  if (argv[1][2] == 'v') {
+    a->f(); // UB here
+  }
+
+  // ICALL-FATAL-NOT: =3=
+  // CAST-FATAL-NOT:  =3=
+  // VCALL-FATAL-NOT: =3=
+  // ALL-RECOVER: =3=
+  fprintf(stderr, "=3=\n");
+
+}
+#endif

test/cfi/cross-dso/icall/icall-from-dso.cpp

 // RUN: %clangxx_cfi_dso -DSHARED_LIB %s -fPIC -shared -o %t-so.so
 // RUN: %clangxx_cfi_dso %s -o %t %t-so.so && %expect_crash %t 2>&1 | FileCheck %s
 
+// RUN: %clangxx_cfi_dso_diag -g -DSHARED_LIB %s -fPIC -shared -o %t2-so.so
+// RUN: %clangxx_cfi_dso_diag -g %s -o %t2 %t2-so.so && %t2 2>&1 | FileCheck %s --check-prefix=CFI-DIAG
+
 #include <stdio.h>
 
 #ifdef SHARED_LIB
 void g();
 void f() {
+  // CHECK-DIAG: =1=
   // CHECK: =1=
   fprintf(stderr, "=1=\n");
   ((void (*)(void))g)();
+  // CHECK-DIAG: =2=
   // CHECK: =2=
   fprintf(stderr, "=2=\n");
+  // CFI-DIAG: runtime error: control flow integrity check for type 'void (int)' failed during indirect function call
+  // CFI-DIAG-NEXT: note: g() defined here
   ((void (*)(int))g)(42); // UB here
+  // CHECK-DIAG: =3=
   // CHECK-NOT: =3=
   fprintf(stderr, "=3=\n");
 }
 #else
 void f();
 void g() {
 }
 
 int main() {
   f();
 }
 #endif

test/cfi/cross-dso/icall/icall.cpp

 // RUN: %clangxx_cfi_dso -DSHARED_LIB %s -fPIC -shared -o %t-so.so
 // RUN: %clangxx_cfi_dso %s -o %t %t-so.so && %expect_crash %t 2>&1 | FileCheck %s
 
+// RUN: %clangxx_cfi_dso_diag -g -DSHARED_LIB %s -fPIC -shared -o %t2-so.so
+// RUN: %clangxx_cfi_dso_diag -g %s -o %t2 %t2-so.so && %t2 2>&1 | FileCheck %s --check-prefix=CFI-DIAG
+
 #include <stdio.h>
 
 #ifdef SHARED_LIB
 void f() {
 }
 #else
 void f();
 int main() {
+  // CHECK-DIAG: =1=
   // CHECK: =1=
   fprintf(stderr, "=1=\n");
   ((void (*)(void))f)();
+  // CHECK-DIAG: =2=
   // CHECK: =2=
   fprintf(stderr, "=2=\n");
+  // CFI-DIAG: runtime error: control flow integrity check for type 'void (int)' failed during indirect function call
+  // CFI-DIAG-NEXT: note: f() defined here
   ((void (*)(int))f)(42); // UB here
+  // CHECK-DIAG: =3=
   // CHECK-NOT: =3=
   fprintf(stderr, "=3=\n");
 }
 #endif

test/cfi/cross-dso/simple-fail.cpp

 // RUN: %t5 2>&1 | FileCheck --check-prefix=NCFI %s
 // RUN: %t5 x 2>&1 | FileCheck --check-prefix=NCFI %s
 
 // RUN: %clangxx -DBM -DSHARED_LIB %s -fPIC -shared -o %t6-so.so
 // RUN: %clangxx_cfi_dso -DBM %s -o %t6 %t6-so.so
 // RUN: %t6 2>&1 | FileCheck --check-prefix=NCFI %s
 // RUN: %t6 x 2>&1 | FileCheck --check-prefix=NCFI %s
 
+// RUN: %clangxx_cfi_dso_diag -DSHARED_LIB %s -fPIC -shared -o %t7-so.so
+// RUN: %clangxx_cfi_dso_diag %s -o %t7 %t7-so.so
+// RUN: %t7 2>&1 | FileCheck --check-prefix=CFI-DIAG-CALL %s
+// RUN: %t7 x 2>&1 | FileCheck --check-prefix=CFI-DIAG-CALL --check-prefix=CFI-DIAG-CAST %s
+
 // Tests that the CFI mechanism crashes the program when making a virtual call
 // to an object of the wrong class but with a compatible vtable, by casting a
 // pointer to such an object and attempting to make a call through it.
 
 // REQUIRES: cxxabi
 
 #include <stdio.h>
 #include <string.h>
int main(int argc, char *argv[]) {
 
   // CFI: =0=
   // CFI-CAST: =0=
   // NCFI: =0=
   fprintf(stderr, "=0=\n");
 
   if (argc > 1 && argv[1][0] == 'x') {
     // Test cast. BOOM.
+    // CFI-DIAG-CAST: runtime error: control flow integrity check for type 'A' failed during cast to unrelated type
+    // CFI-DIAG-CAST-NEXT: note: vtable is of type '{{(struct )?}}B'
     a = (A*)p;
   } else {
     // Invisible to CFI. Test virtual call later.
     memcpy(&a, &p, sizeof(a));
   }
 
   // CFI: =1=
   // CFI-CAST-NOT: =1=
   // NCFI: =1=
   fprintf(stderr, "=1=\n");
 
+  // CFI-DIAG-CALL: runtime error: control flow integrity check for type 'A' failed during virtual call
+  // CFI-DIAG-CALL-NEXT: note: vtable is of type '{{(struct )?}}B'
   a->f(); // UB here
 
   // CFI-NOT: =2=
   // CFI-CAST-NOT: =2=
   // NCFI: =2=
   fprintf(stderr, "=2=\n");
 }
 #endif