Add detect_stack_use_after_scope runtime flag

[vitalybuka]

Summary

This flag could be used to disable check in runtime.

PR27453

[vitalybuka]

Update

[kcc]

Code LGTM, one nit in the test.

test/asan/TestCases/use-after-scope.cc

4–7

don't compile the test twice

[vitalybuka]

Compile once.

lib/asan/asan_flags.inc

 ASAN_FLAG(
     bool, replace_str, true,
     "If set, uses custom wrappers and replacements for libc string functions "
     "to find more errors.")
 ASAN_FLAG(bool, replace_intrin, true,
           "If set, uses custom wrappers for memset/memcpy/memmove intrinsics.")
 ASAN_FLAG(bool, detect_stack_use_after_return, false,
           "Enables stack-use-after-return checking at run-time.")
+ASAN_FLAG(bool, detect_stack_use_after_scope, true,
+          "Enables stack-use-after-scope checking at run-time.")
 ASAN_FLAG(int, min_uar_stack_size_log, 16, // We can't do smaller anyway.
           "Minimum fake stack size log.")
 ASAN_FLAG(int, max_uar_stack_size_log,
           20, // 1Mb per size class, i.e. ~11Mb per thread
           "Maximum fake stack size log.")
 ASAN_FLAG(bool, uar_noreserve, false,
           "Use mmap with 'noreserve' flag to allocate fake stack.")
 ASAN_FLAG(

lib/asan/asan_interface_internal.h

extern "C" {
 
   SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
   /* OPTIONAL */ const char* __asan_default_options();
 
   // Global flag, copy of ASAN_OPTIONS=detect_stack_use_after_return
   SANITIZER_INTERFACE_ATTRIBUTE
   extern int __asan_option_detect_stack_use_after_return;
 
+// Global flag, copy of ASAN_OPTIONS=detect_stack_use_after_scope
+  SANITIZER_INTERFACE_ATTRIBUTE
+  extern int __asan_option_detect_stack_use_after_scope;
+
   SANITIZER_INTERFACE_ATTRIBUTE
   extern uptr *__asan_test_only_reported_buggy_pointer;
 
   SANITIZER_INTERFACE_ATTRIBUTE void __asan_load1(uptr p);
   SANITIZER_INTERFACE_ATTRIBUTE void __asan_load2(uptr p);
   SANITIZER_INTERFACE_ATTRIBUTE void __asan_load4(uptr p);
   SANITIZER_INTERFACE_ATTRIBUTE void __asan_load8(uptr p);
   SANITIZER_INTERFACE_ATTRIBUTE void __asan_load16(uptr p);

lib/asan/asan_poisoning.cc

if (do_poison) {
     // If necessary, mark few first bytes mapping to last shadow byte
     // as addressable
     if (end_value != 0)
       *shadow_end = Max(end_value, end_offset);
   }
 }
 
 void __asan_poison_stack_memory(uptr addr, uptr size) {
+  if (!__asan_option_detect_stack_use_after_scope) return;
   VReport(1, "poisoning: %p %zx\n", (void *)addr, size);
   PoisonAlignedStackMemory(addr, size, true);
 }
 
 void __asan_unpoison_stack_memory(uptr addr, uptr size) {
+  if (!__asan_option_detect_stack_use_after_scope) return;
   VReport(1, "unpoisoning: %p %zx\n", (void *)addr, size);
   PoisonAlignedStackMemory(addr, size, false);
 }
 
 void __sanitizer_annotate_contiguous_container(const void *beg_p,
                                                const void *end_p,
                                                const void *old_mid_p,
                                                const void *new_mid_p) {

lib/asan/asan_rtl.cc

 #include "sanitizer_common/sanitizer_flags.h"
 #include "sanitizer_common/sanitizer_libc.h"
 #include "sanitizer_common/sanitizer_symbolizer.h"
 #include "lsan/lsan_common.h"
 #include "ubsan/ubsan_init.h"
 #include "ubsan/ubsan_platform.h"
 
 int __asan_option_detect_stack_use_after_return;  // Global interface symbol.
+int __asan_option_detect_stack_use_after_scope;  // Global interface symbol.
 uptr *__asan_test_only_reported_buggy_pointer;  // Used only for testing asan.
 
 namespace __asan {
 
 uptr AsanMappingProfile[kAsanMappingProfileSize];
 
 static void AsanDie() {
   static atomic_uint32_t num_calls;
static void AsanInitInternal() {
 
   // Install tool-specific callbacks in sanitizer_common.
   AddDieCallback(AsanDie);
   SetCheckFailedCallback(AsanCheckFailed);
   SetPrintfAndReportCallback(AppendToErrorMessageBuffer);
 
   __sanitizer_set_report_path(common_flags()->log_path);
 
-  // Enable UAR detection, if required.
   __asan_option_detect_stack_use_after_return =
       flags()->detect_stack_use_after_return;
 
+  __asan_option_detect_stack_use_after_scope =
+      flags()->detect_stack_use_after_scope;
+
   // Re-exec ourselves if we need to set additional env or command line args.
   MaybeReexec();
 
   // Setup internal allocator callback.
   SetLowLevelAllocateCallback(OnLowLevelAllocate);
 
   InitializeAsanInterceptors();
 

lib/asan/asan_win.cc

 
 extern "C" {
 SANITIZER_INTERFACE_ATTRIBUTE
 int __asan_should_detect_stack_use_after_return() {
   __asan_init();
   return __asan_option_detect_stack_use_after_return;
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE
+int __asan_should_detect_stack_use_after_scope() {
+  __asan_init();
+  return __asan_option_detect_stack_use_after_scope;
+}
+
 // -------------------- A workaround for the abscence of weak symbols ----- {{{
 // We don't have a direct equivalent of weak symbols when using MSVC, but we can
 // use the /alternatename directive to tell the linker to default a specific
 // symbol to a specific value, which works nicely for allocator hooks and
 // __asan_default_options().
 void __sanitizer_default_malloc_hook(void *ptr, uptr size) { }
 void __sanitizer_default_free_hook(void *ptr) { }
 const char* __asan_default_default_options() { return ""; }

lib/asan/asan_win_dll_thunk.cc

#define WRAP_W_WWWWWW(name)                                                    \
   }                                                                            \
   INTERCEPT_WHEN_POSSIBLE(#name, name);
 // }}}
 
 // ----------------- ASan own interface functions --------------------
 // Don't use the INTERFACE_FUNCTION machinery for this function as we actually
 // want to call it in the __asan_init interceptor.
 WRAP_W_V(__asan_should_detect_stack_use_after_return)
+WRAP_W_V(__asan_should_detect_stack_use_after_scope)
 
 extern "C" {
   int __asan_option_detect_stack_use_after_return;
+  int __asan_option_detect_stack_use_after_scope;
 
   // Manually wrap __asan_init as we need to initialize
   // __asan_option_detect_stack_use_after_return afterwards.
   void __asan_init() {
     typedef void (*fntype)();
     static fntype fn = 0;
     // __asan_init is expected to be called by only one thread.
     if (fn) return;
 
     fn = (fntype)getRealProcAddressOrDie("__asan_init");
     fn();
     __asan_option_detect_stack_use_after_return =
         (__asan_should_detect_stack_use_after_return() != 0);
+    __asan_option_detect_stack_use_after_scope =
+        (__asan_should_detect_stack_use_after_scope() != 0);
 
     InterceptHooks();
   }
 }
 
 extern "C" void __asan_version_mismatch_check() {
   // Do nothing.
 }

lib/asan/asan_win_dynamic_runtime_thunk.cc

 // This file is a part of AddressSanitizer, an address sanity checker.
 //
 // This file defines things that need to be present in the application modules
 // to interact with the ASan DLL runtime correctly and can't be implemented
 // using the default "import library" generated when linking the DLL RTL.
 //
 // This includes:
 //  - forwarding the detect_stack_use_after_return runtime option
+//  - forwarding the detect_stack_use_after_scope runtime option
 //  - working around deficiencies of the MD runtime
 //  - installing a custom SEH handlerx
 //
 //===----------------------------------------------------------------------===//
 
 // Only compile this code when buidling asan_dynamic_runtime_thunk.lib
 // Using #ifdef rather than relying on Makefiles etc.
 // simplifies the build procedure.

 // constant after initialization anyways.
 extern "C" {
 __declspec(dllimport) int __asan_should_detect_stack_use_after_return();
 int __asan_option_detect_stack_use_after_return =
     __asan_should_detect_stack_use_after_return();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
+// Define a copy of __asan_option_detect_stack_use_after_scope that should be
+// used when linking an MD runtime with a set of object files on Windows.
+//
+// The ASan MD runtime dllexports '__asan_option_detect_stack_use_after_scope',
+// so normally we would just dllimport it.  Unfortunately, the dllimport
+// attribute adds __imp_ prefix to the symbol name of a variable.
+// Since in general we don't know if a given TU is going to be used
+// with a MT or MD runtime and we don't want to use ugly __imp_ names on Windows
+// just to work around this issue, let's clone the a variable that is
+// constant after initialization anyways.
+extern "C" {
+__declspec(dllimport) int __asan_should_detect_stack_use_after_scope();
+int __asan_option_detect_stack_use_after_scope =
+    __asan_should_detect_stack_use_after_scope();
+}
+
+////////////////////////////////////////////////////////////////////////////////
 // For some reason, the MD CRT doesn't call the C/C++ terminators during on DLL
 // unload or on exit.  ASan relies on LLVM global_dtors to call
 // __asan_unregister_globals on these events, which unfortunately doesn't work
 // with the MD runtime, see PR22545 for the details.
 // To work around this, for each DLL we schedule a call to UnregisterGlobals
 // using atexit() that calls a small subset of C terminators
 // where LLVM global_dtors is placed.  Fingers crossed, no other C terminators
 // are there.

test/asan/TestCases/Windows/dll_stack_use_after_scope.cc

+// RUN: %clang_cl_asan -O0 %p/dll_host.cc -Fe%t
+// RUN: %clang_cl_asan -LD -O0 %s -Fe%t.dll
+// RUN: %env_asan_opts=detect_stack_use_after_return=1 not %run %t %t.dll 2>&1 | FileCheck %s
+
+#include <malloc.h>
+
+char *x;
+
+void foo() {
+  char stack_buffer[42];
+  x = &stack_buffer[13];
+}
+
+extern "C" __declspec(dllexport)
+int test_function() {
+  foo();
+  *x = 42;
+// CHECK: AddressSanitizer: stack-use-after-return
+// CHECK: WRITE of size 1 at [[ADDR:.*]] thread T0
+// CHECK-NEXT:  test_function{{.*}}dll_stack_use_after_return.cc:[[@LINE-3]]
+// CHECK-NEXT:  main
+//
+// CHECK: Address [[ADDR]] is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
+// CHECK-NEXT: #0 {{.*}} foo{{.*}}dll_stack_use_after_return.cc
+// CHECK: 'stack_buffer' <== Memory access at offset [[OFFSET]] is inside this variable
+  return 0;
+}
+

test/asan/TestCases/Windows/stack_use_after_scope.cc

+// RUN: %clang_cl_asan -O0 %s -Fe%t
+// RUN: %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
+
+char *x;
+
+void foo() {
+  char stack_buffer[42];
+  x = &stack_buffer[13];
+}
+
+int main() {
+  foo();
+  *x = 42;
+// CHECK: AddressSanitizer: stack-use-after-return
+// CHECK: WRITE of size 1 at {{.*}} thread T0
+// CHECK-NEXT: {{#0 0x.* in main .*stack_use_after_return.cc}}:[[@LINE-3]]
+//
+// CHECK: is located in stack of thread T0 at offset [[OFFSET:.*]] in frame
+// CHECK-NEXT: {{#0 0x.* in foo.*stack_use_after_return.cc}}
+//
+// CHECK: 'stack_buffer' <== Memory access at offset [[OFFSET]] is inside this variable
+}

test/asan/TestCases/use-after-scope.cc

 // RUN: %clangxx_asan -O1 -fsanitize-address-use-after-scope %s -o %t && \
-// RUN:     not %run %t 2>&1 | FileCheck %s
+// RUN:     %env_asan_opts=detect_stack_use_after_scope=1 not %run %t 2>&1 | FileCheck %s
 
-int *p = 0;
+// RUN: %clangxx_asan -O1 -fsanitize-address-use-after-scope %s -o %t && \
+// RUN:     %env_asan_opts=detect_stack_use_after_scope=0 %run %t
+
+volatile int *p = 0;
 
 int main() {
   {
     int x = 0;
     p = &x;
   }
-  return *p;  // BOOM
+  *p = 5;  // BOOM
   // CHECK: ERROR: AddressSanitizer: stack-use-after-scope
   // CHECK:  #0 0x{{.*}} in main {{.*}}use-after-scope.cc:[[@LINE-2]]
   // CHECK: Address 0x{{.*}} is located in stack of thread T{{.*}} at offset [[OFFSET:[^ ]+]] in frame
   // {{\[}}[[OFFSET]], {{[0-9]+}}) 'x'
+  return 0;
 }