[asan] Don't poison variables for lifitime analysis on function entry

[vitalybuka]

Summary

In most cases such poisoning makes sense, however PR28267 allows to jump over
intrinsic.

void f2(int cond) {
     switch (cond) {
       case 1: {
         ++cond;
         int tmp = 1;
         ptr = &tmp;
         exit(0);
       case 2:
         ptr = &tmp;
         *ptr = 5;
         exit(0);
       }
     }
   }

[vitalybuka]

Fixed test

[eugenis]

lib/Transforms/Instrumentation/AddressSanitizer.cpp

2388

functions

[vitalybuka]

relaxed AllocaLifetimeChecker
check only successors of lifetime markers, no entry

[vitalybuka]

Description

lib/Transforms/Instrumentation/AddressSanitizer.cpp

class AllocaLifetimeChecker {
   // Contains the lifetime state we detected doing depth-first search on the
   // control flow graph. We expect all future hits will have the same value.
   // true: llvm.lifetime.start, false: llvm.lifetime.end
   DenseMap<const BasicBlock *, bool> InboundState;
   bool Processed = false;
   bool CollisionDetected = false;
 
   bool FindCollision(const std::pair<const BasicBlock *, bool> &BlockState) {
-    auto Ins = InboundState.insert(BlockState);
+    for (const BasicBlock *SB : successors(BlockState.first)) {
+      // We may get into EHPad with any lifetime state, so ignore them.
+      if (SB->isEHPad())
+        continue;
+
+      std::pair<const BasicBlock *, bool> NewState = {SB, BlockState.second};
+      auto Ins = InboundState.insert(NewState);
       if (!Ins.second) {
         // Already there. Return collision if they are different.
-      return BlockState.second != Ins.first->second;
-    }
-
-    // Use marker for successors if block contains any.
-    auto M = Markers.find(BlockState.first);
-    bool NewState = (M != Markers.end() ? M->second : BlockState.second);
-    for (const BasicBlock *SB : successors(BlockState.first))
-      // We may get into EHPad with any lifetime state, so ignore them.
-      if (!SB->isEHPad() && FindCollision({SB, NewState}))
+        if (NewState.second != Ins.first->second)
           return true;
-
+      } else {
+        // Don't recurse into markers, we will start search from each of them.
+        if (Markers.find(SB) == Markers.end() && FindCollision(NewState))
+          return true;
+      }
+    }
     return false;
   }
 
 public:
   // Assume that markers of the same block will be added in the same order as
   // the order of corresponding intrinsics, so in the end we will keep only
   // value of the last intrinsic.
   void AddMarker(const BasicBlock *BB, bool start) {
     assert(!Processed);
     Markers[BB] = start;
   }
 
   bool HasAmbiguousLifetime() {
     if (!Processed) {
       Processed = true;
-      const Function *F = Markers.begin()->first->getParent();
-      CollisionDetected = FindCollision({&F->getEntryBlock(), false});
+      for (const auto& M : Markers) {
+        CollisionDetected = FindCollision(M);
+        if (CollisionDetected)
+          break;
+      }
     }
     return CollisionDetected;
   }
 };
 
 // Removes allocas for which exists at least one block simultaneously
 // reachable in both states: allocas is inside the scope, and alloca is outside
 // of the scope. We don't have enough information to validate access to such
void FunctionStackPoisoner::processStaticAllocas() {
   // Write the PC to redzone[2].
   Value *BasePlus2 = IRB.CreateIntToPtr(
       IRB.CreateAdd(LocalStackBase,
                     ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)),
       IntptrPtrTy);
   IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2);
 
   const auto &ShadowAfterScope = GetShadowBytesAfterScope(SVD, L);
+  const auto &ShadowInScope = GetShadowBytes(SVD, L);
 
   // Poison the stack red zones at the entry.
   Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB);
   // As mask we must use most poisoned case: red zones and after scope.
-  // As bytes we can use either the same or just red zones only.
-  copyToShadow(ShadowAfterScope, ShadowAfterScope, IRB, ShadowBase);
+  // In most cases as bytes we can use either the same or just red zones only.
+  // However PR28267 allows functions with several branches, when some
+  // branches have proper sets of lifetime.start/lifetime.end, and some have
+  // none at all. To avoid reports in such cases we assume that on entry
+  // variable is alive, and it will be poisoned only by lifetime.end.
+  // So we poison frame with red zones only, like var inside of the scope.
+  copyToShadow(ShadowAfterScope, ShadowInScope, IRB, ShadowBase);
 
   if (ClExperimentalPoisoning && !StaticAllocaPoisonCallVec.empty()) {
     // Complete AllocaToSVDMap
     for (const auto &Desc : SVD) {
       auto It = AllocaToSVDMap.find(Desc.AI);
       if (It != AllocaToSVDMap.end()) {
         It->second = &Desc;
       }
     }
 
-    const auto &ShadowInScope = GetShadowBytes(SVD, L);
-
     // Poison static allocas near lifetime intrinsics.
     for (const auto &APC : StaticAllocaPoisonCallVec) {
       // Must be already set.
       assert(AllocaToSVDMap[APC.AI]);
       const auto &Desc = *AllocaToSVDMap[APC.AI];
       assert(Desc.Offset % L.Granularity == 0);
       size_t Begin = Desc.Offset / L.Granularity;
       size_t End = Begin + (APC.Size + L.Granularity - 1) / L.Granularity;

test/Instrumentation/AddressSanitizer/lifetime-throw.ll

 @_ZTI3ABC = linkonce_odr constant { i8*, i8* } { i8* bitcast (i8** getelementptr inbounds (i8*, i8** @_ZTVN10__cxxabiv117__class_type_infoE, i64 2) to i8*), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @_ZTS3ABC, i32 0, i32 0) }, comdat
 
 define void @Throw() sanitize_address personality i8* bitcast (i32 (...)* @__gxx_personality_v0 to i8*) {
 ; CHECK-LABEL: define void @Throw()
 entry:
   %x = alloca %struct.ABC, align 4
   %0 = bitcast %struct.ABC* %x to i8*
 
-  ; Poison memory in prologue: F1F1F1F1F8F3F3F3
-  ; CHECK: store i64 -868082052615769615, i64* %{{[0-9]+}}
+  ; Poison memory in prologue: F1F1F1F104F3F3F3
+  ; CHECK: store i64 -868083100587789839, i64* %{{[0-9]+}}
 
   call void @llvm.lifetime.start(i64 4, i8* %0)
   ; CHECK: store i8 4, i8* %{{[0-9]+}}
   ; CHECK-NEXT: @llvm.lifetime.start
 
   %exception = call i8* @__cxa_allocate_exception(i64 4)
   invoke void @__cxa_throw(i8* %exception, i8* bitcast ({ i8*, i8* }* @_ZTI3ABC to i8*), i8* bitcast (void (%struct.ABC*)* @_ZN3ABCD2Ev to i8*)) noreturn
           to label %unreachable unwind label %lpad

 
 define void @ThrowWin() sanitize_address personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
 ; CHECK-LABEL: define void @ThrowWin()
 entry:
   %x = alloca %struct.ABC, align 4
   %tmp = alloca %struct.ABC, align 4
   %0 = bitcast %struct.ABC* %x to i8*
 
-  ; Poison memory in prologue: F1F1F1F1F8F304F2
-  ; CHECK: store i64 -935355671561244175, i64* %{{[0-9]+}}
+  ; Poison memory in prologue: F1F1F1F104F204F3
+  ; CHECK: store i64 -935356719533264399, i64* %{{[0-9]+}}
 
   call void @llvm.lifetime.start(i64 4, i8* %0)
   ; CHECK: store i8 4, i8* %{{[0-9]+}}
   ; CHECK-NEXT: @llvm.lifetime.start
 
   %1 = bitcast %struct.ABC* %tmp to i8*
   invoke void @_CxxThrowException(i8* %1, %eh.ThrowInfo* nonnull @"_TI1?AUABC@@") noreturn
           to label %unreachable unwind label %ehcleanup

test/Instrumentation/AddressSanitizer/lifetime-uar-uas.ll

 
 define i32 @basic_test() sanitize_address {
   ; CHECK-LABEL: define i32 @basic_test()
 
 entry:
   %retval = alloca i32, align 4
   %c = alloca i8, align 1
 
-  ; Memory is poisoned in prologue: F1F1F1F104F3F8F2
-  ; CHECK-UAS: store i64 -866676825215864335, i64* %{{[0-9]+}}
+  ; Memory is poisoned in prologue: F1F1F1F104F201F3
+  ; CHECK-UAS: store i64 -936201144463396367, i64* %{{[0-9]+}}
 
   call void @llvm.lifetime.start(i64 1, i8* %c)
   ; Memory is unpoisoned at llvm.lifetime.start: 01
   ; CHECK-UAS: store i8 1, i8* %{{[0-9]+}}
 
   store volatile i32 0, i32* %retval
   store volatile i8 0, i8* %c, align 1
 

test/Instrumentation/AddressSanitizer/lifetime.ll

 ; Generic case of lifetime analysis.
 define void @lifetime() sanitize_address {
   ; CHECK-LABEL: define void @lifetime()
 
   ; Regular variable lifetime intrinsics.
   %i = alloca i32, align 4
   %i.ptr = bitcast i32* %i to i8*
 
-  ; Poison memory in prologue: F1F1F1F1F8F3F3F3
-  ; CHECK: store i64 -868082052615769615, i64* %{{[0-9]+}}
+  ; Poison memory in prologue: F1F1F1F104F3F3F3
+  ; CHECK: store i64 -868083100587789839, i64* %{{[0-9]+}}
 
   ; Memory is unpoisoned at llvm.lifetime.start
   call void @llvm.lifetime.start(i64 3, i8* %i.ptr)
   ; CHECK: store i8 4, i8* %{{[0-9]+}}
   ; CHECK-NEXT: llvm.lifetime.start
 
   store volatile i8 0, i8* %i.ptr
   ; CHECK: store volatile
entry:
   ; Regular variable lifetime intrinsics.
   %i = alloca i8, align 4  ; Good
   %j = alloca i8, align 4  ; Bad
 
   call void @llvm.lifetime.start(i64 1, i8* %i)
   ; CHECK: store i8 1, i8* %{{[0-9]+}}
   ; CHECK-NEXT: call void @llvm.lifetime.start
 
+  call void @llvm.lifetime.end(i64 1, i8* %j)
+  ; CHECK-DEFAULT-NOT: store i8 -8, i8* %{{[0-9]+}}
+  ; CHECK-AMBIGUOUS: store i8 -8, i8* %{{[0-9]+}}
+  ; CHECK-NEXT: call void @llvm.lifetime.end
+
   br i1 %x, label %bb0, label %bb1
 
 bb0:
   ; CHECK-LABEL: bb0:
 
   call void @llvm.lifetime.start(i64 1, i8* %j)
   ; CHECK-DEFAULT-NOT: store i8 1, i8* %{{[0-9]+}}
   ; CHECK-AMBIGUOUS: store i8 1, i8* %{{[0-9]+}}

 ; Check that arguments of lifetime may come from phi nodes.
 define void @phi_args(i1 %x) sanitize_address {
   ; CHECK-LABEL: define void @phi_args(i1 %x)
 
 entry:
   %i = alloca i64, align 4
   %i.ptr = bitcast i64* %i to i8*
 
-  ; Poison memory in prologue: F1F1F1F1F8F3F3F3
-  ; CHECK: store i64 -868082052615769615, i64* %{{[0-9]+}}
+  ; Poison memory in prologue: F1F1F1F100F3F3F3
+  ; CHECK: store i64 -868083117767659023, i64* %{{[0-9]+}}
 
   call void @llvm.lifetime.start(i64 8, i8* %i.ptr)
   ; CHECK: store i8 0, i8* %{{[0-9]+}}
   ; CHECK-NEXT: llvm.lifetime.start
 
   store volatile i8 0, i8* %i.ptr
   ; CHECK: store volatile
 

test/Instrumentation/AddressSanitizer/stack-poisoning-experimental-be.ll

entry:
   ; ENTRY-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i8]]*
   ; ENTRY-NEXT: store [[TYPE]] -13, [[TYPE]]* [[PTR]], align 1
 
   ; F1F1F1F1
   ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 0
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i32]]*
   ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -235802127, [[TYPE]]* [[PTR]], align 1
 
-  ; F8F8F8...
+  ; 000000...
   ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 4
-  ; ENTRY-UAS-EXP-NEXT: call void @__asan_set_shadow_f8(i64 [[OFFSET]], i64 82)
+  ; ENTRY-UAS-EXP-NEXT: call void @__asan_set_shadow_00(i64 [[OFFSET]], i64 81)
 
-  ; F2F2F2F2F2F2F2F2
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 86
+  ; F2F2F2F2F2F2F202
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 85
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i64]]*
-  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -940422246894996750, [[TYPE]]* [[PTR]], align 1
+  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] 212499257711850226, [[TYPE]]* [[PTR]], align 1
 
   ; F2F2F2F2F2F2F2F2
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 94
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 93
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i64]]*
   ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -940422246894996750, [[TYPE]]* [[PTR]], align 1
 
-  ; F8F8F2F2F8F8F8F8
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 102
+  ; 000000F2F20500F2
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 101
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i64]]*
-  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -506387832706107144, [[TYPE]]* [[PTR]], align 1
+  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -1008799775530680320, [[TYPE]]* [[PTR]], align 1
 
-  ; F8F3F3F3
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 110
+  ; F3F30000
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 109
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i32]]*
-  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -118230029, [[TYPE]]* [[PTR]], align 1
+  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] 62451, [[TYPE]]* [[PTR]], align 1
 
   ; F3F3
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 114
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 113
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i16]]*
   ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -3085, [[TYPE]]* [[PTR]], align 1
 
   ; CHECK-LABEL: %xx = getelementptr inbounds
   ; CHECK-NEXT: %yy = getelementptr inbounds
   ; CHECK-NEXT: %zz = getelementptr inbounds
 
 

test/Instrumentation/AddressSanitizer/stack-poisoning-experimental.ll

entry:
   ; ENTRY-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i8]]*
   ; ENTRY-NEXT: store [[TYPE]] -13, [[TYPE]]* [[PTR]], align 1
 
   ; F1F1F1F1
   ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 0
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i32]]*
   ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -235802127, [[TYPE]]* [[PTR]], align 1
 
-  ; F8F8F8...
+  ; 000000...
   ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 4
-  ; ENTRY-UAS-EXP-NEXT: call void @__asan_set_shadow_f8(i64 [[OFFSET]], i64 82)
+  ; ENTRY-UAS-EXP-NEXT: call void @__asan_set_shadow_00(i64 [[OFFSET]], i64 81)
 
-  ; F2F2F2F2F2F2F2F2
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 86
+  ; 02F2F2F2F2F2F2F2
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 85
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i64]]*
-  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -940422246894996750, [[TYPE]]* [[PTR]], align 1
+  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -940422246894996990, [[TYPE]]* [[PTR]], align 1
 
   ; F2F2F2F2F2F2F2F2
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 94
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 93
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i64]]*
   ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -940422246894996750, [[TYPE]]* [[PTR]], align 1
 
-  ; F8F8F2F2F8F8F8F8
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 102
+  ; F20005F2F2000000
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 101
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i64]]*
-  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -506381209967593224, [[TYPE]]* [[PTR]], align 1
+  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] 1043442499826, [[TYPE]]* [[PTR]], align 1
 
-  ; F8F3F3F3
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 110
+  ; 0000F3F3
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 109
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i32]]*
-  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -202116104, [[TYPE]]* [[PTR]], align 1
+  ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -202178560, [[TYPE]]* [[PTR]], align 1
 
   ; F3F3
-  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 114
+  ; ENTRY-UAS-EXP-NEXT: [[OFFSET:%[0-9]+]] = add i64 [[SHADOW_BASE]], 113
   ; ENTRY-UAS-EXP-NEXT: [[PTR:%[0-9]+]] = inttoptr i64 [[OFFSET]] to [[TYPE:i16]]*
   ; ENTRY-UAS-EXP-NEXT: store [[TYPE]] -3085, [[TYPE]]* [[PTR]], align 1
 
   ; CHECK-LABEL: %xx = getelementptr inbounds
   ; CHECK-NEXT: %yy = getelementptr inbounds
   ; CHECK-NEXT: %zz = getelementptr inbounds