[asan] Print a "PC is at a non-executable memory region" message if that's the case

[filcab]

Summary

Points the user to look at function pointer assignments.

[filcab]

We can probably remove zero_page_pc.cc since it would share a lot with this one anyway. So I added the same checks here.

[kcc]

LGTM with a nit, nice!

lib/asan/asan_errors.cc

67 ↗

(On Diff #89945)

start with "Hint: " as in some other similarplaces

[vlad.tsyrklevich]

@filcab From the commit history it looks like this test was re-landed with a REQUIRES: linux || freebsd to fix the ppc64be sanitizer bot but those features weren't actually set on linux/freebsd until I just landed https://reviews.llvm.org/rCRT336633 so the test is failing again. http://lab.llvm.org:8011/builders/sanitizer-ppc64be-linux/builds/7924/steps/64-bit%20check-asan-dynamic/logs/stdio

Did you have a PPC environment to test this change against originally? I'm not sure what the correct fix is.

[uweigand]

This is also failing on s390x (randomly). The problem is that we don't actually have a non-executable flag, so the processor *will* execute the contents of "array" as code. Depending on what's there (it is just uninitialized memory), this will crash sooner or later, but in a way that may or may not make the check succeed randomly.

I believe this (i.e. the "n" variant of the test) should only be attempted on architectures that are actually supposed to have non-execute protection.

[uweigand]

I've now disabled the test on s390 to get the build bot going reliably again.

[syzaara]

@kcc @filcab Should this test be disabled for PPC?

[vlad.tsyrklevich]

I've updated the test to be x86/x86_64 only in r336714

compiler-rt/trunk/lib/asan/asan_errors.cc

static void MaybeDumpInstructionBytes(uptr pc) {
   Report("%s", str.data());
 }
 
 static void MaybeDumpRegisters(void *context) {
   if (!flags()->dump_registers) return;
   SignalContext::DumpAllRegisters(context);
 }
 
+static void MaybeReportNonExecRegion(uptr pc) {
+  MemoryMappingLayout proc_maps(/*cache_enabled*/ true);
+  uptr start, end, protection;
+  while (proc_maps.Next(&start, &end, nullptr, nullptr, 0, &protection)) {
+    if (pc >= start && pc < end &&
+        !(protection & MemoryMappingLayout::kProtectionExecute))
+      Report("Hint: PC is at a non-executable region. Maybe a wild jump?\n");
+  }
+}
+
 void ErrorDeadlySignal::Print() {
   Decorator d;
   Printf("%s", d.Warning());
   const char *description = __sanitizer::DescribeSignalOrException(signo);
   Report(
       "ERROR: AddressSanitizer: %s on unknown address %p (pc %p bp %p sp %p "
       "T%d)\n",
       description, (void *)addr, (void *)pc, (void *)bp, (void *)sp, tid);
   Printf("%s", d.EndWarning());
   if (pc < GetPageSizeCached()) Report("Hint: pc points to the zero page.\n");
   if (is_memory_access) {
     const char *access_type =
         write_flag == SignalContext::WRITE
             ? "WRITE"
             : (write_flag == SignalContext::READ ? "READ" : "UNKNOWN");
     Report("The signal is caused by a %s memory access.\n", access_type);
     if (addr < GetPageSizeCached())
       Report("Hint: address points to the zero page.\n");
   }
+  MaybeReportNonExecRegion(pc);
   scariness.Print();
   BufferedStackTrace stack;
   GetStackTraceWithPcBpAndContext(&stack, kStackTraceMax, pc, bp, context,
                                   common_flags()->fast_unwind_on_fatal);
   stack.Print();
   MaybeDumpInstructionBytes(pc);
   MaybeDumpRegisters(context);
   Printf("AddressSanitizer can not provide additional info.\n");

compiler-rt/trunk/test/asan/TestCases/non-executable-pc.cpp

+// RUN: %clangxx_asan %s -o %t
+// RUN: not %run %t 0 2>&1 | FileCheck %s
+// RUN: not %run %t n 2>&1 | FileCheck %s -check-prefix=CHECK -check-prefix=NON_EXEC
+
+#include <assert.h>
+char array[42];
+
+typedef void void_f();
+int main(int argc, char **argv) {
+  void_f *func;
+  assert(argc > 1);
+  if (argv[1][0] == '0') {
+    func = (void_f *)0x04;
+  } else {
+    assert(argv[1][0] == 'n');
+    func = (void_f *)array;
+  }
+
+  func();
+  // x86 reports the SEGV with both address=X and pc=X.
+  // On PowerPC64 ELFv1, the pointer is taken to be a function-descriptor
+  // pointer out of which three 64-bit quantities are read. This will SEGV, but
+  // the compiler is free to choose the order. As a result, the address is
+  // either X, X+0x8 or X+0x10. The pc is still in main() because it has not
+  // actually made the call when the faulting access occurs.
+  // CHECK: DEADLYSIGNAL
+  // CHECK: {{AddressSanitizer: (SEGV|access-violation).*(address|pc) }}
+  // NON_EXEC: PC is at a non-executable region. Maybe a wild jump?
+  return 0;
+}