[UBSan] Add silence_unsigned_overflow flag.

[morehouse]

Summary

Setting UBSAN_OPTIONS=silence_unsigned_overflow=1 will silence all UIO
reports. This feature, combined with
-fsanitize-recover=unsigned-integer-overflow, is useful for providing
fuzzing signal without the excessive log output.

Helps with https://github.com/google/oss-fuzz/issues/910.

[vsk]

LGTM, thanks! Just a small nitpick inline.

Also, if you have the time, please document this in clang/docs/UndefinedBehaviorSanitizer.rst.

compiler-rt/test/ubsan/TestCases/Integer/no-recover.cpp

3 ↗

(On Diff #153120)

You can just pass the --allow-empty flag to FileCheck instead of adding the printf.

[morehouse]

• Remove unnecesary printf in test.
• Update documentation.

[filcab]

Why create yet another way to disable the printing of warnings?
Why not use the suppressions mechanism which is already there?

Thank you,
Filipe

[vsk]

In D48660#1147943, @filcab wrote:

Why create yet another way to disable the printing of warnings?
Why not use the suppressions mechanism which is already there?

Thank you,
Filipe

That's a great question. Would that work with stripped binaries or binaries without debug info?

[morehouse]

@kcc, @Dor1s: Did we previously consider using suppressions to silence UIO for OSS-Fuzz?

[eugenis]

Would not suppression kill the fuzzing signal as well?

[morehouse]

In D48660#1148077, @eugenis wrote:

Would not suppression kill the fuzzing signal as well?

I don't think runtime suppressions would?

[eugenis]

Right, I got them confused with blacklist.

[Dor1s]

(sorry for the delayed response, was OOO for a while) Good point regarding suppressions. I don't think we've considered using it.

[morehouse]

In D48660#1147943, @filcab wrote:

Why not use the suppressions mechanism which is already there?

To circle back, @kcc mentioned offline that the existing suppressions mechanism would incur overhead from repeated searches through the suppression list, which is undesirable for fuzzing.

lib/ubsan/ubsan_flags.inc

 
 UBSAN_FLAG(bool, halt_on_error, false,
            "Crash the program after printing the first error report")
 UBSAN_FLAG(bool, print_stacktrace, false,
            "Include full stacktrace into an error report")
 UBSAN_FLAG(const char *, suppressions, "", "Suppressions file name.")
 UBSAN_FLAG(bool, report_error_type, false,
         "Print specific error type instead of 'undefined-behavior' in summary.")
+UBSAN_FLAG(bool, silence_unsigned_overflow, false,
+  "Do not print error reports for unsigned integer overflow. "
+  "Used to provide fuzzing signal without blowing up logs.")

lib/ubsan/ubsan_handlers.cc

 // Error logging entry points for the UBSan runtime.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ubsan_platform.h"
 #if CAN_SANITIZE_UB
 #include "ubsan_handlers.h"
 #include "ubsan_diag.h"
+#include "ubsan_flags.h"
 #include "ubsan_monitor.h"
 
 #include "sanitizer_common/sanitizer_common.h"
 
 using namespace __sanitizer;
 using namespace __ubsan;
 
 namespace __ubsan {
static void handleIntegerOverflowImpl(OverflowData *Data, ValueHandle LHS,
   SourceLocation Loc = Data->Loc.acquire();
   bool IsSigned = Data->Type.isSignedIntegerTy();
   ErrorType ET = IsSigned ? ErrorType::SignedIntegerOverflow
                           : ErrorType::UnsignedIntegerOverflow;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
+  if (!IsSigned && flags()->silence_unsigned_overflow)
+    return;
+
   ScopedReport R(Opts, Loc, ET);
 
   Diag(Loc, DL_Error, ET, "%0 integer overflow: "
                           "%1 %2 %3 cannot be represented in type %4")
       << (IsSigned ? "signed" : "unsigned") << Value(Data->Type, LHS)
       << Operator << RHS << Data->Type;
 }
 

test/ubsan/TestCases/Integer/no-recover.cpp

 // RUN: %clangxx -fsanitize=unsigned-integer-overflow %s -o %t && %run %t 2>&1 | FileCheck %s --check-prefix=RECOVER
 // RUN: %clangxx -fsanitize=unsigned-integer-overflow -fno-sanitize-recover=all -fsanitize-recover=unsigned-integer-overflow %s -o %t && %run %t 2>&1 | FileCheck %s --check-prefix=RECOVER
+// RUN: %env_ubsan_opts=silence_unsigned_overflow=1 %run %t 2>&1 | FileCheck %s --check-prefix=SILENT-RECOVER --allow-empty
 // RUN: %clangxx -fsanitize=unsigned-integer-overflow -fno-sanitize-recover=unsigned-integer-overflow %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=ABORT
 
 #include <stdint.h>
 
 int main() {
   // These promote to 'int'.
   (void)(uint8_t(0xff) + uint8_t(0xff));
   (void)(uint16_t(0xf0fff) + uint16_t(0x0fff));
   // RECOVER-NOT: runtime error
   // ABORT-NOT: runtime error
 
   uint32_t k = 0x87654321;
   k += 0xedcba987;
   // RECOVER: no-recover.cpp:[[@LINE-1]]:5: runtime error: unsigned integer overflow: 2271560481 + 3989547399 cannot be represented in type 'unsigned int'
   // ABORT: no-recover.cpp:[[@LINE-2]]:5: runtime error: unsigned integer overflow: 2271560481 + 3989547399 cannot be represented in type 'unsigned int'
 
   (void)(uint64_t(10000000000000000000ull) + uint64_t(9000000000000000000ull));
   // RECOVER: 10000000000000000000 + 9000000000000000000 cannot be represented in type 'unsigned {{long( long)?}}'
+  // SILENT-RECOVER-NOT: runtime error
   // ABORT-NOT: runtime error
 }