Do not rely on that subject of ErrorAllocTypeMismatch is a heap address.

[marxin]

Summary

When delete operator is called for a stack memory address, what can happen is that:

#0  __asan::Allocator::AtomicallySetQuarantineFlagIfAllocated (this=0x7ffff7fa62e1 <typeinfo name for std::locale::facet+1>, m=0x7ffff7cb04b0 <__sanitizer::theDepot+7184496>, ptr=0x12400, stack=0x7ffff75d6440 <__sanitizer::theDepot>)
    at /home/marxin/Programming/gcc/libsanitizer/asan/asan_allocator.cc:548
#1  0x00007ffff73e3ff8 in __asan::Allocator::Deallocate (this=0x7ffff7530e80 <__asan::instance>, ptr=0x7fffffffdab0, delete_size=16, delete_alignment=0, stack=0x7fffffffd1d0, alloc_type=__asan::FROM_NEW)
    at /home/marxin/Programming/gcc/libsanitizer/asan/asan_allocator.cc:629
#2  0x00007ffff73dfd9c in __asan::asan_delete (ptr=0x7fffffffdab0, size=16, alignment=0, stack=0x7fffffffd1d0, alloc_type=__asan::FROM_NEW) at /home/marxin/Programming/gcc/libsanitizer/asan/asan_allocator.cc:870
#3  0x00007ffff74b5aca in operator delete (ptr=0x7fffffffdab0, size=16) at /home/marxin/Programming/gcc/libsanitizer/asan/asan_new_delete.cc:177
#4  0x0000000000401554 in Baz::~Baz (this=0x7fffffffda70, __in_chrg=<optimized out>) at pr86229-v2.cpp:25
#5  0x00000000004013bf in main () at pr86229-v2.cpp:32

but luckily:

(gdb) p m->chunk_state
$4 = 2

thus AtomicallySetQuarantineFlagIfAllocated does not call ReportInvalidFree.
But then we correctly call ReportAllocTypeMismatch, but currently only a heap address is expected:

GetHeapAddressInformation(addr, 1, &addr_description);

That however immediately bails out because it's not a heap address. And thus we end up with uninitialized
addr_description. That then triggers a crash in Print function.

[kcc]

Vitaly, please review.
Martin, is a test possible here?

[vitalybuka]

lib/asan/asan_errors.h

114 ↗

(On Diff #175112)

Please use approach similar to ErrorFreeNotMalloced with "AddressDescription addr_description;"

123 ↗

(On Diff #175112)

please clang-format the patch
e.g

git clang-format -f --style=file HEAD^

[marxin]

Updated patch, I also found a test-case that fails for clang before my patch:

cat pr86229-bad.cpp
#include <iostream>

struct FooBar {
  int kii;
  int lii;
  int lii3;
};

struct Baz {
  FooBar *foo;

  Baz(FooBar *f) : foo(f) {}

  Baz() {
    foo = new FooBar();
  }

  ~Baz() {
    delete foo;
  }
};

void setme(volatile int *p)
{
  *p = 2;
}

int main() {
  int a;
  setme (&a);

  FooBar f;
  __builtin_printf ("&f: %p\n", &f);
  Baz baz(&f);
  return 0;
}

$ clang++ pr86229-bad.cpp -fsanitize=address && ./a.out
&f: 0x7fffffffda90
=================================================================
==20122==ERROR: AddressSanitizer: alloc-dealloc-mismatch (INVALID vs operator delete) on 0x000000009000
    #0 0x52bda8 in operator delete(void*) /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:167:3
    #1 0x52e6a1 in Baz::~Baz() (/home/marxin/Programming/testcases/a.out+0x52e6a1)
    #2 0x52e523 in main (/home/marxin/Programming/testcases/a.out+0x52e523)
    #3 0x7ffff7061fea in __libc_start_main /usr/src/debug/glibc-2.27-6.1.x86_64/csu/../csu/libc-start.c:308:16
    #4 0x41e379 in _start /home/abuild/rpmbuild/BUILD/glibc-2.27/csu/../sysdeps/x86_64/start.S:120

0x000000001000 is located 5537600 bytes to the left of 140737488345936-byte region [0x000000576c20,0x800000574770)
==20122==AddressSanitizer CHECK failed: /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_descriptions.cc:178 "((res.trace)) != (0)" (0x0, 0x0)
    #0 0x4fc38b in __asan::AsanCheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_rtl.cc:74:5
    #1 0x514f69 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_termination.cc:79:24
    #2 0x42c74c in GetStackTraceFromId /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_descriptions.cc:178:3
    #3 0x42c74c in __asan::HeapAddressDescription::Print() const /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_descriptions.cc:418:62
    #4 0x42d682 in __asan::ErrorAllocTypeMismatch::Print() /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_errors.cc:136:25
    #5 0x4f6515 in __asan::ErrorDescription::Print() /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_errors.h:423:7
    #6 0x4f6515 in _ZN6__asan19ScopedInErrorReportD4Ev /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_report.cc:142:55
    #7 0x4f6515 in __asan::ReportAllocTypeMismatch(unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, __asan::AllocType) /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_report.cc:241:23
    #8 0x4273d6 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_allocator.cc:635:32
    #9 0x52bd82 in operator delete(void*) /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:167:3
    #10 0x52e6a1 in Baz::~Baz() (/home/marxin/Programming/testcases/a.out+0x52e6a1)
    #11 0x52e523 in main (/home/marxin/Programming/testcases/a.out+0x52e523)
    #12 0x7ffff7061fea in __libc_start_main /usr/src/debug/glibc-2.27-6.1.x86_64/csu/../csu/libc-start.c:308:16
    #13 0x41e379 in _start /home/abuild/rpmbuild/BUILD/glibc-2.27/csu/../sysdeps/x86_64/start.S:120

with the patch applied I see:

$ clang++ pr86229-bad.cpp -fsanitize=address && ./a.out
&f: 0x7fffffffda90
=================================================================
==24415==ERROR: AddressSanitizer: alloc-dealloc-mismatch (INVALID vs operator delete) on 0x7fffffffda90
    #0 0x52bef8 in operator delete(void*) /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:167:3
    #1 0x52e7f1 in Baz::~Baz() (/home/marxin/Programming/testcases/a.out+0x52e7f1)
    #2 0x52e673 in main (/home/marxin/Programming/testcases/a.out+0x52e673)
    #3 0x7ffff7061fea in __libc_start_main /usr/src/debug/glibc-2.27-6.1.x86_64/csu/../csu/libc-start.c:308:16
    #4 0x41e379 in _start /home/abuild/rpmbuild/BUILD/glibc-2.27/csu/../sysdeps/x86_64/start.S:120

Address 0x7fffffffda90 is located in stack of thread T0 at offset 48 in frame
    #0 0x52e52f in main (/home/marxin/Programming/testcases/a.out+0x52e52f)

  This frame has 3 object(s):
    [32, 36) 'a'
    [48, 60) 'f' <== Memory access at offset 48 is inside this variable
    [80, 88) 'baz'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: alloc-dealloc-mismatch /home/marxin/BIG/Programming/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:167:3 in operator delete(void*)
==24415==HINT: if you don't care about these errors you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0
==24415==ABORTING

Note that I have issues with running asan test due to i386 target that cmake configures, but then linkage fails.
I would appreciate if you adapt the test, thanks.

[marxin]

@vitalybuka: I modified the patch based on your notes.

[kcc]

could you please actually add the test to the patch?
(somewhere to compiler-rt/test/asan/TestCases/Linux, probably)

[vitalybuka]

Thanks, code LGTM

In D54856#1309991, @kcc wrote:

could you please actually add the test to the patch?
(somewhere to compiler-rt/test/asan/TestCases/Linux, probably)

I'd recommend a tests which check reports for all possible new types of pointers.
Similar example is TestCases/Linux/new_delete_mismatch.cc.
You can use argv[1] to test different types in a single test.

[marxin]

Updated patch that introduces 2 new tests.

[vitalybuka]

lib/asan/asan_errors.h

122 ↗

(On Diff #175666)

/asan_errors.h:122:9: warning: field 'dealloc_type' will be initialized after field 'addr_description' [-Wreorder]

test/asan/TestCases/Linux/new_delete_mismatch_stack.cc

17 ↗

(On Diff #175666)

Fails on 32 bit

/usr/local/google/home/vitalybuka/src/llvm.git/llvm-project/compiler-rt/test/asan/TestCases/Linux/new_delete_mismatch_stack.cc:17:11: error: CHECK: expected string not found in input
// CHECK: 'a'{{.*}} <== Memory access at offset 32 is inside this variable
          ^
<stdin>:8:63: note: scanning from here
Address 0xff911490 is located in stack of thread T0 at offset 16 in frame
                                                              ^
<stdin>:12:17: note: possible intended match here
 [16, 26) 'a' (line 10) <== Memory access at offset 16 is inside this variable
                ^

--

********************
Testing: 0 .. 10.. 20.. 30.. 40.. 50.. 60.. 70.. 80.. 90.. 
Testing Time: 26.45s
********************
Failing Tests (1):
    AddressSanitizer-i386-linux :: TestCases/Linux/new_delete_mismatch_stack.cc

[marxin]

Thanks for testing Vitaly. I must confirm that i386 is broken on my openSUSE, thus I can't test that.

[marxin]

Updated version of the patch.

[marxin]

The right patch, previous one belongs to GCC :)

[vitalybuka]

Thanks,
LGTM

[marxin]

It's installed.

gcc/asan.h

    up to 2 * ASAN_RED_ZONE_SIZE - 1 bytes.  */
 #define ASAN_RED_ZONE_SIZE  32
 
+/* Stack variable use more compact red zones.  The size includes also
+   size of variable itself.  */
+
+#define ASAN_MIN_RED_ZONE_SIZE  16
+
 /* Shadow memory values for stack protection.  Left is below protected vars,
    the first pointer in stack corresponding to that offset contains
    ASAN_STACK_FRAME_MAGIC word, the second pointer to a string describing

   return c ? 2 * ASAN_RED_ZONE_SIZE - c : ASAN_RED_ZONE_SIZE;
 }
 
+/* Return how much a stack variable occupis on a stack
+   including a space for red zone.  */
+
+static inline unsigned HOST_WIDE_INT
+asan_var_and_redzone_size (unsigned HOST_WIDE_INT size)
+{
+  if (size <= 4)
+    return 16;
+  else if (size <= 16)
+    return 32;
+  else if (size <= 128)
+    return size + 32;
+  else if (size <= 512)
+    return size + 64;
+  else if (size <= 4096)
+    return size + 128;
+  else
+    return size + 256;
+}
+
 extern bool set_asan_shadow_offset (const char *);
 
 extern void set_sanitized_sections (const char *);

gcc/asan.c

   return build1 (ADDR_EXPR, shadow_ptr_types[0], ret);
 }
 
-/* Return a CONST_INT representing 4 subsequent shadow memory bytes.  */
-
-static rtx
-asan_shadow_cst (unsigned char shadow_bytes[4])
-{
-  int i;
-  unsigned HOST_WIDE_INT val = 0;
-  gcc_assert (WORDS_BIG_ENDIAN == BYTES_BIG_ENDIAN);
-  for (i = 0; i < 4; i++)
-    val |= (unsigned HOST_WIDE_INT) shadow_bytes[BYTES_BIG_ENDIAN ? 3 - i : i]
-     << (BITS_PER_UNIT * i);
-  return gen_int_mode (val, SImode);
-}
-
 /* Clear shadow memory at SHADOW_MEM, LEN bytes.  Can't call a library call here
    though.  */
 

   return ROUND_UP (size, ASAN_SHADOW_GRANULARITY) / ASAN_SHADOW_GRANULARITY;
 }
 
+/* Always emit 4 bytes at a time.  */
+#define RZ_BUFFER_SIZE 4
+
+/* ASAN redzone buffer container that handles emission of shadow bytes.  */
+struct asan_redzone_buffer
+{
+  /* Constructor.  */
+  asan_redzone_buffer (rtx shadow_mem, HOST_WIDE_INT prev_offset):
+    m_shadow_mem (shadow_mem), m_prev_offset (prev_offset),
+    m_original_offset (prev_offset), m_shadow_bytes (RZ_BUFFER_SIZE)
+  {}
+
+  /* Emit VALUE shadow byte at a given OFFSET.  */
+  void emit_redzone_byte (HOST_WIDE_INT offset, unsigned char value);
+
+  /* Emit RTX emission of the content of the buffer.  */
+  void flush_redzone_payload (void);
+
+private:
+  /* Flush if the content of the buffer is full
+     (equal to RZ_BUFFER_SIZE).  */
+  void flush_if_full (void);
+
+  /* Memory where we last emitted a redzone payload.  */
+  rtx m_shadow_mem;
+
+  /* Relative offset where we last emitted a redzone payload.  */
+  HOST_WIDE_INT m_prev_offset;
+
+  /* Relative original offset.  Used for checking only.  */
+  HOST_WIDE_INT m_original_offset;
+
+public:
+  /* Buffer with redzone payload.  */
+  auto_vec<unsigned char> m_shadow_bytes;
+};
+
+/* Emit VALUE shadow byte at a given OFFSET.  */
+
+void
+asan_redzone_buffer::emit_redzone_byte (HOST_WIDE_INT offset,
+          unsigned char value)
+{
+  gcc_assert ((offset & (ASAN_SHADOW_GRANULARITY - 1)) == 0);
+  gcc_assert (offset >= m_prev_offset);
+
+  HOST_WIDE_INT off
+    = m_prev_offset + ASAN_SHADOW_GRANULARITY * m_shadow_bytes.length ();
+  if (off == offset)
+    {
+      /* Consecutive shadow memory byte.  */
+      m_shadow_bytes.safe_push (value);
+      flush_if_full ();
+    }
+  else
+    {
+      if (!m_shadow_bytes.is_empty ())
+  flush_redzone_payload ();
+
+      /* Maybe start earlier in order to use aligned store.  */
+      HOST_WIDE_INT align = (offset - m_prev_offset) % ASAN_RED_ZONE_SIZE;
+      if (align)
+  {
+    offset -= align;
+    for (unsigned i = 0; i < align / BITS_PER_UNIT; i++)
+      m_shadow_bytes.safe_push (0);
+  }
+
+      /* Adjust m_prev_offset and m_shadow_mem.  */
+      HOST_WIDE_INT diff = offset - m_prev_offset;
+      m_shadow_mem = adjust_address (m_shadow_mem, VOIDmode,
+             diff >> ASAN_SHADOW_SHIFT);
+      m_prev_offset = offset;
+      m_shadow_bytes.safe_push (value);
+      flush_if_full ();
+    }
+}
+
+/* Emit RTX emission of the content of the buffer.  */
+
+void
+asan_redzone_buffer::flush_redzone_payload (void)
+{
+  gcc_assert (WORDS_BIG_ENDIAN == BYTES_BIG_ENDIAN);
+
+  if (m_shadow_bytes.is_empty ())
+    return;
+
+  /* Be sure we always emit to an aligned address.  */
+  gcc_assert (((m_prev_offset - m_original_offset)
+        & (ASAN_RED_ZONE_SIZE - 1)) == 0);
+
+  /* Fill it to RZ_BUFFER_SIZE bytes with zeros if needed.  */
+  unsigned l = m_shadow_bytes.length ();
+  for (unsigned i = 0; i <= RZ_BUFFER_SIZE - l; i++)
+    m_shadow_bytes.safe_push (0);
+
+  if (dump_file && (dump_flags & TDF_DETAILS))
+    fprintf (dump_file,
+       "Flushing rzbuffer at offset %" PRId64 " with: ", m_prev_offset);
+
+  unsigned HOST_WIDE_INT val = 0;
+  for (unsigned i = 0; i < RZ_BUFFER_SIZE; i++)
+    {
+      unsigned char v
+  = m_shadow_bytes[BYTES_BIG_ENDIAN ? RZ_BUFFER_SIZE - i : i];
+      val |= (unsigned HOST_WIDE_INT)v << (BITS_PER_UNIT * i);
+      if (dump_file && (dump_flags & TDF_DETAILS))
+  fprintf (dump_file, "%02x ", v);
+    }
+
+  if (dump_file && (dump_flags & TDF_DETAILS))
+    fprintf (dump_file, "\n");
+
+  rtx c = gen_int_mode (val, SImode);
+  m_shadow_mem = adjust_address (m_shadow_mem, SImode, 0);
+  emit_move_insn (m_shadow_mem, c);
+  m_shadow_bytes.truncate (0);
+}
+
+/* Flush if the content of the buffer is full
+   (equal to RZ_BUFFER_SIZE).  */
+
+void
+asan_redzone_buffer::flush_if_full (void)
+{
+  if (m_shadow_bytes.length () == RZ_BUFFER_SIZE)
+    flush_redzone_payload ();
+}
+
 /* Insert code to protect stack vars.  The prologue sequence should be emitted
    directly, epilogue sequence returned.  BASE is the register holding the
    stack base, against which OFFSETS array offsets are relative to, OFFSETS

   rtx_code_label *lab;
   rtx_insn *insns;
   char buf[32];
-  unsigned char shadow_bytes[4];
   HOST_WIDE_INT base_offset = offsets[length - 1];
   HOST_WIDE_INT base_align_bias = 0, offset, prev_offset;
   HOST_WIDE_INT asan_frame_size = offsets[0] - base_offset;

          + (base_align_bias >> ASAN_SHADOW_SHIFT));
   gcc_assert (asan_shadow_set != -1
         && (ASAN_RED_ZONE_SIZE >> ASAN_SHADOW_SHIFT) == 4);
-  shadow_mem = gen_rtx_MEM (SImode, shadow_base);
+  shadow_mem = gen_rtx_MEM (QImode, shadow_base);
   set_mem_alias_set (shadow_mem, asan_shadow_set);
   if (STRICT_ALIGNMENT)
     set_mem_align (shadow_mem, (GET_MODE_ALIGNMENT (SImode)));
   prev_offset = base_offset;
+
+  asan_redzone_buffer rz_buffer (shadow_mem, prev_offset);
   for (l = length; l; l -= 2)
     {
       if (l == 2)
   cur_shadow_byte = ASAN_STACK_MAGIC_RIGHT;
       offset = offsets[l - 1];
-      if ((offset - base_offset) & (ASAN_RED_ZONE_SIZE - 1))
+
+      bool extra_byte = (offset - base_offset) & (ASAN_SHADOW_GRANULARITY - 1);
+      /* If a red-zone is not aligned to ASAN_SHADOW_GRANULARITY then
+   the previous stack variable has size % ASAN_SHADOW_GRANULARITY != 0.
+   In that case we have to emit one extra byte that will describe
+   how many bytes (our of ASAN_SHADOW_GRANULARITY) can be accessed.  */
+      if (extra_byte)
   {
-    int i;
     HOST_WIDE_INT aoff
       = base_offset + ((offset - base_offset)
-           & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
-    shadow_mem = adjust_address (shadow_mem, VOIDmode,
-               (aoff - prev_offset)
-               >> ASAN_SHADOW_SHIFT);
-    prev_offset = aoff;
-    for (i = 0; i < 4; i++, aoff += ASAN_SHADOW_GRANULARITY)
-      if (aoff < offset)
-        {
-    if (aoff < offset - (HOST_WIDE_INT)ASAN_SHADOW_GRANULARITY + 1)
-      shadow_bytes[i] = 0;
-    else
-      shadow_bytes[i] = offset - aoff;
-        }
-      else
-        shadow_bytes[i] = ASAN_STACK_MAGIC_MIDDLE;
-    emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
-    offset = aoff;
+           & ~(ASAN_SHADOW_GRANULARITY - HOST_WIDE_INT_1));
+    rz_buffer.emit_redzone_byte (aoff, offset - aoff);
+    offset = aoff + ASAN_SHADOW_GRANULARITY;
   }
-      while (offset <= offsets[l - 2] - ASAN_RED_ZONE_SIZE)
+
+      /* Calculate size of red zone payload.  */
+      while (offset < offsets[l - 2])
   {
-    shadow_mem = adjust_address (shadow_mem, VOIDmode,
-               (offset - prev_offset)
-               >> ASAN_SHADOW_SHIFT);
-    prev_offset = offset;
-    memset (shadow_bytes, cur_shadow_byte, 4);
-    emit_move_insn (shadow_mem, asan_shadow_cst (shadow_bytes));
-    offset += ASAN_RED_ZONE_SIZE;
+    rz_buffer.emit_redzone_byte (offset, cur_shadow_byte);
+    offset += ASAN_SHADOW_GRANULARITY;
   }
+
       cur_shadow_byte = ASAN_STACK_MAGIC_MIDDLE;
     }
+
+  /* As the automatic variables are aligned to
+     ASAN_RED_ZONE_SIZE / ASAN_SHADOW_GRANULARITY, the buffer should be
+     flushed here.  */
+  gcc_assert (rz_buffer.m_shadow_bytes.is_empty ());
+
   do_pending_stack_adjust ();
 
   /* Construct epilogue sequence.  */

   for (l = length; l; l -= 2)
     {
       offset = base_offset + ((offsets[l - 1] - base_offset)
-           & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
+           & ~(ASAN_MIN_RED_ZONE_SIZE - HOST_WIDE_INT_1));
       if (last_offset + last_size != offset)
   {
     shadow_mem = adjust_address (shadow_mem, VOIDmode,

     last_size = 0;
   }
       last_size += base_offset + ((offsets[l - 2] - base_offset)
-          & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1))
+          & ~(ASAN_MIN_RED_ZONE_SIZE - HOST_WIDE_INT_1))
        - offset;
 
       /* Unpoison shadow memory that corresponds to a variable that is 

          "%s (%" PRId64 " B)\n", n, size);
     }
 
-    last_size += size & ~(ASAN_RED_ZONE_SIZE - HOST_WIDE_INT_1);
+    last_size += size & ~(ASAN_MIN_RED_ZONE_SIZE - HOST_WIDE_INT_1);
       }
   }
     }

gcc/cfgexpand.c

         && stack_vars[i].size.is_constant ())
       {
         prev_offset = align_base (prev_offset,
-          MAX (alignb, ASAN_RED_ZONE_SIZE),
+          MAX (alignb, ASAN_MIN_RED_ZONE_SIZE),
           !FRAME_GROWS_DOWNWARD);
         tree repr_decl = NULL_TREE;
-        offset
-    = alloc_stack_frame_space (stack_vars[i].size
-             + ASAN_RED_ZONE_SIZE,
-             MAX (alignb, ASAN_RED_ZONE_SIZE));
+        unsigned HOST_WIDE_INT size
+    = asan_var_and_redzone_size (stack_vars[i].size.to_constant ());
+        if (data->asan_vec.is_empty ())
+    size = MAX (size, ASAN_RED_ZONE_SIZE);
+
+        unsigned HOST_WIDE_INT alignment = MAX (alignb,
+                  ASAN_MIN_RED_ZONE_SIZE);
+        offset = alloc_stack_frame_space (size, alignment);
 
         data->asan_vec.safe_push (prev_offset);
         /* Allocating a constant amount of space from a constant

gcc/testsuite/c-c++-common/asan/asan-stack-small.c

+/* { dg-do run } */
+
+char *pa;
+char *pb;
+char *pc;
+
+void access (volatile char *ptr)
+{
+  *ptr = 'x';
+}
+
+int main (int argc, char **argv)
+{
+  char a;
+  char b;
+  char c;
+
+  pa = &a;
+  pb = &b;
+  pc = &c;
+
+  access (pb);
+  access (pc);
+  // access 'b' here
+  access (pa + 32);
+
+  return 0;
+}