[HWASAN/rt] Implement support for memory intrinsics

[eugenis]

lib/hwasan/hwasan_interceptors_memintrinsics.cc

44

Internal versions are very slow. Just call "memcpy" directly.

Check how __hwasan_loadN is implemented. Move these to hwasan.cc and do the same.

[evgeny777]

Addressed some of review comments
Unfortunately I don't know how to use memset from __hwasan_memset, given this comment in hwasan.cc

// ACHTUNG! No system header includes in this file.

[eugenis]

In D55554#1328211, @evgeny777 wrote:

Addressed some of review comments
Unfortunately I don't know how to use memset from __hwasan_memset, given this comment in hwasan.cc

// ACHTUNG! No system header includes in this file.

I think it only matters for interceptors, where we need to redefine libc functions without knowing their exact signature. It should be OK to remove this comment an include <string.h>.

lib/hwasan/hwasan.cc

532 ↗

(On Diff #177840)

This way -fsanitize-recover does not apply to mem intrinsics. I think, for consistency, there needs to be a __hwasan_memset_noabort variant, used in instrumentation when !Recover.

[kcc]

please don't add system headers to this file.
instead, create a new file that will only contain __hwasan_mem* functions,
and sure, include what you need there.

[evgeny777]

Addressed

[eugenis]

lib/hwasan/hwasan.cc

532 ↗

(On Diff #177840)

please also address this comment

[evgeny777]

lib/hwasan/hwasan.cc

532 ↗

(On Diff #177840)

I noticed that ASAN doesn't have noabort versions, instead mem intrinsic behavior is controlled by halt_on_error flag in runtme. How about doing the same here?

[eugenis]

lib/hwasan/hwasan.cc

532 ↗

(On Diff #177840)

OK, sure.

[evgeny777]

Addressed

[eugenis]

lib/hwasan/hwasan_memintrinsics.cc

29 ↗

(On Diff #178454)

You don't need this - see HwasanOnSIGTRAP, always using ErrorAction::Recover should have the desired behavior.

[evgeny777]

Addressed comments

[eugenis]

LGTM

lib/hwasan/CMakeLists.txt

 include_directories(..)
 
 # Runtime library sources and build flags.
 set(HWASAN_RTL_SOURCES
   hwasan.cc
   hwasan_allocator.cc
   hwasan_dynamic_shadow.cc
   hwasan_interceptors.cc
+  hwasan_interceptors_memintrinsics.cc
   hwasan_linux.cc
   hwasan_poisoning.cc
   hwasan_report.cc
   hwasan_thread.cc
   hwasan_thread_list.cc
   )
 
 set(HWASAN_RTL_CXX_SOURCES

lib/hwasan/hwasan_interceptors_memintrinsics.cc

+//===-- hwasan_interceptors_memintrinsics.cc -----------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===---------------------------------------------------------------------===//
+//
+// This file is a part of HWAddressSanitizer, an address sanity checker.
+//
+// HWASan versions of memcpy, memmove, and memset.
+//===---------------------------------------------------------------------===//
+
+#include "sanitizer_common/sanitizer_common.h"
+#include "sanitizer_common/sanitizer_libc.h"
+
+#include "hwasan.h"
+#include "hwasan_interface_internal.h"
+#include "hwasan_report.h"
+
+using namespace __hwasan;
+
+#define TEST_RANGE(block, size, is_write)                               \
+  do {                                                                  \
+    sptr offset = __hwasan_test_shadow(block, size);                    \
+    if (offset >= 0) {                                                  \
+      GET_CALLER_PC_BP_SP;                                              \
+      GET_FATAL_STACK_TRACE_PC_BP(pc, bp);                              \
+      ReportTagMismatch(&stack, reinterpret_cast<uptr>(block) + offset, \
+                        size - offset, is_write, true);                 \
+      if (__hwasan::flags()->halt_on_error) {                           \
+        Printf("Exiting\n");                                            \
+        Die();                                                          \
+      }                                                                 \
+    }                                                                   \
+  } while (0)
+
+void *__hwasan_memcpy(void *to, const void *from, uptr size) {
+  if (LIKELY(hwasan_inited)) {
+    TEST_RANGE(to, size, true);
+    TEST_RANGE(from, size, false);
+  }
+  return internal_memcpy(to, from, size);
+}
+
+void *__hwasan_memset(void *block, int c, uptr size) {
+  if (LIKELY(hwasan_inited))
+    TEST_RANGE(block, size, true);
+  return internal_memset(block, c, size);
+}
+
+void *__hwasan_memmove(void *to, const void *from, uptr size) {
+  if (LIKELY(hwasan_inited)) {
+    TEST_RANGE(to, size, true);
+    TEST_RANGE(from, size, false);
+  }
+  return internal_memcpy(to, from, size);
+}

lib/hwasan/hwasan_interface_internal.h

 SANITIZER_INTERFACE_ATTRIBUTE
 void * __sanitizer_calloc(uptr nmemb, uptr size);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void * __sanitizer_realloc(void *ptr, uptr size);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void * __sanitizer_malloc(uptr size);
+
+SANITIZER_INTERFACE_ATTRIBUTE
+void *__hwasan_memcpy(void *dst, const void *src, uptr size);
+SANITIZER_INTERFACE_ATTRIBUTE
+void *__hwasan_memset(void *s, int c, uptr n);
+SANITIZER_INTERFACE_ATTRIBUTE
+void *__hwasan_memmove(void *dest, const void *src, uptr n);
 }  // extern "C"
 
 #endif  // HWASAN_INTERFACE_INTERNAL_H

test/hwasan/TestCases/mem-intrinsics.c

+// RUN: %clang_hwasan %s -DTEST_NO=1 -mllvm -hwasan-instrument-mem-intrinsics -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=WRITE
+// RUN: %clang_hwasan %s -DTEST_NO=2 -mllvm -hwasan-instrument-mem-intrinsics -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=READ
+// RUN: %clang_hwasan %s -DTEST_NO=3 -mllvm -hwasan-instrument-mem-intrinsics -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=WRITE
+
+// REQUIRES: stable-runtime
+
+#include <sanitizer/hwasan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int main() {
+  char Q[16];
+  char P[16];
+#if TEST_NO == 1
+  memset(Q, 0, 32);
+#elif TEST_NO == 2
+  memmove(Q, Q + 16, 16);
+#elif TEST_NO == 3
+  memcpy(Q, P, 32);
+#endif
+  // WRITE: ERROR: HWAddressSanitizer: tag-mismatch on address
+  // WRITE: WRITE of size 16 at {{.*}} tags: [[PTR_TAG:..]]/[[MEM_TAG:..]] (ptr/mem)
+  // WRITE: Memory tags around the buggy address (one tag corresponds to 16 bytes):
+  // WRITE: =>{{.*}}[[MEM_TAG]]
+
+  // READ: ERROR: HWAddressSanitizer: tag-mismatch on address
+  // READ: READ of size 16 at {{.*}} tags: [[PTR_TAG:..]]/[[MEM_TAG:..]] (ptr/mem)
+  // READ: Memory tags around the buggy address (one tag corresponds to 16 bytes):
+  // READ: =>{{.*}}[[MEM_TAG]]
+  return 0;
+}