[asan] Unpoison signal alternate stack.

[robot]

Summary

Before unwinding the stack, __asan_handle_no_return is supposed to
unpoison the entire stack - that is, remove the entries in the shadow
memory corresponding to stack (e.g. redzone markers around variables).
This does not work correctly if __asan_handle_no_return is called from
the alternate stack used in signal handlers, because the stack top is
read from a cache, which yields the default stack top instead of the
signal alternate stack top.

It is also possible to jump between the default stack and the signal
alternate stack. Therefore, __asan_handle_no_return needs to unpoison
both.

[robot]

Rebased, slightly better error reporting in test.

[robot]

Fix clang-tidy issues. This cause inconsistency in code style in asan (snake case vs camel case), because I did not want to touch all the asan code in this patch.

[eugenis]

compiler-rt/lib/asan/asan_rtl.cpp

612

I do not think this is true - false positive reports are only possible if we fail the kMaxExpectedCleanupSize check below.
Remove this statement?

compiler-rt/lib/sanitizer_common/sanitizer_common.h

331

I want to say that this will break compilation on fuchsia and rtems because you only have definitions for posix + win, but then we have the same situation with GetThreadStackAndTls on fuchsia, and things are somehow fine. Any idea why? Consider adding an inline implementation in the header under the complementary condition (i.e. not-posix).

[robot]

Refactored the way stack bounds are acquired in __asan_handle_no_return. This should fix compilation on Fuchsia and RTEMS.

compiler-rt/lib/asan/asan_rtl.cpp

612

You sent me down a rabbit hole there :)
My initial reasoning was indeed flawed, but I still think a false positive is possible in the context. Please see the comment I've added to the source.

compiler-rt/lib/sanitizer_common/sanitizer_common.h

331

From a bit of experimentation, I think the dead branches are dropped even at -O0. Therefore there's never a symbol reference for the linker to resolve.

Regarding Fuchsia and RTEMS, I've pondered a bit on where to put things, and came up with another approach. It's more intrusive but avoids noop-functions. Please let me know what you think.

[robot]

Improve portability by supplying fd=-1 to mmap.

[robot]

Fix Windows and MacOS builds:

• #ifdef SANITIZER_POSIX -> #if SANITIZER_POSIX (it's always defined)
• don't address sigaction::sa_restorer member, just let it be implicitly zero-initialized
• use sigemptyset to clear the signal mask

[robot]

Would be great if you could have another look.

[eugenis]

Sorry for the delay.

I find this very hard to read. You add 150 lines to asan_rtl.cpp that do basically nothing. There is maybe 10 lines of the actual logic. I wonder if the same could be expressed in less code, and especially in fewer functions?

[kcc]

also, please avoid #ifdefs.
OS-specific code should go to an OS-specific file.

[vitalybuka]

compiler-rt/lib/asan/asan_rtl.cpp

641

historically code in sanitizer_common and other sanitizers follow Google C++ style, not LLVM
please keep it consistent.

692

Please, extract into a single NFC patch the code
you move existing code for stack calculation into a new function with
common for all platforms. e.g. like the getCurrentStackBounds
and move the current relevant code there. Please put implementation into relevant platform specific files. This will help us avoid ifdef

Then you can rebase D76986 so it will be about behavior changes only without any refactoring.

compiler-rt/lib/sanitizer_common/sanitizer_posix.h

123 ↗

(On Diff #258685)

Code should try to match style around. These comments looks very different from what is on the rest of sanitizer_common

compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp

212

this easily can be compiled into libc memset interceptors, that's why we use
internal_memset(&sigact, 0, sizeof(sigact)); around

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

56

I guess all above is irrelevant to the test?
In most case here just ignoring the return code is appropriate solution.

89

it could be more readable if you inline both these functions

[robot]

Split refactoring into separate commit.

[robot]

I'm trying to split this into two changes, please bear with my while I'm trying to figure out Phabricator & Arcanist.

compiler-rt/lib/asan/asan_rtl.cpp

641

I see. I was trying to satisfy Harbormaster's clang-format checks, which complained about my original code and suggested LLVM style. I've tried to adapt.

692

That's a great idea, thanks! I've reduced the refactoring to a small amount, unfortunately I didn't find a better solution than to introduce customization points for RTEMS, Fuchsia, POSIX and Windows. Logically speaking, those all behave differently, but only slightly. I've struggled with making this difference explicit without duplicating code.

compiler-rt/lib/sanitizer_common/sanitizer_posix.h

123 ↗

(On Diff #258685)

I've seen some doxygen in compiler-rt/lib (e.g. sanitizer_common), so I was trying to use it for the new code.
Reverted to plain C comments, hope that's what you meant?

compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp

212

That's good to know, thanks! I'm not sure though which patterns I should replace with a memset. The code now looks very different anyway, please have a look.

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

56

In other projects, I encountered intermittent faults in CI / push barriers / continuous testing when using system calls - most likely caused by massive parallelism on the test machine. A test would fail or time out, which is hard to reproduce locally. Any error from functions like mmap or pthread_create are not test failures due to a bug in asan, but they are infrastructure issues.

So yes, I can certainly remove the error checks without affecting the test itself, but I fear that this decreases the confidence that test failures indicate a bug in asan.

89

I'm not sure if I can inline prepareStackShadow, from a logical point of view:
I want to test that the redzones created by the local variable Blob in prepareStackShadow are gone.
But if I place the variable into testHandeNoReturn, then its redzones should logically still be there in the catch clause, because the variable is still accessible.
In practice, the redzones should have been deleted because the throw calls __asan_handle_no_return which removes all redzones on the stack. However, I'm not sure if it's good if the test would rely on this behaviour.

I can inline assertNoRedzones, no objections.

[robot]

Trying to split change into two commits.

[robot]

@eugenis I've tried to minimize impact. Hope it's better now.
@kcc I've left most of the logic now as it was originally, not in an OS-specific file but using plain ifs (not ifdefs). Extracted a customization point for POSIX, however I could only come up with a solution that defines GetStackBounds in four different files.

[vitalybuka]

compiler-rt/lib/asan/asan_posix.cpp

44 ↗

(On Diff #268878)

most of this comment is more relevant to GetStackBounds than to this function
also it's explains what I already see from the code.
I'd refer you remove it. Maybe move some into patch description.

78 ↗

(On Diff #268878)

This function looks inconsistent. Sometimes it returns current stack, sometimes the given stack from curr_thread.
Please remove argument from here and move GetCurrentThread(); into GetStackBoundsFromCacheOrOs

compiler-rt/lib/asan/asan_rtems.cpp

67 ↗

(On Diff #268878)

GetStackBounds -> GetCurrentStackBounds

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

105

most comments here and in the lib are quite redundant

112

the test does not cover the case when we throw on default stack but sigaltstack is set.

@eugenis WDTY?
I'd like to ask you to always unpoison both: default and altstack from __asan_handle_no_return.
Currently asan_handle_no_return is just a bailout for exceptions. I don't remember that we tried to avoid false negatives after them. Only that it's not not going to repot false positives. So it should be fine.
Also in case of fake_stack it may unpoison both already.

155

Not sure that all compilers will accepts designated initializers in C++ mode. Runtime is compiled and tested with gcc as well

[eugenis]

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

112

I don't see why we would do that. It's true that we are more concerned with correctness than completeness, but we should not unpoison stuff that we definitely do not need to.

FakeStack is different - it is logically interleaved with the main stack.

[eugenis]

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

112

Hmm, wait, it's possible to longjmp from altstack to the main stack, is it not?
Does it mean we need to unpoison both, at least when the current stack == altstack?

[robot]

Unpoison both stacks always.

To support jumps between stacks, always unpoison both the signal
alternate stack and the default stack.

• [asan] Refactor fetching of stack boundaries
• [asan] Unpoison signal alternate stack.

[robot]

Now unpoisoning both stacks, always.

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

105

lib meaning the asan library (compiler-rt/lib)?
I've removed the last big comment there on your request.
Here in the test I'm trying to explain why the test setup does its steps.

112

Ah, yes, I've even seen this in production code. It's probably possible to jump from main stack to altstack as well, so I've tried to use the simplest solution and unpoison both stacks always.

155

Ah, I was trying to use the C++20 feature but didn't realize the flag is not set in the test command line. I've chosen to set the flag explicitly, but I can also replace the designated initializers of course.

[robot]

Formatting.

• [asan] Refactor fetching of stack boundaries.
• [asan] Unpoison signal alternate stack.

[vitalybuka]

In D76986#2082243, @robot wrote:

Formatting.

• [asan] Refactor fetching of stack boundaries.

can you please move this into a separate review? It's just another NFC patch, no new tests will be needed.

compiler-rt/lib/asan/asan_internal.h

86 ↗

(On Diff #269521)

I'd avoid the list of platforms here as it's may because outdated with time.

compiler-rt/lib/asan/asan_rtl.cpp

603–621

please don't mix refactoring with functional changes in the same patch.
if you want to rename something create another patch.
However, here new naming conversion does not match code in this file, so it should not be renamed like this at all.

627

if (bounds.top == bounds.bottom)
  return;

and you can remove have_bounds

641

please use clang-format with --style=file

652

// everywhere
void PlatformUnpoisonStacks() {
  return false; 
}

// linux
void PlatformUnpoisonStacks() {
  return true or false; 
}

void NOINLINE __asan_handle_no_return() {
  if (asan_init_is_running)
    return;

  if (!PlatformUnpoisonStacks())
     UnpoisonStacks();
  UnpoisonCurrentFakeStack();
}

This way only PlatformUnpoisonStacks needs to be in headers and you can drop StackBounds at all
I would not bother to try to get "WARNING: ASan is ignoring requested" from PlatformUnpoisonStacks

Still request about separate refactoring patch is relevant.

if you like to avoid the new patch then we can do the following:

void NOINLINE __asan_handle_no_return() {
  if (asan_init_is_running)
      return;

  if (!PlatformUnpoisonStacks()) {
   // entire block of existing code
   int local_stack;
   ...
   PoisonShadow(bottom, top - bottom, 0);
  }

  if (curr_thread && curr_thread->has_fake_stack())
    curr_thread->fake_stack()->HandleNoReturn();
}

compiler-rt/lib/asan/asan_win.cpp

273 ↗

(On Diff #269521)

I would prefer we do not let platform to choose not to call UnpoisonCurrentFakeStack();

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

56

it's applies to many other tests, but we don't overload them error handling logic

[robot]

Extracted refactoring into D81577

compiler-rt/lib/asan/asan_rtl.cpp

603–621

Sorry, the renaming was not intentional. I'm running part of the CI linter script locally, and this performed a git-clang-format - essentially what Harbormaster is doing. Will undo.

I misunderstood the request for an NFC change and split the refactoring into its own commit in the same phabricator diff. Will create a new diff out of the refactoring.

652

There are two ways to unpoison the default stack in POSIX case:

• If we're on the sigalt stack, try cache first, fall back to asking OS.
• If we're not on the sigalt stack, never use cache.

I've chosen to put the first into UnpoisonStack and inline the second one into PlatformUnpoisonStacks. However, this also suppresses any warning for the default stack bounds in case we're on the sigalt stack.
It is also questionable if we should ever use the cache on Linux: I've left the problem with SS_AUTODISARM unsolved, so in case we're on the sigalt stack but with SS_AUTODISARM, we'll attempt to use the cache and might produce a warning. If we wouldn't use the cache, we'd properly unpoison the default stack.

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

56

Not sure which error handling is relevant, I've removed all error handling now.

[robot]

compiler-rt/lib/asan/asan_posix.cpp

51 ↗

(On Diff #269862)

In order to properly solve the case "on sigalt stack but SS_AUTODISARM was used", we could intercept sigaltstack and register the signal alternate stack with the thread object in asan. Maybe in another revision.

[vitalybuka]

LGTM with few changes

compiler-rt/lib/asan/asan_posix.cpp

43 ↗

(On Diff #269862)

don't need on_sig_alt_stack

just

if (signal_stack.ss_flags != SS_ONSTACK)
  return false;

66 ↗

(On Diff #269862)

Please in the first patch extract warning block and call it here (and above)

[robot]

Simplify logic, warn about unlikely stack bounds in PlatformUnpoisonStacks.

[vitalybuka]

Do you need me to land these patches?

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

2

This test should be under compiler-rt/test/asan/TestCases/Posix or even compiler-rt/test/asan/TestCases/Linux

[robot]

In D76986#2091249, @vitalybuka wrote:

Do you need me to land these patches?

Yes, please. I don't have commit rights.

[robot]

Move test to posix subfolder, since it requires posix features.

compiler-rt/lib/asan/asan_rtl.cpp

public:
   AsanInitializer() {
     AsanInitFromRtl();
   }
 };
 
 static AsanInitializer asan_initializer;
 #endif  // ASAN_DYNAMIC
 
-} // namespace __asan
+// Tries to find stack bounds of default stack.
+// Returns false IFF stack boundaries could not be determined.
+// local_stack: address of a variable on the stack, used to find stack bottom
+static bool get_default_stack_bounds(uptr local_stack, AsanThread *curr_thread,
+                                     /*out*/ uptr *top, /*out*/ uptr *bottom) {
+  if (curr_thread) {
+    uptr PageSize = GetPageSizeCached();
+    *top = curr_thread->stack_top();
+    *bottom = (local_stack - PageSize) & ~(PageSize - 1);
+    return true;
+  } else if (SANITIZER_RTEMS) {
+    // Give up On RTEMS.
+    return false;
+  } else {
+    CHECK(!SANITIZER_FUCHSIA);
+    // If we haven't seen this thread, try asking the OS for stack bounds.
+    uptr tls_addr, tls_size, stack_size;
+    GetThreadStackAndTls(/*main=*/false, bottom, &stack_size, &tls_addr,
+                         &tls_size);
+    *top = *bottom + stack_size;
+    return true;
+  }
+}
+
+}  // namespace __asan
 
 // ---------------------- Interface ---------------- {{{1
 using namespace __asan;
 
 void NOINLINE __asan_handle_no_return() {
   if (asan_init_is_running)
     return;
 
   int local_stack;
-  AsanThread *curr_thread = GetCurrentThread();
-  uptr PageSize = GetPageSizeCached();
+
   uptr top, bottom;
-  if (curr_thread) {
-    top = curr_thread->stack_top();
-    bottom = ((uptr)&local_stack - PageSize) & ~(PageSize - 1);
-  } else if (SANITIZER_RTEMS) {
-    // Give up On RTEMS.
+  AsanThread *curr_thread = GetCurrentThread();
+
+  AlternateStackInfo const signal_stack = GetSignalAlternateStack();
+  if (0 == signal_stack.error) {
+    if (signal_stack.on_stack) {
+      bottom = signal_stack.bottom;
+      top = signal_stack.top;
+    } else {
+      if (!get_default_stack_bounds((uptr)&local_stack, curr_thread, &top,
+                                    &bottom))
         return;
+    }
   } else {
-    CHECK(!SANITIZER_FUCHSIA);
-    // If we haven't seen this thread, try asking the OS for stack bounds.
-    uptr tls_addr, tls_size, stack_size;
-    GetThreadStackAndTls(/*main=*/false, &bottom, &stack_size, &tls_addr,
-                         &tls_size);
-    top = bottom + stack_size;
+    // This should not happen according to the error list of sigaltstack.
+
+    static bool reported_warning = false;
+    if (!reported_warning) {
+      reported_warning = true;
+      Report(
+          "WARNING: ASan might fail to perform requested "
+          "__asan_handle_no_return correctly: "
+          "error code %d from sigaltstack\n"
+          "False positive error reports may follow\n",
+          signal_stack.error);
     }
+
+    // We don't know if we're on the alternate stack,
+    // but we can't get any information on it anyway.
+    // So we assume we're on the default stack.
+    if (!get_default_stack_bounds((uptr)&local_stack, curr_thread, &top,
+                                  &bottom))
+      return;
+  }
+
   static const uptr kMaxExpectedCleanupSize = 64 << 20;  // 64M
   if (top - bottom > kMaxExpectedCleanupSize) {
     static bool reported_warning = false;
     if (reported_warning)
       return;
     reported_warning = true;
-    Report("WARNING: ASan is ignoring requested __asan_handle_no_return: "
-           "stack top: %p; bottom %p; size: %p (%zd)\n"
-           "False positive error reports may follow\n"
-           "For details see "
-           "https://github.com/google/sanitizers/issues/189\n",
-           top, bottom, top - bottom, top - bottom);
+    Report(
+        "WARNING: ASan is ignoring requested __asan_handle_no_return: "
     return;
   }
   PoisonShadow(bottom, top - bottom, 0);
   if (curr_thread && curr_thread->has_fake_stack())
     curr_thread->fake_stack()->HandleNoReturn();
 }
 
 extern "C" void *__asan_extra_spill_area() {
   AsanThread *t = GetCurrentThread();
   CHECK(t);
   return t->extra_spill_area();
 }
 
 void __asan_handle_vfork(void *sp) {
   AsanThread *t = GetCurrentThread();
   CHECK(t);
   uptr bottom = t->stack_bottom();
   PoisonShadow(bottom, (uptr)sp - bottom, 0);
 }
 
 void NOINLINE __asan_set_death_callback(void (*callback)(void)) {
   SetUserDieCallback(callback);
 }
 
 // Initialize as requested from instrumented application code.
 // We use this call as a trigger to wake up ASan from deactivated state.
 void __asan_init() {
   AsanActivate();
   AsanInitInternal();
 }
 
 void __asan_version_mismatch_check() {
   // Do nothing.
 }

compiler-rt/lib/sanitizer_common/sanitizer_common.h

 // Part of HandleDeadlySignal, exposed for asan.
 void ReportDeadlySignal(const SignalContext &sig, u32 tid,
                         UnwindSignalStackCallbackType unwind,
                         const void *unwind_context);
 
 // Alternative signal stack (POSIX-only).
 void SetAlternateSignalStack();
 void UnsetAlternateSignalStack();
+// Returns true IFF this thread is running on the signal alternate stack.
+// Writes the signal alternate stack top and bottom into *stack_top and
+// *stack_bottom. These values are only meaningful if a signal alternate stack
+// has been installed.
+struct AlternateStackInfo {
+  // The values are only meaningful if error == 0
+  uptr bottom;
+  uptr top;
+  int error;  // 0 == success, other codes are platform-dependent
+  bool on_stack;
+};
+AlternateStackInfo GetSignalAlternateStack();
 
 // We don't want a summary too long.
 const int kMaxSummaryLength = 1024;
 // Construct a one-line string:
 //   SUMMARY: SanitizerToolName: error_message
 // and pass it to __sanitizer_report_error_summary.
 // If alt_tool_name is provided, it's used in place of SanitizerToolName.
 void ReportErrorSummary(const char *error_message,

compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp

void UnsetAlternateSignalStack() {
   stack_t altstack, oldstack;
   altstack.ss_sp = nullptr;
   altstack.ss_flags = SS_DISABLE;
   altstack.ss_size = kAltStackSize;  // Some sane value required on Darwin.
   CHECK_EQ(0, sigaltstack(&altstack, &oldstack));
   UnmapOrDie(oldstack.ss_sp, oldstack.ss_size);
 }
 
-static void MaybeInstallSigaction(int signum,
-                                  SignalHandlerType handler) {
-  if (GetHandleSignalMode(signum) == kHandleSignalNo) return;
+AlternateStackInfo GetSignalAlternateStack() {
+  stack_t signal_stack;
+  if (0 == sigaltstack(nullptr, &signal_stack)) {
+    if (signal_stack.ss_flags == SS_ONSTACK) {
+      uptr const bottom = (uptr)signal_stack.ss_sp;
+      uptr const top =
+          (uptr)((char *)signal_stack.ss_sp + signal_stack.ss_size);
+      return {bottom, top, 0, true};
+    } else {
+      return {0, 0, 0, false};
+    }
+  } else {
+    return {0, 0, errno, false};
+  }
+}
+static void MaybeInstallSigaction(int signum, SignalHandlerType handler) {
+  if (GetHandleSignalMode(signum) == kHandleSignalNo)
+    return;
 
   struct sigaction sigact;
   internal_memset(&sigact, 0, sizeof(sigact));
   sigact.sa_sigaction = (sa_sigaction_t)handler;
   // Do not block the signal from being received in that signal's handler.
   // Clients are responsible for handling this correctly.
   sigact.sa_flags = SA_SIGINFO | SA_NODEFER;
   if (common_flags()->use_sigaltstack) sigact.sa_flags |= SA_ONSTACK;

compiler-rt/lib/sanitizer_common/sanitizer_win.cpp

 void SetAlternateSignalStack() {
   // FIXME: Decide what to do on Windows.
 }
 
 void UnsetAlternateSignalStack() {
   // FIXME: Decide what to do on Windows.
 }
 
+AlternateStackInfo GetSignalAlternateStack() { return {0, 0, 0, false}; }
+
 void InstallDeadlySignalHandlers(SignalHandlerType handler) {
   (void)handler;
   // FIXME: Decide what to do on Windows.
 }
 
 HandleSignalMode GetHandleSignalMode(int signum) {
   // FIXME: Decide what to do on Windows.
   return kHandleSignalNo;

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

+// Tests that __asan_handle_no_return properly unpoisons the signal alternate
+// stack.
+
+// Don't optimize, otherwise the variables which create redzones might be
+// dropped.
+// RUN: %clangxx_asan -fexceptions -O0 %s -o %t -pthread
+// RUN: %run %t
+
+#include <cassert>
+#include <cerrno>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+#include <limits.h>
+#include <pthread.h>
+#include <signal.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+#include <sanitizer/asan_interface.h>
+
+#define HANDLE_ERROR_FROM_RETVAL(EXPRESSION) \
+  handle_error_from_retval((EXPRESSION), #EXPRESSION, __FUNCTION__, __FILE__, __LINE__)
+
+// If EXPRESSION == 0, no error happened.
+#define HANDLE_ERROR_FROM_ERRNO(EXPRESSION) \
+  handle_error_from_errno((EXPRESSION) != 0, #EXPRESSION, __FUNCTION__, __FILE__, __LINE__)
+
+#define ERROR(STR, ERRNO) \
+  error(ERRNO, STR, __FUNCTION__, __FILE__, __LINE__)
+
+namespace {
+
+void error(int err, char const *expression,
+           char const *function, char const *file, int line) {
+  std::fprintf(stderr,
+               "Error %d: %s\nIn expression %s\nIn function %s\nIn file %s:%d\nAborting.\n\n",
+               err, std::strerror(err), expression, function, file, line);
+  std::abort();
+}
+
+void handle_error_from_retval(int err, char const *expression,
+                              char const *function, char const *file, int line) {
+  if (err)
+    error(err, expression, function, file, line);
+}
+
+void handle_error_from_errno(bool failed, char const *expression,
+                             char const *function, char const *file, int line) {
+  if (failed)
+    error(errno, expression, function, file, line);
+}
+
+char *left_redzone;
+char *right_redzone;
+
+// Create redzones for stack variables in shadow memory and throw,
+// which should unpoison the entire stack.
+void __attribute__((noinline)) prepare_stack_shadow() {
+  char blob[100]; // This variable must not be optimized out, because we use it
+                  // to create redzones.
+
+  left_redzone = blob - 1;
+  right_redzone = blob + sizeof(blob);
+
+  assert(__asan_address_is_poisoned(left_redzone));
+  assert(__asan_address_is_poisoned(right_redzone));
+
+  // Trigger stack unwinding, which avoids normal cleanup of redzone markers.
+  // Instead, __asan_handle_no_return is called which unpoisons the entire
+  // stack.
+  throw "up";
+}
+
+// Ensure that the redzones created by prepare_stack_shadow have been removed.
+void __attribute__((noinline)) assert_no_redzones() {
+  assert(0 == __asan_region_is_poisoned(left_redzone,
+                                        right_redzone - left_redzone));
+}
+
+// - Create redzones for a stack variable
+// - Unwind the stack
+// - Ensure that the redzones have been removed
+void test_handle_no_return() {
+  try {
+    prepare_stack_shadow();
+  } catch (...) {
+    assert_no_redzones();
+  }
+}
+
+// Signal handler which must be run on signal alternate stack,
+// and tests if stack unwinding properly triggers stack unpoisoning.
+void signal_handler(int, siginfo_t *, void *) {
+  stack_t stack;
+  HANDLE_ERROR_FROM_ERRNO(sigaltstack(nullptr, &stack));
+  assert(stack.ss_flags == SS_ONSTACK);
+
+  // second test on alt stack (actual check)
+  test_handle_no_return();
+}
+
+// Main test function.
+// Must be run on another thread to be able to control memory placement between
+// default stack and alternate signal stack.
+// If the alternate signal stack is placed in close proximity before the
+// default stack, __asan_handle_no_return might unpoison both, even without
+// being aware of the signal alternate stack.
+// We want to test reliable that __asan_handle_no_return can properly unpoison
+// the signal alternate stack.
+void *thread_fun(void *alt_stack) {
+  // first test on default stack (sanity check)
+  test_handle_no_return();
+
+  HANDLE_ERROR_FROM_ERRNO(sigaltstack((stack_t const *)alt_stack, nullptr));
+
+  struct sigaction const action = {
+      .sa_sigaction = signal_handler,
+      .sa_mask = {0},
+      .sa_flags = SA_SIGINFO | SA_NODEFER | SA_ONSTACK,
+      .sa_restorer = nullptr};
+  HANDLE_ERROR_FROM_ERRNO(sigaction(SIGSEGV, &action, nullptr));
+
+  if (0 != raise(SIGSEGV))
+    assert(false && "failed to raise SIGSEGV");
+
+  return nullptr;
+}
+
+} // namespace
+
+// Check that __asan_handle_no_return properly unpoisons a signal alternate
+// stack.
+// __asan_handle_no_return tries to determine the stack boundaries and
+// unpoisons all memory inside those.
+// If the determination of stack boundaries does not work properly on the
+// signal alternate stack, then the unpoisoning might be omitted.
+// This can leave redzones for variables on the signal alternate stack, which
+// can lead to false positive reports when the stack is reused.
+int main() {
+  size_t const page_size = sysconf(_SC_PAGESIZE);
+  // To align the alternate stack, we round this up to page_size.
+  size_t const default_stack_size =
+      (PTHREAD_STACK_MIN - 1 + page_size) & ~(page_size - 1);
+  // The alternate stack needs a certain size, or the signal handler segfaults.
+  size_t const alt_stack_size = 10 * page_size;
+  size_t const mapping_size = default_stack_size + alt_stack_size;
+  // Using mmap guarantees proper alignment.
+  void *const mapping = mmap(nullptr, mapping_size,
+                             PROT_READ | PROT_WRITE,
+                             MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK,
+                             0, 0);
+  if ((void *)-1 == mapping)
+    ERROR("mmap", errno);
+
+  stack_t const alt_stack = {
+      .ss_sp = (char *)mapping + default_stack_size,
+      .ss_flags = 0,
+      .ss_size = alt_stack_size};
+
+  pthread_t thread;
+  pthread_attr_t thread_attr;
+  HANDLE_ERROR_FROM_RETVAL(pthread_attr_init(&thread_attr));
+  HANDLE_ERROR_FROM_RETVAL(pthread_attr_setstack(&thread_attr, mapping,
+                                                 default_stack_size));
+  HANDLE_ERROR_FROM_RETVAL(pthread_create(&thread, &thread_attr, &thread_fun,
+                                          (void *)&alt_stack));
+
+  if (int const err = pthread_join(thread, nullptr))
+    if (EINVAL != err) // EINVAL means the other thread exited first
+      ERROR("pthread_join", err);
+
+  HANDLE_ERROR_FROM_RETVAL(munmap(mapping, mapping_size));
+}