[asan] Unpoison signal alternate stack.

[robot]

Summary

Before unwinding the stack, __asan_handle_no_return is supposed to
unpoison the entire stack - that is, remove the entries in the shadow
memory corresponding to stack (e.g. redzone markers around variables).
This does not work correctly if __asan_handle_no_return is called from
the alternate stack used in signal handlers, because the stack top is
read from a cache, which yields the default stack top instead of the
signal alternate stack top.

It is also possible to jump between the default stack and the signal
alternate stack. Therefore, __asan_handle_no_return needs to unpoison
both.

[robot]

Rebased, slightly better error reporting in test.

[robot]

Fix clang-tidy issues. This cause inconsistency in code style in asan (snake case vs camel case), because I did not want to touch all the asan code in this patch.

[eugenis]

compiler-rt/lib/asan/asan_rtl.cpp

733

I do not think this is true - false positive reports are only possible if we fail the kMaxExpectedCleanupSize check below.
Remove this statement?

compiler-rt/lib/sanitizer_common/sanitizer_common.h

331 ↗

(On Diff #255325)

I want to say that this will break compilation on fuchsia and rtems because you only have definitions for posix + win, but then we have the same situation with GetThreadStackAndTls on fuchsia, and things are somehow fine. Any idea why? Consider adding an inline implementation in the header under the complementary condition (i.e. not-posix).

[robot]

Refactored the way stack bounds are acquired in __asan_handle_no_return. This should fix compilation on Fuchsia and RTEMS.

compiler-rt/lib/asan/asan_rtl.cpp

733

You sent me down a rabbit hole there :)
My initial reasoning was indeed flawed, but I still think a false positive is possible in the context. Please see the comment I've added to the source.

compiler-rt/lib/sanitizer_common/sanitizer_common.h

331 ↗

(On Diff #255325)

From a bit of experimentation, I think the dead branches are dropped even at -O0. Therefore there's never a symbol reference for the linker to resolve.

Regarding Fuchsia and RTEMS, I've pondered a bit on where to put things, and came up with another approach. It's more intrusive but avoids noop-functions. Please let me know what you think.

[robot]

Improve portability by supplying fd=-1 to mmap.

[robot]

Fix Windows and MacOS builds:

• #ifdef SANITIZER_POSIX -> #if SANITIZER_POSIX (it's always defined)
• don't address sigaction::sa_restorer member, just let it be implicitly zero-initialized
• use sigemptyset to clear the signal mask

[robot]

Would be great if you could have another look.

[eugenis]

Sorry for the delay.

I find this very hard to read. You add 150 lines to asan_rtl.cpp that do basically nothing. There is maybe 10 lines of the actual logic. I wonder if the same could be expressed in less code, and especially in fewer functions?

[kcc]

also, please avoid #ifdefs.
OS-specific code should go to an OS-specific file.

[vitalybuka]

compiler-rt/lib/asan/asan_rtl.cpp

696

Please, extract into a single NFC patch the code
you move existing code for stack calculation into a new function with
common for all platforms. e.g. like the getCurrentStackBounds
and move the current relevant code there. Please put implementation into relevant platform specific files. This will help us avoid ifdef

Then you can rebase D76986 so it will be about behavior changes only without any refactoring.

743–744

historically code in sanitizer_common and other sanitizers follow Google C++ style, not LLVM
please keep it consistent.

compiler-rt/lib/sanitizer_common/sanitizer_posix.h

123

Code should try to match style around. These comments looks very different from what is on the rest of sanitizer_common

compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp

212

this easily can be compiled into libc memset interceptors, that's why we use
internal_memset(&sigact, 0, sizeof(sigact)); around

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

56

I guess all above is irrelevant to the test?
In most case here just ignoring the return code is appropriate solution.

89

it could be more readable if you inline both these functions

[robot]

Split refactoring into separate commit.

[robot]

I'm trying to split this into two changes, please bear with my while I'm trying to figure out Phabricator & Arcanist.

compiler-rt/lib/asan/asan_rtl.cpp

696

That's a great idea, thanks! I've reduced the refactoring to a small amount, unfortunately I didn't find a better solution than to introduce customization points for RTEMS, Fuchsia, POSIX and Windows. Logically speaking, those all behave differently, but only slightly. I've struggled with making this difference explicit without duplicating code.

743–744

I see. I was trying to satisfy Harbormaster's clang-format checks, which complained about my original code and suggested LLVM style. I've tried to adapt.

compiler-rt/lib/sanitizer_common/sanitizer_posix.h

123

I've seen some doxygen in compiler-rt/lib (e.g. sanitizer_common), so I was trying to use it for the new code.
Reverted to plain C comments, hope that's what you meant?

compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp

212

That's good to know, thanks! I'm not sure though which patterns I should replace with a memset. The code now looks very different anyway, please have a look.

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

56

In other projects, I encountered intermittent faults in CI / push barriers / continuous testing when using system calls - most likely caused by massive parallelism on the test machine. A test would fail or time out, which is hard to reproduce locally. Any error from functions like mmap or pthread_create are not test failures due to a bug in asan, but they are infrastructure issues.

So yes, I can certainly remove the error checks without affecting the test itself, but I fear that this decreases the confidence that test failures indicate a bug in asan.

89

I'm not sure if I can inline prepareStackShadow, from a logical point of view:
I want to test that the redzones created by the local variable Blob in prepareStackShadow are gone.
But if I place the variable into testHandeNoReturn, then its redzones should logically still be there in the catch clause, because the variable is still accessible.
In practice, the redzones should have been deleted because the throw calls __asan_handle_no_return which removes all redzones on the stack. However, I'm not sure if it's good if the test would rely on this behaviour.

I can inline assertNoRedzones, no objections.

[robot]

Trying to split change into two commits.

[robot]

@eugenis I've tried to minimize impact. Hope it's better now.
@kcc I've left most of the logic now as it was originally, not in an OS-specific file but using plain ifs (not ifdefs). Extracted a customization point for POSIX, however I could only come up with a solution that defines GetStackBounds in four different files.

[vitalybuka]

compiler-rt/lib/asan/asan_posix.cpp

44 ↗

(On Diff #268878)

most of this comment is more relevant to GetStackBounds than to this function
also it's explains what I already see from the code.
I'd refer you remove it. Maybe move some into patch description.

78 ↗

(On Diff #268878)

This function looks inconsistent. Sometimes it returns current stack, sometimes the given stack from curr_thread.
Please remove argument from here and move GetCurrentThread(); into GetStackBoundsFromCacheOrOs

compiler-rt/lib/asan/asan_rtems.cpp

67 ↗

(On Diff #268878)

GetStackBounds -> GetCurrentStackBounds

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

105

most comments here and in the lib are quite redundant

112

the test does not cover the case when we throw on default stack but sigaltstack is set.

@eugenis WDTY?
I'd like to ask you to always unpoison both: default and altstack from __asan_handle_no_return.
Currently asan_handle_no_return is just a bailout for exceptions. I don't remember that we tried to avoid false negatives after them. Only that it's not not going to repot false positives. So it should be fine.
Also in case of fake_stack it may unpoison both already.

155

Not sure that all compilers will accepts designated initializers in C++ mode. Runtime is compiled and tested with gcc as well

[eugenis]

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

112

I don't see why we would do that. It's true that we are more concerned with correctness than completeness, but we should not unpoison stuff that we definitely do not need to.

FakeStack is different - it is logically interleaved with the main stack.

[eugenis]

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

112

Hmm, wait, it's possible to longjmp from altstack to the main stack, is it not?
Does it mean we need to unpoison both, at least when the current stack == altstack?

[robot]

Unpoison both stacks always.

To support jumps between stacks, always unpoison both the signal
alternate stack and the default stack.

• [asan] Refactor fetching of stack boundaries
• [asan] Unpoison signal alternate stack.

[robot]

Now unpoisoning both stacks, always.

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

105

lib meaning the asan library (compiler-rt/lib)?
I've removed the last big comment there on your request.
Here in the test I'm trying to explain why the test setup does its steps.

112

Ah, yes, I've even seen this in production code. It's probably possible to jump from main stack to altstack as well, so I've tried to use the simplest solution and unpoison both stacks always.

155

Ah, I was trying to use the C++20 feature but didn't realize the flag is not set in the test command line. I've chosen to set the flag explicitly, but I can also replace the designated initializers of course.

[robot]

Formatting.

• [asan] Refactor fetching of stack boundaries.
• [asan] Unpoison signal alternate stack.

[vitalybuka]

In D76986#2082243, @robot wrote:

Formatting.

• [asan] Refactor fetching of stack boundaries.

can you please move this into a separate review? It's just another NFC patch, no new tests will be needed.

compiler-rt/lib/asan/asan_internal.h

86 ↗

(On Diff #269521)

I'd avoid the list of platforms here as it's may because outdated with time.

compiler-rt/lib/asan/asan_rtl.cpp

724–725

please don't mix refactoring with functional changes in the same patch.
if you want to rename something create another patch.
However, here new naming conversion does not match code in this file, so it should not be renamed like this at all.

730

if (bounds.top == bounds.bottom)
  return;

and you can remove have_bounds

743–744

please use clang-format with --style=file

755

// everywhere
void PlatformUnpoisonStacks() {
  return false; 
}

// linux
void PlatformUnpoisonStacks() {
  return true or false; 
}

void NOINLINE __asan_handle_no_return() {
  if (asan_init_is_running)
    return;

  if (!PlatformUnpoisonStacks())
     UnpoisonStacks();
  UnpoisonCurrentFakeStack();
}

This way only PlatformUnpoisonStacks needs to be in headers and you can drop StackBounds at all
I would not bother to try to get "WARNING: ASan is ignoring requested" from PlatformUnpoisonStacks

Still request about separate refactoring patch is relevant.

if you like to avoid the new patch then we can do the following:

void NOINLINE __asan_handle_no_return() {
  if (asan_init_is_running)
      return;

  if (!PlatformUnpoisonStacks()) {
   // entire block of existing code
   int local_stack;
   ...
   PoisonShadow(bottom, top - bottom, 0);
  }

  if (curr_thread && curr_thread->has_fake_stack())
    curr_thread->fake_stack()->HandleNoReturn();
}

compiler-rt/lib/asan/asan_win.cpp

273 ↗

(On Diff #269521)

I would prefer we do not let platform to choose not to call UnpoisonCurrentFakeStack();

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

56

it's applies to many other tests, but we don't overload them error handling logic

[robot]

Extracted refactoring into D81577

compiler-rt/lib/asan/asan_rtl.cpp

724–725

Sorry, the renaming was not intentional. I'm running part of the CI linter script locally, and this performed a git-clang-format - essentially what Harbormaster is doing. Will undo.

I misunderstood the request for an NFC change and split the refactoring into its own commit in the same phabricator diff. Will create a new diff out of the refactoring.

755

There are two ways to unpoison the default stack in POSIX case:

• If we're on the sigalt stack, try cache first, fall back to asking OS.
• If we're not on the sigalt stack, never use cache.

I've chosen to put the first into UnpoisonStack and inline the second one into PlatformUnpoisonStacks. However, this also suppresses any warning for the default stack bounds in case we're on the sigalt stack.
It is also questionable if we should ever use the cache on Linux: I've left the problem with SS_AUTODISARM unsolved, so in case we're on the sigalt stack but with SS_AUTODISARM, we'll attempt to use the cache and might produce a warning. If we wouldn't use the cache, we'd properly unpoison the default stack.

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

56

Not sure which error handling is relevant, I've removed all error handling now.

[robot]

compiler-rt/lib/asan/asan_posix.cpp

51 ↗

(On Diff #269862)

In order to properly solve the case "on sigalt stack but SS_AUTODISARM was used", we could intercept sigaltstack and register the signal alternate stack with the thread object in asan. Maybe in another revision.

[vitalybuka]

LGTM with few changes

compiler-rt/lib/asan/asan_posix.cpp

43 ↗

(On Diff #269862)

don't need on_sig_alt_stack

just

if (signal_stack.ss_flags != SS_ONSTACK)
  return false;

66 ↗

(On Diff #269862)

Please in the first patch extract warning block and call it here (and above)

[robot]

Simplify logic, warn about unlikely stack bounds in PlatformUnpoisonStacks.

[vitalybuka]

Do you need me to land these patches?

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

2

This test should be under compiler-rt/test/asan/TestCases/Posix or even compiler-rt/test/asan/TestCases/Linux

[robot]

In D76986#2091249, @vitalybuka wrote:

Do you need me to land these patches?

Yes, please. I don't have commit rights.

[robot]

Move test to posix subfolder, since it requires posix features.

compiler-rt/lib/asan/asan_rtl.cpp

 #include "sanitizer_common/sanitizer_atomic.h"
 #include "sanitizer_common/sanitizer_flags.h"
 #include "sanitizer_common/sanitizer_libc.h"
 #include "sanitizer_common/sanitizer_symbolizer.h"
 #include "lsan/lsan_common.h"
 #include "ubsan/ubsan_init.h"
 #include "ubsan/ubsan_platform.h"
 
+#if SANITIZER_POSIX
+#include "sanitizer_common/sanitizer_posix.h"
+#endif
+
 uptr __asan_shadow_memory_dynamic_address;  // Global interface symbol.
 int __asan_option_detect_stack_use_after_return;  // Global interface symbol.
 uptr *__asan_test_only_reported_buggy_pointer;  // Used only for testing asan.
 
 namespace __asan {
 
 uptr AsanMappingProfile[kAsanMappingProfileSize];
 
public:
   AsanInitializer() {
     AsanInitFromRtl();
   }
 };
 
 static AsanInitializer asan_initializer;
 #endif  // ASAN_DYNAMIC
 
-} // namespace __asan
+/// Returns the cached stack bounds for the default stack.
+///
+/// \param[in] CurrThread May be null. If non-null, read stack top from cache.
+/// \param[in] LocalStack Address of a variable on the stack, used to find stack
+///                       bottom.
+/// \param[out] Top Top of the default stack. Only guaranteed to be written if
+///                 return value is true.
+/// \param[out] Bottom Bottom of the default stack. Only guaranteed to be
+///                    written if return value is true.
+///
+/// \returns true IFF CurrThread was non-null
+static bool getCachedDefaultStackBounds(AsanThread *CurrThread, uptr LocalStack,
+                                        /*out*/ uptr *Top,
+                                        /*out*/ uptr *Bottom) {
+  if (CurrThread) {
+    uptr PageSize = GetPageSizeCached();
+    *Top = CurrThread->stack_top();
+    *Bottom = (LocalStack - PageSize) & ~(PageSize - 1);
+    return true;
+  } else {
+    return false;
+  }
+}
+
+#if !SANITIZER_FUCHSIA && !SANITIZER_RTEMS
+/// Tries to find stack bounds of default stack.
+///
+/// \param[in] LocalStack Address of a variable on the stack, used to find stack
+///                       bottom.
+/// \param[in] CurrThread Current thread, used to look up cached stack top. Can
+///                       be null, in which case we ask the OS for stack
+///                       boundaries.
+/// \param[out] Top Top of the default stack. Only guaranteed to be written if
+///                 return value is true.
+/// \param[out] Bottom Bottom of the default stack. Only guaranteed to be
+///                    written if return value is true.
+///
+/// \returns true on success (= stack boundaries could be determined).
+static bool getDefaultStackBounds(AsanThread *CurrThread, uptr LocalStack,
+                                  /*out*/ uptr *Top, /*out*/ uptr *Bottom) {
+  if (getCachedDefaultStackBounds(CurrThread, LocalStack, Top, Bottom)) {
+    return true;
+  } else {
+    // If we haven't seen this thread, try asking the OS for stack bounds.
+    uptr TlsAddr, TlsSize, StackSize;
+    GetThreadStackAndTls(/*main=*/false, Bottom, &StackSize, &TlsAddr,
+                         &TlsSize);
+    *Top = *Bottom + StackSize;
+    return true;
+  }
+}
+#endif
+
+#ifdef SANITIZER_POSIX
+/// Tries to find stack bounds of active stack.
+///
+/// This function determines if the signal alternate stack is the current stack,
+/// and if so, returns the stack bounds of the signal alternate stack.
+/// Otherwise, and in case of failure to determine if the sig alt stack is
+/// active, returns the bounds of the default stack.
+///
+/// \param[in] LocalStack address of a variable on the stack, used to find stack
+///            bottom.
+/// \param[in] CurrThread Used to look up cached stack top. Can be null, in
+///                       which case we ask the OS for stack boundaries.
+/// \param[out] Top Top of the default stack. Only guaranteed to be written if
+///                 return value is true.
+/// \param[out] Bottom Bottom of the default stack. Only guaranteed to be
+///                    written if return value is true.
+///
+/// \returns true on success (= stack boundaries could be determined).
+static bool getSignalAltOrDefaultStackBounds(AsanThread *CurrThread,
+                                             uptr LocalStack,
+                                             /*out*/ uptr *Top,
+                                             /*out*/ uptr *Bottom) {
+  AlternateStackInfo const SignalStack = GetSignalAlternateStack();
+  if (0 == SignalStack.error) {
+    if (SignalStack.on_stack) {
+      *Bottom = SignalStack.bottom;
+      *Top = SignalStack.top;
+      return true;
+    } else {
+      return getDefaultStackBounds(CurrThread, LocalStack, Top, Bottom);
+    }
+  } else {
+    // We don't know if we're on the alternate stack, but we can't get any
+    // information on it anyway. So we assume we're on the default stack.
+    // For __asan_handle_no_return, this means:
+    // - if we read the stack top from cache, our range to unpoison is
+    //   [sigalt stack bottom, default stack top).
+    //   . If sigalt stack is shortly before default stack, we'll unpoison both
+    //     stacks => false negatives
+    //   . otherwise, clean-up size heuristic triggers and we don't unpoison
+    //     anything => false positives
+    // - if we read the stack top from OS
+    //   . if we search for the address of a local variable in the memory
+    //     mappings, we get a correct sigalt stack bottom but the found sigalt
+    //     stack top can be too high (stack is smaller than mapping) or too low
+    //     (stack consists of multiple consecutive mappings, pathological).
+    //     _ if top is too high, we unpoison too much => false negatives
+    //     _ if top is too low, we unpoison too little => false positives
+    //   . using pthread_attr_getstack, we get the default stack bounds. The
+    //     sigalt stack is not unpoisoned => false positives
+
+    bool const Ret = getDefaultStackBounds(CurrThread, LocalStack, Top, Bottom);
+
+    static bool ReportedWarning = false;
+    if (!ReportedWarning) {
+      ReportedWarning = true;
+      Report(
+          "WARNING: ASan might fail to perform requested "
+          "__asan_handle_no_return correctly: "
+          "error code %d from sigaltstack\n"
+          "stack top: %p; bottom %p; size: %p (%zd)\n"
+          "False positive error reports may follow\n",
+          SignalStack.error, Top, Bottom, Top - Bottom, Top - Bottom);
+    }
+
+    return Ret;
+  }
+}
+#endif
+
+/// Tries to get stack bounds of active stack of current thread.
+///
+/// \note There can be multiple stacks associated to a thread, e.g. in case of
+///       the signal alternate stack on POSIX.
+///
+/// \param[in] CurrThread Can be null. If non-null, we use its cached values for
+///                       stack top, if applicable.
+/// \param[in] LocalStack Address of a variable on the stack, used to find stack
+///                       bottom.
+/// \param[out] Top Top of the current stack. Only guaranteed to be written if
+///                 return value is true.
+/// \param[out] Bottom Bottom of the current stack. Only guaranteed to be
+///             written if return value is true.
+///
+/// \returns true IFF the stack bounds could be determined.
+static bool getCurrentStackBounds(AsanThread *CurrThread, uptr LocalStack,
+                                  /*out*/ uptr *Top, /*out*/ uptr *Bottom) {
+#if SANITIZER_POSIX
+  return getSignalAltOrDefaultStackBounds(CurrThread, LocalStack, Top, Bottom);
+#elif SANITIZER_RTEMS
+  return getCachedDefaultStackBounds(CurrThread, LocalStack, Top, Bottom);
+#elif SANITIZER_FUCHSIA
+  CHECK(getCachedDefaultStackBounds(CurrThread, LocalStack, Top, Bottom));
+  return true;
+#else
+  return getDefaultStackBounds(CurrThread, LocalStack, Top, Bottom);
+#endif
+}
+
+}  // namespace __asan
 
 // ---------------------- Interface ---------------- {{{1
 using namespace __asan;
 
 void NOINLINE __asan_handle_no_return() {
   if (asan_init_is_running)
     return;
 
   int local_stack;
-  AsanThread *curr_thread = GetCurrentThread();
-  uptr PageSize = GetPageSizeCached();
   uptr top, bottom;
-  if (curr_thread) {
-    top = curr_thread->stack_top();
-    bottom = ((uptr)&local_stack - PageSize) & ~(PageSize - 1);
-  } else if (SANITIZER_RTEMS) {
-    // Give up On RTEMS.
+  AsanThread *CurrThread = GetCurrentThread();
+
+  if (!getCurrentStackBounds(CurrThread, (uptr)&local_stack, &top, &bottom))
     return;
-  } else {
-    CHECK(!SANITIZER_FUCHSIA);
-    // If we haven't seen this thread, try asking the OS for stack bounds.
-    uptr tls_addr, tls_size, stack_size;
-    GetThreadStackAndTls(/*main=*/false, &bottom, &stack_size, &tls_addr,
-                         &tls_size);
-    top = bottom + stack_size;
-  }
+
   static const uptr kMaxExpectedCleanupSize = 64 << 20;  // 64M
+  // top > bottom is possible, but handled gracefully (see above)
   if (top - bottom > kMaxExpectedCleanupSize) {
     static bool reported_warning = false;
     if (reported_warning)
       return;
     reported_warning = true;
-    Report("WARNING: ASan is ignoring requested __asan_handle_no_return: "
-           "stack top: %p; bottom %p; size: %p (%zd)\n"
-           "False positive error reports may follow\n"
-           "For details see "
-           "https://github.com/google/sanitizers/issues/189\n",
-           top, bottom, top - bottom, top - bottom);
+    Report(
+        "WARNING: ASan is ignoring requested __asan_handle_no_return: "
     return;
   }
   PoisonShadow(bottom, top - bottom, 0);
-  if (curr_thread && curr_thread->has_fake_stack())
-    curr_thread->fake_stack()->HandleNoReturn();
+  if (CurrThread && CurrThread->has_fake_stack())
+    CurrThread->fake_stack()->HandleNoReturn();
 }
 
 extern "C" void *__asan_extra_spill_area() {
   AsanThread *t = GetCurrentThread();
   CHECK(t);
   return t->extra_spill_area();
 }
 
 void __asan_handle_vfork(void *sp) {
   AsanThread *t = GetCurrentThread();
   CHECK(t);
   uptr bottom = t->stack_bottom();
   PoisonShadow(bottom, (uptr)sp - bottom, 0);
 }
 
 void NOINLINE __asan_set_death_callback(void (*callback)(void)) {
   SetUserDieCallback(callback);
 }
 

compiler-rt/lib/sanitizer_common/sanitizer_posix.h

 // Platforms should implement at most one of these.
 // 1. Provide a pre-decorated file descriptor to use instead of an anonymous
 // mapping.
 int GetNamedMappingFd(const char *name, uptr size, int *flags);
 // 2. Add name to an existing anonymous mapping. The caller must keep *name
 // alive at least as long as the mapping exists.
 void DecorateMapping(uptr addr, uptr size, const char *name);
 
+struct AlternateStackInfo {
+  uptr bottom;    //!< Bottom of the signal alternate stack, only meaningful if
+                  //!< error == 0 and on_stack == true
+  uptr top;       //!< Top of the signal alternate stack, like
+                  //!< AlternateStackInfo::bottom
+  int error;      //!< 0 == success, other codes are platform-dependent
+  bool on_stack;  //! true IFF this thread is on the signal alternate stack,
+                  //! only meaningful if error == 0
+};
+/// Gets info about the signal alternate stack.
+///
+/// \returns true IFF this thread is running on the signal alternate stack.
+// Writes the signal alternate stack top and bottom into *stack_top and
+// *stack_bottom. These values are only meaningful if a signal alternate stack
+// has been installed.
+AlternateStackInfo GetSignalAlternateStack();
 
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_POSIX_H

compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp

void UnsetAlternateSignalStack() {
   stack_t altstack, oldstack;
   altstack.ss_sp = nullptr;
   altstack.ss_flags = SS_DISABLE;
   altstack.ss_size = kAltStackSize;  // Some sane value required on Darwin.
   CHECK_EQ(0, sigaltstack(&altstack, &oldstack));
   UnmapOrDie(oldstack.ss_sp, oldstack.ss_size);
 }
 
-static void MaybeInstallSigaction(int signum,
-                                  SignalHandlerType handler) {
-  if (GetHandleSignalMode(signum) == kHandleSignalNo) return;
+AlternateStackInfo GetSignalAlternateStack() {
+  stack_t signal_stack;
+  if (0 == sigaltstack(nullptr, &signal_stack)) {
+    if (signal_stack.ss_flags == SS_ONSTACK) {
+      uptr const bottom = (uptr)signal_stack.ss_sp;
+      uptr const top =
+          (uptr)((char *)signal_stack.ss_sp + signal_stack.ss_size);
+      return {bottom, top, 0, true};
+    } else {
+      return {0, 0, 0, false};
+    }
+  } else {
+    // This should not happen according to the error list of sigaltstack.
+    return {0, 0, errno, false};
+  }
+}
+static void MaybeInstallSigaction(int signum, SignalHandlerType handler) {
+  if (GetHandleSignalMode(signum) == kHandleSignalNo)
+    return;
 
   struct sigaction sigact;
   internal_memset(&sigact, 0, sizeof(sigact));
   sigact.sa_sigaction = (sa_sigaction_t)handler;
   // Do not block the signal from being received in that signal's handler.
   // Clients are responsible for handling this correctly.
   sigact.sa_flags = SA_SIGINFO | SA_NODEFER;
   if (common_flags()->use_sigaltstack) sigact.sa_flags |= SA_ONSTACK;

compiler-rt/test/asan/TestCases/unpoison-alternate-stack.cpp

+// Tests that __asan_handle_no_return properly unpoisons the signal alternate
+// stack.
+
+// Don't optimize, otherwise the variables which create redzones might be
+// dropped.
+// RUN: %clangxx_asan -fexceptions -O0 %s -o %t -pthread
+// RUN: %run %t
+
+#include <cassert>
+#include <cerrno>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+#include <limits.h>
+#include <pthread.h>
+#include <signal.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+#include <sanitizer/asan_interface.h>
+
+#define HANDLE_ERROR_FROM_RETVAL(EXPRESSION) \
+  handleErrorFromRetval((EXPRESSION), #EXPRESSION, __FUNCTION__, __FILE__, __LINE__)
+
+// If EXPRESSION == 0, no error happened.
+#define HANDLE_ERROR_FROM_ERRNO(EXPRESSION) \
+  handleErrorFromErrno((EXPRESSION) != 0, #EXPRESSION, __FUNCTION__, __FILE__, __LINE__)
+
+#define ERROR(STR, ERRNO) \
+  error(ERRNO, STR, __FUNCTION__, __FILE__, __LINE__)
+
+namespace {
+
+void error(int Err, char const *Expression,
+           char const *Function, char const *File, int Line) {
+  std::fprintf(stderr,
+               "Error %d: %s\nIn expression %s\nIn function %s\nIn file %s:%d\nAborting.\n\n",
+               Err, std::strerror(Err), Expression, Function, File, Line);
+  std::abort();
+}
+
+void handleErrorFromRetval(int Err, char const *Expression,
+                           char const *Function, char const *File, int Line) {
+  if (Err)
+    error(Err, Expression, Function, File, Line);
+}
+
+void handleErrorFromErrno(bool Failed, char const *Expression,
+                          char const *Function, char const *File, int Line) {
+  if (Failed)
+    error(errno, Expression, Function, File, Line);
+}
+
+char *LeftRedzone;
+char *RightRedzone;
+
+// Create redzones for stack variables in shadow memory and throw,
+// which should unpoison the entire stack.
+void __attribute__((noinline)) prepareStackShadow() {
+  char Blob[100]; // This variable must not be optimized out, because we use it
+                  // to create redzones.
+
+  LeftRedzone = Blob - 1;
+  RightRedzone = Blob + sizeof(Blob);
+
+  assert(__asan_address_is_poisoned(LeftRedzone));
+  assert(__asan_address_is_poisoned(RightRedzone));
+
+  // Trigger stack unwinding, which avoids normal cleanup of redzone markers.
+  // Instead, __asan_handle_no_return is called which unpoisons the entire
+  // stack.
+  throw "up";
+}
+
+// Ensure that the redzones created by prepareStackShadow have been removed.
+void __attribute__((noinline)) assertNoRedzones() {
+  assert(0 == __asan_region_is_poisoned(LeftRedzone,
+                                        RightRedzone - LeftRedzone));
+}
+
+// - Create redzones for a stack variable
+// - Unwind the stack
+// - Ensure that the redzones have been removed
+void testHandleNoReturn() {
+  try {
+    prepareStackShadow();
+  } catch (...) {
+    assertNoRedzones();
+  }
+}
+
+// Signal handler which must be run on signal alternate stack,
+// and tests if stack unwinding properly triggers stack unpoisoning.
+void signalHandler(int, siginfo_t *, void *) {
+  stack_t Stack;
+  HANDLE_ERROR_FROM_ERRNO(sigaltstack(nullptr, &Stack));
+  assert(Stack.ss_flags == SS_ONSTACK);
+
+  // second test on alt stack (actual check)
+  testHandleNoReturn();
+}
+
+// Main test function.
+// Must be run on another thread to be able to control memory placement between
+// default stack and alternate signal stack.
+// If the alternate signal stack is placed in close proximity before the
+// default stack, __asan_handle_no_return might unpoison both, even without
+// being aware of the signal alternate stack.
+// We want to test reliable that __asan_handle_no_return can properly unpoison
+// the signal alternate stack.
+void *threadFun(void *AltStack) {
+  // first test on default stack (sanity check)
+  testHandleNoReturn();
+
+  HANDLE_ERROR_FROM_ERRNO(sigaltstack((stack_t const *)AltStack, nullptr));
+
+  struct sigaction const Action = {
+      .sa_sigaction = signalHandler,
+      .sa_mask = {0},
+      .sa_flags = SA_SIGINFO | SA_NODEFER | SA_ONSTACK,
+      .sa_restorer = nullptr};
+  HANDLE_ERROR_FROM_ERRNO(sigaction(SIGSEGV, &Action, nullptr));
+
+  HANDLE_ERROR_FROM_ERRNO(raise(SIGSEGV));
+
+  return nullptr;
+}
+
+} // namespace
+
+// Check that __asan_handle_no_return properly unpoisons a signal alternate
+// stack.
+// __asan_handle_no_return tries to determine the stack boundaries and
+// unpoisons all memory inside those.
+// If the determination of stack boundaries does not work properly on the
+// signal alternate stack, then the unpoisoning might be omitted.
+// This can leave redzones for variables on the signal alternate stack, which
+// can lead to false positive reports when the stack is reused.
+int main() {
+  size_t const PageSize = sysconf(_SC_PAGESIZE);
+  // To align the alternate stack, we round this up to page_size.
+  size_t const DefaultStackSize =
+      (PTHREAD_STACK_MIN - 1 + PageSize) & ~(PageSize - 1);
+  // The alternate stack needs a certain size, or the signal handler segfaults.
+  size_t const AltStackSize = 10 * PageSize;
+  size_t const MappingSize = DefaultStackSize + AltStackSize;
+  // Using mmap guarantees proper alignment.
+  void *const Mapping = mmap(nullptr, MappingSize,
+                             PROT_READ | PROT_WRITE,
+                             MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK,
+                             -1, 0);
+  if ((void *)-1 == Mapping)
+    ERROR("mmap", errno);
+
+  stack_t const AltStack = {
+      .ss_sp = (char *)Mapping + DefaultStackSize,
+      .ss_flags = 0,
+      .ss_size = AltStackSize};
+
+  pthread_t Thread;
+  pthread_attr_t ThreadAttr;
+  HANDLE_ERROR_FROM_RETVAL(pthread_attr_init(&ThreadAttr));
+  HANDLE_ERROR_FROM_RETVAL(pthread_attr_setstack(&ThreadAttr, Mapping,
+                                                 DefaultStackSize));
+  HANDLE_ERROR_FROM_RETVAL(pthread_create(&Thread, &ThreadAttr, &threadFun,
+                                          (void *)&AltStack));
+
+  if (int const Err = pthread_join(Thread, nullptr))
+    if (EINVAL != Err) // EINVAL means the other thread exited first
+      ERROR("pthread_join", Err);
+
+  HANDLE_ERROR_FROM_RETVAL(munmap(Mapping, MappingSize));
+}