[Asan] Don't crash if metadata is not initialized

[vitalybuka]

Summary

Fixes https://github.com/google/sanitizers/issues/1193.

AsanChunk can be uninitialized yet just after return from the secondary
allocator. If lsan starts scan just before metadata assignment it can
fail to find corresponding AsanChunk.

It should be safe to ignore this and let lsan to assume that
AsanChunk is in the beginning of the block. This block is from the
secondary allocator and created with mmap, so it should not contain
any pointers and will make lsan to miss some leaks.

Similar already happens for primary allocator. If it can't find real
AsanChunk it falls back and assume that block starts with AsanChunk.
Then if the block is already returned to allocator we have garbage in
AsanChunk and may scan dead memory hiding some leaks.
I'll fix this in D87135.

[vitalybuka]

simplify test

[morehouse]

compiler-rt/lib/asan/asan_allocator.cpp

747

The reason for falling back to alloc_beg is not obvious from the code.

Could you add a comment explaining why we do this, and why it's safe? (both here and below)

752

Since we're here, could you also document why falling back to alloc_beg is safe for the primary?

[vitalybuka]

move nullptr handling closer to lsan

[vitalybuka]

compiler-rt/lib/asan/asan_allocator.cpp

752

Looks like this is not very safe as well, lsan is lucky as LsanMetadata::allocated() will return false and the chunk will be ignored.
Other callers like AsanChunkView can handle nullptr, but will display wrong information in case of the current primary fallback.

[vitalybuka]

rebase

[morehouse]

Please update the commit message.

compiler-rt/lib/asan/asan_allocator.cpp

1118

Do we also need to make these changes in lsan_allocator.cpp?

1120

s/0/nullptr

[vitalybuka]

0 -> nullptr

compiler-rt/lib/asan/asan_allocator.cpp

1118

Yes. LsanMetadata argument is results of GetUserBegin
pure lsan version of GetUserBegin never returns null
asan has to return null as we can get into situations when AsanChunk is not yet initialized.

compiler-rt/lib/asan/asan_allocator.cpp

#endif
   // -------------------------- Chunk lookup ----------------------
 
   // Assumes alloc_beg == allocator.GetBlockBegin(alloc_beg).
   AsanChunk *GetAsanChunk(void *alloc_beg) {
     if (!alloc_beg) return nullptr;
     if (!allocator.FromPrimary(alloc_beg)) {
       uptr *meta = reinterpret_cast<uptr *>(allocator.GetMetaData(alloc_beg));
       AsanChunk *m = reinterpret_cast<AsanChunk *>(meta[1]);
-      return m;
+      return m ? m : reinterpret_cast<AsanChunk *>(alloc_beg);
     }
     uptr *alloc_magic = reinterpret_cast<uptr *>(alloc_beg);
     if (alloc_magic[0] == kAllocBegMagic)
       return reinterpret_cast<AsanChunk *>(alloc_magic[1]);
     return reinterpret_cast<AsanChunk *>(alloc_beg);
   }
 
   AsanChunk *GetAsanChunkDebug(void *alloc_beg) {
     if (!alloc_beg) return nullptr;
     if (!allocator.FromPrimary(alloc_beg)) {
       uptr *meta = reinterpret_cast<uptr *>(allocator.GetMetaData(alloc_beg));
       AsanChunk *m = reinterpret_cast<AsanChunk *>(meta[1]);
       Printf("GetAsanChunkDebug1 alloc_beg %p meta %p m %p\n", alloc_beg, meta, m);
-      return m;
+      return m ? m : reinterpret_cast<AsanChunk *>(alloc_beg);
     }
     uptr *alloc_magic = reinterpret_cast<uptr *>(alloc_beg);
     Printf(
         "GetAsanChunkDebug2 alloc_beg %p  alloc_magic %p alloc_magic[0] %p "
         "alloc_magic[1] %p\n",
         alloc_beg, alloc_magic, alloc_magic[0], alloc_magic[1]);
     if (alloc_magic[0] == kAllocBegMagic)
       return reinterpret_cast<AsanChunk *>(alloc_magic[1]);
Printf(
         "chunk: %p caller %p __lsan_current_stage %s\n",
         chunk, GET_CALLER_PC(), __lsan_current_stage);
     GetUserBeginDebug(chunk);
   }
   CHECK(m);
   return m->Beg();
 }
 
 LsanMetadata::LsanMetadata(uptr chunk) {
   metadata_ = reinterpret_cast<void *>(chunk - __asan::kChunkHeaderSize);
 }
 
 bool LsanMetadata::allocated() const {
   __asan::AsanChunk *m = reinterpret_cast<__asan::AsanChunk *>(metadata_);
   return atomic_load(&m->chunk_state, memory_order_relaxed) ==
          __asan::CHUNK_ALLOCATED;
 }
 
 ChunkTag LsanMetadata::tag() const {

compiler-rt/test/asan/TestCases/lsan_crash.cpp

+// RUN: %clangxx_asan -O2 %s -o %t && %run %t
+
+#include <atomic>
+#include <memory>
+#include <sanitizer/lsan_interface.h>
+#include <thread>
+#include <vector>
+
+std::atomic<bool> done;
+
+void foo() {
+  std::vector<std::unique_ptr<char[]>> mem(10);
+
+  while (!done)
+    mem[rand() % mem.size()].reset(new char[1000000]);
+}
+
+int main() {
+  std::vector<std::thread> first;
+  for (int i = 0; i < 10; ++i)
+    first.emplace_back(foo);
+
+  for (int i = 0; i < 100; ++i)
+    __lsan_do_recoverable_leak_check();
+
+  done = true;
+  for (auto &f : first)
+    f.join();
+
+  return 0;
+}
 No newline at end of file