[ASAN] Make sure we are only processing lifetime markers with offset 0 to alloca

[lxfind]

Summary

This patch addresses https://bugs.llvm.org/show_bug.cgi?id=47787 (and hence https://bugs.llvm.org/show_bug.cgi?id=47767 as well).
In latter instrumentation code, we always use the beginning of the alloca as the base for instrumentation, ignoring any offset into the alloca.
Because of that, we should only instrument a lifetime marker if it's actually pointing to the beginning of the alloca.

[vitalybuka]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

1088

Similar problem is if the size of lifetime is smaller then alloca.
Would you like to handle that case, here or in the another patch?

llvm/test/Instrumentation/AddressSanitizer/alloca-offset-lifetime.ll

2

Would you like to try to use llvm/utils/update_test_checks.py

[lxfind]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

1088

Is that a problem though? A lifetime marker should always be accurate, that is, if the marker indicates that only part of the region is alive, it should be ok to just mark that region alive?

[lxfind]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

1088

I will land this as it is for now. But please do let me know your thoughts on what we want to do when the size doesn't match.

[vitalybuka]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

1088

if marker can point with offset, skipping the beginning of the alloca, then I assume sooner or later something may generate code which will set size smaller then alloca, skipping the tail of it.

[vitalybuka]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

1094–1096

[lxfind]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

1088

Not sure if I follow, but my point is if the lifetime points to the beginning of the alloca, the generated instrumentation code will always be correct, and hence it's fine even the size may be smaller than the alloca size.

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

void visitIntrinsicInst(IntrinsicInst &II) {
     if (Size->isMinusOne()) return;
     // Check that size doesn't saturate uint64_t and can
     // be stored in IntptrTy.
     const uint64_t SizeValue = Size->getValue().getLimitedValue();
     if (SizeValue == ~0ULL ||
         !ConstantInt::isValueValidForType(IntptrTy, SizeValue))
       return;
     // Find alloca instruction that corresponds to llvm.lifetime argument.
-    AllocaInst *AI = findAllocaForValue(II.getArgOperand(1));
+    // Currently we can only handle lifetime markers pointing to the
+    // beginning of the alloca.
+    AllocaInst *AI = findAllocaForValue(II.getArgOperand(1), true);
     if (!AI) {
       HasUntracedLifetimeIntrinsic = true;
       return;
     }
     // We're interested only in allocas we can handle.
     if (!ASan.isInterestingAlloca(*AI))
       return;
     bool DoPoison = (ID == Intrinsic::lifetime_end);
     AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison};
     if (AI->isStaticAlloca())
       StaticAllocaPoisonCallVec.push_back(APC);
     else if (ClInstrumentDynamicAllocas)
       DynamicAllocaPoisonCallVec.push_back(APC);
   }
 
   void visitCallBase(CallBase &CB) {

llvm/test/Instrumentation/AddressSanitizer/alloca-offset-lifetime.ll

+; Test that ASAN will not instrument lifetime markers on alloca offsets.
+;
+; RUN: opt < %s --asan --asan-use-after-scope -S | FileCheck %s
+
+target datalayout = "e-m:o-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-apple-macosx10.15.0"
+
+%t = type { void (%t*)*, void (%t*)*, %sub, i64 }
+%sub = type { i32 }
+
+define void @foo() sanitize_address {
+entry:
+  %0 = alloca %t, align 8
+  %x = getelementptr inbounds %t, %t* %0, i64 0, i32 2
+  %1 = bitcast %sub* %x to i8*
+  call void @llvm.lifetime.start.p0i8(i64 4, i8* nonnull %1)
+  call void @bar(%sub* nonnull %x)
+  call void @llvm.lifetime.end.p0i8(i64 4, i8* nonnull %1) #3
+  ret void
+}
+
+declare void @llvm.lifetime.start.p0i8(i64 immarg, i8* nocapture)
+declare void @bar(%sub*)
+declare void @llvm.lifetime.end.p0i8(i64 immarg, i8* nocapture)
+
+; CHECK: store i64 %[[STACK_BASE:.+]], i64* %asan_local_stack_base, align 8
+; CHECK-NOT: store i8 0
+; CHECK: call void @bar(%sub* nonnull %x)