ASAN: Support detect_invalid_pointer_pairs=1 with detect_stack_use_after_return=1

[marxin]

Summary

Do not crash when AsanThread::GetStackVariableShadowStart does not find
a variable for a pointer on a shadow stack.

The patch fixes https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97414

[kcc]

compiler-rt/lib/asan/asan_thread.cpp

369

when does this happen? When a variable is too large to fit in the fake stack?

compiler-rt/test/asan/TestCases/invalid-pointer-pairs-subtract-success.cpp

3

Can we test both modes?

26

If the behavior depends on the size of the stack variable, I'd prefer to extend the test to have both cases.

[marxin]

compiler-rt/lib/asan/asan_thread.cpp

369

The function is only called from IsInvalidPointerPair which finds whether a pointer is a pointer to a stack/global/heap variable.
So it's fine to return 0 when the function is called for a non-stack variable and fake stacks are enabled.

[kcc]

compiler-rt/test/asan/TestCases/invalid-pointer-pairs-subtract-success.cpp

26

any thoughts on this comment?

[marxin]

compiler-rt/test/asan/TestCases/invalid-pointer-pairs-subtract-success.cpp

26

It does not depend on any size of a stack variable. I thought you mean to run the test-case both with shadow stack and without shadow stack.
That's why I added the another // RUN line.

[kcc]

LGTM, thanks!

[MaskRay]

compiler-rt/lib/asan/asan_thread.cpp

369

https://llvm.org/docs/CodingStandards.html#don-t-use-braces-on-simple-single-statement-bodies-of-if-else-loop-statements

The coding standard prefer dropping braces for simple single statements.

compiler-rt/lib/asan/asan_thread.cpp

 }
 
 uptr AsanThread::GetStackVariableShadowStart(uptr addr) {
   uptr bottom = 0;
   if (AddrIsInStack(addr)) {
     bottom = stack_bottom();
   } else if (has_fake_stack()) {
     bottom = fake_stack()->AddrIsInFakeStack(addr);
-    CHECK(bottom);
+    if (bottom == 0) {
+      return 0;
+    }
   } else {
     return 0;
   }
 
   uptr aligned_addr = RoundDownTo(addr, SANITIZER_WORDSIZE / 8);  // align addr.
   u8 *shadow_ptr = (u8*)MemToShadow(aligned_addr);
   u8 *shadow_bottom = (u8*)MemToShadow(bottom);
 

compiler-rt/test/asan/TestCases/invalid-pointer-pairs-subtract-success.cpp

 // RUN: %clangxx_asan -O0 %s -o %t -mllvm -asan-detect-invalid-pointer-pair
 
-// RUN: %env_asan_opts=detect_invalid_pointer_pairs=2 %run %t
+// RUN: %env_asan_opts=detect_invalid_pointer_pairs=2,detect_stack_use_after_return=1 %run %t
 
 #include <assert.h>
 #include <stdlib.h>
 
 int bar(char *p, char *q) {
   return p - q;
 }
 
 char global[10000] = {};
 
 int main() {
   // Heap allocated memory.
   char *p = (char *)malloc(42);
   int r = bar(p, p + 20);
   free(p);
 
   // Global variable.
   bar(&global[0], &global[100]);
   bar(&global[1000], &global[9000]);
   bar(&global[500], &global[10]);
   bar(&global[0], &global[10000]);
 
   // Stack variable.
   char stack[10000];
   bar(&stack[0], &stack[100]);
   bar(&stack[1000], &stack[9000]);
   bar(&stack[500], &stack[10]);
 
   return 0;
 }