[dfsan] Add origin ABI wrappers

[stephan.yichao.zhao]

Summary

supported: dl_get_tls_static_info, calloc, clock_gettime,
dfsan_set_write_callback, dl_iterato_phdr, dlopen, memcpy,
memmove, memset, pread, read, strcat, strdup, strncpy

This is a part of https://reviews.llvm.org/D95835.

[morehouse]

compiler-rt/test/dfsan/custom.cpp

225–232

Please remove these commented out lines

317

324

This is past the end of the buffer, which is only 12 bytes long.

324

Why do we need to align these?

370

strd is a pointer, not an array. We nee to use strlen.

839

sizeof doesn't work properly on non-arrays.

[stephan.yichao.zhao]

compiler-rt/test/dfsan/custom.cpp

324

This is because of the 4-byte aligned origin. This is the aligned up boundary to check if origins of dst were updated. We do not access the out-of-bound address.
added comments.

Also added comments at test_dfsan_set_write_callback.

324

Same as the above. Added comments.

370

Thank you.

839

Thank you.

[stephan.yichao.zhao]

updated

[morehouse]

compiler-rt/test/dfsan/custom.cpp

1737

Can we test strncpy now?

[stephan.yichao.zhao]

turned on testing strncpy

[stephan.yichao.zhao]

turned on testing strncpy

compiler-rt/lib/dfsan/dfsan.h

 void dfsan_clear_arg_tls(uptr offset, uptr size);
 // Zero out the TLS storage.
 void dfsan_clear_thread_local_state();
 
 // Return the origin associated with the first taint byte in the size bytes
 // from the address addr.
 dfsan_origin dfsan_read_origin_of_first_taint(const void *addr, uptr size);
 
+// Set the data within [addr, addr+size) with label and origin.
+void dfsan_set_label_origin(dfsan_label label, dfsan_origin origin, void *addr,
+                            uptr size);
+
 // Copy or move the origins of the len bytes from src to dst.
 void dfsan_mem_origin_transfer(const void *dst, const void *src, uptr len);
 }  // extern "C"
 
 template <typename T>
 void dfsan_set_label(dfsan_label label, T &data) {  // NOLINT
   dfsan_set_label(label, (void *)&data, sizeof(T));
 }

compiler-rt/lib/dfsan/dfsan.cpp

dfsan_read_label(const void *addr, uptr size) {
   return __dfsan_union_load(shadow_for(addr), size);
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE dfsan_origin
 dfsan_read_origin_of_first_taint(const void *addr, uptr size) {
   return GetOriginIfTainted((uptr)addr, size);
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE void dfsan_set_label_origin(dfsan_label label,
+                                                          dfsan_origin origin,
+                                                          void *addr,
+                                                          uptr size) {
+  __dfsan_set_label(label, origin, addr, size);
+}
+
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE
 const struct dfsan_label_info *dfsan_get_label_info(dfsan_label label) {
   return &__dfsan_label_info[label];
 }
 
 extern "C" SANITIZER_INTERFACE_ATTRIBUTE int
 dfsan_has_label(dfsan_label label, dfsan_label elem) {
   if (label == elem)

compiler-rt/lib/dfsan/dfsan_custom.cpp

SANITIZER_INTERFACE_ATTRIBUTE void *__dfsw_calloc(size_t nmemb, size_t size,
                                                   dfsan_label size_label,
                                                   dfsan_label *ret_label) {
   void *p = calloc(nmemb, size);
   dfsan_set_label(0, p, nmemb * size);
   *ret_label = 0;
   return p;
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE void *__dfso_calloc(
+    size_t nmemb, size_t size, dfsan_label nmemb_label, dfsan_label size_label,
+    dfsan_label *ret_label, dfsan_origin nmemb_origin, dfsan_origin size_origin,
+    dfsan_origin *ret_origin) {
+  void *p = __dfsw_calloc(nmemb, size, nmemb_label, size_label, ret_label);
+  *ret_origin = 0;
+  return p;
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE size_t
 __dfsw_strlen(const char *s, dfsan_label s_label, dfsan_label *ret_label) {
   size_t ret = strlen(s);
   if (flags().strict_data_dependencies) {
     *ret_label = 0;
   } else {
     *ret_label = dfsan_read_label(s, ret + 1);
   }

 
 static void *dfsan_memmove(void *dest, const void *src, size_t n) {
   dfsan_label *sdest = shadow_for(dest);
   const dfsan_label *ssrc = shadow_for(src);
   internal_memmove((void *)sdest, (const void *)ssrc, n * sizeof(dfsan_label));
   return internal_memmove(dest, src, n);
 }
 
+static void *dfsan_memmove_with_origin(void *dest, const void *src, size_t n) {
+  dfsan_mem_origin_transfer(dest, src, n);
+  return dfsan_memmove(dest, src, n);
+}
+
 static void *dfsan_memcpy(void *dest, const void *src, size_t n) {
   dfsan_label *sdest = shadow_for(dest);
   const dfsan_label *ssrc = shadow_for(src);
   internal_memcpy((void *)sdest, (const void *)ssrc, n * sizeof(dfsan_label));
   return internal_memcpy(dest, src, n);
 }
 
+static void *dfsan_memcpy_with_origin(void *dest, const void *src, size_t n) {
+  dfsan_mem_origin_transfer(dest, src, n);
+  return dfsan_memcpy(dest, src, n);
+}
+
 static void dfsan_memset(void *s, int c, dfsan_label c_label, size_t n) {
   internal_memset(s, c, n);
   dfsan_set_label(c_label, s, n);
 }
 
+static void dfsan_memset_with_origin(void *s, int c, dfsan_label c_label,
+                                     dfsan_origin c_origin, size_t n) {
+  internal_memset(s, c, n);
+  dfsan_set_label_origin(c_label, c_origin, s, n);
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__dfsw_memcpy(void *dest, const void *src, size_t n,
                     dfsan_label dest_label, dfsan_label src_label,
                     dfsan_label n_label, dfsan_label *ret_label) {
   *ret_label = dest_label;
   return dfsan_memcpy(dest, src, n);
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
+void *__dfso_memcpy(void *dest, const void *src, size_t n,
+                    dfsan_label dest_label, dfsan_label src_label,
+                    dfsan_label n_label, dfsan_label *ret_label,
+                    dfsan_origin dest_origin, dfsan_origin src_origin,
+                    dfsan_origin n_origin, dfsan_origin *ret_origin) {
+  *ret_label = dest_label;
+  *ret_origin = dest_origin;
+  return dfsan_memcpy_with_origin(dest, src, n);
+}
+
+SANITIZER_INTERFACE_ATTRIBUTE
 void *__dfsw_memmove(void *dest, const void *src, size_t n,
                      dfsan_label dest_label, dfsan_label src_label,
                      dfsan_label n_label, dfsan_label *ret_label) {
   *ret_label = dest_label;
   return dfsan_memmove(dest, src, n);
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
+void *__dfso_memmove(void *dest, const void *src, size_t n,
+                     dfsan_label dest_label, dfsan_label src_label,
+                     dfsan_label n_label, dfsan_label *ret_label,
+                     dfsan_origin dest_origin, dfsan_origin src_origin,
+                     dfsan_origin n_origin, dfsan_origin *ret_origin) {
+  *ret_label = dest_label;
+  *ret_origin = dest_origin;
+  return dfsan_memmove_with_origin(dest, src, n);
+}
+
+SANITIZER_INTERFACE_ATTRIBUTE
 void *__dfsw_memset(void *s, int c, size_t n,
                     dfsan_label s_label, dfsan_label c_label,
                     dfsan_label n_label, dfsan_label *ret_label) {
   dfsan_memset(s, c, c_label, n);
   *ret_label = s_label;
   return s;
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE
+void *__dfso_memset(void *s, int c, size_t n, dfsan_label s_label,
+                    dfsan_label c_label, dfsan_label n_label,
+                    dfsan_label *ret_label, dfsan_origin s_origin,
+                    dfsan_origin c_origin, dfsan_origin n_origin,
+                    dfsan_origin *ret_origin) {
+  dfsan_memset_with_origin(s, c, c_label, c_origin, n);
+  *ret_label = s_label;
+  *ret_origin = s_origin;
+  return s;
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE char *__dfsw_strcat(char *dest, const char *src,
                                                   dfsan_label dest_label,
                                                   dfsan_label src_label,
                                                   dfsan_label *ret_label) {
   size_t dest_len = strlen(dest);
   char *ret = strcat(dest, src);  // NOLINT
   dfsan_label *sdest = shadow_for(dest + dest_len);
   const dfsan_label *ssrc = shadow_for(src);
   internal_memcpy((void *)sdest, (const void *)ssrc,
                   strlen(src) * sizeof(dfsan_label));
   *ret_label = dest_label;
   return ret;
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE char *__dfso_strcat(
+    char *dest, const char *src, dfsan_label dest_label, dfsan_label src_label,
+    dfsan_label *ret_label, dfsan_origin dest_origin, dfsan_origin src_origin,
+    dfsan_origin *ret_origin) {
+  size_t dest_len = strlen(dest);
+  char *ret = strcat(dest, src);  // NOLINT
+  dfsan_label *sdest = shadow_for(dest + dest_len);
+  const dfsan_label *ssrc = shadow_for(src);
+  size_t src_len = strlen(src);
+  dfsan_mem_origin_transfer(dest + dest_len, src, src_len);
+  internal_memcpy((void *)sdest, (const void *)ssrc,
+                  src_len * sizeof(dfsan_label));
+  *ret_label = dest_label;
+  *ret_origin = dest_origin;
+  return ret;
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE char *
 __dfsw_strdup(const char *s, dfsan_label s_label, dfsan_label *ret_label) {
   size_t len = strlen(s);
   void *p = malloc(len+1);
   dfsan_memcpy(p, s, len+1);
   *ret_label = 0;
   return static_cast<char *>(p);
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE char *__dfso_strdup(const char *s,
+                                                  dfsan_label s_label,
+                                                  dfsan_label *ret_label,
+                                                  dfsan_origin s_origin,
+                                                  dfsan_origin *ret_origin) {
+  size_t len = strlen(s);
+  void *p = malloc(len + 1);
+  dfsan_memcpy_with_origin(p, s, len + 1);
+  *ret_label = 0;
+  *ret_origin = 0;
+  return static_cast<char *>(p);
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE char *
 __dfsw_strncpy(char *s1, const char *s2, size_t n, dfsan_label s1_label,
                dfsan_label s2_label, dfsan_label n_label,
                dfsan_label *ret_label) {
   size_t len = strlen(s2);
   if (len < n) {
     dfsan_memcpy(s1, s2, len+1);
     dfsan_memset(s1+len+1, 0, 0, n-len-1);
   } else {
     dfsan_memcpy(s1, s2, n);
   }
 
   *ret_label = s1_label;
   return s1;
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE char *__dfso_strncpy(
+    char *s1, const char *s2, size_t n, dfsan_label s1_label,
+    dfsan_label s2_label, dfsan_label n_label, dfsan_label *ret_label,
+    dfsan_origin s1_origin, dfsan_origin s2_origin, dfsan_origin n_origin,
+    dfsan_origin *ret_origin) {
+  size_t len = strlen(s2);
+  if (len < n) {
+    dfsan_memcpy_with_origin(s1, s2, len + 1);
+    dfsan_memset_with_origin(s1 + len + 1, 0, 0, 0, n - len - 1);
+  } else {
+    dfsan_memcpy_with_origin(s1, s2, n);
+  }
+
+  *ret_label = s1_label;
+  *ret_origin = s1_origin;
+  return s1;
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE ssize_t
 __dfsw_pread(int fd, void *buf, size_t count, off_t offset,
              dfsan_label fd_label, dfsan_label buf_label,
              dfsan_label count_label, dfsan_label offset_label,
              dfsan_label *ret_label) {
   ssize_t ret = pread(fd, buf, count, offset);
   if (ret > 0)
     dfsan_set_label(0, buf, ret);
   *ret_label = 0;
   return ret;
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE ssize_t __dfso_pread(
+    int fd, void *buf, size_t count, off_t offset, dfsan_label fd_label,
+    dfsan_label buf_label, dfsan_label count_label, dfsan_label offset_label,
+    dfsan_label *ret_label, dfsan_origin fd_origin, dfsan_origin buf_origin,
+    dfsan_origin count_origin, dfsan_label offset_origin,
+    dfsan_origin *ret_origin) {
+  ssize_t ret = __dfsw_pread(fd, buf, count, offset, fd_label, buf_label,
+                             count_label, offset_label, ret_label);
+  return ret;
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE ssize_t
 __dfsw_read(int fd, void *buf, size_t count,
              dfsan_label fd_label, dfsan_label buf_label,
              dfsan_label count_label,
              dfsan_label *ret_label) {
   ssize_t ret = read(fd, buf, count);
   if (ret > 0)
     dfsan_set_label(0, buf, ret);
   *ret_label = 0;
   return ret;
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE ssize_t __dfso_read(
+    int fd, void *buf, size_t count, dfsan_label fd_label,
+    dfsan_label buf_label, dfsan_label count_label, dfsan_label *ret_label,
+    dfsan_origin fd_origin, dfsan_origin buf_origin, dfsan_origin count_origin,
+    dfsan_origin *ret_origin) {
+  ssize_t ret =
+      __dfsw_read(fd, buf, count, fd_label, buf_label, count_label, ret_label);
+  return ret;
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE int __dfsw_clock_gettime(clockid_t clk_id,
                                                        struct timespec *tp,
                                                        dfsan_label clk_id_label,
                                                        dfsan_label tp_label,
                                                        dfsan_label *ret_label) {
   int ret = clock_gettime(clk_id, tp);
   if (ret == 0)
     dfsan_set_label(0, tp, sizeof(struct timespec));
   *ret_label = 0;
   return ret;
 }
 
-static void unpoison(const void *ptr, uptr size) {
+SANITIZER_INTERFACE_ATTRIBUTE int __dfso_clock_gettime(
+    clockid_t clk_id, struct timespec *tp, dfsan_label clk_id_label,
+    dfsan_label tp_label, dfsan_label *ret_label, dfsan_origin clk_id_origin,
+    dfsan_origin tp_origin, dfsan_origin *ret_origin) {
+  int ret = __dfsw_clock_gettime(clk_id, tp, clk_id_label, tp_label, ret_label);
+  return ret;
+}
+
+static void dfsan_set_zero_label(const void *ptr, uptr size) {
   dfsan_set_label(0, const_cast<void *>(ptr), size);
 }
 
 // dlopen() ultimately calls mmap() down inside the loader, which generally
 // doesn't participate in dynamic symbol resolution.  Therefore we won't
 // intercept its calls to mmap, and we have to hook it here.
 SANITIZER_INTERFACE_ATTRIBUTE void *
 __dfsw_dlopen(const char *filename, int flag, dfsan_label filename_label,
               dfsan_label flag_label, dfsan_label *ret_label) {
   void *handle = dlopen(filename, flag);
   link_map *map = GET_LINK_MAP_BY_DLOPEN_HANDLE(handle);
   if (map)
-    ForEachMappedRegion(map, unpoison);
+    ForEachMappedRegion(map, dfsan_set_zero_label);
   *ret_label = 0;
   return handle;
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE void *__dfso_dlopen(
+    const char *filename, int flag, dfsan_label filename_label,
+    dfsan_label flag_label, dfsan_label *ret_label,
+    dfsan_origin filename_origin, dfsan_origin flag_origin,
+    dfsan_origin *ret_origin) {
+  void *handle =
+      __dfsw_dlopen(filename, flag, filename_label, flag_label, ret_label);
+  return handle;
+}
+
 static void *DFsanThreadStartFunc(void *arg) {
   DFsanThread *t = (DFsanThread *)arg;
   SetCurrentThread(t);
   return t->ThreadStart();
 }
 
 static int dfsan_pthread_create(pthread_t *thread, const pthread_attr_t *attr,
                                 void *start_routine_trampoline,
struct dl_iterate_phdr_info {
   int (*callback_trampoline)(void *callback, struct dl_phdr_info *info,
                              size_t size, void *data, dfsan_label info_label,
                              dfsan_label size_label, dfsan_label data_label,
                              dfsan_label *ret_label);
   void *callback;
   void *data;
 };
 
+struct dl_iterate_phdr_origin_info {
+  int (*callback_trampoline)(void *callback, struct dl_phdr_info *info,
+                             size_t size, void *data, dfsan_label info_label,
+                             dfsan_label size_label, dfsan_label data_label,
+                             dfsan_label *ret_label, dfsan_origin info_origin,
+                             dfsan_origin size_origin, dfsan_origin data_origin,
+                             dfsan_origin *ret_origin);
+  void *callback;
+  void *data;
+};
+
 int dl_iterate_phdr_cb(struct dl_phdr_info *info, size_t size, void *data) {
   dl_iterate_phdr_info *dipi = (dl_iterate_phdr_info *)data;
   dfsan_set_label(0, *info);
   dfsan_set_label(0, const_cast<char *>(info->dlpi_name),
                   strlen(info->dlpi_name) + 1);
   dfsan_set_label(
       0, const_cast<char *>(reinterpret_cast<const char *>(info->dlpi_phdr)),
       sizeof(*info->dlpi_phdr) * info->dlpi_phnum);
   dfsan_label ret_label;
   return dipi->callback_trampoline(dipi->callback, info, size, dipi->data, 0, 0,
                                    0, &ret_label);
 }
 
+int dl_iterate_phdr_origin_cb(struct dl_phdr_info *info, size_t size,
+                              void *data) {
+  dl_iterate_phdr_origin_info *dipi = (dl_iterate_phdr_origin_info *)data;
+  dfsan_set_label(0, *info);
+  dfsan_set_label(0, const_cast<char *>(info->dlpi_name),
+                  strlen(info->dlpi_name) + 1);
+  dfsan_set_label(
+      0, const_cast<char *>(reinterpret_cast<const char *>(info->dlpi_phdr)),
+      sizeof(*info->dlpi_phdr) * info->dlpi_phnum);
+  dfsan_label ret_label;
+  dfsan_origin ret_origin;
+  return dipi->callback_trampoline(dipi->callback, info, size, dipi->data, 0, 0,
+                                   0, &ret_label, 0, 0, 0, &ret_origin);
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE int __dfsw_dl_iterate_phdr(
     int (*callback_trampoline)(void *callback, struct dl_phdr_info *info,
                                size_t size, void *data, dfsan_label info_label,
                                dfsan_label size_label, dfsan_label data_label,
                                dfsan_label *ret_label),
     void *callback, void *data, dfsan_label callback_label,
     dfsan_label data_label, dfsan_label *ret_label) {
   dl_iterate_phdr_info dipi = { callback_trampoline, callback, data };
   *ret_label = 0;
   return dl_iterate_phdr(dl_iterate_phdr_cb, &dipi);
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE int __dfso_dl_iterate_phdr(
+    int (*callback_trampoline)(void *callback, struct dl_phdr_info *info,
+                               size_t size, void *data, dfsan_label info_label,
+                               dfsan_label size_label, dfsan_label data_label,
+                               dfsan_label *ret_label, dfsan_origin info_origin,
+                               dfsan_origin size_origin,
+                               dfsan_origin data_origin,
+                               dfsan_origin *ret_origin),
+    void *callback, void *data, dfsan_label callback_label,
+    dfsan_label data_label, dfsan_label *ret_label,
+    dfsan_origin callback_origin, dfsan_origin data_origin,
+    dfsan_origin *ret_origin) {
+  dl_iterate_phdr_origin_info dipi = {callback_trampoline, callback, data};
+  *ret_label = 0;
+  return dl_iterate_phdr(dl_iterate_phdr_origin_cb, &dipi);
+}
+
 // This function is only available for glibc 2.27 or newer.  Mark it weak so
 // linking succeeds with older glibcs.
 SANITIZER_WEAK_ATTRIBUTE void _dl_get_tls_static_info(size_t *sizep,
                                                       size_t *alignp);
 
 SANITIZER_INTERFACE_ATTRIBUTE void __dfsw__dl_get_tls_static_info(
     size_t *sizep, size_t *alignp, dfsan_label sizep_label,
     dfsan_label alignp_label) {
   assert(_dl_get_tls_static_info);
   _dl_get_tls_static_info(sizep, alignp);
   dfsan_set_label(0, sizep, sizeof(*sizep));
   dfsan_set_label(0, alignp, sizeof(*alignp));
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE void __dfso__dl_get_tls_static_info(
+    size_t *sizep, size_t *alignp, dfsan_label sizep_label,
+    dfsan_label alignp_label, dfsan_origin sizep_origin,
+    dfsan_origin alignp_origin) {
+  __dfsw__dl_get_tls_static_info(sizep, alignp, sizep_label, alignp_label);
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE
 char *__dfsw_ctime_r(const time_t *timep, char *buf, dfsan_label timep_label,
                      dfsan_label buf_label, dfsan_label *ret_label) {
   char *ret = ctime_r(timep, buf);
   if (ret) {
     dfsan_set_label(dfsan_read_label(timep, sizeof(time_t)), buf,
                     strlen(buf) + 1);
     *ret_label = buf_label;

compiler-rt/test/dfsan/custom.cpp

#else
   ASSERT_EQ_ORIGIN(rv, str1[3]);
 #endif
 
   rv = bcmp(str1, str2, sizeof(str1) - 2);
   assert(rv == 0);
   ASSERT_ZERO_LABEL(rv);
 }
 
-#if !defined(ORIGIN_TRACKING)
 void test_memcpy() {
   char str1[] = "str1";
   char str2[sizeof(str1)];
   dfsan_set_label(i_label, &str1[3], 1);
 
-  ASSERT_ZERO_LABEL(memcpy(str2, str1, sizeof(str1)));
+  DEFINE_AND_SAVE_ORIGINS(str1)
+
+  char *ptr2 = str2;
+  dfsan_set_label(j_label, &ptr2, sizeof(ptr2));
+
+  void *r = memcpy(ptr2, str1, sizeof(str1));
+  ASSERT_LABEL(r, j_label);
+  ASSERT_EQ_ORIGIN(r, ptr2);
   assert(0 == memcmp(str2, str1, sizeof(str1)));
   ASSERT_ZERO_LABEL(str2[0]);
   ASSERT_LABEL(str2[3], i_label);
+
+  for (int i = 0; i < sizeof(str2); ++i) {
+    if (!dfsan_get_label(str2[i]))
+      continue;
+    ASSERT_INIT_ORIGIN(&(str2[i]), str1_o[i]);
+  }
 }
 
 void test_memmove() {
   char str[] = "str1xx";
   dfsan_set_label(i_label, &str[3], 1);
 
-  ASSERT_ZERO_LABEL(memmove(str + 2, str, 4));
+  DEFINE_AND_SAVE_ORIGINS(str)
+
+  char *ptr = str + 2;
+  dfsan_set_label(j_label, &ptr, sizeof(ptr));
+
+  void *r = memmove(ptr, str, 4);
+  ASSERT_LABEL(r, j_label);
+  ASSERT_EQ_ORIGIN(r, ptr);
   assert(0 == memcmp(str + 2, "str1", 4));
-  for (int i = 0; i <= 4; ++i)
-    ASSERT_ZERO_LABEL(str[i]);
+  ASSERT_ZERO_LABEL(str[4]);
   ASSERT_LABEL(str[5], i_label);
+
+  for (int i = 0; i < 4; ++i) {
+    if (!dfsan_get_label(ptr[i]))
+      continue;
+    ASSERT_INIT_ORIGIN(&(ptr[i]), str_o[i]);
+  }
 }
 
 void test_memset() {
   char buf[8];
   int j = 'a';
+  char *ptr = buf;
   dfsan_set_label(j_label, &j, sizeof(j));
-
-  ASSERT_ZERO_LABEL(memset(&buf, j, sizeof(buf)));
+  dfsan_set_label(k_label, &ptr, sizeof(ptr));
+  void *ret = memset(ptr, j, sizeof(buf));
+  ASSERT_LABEL(ret, k_label);
+  ASSERT_EQ_ORIGIN(ret, ptr);
   for (int i = 0; i < 8; ++i) {
     ASSERT_LABEL(buf[i], j_label);
+    ASSERT_EQ_ORIGIN(buf[i], j);
     assert(buf[i] == 'a');
   }
 }
-#endif // !defined(ORIGIN_TRACKING)
 
 void test_strcmp() {
   char str1[] = "str1", str2[] = "str2";
   dfsan_set_label(i_label, &str1[3], 1);
   dfsan_set_label(j_label, &str2[3], 1);
 
   int rv = strcmp(str1, str2);
   assert(rv < 0);
#ifdef STRICT_DATA_DEPENDENCIES
   ASSERT_ZERO_LABEL(rv);
   ASSERT_ZERO_ORIGIN(rv);
 #else
   ASSERT_LABEL(rv, i_label);
   ASSERT_EQ_ORIGIN(rv, str1[3]);
 #endif
 }
 
-#if !defined(ORIGIN_TRACKING)
 void test_strcat() {
   char src[] = "world";
+  int volatile x = 0; // buffer to ensure src and dst do not share origins
   char dst[] = "hello \0    ";
+  int volatile y = 0; // buffer to ensure dst and p do not share origins
   char *p = dst;
   dfsan_set_label(k_label, &p, sizeof(p));
   dfsan_set_label(i_label, src, sizeof(src));
   dfsan_set_label(j_label, dst, sizeof(dst));
+  dfsan_origin dst_o = dfsan_get_origin((long)dst[0]);
   char *ret = strcat(p, src);
   ASSERT_LABEL(ret, k_label);
+  ASSERT_EQ_ORIGIN(ret, p);
   assert(ret == dst);
   assert(strcmp(src, dst + 6) == 0);
+  // Origins are assigned for every 4 contiguous 4-aligned bytes. After
+  // appending src to dst, origins of src can overwrite origins of dst if their
+  // application adddresses are within [start_aligned_down, end_aligned_up).
+  // Other origins are not changed.
+  char *start_aligned_down = (char *)(((size_t)(dst + 6)) & ~3UL);
+  char *end_aligned_up = (char *)(((size_t)(dst + 11 + 4)) & ~3UL);
+  for (int i = 0; i < 12; ++i) {
+    if (dst + i < start_aligned_down || dst + i >= end_aligned_up) {
+      ASSERT_INIT_ORIGIN(&dst[i], dst_o);
+    } else {
+      ASSERT_INIT_ORIGIN_EQ_ORIGIN(&dst[i], src[0]);
+    }
+  }
   for (int i = 0; i < 6; ++i) {
     ASSERT_LABEL(dst[i], j_label);
   }
   for (int i = 6; i < strlen(dst); ++i) {
     ASSERT_LABEL(dst[i], i_label);
     assert(dfsan_get_label(dst[i]) == dfsan_get_label(src[i - 6]));
   }
   ASSERT_LABEL(dst[11], j_label);
 }
-#endif // !defined(ORIGIN_TRACKING)
 
 void test_strlen() {
   char str1[] = "str1";
   dfsan_set_label(i_label, &str1[3], 1);
 
   int rv = strlen(str1);
   assert(rv == 4);
 #ifdef STRICT_DATA_DEPENDENCIES
   ASSERT_ZERO_LABEL(rv);
 #else
   ASSERT_LABEL(rv, i_label);
   ASSERT_EQ_ORIGIN(rv, str1[3]);
 #endif
 }
 
-#if !defined(ORIGIN_TRACKING)
 void test_strdup() {
   char str1[] = "str1";
   dfsan_set_label(i_label, &str1[3], 1);
+  DEFINE_AND_SAVE_ORIGINS(str1)
 
   char *strd = strdup(str1);
+  ASSERT_ZERO_LABEL(strd);
   ASSERT_ZERO_LABEL(strd[0]);
   ASSERT_LABEL(strd[3], i_label);
+
+  for (int i = 0; i < strlen(strd); ++i) {
+    if (!dfsan_get_label(strd[i]))
+      continue;
+    ASSERT_INIT_ORIGIN(&(strd[i]), str1_o[i]);
+  }
+
   free(strd);
 }
 
 void test_strncpy() {
   char str1[] = "str1";
   char str2[sizeof(str1)];
   dfsan_set_label(i_label, &str1[3], 1);
 
   char *strd = strncpy(str2, str1, 5);
   assert(strd == str2);
   assert(strcmp(str1, str2) == 0);
   ASSERT_ZERO_LABEL(strd);
   ASSERT_ZERO_LABEL(strd[0]);
   ASSERT_ZERO_LABEL(strd[1]);
   ASSERT_ZERO_LABEL(strd[2]);
   ASSERT_LABEL(strd[3], i_label);
+  ASSERT_INIT_ORIGIN_EQ_ORIGIN(&(strd[3]), str1[3]);
 
-  strd = strncpy(str2, str1, 3);
+  char *p2 = str2;
+  dfsan_set_label(j_label, &p2, sizeof(p2));
+  strd = strncpy(p2, str1, 3);
   assert(strd == str2);
   assert(strncmp(str1, str2, 3) == 0);
-  ASSERT_ZERO_LABEL(strd);
+  ASSERT_LABEL(strd, j_label);
+  ASSERT_EQ_ORIGIN(strd, p2);
+  // When -dfsan-combine-pointer-labels-on-load is on, strd's label propagates
+  // to strd[i]'s label. When ORIGIN_TRACKING is defined,
+  // -dfsan-combine-pointer-labels-on-load is always off, otherwise the flag
+  // is on by default.
+#if defined(ORIGIN_TRACKING)
   ASSERT_ZERO_LABEL(strd[0]);
   ASSERT_ZERO_LABEL(strd[1]);
   ASSERT_ZERO_LABEL(strd[2]);
+#else
+  ASSERT_LABEL(strd[0], j_label);
+  ASSERT_LABEL(strd[1], j_label);
+  ASSERT_LABEL(strd[2], j_label);
+#endif
 }
-#endif // !defined(ORIGIN_TRACKING)
 
 void test_strncmp() {
   char str1[] = "str1", str2[] = "str2";
   dfsan_set_label(i_label, &str1[3], 1);
   dfsan_set_label(j_label, &str2[3], 1);
 
   int rv = strncmp(str1, str2, sizeof(str1));
   assert(rv < 0);
#ifdef STRICT_DATA_DEPENDENCIES
   ASSERT_LABEL(crv, j_label);
   ASSERT_INIT_ORIGIN_EQ_ORIGIN(&crv, p1);
 #else
   ASSERT_LABEL(crv, i_j_label);
   ASSERT_INIT_ORIGIN_EQ_ORIGIN(&crv, str1[3]);
 #endif
 }
 
-#if !defined(ORIGIN_TRACKING)
 void test_calloc() {
   // With any luck this sequence of calls will cause calloc to return the same
   // pointer both times.  This is probably the best we can do to test this
   // function.
   char *crv = (char *) calloc(4096, 1);
   ASSERT_ZERO_LABEL(crv[0]);
   dfsan_set_label(i_label, crv, 100);
   free(crv);
 
   crv = (char *) calloc(4096, 1);
   ASSERT_ZERO_LABEL(crv[0]);
   free(crv);
 }
 
+#if !defined(ORIGIN_TRACKING)
 void test_recvmmsg() {
   int sockfds[2];
   int ret = socketpair(AF_UNIX, SOCK_DGRAM, 0, sockfds);
   assert(ret != -1);
 
   // Setup messages to send.
   struct mmsghdr smmsg[2] = {};
   char sbuf0[] = "abcdefghijkl";
void test_recvmsg() {
   ASSERT_ZERO_LABEL(received);
   ASSERT_READ_ZERO_LABEL(&rmsg, sizeof(rmsg));
   ASSERT_READ_ZERO_LABEL(&rbuf[0], 8);
   ASSERT_READ_LABEL(&rbuf[8], 1, i_label);
 
   close(sockfds[0]);
   close(sockfds[1]);
 }
+#endif // !defined(ORIGIN_TRACKING)
 
 void test_read() {
   char buf[16];
   dfsan_set_label(i_label, buf, 1);
   dfsan_set_label(j_label, buf + 15, 1);
 
+  DEFINE_AND_SAVE_ORIGINS(buf)
   ASSERT_LABEL(buf[0], i_label);
   ASSERT_LABEL(buf[15], j_label);
 
   int fd = open("/dev/zero", O_RDONLY);
   int rv = read(fd, buf, sizeof(buf));
   assert(rv == sizeof(buf));
   ASSERT_ZERO_LABEL(rv);
   ASSERT_ZERO_LABEL(buf[0]);
   ASSERT_ZERO_LABEL(buf[15]);
+  ASSERT_SAVED_ORIGINS(buf)
   close(fd);
 }
 
 void test_pread() {
   char buf[16];
   dfsan_set_label(i_label, buf, 1);
   dfsan_set_label(j_label, buf + 15, 1);
 
+  DEFINE_AND_SAVE_ORIGINS(buf)
   ASSERT_LABEL(buf[0], i_label);
   ASSERT_LABEL(buf[15], j_label);
 
   int fd = open("/bin/sh", O_RDONLY);
   int rv = pread(fd, buf, sizeof(buf), 0);
   assert(rv == sizeof(buf));
   ASSERT_ZERO_LABEL(rv);
   ASSERT_ZERO_LABEL(buf[0]);
   ASSERT_ZERO_LABEL(buf[15]);
+  ASSERT_SAVED_ORIGINS(buf)
   close(fd);
 }
 
 void test_dlopen() {
   void *map = dlopen(NULL, RTLD_NOW);
   assert(map);
   ASSERT_ZERO_LABEL(map);
   dlclose(map);
   map = dlopen("/nonexistent", RTLD_NOW);
   assert(!map);
   ASSERT_ZERO_LABEL(map);
 }
 
 void test_clock_gettime() {
   struct timespec tp;
   dfsan_set_label(j_label, ((char *)&tp) + 3, 1);
+  dfsan_origin origin = dfsan_get_origin((long)(((char *)&tp)[3]));
   int t = clock_gettime(CLOCK_REALTIME, &tp);
   assert(t == 0);
   ASSERT_ZERO_LABEL(t);
   ASSERT_ZERO_LABEL(((char *)&tp)[3]);
+  ASSERT_ORIGIN(((char *)&tp)[3], origin);
 }
 
+#if !defined(ORIGIN_TRACKING)
 void test_ctime_r() {
   char *buf = (char*) malloc(64);
   time_t t = 0;
 
   char *ret = ctime_r(&t, buf);
   ASSERT_ZERO_LABEL(ret);
   assert(buf == ret);
   ASSERT_READ_ZERO_LABEL(buf, strlen(buf) + 1);
 
   dfsan_set_label(i_label, &t, sizeof(t));
   ret = ctime_r(&t, buf);
   ASSERT_ZERO_LABEL(ret);
   ASSERT_READ_LABEL(buf, strlen(buf) + 1, i_label);
 
   t = 0;
   dfsan_set_label(j_label, &buf, sizeof(&buf));
   ret = ctime_r(&t, buf);
   ASSERT_LABEL(ret, j_label);
   ASSERT_READ_ZERO_LABEL(buf, strlen(buf) + 1);
 }
+#endif // !defined(ORIGIN_TRACKING)
 
 static int write_callback_count = 0;
 static int last_fd;
 static const unsigned char *last_buf;
 static size_t last_count;
 
 void write_callback(int fd, const void *buf, size_t count) {
   write_callback_count++;
 
   last_fd = fd;
   last_buf = (const unsigned char*) buf;
   last_count = count;
 }
 
 void test_dfsan_set_write_callback() {
   char buf[] = "Sample chars";
   int buf_len = strlen(buf);
 
   int fd = open("/dev/null", O_WRONLY);
 
   dfsan_set_write_callback(write_callback);
 
   write_callback_count = 0;
 
+  DEFINE_AND_SAVE_ORIGINS(buf)
+
   // Callback should be invoked on every call to write().
   int res = write(fd, buf, buf_len);
   assert(write_callback_count == 1);
   ASSERT_READ_ZERO_LABEL(&res, sizeof(res));
   ASSERT_READ_ZERO_LABEL(&last_fd, sizeof(last_fd));
   ASSERT_READ_ZERO_LABEL(last_buf, sizeof(last_buf));
   ASSERT_READ_ZERO_LABEL(&last_count, sizeof(last_count));
 
+  for (int i = 0; i < buf_len; ++i)
+    ASSERT_ORIGIN(last_buf[i], buf_o[i]);
+
+  ASSERT_ZERO_ORIGINS(&last_count, sizeof(last_count));
+
   // Add a label to write() arguments.  Check that the labels are readable from
   // the values passed to the callback.
   dfsan_set_label(i_label, &fd, sizeof(fd));
   dfsan_set_label(j_label, &(buf[3]), 1);
   dfsan_set_label(k_label, &buf_len, sizeof(buf_len));
 
+  dfsan_origin fd_o = dfsan_get_origin((long)fd);
+  dfsan_origin buf3_o = dfsan_get_origin((long)(buf[3]));
+  dfsan_origin buf_len_o = dfsan_get_origin((long)buf_len);
+
   res = write(fd, buf, buf_len);
   assert(write_callback_count == 2);
   ASSERT_READ_ZERO_LABEL(&res, sizeof(res));
   ASSERT_READ_LABEL(&last_fd, sizeof(last_fd), i_label);
   ASSERT_READ_LABEL(&last_buf[3], sizeof(last_buf[3]), j_label);
   ASSERT_READ_LABEL(last_buf, sizeof(last_buf), j_label);
   ASSERT_READ_LABEL(&last_count, sizeof(last_count), k_label);
+  ASSERT_ZERO_ORIGINS(&res, sizeof(res));
+  ASSERT_INIT_ORIGINS(&last_fd, sizeof(last_fd), fd_o);
+  ASSERT_INIT_ORIGINS(&last_buf[3], sizeof(last_buf[3]), buf3_o);
+
+  // Origins are assigned for every 4 contiguous 4-aligned bytes. After
+  // appending src to dst, origins of src can overwrite origins of dst if their
+  // application adddresses are within an aligned range. Other origins are not
+  // changed.
+  for (int i = 0; i < buf_len; ++i) {
+    size_t i_addr = size_t(&last_buf[i]);
+    if (((size_t(&last_buf[3]) & ~3UL) > i_addr) ||
+        (((size_t(&last_buf[3]) + 4) & ~3UL) <= i_addr))
+      ASSERT_ORIGIN(last_buf[i], buf_o[i]);
+  }
+
+  ASSERT_INIT_ORIGINS(&last_count, sizeof(last_count), buf_len_o);
 
   dfsan_set_write_callback(NULL);
 }
 
+#if !defined(ORIGIN_TRACKING)
 void test_fgets() {
   char *buf = (char*) malloc(128);
   FILE *f = fopen("/etc/passwd", "r");
   dfsan_set_label(j_label, buf, 1);
   char *ret = fgets(buf, sizeof(buf), f);
   assert(ret == buf);
   ASSERT_ZERO_LABEL(ret);
   ASSERT_READ_ZERO_LABEL(buf, 128);
void test_pthread_create() {
   ASSERT_ZERO_LABEL(cbrv);
   ASSERT_SAVED_ORIGINS(cbrv);
 }
 
 // Tested by test_pthread_create().  This empty function is here to appease the
 // check-wrappers script.
 void test_pthread_join() {}
 
-#if !defined(ORIGIN_TRACKING)
 int dl_iterate_phdr_test_cb(struct dl_phdr_info *info, size_t size,
                             void *data) {
   assert(data == (void *)3);
   ASSERT_ZERO_LABEL(info);
   ASSERT_ZERO_LABEL(size);
   ASSERT_ZERO_LABEL(data);
   return 0;
 }
 
 void test_dl_iterate_phdr() {
   dl_iterate_phdr(dl_iterate_phdr_test_cb, (void *)3);
 }
 
 // On glibc < 2.27, this symbol is not available.  Mark it weak so we can skip
 // testing in this case.
 __attribute__((weak)) extern "C" void _dl_get_tls_static_info(size_t *sizep,
                                                               size_t *alignp);
 
 void test__dl_get_tls_static_info() {
   if (!_dl_get_tls_static_info)
     return;
   size_t sizep = 0, alignp = 0;
   dfsan_set_label(i_label, &sizep, sizeof(sizep));
   dfsan_set_label(i_label, &alignp, sizeof(alignp));
+  dfsan_origin sizep_o = dfsan_get_origin(sizep);
+  dfsan_origin alignp_o = dfsan_get_origin(alignp);
   _dl_get_tls_static_info(&sizep, &alignp);
   ASSERT_ZERO_LABEL(sizep);
   ASSERT_ZERO_LABEL(alignp);
+  ASSERT_ORIGIN(sizep, sizep_o);
+  ASSERT_ORIGIN(alignp, alignp_o);
 }
 
+#if !defined(ORIGIN_TRACKING)
 void test_strrchr() {
   char str1[] = "str1str1";
   dfsan_set_label(i_label, &str1[7], 1);
 
   char *rv = strrchr(str1, 'r');
   assert(rv == &str1[6]);
 #ifdef STRICT_DATA_DEPENDENCIES
   ASSERT_ZERO_LABEL(rv);
#else
   m_label = dfsan_create_label("m", 0);
   n_label = dfsan_create_label("n", 0);
 #endif
   i_j_label = dfsan_union(i_label, j_label);
   assert(i_j_label != i_label);
   assert(i_j_label != j_label);
   assert(i_j_label != k_label);
 
-#if !defined(ORIGIN_TRACKING)
   test__dl_get_tls_static_info();
-#endif // !defined(ORIGIN_TRACKING)
   test_bcmp();
-#if !defined(ORIGIN_TRACKING)
   test_calloc();
   test_clock_gettime();
+#if !defined(ORIGIN_TRACKING)
   test_ctime_r();
+#endif // !defined(ORIGIN_TRACKING)
   test_dfsan_set_write_callback();
   test_dl_iterate_phdr();
   test_dlopen();
+#if !defined(ORIGIN_TRACKING)
   test_epoll_wait();
   test_fgets();
 #endif // !defined(ORIGIN_TRACKING)
   test_fork();
   test_fstat();
 #if !defined(ORIGIN_TRACKING)
   test_get_current_dir_name();
   test_getcwd();
   test_gethostname();
   test_getpeername();
   test_getpwuid_r();
   test_getrlimit();
   test_getrusage();
   test_getsockname();
   test_getsockopt();
   test_gettimeofday();
   test_inet_pton();
   test_localtime_r();
   test_memchr();
 #endif // !defined(ORIGIN_TRACKING)
   test_memcmp();
-#if !defined(ORIGIN_TRACKING)
   test_memcpy();
   test_memmove();
   test_memset();
+#if !defined(ORIGIN_TRACKING)
   test_nanosleep();
   test_poll();
-  test_pread();
 #endif // !defined(ORIGIN_TRACKING)
+  test_pread();
   test_pthread_create();
   test_pthread_join();
-#if !defined(ORIGIN_TRACKING)
   test_read();
+#if !defined(ORIGIN_TRACKING)
   test_recvmmsg();
   test_recvmsg();
   test_sched_getaffinity();
   test_select();
 #endif // !defined(ORIGIN_TRACKING)
   test_sigaction();
   test_signal();
   test_sigaltstack();
   test_sigemptyset();
 #if !defined(ORIGIN_TRACKING)
   test_snprintf();
   test_socketpair();
   test_sprintf();
 #endif // !defined(ORIGIN_TRACKING)
   test_stat();
   test_strcasecmp();
   test_strchr();
   test_strcmp();
-#if !defined(ORIGIN_TRACKING)
   test_strcat();
+#if !defined(ORIGIN_TRACKING)
   test_strcpy();
-  test_strdup();
 #endif // !defined(ORIGIN_TRACKING)
+  test_strdup();
   test_strlen();
   test_strncasecmp();
   test_strncmp();
 #if !defined(ORIGIN_TRACKING)
   test_strncpy();
 #endif // !defined(ORIGIN_TRACKING)
   test_strpbrk();
 #if !defined(ORIGIN_TRACKING)
   test_strrchr();
   test_strstr();
   test_strtod();
   test_strtol();
   test_strtoll();
   test_strtoul();
   test_strtoull();
   test_time();
 #endif // !defined(ORIGIN_TRACKING)
   test_write();
 }