92 lines · c
1// Tests use-after-scope detection and reporting.2// RUN: %clang_hwasan -O0 -g %s -o %t && not %run %t 2>&1 | FileCheck %s3// RUN: %clang_hwasan -O2 -g %s -o %t && not %run %t 2>&1 | FileCheck %s4// RUN: %clang_hwasan -O2 -g %s -DBUFFER_SIZE=1000000 -o %t && not %run %t 2>&1 | FileCheck %s5// RUN: %clang_hwasan -O2 -g %s -DBUFFER_SIZE=2000000 -o %t && not %run %t 2>&1 | FileCheck %s6// RUN: %clang_hwasan -g %s -o %t && not %env_hwasan_opts=symbolize=0 %run %t 2>&1 | FileCheck %s --check-prefix=NOSYM7 8// RUN: %clang_hwasan -mllvm -hwasan-use-after-scope=false -g %s -o %t && %run %t 2>&19 10// RUN: %clang_hwasan -g %s -o %t && not %run %t 2>&1 | FileCheck %s11 12// Run the same test as above, but using the __hwasan_add_frame_record libcall.13// The output should be the exact same.14// RUN: %clang_hwasan -mllvm -hwasan-record-stack-history=libcall -g %s -o %t && not %env_hwasan_opts=symbolize=0 %run %t 2>&1 | FileCheck %s --check-prefix=NOSYM15 16// Stack histories currently are not recorded on x86.17// XFAIL: target=x86_64{{.*}}18 19#include <assert.h>20#include <sanitizer/hwasan_interface.h>21#include <stdio.h>22 23#ifndef BUFFER_SIZE24# define BUFFER_SIZE 0x80025#endif26 27void USE(void *x) { // pretend_to_do_something(void *x)28 __asm__ __volatile__(""29 :30 : "r"(x)31 : "memory");32}33 34__attribute__((noinline)) void Unrelated1() {35 int A[2];36 USE(&A[0]);37}38__attribute__((noinline)) void Unrelated2() {39 int BB[3];40 USE(&BB[0]);41}42__attribute__((noinline)) void Unrelated3() {43 int CCC[4];44 USE(&CCC[0]);45}46 47__attribute__((noinline)) char buggy() {48 char *volatile p;49 {50 char zzz[BUFFER_SIZE] = {};51 char yyy[BUFFER_SIZE] = {};52 // With -hwasan-generate-tags-with-calls=false, stack tags can occasionally53 // be zero, leading to a false negative54 // (https://github.com/llvm/llvm-project/issues/69221). Work around it by55 // using the neighboring variable, which is guaranteed by56 // -hwasan-generate-tags-with-calls=false to have a different (hence57 // non-zero) tag.58 if (__hwasan_tag_pointer(zzz, 0) == zzz) {59 assert(__hwasan_tag_pointer(yyy, 0) != yyy);60 p = yyy;61 } else {62 p = zzz;63 }64 }65 return *p;66}67 68int main() {69 Unrelated1();70 Unrelated2();71 Unrelated3();72 char p = buggy();73 return p;74 // CHECK: READ of size 1 at75 // CHECK: #0 {{.*}} in buggy{{.*}}stack-uas.c:[[@LINE-10]]76 // CHECK: Cause: stack tag-mismatch77 // CHECK: is located in stack of thread78 // CHECK: Potentially referenced stack objects:79 // CHECK: Cause: use-after-scope80 // CHECK-NEXT: 0x{{.*}} is located 0 bytes inside a {{.*}}-byte local variable {{zzz|yyy}} [0x{{.*}}) in buggy {{.*}}stack-uas.c:81 // CHECK: Memory tags around the buggy address82 83 // NOSYM: Previously allocated frames:84 // NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uas.c.tmp+0x{{.*}}){{$}}85 // NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uas.c.tmp+0x{{.*}}){{$}}86 // NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uas.c.tmp+0x{{.*}}){{$}}87 // NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uas.c.tmp+0x{{.*}}){{$}}88 // NOSYM: Memory tags around the buggy address89 90 // CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in buggy91}92