[hwasan] make error reporting look more like in asan, print the memory tag around the buggy access, simplify one test

llvm-svn: 340470
This commit is contained in:
Kostya Serebryany 2018-08-22 22:55:16 +00:00
parent ed1b9695ee
commit e2efbbe571
3 changed files with 50 additions and 28 deletions

View File

@ -37,6 +37,7 @@ static StackTrace GetStackTraceFromId(u32 id) {
class Decorator: public __sanitizer::SanitizerCommonDecorator {
public:
Decorator() : SanitizerCommonDecorator() { }
const char *Access() { return Blue(); }
const char *Allocation() const { return Magenta(); }
const char *Origin() const { return Magenta(); }
const char *Name() const { return Green(); }
@ -113,21 +114,46 @@ void ReportTagMismatch(StackTrace *stack, uptr addr, uptr access_size,
ScopedErrorReportLock l;
Decorator d;
Printf("%s", d.Warning());
Printf("%s", d.Error());
uptr address = GetAddressFromPointer(addr);
Printf("%s of size %zu at %p\n", is_store ? "WRITE" : "READ", access_size,
address);
// TODO: when possible, try to print heap-use-after-free, etc.
const char *bug_type = "tag-mismatch";
uptr pc = stack->size ? stack->trace[0] : 0;
Report("ERROR: %s: %s on address %p at pc %p\n", SanitizerToolName, bug_type, address, pc);
tag_t ptr_tag = GetTagFromPointer(addr);
tag_t mem_tag = *(tag_t *)MEM_TO_SHADOW(address);
Printf("pointer tag 0x%x\nmemory tag 0x%x\n", ptr_tag, mem_tag);
tag_t *tag_ptr = reinterpret_cast<tag_t*>(MEM_TO_SHADOW(address));
tag_t mem_tag = *tag_ptr;
Printf("%s", d.Access());
Printf("%s of size %zu at %p tags: %02x/%02x (ptr/mem)\n",
is_store ? "WRITE" : "READ", access_size, address, ptr_tag, mem_tag);
Printf("%s", d.Default());
stack->Print();
PrintAddressDescription(address, access_size);
ReportErrorSummary("tag-mismatch", stack);
Printf(
"Memory tags around the buggy address (one tag corresponds to %zd "
"bytes):\n", kShadowAlignment);
const uptr row_len = 16; // better be power of two.
const uptr num_rows = 11;
tag_t *center_row_beg = reinterpret_cast<tag_t *>(
RoundDownTo(reinterpret_cast<uptr>(tag_ptr), row_len));
tag_t *beg_row = center_row_beg - row_len * (num_rows / 2);
tag_t *end_row = center_row_beg + row_len * (num_rows / 2);
for (tag_t *row = beg_row; row < end_row; row += row_len) {
Printf("%s", row == center_row_beg ? "=>" : " ");
for (uptr i = 0; i < row_len; i++) {
Printf("%s", row + i == tag_ptr ? "[" : " ");
Printf("%02x", row[i]);
Printf("%s", row + i == tag_ptr ? "]" : " ");
}
Printf("%s\n", row == center_row_beg ? "<=" : " ");
}
ReportErrorSummary(bug_type, stack);
}
} // namespace __hwasan

View File

@ -22,7 +22,5 @@ int f(void *caller_frame) {
int main() {
return f(__builtin_frame_address(0));
// CHECK: READ of size 8
// CHECK: pointer tag
// CHECK: memory tag 0x0
// CHECK: READ of size 8 at {{.*}} tags: {{.*}}/00 (ptr/mem)
}

View File

@ -1,13 +1,14 @@
// RUN: %clang_hwasan -O0 -DLOAD %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK,LOAD
// RUN: %clang_hwasan -O1 -DLOAD %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK,LOAD
// RUN: %clang_hwasan -O2 -DLOAD %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK,LOAD
// RUN: %clang_hwasan -O3 -DLOAD %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK,LOAD
// RUN: %clang_hwasan -O0 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
// RUN: %clang_hwasan -O1 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
// RUN: %clang_hwasan -O2 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
// RUN: %clang_hwasan -O3 -DISREAD=1 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
// RUN: %clang_hwasan -O0 -DSTORE %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK,STORE
// RUN: %clang_hwasan -O0 -DISREAD=0 %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
// REQUIRES: stable-runtime
#include <stdlib.h>
#include <stdio.h>
#include <sanitizer/hwasan_interface.h>
int main() {
@ -15,25 +16,22 @@ int main() {
char * volatile x = (char*)malloc(10);
free(x);
__hwasan_disable_allocator_tagging();
#ifdef STORE
x[5] = 42;
#endif
#ifdef LOAD
return x[5];
#endif
// LOAD: READ of size 1 at
// LOAD: #0 {{.*}} in main {{.*}}use-after-free.c:22
// STORE: WRITE of size 1 at
// STORE: #0 {{.*}} in main {{.*}}use-after-free.c:19
fprintf(stderr, "Going to do a %s\n", ISREAD ? "READ" : "WRITE");
// CHECK: Going to do a [[TYPE:[A-Z]*]]
int r = 0;
if (ISREAD) r = x[5]; else x[5] = 42; // should be on the same line.
// CHECK: [[TYPE]] of size 1 at {{.*}} tags: [[PTR_TAG:[0-9a-f][0-9a-f]]]/[[MEM_TAG:[0-9a-f][0-9a-f]]] (ptr/mem)
// CHECK: #0 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-2]]
// CHECK: freed here:
// CHECK: #0 {{.*}} in {{.*}}free{{.*}} {{.*}}hwasan_interceptors.cc
// CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:16
// CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-11]]
// CHECK: previously allocated here:
// CHECK: #0 {{.*}} in {{.*}}malloc{{.*}} {{.*}}hwasan_interceptors.cc
// CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:15
// CHECK: #1 {{.*}} in main {{.*}}use-after-free.c:[[@LINE-16]]
// CHECK: Memory tags around the buggy address (one tag corresponds to 16 bytes):
// CHECK: =>{{.*}}[[MEM_TAG]]
// CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in main
return r;
}