Commit Graph

2115 Commits

Author SHA1 Message Date
Dmitry Vyukov b332134921 tsan: new runtime (v3)
This change switches tsan to the new runtime which features:
 - 2x smaller shadow memory (2x of app memory)
 - faster fully vectorized race detection
 - small fixed-size vector clocks (512b)
 - fast vectorized vector clock operations
 - unlimited number of alive threads/goroutimes

Depends on D112602.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112603
2021-12-13 12:48:34 +01:00
Jonas Devlieghere 396113c19f Revert "tsan: new runtime (v3)"
This reverts commit 5a33e41281 becuase it
breaks LLDB.

https://green.lab.llvm.org/green/view/LLDB/job/lldb-cmake/39208/
2021-12-09 09:18:10 -08:00
Dmitry Vyukov 5a33e41281 tsan: new runtime (v3)
This change switches tsan to the new runtime which features:
 - 2x smaller shadow memory (2x of app memory)
 - faster fully vectorized race detection
 - small fixed-size vector clocks (512b)
 - fast vectorized vector clock operations
 - unlimited number of alive threads/goroutimes

Depends on D112602.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112603
2021-12-09 09:09:52 +01:00
Dmitry Vyukov 8e93d4c996 tsan: fork runtime
Fork the current version of tsan runtime before commiting
rewrite of the runtime (D112603). The old runtime can be
enabled with TSAN_USE_OLD_RUNTIME option.
This is a temporal measure for emergencies and is required
for Chromium rollout (for context see http://crbug.com/1275581).
The old runtime is supposed to be deleted soon.

Reviewed By: thakis

Differential Revision: https://reviews.llvm.org/D115223
2021-12-09 07:28:26 +01:00
Nico Weber 63d518f31a [tsan] Move tsan/rtl build rules into tsan/rtl/CMakeLists.txt
That way, the build rules are closer to the source files they describe.

No intended behavior change.

Differential Revision: https://reviews.llvm.org/D115155
2021-12-06 19:58:30 -05:00
Vitaly Buka 6318001209 [sanitizer] Support IsRssLimitExceeded in all sanitizers
Reviewed By: kstoimenov

Differential Revision: https://reviews.llvm.org/D115000
2021-12-03 12:45:44 -08:00
Dmitry Vyukov 1b576585eb tsan: tolerate munmap with invalid arguments
We call UnmapShadow before the actual munmap, at that point we don't yet
know if the provided address/size are sane. We can't call UnmapShadow
after the actual munmap becuase at that point the memory range can
already be reused for something else, so we can't rely on the munmap
return value to understand is the values are sane.
While calling munmap with insane values (non-canonical address, negative
size, etc) is an error, the kernel won't crash. We must also try to not
crash as the failure mode is very confusing (paging fault inside of the
runtime on some derived shadow address).

Such invalid arguments are observed on Chromium tests:
https://bugs.chromium.org/p/chromium/issues/detail?id=1275581

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D114944
2021-12-02 17:50:51 +01:00
Dmitry Vyukov 97b4e63117 tsan: fix false positives in dynamic libs with static tls
The added test demonstrates  loading a dynamic library with static TLS.
Such static TLS is a hack that allows a dynamic library to have faster TLS,
but it can be loaded only iff all threads happened to allocate some excess
of static TLS space for whatever reason. If it's not the case loading fails with:

dlopen: cannot load any more object with static TLS

We used to produce a false positive because dlopen will write into TLS
of all existing threads to initialize/zero TLS region for the loaded library.
And this appears to be racing with initialization of TLS in the thread
since we model a write into the whole static TLS region (we don't what part
of it is currently unused):

WARNING: ThreadSanitizer: data race (pid=2317365)
  Write of size 1 at 0x7f1fa9bfcdd7 by main thread:
    0 memset
    1 init_one_static_tls
    2 __pthread_init_static_tls
    [[ this is where main calls dlopen ]]
    3 main
  Previous write of size 8 at 0x7f1fa9bfcdd0 by thread T1:
    0 __tsan_tls_initialization

Fix this by ignoring accesses during dlopen.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D114953
2021-12-02 17:47:05 +01:00
Dmitry Vyukov 09859113ed Revert "tsan: new runtime (v3)"
This reverts commit 66d4ce7e26.

Chromium tests started failing:
https://bugs.chromium.org/p/chromium/issues/detail?id=1275581
2021-12-01 18:00:46 +01:00
Julian Lettner 858eb8fc11 [TSan][Darwin] Avoid crashes due to interpreting non-zero shadow content as a pointer
We would like to use TLS to store the ThreadState object (or at least a
reference ot it), but on Darwin accessing TLS via __thread or manually
by using pthread_key_* is problematic, because there are several places
where interceptors are called when TLS is not accessible (early process
startup, thread cleanup, ...).

Previously, we used a "poor man's TLS" implementation, where we use the
shadow memory of the pointer returned by pthread_self() to store a
pointer to the ThreadState object.

The problem with that was that certain operations can populate shadow
bytes unbeknownst to TSan, and we later interpret these non-zero bytes
as the pointer to our ThreadState object and crash on when dereferencing
the pointer.

This patch changes the storage location of our reference to the
ThreadState object to "real" TLS.  We make this work by artificially
keeping this reference alive in the pthread_key destructor by resetting
the key value with pthread_setspecific().

This change also fixes the issue were the ThreadState object is
re-allocated after DestroyThreadState() because intercepted functions
can still get called on the terminating thread after the
THREAD_TERMINATE event.

Radar-Id: rdar://problem/72010355

Reviewed By: dvyukov

Differential Revision: https://reviews.llvm.org/D110236
2021-11-30 14:49:23 -08:00
Dmitry Vyukov a1dc97e472 tsan: remember and print function that installed at_exit callbacks
Sometimes stacks for at_exit callbacks don't include any of the user functions/files.
For example, a race with a global std container destructor will only contain
the container type name and our at_exit_wrapper function. No signs what global variable
this is.
Remember and include in reports the function that installed the at_exit callback.
This should give glues as to what variable is being destroyed.

Depends on D114606.

Reviewed By: vitalybuka, melver

Differential Revision: https://reviews.llvm.org/D114607
2021-11-26 08:00:55 +01:00
Dmitry Vyukov 66d4ce7e26 tsan: new runtime (v3)
This change switches tsan to the new runtime which features:
 - 2x smaller shadow memory (2x of app memory)
 - faster fully vectorized race detection
 - small fixed-size vector clocks (512b)
 - fast vectorized vector clock operations
 - unlimited number of alive threads/goroutimes

Depends on D112602.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112603
2021-11-25 18:32:04 +01:00
Dmitry Vyukov 976bb4724c tsan: fix another potential deadlock in fork
Linux/fork_deadlock.cpp currently hangs in debug mode in the following stack.
Disable memory access handling in OnUserAlloc/Free around fork.

1  0x000000000042c54b in __sanitizer::internal_sched_yield () at sanitizer_linux.cpp:452
2  0x000000000042da15 in __sanitizer::StaticSpinMutex::LockSlow (this=0x57ef02 <__sanitizer::internal_allocator_cache_mu>) at sanitizer_mutex.cpp:24
3  0x0000000000423927 in __sanitizer::StaticSpinMutex::Lock (this=0x57ef02 <__sanitizer::internal_allocator_cache_mu>) at sanitizer_mutex.h:32
4  0x000000000042354c in __sanitizer::GenericScopedLock<__sanitizer::StaticSpinMutex>::GenericScopedLock (this=this@entry=0x7ffcabfca0b8, mu=0x1) at sanitizer_mutex.h:367
5  0x0000000000423653 in __sanitizer::RawInternalAlloc (size=size@entry=72, cache=cache@entry=0x0, alignment=8, alignment@entry=0) at sanitizer_allocator.cpp:52
6  0x00000000004235e9 in __sanitizer::InternalAlloc (size=size@entry=72, cache=0x1, cache@entry=0x0, alignment=4, alignment@entry=0) at sanitizer_allocator.cpp:86
7  0x000000000043aa15 in __sanitizer::SymbolizedStack::New (addr=4802655) at sanitizer_symbolizer.cpp:45
8  0x000000000043b353 in __sanitizer::Symbolizer::SymbolizePC (this=0x7f578b77a028, addr=4802655) at sanitizer_symbolizer_libcdep.cpp:90
9  0x0000000000439dbe in __sanitizer::(anonymous namespace)::StackTraceTextPrinter::ProcessAddressFrames (this=this@entry=0x7ffcabfca208, pc=4802655) at sanitizer_stacktrace_libcdep.cpp:36
10 0x0000000000439c89 in __sanitizer::StackTrace::PrintTo (this=this@entry=0x7ffcabfca2a0, output=output@entry=0x7ffcabfca260) at sanitizer_stacktrace_libcdep.cpp:109
11 0x0000000000439fe0 in __sanitizer::StackTrace::Print (this=0x18) at sanitizer_stacktrace_libcdep.cpp:132
12 0x0000000000495359 in __sanitizer::PrintMutexPC (pc=4802656) at tsan_rtl.cpp:774
13 0x000000000042e0e4 in __sanitizer::InternalDeadlockDetector::Lock (this=0x7f578b1ca740, type=type@entry=2, pc=pc@entry=4371612) at sanitizer_mutex.cpp:177
14 0x000000000042df65 in __sanitizer::CheckedMutex::LockImpl (this=<optimized out>, pc=4) at sanitizer_mutex.cpp:218
15 0x000000000042bc95 in __sanitizer::CheckedMutex::Lock (this=0x600001000000) at sanitizer_mutex.h:127
16 __sanitizer::Mutex::Lock (this=0x600001000000) at sanitizer_mutex.h:165
17 0x000000000042b49c in __sanitizer::GenericScopedLock<__sanitizer::Mutex>::GenericScopedLock (this=this@entry=0x7ffcabfca370, mu=0x1) at sanitizer_mutex.h:367
18 0x000000000049504f in __tsan::TraceSwitch (thr=0x7f578b1ca980) at tsan_rtl.cpp:656
19 0x000000000049523e in __tsan_trace_switch () at tsan_rtl.cpp:683
20 0x0000000000499862 in __tsan::TraceAddEvent (thr=0x7f578b1ca980, fs=..., typ=__tsan::EventTypeMop, addr=4499472) at tsan_rtl.h:624
21 __tsan::MemoryAccessRange (thr=0x7f578b1ca980, pc=4499472, addr=135257110102784, size=size@entry=16, is_write=true) at tsan_rtl_access.cpp:563
22 0x000000000049853a in __tsan::MemoryRangeFreed (thr=thr@entry=0x7f578b1ca980, pc=pc@entry=4499472, addr=addr@entry=135257110102784, size=16) at tsan_rtl_access.cpp:487
23 0x000000000048f6bf in __tsan::OnUserFree (thr=thr@entry=0x7f578b1ca980, pc=pc@entry=4499472, p=p@entry=135257110102784, write=true) at tsan_mman.cpp:260
24 0x000000000048f61f in __tsan::user_free (thr=thr@entry=0x7f578b1ca980, pc=4499472, p=p@entry=0x7b0400004300, signal=true) at tsan_mman.cpp:213
25 0x000000000044a820 in __interceptor_free (p=0x7b0400004300) at tsan_interceptors_posix.cpp:708
26 0x00000000004ad599 in alloc_free_blocks () at fork_deadlock.cpp:25
27 __tsan_test_only_on_fork () at fork_deadlock.cpp:32
28 0x0000000000494870 in __tsan::ForkBefore (thr=0x7f578b1ca980, pc=pc@entry=4904437) at tsan_rtl.cpp:510
29 0x000000000046fcb4 in syscall_pre_fork (pc=1) at tsan_interceptors_posix.cpp:2577
30 0x000000000046fc9b in __sanitizer_syscall_pre_impl_fork () at sanitizer_common_syscalls.inc:3094
31 0x00000000004ad5f5 in myfork () at syscall.h:9
32 main () at fork_deadlock.cpp:46

Depends on D114595.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D114597
2021-11-25 17:08:00 +01:00
Dmitry Vyukov b584741d06 tsan: fix Java heap block begin in reports
We currently use a wrong value for heap block
(only works for C++, but not for Java).
Use the correct value (we already computed it before, just forgot to use).

Depends on D114593.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D114595
2021-11-25 17:07:53 +01:00
Dmitry Vyukov 6f85d68e6a tsan: include internal allocator into deadlock detection
Now that we lock the internal allocator around fork,
it's possible it will create additional deadlocks.
Add a fake mutex that substitutes the internal allocator
for the purposes of deadlock detection.

Depends on D114531.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D114532
2021-11-24 17:01:57 +01:00
Dmitry Vyukov 348389263c tsan: lock internal allocator around fork
There is a small chance that the internal allocator is locked
during fork and then the new process is created with locked
internal allocator and any attempts to use it will deadlock.
For example, if detected a suppressed race in the parent during fork
and then another suppressed race after the fork.
This becomes much more likely with the new tsan runtime
as it uses the internal allocator for more things.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D114531
2021-11-24 17:01:28 +01:00
Weverything 1150f02c77 Revert "tsan: new runtime (v3)"
This reverts commit ebd47b0fb7.
This was causing unexpected behavior in programs.
2021-11-23 18:32:32 -08:00
Dmitry Vyukov ebd47b0fb7 tsan: new runtime (v3)
This change switches tsan to the new runtime which features:
 - 2x smaller shadow memory (2x of app memory)
 - faster fully vectorized race detection
 - small fixed-size vector clocks (512b)
 - fast vectorized vector clock operations
 - unlimited number of alive threads/goroutimes

Differential Revision: https://reviews.llvm.org/D112603
2021-11-23 11:44:59 +01:00
Dmitry Vyukov 5f18ae3988 Revert "tsan: new runtime (v3)"
Summary:
This reverts commit 1784fe0532.

Broke some bots:
https://lab.llvm.org/buildbot#builders/57/builds/12365
http://green.lab.llvm.org/green/job/clang-stage1-RA/25658/

Reviewers: vitalybuka, melver

Subscribers:
2021-11-22 19:08:48 +01:00
Dmitry Vyukov 1784fe0532 tsan: new runtime (v3)
This change switches tsan to the new runtime which features:
 - 2x smaller shadow memory (2x of app memory)
 - faster fully vectorized race detection
 - small fixed-size vector clocks (512b)
 - fast vectorized vector clock operations
 - unlimited number of alive threads/goroutimes

Depends on D112602.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112603
2021-11-22 15:55:39 +01:00
Dmitry Vyukov 6a3958247a tsan: add another fork test
Add a fork test that models what happens on Mac
where fork calls malloc/free inside of our atfork
callbacks.

Reviewed By: vitalybuka, yln

Differential Revision: https://reviews.llvm.org/D114250
2021-11-22 08:36:51 +01:00
Vitaly Buka 6bf71be9f9 [NFC][sanitizer] Move inline implementation of StackStore into cpp 2021-11-18 18:38:06 -08:00
Dmitry Vyukov 111d8f785b tsan: remove quadratic behavior in pthread_join
pthread_join needs to map pthread_t of the joined thread to our Tid.
Currently we do this with linear search over all threads.
This has quadratic complexity and becomes much worse with the new
tsan runtime, which memorizes all threads that ever existed.

To resolve this add a hash map of live threads only (that are still
associated with pthread_t) and use it for the mapping.

With the new tsan runtime some programs spent 1/3 of time in this mapping.
After this change the mapping disappears from profiles.

Depends on D113996.

Reviewed By: vitalybuka, melver

Differential Revision: https://reviews.llvm.org/D113997
2021-11-17 19:41:49 -08:00
Dmitry Vyukov c7081b5b4c tsan: fix crash during thread exit
Use of gethostent provokes caching of some resources inside of libc.
They are freed in __libc_thread_freeres very late in thread lifetime,
after our ThreadFinish. __libc_thread_freeres calls free which
previously crashed in malloc hooks.
Fix it by setting ignore_interceptors for finished threads,
which in turn prevents malloc hooks.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D113989
2021-11-16 16:43:09 +01:00
Dmitry Vyukov c971f989ee tsan: de-hardcode number of unused bits in trace events
Precisely specifying the unused parts of the bitfield is critical for
performance. If we don't specify them, compiler will generate code to load
the old value and shuffle it to extract the unused bits to apply to the new
value. If we specify the unused part and store 0 in there, all that
unnecessary code goes away (store of the 0 const is combined with other
constant parts).

I don't see a good way to ensure we cover all of u64 bits with fields.
So at least introduce named kUnusedBits consts and check that bits
sum up to 64.

Depends on D113978.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D113979
2021-11-16 16:00:14 +01:00
Dmitry Vyukov fa24d58279 tsan: use smaller trace parts for Go
In the old runtime we used to use different number of trace parts
for C++ and Go to reduce trace memory consumption for Go.
But now it's easier and better to use smaller parts because
we already use minimal possible number of parts for C++ (3).

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D113978
2021-11-16 15:59:33 +01:00
Dmitry Vyukov 87261caa55 tsan: use pthread_equal instead of direct pthread_t comparison
man pthread_equal:
  The pthread_equal() function is necessary because thread IDs
  should be considered opaque: there is no portable way for
  applications to directly compare two pthread_t values.

Depends on D113916.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D113919
2021-11-16 07:51:24 +01:00
Dmitry Vyukov 64b45399e5 tsan: speed up pthread_setname_np
pthread_setname_np does linear search over all thread descriptors
to map pthread_t to the thread descriptor. This has O(N^2) complexity
and becomes much worse in the new tsan runtime that keeps all ever
existed threads in the thread registry.
Replace linear search with direct access if pthread_setname_np
is called for the current thread (a very common case).

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D113916
2021-11-16 07:51:08 +01:00
ZijunZhao d2b43605c9 add tsan shared lib
Change-Id: Ic83ff1ec86d6a7d61b07fa3df7e0cb2790b5ebc7
2021-11-16 00:42:30 +00:00
Matt Kulukundis 2d9bdd9dba Fix a deadlock in __cxa_guard_abort in tsan
hat tip: @The_Whole_Daisy for helping to isolate

Reviewed By: dvyukov, fowles

Differential Revision: https://reviews.llvm.org/D113713
2021-11-15 10:39:08 +01:00
Dmitry Vyukov b5ff187b7b tsan: mmap shadow stack
We used to mmap C++ shadow stack as part of the trace region
before ed7f3f5bc9 ("tsan: move shadow stack into ThreadState"),
which moved the shadow stack into TLS. This started causing
timeouts and OOMs on some of our internal tests that repeatedly
create and destroy thousands of threads.
Allocate C++ shadow stack with mmap and small pages again.
This prevents the observed timeouts and OOMs.
But we now need to be more careful with interceptors that
run after thread finalization because FuncEntry/Exit and
TraceAddEvent all need the shadow stack.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D113786
2021-11-13 09:12:55 +01:00
Dmitry Vyukov 79fbba9b79 Revert "tsan: new runtime (v3)"
Summary:
This reverts commit ac95b8d954.
There is a number of bot failures:
http://45.33.8.238/mac/38755/step_4.txt
https://green.lab.llvm.org/green/view/LLDB/job/lldb-cmake/38135/consoleFull#-148886289949ba4694-19c4-4d7e-bec5-911270d8a58c

Reviewers: vitalybuka, melver

Subscribers:
2021-11-12 17:49:47 +01:00
Dmitry Vyukov ac95b8d954 tsan: new runtime (v3)
This change switches tsan to the new runtime which features:
 - 2x smaller shadow memory (2x of app memory)
 - faster fully vectorized race detection
 - small fixed-size vector clocks (512b)
 - fast vectorized vector clock operations
 - unlimited number of alive threads/goroutimes

Depends on D112602.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112603
2021-11-12 14:31:49 +01:00
Dmitry Vyukov e91595bf94 tsan: don't start background thread after clone
Start the background thread only after fork, but not after clone.
For fork we did this always and it's known to work (or user code has adopted).
But if we do this for the new clone interceptor some code (sandbox2) fails.
So model we used to do for years and don't start the background thread after clone.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D113744
2021-11-12 12:58:49 +01:00
Dmitry Vyukov a6728382c6 tsan: fix XMM register corruption in hacky call
The compiler does not recognize HACKY_CALL as a call
(we intentionally hide it from the compiler so that it can
compile non-leaf functions as leaf functions).
To compensate for that hacky call thunk saves and restores
all caller-saved registers. However, it saves only
general-purposes registers and does not save XMM registers.
This is a latent bug that was masked up until a recent "NFC" commit
d736002e90 ("tsan: move memory access functions to a separate file"),
which allowed more inlining and exposed the 10-year bug.
Save and restore caller-saved XMM registers (all) as well.

Currently the bug manifests as e.g. frexp interceptor messes the
return value and the added test fails with:
  i=8177 y=0.000000 exp=4

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D113742
2021-11-12 12:53:47 +01:00
Dmitry Vyukov bc84b2857f tsan: enable clone interceptor only on Linux
Clone does not exist on Mac.
There are chances it will break on other OSes.
Enable it incrementally starting with Linux only,
other OSes can enable it later as needed.

Reviewed By: melver, thakis

Differential Revision: https://reviews.llvm.org/D113693
2021-11-11 19:27:47 +01:00
Dmitry Vyukov 82de586d4b tsan: intercept clone
gtest uses clone for death tests and it needs the same
handling as fork to prevent deadlock (take runtime mutexes
before and release them after).

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D113677
2021-11-11 18:55:54 +01:00
zijunzhao 45d28e3a30 Revert "add tsan shared lib"
This reverts commit 92c9b340be.
2021-11-09 16:36:06 +00:00
ZijunZhao 92c9b340be add tsan shared lib
Change-Id: Ic83ff1ec86d6a7d61b07fa3df7e0cb2790b5ebc7
2021-11-09 02:34:37 +00:00
Dmitry Vyukov d31b2dc235 tsan: add debugging code for ptrace test failures
Debugging of crashes on powerpc after commit:
c80604f7a3 ("tsan: remove real func check from interceptors")
Somehow replacing if with DCHECK leads to strange failures in:
SanitizerCommon-tsan-powerpc64le-Linux :: Linux/ptrace.cpp
https://lab.llvm.org/buildbot/#/builders/105
https://lab.llvm.org/buildbot/#/builders/121
https://lab.llvm.org/buildbot/#/builders/57

The hypothesis is that something writes out-of-bounds
into pt_regs on stack and that corrupts internal tsan state.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112703
2021-10-29 17:37:02 +02:00
Dmitry Vyukov ae833dbb81 sanitizer_common: remove unnecessary GetMemoryProfile arg
stats_size argument is unnecessary in GetMemoryProfile and in the callback.
It just clutters code. The callback knowns how many stats to expect.

Depends on D112789.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112790
2021-10-29 13:44:34 +02:00
David CARLIER bb168f3207 [compiler-rt] update detect_write_exec option for apple devices.
Reviewed By: yln, vitalybuka

Differential Revision: https://reviews.llvm.org/D111390
2021-10-28 17:08:23 +01:00
Dmitry Vyukov d736002e90 tsan: move memory access functions to a separate file
tsan_rtl.cpp is huge and does lots of things.
Move everything related to memory access and tracing
to a separate tsan_rtl_access.cpp file.
No functional changes, only code movement.

Reviewed By: vitalybuka, melver

Differential Revision: https://reviews.llvm.org/D112625
2021-10-28 13:31:10 +02:00
Dmitry Vyukov f50cee2f4b tsan: switch sync test from EXPECT to CHECK
Gtest's EXPECT calls whole lot of libc functions
(mem*, malloc) even when EXPECT does not fail.
This does not play well with tsan runtime unit tests
b/c e.g. we call some EXPECTs with runtime mutexes locked.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112601
2021-10-27 15:11:31 +02:00
Dmitry Vyukov abdefea6a2 tsan: tidy up SCOPED_INTERCEPTOR_RAW
Don't leak caller_pc var from the macro
(it's not supposed to be used by interceptors).
Use UNUSED instead of (void) cast.

Depends on D112540.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112541
2021-10-27 08:47:46 +02:00
Dmitry Vyukov c80604f7a3 tsan: remove real func check from interceptors
If the real function is not intercepted,
we are going to crash one way or another.
The question is just in the failure mode:
error message vs NULL deref. But the message
costs us a check in every interceptor and
they are not observed to be failing in real life
for a long time, also other sanitizers don't
have this check as well (also crash on
NULL deref if that happens).
Remove the check from non-debug mode.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112540
2021-10-27 08:47:27 +02:00
Dmitry Vyukov 65e795c9ca Revert "tsan: turn off COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED"
This reverts commit 5ec832269e.

It broke a number of bots, e.g.:
https://lab.llvm.org/buildbot/#/builders/52/builds/11811

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112563
2021-10-26 19:53:07 +02:00
Dmitry Vyukov 5ec832269e tsan: turn off COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED
All tsan interceptors check for initialization and/or initialize things
as necessary lazily, so we can pretend everything is initialized in the
COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED check to avoid double-checking
for initialization (this is only necessary for sanitizers that don't
handle initialization on common grounds).

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112446
2021-10-26 16:13:03 +02:00
Dmitry Vyukov 1b348902ea tsan: add DynamicMutexSet helper
MutexSet is too large to be allocated on stack.
But we need local MutexSet objects in few places
and use various hacks to allocate them.
Add DynamicMutexSet helper that simplifies allocation
of such objects.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112449
2021-10-25 19:45:06 +02:00
Dmitry Vyukov 75a08b1ba4 tsan: don't use symbol binding 10
Building Go programs with the current runtime fails with:

loadelf: race_linux_amd64: malformed elf file:
_ZZN6__tsan15RestoreAddrImpl5ApplyINS_11MappingGo48EEEmmE6ranges: invalid symbol binding 10

Go linker does not understand ELF in all its generality.
Don't use static const data in inline methods.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D112434
2021-10-25 14:05:15 +02:00
Dmitry Vyukov 27969c4e00 tsan: refactor trace tests
Instead of creating real threads for trace tests
create a new ThreadState in the main thread.
This makes the tests more unit-testy and will also
help with future trace tests that will need
more than 1 thread. Creating more than 1 real thread and
dispatching test actions across multiple threads in the
required deterministic order is painful.

This is resubmit of reverted D110546 with 2 changes:
1. The previous version patched ImitateTlsWrite to not
expect ThreadState to be allocated in TLS (the CHECK
failed for the fake test threads).
This added an ugly hack into production code and was still
logically wrong because we imitated write to the main
thread TLS/stack when we started the fake test thread
(which has nothing to do with the main thread TLS/stack).
This version uses ThreadType::Fiber instead of ThreadType::Regular
for the fake threads. This naturally makes ThreadStart skip
obtaining stack/tls and imitating writes to them.

2. This version still skips the tests on Darwin and PowerPC
to be on the safer side. Build bots reported failures for PowerPC
for the previous version.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D111156
2021-10-17 12:38:56 +02:00
Vitaly Buka 05d46f627c [NFC][sanitizer] Remove sanitizer_persistent_allocator.cpp
We need to make it a template
2021-10-08 13:43:28 -07:00
H.J. Lu c960c8c339 Reland [sanitizer] Support Intel CET
1. Include <cet.h> in sanitizer_common/sanitizer_asm.h, if it exists, to
mark Intel CET support when Intel CET is enabled.
2. Define _CET_ENDBR as empty if it isn't defined.
3. Add _CET_ENDBR to function entries in assembly codes so that ENDBR
instruction will be generated when Intel CET is enabled.

Reviewed By: MaskRay

Differential Revision: https://reviews.llvm.org/D111185
2021-10-08 10:22:39 -07:00
Arthur Eubanks d4c1f222f2 Revert "[sanitizer] Support Intel CET"
This reverts commit fdf4c03522.

Breaks macOS bots, e.g. https://crbug.com/1257863.
Still figuring out if this is actually supported on macOS. Other places
that include <cet.h> only do so on Linux.
2021-10-07 21:03:12 -07:00
H.J. Lu fdf4c03522 [sanitizer] Support Intel CET
1. Include <cet.h> in sanitizer_common/sanitizer_asm.h to mark Intel CET
support when Intel CET is enabled.
2. Add _CET_ENDBR to function entries in assembly codes so that ENDBR
instruction will be generated when Intel CET is enabled.

Reviewed By: dvyukov

Differential Revision: https://reviews.llvm.org/D111185
2021-10-06 10:12:50 -07:00
Dmitry Vyukov c483140f3c tsan: improve detection of stack/tls races
Print meaningful stack frames for stack/tls races
(instead of PC 1/2 that don't symbolize).

Imitate stack/tls writes after we create and initialize
the new thread, otherwise the races are not detected.

This is re-submit of the following reverted commits,
but without tests as they failed on a number of OSes/arches:
"tsan: fix and test detection of TLS races"
"tsan: fix tls_race3 test on darwin"
"tsan: print a meaningful frame for stack races"

Differential Revision: https://reviews.llvm.org/D111147
2021-10-05 15:32:39 +02:00
Dmitry Vyukov a0ed71ff29 tsan: make cur_thread_init return cur_thread
Whenever we call cur_thread_init, we call cur_thread on the next line.
So make cur_thread_init return the current thread directly.
Makes code a bit shorter, does not affect codegen.

Reviewed By: vitalybuka, melver

Differential Revision: https://reviews.llvm.org/D110384
2021-10-05 15:24:52 +02:00
Amy Kwan 103c1bd118 Revert "tsan: fix and test detection of TLS races"
This reverts commit b4c1e5cb73.

Reverting this as it contains a test that is currently failing on the PPC BE bots.
2021-10-01 16:42:31 -05:00
Amy Kwan 8b1984bb8c Revert "tsan: fix tls_race3 test on darwin"
This reverts commit ade5023c54.

Reverting this commit as it is dependent on a test breaking the PPC BE bots.
2021-10-01 16:42:31 -05:00
Amy Kwan 2df1019576 Revert "tsan: print a meaningful frame for stack races"
This reverts commit ccc83ac7c5.

Reverting this commit as it is dependent on additional commits breaking the
PPC BE bots.
2021-10-01 16:42:30 -05:00
ZijunZhao 0e8862901c revert tsan part for investigation 2021-10-01 18:52:36 +00:00
ZijunZhao 91bfccf837 add tsan shared library 2021-10-01 00:19:35 +00:00
Vitaly Buka 7c1128f3bb [NFC][sanitizer] Return StackDepotStats by value
Differential Revision: https://reviews.llvm.org/D110644
2021-09-28 15:42:21 -07:00
Vitaly Buka bfa50250b6 [NFC][sanitizer] Clang-format some code 2021-09-28 11:10:15 -07:00
Dmitry Vyukov ccc83ac7c5 tsan: print a meaningful frame for stack races
Depends on D110631.

Differential Revision: https://reviews.llvm.org/D110632
2021-09-28 17:08:00 +02:00
Dmitry Vyukov ade5023c54 tsan: fix tls_race3 test on darwin
Darwin also needs to use __tsan_tls_initialization
to pass the test.

Differential Revision: https://reviews.llvm.org/D110631
2021-09-28 17:07:51 +02:00
Dmitry Vyukov f3932ae1a0 tsan: fix cur_thread alignment
Commit 354ded67b3 ("tsan: align ThreadState to cache line")
did an incomplete thing. It marked ThreadState as cache line
aligned, but the thread local ThreadState instance is declared
as an aligned char array with hard-coded 64-byte alignment.
On PowerPC cache line size is 128 bytes, so the hard-coded
64-byte alignment is not enough.
Use cache line alignment consistently.

Differential Revision: https://reviews.llvm.org/D110629
2021-09-28 16:49:44 +02:00
Ahsan Saghir 4f6a6ba126 Revert "tsan: fix trace tests on darwin"
This reverts commit 94ea36649e.

Reverting due to errors on buildbots.
2021-09-27 20:17:17 -05:00
Kevin Athey b345952ad4 Revert "tsan: add a test for stack init race"
This reverts commit b72176b9bc.

Broke bot: https://lab.llvm.org/buildbot/#/builders/70/builds/12193
2021-09-27 15:31:23 -07:00
Dmitry Vyukov 94ea36649e tsan: fix trace tests on darwin
The trace tests crashed on darwin because of some thread
initialization issues (thread initialization is somewhat
different on darwin).
Instead of starting real threads, create a new ThreadState
in the main thread. This makes the tests more unit-testy
and hopefully won't crash on darwin (there is almost no
platform-specific code involved now).
This will also help with future trace tests that will need
more than 1 thread. Creating more than 1 real thread and
dispatching test actions across multiple threads in the
required deterministic order is painful.

Depends on D110539.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110546
2021-09-27 16:40:57 +02:00
Dmitry Vyukov b72176b9bc tsan: add a test for stack init race
Depends on D110538.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110539
2021-09-27 16:40:17 +02:00
Dmitry Vyukov b4c1e5cb73 tsan: fix and test detection of TLS races
Currently detection of races with TLS/stack initialization
is broken because we imitate the write before thread initialization,
so it's modelled with a wrong thread/epoch.
Fix that and add a test.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110538
2021-09-27 16:40:08 +02:00
Dmitry Vyukov 1455b552b7 tsan: de-hardcode MemCount const
Use MemCount instead of hard-coded value 7.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110532
2021-09-27 16:11:49 +02:00
Dmitry Vyukov 354ded67b3 tsan: align ThreadState to cache line
There are 2 reasons to do this:
1. We place hot data in the first cache line of ThreadState,
this assumed that it's cache-line-aligned but we never actually
enforced it (or it was lost at some point).
2. The new vector clock uses vector instructions and requires
data alignment. Later the new vector clock will be embedded in
ThreadState, then ensuring vector clock alignment will be
impossible w/o ThreadState alignment.

Depends on D110519.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110520
2021-09-27 12:54:09 +02:00
Dmitry Vyukov ed7f3f5bc9 tsan: move shadow stack into ThreadState
Currently the shadow stack is located in the trace memory mapping.
The new tsan runtime will remove the trace memory mapping.
Move the shadow stack into ThreadState as a preparation step.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110519
2021-09-27 12:53:02 +02:00
Dmitry Vyukov b02938439d tsan: uninline RacyStacks::operator==
It's only used during race reporting.
There is no point in polluting the main header file with it.

Reviewed By: xgupta

Differential Revision: https://reviews.llvm.org/D110470
2021-09-25 12:08:51 +02:00
Frederic Cambus 626e2a6c62 [compiler-rt] Use portable "#!/usr/bin/env bash" shebang for tests.
In build_symbolizer.sh we can safely remove the -eu argument from the shebang (which is an unportable construct), as the scripts sets **-e** and **-u** already.

Differential Revision: https://reviews.llvm.org/D110039
2021-09-24 19:10:07 +05:30
Dmitry Vyukov 7faf1285f2 tsan: remove expected race leftover
Remove nmissed_expected variable.
It's a leftover from removed "expected race" feature and is never incremented.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110321
2021-09-23 14:13:26 +02:00
Dmitry Vyukov 702cb7afe9 tsan: move shadow declaration into a separate header file (NFC)
tsan_rtl.h is very huge and contains too many things.
Move FastState and Shadow types into a new tsan_shadow.h file.
This also allows to use FastState/Shadow in other header files
without creating circular dependencies (which most likely will
happen today).

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110272
2021-09-23 11:04:43 +02:00
Dmitry Vyukov 20d3e51801 tsan: use RawShadow instead of u64 more
Fix few remaining cases where we use u64 instead of the new RawShadow type.

Depends on D110265.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110266
2021-09-23 10:46:07 +02:00
Dmitry Vyukov 356ecd9bd1 tsan: remove DontDumpShadow from Go build
DontDumpShadow is used only in InitializeShadowMemory which is Go-only.

Depends on D110263.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110264
2021-09-23 10:45:05 +02:00
Dmitry Vyukov af8b14c278 tsan: remove unnecessary enum values (NFC)
Remove unnecessary enum values in the memory profiler.
There is no point in spelling them, it can only lead to bugs
and larger diffs when values are added/removed.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110263
2021-09-23 10:43:58 +02:00
Dmitry Vyukov 0ee77d6db3 tsan: write uptime in mem profile
Write uptime in real time seconds for every mem profile record.
Uptime is useful to make more sense out of the profile,
compare random lines, etc.

Depends on D110153.

Reviewed By: melver, vitalybuka

Differential Revision: https://reviews.llvm.org/D110154
2021-09-22 10:19:58 +02:00
Dmitry Vyukov ae6d57ca5a tsan: remove stale comment
We do query it every 100ms now.
(GetRSS was fixed to not be dead slow IIRC)

Depends on D110152.

Reviewed By: melver, vitalybuka

Differential Revision: https://reviews.llvm.org/D110153
2021-09-22 10:18:58 +02:00
Dmitry Vyukov e8101f2149 tsan: move mem profile initialization into separate function
BackgroundThread function is quite large,
move mem profile initialization into a separate function.

Depends on D110151.

Reviewed By: melver, vitalybuka

Differential Revision: https://reviews.llvm.org/D110152
2021-09-22 10:18:08 +02:00
Dmitry Vyukov b8aa9b0c37 tsan: include internal allocator info in mem profile
We allocate things from the internal allocator,
it's useful to know how much it consumes.

Depends on D110150.

Reviewed By: melver, vitalybuka

Differential Revision: https://reviews.llvm.org/D110151
2021-09-22 10:17:01 +02:00
Dmitry Vyukov 58a157cd3b tsan: make mem profile data more consistent
We currently query number of threads before reading /proc/self/smaps.
But reading /proc/self/smaps can take lots of time for huge processes
and it's retries several times with different buffer sizes.
Overall it can take tens of seconds. This can make number of threads
significantly inconsistent with the rest of the stats.
So query it after reading /proc/self/smaps.

Depends on D110149.

Reviewed By: melver, vitalybuka

Differential Revision: https://reviews.llvm.org/D110150
2021-09-22 10:16:15 +02:00
Dmitry Vyukov eefef56ece tsan: include MBlock/SyncObj stats into mem profile
Include info about MBlock/SyncObj memory consumption in the memory profile.

Depends on D110148.

Reviewed By: melver, vitalybuka

Differential Revision: https://reviews.llvm.org/D110149
2021-09-22 10:14:33 +02:00
Dmitry Vyukov 608ffc98c3 tsan: account for mid app range in mem profile
We account low and high ranges, but forgot abount the mid range.
Account mid range as well.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110148
2021-09-22 10:13:31 +02:00
Dmitry Vyukov 82e593cf90 tsan: uninline Enable/DisableIgnores
ScopedInterceptor::Enable/DisableIgnores is only used for some special cases.
Unline them from the common interceptor handling.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D110157
2021-09-22 07:25:14 +02:00
Dmitry Vyukov db2f870fe3 tsan: reset destination range in Java heap move
Switch Java heap move to the new scheme required for the new tsan runtime.
Instead of copying the shadow we reset the destination range.
The new v3 trace contains addresses of accesses, so we cannot simply copy the shadow.
This can lead to false negatives, but cannot lead to false positives.

Depends on D110159.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D110190
2021-09-22 07:23:21 +02:00
Dmitry Vyukov 41f8ef3e31 tsan: enable sse4.2 in tests
Pass -msse4.2 flag to the tests the same way we do for the runtime.
Layout of some structs in the runtime headers depends on the flag
(TSAN_VECTORIZE), so we need it to be consistent across the runtime
and tests.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D110192
2021-09-22 07:13:47 +02:00
Dmitry Vyukov cf93f7677d tsan: move errno spoiling reporting into a separate function (NFC)
CallUserSignalHandler function is quite large and complex.
Move errno spoiling reporting into a separate function.
No logical changes.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D110159
2021-09-22 07:12:53 +02:00
Dmitry Vyukov 20ee72d4cc tsan: don't call dlsym during exit
dlsym calls into dynamic linker which calls malloc and other things.
It's problematic to do it during the actual exit, because
it can happen from a singal handler or from within the runtime
after we reported the first bug, etc.
See https://github.com/google/sanitizers/issues/1440 for an example
(captured in the added test).
Initialize the callbacks during startup instead.

Depends on D110159.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D110166
2021-09-22 07:11:59 +02:00
Dmitry Vyukov 9d7b7350c9 tsan: simplify thread context setting
Currently we set thr->tctx after OnStarted callback
taking thread registry mutex again and searching for the context.
But OnStarted already runs under the thread registry mutex
and has access to the context, so set it in the OnStarted.
This makes code simpler and faster.

Depends on D110132.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110133
2021-09-21 13:26:55 +02:00
Dmitry Vyukov 908256b0ea tsan: rearrange thread state callbacks (NFC)
Thread state functions are split into 2 parts:
tsan entry function (e.g. ThreadStart) and thread registry
state change callback (e.g. OnStart). Currently these
pairs of functions are located far from each other and
in reverse order. This makes it hard to read and follow the logic.
Reorder the code so that OnFoo directly follows ThreadFoo.
No other code changes.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110132
2021-09-21 13:26:36 +02:00
Dmitry Vyukov 6fe35ef419 tsan: fix debug format strings
Some of the DPrintf's currently produce -Wformat warnings if enabled.
Fix these format strings.

Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D110131
2021-09-21 13:23:10 +02:00
Kazuaki Ishizaki a1e7e401d2 [compiler-rt] NFC: Fix trivial typo
Reviewed By: xgupta

Differential Revision: https://reviews.llvm.org/D77457
2021-09-04 14:12:58 +05:30
Xu Mingjie f10d003b0c [tsan] Add environment variable TSAN_SYMBOLIZER_PATH as we do in other sanitizers
ASan, LSan, MSan and UBSan all allow to use environment variable `*SAN_SYMBOLIZER_PATH` to pass the symbolizer path, this patch add `TSAN_SYMBOLIZER_PATH` to TSan.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D108911
2021-08-31 10:18:52 +08:00
Dmitry Vyukov 37b78291c6 tsan: add a comment to CallUserSignalHandler
Reviewed By: melver

Differential Revision: https://reviews.llvm.org/D108907
2021-08-30 11:33:19 +02:00