Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[hwasan] Report unavalible fixed shadow range #98574

Conversation

vitalybuka
Copy link
Collaborator

@vitalybuka vitalybuka commented Jul 12, 2024

Before the patch fixed-shadow.c test died with an obscure SEGV,
because shadow was mapped over libc.so.

Note, FindDynamicShadowStart is expected to select in available region.

Created using spr 1.3.4
@llvmbot
Copy link
Collaborator

llvmbot commented Jul 12, 2024

@llvm/pr-subscribers-compiler-rt-sanitizer

Author: Vitaly Buka (vitalybuka)

Changes

Before the patch fixed-shadow.c died with obscure SEGV mapping shadow over libc.so.


Full diff: https://github.com/llvm/llvm-project/pull/98574.diff

2 Files Affected:

  • (modified) compiler-rt/lib/hwasan/hwasan_linux.cpp (+9)
  • (modified) compiler-rt/test/hwasan/TestCases/Linux/fixed-shadow.c (+12-9)
diff --git a/compiler-rt/lib/hwasan/hwasan_linux.cpp b/compiler-rt/lib/hwasan/hwasan_linux.cpp
index 0a23ffc9fa1ba..68294b5962569 100644
--- a/compiler-rt/lib/hwasan/hwasan_linux.cpp
+++ b/compiler-rt/lib/hwasan/hwasan_linux.cpp
@@ -109,6 +109,15 @@ static void InitializeShadowBaseAddress(uptr shadow_size_bytes) {
   // FIXME: Android should init flags before shadow.
   if (!SANITIZER_ANDROID && flags()->fixed_shadow_base != (uptr)-1) {
     __hwasan_shadow_memory_dynamic_address = flags()->fixed_shadow_base;
+    uptr beg = __hwasan_shadow_memory_dynamic_address;
+    uptr end = beg + shadow_size_bytes;
+    if (!MemoryRangeIsAvailable(beg, end)) {
+      Report(
+          "FATAL: HWAddressSanitizer: Shadow range %p-%p is not available.\n",
+          (void *)beg, (void *)end);
+      DumpProcessMap();
+      CHECK(MemoryRangeIsAvailable(beg, end));
+    }
   } else {
     __hwasan_shadow_memory_dynamic_address =
         FindDynamicShadowStart(shadow_size_bytes);
diff --git a/compiler-rt/test/hwasan/TestCases/Linux/fixed-shadow.c b/compiler-rt/test/hwasan/TestCases/Linux/fixed-shadow.c
index ab6ff52027926..e450c100959d1 100644
--- a/compiler-rt/test/hwasan/TestCases/Linux/fixed-shadow.c
+++ b/compiler-rt/test/hwasan/TestCases/Linux/fixed-shadow.c
@@ -1,15 +1,19 @@
 // Test fixed shadow base functionality.
 //
 // Default compiler instrumentation works with any shadow base (dynamic or fixed).
-// RUN: %clang_hwasan %s -o %t && %run %t
-// RUN: %clang_hwasan %s -o %t && HWASAN_OPTIONS=fixed_shadow_base=263878495698944 %run %t
-// RUN: %clang_hwasan %s -o %t && HWASAN_OPTIONS=fixed_shadow_base=4398046511104 %run %t
+// RUN: %clang_hwasan %s -o %t
+// RUN: %run %t
+// RUN: HWASAN_OPTIONS=fixed_shadow_base=263878495698944 %run %t 2>%t.out || (cat %t.out | FileCheck %s)
+// RUN: HWASAN_OPTIONS=fixed_shadow_base=4398046511104 %run %t 2>%t.out || (cat %t.out | FileCheck %s)
 //
 // If -hwasan-mapping-offset is set, then the fixed_shadow_base needs to match.
-// RUN: %clang_hwasan %s -mllvm -hwasan-mapping-offset=263878495698944 -o %t && HWASAN_OPTIONS=fixed_shadow_base=263878495698944 %run %t
-// RUN: %clang_hwasan %s -mllvm -hwasan-mapping-offset=4398046511104 -o %t && HWASAN_OPTIONS=fixed_shadow_base=4398046511104 %run %t
-// RUN: %clang_hwasan %s -mllvm -hwasan-mapping-offset=263878495698944 -o %t && HWASAN_OPTIONS=fixed_shadow_base=4398046511104 not %run %t
-// RUN: %clang_hwasan %s -mllvm -hwasan-mapping-offset=4398046511104 -o %t && HWASAN_OPTIONS=fixed_shadow_base=263878495698944 not %run %t
+// RUN: %clang_hwasan %s -mllvm -hwasan-mapping-offset=263878495698944 -o %t
+// RUN: HWASAN_OPTIONS=fixed_shadow_base=263878495698944 %run %t 2>%t.out || (cat %t.out | FileCheck %s)
+// RUN: HWASAN_OPTIONS=fixed_shadow_base=4398046511104 not %run %t
+
+// RUN: %clang_hwasan %s -mllvm -hwasan-mapping-offset=4398046511104 -o %t
+// RUN: HWASAN_OPTIONS=fixed_shadow_base=4398046511104 %run %t 2>%t.out || (cat %t.out | FileCheck %s)
+// RUN: HWASAN_OPTIONS=fixed_shadow_base=263878495698944 not %run %t
 //
 // Note: if fixed_shadow_base is not set, compiler-rt will dynamically choose a
 // shadow base, which has a tiny but non-zero probability of matching the
@@ -22,8 +26,7 @@
 //
 // UNSUPPORTED: android
 
-// FIXME: SEGV on Ubuntu 24.04. Looking.
-// UNSUPPORTED: linux
+// CHECK: FATAL: HWAddressSanitizer: Shadow range {{.*}} is not available
 
 #include <assert.h>
 #include <sanitizer/allocator_interface.h>

Copy link
Contributor

@thurstond thurstond left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix is good, please update the test.

Created using spr 1.3.4
@vitalybuka
Copy link
Collaborator Author

Waiting for https://lab.llvm.org/buildbot/#/buildrequests/374163 to validate the patch

@thurstond
Copy link
Contributor

Waiting for https://lab.llvm.org/buildbot/#/buildrequests/374163 to validate the patch

Thanks!

@vitalybuka
Copy link
Collaborator Author

Waiting for https://lab.llvm.org/buildbot/#/buildrequests/374163 to validate the patch

Thanks!

Somehow it does not schedule the build, so I am going to land it.

@vitalybuka vitalybuka merged commit 144dae2 into main Jul 12, 2024
4 of 5 checks passed
@vitalybuka vitalybuka deleted the users/vitalybuka/spr/hwasan-report-unavalible-fixed-shadow-range branch July 12, 2024 04:28
@llvm-ci
Copy link
Collaborator

llvm-ci commented Jul 12, 2024

LLVM Buildbot has detected a new failure on builder sanitizer-x86_64-linux-fast running on sanitizer-buildbot3 while building compiler-rt at step 2 "annotate".

Full details are available at: https://lab.llvm.org/buildbot/#/builders/169/builds/917

Here is the relevant piece of the build log for the reference:

Step 2 (annotate) failure: 'python ../sanitizer_buildbot/sanitizers/zorg/buildbot/builders/sanitizers/buildbot_selector.py' (failure)
...
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using ld64.lld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/ld64.lld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using wasm-ld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/wasm-ld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using ld.lld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/ld.lld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using lld-link: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/lld-link
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using ld64.lld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/ld64.lld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using wasm-ld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/wasm-ld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/main.py:72: note: The test suite configuration requested an individual test timeout of 0 seconds but a timeout of 900 seconds was requested on the command line. Forcing timeout to be 900 seconds.
-- Testing: 83925 of 83926 tests, 80 workers --
Testing:  0.. 10.. 20.. 30.. 40.. 50.. 60..
TIMEOUT: LLVM :: CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir (58658 of 83925)
******************** TEST 'LLVM :: CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir' FAILED ********************
Exit Code: -9
Timeout: Reached timeout of 900 seconds

Command Output (stderr):
--
RUN: at line 2: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/llc -mtriple=amdgcn -mcpu=gfx908 -run-pass=machine-scheduler -o - /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir | /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/FileCheck -check-prefix=GREEDY /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
+ /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/FileCheck -check-prefix=GREEDY /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
+ /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/llc -mtriple=amdgcn -mcpu=gfx908 -run-pass=machine-scheduler -o - /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
RUN: at line 3: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/llc -mtriple=amdgcn -mcpu=gfx908 -amdgpu-igrouplp-exact-solver -run-pass=machine-scheduler -o - /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir | /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/FileCheck -check-prefix=EXACT /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
+ /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/FileCheck -check-prefix=EXACT /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
+ /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/llc -mtriple=amdgcn -mcpu=gfx908 -amdgpu-igrouplp-exact-solver -run-pass=machine-scheduler -o - /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir

--

********************
Testing:  0.. 10.. 20.. 30.. 40.. 50.. 60.. 70.. 80.. 90.. 
Slowest Tests:
--------------------------------------------------------------------------
901.44s: LLVM :: CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
318.24s: Clang :: Preprocessor/riscv-target-features.c
290.49s: Clang :: Analysis/a_flaky_crash.cpp
285.85s: Clang :: Driver/fsanitize.c
271.08s: LLVM :: CodeGen/AMDGPU/llvm.amdgcn.permlane.ll
266.18s: LLVM :: CodeGen/X86/vector-interleaved-load-i8-stride-8.ll
262.55s: Clang :: OpenMP/target_update_codegen.cpp
259.03s: Clang :: Preprocessor/aarch64-target-features.c
251.58s: Clang :: CodeGen/aarch64-sve-intrinsics/acle_sve_reinterpret.c
243.82s: LLVM :: CodeGen/RISCV/attributes.ll
241.77s: Clang :: Driver/arm-cortex-cpus-2.c
236.58s: LLVM :: CodeGen/RISCV/atomic-rmw.ll
234.51s: Clang :: OpenMP/target_defaultmap_codegen_01.cpp
231.85s: Clang :: Driver/arm-cortex-cpus-1.c
231.70s: Clang :: Preprocessor/arm-target-features.c
210.14s: LLVM :: CodeGen/ARM/build-attributes.ll
205.85s: Clang :: Preprocessor/predefined-arch-macros.c
198.81s: Clang :: CodeGen/aarch64-sve-intrinsics/acle_sve_reinterpret-bfloat.c
175.73s: Clang :: CodeGen/X86/rot-intrinsics.c
168.58s: Clang :: Preprocessor/init.c
Step 10 (stage2/asan_ubsan check) failure: stage2/asan_ubsan check (failure)
...
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using ld64.lld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/ld64.lld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using wasm-ld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/wasm-ld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using ld.lld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/ld.lld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using lld-link: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/lld-link
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using ld64.lld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/ld64.lld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/llvm/config.py:508: note: using wasm-ld: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/wasm-ld
llvm-lit: /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/utils/lit/lit/main.py:72: note: The test suite configuration requested an individual test timeout of 0 seconds but a timeout of 900 seconds was requested on the command line. Forcing timeout to be 900 seconds.
-- Testing: 83925 of 83926 tests, 80 workers --
Testing:  0.. 10.. 20.. 30.. 40.. 50.. 60..
TIMEOUT: LLVM :: CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir (58658 of 83925)
******************** TEST 'LLVM :: CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir' FAILED ********************
Exit Code: -9
Timeout: Reached timeout of 900 seconds

Command Output (stderr):
--
RUN: at line 2: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/llc -mtriple=amdgcn -mcpu=gfx908 -run-pass=machine-scheduler -o - /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir | /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/FileCheck -check-prefix=GREEDY /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
+ /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/FileCheck -check-prefix=GREEDY /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
+ /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/llc -mtriple=amdgcn -mcpu=gfx908 -run-pass=machine-scheduler -o - /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
RUN: at line 3: /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/llc -mtriple=amdgcn -mcpu=gfx908 -amdgpu-igrouplp-exact-solver -run-pass=machine-scheduler -o - /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir | /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/FileCheck -check-prefix=EXACT /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
+ /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/FileCheck -check-prefix=EXACT /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
+ /b/sanitizer-x86_64-linux-fast/build/llvm_build_asan_ubsan/bin/llc -mtriple=amdgcn -mcpu=gfx908 -amdgpu-igrouplp-exact-solver -run-pass=machine-scheduler -o - /b/sanitizer-x86_64-linux-fast/build/llvm-project/llvm/test/CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir

--

********************
Testing:  0.. 10.. 20.. 30.. 40.. 50.. 60.. 70.. 80.. 90.. 
Slowest Tests:
--------------------------------------------------------------------------
901.44s: LLVM :: CodeGen/AMDGPU/sched-group-barrier-pipeline-solver.mir
318.24s: Clang :: Preprocessor/riscv-target-features.c
290.49s: Clang :: Analysis/a_flaky_crash.cpp
285.85s: Clang :: Driver/fsanitize.c
271.08s: LLVM :: CodeGen/AMDGPU/llvm.amdgcn.permlane.ll
266.18s: LLVM :: CodeGen/X86/vector-interleaved-load-i8-stride-8.ll
262.55s: Clang :: OpenMP/target_update_codegen.cpp
259.03s: Clang :: Preprocessor/aarch64-target-features.c
251.58s: Clang :: CodeGen/aarch64-sve-intrinsics/acle_sve_reinterpret.c
243.82s: LLVM :: CodeGen/RISCV/attributes.ll
241.77s: Clang :: Driver/arm-cortex-cpus-2.c
236.58s: LLVM :: CodeGen/RISCV/atomic-rmw.ll
234.51s: Clang :: OpenMP/target_defaultmap_codegen_01.cpp
231.85s: Clang :: Driver/arm-cortex-cpus-1.c
231.70s: Clang :: Preprocessor/arm-target-features.c
210.14s: LLVM :: CodeGen/ARM/build-attributes.ll
205.85s: Clang :: Preprocessor/predefined-arch-macros.c
198.81s: Clang :: CodeGen/aarch64-sve-intrinsics/acle_sve_reinterpret-bfloat.c
175.73s: Clang :: CodeGen/X86/rot-intrinsics.c
168.58s: Clang :: Preprocessor/init.c

aaryanshukla pushed a commit to aaryanshukla/llvm-project that referenced this pull request Jul 14, 2024
Before the patch `fixed-shadow.c` test died with an obscure SEGV, 
because shadow was mapped over libc.so.

Note, FindDynamicShadowStart is expected to select in available region.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants