| 1 | // RUN: %clang_hwasan -O1 %s -o %t |
| 2 | // RUN: %env_hwasan_opts=stack_history_size=2048 not %run %t 2045 2>&1 | FileCheck %s --check-prefix=YES |
| 3 | // RUN: %env_hwasan_opts=stack_history_size=2048 not %run %t 2047 2>&1 | FileCheck %s --check-prefix=NO |
| 4 | |
| 5 | // Run the same tests as above, but using the __hwasan_add_frame_record libcall. |
| 6 | // The output should be the exact same. |
| 7 | // RUN: %clang_hwasan -O1 %s -o %t -mllvm -hwasan-record-stack-history=libcall |
| 8 | // RUN: %env_hwasan_opts=stack_history_size=2048 not %run %t 2045 2>&1 | FileCheck %s --check-prefix=YES |
| 9 | // RUN: %env_hwasan_opts=stack_history_size=2048 not %run %t 2047 2>&1 | FileCheck %s --check-prefix=NO |
| 10 | |
| 11 | // Stack histories are currently not recorded on x86. |
| 12 | // XFAIL: target=x86_64{{.*}} |
| 13 | |
| 14 | #include <assert.h> |
| 15 | #include <sanitizer/hwasan_interface.h> |
| 16 | #include <stdlib.h> |
| 17 | |
| 18 | void USE(void *x) { // pretend_to_do_something(void *x) |
| 19 | __asm__ __volatile__("" : : "r" (x) : "memory" ); |
| 20 | } |
| 21 | |
| 22 | volatile int four = 4; |
| 23 | __attribute__((noinline)) void FUNC0() { int x[4]; USE(x: &x[0]); } |
| 24 | __attribute__((noinline)) void FUNC() { int x[4]; USE(x: &x[0]); } |
| 25 | __attribute__((noinline)) void OOB() { |
| 26 | int x[4]; |
| 27 | int y[4]; |
| 28 | // With -hwasan-generate-tags-with-calls=false, stack tags can occasionally |
| 29 | // be zero, leading to a false negative |
| 30 | // (https://github.com/llvm/llvm-project/issues/69221). Work around it by |
| 31 | // using the neighboring variable, which is guaranteed by |
| 32 | // -hwasan-generate-tags-with-calls=false to have a different (hence |
| 33 | // non-zero) tag. |
| 34 | if (__hwasan_tag_pointer(p: x, tag: 0) == x) { |
| 35 | assert(__hwasan_tag_pointer(y, 0) != y); |
| 36 | y[four] = 0; |
| 37 | } else { |
| 38 | x[four] = 0; |
| 39 | } |
| 40 | USE(x: &x[0]); |
| 41 | USE(x: &y[0]); |
| 42 | } |
| 43 | |
| 44 | int main(int argc, char **argv) { |
| 45 | int X = argc == 2 ? atoi(nptr: argv[1]) : 10; |
| 46 | // FUNC0 is X+2's element of the ring buffer. |
| 47 | // If runtime buffer size is less than it, FUNC0 record will be lost. |
| 48 | FUNC0(); |
| 49 | for (int i = 0; i < X; ++i) |
| 50 | FUNC(); |
| 51 | // Make at least one call to OOB where base tag != 0 so that the bug is caught |
| 52 | // at least once. |
| 53 | OOB(); |
| 54 | OOB(); |
| 55 | } |
| 56 | |
| 57 | // YES: Previously allocated frames |
| 58 | // YES: OOB |
| 59 | // YES: FUNC |
| 60 | // YES: FUNC0 |
| 61 | |
| 62 | // NO: Previously allocated frames |
| 63 | // NO: OOB |
| 64 | // NO: FUNC |
| 65 | // NO-NOT: FUNC0 |
| 66 | |