1// Tests use-after-scope detection and reporting.
2// RUN: %clang_hwasan -O0 -g %s -o %t && not %run %t 2>&1 | FileCheck %s
3// RUN: %clang_hwasan -O2 -g %s -o %t && not %run %t 2>&1 | FileCheck %s
4// RUN: %clang_hwasan -g %s -o %t && not %env_hwasan_opts=symbolize=0 %run %t 2>&1 | FileCheck %s --check-prefix=NOSYM
5
6// RUN: %clang_hwasan -mllvm -hwasan-use-after-scope=false -g %s -o %t && %run %t 2>&1
7
8// RUN: %clang_hwasan -g %s -o %t && not %run %t 2>&1 | FileCheck %s
9
10// Run the same test as above, but using the __hwasan_add_frame_record libcall.
11// The output should be the exact same.
12// RUN: %clang_hwasan -mllvm -hwasan-record-stack-history=libcall -g %s -o %t && not %env_hwasan_opts=symbolize=0 %run %t 2>&1 | FileCheck %s --check-prefix=NOSYM
13
14// Stack histories currently are not recorded on x86.
15// XFAIL: target=x86_64{{.*}}
16
17#include <assert.h>
18#include <sanitizer/hwasan_interface.h>
19#include <stdio.h>
20
21void USE(void *x) { // pretend_to_do_something(void *x)
22 __asm__ __volatile__(""
23 :
24 : "r"(x)
25 : "memory");
26}
27
28__attribute__((noinline)) void Unrelated1() {
29 int A[2];
30 USE(x: &A[0]);
31}
32__attribute__((noinline)) void Unrelated2() {
33 int BB[3];
34 USE(x: &BB[0]);
35}
36__attribute__((noinline)) void Unrelated3() {
37 int CCC[4];
38 USE(x: &CCC[0]);
39}
40
41__attribute__((noinline)) char buggy() {
42 char *volatile p;
43 {
44 char zzz[0x800] = {};
45 char yyy[0x800] = {};
46 // With -hwasan-generate-tags-with-calls=false, stack tags can occasionally
47 // be zero, leading to a false negative
48 // (https://github.com/llvm/llvm-project/issues/69221). Work around it by
49 // using the neighboring variable, which is guaranteed by
50 // -hwasan-generate-tags-with-calls=false to have a different (hence
51 // non-zero) tag.
52 if (__hwasan_tag_pointer(p: zzz, tag: 0) == zzz) {
53 assert(__hwasan_tag_pointer(yyy, 0) != yyy);
54 p = yyy;
55 } else {
56 p = zzz;
57 }
58 }
59 return *p;
60}
61
62int main() {
63 Unrelated1();
64 Unrelated2();
65 Unrelated3();
66 char p = buggy();
67 return p;
68 // CHECK: READ of size 1 at
69 // CHECK: #0 {{.*}} in buggy{{.*}}stack-uas.c:[[@LINE-10]]
70 // CHECK: Cause: stack tag-mismatch
71 // CHECK: is located in stack of thread
72 // CHECK: Potentially referenced stack objects:
73 // CHECK: Cause: use-after-scope
74 // CHECK-NEXT: 0x{{.*}} is located 0 bytes inside a 2048-byte local variable {{zzz|yyy}} [0x{{.*}}) in buggy {{.*}}stack-uas.c:
75 // CHECK: Memory tags around the buggy address
76
77 // NOSYM: Previously allocated frames:
78 // NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uas.c.tmp+0x{{.*}}){{$}}
79 // NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uas.c.tmp+0x{{.*}}){{$}}
80 // NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uas.c.tmp+0x{{.*}}){{$}}
81 // NOSYM-NEXT: record_addr:0x{{.*}} record:0x{{.*}} ({{.*}}/stack-uas.c.tmp+0x{{.*}}){{$}}
82 // NOSYM: Memory tags around the buggy address
83
84 // CHECK: SUMMARY: HWAddressSanitizer: tag-mismatch {{.*}} in buggy
85}
86

source code of compiler-rt/test/hwasan/TestCases/stack-uas.c