Skip to content

Commit 6d98571

Browse files
committed
Revert "[NFC][hwasan] Store shadow bytes early (#66682)"
InvalidFreeReport prints invalid ptr/mem. This reverts commit 7641c22.
1 parent b8f056d commit 6d98571

File tree

1 file changed

+48
-102
lines changed

1 file changed

+48
-102
lines changed

compiler-rt/lib/hwasan/hwasan_report.cpp

Lines changed: 48 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525
#include "sanitizer_common/sanitizer_array_ref.h"
2626
#include "sanitizer_common/sanitizer_common.h"
2727
#include "sanitizer_common/sanitizer_flags.h"
28-
#include "sanitizer_common/sanitizer_internal_defs.h"
2928
#include "sanitizer_common/sanitizer_mutex.h"
3029
#include "sanitizer_common/sanitizer_report_decorator.h"
3130
#include "sanitizer_common/sanitizer_stackdepot.h"
@@ -322,61 +321,56 @@ static uptr GetGlobalSizeFromDescriptor(uptr ptr) {
322321

323322
void ReportStats() {}
324323

325-
template <typename PrintTag>
326-
static void PrintTagInfoAroundAddr(uptr addr, uptr num_rows,
327-
InternalScopedString &s,
328-
PrintTag print_tag) {
324+
static void PrintTagInfoAroundAddr(tag_t *tag_ptr, uptr num_rows,
325+
void (*print_tag)(InternalScopedString &s,
326+
tag_t *tag)) {
329327
const uptr row_len = 16; // better be power of two.
330-
uptr center_row_beg = RoundDownTo(addr, row_len);
331-
uptr beg_row = center_row_beg - row_len * (num_rows / 2);
332-
uptr end_row = center_row_beg + row_len * ((num_rows + 1) / 2);
333-
for (uptr row = beg_row; row < end_row; row += row_len) {
328+
tag_t *center_row_beg = reinterpret_cast<tag_t *>(
329+
RoundDownTo(reinterpret_cast<uptr>(tag_ptr), row_len));
330+
tag_t *beg_row = center_row_beg - row_len * (num_rows / 2);
331+
tag_t *end_row = center_row_beg + row_len * ((num_rows + 1) / 2);
332+
InternalScopedString s;
333+
for (tag_t *row = beg_row; row < end_row; row += row_len) {
334334
s.Append(row == center_row_beg ? "=>" : " ");
335-
s.AppendF("%p:", (void *)ShadowToMem(row));
335+
s.AppendF("%p:", (void *)ShadowToMem(reinterpret_cast<uptr>(row)));
336336
for (uptr i = 0; i < row_len; i++) {
337-
s.Append(row + i == addr ? "[" : " ");
338-
print_tag(s, row + i);
339-
s.Append(row + i == addr ? "]" : " ");
337+
s.Append(row + i == tag_ptr ? "[" : " ");
338+
print_tag(s, &row[i]);
339+
s.Append(row + i == tag_ptr ? "]" : " ");
340340
}
341341
s.AppendF("\n");
342342
}
343+
Printf("%s", s.data());
343344
}
344345

345-
template <typename GetTag, typename GetShortTag>
346-
static void PrintTagsAroundAddr(uptr addr, GetTag get_tag,
347-
GetShortTag get_short_tag) {
348-
InternalScopedString s;
349-
addr = MemToShadow(addr);
350-
s.AppendF(
346+
static void PrintTagsAroundAddr(tag_t *tag_ptr) {
347+
Printf(
351348
"Memory tags around the buggy address (one tag corresponds to %zd "
352349
"bytes):\n",
353350
kShadowAlignment);
354-
PrintTagInfoAroundAddr(addr, 17, s,
355-
[&](InternalScopedString &s, uptr tag_addr) {
356-
tag_t tag = get_tag(tag_addr);
357-
s.AppendF("%02x", tag);
358-
});
351+
PrintTagInfoAroundAddr(tag_ptr, 17, [](InternalScopedString &s, tag_t *tag) {
352+
s.AppendF("%02x", *tag);
353+
});
359354

360-
s.AppendF(
355+
Printf(
361356
"Tags for short granules around the buggy address (one tag corresponds "
362357
"to %zd bytes):\n",
363358
kShadowAlignment);
364-
PrintTagInfoAroundAddr(addr, 3, s,
365-
[&](InternalScopedString &s, uptr tag_addr) {
366-
tag_t tag = get_tag(tag_addr);
367-
if (tag >= 1 && tag <= kShadowAlignment) {
368-
tag_t short_tag = get_short_tag(tag_addr);
369-
s.AppendF("%02x", short_tag);
370-
} else {
371-
s.AppendF("..");
372-
}
373-
});
374-
s.AppendF(
359+
PrintTagInfoAroundAddr(tag_ptr, 3, [](InternalScopedString &s, tag_t *tag) {
360+
uptr granule_addr = ShadowToMem(reinterpret_cast<uptr>(tag));
361+
if (*tag >= 1 && *tag <= kShadowAlignment &&
362+
IsAccessibleMemoryRange(granule_addr, kShadowAlignment)) {
363+
s.AppendF("%02x",
364+
*reinterpret_cast<u8 *>(granule_addr + kShadowAlignment - 1));
365+
} else {
366+
s.AppendF("..");
367+
}
368+
});
369+
Printf(
375370
"See "
376371
"https://clang.llvm.org/docs/"
377372
"HardwareAssistedAddressSanitizerDesign.html#short-granules for a "
378373
"description of short granule tags\n");
379-
Printf("%s", s.data());
380374
}
381375

382376
static uptr GetTopPc(const StackTrace *stack) {
@@ -396,8 +390,7 @@ class BaseReport {
396390
ptr_tag(GetTagFromPointer(tagged_addr)),
397391
heap(CopyHeapChunk()),
398392
allocations(CopyAllocations()),
399-
candidate(FindBufferOverflowCandidate()),
400-
shadow(CopyShadow()) {}
393+
candidate(FindBufferOverflowCandidate()) {}
401394

402395
protected:
403396
struct OverflowCandidate {
@@ -435,15 +428,6 @@ class BaseReport {
435428
bool is_allocated = false;
436429
};
437430

438-
struct Shadow {
439-
uptr addr = 0;
440-
tag_t tags[512] = {};
441-
tag_t short_tags[ARRAY_SIZE(tags)] = {};
442-
};
443-
444-
Shadow CopyShadow() const;
445-
tag_t GetTagCopy(uptr addr) const;
446-
tag_t GetShortTagCopy(uptr addr) const;
447431
HeapChunk CopyHeapChunk() const;
448432
Allocations CopyAllocations();
449433
OverflowCandidate FindBufferOverflowCandidate() const;
@@ -463,49 +447,8 @@ class BaseReport {
463447
const HeapChunk heap;
464448
const Allocations allocations;
465449
const OverflowCandidate candidate;
466-
467-
const Shadow shadow;
468450
};
469451

470-
BaseReport::Shadow BaseReport::CopyShadow() const {
471-
Shadow result;
472-
if (!MemIsApp(untagged_addr))
473-
return result;
474-
475-
result.addr = MemToShadow(untagged_addr) - ARRAY_SIZE(result.tags) / 2;
476-
for (uptr i = 0; i < ARRAY_SIZE(result.tags); ++i) {
477-
uptr tag_addr = result.addr + i;
478-
if (!MemIsShadow(tag_addr))
479-
continue;
480-
result.tags[i] = *reinterpret_cast<tag_t *>(tag_addr);
481-
uptr granule_addr = ShadowToMem(tag_addr);
482-
if (1 <= result.tags[i] && result.tags[i] <= kShadowAlignment &&
483-
IsAccessibleMemoryRange(granule_addr, kShadowAlignment)) {
484-
result.short_tags[i] =
485-
*reinterpret_cast<tag_t *>(granule_addr + kShadowAlignment - 1);
486-
}
487-
}
488-
return result;
489-
}
490-
491-
tag_t BaseReport::GetTagCopy(uptr addr) const {
492-
if (addr < shadow.addr)
493-
return 0;
494-
uptr idx = addr - shadow.addr;
495-
if (idx >= ARRAY_SIZE(shadow.tags))
496-
return 0;
497-
return shadow.tags[idx];
498-
}
499-
500-
tag_t BaseReport::GetShortTagCopy(uptr addr) const {
501-
if (addr < shadow.addr)
502-
return 0;
503-
uptr idx = addr - shadow.addr;
504-
if (idx >= ARRAY_SIZE(shadow.short_tags))
505-
return 0;
506-
return shadow.short_tags[idx];
507-
}
508-
509452
BaseReport::HeapChunk BaseReport::CopyHeapChunk() const {
510453
HeapChunk result = {};
511454
if (MemIsShadow(untagged_addr))
@@ -778,6 +721,15 @@ class InvalidFreeReport : public BaseReport {
778721
};
779722

780723
InvalidFreeReport::~InvalidFreeReport() {
724+
tag_t *tag_ptr = nullptr;
725+
tag_t mem_tag = 0;
726+
if (MemIsApp(untagged_addr)) {
727+
tag_ptr = reinterpret_cast<tag_t *>(MemToShadow(untagged_addr));
728+
if (MemIsShadow(reinterpret_cast<uptr>(tag_ptr)))
729+
mem_tag = *tag_ptr;
730+
else
731+
tag_ptr = nullptr;
732+
}
781733
Decorator d;
782734
Printf("%s", d.Error());
783735
uptr pc = GetTopPc(stack);
@@ -791,19 +743,16 @@ InvalidFreeReport::~InvalidFreeReport() {
791743
SanitizerToolName, bug_type, untagged_addr, pc);
792744
}
793745
Printf("%s", d.Access());
794-
if (shadow.addr)
795-
Printf("tags: %02x/%02x (ptr/mem)\n", ptr_tag, GetTagCopy(untagged_addr));
746+
if (tag_ptr)
747+
Printf("tags: %02x/%02x (ptr/mem)\n", ptr_tag, mem_tag);
796748
Printf("%s", d.Default());
797749

798750
stack->Print();
799751

800752
PrintAddressDescription();
801753

802-
if (shadow.addr) {
803-
PrintTagsAroundAddr(
804-
untagged_addr, [&](uptr addr) { return GetTagCopy(addr); },
805-
[&](uptr addr) { return GetShortTagCopy(addr); });
806-
}
754+
if (tag_ptr)
755+
PrintTagsAroundAddr(tag_ptr);
807756

808757
MaybePrintAndroidHelpUrl();
809758
ReportErrorSummary(bug_type, stack);
@@ -885,9 +834,8 @@ TailOverwrittenReport::~TailOverwrittenReport() {
885834
Printf("%s", s.data());
886835
GetCurrentThread()->Announce();
887836

888-
PrintTagsAroundAddr(
889-
untagged_addr, [&](uptr addr) { return GetTagCopy(addr); },
890-
[&](uptr addr) { return GetShortTagCopy(addr); });
837+
tag_t *tag_ptr = reinterpret_cast<tag_t*>(MemToShadow(untagged_addr));
838+
PrintTagsAroundAddr(tag_ptr);
891839

892840
MaybePrintAndroidHelpUrl();
893841
ReportErrorSummary(bug_type, stack);
@@ -964,9 +912,7 @@ TagMismatchReport::~TagMismatchReport() {
964912
PrintAddressDescription();
965913
t->Announce();
966914

967-
PrintTagsAroundAddr(
968-
untagged_addr + offset, [&](uptr addr) { return GetTagCopy(addr); },
969-
[&](uptr addr) { return GetShortTagCopy(addr); });
915+
PrintTagsAroundAddr(tag_ptr);
970916

971917
if (registers_frame)
972918
ReportRegisters(registers_frame, pc);

0 commit comments

Comments
 (0)