[msan] Fix origins in realloc.

Fixes 2 issues in origins arising from realloc() calls:
 * In the in-place grow case origin for the new memory is not set at all.
 * In the copy-realloc case __msan_memcpy is used, which unwinds stack from
   inside the MSan runtime. This does not generally work (as we may be built
   w/o frame pointers), and produces "bad" stack trace anyway, with several
   uninteresting (internal) frames on top.

This change also makes realloc() honor "zeroise" and "poison_in_malloc" flags.

See https://code.google.com/p/memory-sanitizer/issues/detail?id=73.

llvm-svn: 226674

diff --git a/compiler-rt/lib/msan/msan_allocator.cc b/compiler-rt/lib/msan/msan_allocator.cc
index 958dae8..035c2c6 100644 (file)
--- a/compiler-rt/lib/msan/msan_allocator.cc
+++ b/compiler-rt/lib/msan/msan_allocator.cc
@@ -18,6 +18,7 @@
 #include "msan_allocator.h"
 #include "msan_origin.h"
 #include "msan_thread.h"
+#include "msan_poisoning.h"
 
 namespace __msan {
 
@@ -168,15 +169,21 @@ void *MsanReallocate(StackTrace *stack, void *old_p, uptr new_size,
   if (new_size <= actually_allocated_size) {
     // We are not reallocating here.
     meta->requested_size = new_size;
-    if (new_size > old_size)
-      __msan_poison((char*)old_p + old_size, new_size - old_size);
+    if (new_size > old_size) {
+      if (zeroise) {
+        __msan_clear_and_unpoison((char *)old_p + old_size,
+                                  new_size - old_size);
+      } else if (flags()->poison_in_malloc) {
+        PoisonMemory((char *)old_p + old_size, new_size - old_size, stack);
+      }
+    }
     return old_p;
   }
   uptr memcpy_size = Min(new_size, old_size);
   void *new_p = MsanAllocate(stack, new_size, alignment, zeroise);
   // Printf("realloc: old_size %zd new_size %zd\n", old_size, new_size);
   if (new_p) {
-    __msan_memcpy(new_p, old_p, memcpy_size);
+    CopyMemory(new_p, old_p, memcpy_size, stack);
     MsanDeallocate(stack, old_p);
   }
   return new_p;

diff --git a/compiler-rt/test/msan/realloc-large-origin.cc b/compiler-rt/test/msan/realloc-large-origin.cc
new file mode 100644 (file)
index 0000000..349e152
--- /dev/null
+++ b/compiler-rt/test/msan/realloc-large-origin.cc
@@ -0,0 +1,30 @@
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -m64 -O0 %s -o %t && not %run %t >%t.out 2>&1
+// RUN: FileCheck %s < %t.out
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -m64 -O2 %s -o %t && not %run %t >%t.out 2>&1
+// RUN: FileCheck %s < %t.out
+
+// This is a regression test: there used to be broken "stored to memory at"
+// stacks with
+//   in __msan_memcpy
+//   in __msan::MsanReallocate
+// and nothing below that.
+
+#include <stdlib.h>
+int main(int argc, char **argv) {
+  char *p = (char *)malloc(100);
+  p = (char *)realloc(p, 10000);
+  char x = p[50];
+  free(p);
+  return x;
+
+// CHECK: WARNING: MemorySanitizer: use-of-uninitialized-value
+// CHECK:   {{#0 0x.* in main .*realloc-large-origin.cc:}}[[@LINE-3]]
+
+// CHECK:  Uninitialized value was stored to memory at
+// CHECK:   {{#0 0x.* in realloc}}
+// CHECK:   {{#1 0x.* in main .*realloc-large-origin.cc:}}[[@LINE-10]]
+
+// CHECK:   Uninitialized value was created by a heap allocation
+// CHECK:   {{#0 0x.* in malloc}}
+// CHECK:   {{#1 0x.* in main .*realloc-large-origin.cc:}}[[@LINE-15]]
+}

diff --git a/compiler-rt/test/msan/realloc-origin.cc b/compiler-rt/test/msan/realloc-origin.cc
new file mode 100644 (file)
index 0000000..ad176e7
--- /dev/null
+++ b/compiler-rt/test/msan/realloc-origin.cc
@@ -0,0 +1,21 @@
+// RUN: %clangxx_msan -fsanitize-memory-track-origins -m64 -O0 %s -o %t && not %run %t >%t.out 2>&1
+// RUN: FileCheck %s < %t.out
+// RUN: %clangxx_msan -fsanitize-memory-track-origins -m64 -O2 %s -o %t && not %run %t >%t.out 2>&1
+// RUN: FileCheck %s < %t.out
+
+// This test relies on realloc from 100 to 101 being done in-place.
+
+#include <stdlib.h>
+int main(int argc, char **argv) {
+  char *p = (char *)malloc(100);
+  p = (char *)realloc(p, 101);
+  char x = p[100];
+  free(p);
+  return x;
+  // CHECK: WARNING: MemorySanitizer: use-of-uninitialized-value
+  // CHECK: {{#0 0x.* in main .*realloc-origin.cc:}}[[@LINE-2]]
+
+  // CHECK: Uninitialized value was created by a heap allocation
+  // CHECK: {{#0 0x.* in realloc}}
+  // CHECK: {{#1 0x.* in main .*realloc-origin.cc:}}[[@LINE-9]]
+}