1 // RUN: %clang_hwasan -O1 %s -o %t
2 // RUN: %env_hwasan_opts=stack_history_size=2048 not %run %t 2045 2>&1 | FileCheck %s --check-prefix=YES
3 // RUN: %env_hwasan_opts=stack_history_size=2048 not %run %t 2047 2>&1 | FileCheck %s --check-prefix=NO
4
5 // Run the same tests as above, but using the __hwasan_add_frame_record libcall.
6 // The output should be the exact same.
7 // RUN: %clang_hwasan -O1 %s -o %t -mllvm -hwasan-record-stack-history=libcall
8 // RUN: %env_hwasan_opts=stack_history_size=2048 not %run %t 2045 2>&1 | FileCheck %s --check-prefix=YES
9 // RUN: %env_hwasan_opts=stack_history_size=2048 not %run %t 2047 2>&1 | FileCheck %s --check-prefix=NO
10
11 // Stack histories are currently not recorded on x86.
12 // XFAIL: target=x86_64{{.*}}
13
14 #include <assert.h>
15 #include <sanitizer/hwasan_interface.h>
16 #include <stdlib.h>
17
USE(void * x)18 void USE(void *x) { // pretend_to_do_something(void *x)
19 __asm__ __volatile__("" : : "r" (x) : "memory");
20 }
21
22 volatile int four = 4;
FUNC0()23 __attribute__((noinline)) void FUNC0() { int x[4]; USE(&x[0]); }
FUNC()24 __attribute__((noinline)) void FUNC() { int x[4]; USE(&x[0]); }
OOB()25 __attribute__((noinline)) void OOB() {
26 int x[4];
27 int y[4];
28 // With -hwasan-generate-tags-with-calls=false, stack tags can occasionally
29 // be zero, leading to a false negative
30 // (https://github.com/llvm/llvm-project/issues/69221). Work around it by
31 // using the neighboring variable, which is guaranteed by
32 // -hwasan-generate-tags-with-calls=false to have a different (hence
33 // non-zero) tag.
34 if (__hwasan_tag_pointer(x, 0) == x) {
35 assert(__hwasan_tag_pointer(y, 0) != y);
36 y[four] = 0;
37 } else {
38 x[four] = 0;
39 }
40 USE(&x[0]);
41 USE(&y[0]);
42 }
43
main(int argc,char ** argv)44 int main(int argc, char **argv) {
45 int X = argc == 2 ? atoi(argv[1]) : 10;
46 // FUNC0 is X+2's element of the ring buffer.
47 // If runtime buffer size is less than it, FUNC0 record will be lost.
48 FUNC0();
49 for (int i = 0; i < X; ++i)
50 FUNC();
51 // Make at least one call to OOB where base tag != 0 so that the bug is caught
52 // at least once.
53 OOB();
54 OOB();
55 }
56
57 // YES: Previously allocated frames
58 // YES: OOB
59 // YES: FUNC
60 // YES: FUNC0
61
62 // NO: Previously allocated frames
63 // NO: OOB
64 // NO: FUNC
65 // NO-NOT: FUNC0
66