test/msan/vararg_shadow.cpp

// Check that shadow of retrieved value from va_list matches the shadow of passed value.

// Without -fno-sanitize-memory-param-retval we can't even pass poisoned values.
// RUN: %clangxx_msan -fno-sanitize-memory-param-retval -fsanitize-memory-track-origins=0 -O3 %s -o %t

// FIXME: The rest is likely still broken.
// XFAIL: target={{(loongarch64|mips|powerpc64).*}}

#include <sanitizer/msan_interface.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>

#ifdef DEBUG_VARARG_SHADOW_TEST
__attribute__((noinline, no_sanitize("memory"))) void
printb(const void *p, size_t n, int line, int align) {
  fprintf(stderr, "\n%p at line %d: \n", p, line);
  for (int i = 0; i < n;) {
    fprintf(stderr, "%p: ", (void *)(((uint8_t *)p) + i));
    for (int j = 0; j < align; ++i, ++j)
      fprintf(stderr, "%02x ", ((uint8_t *)p)[i]);
    fprintf(stderr, "\n");
  }
}

struct my_va_list {
#  ifdef __ARM_ARCH_ISA_A64
  void *stack;
  void *gr_top;
  void *vr_top;
  int gr_offs;
  int vr_offs;
#  else
  unsigned int gp_offset;
  unsigned int fp_offset;
  void *overflow_arg_area;
  void *reg_save_area;
#  endif
};

__attribute__((noinline, no_sanitize("memory"))) void printva(const void *p,
                                                              int line) {
  my_va_list *pp = (my_va_list *)p;
#  ifdef __ARM_ARCH_ISA_A64
  fprintf(stderr,
          "\nva %p at line %d: stack : %p\n gr_top: %p\n vr_top: %p\n gr_offs: "
          "%d\n "
          "vr_offs: %d\n",
          p, line, pp->stack, pp->gr_top, pp->vr_top, pp->gr_offs, pp->vr_offs);

  printb((char *)pp->gr_top + pp->gr_offs, -pp->gr_offs, __LINE__, 8);
  printb((char *)pp->vr_top + pp->vr_offs, -pp->vr_offs, __LINE__, 16);
  printb((char *)pp->stack, 256, __LINE__, 8);
#  else
  fprintf(stderr,
          "\nva %p at line %d:\n gp_offset: %u\n fp_offset: %u\n "
          "overflow_arg_area: %p\n reg_save_area: %p\n\n",
          p, line, pp->gp_offset, pp->fp_offset, pp->overflow_arg_area,
          pp->reg_save_area);

  printb((char *)pp->reg_save_area + pp->gp_offset,
         pp->fp_offset - pp->gp_offset, __LINE__, 8);
  printb((char *)pp->reg_save_area + pp->fp_offset, 128, __LINE__, 16);
  printb((char *)pp->overflow_arg_area, 256, __LINE__, 8);
#  endif
}

__attribute__((noinline, no_sanitize("memory"))) void printtls(int line) {
  uint8_t tmp[kMsanParamTlsSize];
  for (int i = 0; i < kMsanParamTlsSize; ++i)
    tmp[i] = __msan_va_arg_tls[i];
  fprintf(stderr, "\nTLS at line %d: ", line);
  for (int i = 0; i < kMsanParamTlsSize;) {
    fprintf(stderr, "\n");
    for (int j = 0; j < 16; ++i, ++j)
      fprintf(stderr, "%02x ", tmp[i]);
  }

  fprintf(stderr, "\n");
}
#endif // DEBUG_VARARG_SHADOW_TEST

const int kMsanParamTlsSize = 800;
extern "C" __thread uint8_t __msan_va_arg_tls[];

struct IntInt {
  int a;
  int b;
};

struct Int64Int64 {
  int64_t a;
  int64_t b;
};

struct DoubleDouble {
  double a;
  double b;
};

struct Double4 {
  double a[4];
};

struct DoubleFloat {
  double a;
  float b;
};

struct LongDouble2 {
  long double a[2];
};

struct LongDouble4 {
  long double a[4];
};

template <class T>
__attribute__((noinline)) void print_shadow(va_list &args, int n,
                                            const char *function) {
  for (int i = 0; i < n; i++) {
    // 1-based to make it different from clean shadow.
    fprintf(stderr, "\nArgShadow fn:%s n:%d i:%02x ", function, n, i + 1);
    T arg_int = va_arg(args, T);
    if (__msan_test_shadow(&arg_int, sizeof(arg_int)))
      fprintf(stderr, "fake[clean] %02x", i + 1);
    else
      __msan_dump_shadow(&arg_int, sizeof(arg_int));
#ifdef DEBUG_VARARG_SHADOW_TEST
    printb(&arg_int, sizeof(arg_int), __LINE__, 16);
#endif
  }
}

template <class T> __attribute__((noinline)) void test1(int n, ...) {
#ifdef DEBUG_VARARG_SHADOW_TEST
  printtls(__LINE__);
#endif
  va_list args;
  va_start(args, n);
#ifdef DEBUG_VARARG_SHADOW_TEST
  printva(&args, __LINE__);
#endif
  print_shadow<T>(args, n, __FUNCTION__);
  va_end(args);
}

template <class T> __attribute__((noinline)) void test2(T t, int n, ...) {
#ifdef DEBUG_VARARG_SHADOW_TEST
  printtls(__LINE__);
#endif
  va_list args;
  va_start(args, n);
#ifdef DEBUG_VARARG_SHADOW_TEST
  printva(&args, __LINE__);
#endif
  print_shadow<T>(args, n, __FUNCTION__);
  va_end(args);
}

template <class T> __attribute__((noinline)) void test() {
  // Array of values we will pass into variadic functions.
  static T args[32] = {};

  // Poison values making the fist byte of the item shadow match the index.
  // E.g. item 3 should be poisoned as '03 ff ff ff'.
  memset(args, 0xff, sizeof(args));
  __msan_poison(args, sizeof(args));
  for (int i = 0; i < 32; ++i) {
    char *first = (char *)(&args[i]);
    *first = char(*(int *)(first)&i);
  }
#ifdef DEBUG_VARARG_SHADOW_TEST
  __msan_print_shadow(args, sizeof(args));
#endif

  // Now we will check that index, printed like 'i:03' will match
  // '0x123abc[0x123abc] 03 ff ff ff'
  memset(__msan_va_arg_tls, 0xee, kMsanParamTlsSize);
  test1<T>(1, args[1]);
  // CHECK-COUNT-1: ArgShadow fn:test1 n:1 i:[[ARGI:[[:xdigit:]]{2}]] {{[^]]+}}] [[ARGI]]

  memset(__msan_va_arg_tls, 0xee, kMsanParamTlsSize);
  test1<T>(4, args[1], args[2], args[3], args[4]);
  // CHECK-COUNT-4: ArgShadow fn:test1 n:4 i:[[ARGI:[[:xdigit:]]{2}]] {{[^]]+}}] [[ARGI]]

  memset(__msan_va_arg_tls, 0xee, kMsanParamTlsSize);
  test1<T>(20, args[1], args[2], args[3], args[4], args[5], args[6], args[7],
           args[8], args[9], args[10], args[11], args[12], args[13], args[14],
           args[15], args[16], args[17], args[18], args[19], args[20]);
  // CHECK-COUNT-20: ArgShadow fn:test1 n:20 i:[[ARGI:[[:xdigit:]]{2}]] {{[^]]+}}] [[ARGI]]

  memset(__msan_va_arg_tls, 0xee, kMsanParamTlsSize);
  test2<T>(args[31], 1, args[1]);
  // CHECK-COUNT-1: ArgShadow fn:test2 n:1 i:[[ARGI:[[:xdigit:]]{2}]] {{[^]]+}}] [[ARGI]]

  memset(__msan_va_arg_tls, 0xee, kMsanParamTlsSize);
  test2<T>(args[31], 4, args[1], args[2], args[3], args[4]);
  // CHECK-COUNT-4: ArgShadow fn:test2 n:4 i:[[ARGI:[[:xdigit:]]{2}]] {{[^]]+}}] [[ARGI]]

  memset(__msan_va_arg_tls, 0xee, kMsanParamTlsSize);
  test2<T>(args[31], 20, args[1], args[2], args[3], args[4], args[5], args[6],
           args[7], args[8], args[9], args[10], args[11], args[12], args[13],
           args[14], args[15], args[16], args[17], args[18], args[19],
           args[20]);
  // CHECK-COUNT-20: ArgShadow fn:test2 n:20 i:[[ARGI:[[:xdigit:]]{2}]] {{[^]]+}}] [[ARGI]]
}

int main(int argc, char *argv[]) {
#define TEST(T...)                                                             \
  if (argc == 2 && strcmp(argv[1], #T) == 0) {                                 \
    test<T>();                                                                 \
    return 0;                                                                  \
  }

  TEST(char);
  // RUN: %run %t char 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(int);
  // RUN: %run %t int 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(void*);
  // RUN: %run %t "void*" 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(float);
  // RUN: %run %t float 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(double);
  // RUN: %run %t double 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(long double);
  // RUN: %run %t "long double" 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(IntInt);
  // RUN: %run %t IntInt 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(Int64Int64);
  // RUN: %run %t Int64Int64 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(DoubleDouble);
  // RUN: %run %t DoubleDouble 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(Double4);
  // RUN: %run %t Double4 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(DoubleFloat);
  // RUN: %run %t DoubleFloat 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(LongDouble2);
  // RUN: %run %t LongDouble2 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  TEST(LongDouble4);
  // RUN: %run %t LongDouble4 2>&1 | FileCheck %s --implicit-check-not="ArgShadow"

  return 1;
}