Skip to content

Commit 8a34f6d

Browse files
authored
[ASAN] Do not consider alignment during object size calculations (#109120)
It was found that ASAN logic optimizes away out-of-bound access instrumentation for over-aligned arrays. See #108287 for complete code examples. Fix it by not considering alignment during object size calculation, since out-of-bounds access for over-aligned object is still UB and should be reported by ASAN. Closes: #108287
1 parent 74c0ab6 commit 8a34f6d

File tree

2 files changed

+22
-3
lines changed

2 files changed

+22
-3
lines changed

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3057,9 +3057,7 @@ bool AddressSanitizer::instrumentFunction(Function &F,
30573057
OperandsToInstrument.size() + IntrinToInstrument.size() >
30583058
(unsigned)InstrumentationWithCallsThreshold);
30593059
const DataLayout &DL = F.getDataLayout();
3060-
ObjectSizeOpts ObjSizeOpts;
3061-
ObjSizeOpts.RoundToAlign = true;
3062-
ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(), ObjSizeOpts);
3060+
ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext());
30633061

30643062
// Instrument.
30653063
int NumInstrumented = 0;

llvm/test/Instrumentation/AddressSanitizer/instrument_global.ll

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ target triple = "x86_64-unknown-linux-gnu"
1616
; indexed with constants in-bounds. But instrument all other cases.
1717

1818
@GlobSt = global [10 x i32] zeroinitializer, align 16 ; static initializer
19+
@GlobStAlignInBounds = global [10 x i8] zeroinitializer, align 16 ; static initializer
1920
@GlobDy = global [10 x i32] zeroinitializer, align 16, sanitize_address_dyninit ; dynamic initializer
2021
@GlobEx = external global [10 x i32] , align 16 ; extern initializer
2122

@@ -49,6 +50,26 @@ entry:
4950
; CHECK: ret i32
5051
}
5152

53+
; GlobStAlignInBount is accessed with out of bounds index, but in bounds of allocated area (because of alignemnt)
54+
define i8 @AccessGlobStAlignInBounds_0_11() sanitize_address {
55+
entry:
56+
%0 = load i8, ptr getelementptr inbounds ([10 x i8], ptr @GlobStAlignInBounds, i64 0, i64 11), align 1
57+
ret i8 %0
58+
; CHECK-LABEL: define i8 @AccessGlobStAlignInBounds_0_11
59+
; CHECK: __asan_report
60+
; CHECK: ret i8
61+
}
62+
63+
; GlobStAlignInBount is accessed with in-bound index
64+
define i8 @AccessGlobStAlignInBounds_0_9() sanitize_address {
65+
entry:
66+
%0 = load i8, ptr getelementptr inbounds ([10 x i8], ptr @GlobStAlignInBounds, i64 0, i64 9), align 1
67+
ret i8 %0
68+
; CHECK-LABEL: define i8 @AccessGlobStAlignInBounds_0_9
69+
; CHECK-NOT: __asan_report
70+
; CHECK: ret i8
71+
}
72+
5273
; GlobDy is declared with dynamic initializer -- can't optimize.
5374
define i32 @AccessGlobDy_0_2() sanitize_address {
5475
entry:

0 commit comments

Comments
 (0)