Extended Description

The x86_64 and aarch64 vararg helpers in memorysanitizer pass currently assume no non-vararg argument ends up in the overflow area - if that's not true, the data stored to __msan_va_arg_tls will be misaligned with the overflow pointer computed by va_start. Here's a testcase for x86_64:

#include <stdio.h>
#include <stdarg.h>

int passarg(int a, int b, int c, int d, int e, int f, int g, ...) {
va_list v;
va_start(v, g);
int res = va_arg(v, int);
va_end(v);
return res;
}

int main() {
int undef;
int res = passarg(undef, undef, undef, undef, undef, undef, undef, 2);
if (res)
printf("%d\n", res);
return 0;
}

Compiling with -fsanitize=memory and running results in:

==22438==WARNING: MemorySanitizer: use-of-uninitialized-value
#​0 0x4889ef in main (/home/mwk/llvm/llvm/a.out+0x4889ef)
#​1 0x7f78129fe70f in __libc_start_main (/usr/lib/libc.so.6+0x2070f)
#​2 0x418e38 in _start (/home/mwk/llvm/llvm/a.out+0x418e38)

This is because va_arg effectively reads the shadow belonging to argument g.

aarch64 should be suspectible to the same issue, but I haven't checked it.

mips64 is even worse, since it assumes there's exactly one non-vararg argument.