Bug Summary

File:projects/compiler-rt/lib/asan/asan_descriptions.cc
Warning:line 456, column 3
Value stored to 'addr' is never read

Annotated Source Code

1//===-- asan_descriptions.cc ------------------------------------*- C++ -*-===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12// ASan functions for getting information about an address and/or printing it.
13//===----------------------------------------------------------------------===//
14
15#include "asan_descriptions.h"
16#include "asan_mapping.h"
17#include "asan_report.h"
18#include "asan_stack.h"
19#include "sanitizer_common/sanitizer_stackdepot.h"
20
21namespace __asan {
22
23// Return " (thread_name) " or an empty string if the name is empty.
24const char *ThreadNameWithParenthesis(AsanThreadContext *t, char buff[],
25 uptr buff_len) {
26 const char *name = t->name;
27 if (name[0] == '\0') return "";
28 buff[0] = 0;
29 internal_strncat(buff, " (", 3);
30 internal_strncat(buff, name, buff_len - 4);
31 internal_strncat(buff, ")", 2);
32 return buff;
33}
34
35const char *ThreadNameWithParenthesis(u32 tid, char buff[], uptr buff_len) {
36 if (tid == kInvalidTid) return "";
37 asanThreadRegistry().CheckLocked();
38 AsanThreadContext *t = GetThreadContextByTidLocked(tid);
39 return ThreadNameWithParenthesis(t, buff, buff_len);
40}
41
42void DescribeThread(AsanThreadContext *context) {
43 CHECK(context)do { __sanitizer::u64 v1 = (__sanitizer::u64)((context)); __sanitizer
::u64 v2 = (__sanitizer::u64)(0); if (__builtin_expect(!!(!(v1
!= v2)), 0)) __sanitizer::CheckFailed("/build/llvm-toolchain-snapshot-6.0~svn318211/projects/compiler-rt/lib/asan/asan_descriptions.cc"
, 43, "(" "(context)" ") " "!=" " (" "0" ")", v1, v2); } while
(false)
;
44 asanThreadRegistry().CheckLocked();
45 // No need to announce the main thread.
46 if (context->tid == 0 || context->announced) {
47 return;
48 }
49 context->announced = true;
50 char tname[128];
51 InternalScopedString str(1024);
52 str.append("Thread T%d%s", context->tid,
53 ThreadNameWithParenthesis(context->tid, tname, sizeof(tname)));
54 if (context->parent_tid == kInvalidTid) {
55 str.append(" created by unknown thread\n");
56 Printf("%s", str.data());
57 return;
58 }
59 str.append(
60 " created by T%d%s here:\n", context->parent_tid,
61 ThreadNameWithParenthesis(context->parent_tid, tname, sizeof(tname)));
62 Printf("%s", str.data());
63 StackDepotGet(context->stack_id).Print();
64 // Recursively described parent thread if needed.
65 if (flags()->print_full_thread_history) {
66 AsanThreadContext *parent_context =
67 GetThreadContextByTidLocked(context->parent_tid);
68 DescribeThread(parent_context);
69 }
70}
71
72// Shadow descriptions
73static bool GetShadowKind(uptr addr, ShadowKind *shadow_kind) {
74 CHECK(!AddrIsInMem(addr))do { __sanitizer::u64 v1 = (__sanitizer::u64)((!AddrIsInMem(addr
))); __sanitizer::u64 v2 = (__sanitizer::u64)(0); if (__builtin_expect
(!!(!(v1 != v2)), 0)) __sanitizer::CheckFailed("/build/llvm-toolchain-snapshot-6.0~svn318211/projects/compiler-rt/lib/asan/asan_descriptions.cc"
, 74, "(" "(!AddrIsInMem(addr))" ") " "!=" " (" "0" ")", v1, v2
); } while (false)
;
75 if (AddrIsInShadowGap(addr)) {
76 *shadow_kind = kShadowKindGap;
77 } else if (AddrIsInHighShadow(addr)) {
78 *shadow_kind = kShadowKindHigh;
79 } else if (AddrIsInLowShadow(addr)) {
80 *shadow_kind = kShadowKindLow;
81 } else {
82 CHECK(0 && "Address is not in memory and not in shadow?")do { __sanitizer::u64 v1 = (__sanitizer::u64)((0 && "Address is not in memory and not in shadow?"
)); __sanitizer::u64 v2 = (__sanitizer::u64)(0); if (__builtin_expect
(!!(!(v1 != v2)), 0)) __sanitizer::CheckFailed("/build/llvm-toolchain-snapshot-6.0~svn318211/projects/compiler-rt/lib/asan/asan_descriptions.cc"
, 82, "(" "(0 && \"Address is not in memory and not in shadow?\")"
") " "!=" " (" "0" ")", v1, v2); } while (false)
;
83 return false;
84 }
85 return true;
86}
87
88bool DescribeAddressIfShadow(uptr addr) {
89 ShadowAddressDescription descr;
90 if (!GetShadowAddressInformation(addr, &descr)) return false;
91 descr.Print();
92 return true;
93}
94
95bool GetShadowAddressInformation(uptr addr, ShadowAddressDescription *descr) {
96 if (AddrIsInMem(addr)) return false;
97 ShadowKind shadow_kind;
98 if (!GetShadowKind(addr, &shadow_kind)) return false;
99 if (shadow_kind != kShadowKindGap) descr->shadow_byte = *(u8 *)addr;
100 descr->addr = addr;
101 descr->kind = shadow_kind;
102 return true;
103}
104
105// Heap descriptions
106static void GetAccessToHeapChunkInformation(ChunkAccess *descr,
107 AsanChunkView chunk, uptr addr,
108 uptr access_size) {
109 descr->bad_addr = addr;
110 if (chunk.AddrIsAtLeft(addr, access_size, &descr->offset)) {
111 descr->access_type = kAccessTypeLeft;
112 } else if (chunk.AddrIsAtRight(addr, access_size, &descr->offset)) {
113 descr->access_type = kAccessTypeRight;
114 if (descr->offset < 0) {
115 descr->bad_addr -= descr->offset;
116 descr->offset = 0;
117 }
118 } else if (chunk.AddrIsInside(addr, access_size, &descr->offset)) {
119 descr->access_type = kAccessTypeInside;
120 } else {
121 descr->access_type = kAccessTypeUnknown;
122 }
123 descr->chunk_begin = chunk.Beg();
124 descr->chunk_size = chunk.UsedSize();
125 descr->user_requested_alignment = chunk.UserRequestedAlignment();
126 descr->alloc_type = chunk.GetAllocType();
127}
128
129static void PrintHeapChunkAccess(uptr addr, const ChunkAccess &descr) {
130 Decorator d;
131 InternalScopedString str(4096);
132 str.append("%s", d.Location());
133 switch (descr.access_type) {
134 case kAccessTypeLeft:
135 str.append("%p is located %zd bytes to the left of",
136 (void *)descr.bad_addr, descr.offset);
137 break;
138 case kAccessTypeRight:
139 str.append("%p is located %zd bytes to the right of",
140 (void *)descr.bad_addr, descr.offset);
141 break;
142 case kAccessTypeInside:
143 str.append("%p is located %zd bytes inside of", (void *)descr.bad_addr,
144 descr.offset);
145 break;
146 case kAccessTypeUnknown:
147 str.append(
148 "%p is located somewhere around (this is AddressSanitizer bug!)",
149 (void *)descr.bad_addr);
150 }
151 str.append(" %zu-byte region [%p,%p)\n", descr.chunk_size,
152 (void *)descr.chunk_begin,
153 (void *)(descr.chunk_begin + descr.chunk_size));
154 str.append("%s", d.Default());
155 Printf("%s", str.data());
156}
157
158bool GetHeapAddressInformation(uptr addr, uptr access_size,
159 HeapAddressDescription *descr) {
160 AsanChunkView chunk = FindHeapChunkByAddress(addr);
161 if (!chunk.IsValid()) {
162 return false;
163 }
164 descr->addr = addr;
165 GetAccessToHeapChunkInformation(&descr->chunk_access, chunk, addr,
166 access_size);
167 CHECK_NE(chunk.AllocTid(), kInvalidTid)do { __sanitizer::u64 v1 = (__sanitizer::u64)((chunk.AllocTid
())); __sanitizer::u64 v2 = (__sanitizer::u64)((kInvalidTid))
; if (__builtin_expect(!!(!(v1 != v2)), 0)) __sanitizer::CheckFailed
("/build/llvm-toolchain-snapshot-6.0~svn318211/projects/compiler-rt/lib/asan/asan_descriptions.cc"
, 167, "(" "(chunk.AllocTid())" ") " "!=" " (" "(kInvalidTid)"
")", v1, v2); } while (false)
;
168 descr->alloc_tid = chunk.AllocTid();
169 descr->alloc_stack_id = chunk.GetAllocStackId();
170 descr->free_tid = chunk.FreeTid();
171 if (descr->free_tid != kInvalidTid)
172 descr->free_stack_id = chunk.GetFreeStackId();
173 return true;
174}
175
176static StackTrace GetStackTraceFromId(u32 id) {
177 CHECK(id)do { __sanitizer::u64 v1 = (__sanitizer::u64)((id)); __sanitizer
::u64 v2 = (__sanitizer::u64)(0); if (__builtin_expect(!!(!(v1
!= v2)), 0)) __sanitizer::CheckFailed("/build/llvm-toolchain-snapshot-6.0~svn318211/projects/compiler-rt/lib/asan/asan_descriptions.cc"
, 177, "(" "(id)" ") " "!=" " (" "0" ")", v1, v2); } while (false
)
;
178 StackTrace res = StackDepotGet(id);
179 CHECK(res.trace)do { __sanitizer::u64 v1 = (__sanitizer::u64)((res.trace)); __sanitizer
::u64 v2 = (__sanitizer::u64)(0); if (__builtin_expect(!!(!(v1
!= v2)), 0)) __sanitizer::CheckFailed("/build/llvm-toolchain-snapshot-6.0~svn318211/projects/compiler-rt/lib/asan/asan_descriptions.cc"
, 179, "(" "(res.trace)" ") " "!=" " (" "0" ")", v1, v2); } while
(false)
;
180 return res;
181}
182
183bool DescribeAddressIfHeap(uptr addr, uptr access_size) {
184 HeapAddressDescription descr;
185 if (!GetHeapAddressInformation(addr, access_size, &descr)) {
186 Printf(
187 "AddressSanitizer can not describe address in more detail "
188 "(wild memory access suspected).\n");
189 return false;
190 }
191 descr.Print();
192 return true;
193}
194
195// Stack descriptions
196bool GetStackAddressInformation(uptr addr, uptr access_size,
197 StackAddressDescription *descr) {
198 AsanThread *t = FindThreadByStackAddress(addr);
199 if (!t) return false;
200
201 descr->addr = addr;
202 descr->tid = t->tid();
203 // Try to fetch precise stack frame for this access.
204 AsanThread::StackFrameAccess access;
205 if (!t->GetStackFrameAccessByAddr(addr, &access)) {
206 descr->frame_descr = nullptr;
207 return true;
208 }
209
210 descr->offset = access.offset;
211 descr->access_size = access_size;
212 descr->frame_pc = access.frame_pc;
213 descr->frame_descr = access.frame_descr;
214
215#if SANITIZER_PPC64V10
216 // On PowerPC64 ELFv1, the address of a function actually points to a
217 // three-doubleword data structure with the first field containing
218 // the address of the function's code.
219 descr->frame_pc = *reinterpret_cast<uptr *>(descr->frame_pc);
220#endif
221 descr->frame_pc += 16;
222
223 return true;
224}
225
226static void PrintAccessAndVarIntersection(const StackVarDescr &var, uptr addr,
227 uptr access_size, uptr prev_var_end,
228 uptr next_var_beg) {
229 uptr var_end = var.beg + var.size;
230 uptr addr_end = addr + access_size;
231 const char *pos_descr = nullptr;
232 // If the variable [var.beg, var_end) is the nearest variable to the
233 // current memory access, indicate it in the log.
234 if (addr >= var.beg) {
235 if (addr_end <= var_end)
236 pos_descr = "is inside"; // May happen if this is a use-after-return.
237 else if (addr < var_end)
238 pos_descr = "partially overflows";
239 else if (addr_end <= next_var_beg &&
240 next_var_beg - addr_end >= addr - var_end)
241 pos_descr = "overflows";
242 } else {
243 if (addr_end > var.beg)
244 pos_descr = "partially underflows";
245 else if (addr >= prev_var_end && addr - prev_var_end >= var.beg - addr_end)
246 pos_descr = "underflows";
247 }
248 InternalScopedString str(1024);
249 str.append(" [%zd, %zd)", var.beg, var_end);
250 // Render variable name.
251 str.append(" '");
252 for (uptr i = 0; i < var.name_len; ++i) {
253 str.append("%c", var.name_pos[i]);
254 }
255 str.append("'");
256 if (var.line > 0) {
257 str.append(" (line %d)", var.line);
258 }
259 if (pos_descr) {
260 Decorator d;
261 // FIXME: we may want to also print the size of the access here,
262 // but in case of accesses generated by memset it may be confusing.
263 str.append("%s <== Memory access at offset %zd %s this variable%s\n",
264 d.Location(), addr, pos_descr, d.Default());
265 } else {
266 str.append("\n");
267 }
268 Printf("%s", str.data());
269}
270
271bool DescribeAddressIfStack(uptr addr, uptr access_size) {
272 StackAddressDescription descr;
273 if (!GetStackAddressInformation(addr, access_size, &descr)) return false;
274 descr.Print();
275 return true;
276}
277
278// Global descriptions
279static void DescribeAddressRelativeToGlobal(uptr addr, uptr access_size,
280 const __asan_global &g) {
281 InternalScopedString str(4096);
282 Decorator d;
283 str.append("%s", d.Location());
284 if (addr < g.beg) {
285 str.append("%p is located %zd bytes to the left", (void *)addr,
286 g.beg - addr);
287 } else if (addr + access_size > g.beg + g.size) {
288 if (addr < g.beg + g.size) addr = g.beg + g.size;
289 str.append("%p is located %zd bytes to the right", (void *)addr,
290 addr - (g.beg + g.size));
291 } else {
292 // Can it happen?
293 str.append("%p is located %zd bytes inside", (void *)addr, addr - g.beg);
294 }
295 str.append(" of global variable '%s' defined in '",
296 MaybeDemangleGlobalName(g.name));
297 PrintGlobalLocation(&str, g);
298 str.append("' (0x%zx) of size %zu\n", g.beg, g.size);
299 str.append("%s", d.Default());
300 PrintGlobalNameIfASCII(&str, g);
301 Printf("%s", str.data());
302}
303
304bool GetGlobalAddressInformation(uptr addr, uptr access_size,
305 GlobalAddressDescription *descr) {
306 descr->addr = addr;
307 int globals_num = GetGlobalsForAddress(addr, descr->globals, descr->reg_sites,
308 ARRAY_SIZE(descr->globals)(sizeof(descr->globals)/sizeof((descr->globals)[0])));
309 descr->size = globals_num;
310 descr->access_size = access_size;
311 return globals_num != 0;
312}
313
314bool DescribeAddressIfGlobal(uptr addr, uptr access_size,
315 const char *bug_type) {
316 GlobalAddressDescription descr;
317 if (!GetGlobalAddressInformation(addr, access_size, &descr)) return false;
318
319 descr.Print(bug_type);
320 return true;
321}
322
323void ShadowAddressDescription::Print() const {
324 Printf("Address %p is located in the %s area.\n", addr, ShadowNames[kind]);
325}
326
327void GlobalAddressDescription::Print(const char *bug_type) const {
328 for (int i = 0; i < size; i++) {
329 DescribeAddressRelativeToGlobal(addr, access_size, globals[i]);
330 if (bug_type &&
331 0 == internal_strcmp(bug_type, "initialization-order-fiasco") &&
332 reg_sites[i]) {
333 Printf(" registered at:\n");
334 StackDepotGet(reg_sites[i]).Print();
335 }
336 }
337}
338
339void StackAddressDescription::Print() const {
340 Decorator d;
341 char tname[128];
342 Printf("%s", d.Location());
343 Printf("Address %p is located in stack of thread T%d%s", addr, tid,
344 ThreadNameWithParenthesis(tid, tname, sizeof(tname)));
345
346 if (!frame_descr) {
347 Printf("%s\n", d.Default());
348 return;
349 }
350 Printf(" at offset %zu in frame%s\n", offset, d.Default());
351
352 // Now we print the frame where the alloca has happened.
353 // We print this frame as a stack trace with one element.
354 // The symbolizer may print more than one frame if inlining was involved.
355 // The frame numbers may be different than those in the stack trace printed
356 // previously. That's unfortunate, but I have no better solution,
357 // especially given that the alloca may be from entirely different place
358 // (e.g. use-after-scope, or different thread's stack).
359 Printf("%s", d.Default());
360 StackTrace alloca_stack(&frame_pc, 1);
361 alloca_stack.Print();
362
363 InternalMmapVector<StackVarDescr> vars(16);
364 if (!ParseFrameDescription(frame_descr, &vars)) {
365 Printf(
366 "AddressSanitizer can't parse the stack frame "
367 "descriptor: |%s|\n",
368 frame_descr);
369 // 'addr' is a stack address, so return true even if we can't parse frame
370 return;
371 }
372 uptr n_objects = vars.size();
373 // Report the number of stack objects.
374 Printf(" This frame has %zu object(s):\n", n_objects);
375
376 // Report all objects in this frame.
377 for (uptr i = 0; i < n_objects; i++) {
378 uptr prev_var_end = i ? vars[i - 1].beg + vars[i - 1].size : 0;
379 uptr next_var_beg = i + 1 < n_objects ? vars[i + 1].beg : ~(0UL);
380 PrintAccessAndVarIntersection(vars[i], offset, access_size, prev_var_end,
381 next_var_beg);
382 }
383 Printf(
384 "HINT: this may be a false positive if your program uses "
385 "some custom stack unwind mechanism or swapcontext\n");
386 if (SANITIZER_WINDOWS0)
387 Printf(" (longjmp, SEH and C++ exceptions *are* supported)\n");
388 else
389 Printf(" (longjmp and C++ exceptions *are* supported)\n");
390
391 DescribeThread(GetThreadContextByTidLocked(tid));
392}
393
394void HeapAddressDescription::Print() const {
395 PrintHeapChunkAccess(addr, chunk_access);
396
397 asanThreadRegistry().CheckLocked();
398 AsanThreadContext *alloc_thread = GetThreadContextByTidLocked(alloc_tid);
399 StackTrace alloc_stack = GetStackTraceFromId(alloc_stack_id);
400
401 char tname[128];
402 Decorator d;
403 AsanThreadContext *free_thread = nullptr;
404 if (free_tid != kInvalidTid) {
405 free_thread = GetThreadContextByTidLocked(free_tid);
406 Printf("%sfreed by thread T%d%s here:%s\n", d.Allocation(),
407 free_thread->tid,
408 ThreadNameWithParenthesis(free_thread, tname, sizeof(tname)),
409 d.Default());
410 StackTrace free_stack = GetStackTraceFromId(free_stack_id);
411 free_stack.Print();
412 Printf("%spreviously allocated by thread T%d%s here:%s\n", d.Allocation(),
413 alloc_thread->tid,
414 ThreadNameWithParenthesis(alloc_thread, tname, sizeof(tname)),
415 d.Default());
416 } else {
417 Printf("%sallocated by thread T%d%s here:%s\n", d.Allocation(),
418 alloc_thread->tid,
419 ThreadNameWithParenthesis(alloc_thread, tname, sizeof(tname)),
420 d.Default());
421 }
422 alloc_stack.Print();
423 DescribeThread(GetCurrentThread());
424 if (free_thread) DescribeThread(free_thread);
425 DescribeThread(alloc_thread);
426}
427
428AddressDescription::AddressDescription(uptr addr, uptr access_size,
429 bool shouldLockThreadRegistry) {
430 if (GetShadowAddressInformation(addr, &data.shadow)) {
431 data.kind = kAddressKindShadow;
432 return;
433 }
434 if (GetHeapAddressInformation(addr, access_size, &data.heap)) {
435 data.kind = kAddressKindHeap;
436 return;
437 }
438
439 bool isStackMemory = false;
440 if (shouldLockThreadRegistry) {
441 ThreadRegistryLock l(&asanThreadRegistry());
442 isStackMemory = GetStackAddressInformation(addr, access_size, &data.stack);
443 } else {
444 isStackMemory = GetStackAddressInformation(addr, access_size, &data.stack);
445 }
446 if (isStackMemory) {
447 data.kind = kAddressKindStack;
448 return;
449 }
450
451 if (GetGlobalAddressInformation(addr, access_size, &data.global)) {
452 data.kind = kAddressKindGlobal;
453 return;
454 }
455 data.kind = kAddressKindWild;
456 addr = 0;
Value stored to 'addr' is never read
457}
458
459void PrintAddressDescription(uptr addr, uptr access_size,
460 const char *bug_type) {
461 ShadowAddressDescription shadow_descr;
462 if (GetShadowAddressInformation(addr, &shadow_descr)) {
463 shadow_descr.Print();
464 return;
465 }
466
467 GlobalAddressDescription global_descr;
468 if (GetGlobalAddressInformation(addr, access_size, &global_descr)) {
469 global_descr.Print(bug_type);
470 return;
471 }
472
473 StackAddressDescription stack_descr;
474 if (GetStackAddressInformation(addr, access_size, &stack_descr)) {
475 stack_descr.Print();
476 return;
477 }
478
479 HeapAddressDescription heap_descr;
480 if (GetHeapAddressInformation(addr, access_size, &heap_descr)) {
481 heap_descr.Print();
482 return;
483 }
484
485 // We exhausted our possibilities. Bail out.
486 Printf(
487 "AddressSanitizer can not describe address in more detail "
488 "(wild memory access suspected).\n");
489}
490} // namespace __asan