google / sanitizers

AddressSanitizer, ThreadSanitizer, MemorySanitizer
Other
11.01k stars 998 forks source link

TestCases/stack-uas.c occasionally misclassified as stack-buffer-overflow #1723

Closed thurstond closed 4 months ago

thurstond commented 5 months ago

Found as test flakiness on buildbot: https://lab.llvm.org/buildbot/#/builders/269/builds/4202/steps/9/logs/stdio

Relevant CLs:

Output from buildbot:

FAIL: HWAddressSanitizer-aarch64 :: TestCases/stack-uas.c (420 of 5436)
******************** TEST 'HWAddressSanitizer-aarch64 :: TestCases/stack-uas.c' FAILED ********************
Exit Code: 1
Command Output (stderr):
--
RUN: at line 2: /b/sanitizer-aarch64-linux/build/build_gcc/./bin/clang    -Wthread-safety -Wthread-safety-reference -Wthread-safety-beta   -gline-tables-only -fsanitize=hwaddress -fuse-ld=lld -mllvm -hwasan-globals -mllvm -hwasan-use-short-granules -mllvm -hwasan-instrument-landing-pads=0 -mllvm -hwasan-instrument-personality-functions -O0 -g /b/sanitizer-aarch64-linux/build/llvm-project/compiler-rt/test/hwasan/TestCases/stack-uas.c -o /b/sanitizer-aarch64-linux/build/build_gcc/runtimes/runtimes-bins/compiler-rt/test/hwasan/AARCH64/TestCases/Output/stack-uas.c.tmp && not  /b/sanitizer-aarch64-linux/build/build_gcc/runtimes/runtimes-bins/compiler-rt/test/hwasan/AARCH64/TestCases/Output/stack-uas.c.tmp 2>&1 | FileCheck /b/sanitizer-aarch64-linux/build/llvm-project/compiler-rt/test/hwasan/TestCases/stack-uas.c
+ /b/sanitizer-aarch64-linux/build/build_gcc/./bin/clang -Wthread-safety -Wthread-safety-reference -Wthread-safety-beta -gline-tables-only -fsanitize=hwaddress -fuse-ld=lld -mllvm -hwasan-globals -mllvm -hwasan-use-short-granules -mllvm -hwasan-instrument-landing-pads=0 -mllvm -hwasan-instrument-personality-functions -O0 -g /b/sanitizer-aarch64-linux/build/llvm-project/compiler-rt/test/hwasan/TestCases/stack-uas.c -o /b/sanitizer-aarch64-linux/build/build_gcc/runtimes/runtimes-bins/compiler-rt/test/hwasan/AARCH64/TestCases/Output/stack-uas.c.tmp
+ FileCheck /b/sanitizer-aarch64-linux/build/llvm-project/compiler-rt/test/hwasan/TestCases/stack-uas.c
+ not /b/sanitizer-aarch64-linux/build/build_gcc/runtimes/runtimes-bins/compiler-rt/test/hwasan/AARCH64/TestCases/Output/stack-uas.c.tmp
/b/sanitizer-aarch64-linux/build/llvm-project/compiler-rt/test/hwasan/TestCases/stack-uas.c:73:12: error: CHECK: expected string not found in input
 // CHECK: Cause: use-after-scope
           ^
<stdin>:14:38: note: scanning from here
Potentially referenced stack objects:
                                     ^
<stdin>:15:1: note: possible intended match here
Cause: stack-buffer-overflow
^
Input file: <stdin>
Check file: /b/sanitizer-aarch64-linux/build/llvm-project/compiler-rt/test/hwasan/TestCases/stack-uas.c
-dump-input=help explains the following input dump.
Input was:
<<<<<<
            .
            .
            .
            9:  
           10: Cause: stack tag-mismatch 
           11: Address 0xffffc38ff8f0 is located in stack of thread T0 
           12: Thread: T0 0xeffe00002000 stack: [0xffffc3101000,0xffffc3901000) sz: 8388608 tls: [0xffff9037a700,0xffff9037b5a0) 
           13:  
           14: Potentially referenced stack objects: 
check:73'0                                          X error: no match found
           15: Cause: stack-buffer-overflow 
check:73'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
check:73'1     ?                             possible intended match
           16: 0xffffc38ff8f0 is located 281473962735616 bytes after a 2048-byte local variable zzz [0xfffffffffffff8f0,0x0000000000f0) in buggy /b/sanitizer-aarch64-linux/build/llvm-project/compiler-rt/test/hwasan/TestCases/stack-uas.c:44 
check:73'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           17:  
check:73'0     ~
           18:  
check:73'0     ~
           19:  
check:73'0     ~
           20: Memory tags around the buggy address (one tag corresponds to 16 bytes): 
check:73'0     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            .
            .
            .
>>>>>>