google / sanitizers

AddressSanitizer, ThreadSanitizer, MemorySanitizer
Other
11.55k stars 1.04k forks source link

hwasan false positive when exception throws #1800

Open nunojpg opened 2 months ago

nunojpg commented 2 months ago

Possibly related to #1791.

#include <fstream>
void func()
{
    std::ifstream file("a");
    throw std::runtime_error("b");
}
int main()
{
    try {
        func();
    } catch (...) {
    }
    std::ofstream f("c");
    f << 10;
    return 0;
}

Compiler: aarch64-buildroot-linux-gnu-g++.br_real (Buildroot 2024.08) 14.2.0 Options: g -O0 -fsanitize=hwaddress

==2559==ERROR: HWAddressSanitizer: tag-mismatch on address 0xffffda54ac70 at pc 0xffffb5b7fa28
READ of size 256 at 0xffffda54ac70 tags: 00/9f (ptr/mem) in thread T0
    #0 0xffffb5b7fa28 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) (/opt/abcd/lib/libhwasan.so.0+0x2aa28)
    #1 0xffffb59df90c in std::ctype<char>::_M_widen_init() const (/lib64/libstdc++.so.6+0xd690c)
    #2 0xffffb5a43aa8 in std::ostream& std::ostream::_M_insert<long>(long) (/lib64/libstdc++.so.6+0x13aaa8)
    #3 0xaaaae0d5b1cc in main buildroot/build_debug/main.cpp:14
    #4 0xffffb56f3328  (/lib64/libc.so.6+0x2c328)
    #5 0xffffb56f3404 in __libc_start_main (/lib64/libc.so.6+0x2c404)
    #6 0xaaaae0d5af2c in _start (/tmp/a.out+0xf2c)

Cause: stack tag-mismatch
Address 0xffffda54ac70 is located in stack of thread T0
Thread: T0 0xeffe00002000 stack: [0xffffd9d4c000,0xffffda54c000) sz: 8388608 tls: [0xffffb56c6120,0xffffb56c6fe0)
Previously allocated frames:
Memory tags around the buggy address (one tag corresponds to 16 bytes):
  0xffffda54a400: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54a500: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54a600: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54a700: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54a800: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54a900: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54aa00: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54ab00: 00  00  00  00  00  00  00  00  9f  9f  9f  9f  9f  9f  9f  9f 
=>0xffffda54ac00: 9f  9f  9f  9f  9f  9f  9f [9f] 9f  9f  9f  9f  9f  9f  9f  9f 
  0xffffda54ad00: 9f  9f  9f  9f  9f  9f  9f  9f  9f  9e  00  00  00  95  95  95 
  0xffffda54ae00: 95  95  95  95  95  95  95  95  95  95  95  95  95  95  95  95 
  0xffffda54af00: 95  95  95  95  95  95  95  95  95  95  95  95  95  95  94  00 
  0xffffda54b000: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54b100: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54b200: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54b300: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
  0xffffda54b400: 00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 
Tags for short granules around the buggy address (one tag corresponds to 16 bytes):
  0xffffda54ab00: ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  .. 
=>0xffffda54ac00: ..  ..  ..  ..  ..  ..  .. [..] ..  ..  ..  ..  ..  ..  ..  .. 
  0xffffda54ad00: ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  ..  .. 
See https://clang.llvm.org/docs/HardwareAssistedAddressSanitizerDesign.html#short-granules for a description of short granule tags
SUMMARY: HWAddressSanitizer: tag-mismatch (/opt/abcd/lib/libhwasan.so.0+0x2aa28) in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long)