[Bug sanitizer/102911] New: AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[Bug sanitizer/102911] New: AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

            Bug ID: 102911
           Summary: AddressSanitizer: CHECK failed:
                    asan_malloc_linux.cpp:46
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: hjl.tools at gmail dot com
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
  Target Milestone: ---

On Fedora 35/x86-64 with glibc 2.34, I got

[hjl@gnu-skx-1 gcc]$
/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/gcc/xgcc
-B/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/gcc/
/export/gnu/import/git/sources/gcc/gcc/testsuite/c-c++-common/asan/alloca_detect_custom_size.c
-m32
-B/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/
-B/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/asan/
-L/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/asan/.libs
-fsanitize=address -g
-I/export/gnu/import/git/sources/gcc/gcc/testsuite/../../libsanitizer/include
-fdiagnostics-plain-output    -O0    -lm  -o
./alloca_detect_custom_size.exe.bad
[hjl@gnu-skx-1 gcc]$ export
LD_LIBRARY_PATH=/export/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/asan/.libs
[hjl@gnu-skx-1 gcc]$ ./alloca_detect_custom_size.exe.bad
=================================================================
==3485262==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address
0xffe51f80 at pc 0x08049279 bp 0xffe51e98 sp 0xffe51e8c
WRITE of size 1 at 0xffe51f80 thread T0
    #0 0x8049278 in foo
/export/gnu/import/git/sources/gcc/gcc/testsuite/c-c++-common/asan/alloca_detect_custom_size.c:16
    #1 0x80492dc in main
/export/gnu/import/git/sources/gcc/gcc/testsuite/c-c++-common/asan/alloca_detect_custom_size.c:20
    #2 0xf7653468 in __libc_start_call_main (/lib/libc.so.6+0x25468)
    #3 0xf765355f in __libc_start_main@@GLIBC_2.34 (/lib/libc.so.6+0x2555f)
    #4 0x80490eb in _start
(/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/gcc/testsuite/gcc/alloca_detect_custom_size.exe.bad+0x80490eb)

Address 0xffe51f80 is located in stack of thread T0
SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow
/export/gnu/import/git/sources/gcc/gcc/testsuite/c-c++-common/asan/alloca_detect_custom_size.c:16
in foo
Shadow bytes around the buggy address:
  0x3ffca3a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x3ffca3b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x3ffca3c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x3ffca3d0: 00 00 00 00 00 00 00 00 ca ca ca ca 00 00 00 00
  0x3ffca3e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x3ffca3f0:[cb]cb cb cb 00 00 00 00 00 00 00 00 00 00 00 00
  0x3ffca400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x3ffca410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x3ffca420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x3ffca430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x3ffca440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3485262==ABORTING
[hjl@gnu-skx-1 gcc]$ export
LD_LIBRARY_PATH=/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/asan/.libs
[hjl@gnu-skx-1 gcc]$ ./alloca_detect_custom_size.exe.bad
AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46
"((allocated_for_dlsym)) < ((kDlsymAllocPoolSize))" (0x421, 0x400)
(tid=3485264)
    <empty stack>

[hjl@gnu-skx-1 gcc]$ ls -l /export/build
lrwxrwxrwx 1 hjl hjl 15 Dec  4  2018 /export/build -> users/hjl/build
[hjl@gnu-skx-1 gcc]$ 

It is related to

https://bugs.llvm.org/show_bug.cgi?id=33206

[Bug sanitizer/102911] AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-10-24
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
Also see:

https://bugs.llvm.org/show_bug.cgi?id=52278

[Bug sanitizer/102911] AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

--- Comment #2 from H.J. Lu <hjl.tools at gmail dot com> ---
The backtrace:

(gdb) bt
#0  __sanitizer::CheckFailed (
    file=0xf7b17af4
"/export/gnu/import/git/sources/gcc/libsanitizer/asan/asan_malloc_linux.cpp",
line=46, 
    cond=0xf7b17ac0 "((allocated_for_dlsym)) < ((kDlsymAllocPoolSize))", 
    v1=1057, v2=1024)
    at
/export/gnu/import/git/sources/gcc/libsanitizer/sanitizer_common/sanitizer_termination.cpp:68
#1  0xf7ababf3 in AllocateFromLocalPool (size_in_bytes=<optimized out>)
    at
/export/gnu/import/git/sources/gcc/libsanitizer/asan/asan_malloc_linux.cpp:46
#2  __interceptor_malloc (size=<optimized out>)
    at
/export/gnu/import/git/sources/gcc/libsanitizer/asan/asan_malloc_linux.cpp:127
#3  0xf7fe2475 in malloc (size=155) at ../include/rtld-malloc.h:56
#4  __GI__dl_exception_create_format (exception=exception@entry=0xffffccc4, 
    objname=0xf7fc0550
"/export/users/hjl/build/gnu/tools-build/gcc-debug/build-x86_64-linux/x86_64-pc-linux-gnu/32/libsanitizer/asan/.libs/libasan.so.8", 
    fmt=fmt@entry=0xf7ff2f11 "undefined symbol: %s%s%s") at dl-exception.c:157
#5  0xf7fd508b in _dl_lookup_symbol_x (undef_name=0xf7b14d64 "crypt_r", 
    undef_map=0xf7fc05e0, ref=<optimized out>, symbol_scope=<optimized out>, 
    version=0x0, type_class=0, flags=0, skip_map=0xf7fc05e0) at dl-lookup.c:877
#6  0xf7960553 in do_sym (handle=<optimized out>, name=0xf7b14d64 "crypt_r", 
    who=who@entry=
--Type <RET> for more, q to quit, c to continue without paging--
    igned long*, unsigned long, unsigned long)+38>, vers=0x0, flags=2) at
dl-sym.c:146
#7  0xf79609f4 in _dl_sym (handle=<optimized out>, name=<optimized out>, 
    who=0xf7af8b86 <__interception::InterceptFunction(char const*, unsigned
long*, unsigned long, unsigned long)+38>) at dl-sym.c:195
#8  0xf786c617 in dlsym_doit (a=0xffffcf60) at dlsym.c:40
#9  0xf7960c28 in __GI__dl_catch_exception (exception=<optimized out>, 
    exception@entry=0xffffcea4, operate=<optimized out>, 
    operate@entry=0xf786c5f0 <dlsym_doit>, args=<optimized out>, 
    args@entry=0xffffcf60)
    at /export/ssd/git/gitlab/x86-glibc/elf/dl-error-skeleton.c:208
#10 0xf7960ce3 in __GI__dl_catch_error (objname=0xffffcf28, 
    errstring=0xffffcf2c, mallocedp=0xffffcf27, 
    operate=0xf786c5f0 <dlsym_doit>, args=0xffffcf60)
    at /export/ssd/git/gitlab/x86-glibc/elf/dl-error-skeleton.c:227
#11 0xf7fea102 in _rtld_catch_error (objname=0xffffcf28, errstring=0xffffcf2c, 
    mallocedp=0xffffcf27, operate=0xf786c5f0 <dlsym_doit>, args=0xffffcf60)
    at /export/ssd/git/gitlab/x86-glibc/elf/dl-error-skeleton.c:260
#12 0xf786bf1a in _dlerror_run (operate=<optimized out>, 
    operate@entry=0xf786c5f0 <dlsym_doit>, args=<optimized out>, 
    args@entry=0xffffcf60) at dlerror.c:138
#13 0xf786c696 in dlsym_implementation (dl_caller=<optimized out>, 
    name=0xf7b14d64 "crypt_r", handle=0xffffffff) at dlsym.c:54
#14 ___dlsym (handle=0xffffffff, name=0xf7b14d64 "crypt_r") at dlsym.c:68
#15 0xf7af8b86 in __interception::GetFuncAddr (wrapper_addr=4154798864, 
    name=0xf7b14d64 "crypt_r")
    at
/export/gnu/import/git/sources/gcc/libsanitizer/interception/interception_linux.cpp:42
#16 __interception::InterceptFunction (name=0xf7b14d64 "crypt_r", 
    ptr_to_real=0xf7b908d8 <__interception::real_crypt_r>, func=4154798864, 
    wrapper=4154798864)
    at
/export/gnu/import/git/sources/gcc/libsanitizer/interception/interception_linux.cpp:61
#17 0xf7ab6c1b in InitializeCommonInterceptors ()
    at
/export/gnu/import/git/sources/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:10463
#18 __asan::InitializeAsanInterceptors ()
    at
/export/gnu/import/git/sources/gcc/libsanitizer/asan/asan_interceptors.cp--Type
<RET> for more, q to quit, c to continue without paging--
p:619
#19 0xf7ac988e in __asan::AsanInitInternal ()
    at /export/gnu/import/git/sources/gcc/libsanitizer/asan/asan_rtl.cpp:444
#20 0xf7fdb29d in _dl_init (main_map=<optimized out>, argc=1, argv=0xffffd0e4, 
    env=0xffffd0ec) at dl-init.c:102
#21 0xf7fc90fa in _dl_start_user ()
   from
/export/build/gnu/tools-build/glibc-32bit-cet-gitlab/build-i686-linux/elf/ld-linux.so.2
(gdb) 

Is there a memory after glibc 2.33 which doesn't have this problem?

[Bug sanitizer/102911] AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by H.J. Lu <hjl@gcc.gnu.org>:

https://gcc.gnu.org/g:86289a4ff4768fab61f16372650fe85c37f9284e

commit r12-5225-g86289a4ff4768fab61f16372650fe85c37f9284e
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Fri Nov 12 22:23:45 2021 -0800

    libsanitizer: Merge with upstream

    Merged revision: 82bc6a094e85014f1891ef9407496f44af8fe442

    with the fix for PR sanitizer/102911

[Bug sanitizer/102911] AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

--- Comment #4 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed for GCC 12.

[Bug sanitizer/102911] AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
   Target Milestone|---                         |12.0
             Status|NEW                         |RESOLVED

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
.

[Bug sanitizer/102911] AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by H.J. Lu <hjl@gcc.gnu.org>:

https://gcc.gnu.org/g:8c0f58cd71ec3afcce5abf10c750ec494e88232b

commit r11-9454-g8c0f58cd71ec3afcce5abf10c750ec494e88232b
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Fri Dec 17 11:08:32 2021 -0800

    libsanitizer: Cherry-pick LLVM release/13.x commit d96358a28193

    Cherry-pick from LLVM release/13.x branch:

    commit d96358a2819399a2abb60ad3b26444ab7b4409cf
    Author: MichaŠGórny <mgorny@moritz.systems>
    Date:   Mon Dec 13 22:28:26 2021 +0100

        [compiler-rt] Increase kDlsymAllocPoolSize to fix test failures

        Increase kDlsymAllocPoolSize on the release branch as discussed on bug
        51620, as an alternative to backporting
        cb0e14ce6dcdd614a7207f4ce6fcf81a164471ab and its dependencies.
        The minimum size is 8192, as needed for the following test to pass:

          AddressSanitizer-i386-linux :: TestCases/Linux/long-object-path.cpp

        Fixes #51620

            PR sanitizer/102911
            * asan/asan_malloc_linux.cpp (kDlsymAllocPoolSize): Set it to
            8192 on Linux.

[Bug sanitizer/102911] AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by H.J. Lu <hjl@gcc.gnu.org>:

https://gcc.gnu.org/g:666eb85627e961db200dd5db639a1831d81188e1

commit r10-10408-g666eb85627e961db200dd5db639a1831d81188e1
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Fri Dec 17 11:08:32 2021 -0800

    libsanitizer: Cherry-pick LLVM release/13.x commit d96358a28193

    Cherry-pick from LLVM release/13.x branch:

    commit d96358a2819399a2abb60ad3b26444ab7b4409cf
    Author: MichaŠGórny <mgorny@moritz.systems>
    Date:   Mon Dec 13 22:28:26 2021 +0100

        [compiler-rt] Increase kDlsymAllocPoolSize to fix test failures

        Increase kDlsymAllocPoolSize on the release branch as discussed on bug
        51620, as an alternative to backporting
        cb0e14ce6dcdd614a7207f4ce6fcf81a164471ab and its dependencies.
        The minimum size is 8192, as needed for the following test to pass:

          AddressSanitizer-i386-linux :: TestCases/Linux/long-object-path.cpp

        Fixes #51620

            PR sanitizer/102911
            * asan/asan_malloc_linux.cpp (kDlsymAllocPoolSize): Set it to
            8192 on Linux.

    (cherry picked from commit 8c0f58cd71ec3afcce5abf10c750ec494e88232b)

[Bug sanitizer/102911] AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by H.J. Lu <hjl@gcc.gnu.org>:

https://gcc.gnu.org/g:ffe873471fb59dbe95a31afa089cfcac1a9327d4

commit r9-9918-gffe873471fb59dbe95a31afa089cfcac1a9327d4
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Fri Dec 17 11:08:32 2021 -0800

    libsanitizer: Cherry-pick LLVM release/13.x commit d96358a28193

    Cherry-pick from LLVM release/13.x branch:

    commit d96358a2819399a2abb60ad3b26444ab7b4409cf
    Author: MichaŠGórny <mgorny@moritz.systems>
    Date:   Mon Dec 13 22:28:26 2021 +0100

        [compiler-rt] Increase kDlsymAllocPoolSize to fix test failures

        Increase kDlsymAllocPoolSize on the release branch as discussed on bug
        51620, as an alternative to backporting
        cb0e14ce6dcdd614a7207f4ce6fcf81a164471ab and its dependencies.
        The minimum size is 8192, as needed for the following test to pass:

          AddressSanitizer-i386-linux :: TestCases/Linux/long-object-path.cpp

        Fixes #51620

            PR sanitizer/102911
            * asan/asan_malloc_linux.cc (kDlsymAllocPoolSize): Set it to
            8192 on Linux.

    (cherry picked from commit 8c0f58cd71ec3afcce5abf10c750ec494e88232b)

[Bug sanitizer/102911] AddressSanitizer: CHECK failed: asan_malloc_linux.cpp:46

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102911

--- Comment #9 from H.J. Lu <hjl.tools at gmail dot com> ---
Also fixed for GCC 11.3, 10.4 and 9.5.