[Bug c/107963] New: Support __attribute__((disable_sanitizer_instrumentation))

[Bug c/107963] New: Support __attribute__((disable_sanitizer_instrumentation))

[i at maskray dot me]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107963

            Bug ID: 107963
           Summary: Support
                    __attribute__((disable_sanitizer_instrumentation))
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: i at maskray dot me
  Target Milestone: ---

Clang introduced the attribute in https://reviews.llvm.org/D108029 (2021-08).
It disables instrumentations for all kinds of sanitizers.
For non-memory sanitizers, it's like the union of all available
no_sanitize("xxx").
For msan, it disables all instrumentations, therefore the following function
does not unpoison the shadow for *a, which may lead to a false positive for a
subsequent function
(https://clang.llvm.org/docs/MemorySanitizer.html#attribute-disable-sanitizer-instrumentation).
That said, such functionality is useful in some scenarios, e.g. `noinstr` in
the Linux kernel
(https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9b448bc25b776daab3215393c3ce6953dd3bb8ad)

__attribute__((disable_sanitizer_instrumentation)) int foo(int *a) {
  *a = 42;
  return *a;
}

[Bug sanitizer/107963] Support __attribute__((disable_sanitizer_instrumentation))

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107963

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
https://gcc.gnu.org/pipermail/gcc/2021-November/237787.html

If I read this correctly, there is no reason for a new attribute for gcc.

[Bug sanitizer/107963] Support __attribute__((disable_sanitizer_instrumentation))

[sam at gentoo dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107963

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

--- Comment #2 from Sam James <sam at gentoo dot org> ---
(In reply to Andrew Pinski from comment #1)
> https://gcc.gnu.org/pipermail/gcc/2021-November/237787.html
> 
> If I read this correctly, there is no reason for a new attribute for gcc.

Sounds like a possible documentation issue then.

[Bug sanitizer/107963] Support __attribute__((disable_sanitizer_instrumentation))

[i at maskray dot me]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107963

--- Comment #3 from Fangrui Song <i at maskray dot me> ---
GCC doesn't implement -fsanitize=memory.
In the absence of it, __attribute__((disable_sanitizer_instrumentation)) is
like __attribute__((no_sanitize("all"))).

When -fsanitize=memory is implemented, the two attribute will be different.

[Bug sanitizer/107963] Support __attribute__((disable_sanitizer_instrumentation))

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107963

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Fangrui Song from comment #3)
> GCC doesn't implement -fsanitize=memory.
> In the absence of it, __attribute__((disable_sanitizer_instrumentation)) is
> like __attribute__((no_sanitize("all"))).
> 
> When -fsanitize=memory is implemented, the two attribute will be different.

Why do you think GCC will implement no_sanitize that way. It already didn't
implement  no_sanitize  that way for -fsanitize=thread too.

[Bug sanitizer/107963] Support __attribute__((disable_sanitizer_instrumentation))

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107963

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WONTFIX
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Yep, that would just be confusing.  If "not unpoison the shadow for *a" is
useful and no_sanitize("all") shouldn't cover that then no_unpoison_shadow
would have been better.