[DevSAN] Fix issue where shadow value may be overwritten

libdevice/sanitizer/asan_rtl.cpp

@@ -485,7 +485,7 @@ void ReportAccessError(uptr poisoned_addr, uint32_t as, bool is_recover,
   // Check Error Type
   auto *shadow_address =
       (__SYCL_GLOBAL__ s8 *)MemToShadow(poisoned_addr, as, debug);
-  int shadow_value = *shadow_address;
+  s8 shadow_value = *shadow_address;
   if (shadow_value > 0) {
     shadow_value = *(shadow_address + 1);
   }
@@ -531,7 +531,7 @@ void ReportMisalignError(uptr addr, uint32_t as, bool is_recover,
   while (*shadow >= 0) {
     ++shadow;
   }
-  int shadow_value = *shadow;
+  s8 shadow_value = *shadow;
 
   SaveReport(ErrorType::MISALIGNED, GetMemoryTypeByShadowValue(shadow_value),
              is_recover, debug);
@@ -564,7 +564,7 @@ inline int IsAddressPoisoned(uptr a, uint32_t as, size_t size,
                              const DebugInfo *debug) {
   auto *shadow_address = (__SYCL_GLOBAL__ s8 *)MemToShadow(a, as, debug);
   if (shadow_address) {
-    auto shadow_value = *shadow_address;
+    s8 shadow_value = *shadow_address;
     if (shadow_value) {
       if (size == ASAN_SHADOW_GRANULARITY)
         return true;

unified-runtime/source/loader/layers/sanitizer/asan/asan_interceptor.cpp

@@ -21,6 +21,7 @@
 #include "sanitizer_common/sanitizer_options.hpp"
 #include "sanitizer_common/sanitizer_stacktrace.hpp"
 #include "sanitizer_common/sanitizer_utils.hpp"
+#include <numeric>
 
 namespace ur_sanitizer_layer {
 namespace asan {
@@ -339,22 +340,22 @@ AsanInterceptor::enqueueAllocInfo(std::shared_ptr<DeviceInfo> &DeviceInfo,
                                   ur_queue_handle_t Queue,
                                   std::shared_ptr<AllocInfo> &AI) {
   if (AI->IsReleased) {
-    int ShadowByte;
+    const int8_t *ShadowByte;
     switch (AI->Type) {
     case AllocType::HOST_USM:
-      ShadowByte = kUsmHostDeallocatedMagic;
+      ShadowByte = &kUsmHostDeallocatedMagic;
       break;
     case AllocType::DEVICE_USM:
-      ShadowByte = kUsmDeviceDeallocatedMagic;
+      ShadowByte = &kUsmDeviceDeallocatedMagic;
       break;
     case AllocType::SHARED_USM:
-      ShadowByte = kUsmSharedDeallocatedMagic;
+      ShadowByte = &kUsmSharedDeallocatedMagic;
       break;
     case AllocType::MEM_BUFFER:
-      ShadowByte = kMemBufferDeallocatedMagic;
+      ShadowByte = &kMemBufferDeallocatedMagic;
       break;
     default:
-      ShadowByte = 0xff;
+      ShadowByte = &kUnknownMagic;
       assert(false && "Unknow AllocInfo Type");
     }
     UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(Queue, AI->AllocBegin,
@@ -363,39 +364,45 @@ AsanInterceptor::enqueueAllocInfo(std::shared_ptr<DeviceInfo> &DeviceInfo,
   }
 
   // Init zero
+  static const int8_t Zero = 0;
   UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(Queue, AI->AllocBegin,
-                                                  AI->AllocSize, 0));
+                                                  AI->AllocSize, &Zero));
 
   uptr TailBegin = RoundUpTo(AI->UserEnd, ASAN_SHADOW_GRANULARITY);
   uptr TailEnd = AI->AllocBegin + AI->AllocSize;
 
   // User tail
   if (TailBegin != AI->UserEnd) {
+    static const std::array<int8_t, 16> TailMagic = [] {
+      std::array<int8_t, 16> a{};
+      std::iota(a.begin(), a.end(), 0);
+      return a;
+    }();
     auto Value =
         AI->UserEnd - RoundDownTo(AI->UserEnd, ASAN_SHADOW_GRANULARITY);
     UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(Queue, AI->UserEnd, 1,
-                                                    static_cast<u8>(Value)));
+                                                    &TailMagic[Value]));
   }
 
-  int ShadowByte;
+  const int8_t *ShadowByte;
   switch (AI->Type) {
   case AllocType::HOST_USM:
-    ShadowByte = kUsmHostRedzoneMagic;
+    ShadowByte = &kUsmHostRedzoneMagic;
     break;
   case AllocType::DEVICE_USM:
-    ShadowByte = kUsmDeviceRedzoneMagic;
+    ShadowByte = &kUsmDeviceRedzoneMagic;
     break;
   case AllocType::SHARED_USM:
-    ShadowByte = kUsmSharedRedzoneMagic;
+    ShadowByte = &kUsmSharedRedzoneMagic;
     break;
   case AllocType::MEM_BUFFER:
-    ShadowByte = kMemBufferRedzoneMagic;
+    ShadowByte = &kMemBufferRedzoneMagic;
     break;
   case AllocType::DEVICE_GLOBAL:
-    ShadowByte = kDeviceGlobalRedzoneMagic;
+    ShadowByte = &kDeviceGlobalRedzoneMagic;
     break;
   default:
-    ShadowByte = 0xff;
+    ShadowByte = &kUnknownMagic;
     assert(false && "Unknow AllocInfo Type");
   }
 

unified-runtime/source/loader/layers/sanitizer/asan/asan_libdevice.hpp

@@ -88,24 +88,27 @@ constexpr uint64_t ASAN_PRIVATE_SIZE = 0xffffffULL + 1;
 
 // These magic values are written to shadow for better error
 // reporting.
-constexpr int kUsmDeviceRedzoneMagic = (char)0x81;
-constexpr int kUsmHostRedzoneMagic = (char)0x82;
-constexpr int kUsmSharedRedzoneMagic = (char)0x83;
-constexpr int kMemBufferRedzoneMagic = (char)0x84;
-constexpr int kDeviceGlobalRedzoneMagic = (char)0x85;
-constexpr int kNullPointerRedzoneMagic = (char)0x86;
+constexpr int8_t kUsmDeviceRedzoneMagic = (int8_t)0x81;
+constexpr int8_t kUsmHostRedzoneMagic = (int8_t)0x82;
+constexpr int8_t kUsmSharedRedzoneMagic = (int8_t)0x83;
+constexpr int8_t kMemBufferRedzoneMagic = (int8_t)0x84;
+constexpr int8_t kDeviceGlobalRedzoneMagic = (int8_t)0x85;
+constexpr int8_t kNullPointerRedzoneMagic = (int8_t)0x86;
 
-constexpr int kUsmDeviceDeallocatedMagic = (char)0x91;
-constexpr int kUsmHostDeallocatedMagic = (char)0x92;
-constexpr int kUsmSharedDeallocatedMagic = (char)0x93;
-constexpr int kMemBufferDeallocatedMagic = (char)0x93;
+constexpr int8_t kUsmDeviceDeallocatedMagic = (int8_t)0x91;
+constexpr int8_t kUsmHostDeallocatedMagic = (int8_t)0x92;
+constexpr int8_t kUsmSharedDeallocatedMagic = (int8_t)0x93;
+constexpr int8_t kMemBufferDeallocatedMagic = (int8_t)0x93;
 
-constexpr int kSharedLocalRedzoneMagic = (char)0xa1;
+constexpr int8_t kSharedLocalRedzoneMagic = (int8_t)0xa1;
 
 // Same with host ASan stack
-const int kPrivateLeftRedzoneMagic = (char)0xf1;
-const int kPrivateMidRedzoneMagic = (char)0xf2;
-const int kPrivateRightRedzoneMagic = (char)0xf3;
+const int8_t kPrivateLeftRedzoneMagic = (int8_t)0xf1;
+const int8_t kPrivateMidRedzoneMagic = (int8_t)0xf2;
+const int8_t kPrivateRightRedzoneMagic = (int8_t)0xf3;
+
+// Unknown shadow value
+constexpr int8_t kUnknownMagic = (int8_t)0xff;
 
 constexpr auto kSPIR_AsanDeviceGlobalMetadata = "__AsanDeviceGlobalMetadata";
 constexpr auto kSPIR_AsanSpirKernelMetadata = "__AsanKernelMetadata";

unified-runtime/source/loader/layers/sanitizer/asan/asan_shadow.cpp

@@ -47,7 +47,7 @@ ur_result_t ShadowMemoryCPU::Setup() {
   // For CPU, we use a typical page size of 4K bytes.
   constexpr size_t NullptrRedzoneSize = 4096;
   auto URes =
-      EnqueuePoisonShadow({}, 0, NullptrRedzoneSize, kNullPointerRedzoneMagic);
+      EnqueuePoisonShadow({}, 0, NullptrRedzoneSize, &kNullPointerRedzoneMagic);
   if (URes != UR_RESULT_SUCCESS) {
     UR_LOG_L(getContext()->logger, ERR,
              "EnqueuePoisonShadow(NullPointerRZ): {}", URes);
@@ -74,7 +74,8 @@ uptr ShadowMemoryCPU::MemToShadow(uptr Ptr) {
 }
 
 ur_result_t ShadowMemoryCPU::EnqueuePoisonShadow(ur_queue_handle_t, uptr Ptr,
-                                                 uptr Size, u8 Value) {
+                                                 uptr Size,
+                                                 const int8_t *Value) {
   if (Size == 0) {
     return UR_RESULT_SUCCESS;
   }
@@ -85,8 +86,8 @@ ur_result_t ShadowMemoryCPU::EnqueuePoisonShadow(ur_queue_handle_t, uptr Ptr,
   UR_LOG_L(getContext()->logger, DEBUG,
            "EnqueuePoisonShadow(addr={}, count={}, value={})",
            (void *)ShadowBegin, ShadowEnd - ShadowBegin + 1,
-           (void *)(size_t)Value);
-  memset((void *)ShadowBegin, Value, ShadowEnd - ShadowBegin + 1);
+           (void *)(size_t)*Value);
+  memset((void *)ShadowBegin, *Value, ShadowEnd - ShadowBegin + 1);
 
   return UR_RESULT_SUCCESS;
 }
@@ -118,7 +119,7 @@ ur_result_t ShadowMemoryGPU::Setup() {
                                     << ASAN_SHADOW_SCALE;
   ManagedQueue Queue(Context, Device);
   Result = EnqueuePoisonShadow(Queue, 0, NullptrRedzoneSize,
-                               kNullPointerRedzoneMagic);
+                               &kNullPointerRedzoneMagic);
   if (Result != UR_RESULT_SUCCESS) {
     UR_LOG_L(getContext()->logger, ERR,
              "EnqueuePoisonShadow(NullPointerRZ): {}", Result);
@@ -168,7 +169,7 @@ ur_result_t ShadowMemoryGPU::Destory() {
 
 ur_result_t ShadowMemoryGPU::EnqueuePoisonShadow(ur_queue_handle_t Queue,
                                                  uptr Ptr, uptr Size,
-                                                 u8 Value) {
+                                                 const int8_t *Value) {
   if (Size == 0) {
     return UR_RESULT_SUCCESS;
   }
@@ -180,7 +181,7 @@ ur_result_t ShadowMemoryGPU::EnqueuePoisonShadow(ur_queue_handle_t Queue,
   UR_LOG_L(getContext()->logger, DEBUG,
            "EnqueuePoisonShadow(addr={}, count={}, value={})",
            (void *)ShadowBegin, ShadowEnd - ShadowBegin + 1,
-           (void *)(size_t)Value);
+           (void *)(size_t)*Value);
 
   // Make sure the shadow memory is mapped to physical memory
   {
@@ -216,7 +217,7 @@ ur_result_t ShadowMemoryGPU::EnqueuePoisonShadow(ur_queue_handle_t Queue,
                  (void *)MappedPtr, (void *)(MappedPtr + PageSize - 1));
 
         // Initialize to zero
-        URes = EnqueueUSMSet(Queue, (void *)MappedPtr, (char)0, PageSize);
+        URes = EnqueueUSMSetZero(Queue, (void *)MappedPtr, PageSize);
         if (URes != UR_RESULT_SUCCESS) {
           UR_LOG_L(getContext()->logger, ERR, "EnqueueUSMBlockingSet(): {}",
                    URes);
@@ -240,7 +241,7 @@ ur_result_t ShadowMemoryGPU::EnqueuePoisonShadow(ur_queue_handle_t Queue,
     UR_LOG_L(getContext()->logger, ERR,
              "EnqueuePoisonShadow(addr={}, count={}, value={}): {}",
              (void *)ShadowBegin, ShadowEnd - ShadowBegin + 1,
-             (void *)(size_t)Value, URes);
+             (void *)(size_t)*Value, URes);
     return URes;
   }
 
@@ -270,8 +271,8 @@ ur_result_t ShadowMemoryGPU::AllocLocalShadow(ur_queue_handle_t Queue,
                          AllocType::DEVICE_USM, (void **)&LocalShadowOffset));
 
     // Initialize shadow memory
-    ur_result_t URes = EnqueueUSMSet(Queue, (void *)LocalShadowOffset, (char)0,
-                                     RequiredShadowSize);
+    ur_result_t URes =
+        EnqueueUSMSetZero(Queue, (void *)LocalShadowOffset, RequiredShadowSize);
     if (URes != UR_RESULT_SUCCESS) {
       UR_CALL(getContext()->urDdiTable.USM.pfnFree(Context,
                                                    (void *)LocalShadowOffset));
@@ -340,8 +341,8 @@ ur_result_t ShadowMemoryGPU::AllocPrivateShadow(ur_queue_handle_t Queue,
                                   nullptr, nullptr, AllocType::DEVICE_USM,
                                   (void **)&PrivateShadowOffset));
       LastPrivateShadowAllocedSize = NewPrivateShadowSize;
-      UR_CALL_THROWS(EnqueueUSMSet(Queue, (void *)PrivateShadowOffset, (char)0,
-                                   NewPrivateShadowSize));
+      UR_CALL_THROWS(EnqueueUSMSetZero(Queue, (void *)PrivateShadowOffset,
+                                       NewPrivateShadowSize));
       ContextInfo->Stats.UpdateShadowMalloced(NewPrivateShadowSize);
     }
 

unified-runtime/source/loader/layers/sanitizer/asan/asan_shadow.hpp

@@ -48,7 +48,7 @@ struct ShadowMemory {
   virtual uptr MemToShadow(uptr Ptr) = 0;
 
   virtual ur_result_t EnqueuePoisonShadow(ur_queue_handle_t Queue, uptr Ptr,
-                                          uptr Size, u8 Value) = 0;
+                                          uptr Size, const int8_t *Value) = 0;
 
   virtual size_t GetShadowSize() = 0;
 
@@ -80,7 +80,7 @@ struct ShadowMemoryCPU final : public ShadowMemory {
   uptr MemToShadow(uptr Ptr) override;
 
   ur_result_t EnqueuePoisonShadow(ur_queue_handle_t Queue, uptr Ptr, uptr Size,
-                                  u8 Value) override;
+                                  const int8_t *Value) override;
 
   size_t GetShadowSize() override { return 0x80000000000ULL; }
 
@@ -106,7 +106,7 @@ struct ShadowMemoryGPU : public ShadowMemory {
 
   ur_result_t Destory() override;
   ur_result_t EnqueuePoisonShadow(ur_queue_handle_t Queue, uptr Ptr, uptr Size,
-                                  u8 Value) override final;
+                                  const int8_t *Value) override final;
 
   ur_result_t AllocLocalShadow(ur_queue_handle_t Queue, uint32_t NumWG,
                                uptr &Begin, uptr &End) override final;

unified-runtime/source/loader/layers/sanitizer/msan/msan_ddi.cpp

@@ -652,8 +652,8 @@ ur_result_t urMemBufferCreate(
       // Update shadow memory
       std::shared_ptr<DeviceInfo> DeviceInfo =
           getMsanInterceptor()->getDeviceInfo(hDevice);
-      UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(InternalQueue,
-                                                      (uptr)Handle, size, 0));
+      UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(
+          InternalQueue, (uptr)Handle, size, &kMemInitializedMagic));
     }
   }
 
@@ -1552,8 +1552,8 @@ ur_result_t urEnqueueUSMFill(
     uptr MemShadow = DeviceInfo->Shadow->MemToShadow((uptr)pMem);
 
     ur_event_handle_t Event = nullptr;
-    UR_CALL(EnqueueUSMSet(hQueue, (void *)MemShadow, (char)0, size, 0, nullptr,
-                          &Event));
+    UR_CALL(
+        EnqueueUSMSetZero(hQueue, (void *)MemShadow, size, 0, nullptr, &Event));
     Events.push_back(Event);
   }
 
@@ -1645,8 +1645,8 @@ ur_result_t urEnqueueUSMMemcpy(
     {
       const auto DstShadow = DstDI->Shadow->MemToShadow((uptr)pDst);
       ur_event_handle_t Event = nullptr;
-      UR_CALL(EnqueueUSMSet(hQueue, (void *)DstShadow, (char)0, size, 0,
-                            nullptr, &Event));
+      UR_CALL(EnqueueUSMSetZero(hQueue, (void *)DstShadow, size, 0, nullptr,
+                                &Event));
       Events.push_back(Event);
     }
   }

unified-runtime/source/loader/layers/sanitizer/msan/msan_interceptor.cpp

@@ -107,12 +107,14 @@ ur_result_t MsanInterceptor::allocateMemory(ur_context_handle_t Context,
 
   // Update shadow memory
   auto EnqueuePoison = [&](const std::vector<ur_device_handle_t> &Devices) {
-    u8 Value = DontCheckHostOrSharedUSM ? 0 : 0xff;
     for (ur_device_handle_t Device : Devices) {
       ManagedQueue Queue(Context, Device);
       std::shared_ptr<DeviceInfo> DI = getDeviceInfo(Device);
       DI->Shadow->EnqueuePoisonShadowWithOrigin(Queue, (uptr)Allocated, Size,
-                                                Value, HeapOrigin.rawId());
+                                                DontCheckHostOrSharedUSM
+                                                    ? &kMemInitializedMagic
+                                                    : &kMemUninitializedMagic,
+                                                HeapOrigin.rawId());
     }
   };
   if (Device) { // shared/device USM
@@ -310,8 +312,8 @@ MsanInterceptor::registerDeviceGlobals(ur_program_handle_t Program) {
            MsanShadowMemoryPVC::IsDeviceUSM(GVInfo.Addr)) ||
           (DeviceInfo->Type == DeviceType::GPU_DG2 &&
            MsanShadowMemoryDG2::IsDeviceUSM(GVInfo.Addr))) {
-        UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(Queue, GVInfo.Addr,
-                                                        GVInfo.Size, 0));
+        UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(
+            Queue, GVInfo.Addr, GVInfo.Size, &kMemInitializedMagic));
         ContextInfo->CleanShadowSize =
             std::max(ContextInfo->CleanShadowSize, GVInfo.Size);
       }
@@ -502,9 +504,8 @@ ur_result_t MsanInterceptor::prepareLaunch(
                        ContextInfo->CleanShadowSize, nullptr, nullptr,
                        AllocType::DEVICE_USM,
                        (void **)&LaunchInfo.Data.Host.CleanShadow));
-  UR_CALL(EnqueueUSMSet(Queue, (void *)LaunchInfo.Data.Host.CleanShadow,
-                        (char)0, ContextInfo->CleanShadowSize, 0, nullptr,
-                        nullptr));
+  UR_CALL(EnqueueUSMSetZero(Queue, (void *)LaunchInfo.Data.Host.CleanShadow,
+                            ContextInfo->CleanShadowSize));
 
   if (LaunchInfo.LocalWorkSize.empty()) {
     LaunchInfo.LocalWorkSize.resize(LaunchInfo.WorkDim);

unified-runtime/source/loader/layers/sanitizer/msan/msan_libdevice.hpp

@@ -78,6 +78,9 @@ struct MsanRuntimeData {
 // variable have changed
 constexpr std::size_t MSAN_PRIVATE_SIZE = 0xffffffULL + 1;
 
+constexpr uint8_t kMemInitializedMagic = 0;
+constexpr uint8_t kMemUninitializedMagic = 0xff;
+
 constexpr auto kSPIR_MsanDeviceGlobalMetadata = "__MsanDeviceGlobalMetadata";
 constexpr auto kSPIR_MsanSpirKernelMetadata = "__MsanKernelMetadata";
 

unified-runtime/source/loader/layers/sanitizer/msan/msan_origin.hpp

@@ -34,7 +34,7 @@ namespace msan {
 
 class Origin {
 public:
-  uint32_t rawId() const { return raw_id_; }
+  const uint32_t *rawId() const { return &raw_id_; }
 
   bool isHeapOrigin() const {
     return isDeviceUSMOrigin() || isHostUSMOrigin() || isSharedUSMOrigin() ||