[Bug sanitizer/80114] New: asan-stack=1 with -fsanitize-address-use-after-scope and stack arrays multiplies code size

[jani.nikula at intel dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80114

Bug ID: 80114
   Summary: asan-stack=1 with -fsanitize-address-use-after-scope
and stack arrays multiplies code size
   Product: gcc
   Version: unknown
Status: UNCONFIRMED
  Severity: normal
  Priority: P3
 Component: sanitizer
  Assignee: unassigned at gcc dot gnu.org
  Reporter: jani.nikula at intel dot com
CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
jakub at gcc dot gnu.org, kcc at gcc dot gnu.org
  Target Milestone: ---

Compiling

int main(void)
{
volatile int i = (const int []){0, 1, 2, 3, 4, 5}[1];
const int j = (const int []){0, 1, 2, 3, 4, 5}[i];
return j;
}

with --param asan-stack=1 and -fsanitize-address-use-after-scope doubles
generated code size. Compared to to the very tightly optimized non-asan code
size, this seems pretty bad. Is this to be expected?

Comparison: https://godbolt.org/g/hgS817

[Bug sanitizer/80114] asan-stack=1 with -fsanitize-address-use-after-scope and stack arrays multiplies code size

[jani.nikula at intel dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80114

--- Comment #3 from Jani Nikula  ---
(In reply to Martin Liška from comment #2)
> Well, just adding the param and -fsanitize-address-use-after-scope does not
> enable any sanitization. One has to add -fsanitize=address to trigger real
> sanitization. With Address Sanitizer, the code really grows, which is kind
> of expected.

Yes, of course. The full options (in the godbolt link) are: -O2 -std=c11 -x c
-fsanitize=kernel-address -fasan-shadow-offset=0xdfff9000 --param
asan-stack=1 --param asan-globals=1 --param
asan-instrumentation-with-call-threshold=1
-fsanitize-address-use-after-scope

I fully expect asan to grow code; I'm just not sure whether such a huge growth
particularly with the combination of --param asan-stack=1 and
-fsanitize-address-use-after-scope is expected.

[Bug sanitizer/80114] asan-stack=1 with -fsanitize-address-use-after-scope and stack arrays multiplies code size

[jani.nikula at intel dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80114

--- Comment #5 from Jani Nikula  ---
(In reply to Martin Liška from comment #4)
> How common is such situation and why do you use volatile keyword in
> combination with a constant index?

I didn't write the sample, I think the goal of 'volatile' was to ensure the
compiler doesn't optimize it all away.

The sample comes from a trick in kernel code to pick a constant based on a
limited range variable. For example, you have one hardware register per port,
the register offsets aren't uniformly distributed, and you want to have macros
of the form FOO(port) to give you the right register offset based on the port.

So you could have:

#define _PICK(__index, ...) (((const u32 []){ __VA_ARGS__ })[__index])

#define FOO(x) _PICK(x, 1, 2, 3)

instead of things like:

#define _PICK(__index, a, b, c) ((__index) == 0 ? (a) : (__index) == 1 ? (b) :
(c))

If you have clever ideas how to neatly handle this otherwise, expecially when
the number of ports increases, I'm all ears!

[Bug sanitizer/80114] asan-stack=1 with -fsanitize-address-use-after-scope and stack arrays multiplies code size

[jani.nikula at intel dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80114

--- Comment #11 from Jani Nikula  ---
(In reply to Martin Liška from comment #10)
> May I close this as worksforme?

If the conclusion is that the magnitude of the code size bloat demonstrated in
https://godbolt.org/g/hgS817 is expected, then go ahead.

Thanks for asking first, though. :)