ASan breaks __seg_gs

[glandium]

Take this source:

#include <cstdint>
void test(uintptr_t addr) {
    __builtin_memcpy((void __seg_gs*)addr, "x", 1);
}

It compiles to

test(unsigned long):
        push    rbp
        mov     rbp, rsp
        mov     qword ptr [rbp - 8], rdi
        mov     rax, qword ptr [rbp - 8]
        mov     byte ptr gs:[rax], 120
        pop     rbp
        ret

Or even

test(unsigned long):
        mov     byte ptr gs:[rdi], 120
        ret

Without ASan, but with ASan:

test(unsigned long):
        push    rbp
        mov     rbp, rsp
        sub     rsp, 16
        mov     qword ptr [rbp - 8], rdi
        mov     rdi, qword ptr [rbp - 8]
        lea     rsi, [rip + .str]
        mov     edx, 1
        call    __asan_memcpy@PLT
        add     rsp, 16
        pop     rbp
        ret

The gs: addressing is gone.

Funnily enough, with -O + ASan, it compiles to the same thing as without ASan.

Obligatory godbolt link: https://godbolt.org/z/8hWGxdc3P

[glandium]

TSan breaks it too:

test(unsigned long):
        push    rbp
        mov     rbp, rsp
        sub     rsp, 16
        mov     qword ptr [rbp - 16], rdi
        mov     rdi, qword ptr [rbp + 8]
        call    __tsan_func_entry@PLT
        mov     rdi, qword ptr [rbp - 16]
        mov     qword ptr [rbp - 8], rdi
        mov     rdi, qword ptr [rbp - 8]
        lea     rsi, [rip + .L.str]
        mov     edx, 1
        call    __tsan_memcpy@PLT
        call    __tsan_func_exit@PLT
        add     rsp, 16
        pop     rbp
        ret

But not LSan or UBSan.

[cheezeburglar]

I've looked a little bit at sanitizers in llvm and gcc - if it's appropriate, could I get assigned this?

Update/Edit: Looked at today, I think something funny happens during x86-isel; still in progress

[cheezeburglar]

It looks like ASan and TSan are generically intercepting memintrinsics in llvm ir and don't currently know how to write to distinct address spaces in __asan_mem{set, cpy, move}.

I've got a patch that just punts ASan out when instrumenting memintrinsics that write to fs and gs, but I don't know if this has bad side effects. Pull request draft soon

[ramosian-glider]

@dvyukov FYI