google / google/heir

ASAN heap-use-after-free during dialect conversion

Open
#2,479 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
MLIR
Stars
906
Forks
171
Avg merge
4d 12h
Merged PRs (30d)
32

Description

**Test commit**
[a413796feb31eb6a1e70160308defe4d0250d09e](https://github.com/google/heir/commit/a413796feb31eb6a1e70160308defe4d0250d09e)

**Description**
A `heap-use-after-free occurs` when `heir-opt` fails to legalize `arith.xori`. The crash happens while attempting to access `getName()` on an operation that was likely invalidated or erased during the conversion process (?)

**Steps to reproduce**
- Minimal MLIR program (test.mlir)
```
"builtin.module"() ({
"func.func"() <{
function_type = (tensor<8xi32>, tensor<8xi32>) -> tensor<8xi32>,
sym_name = "tensor_xor"
}> ({
^bb0(%arg0: tensor<8xi32>, %arg1: tensor<8xi32>):
%0 = "arith.xori"(%arg0, %arg1) : (tensor<8xi32>, tensor<8xi32>) -> tensor<8xi32>
"func.return"(%0) : (tensor<8xi32>) -> ()
}) : () -> ()
}) : () -> ()
```

**Command**
```
heir-opt --convert-elementwise-to-affine --arith-to-mod-arith=modulus=65537 test.mlir
```

**Output**
```
=================================================================
==922173==ERROR: AddressSanitizer: heap-use-after-free on address 0x50800001ed60 at pc 0x5600e1aded4e bp 0x7ffe892d45f0 sp 0x7ffe892d45e8
READ of size 8 at 0x50800001ed60 thread T0
#0 0x5600e1aded4d in mlir::Operation::getName() /proc/self/cwd/external/llvm-project/mlir/include/mlir/IR/Operation.h:119:36
#1 0x5600e1aded4d in reportNewIrLegalizationFatalError(mlir::Pattern const&, llvm::SetVector, llvm::DenseSet>, 0u> const&, llvm::SetVector, llvm::DenseSet>, 0u> const&, llvm::SetVector, llvm::DenseSet>, 0u> const&)::$_0::operator()(mlir::Operation*) const /proc/self/cwd/external/llvm-project/mlir/lib/Transforms/Utils/DialectConversion.cpp:2638:46
#2 0x5600e1aded4d in decltype(auto) llvm::callable_detail::Callable, llvm::DenseSet>, 0u> const&, llvm::SetVector, llvm::DenseSet>, 0u> const&, llvm::SetVector, llvm::DenseSet>, 0u> const&)::$_0, false>::operator()(mlir::Operation* const&) const /proc/self/cwd/external/llvm-project/llvm/include/llvm/ADT/STLExtras.h:230:12
...

SUMMARY: AddressSanitizer: heap-use-after-free /proc/self/cwd/external/llvm-project/mlir/include/mlir/IR/Operation.h:119:36 in mlir::Operation::getName()
Shadow bytes around the buggy address:
0x50800001ea80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x50800001eb00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
0x50800001eb80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
0x50800001ec00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
0x50800001ec80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
=>0x50800001ed00: fa fa fa fa fd fd fd fd fd fd fd fd[fd]fd fd fd
0x50800001ed80: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
0x50800001ee00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x50800001ee80: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x50800001ef00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50800001ef80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==922173==ABORTING

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.