Asan sanitizer throws stack-underflow error

[grishasobol]

Hi wasmer team!!

Describe the bug

Catch the problem when run wasmer on Rust thru asan sanitizer:

cargo test output

running 1 test ================================================================= ==2857==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x000105e83bc0 at pc 0x000103c30318 bp 0x000105e83a50 sp 0x000105e83200 WRITE of size 48 at 0x000105e83bc0 thread T1 #0 0x103c30314 in __asan_memcpy+0x420 (librustc-nightly_rt.asan.dylib:arm64+0x4c314)

Address 0x000105e83bc0 is a wild pointer inside of access range of size 0x000000000030.
SUMMARY: AddressSanitizer: stack-buffer-underflow (librustc-nightly_rt.asan.dylib:arm64+0x4c314) in __asan_memcpy+0x420
Shadow bytes around the buggy address:
0x000105e83900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000105e83980: f1 f1 f1 f1 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3
0x000105e83a00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x000105e83a80: 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 00 00 00 00
0x000105e83b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x000105e83b80: 00 00 00 00 00 00 00 00[f1]f1 f1 f1 00 00 00 00
0x000105e83c00: 00 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
0x000105e83c80: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 f3 f3
0x000105e83d00: f3 f3 f3 f3 f8 f8 f2 f2 f2 f2 00 00 00 00 00 f2
0x000105e83d80: f2 f2 f2 f2 00 00 00 00 f1 f1 f1 f1 f8 f8 f8 f8
0x000105e83e00: f8 f8 f2 f2 f2 f2 00 00 00 00 00 00 f2 f2 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Thread T1 created by T0 here:
#0 0x103c2ad88 in pthread_create+0x58 (librustc-nightly_rt.asan.dylib:arm64+0x46d88)
#1 0x101bf68c4 in std::sys::pal::unix::thread::Thread::new::h12e6ce2921b08305+0xc8 (wasmer_fail-80df422d0123702d:arm64+0x10175a8c4)
#2 0x101bc7a80 in test::run_test::hc93c06cf7c970a54+0xaa0 (wasmer_fail-80df422d0123702d:arm64+0x10172ba80)
#3 0x101baf6c8 in test::console::run_tests_console::h368a56c574d5cbc8+0x11dc (wasmer_fail-80df422d0123702d:arm64+0x1017136c8)
#4 0x101bc4f60 in test::test_main::hf6ac6aab472272ca+0x1ec (wasmer_fail-80df422d0123702d:arm64+0x101728f60)
#5 0x101bc5b04 in test::test_main_static::h16ca74eaa6b88285+0x54 (wasmer_fail-80df422d0123702d:arm64+0x101729b04)
#6 0x1004b97b0 in wasmer_fail::main::h5d6fa1596e8ae7f9 lib.rs:1
#7 0x1004a3578 in core::ops::function::FnOnce::call_once::hca11f13f36c3b746 function.rs:250
#8 0x1004adfcc in std::sys::backtrace::__rust_begin_short_backtrace::h8ceea1e0b9f546a8 backtrace.rs:155
#9 0x1004ab23c in std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::h852f84421ecb4d76 rt.rs:159
#10 0x101be9768 in std::rt::lang_start_internal::hb0f920d1b02fc260+0x27c (wasmer_fail-80df422d0123702d:arm64+0x10174d768)
#11 0x1004ab074 in std::rt::lang_start::h050279d6769f6ad7 rt.rs:158
#12 0x1004b97dc in main+0x20 (wasmer_fail-80df422d0123702d:arm64+0x10001d7dc)
#13 0x19edcb150 ()
#14 0x904ffffffffffffc ()

==2857==ABORTING
error: test failed, to rerun pass --lib

Caused by:
process didn't exit successfully: wasmer-fail/target/aarch64-apple-darwin/debug/deps/wasmer_fail-80df422d0123702d (signal: 6, SIGABRT: process abort signal)


Steps to reproduce

1. clone repo with test (https://github.com/grishasobol/wasmer-fail):

git clone git@github.com:grishasobol/wasmer-fail.git

2. run test using santitizer (use your target), you would have output like above:

RUSTFLAGS=-Zsanitizer=address cargo test --target aarch64-apple-darwin

Environment

% rustc --version
rustc 1.81.0-nightly (6868c831a 2024-06-30)

% uname -a
23.6.0 Darwin Kernel Version 23.6.0

% cat Cargo.toml
[package]
name = "wasmer-fail"
version = "0.0.1"
edition = "2021"

[dependencies]
wasmer = { version = "5", default-features = false, features = ["singlepass", "wat"] }

Thoughts

Maybe the problem is connected with how user panics are handled in wasmer using corosensei, which includes complex manipulations with stack.

[ark0f]

Note: AddressSanitizer aborts since Wasmer 2.3.0 (corosensei introduced) and don't abort on Wasmer 2.2.1 with latest toolchain