[TySan] Varargs stack use doesn't set shadow, leading to strange reports

[tavianator]

Trying out #76261, this program with a variadic function:

#include <stdarg.h>
#include <stdio.h>

void foo(void) {
	long array[64];
	for (int i = 0; i < 64; ++i) {
		array[i] = i;
	}
	printf("%p\n", array);
}

void bar(int first, ...) {
	va_list args;
	va_start(args, first);
	va_arg(args, char *);
	va_end(args);
}

int main(void) {
	foo();
	bar(0, "");
}

Gives a strange report:

tavianator@tachyon $ ~/code/llvm/llvm-project/build/bin/clang -g -fsanitize=type foo.c -o foo
tavianator@tachyon $ ./foo
0x7ffd254f1130
==231524==ERROR: TypeSanitizer: type-aliasing-violation on address 0x7ffd254f1268 (pc 0x55b385ac9008 bp 0x7ffd254f1170 sp 0x7ffd254f1110 tid 231524)
READ of size 8 at 0x7ffd254f1268 with type any pointer accesses an existing object of type long
    #0 0x55b385ac9007 in bar /home/tavianator/code/bfs/foo.c:15:2

CC: @gbMattN

[gbMattN]

There is a va_arg llvm ir instruction, but from what I can tell its not used unless on specific targets. Clang lowers va_arg to other instructions automagically. In doing so it gets rid of the information TySan needs to instrument it.

There are a few discussions about changing Clang to modify this behavior but none of them seemed to gain any traction so for now I think raw va_arg usage will have to be unsupported. If you make a function which takes in a va_list and returns the type you want, TySan correctly instruments that, which is a little clunky but at least there is a workaround.