MemorySanitizer detects use-of-uninitialized-value in a simple OpenMP program

[lqhl]

Here is a minimal OpenMP program:

#include <omp.h>
#include <stdio.h>

int main() {
#pragma omp parallel for
    for (int i = 0; i < 10; i++) {
        // do nothing
    }
    printf("done\n");
}

But MemorySanitizer detects use-of-uninitialized-value error:

❯ clang++-13 main.cpp -fopenmp -fsanitize=memory && ./a.out
Uninitialized bytes in __interceptor_strlen at offset 2259 inside [0x71d000000040, 2260)
==3120751==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7faa9ed131f5  (/lib/x86_64-linux-gnu/libomp.so.5+0x4a1f5)
    #1 0x7faa9ed00fd6  (/lib/x86_64-linux-gnu/libomp.so.5+0x37fd6)
    #2 0x7faa9ed00f44  (/lib/x86_64-linux-gnu/libomp.so.5+0x37f44)
    #3 0x7faa9ecf489c in __kmpc_fork_call (/lib/x86_64-linux-gnu/libomp.so.5+0x2b89c)
    #4 0x4a0f05 in main (/home/qliu/workspace/test-openmp-msan/a.out+0x4a0f05)
    #5 0x7faa9eaaad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #6 0x7faa9eaaae3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #7 0x420244 in _start (/home/qliu/workspace/test-openmp-msan/a.out+0x420244)

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/lib/x86_64-linux-gnu/libomp.so.5+0x4a1f5)
Exiting

Without MemorySantinizer, it's ok:

❯ clang++-13 main.cpp -fopenmp && ./a.out
done

Another example is simply getting number of threads using OpenMP:

#include <omp.h>
#include <stdio.h>

int main() {
    int number_of_threads = omp_get_max_threads();
    printf("number_of_threads: %d\n", number_of_threads);

    return 0;
}

This program crashes too with MemorySantinizer:

❯ clang++-13 main.cpp -fopenmp -fsanitize=memory && ./a.out
Uninitialized bytes in __interceptor_strlen at offset 2259 inside [0x71d000000040, 2260)
==3125901==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7f8d2b0fa1f5  (/lib/x86_64-linux-gnu/libomp.so.5+0x4a1f5)
    #1 0x7f8d2b0e7fd6  (/lib/x86_64-linux-gnu/libomp.so.5+0x37fd6)
    #2 0x7f8d2b0f5be8  (/lib/x86_64-linux-gnu/libomp.so.5+0x45be8)
    #3 0x7f8d2b0f5bb9  (/lib/x86_64-linux-gnu/libomp.so.5+0x45bb9)
    #4 0x7f8d2b16e9a4 in omp_get_max_threads (/lib/x86_64-linux-gnu/libomp.so.5+0xbe9a4)
    #5 0x4a0ee3 in main (/home/qliu/workspace/test-openmp-msan/a.out+0x4a0ee3)
    #6 0x7f8d2ae91d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #7 0x7f8d2ae91e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #8 0x420224 in _start (/home/qliu/workspace/test-openmp-msan/a.out+0x420224)

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/lib/x86_64-linux-gnu/libomp.so.5+0x4a1f5)
Exiting

[EugeneZelenko]

Could you please try 16 release candidate or main branch?

[llvmbot]

@llvm/issue-subscribers-openmp

[lqhl]

@EugeneZelenko I tried clang-16 and it has the same problem:

root@1cd1ef471ae7:/work# clang-16 main.cpp -fopenmp -fsanitize=memory
root@1cd1ef471ae7:/work# ./a.out
Uninitialized bytes in __interceptor_strlen at offset 2356 inside [0x71d000000a40, 2357)
==4948==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7fb09026a845  (/usr/lib/llvm-16/lib/libomp.so.5+0x4b845) (BuildId: 79155c5e13025c8706695c4183b5c08857d73fda)
    #1 0x7fb0902574c6  (/usr/lib/llvm-16/lib/libomp.so.5+0x384c6) (BuildId: 79155c5e13025c8706695c4183b5c08857d73fda)
    #2 0x7fb090257434  (/usr/lib/llvm-16/lib/libomp.so.5+0x38434) (BuildId: 79155c5e13025c8706695c4183b5c08857d73fda)
    #3 0x7fb09024a38d in __kmpc_fork_call (/usr/lib/llvm-16/lib/libomp.so.5+0x2b38d) (BuildId: 79155c5e13025c8706695c4183b5c08857d73fda)
    #4 0x558c6b24f192 in main (/work/a.out+0xa6192) (BuildId: f6b9f7f6eb242c55a0cb98b0277d9db657a80edb)
    #5 0x7fb090000d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #6 0x7fb090000e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #7 0x558c6b1c72c4 in _start (/work/a.out+0x1e2c4) (BuildId: f6b9f7f6eb242c55a0cb98b0277d9db657a80edb)

SUMMARY: MemorySanitizer: use-of-uninitialized-value (/usr/lib/llvm-16/lib/libomp.so.5+0x4b845) (BuildId: 79155c5e13025c8706695c4183b5c08857d73fda)
Exiting

Clang version:

root@1cd1ef471ae7:/work# clang-16 -v
Ubuntu clang version 16.0.0 (++20230202043241+c2f68bc2f08b-1~exp1~20230202163341.13)
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/bin
Found candidate GCC installation: /usr/bin/../lib/gcc/x86_64-linux-gnu/11
Selected GCC installation: /usr/bin/../lib/gcc/x86_64-linux-gnu/11
Candidate multilib: .;@m64
Selected multilib: .;@m64

[hhoffstaette]

Both examples build & work here with clang-15.0.7 on Gentoo:

$ clang++ -fopenmp -fsanitize=memory omp.cpp
$ ./a.out                                             
number_of_threads: 16

$ clang++ --version 
clang version 15.0.7
Target: x86_64-pc-linux-gnu
Thread model: posix
InstalledDir: /usr/lib/llvm/15/bin
Configuration file: /etc/clang/clang++.cfg

[jhuber6]

I can reproduce upstream, I don't think I get it at the same location though. I don't know much about libomp unfortunately. Maybe @jpeyton52 or @carlobertolli can help.

> clang++ omp.cpp -fopenmp -fsanitize=memory -g && ./a.out 
Uninitialized bytes in __interceptor_strlen at offset 2049 inside [0x71d000000a40, 2050)
==3225501==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7f86e0088621 in __kmp_env_dump() kmp_settings.cpp
    #1 0x7f86e006e793 in __kmp_do_serial_initialize() kmp_runtime.cpp
    #2 0x7f86e00707f4 in __kmp_do_middle_initialize() kmp_runtime.cpp
    #3 0x7f86e007086e in __kmp_middle_initialize kmp_runtime.cpp
    #4 0x7f86e00f1ebc in omp_get_max_threads (/home/jhuber/Documents/llvm/clang/lib/libomp.so+0xf8ebc) (BuildId: b217933c5b6d8fb5)
    #5 0x563fbfa6a591 in main /home/jhuber/Documents/llvm/llvm-project/build/san.cpp:5:29
    #6 0x7f86dfe3528f  (/usr/lib/libc.so.6+0x2328f) (BuildId: 768945cdf5e5796c2ab39f38ed160748fd94d12e)
    #7 0x7f86dfe35349 in __libc_start_main (/usr/lib/libc.so.6+0x23349) (BuildId: 768945cdf5e5796c2ab39f38ed160748fd94d12e)
    #8 0x563fbf9dac84 in _start (/home/jhuber/Documents/llvm/llvm-project/build/a.out+0x4dc84)

SUMMARY: MemorySanitizer: use-of-uninitialized-value kmp_settings.cpp in __kmp_env_dump()
Exiting

[shiltian]

Which variable is uninitialized?

[jpeyton52]

The use-of-uninitialized-value occurs during the KMP_STRLEN() call inside __kmp_env_dump(). The root cause is the implementation of __kmp_str_buf_cat() which uses a memcpy() + explicit assignment of the last byte to 0.

  KMP_MEMCPY(buffer->str + buffer->used, str, len);
  buffer->str[buffer->used + len] = 0;

Because the memory sanitizer intercepts the typical C string functions, but not that direct memory assignment, it believes the last byte is uninitialized. Using strncat() instead solves the issue.

Posted patch: https://reviews.llvm.org/D143401