Skip to content

Commit 395f737

Browse files
committed
msan: check that ucontext_t is initialized on signal return
A signal handler can alter ucontext_t to affect execution after the signal returns. Check that the contents are initialized. Restoring unitialized values in registers can't be good. Reviewed By: vitalybuka Differential Revision: https://reviews.llvm.org/D116209
1 parent 1298273 commit 395f737

File tree

2 files changed

+28
-0
lines changed

2 files changed

+28
-0
lines changed

compiler-rt/lib/msan/msan_interceptors.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -996,6 +996,7 @@ static void SignalAction(int signo, void *si, void *uc) {
996996
sigaction_cb cb =
997997
(sigaction_cb)atomic_load(&sigactions[signo], memory_order_relaxed);
998998
cb(signo, si, uc);
999+
CHECK_UNPOISONED(uc, ucontext_t_sz(uc));
9991000
}
10001001

10011002
static void read_sigaction(const __sanitizer_sigaction *act) {
Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -O1 %s -o %t && not %run %t 2>&1 | FileCheck %s
2+
3+
#include <pthread.h>
4+
#include <signal.h>
5+
#include <ucontext.h>
6+
7+
void handler(int sig, siginfo_t *info, void *uctx) {
8+
volatile int uninit;
9+
auto *mctx = &static_cast<ucontext_t *>(uctx)->uc_mcontext;
10+
auto *fpregs = mctx->fpregs;
11+
if (fpregs && fpregs->__glibc_reserved1[12] == FP_XSTATE_MAGIC1)
12+
reinterpret_cast<_xstate *>(mctx->fpregs)->ymmh.ymmh_space[0] = uninit;
13+
else
14+
mctx->gregs[REG_RAX] = uninit;
15+
}
16+
17+
int main(int argc, char **argv) {
18+
struct sigaction act = {};
19+
act.sa_sigaction = handler;
20+
act.sa_flags = SA_SIGINFO;
21+
sigfillset(&act.sa_mask);
22+
sigaction(SIGPROF, &act, 0);
23+
pthread_kill(pthread_self(), SIGPROF);
24+
return 0;
25+
}
26+
27+
// CHECK: WARNING: MemorySanitizer:

0 commit comments

Comments
 (0)