[HWASan] Catch cases where libc populated jmp_buf.

[morehouse]

Summary

Some setjmp calls within libc cannot be intercepted while their matching
longjmp calls can be. This causes problems if our setjmp/longjmp
interceptors don't use the exact same format as libc for populating and
reading the jmp_buf.

We add a magic field to our jmp_buf and populate it in setjmp. This
allows our longjmp interceptor to notice when a libc jmp_buf is passed
to it.

See discussion on https://reviews.llvm.org/D109699 and
https://reviews.llvm.org/D69045.

Fixes https://github.com/google/sanitizers/issues/1244.

[eugenis]

Yes, I think I like this version better. What does glibc has at the offset of __mask_was_saved? Is it impossible for the magic value to match that contents, or simply very unlikely?

We could also print a warning if that happens when not expected, i.e. in non-__libc-prefixed variants.

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

161

why aarch64 only?

[morehouse]

• Add warning on mismatch in [sig]longjmp.

[morehouse]

In D109787#3000510, @eugenis wrote:

Yes, I think I like this version better. What does glibc has at the offset of __mask_was_saved? Is it impossible for the magic value to match that contents, or simply very unlikely?

glibc has the same int __mask_was_saved at this offset but they use it as a bool, so it's always 0 or 1. No chance of matching unless the glibc struct changes.

We could also print a warning if that happens when not expected, i.e. in non-__libc-prefixed variants.

Done.

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

161

The interceptors are only defined on aarch64 (for now).

I have another patch queued that adds the longjmp interceptor on x86 and removes this ifdef.

[eugenis]

LGTM

[fmayer]

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

109–110

driveby nit: newline?

133–134

as above

[morehouse]

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

109–110

Added in https://reviews.llvm.org/rG0a07789fe93d.

compiler-rt/lib/hwasan/hwasan.h

 // interception code is platform specific too.  As yet we've only implemented
 // the interception for AArch64.
 typedef unsigned long long __hw_register_buf[22];
 struct __hw_jmp_buf_struct {
   // NOTE: The machine-dependent definition of `__sigsetjmp'
   // assume that a `__hw_jmp_buf' begins with a `__hw_register_buf' and that
   // `__mask_was_saved' follows it.  Do not move these members or add others
   // before it.
+  //
+  // We add a __magic field to our struct to catch cases where libc's setjmp
+  // populated the jmp_buf instead of our interceptor.
   __hw_register_buf __jmpbuf; // Calling environment.
-  int __mask_was_saved;       // Saved the signal mask?
+  unsigned __mask_was_saved : 1;  // Saved the signal mask?
+  unsigned __magic : 31;      // Used to distinguish __hw_jmp_buf from jmp_buf.
   __hw_sigset_t __saved_mask; // Saved signal mask.
 };
 typedef struct __hw_jmp_buf_struct __hw_jmp_buf[1];
 typedef struct __hw_jmp_buf_struct __hw_sigjmp_buf[1];
+constexpr unsigned kHwJmpBufMagic = 0x248ACE77;
 #endif // HWASAN_WITH_INTERCEPTORS && __aarch64__
 
 #define ENSURE_HWASAN_INITED()      \
   do {                              \
     CHECK(!hwasan_init_is_running); \
     if (!hwasan_inited) {           \
       __hwasan_init();              \
     }                               \
   } while (0)
 
 #endif  // HWASAN_H

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

 
 #if HWASAN_WITH_INTERCEPTORS && defined(__aarch64__)
 // Get and/or change the set of blocked signals.
 extern "C" int sigprocmask(int __how, const __hw_sigset_t *__restrict __set,
                            __hw_sigset_t *__restrict __oset);
 #define SIG_BLOCK 0
 #define SIG_SETMASK 2
 extern "C" int __sigjmp_save(__hw_sigjmp_buf env, int savemask) {
+  env[0].__magic = kHwJmpBufMagic;
   env[0].__mask_was_saved =
       (savemask && sigprocmask(SIG_BLOCK, (__hw_sigset_t *)0,
                                &env[0].__saved_mask) == 0);
   return 0;
 }
 
 static void __attribute__((always_inline))
 InternalLongjmp(__hw_register_buf env, int retval) {
asm volatile("ldp  x19, x20, [%0, #0<<3];"
                "mov  x0, #1;"
                "csel x0, %1, x0, ne;"
                "br x30;"
                : "+r"(env_address)
                : "r"(retval_tmp));
 }
 
 INTERCEPTOR(void, siglongjmp, __hw_sigjmp_buf env, int val) {
+  if (env[0].__magic != kHwJmpBufMagic) {
+    Printf(
+        "WARNING: Unexpected bad jmp_buf. Either setjmp was not called or "
+        "there is a bug in HWASan.");
+    return REAL(siglongjmp)(env, val);
+  }
+
   if (env[0].__mask_was_saved)
     // Restore the saved signal mask.
     (void)sigprocmask(SIG_SETMASK, &env[0].__saved_mask,
                       (__hw_sigset_t *)0);
   InternalLongjmp(env[0].__jmpbuf, val);
 }
 
 // Required since glibc libpthread calls __libc_longjmp on pthread_exit, and
 // _setjmp on start_thread.  Hence we have to intercept the longjmp on
 // pthread_exit so the __hw_jmp_buf order matches.
 INTERCEPTOR(void, __libc_longjmp, __hw_jmp_buf env, int val) {
+  if (env[0].__magic != kHwJmpBufMagic)
+    return REAL(__libc_longjmp)(env, val);
   InternalLongjmp(env[0].__jmpbuf, val);
 }
 
 INTERCEPTOR(void, longjmp, __hw_jmp_buf env, int val) {
+  if (env[0].__magic != kHwJmpBufMagic) {
+    Printf(
+        "WARNING: Unexpected bad jmp_buf. Either setjmp was not called or "
+        "there is a bug in HWASan.");
+    return REAL(longjmp)(env, val);
+  }
   InternalLongjmp(env[0].__jmpbuf, val);
 }
 #undef SIG_BLOCK
 #undef SIG_SETMASK
 
 #endif // HWASAN_WITH_INTERCEPTORS && __aarch64__
 
 namespace __hwasan {
 
 int OnExit() {
   // FIXME: ask frontend whether we need to return failure.
   return 0;
 }
 
 } // namespace __hwasan
 
 namespace __hwasan {
 
 void InitializeInterceptors() {
   static int inited = 0;
   CHECK_EQ(inited, 0);
 
 #if HWASAN_WITH_INTERCEPTORS
 #if defined(__linux__)
+#      if defined(__aarch64__)
+  INTERCEPT_FUNCTION(__libc_longjmp);
+  INTERCEPT_FUNCTION(longjmp);
+  INTERCEPT_FUNCTION(siglongjmp);
+#      endif  // __aarch64__
   INTERCEPT_FUNCTION(vfork);
 #endif  // __linux__
   INTERCEPT_FUNCTION(pthread_create);
 #endif
 
   inited = 1;
 }
 } // namespace __hwasan
 
 #endif  // #if !SANITIZER_FUCHSIA