msan: check that ucontext_t is initialized on signal return

[dvyukov]

Summary

A signal handler can alter ucontext_t to affect execution after
the signal returns. Check that the contents are initialized.
Restoring unitialized values in registers can't be good.

[vitalybuka]

Do you expect some cleanup for this?

compiler-rt/lib/msan/msan_interceptors.cpp

999

what if signal handler is not instrumented?

compiler-rt/test/msan/Linux/signal_mcontext2.cpp

2

do we need -fsanitize-memory-track-origins=2 ?
if not the rest of the test is not msan specific and can be moved under sanitizer_common?

[vitalybuka]

compiler-rt/lib/msan/msan_interceptors.cpp

999

Ah, uc then should stay OK after __msan_unpoison

[vitalybuka]

compiler-rt/lib/msan/msan_interceptors.cpp

999

I guess we will have a problem if uninstructed handler use memcpy interceptors

[dvyukov]

compiler-rt/lib/msan/msan_interceptors.cpp

999

Are there any known precedents for uninstrumented handlers that call instrumented functions?
Otherwise it does not look different from not instrumenting random parts of the code with msan and getting false positives. Yes, that leads to false positives for any code. If the code will call memcpy+memcmp if will get false positives even w/o this change.

compiler-rt/test/msan/Linux/signal_mcontext2.cpp

2

It will fail only under msan, so the "not %run" part is msan-specific.

[dvyukov]

rebased

compiler-rt/lib/msan/msan_interceptors.cpp

static void SignalAction(int signo, void *si, void *uc) {
   UnpoisonParam(3);
   __msan_unpoison(si, sizeof(__sanitizer_sigaction));
   __msan_unpoison(uc, ucontext_t_sz(uc));
 
   typedef void (*sigaction_cb)(int, void *, void *);
   sigaction_cb cb =
       (sigaction_cb)atomic_load(&sigactions[signo], memory_order_relaxed);
   cb(signo, si, uc);
+  CHECK_UNPOISONED(uc, ucontext_t_sz(uc));
 }
 
 static void read_sigaction(const __sanitizer_sigaction *act) {
   CHECK_UNPOISONED(&act->sa_flags, sizeof(act->sa_flags));
   if (act->sa_flags & __sanitizer::sa_siginfo)
     CHECK_UNPOISONED(&act->sigaction, sizeof(act->sigaction));
   else
     CHECK_UNPOISONED(&act->handler, sizeof(act->handler));

compiler-rt/test/msan/Linux/signal_mcontext2.cpp

+// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -O1 %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+#include <pthread.h>
+#include <signal.h>
+#include <ucontext.h>
+
+void handler(int sig, siginfo_t *info, void *uctx) {
+  volatile int uninit;
+  auto *mctx = &static_cast<ucontext_t *>(uctx)->uc_mcontext;
+  auto *fpregs = mctx->fpregs;
+  if (fpregs && fpregs->__glibc_reserved1[12] == FP_XSTATE_MAGIC1)
+    reinterpret_cast<_xstate *>(mctx->fpregs)->ymmh.ymmh_space[0] = uninit;
+  else
+    mctx->gregs[REG_RAX] = uninit;
+}
+
+int main(int argc, char **argv) {
+  struct sigaction act = {};
+  act.sa_sigaction = handler;
+  act.sa_flags = SA_SIGINFO;
+  sigfillset(&act.sa_mask);
+  sigaction(SIGPROF, &act, 0);
+  pthread_kill(pthread_self(), SIGPROF);
+  return 0;
+}
+
+// CHECK: WARNING: MemorySanitizer: