[MSAN] add interceptor for timer_create, timer_settime, timer_gettime

[kda]

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h

515

lint is insisting on these spaces.
They seem wrong.
How do I bypass the linter here?

[vitalybuka]

for sanitizer_common interceptors we usually add trivial lit test just to make sure that it does not crash with any sanitizers
so LGTM with test/sanitizer_common

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

10222

man says timerid us not NULL pointer

10224

we don't use {} for one liners

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h

515

insisting to add spaces or to remove?

[kda]

remove spacing noise

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

10224

I stole this from getitimer, which does.

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h

515

The linter is insisting on ADDING the spaces.
I don't think they belong there and want to remove them.

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h

515

it's find, there is a setting in clang-format to add these spaces, we have it ON.
Still some files are not reformated yet.
Either way is fine, we can reformat in a separate patch.

[kda]

add interceptors for timer_settime and timer_gettime

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

10222

btw we need COMMON_INTERCEPTOR_READ_RANGE for sevp

10240

COMMON_INTERCEPTOR_READ_RANGE for new_value?
before REAL()?

[kda]

add sanitizer_common test, and UMR checks.

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

10215

Can you please clang format it?

10219

Sorry, I guess my suggestion does not work here.
sigevent is complex structure, and it contains unions.
It's not required to be initialized fully. We need to check field by field according to the spec if the functions.
Let's just skip it for now.

10239

Sorry, I've read the man page and similar story:

If either field in new_value.it_value is nonzero, then the timer

is armed to initially expire at the specified time.  If both
fields in new_value.it_value are zero, then the timer is
disarmed.

The new_value.it_interval field specifies the new interval for
the timer; if both of its subfields are zero, the timer is
single-shot.

So we don't READ new_value.it_interval if new_value.it_value is ZERO.
I propose just drop it for to avoid introducing struct __sanitizer_itimerval

compiler-rt/test/sanitizer_common/TestCases/Linux/timer.cpp

1–40 ↗

(On Diff #412595)

[kda]

remove read checks and format

[kda]

remove FileCheck from timer.cpp

[kda]

move timer.cpp from Linux to Posix.

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h

591–593

OSX does not support it

also single define maybe is enough?

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h

512

we need to make this timer_create, #define SANITIZER_INTERCEPT_TIMER_CREATE SI_POSIX
#define SANITIZER_INTERCEPT_TIMER_SETTIME SI_POSIX
#define SANITIZER_INTERCEPT_TIMER_GETTIME SI_POSIX and
TestCases/Posix/ or TestCases/Linux/
and
TEST(MemorySanitizer, timer_create) { ....
consistent

Looks like OSX does not support this functions

we need this for other platforms:
search all "typedef.*__sanitizer_clockid_t"

compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp

2 ↗

(On Diff #413169)

// UNSUPPORTED: darwin

[kda]

going with LINUX

[kda]

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h

512

I'm leaving this as is. I'm choosing LINUX.

[kda]

move test back to Posix, add typedef to solaris, freebsd, netbsd.

[vitalybuka]

compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp

1 ↗

(On Diff #413932)

[kda]

add UNSUPPORTED: darwin to test

[phosek]

The new test is failing on our builders with what appears to be a leak:

Script:
--
: 'RUN: at line 1';      /opt/s/w/ir/x/w/staging/llvm_build/./bin/clang  --driver-mode=g++ -gline-tables-only -fsanitize=leak  --unwindlib=libunwind -static-libgcc -Wthread-safety -Wthread-safety-reference -Wthread-safety-beta  -funwind-tables --sysroot=/opt/s/w/ir/x/w/cipd/linux  -ldl -O0 -g /opt/s/w/ir/x/w/llvm-llvm-project/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp -o /opt/s/w/ir/x/w/staging/llvm_build/runtimes/runtimes-aarch64-unknown-linux-gnu-bins/compiler-rt/test/sanitizer_common/lsan-aarch64-Linux/Posix/Output/timer.cpp.tmp &&  /opt/s/w/ir/x/w/staging/llvm_build/runtimes/runtimes-aarch64-unknown-linux-gnu-bins/compiler-rt/test/sanitizer_common/lsan-aarch64-Linux/Posix/Output/timer.cpp.tmp
--
Exit Code: 23

Command Output (stderr):
--

=================================================================
==16730==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x2510e0 in malloc ../staging/llvm_build/runtimes/runtimes-aarch64-unknown-linux-gnu-bins/../staging/llvm_build/runtimes/runtimes-aarch64-unknown-linux-gnu-bins/compiler-rt/lib/lsan/lsan_interceptors.cpp:75:3
    #1 0xffff819feb50 in timer_create (/lib/aarch64-linux-gnu/librt.so.1+0x3b50) (BuildId: 1aba141af4fa49c86298936e700aa7fd865f5518)
    #2 0x253838 in main /opt/s/w/ir/x/w/llvm-llvm-project/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp:13:3
    #3 0xffff818c26dc in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x206dc) (BuildId: 53f40c1d2f3739ae017dcdcef1a17314786e3709)
    #4 0x2281d4 in _start (/opt/s/w/ir/x/w/staging/llvm_build/runtimes/runtimes-aarch64-unknown-linux-gnu-bins/compiler-rt/test/sanitizer_common/lsan-aarch64-Linux/Posix/Output/timer.cpp.tmp+0x2281d4) (BuildId: a7e4b66ead191fc7)

SUMMARY: LeakSanitizer: 8 byte(s) leaked in 1 allocation(s).

--

Would it be possible to take a look and revert the change if necessary?

[shchenz]

This commit also causes our bots fail https://lab.llvm.org/buildbot/#/builders/105/builds/22623

******************** TEST 'SanitizerCommon-lsan-powerpc64le-Linux :: Posix/timer.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';      /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/./bin/clang  --driver-mode=g++ -gline-tables-only -fsanitize=leak  -m64 -fno-function-sections -funwind-tables  -ldl -O0 -g /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp -o /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/projects/compiler-rt/test/sanitizer_common/lsan-powerpc64le-Linux/Posix/Output/timer.cpp.tmp &&  /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/projects/compiler-rt/test/sanitizer_common/lsan-powerpc64le-Linux/Posix/Output/timer.cpp.tmp
--
Exit Code: 23
Command Output (stderr):
--
=================================================================
==151261==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x1005410c in __interceptor_malloc.part.10 /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/lib/lsan/lsan_interceptors.cpp:75:3
    #1 0x7fff81a649a8 in .annobin_timer_create.c timer_create.c
    #2 0x10058c24 in main /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp:13:3
    #3 0x7fff818249f4 in .annobin_libc_start.c libc-start.c
    #4 0x7fff81824be0 in __libc_start_main (/lib64/libc.so.6+0x24be0) (BuildId: 3f510e433e7682fc2680148fe7836ab789f8084b)
SUMMARY: LeakSanitizer: 8 byte(s) leaked in 1 allocation(s).

******************** TEST 'SanitizerCommon-lsan-powerpc64le-Linux :: Posix/timer.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';      /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/./bin/clang  --driver-mode=g++ -gline-tables-only -fsanitize=leak  -m64 -fno-function-sections -funwind-tables  -ldl -O0 -g /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp -o /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/projects/compiler-rt/test/sanitizer_common/lsan-powerpc64le-Linux/Posix/Output/timer.cpp.tmp &&  /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/projects/compiler-rt/test/sanitizer_common/lsan-powerpc64le-Linux/Posix/Output/timer.cpp.tmp
--
Exit Code: 23
Command Output (stderr):
--
=================================================================
==151261==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x1005410c in __interceptor_malloc.part.10 /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/lib/lsan/lsan_interceptors.cpp:75:3
    #1 0x7fff81a649a8 in .annobin_timer_create.c timer_create.c
    #2 0x10058c24 in main /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp:13:3
    #3 0x7fff818249f4 in .annobin_libc_start.c libc-start.c
    #4 0x7fff81824be0 in __libc_start_main (/lib64/libc.so.6+0x24be0) (BuildId: 3f510e433e7682fc2680148fe7836ab789f8084b)
SUMMARY: LeakSanitizer: 8 byte(s) leaked in 1 allocation(s).

[lei]

This also failing on all our bots:
https://lab.llvm.org/buildbot/#/builders/105/builds/22623
https://lab.llvm.org/buildbot/#/builders/100/builds/13530

******************** TEST 'SanitizerCommon-lsan-powerpc64le-Linux :: Posix/timer.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';      /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/./bin/clang  --driver-mode=g++ -gline-tables-only -fsanitize=leak  -m64 -fno-function-sections -funwind-tables  -ldl -O0 -g /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp -o /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/projects/compiler-rt/test/sanitizer_common/lsan-powerpc64le-Linux/Posix/Output/timer.cpp.tmp &&  /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/projects/compiler-rt/test/sanitizer_common/lsan-powerpc64le-Linux/Posix/Output/timer.cpp.tmp
--
Exit Code: 23
Command Output (stderr):
--
=================================================================
==151261==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x1005410c in __interceptor_malloc.part.10 /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/lib/lsan/lsan_interceptors.cpp:75:3
    #1 0x7fff81a649a8 in .annobin_timer_create.c timer_create.c
    #2 0x10058c24 in main /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp:13:3
    #3 0x7fff818249f4 in .annobin_libc_start.c libc-start.c
    #4 0x7fff81824be0 in __libc_start_main (/lib64/libc.so.6+0x24be0) (BuildId: 3f510e433e7682fc2680148fe7836ab789f8084b)
SUMMARY: LeakSanitizer: 8 byte(s) leaked in 1 allocation(s).
--
********************
******************** TEST 'SanitizerCommon-asan-powerpc64le-Linux :: Posix/timer.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';      /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/./bin/clang  --driver-mode=g++ -gline-tables-only -fsanitize=address  -m64 -fno-function-sections -funwind-tables  -ldl -O0 -g /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp -o /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/projects/compiler-rt/test/sanitizer_common/asan-powerpc64le-Linux/Posix/Output/timer.cpp.tmp &&  /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/stage1/projects/compiler-rt/test/sanitizer_common/asan-powerpc64le-Linux/Posix/Output/timer.cpp.tmp
--
Exit Code: 1
Command Output (stderr):
--
=================================================================
==151451==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 8 byte(s) in 1 object(s) allocated from:
    #0 0x100e7e84 in __interceptor_malloc.part.10 /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x7ffff7b649a8 in .annobin_timer_create.c timer_create.c
    #2 0x1007075c in __interceptor_timer_create.part.331 /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:10222:31
    #3 0x10151d68 in main /home/buildbots/ppc64le-clang-lnt-test/clang-ppc64le-lnt/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp:13:3
    #4 0x7ffff79249f4 in .annobin_libc_start.c libc-start.c
    #5 0x7ffff7924be0 in __libc_start_main (/lib64/libc.so.6+0x24be0) (BuildId: 3f510e433e7682fc2680148fe7836ab789f8084b)
SUMMARY: AddressSanitizer: 8 byte(s) leaked in 1 allocation(s).
--
********************

[uweigand]

The test is failing on s390x as well:

******************** TEST 'SanitizerCommon-asan-s390x-Linux :: Posix/timer.cpp' FAILED ********************
Script:
--
: 'RUN: at line 1';      /home/uweigand/sandbox/buildbot/clang-s390x-linux/stage1/./bin/clang  --driver-mode=g++ -gline-tables-only -fsanitize=address  -funwind-tables  -ldl -O0 -g /home/uweigand/sandbox/buildbot/clang-s390x-linux/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp -o /home/uweigand/sandbox/buildbot/clang-s390x-linux/stage1/projects/compiler-rt/test/sanitizer_common/asan-s390x-Linux/Posix/Output/timer.cpp.tmp &&  /home/uweigand/sandbox/buildbot/clang-s390x-linux/stage1/projects/compiler-rt/test/sanitizer_common/asan-s390x-Linux/Posix/Output/timer.cpp.tmp
--
Exit Code: 1
Command Output (stderr):
--
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3181575==ERROR: AddressSanitizer: SEGV on unknown address 0x0403cb561000 (pc 0x03ff88104914 bp 0x000000000000 sp 0x03fffd7fe028 T0)
==3181575==The signal is caused by a UNKNOWN memory access.
    #0 0x3ff88104914 in timer_settime /build/glibc-8YaO6T/glibc-2.31/rt/../sysdeps/unix/sysv/linux/x86_64/timer_settime.c:41:10
    #1 0x10436a7 in timer_settime /home/uweigand/sandbox/buildbot/clang-s390x-linux/llvm/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:10235:32
    #2 0x1110fbb in main /home/uweigand/sandbox/buildbot/clang-s390x-linux/llvm/compiler-rt/test/sanitizer_common/TestCases/Posix/timer.cpp:21:3
    #3 0x3ff87ea4409 in __libc_start_main /build/glibc-8YaO6T/glibc-2.31/csu/libc-start.c:308:16
    #4 0x1022173 in _start (/home/uweigand/sandbox/buildbot/clang-s390x-linux/stage1/projects/compiler-rt/test/sanitizer_common/asan-s390x-Linux/Posix/Output/timer.cpp.tmp+0x1022173)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /build/glibc-8YaO6T/glibc-2.31/rt/../sysdeps/unix/sysv/linux/x86_64/timer_settime.c:41:10 in timer_settime
==3181575==ABORTING
--
********************

[kda]

fix memory leak and SEGV in timer.cpp

compiler-rt/lib/msan/tests/msan_test.cpp

TEST(MemorySanitizer, LargeAllocatorUnpoisonsOnFree) {
 
   EXPECT_NOT_POISONED(q[0]);
   EXPECT_NOT_POISONED(q[10]);
   EXPECT_NOT_POISONED(q[100]);
 
   munmap(q, 4096);
 }
 
+TEST(MemorySanitizer, timer_create) {
+  struct sigevent sev {};
+  sev.sigev_notify = SIGEV_NONE;
+  timer_t timerid;
+  int res;
+  EXPECT_POISONED(timerid);
+  res = timer_create(CLOCK_REALTIME, &sev, &timerid);
+  ASSERT_EQ(0, res);
+  EXPECT_NOT_POISONED(timerid);
+}
+
 #if SANITIZER_TEST_HAS_MALLOC_USABLE_SIZE
 TEST(MemorySanitizer, MallocUsableSizeTest) {
   const size_t kArraySize = 100;
   char *array = Ident((char*)malloc(kArraySize));
   int *int_ptr = Ident(new int);
   EXPECT_EQ(0U, malloc_usable_size(NULL));
   EXPECT_EQ(kArraySize, malloc_usable_size(array));
   EXPECT_EQ(sizeof(int), malloc_usable_size(int_ptr));

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

COMMON_INTERCEPTOR_WRITE_RANGE(ctx, utsname,
                                    __sanitizer::struct_utsname_sz);
   return res;
 }
 #define INIT___XUNAME COMMON_INTERCEPT_FUNCTION(__xuname)
 #else
 #define INIT___XUNAME
 #endif
 
+#if SANITIZER_INTERCEPT_TIMER_CREATE
+INTERCEPTOR(int, timer_create, __sanitizer_clockid_t clockid, struct sigevent *sevp, __sanitizer_timer_t *timerid) {
+  void *ctx;
+  COMMON_INTERCEPTOR_ENTER(ctx, timer_create, clockid, sevp, timerid);
+  // FIXME: under ASan the call below may write to freed memory and corrupt
+  // its metadata. See
+  // https://github.com/google/sanitizers/issues/321.
+  int res = REAL(timer_create)(clockid, sevp, timerid);
+  if (!res && timerid) {
+    COMMON_INTERCEPTOR_WRITE_RANGE(ctx, timerid, sizeof(*timerid));
+  }
+  return res;
+}
+#define INIT_TIMER_CREATE COMMON_INTERCEPT_FUNCTION(timer_create)
+#else
+#define INIT_TIMER_CREATE
+#endif
+
 #include "sanitizer_common_interceptors_netbsd_compat.inc"
 
 static void InitializeCommonInterceptors() {
 #if SI_POSIX
   static u64 metadata_mem[sizeof(MetadataHashMap) / sizeof(u64) + 1];
   interceptor_metadata_map = new ((void *)&metadata_mem) MetadataHashMap();
 #endif
 
   INIT_MMAP;
   INIT_MMAP64;
   INIT_TEXTDOMAIN;
   INIT_STRLEN;
   INIT_STRNLEN;
   INIT_STRNDUP;
   INIT___STRNDUP;
   INIT_STRCMP;
   INIT_STRNCMP;
#endif
   INIT_CRYPT_R;
   INIT_GETENTROPY;
   INIT_QSORT;
   INIT_QSORT_R;
   INIT_BSEARCH;
   INIT_SIGALTSTACK;
   INIT_UNAME;
   INIT___XUNAME;
+  INIT_TIMER_CREATE;
 
   INIT___PRINTF_CHK;
 }

compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h

 #define SANITIZER_INTERCEPT_BSEARCH \
   (SI_POSIX && !SI_IOSSIM && !SI_WATCHOS && !SI_TVOS && !SI_ANDROID)
 // sigaltstack on i386 macOS cannot be intercepted due to setjmp()
 // calling it and assuming that it does not clobber registers.
 #define SANITIZER_INTERCEPT_SIGALTSTACK \
   (SI_POSIX && !(SANITIZER_MAC && SANITIZER_I386))
 #define SANITIZER_INTERCEPT_UNAME (SI_POSIX && !SI_FREEBSD)
 #define SANITIZER_INTERCEPT___XUNAME SI_FREEBSD
+#define SANITIZER_INTERCEPT_TIMER_CREATE SI_POSIX
 #define SANITIZER_INTERCEPT_FLOPEN SI_FREEBSD
 
 // This macro gives a way for downstream users to override the above
 // interceptor macros irrespective of the platform they are on. They have
 // to do two things:
 // 1. Build compiler-rt with -DSANITIZER_OVERRIDE_INTERCEPTORS.
 // 2. Provide a header file named sanitizer_intercept_overriders.h in the
 //    include path for their compiler-rt build.
 // An example of an overrider for strlen interceptor that one can list in
 // sanitizer_intercept_overriders.h is as follows:

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h

 #endif
 
 #if defined(__x86_64__) && !defined(_LP64)
 typedef long long __sanitizer_clock_t;
 #else
 typedef long __sanitizer_clock_t;
 #endif
 
 #if SANITIZER_LINUX
 typedef int __sanitizer_clockid_t;
-#endif
+typedef void *__sanitizer_timer_t;
+#  endif
 
-#if SANITIZER_LINUX
+#  if SANITIZER_LINUX
 #    if defined(_LP64) || defined(__x86_64__) || defined(__powerpc__) || \
         defined(__mips__) || defined(__hexagon__)
 typedef unsigned __sanitizer___kernel_uid_t;
 typedef unsigned __sanitizer___kernel_gid_t;
 #else
 typedef unsigned short __sanitizer___kernel_uid_t;
 typedef unsigned short __sanitizer___kernel_gid_t;
 #endif