[msan] Add interceptors for Linux 64-bit stat variants

[manojgupta]

Summary

glibc >= 2.33 uses shared functions for stat family functions.
D111984 added support for non-64 bit variants but they
do not appear to be enough as we have been noticing msan
errors on 64-bit stat variants on Chrome OS.

[manojgupta]

I am noticing a unit tests error with this change for glob_altdirfunc.cpp file but not sure how to resolve it.

MemorySanitizer:DEADLYSIGNAL
==3854677==ERROR: MemorySanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffeeab8eb60 sp 0x7ffeeab8eb28 T3854677)
==3854677==Hint: pc points to the zero page.
==3854677==The signal is caused by a READ memory access.
==3854677==Hint: address points to the zero page.

    #0 0x0  (<unknown module>)
    #1 0x449cef  (compiler-rt/test/msan/X86_64/Linux/Output/glob_altdirfunc.cpp.tmp+0x449cef)
    #2 0x4433e5  (compiler-rt/test/msan/X86_64/Linux/Output/glob_altdirfunc.cpp.tmp+0x4433e5)
    #3 0x44370a  (/compiler-rt/test/msan/X86_64/Linux/Output/glob_altdirfunc.cpp.tmp+0x44370a)
    #4 0x7f0f777021ff  (/lib/x86_64-linux-gnu/libpthread.so.0+0x131ff) (BuildId: 54322f9a621b22e9ea3a4a96b6692f7a0f931b2d)

[vitalybuka]

to avoid crash you need:
INIT_STAT64;
INIT_LSTAT64;
around sanitizer_common_interceptors.inc:10554

can you please add corresponding tests similar to
llvm-project/compiler-rt/test/sanitizer_common/TestCases/Posix/lstat.cpp
llvm-project/compiler-rt/test/msan/fstat.cpp

In D121652#3381093, @manojgupta wrote:

I am noticing a unit tests error with this change for glob_altdirfunc.cpp file but not sure how to resolve it.

MemorySanitizer:DEADLYSIGNAL
==3854677==ERROR: MemorySanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffeeab8eb60 sp 0x7ffeeab8eb28 T3854677)
==3854677==Hint: pc points to the zero page.
==3854677==The signal is caused by a READ memory access.
==3854677==Hint: address points to the zero page.

    #0 0x0  (<unknown module>)
    #1 0x449cef  (compiler-rt/test/msan/X86_64/Linux/Output/glob_altdirfunc.cpp.tmp+0x449cef)
    #2 0x4433e5  (compiler-rt/test/msan/X86_64/Linux/Output/glob_altdirfunc.cpp.tmp+0x4433e5)
    #3 0x44370a  (/compiler-rt/test/msan/X86_64/Linux/Output/glob_altdirfunc.cpp.tmp+0x44370a)
    #4 0x7f0f777021ff  (/lib/x86_64-linux-gnu/libpthread.so.0+0x131ff) (BuildId: 54322f9a621b22e9ea3a4a96b6692f7a0f931b2d)

compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h

468–471

Just SANITIZER_INTERCEPT_STAT64 should be enough for now

[manojgupta]

Fixed crash and added suggested tests.

[manojgupta]

In D121652#3381363, @vitalybuka wrote:

to avoid crash you need:
INIT_STAT64;
INIT_LSTAT64;
around sanitizer_common_interceptors.inc:10554

can you please add corresponding tests similar to
llvm-project/compiler-rt/test/sanitizer_common/TestCases/Posix/lstat.cpp
llvm-project/compiler-rt/test/msan/fstat.cpp

Done

[vitalybuka]

compiler-rt/lib/msan/msan_interceptors.cpp

670

also fstat?

682

I guess we can do now SANITIZER_GLIBC && !__GLIBC_PREREQ(2, 33))
but let keep it as-is for compatibility (to let runtime built with 2.33 work with 2.32 glibc if needed)

721

also fstatat

[vitalybuka]

compiler-rt/test/msan/fstat64.cpp

10

for all new interceptors please, unless it's already there

compiler-rt/test/sanitizer_common/TestCases/Posix/lstat64.cpp

11

what is about test for stat64?

[manojgupta]

compiler-rt/lib/msan/msan_interceptors.cpp

670

fstat is handled right above under the condition SANITIZER_FREEBSD || SANITIZER_NETBSD || SANITIZER_STAT_LINUX .

Do I need to do anything special for fstat?

compiler-rt/test/sanitizer_common/TestCases/Posix/lstat64.cpp

11

Suer, will add tests for others.

[vitalybuka]

LGTM with more tests
Thanks!

compiler-rt/lib/msan/msan_interceptors.cpp

670

Sorry, my mistake.

721

same, nothing needs to be done

[manojgupta]

Added tests for stat64 and fstatat64

[manojgupta]

Replaced uses of /dev/stdin by /dev/null and added asserts.

compiler-rt/lib/msan/msan_interceptors.cpp

if (!res)
     __msan_unpoison(buf, __sanitizer::struct_stat_sz);
   return res;
 }
 #  define MSAN_MAYBE_INTERCEPT_FSTAT MSAN_INTERCEPT_FUNC(fstat)
 #else
 #define MSAN_MAYBE_INTERCEPT_FSTAT
 #endif
 
+#if SANITIZER_STAT_LINUX
+INTERCEPTOR(int, fstat64, int fd, void *buf) {
+  ENSURE_MSAN_INITED();
+  int res = REAL(fstat64)(fd, buf);
+  if (!res)
+    __msan_unpoison(buf, __sanitizer::struct_stat64_sz);
+  return res;
+}
+#  define MSAN_MAYBE_INTERCEPT_FSTAT64 MSAN_INTERCEPT_FUNC(fstat64)
+#else
+#  define MSAN_MAYBE_INTERCEPT_FSTAT64
+#endif
+
 #if SANITIZER_GLIBC
 INTERCEPTOR(int, __fxstat, int magic, int fd, void *buf) {
   ENSURE_MSAN_INITED();
   int res = REAL(__fxstat)(magic, fd, buf);
   if (!res)
     __msan_unpoison(buf, __sanitizer::struct_stat_sz);
   return res;
 }
 #  define MSAN_MAYBE_INTERCEPT___FXSTAT MSAN_INTERCEPT_FUNC(__fxstat)
INTERCEPTOR(int, fstatat, int fd, char *pathname, void *buf, int flags) {
   if (!res) __msan_unpoison(buf, __sanitizer::struct_stat_sz);
   return res;
 }
 #  define MSAN_MAYBE_INTERCEPT_FSTATAT MSAN_INTERCEPT_FUNC(fstatat)
 #else
 #  define MSAN_MAYBE_INTERCEPT_FSTATAT
 #endif
 
+#if SANITIZER_STAT_LINUX
+INTERCEPTOR(int, fstatat64, int fd, char *pathname, void *buf, int flags) {
+  ENSURE_MSAN_INITED();
+  int res = REAL(fstatat64)(fd, pathname, buf, flags);
+  if (!res)
+    __msan_unpoison(buf, __sanitizer::struct_stat64_sz);
+  return res;
+}
+#  define MSAN_MAYBE_INTERCEPT_FSTATAT64 MSAN_INTERCEPT_FUNC(fstatat64)
+#else
+#  define MSAN_MAYBE_INTERCEPT_FSTATAT64
+#endif
+
 #if SANITIZER_GLIBC
 INTERCEPTOR(int, __fxstatat, int magic, int fd, char *pathname, void *buf,
             int flags) {
   ENSURE_MSAN_INITED();
   int res = REAL(__fxstatat)(magic, fd, pathname, buf, flags);
   if (!res) __msan_unpoison(buf, __sanitizer::struct_stat_sz);
   return res;
 }
#endif
   INTERCEPT_FUNCTION(wcsncpy);
   INTERCEPT_FUNCTION(wcscmp);
   INTERCEPT_FUNCTION(getenv);
   INTERCEPT_FUNCTION(setenv);
   INTERCEPT_FUNCTION(putenv);
   INTERCEPT_FUNCTION(gettimeofday);
   MSAN_MAYBE_INTERCEPT_FCVT;
   MSAN_MAYBE_INTERCEPT_FSTAT;
+  MSAN_MAYBE_INTERCEPT_FSTAT64;
   MSAN_MAYBE_INTERCEPT___FXSTAT;
   MSAN_MAYBE_INTERCEPT_FSTATAT;
+  MSAN_MAYBE_INTERCEPT_FSTATAT64;
   MSAN_MAYBE_INTERCEPT___FXSTATAT;
   MSAN_MAYBE_INTERCEPT___FXSTAT64;
   MSAN_MAYBE_INTERCEPT___FXSTATAT64;
   INTERCEPT_FUNCTION(pipe);
   INTERCEPT_FUNCTION(pipe2);
   INTERCEPT_FUNCTION(socketpair);
   MSAN_MAYBE_INTERCEPT_FGETS_UNLOCKED;
   INTERCEPT_FUNCTION(getrlimit);

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

if (!res)
     COMMON_INTERCEPTOR_WRITE_RANGE(ctx, buf, __sanitizer::struct_stat_sz);
   return res;
 }
 #define INIT_STAT COMMON_INTERCEPT_FUNCTION(stat)
 #else
 #define INIT_STAT
 #endif
 
+#if SANITIZER_INTERCEPT_STAT64
+INTERCEPTOR(int, stat64, const char *path, void *buf) {
+  void *ctx;
+  COMMON_INTERCEPTOR_ENTER(ctx, stat64, path, buf);
+  if (common_flags()->intercept_stat)
+    COMMON_INTERCEPTOR_READ_STRING(ctx, path, 0);
+  int res = REAL(stat64)(path, buf);
+  if (!res)
+    COMMON_INTERCEPTOR_WRITE_RANGE(ctx, buf, __sanitizer::struct_stat64_sz);
+  return res;
+}
+#define INIT_STAT64 COMMON_INTERCEPT_FUNCTION(stat64)
+#else
+#define INIT_STAT64
+#endif
+
+
 #if SANITIZER_INTERCEPT_LSTAT
 INTERCEPTOR(int, lstat, const char *path, void *buf) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, lstat, path, buf);
   if (common_flags()->intercept_stat)
     COMMON_INTERCEPTOR_READ_STRING(ctx, path, 0);
   int res = REAL(lstat)(path, buf);
   if (!res)
     COMMON_INTERCEPTOR_WRITE_RANGE(ctx, buf, __sanitizer::struct_stat_sz);
   return res;
 }
 #define INIT_LSTAT COMMON_INTERCEPT_FUNCTION(lstat)
 #else
 #define INIT_LSTAT
 #endif
 
+#if SANITIZER_INTERCEPT_STAT64
+INTERCEPTOR(int, lstat64, const char *path, void *buf) {
+  void *ctx;
+  COMMON_INTERCEPTOR_ENTER(ctx, lstat64, path, buf);
+  if (common_flags()->intercept_stat)
+    COMMON_INTERCEPTOR_READ_STRING(ctx, path, 0);
+  int res = REAL(lstat64)(path, buf);
+  if (!res)
+    COMMON_INTERCEPTOR_WRITE_RANGE(ctx, buf, __sanitizer::struct_stat64_sz);
+  return res;
+}
+#define INIT_LSTAT64 COMMON_INTERCEPT_FUNCTION(lstat64)
+#else
+#define INIT_LSTAT64
+#endif
+
 #if SANITIZER_INTERCEPT___XSTAT
 INTERCEPTOR(int, __xstat, int version, const char *path, void *buf) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, __xstat, version, path, buf);
   if (common_flags()->intercept_stat)
     COMMON_INTERCEPTOR_READ_STRING(ctx, path, 0);
   int res = REAL(__xstat)(version, path, buf);
   if (!res)
#endif
   INIT_PTHREAD_SETCANCEL;
   INIT_MINCORE;
   INIT_PROCESS_VM_READV;
   INIT_CTERMID;
   INIT_CTERMID_R;
   INIT_RECV_RECVFROM;
   INIT_SEND_SENDTO;
   INIT_STAT;
+  INIT_STAT64;
   INIT_EVENTFD_READ_WRITE;
   INIT_LSTAT;
+  INIT_LSTAT64;
   INIT___XSTAT;
   INIT___XSTAT64;
   INIT___LXSTAT;
   INIT___LXSTAT64;
   // FIXME: add other *stat interceptors.
   INIT_UTMP;
   INIT_UTMPX;
   INIT_GETLOADAVG;

compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h

 #define SANITIZER_INTERCEPT_RECV_RECVFROM SI_POSIX
 #define SANITIZER_INTERCEPT_SEND_SENDTO SI_POSIX
 #define SANITIZER_INTERCEPT_EVENTFD_READ_WRITE SI_LINUX
 
 #define SI_STAT_LINUX (SI_LINUX && __GLIBC_PREREQ(2, 33))
 #define SANITIZER_INTERCEPT_STAT                                        \
   (SI_FREEBSD || SI_MAC || SI_ANDROID || SI_NETBSD || SI_SOLARIS ||     \
    SI_STAT_LINUX)
+#define SANITIZER_INTERCEPT_STAT64 SI_STAT_LINUX
 #define SANITIZER_INTERCEPT_LSTAT (SI_NETBSD || SI_FREEBSD || SI_STAT_LINUX)
 #define SANITIZER_INTERCEPT___XSTAT \
   ((!SANITIZER_INTERCEPT_STAT && SI_POSIX) || SI_STAT_LINUX)
 #define SANITIZER_INTERCEPT___XSTAT64 SI_LINUX_NOT_ANDROID
 #define SANITIZER_INTERCEPT___LXSTAT SANITIZER_INTERCEPT___XSTAT
 #define SANITIZER_INTERCEPT___LXSTAT64 SI_LINUX_NOT_ANDROID
 
 #define SANITIZER_INTERCEPT_UTMP \
   (SI_POSIX && !SI_MAC && !SI_FREEBSD && !SI_NETBSD)
 #define SANITIZER_INTERCEPT_UTMPX \
   (SI_LINUX_NOT_ANDROID || SI_MAC || SI_FREEBSD || SI_NETBSD)

compiler-rt/test/msan/fstat64.cpp

+// REQUIRES: linux
+// RUN: %clangxx_msan -O0 %s -o %t && %run %t
+
+#include <stdlib.h>
+#include <sys/stat.h>
+
+int main(void) {
+  struct stat64 st;
+  if (fstat64(0, &st))
+    exit(1);
+
+  if (S_ISBLK(st.st_mode))
+    exit(0);
+
+  return 0;
+}

compiler-rt/test/msan/fstatat64.cpp

+// REQUIRES: linux
+// RUN: %clangxx_msan -O0 %s -o %t && %run %t
+
+#include <cassert>
+#include <cstdlib>
+#include <fcntl.h>
+#include <sys/stat.h>
+
+int main(void) {
+  struct stat64 st;
+  int dirfd = open("/dev", O_RDONLY);
+  if (fstatat64(dirfd, "null", &st, 0))
+    exit(1);
+
+  assert(S_ISCHR(st.st_mode));
+
+  return 0;
+}

compiler-rt/test/msan/stat64.cpp

+// REQUIRES: linux
+// RUN: %clangxx_msan -O0 %s -o %t && %run %t
+
+#include <cassert>
+#include <cstdlib>
+#include <sys/stat.h>
+
+int main(void) {
+  struct stat64 st;
+  if (stat64("/dev/null", &st))
+    exit(1);
+
+  assert(S_ISCHR(st.st_mode));
+
+  return 0;
+}

compiler-rt/test/sanitizer_common/TestCases/Posix/lstat64.cpp

+// REQUIRES: linux
+// RUN: %clangxx -O0 -g %s -o %t && %run %t
+
+#include <assert.h>
+#include <stdlib.h>
+#include <sys/stat.h>
+
+int main(void) {
+  struct stat64 st;
+
+  assert(!lstat64("/dev/null", &st));
+#if defined(__sun__) && defined(__svr4__)
+  assert(S_ISLNK(st.st_mode));
+#else
+  assert(S_ISCHR(st.st_mode));
+#endif
+
+  return 0;
+}