[libunwind][SystemZ] Use process_vm_readv to avoid potential segfaults

[uweigand]

Summary

Fix potential crashes during unwind when checking for signal frames and the current PC is invalid.

The same bug was fixed for aarch64 in https://reviews.llvm.org/D126343.

[smeenai]

process_vm_readv was introduced in Linux 3.2; is it okay to use it unconditionally for you? (aarch64 support was only added in Linux 3.7, so we were guaranteed to have the syscall available for it.)

libunwind/src/UnwindCursor.hpp

2705

For aarch64, I went through syscall instead of the libc process_vm_readv wrapper because the latter wasn't guaranteed to be present even when the kernel supported the syscall (e.g. on Android 5). If you don't have that constraint, it'd be cleaner to just use the libc wrapper (assuming it's available on SystemZ).

[uweigand]

In D129856#3657718, @smeenai wrote:

process_vm_readv was introduced in Linux 3.2; is it okay to use it unconditionally for you? (aarch64 support was only added in Linux 3.7, so we were guaranteed to have the syscall available for it.)

Well, while s390x Linux support long precedes Linux 3.2, it's still over 10 years old and all Linux distributions currently in support have a more recent kernel. So I think it's fine to rely on in unconditionally.

libunwind/src/UnwindCursor.hpp

2705

Good point. All supported SystemZ Linux distributions have a recent enough glibc, so I've switched to the glibc wrapper.

libunwind/src/UnwindCursor.hpp

 template <typename A, typename R>
 bool UnwindCursor<A, R>::setInfoForSigReturn(Registers_s390x &) {
   // Look for the sigreturn trampoline. The trampoline's body is a
   // specific instruction (see below). Typically the trampoline comes from the
   // vDSO (i.e. the __kernel_[rt_]sigreturn function). A libc might provide its
   // own restorer function, though, or user-mode QEMU might write a trampoline
   // onto the stack.
   const pint_t pc = static_cast<pint_t>(this->getReg(UNW_REG_IP));
-  const uint16_t inst = _addressSpace.get16(pc);
-  if (inst == 0x0a77 || inst == 0x0aad) {
+  // The PC might contain an invalid address if the unwind info is bad, so
+  // directly accessing it could cause a segfault. Use process_vm_readv to
+  // read the memory safely instead.
+  uint16_t inst;
+  struct iovec local_iov = {&inst, sizeof inst};
+  struct iovec remote_iov = {reinterpret_cast<void *>(pc), sizeof inst};
+  long bytesRead = process_vm_readv(getpid(), &local_iov, 1, &remote_iov, 1, 0);
+  if (bytesRead == sizeof inst && (inst == 0x0a77 || inst == 0x0aad)) {
     _info = {};
     _info.start_ip = pc;
     _info.end_ip = pc + 2;
     _isSigReturn = true;
     return true;
   }
   return false;
 }

libunwind/test/bad_unwind_info.pass.cpp

 // -*- C++ -*-
 //===----------------------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 // Ensure that libunwind doesn't crash on invalid info; the Linux aarch64
 // sigreturn frame check would previously attempt to access invalid memory in
 // this scenario.
-// REQUIRES: linux && (target={{aarch64-.+}} || target={{x86_64-.+}})
+// REQUIRES: linux && (target={{aarch64-.+}} || target={{s390x-.+}} || target={{x86_64-.+}})
 
 // GCC doesn't support __attribute__((naked)) on AArch64.
 // UNSUPPORTED: gcc
 
 // Inline assembly is incompatible with MSAN.
 // UNSUPPORTED: msan
 
 #undef NDEBUG
__asm__("// not using 0 because unwinder was already resilient to that\n"
           ".cfi_def_cfa_offset 16\n"
           "// purposely use incorrect offset for x30\n"
           ".cfi_offset x30, -8\n"
           "bl      stepper\n"
           "ldr     x30, [sp], #16\n"
           ".cfi_def_cfa_offset 0\n"
           ".cfi_restore x30\n"
           "ret\n");
+#elif defined(__s390x__)
+  __asm__("stmg    %r14,%r15,112(%r15)\n"
+    "mvghi   104(%r15),4\n"
+          "# purposely use incorrect offset for %r14\n"
+          ".cfi_offset 14, -56\n"
+          ".cfi_offset 15, -40\n"
+          "lay     %r15,-160(%r15)\n"
+          ".cfi_def_cfa_offset 320\n"
+          "brasl   %r14,stepper\n"
+          "lmg     %r14,%r15,272(%r15)\n"
+          ".cfi_restore 15\n"
+          ".cfi_restore 14\n"
+          ".cfi_def_cfa_offset 160\n"
+          "br      %r14\n");
 #elif defined(__x86_64__)
   __asm__("pushq   %rbx\n"
           ".cfi_def_cfa_offset 16\n"
           "movq    8(%rsp), %rbx\n"
           "# purposely corrupt return value on stack\n"
           "movq    $4, 8(%rsp)\n"
           "callq   stepper\n"
           "movq    %rbx, 8(%rsp)\n"
           "popq    %rbx\n"
           ".cfi_def_cfa_offset 8\n"
           "ret\n");
 #else
-#error This test is only supported on aarch64 or x86-64
+#error This test is only supported on aarch64, s390x, or x86-64
 #endif
 }
 
 extern "C" void stepper() {
   unw_cursor_t cursor;
   unw_context_t uc;
   unw_getcontext(&uc);
   unw_init_local(&cursor, &uc);
   // stepping to bad_unwind_info should succeed
   assert(unw_step(&cursor) > 0);
   // stepping past bad_unwind_info should fail but not crash
   assert(unw_step(&cursor) <= 0);
 }
 
 int main() { bad_unwind_info(); }