[asan] Reset stack bounds of context

[vitalybuka]

Summary

ClearShadowMemoryForContextStack assumes that context contains the stack
bounds. This is not true for a context from getcontext or oucp of
swapcontext.

compiler-rt/lib/asan/asan_interceptors.cpp

static void ClearShadowMemoryForContextStack(uptr stack, uptr ssize) {
   uptr bottom = RoundDownTo(stack, PageSize);
   ssize += stack - bottom;
   ssize = RoundUpTo(ssize, PageSize);
   static const uptr kMaxSaneContextStackSize = 1 << 22;  // 4 Mb
   if (AddrIsInMem(bottom) && ssize && ssize <= kMaxSaneContextStackSize)
     PoisonShadow(bottom, ssize, 0);
 }
 
+INTERCEPTOR(int, getcontext, struct ucontext_t *ucp) {
+  // API does not requires to have ucp clean, and sets only part of fields. We
+  // use ucp->uc_stack to unpoison new stack. We prefer to have zeroes then
+  // uninitialized bytes.
+  ResetContextStack(ucp);
+  return REAL(getcontext)(ucp);
+}
+
 INTERCEPTOR(int, swapcontext, struct ucontext_t *oucp,
             struct ucontext_t *ucp) {
   static bool reported_warning = false;
   if (!reported_warning) {
     Report("WARNING: ASan doesn't fully support makecontext/swapcontext "
            "functions and may produce false positives in some cases!\n");
     reported_warning = true;
   }
   // Clear shadow memory for new context (it may share stack
   // with current context).
   uptr stack, ssize;
   ReadContextStack(ucp, &stack, &ssize);
   ClearShadowMemoryForContextStack(stack, ssize);
+
+  // See getcontext interceptor.
+  ResetContextStack(oucp);
+
 #    if __has_attribute(__indirect_return__) && \
         (defined(__x86_64__) || defined(__i386__))
   int (*real_swapcontext)(struct ucontext_t *, struct ucontext_t *)
       __attribute__((__indirect_return__)) = REAL(swapcontext);
   int res = real_swapcontext(oucp, ucp);
 #    else
   int res = REAL(swapcontext)(oucp, ucp);
 #    endif
#if ASAN_INTERCEPT_ATOLL_AND_STRTOLL
   ASAN_INTERCEPT_FUNC(atoll);
   ASAN_INTERCEPT_FUNC(strtoll);
 #endif
 
   // Intecept jump-related functions.
   ASAN_INTERCEPT_FUNC(longjmp);
 
 #if ASAN_INTERCEPT_SWAPCONTEXT
+  ASAN_INTERCEPT_FUNC(getcontext);
   ASAN_INTERCEPT_FUNC(swapcontext);
 #endif
 #if ASAN_INTERCEPT__LONGJMP
   ASAN_INTERCEPT_FUNC(_longjmp);
 #endif
 #if ASAN_INTERCEPT___LONGJMP_CHK
   ASAN_INTERCEPT_FUNC(__longjmp_chk);
 #endif

compiler-rt/lib/asan/asan_internal.h

 // structures declared in that image, applying `op' (e.g.,
 // __asan_(un)register_globals) to them.
 typedef void (*globals_op_fptr)(__asan_global *, uptr);
 void AsanApplyToGlobals(globals_op_fptr op, const void *needle);
 
 void AsanOnDeadlySignal(int, void *siginfo, void *context);
 
 void ReadContextStack(void *context, uptr *stack, uptr *ssize);
+void ResetContextStack(void *context);
 void StopInitOrderChecking();
 
 // Wrapper for TLS/TSD.
 void AsanTSDInit(void (*destructor)(void *tsd));
 void *AsanTSDGet();
 void AsanTSDSet(void *tsd);
 void PlatformTSDDtor(void *tsd);
 

compiler-rt/lib/asan/asan_linux.cpp

 #endif // SANITIZER_ANDROID
 
 #if !SANITIZER_ANDROID
 void ReadContextStack(void *context, uptr *stack, uptr *ssize) {
   ucontext_t *ucp = (ucontext_t*)context;
   *stack = (uptr)ucp->uc_stack.ss_sp;
   *ssize = ucp->uc_stack.ss_size;
 }
-#else
+
+void ResetContextStack(void *context) {
+  ucontext_t *ucp = (ucontext_t *)context;
+  ucp->uc_stack.ss_sp = nullptr;
+  ucp->uc_stack.ss_size = 0;
+}
+#  else
 void ReadContextStack(void *context, uptr *stack, uptr *ssize) {
   UNIMPLEMENTED();
 }
-#endif
+
+void ResetContextStack(void *context) { UNIMPLEMENTED(); }
+#  endif
 
 void *AsanDlSymNext(const char *sym) {
   return dlsym(RTLD_NEXT, sym);
 }
 
 bool HandleDlopenInit() {
   // Not supported on this platform.
   static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
                 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
   return false;
 }
 
 } // namespace __asan
 
 #endif  // SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD ||
         // SANITIZER_SOLARIS

compiler-rt/lib/asan/asan_mac.cpp

void FlushUnneededASanShadowMemory(uptr p, uptr size) {
   // not page-aligned, so we only flush the page-aligned portion.
   ReleaseMemoryPagesToOS(MemToShadow(p), MemToShadow(p + size));
 }
 
 void ReadContextStack(void *context, uptr *stack, uptr *ssize) {
   UNIMPLEMENTED();
 }
 
+void ResetContextStack(void *context) { UNIMPLEMENTED(); }
+
 // Support for the following functions from libdispatch on Mac OS:
 //   dispatch_async_f()
 //   dispatch_async()
 //   dispatch_sync_f()
 //   dispatch_sync()
 //   dispatch_after_f()
 //   dispatch_after()
 //   dispatch_group_async_f()

compiler-rt/lib/asan/asan_win.cpp

 void AsanCheckDynamicRTPrereqs() {}
 
 void AsanCheckIncompatibleRT() {}
 
 void ReadContextStack(void *context, uptr *stack, uptr *ssize) {
   UNIMPLEMENTED();
 }
 
+void ResetContextStack(void *context) { UNIMPLEMENTED(); }
+
 void AsanOnDeadlySignal(int, void *siginfo, void *context) { UNIMPLEMENTED(); }
 
 bool PlatformUnpoisonStacks() { return false; }
 
 #if SANITIZER_WINDOWS64
 // Exception handler for dealing with shadow memory.
 static LONG CALLBACK
 ShadowExceptionHandler(PEXCEPTION_POINTERS exception_pointers) {

compiler-rt/test/asan/TestCases/Linux/swapcontext_test.cpp

 // Check that ASan plays well with easy cases of makecontext/swapcontext.
 
 // RUN: %clangxx_asan -O0 %s -o %t && %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan -O1 %s -o %t && %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan -O2 %s -o %t && %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan -O3 %s -o %t && %run %t 2>&1 | FileCheck %s
 //
 // This test is too sublte to try on non-x86 arch for now.
 // Android and musl do not support swapcontext.
 // REQUIRES: x86-target-arch && glibc-2.27
 
+#include <assert.h>
+#include <memory.h>
 #include <stdio.h>
 #include <ucontext.h>
 #include <unistd.h>
 
 ucontext_t orig_context;
 ucontext_t child_context;
 
 const int kStackSize = 1 << 20;
 
 __attribute__((noinline))
 void Throw() {
   throw 1;
 }
 
 __attribute__((noinline))
 void ThrowAndCatch() {
   try {
     Throw();
   } catch(int a) {
     printf("ThrowAndCatch: %d\n", a);
   }
 }
 
 void Child(int mode) {
+  assert(orig_context.uc_stack.ss_size == 0);
   char x[32] = {0};  // Stack gets poisoned.
   printf("Child: %p\n", x);
   ThrowAndCatch();  // Simulate __asan_handle_no_return().
   // (a) Do nothing, just return to parent function.
   // (b) Jump into the original function. Stack remains poisoned unless we do
   //     something.
   if (mode == 1) {
     if (swapcontext(&child_context, &orig_context) < 0) {
       perror("swapcontext");
       _exit(0);
     }
   }
 }
 
 int Run(int arg, int mode, char *child_stack) {
   printf("Child stack: %p\n", child_stack);
   // Setup child context.
+  memset(&child_context, 0xff, sizeof(child_context));
   getcontext(&child_context);
+  assert(child_context.uc_stack.ss_size == 0);
   child_context.uc_stack.ss_sp = child_stack;
   child_context.uc_stack.ss_size = kStackSize / 2;
   if (mode == 0) {
     child_context.uc_link = &orig_context;
   }
   makecontext(&child_context, (void (*)())Child, 1, mode);
+  memset(&orig_context, 0xff, sizeof(orig_context));
   if (swapcontext(&orig_context, &child_context) < 0) {
     perror("swapcontext");
     return 0;
   }
   // Touch childs's stack to make sure it's unpoisoned.
   for (int i = 0; i < kStackSize; i++) {
     child_stack[i] = i;
   }