[runtimes][asan] Fix swapcontext interception

[itrofimow]

Summary

Resetting oucp's stack to zero in swapcontext interception is incorrect,
since it breaks ucp cleanup after swapcontext returns in some cases:

Say we have two contexts, A and B, and we swapcontext from A to B, do
some work on Bs stack and then swapcontext back from B to A. At this
point shadow memory of Bs stack is in arbitrary state, but since we
can't know whether B will ever swapcontext-ed to again we clean up it's
shadow memory, because otherwise it remains poisoned and blows in
completely unrelated places when heap-allocated memory of Bs context
gets reused later (see https://github.com/llvm/llvm-project/issues/58633
for example). swapcontext prototype is swapcontext(ucontext* oucp,
ucontext* ucp), so in this example A is oucp and B is ucp, and i refer
to the process of cleaning up Bs shadow memory as ucp cleanup.

About how it breaks:
Take the same example with A and B: when we swapcontext back from B to A
the oucp parameter of swapcontext is actually B, and current trunk
resets its stack in a way that it becomes "uncleanupable" later. It
works fine if we do A->B->A, but if we do A->B->A->B->A no cleanup is
performed for Bs stack after B "returns" to A second time. That's
exactly what happens in the test i provided, and it's actually a pretty
common real world scenario.

Instead of resetting oucp's we make use of uc_stack.ss_flags to mark
context as "cleanup-able" by storing stack specific hash. It should be
safe since this field is not used in [get|make|swap]context functions
and is hopefully never meaningfully used in real-world scenarios (and i
haven't seen any).

Fixes https://github.com/llvm/llvm-project/issues/58633

[itrofimow]

Hi! Could you please have a look at this?

This patch is an attempt to fix bugs introduced by https://reviews.llvm.org/D129219 and https://reviews.llvm.org/D130218,
and the test added is failing with current clang++-15 with -fsanitize-address-use-after-return=never.

Actually about that -fsanitize-address-use-after-return, which default value was changed to
runtime in clang-15 - doesn't that render all that cleanup machinery useless, since fake stack is used instead of the stack specified in ucontext_t?

[vitalybuka]

In D137654#3919620, @itrofimow wrote:

Hi! Could you please have a look at this?

This patch is an attempt to fix bugs introduced by https://reviews.llvm.org/D129219 and https://reviews.llvm.org/D130218,
and the test added is failing with current clang++-15 with -fsanitize-address-use-after-return=never.

Actually about that -fsanitize-address-use-after-return, which default value was changed to
runtime in clang-15 - doesn't that render all that cleanup machinery useless, since fake stack is used instead of the stack specified in ucontext_t?

Yes, it's less important. UAR moves most variables to the fake, stack, but not all.
Also if UAR allocator overflows it falls back to non-UAR stack.

compiler-rt/lib/asan/asan_interceptors.cpp

259–260

so if we do:
getcontext
update fields, including flags
makecontext
we will not be able to tell a difference?

306

if you change ReadContextStack, please make it return bool: true - need cleanaup, false does not
then hide kAsanContextStackFlagsMagic into ReadContextStack
and you don't need return flags after that

319

I still think that intercepting makecontext is the better solution.

INTERCEPTOR( ... makecontext {
...
ucp->uc_stack.ss_size -= sizeof(u64);
*(ucp->uc_stack.ss_sp + ucp->uc_stack.ss_size) = kMagic.
return REAL(makecontext)
...
}

Then we need only to check: *(ucp->uc_stack.ss_sp + ucp->uc_stack.ss_size) == magic to decide

compiler-rt/lib/asan/asan_linux.cpp

230

It looks "ss_flags == kAsanContextStackFlagsMagic" only if "ss_sp == nullptr"

[itrofimow]

compiler-rt/lib/asan/asan_interceptors.cpp

259–260

Yes, but that's the point of using ss_flags for this: nobody uses them for anything meaningful,
this field is either set to 0 or left unchanged after getcontext call.

I mean, some people might use ss_flags, but for them we at least would break in a
realistically debuggable way, not just some random use-after-scope in a completely unrelated places.

319

I see a couple of problems with intercepting makecontext:

first, makecontext takes ellipsis (...) args, and i'm not sure how to pass that to real makecontext without too much hassle

second, saving magic to users stack is unreliable, and the exact approach you provided might break boost.context for instance (https://github.com/boostorg/context/blob/develop/include/boost/context/continuation_ucontext.hpp#L279)

compiler-rt/lib/asan/asan_linux.cpp

230

Not necessary: ss_sp|ss_size could be changed by user after getcontext call

The idea is that there are 3 major cases:

1. context is initialized with getcontext for later usage with makecontext. Since nobody uses ss_flags (see my other comment for explanation) we can reliably tell that we should cleanup its stack
2. context is some global variable that is just set to zeroes (that's what happens in tests, for example) - we can't distinguish this case from 1. but can assume that ss_sp is either implicitly zeroed or set by user, who also explicitly set ss_flags to zero
3. context is uninitialized and used as oucp for swapcontext - then its flags would never be equal to magic, so we won't try to clean it up

[itrofimow]

compiler-rt/lib/asan/asan_interceptors.cpp

259–260

You are right, setting ss_flags in makecontext would be better, but idk how to do that

[itrofimow]

• cr fixes

[itrofimow]

Hi @vitalybuka!
Did you have a chance to make yourself familiar with my reasoning?

[vitalybuka]

Using flags is to easy to find example when it fails.

With makecontext the only issues is ... handling, I can look into this a little bit later.
Also with makecontext we can handle uc_link, we need to clean the stack before moving to the next.

compiler-rt/lib/asan/asan_interceptors.cpp

319

I see a couple of problems with intercepting makecontext:

first, makecontext takes ellipsis (...) args, and i'm not sure how to pass that to real makecontext without too much hassle

Can be tricky, but we do something like this for printf interceptors

second, saving magic to users stack is unreliable, and the exact approach you provided might break boost.context for instance (https://github.com/boostorg/context/blob/develop/include/boost/context/continuation_ucontext.hpp#L279)

It should not be a problem, makecontext implementation already cut off a piece of buffer for own data.

compiler-rt/lib/asan/asan_linux.cpp

214–215

can you make it more "random", I suspect probability of this constant in unrelated place is above average.

compiler-rt/test/asan/TestCases/Linux/swapcontext_test.cpp

28

is this clang format?
if so please move out reformating into a separate CL, or just revert here

95

I can imagine someone clears poll_context.uc_stack before setting ss_sp and ss_size

[itrofimow]

In D137654#3925990, @vitalybuka wrote:

Using flags is to easy to find example when it fails.

Maybe i'm having a brain lag here, but what would that example be?
One has to explicitly set this field to non-zero after getcontext (or makecontext if i manage to intercept it somehow and move the assignment of flags there),
and it seems to me like literally nobody does that - it's either left unchanged or zeroed.

ss_flags is either set to Magic by me or set to 0 by user (and maybe i should add checks for SS_DISABLE/SS_ONSTACK as well),
and as long as it's set to something meaningful we can almost reliably identify this context as cleanup-able,
because having meaningful values implies it was set up by user manually, and the context isn't used just as oucp for swapcontext without prior setup.
What am i missing here?

P.S. I do understand that this is still an heuristic and can fail in some cases, but i would argue that those cases are uncommon to say the least

compiler-rt/lib/asan/asan_interceptors.cpp

319

Can be tricky, but we do something like this for printf interceptors

I might be mistaken, but it seems to me that for printf/scanf functions Asan just proxies to their analogues in libc taking va_list (vprintf/vscanf and the likes of). However there is no such thing for makecontext, sadly.

It should not be a problem, makecontext implementation already cut off a piece of buffer for own data.

You are right, in this exact case it would work, but the idea of manipulating user input in such ways makes me uneasy: people might rely on their layout/sizes, and we can unintentionally bring them all kinds of not-that-easy-to-debug UBs.

compiler-rt/lib/asan/asan_linux.cpp

214–215

I hope it is)

I was thinking about scenarios where manipulating ss_flags breaks someones logic, and they start to debug what's going on and why are there mismatches in this value. For me this screams "i am not random garbage" and should give a hint that this is intentional.

Would be better to have this set in makecontext, that's true.

compiler-rt/test/asan/TestCases/Linux/swapcontext_test.cpp

28

Yes, it's clang-format. Will revert

95

Not sure if i understood this, could you please elaborate?

[itrofimow]

• more exhaustive check for flags

[itrofimow]

@vitalybuka gently pinging you on this. Can you see this ever landing or am i going the wrong direction with the idea of using ss_flags?

[vitalybuka]

In D137654#3963774, @itrofimow wrote:

@vitalybuka gently pinging you on this. Can you see this ever landing or am i going the wrong direction with the idea of using ss_flags?

@dvyukov @eugenis

Sorry I wanted to try makecontext interceptor and it works fine, but I hit other issues I have no idea how to solve.
I think we can't have reasonable context switch support and rather recommend to remove existing "INTERCEPTOR(int, swapcontext" and make poisoning users responsibility.

Or simplify interceptors to:

INTERCEPTOR(int, swapcontext, struct ucontext_t *oucp,
            struct ucontext_t *ucp) {
  static bool reported_warning = false;
  if (!reported_warning) {
    Report("WARNING: ASan doesn't fully support makecontext/swapcontext "
           "functions and may produce false positives in some cases!\n");
    reported_warning = true;
  }
  ___asan_handle_no_return();
  int res = real_swapcontext(oucp, ucp);
  __asan_handle_no_return();
  return res;
}

and make users to use existing sanitizer_start_switch_fiber/sanitizer_finish_switch_fiber to make sure __asan_handle_no_return does the job.

[vitalybuka]

don't use flags

[vitalybuka]

switch back to flags

[MaskRay]

since it breaks ucp cleanup after swapcontext returns in some cases.

Can you elaborate a bit what is "ucp cleanup" and how it breaks?

compiler-rt/lib/asan/asan_linux.cpp

231

^ has lower precedence than ==. This may not work as intended.

[itrofimow]

In D137654#4030513, @MaskRay wrote:

since it breaks ucp cleanup after swapcontext returns in some cases.

Can you elaborate a bit what is "ucp cleanup" and how it breaks?

Sure.
Say we have two contexts, A and B, and we swapcontext from A to B, do some work on Bs stack and then swapcontext back from B to A.
At this point shadow memory of Bs stack is in arbitrary state, but since we can't know whether B will ever swapcontext-ed to again we clean up it's shadow memory,
because otherwise it remains poisoned and blows in completely unrelated places when heap-allocated memory of Bs context gets reused later (see https://github.com/llvm/llvm-project/issues/58633 for example).
swapcontext prototype is swapcontext(ucontext* oucp, ucontext* ucp), so in this example A is oucp and B is ucp, and i refer to the process of cleaning up Bs shadow memory as ucp cleanup.

About how it breaks:
Take the same example with A and B: when we swapcontext back from B to A the oucp parameter of swapcontext is actually B, and current trunk resets its stack in a way that it becomes "uncleanupable" later.
It works fine if we do A->B->A, but if we do A->B->A->B->A no cleanup is performed for Bs stack after after B "returns" to A second time.
That's exactly what happens in the test i provided, and it's actually a pretty common real world scenario.

Hope this clarifies things at least a bit.

[MaskRay]

In D137654#4031095, @itrofimow wrote:

In D137654#4030513, @MaskRay wrote:

since it breaks ucp cleanup after swapcontext returns in some cases.

Can you elaborate a bit what is "ucp cleanup" and how it breaks?

Sure.
Say we have two contexts, A and B, and we swapcontext from A to B, do some work on Bs stack and then swapcontext back from B to A.
At this point shadow memory of Bs stack is in arbitrary state, but since we can't know whether B will ever swapcontext-ed to again we clean up it's shadow memory,
because otherwise it remains poisoned and blows in completely unrelated places when heap-allocated memory of Bs context gets reused later (see https://github.com/llvm/llvm-project/issues/58633 for example).
swapcontext prototype is swapcontext(ucontext* oucp, ucontext* ucp), so in this example A is oucp and B is ucp, and i refer to the process of cleaning up Bs shadow memory as ucp cleanup.

About how it breaks:
Take the same example with A and B: when we swapcontext back from B to A the oucp parameter of swapcontext is actually B, and current trunk resets its stack in a way that it becomes "uncleanupable" later.
It works fine if we do A->B->A, but if we do A->B->A->B->A no cleanup is performed for Bs stack after after B "returns" to A second time.
That's exactly what happens in the test i provided, and it's actually a pretty common real world scenario.

Hope this clarifies things at least a bit.

Thanks! You may fold the description into the commit message/Differential summary and perhaps add a brief comment (including A->B->A->B->A) to the test function Poll.

[itrofimow]

In D137654#4032187, @MaskRay wrote:

In D137654#4031095, @itrofimow wrote:

In D137654#4030513, @MaskRay wrote:

since it breaks ucp cleanup after swapcontext returns in some cases.

Can you elaborate a bit what is "ucp cleanup" and how it breaks?

Sure.
Say we have two contexts, A and B, and we swapcontext from A to B, do some work on Bs stack and then swapcontext back from B to A.
At this point shadow memory of Bs stack is in arbitrary state, but since we can't know whether B will ever swapcontext-ed to again we clean up it's shadow memory,
because otherwise it remains poisoned and blows in completely unrelated places when heap-allocated memory of Bs context gets reused later (see https://github.com/llvm/llvm-project/issues/58633 for example).
swapcontext prototype is swapcontext(ucontext* oucp, ucontext* ucp), so in this example A is oucp and B is ucp, and i refer to the process of cleaning up Bs shadow memory as ucp cleanup.

About how it breaks:
Take the same example with A and B: when we swapcontext back from B to A the oucp parameter of swapcontext is actually B, and current trunk resets its stack in a way that it becomes "uncleanupable" later.
It works fine if we do A->B->A, but if we do A->B->A->B->A no cleanup is performed for Bs stack after after B "returns" to A second time.
That's exactly what happens in the test i provided, and it's actually a pretty common real world scenario.

Hope this clarifies things at least a bit.

Thanks! You may fold the description into the commit message/Differential summary and perhaps add a brief comment (including A->B->A->B->A) to the test function Poll.

Updated the summary with the more detailed explanation of the problem and a brief of proposed changes.

Actually, what's the state of this patch? It feels to me that there are 3 competing possibilities of what to do with the swapcontext issue:

1. Land this, see how it goes and what/where it breaks, if any
2. Completely abandon all cleanup machinery and make it users responsibility, as @vitalybuka suggested
3. Revert https://reviews.llvm.org/D129219 together with https://reviews.llvm.org/D130218

I could try to ping folks from github issue to try this patch out before merging, to check if it's actually working

[itrofimow]

Hi!
Is there anything i can do to help resolving the issue (https://github.com/llvm/llvm-project/issues/58633), be that this patch or reverting some other patches?
Right now i'm a bit confused as what to do with this and how to advance any further.

@MaskRay @vitalybuka

[vitalybuka]

In D137654#4094514, @itrofimow wrote:

Hi!
Is there anything i can do to help resolving the issue (https://github.com/llvm/llvm-project/issues/58633), be that this patch or reverting some other patches?
Right now i'm a bit confused as what to do with this and how to advance any further.

@MaskRay @vitalybuka

Sorry, the problem totally slipped my mind.
I will review it in the first half of the weak, can't do today.
Feel free to ping me any other day, If I stop replying.

compiler-rt/test/asan/TestCases/Linux/swapcontext_test.cpp

104

I suspect with higher O levels it will be converted into stack buffer

[vitalybuka]

Actually, what's the state of this patch? It feels to me that there are 3 competing possibilities of what to do with the swapcontext issue:

1. Land this, see how it goes and what/where it breaks, if any
2. Completely abandon all cleanup machinery and make it users responsibility, as @vitalybuka suggested
3. Revert https://reviews.llvm.org/D129219 together with https://reviews.llvm.org/D130218

So I would prefer no.1, likely some cases would need some user side workaround like no.2
Do you see issues with the current state of the patch? If not, I can land it.
Would you prefer if I submit the patch into your name, as it was started by you? If you don't want to accept the blame for this version, I can land with my name.

[itrofimow]

In D137654#4101055, @vitalybuka wrote:

Actually, what's the state of this patch? It feels to me that there are 3 competing possibilities of what to do with the swapcontext issue:

1. Land this, see how it goes and what/where it breaks, if any
2. Completely abandon all cleanup machinery and make it users responsibility, as @vitalybuka suggested
3. Revert https://reviews.llvm.org/D129219 together with https://reviews.llvm.org/D130218

So I would prefer no.1, likely some cases would need some user side workaround like no.2
Do you see issues with the current state of the patch? If not, I can land it.
Would you prefer if I submit the patch into your name, as it was started by you? If you don't want to accept the blame for this version, I can land with my name.

Left some inline comments, please have a look.

I'm fine with taking the blame for this. In github it should be shown as co-authored by us anyway, so people would be able to reach out if something goes wrong.

compiler-rt/lib/asan/asan_interceptors.cpp

262

My (limited) knowledge of C tells me, that there is no portable way to forward an invocation of variadic function
(https://c-faq.com/varargs/handoff.html).
Are you sure that this indeed does what it's supposed to do?

compiler-rt/lib/asan/asan_linux.cpp

231

Nice catch

[vitalybuka]

I will look into makecontext issue

compiler-rt/lib/asan/asan_interceptors.cpp

262

somehow it works on test, but replacing ... with va_list does not look right

[itrofimow]

Hi @vitalybuka! Did you have a chance to look into makecontext issue?

compiler-rt/lib/asan/asan_interceptors.cpp

262

I'm almost sure that it breaks as soon as there are more than 6 (on x86 that is) parameters, or more than sizeof(va_list) / sizeof(int64).
Might be worth to add a test for that

[itrofimow]

Hi @vitalybuka ! Pinging you about this

[vitalybuka]

fix makecontext interceptor

[vitalybuka]

up to 64 args

[vitalybuka]

This works for me

[vitalybuka]

rebase

[itrofimow]

Hi @vitalybuka! Thank you for getting back to this.

I really like your idea of marking flags in makecontext instead of getcontext, and i'm glad you've found a solution to ellipsis args forwarding - neat!
I can confirm that this fixes all the standalone repros i had, and i'm working on testing some larger projects with this patch applied to clang.

There seems to be one last issue with operator precedence in ReadContextStack left, and i guess we are done after that?

[vitalybuka]

fix ^, == precedence

[itrofimow]

I can confirm that this patch (with parentheses added around comparison in ReadContextStack)
applied atop of clang-15.0.7 fixes https://github.com/userver-framework/userver/issues/170

[vitalybuka]

Use existing hash function

[vitalybuka]

compiler-rt/lib/asan/asan_linux.cpp

231

Done.

[vitalybuka]

Thanks for verifying. I am going to merge this.

compiler-rt/lib/asan/asan_interceptors.cpp

static void ClearShadowMemoryForContextStack(uptr stack, uptr ssize) {
   uptr PageSize = GetPageSizeCached();
   uptr bottom = RoundDownTo(stack, PageSize);
   if (!AddrIsInMem(bottom))
     return;
   ssize += stack - bottom;
   ssize = RoundUpTo(ssize, PageSize);
   PoisonShadow(bottom, ssize, 0);
 }
 
-INTERCEPTOR(int, getcontext, struct ucontext_t *ucp) {
-  // API does not requires to have ucp clean, and sets only part of fields. We
-  // use ucp->uc_stack to unpoison new stack. We prefer to have zeroes then
-  // uninitialized bytes.
-  ResetContextStack(ucp);
-  return REAL(getcontext)(ucp);
+INTERCEPTOR(void, makecontext, struct ucontext_t *ucp, void (*func)(), int argc,
+            ...) {
+  va_list ap;
+  uptr args[64];
+  // We don't know a better way to forward ... into REAL function. We can
+  // increase args size if neccecary.
+  CHECK_LE(argc, ARRAY_SIZE(args));
+  internal_memset(args, 0, sizeof(args));
+  va_start(ap, argc);
+  for (int i = 0; i < argc; ++i) args[i] = va_arg(ap, uptr);
+  va_end(ap);
+
+#    define ENUMERATE_ARRAY_4(start) \
+      args[start], args[start + 1], args[start + 2], args[start + 3]
+#    define ENUMERATE_ARRAY_16(start)                         \
+      ENUMERATE_ARRAY_4(start), ENUMERATE_ARRAY_4(start + 4), \
+          ENUMERATE_ARRAY_4(start + 8), ENUMERATE_ARRAY_4(start + 12)
+#    define ENUMERATE_ARRAY_64()                                             \
+      ENUMERATE_ARRAY_16(0), ENUMERATE_ARRAY_16(16), ENUMERATE_ARRAY_16(32), \
+          ENUMERATE_ARRAY_16(48)
+
+  REAL(makecontext)
+  ((struct ucontext_t *)ucp, func, argc, ENUMERATE_ARRAY_64());
+
+#    undef ENUMERATE_ARRAY_4
+#    undef ENUMERATE_ARRAY_16
+#    undef ENUMERATE_ARRAY_64
+
+  // Sign the stack so we can identify it for unpoisoning.
+  SignContextStack(ucp);
 }
 
 INTERCEPTOR(int, swapcontext, struct ucontext_t *oucp,
             struct ucontext_t *ucp) {
   static bool reported_warning = false;
   if (!reported_warning) {
     Report("WARNING: ASan doesn't fully support makecontext/swapcontext "
            "functions and may produce false positives in some cases!\n");
     reported_warning = true;
   }
   // Clear shadow memory for new context (it may share stack
   // with current context).
   uptr stack, ssize;
   ReadContextStack(ucp, &stack, &ssize);
   ClearShadowMemoryForContextStack(stack, ssize);
 
-  // See getcontext interceptor.
-  ResetContextStack(oucp);
-
 #    if __has_attribute(__indirect_return__) && \
         (defined(__x86_64__) || defined(__i386__))
   int (*real_swapcontext)(struct ucontext_t *, struct ucontext_t *)
       __attribute__((__indirect_return__)) = REAL(swapcontext);
   int res = real_swapcontext(oucp, ucp);
 #    else
   int res = REAL(swapcontext)(oucp, ucp);
 #    endif
   // swapcontext technically does not return, but program may swap context to
   // "oucp" later, that would look as if swapcontext() returned 0.
   // We need to clear shadow for ucp once again, as it may be in arbitrary
   // state.
   ClearShadowMemoryForContextStack(stack, ssize);
   return res;
 }
 #endif  // ASAN_INTERCEPT_SWAPCONTEXT
 
 #if SANITIZER_NETBSD
 #define longjmp __longjmp14
 #define siglongjmp __siglongjmp14
 #endif
 

 #if ASAN_INTERCEPT_ATOLL_AND_STRTOLL
   ASAN_INTERCEPT_FUNC(atoll);
   ASAN_INTERCEPT_FUNC(strtoll);
 #endif
 
   // Intecept jump-related functions.
   ASAN_INTERCEPT_FUNC(longjmp);
 
-#if ASAN_INTERCEPT_SWAPCONTEXT
-  ASAN_INTERCEPT_FUNC(getcontext);
+#  if ASAN_INTERCEPT_SWAPCONTEXT
   ASAN_INTERCEPT_FUNC(swapcontext);
-#endif
-#if ASAN_INTERCEPT__LONGJMP
+  ASAN_INTERCEPT_FUNC(makecontext);
+#  endif
+#  if ASAN_INTERCEPT__LONGJMP
   ASAN_INTERCEPT_FUNC(_longjmp);
 #endif
 #if ASAN_INTERCEPT___LONGJMP_CHK
   ASAN_INTERCEPT_FUNC(__longjmp_chk);
 #endif
 #if ASAN_INTERCEPT_SIGLONGJMP
   ASAN_INTERCEPT_FUNC(siglongjmp);
 #endif

compiler-rt/lib/asan/asan_internal.h

 // loaded image containing `needle' and then enumerates all global metadata
 // structures declared in that image, applying `op' (e.g.,
 // __asan_(un)register_globals) to them.
 typedef void (*globals_op_fptr)(__asan_global *, uptr);
 void AsanApplyToGlobals(globals_op_fptr op, const void *needle);
 
 void AsanOnDeadlySignal(int, void *siginfo, void *context);
 
+void SignContextStack(void *context);
 void ReadContextStack(void *context, uptr *stack, uptr *ssize);
-void ResetContextStack(void *context);
 void StopInitOrderChecking();
 
 // Wrapper for TLS/TSD.
 void AsanTSDInit(void (*destructor)(void *tsd));
 void *AsanTSDGet();
 void AsanTSDSet(void *tsd);
 void PlatformTSDDtor(void *tsd);
 

compiler-rt/lib/asan/asan_linux.cpp

 #  include <unwind.h>
 
 #  include "asan_interceptors.h"
 #  include "asan_internal.h"
 #  include "asan_premap_shadow.h"
 #  include "asan_thread.h"
 #  include "sanitizer_common/sanitizer_flags.h"
 #  include "sanitizer_common/sanitizer_freebsd.h"
+#  include "sanitizer_common/sanitizer_hash.h"
 #  include "sanitizer_common/sanitizer_libc.h"
 #  include "sanitizer_common/sanitizer_procmaps.h"
 
 #  if SANITIZER_FREEBSD
 #    include <sys/link_elf.h>
 #  endif
 
 #  if SANITIZER_SOLARIS
if (__asan_rt_version == ASAN_RT_VERSION_UNDEFINED) {
       __asan_rt_version = ASAN_RT_VERSION_STATIC;
     } else if (__asan_rt_version != ASAN_RT_VERSION_STATIC) {
       ReportIncompatibleRT();
     }
   }
 }
 #  endif  // SANITIZER_ANDROID
 
 #  if ASAN_INTERCEPT_SWAPCONTEXT
+constexpr u32 kAsanContextStackFlagsMagic = 0x51260eea;
+
+static int HashContextStack(const ucontext_t &ucp) {
+  MurMur2Hash64Builder hash(kAsanContextStackFlagsMagic);
+  hash.add(reinterpret_cast<uptr>(ucp.uc_stack.ss_sp));
+  hash.add(ucp.uc_stack.ss_size);
+  return static_cast<int>(hash.get());
+}
+
+void SignContextStack(void *context) {
+  ucontext_t *ucp = reinterpret_cast<ucontext_t *>(context);
+  ucp->uc_stack.ss_flags = HashContextStack(*ucp);
+}
+
 void ReadContextStack(void *context, uptr *stack, uptr *ssize) {
-  ucontext_t *ucp = (ucontext_t *)context;
-  *stack = (uptr)ucp->uc_stack.ss_sp;
+  const ucontext_t *ucp = reinterpret_cast<const ucontext_t *>(context);
+  if (HashContextStack(*ucp) == ucp->uc_stack.ss_flags) {
+    *stack = reinterpret_cast<uptr>(ucp->uc_stack.ss_sp);
     *ssize = ucp->uc_stack.ss_size;
+    return;
   }
-
-void ResetContextStack(void *context) {
-  ucontext_t *ucp = (ucontext_t *)context;
-  ucp->uc_stack.ss_sp = nullptr;
-  ucp->uc_stack.ss_size = 0;
+  *stack = 0;
+  *ssize = 0;
 }
 #  endif  // ASAN_INTERCEPT_SWAPCONTEXT
 
 void *AsanDlSymNext(const char *sym) { return dlsym(RTLD_NEXT, sym); }
 
 bool HandleDlopenInit() {
   // Not supported on this platform.
   static_assert(!SANITIZER_SUPPORTS_INIT_FOR_DLOPEN,
                 "Expected SANITIZER_SUPPORTS_INIT_FOR_DLOPEN to be false");
   return false;
 }
 
 }  // namespace __asan
 
 #endif  // SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD ||
         // SANITIZER_SOLARIS

compiler-rt/test/asan/TestCases/Linux/swapcontext_test.cpp

 #include <ucontext.h>
 #include <unistd.h>
 
 ucontext_t orig_context;
 ucontext_t child_context;
 
 const int kStackSize = 1 << 20;
 
-__attribute__((noinline))
-void Throw() {
-  throw 1;
-}
+__attribute__((noinline)) void Throw() { throw 1; }
 
-__attribute__((noinline))
-void ThrowAndCatch() {
+__attribute__((noinline)) void ThrowAndCatch() {
   try {
     Throw();
-  } catch(int a) {
+  } catch (int a) {
     printf("ThrowAndCatch: %d\n", a);
   }
 }
 
-void Child(int mode) {
-  assert(orig_context.uc_stack.ss_size == 0);
-  char x[32] = {0};  // Stack gets poisoned.
-  printf("Child: %p\n", x);
-  ThrowAndCatch();  // Simulate __asan_handle_no_return().
+void Child(int mode, int a, int b, int c) {
+  char x[32] = {0}; // Stack gets poisoned.
+  printf("Child: %d\n", x);
+  assert(a == 'a');
+  assert(b == 'b');
+  assert(c == 'c');
+  ThrowAndCatch(); // Simulate __asan_handle_no_return().
   // (a) Do nothing, just return to parent function.
   // (b) Jump into the original function. Stack remains poisoned unless we do
   //     something.
   if (mode == 1) {
     if (swapcontext(&child_context, &orig_context) < 0) {
       perror("swapcontext");
       _exit(0);
     }
   }
 }
 
 int Run(int arg, int mode, char *child_stack) {
   printf("Child stack: %p\n", child_stack);
   // Setup child context.
-  memset(&child_context, 0xff, sizeof(child_context));
   getcontext(&child_context);
-  assert(child_context.uc_stack.ss_size == 0);
   child_context.uc_stack.ss_sp = child_stack;
   child_context.uc_stack.ss_size = kStackSize / 2;
   if (mode == 0) {
     child_context.uc_link = &orig_context;
   }
-  makecontext(&child_context, (void (*)())Child, 1, mode);
-  memset(&orig_context, 0xff, sizeof(orig_context));
+  makecontext(&child_context, (void (*)())Child, 4, mode, 'a', 'b', 'c');
   if (swapcontext(&orig_context, &child_context) < 0) {
     perror("swapcontext");
     return 0;
   }
   // Touch childs's stack to make sure it's unpoisoned.
   for (int i = 0; i < kStackSize; i++) {
     child_stack[i] = i;
   }
   return child_stack[arg];
 }
 
+ucontext_t poll_context;
+ucontext_t poller_context;
+
+void Poll() {
+  swapcontext(&poll_context, &poller_context);
+
+  {
+    char x = 0;
+    printf("POLL: %p\n", &x);
+  }
+
+  swapcontext(&poll_context, &poller_context);
+}
+
+void DoRunPoll(char *poll_stack) {
+  getcontext(&poll_context);
+  poll_context.uc_stack.ss_sp = poll_stack;
+  poll_context.uc_stack.ss_size = kStackSize / 2;
+  makecontext(&poll_context, Poll, 0);
+
+  getcontext(&poller_context);
+
+  swapcontext(&poller_context, &poll_context);
+  swapcontext(&poller_context, &poll_context);
+
+  // Touch poll's stack to make sure it's unpoisoned.
+  for (int i = 0; i < kStackSize; i++) {
+    poll_stack[i] = i;
+  }
+}
+
+void RunPoll() {
+  char *poll_stack = new char[kStackSize];
+
+  for (size_t i = 0; i < 2; ++i) {
+    DoRunPoll(poll_stack);
+  }
+
+  delete[] poll_stack;
+}
+
 int main(int argc, char **argv) {
   char stack[kStackSize + 1];
   int ret = 0;
   ret += Run(argc - 1, 0, stack);
   ret += Run(argc - 1, 1, stack);
   char *heap = new char[kStackSize + 1];
   ret += Run(argc - 1, 0, heap);
   ret += Run(argc - 1, 1, heap);
-  delete [] heap;
+
+  RunPoll();
+  delete[] heap;
   return ret;
 }