diff --git a/compiler-rt/lib/asan/asan_interceptors.cpp b/compiler-rt/lib/asan/asan_interceptors.cpp --- a/compiler-rt/lib/asan/asan_interceptors.cpp +++ b/compiler-rt/lib/asan/asan_interceptors.cpp @@ -257,12 +257,13 @@ PoisonShadow(bottom, ssize, 0); } -INTERCEPTOR(int, getcontext, struct ucontext_t *ucp) { - // API does not requires to have ucp clean, and sets only part of fields. We - // use ucp->uc_stack to unpoison new stack. We prefer to have zeroes then - // uninitialized bytes. - ResetContextStack(ucp); - return REAL(getcontext)(ucp); +INTERCEPTOR(void, makecontext, struct ucontext_t *ucp, void (*func)(), int argc, + va_list args) { + // Sign the stack so we can identify it for unpoisoning. + SignContextStackBegin(ucp); + REAL(makecontext)((struct ucontext_t *)ucp, func, argc, args); + // Restore uc_stack to hide changes from caller. + SignContextStackEnd(ucp); } INTERCEPTOR(int, swapcontext, struct ucontext_t *oucp, @@ -279,9 +280,6 @@ ReadContextStack(ucp, &stack, &ssize); ClearShadowMemoryForContextStack(stack, ssize); - // See getcontext interceptor. - ResetContextStack(oucp); - # if __has_attribute(__indirect_return__) && \ (defined(__x86_64__) || defined(__i386__)) int (*real_swapcontext)(struct ucontext_t *, struct ucontext_t *) @@ -659,8 +657,8 @@ ASAN_INTERCEPT_FUNC(longjmp); #if ASAN_INTERCEPT_SWAPCONTEXT - ASAN_INTERCEPT_FUNC(getcontext); ASAN_INTERCEPT_FUNC(swapcontext); + ASAN_INTERCEPT_FUNC(makecontext); #endif #if ASAN_INTERCEPT__LONGJMP ASAN_INTERCEPT_FUNC(_longjmp); diff --git a/compiler-rt/lib/asan/asan_internal.h b/compiler-rt/lib/asan/asan_internal.h --- a/compiler-rt/lib/asan/asan_internal.h +++ b/compiler-rt/lib/asan/asan_internal.h @@ -105,8 +105,9 @@ void AsanOnDeadlySignal(int, void *siginfo, void *context); +void SignContextStackBegin(void *context); +void SignContextStackEnd(void *context); void ReadContextStack(void *context, uptr *stack, uptr *ssize); -void ResetContextStack(void *context); void StopInitOrderChecking(); // Wrapper for TLS/TSD. diff --git a/compiler-rt/lib/asan/asan_linux.cpp b/compiler-rt/lib/asan/asan_linux.cpp --- a/compiler-rt/lib/asan/asan_linux.cpp +++ b/compiler-rt/lib/asan/asan_linux.cpp @@ -209,23 +209,49 @@ #endif // SANITIZER_ANDROID #if !SANITIZER_ANDROID -void ReadContextStack(void *context, uptr *stack, uptr *ssize) { +constexpr u64 kAsanContextStackFlagsMagic = 0x51260eea02787b0c; + +void SignContextStackBegin(void *context) { ucontext_t *ucp = (ucontext_t*)context; - *stack = (uptr)ucp->uc_stack.ss_sp; - *ssize = ucp->uc_stack.ss_size; + u64 *sig = (u64 *)ucp->uc_stack.ss_sp; + u64 st = (uptr)ucp->uc_stack.ss_sp; + u64 sz = ucp->uc_stack.ss_size; + *sig = st ^ sz ^ kAsanContextStackFlagsMagic; + ucp->uc_stack.ss_sp = sig + 1; + ucp->uc_stack.ss_size -= sizeof(*sig); } -void ResetContextStack(void *context) { +void SignContextStackEnd(void *context) { ucontext_t *ucp = (ucontext_t *)context; - ucp->uc_stack.ss_sp = nullptr; - ucp->uc_stack.ss_size = 0; + u64 *sig = (u64 *)ucp->uc_stack.ss_sp; + ucp->uc_stack.ss_sp = sig - 1; + ucp->uc_stack.ss_size += sizeof(*sig); } -# else + void ReadContextStack(void *context, uptr *stack, uptr *ssize) { - UNIMPLEMENTED(); + ucontext_t *ucp = (ucontext_t *)context; + u64 *sig = (u64 *)ucp->uc_stack.ss_sp; + if (sig) { + u64 st = (uptr)ucp->uc_stack.ss_sp; + u64 sz = ucp->uc_stack.ss_size; + if (st ^ sz ^ kAsanContextStackFlagsMagic == *sig) { + *stack = st; + *ssize = sz; + return; + } + } + *stack = 0; + *ssize = 0; } +# else +void SignContextStackBegin(void *context) { UNIMPLEMENTED(); } -void ResetContextStack(void *context) { UNIMPLEMENTED(); } +void SignContextStackEnd(void *context) { UNIMPLEMENTED(); } + +void ReadContextStack(void *context, uptr *stack, uptr *ssize) { + *stack = 0; + *ssize = 0; +} # endif void *AsanDlSymNext(const char *sym) { diff --git a/compiler-rt/test/asan/TestCases/Linux/swapcontext_test.cpp b/compiler-rt/test/asan/TestCases/Linux/swapcontext_test.cpp --- a/compiler-rt/test/asan/TestCases/Linux/swapcontext_test.cpp +++ b/compiler-rt/test/asan/TestCases/Linux/swapcontext_test.cpp @@ -4,6 +4,10 @@ // RUN: %clangxx_asan -O1 %s -o %t && %run %t 2>&1 | FileCheck %s // RUN: %clangxx_asan -O2 %s -o %t && %run %t 2>&1 | FileCheck %s // RUN: %clangxx_asan -O3 %s -o %t && %run %t 2>&1 | FileCheck %s +// RUN: %clangxx_asan -fsanitize-address-use-after-return=never -O0 %s -o %t && %run %t 2>&1 | FileCheck %s +// RUN: %clangxx_asan -fsanitize-address-use-after-return=never -O1 %s -o %t && %run %t 2>&1 | FileCheck %s +// RUN: %clangxx_asan -fsanitize-address-use-after-return=never -O2 %s -o %t && %run %t 2>&1 | FileCheck %s +// RUN: %clangxx_asan -fsanitize-address-use-after-return=never -O3 %s -o %t && %run %t 2>&1 | FileCheck %s // // This test is too sublte to try on non-x86 arch for now. // Android and musl do not support swapcontext. @@ -20,25 +24,20 @@ const int kStackSize = 1 << 20; -__attribute__((noinline)) -void Throw() { - throw 1; -} +__attribute__((noinline)) void Throw() { throw 1; } -__attribute__((noinline)) -void ThrowAndCatch() { +__attribute__((noinline)) void ThrowAndCatch() { try { Throw(); - } catch(int a) { + } catch (int a) { printf("ThrowAndCatch: %d\n", a); } } void Child(int mode) { - assert(orig_context.uc_stack.ss_size == 0); - char x[32] = {0}; // Stack gets poisoned. + char x[32] = {0}; // Stack gets poisoned. printf("Child: %p\n", x); - ThrowAndCatch(); // Simulate __asan_handle_no_return(). + ThrowAndCatch(); // Simulate __asan_handle_no_return(). // (a) Do nothing, just return to parent function. // (b) Jump into the original function. Stack remains poisoned unless we do // something. @@ -53,16 +52,13 @@ int Run(int arg, int mode, char *child_stack) { printf("Child stack: %p\n", child_stack); // Setup child context. - memset(&child_context, 0xff, sizeof(child_context)); getcontext(&child_context); - assert(child_context.uc_stack.ss_size == 0); child_context.uc_stack.ss_sp = child_stack; child_context.uc_stack.ss_size = kStackSize / 2; if (mode == 0) { child_context.uc_link = &orig_context; } makecontext(&child_context, (void (*)())Child, 1, mode); - memset(&orig_context, 0xff, sizeof(orig_context)); if (swapcontext(&orig_context, &child_context) < 0) { perror("swapcontext"); return 0; @@ -74,6 +70,47 @@ return child_stack[arg]; } +ucontext_t poll_context; +ucontext_t poller_context; + +void Poll() { + swapcontext(&poll_context, &poller_context); + + { + char x = 0; + printf("POLL: %p\n", &x); + } + + swapcontext(&poll_context, &poller_context); +} + +void DoRunPoll(char *poll_stack) { + getcontext(&poll_context); + poll_context.uc_stack.ss_sp = poll_stack; + poll_context.uc_stack.ss_size = kStackSize / 2; + makecontext(&poll_context, Poll, 0); + + getcontext(&poller_context); + + swapcontext(&poller_context, &poll_context); + swapcontext(&poller_context, &poll_context); + + // Touch poll's stack to make sure it's unpoisoned. + for (int i = 0; i < kStackSize; i++) { + poll_stack[i] = i; + } +} + +void RunPoll() { + char *poll_stack = new char[kStackSize]; + + for (size_t i = 0; i < 2; ++i) { + DoRunPoll(poll_stack); + } + + delete[] poll_stack; +} + int main(int argc, char **argv) { char stack[kStackSize + 1]; // CHECK: WARNING: ASan doesn't fully support makecontext/swapcontext @@ -92,6 +129,10 @@ printf("Test4 passed\n"); // CHECK: Test4 passed - delete [] heap; + RunPoll(); + printf("Test Poll passed\n"); + // CHECK: Test Poll passed + + delete[] heap; return ret; }