[sanitizer] Support v2 and v3 capabilities

[iii]

Summary

capget() and capset() may read or write more than one cap_user_data_t,
depending on the version field of cap_user_header_t. Currently the
code assumes it's just one, so MSan complains if an application uses
version 2 or 3, where two cap_user_data_ts are used.

Parse the header in order to determine the number of cap_user_data_ts.
Also add a test.

[iii]

• Do not define the constants, the kernel provides them since v2.6.
• Rewrite the test in C.

[iii]

Ping.

[glider]

LGTM with a nit.

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp

252

Do we want to do anything in the case of incorrect version?

compiler-rt/test/sanitizer_common/TestCases/Linux/cap.c

36

If we do, can you please add a test case for it?

[iii]

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp

252

I used 1 here in order to keep the old sanitizer behavior, but, come to think of it, it doesn't really make sense: if a buggy program passes a bad version, we don't want to unpoison the buffer. There can be new versions added in the future too, but this code would have to be updated in order to support them anyway.

So I'll change this to 0 and think of a way to test this.

[iii]

• Do not touch memory if the version is incorrect.
• Test this.

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

5762–5768

5780

same

[iii]

• Compute datasz only when necessary.

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

 #endif
 
 #if SANITIZER_INTERCEPT_CAPGET
 INTERCEPTOR(int, capget, void *hdrp, void *datap) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, capget, hdrp, datap);
   if (hdrp)
     COMMON_INTERCEPTOR_READ_RANGE(ctx, hdrp, __user_cap_header_struct_sz);
+  unsigned datasz = __user_cap_data_struct_sz(hdrp);
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://github.com/google/sanitizers/issues/321.
   int res = REAL(capget)(hdrp, datap);
   if (res == 0 && datap)
-    COMMON_INTERCEPTOR_WRITE_RANGE(ctx, datap, __user_cap_data_struct_sz);
+    COMMON_INTERCEPTOR_WRITE_RANGE(ctx, datap, datasz);
   // We can also return -1 and write to hdrp->version if the version passed in
   // hdrp->version is unsupported. But that's not a trivial condition to check,
   // and anyway COMMON_INTERCEPTOR_READ_RANGE protects us to some extent.
   return res;
 }
 INTERCEPTOR(int, capset, void *hdrp, const void *datap) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, capset, hdrp, datap);
   if (hdrp)
     COMMON_INTERCEPTOR_READ_RANGE(ctx, hdrp, __user_cap_header_struct_sz);
+  unsigned datasz = __user_cap_data_struct_sz(hdrp);
   if (datap)
-    COMMON_INTERCEPTOR_READ_RANGE(ctx, datap, __user_cap_data_struct_sz);
+    COMMON_INTERCEPTOR_READ_RANGE(ctx, datap, datasz);
   return REAL(capset)(hdrp, datap);
 }
 #define INIT_CAPGET                  \
   COMMON_INTERCEPT_FUNCTION(capget); \
   COMMON_INTERCEPT_FUNCTION(capset);
 #else
 #define INIT_CAPGET
 #endif

compiler-rt/lib/sanitizer_common/sanitizer_common_syscalls.inc

 PRE_SYSCALL(capget)(void *header, void *dataptr) {
   if (header)
     PRE_READ(header, __user_cap_header_struct_sz);
 }
 
 POST_SYSCALL(capget)(long res, void *header, void *dataptr) {
   if (res >= 0)
     if (dataptr)
-      POST_WRITE(dataptr, __user_cap_data_struct_sz);
+      POST_WRITE(dataptr, __user_cap_data_struct_sz(header));
 }
 
 PRE_SYSCALL(capset)(void *header, const void *data) {
   if (header)
     PRE_READ(header, __user_cap_header_struct_sz);
   if (data)
-    PRE_READ(data, __user_cap_data_struct_sz);
+    PRE_READ(data, __user_cap_data_struct_sz(header));
 }
 
 POST_SYSCALL(capset)(long res, void *header, const void *data) {}
 
 PRE_SYSCALL(personality)(long personality) {}
 
 POST_SYSCALL(personality)(long res, long personality) {}
 

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h

struct __sanitizer_perf_event_attr {
   unsigned type;
   unsigned size;
   // More fields that vary with the kernel version.
 };
 
 extern unsigned struct_epoll_event_sz;
 extern unsigned struct_sysinfo_sz;
 extern unsigned __user_cap_header_struct_sz;
-extern unsigned __user_cap_data_struct_sz;
+extern unsigned __user_cap_data_struct_sz(void *hdrp);
 extern unsigned struct_new_utsname_sz;
 extern unsigned struct_old_utsname_sz;
 extern unsigned struct_oldold_utsname_sz;
 
 const unsigned struct_kexec_segment_sz = 4 * sizeof(unsigned long);
 #endif  // SANITIZER_LINUX
 
 #if SANITIZER_LINUX

compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp

#    endif
   }
 #  endif  // !SANITIZER_ANDROID
 
 #  if SANITIZER_LINUX
   unsigned struct_epoll_event_sz = sizeof(struct epoll_event);
   unsigned struct_sysinfo_sz = sizeof(struct sysinfo);
   unsigned __user_cap_header_struct_sz =
       sizeof(struct __user_cap_header_struct);
-  unsigned __user_cap_data_struct_sz = sizeof(struct __user_cap_data_struct);
+  unsigned __user_cap_data_struct_sz(void *hdrp) {
+    int u32s = 0;
+    if (hdrp) {
+      switch (((struct __user_cap_header_struct *)hdrp)->version) {
+      case _LINUX_CAPABILITY_VERSION_1:
+        u32s = _LINUX_CAPABILITY_U32S_1;
+        break;
+      case _LINUX_CAPABILITY_VERSION_2:
+        u32s = _LINUX_CAPABILITY_U32S_2;
+        break;
+      case _LINUX_CAPABILITY_VERSION_3:
+        u32s = _LINUX_CAPABILITY_U32S_3;
+        break;
+      }
+    }
+    return sizeof(struct __user_cap_data_struct) * u32s;
+  }
   unsigned struct_new_utsname_sz = sizeof(struct new_utsname);
   unsigned struct_old_utsname_sz = sizeof(struct old_utsname);
   unsigned struct_oldold_utsname_sz = sizeof(struct oldold_utsname);
 #endif // SANITIZER_LINUX
 
 #if SANITIZER_LINUX
   unsigned struct_rlimit_sz = sizeof(struct rlimit);
   unsigned struct_timespec_sz = sizeof(struct timespec);

compiler-rt/test/sanitizer_common/TestCases/Linux/cap.c

+// RUN: %clang %s -o %t && %run %t
+// capget() and capset() are not intercepted on Android.
+// UNSUPPORTED: android
+
+#include <assert.h>
+#include <errno.h>
+#include <linux/capability.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include "sanitizer_common/sanitizer_specific.h"
+
+/* Use capget() and capset() from glibc. */
+int capget(cap_user_header_t header, cap_user_data_t data);
+int capset(cap_user_header_t header, const cap_user_data_t data);
+
+static void test(int version, int u32s) {
+  struct __user_cap_header_struct hdr = {
+      .version = version,
+      .pid = 0,
+  };
+  struct __user_cap_data_struct data[u32s];
+  if (capget(&hdr, data)) {
+    assert(errno == EINVAL);
+    /* Check that memory is not touched. */
+#if __has_feature(memory_sanitizer)
+    assert(__msan_test_shadow(data, sizeof(data)) == 0);
+#endif
+    hdr.version = version;
+    int err = capset(&hdr, data);
+    assert(errno == EINVAL);
+  } else {
+    for (int i = 0; i < u32s; i++)
+      printf("%x %x %x\n", data[i].effective, data[i].permitted,
+             data[i].inheritable);
+    int err = capset(&hdr, data);
+    assert(!err);
+  }
+}
+
+int main() {
+  test(0, 1); /* Test an incorrect version. */
+  test(_LINUX_CAPABILITY_VERSION_1, _LINUX_CAPABILITY_U32S_1);
+  test(_LINUX_CAPABILITY_VERSION_2, _LINUX_CAPABILITY_U32S_2);
+  test(_LINUX_CAPABILITY_VERSION_3, _LINUX_CAPABILITY_U32S_3);
+
+  return EXIT_SUCCESS;
+}