[hwasan] add interceptor for dlopen, check if user dlopens shared library with RTLD_DEEPBIND flag

[Enna1]

Summary

Checking if user dlopens shared library with RTLD_DEEPBIND flag is implemented in sanitizer_common_interceptors.inc, and HWASAN doesn't include sanitizer_common_interceptors.inc.
This patch adds dlopen interceptor and checks if dlopen is called with RTLD_DEEPBIND flag for HWASAN.

[vitalybuka]

How important this is now?
We are likely will need sanitizer_common_interceptors.inc. So I'd rather wait for that.

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

227

why do we need to exclude android?
SANITIZER_INTERCEPT_DLOPEN_DLCLOSE is ON there for other sanitizers

[Enna1]

I'm fine with waiting for HWASAN includes sanitizer_common_interceptors.inc :)

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

227

In https://github.com/llvm/llvm-project/blob/main/compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h#L438, I see SANITIZER_INTERCEPT_DLOPEN_DLCLOSE is ON for SI_LINUX_NOT_ANDROID. Am I miss something ?

[vitalybuka]

In D149054#4297653, @Enna1 wrote:

I'm fine with waiting for HWASAN includes sanitizer_common_interceptors.inc :)

BTW There is D149234, so we don't need additional test

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

227

Sorry, my mistake.

[Enna1]

remove additional test

[vitalybuka]

We are going to use D150708 to incrementally add interceptors

[Enna1]

We are going to use D150708 to incrementally add interceptors

Thanks for pointing this, I'll abandon this patch.

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

Printf(
         "there is a bug in HWASan.\n");
     return REAL(longjmp)(env, val);
   }
   InternalLongjmp(env[0].__jmpbuf, val);
 }
 #undef SIG_BLOCK
 #undef SIG_SETMASK
 
+#    if SANITIZER_LINUX && !SANITIZER_ANDROID
+INTERCEPTOR(void *, dlopen, const char *filename, int flag) {
+  CheckNoDeepBind(filename, flag);
+  return REAL(dlopen)(filename, flag);
+}
+#    endif
+
 #  endif  // HWASAN_WITH_INTERCEPTORS
 
 namespace __hwasan {
 
 int OnExit() {
   if (CAN_SANITIZE_LEAKS && common_flags()->detect_leaks &&
       __lsan::HasReportedLeaks()) {
     return common_flags()->exitcode;
   }
   // FIXME: ask frontend whether we need to return failure.
   return 0;
 }
 
 } // namespace __hwasan
 
 namespace __hwasan {
 
 void InitializeInterceptors() {
   static int inited = 0;
   CHECK_EQ(inited, 0);
 
 #if HWASAN_WITH_INTERCEPTORS
-#if defined(__linux__)
+#    if SANITIZER_LINUX
   INTERCEPT_FUNCTION(__libc_longjmp);
   INTERCEPT_FUNCTION(longjmp);
   INTERCEPT_FUNCTION(siglongjmp);
   INTERCEPT_FUNCTION(vfork);
-#endif  // __linux__
+#      if !SANITIZER_ANDROID
+  INTERCEPT_FUNCTION(dlopen);
+#      endif
+#    endif
   INTERCEPT_FUNCTION(pthread_create);
   INTERCEPT_FUNCTION(pthread_join);
 #  endif
 
   inited = 1;
 }
 } // namespace __hwasan
 
 #endif  // #if !SANITIZER_FUCHSIA

compiler-rt/test/hwasan/TestCases/Linux/deepbind.cpp

+// RUN: %clang_hwasan %s -o %t && %run not %t 2>&1 | FileCheck %s
+// UNSUPPORTED: android
+
+#include <dlfcn.h>
+
+int main(int argc, char *argv[]) {
+  // CHECK: You are trying to dlopen a <arbitrary path> shared library with RTLD_DEEPBIND flag
+  void *lib = dlopen("<arbitrary path>", RTLD_NOW | RTLD_DEEPBIND);
+  return 0;
+}