[hwasan] Intercept __tls_get_addr (except for PPC and S390X)

[thurston]

Summary

This ports sanitizer-common's __tls_get_addr interceptor to HWASan, since
HWASan does not include them.

This patch does not cover PowerPC and S390X. Although sanitizer-common
contains reference code, it needs to be adapted to HWASan, and I do not have
the setup to test it.

[vitalybuka]

I assume this done for lsan? @kstoimenov

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

308

we don't hwasan there

compiler-rt/test/sanitizer_common/TestCases/Linux/resize_tls_dynamic.cpp

9–12

we don't hwasan there
set(ALL_HWASAN_SUPPORTED_ARCH ${X86_64} ${ARM64} ${RISCV64})

[vitalybuka]

Let's not copy interceptors from common to hwasan.

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

264

[vitalybuka]

Can you try the following?

#include "hwasan_platform_interceptors.h"
#include "sanitizer_common/sanitizer_common_interceptors.inc"

then hwasan_platform_interceptors.h like:

#include "sanitizer_common/sanitizer_platform_interceptors.h"

#undef SANITIZER_INTERCEPT_STRLEN
...all of them without SANITIZER_INTERCEPT_TLS_GET_ADDR...
#undef SANITIZER_INTERCEPT_STRLEN

then

#define SANITIZER_INTERCEPT_STRLEN 0
...all of them without SANITIZER_INTERCEPT_TLS_GET_ADDR...
#define SANITIZER_INTERCEPT_STRLEN 0

[vitalybuka]

Any progress here? we need more common interceptors, e.g. mmap

[thurston]

In D149701#4343618, @vitalybuka wrote:

Any progress here? we need more common interceptors, e.g. mmap

Making it work with common interceptors (rather than specializing them to specific interceptors for HWASan) made it a bit more complicated. I'll take another stab at it, hopefully this week.

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

 // sanitizer_common/sanitizer_common_interceptors.h
 //===----------------------------------------------------------------------===//
 
 #include "hwasan.h"
 #include "hwasan_checks.h"
 #include "hwasan_thread.h"
 #include "interception/interception.h"
 #include "sanitizer_common/sanitizer_linux.h"
+#include "sanitizer_common/sanitizer_platform_interceptors.h"
 #include "sanitizer_common/sanitizer_stackdepot.h"
+#include "sanitizer_common/sanitizer_tls_get_addr.h"
 
 #if !SANITIZER_FUCHSIA
 
 using namespace __hwasan;
 
 #if HWASAN_WITH_INTERCEPTORS
 
 struct ThreadStartArg {
Printf(
         "there is a bug in HWASan.\n");
     return REAL(longjmp)(env, val);
   }
   InternalLongjmp(env[0].__jmpbuf, val);
 }
 #undef SIG_BLOCK
 #undef SIG_SETMASK
 
+// Adapted from sanitizer_common/sanitizer_common_interceptors.inc
+// S390 and PowerPPC are left as an exercise for the reader.
+#if SANITIZER_INTERCEPT_TLS_GET_ADDR
+#if !SANITIZER_S390 && !SANITIZER_PPC
+// If you see any crashes around this functions, there are 2 known issues with
+// it: 1. __tls_get_addr can be called with mis-aligned stack due to:
+// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58066
+// 2. It can be called recursively if sanitizer code uses __tls_get_addr
+// to access thread local variables (it should not happen normally,
+// because sanitizers use initial-exec tls model).
+INTERCEPTOR(void *, __tls_get_addr, void *arg) {
+  void *res = REAL(__tls_get_addr)(arg);
+  uptr tls_begin, tls_end;
+
+  if (Thread *t = GetCurrentThread()) {
+    tls_begin = t->tls_begin();
+    tls_end = t->tls_end();
+  } else {
+    tls_begin = tls_end = 0;
+  }
+
+  DTLS::DTV *dtv = DTLS_on_tls_get_addr(arg, res, tls_begin, tls_end);
+  if (dtv) {
+    // New DTLS block has been allocated.
+    // Nothing to do for now - memory was allocated with malloc
+  }
+  return res;
+}
+#endif
+#endif
+
 #  endif  // HWASAN_WITH_INTERCEPTORS
 
 namespace __hwasan {
 
 int OnExit() {
   if (CAN_SANITIZE_LEAKS && common_flags()->detect_leaks &&
       __lsan::HasReportedLeaks()) {
     return common_flags()->exitcode;

 #if defined(__linux__)
   INTERCEPT_FUNCTION(__libc_longjmp);
   INTERCEPT_FUNCTION(longjmp);
   INTERCEPT_FUNCTION(siglongjmp);
   INTERCEPT_FUNCTION(vfork);
 #endif  // __linux__
   INTERCEPT_FUNCTION(pthread_create);
   INTERCEPT_FUNCTION(pthread_join);
+#if SANITIZER_INTERCEPT_TLS_GET_ADDR
+#if !SANITIZER_S390 && !SANITIZER_PPC
+  INTERCEPT_FUNCTION(__tls_get_addr);
+#endif
+#endif // SANITIZER_INTERCEPT_TLS_GET_ADDR
 #  endif
 
   inited = 1;
 }
 } // namespace __hwasan
 
 #endif  // #if !SANITIZER_FUCHSIA

compiler-rt/test/sanitizer_common/TestCases/Linux/resize_tls_dynamic.cpp

 // RUN: %clangxx %s -DBUILD_DSO -fPIC -shared -o %t.so
 // RUN: %clangxx --std=c++11 %s -o %t
 // RUN: %env_tool_opts=verbosity=2 %run %t 2>&1 | FileCheck %s
 
 // Does not call __tls_get_addr
 // UNSUPPORTED: i386-linux
 
 // Do not intercept __tls_get_addr
-// UNSUPPORTED: hwasan, lsan, ubsan, android
+// UNSUPPORTED: lsan, ubsan, android
+
+// Does not intercept __tls_get_addr
+// UNSUPPORTED: hwasan && target={{(powerpc64|s390x).*}}
 
 // FIXME: Investigate
 // UNSUPPORTED: target=powerpc64{{.*}}
 
 #include <string.h>
 
 #ifndef BUILD_DSO