[sanitizer] Move signal blocking code into posix

[vitalybuka]

Summary

This will affect only Darwin, as the rest alredy do that.

[vitalybuka]

Any concern?
Reproducing crashes without signal blocking is hard, we have tests which crashes 1 in 1M times.
So the question to reviewers is rather: does this regress anything on Darwin?

[rsundahl]

@kubamracek , do you have any historical context why this has been avoided so far in Darwin?

[vitalybuka]

In D156385#4543045, @rsundahl wrote:

@kubamracek , do you have any historical context why this has been avoided so far in Darwin?

It was not avoided. It was used by msan, which is Linux only. And I just added this to Linux Asan as well. Without testing, I am not confident enabling this on Darwin.

[thetruestblue]

In D156385#4545366, @vitalybuka wrote:

In D156385#4543045, @rsundahl wrote:

@kubamracek , do you have any historical context why this has been avoided so far in Darwin?

It was not avoided. It was used by msan, which is Linux only. And I just added this to Linux Asan as well. Without testing, I am not confident enabling this on Darwin.

I can run tests today

[rsundahl]

In D156385#4547538, @thetruestblue wrote:

In D156385#4545366, @vitalybuka wrote:

In D156385#4543045, @rsundahl wrote:

@kubamracek , do you have any historical context why this has been avoided so far in Darwin?

It was not avoided. It was used by msan, which is Linux only. And I just added this to Linux Asan as well. Without testing, I am not confident enabling this on Darwin.

I can run tests today

If @vitalybuka is reasonably comfortable that testing in our CI will expose likely Darwin issues then I'm comfortable approving and just keeping an eye on it as it comes down into the automerger. If we need to do more testing than that, we should do what you suggest @thetruestblue and bring the diff down out-of-channel and do some more thorough testing first.

[vitalybuka]

rebase

[vitalybuka]

ping

[rsundahl]

In D156385#4650200, @vitalybuka wrote:

ping

I applied this diff internally and at least as far as all of the tests run by

ninja check-runtimes

goes, there are no differences. I don't feel necessarily that I have any deep insight into why there should or should not be any subtle difference that would surface on macOS, but I also no longer want to be in the way of this one @vitalybuka. I'll keep an eye on it though and let you know if I see anything surprising.

[vitalybuka]

rebase

[vitalybuka]

Thanks!

compiler-rt/lib/asan/asan_interceptors.cpp

 #if ASAN_INTERCEPT_PTHREAD_CREATE
 static thread_return_t THREAD_CALLING_CONV asan_thread_start(void *arg) {
   AsanThread *t = (AsanThread *)arg;
   SetCurrentThread(t);
   auto self = GetThreadSelf();
   auto args = asanThreadArgRetval().GetArgs(self);
   t->ThreadStart(GetTid());
 
-#    if SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD || \
-        SANITIZER_SOLARIS
   __sanitizer_sigset_t sigset;
   t->GetStartData(sigset);
   SetSigProcMask(&sigset, nullptr);
-#    endif
 
   thread_return_t retval = (*args.routine)(args.arg_retval);
   asanThreadArgRetval().Finish(self, retval);
   return retval;
 }
 
 INTERCEPTOR(int, pthread_create, void *thread, void *attr,
             void *(*start_routine)(void *), void *arg) {
   EnsureMainThreadIDIsCorrect();
   // Strict init-order checking is thread-hostile.
   if (flags()->strict_init_order)
     StopInitOrderChecking();
   GET_STACK_TRACE_THREAD;
   bool detached = [attr]() {
     int d = 0;
     return attr && !REAL(pthread_attr_getdetachstate)(attr, &d) &&
            IsStateDetached(d);
   }();
 
   u32 current_tid = GetCurrentTidOrInvalid();
 
   __sanitizer_sigset_t sigset;
-#    if SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD || \
-        SANITIZER_SOLARIS
   ScopedBlockSignals block(&sigset);
-#    endif
 
   AsanThread *t = AsanThread::Create(sigset, current_tid, &stack, detached);
 
   int result;
   {
     // Ignore all allocations made by pthread_create: thread stack/TLS may be
     // stored by pthread for future reuse even after thread destruction, and
     // the linked list it's stored in doesn't even hold valid pointers to the

compiler-rt/lib/asan/asan_posix.cpp

 }
 
 void PlatformTSDDtor(void *tsd) {
   CHECK(tsd_destructor);
   CHECK_EQ(key.key, tsd);
   key.key = nullptr;
   // Make sure that signal handler can not see a stale current thread pointer.
   atomic_signal_fence(memory_order_seq_cst);
+  // After this point it's unsafe to execute signal handlers which may be
+  // instrumented.
+  BlockSignals();
   AsanThread::TSDDtor(tsd);
 }
 #else
 static pthread_key_t tsd_key;
 static bool tsd_key_inited = false;
 void AsanTSDInit(void (*destructor)(void *tsd)) {
   CHECK(!tsd_key_inited);
   tsd_key_inited = true;

 
 void PlatformTSDDtor(void *tsd) {
   AsanThreadContext *context = (AsanThreadContext *)tsd;
   if (context->destructor_iterations > 1) {
     context->destructor_iterations--;
     CHECK_EQ(0, pthread_setspecific(tsd_key, tsd));
     return;
   }
-#    if SANITIZER_FREEBSD || SANITIZER_LINUX || SANITIZER_NETBSD || \
-        SANITIZER_SOLARIS
   // After this point it's unsafe to execute signal handlers which may be
-  // instrumented. It's probably not just a Linux issue.
+  // instrumented.
   BlockSignals();
-#    endif
   AsanThread::TSDDtor(tsd);
 }
 #endif
 
 void InstallAtExitCheckLeaks() {
   if (CAN_SANITIZE_LEAKS) {
     if (common_flags()->detect_leaks && common_flags()->leak_check_at_exit) {
       if (flags()->halt_on_error)

compiler-rt/lib/sanitizer_common/sanitizer_linux.h

struct MemoryMappingLayoutData {
   ProcSelfMapsBuff proc_self_maps;
   const char *current;
 };
 
 void ReadProcMaps(ProcSelfMapsBuff *proc_maps);
 
 // Syscall wrappers.
 uptr internal_getdents(fd_t fd, struct linux_dirent *dirp, unsigned int count);
-uptr internal_sigaltstack(const void* ss, void* oss);
-uptr internal_sigprocmask(int how, __sanitizer_sigset_t *set,
-    __sanitizer_sigset_t *oldset);
-
-void SetSigProcMask(__sanitizer_sigset_t *set, __sanitizer_sigset_t *oldset);
-void BlockSignals(__sanitizer_sigset_t *oldset = nullptr);
-struct ScopedBlockSignals {
-  explicit ScopedBlockSignals(__sanitizer_sigset_t *copy);
-  ~ScopedBlockSignals();
-
-  ScopedBlockSignals &operator=(const ScopedBlockSignals &) = delete;
-  ScopedBlockSignals(const ScopedBlockSignals &) = delete;
-
- private:
-  __sanitizer_sigset_t saved_;
-};
+uptr internal_sigaltstack(const void *ss, void *oss);
 
 #  if SANITIZER_GLIBC
 uptr internal_clock_gettime(__sanitizer_clockid_t clk_id, void *tp);
 #endif
 
 // Linux-only syscalls.
 #if SANITIZER_LINUX
 uptr internal_prctl(int option, uptr arg2, uptr arg3, uptr arg4, uptr arg5);

compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp

 #if SANITIZER_FREEBSD && __FreeBSD_version >= 1200000
 #  define SANITIZER_USE_GETENTROPY 1
 #else
 #  define SANITIZER_USE_GETENTROPY 0
 #endif
 
 namespace __sanitizer {
 
-void SetSigProcMask(__sanitizer_sigset_t *set, __sanitizer_sigset_t *oldset) {
-  CHECK_EQ(0, internal_sigprocmask(SIG_SETMASK, set, oldset));
-}
-
-void BlockSignals(__sanitizer_sigset_t *oldset) {
-  __sanitizer_sigset_t set;
-  internal_sigfillset(&set);
-#  if SANITIZER_LINUX && !SANITIZER_ANDROID
-  // Glibc uses SIGSETXID signal during setuid call. If this signal is blocked
-  // on any thread, setuid call hangs.
-  // See test/sanitizer_common/TestCases/Linux/setuid.c.
-  internal_sigdelset(&set, 33);
-#  endif
-#  if SANITIZER_LINUX
-  // Seccomp-BPF-sandboxed processes rely on SIGSYS to handle trapped syscalls.
-  // If this signal is blocked, such calls cannot be handled and the process may
-  // hang.
-  internal_sigdelset(&set, 31);
-#  endif
-  SetSigProcMask(&set, oldset);
-}
-
-ScopedBlockSignals::ScopedBlockSignals(__sanitizer_sigset_t *copy) {
-  BlockSignals(&saved_);
-  if (copy)
-    internal_memcpy(copy, &saved_, sizeof(saved_));
-}
-
-ScopedBlockSignals::~ScopedBlockSignals() { SetSigProcMask(&saved_, nullptr); }
-
 #  if SANITIZER_LINUX && defined(__x86_64__)
 #    include "sanitizer_syscall_linux_x86_64.inc"
 #  elif SANITIZER_LINUX && SANITIZER_RISCV64
 #    include "sanitizer_syscall_linux_riscv64.inc"
 #  elif SANITIZER_LINUX && defined(__aarch64__)
 #    include "sanitizer_syscall_linux_aarch64.inc"
 #  elif SANITIZER_LINUX && defined(__arm__)
 #    include "sanitizer_syscall_linux_arm.inc"

compiler-rt/lib/sanitizer_common/sanitizer_posix.h

 int internal_pthread_attr_getstack(void *attr, void **addr, uptr *size);
 
 // A routine named real_sigaction() must be implemented by each sanitizer in
 // order for internal_sigaction() to bypass interceptors.
 int internal_sigaction(int signum, const void *act, void *oldact);
 void internal_sigfillset(__sanitizer_sigset_t *set);
 void internal_sigemptyset(__sanitizer_sigset_t *set);
 bool internal_sigismember(__sanitizer_sigset_t *set, int signum);
+uptr internal_sigprocmask(int how, __sanitizer_sigset_t *set,
+                          __sanitizer_sigset_t *oldset);
 
 uptr internal_execve(const char *filename, char *const argv[],
                      char *const envp[]);
 
 bool IsStateDetached(int state);
 
 // Move the fd out of {0, 1, 2} range.
 fd_t ReserveStandardFds(fd_t fd);

 // 2. Add name to an existing anonymous mapping. The caller must keep *name
 // alive at least as long as the mapping exists.
 void DecorateMapping(uptr addr, uptr size, const char *name);
 
 #  if !SANITIZER_FREEBSD
 #    define __sanitizer_dirsiz(dp) ((dp)->d_reclen)
 #  endif
 
+void SetSigProcMask(__sanitizer_sigset_t *set, __sanitizer_sigset_t *oldset);
+void BlockSignals(__sanitizer_sigset_t *oldset = nullptr);
+struct ScopedBlockSignals {
+  explicit ScopedBlockSignals(__sanitizer_sigset_t *copy);
+  ~ScopedBlockSignals();
+
+  ScopedBlockSignals &operator=(const ScopedBlockSignals &) = delete;
+  ScopedBlockSignals(const ScopedBlockSignals &) = delete;
+
+ private:
+  __sanitizer_sigset_t saved_;
+};
+
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_POSIX
 
 #endif  // SANITIZER_POSIX_H

compiler-rt/lib/sanitizer_common/sanitizer_posix.cpp

 uptr MmapNamed(void *addr, uptr length, int prot, int flags, const char *name) {
   int fd = GetNamedMappingFd(name, length, &flags);
   uptr res = internal_mmap(addr, length, prot, flags, fd, 0);
   if (!internal_iserror(res))
     DecorateMapping(res, length, name);
   return res;
 }
 
+void SetSigProcMask(__sanitizer_sigset_t *set, __sanitizer_sigset_t *oldset) {
+  CHECK_EQ(0, internal_sigprocmask(SIG_SETMASK, set, oldset));
+}
+
+void BlockSignals(__sanitizer_sigset_t *oldset) {
+  __sanitizer_sigset_t set;
+  internal_sigfillset(&set);
+#  if SANITIZER_LINUX && !SANITIZER_ANDROID
+  // Glibc uses SIGSETXID signal during setuid call. If this signal is blocked
+  // on any thread, setuid call hangs.
+  // See test/sanitizer_common/TestCases/Linux/setuid.c.
+  internal_sigdelset(&set, 33);
+#  endif
+#  if SANITIZER_LINUX
+  // Seccomp-BPF-sandboxed processes rely on SIGSYS to handle trapped syscalls.
+  // If this signal is blocked, such calls cannot be handled and the process may
+  // hang.
+  internal_sigdelset(&set, 31);
+#  endif
+  SetSigProcMask(&set, oldset);
+}
+
+ScopedBlockSignals::ScopedBlockSignals(__sanitizer_sigset_t *copy) {
+  BlockSignals(&saved_);
+  if (copy)
+    internal_memcpy(copy, &saved_, sizeof(saved_));
+}
+
+ScopedBlockSignals::~ScopedBlockSignals() { SetSigProcMask(&saved_, nullptr); }
 
 } // namespace __sanitizer
 
 #endif // SANITIZER_POSIX