[msan] Check sigset_t and sigaction arguments.

[eugenis]

Summary

Check sigset_t arguments in ppoll, sig*wait*, sigprocmask
interceptors, and the entire "struct sigaction" in sigaction. This
can be done because sigemptyset/sigfullset are intercepted and
signal masks should be correctly marked as initialized.

[vitalybuka]

compiler-rt/lib/msan/msan_interceptors.cc

137

separate patch?

compiler-rt/test/msan/Linux/poll.cc

19

maybe runtime args to avoid recompilation?

[eugenis]

addressed vitaly's comments

[eugenis]

fix sa_handler / sa_sigaction mix-up

compiler-rt/lib/msan/msan_interceptors.cc

do {                                                                         \
     }                                                                          \
   } while (0)
 
 // Check that [x, x+n) range is unpoisoned unless we are in a nested
 // interceptor.
 #define CHECK_UNPOISONED(x, n)                             \
   do {                                                     \
     if (!IsInInterceptorScope()) CHECK_UNPOISONED_0(x, n); \
-  } while (0);
+  } while (0)
 
 #define CHECK_UNPOISONED_STRING_OF_LEN(x, len, n)               \
   CHECK_UNPOISONED((x),                                         \
     common_flags()->strict_string_checks ? (len) + 1 : (n) )
 
 #define CHECK_UNPOISONED_STRING(x, n)                           \
     CHECK_UNPOISONED_STRING_OF_LEN((x), internal_strlen(x), (n))
 
 #if !SANITIZER_FREEBSD
 INTERCEPTOR(SIZE_T, fread_unlocked, void *ptr, SIZE_T size, SIZE_T nmemb,
             void *file) {
   ENSURE_MSAN_INITED();
   SIZE_T res = REAL(fread_unlocked)(ptr, size, nmemb, file);
   if (res > 0)
     __msan_unpoison(ptr, res *size);
   return res;
 }
 #define MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED INTERCEPT_FUNCTION(fread_unlocked)
 #else
 #define MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED
 #endif
 
 INTERCEPTOR(SSIZE_T, readlink, const char *path, char *buf, SIZE_T bufsiz) {
   ENSURE_MSAN_INITED();
-  CHECK_UNPOISONED_STRING(path, 0)
+  CHECK_UNPOISONED_STRING(path, 0);
   SSIZE_T res = REAL(readlink)(path, buf, bufsiz);
   if (res > 0)
     __msan_unpoison(buf, res);
   return res;
 }
 
 INTERCEPTOR(void *, mempcpy, void *dest, const void *src, SIZE_T n) {
   return (char *)__msan_memcpy(dest, src, n) + n;
for (; *envp; ++envp) {
     __msan_unpoison(*envp, REAL(strlen)(*envp) + 1);
   }
   // Trailing NULL pointer.
   __msan_unpoison(envp, sizeof(*envp));
 }
 
 INTERCEPTOR(int, setenv, const char *name, const char *value, int overwrite) {
   ENSURE_MSAN_INITED();
-  CHECK_UNPOISONED_STRING(name, 0)
+  CHECK_UNPOISONED_STRING(name, 0);
   int res = REAL(setenv)(name, value, overwrite);
   if (!res) UnpoisonEnviron();
   return res;
 }
 
 INTERCEPTOR(int, putenv, char *string) {
   ENSURE_MSAN_INITED();
   int res = REAL(putenv)(string);
static void SignalAction(int signo, void *si, void *uc) {
   __msan_unpoison(uc, __sanitizer::ucontext_t_sz);
 
   typedef void (*sigaction_cb)(int, void *, void *);
   sigaction_cb cb =
       (sigaction_cb)atomic_load(&sigactions[signo], memory_order_relaxed);
   cb(signo, si, uc);
 }
 
+static void read_sigaction(const __sanitizer_sigaction *act) {
+  CHECK_UNPOISONED(&act->sa_flags, sizeof(act->sa_flags));
+  if (act->sa_flags & __sanitizer::sa_siginfo)
+    CHECK_UNPOISONED(&act->handler, sizeof(act->handler));
+  else
+    CHECK_UNPOISONED(&act->sigaction, sizeof(act->sigaction));
+  CHECK_UNPOISONED(&act->sa_mask, sizeof(act->sa_mask));
+}
+
 INTERCEPTOR(int, sigaction, int signo, const __sanitizer_sigaction *act,
             __sanitizer_sigaction *oldact) {
   ENSURE_MSAN_INITED();
   // FIXME: check that *act is unpoisoned.
   // That requires intercepting all of sigemptyset, sigfillset, etc.
+  if (act) read_sigaction(act);
   int res;
   if (flags()->wrap_signals) {
     SpinMutexLock lock(&sigactions_mu);
     CHECK_LT(signo, kMaxSignals);
     uptr old_cb = atomic_load(&sigactions[signo], memory_order_relaxed);
     __sanitizer_sigaction new_act;
     __sanitizer_sigaction *pnew_act = act ? &new_act : nullptr;
     if (act) {

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

 #if SANITIZER_INTERCEPT_PPOLL
 INTERCEPTOR(int, ppoll, __sanitizer_pollfd *fds, __sanitizer_nfds_t nfds,
             void *timeout_ts, __sanitizer_sigset_t *sigmask) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, ppoll, fds, nfds, timeout_ts, sigmask);
   if (fds && nfds) read_pollfd(ctx, fds, nfds);
   if (timeout_ts)
     COMMON_INTERCEPTOR_READ_RANGE(ctx, timeout_ts, struct_timespec_sz);
-  // FIXME: read sigmask when all of sigemptyset, etc are intercepted.
+  if (sigmask) COMMON_INTERCEPTOR_READ_RANGE(ctx, sigmask, sizeof(*sigmask));
   int res =
       COMMON_INTERCEPTOR_BLOCK_REAL(ppoll)(fds, nfds, timeout_ts, sigmask);
   if (fds && nfds) write_pollfd(ctx, fds, nfds);
   return res;
 }
 #define INIT_PPOLL COMMON_INTERCEPT_FUNCTION(ppoll);
 #else
 #define INIT_PPOLL

 #else
 #define INIT_WORDEXP
 #endif
 
 #if SANITIZER_INTERCEPT_SIGWAIT
 INTERCEPTOR(int, sigwait, __sanitizer_sigset_t *set, int *sig) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, sigwait, set, sig);
-  // FIXME: read sigset_t when all of sigemptyset, etc are intercepted
+  if (set) COMMON_INTERCEPTOR_READ_RANGE(ctx, set, sizeof(*set));
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://github.com/google/sanitizers/issues/321.
   int res = REAL(sigwait)(set, sig);
   if (!res && sig) COMMON_INTERCEPTOR_WRITE_RANGE(ctx, sig, sizeof(*sig));
   return res;
 }
 #define INIT_SIGWAIT COMMON_INTERCEPT_FUNCTION(sigwait);
 #else
 #define INIT_SIGWAIT
 #endif
 
 #if SANITIZER_INTERCEPT_SIGWAITINFO
 INTERCEPTOR(int, sigwaitinfo, __sanitizer_sigset_t *set, void *info) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, sigwaitinfo, set, info);
-  // FIXME: read sigset_t when all of sigemptyset, etc are intercepted
+  if (set) COMMON_INTERCEPTOR_READ_RANGE(ctx, set, sizeof(*set));
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://github.com/google/sanitizers/issues/321.
   int res = REAL(sigwaitinfo)(set, info);
   if (res > 0 && info) COMMON_INTERCEPTOR_WRITE_RANGE(ctx, info, siginfo_t_sz);
   return res;
 }
 #define INIT_SIGWAITINFO COMMON_INTERCEPT_FUNCTION(sigwaitinfo);
 #else
 #define INIT_SIGWAITINFO
 #endif
 
 #if SANITIZER_INTERCEPT_SIGTIMEDWAIT
 INTERCEPTOR(int, sigtimedwait, __sanitizer_sigset_t *set, void *info,
             void *timeout) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, sigtimedwait, set, info, timeout);
   if (timeout) COMMON_INTERCEPTOR_READ_RANGE(ctx, timeout, struct_timespec_sz);
-  // FIXME: read sigset_t when all of sigemptyset, etc are intercepted
+  if (set) COMMON_INTERCEPTOR_READ_RANGE(ctx, set, sizeof(*set));
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://github.com/google/sanitizers/issues/321.
   int res = REAL(sigtimedwait)(set, info, timeout);
   if (res > 0 && info) COMMON_INTERCEPTOR_WRITE_RANGE(ctx, info, siginfo_t_sz);
   return res;
 }
 #define INIT_SIGTIMEDWAIT COMMON_INTERCEPT_FUNCTION(sigtimedwait);

 #define INIT_SIGPENDING
 #endif
 
 #if SANITIZER_INTERCEPT_SIGPROCMASK
 INTERCEPTOR(int, sigprocmask, int how, __sanitizer_sigset_t *set,
             __sanitizer_sigset_t *oldset) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, sigprocmask, how, set, oldset);
-  // FIXME: read sigset_t when all of sigemptyset, etc are intercepted
+  if (set) COMMON_INTERCEPTOR_READ_RANGE(ctx, set, sizeof(*set));
   // FIXME: under ASan the call below may write to freed memory and corrupt
   // its metadata. See
   // https://github.com/google/sanitizers/issues/321.
   int res = REAL(sigprocmask)(how, set, oldset);
   if (!res && oldset)
     COMMON_INTERCEPTOR_WRITE_RANGE(ctx, oldset, sizeof(*oldset));
   return res;
 }

compiler-rt/test/msan/Linux/poll.cc

+// RUN: %clangxx_msan -O0 -std=c++11 -g %s -o %t && %run %t 2>&1 | FileCheck %s --check-prefix=CLEAN
+// RUN: %clangxx_msan -DTEST_A -O0 -std=c++11 -g %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=A
+// RUN: %clangxx_msan -DTEST_B -O0 -std=c++11 -g %s -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=B
+
+#include <assert.h>
+#include <poll.h>
+#include <signal.h>
+#include <stdio.h>
+
+#include <sanitizer/msan_interface.h>
+
+int main(void) {
+  struct timespec ts;
+  ts.tv_sec = 0;
+  ts.tv_nsec = 1000;
+  int res = ppoll(nullptr, 0, &ts, nullptr);
+  assert(res == 0);
+
+#ifdef TEST_A
+  __msan_poison(&ts.tv_sec, sizeof(ts.tv_sec));
+  ppoll(nullptr, 0, &ts, nullptr);
+  // A: use-of-uninitialized-value
+#endif
+
+  // A-NOT: ==1
+  // B: ==1
+  fprintf(stderr, "==1\n");
+
+  sigset_t sig;
+#ifndef TEST_B
+  sigemptyset(&sig);
+#endif
+  ppoll(nullptr, 0, &ts, &sig);
+  // B: use-of-uninitialized-value
+
+  // B-NOT: ==2
+  // CLEAN: ==2
+  fprintf(stderr, "==2\n");
+  return 0;
+}

compiler-rt/test/msan/sigaction.cc

+// RUN: %clangxx_msan -std=c++11 -O0 -g %s -o %t && %run %t
+// RUN: %clangxx_msan -DTEST_A -std=c++11 -O0 -g %s -o %t && not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_msan -DTEST_B -std=c++11 -O0 -g %s -o %t && not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_msan -DTEST_C -std=c++11 -O0 -g %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+#include <assert.h>
+#include <signal.h>
+#include <string.h>
+#include <sys/time.h>
+#include <unistd.h>
+
+#include <sanitizer/msan_interface.h>
+
+void test_sigwait() {
+  sigset_t s;
+#ifndef POSITIVE
+  sigemptyset(&s);
+  sigaddset(&s, SIGUSR1);
+#endif
+  sigprocmask(SIG_BLOCK, &s, 0);
+  // CHECK:  MemorySanitizer: use-of-uninitialized-value
+
+  if (pid_t pid = fork()) {
+    kill(pid, SIGUSR1);
+    _exit(0);
+  } else {
+    int sig;
+    int res = sigwait(&s, &sig);
+    assert(!res);
+    // The following checks that sig is initialized.
+    assert(sig == SIGUSR1);
+  }
+}
+
+void handler(int) {}
+void action(int, siginfo_t *, void *) {}
+
+int main(void) {
+  struct sigaction sa;
+  memset(&sa, 0, sizeof(sa));
+#ifdef HANDLER
+  sa.sa_handler = handler;
+#else
+  sa.sa_sigaction = action;
+  sa.sa_flags = SA_SIGINFO;
+#endif
+
+#ifdef TEST_A
+#ifdef HANDLER
+  __msan_poison(&sa.sa_handler, sizeof(sa.sa_handler));
+#else
+  __msan_poison(&sa.sa_sigaction, sizeof(sa.sa_sigaction));
+#endif
+#endif
+#ifdef TEST_B
+  __msan_poison(&sa.sa_flags, sizeof(sa.sa_flags));
+#endif
+#ifdef TEST_C
+  __msan_poison(&sa.sa_mask, sizeof(sa.sa_mask));
+#endif
+  // CHECK: use-of-uninitialized-value
+  int res = sigaction(SIGUSR1, &sa, nullptr);
+  assert(res == 0);
+  return 0;
+}

compiler-rt/test/msan/sigwait.cc

 // RUN: %clangxx_msan -std=c++11 -O0 -g %s -o %t && %run %t
+// RUN: %clangxx_msan -DPOSITIVE -std=c++11 -O0 -g %s -o %t && not %run %t 2>&1 | FileCheck %s
 
 #include <assert.h>
-#include <sanitizer/msan_interface.h>
 #include <signal.h>
 #include <sys/time.h>
 #include <unistd.h>
 
+#include <sanitizer/msan_interface.h>
+
 void test_sigwait() {
   sigset_t s;
+#ifndef POSITIVE
   sigemptyset(&s);
   sigaddset(&s, SIGUSR1);
+#endif
   sigprocmask(SIG_BLOCK, &s, 0);
+  // CHECK:  MemorySanitizer: use-of-uninitialized-value
 
   if (pid_t pid = fork()) {
     kill(pid, SIGUSR1);
     _exit(0);
   } else {
     int sig;
     int res = sigwait(&s, &sig);
     assert(!res);