[compiler-rt] Use uname syscall in GetKernelAreaSize()

[iii]

Summary

Commit 5f5fb56c68e4 ("[compiler-rt] Intercept the uname() function")
broke clang-cmake-thumbv7-full-sh build:

http://lab.llvm.org:8011/builders/clang-cmake-thumbv7-full-sh/builds/4296

This also affects i386.

The reason is that intercepted uname() is called by GetKernelAreaSize()
during ASAN initialization on 32-bit platforms, but the respective
interceptor is not initialized yet at this point, leading to null
pointer dereference.

Introduce internal_uname() wrapper around uname syscall, and use it in
GetKernelAreaSize() and in FixedCVE_2016_2143().

[eugenis]

I'm a bit worried about introducing dlsym on common code paths in sanitizer_common, as it would break in static binaries. HWASan, at least on Android, supports that, and now it is also available on gcc+glibc which I'm pretty sure will hit this code.

I think this has to be a system call.

[iii]

Ok, I can do that.

The only thing is - do I need to support oldolduname and olduname? Or can I assume everyone uses a more or less recent kernel?

[iii]

Use uname syscall. Don't try olduname and oldolduname fallbacks until we know we need them.

Also, give in and reformat the code the way clang-format wants to see it.

[eugenis]

This is fine, I don't think we need to care about olduname.
LGTM.

compiler-rt/lib/sanitizer_common/sanitizer_linux.h

 #include "sanitizer_platform_limits_freebsd.h"
 #include "sanitizer_platform_limits_netbsd.h"
 #include "sanitizer_platform_limits_openbsd.h"
 #include "sanitizer_platform_limits_posix.h"
 #include "sanitizer_platform_limits_solaris.h"
 #include "sanitizer_posix.h"
 
 struct link_map;  // Opaque type returned by dlopen().
+struct utsname;
 
 namespace __sanitizer {
 // Dirent structure for getdents(). Note that this structure is different from
 // the one in <dirent.h>, which is used by readdir().
 struct linux_dirent;
 
 struct ProcSelfMapsBuff {
   char *data;
uptr internal_clone(int (*fn)(void *), void *child_stack, int flags, void *arg,
                     int *parent_tidptr, void *newtls, int *child_tidptr);
 #endif
 #elif SANITIZER_FREEBSD
 void internal_sigdelset(__sanitizer_sigset_t *set, int signum);
 #elif SANITIZER_NETBSD
 void internal_sigdelset(__sanitizer_sigset_t *set, int signum);
 uptr internal_clone(int (*fn)(void *), void *child_stack, int flags, void *arg);
 #endif  // SANITIZER_LINUX
+int internal_uname(struct utsname *buf);
 
 // This class reads thread IDs from /proc/<pid>/task using only syscalls.
 class ThreadLister {
  public:
   explicit ThreadLister(pid_t pid);
   ~ThreadLister();
   enum Result {
     Error,

compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp

 
 #if !SANITIZER_ANDROID
   // Even if nothing is mapped, top Gb may still be accessible
   // if we are running on 64-bit kernel.
   // Uname may report misleading results if personality type
   // is modified (e.g. under schroot) so check this as well.
   struct utsname uname_info;
   int pers = personality(0xffffffffUL);
   if (!(pers & PER_MASK)
-      && uname(&uname_info) == 0
+      && internal_uname(&uname_info) == 0
       && internal_strstr(uname_info.machine, "64"))
     return 0;
 #endif  // SANITIZER_ANDROID
 
   // Top gigabyte is reserved for kernel.
   return gbyte;
 #else
   return 0;
__asm__ __volatile__(
                        : "=r"(res)
                        : "r"(r0), "r"(r1), "r"(r2), "r"(r3), "r"(r4), "r"(r7),
                          "i"(__NR_exit)
                        : "memory");
   return res;
 }
 #endif  // defined(__x86_64__) && SANITIZER_LINUX
 
+int internal_uname(struct utsname *buf) {
+  // Depending on the concrete sanitizer being used, uname may or may not
+  // be intercepted. Make sure we use the libc version in either case.
+  using Uname = int (*)(struct utsname *);
+  Uname real = reinterpret_cast<Uname>(dlsym(RTLD_NEXT, "uname"));
+  if (real == nullptr) {
+    errno = -ENOSYS;
+    return -1;
+  }
+  return real(buf);
+}
+
 #if SANITIZER_ANDROID
 #if __ANDROID_API__ < 21
 extern "C" __attribute__((weak)) int dl_iterate_phdr(
     int (*)(struct dl_phdr_info *, size_t, void *), void *);
 #endif
 
 static int dl_iterate_phdr_test_cb(struct dl_phdr_info *info, size_t size,
                                    void *data) {

compiler-rt/lib/sanitizer_common/sanitizer_linux_s390.cpp

 
 #if SANITIZER_S390_64
 static bool FixedCVE_2016_2143() {
   // Try to determine if the running kernel has a fix for CVE-2016-2143,
   // return false if in doubt (better safe than sorry).  Distros may want to
   // adjust this for their own kernels.
   struct utsname buf;
   unsigned int major, minor, patch = 0;
-  // Depending on the concrete sanitizer being used, uname may or may not
-  // be intercepted. Make sure we use the libc version in either case.
-  using Uname = int (*)(struct utsname *);
-  Uname uname = reinterpret_cast<Uname>(dlsym(RTLD_NEXT, "uname"));
   // This should never fail, but just in case...
-  if (uname == nullptr || uname(&buf))
+  if (internal_uname(&buf))
     return false;
   const char *ptr = buf.release;
   major = internal_simple_strtoll(ptr, &ptr, 10);
   // At least first 2 should be matched.
   if (ptr[0] != '.')
     return false;
   minor = internal_simple_strtoll(ptr+1, &ptr, 10);
   // Third is optional.