[msan] unpoison_file from fclose and fflash

[vitalybuka]

Summary

Also unpoison IO_write_base/_IO_write_end buffer

memcpy from fclose and fflash can copy internal bytes without metadata into user memory.

[vitalybuka]

format

[eugenis]

LGTM
The unpoison_file stuff is very incomplete, but this seems like an improvement.

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

 #if SANITIZER_NETBSD
   if (fp->_bf._base && fp->_bf._size > 0)
     COMMON_INTERCEPTOR_INITIALIZE_RANGE(fp->_bf._base,
                                         fp->_bf._size);
 #else
   if (fp->_IO_read_base && fp->_IO_read_base < fp->_IO_read_end)
     COMMON_INTERCEPTOR_INITIALIZE_RANGE(fp->_IO_read_base,
                                         fp->_IO_read_end - fp->_IO_read_base);
+  if (fp->_IO_write_base && fp->_IO_write_base < fp->_IO_write_end)
+    COMMON_INTERCEPTOR_INITIALIZE_RANGE(fp->_IO_write_base,
+                                        fp->_IO_write_end - fp->_IO_write_base);
 #endif
 #endif  // SANITIZER_HAS_STRUCT_FILE
 }
 #endif
 
 #if SANITIZER_INTERCEPT_LIBIO_INTERNALS
 // These guys are called when a .c source is built with -O2.
 INTERCEPTOR(int, __uflow, __sanitizer_FILE *fp) {

 #else
 #define INIT_OBSTACK
 #endif
 
 #if SANITIZER_INTERCEPT_FFLUSH
 INTERCEPTOR(int, fflush, __sanitizer_FILE *fp) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, fflush, fp);
+  if (fp)
+    unpoison_file(fp);
   int res = REAL(fflush)(fp);
   // FIXME: handle fp == NULL
   if (fp) {
     const FileMetadata *m = GetInterceptorMetadata(fp);
     if (m) COMMON_INTERCEPTOR_INITIALIZE_RANGE(*m->addr, *m->size);
   }
   return res;
 }
 #define INIT_FFLUSH COMMON_INTERCEPT_FUNCTION(fflush);
 #else
 #define INIT_FFLUSH
 #endif
 
 #if SANITIZER_INTERCEPT_FCLOSE
 INTERCEPTOR(int, fclose, __sanitizer_FILE *fp) {
   void *ctx;
   COMMON_INTERCEPTOR_ENTER(ctx, fclose, fp);
   COMMON_INTERCEPTOR_FILE_CLOSE(ctx, fp);
   const FileMetadata *m = GetInterceptorMetadata(fp);
+  if (fp)
+    unpoison_file(fp);
   int res = REAL(fclose)(fp);
   if (m) {
     COMMON_INTERCEPTOR_INITIALIZE_RANGE(*m->addr, *m->size);
     DeleteInterceptorMetadata(fp);
   }
   return res;
 }
 #define INIT_FCLOSE COMMON_INTERCEPT_FUNCTION(fclose);

compiler-rt/test/msan/Linux/file.cpp

+// RUN: %clangxx_msan -std=c++11 -O0 %s -o %t && %run %t
+// RUN: %clangxx_msan -std=c++11 -fsanitize-memory-track-origins -O0 %s -o %t && %run %t
+
+#include <assert.h>
+#include <stdio.h>
+
+#include <sanitizer/msan_interface.h>
+
+int main(int argc, char *argv[]) {
+  FILE *f = fopen(argv[0], "r");
+  assert(f);
+  char buf[50];
+  fread(buf, 1, 1, f);
+  fflush(f);
+
+  assert(f->_IO_read_end > f->_IO_read_base);
+  __msan_check_mem_is_initialized(f->_IO_read_end, f->_IO_read_end - f->_IO_read_base);
+
+  char tmp_file[1000];
+  sprintf(tmp_file, "%s.write.tmp", argv[0]);
+
+  f = fopen(tmp_file, "w+");
+  assert(f);
+  fwrite(buf, 1, 1, f);
+  fflush(f);
+
+  assert(f->_IO_write_end > f->_IO_write_base);
+  __msan_check_mem_is_initialized(f->_IO_write_end, f->_IO_write_end - f->_IO_write_base);
+}