[DFSan] Add custom wrapper for recvmsg.

[morehouse]

Summary

The wrapper clears shadow for anything written by recvmsg.

[stephan.yichao.zhao]

compiler-rt/lib/dfsan/dfsan_custom.cpp

894

If msg is from users' inputs, can iov_len be < 0?

https://linux.die.net/man/2/recvmsg does not say what happens in this case.

[morehouse]

compiler-rt/lib/dfsan/dfsan_custom.cpp

894

iov_len is size_t, which is never negative.

compiler-rt/lib/dfsan/dfsan_custom.cpp

 #include <stdarg.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/epoll.h>
 #include <sys/resource.h>
 #include <sys/select.h>
+#include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
 
 #include "dfsan/dfsan.h"
 #include "sanitizer_common/sanitizer_common.h"
SANITIZER_INTERFACE_ATTRIBUTE int __dfsw_nanosleep(const struct timespec *req,
   *ret_label = 0;
   if (ret == -1) {
     // Interrupted by a signal, rem is filled with the remaining time.
     dfsan_set_label(0, rem, sizeof(struct timespec));
   }
   return ret;
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE ssize_t __dfsw_recvmsg(
+    int sockfd, struct msghdr *msg, int flags, dfsan_label sockfd_label,
+    dfsan_label msg_label, dfsan_label flags_label, dfsan_label *ret_label) {
+  ssize_t ret = recvmsg(sockfd, msg, flags);
+  if (ret >= 0) {
+    dfsan_set_label(0, msg, sizeof(*msg));
+    dfsan_set_label(0, msg->msg_name, msg->msg_namelen);
+    dfsan_set_label(0, msg->msg_control, msg->msg_controllen);
+    for (size_t remaining = ret, i = 0; remaining > 0; ++i) {
+      assert(i < msg->msg_iovlen);
+      struct iovec *iov = &msg->msg_iov[i];
+      size_t written = remaining < iov->iov_len ? remaining : iov->iov_len;
+      dfsan_set_label(0, iov->iov_base, written);
+      remaining -= written;
+    }
+  }
+  *ret_label = 0;
+  return ret;
+}
+
 SANITIZER_INTERFACE_ATTRIBUTE int
 __dfsw_socketpair(int domain, int type, int protocol, int sv[2],
                   dfsan_label domain_label, dfsan_label type_label,
                   dfsan_label protocol_label, dfsan_label sv_label,
                   dfsan_label *ret_label) {
   int ret = socketpair(domain, type, protocol, sv);
   *ret_label = 0;
   if (ret == 0) {

compiler-rt/lib/dfsan/done_abilist.txt

 fun:bind=discard
 fun:chdir=discard
 fun:close=discard
 fun:closedir=discard
 fun:connect=discard
 fun:creat=discard
 fun:dladdr=discard
 fun:dlclose=discard
+fun:epoll_create=discard
+fun:epoll_create1=discard
 fun:epoll_ctl=discard
 fun:fclose=discard
 fun:feof=discard
 fun:ferror=discard
 fun:fflush=discard
 fun:fileno=discard
 fun:fopen=discard
 fun:fprintf=discard

 fun:getcwd=custom
 fun:get_current_dir_name=custom
 fun:gethostname=custom
 fun:getrlimit=custom
 fun:getrusage=custom
 fun:nanosleep=custom
 fun:pread=custom
 fun:read=custom
+fun:recvmsg=custom
 fun:socketpair=custom
 fun:stat=custom
 fun:time=custom
 
 # Functions that produce an output that depend on the input (propagate the
 # shadow manually).
 fun:ctime_r=custom
 fun:inet_pton=custom

compiler-rt/test/dfsan/custom.cpp

 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <strings.h>
 #include <sys/epoll.h>
 #include <sys/resource.h>
 #include <sys/select.h>
+#include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
 
 dfsan_label i_label = 0;
 dfsan_label j_label = 0;
void test_calloc() {
   dfsan_set_label(i_label, crv, 100);
   free(crv);
 
   crv = (char *) calloc(4096, 1);
   ASSERT_ZERO_LABEL(crv[0]);
   free(crv);
 }
 
+void test_recvmsg() {
+  int sockfds[2];
+  int ret = socketpair(AF_UNIX, SOCK_DGRAM, 0, sockfds);
+  assert(ret != -1);
+
+  char sbuf[] = "abcdefghijkl";
+  struct iovec siovs[2] = {{&sbuf[0], 4}, {&sbuf[4], 4}};
+  struct msghdr smsg = {};
+  smsg.msg_iov = siovs;
+  smsg.msg_iovlen = 2;
+
+  ssize_t sent = sendmsg(sockfds[0], &smsg, 0);
+  assert(sent > 0);
+
+  char rbuf[128];
+  struct iovec riovs[2] = {{&rbuf[0], 4}, {&rbuf[4], 4}};
+  struct msghdr rmsg = {};
+  rmsg.msg_iov = riovs;
+  rmsg.msg_iovlen = 2;
+
+  dfsan_set_label(i_label, rbuf, sizeof(rbuf));
+  dfsan_set_label(i_label, &rmsg, sizeof(rmsg));
+
+  ssize_t received = recvmsg(sockfds[1], &rmsg, 0);
+  assert(received == sent);
+  assert(memcmp(sbuf, rbuf, 8) == 0);
+  ASSERT_ZERO_LABEL(received);
+  ASSERT_READ_ZERO_LABEL(&rmsg, sizeof(rmsg));
+  ASSERT_READ_ZERO_LABEL(&rbuf[0], 8);
+  ASSERT_READ_LABEL(&rbuf[8], 1, i_label);
+
+  close(sockfds[0]);
+  close(sockfds[1]);
+}
+
 void test_read() {
   char buf[16];
   dfsan_set_label(i_label, buf, 1);
   dfsan_set_label(j_label, buf + 15, 1);
 
   ASSERT_LABEL(buf[0], i_label);
   ASSERT_LABEL(buf[15], j_label);
 
#endif
   test_memcmp();
   test_memcpy();
   test_memset();
   test_nanosleep();
   test_poll();
   test_pread();
   test_pthread_create();
   test_read();
+  test_recvmsg();
   test_sched_getaffinity();
   test_select();
   test_sigaction();
   test_sigemptyset();
   test_snprintf();
   test_socketpair();
   test_sprintf();
   test_stat();