diff options
| -rw-r--r-- | compiler-rt/lib/fuzzer/FuzzerExtFunctions.def | 1 | ||||
| -rw-r--r-- | compiler-rt/lib/fuzzer/FuzzerLoop.cpp | 4 | ||||
| -rw-r--r-- | compiler-rt/test/fuzzer/MsanParamUnpoison.cpp | 28 | ||||
| -rw-r--r-- | compiler-rt/test/fuzzer/msan-param-unpoison.test | 5 |
4 files changed, 37 insertions, 1 deletions
diff --git a/compiler-rt/lib/fuzzer/FuzzerExtFunctions.def b/compiler-rt/lib/fuzzer/FuzzerExtFunctions.def index 288a59ce39e..41fa0fd2b74 100644 --- a/compiler-rt/lib/fuzzer/FuzzerExtFunctions.def +++ b/compiler-rt/lib/fuzzer/FuzzerExtFunctions.def @@ -46,3 +46,4 @@ EXT_FUNC(__sanitizer_set_report_fd, void, (void*), false); EXT_FUNC(__msan_scoped_disable_interceptor_checks, void, (), false); EXT_FUNC(__msan_scoped_enable_interceptor_checks, void, (), false); EXT_FUNC(__msan_unpoison, void, (const volatile void *, size_t size), false); +EXT_FUNC(__msan_unpoison_param, void, (size_t n), false); diff --git a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp index d1ad3e37efa..cb3d8214c0c 100644 --- a/compiler-rt/lib/fuzzer/FuzzerLoop.cpp +++ b/compiler-rt/lib/fuzzer/FuzzerLoop.cpp @@ -542,6 +542,8 @@ void Fuzzer::ExecuteCallback(const uint8_t *Data, size_t Size) { memcpy(DataCopy, Data, Size); if (EF->__msan_unpoison) EF->__msan_unpoison(DataCopy, Size); + if (EF->__msan_unpoison_param) + EF->__msan_unpoison_param(2); if (CurrentUnitData && CurrentUnitData != Data) memcpy(CurrentUnitData, Data, Size); CurrentUnitSize = Size; @@ -702,7 +704,7 @@ void Fuzzer::MutateAndTestOne() { break; // We will mutate this input more in the next rounds. } if (Options.ReduceDepth && !FoundUniqFeatures) - break; + break; } } diff --git a/compiler-rt/test/fuzzer/MsanParamUnpoison.cpp b/compiler-rt/test/fuzzer/MsanParamUnpoison.cpp new file mode 100644 index 00000000000..bcf50804d73 --- /dev/null +++ b/compiler-rt/test/fuzzer/MsanParamUnpoison.cpp @@ -0,0 +1,28 @@ +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception + +// Triggers the bug described here: +// https://github.com/google/oss-fuzz/issues/2369#issuecomment-490240627 +// +// In a nutshell, MSan's parameter shadow does not get unpoisoned before calls +// to LLVMFuzzerTestOneInput. This test case causes the parameter shadow to be +// poisoned by the call to foo(), which will trigger an MSan false positive on +// the Size == 0 check if the parameter shadow is still poisoned. +#include <cstdint> +#include <cstdio> +#include <cstdlib> +#include <cstring> + +volatile int zero = 0; +__attribute__((noinline)) int foo(int arg1, int arg2) { return zero; } + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { + if (Size == 0) + return 0; + + // Pass uninitialized values to foo(). Since foo doesn't do anything with + // them, MSan should not report an error here. + int a, b; + return foo(a, b); +} diff --git a/compiler-rt/test/fuzzer/msan-param-unpoison.test b/compiler-rt/test/fuzzer/msan-param-unpoison.test new file mode 100644 index 00000000000..f32f8511dd8 --- /dev/null +++ b/compiler-rt/test/fuzzer/msan-param-unpoison.test @@ -0,0 +1,5 @@ +REQUIRES: msan +RUN: %msan_compiler %S/MsanParamUnpoison.cpp -o %t +RUN: %run %t -seed=1 -runs=1000 2>&1 | FileCheck %s + +CHECK-NOT: MemorySanitizer: use-of-uninitialized-value |
