diff options
| -rw-r--r-- | compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc | 30 | ||||
| -rw-r--r-- | compiler-rt/test/msan/Linux/cmsghdr.cc | 101 |
2 files changed, 130 insertions, 1 deletions
diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc index af235a11282..955950538c4 100644 --- a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc +++ b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc @@ -2499,6 +2499,34 @@ INTERCEPTOR(SSIZE_T, recvmsg, int fd, struct __sanitizer_msghdr *msg, #endif #if SANITIZER_INTERCEPT_SENDMSG +static void read_msghdr_control(void *ctx, void *control, uptr controllen) { + const unsigned kCmsgDataOffset = + RoundUpTo(sizeof(__sanitizer_cmsghdr), sizeof(uptr)); + + char *p = (char *)control; + char *const control_end = p + controllen; + while (true) { + if (p + sizeof(__sanitizer_cmsghdr) > control_end) break; + __sanitizer_cmsghdr *cmsg = (__sanitizer_cmsghdr *)p; + COMMON_INTERCEPTOR_READ_RANGE(ctx, &cmsg->cmsg_len, sizeof(cmsg->cmsg_len)); + + if (p + RoundUpTo(cmsg->cmsg_len, sizeof(uptr)) > control_end) break; + + COMMON_INTERCEPTOR_READ_RANGE(ctx, &cmsg->cmsg_level, + sizeof(cmsg->cmsg_level)); + COMMON_INTERCEPTOR_READ_RANGE(ctx, &cmsg->cmsg_type, + sizeof(cmsg->cmsg_type)); + + if (cmsg->cmsg_len > kCmsgDataOffset) { + char *data = p + kCmsgDataOffset; + unsigned data_len = cmsg->cmsg_len - kCmsgDataOffset; + if (data_len > 0) COMMON_INTERCEPTOR_READ_RANGE(ctx, data, data_len); + } + + p += RoundUpTo(cmsg->cmsg_len, sizeof(uptr)); + } +} + static void read_msghdr(void *ctx, struct __sanitizer_msghdr *msg, SSIZE_T maxlen) { #define R(f) \ @@ -2518,7 +2546,7 @@ static void read_msghdr(void *ctx, struct __sanitizer_msghdr *msg, sizeof(*msg->msg_iov) * msg->msg_iovlen); read_iovec(ctx, msg->msg_iov, msg->msg_iovlen, maxlen); if (msg->msg_control && msg->msg_controllen) - COMMON_INTERCEPTOR_READ_RANGE(ctx, msg->msg_control, msg->msg_controllen); + read_msghdr_control(ctx, msg->msg_control, msg->msg_controllen); } INTERCEPTOR(SSIZE_T, sendmsg, int fd, struct __sanitizer_msghdr *msg, diff --git a/compiler-rt/test/msan/Linux/cmsghdr.cc b/compiler-rt/test/msan/Linux/cmsghdr.cc new file mode 100644 index 00000000000..daed1baad20 --- /dev/null +++ b/compiler-rt/test/msan/Linux/cmsghdr.cc @@ -0,0 +1,101 @@ +// RUN: %clangxx_msan %s -std=c++11 -DSENDMSG -DPOISONFD -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=SENDMSG +// RUN: %clangxx_msan %s -std=c++11 -DSENDMSG -DPOISONCRED -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=SENDMSG +// RUN: %clangxx_msan %s -std=c++11 -DSENDMSG -DPOISONLEN -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=SENDMSG +// RUN: %clangxx_msan %s -std=c++11 -DSENDMSG -DPOISONLEVEL -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=SENDMSG +// RUN: %clangxx_msan %s -std=c++11 -DSENDMSG -DPOISONTYPE -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=SENDMSG +// RUN: %clangxx_msan %s -std=c++11 -DSENDMSG -DPOISONLEN2 -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=SENDMSG +// RUN: %clangxx_msan %s -std=c++11 -DSENDMSG -DPOISONLEVEL2 -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=SENDMSG +// RUN: %clangxx_msan %s -std=c++11 -DSENDMSG -DPOISONTYPE2 -o %t && not %run %t 2>&1 | FileCheck %s --check-prefix=SENDMSG +// RUN: %clangxx_msan %s -std=c++11 -DSENDMSG -o %t && %run %t 2>&1 | FileCheck %s --check-prefix=NEGATIVE + +// UNSUPPORTED: android + +#include <assert.h> +#include <stdio.h> +#include <unistd.h> +#include <stdlib.h> +#include <string.h> +#include <errno.h> +#include <netdb.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <sys/un.h> +#include <sanitizer/msan_interface.h> + +const int kBufSize = 10; + +int main() { + int ret; + char buf[kBufSize] = {0}; + pthread_t client_thread; + struct sockaddr_un serveraddr; + + int sock[2]; + ret = socketpair(AF_UNIX, SOCK_STREAM, 0, sock); + assert(ret == 0); + + int sockfd = sock[0]; + + struct iovec iov[] = {{buf, 10}}; + struct msghdr msg = {0}; + msg.msg_iov = iov; + msg.msg_iovlen = 1; + msg.msg_flags = 0; + + static const int kNumFds = 3; + char controlbuf[CMSG_SPACE(kNumFds * sizeof(int)) + + CMSG_SPACE(sizeof(struct ucred))]; + msg.msg_control = &controlbuf; + msg.msg_controllen = sizeof(controlbuf); + + struct cmsghdr *cmsg = (struct cmsghdr *)&controlbuf; + assert(cmsg); + int myfds[kNumFds]; + for (int &fd : myfds) + fd = sockfd; +#ifdef POISONFD + __msan_poison(&myfds[1], sizeof(int)); +#endif + cmsg->cmsg_level = SOL_SOCKET; + cmsg->cmsg_type = SCM_RIGHTS; + cmsg->cmsg_len = CMSG_LEN(kNumFds * sizeof(int)); + memcpy(CMSG_DATA(cmsg), myfds, kNumFds * sizeof(int)); +#ifdef POISONLEVEL + __msan_poison(&cmsg->cmsg_level, sizeof(cmsg->cmsg_level)); +#endif +#ifdef POISONTYPE + __msan_poison(&cmsg->cmsg_type, sizeof(cmsg->cmsg_type)); +#endif +#ifdef POISONLEN + __msan_poison(&cmsg->cmsg_len, sizeof(cmsg->cmsg_len)); +#endif + + cmsg = (struct cmsghdr *)(&controlbuf[CMSG_SPACE(kNumFds * sizeof(int))]); + assert(cmsg); + struct ucred cred = {getpid(), getuid(), getgid()}; +#ifdef POISONCRED + __msan_poison(&cred.uid, sizeof(cred.uid)); +#endif + cmsg->cmsg_level = SOL_SOCKET; + cmsg->cmsg_type = SCM_CREDENTIALS; + cmsg->cmsg_len = CMSG_LEN(sizeof(struct ucred)); + memcpy(CMSG_DATA(cmsg), &cred, sizeof(struct ucred)); +#ifdef POISONLEVEL2 + __msan_poison(&cmsg->cmsg_level, sizeof(cmsg->cmsg_level)); +#endif +#ifdef POISONTYPE2 + __msan_poison(&cmsg->cmsg_type, sizeof(cmsg->cmsg_type)); +#endif +#ifdef POISONLEN2 + __msan_poison(&cmsg->cmsg_len, sizeof(cmsg->cmsg_len)); +#endif + + ret = sendmsg(sockfd, &msg, 0); + // SENDMSG: MemorySanitizer: use-of-uninitialized-value + if (ret == -1) printf("%d: %s\n", errno, strerror(errno)); + assert(ret > 0); + + fprintf(stderr, "== done\n"); + // NEGATIVE: == done + return 0; +} |
