msan_interceptors.cpp 56 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745
  1. //===-- msan_interceptors.cpp ---------------------------------------------===//
  2. //
  3. // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
  4. // See https://llvm.org/LICENSE.txt for license information.
  5. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
  6. //
  7. //===----------------------------------------------------------------------===//
  8. //
  9. // This file is a part of MemorySanitizer.
  10. //
  11. // Interceptors for standard library functions.
  12. //
  13. // FIXME: move as many interceptors as possible into
  14. // sanitizer_common/sanitizer_common_interceptors.h
  15. //===----------------------------------------------------------------------===//
  16. #include "interception/interception.h"
  17. #include "msan.h"
  18. #include "msan_chained_origin_depot.h"
  19. #include "msan_origin.h"
  20. #include "msan_poisoning.h"
  21. #include "msan_report.h"
  22. #include "msan_thread.h"
  23. #include "sanitizer_common/sanitizer_allocator.h"
  24. #include "sanitizer_common/sanitizer_allocator_dlsym.h"
  25. #include "sanitizer_common/sanitizer_allocator_interface.h"
  26. #include "sanitizer_common/sanitizer_atomic.h"
  27. #include "sanitizer_common/sanitizer_common.h"
  28. #include "sanitizer_common/sanitizer_errno.h"
  29. #include "sanitizer_common/sanitizer_errno_codes.h"
  30. #include "sanitizer_common/sanitizer_glibc_version.h"
  31. #include "sanitizer_common/sanitizer_libc.h"
  32. #include "sanitizer_common/sanitizer_linux.h"
  33. #include "sanitizer_common/sanitizer_platform_limits_netbsd.h"
  34. #include "sanitizer_common/sanitizer_platform_limits_posix.h"
  35. #include "sanitizer_common/sanitizer_stackdepot.h"
  36. #include "sanitizer_common/sanitizer_tls_get_addr.h"
  37. #include "sanitizer_common/sanitizer_vector.h"
  38. #if SANITIZER_NETBSD
  39. #define fstat __fstat50
  40. #define gettimeofday __gettimeofday50
  41. #define getrusage __getrusage50
  42. #define tzset __tzset50
  43. #endif
  44. #include <stdarg.h>
  45. // ACHTUNG! No other system header includes in this file.
  46. // Ideally, we should get rid of stdarg.h as well.
  47. using namespace __msan;
  48. using __sanitizer::memory_order;
  49. using __sanitizer::atomic_load;
  50. using __sanitizer::atomic_store;
  51. using __sanitizer::atomic_uintptr_t;
  52. DECLARE_REAL(SIZE_T, strlen, const char *s)
  53. DECLARE_REAL(SIZE_T, strnlen, const char *s, SIZE_T maxlen)
  54. DECLARE_REAL(void *, memcpy, void *dest, const void *src, uptr n)
  55. DECLARE_REAL(void *, memset, void *dest, int c, uptr n)
  56. // True if this is a nested interceptor.
  57. static THREADLOCAL int in_interceptor_scope;
  58. void __msan_scoped_disable_interceptor_checks() { ++in_interceptor_scope; }
  59. void __msan_scoped_enable_interceptor_checks() { --in_interceptor_scope; }
  60. struct InterceptorScope {
  61. InterceptorScope() { ++in_interceptor_scope; }
  62. ~InterceptorScope() { --in_interceptor_scope; }
  63. };
  64. bool IsInInterceptorScope() {
  65. return in_interceptor_scope;
  66. }
  67. struct DlsymAlloc : public DlSymAllocator<DlsymAlloc> {
  68. static bool UseImpl() { return !msan_inited; }
  69. };
  70. #define ENSURE_MSAN_INITED() do { \
  71. CHECK(!msan_init_is_running); \
  72. if (!msan_inited) { \
  73. __msan_init(); \
  74. } \
  75. } while (0)
  76. // Check that [x, x+n) range is unpoisoned.
  77. #define CHECK_UNPOISONED_0(x, n) \
  78. do { \
  79. sptr __offset = __msan_test_shadow(x, n); \
  80. if (__msan::IsInSymbolizer()) break; \
  81. if (__offset >= 0 && __msan::flags()->report_umrs) { \
  82. GET_CALLER_PC_BP_SP; \
  83. (void)sp; \
  84. ReportUMRInsideAddressRange(__func__, x, n, __offset); \
  85. __msan::PrintWarningWithOrigin( \
  86. pc, bp, __msan_get_origin((const char *)x + __offset)); \
  87. if (__msan::flags()->halt_on_error) { \
  88. Printf("Exiting\n"); \
  89. Die(); \
  90. } \
  91. } \
  92. } while (0)
  93. // Check that [x, x+n) range is unpoisoned unless we are in a nested
  94. // interceptor.
  95. #define CHECK_UNPOISONED(x, n) \
  96. do { \
  97. if (!IsInInterceptorScope()) CHECK_UNPOISONED_0(x, n); \
  98. } while (0)
  99. #define CHECK_UNPOISONED_STRING_OF_LEN(x, len, n) \
  100. CHECK_UNPOISONED((x), \
  101. common_flags()->strict_string_checks ? (len) + 1 : (n) )
  102. #define CHECK_UNPOISONED_STRING(x, n) \
  103. CHECK_UNPOISONED_STRING_OF_LEN((x), internal_strlen(x), (n))
  104. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  105. INTERCEPTOR(SIZE_T, fread_unlocked, void *ptr, SIZE_T size, SIZE_T nmemb,
  106. void *file) {
  107. ENSURE_MSAN_INITED();
  108. SIZE_T res = REAL(fread_unlocked)(ptr, size, nmemb, file);
  109. if (res > 0)
  110. __msan_unpoison(ptr, res *size);
  111. return res;
  112. }
  113. #define MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED INTERCEPT_FUNCTION(fread_unlocked)
  114. #else
  115. #define MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED
  116. #endif
  117. #if !SANITIZER_NETBSD
  118. INTERCEPTOR(void *, mempcpy, void *dest, const void *src, SIZE_T n) {
  119. return (char *)__msan_memcpy(dest, src, n) + n;
  120. }
  121. #define MSAN_MAYBE_INTERCEPT_MEMPCPY INTERCEPT_FUNCTION(mempcpy)
  122. #else
  123. #define MSAN_MAYBE_INTERCEPT_MEMPCPY
  124. #endif
  125. INTERCEPTOR(void *, memccpy, void *dest, const void *src, int c, SIZE_T n) {
  126. ENSURE_MSAN_INITED();
  127. void *res = REAL(memccpy)(dest, src, c, n);
  128. CHECK(!res || (res >= dest && res <= (char *)dest + n));
  129. SIZE_T sz = res ? (char *)res - (char *)dest : n;
  130. CHECK_UNPOISONED(src, sz);
  131. __msan_unpoison(dest, sz);
  132. return res;
  133. }
  134. INTERCEPTOR(void *, bcopy, const void *src, void *dest, SIZE_T n) {
  135. return __msan_memmove(dest, src, n);
  136. }
  137. INTERCEPTOR(int, posix_memalign, void **memptr, SIZE_T alignment, SIZE_T size) {
  138. GET_MALLOC_STACK_TRACE;
  139. CHECK_NE(memptr, 0);
  140. int res = msan_posix_memalign(memptr, alignment, size, &stack);
  141. if (!res)
  142. __msan_unpoison(memptr, sizeof(*memptr));
  143. return res;
  144. }
  145. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  146. INTERCEPTOR(void *, memalign, SIZE_T alignment, SIZE_T size) {
  147. GET_MALLOC_STACK_TRACE;
  148. return msan_memalign(alignment, size, &stack);
  149. }
  150. #define MSAN_MAYBE_INTERCEPT_MEMALIGN INTERCEPT_FUNCTION(memalign)
  151. #else
  152. #define MSAN_MAYBE_INTERCEPT_MEMALIGN
  153. #endif
  154. INTERCEPTOR(void *, aligned_alloc, SIZE_T alignment, SIZE_T size) {
  155. GET_MALLOC_STACK_TRACE;
  156. return msan_aligned_alloc(alignment, size, &stack);
  157. }
  158. #if !SANITIZER_NETBSD
  159. INTERCEPTOR(void *, __libc_memalign, SIZE_T alignment, SIZE_T size) {
  160. GET_MALLOC_STACK_TRACE;
  161. void *ptr = msan_memalign(alignment, size, &stack);
  162. if (ptr)
  163. DTLS_on_libc_memalign(ptr, size);
  164. return ptr;
  165. }
  166. #define MSAN_MAYBE_INTERCEPT___LIBC_MEMALIGN INTERCEPT_FUNCTION(__libc_memalign)
  167. #else
  168. #define MSAN_MAYBE_INTERCEPT___LIBC_MEMALIGN
  169. #endif
  170. INTERCEPTOR(void *, valloc, SIZE_T size) {
  171. GET_MALLOC_STACK_TRACE;
  172. return msan_valloc(size, &stack);
  173. }
  174. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  175. INTERCEPTOR(void *, pvalloc, SIZE_T size) {
  176. GET_MALLOC_STACK_TRACE;
  177. return msan_pvalloc(size, &stack);
  178. }
  179. #define MSAN_MAYBE_INTERCEPT_PVALLOC INTERCEPT_FUNCTION(pvalloc)
  180. #else
  181. #define MSAN_MAYBE_INTERCEPT_PVALLOC
  182. #endif
  183. INTERCEPTOR(void, free, void *ptr) {
  184. if (UNLIKELY(!ptr))
  185. return;
  186. if (DlsymAlloc::PointerIsMine(ptr))
  187. return DlsymAlloc::Free(ptr);
  188. GET_MALLOC_STACK_TRACE;
  189. MsanDeallocate(&stack, ptr);
  190. }
  191. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  192. INTERCEPTOR(void, cfree, void *ptr) {
  193. if (UNLIKELY(!ptr))
  194. return;
  195. if (DlsymAlloc::PointerIsMine(ptr))
  196. return DlsymAlloc::Free(ptr);
  197. GET_MALLOC_STACK_TRACE;
  198. MsanDeallocate(&stack, ptr);
  199. }
  200. # define MSAN_MAYBE_INTERCEPT_CFREE INTERCEPT_FUNCTION(cfree)
  201. #else
  202. #define MSAN_MAYBE_INTERCEPT_CFREE
  203. #endif
  204. #if !SANITIZER_NETBSD
  205. INTERCEPTOR(uptr, malloc_usable_size, void *ptr) {
  206. return __sanitizer_get_allocated_size(ptr);
  207. }
  208. #define MSAN_MAYBE_INTERCEPT_MALLOC_USABLE_SIZE \
  209. INTERCEPT_FUNCTION(malloc_usable_size)
  210. #else
  211. #define MSAN_MAYBE_INTERCEPT_MALLOC_USABLE_SIZE
  212. #endif
  213. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  214. // This function actually returns a struct by value, but we can't unpoison a
  215. // temporary! The following is equivalent on all supported platforms but
  216. // aarch64 (which uses a different register for sret value). We have a test
  217. // to confirm that.
  218. INTERCEPTOR(void, mallinfo, __sanitizer_struct_mallinfo *sret) {
  219. #ifdef __aarch64__
  220. uptr r8;
  221. asm volatile("mov %0,x8" : "=r" (r8));
  222. sret = reinterpret_cast<__sanitizer_struct_mallinfo*>(r8);
  223. #endif
  224. REAL(memset)(sret, 0, sizeof(*sret));
  225. __msan_unpoison(sret, sizeof(*sret));
  226. }
  227. #define MSAN_MAYBE_INTERCEPT_MALLINFO INTERCEPT_FUNCTION(mallinfo)
  228. #else
  229. #define MSAN_MAYBE_INTERCEPT_MALLINFO
  230. #endif
  231. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  232. INTERCEPTOR(int, mallopt, int cmd, int value) {
  233. return 0;
  234. }
  235. #define MSAN_MAYBE_INTERCEPT_MALLOPT INTERCEPT_FUNCTION(mallopt)
  236. #else
  237. #define MSAN_MAYBE_INTERCEPT_MALLOPT
  238. #endif
  239. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  240. INTERCEPTOR(void, malloc_stats, void) {
  241. // FIXME: implement, but don't call REAL(malloc_stats)!
  242. }
  243. #define MSAN_MAYBE_INTERCEPT_MALLOC_STATS INTERCEPT_FUNCTION(malloc_stats)
  244. #else
  245. #define MSAN_MAYBE_INTERCEPT_MALLOC_STATS
  246. #endif
  247. INTERCEPTOR(char *, strcpy, char *dest, const char *src) {
  248. ENSURE_MSAN_INITED();
  249. GET_STORE_STACK_TRACE;
  250. SIZE_T n = internal_strlen(src);
  251. CHECK_UNPOISONED_STRING(src + n, 0);
  252. char *res = REAL(strcpy)(dest, src);
  253. CopyShadowAndOrigin(dest, src, n + 1, &stack);
  254. return res;
  255. }
  256. INTERCEPTOR(char *, strncpy, char *dest, const char *src, SIZE_T n) {
  257. ENSURE_MSAN_INITED();
  258. GET_STORE_STACK_TRACE;
  259. SIZE_T copy_size = internal_strnlen(src, n);
  260. if (copy_size < n)
  261. copy_size++; // trailing \0
  262. char *res = REAL(strncpy)(dest, src, n);
  263. CopyShadowAndOrigin(dest, src, copy_size, &stack);
  264. __msan_unpoison(dest + copy_size, n - copy_size);
  265. return res;
  266. }
  267. #if !SANITIZER_NETBSD
  268. INTERCEPTOR(char *, stpcpy, char *dest, const char *src) {
  269. ENSURE_MSAN_INITED();
  270. GET_STORE_STACK_TRACE;
  271. SIZE_T n = internal_strlen(src);
  272. CHECK_UNPOISONED_STRING(src + n, 0);
  273. char *res = REAL(stpcpy)(dest, src);
  274. CopyShadowAndOrigin(dest, src, n + 1, &stack);
  275. return res;
  276. }
  277. #define MSAN_MAYBE_INTERCEPT_STPCPY INTERCEPT_FUNCTION(stpcpy)
  278. #else
  279. #define MSAN_MAYBE_INTERCEPT_STPCPY
  280. #endif
  281. INTERCEPTOR(char *, strdup, char *src) {
  282. ENSURE_MSAN_INITED();
  283. GET_STORE_STACK_TRACE;
  284. // On FreeBSD strdup() leverages strlen().
  285. InterceptorScope interceptor_scope;
  286. SIZE_T n = internal_strlen(src);
  287. CHECK_UNPOISONED_STRING(src + n, 0);
  288. char *res = REAL(strdup)(src);
  289. CopyShadowAndOrigin(res, src, n + 1, &stack);
  290. return res;
  291. }
  292. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  293. INTERCEPTOR(char *, __strdup, char *src) {
  294. ENSURE_MSAN_INITED();
  295. GET_STORE_STACK_TRACE;
  296. SIZE_T n = internal_strlen(src);
  297. CHECK_UNPOISONED_STRING(src + n, 0);
  298. char *res = REAL(__strdup)(src);
  299. CopyShadowAndOrigin(res, src, n + 1, &stack);
  300. return res;
  301. }
  302. #define MSAN_MAYBE_INTERCEPT___STRDUP INTERCEPT_FUNCTION(__strdup)
  303. #else
  304. #define MSAN_MAYBE_INTERCEPT___STRDUP
  305. #endif
  306. #if !SANITIZER_NETBSD
  307. INTERCEPTOR(char *, gcvt, double number, SIZE_T ndigit, char *buf) {
  308. ENSURE_MSAN_INITED();
  309. char *res = REAL(gcvt)(number, ndigit, buf);
  310. SIZE_T n = internal_strlen(buf);
  311. __msan_unpoison(buf, n + 1);
  312. return res;
  313. }
  314. #define MSAN_MAYBE_INTERCEPT_GCVT INTERCEPT_FUNCTION(gcvt)
  315. #else
  316. #define MSAN_MAYBE_INTERCEPT_GCVT
  317. #endif
  318. INTERCEPTOR(char *, strcat, char *dest, const char *src) {
  319. ENSURE_MSAN_INITED();
  320. GET_STORE_STACK_TRACE;
  321. SIZE_T src_size = internal_strlen(src);
  322. SIZE_T dest_size = internal_strlen(dest);
  323. CHECK_UNPOISONED_STRING(src + src_size, 0);
  324. CHECK_UNPOISONED_STRING(dest + dest_size, 0);
  325. char *res = REAL(strcat)(dest, src);
  326. CopyShadowAndOrigin(dest + dest_size, src, src_size + 1, &stack);
  327. return res;
  328. }
  329. INTERCEPTOR(char *, strncat, char *dest, const char *src, SIZE_T n) {
  330. ENSURE_MSAN_INITED();
  331. GET_STORE_STACK_TRACE;
  332. SIZE_T dest_size = internal_strlen(dest);
  333. SIZE_T copy_size = internal_strnlen(src, n);
  334. CHECK_UNPOISONED_STRING(dest + dest_size, 0);
  335. char *res = REAL(strncat)(dest, src, n);
  336. CopyShadowAndOrigin(dest + dest_size, src, copy_size, &stack);
  337. __msan_unpoison(dest + dest_size + copy_size, 1); // \0
  338. return res;
  339. }
  340. // Hack: always pass nptr and endptr as part of __VA_ARGS_ to avoid having to
  341. // deal with empty __VA_ARGS__ in the case of INTERCEPTOR_STRTO.
  342. #define INTERCEPTOR_STRTO_BODY(ret_type, func, ...) \
  343. ENSURE_MSAN_INITED(); \
  344. ret_type res = REAL(func)(__VA_ARGS__); \
  345. __msan_unpoison(endptr, sizeof(*endptr)); \
  346. return res;
  347. #define INTERCEPTOR_STRTO(ret_type, func, char_type) \
  348. INTERCEPTOR(ret_type, func, const char_type *nptr, char_type **endptr) { \
  349. INTERCEPTOR_STRTO_BODY(ret_type, func, nptr, endptr); \
  350. }
  351. #define INTERCEPTOR_STRTO_BASE(ret_type, func, char_type) \
  352. INTERCEPTOR(ret_type, func, const char_type *nptr, char_type **endptr, \
  353. int base) { \
  354. INTERCEPTOR_STRTO_BODY(ret_type, func, nptr, endptr, base); \
  355. }
  356. #define INTERCEPTOR_STRTO_LOC(ret_type, func, char_type) \
  357. INTERCEPTOR(ret_type, func, const char_type *nptr, char_type **endptr, \
  358. void *loc) { \
  359. INTERCEPTOR_STRTO_BODY(ret_type, func, nptr, endptr, loc); \
  360. }
  361. #define INTERCEPTOR_STRTO_BASE_LOC(ret_type, func, char_type) \
  362. INTERCEPTOR(ret_type, func, const char_type *nptr, char_type **endptr, \
  363. int base, void *loc) { \
  364. INTERCEPTOR_STRTO_BODY(ret_type, func, nptr, endptr, base, loc); \
  365. }
  366. #if SANITIZER_NETBSD
  367. #define INTERCEPTORS_STRTO(ret_type, func, char_type) \
  368. INTERCEPTOR_STRTO(ret_type, func, char_type) \
  369. INTERCEPTOR_STRTO_LOC(ret_type, func##_l, char_type)
  370. #define INTERCEPTORS_STRTO_BASE(ret_type, func, char_type) \
  371. INTERCEPTOR_STRTO_BASE(ret_type, func, char_type) \
  372. INTERCEPTOR_STRTO_BASE_LOC(ret_type, func##_l, char_type)
  373. #else
  374. #define INTERCEPTORS_STRTO(ret_type, func, char_type) \
  375. INTERCEPTOR_STRTO(ret_type, func, char_type) \
  376. INTERCEPTOR_STRTO_LOC(ret_type, func##_l, char_type) \
  377. INTERCEPTOR_STRTO_LOC(ret_type, __##func##_l, char_type) \
  378. INTERCEPTOR_STRTO_LOC(ret_type, __##func##_internal, char_type)
  379. #define INTERCEPTORS_STRTO_BASE(ret_type, func, char_type) \
  380. INTERCEPTOR_STRTO_BASE(ret_type, func, char_type) \
  381. INTERCEPTOR_STRTO_BASE_LOC(ret_type, func##_l, char_type) \
  382. INTERCEPTOR_STRTO_BASE_LOC(ret_type, __##func##_l, char_type) \
  383. INTERCEPTOR_STRTO_BASE_LOC(ret_type, __##func##_internal, char_type)
  384. #endif
  385. INTERCEPTORS_STRTO(double, strtod, char)
  386. INTERCEPTORS_STRTO(float, strtof, char)
  387. INTERCEPTORS_STRTO(long double, strtold, char)
  388. INTERCEPTORS_STRTO_BASE(long, strtol, char)
  389. INTERCEPTORS_STRTO_BASE(long long, strtoll, char)
  390. INTERCEPTORS_STRTO_BASE(unsigned long, strtoul, char)
  391. INTERCEPTORS_STRTO_BASE(unsigned long long, strtoull, char)
  392. INTERCEPTORS_STRTO_BASE(u64, strtouq, char)
  393. INTERCEPTORS_STRTO(double, wcstod, wchar_t)
  394. INTERCEPTORS_STRTO(float, wcstof, wchar_t)
  395. INTERCEPTORS_STRTO(long double, wcstold, wchar_t)
  396. INTERCEPTORS_STRTO_BASE(long, wcstol, wchar_t)
  397. INTERCEPTORS_STRTO_BASE(long long, wcstoll, wchar_t)
  398. INTERCEPTORS_STRTO_BASE(unsigned long, wcstoul, wchar_t)
  399. INTERCEPTORS_STRTO_BASE(unsigned long long, wcstoull, wchar_t)
  400. #if SANITIZER_NETBSD
  401. #define INTERCEPT_STRTO(func) \
  402. INTERCEPT_FUNCTION(func); \
  403. INTERCEPT_FUNCTION(func##_l);
  404. #else
  405. #define INTERCEPT_STRTO(func) \
  406. INTERCEPT_FUNCTION(func); \
  407. INTERCEPT_FUNCTION(func##_l); \
  408. INTERCEPT_FUNCTION(__##func##_l); \
  409. INTERCEPT_FUNCTION(__##func##_internal);
  410. #endif
  411. // FIXME: support *wprintf in common format interceptors.
  412. INTERCEPTOR(int, vswprintf, void *str, uptr size, void *format, va_list ap) {
  413. ENSURE_MSAN_INITED();
  414. int res = REAL(vswprintf)(str, size, format, ap);
  415. if (res >= 0) {
  416. __msan_unpoison(str, 4 * (res + 1));
  417. }
  418. return res;
  419. }
  420. INTERCEPTOR(int, swprintf, void *str, uptr size, void *format, ...) {
  421. ENSURE_MSAN_INITED();
  422. va_list ap;
  423. va_start(ap, format);
  424. int res = vswprintf(str, size, format, ap);
  425. va_end(ap);
  426. return res;
  427. }
  428. #define INTERCEPTOR_STRFTIME_BODY(char_type, ret_type, func, s, ...) \
  429. ENSURE_MSAN_INITED(); \
  430. InterceptorScope interceptor_scope; \
  431. ret_type res = REAL(func)(s, __VA_ARGS__); \
  432. if (s) __msan_unpoison(s, sizeof(char_type) * (res + 1)); \
  433. return res;
  434. INTERCEPTOR(SIZE_T, strftime, char *s, SIZE_T max, const char *format,
  435. __sanitizer_tm *tm) {
  436. INTERCEPTOR_STRFTIME_BODY(char, SIZE_T, strftime, s, max, format, tm);
  437. }
  438. INTERCEPTOR(SIZE_T, strftime_l, char *s, SIZE_T max, const char *format,
  439. __sanitizer_tm *tm, void *loc) {
  440. INTERCEPTOR_STRFTIME_BODY(char, SIZE_T, strftime_l, s, max, format, tm, loc);
  441. }
  442. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  443. INTERCEPTOR(SIZE_T, __strftime_l, char *s, SIZE_T max, const char *format,
  444. __sanitizer_tm *tm, void *loc) {
  445. INTERCEPTOR_STRFTIME_BODY(char, SIZE_T, __strftime_l, s, max, format, tm,
  446. loc);
  447. }
  448. #define MSAN_MAYBE_INTERCEPT___STRFTIME_L INTERCEPT_FUNCTION(__strftime_l)
  449. #else
  450. #define MSAN_MAYBE_INTERCEPT___STRFTIME_L
  451. #endif
  452. INTERCEPTOR(SIZE_T, wcsftime, wchar_t *s, SIZE_T max, const wchar_t *format,
  453. __sanitizer_tm *tm) {
  454. INTERCEPTOR_STRFTIME_BODY(wchar_t, SIZE_T, wcsftime, s, max, format, tm);
  455. }
  456. INTERCEPTOR(SIZE_T, wcsftime_l, wchar_t *s, SIZE_T max, const wchar_t *format,
  457. __sanitizer_tm *tm, void *loc) {
  458. INTERCEPTOR_STRFTIME_BODY(wchar_t, SIZE_T, wcsftime_l, s, max, format, tm,
  459. loc);
  460. }
  461. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  462. INTERCEPTOR(SIZE_T, __wcsftime_l, wchar_t *s, SIZE_T max, const wchar_t *format,
  463. __sanitizer_tm *tm, void *loc) {
  464. INTERCEPTOR_STRFTIME_BODY(wchar_t, SIZE_T, __wcsftime_l, s, max, format, tm,
  465. loc);
  466. }
  467. #define MSAN_MAYBE_INTERCEPT___WCSFTIME_L INTERCEPT_FUNCTION(__wcsftime_l)
  468. #else
  469. #define MSAN_MAYBE_INTERCEPT___WCSFTIME_L
  470. #endif
  471. INTERCEPTOR(int, mbtowc, wchar_t *dest, const char *src, SIZE_T n) {
  472. ENSURE_MSAN_INITED();
  473. int res = REAL(mbtowc)(dest, src, n);
  474. if (res != -1 && dest) __msan_unpoison(dest, sizeof(wchar_t));
  475. return res;
  476. }
  477. INTERCEPTOR(SIZE_T, mbrtowc, wchar_t *dest, const char *src, SIZE_T n,
  478. void *ps) {
  479. ENSURE_MSAN_INITED();
  480. SIZE_T res = REAL(mbrtowc)(dest, src, n, ps);
  481. if (res != (SIZE_T)-1 && dest) __msan_unpoison(dest, sizeof(wchar_t));
  482. return res;
  483. }
  484. // wchar_t *wmemcpy(wchar_t *dest, const wchar_t *src, SIZE_T n);
  485. INTERCEPTOR(wchar_t *, wmemcpy, wchar_t *dest, const wchar_t *src, SIZE_T n) {
  486. ENSURE_MSAN_INITED();
  487. GET_STORE_STACK_TRACE;
  488. wchar_t *res = REAL(wmemcpy)(dest, src, n);
  489. CopyShadowAndOrigin(dest, src, n * sizeof(wchar_t), &stack);
  490. return res;
  491. }
  492. #if !SANITIZER_NETBSD
  493. INTERCEPTOR(wchar_t *, wmempcpy, wchar_t *dest, const wchar_t *src, SIZE_T n) {
  494. ENSURE_MSAN_INITED();
  495. GET_STORE_STACK_TRACE;
  496. wchar_t *res = REAL(wmempcpy)(dest, src, n);
  497. CopyShadowAndOrigin(dest, src, n * sizeof(wchar_t), &stack);
  498. return res;
  499. }
  500. #define MSAN_MAYBE_INTERCEPT_WMEMPCPY INTERCEPT_FUNCTION(wmempcpy)
  501. #else
  502. #define MSAN_MAYBE_INTERCEPT_WMEMPCPY
  503. #endif
  504. INTERCEPTOR(wchar_t *, wmemset, wchar_t *s, wchar_t c, SIZE_T n) {
  505. CHECK(MEM_IS_APP(s));
  506. ENSURE_MSAN_INITED();
  507. wchar_t *res = REAL(wmemset)(s, c, n);
  508. __msan_unpoison(s, n * sizeof(wchar_t));
  509. return res;
  510. }
  511. INTERCEPTOR(wchar_t *, wmemmove, wchar_t *dest, const wchar_t *src, SIZE_T n) {
  512. ENSURE_MSAN_INITED();
  513. GET_STORE_STACK_TRACE;
  514. wchar_t *res = REAL(wmemmove)(dest, src, n);
  515. MoveShadowAndOrigin(dest, src, n * sizeof(wchar_t), &stack);
  516. return res;
  517. }
  518. INTERCEPTOR(int, wcscmp, const wchar_t *s1, const wchar_t *s2) {
  519. ENSURE_MSAN_INITED();
  520. int res = REAL(wcscmp)(s1, s2);
  521. return res;
  522. }
  523. INTERCEPTOR(int, gettimeofday, void *tv, void *tz) {
  524. ENSURE_MSAN_INITED();
  525. int res = REAL(gettimeofday)(tv, tz);
  526. if (tv)
  527. __msan_unpoison(tv, 16);
  528. if (tz)
  529. __msan_unpoison(tz, 8);
  530. return res;
  531. }
  532. #if !SANITIZER_NETBSD
  533. INTERCEPTOR(char *, fcvt, double x, int a, int *b, int *c) {
  534. ENSURE_MSAN_INITED();
  535. char *res = REAL(fcvt)(x, a, b, c);
  536. __msan_unpoison(b, sizeof(*b));
  537. __msan_unpoison(c, sizeof(*c));
  538. if (res)
  539. __msan_unpoison(res, internal_strlen(res) + 1);
  540. return res;
  541. }
  542. #define MSAN_MAYBE_INTERCEPT_FCVT INTERCEPT_FUNCTION(fcvt)
  543. #else
  544. #define MSAN_MAYBE_INTERCEPT_FCVT
  545. #endif
  546. INTERCEPTOR(char *, getenv, char *name) {
  547. if (msan_init_is_running)
  548. return REAL(getenv)(name);
  549. ENSURE_MSAN_INITED();
  550. char *res = REAL(getenv)(name);
  551. if (res)
  552. __msan_unpoison(res, internal_strlen(res) + 1);
  553. return res;
  554. }
  555. extern char **environ;
  556. static void UnpoisonEnviron() {
  557. char **envp = environ;
  558. for (; *envp; ++envp) {
  559. __msan_unpoison(envp, sizeof(*envp));
  560. __msan_unpoison(*envp, internal_strlen(*envp) + 1);
  561. }
  562. // Trailing NULL pointer.
  563. __msan_unpoison(envp, sizeof(*envp));
  564. }
  565. INTERCEPTOR(int, setenv, const char *name, const char *value, int overwrite) {
  566. ENSURE_MSAN_INITED();
  567. CHECK_UNPOISONED_STRING(name, 0);
  568. int res = REAL(setenv)(name, value, overwrite);
  569. if (!res) UnpoisonEnviron();
  570. return res;
  571. }
  572. INTERCEPTOR(int, putenv, char *string) {
  573. ENSURE_MSAN_INITED();
  574. int res = REAL(putenv)(string);
  575. if (!res) UnpoisonEnviron();
  576. return res;
  577. }
  578. #define SANITIZER_STAT_LINUX (SANITIZER_LINUX && __GLIBC_PREREQ(2, 33))
  579. #if SANITIZER_FREEBSD || SANITIZER_NETBSD || SANITIZER_STAT_LINUX
  580. INTERCEPTOR(int, fstat, int fd, void *buf) {
  581. ENSURE_MSAN_INITED();
  582. int res = REAL(fstat)(fd, buf);
  583. if (!res)
  584. __msan_unpoison(buf, __sanitizer::struct_stat_sz);
  585. return res;
  586. }
  587. # define MSAN_MAYBE_INTERCEPT_FSTAT MSAN_INTERCEPT_FUNC(fstat)
  588. #else
  589. #define MSAN_MAYBE_INTERCEPT_FSTAT
  590. #endif
  591. #if SANITIZER_GLIBC
  592. INTERCEPTOR(int, __fxstat, int magic, int fd, void *buf) {
  593. ENSURE_MSAN_INITED();
  594. int res = REAL(__fxstat)(magic, fd, buf);
  595. if (!res)
  596. __msan_unpoison(buf, __sanitizer::struct_stat_sz);
  597. return res;
  598. }
  599. # define MSAN_MAYBE_INTERCEPT___FXSTAT MSAN_INTERCEPT_FUNC(__fxstat)
  600. #else
  601. #define MSAN_MAYBE_INTERCEPT___FXSTAT
  602. #endif
  603. #if SANITIZER_GLIBC
  604. INTERCEPTOR(int, __fxstat64, int magic, int fd, void *buf) {
  605. ENSURE_MSAN_INITED();
  606. int res = REAL(__fxstat64)(magic, fd, buf);
  607. if (!res)
  608. __msan_unpoison(buf, __sanitizer::struct_stat64_sz);
  609. return res;
  610. }
  611. # define MSAN_MAYBE_INTERCEPT___FXSTAT64 MSAN_INTERCEPT_FUNC(__fxstat64)
  612. #else
  613. # define MSAN_MAYBE_INTERCEPT___FXSTAT64
  614. #endif
  615. #if SANITIZER_FREEBSD || SANITIZER_NETBSD || SANITIZER_STAT_LINUX
  616. INTERCEPTOR(int, fstatat, int fd, char *pathname, void *buf, int flags) {
  617. ENSURE_MSAN_INITED();
  618. int res = REAL(fstatat)(fd, pathname, buf, flags);
  619. if (!res) __msan_unpoison(buf, __sanitizer::struct_stat_sz);
  620. return res;
  621. }
  622. # define MSAN_MAYBE_INTERCEPT_FSTATAT MSAN_INTERCEPT_FUNC(fstatat)
  623. #else
  624. # define MSAN_MAYBE_INTERCEPT_FSTATAT
  625. #endif
  626. #if SANITIZER_GLIBC
  627. INTERCEPTOR(int, __fxstatat, int magic, int fd, char *pathname, void *buf,
  628. int flags) {
  629. ENSURE_MSAN_INITED();
  630. int res = REAL(__fxstatat)(magic, fd, pathname, buf, flags);
  631. if (!res) __msan_unpoison(buf, __sanitizer::struct_stat_sz);
  632. return res;
  633. }
  634. # define MSAN_MAYBE_INTERCEPT___FXSTATAT MSAN_INTERCEPT_FUNC(__fxstatat)
  635. #else
  636. # define MSAN_MAYBE_INTERCEPT___FXSTATAT
  637. #endif
  638. #if SANITIZER_GLIBC
  639. INTERCEPTOR(int, __fxstatat64, int magic, int fd, char *pathname, void *buf,
  640. int flags) {
  641. ENSURE_MSAN_INITED();
  642. int res = REAL(__fxstatat64)(magic, fd, pathname, buf, flags);
  643. if (!res) __msan_unpoison(buf, __sanitizer::struct_stat64_sz);
  644. return res;
  645. }
  646. # define MSAN_MAYBE_INTERCEPT___FXSTATAT64 MSAN_INTERCEPT_FUNC(__fxstatat64)
  647. #else
  648. # define MSAN_MAYBE_INTERCEPT___FXSTATAT64
  649. #endif
  650. INTERCEPTOR(int, pipe, int pipefd[2]) {
  651. if (msan_init_is_running)
  652. return REAL(pipe)(pipefd);
  653. ENSURE_MSAN_INITED();
  654. int res = REAL(pipe)(pipefd);
  655. if (!res)
  656. __msan_unpoison(pipefd, sizeof(int[2]));
  657. return res;
  658. }
  659. INTERCEPTOR(int, pipe2, int pipefd[2], int flags) {
  660. ENSURE_MSAN_INITED();
  661. int res = REAL(pipe2)(pipefd, flags);
  662. if (!res)
  663. __msan_unpoison(pipefd, sizeof(int[2]));
  664. return res;
  665. }
  666. INTERCEPTOR(int, socketpair, int domain, int type, int protocol, int sv[2]) {
  667. ENSURE_MSAN_INITED();
  668. int res = REAL(socketpair)(domain, type, protocol, sv);
  669. if (!res)
  670. __msan_unpoison(sv, sizeof(int[2]));
  671. return res;
  672. }
  673. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  674. INTERCEPTOR(char *, fgets_unlocked, char *s, int size, void *stream) {
  675. ENSURE_MSAN_INITED();
  676. char *res = REAL(fgets_unlocked)(s, size, stream);
  677. if (res)
  678. __msan_unpoison(s, internal_strlen(s) + 1);
  679. return res;
  680. }
  681. #define MSAN_MAYBE_INTERCEPT_FGETS_UNLOCKED INTERCEPT_FUNCTION(fgets_unlocked)
  682. #else
  683. #define MSAN_MAYBE_INTERCEPT_FGETS_UNLOCKED
  684. #endif
  685. #define INTERCEPTOR_GETRLIMIT_BODY(func, resource, rlim) \
  686. if (msan_init_is_running) \
  687. return REAL(getrlimit)(resource, rlim); \
  688. ENSURE_MSAN_INITED(); \
  689. int res = REAL(func)(resource, rlim); \
  690. if (!res) \
  691. __msan_unpoison(rlim, __sanitizer::struct_rlimit_sz); \
  692. return res
  693. INTERCEPTOR(int, getrlimit, int resource, void *rlim) {
  694. INTERCEPTOR_GETRLIMIT_BODY(getrlimit, resource, rlim);
  695. }
  696. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  697. INTERCEPTOR(int, __getrlimit, int resource, void *rlim) {
  698. INTERCEPTOR_GETRLIMIT_BODY(__getrlimit, resource, rlim);
  699. }
  700. INTERCEPTOR(int, getrlimit64, int resource, void *rlim) {
  701. if (msan_init_is_running) return REAL(getrlimit64)(resource, rlim);
  702. ENSURE_MSAN_INITED();
  703. int res = REAL(getrlimit64)(resource, rlim);
  704. if (!res) __msan_unpoison(rlim, __sanitizer::struct_rlimit64_sz);
  705. return res;
  706. }
  707. INTERCEPTOR(int, prlimit, int pid, int resource, void *new_rlimit,
  708. void *old_rlimit) {
  709. if (msan_init_is_running)
  710. return REAL(prlimit)(pid, resource, new_rlimit, old_rlimit);
  711. ENSURE_MSAN_INITED();
  712. CHECK_UNPOISONED(new_rlimit, __sanitizer::struct_rlimit_sz);
  713. int res = REAL(prlimit)(pid, resource, new_rlimit, old_rlimit);
  714. if (!res) __msan_unpoison(old_rlimit, __sanitizer::struct_rlimit_sz);
  715. return res;
  716. }
  717. INTERCEPTOR(int, prlimit64, int pid, int resource, void *new_rlimit,
  718. void *old_rlimit) {
  719. if (msan_init_is_running)
  720. return REAL(prlimit64)(pid, resource, new_rlimit, old_rlimit);
  721. ENSURE_MSAN_INITED();
  722. CHECK_UNPOISONED(new_rlimit, __sanitizer::struct_rlimit64_sz);
  723. int res = REAL(prlimit64)(pid, resource, new_rlimit, old_rlimit);
  724. if (!res) __msan_unpoison(old_rlimit, __sanitizer::struct_rlimit64_sz);
  725. return res;
  726. }
  727. #define MSAN_MAYBE_INTERCEPT___GETRLIMIT INTERCEPT_FUNCTION(__getrlimit)
  728. #define MSAN_MAYBE_INTERCEPT_GETRLIMIT64 INTERCEPT_FUNCTION(getrlimit64)
  729. #define MSAN_MAYBE_INTERCEPT_PRLIMIT INTERCEPT_FUNCTION(prlimit)
  730. #define MSAN_MAYBE_INTERCEPT_PRLIMIT64 INTERCEPT_FUNCTION(prlimit64)
  731. #else
  732. #define MSAN_MAYBE_INTERCEPT___GETRLIMIT
  733. #define MSAN_MAYBE_INTERCEPT_GETRLIMIT64
  734. #define MSAN_MAYBE_INTERCEPT_PRLIMIT
  735. #define MSAN_MAYBE_INTERCEPT_PRLIMIT64
  736. #endif
  737. INTERCEPTOR(int, gethostname, char *name, SIZE_T len) {
  738. ENSURE_MSAN_INITED();
  739. int res = REAL(gethostname)(name, len);
  740. if (!res || (res == -1 && errno == errno_ENAMETOOLONG)) {
  741. SIZE_T real_len = internal_strnlen(name, len);
  742. if (real_len < len)
  743. ++real_len;
  744. __msan_unpoison(name, real_len);
  745. }
  746. return res;
  747. }
  748. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  749. INTERCEPTOR(int, epoll_wait, int epfd, void *events, int maxevents,
  750. int timeout) {
  751. ENSURE_MSAN_INITED();
  752. int res = REAL(epoll_wait)(epfd, events, maxevents, timeout);
  753. if (res > 0) {
  754. __msan_unpoison(events, __sanitizer::struct_epoll_event_sz * res);
  755. }
  756. return res;
  757. }
  758. #define MSAN_MAYBE_INTERCEPT_EPOLL_WAIT INTERCEPT_FUNCTION(epoll_wait)
  759. #else
  760. #define MSAN_MAYBE_INTERCEPT_EPOLL_WAIT
  761. #endif
  762. #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD
  763. INTERCEPTOR(int, epoll_pwait, int epfd, void *events, int maxevents,
  764. int timeout, void *sigmask) {
  765. ENSURE_MSAN_INITED();
  766. int res = REAL(epoll_pwait)(epfd, events, maxevents, timeout, sigmask);
  767. if (res > 0) {
  768. __msan_unpoison(events, __sanitizer::struct_epoll_event_sz * res);
  769. }
  770. return res;
  771. }
  772. #define MSAN_MAYBE_INTERCEPT_EPOLL_PWAIT INTERCEPT_FUNCTION(epoll_pwait)
  773. #else
  774. #define MSAN_MAYBE_INTERCEPT_EPOLL_PWAIT
  775. #endif
  776. INTERCEPTOR(void *, calloc, SIZE_T nmemb, SIZE_T size) {
  777. GET_MALLOC_STACK_TRACE;
  778. if (DlsymAlloc::Use())
  779. return DlsymAlloc::Callocate(nmemb, size);
  780. return msan_calloc(nmemb, size, &stack);
  781. }
  782. INTERCEPTOR(void *, realloc, void *ptr, SIZE_T size) {
  783. if (DlsymAlloc::Use() || DlsymAlloc::PointerIsMine(ptr))
  784. return DlsymAlloc::Realloc(ptr, size);
  785. GET_MALLOC_STACK_TRACE;
  786. return msan_realloc(ptr, size, &stack);
  787. }
  788. INTERCEPTOR(void *, reallocarray, void *ptr, SIZE_T nmemb, SIZE_T size) {
  789. GET_MALLOC_STACK_TRACE;
  790. return msan_reallocarray(ptr, nmemb, size, &stack);
  791. }
  792. INTERCEPTOR(void *, malloc, SIZE_T size) {
  793. if (DlsymAlloc::Use())
  794. return DlsymAlloc::Allocate(size);
  795. GET_MALLOC_STACK_TRACE;
  796. return msan_malloc(size, &stack);
  797. }
  798. void __msan_allocated_memory(const void *data, uptr size) {
  799. if (flags()->poison_in_malloc) {
  800. GET_MALLOC_STACK_TRACE;
  801. stack.tag = STACK_TRACE_TAG_POISON;
  802. PoisonMemory(data, size, &stack);
  803. }
  804. }
  805. void __msan_copy_shadow(void *dest, const void *src, uptr n) {
  806. GET_STORE_STACK_TRACE;
  807. MoveShadowAndOrigin(dest, src, n, &stack);
  808. }
  809. void __sanitizer_dtor_callback(const void *data, uptr size) {
  810. if (flags()->poison_in_dtor) {
  811. GET_MALLOC_STACK_TRACE;
  812. stack.tag = STACK_TRACE_TAG_POISON;
  813. PoisonMemory(data, size, &stack);
  814. }
  815. }
  816. extern "C" void __sanitizer_dtor_callback_fields(const void *data, uptr size) {
  817. if (flags()->poison_in_dtor) {
  818. GET_MALLOC_STACK_TRACE;
  819. stack.tag = STACK_TRACE_TAG_POISON;
  820. PoisonMemory(data, size, &stack);
  821. }
  822. }
  823. extern "C" void __sanitizer_dtor_callback_vptr(const void *data) {
  824. if (flags()->poison_in_dtor) {
  825. GET_MALLOC_STACK_TRACE;
  826. stack.tag = STACK_TRACE_TAG_POISON;
  827. PoisonMemory(data, sizeof(void *), &stack);
  828. }
  829. }
  830. template <class Mmap>
  831. static void *mmap_interceptor(Mmap real_mmap, void *addr, SIZE_T length,
  832. int prot, int flags, int fd, OFF64_T offset) {
  833. SIZE_T rounded_length = RoundUpTo(length, GetPageSize());
  834. void *end_addr = (char *)addr + (rounded_length - 1);
  835. if (addr && (!MEM_IS_APP(addr) || !MEM_IS_APP(end_addr))) {
  836. if (flags & map_fixed) {
  837. errno = errno_EINVAL;
  838. return (void *)-1;
  839. } else {
  840. addr = nullptr;
  841. }
  842. }
  843. void *res = real_mmap(addr, length, prot, flags, fd, offset);
  844. if (res != (void *)-1) {
  845. void *end_res = (char *)res + (rounded_length - 1);
  846. if (MEM_IS_APP(res) && MEM_IS_APP(end_res)) {
  847. __msan_unpoison(res, rounded_length);
  848. } else {
  849. // Application has attempted to map more memory than is supported by
  850. // MSAN. Act as if we ran out of memory.
  851. internal_munmap(res, length);
  852. errno = errno_ENOMEM;
  853. return (void *)-1;
  854. }
  855. }
  856. return res;
  857. }
  858. INTERCEPTOR(int, getrusage, int who, void *usage) {
  859. ENSURE_MSAN_INITED();
  860. int res = REAL(getrusage)(who, usage);
  861. if (res == 0) {
  862. __msan_unpoison(usage, __sanitizer::struct_rusage_sz);
  863. }
  864. return res;
  865. }
  866. class SignalHandlerScope {
  867. public:
  868. SignalHandlerScope() {
  869. if (MsanThread *t = GetCurrentThread())
  870. t->EnterSignalHandler();
  871. }
  872. ~SignalHandlerScope() {
  873. if (MsanThread *t = GetCurrentThread())
  874. t->LeaveSignalHandler();
  875. }
  876. };
  877. // sigactions_mu guarantees atomicity of sigaction() and signal() calls.
  878. // Access to sigactions[] is gone with relaxed atomics to avoid data race with
  879. // the signal handler.
  880. const int kMaxSignals = 1024;
  881. static atomic_uintptr_t sigactions[kMaxSignals];
  882. static StaticSpinMutex sigactions_mu;
  883. static void SignalHandler(int signo) {
  884. SignalHandlerScope signal_handler_scope;
  885. ScopedThreadLocalStateBackup stlsb;
  886. UnpoisonParam(1);
  887. typedef void (*signal_cb)(int x);
  888. signal_cb cb =
  889. (signal_cb)atomic_load(&sigactions[signo], memory_order_relaxed);
  890. cb(signo);
  891. }
  892. static void SignalAction(int signo, void *si, void *uc) {
  893. SignalHandlerScope signal_handler_scope;
  894. ScopedThreadLocalStateBackup stlsb;
  895. UnpoisonParam(3);
  896. __msan_unpoison(si, sizeof(__sanitizer_sigaction));
  897. __msan_unpoison(uc, ucontext_t_sz(uc));
  898. typedef void (*sigaction_cb)(int, void *, void *);
  899. sigaction_cb cb =
  900. (sigaction_cb)atomic_load(&sigactions[signo], memory_order_relaxed);
  901. cb(signo, si, uc);
  902. CHECK_UNPOISONED(uc, ucontext_t_sz(uc));
  903. }
  904. static void read_sigaction(const __sanitizer_sigaction *act) {
  905. CHECK_UNPOISONED(&act->sa_flags, sizeof(act->sa_flags));
  906. if (act->sa_flags & __sanitizer::sa_siginfo)
  907. CHECK_UNPOISONED(&act->sigaction, sizeof(act->sigaction));
  908. else
  909. CHECK_UNPOISONED(&act->handler, sizeof(act->handler));
  910. CHECK_UNPOISONED(&act->sa_mask, sizeof(act->sa_mask));
  911. }
  912. extern "C" int pthread_attr_init(void *attr);
  913. extern "C" int pthread_attr_destroy(void *attr);
  914. static void *MsanThreadStartFunc(void *arg) {
  915. MsanThread *t = (MsanThread *)arg;
  916. SetCurrentThread(t);
  917. t->Init();
  918. SetSigProcMask(&t->starting_sigset_, nullptr);
  919. return t->ThreadStart();
  920. }
  921. INTERCEPTOR(int, pthread_create, void *th, void *attr, void *(*callback)(void*),
  922. void * param) {
  923. ENSURE_MSAN_INITED(); // for GetTlsSize()
  924. __sanitizer_pthread_attr_t myattr;
  925. if (!attr) {
  926. pthread_attr_init(&myattr);
  927. attr = &myattr;
  928. }
  929. AdjustStackSize(attr);
  930. MsanThread *t = MsanThread::Create(callback, param);
  931. ScopedBlockSignals block(&t->starting_sigset_);
  932. int res = REAL(pthread_create)(th, attr, MsanThreadStartFunc, t);
  933. if (attr == &myattr)
  934. pthread_attr_destroy(&myattr);
  935. if (!res) {
  936. __msan_unpoison(th, __sanitizer::pthread_t_sz);
  937. }
  938. return res;
  939. }
  940. INTERCEPTOR(int, pthread_key_create, __sanitizer_pthread_key_t *key,
  941. void (*dtor)(void *value)) {
  942. if (msan_init_is_running) return REAL(pthread_key_create)(key, dtor);
  943. ENSURE_MSAN_INITED();
  944. int res = REAL(pthread_key_create)(key, dtor);
  945. if (!res && key)
  946. __msan_unpoison(key, sizeof(*key));
  947. return res;
  948. }
  949. #if SANITIZER_NETBSD
  950. INTERCEPTOR(int, __libc_thr_keycreate, __sanitizer_pthread_key_t *m,
  951. void (*dtor)(void *value))
  952. ALIAS(WRAPPER_NAME(pthread_key_create));
  953. #endif
  954. INTERCEPTOR(int, pthread_join, void *th, void **retval) {
  955. ENSURE_MSAN_INITED();
  956. int res = REAL(pthread_join)(th, retval);
  957. if (!res && retval)
  958. __msan_unpoison(retval, sizeof(*retval));
  959. return res;
  960. }
  961. DEFINE_REAL_PTHREAD_FUNCTIONS
  962. extern char *tzname[2];
  963. INTERCEPTOR(void, tzset, int fake) {
  964. ENSURE_MSAN_INITED();
  965. InterceptorScope interceptor_scope;
  966. REAL(tzset)(fake);
  967. if (tzname[0])
  968. __msan_unpoison(tzname[0], internal_strlen(tzname[0]) + 1);
  969. if (tzname[1])
  970. __msan_unpoison(tzname[1], internal_strlen(tzname[1]) + 1);
  971. return;
  972. }
  973. struct MSanAtExitRecord {
  974. void (*func)(void *arg);
  975. void *arg;
  976. };
  977. struct InterceptorContext {
  978. Mutex atexit_mu;
  979. Vector<struct MSanAtExitRecord *> AtExitStack;
  980. InterceptorContext()
  981. : AtExitStack() {
  982. }
  983. };
  984. static ALIGNED(64) char interceptor_placeholder[sizeof(InterceptorContext)];
  985. InterceptorContext *interceptor_ctx() {
  986. return reinterpret_cast<InterceptorContext*>(&interceptor_placeholder[0]);
  987. }
  988. void MSanAtExitWrapper() {
  989. MSanAtExitRecord *r;
  990. {
  991. Lock l(&interceptor_ctx()->atexit_mu);
  992. uptr element = interceptor_ctx()->AtExitStack.Size() - 1;
  993. r = interceptor_ctx()->AtExitStack[element];
  994. interceptor_ctx()->AtExitStack.PopBack();
  995. }
  996. UnpoisonParam(1);
  997. ((void(*)())r->func)();
  998. InternalFree(r);
  999. }
  1000. void MSanCxaAtExitWrapper(void *arg) {
  1001. UnpoisonParam(1);
  1002. MSanAtExitRecord *r = (MSanAtExitRecord *)arg;
  1003. // libc before 2.27 had race which caused occasional double handler execution
  1004. // https://sourceware.org/ml/libc-alpha/2017-08/msg01204.html
  1005. if (!r->func)
  1006. return;
  1007. r->func(r->arg);
  1008. r->func = nullptr;
  1009. }
  1010. static int setup_at_exit_wrapper(void(*f)(), void *arg, void *dso);
  1011. // Unpoison argument shadow for C++ module destructors.
  1012. INTERCEPTOR(int, __cxa_atexit, void (*func)(void *), void *arg,
  1013. void *dso_handle) {
  1014. if (msan_init_is_running) return REAL(__cxa_atexit)(func, arg, dso_handle);
  1015. return setup_at_exit_wrapper((void(*)())func, arg, dso_handle);
  1016. }
  1017. // Unpoison argument shadow for C++ module destructors.
  1018. INTERCEPTOR(int, atexit, void (*func)()) {
  1019. // Avoid calling real atexit as it is unreachable on at least on Linux.
  1020. if (msan_init_is_running)
  1021. return REAL(__cxa_atexit)((void (*)(void *a))func, 0, 0);
  1022. return setup_at_exit_wrapper((void(*)())func, 0, 0);
  1023. }
  1024. static int setup_at_exit_wrapper(void(*f)(), void *arg, void *dso) {
  1025. ENSURE_MSAN_INITED();
  1026. MSanAtExitRecord *r =
  1027. (MSanAtExitRecord *)InternalAlloc(sizeof(MSanAtExitRecord));
  1028. r->func = (void(*)(void *a))f;
  1029. r->arg = arg;
  1030. int res;
  1031. if (!dso) {
  1032. // NetBSD does not preserve the 2nd argument if dso is equal to 0
  1033. // Store ctx in a local stack-like structure
  1034. Lock l(&interceptor_ctx()->atexit_mu);
  1035. res = REAL(__cxa_atexit)((void (*)(void *a))MSanAtExitWrapper, 0, 0);
  1036. if (!res) {
  1037. interceptor_ctx()->AtExitStack.PushBack(r);
  1038. }
  1039. } else {
  1040. res = REAL(__cxa_atexit)(MSanCxaAtExitWrapper, r, dso);
  1041. }
  1042. return res;
  1043. }
  1044. static void BeforeFork() {
  1045. StackDepotLockAll();
  1046. ChainedOriginDepotLockAll();
  1047. }
  1048. static void AfterFork() {
  1049. ChainedOriginDepotUnlockAll();
  1050. StackDepotUnlockAll();
  1051. }
  1052. INTERCEPTOR(int, fork, void) {
  1053. ENSURE_MSAN_INITED();
  1054. BeforeFork();
  1055. int pid = REAL(fork)();
  1056. AfterFork();
  1057. return pid;
  1058. }
  1059. // NetBSD ships with openpty(3) in -lutil, that needs to be prebuilt explicitly
  1060. // with MSan.
  1061. #if SANITIZER_LINUX
  1062. INTERCEPTOR(int, openpty, int *aparent, int *aworker, char *name,
  1063. const void *termp, const void *winp) {
  1064. ENSURE_MSAN_INITED();
  1065. InterceptorScope interceptor_scope;
  1066. int res = REAL(openpty)(aparent, aworker, name, termp, winp);
  1067. if (!res) {
  1068. __msan_unpoison(aparent, sizeof(*aparent));
  1069. __msan_unpoison(aworker, sizeof(*aworker));
  1070. }
  1071. return res;
  1072. }
  1073. #define MSAN_MAYBE_INTERCEPT_OPENPTY INTERCEPT_FUNCTION(openpty)
  1074. #else
  1075. #define MSAN_MAYBE_INTERCEPT_OPENPTY
  1076. #endif
  1077. // NetBSD ships with forkpty(3) in -lutil, that needs to be prebuilt explicitly
  1078. // with MSan.
  1079. #if SANITIZER_LINUX
  1080. INTERCEPTOR(int, forkpty, int *aparent, char *name, const void *termp,
  1081. const void *winp) {
  1082. ENSURE_MSAN_INITED();
  1083. InterceptorScope interceptor_scope;
  1084. int res = REAL(forkpty)(aparent, name, termp, winp);
  1085. if (res != -1)
  1086. __msan_unpoison(aparent, sizeof(*aparent));
  1087. return res;
  1088. }
  1089. #define MSAN_MAYBE_INTERCEPT_FORKPTY INTERCEPT_FUNCTION(forkpty)
  1090. #else
  1091. #define MSAN_MAYBE_INTERCEPT_FORKPTY
  1092. #endif
  1093. struct MSanInterceptorContext {
  1094. bool in_interceptor_scope;
  1095. };
  1096. namespace __msan {
  1097. int OnExit() {
  1098. // FIXME: ask frontend whether we need to return failure.
  1099. return 0;
  1100. }
  1101. } // namespace __msan
  1102. // A version of CHECK_UNPOISONED using a saved scope value. Used in common
  1103. // interceptors.
  1104. #define CHECK_UNPOISONED_CTX(ctx, x, n) \
  1105. do { \
  1106. if (!((MSanInterceptorContext *)ctx)->in_interceptor_scope) \
  1107. CHECK_UNPOISONED_0(x, n); \
  1108. } while (0)
  1109. #define MSAN_INTERCEPT_FUNC(name) \
  1110. do { \
  1111. if (!INTERCEPT_FUNCTION(name)) \
  1112. VReport(1, "MemorySanitizer: failed to intercept '%s'\n", #name); \
  1113. } while (0)
  1114. #define MSAN_INTERCEPT_FUNC_VER(name, ver) \
  1115. do { \
  1116. if (!INTERCEPT_FUNCTION_VER(name, ver)) \
  1117. VReport(1, "MemorySanitizer: failed to intercept '%s@@%s'\n", #name, \
  1118. ver); \
  1119. } while (0)
  1120. #define MSAN_INTERCEPT_FUNC_VER_UNVERSIONED_FALLBACK(name, ver) \
  1121. do { \
  1122. if (!INTERCEPT_FUNCTION_VER(name, ver) && !INTERCEPT_FUNCTION(name)) \
  1123. VReport(1, "MemorySanitizer: failed to intercept '%s@@%s' or '%s'\n", \
  1124. #name, ver, #name); \
  1125. } while (0)
  1126. #define COMMON_INTERCEPT_FUNCTION(name) MSAN_INTERCEPT_FUNC(name)
  1127. #define COMMON_INTERCEPT_FUNCTION_VER(name, ver) \
  1128. MSAN_INTERCEPT_FUNC_VER(name, ver)
  1129. #define COMMON_INTERCEPT_FUNCTION_VER_UNVERSIONED_FALLBACK(name, ver) \
  1130. MSAN_INTERCEPT_FUNC_VER_UNVERSIONED_FALLBACK(name, ver)
  1131. #define COMMON_INTERCEPTOR_UNPOISON_PARAM(count) \
  1132. UnpoisonParam(count)
  1133. #define COMMON_INTERCEPTOR_WRITE_RANGE(ctx, ptr, size) \
  1134. __msan_unpoison(ptr, size)
  1135. #define COMMON_INTERCEPTOR_READ_RANGE(ctx, ptr, size) \
  1136. CHECK_UNPOISONED_CTX(ctx, ptr, size)
  1137. #define COMMON_INTERCEPTOR_INITIALIZE_RANGE(ptr, size) \
  1138. __msan_unpoison(ptr, size)
  1139. #define COMMON_INTERCEPTOR_ENTER(ctx, func, ...) \
  1140. if (msan_init_is_running) \
  1141. return REAL(func)(__VA_ARGS__); \
  1142. ENSURE_MSAN_INITED(); \
  1143. MSanInterceptorContext msan_ctx = {IsInInterceptorScope()}; \
  1144. ctx = (void *)&msan_ctx; \
  1145. (void)ctx; \
  1146. InterceptorScope interceptor_scope; \
  1147. __msan_unpoison(__errno_location(), sizeof(int));
  1148. #define COMMON_INTERCEPTOR_DIR_ACQUIRE(ctx, path) \
  1149. do { \
  1150. } while (false)
  1151. #define COMMON_INTERCEPTOR_FD_ACQUIRE(ctx, fd) \
  1152. do { \
  1153. } while (false)
  1154. #define COMMON_INTERCEPTOR_FD_RELEASE(ctx, fd) \
  1155. do { \
  1156. } while (false)
  1157. #define COMMON_INTERCEPTOR_FD_SOCKET_ACCEPT(ctx, fd, newfd) \
  1158. do { \
  1159. } while (false)
  1160. #define COMMON_INTERCEPTOR_SET_THREAD_NAME(ctx, name) \
  1161. do { \
  1162. } while (false) // FIXME
  1163. #define COMMON_INTERCEPTOR_SET_PTHREAD_NAME(ctx, thread, name) \
  1164. do { \
  1165. } while (false) // FIXME
  1166. #define COMMON_INTERCEPTOR_BLOCK_REAL(name) REAL(name)
  1167. #define COMMON_INTERCEPTOR_ON_EXIT(ctx) OnExit()
  1168. #define COMMON_INTERCEPTOR_LIBRARY_LOADED(filename, handle) \
  1169. do { \
  1170. link_map *map = GET_LINK_MAP_BY_DLOPEN_HANDLE((handle)); \
  1171. if (filename && map) \
  1172. ForEachMappedRegion(map, __msan_unpoison); \
  1173. } while (false)
  1174. #define COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED (!msan_inited)
  1175. #define COMMON_INTERCEPTOR_GET_TLS_RANGE(begin, end) \
  1176. if (MsanThread *t = GetCurrentThread()) { \
  1177. *begin = t->tls_begin(); \
  1178. *end = t->tls_end(); \
  1179. } else { \
  1180. *begin = *end = 0; \
  1181. }
  1182. #define COMMON_INTERCEPTOR_MEMSET_IMPL(ctx, block, c, size) \
  1183. { \
  1184. (void)ctx; \
  1185. return __msan_memset(block, c, size); \
  1186. }
  1187. #define COMMON_INTERCEPTOR_MEMMOVE_IMPL(ctx, to, from, size) \
  1188. { \
  1189. (void)ctx; \
  1190. return __msan_memmove(to, from, size); \
  1191. }
  1192. #define COMMON_INTERCEPTOR_MEMCPY_IMPL(ctx, to, from, size) \
  1193. { \
  1194. (void)ctx; \
  1195. return __msan_memcpy(to, from, size); \
  1196. }
  1197. #define COMMON_INTERCEPTOR_COPY_STRING(ctx, to, from, size) \
  1198. do { \
  1199. GET_STORE_STACK_TRACE; \
  1200. CopyShadowAndOrigin(to, from, size, &stack); \
  1201. __msan_unpoison(to + size, 1); \
  1202. } while (false)
  1203. #define COMMON_INTERCEPTOR_MMAP_IMPL(ctx, mmap, addr, length, prot, flags, fd, \
  1204. offset) \
  1205. do { \
  1206. return mmap_interceptor(REAL(mmap), addr, sz, prot, flags, fd, off); \
  1207. } while (false)
  1208. #include "sanitizer_common/sanitizer_platform_interceptors.h"
  1209. #include "sanitizer_common/sanitizer_common_interceptors.inc"
  1210. static uptr signal_impl(int signo, uptr cb);
  1211. static int sigaction_impl(int signo, const __sanitizer_sigaction *act,
  1212. __sanitizer_sigaction *oldact);
  1213. #define SIGNAL_INTERCEPTOR_SIGACTION_IMPL(signo, act, oldact) \
  1214. { return sigaction_impl(signo, act, oldact); }
  1215. #define SIGNAL_INTERCEPTOR_SIGNAL_IMPL(func, signo, handler) \
  1216. { \
  1217. handler = signal_impl(signo, handler); \
  1218. InterceptorScope interceptor_scope; \
  1219. return REAL(func)(signo, handler); \
  1220. }
  1221. #include "sanitizer_common/sanitizer_signal_interceptors.inc"
  1222. static int sigaction_impl(int signo, const __sanitizer_sigaction *act,
  1223. __sanitizer_sigaction *oldact) {
  1224. ENSURE_MSAN_INITED();
  1225. if (signo <= 0 || signo >= kMaxSignals) {
  1226. errno = errno_EINVAL;
  1227. return -1;
  1228. }
  1229. if (act) read_sigaction(act);
  1230. int res;
  1231. if (flags()->wrap_signals) {
  1232. SpinMutexLock lock(&sigactions_mu);
  1233. uptr old_cb = atomic_load(&sigactions[signo], memory_order_relaxed);
  1234. __sanitizer_sigaction new_act;
  1235. __sanitizer_sigaction *pnew_act = act ? &new_act : nullptr;
  1236. if (act) {
  1237. REAL(memcpy)(pnew_act, act, sizeof(__sanitizer_sigaction));
  1238. uptr cb = (uptr)pnew_act->sigaction;
  1239. uptr new_cb = (pnew_act->sa_flags & __sanitizer::sa_siginfo)
  1240. ? (uptr)SignalAction
  1241. : (uptr)SignalHandler;
  1242. if (cb != __sanitizer::sig_ign && cb != __sanitizer::sig_dfl) {
  1243. atomic_store(&sigactions[signo], cb, memory_order_relaxed);
  1244. pnew_act->sigaction = (decltype(pnew_act->sigaction))new_cb;
  1245. }
  1246. }
  1247. res = REAL(SIGACTION_SYMNAME)(signo, pnew_act, oldact);
  1248. if (res == 0 && oldact) {
  1249. uptr cb = (uptr)oldact->sigaction;
  1250. if (cb == (uptr)SignalAction || cb == (uptr)SignalHandler) {
  1251. oldact->sigaction = (decltype(oldact->sigaction))old_cb;
  1252. }
  1253. }
  1254. } else {
  1255. res = REAL(SIGACTION_SYMNAME)(signo, act, oldact);
  1256. }
  1257. if (res == 0 && oldact) {
  1258. __msan_unpoison(oldact, sizeof(__sanitizer_sigaction));
  1259. }
  1260. return res;
  1261. }
  1262. static uptr signal_impl(int signo, uptr cb) {
  1263. ENSURE_MSAN_INITED();
  1264. if (signo <= 0 || signo >= kMaxSignals) {
  1265. errno = errno_EINVAL;
  1266. return -1;
  1267. }
  1268. if (flags()->wrap_signals) {
  1269. SpinMutexLock lock(&sigactions_mu);
  1270. if (cb != __sanitizer::sig_ign && cb != __sanitizer::sig_dfl) {
  1271. atomic_store(&sigactions[signo], cb, memory_order_relaxed);
  1272. cb = (uptr)&SignalHandler;
  1273. }
  1274. }
  1275. return cb;
  1276. }
  1277. #define COMMON_SYSCALL_PRE_READ_RANGE(p, s) CHECK_UNPOISONED(p, s)
  1278. #define COMMON_SYSCALL_PRE_WRITE_RANGE(p, s) \
  1279. do { \
  1280. } while (false)
  1281. #define COMMON_SYSCALL_POST_READ_RANGE(p, s) \
  1282. do { \
  1283. } while (false)
  1284. #define COMMON_SYSCALL_POST_WRITE_RANGE(p, s) __msan_unpoison(p, s)
  1285. #include "sanitizer_common/sanitizer_common_syscalls.inc"
  1286. #include "sanitizer_common/sanitizer_syscalls_netbsd.inc"
  1287. struct dlinfo {
  1288. char *dli_fname;
  1289. void *dli_fbase;
  1290. char *dli_sname;
  1291. void *dli_saddr;
  1292. };
  1293. INTERCEPTOR(int, dladdr, void *addr, dlinfo *info) {
  1294. void *ctx;
  1295. COMMON_INTERCEPTOR_ENTER(ctx, dladdr, addr, info);
  1296. int res = REAL(dladdr)(addr, info);
  1297. if (res != 0) {
  1298. __msan_unpoison(info, sizeof(*info));
  1299. if (info->dli_fname)
  1300. __msan_unpoison(info->dli_fname, internal_strlen(info->dli_fname) + 1);
  1301. if (info->dli_sname)
  1302. __msan_unpoison(info->dli_sname, internal_strlen(info->dli_sname) + 1);
  1303. }
  1304. return res;
  1305. }
  1306. INTERCEPTOR(char *, dlerror, int fake) {
  1307. void *ctx;
  1308. COMMON_INTERCEPTOR_ENTER(ctx, dlerror, fake);
  1309. char *res = REAL(dlerror)(fake);
  1310. if (res)
  1311. __msan_unpoison(res, internal_strlen(res) + 1);
  1312. return res;
  1313. }
  1314. typedef int (*dl_iterate_phdr_cb)(__sanitizer_dl_phdr_info *info, SIZE_T size,
  1315. void *data);
  1316. struct dl_iterate_phdr_data {
  1317. dl_iterate_phdr_cb callback;
  1318. void *data;
  1319. };
  1320. static int msan_dl_iterate_phdr_cb(__sanitizer_dl_phdr_info *info, SIZE_T size,
  1321. void *data) {
  1322. if (info) {
  1323. __msan_unpoison(info, size);
  1324. if (info->dlpi_phdr && info->dlpi_phnum)
  1325. __msan_unpoison(info->dlpi_phdr, struct_ElfW_Phdr_sz * info->dlpi_phnum);
  1326. if (info->dlpi_name)
  1327. __msan_unpoison(info->dlpi_name, internal_strlen(info->dlpi_name) + 1);
  1328. }
  1329. dl_iterate_phdr_data *cbdata = (dl_iterate_phdr_data *)data;
  1330. UnpoisonParam(3);
  1331. return cbdata->callback(info, size, cbdata->data);
  1332. }
  1333. INTERCEPTOR(void *, shmat, int shmid, const void *shmaddr, int shmflg) {
  1334. ENSURE_MSAN_INITED();
  1335. void *p = REAL(shmat)(shmid, shmaddr, shmflg);
  1336. if (p != (void *)-1) {
  1337. __sanitizer_shmid_ds ds;
  1338. int res = REAL(shmctl)(shmid, shmctl_ipc_stat, &ds);
  1339. if (!res) {
  1340. __msan_unpoison(p, ds.shm_segsz);
  1341. }
  1342. }
  1343. return p;
  1344. }
  1345. INTERCEPTOR(int, dl_iterate_phdr, dl_iterate_phdr_cb callback, void *data) {
  1346. void *ctx;
  1347. COMMON_INTERCEPTOR_ENTER(ctx, dl_iterate_phdr, callback, data);
  1348. dl_iterate_phdr_data cbdata;
  1349. cbdata.callback = callback;
  1350. cbdata.data = data;
  1351. int res = REAL(dl_iterate_phdr)(msan_dl_iterate_phdr_cb, (void *)&cbdata);
  1352. return res;
  1353. }
  1354. // wchar_t *wcschr(const wchar_t *wcs, wchar_t wc);
  1355. INTERCEPTOR(wchar_t *, wcschr, void *s, wchar_t wc, void *ps) {
  1356. ENSURE_MSAN_INITED();
  1357. wchar_t *res = REAL(wcschr)(s, wc, ps);
  1358. return res;
  1359. }
  1360. // wchar_t *wcscpy(wchar_t *dest, const wchar_t *src);
  1361. INTERCEPTOR(wchar_t *, wcscpy, wchar_t *dest, const wchar_t *src) {
  1362. ENSURE_MSAN_INITED();
  1363. GET_STORE_STACK_TRACE;
  1364. wchar_t *res = REAL(wcscpy)(dest, src);
  1365. CopyShadowAndOrigin(dest, src, sizeof(wchar_t) * (internal_wcslen(src) + 1),
  1366. &stack);
  1367. return res;
  1368. }
  1369. INTERCEPTOR(wchar_t *, wcsncpy, wchar_t *dest, const wchar_t *src, SIZE_T n) {
  1370. ENSURE_MSAN_INITED();
  1371. GET_STORE_STACK_TRACE;
  1372. SIZE_T copy_size = internal_wcsnlen(src, n);
  1373. if (copy_size < n) copy_size++; // trailing \0
  1374. wchar_t *res = REAL(wcsncpy)(dest, src, n);
  1375. CopyShadowAndOrigin(dest, src, copy_size * sizeof(wchar_t), &stack);
  1376. __msan_unpoison(dest + copy_size, (n - copy_size) * sizeof(wchar_t));
  1377. return res;
  1378. }
  1379. // These interface functions reside here so that they can use
  1380. // REAL(memset), etc.
  1381. void __msan_unpoison(const void *a, uptr size) {
  1382. if (!MEM_IS_APP(a)) return;
  1383. SetShadow(a, size, 0);
  1384. }
  1385. void __msan_poison(const void *a, uptr size) {
  1386. if (!MEM_IS_APP(a)) return;
  1387. SetShadow(a, size, __msan::flags()->poison_heap_with_zeroes ? 0 : -1);
  1388. }
  1389. void __msan_poison_stack(void *a, uptr size) {
  1390. if (!MEM_IS_APP(a)) return;
  1391. SetShadow(a, size, __msan::flags()->poison_stack_with_zeroes ? 0 : -1);
  1392. }
  1393. void __msan_unpoison_param(uptr n) { UnpoisonParam(n); }
  1394. void __msan_clear_and_unpoison(void *a, uptr size) {
  1395. REAL(memset)(a, 0, size);
  1396. SetShadow(a, size, 0);
  1397. }
  1398. void *__msan_memcpy(void *dest, const void *src, SIZE_T n) {
  1399. if (!msan_inited) return internal_memcpy(dest, src, n);
  1400. if (msan_init_is_running || __msan::IsInSymbolizer())
  1401. return REAL(memcpy)(dest, src, n);
  1402. ENSURE_MSAN_INITED();
  1403. GET_STORE_STACK_TRACE;
  1404. void *res = REAL(memcpy)(dest, src, n);
  1405. CopyShadowAndOrigin(dest, src, n, &stack);
  1406. return res;
  1407. }
  1408. void *__msan_memset(void *s, int c, SIZE_T n) {
  1409. if (!msan_inited) return internal_memset(s, c, n);
  1410. if (msan_init_is_running) return REAL(memset)(s, c, n);
  1411. ENSURE_MSAN_INITED();
  1412. void *res = REAL(memset)(s, c, n);
  1413. __msan_unpoison(s, n);
  1414. return res;
  1415. }
  1416. void *__msan_memmove(void *dest, const void *src, SIZE_T n) {
  1417. if (!msan_inited) return internal_memmove(dest, src, n);
  1418. if (msan_init_is_running) return REAL(memmove)(dest, src, n);
  1419. ENSURE_MSAN_INITED();
  1420. GET_STORE_STACK_TRACE;
  1421. void *res = REAL(memmove)(dest, src, n);
  1422. MoveShadowAndOrigin(dest, src, n, &stack);
  1423. return res;
  1424. }
  1425. void __msan_unpoison_string(const char* s) {
  1426. if (!MEM_IS_APP(s)) return;
  1427. __msan_unpoison(s, internal_strlen(s) + 1);
  1428. }
  1429. namespace __msan {
  1430. void InitializeInterceptors() {
  1431. static int inited = 0;
  1432. CHECK_EQ(inited, 0);
  1433. new(interceptor_ctx()) InterceptorContext();
  1434. InitializeCommonInterceptors();
  1435. InitializeSignalInterceptors();
  1436. INTERCEPT_FUNCTION(posix_memalign);
  1437. MSAN_MAYBE_INTERCEPT_MEMALIGN;
  1438. MSAN_MAYBE_INTERCEPT___LIBC_MEMALIGN;
  1439. INTERCEPT_FUNCTION(valloc);
  1440. MSAN_MAYBE_INTERCEPT_PVALLOC;
  1441. INTERCEPT_FUNCTION(malloc);
  1442. INTERCEPT_FUNCTION(calloc);
  1443. INTERCEPT_FUNCTION(realloc);
  1444. INTERCEPT_FUNCTION(reallocarray);
  1445. INTERCEPT_FUNCTION(free);
  1446. MSAN_MAYBE_INTERCEPT_CFREE;
  1447. MSAN_MAYBE_INTERCEPT_MALLOC_USABLE_SIZE;
  1448. MSAN_MAYBE_INTERCEPT_MALLINFO;
  1449. MSAN_MAYBE_INTERCEPT_MALLOPT;
  1450. MSAN_MAYBE_INTERCEPT_MALLOC_STATS;
  1451. INTERCEPT_FUNCTION(fread);
  1452. MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED;
  1453. INTERCEPT_FUNCTION(memccpy);
  1454. MSAN_MAYBE_INTERCEPT_MEMPCPY;
  1455. INTERCEPT_FUNCTION(bcopy);
  1456. INTERCEPT_FUNCTION(wmemset);
  1457. INTERCEPT_FUNCTION(wmemcpy);
  1458. MSAN_MAYBE_INTERCEPT_WMEMPCPY;
  1459. INTERCEPT_FUNCTION(wmemmove);
  1460. INTERCEPT_FUNCTION(strcpy);
  1461. MSAN_MAYBE_INTERCEPT_STPCPY;
  1462. INTERCEPT_FUNCTION(strdup);
  1463. MSAN_MAYBE_INTERCEPT___STRDUP;
  1464. INTERCEPT_FUNCTION(strncpy);
  1465. MSAN_MAYBE_INTERCEPT_GCVT;
  1466. INTERCEPT_FUNCTION(strcat);
  1467. INTERCEPT_FUNCTION(strncat);
  1468. INTERCEPT_STRTO(strtod);
  1469. INTERCEPT_STRTO(strtof);
  1470. INTERCEPT_STRTO(strtold);
  1471. INTERCEPT_STRTO(strtol);
  1472. INTERCEPT_STRTO(strtoul);
  1473. INTERCEPT_STRTO(strtoll);
  1474. INTERCEPT_STRTO(strtoull);
  1475. INTERCEPT_STRTO(strtouq);
  1476. INTERCEPT_STRTO(wcstod);
  1477. INTERCEPT_STRTO(wcstof);
  1478. INTERCEPT_STRTO(wcstold);
  1479. INTERCEPT_STRTO(wcstol);
  1480. INTERCEPT_STRTO(wcstoul);
  1481. INTERCEPT_STRTO(wcstoll);
  1482. INTERCEPT_STRTO(wcstoull);
  1483. #ifdef SANITIZER_NLDBL_VERSION
  1484. INTERCEPT_FUNCTION_VER(vswprintf, SANITIZER_NLDBL_VERSION);
  1485. INTERCEPT_FUNCTION_VER(swprintf, SANITIZER_NLDBL_VERSION);
  1486. #else
  1487. INTERCEPT_FUNCTION(vswprintf);
  1488. INTERCEPT_FUNCTION(swprintf);
  1489. #endif
  1490. INTERCEPT_FUNCTION(strftime);
  1491. INTERCEPT_FUNCTION(strftime_l);
  1492. MSAN_MAYBE_INTERCEPT___STRFTIME_L;
  1493. INTERCEPT_FUNCTION(wcsftime);
  1494. INTERCEPT_FUNCTION(wcsftime_l);
  1495. MSAN_MAYBE_INTERCEPT___WCSFTIME_L;
  1496. INTERCEPT_FUNCTION(mbtowc);
  1497. INTERCEPT_FUNCTION(mbrtowc);
  1498. INTERCEPT_FUNCTION(wcslen);
  1499. INTERCEPT_FUNCTION(wcsnlen);
  1500. INTERCEPT_FUNCTION(wcschr);
  1501. INTERCEPT_FUNCTION(wcscpy);
  1502. INTERCEPT_FUNCTION(wcsncpy);
  1503. INTERCEPT_FUNCTION(wcscmp);
  1504. INTERCEPT_FUNCTION(getenv);
  1505. INTERCEPT_FUNCTION(setenv);
  1506. INTERCEPT_FUNCTION(putenv);
  1507. INTERCEPT_FUNCTION(gettimeofday);
  1508. MSAN_MAYBE_INTERCEPT_FCVT;
  1509. MSAN_MAYBE_INTERCEPT_FSTAT;
  1510. MSAN_MAYBE_INTERCEPT___FXSTAT;
  1511. MSAN_MAYBE_INTERCEPT_FSTATAT;
  1512. MSAN_MAYBE_INTERCEPT___FXSTATAT;
  1513. MSAN_MAYBE_INTERCEPT___FXSTAT64;
  1514. MSAN_MAYBE_INTERCEPT___FXSTATAT64;
  1515. INTERCEPT_FUNCTION(pipe);
  1516. INTERCEPT_FUNCTION(pipe2);
  1517. INTERCEPT_FUNCTION(socketpair);
  1518. MSAN_MAYBE_INTERCEPT_FGETS_UNLOCKED;
  1519. INTERCEPT_FUNCTION(getrlimit);
  1520. MSAN_MAYBE_INTERCEPT___GETRLIMIT;
  1521. MSAN_MAYBE_INTERCEPT_GETRLIMIT64;
  1522. MSAN_MAYBE_INTERCEPT_PRLIMIT;
  1523. MSAN_MAYBE_INTERCEPT_PRLIMIT64;
  1524. INTERCEPT_FUNCTION(gethostname);
  1525. MSAN_MAYBE_INTERCEPT_EPOLL_WAIT;
  1526. MSAN_MAYBE_INTERCEPT_EPOLL_PWAIT;
  1527. INTERCEPT_FUNCTION(dladdr);
  1528. INTERCEPT_FUNCTION(dlerror);
  1529. INTERCEPT_FUNCTION(dl_iterate_phdr);
  1530. INTERCEPT_FUNCTION(getrusage);
  1531. #if defined(__mips__)
  1532. INTERCEPT_FUNCTION_VER(pthread_create, "GLIBC_2.2");
  1533. #else
  1534. INTERCEPT_FUNCTION(pthread_create);
  1535. #endif
  1536. INTERCEPT_FUNCTION(pthread_join);
  1537. INTERCEPT_FUNCTION(pthread_key_create);
  1538. #if SANITIZER_NETBSD
  1539. INTERCEPT_FUNCTION(__libc_thr_keycreate);
  1540. #endif
  1541. INTERCEPT_FUNCTION(pthread_join);
  1542. INTERCEPT_FUNCTION(tzset);
  1543. INTERCEPT_FUNCTION(atexit);
  1544. INTERCEPT_FUNCTION(__cxa_atexit);
  1545. INTERCEPT_FUNCTION(shmat);
  1546. INTERCEPT_FUNCTION(fork);
  1547. MSAN_MAYBE_INTERCEPT_OPENPTY;
  1548. MSAN_MAYBE_INTERCEPT_FORKPTY;
  1549. inited = 1;
  1550. }
  1551. } // namespace __msan