1 //===-- msan_interceptors.cpp ---------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is a part of MemorySanitizer. 10 // 11 // Interceptors for standard library functions. 12 // 13 // FIXME: move as many interceptors as possible into 14 // sanitizer_common/sanitizer_common_interceptors.h 15 //===----------------------------------------------------------------------===// 16 17 #include "interception/interception.h" 18 #include "msan.h" 19 #include "msan_chained_origin_depot.h" 20 #include "msan_origin.h" 21 #include "msan_report.h" 22 #include "msan_thread.h" 23 #include "msan_poisoning.h" 24 #include "sanitizer_common/sanitizer_errno_codes.h" 25 #include "sanitizer_common/sanitizer_platform_limits_posix.h" 26 #include "sanitizer_common/sanitizer_platform_limits_netbsd.h" 27 #include "sanitizer_common/sanitizer_allocator.h" 28 #include "sanitizer_common/sanitizer_allocator_interface.h" 29 #include "sanitizer_common/sanitizer_allocator_internal.h" 30 #include "sanitizer_common/sanitizer_atomic.h" 31 #include "sanitizer_common/sanitizer_common.h" 32 #include "sanitizer_common/sanitizer_errno.h" 33 #include "sanitizer_common/sanitizer_stackdepot.h" 34 #include "sanitizer_common/sanitizer_libc.h" 35 #include "sanitizer_common/sanitizer_linux.h" 36 #include "sanitizer_common/sanitizer_tls_get_addr.h" 37 #include "sanitizer_common/sanitizer_vector.h" 38 39 #if SANITIZER_NETBSD 40 #define fstat __fstat50 41 #define gettimeofday __gettimeofday50 42 #define getrusage __getrusage50 43 #define tzset __tzset50 44 #endif 45 46 #include <stdarg.h> 47 // ACHTUNG! No other system header includes in this file. 48 // Ideally, we should get rid of stdarg.h as well. 49 50 using namespace __msan; 51 52 using __sanitizer::memory_order; 53 using __sanitizer::atomic_load; 54 using __sanitizer::atomic_store; 55 using __sanitizer::atomic_uintptr_t; 56 57 DECLARE_REAL(SIZE_T, strlen, const char *s) 58 DECLARE_REAL(SIZE_T, strnlen, const char *s, SIZE_T maxlen) 59 DECLARE_REAL(void *, memcpy, void *dest, const void *src, uptr n) 60 DECLARE_REAL(void *, memset, void *dest, int c, uptr n) 61 62 // True if this is a nested interceptor. 63 static THREADLOCAL int in_interceptor_scope; 64 65 void __msan_scoped_disable_interceptor_checks() { ++in_interceptor_scope; } 66 void __msan_scoped_enable_interceptor_checks() { --in_interceptor_scope; } 67 68 struct InterceptorScope { 69 InterceptorScope() { ++in_interceptor_scope; } 70 ~InterceptorScope() { --in_interceptor_scope; } 71 }; 72 73 bool IsInInterceptorScope() { 74 return in_interceptor_scope; 75 } 76 77 static uptr allocated_for_dlsym; 78 static const uptr kDlsymAllocPoolSize = 1024; 79 static uptr alloc_memory_for_dlsym[kDlsymAllocPoolSize]; 80 81 static bool IsInDlsymAllocPool(const void *ptr) { 82 uptr off = (uptr)ptr - (uptr)alloc_memory_for_dlsym; 83 return off < sizeof(alloc_memory_for_dlsym); 84 } 85 86 static void *AllocateFromLocalPool(uptr size_in_bytes) { 87 uptr size_in_words = RoundUpTo(size_in_bytes, kWordSize) / kWordSize; 88 void *mem = (void *)&alloc_memory_for_dlsym[allocated_for_dlsym]; 89 allocated_for_dlsym += size_in_words; 90 CHECK_LT(allocated_for_dlsym, kDlsymAllocPoolSize); 91 return mem; 92 } 93 94 #define ENSURE_MSAN_INITED() do { \ 95 CHECK(!msan_init_is_running); \ 96 if (!msan_inited) { \ 97 __msan_init(); \ 98 } \ 99 } while (0) 100 101 // Check that [x, x+n) range is unpoisoned. 102 #define CHECK_UNPOISONED_0(x, n) \ 103 do { \ 104 sptr __offset = __msan_test_shadow(x, n); \ 105 if (__msan::IsInSymbolizer()) break; \ 106 if (__offset >= 0 && __msan::flags()->report_umrs) { \ 107 GET_CALLER_PC_BP_SP; \ 108 (void)sp; \ 109 ReportUMRInsideAddressRange(__func__, x, n, __offset); \ 110 __msan::PrintWarningWithOrigin( \ 111 pc, bp, __msan_get_origin((const char *)x + __offset)); \ 112 if (__msan::flags()->halt_on_error) { \ 113 Printf("Exiting\n"); \ 114 Die(); \ 115 } \ 116 } \ 117 } while (0) 118 119 // Check that [x, x+n) range is unpoisoned unless we are in a nested 120 // interceptor. 121 #define CHECK_UNPOISONED(x, n) \ 122 do { \ 123 if (!IsInInterceptorScope()) CHECK_UNPOISONED_0(x, n); \ 124 } while (0) 125 126 #define CHECK_UNPOISONED_STRING_OF_LEN(x, len, n) \ 127 CHECK_UNPOISONED((x), \ 128 common_flags()->strict_string_checks ? (len) + 1 : (n) ) 129 130 #define CHECK_UNPOISONED_STRING(x, n) \ 131 CHECK_UNPOISONED_STRING_OF_LEN((x), internal_strlen(x), (n)) 132 133 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 134 INTERCEPTOR(SIZE_T, fread_unlocked, void *ptr, SIZE_T size, SIZE_T nmemb, 135 void *file) { 136 ENSURE_MSAN_INITED(); 137 SIZE_T res = REAL(fread_unlocked)(ptr, size, nmemb, file); 138 if (res > 0) 139 __msan_unpoison(ptr, res *size); 140 return res; 141 } 142 #define MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED INTERCEPT_FUNCTION(fread_unlocked) 143 #else 144 #define MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED 145 #endif 146 147 #if !SANITIZER_NETBSD 148 INTERCEPTOR(void *, mempcpy, void *dest, const void *src, SIZE_T n) { 149 return (char *)__msan_memcpy(dest, src, n) + n; 150 } 151 #define MSAN_MAYBE_INTERCEPT_MEMPCPY INTERCEPT_FUNCTION(mempcpy) 152 #else 153 #define MSAN_MAYBE_INTERCEPT_MEMPCPY 154 #endif 155 156 INTERCEPTOR(void *, memccpy, void *dest, const void *src, int c, SIZE_T n) { 157 ENSURE_MSAN_INITED(); 158 void *res = REAL(memccpy)(dest, src, c, n); 159 CHECK(!res || (res >= dest && res <= (char *)dest + n)); 160 SIZE_T sz = res ? (char *)res - (char *)dest : n; 161 CHECK_UNPOISONED(src, sz); 162 __msan_unpoison(dest, sz); 163 return res; 164 } 165 166 INTERCEPTOR(void *, bcopy, const void *src, void *dest, SIZE_T n) { 167 return __msan_memmove(dest, src, n); 168 } 169 170 INTERCEPTOR(int, posix_memalign, void **memptr, SIZE_T alignment, SIZE_T size) { 171 GET_MALLOC_STACK_TRACE; 172 CHECK_NE(memptr, 0); 173 int res = msan_posix_memalign(memptr, alignment, size, &stack); 174 if (!res) 175 __msan_unpoison(memptr, sizeof(*memptr)); 176 return res; 177 } 178 179 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 180 INTERCEPTOR(void *, memalign, SIZE_T alignment, SIZE_T size) { 181 GET_MALLOC_STACK_TRACE; 182 return msan_memalign(alignment, size, &stack); 183 } 184 #define MSAN_MAYBE_INTERCEPT_MEMALIGN INTERCEPT_FUNCTION(memalign) 185 #else 186 #define MSAN_MAYBE_INTERCEPT_MEMALIGN 187 #endif 188 189 INTERCEPTOR(void *, aligned_alloc, SIZE_T alignment, SIZE_T size) { 190 GET_MALLOC_STACK_TRACE; 191 return msan_aligned_alloc(alignment, size, &stack); 192 } 193 194 #if !SANITIZER_NETBSD 195 INTERCEPTOR(void *, __libc_memalign, SIZE_T alignment, SIZE_T size) { 196 GET_MALLOC_STACK_TRACE; 197 void *ptr = msan_memalign(alignment, size, &stack); 198 if (ptr) 199 DTLS_on_libc_memalign(ptr, size); 200 return ptr; 201 } 202 #define MSAN_MAYBE_INTERCEPT___LIBC_MEMALIGN INTERCEPT_FUNCTION(__libc_memalign) 203 #else 204 #define MSAN_MAYBE_INTERCEPT___LIBC_MEMALIGN 205 #endif 206 207 INTERCEPTOR(void *, valloc, SIZE_T size) { 208 GET_MALLOC_STACK_TRACE; 209 return msan_valloc(size, &stack); 210 } 211 212 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 213 INTERCEPTOR(void *, pvalloc, SIZE_T size) { 214 GET_MALLOC_STACK_TRACE; 215 return msan_pvalloc(size, &stack); 216 } 217 #define MSAN_MAYBE_INTERCEPT_PVALLOC INTERCEPT_FUNCTION(pvalloc) 218 #else 219 #define MSAN_MAYBE_INTERCEPT_PVALLOC 220 #endif 221 222 INTERCEPTOR(void, free, void *ptr) { 223 GET_MALLOC_STACK_TRACE; 224 if (!ptr || UNLIKELY(IsInDlsymAllocPool(ptr))) return; 225 MsanDeallocate(&stack, ptr); 226 } 227 228 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 229 INTERCEPTOR(void, cfree, void *ptr) { 230 GET_MALLOC_STACK_TRACE; 231 if (!ptr || UNLIKELY(IsInDlsymAllocPool(ptr))) return; 232 MsanDeallocate(&stack, ptr); 233 } 234 #define MSAN_MAYBE_INTERCEPT_CFREE INTERCEPT_FUNCTION(cfree) 235 #else 236 #define MSAN_MAYBE_INTERCEPT_CFREE 237 #endif 238 239 #if !SANITIZER_NETBSD 240 INTERCEPTOR(uptr, malloc_usable_size, void *ptr) { 241 return __sanitizer_get_allocated_size(ptr); 242 } 243 #define MSAN_MAYBE_INTERCEPT_MALLOC_USABLE_SIZE \ 244 INTERCEPT_FUNCTION(malloc_usable_size) 245 #else 246 #define MSAN_MAYBE_INTERCEPT_MALLOC_USABLE_SIZE 247 #endif 248 249 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 250 // This function actually returns a struct by value, but we can't unpoison a 251 // temporary! The following is equivalent on all supported platforms but 252 // aarch64 (which uses a different register for sret value). We have a test 253 // to confirm that. 254 INTERCEPTOR(void, mallinfo, __sanitizer_struct_mallinfo *sret) { 255 #ifdef __aarch64__ 256 uptr r8; 257 asm volatile("mov %0,x8" : "=r" (r8)); 258 sret = reinterpret_cast<__sanitizer_struct_mallinfo*>(r8); 259 #endif 260 REAL(memset)(sret, 0, sizeof(*sret)); 261 __msan_unpoison(sret, sizeof(*sret)); 262 } 263 #define MSAN_MAYBE_INTERCEPT_MALLINFO INTERCEPT_FUNCTION(mallinfo) 264 #else 265 #define MSAN_MAYBE_INTERCEPT_MALLINFO 266 #endif 267 268 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 269 INTERCEPTOR(int, mallopt, int cmd, int value) { 270 return 0; 271 } 272 #define MSAN_MAYBE_INTERCEPT_MALLOPT INTERCEPT_FUNCTION(mallopt) 273 #else 274 #define MSAN_MAYBE_INTERCEPT_MALLOPT 275 #endif 276 277 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 278 INTERCEPTOR(void, malloc_stats, void) { 279 // FIXME: implement, but don't call REAL(malloc_stats)! 280 } 281 #define MSAN_MAYBE_INTERCEPT_MALLOC_STATS INTERCEPT_FUNCTION(malloc_stats) 282 #else 283 #define MSAN_MAYBE_INTERCEPT_MALLOC_STATS 284 #endif 285 286 INTERCEPTOR(char *, strcpy, char *dest, const char *src) { 287 ENSURE_MSAN_INITED(); 288 GET_STORE_STACK_TRACE; 289 SIZE_T n = internal_strlen(src); 290 CHECK_UNPOISONED_STRING(src + n, 0); 291 char *res = REAL(strcpy)(dest, src); 292 CopyShadowAndOrigin(dest, src, n + 1, &stack); 293 return res; 294 } 295 296 INTERCEPTOR(char *, strncpy, char *dest, const char *src, SIZE_T n) { 297 ENSURE_MSAN_INITED(); 298 GET_STORE_STACK_TRACE; 299 SIZE_T copy_size = internal_strnlen(src, n); 300 if (copy_size < n) 301 copy_size++; // trailing \0 302 char *res = REAL(strncpy)(dest, src, n); 303 CopyShadowAndOrigin(dest, src, copy_size, &stack); 304 __msan_unpoison(dest + copy_size, n - copy_size); 305 return res; 306 } 307 308 #if !SANITIZER_NETBSD 309 INTERCEPTOR(char *, stpcpy, char *dest, const char *src) { 310 ENSURE_MSAN_INITED(); 311 GET_STORE_STACK_TRACE; 312 SIZE_T n = internal_strlen(src); 313 CHECK_UNPOISONED_STRING(src + n, 0); 314 char *res = REAL(stpcpy)(dest, src); 315 CopyShadowAndOrigin(dest, src, n + 1, &stack); 316 return res; 317 } 318 #define MSAN_MAYBE_INTERCEPT_STPCPY INTERCEPT_FUNCTION(stpcpy) 319 #else 320 #define MSAN_MAYBE_INTERCEPT_STPCPY 321 #endif 322 323 INTERCEPTOR(char *, strdup, char *src) { 324 ENSURE_MSAN_INITED(); 325 GET_STORE_STACK_TRACE; 326 // On FreeBSD strdup() leverages strlen(). 327 InterceptorScope interceptor_scope; 328 SIZE_T n = internal_strlen(src); 329 CHECK_UNPOISONED_STRING(src + n, 0); 330 char *res = REAL(strdup)(src); 331 CopyShadowAndOrigin(res, src, n + 1, &stack); 332 return res; 333 } 334 335 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 336 INTERCEPTOR(char *, __strdup, char *src) { 337 ENSURE_MSAN_INITED(); 338 GET_STORE_STACK_TRACE; 339 SIZE_T n = internal_strlen(src); 340 CHECK_UNPOISONED_STRING(src + n, 0); 341 char *res = REAL(__strdup)(src); 342 CopyShadowAndOrigin(res, src, n + 1, &stack); 343 return res; 344 } 345 #define MSAN_MAYBE_INTERCEPT___STRDUP INTERCEPT_FUNCTION(__strdup) 346 #else 347 #define MSAN_MAYBE_INTERCEPT___STRDUP 348 #endif 349 350 #if !SANITIZER_NETBSD 351 INTERCEPTOR(char *, gcvt, double number, SIZE_T ndigit, char *buf) { 352 ENSURE_MSAN_INITED(); 353 char *res = REAL(gcvt)(number, ndigit, buf); 354 SIZE_T n = internal_strlen(buf); 355 __msan_unpoison(buf, n + 1); 356 return res; 357 } 358 #define MSAN_MAYBE_INTERCEPT_GCVT INTERCEPT_FUNCTION(gcvt) 359 #else 360 #define MSAN_MAYBE_INTERCEPT_GCVT 361 #endif 362 363 INTERCEPTOR(char *, strcat, char *dest, const char *src) { 364 ENSURE_MSAN_INITED(); 365 GET_STORE_STACK_TRACE; 366 SIZE_T src_size = internal_strlen(src); 367 SIZE_T dest_size = internal_strlen(dest); 368 CHECK_UNPOISONED_STRING(src + src_size, 0); 369 CHECK_UNPOISONED_STRING(dest + dest_size, 0); 370 char *res = REAL(strcat)(dest, src); 371 CopyShadowAndOrigin(dest + dest_size, src, src_size + 1, &stack); 372 return res; 373 } 374 375 INTERCEPTOR(char *, strncat, char *dest, const char *src, SIZE_T n) { 376 ENSURE_MSAN_INITED(); 377 GET_STORE_STACK_TRACE; 378 SIZE_T dest_size = internal_strlen(dest); 379 SIZE_T copy_size = internal_strnlen(src, n); 380 CHECK_UNPOISONED_STRING(dest + dest_size, 0); 381 char *res = REAL(strncat)(dest, src, n); 382 CopyShadowAndOrigin(dest + dest_size, src, copy_size, &stack); 383 __msan_unpoison(dest + dest_size + copy_size, 1); // \0 384 return res; 385 } 386 387 // Hack: always pass nptr and endptr as part of __VA_ARGS_ to avoid having to 388 // deal with empty __VA_ARGS__ in the case of INTERCEPTOR_STRTO. 389 #define INTERCEPTOR_STRTO_BODY(ret_type, func, ...) \ 390 ENSURE_MSAN_INITED(); \ 391 ret_type res = REAL(func)(__VA_ARGS__); \ 392 __msan_unpoison(endptr, sizeof(*endptr)); \ 393 return res; 394 395 #define INTERCEPTOR_STRTO(ret_type, func, char_type) \ 396 INTERCEPTOR(ret_type, func, const char_type *nptr, char_type **endptr) { \ 397 INTERCEPTOR_STRTO_BODY(ret_type, func, nptr, endptr); \ 398 } 399 400 #define INTERCEPTOR_STRTO_BASE(ret_type, func, char_type) \ 401 INTERCEPTOR(ret_type, func, const char_type *nptr, char_type **endptr, \ 402 int base) { \ 403 INTERCEPTOR_STRTO_BODY(ret_type, func, nptr, endptr, base); \ 404 } 405 406 #define INTERCEPTOR_STRTO_LOC(ret_type, func, char_type) \ 407 INTERCEPTOR(ret_type, func, const char_type *nptr, char_type **endptr, \ 408 void *loc) { \ 409 INTERCEPTOR_STRTO_BODY(ret_type, func, nptr, endptr, loc); \ 410 } 411 412 #define INTERCEPTOR_STRTO_BASE_LOC(ret_type, func, char_type) \ 413 INTERCEPTOR(ret_type, func, const char_type *nptr, char_type **endptr, \ 414 int base, void *loc) { \ 415 INTERCEPTOR_STRTO_BODY(ret_type, func, nptr, endptr, base, loc); \ 416 } 417 418 #if SANITIZER_NETBSD 419 #define INTERCEPTORS_STRTO(ret_type, func, char_type) \ 420 INTERCEPTOR_STRTO(ret_type, func, char_type) \ 421 INTERCEPTOR_STRTO_LOC(ret_type, func##_l, char_type) 422 423 #define INTERCEPTORS_STRTO_BASE(ret_type, func, char_type) \ 424 INTERCEPTOR_STRTO_BASE(ret_type, func, char_type) \ 425 INTERCEPTOR_STRTO_BASE_LOC(ret_type, func##_l, char_type) 426 427 #else 428 #define INTERCEPTORS_STRTO(ret_type, func, char_type) \ 429 INTERCEPTOR_STRTO(ret_type, func, char_type) \ 430 INTERCEPTOR_STRTO_LOC(ret_type, func##_l, char_type) \ 431 INTERCEPTOR_STRTO_LOC(ret_type, __##func##_l, char_type) \ 432 INTERCEPTOR_STRTO_LOC(ret_type, __##func##_internal, char_type) 433 434 #define INTERCEPTORS_STRTO_BASE(ret_type, func, char_type) \ 435 INTERCEPTOR_STRTO_BASE(ret_type, func, char_type) \ 436 INTERCEPTOR_STRTO_BASE_LOC(ret_type, func##_l, char_type) \ 437 INTERCEPTOR_STRTO_BASE_LOC(ret_type, __##func##_l, char_type) \ 438 INTERCEPTOR_STRTO_BASE_LOC(ret_type, __##func##_internal, char_type) 439 #endif 440 441 INTERCEPTORS_STRTO(double, strtod, char) 442 INTERCEPTORS_STRTO(float, strtof, char) 443 INTERCEPTORS_STRTO(long double, strtold, char) 444 INTERCEPTORS_STRTO_BASE(long, strtol, char) 445 INTERCEPTORS_STRTO_BASE(long long, strtoll, char) 446 INTERCEPTORS_STRTO_BASE(unsigned long, strtoul, char) 447 INTERCEPTORS_STRTO_BASE(unsigned long long, strtoull, char) 448 INTERCEPTORS_STRTO_BASE(u64, strtouq, char) 449 450 INTERCEPTORS_STRTO(double, wcstod, wchar_t) 451 INTERCEPTORS_STRTO(float, wcstof, wchar_t) 452 INTERCEPTORS_STRTO(long double, wcstold, wchar_t) 453 INTERCEPTORS_STRTO_BASE(long, wcstol, wchar_t) 454 INTERCEPTORS_STRTO_BASE(long long, wcstoll, wchar_t) 455 INTERCEPTORS_STRTO_BASE(unsigned long, wcstoul, wchar_t) 456 INTERCEPTORS_STRTO_BASE(unsigned long long, wcstoull, wchar_t) 457 458 #if SANITIZER_NETBSD 459 #define INTERCEPT_STRTO(func) \ 460 INTERCEPT_FUNCTION(func); \ 461 INTERCEPT_FUNCTION(func##_l); 462 #else 463 #define INTERCEPT_STRTO(func) \ 464 INTERCEPT_FUNCTION(func); \ 465 INTERCEPT_FUNCTION(func##_l); \ 466 INTERCEPT_FUNCTION(__##func##_l); \ 467 INTERCEPT_FUNCTION(__##func##_internal); 468 #endif 469 470 471 // FIXME: support *wprintf in common format interceptors. 472 INTERCEPTOR(int, vswprintf, void *str, uptr size, void *format, va_list ap) { 473 ENSURE_MSAN_INITED(); 474 int res = REAL(vswprintf)(str, size, format, ap); 475 if (res >= 0) { 476 __msan_unpoison(str, 4 * (res + 1)); 477 } 478 return res; 479 } 480 481 INTERCEPTOR(int, swprintf, void *str, uptr size, void *format, ...) { 482 ENSURE_MSAN_INITED(); 483 va_list ap; 484 va_start(ap, format); 485 int res = vswprintf(str, size, format, ap); 486 va_end(ap); 487 return res; 488 } 489 490 #define INTERCEPTOR_STRFTIME_BODY(char_type, ret_type, func, s, ...) \ 491 ENSURE_MSAN_INITED(); \ 492 InterceptorScope interceptor_scope; \ 493 ret_type res = REAL(func)(s, __VA_ARGS__); \ 494 if (s) __msan_unpoison(s, sizeof(char_type) * (res + 1)); \ 495 return res; 496 497 INTERCEPTOR(SIZE_T, strftime, char *s, SIZE_T max, const char *format, 498 __sanitizer_tm *tm) { 499 INTERCEPTOR_STRFTIME_BODY(char, SIZE_T, strftime, s, max, format, tm); 500 } 501 502 INTERCEPTOR(SIZE_T, strftime_l, char *s, SIZE_T max, const char *format, 503 __sanitizer_tm *tm, void *loc) { 504 INTERCEPTOR_STRFTIME_BODY(char, SIZE_T, strftime_l, s, max, format, tm, loc); 505 } 506 507 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 508 INTERCEPTOR(SIZE_T, __strftime_l, char *s, SIZE_T max, const char *format, 509 __sanitizer_tm *tm, void *loc) { 510 INTERCEPTOR_STRFTIME_BODY(char, SIZE_T, __strftime_l, s, max, format, tm, 511 loc); 512 } 513 #define MSAN_MAYBE_INTERCEPT___STRFTIME_L INTERCEPT_FUNCTION(__strftime_l) 514 #else 515 #define MSAN_MAYBE_INTERCEPT___STRFTIME_L 516 #endif 517 518 INTERCEPTOR(SIZE_T, wcsftime, wchar_t *s, SIZE_T max, const wchar_t *format, 519 __sanitizer_tm *tm) { 520 INTERCEPTOR_STRFTIME_BODY(wchar_t, SIZE_T, wcsftime, s, max, format, tm); 521 } 522 523 INTERCEPTOR(SIZE_T, wcsftime_l, wchar_t *s, SIZE_T max, const wchar_t *format, 524 __sanitizer_tm *tm, void *loc) { 525 INTERCEPTOR_STRFTIME_BODY(wchar_t, SIZE_T, wcsftime_l, s, max, format, tm, 526 loc); 527 } 528 529 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 530 INTERCEPTOR(SIZE_T, __wcsftime_l, wchar_t *s, SIZE_T max, const wchar_t *format, 531 __sanitizer_tm *tm, void *loc) { 532 INTERCEPTOR_STRFTIME_BODY(wchar_t, SIZE_T, __wcsftime_l, s, max, format, tm, 533 loc); 534 } 535 #define MSAN_MAYBE_INTERCEPT___WCSFTIME_L INTERCEPT_FUNCTION(__wcsftime_l) 536 #else 537 #define MSAN_MAYBE_INTERCEPT___WCSFTIME_L 538 #endif 539 540 INTERCEPTOR(int, mbtowc, wchar_t *dest, const char *src, SIZE_T n) { 541 ENSURE_MSAN_INITED(); 542 int res = REAL(mbtowc)(dest, src, n); 543 if (res != -1 && dest) __msan_unpoison(dest, sizeof(wchar_t)); 544 return res; 545 } 546 547 INTERCEPTOR(SIZE_T, mbrtowc, wchar_t *dest, const char *src, SIZE_T n, 548 void *ps) { 549 ENSURE_MSAN_INITED(); 550 SIZE_T res = REAL(mbrtowc)(dest, src, n, ps); 551 if (res != (SIZE_T)-1 && dest) __msan_unpoison(dest, sizeof(wchar_t)); 552 return res; 553 } 554 555 // wchar_t *wmemcpy(wchar_t *dest, const wchar_t *src, SIZE_T n); 556 INTERCEPTOR(wchar_t *, wmemcpy, wchar_t *dest, const wchar_t *src, SIZE_T n) { 557 ENSURE_MSAN_INITED(); 558 GET_STORE_STACK_TRACE; 559 wchar_t *res = REAL(wmemcpy)(dest, src, n); 560 CopyShadowAndOrigin(dest, src, n * sizeof(wchar_t), &stack); 561 return res; 562 } 563 564 #if !SANITIZER_NETBSD 565 INTERCEPTOR(wchar_t *, wmempcpy, wchar_t *dest, const wchar_t *src, SIZE_T n) { 566 ENSURE_MSAN_INITED(); 567 GET_STORE_STACK_TRACE; 568 wchar_t *res = REAL(wmempcpy)(dest, src, n); 569 CopyShadowAndOrigin(dest, src, n * sizeof(wchar_t), &stack); 570 return res; 571 } 572 #define MSAN_MAYBE_INTERCEPT_WMEMPCPY INTERCEPT_FUNCTION(wmempcpy) 573 #else 574 #define MSAN_MAYBE_INTERCEPT_WMEMPCPY 575 #endif 576 577 INTERCEPTOR(wchar_t *, wmemset, wchar_t *s, wchar_t c, SIZE_T n) { 578 CHECK(MEM_IS_APP(s)); 579 ENSURE_MSAN_INITED(); 580 wchar_t *res = REAL(wmemset)(s, c, n); 581 __msan_unpoison(s, n * sizeof(wchar_t)); 582 return res; 583 } 584 585 INTERCEPTOR(wchar_t *, wmemmove, wchar_t *dest, const wchar_t *src, SIZE_T n) { 586 ENSURE_MSAN_INITED(); 587 GET_STORE_STACK_TRACE; 588 wchar_t *res = REAL(wmemmove)(dest, src, n); 589 MoveShadowAndOrigin(dest, src, n * sizeof(wchar_t), &stack); 590 return res; 591 } 592 593 INTERCEPTOR(int, wcscmp, const wchar_t *s1, const wchar_t *s2) { 594 ENSURE_MSAN_INITED(); 595 int res = REAL(wcscmp)(s1, s2); 596 return res; 597 } 598 599 INTERCEPTOR(int, gettimeofday, void *tv, void *tz) { 600 ENSURE_MSAN_INITED(); 601 int res = REAL(gettimeofday)(tv, tz); 602 if (tv) 603 __msan_unpoison(tv, 16); 604 if (tz) 605 __msan_unpoison(tz, 8); 606 return res; 607 } 608 609 #if !SANITIZER_NETBSD 610 INTERCEPTOR(char *, fcvt, double x, int a, int *b, int *c) { 611 ENSURE_MSAN_INITED(); 612 char *res = REAL(fcvt)(x, a, b, c); 613 __msan_unpoison(b, sizeof(*b)); 614 __msan_unpoison(c, sizeof(*c)); 615 if (res) 616 __msan_unpoison(res, internal_strlen(res) + 1); 617 return res; 618 } 619 #define MSAN_MAYBE_INTERCEPT_FCVT INTERCEPT_FUNCTION(fcvt) 620 #else 621 #define MSAN_MAYBE_INTERCEPT_FCVT 622 #endif 623 624 INTERCEPTOR(char *, getenv, char *name) { 625 if (msan_init_is_running) 626 return REAL(getenv)(name); 627 ENSURE_MSAN_INITED(); 628 char *res = REAL(getenv)(name); 629 if (res) 630 __msan_unpoison(res, internal_strlen(res) + 1); 631 return res; 632 } 633 634 extern char **environ; 635 636 static void UnpoisonEnviron() { 637 char **envp = environ; 638 for (; *envp; ++envp) { 639 __msan_unpoison(envp, sizeof(*envp)); 640 __msan_unpoison(*envp, internal_strlen(*envp) + 1); 641 } 642 // Trailing NULL pointer. 643 __msan_unpoison(envp, sizeof(*envp)); 644 } 645 646 INTERCEPTOR(int, setenv, const char *name, const char *value, int overwrite) { 647 ENSURE_MSAN_INITED(); 648 CHECK_UNPOISONED_STRING(name, 0); 649 int res = REAL(setenv)(name, value, overwrite); 650 if (!res) UnpoisonEnviron(); 651 return res; 652 } 653 654 INTERCEPTOR(int, putenv, char *string) { 655 ENSURE_MSAN_INITED(); 656 int res = REAL(putenv)(string); 657 if (!res) UnpoisonEnviron(); 658 return res; 659 } 660 661 #define SANITIZER_STAT_LINUX (SANITIZER_LINUX && __GLIBC_PREREQ(2, 33)) 662 #if SANITIZER_FREEBSD || SANITIZER_NETBSD || SANITIZER_STAT_LINUX 663 INTERCEPTOR(int, fstat, int fd, void *buf) { 664 ENSURE_MSAN_INITED(); 665 int res = REAL(fstat)(fd, buf); 666 if (!res) 667 __msan_unpoison(buf, __sanitizer::struct_stat_sz); 668 return res; 669 } 670 # define MSAN_MAYBE_INTERCEPT_FSTAT MSAN_INTERCEPT_FUNC(fstat) 671 #else 672 #define MSAN_MAYBE_INTERCEPT_FSTAT 673 #endif 674 675 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 676 INTERCEPTOR(int, __fxstat, int magic, int fd, void *buf) { 677 ENSURE_MSAN_INITED(); 678 int res = REAL(__fxstat)(magic, fd, buf); 679 if (!res) 680 __msan_unpoison(buf, __sanitizer::struct_stat_sz); 681 return res; 682 } 683 # define MSAN_MAYBE_INTERCEPT___FXSTAT MSAN_INTERCEPT_FUNC(__fxstat) 684 #else 685 #define MSAN_MAYBE_INTERCEPT___FXSTAT 686 #endif 687 688 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 689 INTERCEPTOR(int, __fxstat64, int magic, int fd, void *buf) { 690 ENSURE_MSAN_INITED(); 691 int res = REAL(__fxstat64)(magic, fd, buf); 692 if (!res) 693 __msan_unpoison(buf, __sanitizer::struct_stat64_sz); 694 return res; 695 } 696 # define MSAN_MAYBE_INTERCEPT___FXSTAT64 MSAN_INTERCEPT_FUNC(__fxstat64) 697 #else 698 # define MSAN_MAYBE_INTERCEPT___FXSTAT64 699 #endif 700 701 #if SANITIZER_FREEBSD || SANITIZER_NETBSD || SANITIZER_STAT_LINUX 702 INTERCEPTOR(int, fstatat, int fd, char *pathname, void *buf, int flags) { 703 ENSURE_MSAN_INITED(); 704 int res = REAL(fstatat)(fd, pathname, buf, flags); 705 if (!res) __msan_unpoison(buf, __sanitizer::struct_stat_sz); 706 return res; 707 } 708 # define MSAN_MAYBE_INTERCEPT_FSTATAT MSAN_INTERCEPT_FUNC(fstatat) 709 #else 710 # define MSAN_MAYBE_INTERCEPT_FSTATAT 711 #endif 712 713 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 714 INTERCEPTOR(int, __fxstatat, int magic, int fd, char *pathname, void *buf, 715 int flags) { 716 ENSURE_MSAN_INITED(); 717 int res = REAL(__fxstatat)(magic, fd, pathname, buf, flags); 718 if (!res) __msan_unpoison(buf, __sanitizer::struct_stat_sz); 719 return res; 720 } 721 # define MSAN_MAYBE_INTERCEPT___FXSTATAT MSAN_INTERCEPT_FUNC(__fxstatat) 722 #else 723 # define MSAN_MAYBE_INTERCEPT___FXSTATAT 724 #endif 725 726 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 727 INTERCEPTOR(int, __fxstatat64, int magic, int fd, char *pathname, void *buf, 728 int flags) { 729 ENSURE_MSAN_INITED(); 730 int res = REAL(__fxstatat64)(magic, fd, pathname, buf, flags); 731 if (!res) __msan_unpoison(buf, __sanitizer::struct_stat64_sz); 732 return res; 733 } 734 # define MSAN_MAYBE_INTERCEPT___FXSTATAT64 MSAN_INTERCEPT_FUNC(__fxstatat64) 735 #else 736 # define MSAN_MAYBE_INTERCEPT___FXSTATAT64 737 #endif 738 739 INTERCEPTOR(int, pipe, int pipefd[2]) { 740 if (msan_init_is_running) 741 return REAL(pipe)(pipefd); 742 ENSURE_MSAN_INITED(); 743 int res = REAL(pipe)(pipefd); 744 if (!res) 745 __msan_unpoison(pipefd, sizeof(int[2])); 746 return res; 747 } 748 749 INTERCEPTOR(int, pipe2, int pipefd[2], int flags) { 750 ENSURE_MSAN_INITED(); 751 int res = REAL(pipe2)(pipefd, flags); 752 if (!res) 753 __msan_unpoison(pipefd, sizeof(int[2])); 754 return res; 755 } 756 757 INTERCEPTOR(int, socketpair, int domain, int type, int protocol, int sv[2]) { 758 ENSURE_MSAN_INITED(); 759 int res = REAL(socketpair)(domain, type, protocol, sv); 760 if (!res) 761 __msan_unpoison(sv, sizeof(int[2])); 762 return res; 763 } 764 765 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 766 INTERCEPTOR(char *, fgets_unlocked, char *s, int size, void *stream) { 767 ENSURE_MSAN_INITED(); 768 char *res = REAL(fgets_unlocked)(s, size, stream); 769 if (res) 770 __msan_unpoison(s, internal_strlen(s) + 1); 771 return res; 772 } 773 #define MSAN_MAYBE_INTERCEPT_FGETS_UNLOCKED INTERCEPT_FUNCTION(fgets_unlocked) 774 #else 775 #define MSAN_MAYBE_INTERCEPT_FGETS_UNLOCKED 776 #endif 777 778 #define INTERCEPTOR_GETRLIMIT_BODY(func, resource, rlim) \ 779 if (msan_init_is_running) \ 780 return REAL(getrlimit)(resource, rlim); \ 781 ENSURE_MSAN_INITED(); \ 782 int res = REAL(func)(resource, rlim); \ 783 if (!res) \ 784 __msan_unpoison(rlim, __sanitizer::struct_rlimit_sz); \ 785 return res 786 787 INTERCEPTOR(int, getrlimit, int resource, void *rlim) { 788 INTERCEPTOR_GETRLIMIT_BODY(getrlimit, resource, rlim); 789 } 790 791 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 792 INTERCEPTOR(int, __getrlimit, int resource, void *rlim) { 793 INTERCEPTOR_GETRLIMIT_BODY(__getrlimit, resource, rlim); 794 } 795 796 INTERCEPTOR(int, getrlimit64, int resource, void *rlim) { 797 if (msan_init_is_running) return REAL(getrlimit64)(resource, rlim); 798 ENSURE_MSAN_INITED(); 799 int res = REAL(getrlimit64)(resource, rlim); 800 if (!res) __msan_unpoison(rlim, __sanitizer::struct_rlimit64_sz); 801 return res; 802 } 803 804 INTERCEPTOR(int, prlimit, int pid, int resource, void *new_rlimit, 805 void *old_rlimit) { 806 if (msan_init_is_running) 807 return REAL(prlimit)(pid, resource, new_rlimit, old_rlimit); 808 ENSURE_MSAN_INITED(); 809 CHECK_UNPOISONED(new_rlimit, __sanitizer::struct_rlimit_sz); 810 int res = REAL(prlimit)(pid, resource, new_rlimit, old_rlimit); 811 if (!res) __msan_unpoison(old_rlimit, __sanitizer::struct_rlimit_sz); 812 return res; 813 } 814 815 INTERCEPTOR(int, prlimit64, int pid, int resource, void *new_rlimit, 816 void *old_rlimit) { 817 if (msan_init_is_running) 818 return REAL(prlimit64)(pid, resource, new_rlimit, old_rlimit); 819 ENSURE_MSAN_INITED(); 820 CHECK_UNPOISONED(new_rlimit, __sanitizer::struct_rlimit64_sz); 821 int res = REAL(prlimit64)(pid, resource, new_rlimit, old_rlimit); 822 if (!res) __msan_unpoison(old_rlimit, __sanitizer::struct_rlimit64_sz); 823 return res; 824 } 825 826 #define MSAN_MAYBE_INTERCEPT___GETRLIMIT INTERCEPT_FUNCTION(__getrlimit) 827 #define MSAN_MAYBE_INTERCEPT_GETRLIMIT64 INTERCEPT_FUNCTION(getrlimit64) 828 #define MSAN_MAYBE_INTERCEPT_PRLIMIT INTERCEPT_FUNCTION(prlimit) 829 #define MSAN_MAYBE_INTERCEPT_PRLIMIT64 INTERCEPT_FUNCTION(prlimit64) 830 #else 831 #define MSAN_MAYBE_INTERCEPT___GETRLIMIT 832 #define MSAN_MAYBE_INTERCEPT_GETRLIMIT64 833 #define MSAN_MAYBE_INTERCEPT_PRLIMIT 834 #define MSAN_MAYBE_INTERCEPT_PRLIMIT64 835 #endif 836 837 INTERCEPTOR(int, gethostname, char *name, SIZE_T len) { 838 ENSURE_MSAN_INITED(); 839 int res = REAL(gethostname)(name, len); 840 if (!res || (res == -1 && errno == errno_ENAMETOOLONG)) { 841 SIZE_T real_len = internal_strnlen(name, len); 842 if (real_len < len) 843 ++real_len; 844 __msan_unpoison(name, real_len); 845 } 846 return res; 847 } 848 849 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 850 INTERCEPTOR(int, epoll_wait, int epfd, void *events, int maxevents, 851 int timeout) { 852 ENSURE_MSAN_INITED(); 853 int res = REAL(epoll_wait)(epfd, events, maxevents, timeout); 854 if (res > 0) { 855 __msan_unpoison(events, __sanitizer::struct_epoll_event_sz * res); 856 } 857 return res; 858 } 859 #define MSAN_MAYBE_INTERCEPT_EPOLL_WAIT INTERCEPT_FUNCTION(epoll_wait) 860 #else 861 #define MSAN_MAYBE_INTERCEPT_EPOLL_WAIT 862 #endif 863 864 #if !SANITIZER_FREEBSD && !SANITIZER_NETBSD 865 INTERCEPTOR(int, epoll_pwait, int epfd, void *events, int maxevents, 866 int timeout, void *sigmask) { 867 ENSURE_MSAN_INITED(); 868 int res = REAL(epoll_pwait)(epfd, events, maxevents, timeout, sigmask); 869 if (res > 0) { 870 __msan_unpoison(events, __sanitizer::struct_epoll_event_sz * res); 871 } 872 return res; 873 } 874 #define MSAN_MAYBE_INTERCEPT_EPOLL_PWAIT INTERCEPT_FUNCTION(epoll_pwait) 875 #else 876 #define MSAN_MAYBE_INTERCEPT_EPOLL_PWAIT 877 #endif 878 879 INTERCEPTOR(void *, calloc, SIZE_T nmemb, SIZE_T size) { 880 GET_MALLOC_STACK_TRACE; 881 if (UNLIKELY(!msan_inited)) 882 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym. 883 return AllocateFromLocalPool(nmemb * size); 884 return msan_calloc(nmemb, size, &stack); 885 } 886 887 INTERCEPTOR(void *, realloc, void *ptr, SIZE_T size) { 888 GET_MALLOC_STACK_TRACE; 889 if (UNLIKELY(IsInDlsymAllocPool(ptr))) { 890 uptr offset = (uptr)ptr - (uptr)alloc_memory_for_dlsym; 891 uptr copy_size = Min(size, kDlsymAllocPoolSize - offset); 892 void *new_ptr; 893 if (UNLIKELY(!msan_inited)) { 894 new_ptr = AllocateFromLocalPool(copy_size); 895 } else { 896 copy_size = size; 897 new_ptr = msan_malloc(copy_size, &stack); 898 } 899 internal_memcpy(new_ptr, ptr, copy_size); 900 return new_ptr; 901 } 902 return msan_realloc(ptr, size, &stack); 903 } 904 905 INTERCEPTOR(void *, reallocarray, void *ptr, SIZE_T nmemb, SIZE_T size) { 906 GET_MALLOC_STACK_TRACE; 907 return msan_reallocarray(ptr, nmemb, size, &stack); 908 } 909 910 INTERCEPTOR(void *, malloc, SIZE_T size) { 911 GET_MALLOC_STACK_TRACE; 912 if (UNLIKELY(!msan_inited)) 913 // Hack: dlsym calls malloc before REAL(malloc) is retrieved from dlsym. 914 return AllocateFromLocalPool(size); 915 return msan_malloc(size, &stack); 916 } 917 918 void __msan_allocated_memory(const void *data, uptr size) { 919 GET_MALLOC_STACK_TRACE; 920 if (flags()->poison_in_malloc) { 921 stack.tag = STACK_TRACE_TAG_POISON; 922 PoisonMemory(data, size, &stack); 923 } 924 } 925 926 void __msan_copy_shadow(void *dest, const void *src, uptr n) { 927 GET_STORE_STACK_TRACE; 928 MoveShadowAndOrigin(dest, src, n, &stack); 929 } 930 931 void __sanitizer_dtor_callback(const void *data, uptr size) { 932 GET_MALLOC_STACK_TRACE; 933 if (flags()->poison_in_dtor) { 934 stack.tag = STACK_TRACE_TAG_POISON; 935 PoisonMemory(data, size, &stack); 936 } 937 } 938 939 template <class Mmap> 940 static void *mmap_interceptor(Mmap real_mmap, void *addr, SIZE_T length, 941 int prot, int flags, int fd, OFF64_T offset) { 942 SIZE_T rounded_length = RoundUpTo(length, GetPageSize()); 943 void *end_addr = (char *)addr + (rounded_length - 1); 944 if (addr && (!MEM_IS_APP(addr) || !MEM_IS_APP(end_addr))) { 945 if (flags & map_fixed) { 946 errno = errno_EINVAL; 947 return (void *)-1; 948 } else { 949 addr = nullptr; 950 } 951 } 952 void *res = real_mmap(addr, length, prot, flags, fd, offset); 953 if (res != (void *)-1) { 954 void *end_res = (char *)res + (rounded_length - 1); 955 if (MEM_IS_APP(res) && MEM_IS_APP(end_res)) { 956 __msan_unpoison(res, rounded_length); 957 } else { 958 // Application has attempted to map more memory than is supported by 959 // MSAN. Act as if we ran out of memory. 960 internal_munmap(res, length); 961 errno = errno_ENOMEM; 962 return (void *)-1; 963 } 964 } 965 return res; 966 } 967 968 INTERCEPTOR(int, getrusage, int who, void *usage) { 969 ENSURE_MSAN_INITED(); 970 int res = REAL(getrusage)(who, usage); 971 if (res == 0) { 972 __msan_unpoison(usage, __sanitizer::struct_rusage_sz); 973 } 974 return res; 975 } 976 977 class SignalHandlerScope { 978 public: 979 SignalHandlerScope() { 980 if (MsanThread *t = GetCurrentThread()) 981 t->EnterSignalHandler(); 982 } 983 ~SignalHandlerScope() { 984 if (MsanThread *t = GetCurrentThread()) 985 t->LeaveSignalHandler(); 986 } 987 }; 988 989 // sigactions_mu guarantees atomicity of sigaction() and signal() calls. 990 // Access to sigactions[] is gone with relaxed atomics to avoid data race with 991 // the signal handler. 992 const int kMaxSignals = 1024; 993 static atomic_uintptr_t sigactions[kMaxSignals]; 994 static StaticSpinMutex sigactions_mu; 995 996 static void SignalHandler(int signo) { 997 SignalHandlerScope signal_handler_scope; 998 ScopedThreadLocalStateBackup stlsb; 999 UnpoisonParam(1); 1000 1001 typedef void (*signal_cb)(int x); 1002 signal_cb cb = 1003 (signal_cb)atomic_load(&sigactions[signo], memory_order_relaxed); 1004 cb(signo); 1005 } 1006 1007 static void SignalAction(int signo, void *si, void *uc) { 1008 SignalHandlerScope signal_handler_scope; 1009 ScopedThreadLocalStateBackup stlsb; 1010 UnpoisonParam(3); 1011 __msan_unpoison(si, sizeof(__sanitizer_sigaction)); 1012 __msan_unpoison(uc, __sanitizer::ucontext_t_sz); 1013 1014 typedef void (*sigaction_cb)(int, void *, void *); 1015 sigaction_cb cb = 1016 (sigaction_cb)atomic_load(&sigactions[signo], memory_order_relaxed); 1017 cb(signo, si, uc); 1018 } 1019 1020 static void read_sigaction(const __sanitizer_sigaction *act) { 1021 CHECK_UNPOISONED(&act->sa_flags, sizeof(act->sa_flags)); 1022 if (act->sa_flags & __sanitizer::sa_siginfo) 1023 CHECK_UNPOISONED(&act->sigaction, sizeof(act->sigaction)); 1024 else 1025 CHECK_UNPOISONED(&act->handler, sizeof(act->handler)); 1026 CHECK_UNPOISONED(&act->sa_mask, sizeof(act->sa_mask)); 1027 } 1028 1029 extern "C" int pthread_attr_init(void *attr); 1030 extern "C" int pthread_attr_destroy(void *attr); 1031 1032 static void *MsanThreadStartFunc(void *arg) { 1033 MsanThread *t = (MsanThread *)arg; 1034 SetCurrentThread(t); 1035 return t->ThreadStart(); 1036 } 1037 1038 INTERCEPTOR(int, pthread_create, void *th, void *attr, void *(*callback)(void*), 1039 void * param) { 1040 ENSURE_MSAN_INITED(); // for GetTlsSize() 1041 __sanitizer_pthread_attr_t myattr; 1042 if (!attr) { 1043 pthread_attr_init(&myattr); 1044 attr = &myattr; 1045 } 1046 1047 AdjustStackSize(attr); 1048 1049 MsanThread *t = MsanThread::Create(callback, param); 1050 1051 int res = REAL(pthread_create)(th, attr, MsanThreadStartFunc, t); 1052 1053 if (attr == &myattr) 1054 pthread_attr_destroy(&myattr); 1055 if (!res) { 1056 __msan_unpoison(th, __sanitizer::pthread_t_sz); 1057 } 1058 return res; 1059 } 1060 1061 INTERCEPTOR(int, pthread_key_create, __sanitizer_pthread_key_t *key, 1062 void (*dtor)(void *value)) { 1063 if (msan_init_is_running) return REAL(pthread_key_create)(key, dtor); 1064 ENSURE_MSAN_INITED(); 1065 int res = REAL(pthread_key_create)(key, dtor); 1066 if (!res && key) 1067 __msan_unpoison(key, sizeof(*key)); 1068 return res; 1069 } 1070 1071 #if SANITIZER_NETBSD 1072 INTERCEPTOR(int, __libc_thr_keycreate, __sanitizer_pthread_key_t *m, 1073 void (*dtor)(void *value)) 1074 ALIAS(WRAPPER_NAME(pthread_key_create)); 1075 #endif 1076 1077 INTERCEPTOR(int, pthread_join, void *th, void **retval) { 1078 ENSURE_MSAN_INITED(); 1079 int res = REAL(pthread_join)(th, retval); 1080 if (!res && retval) 1081 __msan_unpoison(retval, sizeof(*retval)); 1082 return res; 1083 } 1084 1085 extern char *tzname[2]; 1086 1087 INTERCEPTOR(void, tzset, int fake) { 1088 ENSURE_MSAN_INITED(); 1089 InterceptorScope interceptor_scope; 1090 REAL(tzset)(fake); 1091 if (tzname[0]) 1092 __msan_unpoison(tzname[0], internal_strlen(tzname[0]) + 1); 1093 if (tzname[1]) 1094 __msan_unpoison(tzname[1], internal_strlen(tzname[1]) + 1); 1095 return; 1096 } 1097 1098 struct MSanAtExitRecord { 1099 void (*func)(void *arg); 1100 void *arg; 1101 }; 1102 1103 struct InterceptorContext { 1104 Mutex atexit_mu; 1105 Vector<struct MSanAtExitRecord *> AtExitStack; 1106 1107 InterceptorContext() 1108 : AtExitStack() { 1109 } 1110 }; 1111 1112 static ALIGNED(64) char interceptor_placeholder[sizeof(InterceptorContext)]; 1113 InterceptorContext *interceptor_ctx() { 1114 return reinterpret_cast<InterceptorContext*>(&interceptor_placeholder[0]); 1115 } 1116 1117 void MSanAtExitWrapper() { 1118 MSanAtExitRecord *r; 1119 { 1120 Lock l(&interceptor_ctx()->atexit_mu); 1121 1122 uptr element = interceptor_ctx()->AtExitStack.Size() - 1; 1123 r = interceptor_ctx()->AtExitStack[element]; 1124 interceptor_ctx()->AtExitStack.PopBack(); 1125 } 1126 1127 UnpoisonParam(1); 1128 ((void(*)())r->func)(); 1129 InternalFree(r); 1130 } 1131 1132 void MSanCxaAtExitWrapper(void *arg) { 1133 UnpoisonParam(1); 1134 MSanAtExitRecord *r = (MSanAtExitRecord *)arg; 1135 // libc before 2.27 had race which caused occasional double handler execution 1136 // https://sourceware.org/ml/libc-alpha/2017-08/msg01204.html 1137 if (!r->func) 1138 return; 1139 r->func(r->arg); 1140 r->func = nullptr; 1141 } 1142 1143 static int setup_at_exit_wrapper(void(*f)(), void *arg, void *dso); 1144 1145 // Unpoison argument shadow for C++ module destructors. 1146 INTERCEPTOR(int, __cxa_atexit, void (*func)(void *), void *arg, 1147 void *dso_handle) { 1148 if (msan_init_is_running) return REAL(__cxa_atexit)(func, arg, dso_handle); 1149 return setup_at_exit_wrapper((void(*)())func, arg, dso_handle); 1150 } 1151 1152 // Unpoison argument shadow for C++ module destructors. 1153 INTERCEPTOR(int, atexit, void (*func)()) { 1154 // Avoid calling real atexit as it is unreachable on at least on Linux. 1155 if (msan_init_is_running) 1156 return REAL(__cxa_atexit)((void (*)(void *a))func, 0, 0); 1157 return setup_at_exit_wrapper((void(*)())func, 0, 0); 1158 } 1159 1160 static int setup_at_exit_wrapper(void(*f)(), void *arg, void *dso) { 1161 ENSURE_MSAN_INITED(); 1162 MSanAtExitRecord *r = 1163 (MSanAtExitRecord *)InternalAlloc(sizeof(MSanAtExitRecord)); 1164 r->func = (void(*)(void *a))f; 1165 r->arg = arg; 1166 int res; 1167 if (!dso) { 1168 // NetBSD does not preserve the 2nd argument if dso is equal to 0 1169 // Store ctx in a local stack-like structure 1170 1171 Lock l(&interceptor_ctx()->atexit_mu); 1172 1173 res = REAL(__cxa_atexit)((void (*)(void *a))MSanAtExitWrapper, 0, 0); 1174 if (!res) { 1175 interceptor_ctx()->AtExitStack.PushBack(r); 1176 } 1177 } else { 1178 res = REAL(__cxa_atexit)(MSanCxaAtExitWrapper, r, dso); 1179 } 1180 return res; 1181 } 1182 1183 static void BeforeFork() { 1184 StackDepotLockAll(); 1185 ChainedOriginDepotLockAll(); 1186 } 1187 1188 static void AfterFork() { 1189 ChainedOriginDepotUnlockAll(); 1190 StackDepotUnlockAll(); 1191 } 1192 1193 INTERCEPTOR(int, fork, void) { 1194 ENSURE_MSAN_INITED(); 1195 BeforeFork(); 1196 int pid = REAL(fork)(); 1197 AfterFork(); 1198 return pid; 1199 } 1200 1201 // NetBSD ships with openpty(3) in -lutil, that needs to be prebuilt explicitly 1202 // with MSan. 1203 #if SANITIZER_LINUX 1204 INTERCEPTOR(int, openpty, int *aparent, int *aworker, char *name, 1205 const void *termp, const void *winp) { 1206 ENSURE_MSAN_INITED(); 1207 InterceptorScope interceptor_scope; 1208 int res = REAL(openpty)(aparent, aworker, name, termp, winp); 1209 if (!res) { 1210 __msan_unpoison(aparent, sizeof(*aparent)); 1211 __msan_unpoison(aworker, sizeof(*aworker)); 1212 } 1213 return res; 1214 } 1215 #define MSAN_MAYBE_INTERCEPT_OPENPTY INTERCEPT_FUNCTION(openpty) 1216 #else 1217 #define MSAN_MAYBE_INTERCEPT_OPENPTY 1218 #endif 1219 1220 // NetBSD ships with forkpty(3) in -lutil, that needs to be prebuilt explicitly 1221 // with MSan. 1222 #if SANITIZER_LINUX 1223 INTERCEPTOR(int, forkpty, int *aparent, char *name, const void *termp, 1224 const void *winp) { 1225 ENSURE_MSAN_INITED(); 1226 InterceptorScope interceptor_scope; 1227 int res = REAL(forkpty)(aparent, name, termp, winp); 1228 if (res != -1) 1229 __msan_unpoison(aparent, sizeof(*aparent)); 1230 return res; 1231 } 1232 #define MSAN_MAYBE_INTERCEPT_FORKPTY INTERCEPT_FUNCTION(forkpty) 1233 #else 1234 #define MSAN_MAYBE_INTERCEPT_FORKPTY 1235 #endif 1236 1237 struct MSanInterceptorContext { 1238 bool in_interceptor_scope; 1239 }; 1240 1241 namespace __msan { 1242 1243 int OnExit() { 1244 // FIXME: ask frontend whether we need to return failure. 1245 return 0; 1246 } 1247 1248 } // namespace __msan 1249 1250 // A version of CHECK_UNPOISONED using a saved scope value. Used in common 1251 // interceptors. 1252 #define CHECK_UNPOISONED_CTX(ctx, x, n) \ 1253 do { \ 1254 if (!((MSanInterceptorContext *)ctx)->in_interceptor_scope) \ 1255 CHECK_UNPOISONED_0(x, n); \ 1256 } while (0) 1257 1258 #define MSAN_INTERCEPT_FUNC(name) \ 1259 do { \ 1260 if (!INTERCEPT_FUNCTION(name)) \ 1261 VReport(1, "MemorySanitizer: failed to intercept '%s'\n", #name); \ 1262 } while (0) 1263 1264 #define MSAN_INTERCEPT_FUNC_VER(name, ver) \ 1265 do { \ 1266 if (!INTERCEPT_FUNCTION_VER(name, ver)) \ 1267 VReport(1, "MemorySanitizer: failed to intercept '%s@@%s'\n", #name, \ 1268 ver); \ 1269 } while (0) 1270 #define MSAN_INTERCEPT_FUNC_VER_UNVERSIONED_FALLBACK(name, ver) \ 1271 do { \ 1272 if (!INTERCEPT_FUNCTION_VER(name, ver) && !INTERCEPT_FUNCTION(name)) \ 1273 VReport(1, "MemorySanitizer: failed to intercept '%s@@%s' or '%s'\n", \ 1274 #name, ver, #name); \ 1275 } while (0) 1276 1277 #define COMMON_INTERCEPT_FUNCTION(name) MSAN_INTERCEPT_FUNC(name) 1278 #define COMMON_INTERCEPT_FUNCTION_VER(name, ver) \ 1279 MSAN_INTERCEPT_FUNC_VER(name, ver) 1280 #define COMMON_INTERCEPT_FUNCTION_VER_UNVERSIONED_FALLBACK(name, ver) \ 1281 MSAN_INTERCEPT_FUNC_VER_UNVERSIONED_FALLBACK(name, ver) 1282 #define COMMON_INTERCEPTOR_UNPOISON_PARAM(count) \ 1283 UnpoisonParam(count) 1284 #define COMMON_INTERCEPTOR_WRITE_RANGE(ctx, ptr, size) \ 1285 __msan_unpoison(ptr, size) 1286 #define COMMON_INTERCEPTOR_READ_RANGE(ctx, ptr, size) \ 1287 CHECK_UNPOISONED_CTX(ctx, ptr, size) 1288 #define COMMON_INTERCEPTOR_INITIALIZE_RANGE(ptr, size) \ 1289 __msan_unpoison(ptr, size) 1290 #define COMMON_INTERCEPTOR_ENTER(ctx, func, ...) \ 1291 if (msan_init_is_running) \ 1292 return REAL(func)(__VA_ARGS__); \ 1293 ENSURE_MSAN_INITED(); \ 1294 MSanInterceptorContext msan_ctx = {IsInInterceptorScope()}; \ 1295 ctx = (void *)&msan_ctx; \ 1296 (void)ctx; \ 1297 InterceptorScope interceptor_scope; \ 1298 __msan_unpoison(__errno_location(), sizeof(int)); 1299 #define COMMON_INTERCEPTOR_DIR_ACQUIRE(ctx, path) \ 1300 do { \ 1301 } while (false) 1302 #define COMMON_INTERCEPTOR_FD_ACQUIRE(ctx, fd) \ 1303 do { \ 1304 } while (false) 1305 #define COMMON_INTERCEPTOR_FD_RELEASE(ctx, fd) \ 1306 do { \ 1307 } while (false) 1308 #define COMMON_INTERCEPTOR_FD_SOCKET_ACCEPT(ctx, fd, newfd) \ 1309 do { \ 1310 } while (false) 1311 #define COMMON_INTERCEPTOR_SET_THREAD_NAME(ctx, name) \ 1312 do { \ 1313 } while (false) // FIXME 1314 #define COMMON_INTERCEPTOR_SET_PTHREAD_NAME(ctx, thread, name) \ 1315 do { \ 1316 } while (false) // FIXME 1317 #define COMMON_INTERCEPTOR_BLOCK_REAL(name) REAL(name) 1318 #define COMMON_INTERCEPTOR_ON_EXIT(ctx) OnExit() 1319 #define COMMON_INTERCEPTOR_LIBRARY_LOADED(filename, handle) \ 1320 do { \ 1321 link_map *map = GET_LINK_MAP_BY_DLOPEN_HANDLE((handle)); \ 1322 if (filename && map) \ 1323 ForEachMappedRegion(map, __msan_unpoison); \ 1324 } while (false) 1325 1326 #define COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED (!msan_inited) 1327 1328 #define COMMON_INTERCEPTOR_GET_TLS_RANGE(begin, end) \ 1329 if (MsanThread *t = GetCurrentThread()) { \ 1330 *begin = t->tls_begin(); \ 1331 *end = t->tls_end(); \ 1332 } else { \ 1333 *begin = *end = 0; \ 1334 } 1335 1336 #define COMMON_INTERCEPTOR_MEMSET_IMPL(ctx, block, c, size) \ 1337 { \ 1338 (void)ctx; \ 1339 return __msan_memset(block, c, size); \ 1340 } 1341 #define COMMON_INTERCEPTOR_MEMMOVE_IMPL(ctx, to, from, size) \ 1342 { \ 1343 (void)ctx; \ 1344 return __msan_memmove(to, from, size); \ 1345 } 1346 #define COMMON_INTERCEPTOR_MEMCPY_IMPL(ctx, to, from, size) \ 1347 { \ 1348 (void)ctx; \ 1349 return __msan_memcpy(to, from, size); \ 1350 } 1351 1352 #define COMMON_INTERCEPTOR_COPY_STRING(ctx, to, from, size) \ 1353 do { \ 1354 GET_STORE_STACK_TRACE; \ 1355 CopyShadowAndOrigin(to, from, size, &stack); \ 1356 __msan_unpoison(to + size, 1); \ 1357 } while (false) 1358 1359 #define COMMON_INTERCEPTOR_MMAP_IMPL(ctx, mmap, addr, length, prot, flags, fd, \ 1360 offset) \ 1361 do { \ 1362 return mmap_interceptor(REAL(mmap), addr, sz, prot, flags, fd, off); \ 1363 } while (false) 1364 1365 #include "sanitizer_common/sanitizer_platform_interceptors.h" 1366 #include "sanitizer_common/sanitizer_common_interceptors.inc" 1367 1368 static uptr signal_impl(int signo, uptr cb); 1369 static int sigaction_impl(int signo, const __sanitizer_sigaction *act, 1370 __sanitizer_sigaction *oldact); 1371 1372 #define SIGNAL_INTERCEPTOR_SIGACTION_IMPL(signo, act, oldact) \ 1373 { return sigaction_impl(signo, act, oldact); } 1374 1375 #define SIGNAL_INTERCEPTOR_SIGNAL_IMPL(func, signo, handler) \ 1376 { \ 1377 handler = signal_impl(signo, handler); \ 1378 InterceptorScope interceptor_scope; \ 1379 return REAL(func)(signo, handler); \ 1380 } 1381 1382 #include "sanitizer_common/sanitizer_signal_interceptors.inc" 1383 1384 static int sigaction_impl(int signo, const __sanitizer_sigaction *act, 1385 __sanitizer_sigaction *oldact) { 1386 ENSURE_MSAN_INITED(); 1387 if (signo <= 0 || signo >= kMaxSignals) { 1388 errno = errno_EINVAL; 1389 return -1; 1390 } 1391 if (act) read_sigaction(act); 1392 int res; 1393 if (flags()->wrap_signals) { 1394 SpinMutexLock lock(&sigactions_mu); 1395 uptr old_cb = atomic_load(&sigactions[signo], memory_order_relaxed); 1396 __sanitizer_sigaction new_act; 1397 __sanitizer_sigaction *pnew_act = act ? &new_act : nullptr; 1398 if (act) { 1399 REAL(memcpy)(pnew_act, act, sizeof(__sanitizer_sigaction)); 1400 uptr cb = (uptr)pnew_act->sigaction; 1401 uptr new_cb = (pnew_act->sa_flags & __sanitizer::sa_siginfo) 1402 ? (uptr)SignalAction 1403 : (uptr)SignalHandler; 1404 if (cb != __sanitizer::sig_ign && cb != __sanitizer::sig_dfl) { 1405 atomic_store(&sigactions[signo], cb, memory_order_relaxed); 1406 pnew_act->sigaction = (decltype(pnew_act->sigaction))new_cb; 1407 } 1408 } 1409 res = REAL(SIGACTION_SYMNAME)(signo, pnew_act, oldact); 1410 if (res == 0 && oldact) { 1411 uptr cb = (uptr)oldact->sigaction; 1412 if (cb == (uptr)SignalAction || cb == (uptr)SignalHandler) { 1413 oldact->sigaction = (decltype(oldact->sigaction))old_cb; 1414 } 1415 } 1416 } else { 1417 res = REAL(SIGACTION_SYMNAME)(signo, act, oldact); 1418 } 1419 1420 if (res == 0 && oldact) { 1421 __msan_unpoison(oldact, sizeof(__sanitizer_sigaction)); 1422 } 1423 return res; 1424 } 1425 1426 static uptr signal_impl(int signo, uptr cb) { 1427 ENSURE_MSAN_INITED(); 1428 if (signo <= 0 || signo >= kMaxSignals) { 1429 errno = errno_EINVAL; 1430 return -1; 1431 } 1432 if (flags()->wrap_signals) { 1433 SpinMutexLock lock(&sigactions_mu); 1434 if (cb != __sanitizer::sig_ign && cb != __sanitizer::sig_dfl) { 1435 atomic_store(&sigactions[signo], cb, memory_order_relaxed); 1436 cb = (uptr)&SignalHandler; 1437 } 1438 } 1439 return cb; 1440 } 1441 1442 #define COMMON_SYSCALL_PRE_READ_RANGE(p, s) CHECK_UNPOISONED(p, s) 1443 #define COMMON_SYSCALL_PRE_WRITE_RANGE(p, s) \ 1444 do { \ 1445 } while (false) 1446 #define COMMON_SYSCALL_POST_READ_RANGE(p, s) \ 1447 do { \ 1448 } while (false) 1449 #define COMMON_SYSCALL_POST_WRITE_RANGE(p, s) __msan_unpoison(p, s) 1450 #include "sanitizer_common/sanitizer_common_syscalls.inc" 1451 #include "sanitizer_common/sanitizer_syscalls_netbsd.inc" 1452 1453 struct dlinfo { 1454 char *dli_fname; 1455 void *dli_fbase; 1456 char *dli_sname; 1457 void *dli_saddr; 1458 }; 1459 1460 INTERCEPTOR(int, dladdr, void *addr, dlinfo *info) { 1461 void *ctx; 1462 COMMON_INTERCEPTOR_ENTER(ctx, dladdr, addr, info); 1463 int res = REAL(dladdr)(addr, info); 1464 if (res != 0) { 1465 __msan_unpoison(info, sizeof(*info)); 1466 if (info->dli_fname) 1467 __msan_unpoison(info->dli_fname, internal_strlen(info->dli_fname) + 1); 1468 if (info->dli_sname) 1469 __msan_unpoison(info->dli_sname, internal_strlen(info->dli_sname) + 1); 1470 } 1471 return res; 1472 } 1473 1474 INTERCEPTOR(char *, dlerror, int fake) { 1475 void *ctx; 1476 COMMON_INTERCEPTOR_ENTER(ctx, dlerror, fake); 1477 char *res = REAL(dlerror)(fake); 1478 if (res) 1479 __msan_unpoison(res, internal_strlen(res) + 1); 1480 return res; 1481 } 1482 1483 typedef int (*dl_iterate_phdr_cb)(__sanitizer_dl_phdr_info *info, SIZE_T size, 1484 void *data); 1485 struct dl_iterate_phdr_data { 1486 dl_iterate_phdr_cb callback; 1487 void *data; 1488 }; 1489 1490 static int msan_dl_iterate_phdr_cb(__sanitizer_dl_phdr_info *info, SIZE_T size, 1491 void *data) { 1492 if (info) { 1493 __msan_unpoison(info, size); 1494 if (info->dlpi_phdr && info->dlpi_phnum) 1495 __msan_unpoison(info->dlpi_phdr, struct_ElfW_Phdr_sz * info->dlpi_phnum); 1496 if (info->dlpi_name) 1497 __msan_unpoison(info->dlpi_name, internal_strlen(info->dlpi_name) + 1); 1498 } 1499 dl_iterate_phdr_data *cbdata = (dl_iterate_phdr_data *)data; 1500 UnpoisonParam(3); 1501 return cbdata->callback(info, size, cbdata->data); 1502 } 1503 1504 INTERCEPTOR(void *, shmat, int shmid, const void *shmaddr, int shmflg) { 1505 ENSURE_MSAN_INITED(); 1506 void *p = REAL(shmat)(shmid, shmaddr, shmflg); 1507 if (p != (void *)-1) { 1508 __sanitizer_shmid_ds ds; 1509 int res = REAL(shmctl)(shmid, shmctl_ipc_stat, &ds); 1510 if (!res) { 1511 __msan_unpoison(p, ds.shm_segsz); 1512 } 1513 } 1514 return p; 1515 } 1516 1517 INTERCEPTOR(int, dl_iterate_phdr, dl_iterate_phdr_cb callback, void *data) { 1518 void *ctx; 1519 COMMON_INTERCEPTOR_ENTER(ctx, dl_iterate_phdr, callback, data); 1520 dl_iterate_phdr_data cbdata; 1521 cbdata.callback = callback; 1522 cbdata.data = data; 1523 int res = REAL(dl_iterate_phdr)(msan_dl_iterate_phdr_cb, (void *)&cbdata); 1524 return res; 1525 } 1526 1527 // wchar_t *wcschr(const wchar_t *wcs, wchar_t wc); 1528 INTERCEPTOR(wchar_t *, wcschr, void *s, wchar_t wc, void *ps) { 1529 ENSURE_MSAN_INITED(); 1530 wchar_t *res = REAL(wcschr)(s, wc, ps); 1531 return res; 1532 } 1533 1534 // wchar_t *wcscpy(wchar_t *dest, const wchar_t *src); 1535 INTERCEPTOR(wchar_t *, wcscpy, wchar_t *dest, const wchar_t *src) { 1536 ENSURE_MSAN_INITED(); 1537 GET_STORE_STACK_TRACE; 1538 wchar_t *res = REAL(wcscpy)(dest, src); 1539 CopyShadowAndOrigin(dest, src, sizeof(wchar_t) * (internal_wcslen(src) + 1), 1540 &stack); 1541 return res; 1542 } 1543 1544 INTERCEPTOR(wchar_t *, wcsncpy, wchar_t *dest, const wchar_t *src, SIZE_T n) { 1545 ENSURE_MSAN_INITED(); 1546 GET_STORE_STACK_TRACE; 1547 SIZE_T copy_size = internal_wcsnlen(src, n); 1548 if (copy_size < n) copy_size++; // trailing \0 1549 wchar_t *res = REAL(wcsncpy)(dest, src, n); 1550 CopyShadowAndOrigin(dest, src, copy_size * sizeof(wchar_t), &stack); 1551 __msan_unpoison(dest + copy_size, (n - copy_size) * sizeof(wchar_t)); 1552 return res; 1553 } 1554 1555 // These interface functions reside here so that they can use 1556 // REAL(memset), etc. 1557 void __msan_unpoison(const void *a, uptr size) { 1558 if (!MEM_IS_APP(a)) return; 1559 SetShadow(a, size, 0); 1560 } 1561 1562 void __msan_poison(const void *a, uptr size) { 1563 if (!MEM_IS_APP(a)) return; 1564 SetShadow(a, size, __msan::flags()->poison_heap_with_zeroes ? 0 : -1); 1565 } 1566 1567 void __msan_poison_stack(void *a, uptr size) { 1568 if (!MEM_IS_APP(a)) return; 1569 SetShadow(a, size, __msan::flags()->poison_stack_with_zeroes ? 0 : -1); 1570 } 1571 1572 void __msan_unpoison_param(uptr n) { UnpoisonParam(n); } 1573 1574 void __msan_clear_and_unpoison(void *a, uptr size) { 1575 REAL(memset)(a, 0, size); 1576 SetShadow(a, size, 0); 1577 } 1578 1579 void *__msan_memcpy(void *dest, const void *src, SIZE_T n) { 1580 if (!msan_inited) return internal_memcpy(dest, src, n); 1581 if (msan_init_is_running || __msan::IsInSymbolizer()) 1582 return REAL(memcpy)(dest, src, n); 1583 ENSURE_MSAN_INITED(); 1584 GET_STORE_STACK_TRACE; 1585 void *res = REAL(memcpy)(dest, src, n); 1586 CopyShadowAndOrigin(dest, src, n, &stack); 1587 return res; 1588 } 1589 1590 void *__msan_memset(void *s, int c, SIZE_T n) { 1591 if (!msan_inited) return internal_memset(s, c, n); 1592 if (msan_init_is_running) return REAL(memset)(s, c, n); 1593 ENSURE_MSAN_INITED(); 1594 void *res = REAL(memset)(s, c, n); 1595 __msan_unpoison(s, n); 1596 return res; 1597 } 1598 1599 void *__msan_memmove(void *dest, const void *src, SIZE_T n) { 1600 if (!msan_inited) return internal_memmove(dest, src, n); 1601 if (msan_init_is_running) return REAL(memmove)(dest, src, n); 1602 ENSURE_MSAN_INITED(); 1603 GET_STORE_STACK_TRACE; 1604 void *res = REAL(memmove)(dest, src, n); 1605 MoveShadowAndOrigin(dest, src, n, &stack); 1606 return res; 1607 } 1608 1609 void __msan_unpoison_string(const char* s) { 1610 if (!MEM_IS_APP(s)) return; 1611 __msan_unpoison(s, internal_strlen(s) + 1); 1612 } 1613 1614 namespace __msan { 1615 1616 void InitializeInterceptors() { 1617 static int inited = 0; 1618 CHECK_EQ(inited, 0); 1619 1620 new(interceptor_ctx()) InterceptorContext(); 1621 1622 InitializeCommonInterceptors(); 1623 InitializeSignalInterceptors(); 1624 1625 INTERCEPT_FUNCTION(posix_memalign); 1626 MSAN_MAYBE_INTERCEPT_MEMALIGN; 1627 MSAN_MAYBE_INTERCEPT___LIBC_MEMALIGN; 1628 INTERCEPT_FUNCTION(valloc); 1629 MSAN_MAYBE_INTERCEPT_PVALLOC; 1630 INTERCEPT_FUNCTION(malloc); 1631 INTERCEPT_FUNCTION(calloc); 1632 INTERCEPT_FUNCTION(realloc); 1633 INTERCEPT_FUNCTION(reallocarray); 1634 INTERCEPT_FUNCTION(free); 1635 MSAN_MAYBE_INTERCEPT_CFREE; 1636 MSAN_MAYBE_INTERCEPT_MALLOC_USABLE_SIZE; 1637 MSAN_MAYBE_INTERCEPT_MALLINFO; 1638 MSAN_MAYBE_INTERCEPT_MALLOPT; 1639 MSAN_MAYBE_INTERCEPT_MALLOC_STATS; 1640 INTERCEPT_FUNCTION(fread); 1641 MSAN_MAYBE_INTERCEPT_FREAD_UNLOCKED; 1642 INTERCEPT_FUNCTION(memccpy); 1643 MSAN_MAYBE_INTERCEPT_MEMPCPY; 1644 INTERCEPT_FUNCTION(bcopy); 1645 INTERCEPT_FUNCTION(wmemset); 1646 INTERCEPT_FUNCTION(wmemcpy); 1647 MSAN_MAYBE_INTERCEPT_WMEMPCPY; 1648 INTERCEPT_FUNCTION(wmemmove); 1649 INTERCEPT_FUNCTION(strcpy); 1650 MSAN_MAYBE_INTERCEPT_STPCPY; 1651 INTERCEPT_FUNCTION(strdup); 1652 MSAN_MAYBE_INTERCEPT___STRDUP; 1653 INTERCEPT_FUNCTION(strncpy); 1654 MSAN_MAYBE_INTERCEPT_GCVT; 1655 INTERCEPT_FUNCTION(strcat); 1656 INTERCEPT_FUNCTION(strncat); 1657 INTERCEPT_STRTO(strtod); 1658 INTERCEPT_STRTO(strtof); 1659 INTERCEPT_STRTO(strtold); 1660 INTERCEPT_STRTO(strtol); 1661 INTERCEPT_STRTO(strtoul); 1662 INTERCEPT_STRTO(strtoll); 1663 INTERCEPT_STRTO(strtoull); 1664 INTERCEPT_STRTO(strtouq); 1665 INTERCEPT_STRTO(wcstod); 1666 INTERCEPT_STRTO(wcstof); 1667 INTERCEPT_STRTO(wcstold); 1668 INTERCEPT_STRTO(wcstol); 1669 INTERCEPT_STRTO(wcstoul); 1670 INTERCEPT_STRTO(wcstoll); 1671 INTERCEPT_STRTO(wcstoull); 1672 #ifdef SANITIZER_NLDBL_VERSION 1673 INTERCEPT_FUNCTION_VER(vswprintf, SANITIZER_NLDBL_VERSION); 1674 INTERCEPT_FUNCTION_VER(swprintf, SANITIZER_NLDBL_VERSION); 1675 #else 1676 INTERCEPT_FUNCTION(vswprintf); 1677 INTERCEPT_FUNCTION(swprintf); 1678 #endif 1679 INTERCEPT_FUNCTION(strftime); 1680 INTERCEPT_FUNCTION(strftime_l); 1681 MSAN_MAYBE_INTERCEPT___STRFTIME_L; 1682 INTERCEPT_FUNCTION(wcsftime); 1683 INTERCEPT_FUNCTION(wcsftime_l); 1684 MSAN_MAYBE_INTERCEPT___WCSFTIME_L; 1685 INTERCEPT_FUNCTION(mbtowc); 1686 INTERCEPT_FUNCTION(mbrtowc); 1687 INTERCEPT_FUNCTION(wcslen); 1688 INTERCEPT_FUNCTION(wcsnlen); 1689 INTERCEPT_FUNCTION(wcschr); 1690 INTERCEPT_FUNCTION(wcscpy); 1691 INTERCEPT_FUNCTION(wcsncpy); 1692 INTERCEPT_FUNCTION(wcscmp); 1693 INTERCEPT_FUNCTION(getenv); 1694 INTERCEPT_FUNCTION(setenv); 1695 INTERCEPT_FUNCTION(putenv); 1696 INTERCEPT_FUNCTION(gettimeofday); 1697 MSAN_MAYBE_INTERCEPT_FCVT; 1698 MSAN_MAYBE_INTERCEPT_FSTAT; 1699 MSAN_MAYBE_INTERCEPT___FXSTAT; 1700 MSAN_MAYBE_INTERCEPT_FSTATAT; 1701 MSAN_MAYBE_INTERCEPT___FXSTATAT; 1702 MSAN_MAYBE_INTERCEPT___FXSTAT64; 1703 MSAN_MAYBE_INTERCEPT___FXSTATAT64; 1704 INTERCEPT_FUNCTION(pipe); 1705 INTERCEPT_FUNCTION(pipe2); 1706 INTERCEPT_FUNCTION(socketpair); 1707 MSAN_MAYBE_INTERCEPT_FGETS_UNLOCKED; 1708 INTERCEPT_FUNCTION(getrlimit); 1709 MSAN_MAYBE_INTERCEPT___GETRLIMIT; 1710 MSAN_MAYBE_INTERCEPT_GETRLIMIT64; 1711 MSAN_MAYBE_INTERCEPT_PRLIMIT; 1712 MSAN_MAYBE_INTERCEPT_PRLIMIT64; 1713 INTERCEPT_FUNCTION(gethostname); 1714 MSAN_MAYBE_INTERCEPT_EPOLL_WAIT; 1715 MSAN_MAYBE_INTERCEPT_EPOLL_PWAIT; 1716 INTERCEPT_FUNCTION(dladdr); 1717 INTERCEPT_FUNCTION(dlerror); 1718 INTERCEPT_FUNCTION(dl_iterate_phdr); 1719 INTERCEPT_FUNCTION(getrusage); 1720 #if defined(__mips__) 1721 INTERCEPT_FUNCTION_VER(pthread_create, "GLIBC_2.2"); 1722 #else 1723 INTERCEPT_FUNCTION(pthread_create); 1724 #endif 1725 INTERCEPT_FUNCTION(pthread_key_create); 1726 1727 #if SANITIZER_NETBSD 1728 INTERCEPT_FUNCTION(__libc_thr_keycreate); 1729 #endif 1730 1731 INTERCEPT_FUNCTION(pthread_join); 1732 INTERCEPT_FUNCTION(tzset); 1733 INTERCEPT_FUNCTION(atexit); 1734 INTERCEPT_FUNCTION(__cxa_atexit); 1735 INTERCEPT_FUNCTION(shmat); 1736 INTERCEPT_FUNCTION(fork); 1737 MSAN_MAYBE_INTERCEPT_OPENPTY; 1738 MSAN_MAYBE_INTERCEPT_FORKPTY; 1739 1740 inited = 1; 1741 } 1742 } // namespace __msan 1743