Commit Graph

12 Commits

Author SHA1 Message Date
Matt Morehouse 846ec2c3cc [HWASan] Ensure RNG is initialized in GenerateRandomTag
Fixes a CHECK-failure caused by glibc's pthread_getattr_np
implementation calling realloc.  Essentially, Thread::GenerateRandomTag
gets called during Thread::Init and before Thread::InitRandomState:

  HWAddressSanitizer: CHECK failed: hwasan_thread.cpp:134 "((random_buffer_)) != (0)" (0x0, 0x0) (tid=314)
    #0 0x55845475a662 in __hwasan::CheckUnwind()
    #1 0x558454778797 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long)
    #2 0x558454766461 in __hwasan::Thread::GenerateRandomTag(unsigned long)
    #3 0x55845475c58b in __hwasan::HwasanAllocate(__sanitizer::StackTrace*, unsigned long, unsigned long, bool)
    #4 0x55845475c80a in __hwasan::hwasan_realloc(void*, unsigned long, __sanitizer::StackTrace*)
    #5 0x5584547608aa in realloc
    #6 0x7f6f3a3d8c2c in pthread_getattr_np
    #7 0x5584547790dc in __sanitizer::GetThreadStackTopAndBottom(bool, unsigned long*, unsigned long*)
    #8 0x558454779651 in __sanitizer::GetThreadStackAndTls(bool, unsigned long*, unsigned long*, unsigned long*, unsigned long*)
    #9 0x558454761bca in __hwasan::Thread::InitStackAndTls(__hwasan::Thread::InitState const*)
    #10 0x558454761e5c in __hwasan::HwasanThreadList::CreateCurrentThread(__hwasan::Thread::InitState const*)
    #11 0x55845476184f in __hwasan_thread_enter
    #12 0x558454760def in HwasanThreadStartFunc(void*)
    #13 0x7f6f3a3d6fa2 in start_thread
    #14 0x7f6f3a15b4ce in __clone

Also reverts 7a3fb71c3c, as it's now
unneeded.

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D113045
2021-11-09 07:01:55 -08:00
Evgenii Stepanov 7a3fb71c3c [hwasan] Fix TestCases/thread-uaf.c.
On newer glibc, this test detects an extra match somewhere under
pthread_getattr_np. This results in Thread: lines getting spread out in
the report and failing to match the CHECKs.

Fix the CHECKs to allow this possibility.

Reviewed By: fmayer

Differential Revision: https://reviews.llvm.org/D111841
2021-10-14 14:56:57 -07:00
Florian Mayer b458bb8c04 [hwasan] Display causes in order of probability.
A heap or global buffer that is far away from the faulting address is
unlikely to be the cause, especially if there is a potential
use-after-free as well, so we want to show it after the other
causes.

Reviewed By: eugenis

Differential Revision: https://reviews.llvm.org/D104781
2021-06-29 13:00:05 +01:00
Evgenii Stepanov 523cc097fd [hwasan] Fix Thread reuse (try 2).
HwasanThreadList::DontNeedThread clobbers Thread::next_,
Breaking the freelist. As a result, only the top of the freelist ever
gets reused, and the rest of it is lost.

Since the Thread object with its associated ring buffer is only 8Kb, this is
typically only noticable in long running processes, such as fuzzers.

Fix the problem by switching from an intrusive linked list to a vector.

Differential Revision: https://reviews.llvm.org/D91392
2020-11-18 16:04:08 -08:00
Nico Weber 6ab31eeb62 Revert "[hwasan] Fix Thread reuse."
This reverts commit e1eeb026e6.
Test fails: https://reviews.llvm.org/D91208#2388613
2020-11-11 09:56:21 -05:00
Evgenii Stepanov e1eeb026e6 [hwasan] Fix Thread reuse.
HwasanThreadList::DontNeedThread clobbers Thread::next_, breaking the
freelist. As a result, only the top of the freelist ever gets reused,
and the rest of it is lost.

Since the Thread object its associated ring buffer is only 8Kb, this is
typically only noticable in long running processes, such as fuzzers.

Fix the problem by switching from an intrusive linked list to a vector.

Differential Revision: https://reviews.llvm.org/D91208
2020-11-10 17:24:24 -08:00
Kostya Serebryany a393399741 [hwasan] print all threads in a bug report
llvm-svn: 344174
2018-10-10 18:56:31 +00:00
Kostya Serebryany 3daf3e7072 [hwasan] deflake a test
llvm-svn: 341480
2018-09-05 16:09:53 +00:00
Kostya Serebryany 5d05be84b7 [hwasan] print thread IDs when reporting a bug (also had to fix pthread_create on Linux)
llvm-svn: 341438
2018-09-05 01:16:50 +00:00
Kostya Serebryany 347b989cef [hwasan] fix the linux-only pthread_create interceptor and reinstate the two threaded tests
llvm-svn: 341143
2018-08-30 23:22:26 +00:00
Kostya Serebryany 8f0f36b83f [hwasan] temporarily remove two tests to silence the bots
llvm-svn: 341129
2018-08-30 22:07:09 +00:00
Kostya Serebryany a4132df0ee [hwasan] add a simple threaded UAF test, make it work on x86 (need to disable tagging in malloc with inside pthread_create)
llvm-svn: 341007
2018-08-30 00:44:55 +00:00