[PATCH] D39779: sanitizer_common: Try looking up symbols with RTLD_DEFAULT if RTLD_NEXT does not work.

[Peter Collingbourne via Phabricator via llvm-commits]

pcc created this revision.
Herald added subscribers: kubamracek, srhines.

If the lookup using RTLD_NEXT failed, the sanitizer runtime library
is later in the library search order than the DSO that we are trying
to intercept, which means that we cannot intercept this function. We
still want the address of the real definition, though, so look it up
using RTLD_DEFAULT.


https://reviews.llvm.org/D39779

Files:
  compiler-rt/lib/interception/interception_linux.cc
  compiler-rt/test/ubsan/TestCases/Misc/Inputs/no-interception-dso.c
  compiler-rt/test/ubsan/TestCases/Misc/no-interception.cpp
  compiler-rt/test/ubsan/lit.common.cfg


Index: compiler-rt/test/ubsan/lit.common.cfg
===================================================================
--- compiler-rt/test/ubsan/lit.common.cfg
+++ compiler-rt/test/ubsan/lit.common.cfg
@@ -74,3 +74,5 @@
   config.unsupported = True
 
 config.available_features.add('arch=' + config.target_arch)
+
+config.excludes = ['Inputs']
Index: compiler-rt/test/ubsan/TestCases/Misc/no-interception.cpp
===================================================================
--- /dev/null
+++ compiler-rt/test/ubsan/TestCases/Misc/no-interception.cpp
@@ -0,0 +1,19 @@
+// REQUIRES: android
+
+// Tests that ubsan can detect errors on Android if libc appears before the
+// runtime in the library search order, which means that we cannot intercept
+// symbols.
+
+// RUN: %clangxx %p/Inputs/no-interception-dso.c -fsanitize=undefined -o %t.so -fPIC -shared
+// Make sure that libc is first in DT_NEEDED.
+// RUN: %clangxx %s -lc %t.so -o %t
+// RUN: %run %t 2>&1 | FileCheck %s
+
+#include <limits.h>
+
+int dso_function(int);
+
+int main(int argc, char **argv) {
+  // CHECK: signed integer overflow
+  dso_function(INT_MAX);
+}
Index: compiler-rt/test/ubsan/TestCases/Misc/Inputs/no-interception-dso.c
===================================================================
--- /dev/null
+++ compiler-rt/test/ubsan/TestCases/Misc/Inputs/no-interception-dso.c
@@ -0,0 +1,3 @@
+int dso_function(int i) {
+  return i + 1;
+}
Index: compiler-rt/lib/interception/interception_linux.cc
===================================================================
--- compiler-rt/lib/interception/interception_linux.cc
+++ compiler-rt/lib/interception/interception_linux.cc
@@ -29,6 +29,14 @@
   if (internal_strcmp(func_name, "sigaction") == 0) func_name = "__sigaction14";
 #endif
   *func_addr = (uptr)dlsym(RTLD_NEXT, func_name);
+  if (!*func_addr) {
+    // If the lookup using RTLD_NEXT failed, the sanitizer runtime library is
+    // later in the library search order than the DSO that we are trying to
+    // intercept, which means that we cannot intercept this function. We still
+    // want the address of the real definition, though, so look it up using
+    // RTLD_DEFAULT.
+    *func_addr = (uptr)dlsym(RTLD_DEFAULT, func_name);
+  }
   return real == wrapper;
 }
 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D39779.122026.patch
Type: text/x-patch
Size: 2262 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20171108/ffa2a897/attachment-0001.bin>