[PATCH] D137292: [lsan] Fix stack buffer overwrite in SuspendedThreadsListMac::GetRegistersAndSP

[Kuba (Brecka) Mracek via Phabricator via llvm-commits]

kubamracek created this revision.
kubamracek added reviewers: vitalybuka, kcc, yln, usama54321, thetruestblue, Eugene.Zelenko, rsundahl, wrotki.
kubamracek added a project: Sanitizers.
Herald added subscribers: Enna1, kristof.beyls.
Herald added a project: All.
kubamracek requested review of this revision.
Herald added a subscriber: Sanitizers.

The call to the thread_get_state syscall (that fetches the register values for a thread) on arm64 is mistakenly claiming that the buffer to receive the register state is larger that its actual size on the stack -- the struct on the stack is arm_thread_state64_t, but the MACHINE_THREAD_STATE + MACHINE_THREAD_STATE_COUNT refer to the "unified arm state" struct (which is larger).

Fixes https://github.com/llvm/llvm-project/issues/58503.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D137292

Files:
  compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp


Index: compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp
===================================================================
--- compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp
+++ compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp
@@ -87,11 +87,13 @@
 
 #if defined(__x86_64__)
 typedef x86_thread_state64_t regs_struct;
+#define regs_flavor x86_THREAD_STATE64
 
 #define SP_REG __rsp
 
 #elif defined(__aarch64__)
 typedef arm_thread_state64_t regs_struct;
+#define regs_flavor ARM_THREAD_STATE64
 
 # if __DARWIN_UNIX03
 #  define SP_REG __sp
@@ -101,6 +103,7 @@
 
 #elif defined(__i386)
 typedef x86_thread_state32_t regs_struct;
+#define regs_flavor x86_THREAD_STATE32
 
 #define SP_REG __esp
 
@@ -146,8 +149,8 @@
   thread_t thread = GetThread(index);
   regs_struct regs;
   int err;
-  mach_msg_type_number_t reg_count = MACHINE_THREAD_STATE_COUNT;
-  err = thread_get_state(thread, MACHINE_THREAD_STATE, (thread_state_t)&regs,
+  mach_msg_type_number_t reg_count = sizeof(regs) / sizeof(natural_t);
+  err = thread_get_state(thread, regs_flavor, (thread_state_t)&regs,
                          &reg_count);
   if (err != KERN_SUCCESS) {
     VReport(1, "Error - unable to get registers for a thread\n");


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D137292.472774.patch
Type: text/x-patch
Size: 1258 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20221102/7c32b2d3/attachment.bin>