[compiler-rt] [compiler-rt][sanitizer_common] Size readlink/getsockopt post-hook unpoison by bytes written (PR #209209)

[via llvm-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-compiler-rt-sanitizer

Author: Patrik Dokoupil (pdokoupil)

<details>
<summary>Changes</summary>

# About

`readlink`/`readlinkat` return the number of bytes placed in the buffer in res and do not NUL-terminate it, and getsockopt writes *optlen bytes of binary option data. The post-hooks instead sized their POST_WRITE (MSan unpoison) with internal_strlen(buf) + 1, which reads past what the kernel wrote -- over- unpoisoning the uninitialized tail (masking real bugs) and, on a buffer with no NUL, reading out of bounds inside the runtime. For binary option data an early zero byte instead under-unpoisons.

Size the unpoison by the actual written length, matching the corresponding libc interceptors (readlink unpoisons res bytes, and getsockopt unpoisons *optlen bytes).

Seems to be present since the file's 2013 import.

---
Full diff: https://github.com/llvm/llvm-project/pull/209209.diff


2 Files Affected:

- (modified) compiler-rt/lib/sanitizer_common/sanitizer_common_syscalls.inc (+4-5) 
- (added) compiler-rt/test/msan/Linux/syscalls_post_output_size.cpp (+41) 


``````````diff
diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_common_syscalls.inc b/compiler-rt/lib/sanitizer_common/sanitizer_common_syscalls.inc
index ee3ac723e3669..5f4fba5299167 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_common_syscalls.inc
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_common_syscalls.inc
@@ -1510,7 +1510,7 @@ PRE_SYSCALL(readlink)(const void *path, void *buf, long bufsiz) {
 POST_SYSCALL(readlink)(long res, const void *path, void *buf, long bufsiz) {
   if (res >= 0) {
     if (buf)
-      POST_WRITE(buf, __sanitizer::internal_strlen((const char *)buf) + 1);
+      POST_WRITE(buf, res);
   }
 }
 
@@ -1905,9 +1905,8 @@ PRE_SYSCALL(getsockopt)
 POST_SYSCALL(getsockopt)
 (long res, long fd, long level, long optname, void *optval, void *optlen) {
   if (res >= 0) {
-    if (optval)
-      POST_WRITE(optval,
-                 __sanitizer::internal_strlen((const char *)optval) + 1);
+    if (optval && optlen)
+      POST_WRITE(optval, *(unsigned int *)optlen);
     if (optlen)
       POST_WRITE(optlen, sizeof(int));
   }
@@ -2900,7 +2899,7 @@ POST_SYSCALL(readlinkat)
 (long res, long dfd, const void *path, void *buf, long bufsiz) {
   if (res >= 0) {
     if (buf)
-      POST_WRITE(buf, __sanitizer::internal_strlen((const char *)buf) + 1);
+      POST_WRITE(buf, res);
   }
 }
 
diff --git a/compiler-rt/test/msan/Linux/syscalls_post_output_size.cpp b/compiler-rt/test/msan/Linux/syscalls_post_output_size.cpp
new file mode 100644
index 0000000000000..14fb01d989e5e
--- /dev/null
+++ b/compiler-rt/test/msan/Linux/syscalls_post_output_size.cpp
@@ -0,0 +1,41 @@
+// RUN: %clangxx_msan -O0 %s -o %t && %run %t
+
+// readlink/readlinkat return the byte count in res and do not NUL-terminate;
+// getsockopt writes *optlen bytes of binary option data. The POST hooks used
+// internal_strlen() to size the unpoison, which reads past what the kernel
+// wrote. After the fix the unpoisoned span matches the real written length.
+
+#include <assert.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/socket.h>
+
+#include <sanitizer/linux_syscall_hooks.h>
+#include <sanitizer/msan_interface.h>
+
+int main() {
+  {
+    char buf[64];
+    memset(buf, 'x', 64);
+    buf[63] = 0; // in-bounds NUL so a stray strlen would run to 63, not OOB
+    __msan_poison(buf, 64);
+    __sanitizer_syscall_post_readlink(3, "/x", buf, 64);
+    assert(__msan_test_shadow(buf, 64) == 3); // exactly res bytes
+  }
+  {
+    char buf[64];
+    memset(buf, 'x', 64);
+    buf[63] = 0;
+    __msan_poison(buf, 64);
+    __sanitizer_syscall_post_readlinkat(3, AT_FDCWD, "/x", buf, 64);
+    assert(__msan_test_shadow(buf, 64) == 3);
+  }
+  {
+    unsigned char ov[16];
+    __msan_poison(ov, 16);
+    socklen_t ol = 4;
+    __sanitizer_syscall_post_getsockopt(0, 3, 1, 2, ov, &ol);
+    assert(__msan_test_shadow(ov, 16) == 4); // exactly *optlen bytes
+  }
+  return 0;
+}

``````````

</details>


https://github.com/llvm/llvm-project/pull/209209