[msan] Unpoison argument shadow for C++ module destructors.
Fixes PR17377.
git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk@191508 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/msan/lit_tests/cxa_atexit.cc b/lib/msan/lit_tests/cxa_atexit.cc
new file mode 100644
index 0000000..f3641aa
--- /dev/null
+++ b/lib/msan/lit_tests/cxa_atexit.cc
@@ -0,0 +1,28 @@
+// RUN: %clangxx_msan -m64 -O0 %s -o %t && %t %p
+
+// PR17377: C++ module destructors get stale argument shadow.
+
+#include <stdio.h>
+#include <stdlib.h>
+class A {
+public:
+ // This destructor get stale argument shadow left from the call to f().
+ ~A() {
+ if (this)
+ exit(0);
+ }
+};
+
+A a;
+
+__attribute__((noinline))
+void f(long x) {
+}
+
+int main(void) {
+ long x;
+ long * volatile p = &x;
+ // This call poisons TLS shadow for the first function argument.
+ f(*p);
+ return 0;
+}
diff --git a/lib/msan/msan.cc b/lib/msan/msan.cc
index 34a7c9f..6b52c72 100644
--- a/lib/msan/msan.cc
+++ b/lib/msan/msan.cc
@@ -296,10 +296,10 @@
msan_init_is_running = 1;
SanitizerToolName = "MemorySanitizer";
- InstallAtExitHandler();
SetDieCallback(MsanDie);
InitTlsSize();
InitializeInterceptors();
+ InstallAtExitHandler(); // Needs __cxa_atexit interceptor.
if (MSAN_REPLACE_OPERATORS_NEW_AND_DELETE)
ReplaceOperatorsNewAndDelete();
diff --git a/lib/msan/msan_interceptors.cc b/lib/msan/msan_interceptors.cc
index ebff67a..0d5c848 100644
--- a/lib/msan/msan_interceptors.cc
+++ b/lib/msan/msan_interceptors.cc
@@ -19,6 +19,7 @@
#include "msan.h"
#include "sanitizer_common/sanitizer_platform_limits_posix.h"
#include "sanitizer_common/sanitizer_allocator.h"
+#include "sanitizer_common/sanitizer_allocator_internal.h"
#include "sanitizer_common/sanitizer_atomic.h"
#include "sanitizer_common/sanitizer_common.h"
#include "sanitizer_common/sanitizer_stackdepot.h"
@@ -1083,6 +1084,30 @@
return;
}
+struct MSanAtExitRecord {
+ void (*func)(void *arg);
+ void *arg;
+};
+
+void MSanAtExitWrapper(void *arg) {
+ UnpoisonParam(1);
+ MSanAtExitRecord *r = (MSanAtExitRecord *)arg;
+ r->func(r->arg);
+ InternalFree(r);
+}
+
+// Unpoison argument shadow for C++ module destructors.
+INTERCEPTOR(int, __cxa_atexit, void (*func)(void *), void *arg,
+ void *dso_handle) {
+ if (msan_init_is_running) return REAL(__cxa_atexit)(func, arg, dso_handle);
+ ENSURE_MSAN_INITED();
+ MSanAtExitRecord *r =
+ (MSanAtExitRecord *)InternalAlloc(sizeof(MSanAtExitRecord));
+ r->func = func;
+ r->arg = arg;
+ return REAL(__cxa_atexit)(MSanAtExitWrapper, r, dso_handle);
+}
+
struct MSanInterceptorContext {
bool in_interceptor_scope;
};
@@ -1340,6 +1365,7 @@
INTERCEPT_FUNCTION(pthread_key_create);
INTERCEPT_FUNCTION(pthread_join);
INTERCEPT_FUNCTION(tzset);
+ INTERCEPT_FUNCTION(__cxa_atexit);
inited = 1;
}
} // namespace __msan