memory sanitizer: not tracking memory initialization with getrandom

[hannob]

The fuzzing of expat by oss-fuzz turned up a false positive because msan isn't tracking memory writes by the new Linux getrandom interface. This can be either used via a syscall or via the new getrandom() function in latest glibc versions.

msan should intercept those calls and properly track them.

Here's a minimal example that shows both variants (compiled with -DSYSCALL gives the syscall interface variant, without it uses the getrandom() call). It shouldn't show any use of uninitialized memory (unless you pass more than 4 parameters), but it does:

#include <unistd.h>
#include <sys/syscall.h>
#include <sys/random.h>

int main(int argc, char** argv) {
	unsigned char x[5];
#ifdef SYSCALL
        syscall(SYS_getrandom, x, 5, 0);
#else
	getrandom(x, 5, 0);
#endif
	if(x[argc]) return 1;
}

Compiled with msan it says:

==15128==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x490179 in main /tmp/syscall-getrandom.c:12:5
    #1 0x7f1d39a96520 in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.25-r4/work/glibc-2.25/csu/../csu/libc-start.c:295
    #2 0x41a1b9 in _start (/tmp/a.out+0x41a1b9)

SUMMARY: MemorySanitizer: use-of-uninitialized-value /tmp/syscall-getrandom.c:12:5 in main

[kcc]

We don't have a mechanism to intercept syscalls, so it's unlikely we'll support syscall(SYS_getrandom, x, 5, 0); any time soon.
As for getrandom, yes, I think we can intercept it.
But I don't see such thing on Ubuntu 16.04:

m.c:3:10: fatal error: 'sys/random.h' file not found
#include <sys/random.h>

which means the fix won't be useful on a pretty recent platform.

[eugenis]

We can't intercept raw system calls, but we could handle the syscall() function. This needs refactoring of syscall support in MSan, which is currently implemented with macros based off the syscall name instead of the syscall number.

…

On Tue, Sep 5, 2017 at 2:14 PM, Kostya Serebryany ***@***.***> wrote: We don't have a mechanism to intercept syscalls, so it's unlikely we'll support syscall(SYS_getrandom, x, 5, 0); any time soon. As for getrandom, yes, I think we can intercept it. But I don't see such thing on Ubuntu 16.04: m.c:3:10: fatal error: 'sys/random.h' file not found #include <sys/random.h> which means the fix won't be useful on a pretty recent platform. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#852 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAZuSv45SEjZrRmaDD8VV43wAyjsJi25ks5sfbnBgaJpZM4PLNC3> .

[hartwork]

Please note that syscall numbers vary across architectures, if they get hardcoded.

[hannob]

I think it would be okay to only support getrandom. The syscall version is only an intermediate solution.

getrandom only got added in the very latest glibc version 2.25, so probably none of the major distros has it yet by default. But as a medium- to long term solution supporting it would make sense.

[kcc]

Yes, we'l need to support getrandom and the change should be simple.
But we won't even be able to test it on the LLVM bots yet :(
And it won't help google/oss-fuzz#806 since OSS-Fuzz uses ubuntu 16.04

[morehouse]

What's the status of this?

[eugenis]

Not done.

[akrieger]

I think is resolved by llvm/llvm-project@ac9ee01

[vitalybuka]

Thanks