When code uses utimensat with UTIME_NOW or UTIME_OMIT valgrind memcheck
would generate a warning. But as the utimensat manpage says:
If the tv_nsec field of one of the timespec structures has the special
value UTIME_NOW, then the corresponding file timestamp is set to the
current time. If the tv_nsec field of one of the timespec structures
has the special value UTIME_OMIT, then the corresponding file timestamp
is left unchanged. In both of these cases, the value of the corre‐
sponding tv_sec field is ignored.
So ignore the timespec tv_sec when tv_nsec is set to UTIME_NOW or
UTIME_OMIT.
Support for the bpf system call was added in a previous commit, but
did not include tracking for file descriptors handled by the call.
Add checks and tracking for file descriptors. Check in PRE() wrapper
that all file descriptors (pointing to object such as eBPF programs or
maps, cgroups, or raw tracepoints) used by the system call are valid,
then add tracking in POST() wrapper for newly produced file descriptors.
As the file descriptors are not always processed in the same way by the
bpf call, add to the header file some additional definitions from bpf.h
that are necessary to sort out under what conditions descriptors should
be checked in the PRE() helper.
Fixes: 388786 - Support bpf syscall in amd64 Linux
Add support for bpf() Linux-specific system call on amd64 platform. The
bpf() syscall is used to handle eBPF objects (programs and maps), and
can be used for a number of operations. It takes three arguments:
- "cmd" is an integer encoding a subcommand to run. Available subcommand
include loading a new program, creating a map or updating its entries,
retrieving information about an eBPF object, and may others.
- "attr" is a pointer to an object of type union bpf_attr. This object
converts to a struct related to selected subcommand, and embeds the
various parameters used with this subcommand. Some of those parameters
are read by the kernel (example for an eBPF map lookup: the key of the
entry to lookup), others are written into (the value retrieved from
the map lookup).
- "attr_size" is the size of the object pointed by "attr".
Since the action performed by the kernel, and the way "attr" attributes
are processed depends on the subcommand in use, the PRE() and POST()
wrappers need to make the distinction as well. For each subcommand, mark
the attributes that are read or written.
For some map operations, the only way to infer the size of the memory
areas used for read or write operations seems to involve reading
from /proc/<pid>/fdinfo/<fd> in order to retrieve the size of keys
and values for this map.
The definitions of union bpf_attr and of other eBPF-related elements
required for adequately performing the checks were added to the Linux
header file.
Processing related to file descriptors is added in a follow-up patch.
The sys_prctl wrapper with PR_SET_NAME option reads an ASCII string passed
as its second argument. This string is supposed to be shorter than a given
limit. As the actual length of the string is unknown, the PRE() wrapper
performs a number of checks on it, including, in worst case, trying to
dereference it byte by byte.
To avoid re-implementing all this logic for other wrappers that could
need it, get the string processing out of the wrapper and move it to a
static function. Note that passing tid as an argument to the function is
required for macros PRE_MEM_RASCIIZ and PRE_MEM_READ to work properly.
Follow up to "Introduce RegWord type" change.
Part of the changes required for BZ issue - #345763.
Contributed by:
Tamara Vlahovic and Dimitrije Nikolic.
On majority of architectures size of long matches register width.
On mips n32 size of long is 32 bits and register width is 64 bits.
Valgrind is written with assumption that long size matches register
width. This is the reason why both UWord for Valgrind and HWord for VEX
match size of long. Long size differs from register size on mips n32 ABI.
Introducing RegWord type that will match size of registers.
Part of the changes required for BZ issue - #345763.
Contributed by:
Tamara Vlahovic and Dimitrije Nikolic.
Shingled magnetic recording drives support a command set called ZBC
(Zoned Block Commands). Two new ioctls have been added to the Linux
kernel to support such drives, namely VKI_BLKREPORTZONE and
VKI_BLKRESETZONE. Add support to Valgrind for these ioctls.
According to the epoll_pwait(2) man page:
The sigmask argument may be specified as NULL, in which case
epoll_pwait() is equivalent to epoll_wait().
But doing that under valgrind gives:
==13887== Syscall param epoll_pwait(sigmask) points to unaddressable byte(s)
==13887== at 0x4F2B940: epoll_pwait (epoll_pwait.c:43)
==13887== by 0x400ADE: main (syscalls-2007.c:89)
==13887== Address 0x0 is not stack'd, malloc'd or (recently) free'd
This is because the sys_epoll_pwait wrapper has:
if (ARG4)
PRE_MEM_READ( "epoll_pwait(sigmask)", ARG5, sizeof(vki_sigset_t) );
Which looks like a typo (ARG4 is timeout and ARG5 is sigmask).
This shows up with newer glibc which translates an epoll_wait call into
an epoll_pwait call with NULL sigmask.
Fix typo and add a testcase.
https://bugs.kde.org/show_bug.cgi?id=381289
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16451
and FUTEX_WAKE_BITSET, check only 4 args for FUTEX_WAKE_BITSET,
and 2 args for FUTEX_TRYLOCK_PI.
Fixes BZ#377698.
Patch by: diane.meirowitz@oracle.com
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16285
causing some addresses to be wrongly marked as addressable
Just in case, do the assert after ARG2 has been truncated to 32 bits,
to avoid comparing sign extended requests on 64 bits.
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16278
addresses to be wrongly marked as addressable
As noted by Ivo, if the syscall fails, then we have a leak.
So, enable the flag SfPostOnFail if we allocate memory.
In the POST ioctl, check that FAILURE only happens for this drm ioctl,
and free the memory for both SUCCESS and FAILURE.
Do the POST_MEM_WRITE only if SUCCESS
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16277
Due to this missing break, the code was falling through to
the case VKI_SNDRV_CTL_IOCTL_PVERSION:
and was then setting some bytes as defined at (whatever address is in) ARG3.
Patch and analysis by Daniel Glöckner
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16266
Before dereferencing the sigaction pointer and reading the fields we
need to make sure the whole struct is safe_to_deref. We were using the
size of the pointer, but needed the size of the struct.
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16258
Fix 373192 Calling posix_spawn in glibc 2.24 completely broken
Functionally, this patch just does the following 2 changes to the
fork clone handling:
* It does not mask anymore CLONE_VFORK :
The only effect of this flag is to suspend the parent, waiting for
the child to either exit or execve.
If some applications depends on this synchronisation, better keep it,
as it will not harm to suspend the parent valgrind waiting for the
child valgrind to exit or execve.
* In case the guest calls the clone syscall providing a non zero client stack,
set the child guest SP after the syscall, before executing guest instructions.
Not setting the guest stack ptr was the source of the problem reported
in the bugs.
This also adds a test case none/tests/linux/clonev.
Before this patch, test gives a SEGV, which is fixed by the patch.
The patch is however a lot bigger : this fix was touching some (mostly
identical/duplicated) code in all the linux platforms.
So, the clone/fork code has been factorised as much as possible.
This removes about 1700 lines of code.
This has been tested on:
* amd64
* x86
* ppc64 be and le
* ppc32
* arm64
This has been compiled on but *not really tested* on:
* mips64 (not too clear how to properly build and run valgrind on gcc22)
It has *not* been compiled and *not* tested on:
* arm
* mips32
* tilegx
* darwin (normally, no impact)
* solaris (normally, no impact)
The changes are relatively mechanical, so it is not impossible that
it will compile and work out of the box on these platforms.
Otherwise, questions welcome.
A few points of interest:
* Some platforms did have a typedef void vki_modify_ldt_t,
and some platforms had no definition for this type at all.
To make it easier to factorise, for such platforms, the following has
been used:
typedef char vki_modify_ldt_t;
When the sizeof vki_modify_ldt_t is > 1, then the arg syscall is checked.
This is somewhat a hack, but was simplifying the factorisation.
* for mips32/mips64 and tilegx, there is a strange unconditional assignment
of 0 to a register (guest_r2 on mips, guest_r0 on tilegx).
Unclear what this is, in particular because this is assigned whatever
the result of the syscall (success or not).
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16186
For fadvise64 system call, 7th 32-bit argument slot (third on the stack)
will also be used due to MIPS O32 calling convention in passing 64-bit
values.
sys_fadvise64(int fd, loff_t offset, loff_t len, int advice);
NR_fadvise64 -> v0 (sysno)
fd -> a0 (ARG1)
offset -> a2, a3 (ARG3, ARG4)
len -> SP + 16, SP + 20 (ARG5, ARG6)
advise -> SP + 24 (ARG7)
Change the code according to it.
Patch by Aleksandar Rikalo.
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16162
with no size/direction hints. (DVD_READ_STRUCT)
Patch from Austin English (austinenglish@gmail.com).
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16153
with no size/direction hints. (CDROMSTOP).
Patch from Austin English (austinenglish@gmail.com).
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16152
Note that it is unclear if the PRE syscall for rt_sigsuspend
is properly setting up a temporary mask in the thread state
tmp_sig_mask: if an handler is called while a thread is
calling sigsuspend, the mask during the handler run must be
the temporary mask set by sigsuspend.
It is not clear if/where the valgrind sigframe builder/handler
sets the tmp_sig_mask to the value as expected by the user
(i.e. the value of the temporary mask which was given to
the sigsuspend syscall)
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@16141
Since we try to modify the old/new sigaction handler before passing it
to the kernel we must make sure that (if they aren't NULL) it is safe
to use. If not we should bail out early with EFAULT.
Bug #369362
Found by LTP testcases/kernel/syscalls/rt_sigaction/rt_sigaction02.
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@15994
Since we want to use the set and oldset for bookkeeping we also want
to make sure they are addressable otherwise, like the kernel, we EFAULT.
Also use EINVAL instead of EMFILE as failure when sigset size is wrong.
Found by LTP testcases/kernel/syscalls/rt_sigprocmask/rt_sigprocmask02.
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@15992
Don't check or try to copy sigmask if it is NULL. The sigmask might be
given in a struct, where the length is non-zero, but the signal set
pointer is NULL.
Testcase provided by Paul Eggert <eggert@cs.ucla.edu>.
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@15893
The new memcheck/tests/arm64-linux/scalar test is based on the
memcheck/tests/x86-linux/scalar test and contains all syscalls
that are also available on arm64. To make comparison of exp results
easier the order of the tested syscalls is the same as on x86.
This enables a couple extra arm64 syscalls. Part of the fix for
bug #359503 - Add missing syscalls for aarch64 (arm64).
git-svn-id: svn://svn.valgrind.org/valgrind/trunk@15825
