tsan: fix out-of-bounds access in Go runtime
authorDmitry Vyukov <dvyukov@google.com>
Fri, 6 Jun 2014 15:56:08 +0000 (15:56 +0000)
committerDmitry Vyukov <dvyukov@google.com>
Fri, 6 Jun 2014 15:56:08 +0000 (15:56 +0000)
FuncEntry can resize the shadow stack, while "thr->shadow_stack_pos[0] = pc" writes out-of-bounds.

llvm-svn: 210349

compiler-rt/lib/tsan/rtl/tsan_rtl.cc

index fe95971..add6bd7 100644 (file)
@@ -423,13 +423,11 @@ void ForkChildAfter(ThreadState *thr, uptr pc) {
 u32 CurrentStackId(ThreadState *thr, uptr pc) {
   if (thr->shadow_stack_pos == 0)  // May happen during bootstrap.
     return 0;
-  if (pc) {
-    thr->shadow_stack_pos[0] = pc;
-    thr->shadow_stack_pos++;
-  }
+  if (pc != 0)
+    FuncEntry(thr, pc);  // can resize the shadow stack
   u32 id = StackDepotPut(thr->shadow_stack,
                          thr->shadow_stack_pos - thr->shadow_stack);
-  if (pc)
+  if (pc != 0)
     thr->shadow_stack_pos--;
   return id;
 }