From 32bada2edaf8a6ecb515925dda5e736783f5d8eb Mon Sep 17 00:00:00 2001 From: Kuba Mracek Date: Sat, 12 Nov 2022 10:16:34 -0800 Subject: [PATCH] [lsan] Fix stack buffer overwrite in SuspendedThreadsListMac::GetRegistersAndSP The call to the thread_get_state syscall (that fetches the register values for a thread) on arm64 is mistakenly claiming that the buffer to receive the register state is larger that its actual size on the stack -- the struct on the stack is arm_thread_state64_t, but the MACHINE_THREAD_STATE + MACHINE_THREAD_STATE_COUNT refer to the "unified arm state" struct (which is larger). Fixes https://github.com/llvm/llvm-project/issues/58503. Differential Revision: https://reviews.llvm.org/D137292 --- compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp b/compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp index 87f5250..3ebeac5 100644 --- a/compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp +++ b/compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp @@ -87,11 +87,13 @@ void StopTheWorld(StopTheWorldCallback callback, void *argument) { #if defined(__x86_64__) typedef x86_thread_state64_t regs_struct; +#define regs_flavor x86_THREAD_STATE64 #define SP_REG __rsp #elif defined(__aarch64__) typedef arm_thread_state64_t regs_struct; +#define regs_flavor ARM_THREAD_STATE64 # if __DARWIN_UNIX03 # define SP_REG __sp @@ -101,6 +103,7 @@ typedef arm_thread_state64_t regs_struct; #elif defined(__i386) typedef x86_thread_state32_t regs_struct; +#define regs_flavor x86_THREAD_STATE32 #define SP_REG __esp @@ -146,8 +149,8 @@ PtraceRegistersStatus SuspendedThreadsListMac::GetRegistersAndSP( thread_t thread = GetThread(index); regs_struct regs; int err; - mach_msg_type_number_t reg_count = MACHINE_THREAD_STATE_COUNT; - err = thread_get_state(thread, MACHINE_THREAD_STATE, (thread_state_t)®s, + mach_msg_type_number_t reg_count = sizeof(regs) / sizeof(natural_t); + err = thread_get_state(thread, regs_flavor, (thread_state_t)®s, ®_count); if (err != KERN_SUCCESS) { VReport(1, "Error - unable to get registers for a thread\n"); -- 2.7.4