| 1 | // RUN: %clangxx_msan -fno-sanitize-memory-param-retval -fno-sanitize=memory -c %s -o %t-main.o |
| 2 | // RUN: %clangxx_msan -fno-sanitize-memory-param-retval %t-main.o %s -o %t |
| 3 | // RUN: %run %t |
| 4 | |
| 5 | #include <assert.h> |
| 6 | #include <stdio.h> |
| 7 | #include <stdlib.h> |
| 8 | #include <ucontext.h> |
| 9 | #include <unistd.h> |
| 10 | |
| 11 | #include <sanitizer/msan_interface.h> |
| 12 | |
| 13 | #if __has_feature(memory_sanitizer) |
| 14 | |
| 15 | __attribute__((noinline)) int bar(int a, int b) { |
| 16 | volatile int zero = 0; |
| 17 | return zero; |
| 18 | } |
| 19 | |
| 20 | void foo(int x, int y, int expected) { |
| 21 | assert(__msan_test_shadow(&x, sizeof(x)) == expected); |
| 22 | assert(__msan_test_shadow(&y, sizeof(y)) == expected); |
| 23 | |
| 24 | // Poisons parameter shadow in TLS so that the next call (to foo) from |
| 25 | // uninstrumented main has params 1 and 2 poisoned no matter what. |
| 26 | int a, b; |
| 27 | (void)bar(a, b); |
| 28 | } |
| 29 | |
| 30 | #else |
| 31 | |
| 32 | // This code is not instrumented by MemorySanitizer to prevent it from modifying |
| 33 | // MSAN TLS data for this test. |
| 34 | |
| 35 | int foo(int, int, int); |
| 36 | |
| 37 | int main(int argc, char **argv) { |
| 38 | int x, y; |
| 39 | // The parameters should _not_ be poisoned; this is the first call to foo. |
| 40 | foo(x, y, -1); |
| 41 | // The parameters should be poisoned; the prior call to foo left them so. |
| 42 | foo(x, y, 0); |
| 43 | |
| 44 | ucontext_t ctx; |
| 45 | if (getcontext(ucp: &ctx) == -1) { |
| 46 | perror(s: "getcontext" ); |
| 47 | _exit(status: 1); |
| 48 | } |
| 49 | |
| 50 | // Simulate a fiber switch occurring from MSAN's perspective (though no switch |
| 51 | // actually occurs). |
| 52 | const void *previous_stack_bottom = nullptr; |
| 53 | size_t previous_stack_size = 0; |
| 54 | __msan_start_switch_fiber(bottom: ctx.uc_stack.ss_sp, size: ctx.uc_stack.ss_size); |
| 55 | __msan_finish_switch_fiber(bottom_old: &previous_stack_bottom, size_old: &previous_stack_size); |
| 56 | |
| 57 | // The simulated fiber switch will reset the TLS parameter shadow. So even |
| 58 | // though the most recent call to foo left the parameter shadow poisoned, the |
| 59 | // parameters are _not_ expected to be poisoned now. |
| 60 | foo(x, y, -1); |
| 61 | |
| 62 | return 0; |
| 63 | } |
| 64 | |
| 65 | #endif |
| 66 | |