Bug 369356

Summary:	pre_mem_read_sockaddr syscall wrapper can crash with bad sockaddr
Product:	[Developer tools] valgrind	Reporter:	Mark Wielaard <mark>
Component:	general	Assignee:	Julian Seward <jseward>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	NOR
Version First Reported In:	unspecified
Target Milestone:	---
Platform:	Other
OS:	Linux
Latest Commit:		Version Fixed In:
Sentry Crash Report:
Attachments:	Fix pre_mem_read_sockaddr crash on invalid syscall arguments

Description Mark Wielaard 2016-09-25 21:53:10 UTC

LTP testcases/kernel/syscalls/bind/bind01 crashes valgrind:

==19407==    at 0x4F2C427: bind (syscall-template.S:81)
==19407==    by 0x402803: main (bind01.c:120)
==19407==  Address 0xffffffffffffffff is not stack'd, malloc'd or (recently) free'd
==19407== 
--19407-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--19407-- si_code=1;  Faulting address: 0xFFFFFFFFFFFFFFFF;  sp: 0x802ea9d70

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==19407==    at 0x38094231: pre_mem_read_sockaddr.part.12 (syswrap-generic.c:1131)
==19407==    by 0x38092CDF: vgPlain_client_syscall (syswrap-main.c:1906)
==19407==    by 0x3808F8B2: handle_syscall (scheduler.c:1118)
==19407==    by 0x38090E76: vgPlain_scheduler (scheduler.c:1435)
==19407==    by 0x380A027A: thread_wrapper (syswrap-linux.c:103)
==19407==    by 0x380A027A: run_a_thread_NORETURN (syswrap-linux.c:156)


Reproducible: Always

Comment 1 Mark Wielaard 2016-09-25 22:03:41 UTC

Created attachment 101286 [details]
Fix pre_mem_read_sockaddr crash on invalid syscall arguments

Don't do any more checks if it isn't safe to inspect the address family.
Likewise, don't check sun_path if the string address isn't safe.

Comment 2 Mark Wielaard 2016-10-01 12:00:47 UTC

valgrind svn r15990