Bug 369356 - pre_mem_read_sockaddr syscall wrapper can crash with bad sockaddr
Summary: pre_mem_read_sockaddr syscall wrapper can crash with bad sockaddr
Status: RESOLVED FIXED
Alias: None
Product: valgrind
Classification: Developer tools
Component: general (other bugs)
Version First Reported In: unspecified
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: Julian Seward
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-09-25 21:53 UTC by Mark Wielaard
Modified: 2016-10-01 12:01 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
Fix pre_mem_read_sockaddr crash on invalid syscall arguments (1.71 KB, patch)
2016-09-25 22:03 UTC, Mark Wielaard
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Wielaard 2016-09-25 21:53:10 UTC
LTP testcases/kernel/syscalls/bind/bind01 crashes valgrind:

==19407==    at 0x4F2C427: bind (syscall-template.S:81)
==19407==    by 0x402803: main (bind01.c:120)
==19407==  Address 0xffffffffffffffff is not stack'd, malloc'd or (recently) free'd
==19407== 
--19407-- VALGRIND INTERNAL ERROR: Valgrind received a signal 11 (SIGSEGV) - exiting
--19407-- si_code=1;  Faulting address: 0xFFFFFFFFFFFFFFFF;  sp: 0x802ea9d70

valgrind: the 'impossible' happened:
   Killed by fatal signal

host stacktrace:
==19407==    at 0x38094231: pre_mem_read_sockaddr.part.12 (syswrap-generic.c:1131)
==19407==    by 0x38092CDF: vgPlain_client_syscall (syswrap-main.c:1906)
==19407==    by 0x3808F8B2: handle_syscall (scheduler.c:1118)
==19407==    by 0x38090E76: vgPlain_scheduler (scheduler.c:1435)
==19407==    by 0x380A027A: thread_wrapper (syswrap-linux.c:103)
==19407==    by 0x380A027A: run_a_thread_NORETURN (syswrap-linux.c:156)


Reproducible: Always
Comment 1 Mark Wielaard 2016-09-25 22:03:41 UTC
Created attachment 101286 [details]
Fix pre_mem_read_sockaddr crash on invalid syscall arguments

Don't do any more checks if it isn't safe to inspect the address family.
Likewise, don't check sun_path if the string address isn't safe.
Comment 2 Mark Wielaard 2016-10-01 12:00:47 UTC
valgrind svn r15990