[valgrind] [Bug 377698] Missing memory check for futex() uaddr arg for FUTEX_WAKE and FUTEX_WAKE_BITSET

[Diane M]

https://bugs.kde.org/show_bug.cgi?id=377698

--- Comment #1 from Diane M <diane.meirow...@oracle.com> ---
In addition to the previously-described problems:

- FUTEX_WAKE_BITSET should not do scalar read check on all 6 arguments;
  it should check uaddr, op, val, and val3 only.

- FUTEX_TRYLOCK_PI should check only uaddr and op

Here is a modified patch:

diff -r 231368959406 coregrind/m_syswrap/syswrap-linux.c
--- a/coregrind/m_syswrap/syswrap-linux.c       Tue Mar 14 09:47:29 2017 -0700
+++ b/coregrind/m_syswrap/syswrap-linux.c       Mon Mar 20 08:26:03 2017 -0700
@@ -1633,9 +1633,11 @@
       }
       break;
    case VKI_FUTEX_WAKE_BITSET:
-      PRE_REG_READ6(long, "futex",
-                    vki_u32 *, futex, int, op, int, val,
-                    int, dummy, int, dummy2, int, val3);
+      PRE_REG_READ3(long, "futex",
+                    vki_u32 *, futex, int, op, int, val);
+      if (VG_(tdict).track_pre_reg_read) {
+         PRA6("futex",int,val3);
+      }
       break;
    case VKI_FUTEX_WAIT:
    case VKI_FUTEX_LOCK_PI:
@@ -1645,11 +1647,11 @@
       break;
    case VKI_FUTEX_WAKE:
    case VKI_FUTEX_FD:
-   case VKI_FUTEX_TRYLOCK_PI:
       PRE_REG_READ3(long, "futex",
                     vki_u32 *, futex, int, op, int, val);
       break;
    case VKI_FUTEX_UNLOCK_PI:
+   case VKI_FUTEX_TRYLOCK_PI:
    default:
       PRE_REG_READ2(long, "futex", vki_u32 *, futex, int, op);
       break;
@@ -1678,14 +1680,11 @@
    case VKI_FUTEX_FD:
    case VKI_FUTEX_TRYLOCK_PI:
    case VKI_FUTEX_UNLOCK_PI:
+   case VKI_FUTEX_WAKE:
+   case VKI_FUTEX_WAKE_BITSET:
       PRE_MEM_READ( "futex(futex)", ARG1, sizeof(Int) );
      break;

-   case VKI_FUTEX_WAKE:
-   case VKI_FUTEX_WAKE_BITSET:
-      /* no additional pointers */
-      break;
-
    default:
       SET_STATUS_Failure( VKI_ENOSYS );   // some futex function we don't
understand
       break;

-- 
You are receiving this mail because:
You are watching all bug changes.