Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmds: static tmp_dirname used stack after return #1915

Closed
paranlee opened this issue Apr 10, 2024 · 1 comment · Fixed by #1924
Closed

cmds: static tmp_dirname used stack after return #1915

paranlee opened this issue Apr 10, 2024 · 1 comment · Fixed by #1924

Comments

@paranlee
Copy link
Contributor

In cmds/live.c, There was stack use after return code.
tmp_dirname static char pointer would be not pointed stack allocation after command_live() call ended.
We can use tmp_dirname heap or fix sized array.

static char *tmp_dirname; // <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
static void cleanup_tempdir(void)
{
	if (!tmp_dirname)
		return;

	remove_directory(tmp_dirname);
	tmp_dirname = NULL;
}
int command_live(int argc, char *argv[], struct uftrace_opts *opts)
{
#define LIVE_NAME "uftrace-live-XXXXXX"
	char template[32] = "/tmp/" LIVE_NAME; // <<<<<<<<<<<<<<<<<<<
	int fd;
	struct sigaction sa = {
		.sa_flags = SA_RESETHAND,
	};
	int ret;

	if (!opts->record) {
		tmp_dirname = template; // <<<<<<<<<<<<<<<<<<<<<<<<<<<
@paranlee paranlee changed the title static tmp_dirname used stack after return. cmds: static tmp_dirname used stack after return Apr 12, 2024
@yskelg
Copy link
Contributor

yskelg commented May 11, 2024

This detected when agent tracing on/off with make ASAN=1.
I've checked from valkey

# valkey server on
$ uftrace record --agent --trace=off ./valkey-server

# valkey-server trace on/off
$ uftrace --pid `pidof valkey-server`  --trace=on
$ uftrace --pid `pidof valkey-server`  --trace=off

This would be stack-use-after- return on x86_64 Cent OS 7.

84462==ERROR: AddressSanitizer: stack-use-after- return on address 0x7f7eaf900020 at pc 0x7f7eb3d0a411 bp 0x7ffcc4a464c0 sp 0x7ffcc4a45c80
READ of size 25 at 0x7f7eaf900020 thread To
#0 0x7f7eb3d0a410 in __interceptor_opendir gcc-releases-gcc-13.2.0/libsanitizer/sanitizer/common/sanitizer_common_interceptors.inc: 3429
#1 0x586693 in remove_directory uftrace/utils/utils.c: 169
#2 0x447f42 in cleanup_tempdir uftrace/cds/live.c: 22
#3 0x7f7eb21bace8 in __run_exit_handlers (/lib64/libc.so.6+0x39ce8) (BuildId: fc4fa58e47a5acc137eadb7689bce4357c557a96)
#4 0x7f7eb21bad36 in exit (/lib64/libc.so.6+0x39d36) (BuildId: fc4fa5847a5acc137eadb7689bce4357c557a96)
#5 0x7f7eb21a355b in libc start main (/lib64/libc.so.6+0x2255b) (BuildId: fc4fa58e47a5acc137eadb7689bce4357c557a96)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants