From: Philippe Waroquiers <philippe.waroquiers@skynet.be>
Date: Sun, 10 Jul 2016 21:17:58 +0000 (+0000)
Subject: Fix 365273 - Invalid write to stack location reported after signal handler runs
X-Git-Tag: svn/VALGRIND_3_12_0~121
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=80dec3e514121e48a3429489596ffa6d1a8f9e99;p=thirdparty%2Fvalgrind.git

Fix 365273 - Invalid write to stack location reported after signal handler runs

Analysis and patch by Earl Chew

Tested on x86/amd64/ppc64



git-svn-id: svn://svn.valgrind.org/valgrind/trunk@15902
---

diff --git a/NEWS b/NEWS
index 2f49dbb1ff..b85b786fa2 100644
--- a/NEWS
+++ b/NEWS
@@ -127,6 +127,7 @@ where XXXXXX is the bug number as listed below.
 364413  pselect sycallwrapper mishandles NULL sigmask
 364728  Power PC, missing support for several HW registers in
         get_otrack_shadow_offset_wrk()
+365273  Invalid write to stack location reported after signal handler runs
 
 n-i-bz Fix incorrect (or infinite loop) unwind on RHEL7 x86 and amd64
 n-i-bz massif --pages-as-heap=yes does not report peak caused by mmap+munmap
diff --git a/coregrind/m_signals.c b/coregrind/m_signals.c
index 3e8326f984..9146d0c5a7 100644
--- a/coregrind/m_signals.c
+++ b/coregrind/m_signals.c
@@ -2519,6 +2519,7 @@ void async_signalhandler ( Int sigNo,
 Bool VG_(extend_stack)(ThreadId tid, Addr addr)
 {
    SizeT udelta;
+   Addr new_stack_base;
 
    /* Get the segment containing addr. */
    const NSegment* seg = VG_(am_find_nsegment)(addr);
@@ -2536,14 +2537,15 @@ Bool VG_(extend_stack)(ThreadId tid, Addr addr)
    vg_assert(seg_next != NULL);
 
    udelta = VG_PGROUNDUP(seg_next->start - addr);
+   new_stack_base = seg_next->start - udelta;
 
    VG_(debugLog)(1, "signals", 
-                    "extending a stack base 0x%lx down by %lu\n",
-                    seg_next->start, udelta);
+                 "extending a stack base 0x%lx down by %lu"
+                 " new base 0x%lx to cover 0x%lx\n",
+                 seg_next->start, udelta, new_stack_base, addr);
    Bool overflow;
    if (! VG_(am_extend_into_adjacent_reservation_client)
        ( seg_next->start, -(SSizeT)udelta, &overflow )) {
-      Addr new_stack_base = seg_next->start - udelta;
       if (overflow)
          VG_(umsg)("Stack overflow in thread #%u: can't grow stack to %#lx\n",
                    tid, new_stack_base);
@@ -2555,7 +2557,7 @@ Bool VG_(extend_stack)(ThreadId tid, Addr addr)
 
    /* When we change the main stack, we have to let the stack handling
       code know about it. */
-   VG_(change_stack)(VG_(clstk_id), addr, VG_(clstk_end));
+   VG_(change_stack)(VG_(clstk_id), new_stack_base, VG_(clstk_end));
 
    if (VG_(clo_sanity_level) > 2)
       VG_(sanity_check_general)(False);