[Valgrind-developers] VALGRIND_2_2_0_BRANCH: valgrind [POSSIBLY UNSAFE]

[Nicholas N. <nj...@ca...>]

CVS commit by nethercote: 

Fix for bug 91162:  cope with jumps to bogus addresses when there is a SEGV
signal handler present -- previously, Valgrind would abort unnecessarily on
this case.

Added a regression test for it.

MERGED FROM HEAD


  A            memcheck/tests/badjump2.c   1.1.2.1 [POSSIBLY UNSAFE: printf] [no copyright]
  A            memcheck/tests/badjump2.stderr.exp   1.1.2.1
  A            memcheck/tests/badjump2.vgtest   1.1.2.1
  M +1 -1      coregrind/vg_include.h   1.235.2.2
  M +17 -5     coregrind/vg_scheduler.c   1.171.2.1
  M +4 -2      coregrind/vg_translate.c   1.88.2.1
  M +1 -0      memcheck/tests/.cvsignore   1.14.2.1
  M +4 -1      memcheck/tests/Makefile.am   1.41.2.1


--- valgrind/coregrind/vg_include.h  #1.235.2.1:1.235.2.2
@@ -1161,5 +1161,5 @@ struct _UCodeBlock { 
 };
 
-extern void VG_(translate)  ( ThreadId tid, Addr orig_addr, Bool debugging );
+extern Bool VG_(translate)  ( ThreadId tid, Addr orig_addr, Bool debugging );
 
 extern void VG_(sanity_check_UInstr) ( UInt n, UInstr* u );

--- valgrind/coregrind/vg_scheduler.c  #1.171:1.171.2.1
@@ -1022,15 +1022,27 @@ VgSchedReturnCode do_scheduler ( Int* ex
 
          if (trc == VG_TRC_INNER_FASTMISS) {
+            Addr ip = VG_(threads)[tid].m_eip;
+
             vg_assert(VG_(dispatch_ctr) > 0);
 
             /* Trivial event.  Miss in the fast-cache.  Do a full
                lookup for it. */
-            trans_addr = VG_(search_transtab) ( VG_(threads)[tid].m_eip );
+            trans_addr = VG_(search_transtab) ( ip );
             if (trans_addr == (Addr)0) {
                /* Not found; we need to request a translation. */
-               VG_(translate)( tid, VG_(threads)[tid].m_eip, /*debug*/False ); 
-               trans_addr = VG_(search_transtab) ( VG_(threads)[tid].m_eip ); 
+               if (VG_(translate)( tid, ip, /*debug*/False )) {
+                  trans_addr = VG_(search_transtab)( ip ); 
                if (trans_addr == (Addr)0)
                   VG_(core_panic)("VG_TRC_INNER_FASTMISS: missing tt_fast entry");
+               } else {
+                  // If VG_(translate)() fails, it's because it had to throw
+                  // a signal because the client jumped to a bad address.
+                  // This means VG_(deliver_signal)() will have been called
+                  // by now, and the program counter will now be pointing to
+                  // the start of the signal handler (if there is no
+                  // handler, things would have been aborted by now), so do
+                  // nothing, and things will work out next time around the
+                  // scheduler loop.
+               }
             }
             continue; /* with this thread */

--- valgrind/coregrind/vg_translate.c  #1.88:1.88.2.1
@@ -2429,5 +2429,5 @@ static void vg_realreg_liveness_analysis
    'tid' is the identity of the thread needing this block.
 */
-void VG_(translate) ( ThreadId tid, Addr orig_addr,
+Bool VG_(translate) ( ThreadId tid, Addr orig_addr,
                       Bool debugging_translation )
 {
@@ -2485,5 +2485,5 @@ void VG_(translate) ( ThreadId tid, Addr
          VG_(synth_fault_mapping)(tid, orig_addr);
 
-      return;
+      return False;
    } else
       seg->flags |= SF_CODE;    /* contains cached code */
@@ -2584,4 +2584,6 @@ void VG_(translate) ( ThreadId tid, Addr
 
    VGP_POPCC(VgpTranslate);
+
+   return True;
 }
 

--- valgrind/memcheck/tests/.cvsignore  #1.14:1.14.2.1
@@ -4,4 +4,5 @@
 badfree
 badjump
+badjump2
 badloop
 buflen_check

--- valgrind/memcheck/tests/Makefile.am  #1.41:1.41.2.1
@@ -16,4 +16,5 @@
         badfree.stderr.exp badfree.vgtest \
         badjump.stderr.exp badjump.vgtest \
+        badjump2.stderr.exp badjump2.vgtest \
         badloop.stderr.exp badloop.vgtest \
         badrw.stderr.exp badrw.vgtest \
@@ -79,5 +80,6 @@
 
 check_PROGRAMS = \
-        badaddrvalue badfree badjump badloop badrw brk brk2 buflen_check \
+        badaddrvalue badfree badjump badjump2 \
+        badloop badrw brk brk2 buflen_check \
         clientperm custom_alloc \
         doublefree error_counts errs1 exitprog execve execve2 \
@@ -99,4 +101,5 @@
 badfree_SOURCES         = badfree.c
 badjump_SOURCES         = badjump.c
+badjump2_SOURCES        = badjump2.c
 badloop_SOURCES         = badloop.c
 badrw_SOURCES           = badrw.c