Skip to content

Commit 0c46c5c

Browse files
committed
i#7826: Fix drx time scale verbose=2 null dereferences
Fixes drx time scale crashes when verbosity is raised to 2+ and an epoll_pwait2 system call is invoked by the app with a null (infinite) timeout. Adds a test case of a null timeout to epoll_pwait2. Tested by raising verbosity and observing a crash with the fix and no crash without the fix. Also tested on the internal test that first hit this issue. Fixes #7826
1 parent eacfd20 commit 0c46c5c

File tree

2 files changed

+10
-4
lines changed

2 files changed

+10
-4
lines changed

ext/drx/drx_time_scale.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* **********************************************************
2-
* Copyright (c) 2025 Google, Inc. All rights reserved.
2+
* Copyright (c) 2025-2026 Google, Inc. All rights reserved.
33
* **********************************************************/
44

55
/*
@@ -725,7 +725,8 @@ event_pre_syscall(void *drcontext, int sysnum)
725725
struct timespec *spec = (struct timespec *)dr_syscall_get_param(drcontext, 3);
726726
data->app_set_timer_param = spec;
727727
NOTIFY(2, "T" TIDFMT " epoll_pwait2 time=%p %" SSZFC ".%.12" SSZFC "\n",
728-
dr_get_thread_id(drcontext), spec, spec->tv_sec, spec->tv_nsec);
728+
dr_get_thread_id(drcontext), spec, spec == NULL ? 0 : spec->tv_sec,
729+
spec == NULL ? 0 : spec->tv_nsec);
729730
if (spec == NULL) /* Infinite. */
730731
break;
731732
size_t wrote;
@@ -746,7 +747,8 @@ event_pre_syscall(void *drcontext, int sysnum)
746747
NOTIFY(2,
747748
"T" TIDFMT " epoll_pwait2 time=%p %" INT64_FORMAT_CODE
748749
".%.12" INT64_FORMAT_CODE "\n",
749-
dr_get_thread_id(drcontext), spec, spec->tv_sec, spec->tv_nsec);
750+
dr_get_thread_id(drcontext), spec, spec == NULL ? 0 : spec->tv_sec,
751+
spec == NULL ? 0 : spec->tv_nsec);
750752
if (spec == NULL) /* Infinite. */
751753
break;
752754
size_t wrote;

suite/tests/client-interface/drx_timeout_scale-test.cpp

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* **********************************************************
2-
* Copyright (c) 2025 Google, Inc. All rights reserved.
2+
* Copyright (c) 2025-2026 Google, Inc. All rights reserved.
33
* **********************************************************/
44

55
/*
@@ -238,6 +238,10 @@ perform_epolls()
238238
/*sigmask=*/nullptr);
239239
assert(res == 0);
240240
++epoll_count;
241+
// Test a null timeout to ensure we don't fall over.
242+
res = epoll_pwait2(/*fd=*/-1, &events, EPOLL_MAX_EVENTS, /*timeout=*/nullptr,
243+
/*sigmask=*/nullptr);
244+
assert(res != 0);
241245
#endif
242246
}
243247
return epoll_count;

0 commit comments

Comments
 (0)