[pseudo][PATCH] makewrappers: Handle parameters marked as nonnull

["Philip Lorenz" <philip@bithub.de>]

Commit 60e25a36558f1f07dcce1a044fe976b475bec42b started dereferencing
the "path" parameter which for some functions is annotated with the
"nonnull" attribute. While the commit explicitly checks for NULL
pointers before dereferencing it, GCC (at optimization level 1 and
above) removes the check due to the "nonnull" attribute being set for
some parameters in the glibc headers (e.g. statx()).

However, the statx() man page explicitly allows calling with NULL
pointers (in which case the EFAULT is returned) and this behaviour is
used in the wild (e.g. in Rust) to determine whether the statx() system
call is supported.

Disabling the optimization is not possible ([1]) so prevent the compiler
optimization by referencing the parameter in a noop inline assembly
instruction instead.

[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100404

Signed-off-by: Philip Lorenz <philip@bithub.de>
---
 Makefile.in        |  2 ++
 makewrappers       |  6 +++++-
 test/test-fstat.c  | 29 +++++++++++++++++++++++++++++
 test/test-fstat.sh |  8 ++++++++
 4 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 test/test-fstat.c
 create mode 100755 test/test-fstat.sh

diff --git a/Makefile.in b/Makefile.in
index cf13010..10441ef 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -77,6 +77,8 @@ all: $(LIBPSEUDO) $(PSEUDO) $(PSEUDODB) $(PSEUDOLOG) $(PSEUDO_PROFILE)
 test: all | $(BIN) $(LIB) $(LOCALSTATE)
 	$(CC) $(CFLAGS) $(CFLAGS_PSEUDO) -o test/test-rename-fstat test/test-rename-fstat.c
 	$(CC) $(CFLAGS) $(CFLAGS_PSEUDO) -o test/test-openat test/test-openat.c
+	$(CC) $(CFLAGS) $(CFLAGS_PSEUDO) -o test/test-statx test/test-statx.c
+	$(CC) $(CFLAGS) $(CFLAGS_PSEUDO) -o test/test-fstat test/test-fstat.c
 	@./run_tests.sh -v
 
 install-lib: $(LIBPSEUDO)
diff --git a/makewrappers b/makewrappers
index 818834e..cf5ad60 100755
--- a/makewrappers
+++ b/makewrappers
@@ -375,8 +375,12 @@ class Function:
             if self.dirfd != "AT_FDCWD" and "flags" in self.flags \
                     and "AT_SYMLINK_NOFOLLOW" in self.flags:
                 fix_paths.append(
+                    # Reference the variable inside a noop inline-asm to stop
+                    # the compiler from eliminating the null pointer check
+                    # on parameters marked nonnull
+                    "asm(\"\" : \"+r\"(%s));"
                     "if (%s && !*%s && (flags & AT_EMPTY_PATH))\n"
-                    "\t\t\tflags |= AT_SYMLINK_NOFOLLOW;" % (path, path))
+                    "\t\t\tflags |= AT_SYMLINK_NOFOLLOW;" % (path, path, path))
             fix_paths.append(
                 "%s = pseudo_root_path(__func__, __LINE__, %s%s, %s, %s);" %
                 (path, prefix, self.dirfd, path, self.flags))
diff --git a/test/test-fstat.c b/test/test-fstat.c
new file mode 100644
index 0000000..78f7013
--- /dev/null
+++ b/test/test-fstat.c
@@ -0,0 +1,29 @@
+/*
+ * Test that stat'ing a file descriptor of a symlink does not dereference the symlink
+ * SPDX-License-Identifier: LGPL-2.1-only
+ *
+ */
+#define _GNU_SOURCE
+
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <fcntl.h>
+#include <stdio.h>
+
+int main(void) {
+    struct stat buf;
+    int fd = open("symlink", O_NOFOLLOW | O_PATH);
+    if (fd == -1) {
+        perror("open symlink");
+        return 1;
+    }
+    if (fstatat(fd, "", &buf, AT_EMPTY_PATH) == -1) {
+        perror("stat symlink");
+        return 1;
+    }
+    if (S_ISLNK(buf.st_mode) != 1) {
+        fprintf(stderr, "path is not a symlink\n");
+        return 1;
+    }
+    return 0;
+}
diff --git a/test/test-fstat.sh b/test/test-fstat.sh
new file mode 100755
index 0000000..88eab8b
--- /dev/null
+++ b/test/test-fstat.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+#
+# SPDX-License-Identifier: LGPL-2.1-only
+#
+
+ln -s . symlink
+trap "rm symlink" 0
+./test/test-fstat
-- 
2.31.1