From nobody Fri Dec 01 00:38:35 2023 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ShDgv5DMMz53288; Fri, 1 Dec 2023 00:38:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4ShDgv4kBMz4LPQ; Fri, 1 Dec 2023 00:38:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1701391115; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lDiOv/VMU4SZ2kYtUE4idEAQY5VGPwBoyTwH8oty5CA=; b=vYVLESlLZkyxF/WW37ZiUNlmJtlxmAzkOOFKYHhgjV+qqIbmyhl2BQnRJ8BE+8tbRC0eR7 i8x9J/rETRZIAmC8DwvlXbuqvk/BEN2qC/ifAs1SHGzcahZfeaFjqDw5SvdvHCjDaVCEeV 2l8Tj4hoYSSG+7/BkE6aTWH6pulUEFqb7GNijI4p7jcm0FlApY4/ZQIRhIHvwBSEKR9e2j sNB9+FUFZSEksgtJvH1PYrGGZe459qxV943wdqEmQ+H5Ozax+Wbggw1Klo6PbNbuCdEU9I Qkb4b8xYjJFnMf+wDck790d7nhPjm8d7TEh7aEzt/gGeI8qaDAtV9QLMoO7qfg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1701391115; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lDiOv/VMU4SZ2kYtUE4idEAQY5VGPwBoyTwH8oty5CA=; b=Ej2DWlGEnl7ftLWBHnxMRrdt+94OR2f85kD7gYTzswN+nSOnYqj8gp5AOJTRcS4SgopERM ZpUQwA3vfy3uycfDMED4YFJGpiDY5ajBhmBh//GRE8pvAKLYRx0/T2F5lU7QfyP6xaLEoo 2v09Vo1N5+mB2r17O3l7FJahoZbXsQSq5zjXJGVG5hv7pJwvcWdacrVItGBGlzTrel3+Eg C9Q0FDhmRdNvZDTGmjb21mB6H8h8QgsJKbdwU+cdK7+wD5pblMRgYHJnuog3CYrDSLQJyx 8YCedx3v2V28HPP3mNHzPmEtuJovBzUsW/MSvTTUU5nXVuxPgFbM4O7/Ombyhg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1701391115; a=rsa-sha256; cv=none; b=a/on9K/KU52oAKCYLgxP/McFxnOoEalVfwjxft4hCEs7zyOHLfxB2/VS1q4xHokr9+gg8Z GO3gDnavcIZBvB3pI5KEUS0Q/AgfsCUsYpiPKas5a+0d8KnmU+8GBdgiQve1QY8IJ4IrWZ QyYiU9SgrUT5kKzHERYy/y3GB6jk+V1mMkPje1IT1UKFvcA5JK6WVHaP8xICuVI024cpje UnlVX/HdDI90RkJDR94CZY780T9k9POYFdrx0awp5UNt3GswjqcSM9BeXOPIaVn2VJMjFH 60uztkQ2DzzXAcFG2kCVYrUu6Z1/98pbr7DjaqjI+HjfesrlkuaSIQr30IF3zA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4ShDgv3mqnz1BbY; Fri, 1 Dec 2023 00:38:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 3B10cZIa056617; Fri, 1 Dec 2023 00:38:35 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 3B10cZxh056614; Fri, 1 Dec 2023 00:38:35 GMT (envelope-from git) Date: Fri, 1 Dec 2023 00:38:35 GMT Message-Id: <202312010038.3B10cZxh056614@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Gordon Tetlow Subject: git: 78b4c762b20b - releng/14.0 - compiler-rt: avoid segfaults when re-exec'ing with ASLR List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: gordon X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.0 X-Git-Reftype: branch X-Git-Commit: 78b4c762b20b188cd7bc65999ed44e431a8882ff Auto-Submitted: auto-generated The branch releng/14.0 has been updated by gordon: URL: https://cgit.FreeBSD.org/src/commit/?id=78b4c762b20b188cd7bc65999ed44e431a8882ff commit 78b4c762b20b188cd7bc65999ed44e431a8882ff Author: Dimitry Andric AuthorDate: 2023-11-22 18:23:06 +0000 Commit: Gordon Tetlow CommitDate: 2023-11-30 21:24:58 +0000 compiler-rt: avoid segfaults when re-exec'ing with ASLR After 930a7c2ac67e ("compiler-rt: re-exec with ASLR disabled when necessary") and 96fe7c8ab0f6 ("compiler-rt: support ReExec() on FreeBSD"), binaries linked against the sanitizer libraries may segfault due to procctl(2) being intercepted. Instead, the non-intercepted internal_procctl() should be called. Similarly, the ReExec() function that re-executes the binary after turning off ASLR should not call elf_aux_info(3) and realpath(3), since these will also be intercepted. Instead, loop directly over the elf aux info vector to find the executable path, and avoid calling realpath(3) since it is actually unwanted for this use case. Fixes: 930a7c2ac67e, 96fe7c8ab0f6 MFC after: 3 days Approved by: so Security: FreeBSD-EN-23:15.sanitizer (cherry picked from commit 4c9a0adad18263ec8725d9bfc5f560c6ad1da8bd) (cherry picked from commit 1e4798e9677f17a7cdc9a1873a0c6e008fc620d8) --- .../compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp | 2 +- .../lib/sanitizer_common/sanitizer_linux_libcdep.cpp | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/contrib/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp b/contrib/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp index 3f544623c6fb..ebbd14eca72f 100644 --- a/contrib/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp +++ b/contrib/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp @@ -2323,7 +2323,7 @@ void CheckASLR() { "and binaries compiled with PIE\n" "ASLR will be disabled and the program re-executed.\n"); int aslr_ctl = PROC_ASLR_FORCE_DISABLE; - CHECK_NE(procctl(P_PID, 0, PROC_ASLR_CTL, &aslr_ctl), -1); + CHECK_NE(internal_procctl(P_PID, 0, PROC_ASLR_CTL, &aslr_ctl), -1); ReExec(); } # elif SANITIZER_PPC64V2 diff --git a/contrib/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cpp b/contrib/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cpp index ff62fc4af430..58310e05b359 100644 --- a/contrib/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cpp +++ b/contrib/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cpp @@ -56,6 +56,7 @@ // that, it was never implemented. So just define it to zero. #undef MAP_NORESERVE #define MAP_NORESERVE 0 +extern const Elf_Auxinfo *__elf_aux_vector; #endif #if SANITIZER_NETBSD @@ -947,11 +948,11 @@ void ReExec() { const char *pathname = "/proc/self/exe"; #if SANITIZER_FREEBSD - char exe_path[PATH_MAX]; - if (elf_aux_info(AT_EXECPATH, exe_path, sizeof(exe_path)) == 0) { - char link_path[PATH_MAX]; - if (realpath(exe_path, link_path)) - pathname = link_path; + for (const auto *aux = __elf_aux_vector; aux->a_type != AT_NULL; aux++) { + if (aux->a_type == AT_EXECPATH) { + pathname = static_cast(aux->a_un.a_ptr); + break; + } } #elif SANITIZER_NETBSD static const int name[] = {