[compiler-rt] Fix SIGSEGV in ForEachMappedRegion for DSOs with custom image base (PR #206299)

[Mike Kruskal via llvm-commits]

https://github.com/mkruskal-google created https://github.com/llvm/llvm-project/pull/206299

`ForEachMappedRegion` processes dynamic linker map entries to track loaded segments. However, it assumes map->l_addr is the address of the ELF header.  For DSOs linked with a custom preferred image base offset (e.g. -Wl,--image-base=0x4000000), `map->l_addr` contains the relocation bias: `map->l_addr = actual_load_address - preferred_base`

In this case, map->l_addr points below the first loaded segment in unmapped or PROT_NONE memory. Doing a read dereference at this address triggers a SIGSEGV.  Add a call to dladdr() on the dynamic section pointer map->l_ld to obtain the true ELF header base address.

>From e8404935a8c31566e03305c2b4371f6b5b41618e Mon Sep 17 00:00:00 2001
From: Mike Kruskal <mkruskal at google.com>
Date: Sat, 27 Jun 2026 19:45:01 -0700
Subject: [PATCH] Fix SIGSEGV in ForEachMappedRegion for DSOs with custom image
 base

---
 .../lib/sanitizer_common/sanitizer_linux.cpp  |  4 ++
 compiler-rt/test/msan/dlopen_image_base.c     | 53 +++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 compiler-rt/test/msan/dlopen_image_base.c

diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
index 6f0259f31dbf5..2f21a8d992e13 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
@@ -1404,6 +1404,10 @@ void ForEachMappedRegion(link_map *map, void (*cb)(const void *, uptr)) {
   typedef ElfW(Ehdr) Elf_Ehdr;
 #    endif  // !SANITIZER_FREEBSD
   char *base = (char *)map->l_addr;
+  Dl_info info;
+  if (dladdr((void *)map->l_ld, &info) && info.dli_fbase) {
+    base = (char *)info.dli_fbase;
+  }
   Elf_Ehdr *ehdr = (Elf_Ehdr *)base;
   char *phdrs = base + ehdr->e_phoff;
   char *phdrs_end = phdrs + ehdr->e_phnum * ehdr->e_phentsize;
diff --git a/compiler-rt/test/msan/dlopen_image_base.c b/compiler-rt/test/msan/dlopen_image_base.c
new file mode 100644
index 0000000000000..07121b02501e5
--- /dev/null
+++ b/compiler-rt/test/msan/dlopen_image_base.c
@@ -0,0 +1,53 @@
+/* RUN: %clang_msan -g %s -o %t
+   RUN: %clang_msan -g %s -DBUILD_SO -fPIC -o %t-so.so -shared -Wl,--image-base=0x4000000
+   RUN: %run %t 2>&1
+   REQUIRES: glibc
+*/
+
+#ifndef BUILD_SO
+#define _GNU_SOURCE
+#include <assert.h>
+#include <dlfcn.h>
+#include <link.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[]) {
+  char path[4096];
+  snprintf(path, sizeof(path), "%s-so.so", argv[0]);
+
+  void *handle = dlopen(path, RTLD_LAZY);
+  if (!handle) {
+    fprintf(stderr, "dlopen failed: %s\n", dlerror());
+    return 1;
+  }
+
+  struct link_map *map = NULL;
+  dlinfo(handle, RTLD_DI_LINKMAP, &map);
+  if (map) {
+    printf("DSO link_map name: %s\n", map->l_name);
+    printf("DSO link_map l_addr: %p\n", (void*)map->l_addr);
+    int pipefd[2];
+    bool readable = false;
+    if (pipe(pipefd) == 0) {
+      if (write(pipefd[1], (void*)map->l_addr, 1) == 1) {
+        readable = true;
+      }
+      close(pipefd[0]);
+      close(pipefd[1]);
+    }
+    printf("DSO l_addr readable: %d\n", readable);
+  }
+
+  void (*fn)() = (void (*)())dlsym(handle, "fn");
+  assert(fn != NULL);
+  fn();
+
+  dlclose(handle);
+  return 0;
+}
+#else // BUILD_SO
+#include <stdio.h>
+void fn() { printf("DSO function called successfully\n"); }
+#endif