[compiler-rt] [compiler-rt] [sanitizer_common] Fix SIGSEGV in ForEachMappedRegion for DSOs with custom image base (PR #206299)

[via llvm-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-compiler-rt-sanitizer

Author: Mike Kruskal (mkruskal-google)

<details>
<summary>Changes</summary>

`ForEachMappedRegion` processes dynamic linker map entries to track loaded segments. However, it assumes map->l_addr is the address of the ELF header.  For DSOs linked with a custom preferred image base offset (e.g. -Wl,--image-base=0x4000000), `map->l_addr` contains the relocation bias: `map->l_addr = actual_load_address - preferred_base`

In this case, map->l_addr points below the first loaded segment in unmapped or PROT_NONE memory. Doing a read dereference at this address triggers a SIGSEGV.  Add a call to dladdr() on the dynamic section pointer map->l_ld to obtain the true ELF header base address.

---
Full diff: https://github.com/llvm/llvm-project/pull/206299.diff


2 Files Affected:

- (modified) compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp (+4) 
- (added) compiler-rt/test/msan/dlopen_image_base.c (+53) 


``````````diff
diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
index 6f0259f31dbf5..2f21a8d992e13 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
@@ -1404,6 +1404,10 @@ void ForEachMappedRegion(link_map *map, void (*cb)(const void *, uptr)) {
   typedef ElfW(Ehdr) Elf_Ehdr;
 #    endif  // !SANITIZER_FREEBSD
   char *base = (char *)map->l_addr;
+  Dl_info info;
+  if (dladdr((void *)map->l_ld, &info) && info.dli_fbase) {
+    base = (char *)info.dli_fbase;
+  }
   Elf_Ehdr *ehdr = (Elf_Ehdr *)base;
   char *phdrs = base + ehdr->e_phoff;
   char *phdrs_end = phdrs + ehdr->e_phnum * ehdr->e_phentsize;
diff --git a/compiler-rt/test/msan/dlopen_image_base.c b/compiler-rt/test/msan/dlopen_image_base.c
new file mode 100644
index 0000000000000..07121b02501e5
--- /dev/null
+++ b/compiler-rt/test/msan/dlopen_image_base.c
@@ -0,0 +1,53 @@
+/* RUN: %clang_msan -g %s -o %t
+   RUN: %clang_msan -g %s -DBUILD_SO -fPIC -o %t-so.so -shared -Wl,--image-base=0x4000000
+   RUN: %run %t 2>&1
+   REQUIRES: glibc
+*/
+
+#ifndef BUILD_SO
+#define _GNU_SOURCE
+#include <assert.h>
+#include <dlfcn.h>
+#include <link.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[]) {
+  char path[4096];
+  snprintf(path, sizeof(path), "%s-so.so", argv[0]);
+
+  void *handle = dlopen(path, RTLD_LAZY);
+  if (!handle) {
+    fprintf(stderr, "dlopen failed: %s\n", dlerror());
+    return 1;
+  }
+
+  struct link_map *map = NULL;
+  dlinfo(handle, RTLD_DI_LINKMAP, &map);
+  if (map) {
+    printf("DSO link_map name: %s\n", map->l_name);
+    printf("DSO link_map l_addr: %p\n", (void*)map->l_addr);
+    int pipefd[2];
+    bool readable = false;
+    if (pipe(pipefd) == 0) {
+      if (write(pipefd[1], (void*)map->l_addr, 1) == 1) {
+        readable = true;
+      }
+      close(pipefd[0]);
+      close(pipefd[1]);
+    }
+    printf("DSO l_addr readable: %d\n", readable);
+  }
+
+  void (*fn)() = (void (*)())dlsym(handle, "fn");
+  assert(fn != NULL);
+  fn();
+
+  dlclose(handle);
+  return 0;
+}
+#else // BUILD_SO
+#include <stdio.h>
+void fn() { printf("DSO function called successfully\n"); }
+#endif

``````````

</details>


https://github.com/llvm/llvm-project/pull/206299