[compiler-rt] [compiler-rt] [sanitizer_common] Fix SIGSEGV in ForEachMappedRegion for DSOs with custom image base (PR #206299)

[Mike Kruskal via llvm-commits]

https://github.com/mkruskal-google updated https://github.com/llvm/llvm-project/pull/206299

>From e8404935a8c31566e03305c2b4371f6b5b41618e Mon Sep 17 00:00:00 2001
From: Mike Kruskal <mkruskal at google.com>
Date: Sat, 27 Jun 2026 19:45:01 -0700
Subject: [PATCH 1/2] Fix SIGSEGV in ForEachMappedRegion for DSOs with custom
 image base

---
 .../lib/sanitizer_common/sanitizer_linux.cpp  |  4 ++
 compiler-rt/test/msan/dlopen_image_base.c     | 53 +++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 compiler-rt/test/msan/dlopen_image_base.c

diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
index 6f0259f31dbf5..2f21a8d992e13 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
@@ -1404,6 +1404,10 @@ void ForEachMappedRegion(link_map *map, void (*cb)(const void *, uptr)) {
   typedef ElfW(Ehdr) Elf_Ehdr;
 #    endif  // !SANITIZER_FREEBSD
   char *base = (char *)map->l_addr;
+  Dl_info info;
+  if (dladdr((void *)map->l_ld, &info) && info.dli_fbase) {
+    base = (char *)info.dli_fbase;
+  }
   Elf_Ehdr *ehdr = (Elf_Ehdr *)base;
   char *phdrs = base + ehdr->e_phoff;
   char *phdrs_end = phdrs + ehdr->e_phnum * ehdr->e_phentsize;
diff --git a/compiler-rt/test/msan/dlopen_image_base.c b/compiler-rt/test/msan/dlopen_image_base.c
new file mode 100644
index 0000000000000..07121b02501e5
--- /dev/null
+++ b/compiler-rt/test/msan/dlopen_image_base.c
@@ -0,0 +1,53 @@
+/* RUN: %clang_msan -g %s -o %t
+   RUN: %clang_msan -g %s -DBUILD_SO -fPIC -o %t-so.so -shared -Wl,--image-base=0x4000000
+   RUN: %run %t 2>&1
+   REQUIRES: glibc
+*/
+
+#ifndef BUILD_SO
+#define _GNU_SOURCE
+#include <assert.h>
+#include <dlfcn.h>
+#include <link.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[]) {
+  char path[4096];
+  snprintf(path, sizeof(path), "%s-so.so", argv[0]);
+
+  void *handle = dlopen(path, RTLD_LAZY);
+  if (!handle) {
+    fprintf(stderr, "dlopen failed: %s\n", dlerror());
+    return 1;
+  }
+
+  struct link_map *map = NULL;
+  dlinfo(handle, RTLD_DI_LINKMAP, &map);
+  if (map) {
+    printf("DSO link_map name: %s\n", map->l_name);
+    printf("DSO link_map l_addr: %p\n", (void*)map->l_addr);
+    int pipefd[2];
+    bool readable = false;
+    if (pipe(pipefd) == 0) {
+      if (write(pipefd[1], (void*)map->l_addr, 1) == 1) {
+        readable = true;
+      }
+      close(pipefd[0]);
+      close(pipefd[1]);
+    }
+    printf("DSO l_addr readable: %d\n", readable);
+  }
+
+  void (*fn)() = (void (*)())dlsym(handle, "fn");
+  assert(fn != NULL);
+  fn();
+
+  dlclose(handle);
+  return 0;
+}
+#else // BUILD_SO
+#include <stdio.h>
+void fn() { printf("DSO function called successfully\n"); }
+#endif

>From d78e9b597b08a11a90801f8170b2348710301fd6 Mon Sep 17 00:00:00 2001
From: Mike Kruskal <mkruskal at google.com>
Date: Wed, 8 Jul 2026 17:48:08 -0700
Subject: [PATCH 2/2] Response to review comments

---
 compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp            | 2 ++
 .../TestCases/Linux}/dlopen_image_base.c                        | 1 +
 2 files changed, 3 insertions(+)
 rename compiler-rt/test/{msan => sanitizer_common/TestCases/Linux}/dlopen_image_base.c (97%)

diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
index 2f21a8d992e13..20e93c36338f6 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
@@ -1404,10 +1404,12 @@ void ForEachMappedRegion(link_map *map, void (*cb)(const void *, uptr)) {
   typedef ElfW(Ehdr) Elf_Ehdr;
 #    endif  // !SANITIZER_FREEBSD
   char *base = (char *)map->l_addr;
+#    if SANITIZER_GLIBC
   Dl_info info;
   if (dladdr((void *)map->l_ld, &info) && info.dli_fbase) {
     base = (char *)info.dli_fbase;
   }
+#    endif  // SANITIZER_GLIBC
   Elf_Ehdr *ehdr = (Elf_Ehdr *)base;
   char *phdrs = base + ehdr->e_phoff;
   char *phdrs_end = phdrs + ehdr->e_phnum * ehdr->e_phentsize;
diff --git a/compiler-rt/test/msan/dlopen_image_base.c b/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
similarity index 97%
rename from compiler-rt/test/msan/dlopen_image_base.c
rename to compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
index 07121b02501e5..090c7d8ed1a38 100644
--- a/compiler-rt/test/msan/dlopen_image_base.c
+++ b/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
@@ -1,6 +1,7 @@
 /* RUN: %clang_msan -g %s -o %t
    RUN: %clang_msan -g %s -DBUILD_SO -fPIC -o %t-so.so -shared -Wl,--image-base=0x4000000
    RUN: %run %t 2>&1
+   REQUIRES: lld-available
    REQUIRES: glibc
 */