[compiler-rt] [compiler-rt] [sanitizer_common] Fix SIGSEGV in ForEachMappedRegion for DSOs with custom image base (PR #206299)
Mike Kruskal via llvm-commits
llvm-commits at lists.llvm.org
Wed Jul 8 18:07:25 PDT 2026
https://github.com/mkruskal-google updated https://github.com/llvm/llvm-project/pull/206299
>From f05f412150992bfe8824afb6f30f2b53ff99c244 Mon Sep 17 00:00:00 2001
From: Mike Kruskal <mkruskal at google.com>
Date: Sat, 27 Jun 2026 19:45:01 -0700
Subject: [PATCH 1/4] Add a testcase reproducing #84482 and #21068
---
.../TestCases/Linux/dlopen_image_base.c | 55 +++++++++++++++++++
1 file changed, 55 insertions(+)
create mode 100644 compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
diff --git a/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c b/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
new file mode 100644
index 0000000000000..c7f7639f4c446
--- /dev/null
+++ b/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
@@ -0,0 +1,55 @@
+/* RUN: %clang_msan -g %s -o %t
+ RUN: %clang_msan -g %s -DBUILD_SO -fPIC -o %t-so.so -shared -Wl,--image-base=0x4000000
+ RUN: %run %t 2>&1
+ REQUIRES: lld-available
+ REQUIRES: glibc
+ XFAIL: msan, dfsan
+*/
+
+#ifndef BUILD_SO
+#define _GNU_SOURCE
+#include <assert.h>
+#include <dlfcn.h>
+#include <link.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[]) {
+ char path[4096];
+ snprintf(path, sizeof(path), "%s-so.so", argv[0]);
+
+ void *handle = dlopen(path, RTLD_LAZY);
+ if (!handle) {
+ fprintf(stderr, "dlopen failed: %s\n", dlerror());
+ return 1;
+ }
+
+ struct link_map *map = NULL;
+ dlinfo(handle, RTLD_DI_LINKMAP, &map);
+ if (map) {
+ printf("DSO link_map name: %s\n", map->l_name);
+ printf("DSO link_map l_addr: %p\n", (void*)map->l_addr);
+ int pipefd[2];
+ bool readable = false;
+ if (pipe(pipefd) == 0) {
+ if (write(pipefd[1], (void*)map->l_addr, 1) == 1) {
+ readable = true;
+ }
+ close(pipefd[0]);
+ close(pipefd[1]);
+ }
+ printf("DSO l_addr readable: %d\n", readable);
+ }
+
+ void (*fn)() = (void (*)())dlsym(handle, "fn");
+ assert(fn != NULL);
+ fn();
+
+ dlclose(handle);
+ return 0;
+}
+#else // BUILD_SO
+#include <stdio.h>
+void fn() { printf("DSO function called successfully\n"); }
+#endif
>From 95638bf8628134b115a99b2f4820ef8e026be25b Mon Sep 17 00:00:00 2001
From: Mike Kruskal <mkruskal at google.com>
Date: Wed, 8 Jul 2026 18:05:52 -0700
Subject: [PATCH 2/4] Fix formatting
---
.../TestCases/Linux/dlopen_image_base.c | 20 +++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c b/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
index c7f7639f4c446..e340d0bd2bfe2 100644
--- a/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
+++ b/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
@@ -7,13 +7,13 @@
*/
#ifndef BUILD_SO
-#define _GNU_SOURCE
-#include <assert.h>
-#include <dlfcn.h>
-#include <link.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <unistd.h>
+# define _GNU_SOURCE
+# include <assert.h>
+# include <dlfcn.h>
+# include <link.h>
+# include <stdbool.h>
+# include <stdio.h>
+# include <unistd.h>
int main(int argc, char *argv[]) {
char path[4096];
@@ -29,11 +29,11 @@ int main(int argc, char *argv[]) {
dlinfo(handle, RTLD_DI_LINKMAP, &map);
if (map) {
printf("DSO link_map name: %s\n", map->l_name);
- printf("DSO link_map l_addr: %p\n", (void*)map->l_addr);
+ printf("DSO link_map l_addr: %p\n", (void *)map->l_addr);
int pipefd[2];
bool readable = false;
if (pipe(pipefd) == 0) {
- if (write(pipefd[1], (void*)map->l_addr, 1) == 1) {
+ if (write(pipefd[1], (void *)map->l_addr, 1) == 1) {
readable = true;
}
close(pipefd[0]);
@@ -50,6 +50,6 @@ int main(int argc, char *argv[]) {
return 0;
}
#else // BUILD_SO
-#include <stdio.h>
+# include <stdio.h>
void fn() { printf("DSO function called successfully\n"); }
#endif
>From 34b49383e9f1a8dcbfe8bd00e1664f5d596da8ab Mon Sep 17 00:00:00 2001
From: Mike Kruskal <mkruskal at google.com>
Date: Sat, 27 Jun 2026 19:45:01 -0700
Subject: [PATCH 3/4] Fix SIGSEGV in ForEachMappedRegion for DSOs with custom
image base
---
.../lib/sanitizer_common/sanitizer_linux.cpp | 4 ++
compiler-rt/test/msan/dlopen_image_base.c | 53 +++++++++++++++++++
2 files changed, 57 insertions(+)
create mode 100644 compiler-rt/test/msan/dlopen_image_base.c
diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
index 6f0259f31dbf5..2f21a8d992e13 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
@@ -1404,6 +1404,10 @@ void ForEachMappedRegion(link_map *map, void (*cb)(const void *, uptr)) {
typedef ElfW(Ehdr) Elf_Ehdr;
# endif // !SANITIZER_FREEBSD
char *base = (char *)map->l_addr;
+ Dl_info info;
+ if (dladdr((void *)map->l_ld, &info) && info.dli_fbase) {
+ base = (char *)info.dli_fbase;
+ }
Elf_Ehdr *ehdr = (Elf_Ehdr *)base;
char *phdrs = base + ehdr->e_phoff;
char *phdrs_end = phdrs + ehdr->e_phnum * ehdr->e_phentsize;
diff --git a/compiler-rt/test/msan/dlopen_image_base.c b/compiler-rt/test/msan/dlopen_image_base.c
new file mode 100644
index 0000000000000..07121b02501e5
--- /dev/null
+++ b/compiler-rt/test/msan/dlopen_image_base.c
@@ -0,0 +1,53 @@
+/* RUN: %clang_msan -g %s -o %t
+ RUN: %clang_msan -g %s -DBUILD_SO -fPIC -o %t-so.so -shared -Wl,--image-base=0x4000000
+ RUN: %run %t 2>&1
+ REQUIRES: glibc
+*/
+
+#ifndef BUILD_SO
+#define _GNU_SOURCE
+#include <assert.h>
+#include <dlfcn.h>
+#include <link.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <unistd.h>
+
+int main(int argc, char *argv[]) {
+ char path[4096];
+ snprintf(path, sizeof(path), "%s-so.so", argv[0]);
+
+ void *handle = dlopen(path, RTLD_LAZY);
+ if (!handle) {
+ fprintf(stderr, "dlopen failed: %s\n", dlerror());
+ return 1;
+ }
+
+ struct link_map *map = NULL;
+ dlinfo(handle, RTLD_DI_LINKMAP, &map);
+ if (map) {
+ printf("DSO link_map name: %s\n", map->l_name);
+ printf("DSO link_map l_addr: %p\n", (void*)map->l_addr);
+ int pipefd[2];
+ bool readable = false;
+ if (pipe(pipefd) == 0) {
+ if (write(pipefd[1], (void*)map->l_addr, 1) == 1) {
+ readable = true;
+ }
+ close(pipefd[0]);
+ close(pipefd[1]);
+ }
+ printf("DSO l_addr readable: %d\n", readable);
+ }
+
+ void (*fn)() = (void (*)())dlsym(handle, "fn");
+ assert(fn != NULL);
+ fn();
+
+ dlclose(handle);
+ return 0;
+}
+#else // BUILD_SO
+#include <stdio.h>
+void fn() { printf("DSO function called successfully\n"); }
+#endif
>From b6537c8d07bdb92d5d97a3313ebb71a019444af1 Mon Sep 17 00:00:00 2001
From: Mike Kruskal <mkruskal at google.com>
Date: Wed, 8 Jul 2026 17:48:08 -0700
Subject: [PATCH 4/4] Response to review comments
---
.../lib/sanitizer_common/sanitizer_linux.cpp | 2 +
compiler-rt/test/msan/dlopen_image_base.c | 53 -------------------
.../TestCases/Linux/dlopen_image_base.c | 1 -
3 files changed, 2 insertions(+), 54 deletions(-)
delete mode 100644 compiler-rt/test/msan/dlopen_image_base.c
diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
index 2f21a8d992e13..20e93c36338f6 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
+++ b/compiler-rt/lib/sanitizer_common/sanitizer_linux.cpp
@@ -1404,10 +1404,12 @@ void ForEachMappedRegion(link_map *map, void (*cb)(const void *, uptr)) {
typedef ElfW(Ehdr) Elf_Ehdr;
# endif // !SANITIZER_FREEBSD
char *base = (char *)map->l_addr;
+# if SANITIZER_GLIBC
Dl_info info;
if (dladdr((void *)map->l_ld, &info) && info.dli_fbase) {
base = (char *)info.dli_fbase;
}
+# endif // SANITIZER_GLIBC
Elf_Ehdr *ehdr = (Elf_Ehdr *)base;
char *phdrs = base + ehdr->e_phoff;
char *phdrs_end = phdrs + ehdr->e_phnum * ehdr->e_phentsize;
diff --git a/compiler-rt/test/msan/dlopen_image_base.c b/compiler-rt/test/msan/dlopen_image_base.c
deleted file mode 100644
index 07121b02501e5..0000000000000
--- a/compiler-rt/test/msan/dlopen_image_base.c
+++ /dev/null
@@ -1,53 +0,0 @@
-/* RUN: %clang_msan -g %s -o %t
- RUN: %clang_msan -g %s -DBUILD_SO -fPIC -o %t-so.so -shared -Wl,--image-base=0x4000000
- RUN: %run %t 2>&1
- REQUIRES: glibc
-*/
-
-#ifndef BUILD_SO
-#define _GNU_SOURCE
-#include <assert.h>
-#include <dlfcn.h>
-#include <link.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <unistd.h>
-
-int main(int argc, char *argv[]) {
- char path[4096];
- snprintf(path, sizeof(path), "%s-so.so", argv[0]);
-
- void *handle = dlopen(path, RTLD_LAZY);
- if (!handle) {
- fprintf(stderr, "dlopen failed: %s\n", dlerror());
- return 1;
- }
-
- struct link_map *map = NULL;
- dlinfo(handle, RTLD_DI_LINKMAP, &map);
- if (map) {
- printf("DSO link_map name: %s\n", map->l_name);
- printf("DSO link_map l_addr: %p\n", (void*)map->l_addr);
- int pipefd[2];
- bool readable = false;
- if (pipe(pipefd) == 0) {
- if (write(pipefd[1], (void*)map->l_addr, 1) == 1) {
- readable = true;
- }
- close(pipefd[0]);
- close(pipefd[1]);
- }
- printf("DSO l_addr readable: %d\n", readable);
- }
-
- void (*fn)() = (void (*)())dlsym(handle, "fn");
- assert(fn != NULL);
- fn();
-
- dlclose(handle);
- return 0;
-}
-#else // BUILD_SO
-#include <stdio.h>
-void fn() { printf("DSO function called successfully\n"); }
-#endif
diff --git a/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c b/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
index e340d0bd2bfe2..d8986c4672cc6 100644
--- a/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
+++ b/compiler-rt/test/sanitizer_common/TestCases/Linux/dlopen_image_base.c
@@ -3,7 +3,6 @@
RUN: %run %t 2>&1
REQUIRES: lld-available
REQUIRES: glibc
- XFAIL: msan, dfsan
*/
#ifndef BUILD_SO
More information about the llvm-commits
mailing list