0v3QY7AfkHvTogOKgSPhv7vn2yNucx0vthdaFlztxdZ2eKN0EPZl0F+Ma6CAHD 3K16JEjwanThK92b5V4Kh8neNmMWCRNvJDcuvmXhxTFAjohKwjlK61C5lhUjavYkMwmdnu ExBzUKihgG5w7cl6TFL7Jg3b7Rkgxs1SE+NGP2zbfD4Xf1qqAiAjwlwA/MwJFFWTlADb8s vMKrVlv5EbQGcFPVITTS57zb17/i1SvpJlBghFZSUwdR5rvFssjCEcHQTEbxnI7326HF/f hZEfbtIyOiHm7m5icts3mXJAWY/Kyz435mWvqizckVzcaVtKPssRNDRPluPg1g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4dVSxS5K9JzVhc for ; Mon, 15 Dec 2025 18:18:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 231f6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 15 Dec 2025 18:18:52 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jessica Clarke Subject: git: cb48c371f277 - stable/13 - rtld-elf: Fix UB for direct exec with no extra rtld arguments List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jrtc27 X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: cb48c371f2770a33c7934bb0dc098fee76e28711 Auto-Submitted: auto-generated Date: Mon, 15 Dec 2025 18:18:52 +0000 Message-Id: <6940510c.231f6.2bc039a@gitrepo.freebsd.org> The branch stable/13 has been updated by jrtc27: URL: https://cgit.FreeBSD.org/src/commit/?id=cb48c371f2770a33c7934bb0dc098fee76e28711 commit cb48c371f2770a33c7934bb0dc098fee76e28711 Author: Jessica Clarke AuthorDate: 2025-05-06 22:14:51 +0000 Commit: Jessica Clarke CommitDate: 2025-12-15 17:56:36 +0000 rtld-elf: Fix UB for direct exec with no extra rtld arguments If no extra rtld arguments are provided, rtld_argc will be 1 (for argv[0] and so we are shifting the entire memory range down by a single pointer. However, unlike argv and envp, auxp's entries are two pointers in size, not one, and so in this case the source and destination overlap, meaning simple assignment is UB (C99 6.5.16.1p3). On many architectures this ends up being harmless as the compiler will emit double machine word loads and stores, or if it splits them it may still schedule them such that it works in this case, but our RISC-V baseline does not include such instructions and LLVM ends up picking a schedule that copies the second word before the first word, thereby replacing the first word with a copy of the second word. This results in direct exec mode segfaulting on RISC-V when given no arguments. Fix this by using a temporary in the source and let the compiler safely elide its use. Reviewed by: kib Fixes: 0fc65b0ab82c ("Make ld-elf.so.1 directly executable.") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D50185 (cherry picked from commit 2b04ba6e08b983d8756552286846059507bca7a3) --- libexec/rtld-elf/rtld.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c index 1cab00bb1c59..980f5c89edb7 100644 --- a/libexec/rtld-elf/rtld.c +++ b/libexec/rtld-elf/rtld.c @@ -510,7 +510,7 @@ rtld_trunc_page(uintptr_t x) func_ptr_type _rtld(Elf_Addr *sp, func_ptr_type *exit_proc, Obj_Entry **objp) { - Elf_Auxinfo *aux, *auxp, *auxpf, *aux_info[AT_COUNT]; + Elf_Auxinfo *aux, *auxp, *auxpf, *aux_info[AT_COUNT], auxtmp; Objlist_Entry *entry; Obj_Entry *last_interposer, *obj, *preload_tail; const Elf_Phdr *phdr; @@ -675,7 +675,12 @@ _rtld(Elf_Addr *sp, func_ptr_type *exit_proc, Obj_Entry **objp) dbg("move aux from %p to %p", auxpf, aux); /* XXXKIB insert place for AT_EXECPATH if not present */ for (;; auxp++, auxpf++) { - *auxp = *auxpf; + /* + * NB: Use a temporary since *auxpf and + * *auxp overlap if rtld_argc is 1 + */ + auxtmp = *auxpf; + *auxp = auxtmp; if (auxp->a_type == AT_NULL) break; }