Date: Mon, 15 Dec 2025 17:00:25 +0000 From: Jessica Clarke <jrtc27@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: f1344d0aa816 - stable/14 - rtld-elf: Fix UB for direct exec with no extra rtld arguments Message-ID: <69403ea9.d0d2.199bac4@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/14 has been updated by jrtc27: URL: https://cgit.FreeBSD.org/src/commit/?id=f1344d0aa816d0a2e9b316d4bd28b5f478b5d3da commit f1344d0aa816d0a2e9b316d4bd28b5f478b5d3da Author: Jessica Clarke <jrtc27@FreeBSD.org> AuthorDate: 2025-05-06 22:14:51 +0000 Commit: Jessica Clarke <jrtc27@FreeBSD.org> CommitDate: 2025-12-15 16:58:44 +0000 rtld-elf: Fix UB for direct exec with no extra rtld arguments If no extra rtld arguments are provided, rtld_argc will be 1 (for argv[0] and so we are shifting the entire memory range down by a single pointer. However, unlike argv and envp, auxp's entries are two pointers in size, not one, and so in this case the source and destination overlap, meaning simple assignment is UB (C99 6.5.16.1p3). On many architectures this ends up being harmless as the compiler will emit double machine word loads and stores, or if it splits them it may still schedule them such that it works in this case, but our RISC-V baseline does not include such instructions and LLVM ends up picking a schedule that copies the second word before the first word, thereby replacing the first word with a copy of the second word. This results in direct exec mode segfaulting on RISC-V when given no arguments. Fix this by using a temporary in the source and let the compiler safely elide its use. Reviewed by: kib Fixes: 0fc65b0ab82c ("Make ld-elf.so.1 directly executable.") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D50185 (cherry picked from commit 2b04ba6e08b983d8756552286846059507bca7a3) --- libexec/rtld-elf/rtld.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c index a44a5e303dcc..1a5cb0a6fce9 100644 --- a/libexec/rtld-elf/rtld.c +++ b/libexec/rtld-elf/rtld.c @@ -498,7 +498,7 @@ rtld_trunc_page(uintptr_t x) func_ptr_type _rtld(Elf_Addr *sp, func_ptr_type *exit_proc, Obj_Entry **objp) { - Elf_Auxinfo *aux, *auxp, *auxpf, *aux_info[AT_COUNT]; + Elf_Auxinfo *aux, *auxp, *auxpf, *aux_info[AT_COUNT], auxtmp; Objlist_Entry *entry; Obj_Entry *last_interposer, *obj, *preload_tail; const Elf_Phdr *phdr; @@ -663,7 +663,12 @@ _rtld(Elf_Addr *sp, func_ptr_type *exit_proc, Obj_Entry **objp) dbg("move aux from %p to %p", auxpf, aux); /* XXXKIB insert place for AT_EXECPATH if not present */ for (;; auxp++, auxpf++) { - *auxp = *auxpf; + /* + * NB: Use a temporary since *auxpf and + * *auxp overlap if rtld_argc is 1 + */ + auxtmp = *auxpf; + *auxp = auxtmp; if (auxp->a_type == AT_NULL) break; }help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?69403ea9.d0d2.199bac4>