Date: Sat, 27 Jun 2026 16:08:11 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 295991] lib/libc posix_spawnp(): PATH-search child runs on an undersized rfork_thread stack and underflows into the caller's heap (heavily-linked processes; PHP proc_open) Message-ID: <bug-295991-227-hXEK0mkKwa@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-295991-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | previous in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295991 --- Comment #8 from Kyle Evans <kevans@freebsd.org> --- (In reply to Konstantin Belousov from comment #7) This seems to fix my somewhat amusing reproducer: https://paste.fbsd.dev/t3i5 -- patch is kind of hacky because we don't have an asan COMPILER_FEATURES yet. I don't know that the sketchy .XXX SONAME and runtime replacement is really necessary, but I had added it when I couldn't figure out why my object wasn't being loaded again. In this test case, the failure mode is that the child crashes and atf hangs: ``` root@ifrit:/usr/src/lib/libc/tests/gen # env ASAN_OPTIONS="detect_leaks=0" /usr/tests/lib/libc/gen/posix_spawn_test posix_spawnp_stackoverflow posix_spawn_test: WARNING: Running test cases outside of kyua(1) is unsupported posix_spawn_test: WARNING: No isolation nor timeout control is being applied; you may get unexpected failures; see atf-test-case(4) failed: /usr/src/lib/libc/tests/gen/posix_spawn_test.c:239: WIFEXITED(status) && WEXITSTATUS(status) == 0 not met o load: 0.57 cmd: posix_spawn_test 1912 [uwrlck] 4.05r 0.00u 0.00s 0% 10076k mi_switch+0x172 sleepq_switch+0x109 sleepq_catch_signals+0x276 sleepq_wait_sig+0x9 _sleep+0x29a umtxq_sleep+0x302 do_rw_wrlock+0x3d3 sys__umtx_op+0x7e amd64_syscall+0x168 fast_syscall_common+0xf8 ``` I guess we end up wiping out one of the rtld locks or something. -- You are receiving this mail because: You are the assignee for the bug.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-295991-227-hXEK0mkKwa>