FORTIFY'ed binaries get SIGKILLed on user devices |
|||
Issue descriptionSplit out from issue 774573 . Yunlian, Luis said you may be a good person to look at this? --- Looks like there's glibc on reef (and maybe other boards) cause FORTIFY to SIGKILL programs instead of aborting them. From discussion on said issue, it sounds like this may keep us from getting crash reports? Repro (run from inside my chroot): $ cat foo.c int main() { const char buf[] = "Hello, world!"; char cs[4]; __builtin___memcpy_chk(cs, buf, sizeof(buf), sizeof(cs)); } $ clang -O2 foo.c -w $ gdb -ex r ./a.out [[snip]] *** buffer overflow detected ***: /tmp/a.out terminated ======= Backtrace: ========= /lib64/libc.so.6(+0x73b12)[0x7ffff7aa5b12] /lib64/libc.so.6(__fortify_fail+0x47)[0x7ffff7b35487] /lib64/libc.so.6(+0x101540)[0x7ffff7b33540] /tmp/a.out[0x40056a] /lib64/libc.so.6(__libc_start_main+0xf0)[0x7ffff7a52730] /tmp/a.out[0x400489] ======= Memory map: ======== [[snip]] Program received signal SIGABRT, Aborted. 0x00007ffff7a65cf2 in raise () from /lib64/libc.so.6 $ sudo cp a.out /build/reef $ gdb-reef /a.out (reef-gdb) r Starting program: /a.out *** buffer overflow detected ***: a.out terminated; report to <http://crbug.com/new> Program terminated with signal SIGKILL, Killed. The program no longer exists. (reef-gdb) Doing some initial greping around, FORTIFY lands us in __chk_fail, which calls __hardened_gentoo_fail. If ENABLE_SSP_SMASH_DUMPS_CORE is truthy, we'll abort(). Otherwise, we'll SIGKILL ourselves. SSP_SMASH_DUMPS_CORE controls whether ENABLE_SSP_SMASH_DUMPS_CORE is truthy.
,
Oct 20 2017
thanks for figuring this out! Definitely need a unittest for this! assigning to Yunlian.
,
Oct 20 2017
we should probably put the fix in the latest branch too.
,
Oct 21 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/4cc9a879ece06245816dd2625d0d7d123b229a03 commit 4cc9a879ece06245816dd2625d0d7d123b229a03 Author: Mike Frysinger <vapier@chromium.org> Date: Sat Oct 21 06:55:09 2017 glibc: re-enable coredumps on fortify failures This was lost during the upgrade. BUG= chromium:776972 TEST=None Change-Id: Icffac6c461715d36d8b447b8f2acbece3900cd76 Reviewed-on: https://chromium-review.googlesource.com/731659 Commit-Ready: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Manoj Gupta <manojgupta@chromium.org> [rename] https://crrev.com/4cc9a879ece06245816dd2625d0d7d123b229a03/sys-libs/glibc/glibc-2.23-r11.ebuild
,
Nov 10 2017
|
|||
►
Sign in to add a comment |
|||
Comment 1 by vapier@chromium.org
, Oct 20 2017