New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 776972 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Last visit > 30 days ago
Closed: Nov 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug



Sign in to add a comment

FORTIFY'ed binaries get SIGKILLed on user devices

Project Member Reported by g...@chromium.org, Oct 20 2017

Issue description

Split out from  issue 774573 .

Yunlian, Luis said you may be a good person to look at this?

---

Looks like there's glibc on reef (and maybe other boards) cause FORTIFY to SIGKILL programs instead of aborting them. From discussion on said issue, it sounds like this may keep us from getting crash reports?

Repro (run from inside my chroot):

$ cat foo.c
int main() {
        const char buf[] = "Hello, world!";
        char cs[4];
        __builtin___memcpy_chk(cs, buf, sizeof(buf), sizeof(cs));
}
$ clang -O2 foo.c -w
$ gdb -ex r ./a.out
[[snip]]
*** buffer overflow detected ***: /tmp/a.out terminated
======= Backtrace: =========
/lib64/libc.so.6(+0x73b12)[0x7ffff7aa5b12]
/lib64/libc.so.6(__fortify_fail+0x47)[0x7ffff7b35487]
/lib64/libc.so.6(+0x101540)[0x7ffff7b33540]
/tmp/a.out[0x40056a]
/lib64/libc.so.6(__libc_start_main+0xf0)[0x7ffff7a52730]
/tmp/a.out[0x400489]
======= Memory map: ========
[[snip]]
Program received signal SIGABRT, Aborted.
0x00007ffff7a65cf2 in raise () from /lib64/libc.so.6

$ sudo cp a.out /build/reef
$ gdb-reef /a.out
(reef-gdb) r
Starting program: /a.out
*** buffer overflow detected ***: a.out terminated; report to <http://crbug.com/new>

Program terminated with signal SIGKILL, Killed.
The program no longer exists.
(reef-gdb)


Doing some initial greping around, FORTIFY lands us in __chk_fail, which calls __hardened_gentoo_fail. If ENABLE_SSP_SMASH_DUMPS_CORE is truthy, we'll abort(). Otherwise, we'll SIGKILL ourselves. SSP_SMASH_DUMPS_CORE controls whether ENABLE_SSP_SMASH_DUMPS_CORE is truthy.
 

Comment 1 by vapier@chromium.org, Oct 20 2017

it broke in the upgrade:
  https://chromium-review.googlesource.com/424122

--- a/sys-libs/glibc/glibc-2.19-r14.ebuild
+++ b/sys-libs/glibc/glibc-2.23-r3.ebuild
        # Use SIGABRT instead of SIGKILL for check handler for all cases. crbug://389360
-       if true ; then
+       if use debug ; then

we didn't set USE=debug on the new glibc builds.  this should fix it:
  https://chromium-review.googlesource.com/731659

someone should write a test to prevent future regressions ;)
Labels: OS-Chrome
Owner: yunlian@chromium.org
Status: Assigned (was: Untriaged)
thanks for figuring this out!

Definitely need a unittest for this!

assigning to Yunlian. 
we should probably put the fix in the latest branch too. 
Project Member

Comment 4 by bugdroid1@chromium.org, Oct 21 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/4cc9a879ece06245816dd2625d0d7d123b229a03

commit 4cc9a879ece06245816dd2625d0d7d123b229a03
Author: Mike Frysinger <vapier@chromium.org>
Date: Sat Oct 21 06:55:09 2017

glibc: re-enable coredumps on fortify failures

This was lost during the upgrade.

BUG= chromium:776972 
TEST=None

Change-Id: Icffac6c461715d36d8b447b8f2acbece3900cd76
Reviewed-on: https://chromium-review.googlesource.com/731659
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>

[rename] https://crrev.com/4cc9a879ece06245816dd2625d0d7d123b229a03/sys-libs/glibc/glibc-2.23-r11.ebuild

Status: Verified (was: Assigned)

Sign in to add a comment