public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug sanitizer/103930] New: asan intercepts fail if target library is only loaded (indirectly) through dlopen (e.g. plugin)
@ 2022-01-06 14:22 source at stbuehler dot de
  2022-11-17 11:16 ` [Bug sanitizer/103930] " jengelh at inai dot de
  2022-11-17 11:27 ` jengelh at inai dot de
  0 siblings, 2 replies; 3+ messages in thread
From: source at stbuehler dot de @ 2022-01-06 14:22 UTC (permalink / raw)
  To: gcc-bugs

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103930

            Bug ID: 103930
           Summary: asan intercepts fail if target library is only loaded
                    (indirectly) through dlopen (e.g. plugin)
           Product: gcc
           Version: 11.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: source at stbuehler dot de
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
  Target Milestone: ---

Basically two problems:

a) the crash output is completely useless
b) asan should either reload intercept on dlopen automatically or
   provide some way to trigger it

Demo: (also on https://github.com/stbuehler/asan-dlopen-intercepts-bug)

main.c:
> #include <dlfcn.h>
> #include <stdio.h>
> 
> typedef void (*run_fn)();
> 
> int main() {
>   void *plugin = dlopen("./plugin.so", RTLD_NOW|RTLD_GLOBAL);
>   run_fn fn = (run_fn) dlsym(plugin, "run");
>   printf("Found plugin run function: %p\n", fn);
>   (*fn)();
> }

plugin.c:
> #include <stdio.h>
> #include <crypt.h>
> 
> void run() {
>   char *crypted = crypt("des", "12tMnfw882VDQ");
>   printf("Crypt output: %s\n", crypted);
> }

Makefile:
> override CFLAGS := -Wall -O2 -ggdb -fsanitize=address -fno-omit-frame-pointer
> # override WORKAROUND := -lcrypt
> 
> all: plugin.so main
> clean:
>     rm -f plugin.so main
> .PHONY: all clean
> 
> plugin.so: plugin.c Makefile
>     gcc -shared -o $@ -lcrypt $(CFLAGS) $<
> 
> main: main.c Makefile
>     gcc -o $@ -ldl $(WORKAROUND) $(CFLAGS) $<

Fails with:

> $ ./main
> Found plugin run function: 0x7fa33ea3b1a0
> AddressSanitizer:DEADLYSIGNAL
> =================================================================
> ==208926==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffed844e1b0 sp 0x7ffed844e1a8 T0)
> ==208926==Hint: pc points to the zero page.
> ==208926==The signal is caused by a READ memory access.
> ==208926==Hint: address points to the zero page.
>     #0 0x0  (<unknown module>)
> 
> AddressSanitizer can not provide additional info.
> SUMMARY: AddressSanitizer: SEGV (<unknown module>) 
> ==208926==ABORTING

Compiler:

> $ gcc -v
> Using built-in specs.
> COLLECT_GCC=gcc
> COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/11/lto-wrapper
> OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa
> OFFLOAD_TARGET_DEFAULT=1
> Target: x86_64-linux-gnu
> Configured with: ../src/configure -v --with-pkgversion='Debian 11.2.0-13' --with-bugurl=file:///usr/share/doc/gcc-11/README.Bugs --enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++,m2 --prefix=/usr --with-gcc-major-version-only --program-suffix=-11 --program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --enable-bootstrap --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-plugin --enable-default-pie --with-system-zlib --enable-libphobos-checking=release --with-target-system-zlib=auto --enable-objc-gc=auto --enable-multiarch --disable-werror --enable-cet --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-offload-targets=nvptx-none=/build/gcc-11-KdLYb3/gcc-11-11.2.0/debian/tmp-nvptx/usr,amdgcn-amdhsa=/build/gcc-11-KdLYb3/gcc-11-11.2.0/debian/tmp-gcn/usr --without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu --with-build-config=bootstrap-lto-lean --enable-link-serialization=2
> Thread model: posix
> Supported LTO compression algorithms: zlib zstd
> gcc version 11.2.0 (Debian 11.2.0-13)

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-11-17 11:27 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-06 14:22 [Bug sanitizer/103930] New: asan intercepts fail if target library is only loaded (indirectly) through dlopen (e.g. plugin) source at stbuehler dot de
2022-11-17 11:16 ` [Bug sanitizer/103930] " jengelh at inai dot de
2022-11-17 11:27 ` jengelh at inai dot de

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).