[Bug 295991] lib/libc posix_spawnp(): PATH-search child runs on an undersized rfork_thread stack and underflows into the caller's heap (heavily-linked processes; PHP proc_open)

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295991

--- Comment #8 from Kyle Evans <[email protected]> ---
(In reply to Konstantin Belousov from comment #7)

This seems to fix my somewhat amusing reproducer: https://paste.fbsd.dev/t3i5
-- patch is kind of hacky because we don't have an asan COMPILER_FEATURES yet. 
I don't know that the sketchy .XXX SONAME and runtime replacement is really
necessary, but I had added it when I couldn't figure out why my object wasn't
being loaded again.  In this test case, the failure mode is that the child
crashes and atf hangs:

```
root@ifrit:/usr/src/lib/libc/tests/gen # env ASAN_OPTIONS="detect_leaks=0"
/usr/tests/lib/libc/gen/posix_spawn_test posix_spawnp_stackoverflow
posix_spawn_test: WARNING: Running test cases outside of kyua(1) is unsupported
posix_spawn_test: WARNING: No isolation nor timeout control is being applied;
you may get unexpected failures; see atf-test-case(4)
failed: /usr/src/lib/libc/tests/gen/posix_spawn_test.c:239: WIFEXITED(status)
&& WEXITSTATUS(status) == 0 not met
o
load: 0.57  cmd: posix_spawn_test 1912 [uwrlck] 4.05r 0.00u 0.00s 0% 10076k
mi_switch+0x172 sleepq_switch+0x109 sleepq_catch_signals+0x276
sleepq_wait_sig+0x9 _sleep+0x29a umtxq_sleep+0x302 do_rw_wrlock+0x3d3
sys__umtx_op+0x7e amd64_syscall+0x168 fast_syscall_common+0xf8 
```

I guess we end up wiping out one of the rtld locks or something.

-- 
You are receiving this mail because:
You are the assignee for the bug.