[Bug 295991] lib/libc posix_spawnp(): PATH-search child runs on an undersized rfork_thread stack and underflows into the caller's heap (heavily-linked processes; PHP proc_open)
| Newsgroups | gmane.os.freebsd.bugs |
|---|---|
| Message-ID | <[email protected]/bugzilla/> |
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295991 --- Comment #13 from [email protected] --- A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3de9dc5bf4b438e0d98222dc028982380d5a25d2 commit 3de9dc5bf4b438e0d98222dc028982380d5a25d2 Author: Kyle Evans <[email protected]> AuthorDate: 2026-06-30 13:12:51 +0000 Commit: Kyle Evans <[email protected]> CommitDate: 2026-06-30 13:12:51 +0000 libc: gen: add a test for rtld underflowing our posix_spawn thread This is a distillation of the environment described in the PR, using a dummy shlib and mapping it repeatedly. This takes advantage of the guard page added in 2767a1f3686e5b16 to reliably crash if rtld tries to scale its stack usage excessively with the # DSOs loaded. PR: 295991 Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D57954 lib/libc/tests/gen/Makefile | 2 + lib/libc/tests/gen/libdummy/Makefile (new) | 9 ++++ lib/libc/tests/gen/libdummy/libdummy.c (new) | 14 ++++++ lib/libc/tests/gen/posix_spawn_test.c | 68 ++++++++++++++++++++++++++++ 4 files changed, 93 insertions(+) -- You are receiving this mail because: You are the assignee for the bug.