From owner-freebsd-current@freebsd.org Fri Feb 26 17:21:30 2016 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E058EAB57A1 for ; Fri, 26 Feb 2016 17:21:30 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org [IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with ESMTP id CC7281645 for ; Fri, 26 Feb 2016 17:21:30 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: by mailman.ysv.freebsd.org (Postfix) id C9828AB57A0; Fri, 26 Feb 2016 17:21:30 +0000 (UTC) Delivered-To: current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id AF2ADAB579F for ; Fri, 26 Feb 2016 17:21:30 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: from tensor.andric.com (tensor.andric.com [IPv6:2001:7b8:3a7:1:2d0:b7ff:fea0:8c26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "tensor.andric.com", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 406801644 for ; Fri, 26 Feb 2016 17:21:30 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: from [IPv6:2001:7b8:3a7::a98a:526b:da5e:83b5] (unknown [IPv6:2001:7b8:3a7:0:a98a:526b:da5e:83b5]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by tensor.andric.com (Postfix) with ESMTPSA id 8676135001; Fri, 26 Feb 2016 18:21:25 +0100 (CET) Subject: Re: buffer overflow warning in /bin/sh Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\)) Content-Type: multipart/signed; boundary="Apple-Mail=_B61D0859-2942-42C8-885C-42F4FE89BFF1"; protocol="application/pgp-signature"; micalg=pgp-sha1 X-Pgp-Agent: GPGMail 2.6b2 (ebbf3ef) From: Dimitry Andric In-Reply-To: Date: Fri, 26 Feb 2016 18:21:20 +0100 Cc: current@freebsd.org Message-Id: <0353BD46-1397-4DAC-9115-6D2355E7F42D@FreeBSD.org> References: To: Howard Su X-Mailer: Apple Mail (2.3112) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Feb 2016 17:21:31 -0000 --Apple-Mail=_B61D0859-2942-42C8-885C-42F4FE89BFF1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 26 Feb 2016, at 04:21, Howard Su wrote: >=20 > I got the error when compiling GENERIC kernel with address sanitizer > /bin/sh: > --- vers.c --- > MAKE=3Dmake sh /usr/home/howardsu/freebsd/sys/conf/newvers.sh > = GENERIC=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > =3D=3D4132=3D=3DERROR: AddressSanitizer: stack-buffer-overflow on = address > 0x7fffffffc9c0 at pc 0x00000045fdc7 bp 0x7fffffffc930 sp = 0x7fffffffc0f0 > WRITE of size 312 at 0x7fffffffc9c0 thread T0 > #0 0x45fdc6 (/bin/sh+0x45fdc6) > #1 0x801431767 (/lib/libc.so.7+0x7c767) > #2 0x42ff5e (/bin/sh+0x42ff5e) > #3 0x4b6b00 (/bin/sh+0x4b6b00) > #4 0x49686e (/bin/sh+0x49686e) > #5 0x495572 (/bin/sh+0x495572) > #6 0x48c3f9 (/bin/sh+0x48c3f9) > #7 0x489920 (/bin/sh+0x489920) > #8 0x4acde8 (/bin/sh+0x4acde8) > #9 0x4aca4d (/bin/sh+0x4aca4d) > #10 0x40fb0e (/bin/sh+0x40fb0e) > #11 0x80071afff () >=20 > Address 0x7fffffffc9c0 is located in stack of thread > T0=3D=3D4132=3D=3DAddressSanitizer CHECK failed: > = /usr/home/howardsu/freebsd/lib/libclang_rt/asan/../../../contrib/compiler-= rt/lib/asan/asan_thread.cc:246 > "((ptr[0] =3D=3D kCurrentStackFrameMagic)) !=3D (0)" (0x0, 0x0) > #0 0x422b9d (/bin/sh+0x422b9d) > #1 0x41de09 (/bin/sh+0x41de09) > #2 0x41f301 (/bin/sh+0x41f301) > #3 0x4728be (/bin/sh+0x4728be) > #4 0x474589 (/bin/sh+0x474589) > #5 0x47502a (/bin/sh+0x47502a) > #6 0x45fdef (/bin/sh+0x45fdef) > #7 0x801431767 (/lib/libc.so.7+0x7c767) > #8 0x42ff5e (/bin/sh+0x42ff5e) > #9 0x4b6b00 (/bin/sh+0x4b6b00) > #10 0x49686e (/bin/sh+0x49686e) > #11 0x495572 (/bin/sh+0x495572) > #12 0x48c3f9 (/bin/sh+0x48c3f9) > #13 0x489920 (/bin/sh+0x489920) > #14 0x4acde8 (/bin/sh+0x4acde8) > #15 0x4aca4d (/bin/sh+0x4aca4d) > #16 0x40fb0e (/bin/sh+0x40fb0e) > #17 0x80071afff () >=20 > *** [vers.c] Error code 1 >=20 > I am using latest -Current and add the following flags to = /etc/make.conf. > # CFLAGS+=3D -g -fsanitize=3Daddress -fno-omit-frame-pointer >=20 > I rebuild /bin/sh as a first step. with the /bin/sh I got the above = error. > I would like to understand how to get symbols. The following command > doesn't work at all. > addr2line -e /bin/sh 0x422b9d >=20 > =E2=80=8BAny idea?=E2=80=8B Please recompile and reinstall world, using WITH_CLANG_EXTRAS=3Dy in /etc/src.conf. This will install the /usr/bin/llvm-symbolizer command, which is needed by AddressSanitizer to resolve symbols. On my system with the projects/clang380-import branch installed, I get the following AdressSanitizer report. It does not look completely similar to your case, though: $ sh sys/conf/newvers.sh =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D9912=3D=3DERROR: AddressSanitizer: stack-buffer-overflow on = address 0xbfbfe380 at pc 0x08121f12 bp 0xbfbfe354 sp 0xbfbfe34c WRITE of size 4 at 0xbfbfe380 thread T0 #0 0x8121f11 in readtoken1 = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:1419:= 22 #1 0x812597d in xxreadtoken = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:930:1= 1 #2 0x811c90f in readtoken = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:827:6= #3 0x812341c in simplecmd = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:647:7= #4 0x812341c in command = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:592 #5 0x8122e19 in pipeline = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:376:7= #6 0x811cc57 in andor = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:347:6= #7 0x811cc57 in list = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:278 #8 0x8126501 in parsebackq = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:1182:= 6 #9 0x811f36c in readtoken1 = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:1556:= 11 #10 0x812597d in xxreadtoken = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:930:1= 1 #11 0x811c90f in readtoken = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:827:6= #12 0x811c7c9 in parsecmd = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:224:6= #13 0x811046f in cmdloop = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/main.c:217:7 #14 0x811015e in main = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/main.c:178:3 #15 0x80557c9 in _start1 (/bin/sh+0x80557c9) Address 0xbfbfe380 is located in stack of thread T0 at offset 32 in = frame #0 0x811e8ff in readtoken1 = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:1400 This frame has 3 object(s): [16, 20) 'bqlist' [32, 128) 'state_static' <=3D=3D Memory access at offset 32 is = inside this variable [160, 170) 'buf' HINT: this may be a false positive if your program uses some custom = stack unwind mechanism or swapcontext (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow = /share/dim/src/freebsd/base/projects/clang380-import/bin/sh/parser.c:1419:= 22 in readtoken1 Shadow bytes around the buggy address: 0x57f7fc20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x57f7fc30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x57f7fc40: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 00 00 0x57f7fc50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x57f7fc60: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 04 f2 =3D>0x57f7fc70:[f3]f3 f3 f3 f3 f3 00 00 00 00 00 00 f2 f2 f2 f2 0x57f7fc80: 00 02 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x57f7fc90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x57f7fca0: 00 00 00 00 00 00 00 00 f1 f1 04 f2 04 f2 04 f2 0x57f7fcb0: 04 f2 04 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x57f7fcc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb =3D=3D9912=3D=3DABORTING This may be a false positive though. I'm currently trying to run this under valgrind, but the valgrind port crashes with: valgrind: m_syswrap/syswrap-freebsd.c:3302 (void = vgSysWrap_freebsd_sys_fcntl_before(ThreadId, SyscallArgLayout *, = SyscallArgs *, SyscallStatus *, UWord *)): Assertion 'Unimplemented = functionality' failed. valgrind: valgrind host stacktrace: =3D=3D6180=3D=3D at 0x38043152: ??? (in = /usr/local/lib/valgrind/memcheck-amd64-freebsd) =3D=3D6180=3D=3D by 0x380434D7: ??? (in = /usr/local/lib/valgrind/memcheck-amd64-freebsd) =3D=3D6180=3D=3D by 0x380434BD: ??? (in = /usr/local/lib/valgrind/memcheck-amd64-freebsd) =3D=3D6180=3D=3D by 0x380B2DF4: ??? (in = /usr/local/lib/valgrind/memcheck-amd64-freebsd) =3D=3D6180=3D=3D by 0x3809AE77: ??? (in = /usr/local/lib/valgrind/memcheck-amd64-freebsd) =3D=3D6180=3D=3D by 0x38099F2F: ??? (in = /usr/local/lib/valgrind/memcheck-amd64-freebsd) =3D=3D6180=3D=3D by 0x380985F7: ??? (in = /usr/local/lib/valgrind/memcheck-amd64-freebsd) =3D=3D6180=3D=3D by 0x380A5E50: ??? (in = /usr/local/lib/valgrind/memcheck-amd64-freebsd) sched status: running_tid=3D1 Thread 1: status =3D VgTs_Runnable =3D=3D6180=3D=3D at 0x51AF0DA: _fcntl (in /lib/libc.so.7) =3D=3D6180=3D=3D by 0x50B4CDB: fcntl (in /lib/libc.so.7) =3D=3D6180=3D=3D by 0x40DD20: setinputfile (input.c:369) =3D=3D6180=3D=3D by 0x412F9D: procargs (options.c:113) =3D=3D6180=3D=3D by 0x411571: main (main.c:147) So it is fairly unusable now. :-( -Dimitry --Apple-Mail=_B61D0859-2942-42C8-885C-42F4FE89BFF1 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.29 iEYEARECAAYFAlbQiZUACgkQsF6jCi4glqNDFQCgyRHNHbpOUsW0VSX1nJuPtOwb bIAAoMry66dR0hIYNTdveq0eWYQHFIPQ =s/zp -----END PGP SIGNATURE----- --Apple-Mail=_B61D0859-2942-42C8-885C-42F4FE89BFF1--