1950573 - Crash in [@ setup_stack_prot] caused by a madvise() call

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P1)

Description

[Gabriele Svelto [:gsvelto]]

Crash report: https://crash-stats.mozilla.org/report/index/79f6d944-3507-4f79-8986-aec210250226

Reason:

SIGSYS / SYS_SECCOMP

Top 10 frames:

0  libc.so.6  __GI_madvise  /usr/src/debug/glibc-2.41.9000-1.fc43.x86_64/sysdeps/unix/syscall-template.S:117
1  libc.so.6  setup_stack_prot  /usr/src/debug/glibc-2.41.9000-1.fc43.x86_64/nptl/allocatestack.c:203
1  libc.so.6  allocate_stack  /usr/src/debug/glibc-2.41.9000-1.fc43.x86_64/nptl/allocatestack.c:519
1  libc.so.6  __pthread_create_2_1  /usr/src/debug/glibc-2.41.9000-1.fc43.x86_64/nptl/pthread_create.c:660
2  firefox-bin  pthread_create  mozglue/interposers/pthread_create_interposer.cpp:99
3  libnspr4.so  _PR_CreateThread  nsprpub/pr/src/pthreads/ptthread.c:429
4  libnspr4.so  PR_CreateThread  nsprpub/pr/src/pthreads/ptthread.c:496
5  libxul.so  nsThread::Init(nsTSubstring<char> const&)  xpcom/threads/nsThread.cpp:615
6  libxul.so  nsThreadManager::NewNamedThread(nsTSubstring<char> const&, nsIThreadManager::...  xpcom/threads/nsThreadManager.cpp:619
7  libxul.so  NS_NewNamedThread(nsTSubstring<char> const&, nsIThread**, already_AddRefed<ns...  xpcom/threads/nsThreadUtils.cpp:176

This is caused by a madvise() call that was introduced by this glibc change.

Comment 1

[Liz Henry (:lizzard) (relman/hg->git project)]

Huge spike in Nightly crashes, probably worth release tracking.

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

It looks like this currently applies only to Fedora Rawhide, their rolling-release experimental distro which uses bleeding-edge prerelease versions of glibc.

Also, this crash is Nightly-only; other branches will return an error and glibc will fall back to mprotect.

(Edit: fixed hyperlink)

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: Bug 1950573 - Allow madvise-based guard pages in the Linux sandbox.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e4e7ca5d70cf
Allow madvise-based guard pages in the Linux sandbox. r=gcp

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/e4e7ca5d70cf

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:jld, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox137 to wontfix.

For more information, please visit BugBot documentation.

Comment 8

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

137 is unaffected now that it's Beta; the crash is Nightly-only.