Bug 444278 - SIGSEGV in musl freelocale
Summary: SIGSEGV in musl freelocale
Status: RESOLVED NOT A BUG
Alias: None
Product: valgrind
Classification: Developer tools
Component: general (show other bugs)
Version: unspecified
Platform: Other Linux
: NOR normal
Target Milestone: ---
Assignee: Julian Seward
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-10-23 16:12 UTC by shininggate83
Modified: 2023-01-26 06:39 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
minimal test case (265 bytes, text/plain)
2021-10-23 16:12 UTC, shininggate83
Details
patch replacing __libc_free (627 bytes, text/plain)
2021-10-23 16:13 UTC, shininggate83
Details

Note You need to log in before you can comment on or make changes to this bug.
Description shininggate83 2021-10-23 16:12:35 UTC
Created attachment 142798 [details]
minimal test case

SUMMARY
When running the program `min.c` under valgrind and musl libc, the process is terminated with SIGSEGV in `freelocale`.

STEPS TO REPRODUCE
1. Compile and run `min.c` with valgrind using musl libc.

OBSERVED RESULT
Program crashes with SIGSEGV.

EXPECTED RESULT
No crashes.

SOFTWARE/OS VERSIONS
Linux 5.10.75, Alpine Linux, musl 1.2.2

ADDITIONAL INFORMATION
The issue seems to be that musl calls `__libc_free` in freelocale, which valgrind does not replace, leading to musl trying to read metadata that is not present, instead getting garbage. In glibc, freelocale calls the normal `free` function, which is correctly replaced by valgrind.
Attached is a (semi-)tested patch which replaces `__libc_free`, making the test case and the original application run fine.
Comment 1 shininggate83 2021-10-23 16:13:14 UTC
Created attachment 142799 [details]
patch replacing __libc_free
Comment 2 Mark Wielaard 2021-10-24 11:47:27 UTC
Although it might be an idea to intercept __libc_free (but then also __libc_malloc) it seems you uncovered a bug in musl.

newlocale and freelocale do use __libc_malloc and __libc_free, but duplocale uses malloc. That means locales created by duplocale can use a different malloc allocator than the internal one. This bug would also show up if you used another LD_PRELOAD malloc ELF interposition tool.
Comment 3 Paul Floyd 2023-01-25 11:25:44 UTC
I agree with Mark. We shouldn't put bug workarounds in Valgrind unless really necessary.
Comment 4 Sam James 2023-01-25 21:12:36 UTC
I think this was fixed in musl by https://git.musl-libc.org/cgit/musl/commit/?id=6d8a515796270eb6cec8a278cb353a078a10f09a.
Comment 5 Paul Floyd 2023-01-26 06:39:35 UTC
Yes looks like it is fixed in musl.