Skip to content

Commit 0d70731

Browse files
krajotavio
kraj
authored and
otavio
committed
chromium: Fix sanbox crashes on musl
Signed-off-by: Khem Raj <raj.khem@gmail.com>
1 parent b3a2dbe commit 0d70731

File tree

4 files changed

+295
-0
lines changed

4 files changed

+295
-0
lines changed

‎meta-chromium/recipes-browser/chromium/chromium-gn.inc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ SRC_URI_append_libc-musl = "\
4242
file://musl/0015-mallopt-is-glibc-specific-API.patch \
4343
file://musl/0016-tcmalloc-undef-mmap64.patch \
4444
file://musl/0017-tcmalloc-no-__sbrk.patch \
45+
file://musl/0018--Use-monotonic-clock-for-pthread_cond_timedwait-with-.patch \
46+
file://musl/0019-adjust-thread-stack-sizes.patch \
47+
file://musl/0020-Fix-tab-crashes-on-musl.patch \
4548
"
4649

4750
# Append instead of assigning; the gtk-icon-cache class inherited above also

‎meta-chromium/recipes-browser/chromium/files/musl/0018--Use-monotonic-clock-for-pthread_cond_timedwait-with-.patch

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From 7f5b1d8fdc9a641b9c32e47e5bce0fa23447c4cf Mon Sep 17 00:00:00 2001
2+
From: Khem Raj <raj.khem@gmail.com>
3+
Date: Fri, 19 Mar 2021 20:06:34 -0700
4+
Subject: [PATCH 1/3] Use monotonic clock for pthread_cond_timedwait with musl
5+
too.
6+
7+
Sourced from Alpine Linux
8+
9+
Upstream-Status: Pending
10+
Signed-off-by: Khem Raj <raj.khem@gmail.com>
11+
---
12+
v8/src/base/platform/condition-variable.cc | 4 ++--
13+
1 file changed, 2 insertions(+), 2 deletions(-)
14+
15+
diff --git a/v8/src/base/platform/condition-variable.cc b/v8/src/base/platform/condition-variable.cc
16+
index 04ea29181..d121acdc5 100644
17+
--- a/v8/src/base/platform/condition-variable.cc
18+
+++ b/v8/src/base/platform/condition-variable.cc
19+
@@ -16,7 +16,7 @@ namespace base {
20+
21+
ConditionVariable::ConditionVariable() {
22+
#if (V8_OS_FREEBSD || V8_OS_NETBSD || V8_OS_OPENBSD || \
23+
- (V8_OS_LINUX && V8_LIBC_GLIBC))
24+
+ V8_OS_LINUX)
25+
// On Free/Net/OpenBSD and Linux with glibc we can change the time
26+
// source for pthread_cond_timedwait() to use the monotonic clock.
27+
pthread_condattr_t attr;
28+
@@ -92,7 +92,7 @@ bool ConditionVariable::WaitFor(Mutex* mutex, const TimeDelta& rel_time) {
29+
&native_handle_, &mutex->native_handle(), &ts);
30+
#else
31+
#if (V8_OS_FREEBSD || V8_OS_NETBSD || V8_OS_OPENBSD || \
32+
- (V8_OS_LINUX && V8_LIBC_GLIBC))
33+
+ V8_OS_LINUX)
34+
// On Free/Net/OpenBSD and Linux with glibc we can change the time
35+
// source for pthread_cond_timedwait() to use the monotonic clock.
36+
result = clock_gettime(CLOCK_MONOTONIC, &ts);
37+
--
38+
2.31.0
39+

‎meta-chromium/recipes-browser/chromium/files/musl/0019-adjust-thread-stack-sizes.patch

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
From 0b2cb722d3d256e20d265ed5421e286e0589d182 Mon Sep 17 00:00:00 2001
2+
From: Khem Raj <raj.khem@gmail.com>
3+
Date: Fri, 19 Mar 2021 20:09:10 -0700
4+
Subject: [PATCH 2/3] adjust thread stack sizes
5+
6+
musl default stack is 128K as compared to glibc's 8M
7+
adjust the expecations accordingly
8+
9+
Upstream-Status: Pending
10+
Signed-off-by: Khem Raj <raj.khem@gmail.com>
11+
---
12+
base/threading/platform_thread_linux.cc | 3 ++-
13+
chrome/app/shutdown_signal_handlers_posix.cc | 8 ++++++++
14+
2 files changed, 10 insertions(+), 1 deletion(-)
15+
16+
diff --git a/base/threading/platform_thread_linux.cc b/base/threading/platform_thread_linux.cc
17+
index de2e0c169..53cb90def 100644
18+
--- a/base/threading/platform_thread_linux.cc
19+
+++ b/base/threading/platform_thread_linux.cc
20+
@@ -437,7 +437,8 @@ void TerminateOnThread() {}
21+
22+
size_t GetDefaultThreadStackSize(const pthread_attr_t& attributes) {
23+
#if !defined(THREAD_SANITIZER)
24+
- return 0;
25+
+ // use 8mb like glibc to avoid running out of space
26+
+ return (1 << 23);
27+
#else
28+
// ThreadSanitizer bloats the stack heavily. Evidence has been that the
29+
// default stack size isn't enough for some browser tests.
30+
diff --git a/chrome/app/shutdown_signal_handlers_posix.cc b/chrome/app/shutdown_signal_handlers_posix.cc
31+
index 621d441e8..472a3a878 100644
32+
--- a/chrome/app/shutdown_signal_handlers_posix.cc
33+
+++ b/chrome/app/shutdown_signal_handlers_posix.cc
34+
@@ -187,11 +187,19 @@ void InstallShutdownSignalHandlers(
35+
g_shutdown_pipe_read_fd = pipefd[0];
36+
g_shutdown_pipe_write_fd = pipefd[1];
37+
#if !defined(ADDRESS_SANITIZER)
38+
+# if defined(__GLIBC__)
39+
const size_t kShutdownDetectorThreadStackSize = PTHREAD_STACK_MIN * 2;
40+
+# else
41+
+ const size_t kShutdownDetectorThreadStackSize = PTHREAD_STACK_MIN * 2 * 8; // match up musls 2k PTHREAD_STACK_MIN with glibcs 16k
42+
+# endif
43+
#else
44+
+# if defined(__GLIBC__)
45+
// ASan instrumentation bloats the stack frames, so we need to increase the
46+
// stack size to avoid hitting the guard page.
47+
const size_t kShutdownDetectorThreadStackSize = PTHREAD_STACK_MIN * 4;
48+
+# else
49+
+ const size_t kShutdownDetectorThreadStackSize = PTHREAD_STACK_MIN * 4 * 8; // match up musls 2k PTHREAD_STACK_MIN with glibcs 16k
50+
+# endif
51+
#endif
52+
ShutdownDetector* detector = new ShutdownDetector(
53+
g_shutdown_pipe_read_fd, std::move(shutdown_callback), task_runner);
54+
--
55+
2.31.0
56+

‎meta-chromium/recipes-browser/chromium/files/musl/0020-Fix-tab-crashes-on-musl.patch

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
From b11616073264bba0d45f6a61eac17886f6aa0583 Mon Sep 17 00:00:00 2001
2+
From: Khem Raj <raj.khem@gmail.com>
3+
Date: Fri, 19 Mar 2021 20:16:00 -0700
4+
Subject: [PATCH 3/3] Fix tab crashes on musl
5+
6+
Upstream-Status: Inappropriate [musl-specific]
7+
Signed-off-by: Khem Raj <raj.khem@gmail.com>
8+
---
9+
.../syscall_parameters_restrictions.cc | 22 +++++--------------
10+
.../linux/seccomp-bpf-helpers/syscall_sets.cc | 5 +++--
11+
.../system_headers/arm64_linux_syscalls.h | 4 ++++
12+
.../linux/system_headers/arm_linux_syscalls.h | 4 ++++
13+
sandbox/linux/system_headers/linux_syscalls.h | 1 +
14+
.../system_headers/mips64_linux_syscalls.h | 4 ++++
15+
.../system_headers/mips_linux_syscalls.h | 4 ++++
16+
.../system_headers/x86_64_linux_syscalls.h | 4 ++++
17+
.../policy/linux/bpf_renderer_policy_linux.cc | 4 ++--
18+
9 files changed, 32 insertions(+), 20 deletions(-)
19+
20+
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
21+
index 2a97d3916..0c86cc519 100644
22+
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
23+
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
24+
@@ -130,21 +130,11 @@ namespace sandbox {
25+
// present (as in newer versions of posix_spawn).
26+
ResultExpr RestrictCloneToThreadsAndEPERMFork() {
27+
const Arg<unsigned long> flags(0);
28+
-
29+
- // TODO(mdempsky): Extend DSL to support (flags & ~mask1) == mask2.
30+
- const uint64_t kAndroidCloneMask = CLONE_VM | CLONE_FS | CLONE_FILES |
31+
- CLONE_SIGHAND | CLONE_THREAD |
32+
- CLONE_SYSVSEM;
33+
- const uint64_t kObsoleteAndroidCloneMask = kAndroidCloneMask | CLONE_DETACHED;
34+
-
35+
- const uint64_t kGlibcPthreadFlags =
36+
- CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND | CLONE_THREAD |
37+
- CLONE_SYSVSEM | CLONE_SETTLS | CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID;
38+
- const BoolExpr glibc_test = flags == kGlibcPthreadFlags;
39+
-
40+
- const BoolExpr android_test =
41+
- AnyOf(flags == kAndroidCloneMask, flags == kObsoleteAndroidCloneMask,
42+
- flags == kGlibcPthreadFlags);
43+
+ const int required = CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND |
44+
+ CLONE_THREAD | CLONE_SYSVSEM;
45+
+ const int safe = CLONE_SETTLS | CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID |
46+
+ CLONE_DETACHED;
47+
+ const BoolExpr thread_clone_ok = (flags&~safe)==required;
48+
49+
// The following two flags are the two important flags in any vfork-emulating
50+
// clone call. EPERM any clone call that contains both of them.
51+
@@ -154,7 +144,7 @@ ResultExpr RestrictCloneToThreadsAndEPERMFork() {
52+
AnyOf((flags & (CLONE_VM | CLONE_THREAD)) == 0,
53+
(flags & kImportantCloneVforkFlags) == kImportantCloneVforkFlags);
54+
55+
- return If(IsAndroid() ? android_test : glibc_test, Allow())
56+
+ return If(thread_clone_ok, Allow())
57+
.ElseIf(is_fork_or_clone_vfork, Error(EPERM))
58+
.Else(CrashSIGSYSClone());
59+
}
60+
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
61+
index 0db8745cb..8acf30c3e 100644
62+
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
63+
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
64+
@@ -398,6 +398,7 @@ bool SyscallSets::IsAllowedProcessStartOrDeath(int sysno) {
65+
#if defined(__i386__)
66+
case __NR_waitpid:
67+
#endif
68+
+ case __NR_set_tid_address:
69+
return true;
70+
case __NR_clone: // Should be parameter-restricted.
71+
case __NR_setns: // Privileged.
72+
@@ -410,7 +411,6 @@ bool SyscallSets::IsAllowedProcessStartOrDeath(int sysno) {
73+
#if defined(__i386__) || defined(__x86_64__) || defined(__mips__)
74+
case __NR_set_thread_area:
75+
#endif
76+
- case __NR_set_tid_address:
77+
case __NR_unshare:
78+
#if !defined(__mips__) && !defined(__aarch64__)
79+
case __NR_vfork:
80+
@@ -520,6 +520,8 @@ bool SyscallSets::IsAllowedAddressSpaceAccess(int sysno) {
81+
case __NR_mlock:
82+
case __NR_munlock:
83+
case __NR_munmap:
84+
+ case __NR_mremap:
85+
+ case __NR_membarrier:
86+
return true;
87+
case __NR_madvise:
88+
case __NR_mincore:
89+
@@ -537,7 +539,6 @@ bool SyscallSets::IsAllowedAddressSpaceAccess(int sysno) {
90+
case __NR_modify_ldt:
91+
#endif
92+
case __NR_mprotect:
93+
- case __NR_mremap:
94+
case __NR_msync:
95+
case __NR_munlockall:
96+
case __NR_readahead:
97+
diff --git a/sandbox/linux/system_headers/arm64_linux_syscalls.h b/sandbox/linux/system_headers/arm64_linux_syscalls.h
98+
index a242c18c8..30751fc4a 100644
99+
--- a/sandbox/linux/system_headers/arm64_linux_syscalls.h
100+
+++ b/sandbox/linux/system_headers/arm64_linux_syscalls.h
101+
@@ -1119,4 +1119,8 @@
102+
#define __NR_rseq 293
103+
#endif
104+
105+
+#if !defined(__NR_membarrier)
106+
+#define __NR_membarrier 283
107+
+#endif
108+
+
109+
#endif // SANDBOX_LINUX_SYSTEM_HEADERS_ARM64_LINUX_SYSCALLS_H_
110+
diff --git a/sandbox/linux/system_headers/arm_linux_syscalls.h b/sandbox/linux/system_headers/arm_linux_syscalls.h
111+
index c39c22b51..32c00852a 100644
112+
--- a/sandbox/linux/system_headers/arm_linux_syscalls.h
113+
+++ b/sandbox/linux/system_headers/arm_linux_syscalls.h
114+
@@ -1449,6 +1449,10 @@
115+
#define __NR_clock_nanosleep_time64 (__NR_SYSCALL_BASE+407)
116+
#endif
117+
118+
+#if !defined(__NR_membarrier)
119+
+#define __NR_membarrier (__NR_SYSCALL_BASE+389)
120+
+#endif
121+
+
122+
// ARM private syscalls.
123+
#if !defined(__ARM_NR_BASE)
124+
#define __ARM_NR_BASE (__NR_SYSCALL_BASE + 0xF0000)
125+
diff --git a/sandbox/linux/system_headers/linux_syscalls.h b/sandbox/linux/system_headers/linux_syscalls.h
126+
index 2b78a0cc3..b6fedb5c2 100644
127+
--- a/sandbox/linux/system_headers/linux_syscalls.h
128+
+++ b/sandbox/linux/system_headers/linux_syscalls.h
129+
@@ -10,6 +10,7 @@
130+
#define SANDBOX_LINUX_SYSTEM_HEADERS_LINUX_SYSCALLS_H_
131+
132+
#include "build/build_config.h"
133+
+#include <sys/syscall.h>
134+
135+
#if defined(__x86_64__)
136+
#include "sandbox/linux/system_headers/x86_64_linux_syscalls.h"
137+
diff --git a/sandbox/linux/system_headers/mips64_linux_syscalls.h b/sandbox/linux/system_headers/mips64_linux_syscalls.h
138+
index ec75815a8..551527083 100644
139+
--- a/sandbox/linux/system_headers/mips64_linux_syscalls.h
140+
+++ b/sandbox/linux/system_headers/mips64_linux_syscalls.h
141+
@@ -1271,4 +1271,8 @@
142+
#define __NR_memfd_create (__NR_Linux + 314)
143+
#endif
144+
145+
+#if !defined(__NR_membarrier)
146+
+#define __NR_membarrier (__NR_Linux 318)
147+
+#endif
148+
+
149+
#endif // SANDBOX_LINUX_SYSTEM_HEADERS_MIPS64_LINUX_SYSCALLS_H_
150+
diff --git a/sandbox/linux/system_headers/mips_linux_syscalls.h b/sandbox/linux/system_headers/mips_linux_syscalls.h
151+
index fa01b3bbc..8695e2b31 100644
152+
--- a/sandbox/linux/system_headers/mips_linux_syscalls.h
153+
+++ b/sandbox/linux/system_headers/mips_linux_syscalls.h
154+
@@ -1441,4 +1441,8 @@
155+
#define __NR_clock_nanosleep_time64 (__NR_Linux + 407)
156+
#endif
157+
158+
+#if !defined(__NR_membarrier)
159+
+#define __NR_membarrier (__NR_Linux 358)
160+
+#endif
161+
+
162+
#endif // SANDBOX_LINUX_SYSTEM_HEADERS_MIPS_LINUX_SYSCALLS_H_
163+
diff --git a/sandbox/linux/system_headers/x86_64_linux_syscalls.h b/sandbox/linux/system_headers/x86_64_linux_syscalls.h
164+
index b0ae0a2ed..8b1202947 100644
165+
--- a/sandbox/linux/system_headers/x86_64_linux_syscalls.h
166+
+++ b/sandbox/linux/system_headers/x86_64_linux_syscalls.h
167+
@@ -1350,5 +1350,9 @@
168+
#define __NR_rseq 334
169+
#endif
170+
171+
+#if !defined(__NR_membarrier)
172+
+#define __NR_membarrier 324
173+
+#endif
174+
+
175+
#endif // SANDBOX_LINUX_SYSTEM_HEADERS_X86_64_LINUX_SYSCALLS_H_
176+
177+
diff --git a/sandbox/policy/linux/bpf_renderer_policy_linux.cc b/sandbox/policy/linux/bpf_renderer_policy_linux.cc
178+
index 9fe9575eb..fa1a946f6 100644
179+
--- a/sandbox/policy/linux/bpf_renderer_policy_linux.cc
180+
+++ b/sandbox/policy/linux/bpf_renderer_policy_linux.cc
181+
@@ -93,11 +93,11 @@ ResultExpr RendererProcessPolicy::EvaluateSyscall(int sysno) const {
182+
case __NR_sysinfo:
183+
case __NR_times:
184+
case __NR_uname:
185+
- return Allow();
186+
- case __NR_sched_getaffinity:
187+
case __NR_sched_getparam:
188+
case __NR_sched_getscheduler:
189+
case __NR_sched_setscheduler:
190+
+ return Allow();
191+
+ case __NR_sched_getaffinity:
192+
return RestrictSchedTarget(GetPolicyPid(), sysno);
193+
case __NR_prlimit64:
194+
// See crbug.com/662450 and setrlimit comment above.
195+
--
196+
2.31.0
197+

0 commit comments

Comments
 (0)