process can segfault on macOS Sequoia with a configure script from Autoconf 2.72

[TuongNM]

As was discovered in haskell/cabal#11465 the following process versions can segfault on macOS Sequoia 15.7.4:

1.6.26.1
1.6.25.0
1.6.24.0

Of the other recent versions 1.6.26.0, 1.6.26.2 and 1.6.27.0 don't segfault.

Looking more into it, this is due to the configure script that was uploaded to Hackage. The versions that segfault contain a configure script that was generated with Autoconf 2.72 while the versions without any issues have a configure script that was generated with Autoconf 2.69.
Indeed, after checking out the git repository of process, creating a configure script with autoreconf -i with Autoconf 2.72 and using the reproducer from haskell/cabal#11465 (comment) with it, I encounter the segfault. But there is no segfault when I use the 1.6.27.0 version from Hackage.

Based on the comments in haskell/cabal#11465 other macOS versions don't have this issue, neither the newer macOS Tahoe nor the older macOS Sonoma. It may just be a macOS issue that will go away with time after upgrading.

[MangoIV]

@TuongNM I can reproduce the segfault with 2.69 in GHC's testsuite

head libraries/process/configure
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.69 for Haskell process package 1.0.
#
# Report bugs to <libraries@haskell.org>.
#
#
# Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
#

The reproducer is pretty simple, it's process004.hs from the testsuite:

module Main where

import System.IO.Error
import System.Process

main :: IO ()
main = do
  -- N.B. Only show the error type since the exact error text
  -- may depend upon precise system call which @process@ decided
  -- to use.
  let printError e = putStrLn ("Exc: " ++ show (ioeGetErrorType e))
  test1 `catchIOError` printError
  test2 `catchIOError` printError

test1 :: IO ()
test1 = do
  (_, _, _, commhand) <-
      runInteractiveProcess "true" [] (Just "/no/such/dir") Nothing
  exitCode <- waitForProcess commhand
  print exitCode

test2 :: IO ()
test2 = do
  commhand <- runProcess "true" [] (Just "/no/such/dir") Nothing
                Nothing Nothing Nothing
  exitCode <- waitForProcess commhand
  print exitCode

[TuongNM]

Okay, that's weird.
I've setup a cabal project with the contents you provided on macOS. I only encounter the segfault if I use process versions with Autoconf 2.72 like process-1.6.26.1 or process-1.6.24.0.
If I use process versions with Autoconf 2.69 like process-1.6.27.0 or process-1.6.26.0 then there is no segfault for me.

[MangoIV]

I mean, I can reproduce that behaviour as well, but there must be another difference besides running with autoconf version 2.69 vs 2.71 because as I said, I get the segfault even with the older autoconf when configuring ghc's bootlibs with that.

[MangoIV]

655a656
> runstatedir
725a727
> runstatedir='${localstatedir}/run'
977a980,988
>   -runstatedir | --runstatedir | --runstatedi | --runstated \
>   | --runstate | --runstat | --runsta | --runst | --runs \
>   | --run | --ru | --r)
>     ac_prev=runstatedir ;;
>   -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
>   | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
>   | --run=* | --ru=* | --r=*)
>     runstatedir=$ac_optarg ;;
> 
1115c1126
< 		libdir localedir mandir
---
> 		libdir localedir mandir runstatedir
1267a1279
>   --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
1789,1834d1800
< # ac_fn_c_check_decl LINENO SYMBOL VAR INCLUDES
< # ---------------------------------------------
< # Tests whether SYMBOL is declared in INCLUDES, setting cache variable VAR
< # accordingly.
< ac_fn_c_check_decl ()
< {
<   as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
<   as_decl_name=`echo $2|sed 's/ *(.*//'`
<   as_decl_use=`echo $2|sed -e 's/(/((/' -e 's/)/) 0&/' -e 's/,/) 0& (/g'`
<   { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $as_decl_name is declared" >&5
< $as_echo_n "checking whether $as_decl_name is declared... " >&6; }
< if eval \${$3+:} false; then :
<   $as_echo_n "(cached) " >&6
< else
<   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
< /* end confdefs.h.  */
< $4
< int
< main ()
< {
< #ifndef $as_decl_name
< #ifdef __cplusplus
<   (void) $as_decl_use;
< #else
<   (void) $as_decl_name;
< #endif
< #endif
< 
<   ;
<   return 0;
< }
< _ACEOF
< if ac_fn_c_try_compile "$LINENO"; then :
<   eval "$3=yes"
< else
<   eval "$3=no"
< fi
< rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
< fi
< eval ac_res=\$$3
< 	       { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5
< $as_echo "$ac_res" >&6; }
<   eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
< 
< } # ac_fn_c_check_decl
< 
3816,3962d3781
< for ac_func in execvpe
< do :
<   ac_fn_c_check_func "$LINENO" "execvpe" "ac_cv_func_execvpe"
< if test "x$ac_cv_func_execvpe" = xyes; then :
<   cat >>confdefs.h <<_ACEOF
< #define HAVE_EXECVPE 1
< _ACEOF
< 
< fi
< done
< 
< for ac_func in pipe2
< do :
<   ac_fn_c_check_func "$LINENO" "pipe2" "ac_cv_func_pipe2"
< if test "x$ac_cv_func_pipe2" = xyes; then :
<   cat >>confdefs.h <<_ACEOF
< #define HAVE_PIPE2 1
< _ACEOF
< 
< fi
< done
< 
< 
< # posix_spawn checks
< for ac_header in spawn.h
< do :
<   ac_fn_c_check_header_mongrel "$LINENO" "spawn.h" "ac_cv_header_spawn_h" "$ac_includes_default"
< if test "x$ac_cv_header_spawn_h" = xyes; then :
<   cat >>confdefs.h <<_ACEOF
< #define HAVE_SPAWN_H 1
< _ACEOF
< 
< fi
< 
< done
< 
< for ac_func in posix_spawnp posix_spawn_file_actions_addchdir_np posix_spawn_file_actions_addchdir
< do :
<   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
< ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
< if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
<   cat >>confdefs.h <<_ACEOF
< #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
< _ACEOF
< 
< fi
< done
< 
< ac_fn_c_check_decl "$LINENO" "POSIX_SPAWN_SETSID" "ac_cv_have_decl_POSIX_SPAWN_SETSID" "
<   #define _GNU_SOURCE
<   #include <spawn.h>
< 
< "
< if test "x$ac_cv_have_decl_POSIX_SPAWN_SETSID" = xyes; then :
<   ac_have_decl=1
< else
<   ac_have_decl=0
< fi
< 
< cat >>confdefs.h <<_ACEOF
< #define HAVE_DECL_POSIX_SPAWN_SETSID $ac_have_decl
< _ACEOF
< ac_fn_c_check_decl "$LINENO" "POSIX_SPAWN_SETSID_NP" "ac_cv_have_decl_POSIX_SPAWN_SETSID_NP" "
<   #define _GNU_SOURCE
<   #include <spawn.h>
< 
< "
< if test "x$ac_cv_have_decl_POSIX_SPAWN_SETSID_NP" = xyes; then :
<   ac_have_decl=1
< else
<   ac_have_decl=0
< fi
< 
< cat >>confdefs.h <<_ACEOF
< #define HAVE_DECL_POSIX_SPAWN_SETSID_NP $ac_have_decl
< _ACEOF
< 
< ac_fn_c_check_decl "$LINENO" "POSIX_SPAWN_SETPGROUP" "ac_cv_have_decl_POSIX_SPAWN_SETPGROUP" "
<   #define _GNU_SOURCE
<   #include <spawn.h>
< 
< "
< if test "x$ac_cv_have_decl_POSIX_SPAWN_SETPGROUP" = xyes; then :
<   ac_have_decl=1
< else
<   ac_have_decl=0
< fi
< 
< cat >>confdefs.h <<_ACEOF
< #define HAVE_DECL_POSIX_SPAWN_SETPGROUP $ac_have_decl
< _ACEOF
< 
< 
< if test "$ac_cv_func_posix_spawnp" = "yes"; then
< 
<     { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether posix_spawn reports errors sensibly" >&5
< $as_echo_n "checking whether posix_spawn reports errors sensibly... " >&6; }
<     if test "$cross_compiling" = yes; then :
<   $as_echo "#define USE_POSIX_SPAWN /**/" >>confdefs.h
< 
<           { $as_echo "$as_me:${as_lineno-$LINENO}: result: cross-compiling - assuming yes" >&5
< $as_echo "cross-compiling - assuming yes" >&6; }
< 
< else
<   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
< /* end confdefs.h.  */
< 
<              #include <stddef.h>
<              #include <stdbool.h>
<              #include <errno.h>
<              #include <spawn.h>
< 
< int
< main ()
< {
< 
<                  pid_t pid;
<                  char *prog = "__nonexistent_program__";
<                  char *args[] = {prog, NULL};
<                  char *env[] = {NULL};
< 
<                  // This should fail with ENOENT
<                  int ret = posix_spawnp(&pid, prog, NULL, NULL, args, env);
<                  bool okay = ret == ENOENT;
<                  return !okay;
< 
< 
<   ;
<   return 0;
< }
< _ACEOF
< if ac_fn_c_try_run "$LINENO"; then :
< 
< $as_echo "#define USE_POSIX_SPAWN /**/" >>confdefs.h
< 
<           { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
< $as_echo "yes" >&6; }
< else
<   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, falling back to fork/exec" >&5
< $as_echo "no, falling back to fork/exec" >&6; }
< fi
< rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
<   conftest.$ac_objext conftest.beam conftest.$ac_ext
< fi
< 
< fi
< 
3976a3796
> 

This is the difference between the configure scripts (both created by autoconf 2.69). The one being used for the faulty process, seems to configure with posix spawn, whereas the other one does not. I assume that this is causing the discrepancy, maybe there's a bug in how apple's implementation of posix spawn treats empty files (see reproducer)?

[TuongNM]

maybe there's a bug in how apple's implementation of posix spawn treats empty files (see reproducer)?

Sounds like you are on to something here. I ran it with lldb on got these results:

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
    frame #0: 0x0000000000000000
error: memory read failed for 0x0
Target 0: (process-segfault) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x0)
  * frame #0: 0x0000000000000000
    frame #1: 0x0000000100020da0 process-segfault-still`do_spawn_posix + 184
    frame #2: 0x0000000100020454 process-segfault-still`runInteractiveProcess + 388
    frame #3: 0x000000010001de60 process-segfault-still`Lc8qP_info + 136
    frame #4: 0x000000010046d958 process-segfault-still`scheduleWaitThread + 828
    frame #5: 0x000000019072bc40 libdispatch.dylib`_OBJC_$_INSTANCE_METHODS_OS_dispatch_data + 192

I assume 0x0 means it tried to read from NULL.