From 59876296829f305fe1b02f097ee4dc7d53be7d7a Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Thu, 12 Nov 2026 00:14:49 +0100 Subject: [PATCH] ci(msan): lower mmap ASLR entropy on the host before the MSan suite Since the hosted runner image changed on 2026-11-11 the MSan lane aborts before any test runs: MemorySanitizer: CHECK failed: msan_linux.cpp:193 "((personality(old_personality | ADDR_NO_RANDOMIZE))) != ((-1))" The runner kernel now randomizes mmap with more bits than MSan's shadow layout tolerates, so the runtime tries to re-exec itself with ADDR_NO_RANDOMIZE; inside the lane's container the default seccomp profile refuses that personality() call. The last green MSan run was 2026-11-11 01:28Z (run 42939151247); every PR run with the lane since 18:45Z failed this way (runs 43080749803, 43081615012), independent of the change under test. The TSan leg hit the same kernel behaviour earlier and lowers vm.mmap_rnd_bits to 28 on Linux before its suite. Do the same on the host before the MSan container starts; the container shares the host kernel, so MSan's layout fits again without disabling ASLR in the container. `|| true` keeps the step from failing where sysctl is not permitted, exactly as in the TSan step. Signed-off-by: Martin Vogel --- .github/workflows/_test.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml index 0eddc1754..e1db65e32 100644 --- a/.github/workflows/_test.yml +++ b/.github/workflows/_test.yml @@ -460,7 +460,14 @@ jobs: run: scripts/ci/msan-lane.sh build - name: MSan suite (exclusions per scripts/msan.sh) - run: scripts/ci/msan-lane.sh run + # Reduce mmap ASLR entropy on the host first, as the TSan leg does: with + # the runner kernel's higher default the MSan runtime tries to re-exec + # itself with ADDR_NO_RANDOMIZE, which the container's seccomp profile + # refuses, and it aborts ("CHECK failed: msan_linux.cpp:193 ... + # personality") before any test runs. The container shares this kernel. + run: | + sudo sysctl -w vm.mmap_rnd_bits=28 || true + scripts/ci/msan-lane.sh run # macOS leak coverage. LeakSanitizer runs by default under ASan on Linux, so # test-unix's ubuntu legs have always had it; on macOS it is off by default