From 64418cb26af0e918ce3d19759afe4d00ee729d38 Mon Sep 17 00:00:00 2001 From: Lisa Gnedt Date: Sat, 30 Aug 2025 20:03:58 +0200 Subject: [PATCH 1/2] nixos/malloc: fix Scudo library path The commit 01e8f570c67955ab92be0ef352066f16b63940f2 unpinned the LLVM version, which led to building errors similar to this when Scudo is used: building the system configuration... error: builder for '/nix/store/1f9z73haq6avvv19glifalfnmpw3gsbx-malloc-provider-scudo.drv' failed with exit code 1; last 1 log lines: > cp: cannot stat '/nix/store/s43991isxhvknqmk53q7pqmkdrfvj1p4-compiler-rt-libc-19.1.7/lib/linux/libclang_rt.scudo-x86_64.so': No such file or directory For full logs, run: nix log /nix/store/1f9z73haq6avvv19glifalfnmpw3gsbx-malloc-provider-scudo.drv It seems in the new LLVM version the Scudo library was moved: $ ls /nix/store/*-compiler-rt-libc-20.1.8/lib/linux/libclang_rt.scudo* /nix/store/z98mwyi0w8f4kgk3rw6av946azh28hc9-compiler-rt-libc-20.1.8/lib/linux/libclang_rt.scudo_standalone_cxx-x86_64.a /nix/store/z98mwyi0w8f4kgk3rw6av946azh28hc9-compiler-rt-libc-20.1.8/lib/linux/libclang_rt.scudo_standalone-x86_64.a /nix/store/z98mwyi0w8f4kgk3rw6av946azh28hc9-compiler-rt-libc-20.1.8/lib/linux/libclang_rt.scudo_standalone-x86_64.so This commit adjusts the library path. Co-authored-by: CUB3D --- nixos/modules/config/malloc.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/config/malloc.nix b/nixos/modules/config/malloc.nix index bc02fa5010d3..8959a99f7b7b 100644 --- a/nixos/modules/config/malloc.nix +++ b/nixos/modules/config/malloc.nix @@ -52,7 +52,7 @@ let or (throw "scudo not supported on ${pkgs.stdenv.hostPlatform.system}"); in { - libPath = "${pkgs.llvmPackages.compiler-rt}/lib/linux/libclang_rt.scudo-${systemPlatform}.so"; + libPath = "${pkgs.llvmPackages.compiler-rt}/lib/linux/libclang_rt.scudo_standalone-${systemPlatform}.so"; description = '' A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator, which aims at providing additional mitigations against heap based From 753af06dab0561b180b8d9e274a9f6c41e5107ee Mon Sep 17 00:00:00 2001 From: Lisa Gnedt Date: Thu, 18 Sep 2025 21:19:48 +0200 Subject: [PATCH 2/2] treewide: fix Scudo options The commit 01e8f570c67955ab92be0ef352066f16b63940f2 unpinned the LLVM version, which led to the following warnings whenever Scudo is loaded (basically whenever a command is started when used system-wide): Scudo WARNING: found 3 unrecognized flag(s): DeleteSizeMismatch=0:DeallocationTypeMismatch=0 DeallocationTypeMismatch=0 ZeroContents=1 According to the current Scudo documentation [1] the options are now spelled differently. This commit keeps all existing options and only updates the spelling. [1] https://llvm.org/docs/ScudoHardenedAllocator.html Reported-by: CUB3D --- nixos/modules/profiles/hardened.nix | 2 +- pkgs/development/compilers/llvm/common/compiler-rt/default.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix index 06e5644f76e9..e12eb19b13d8 100644 --- a/nixos/modules/profiles/hardened.nix +++ b/nixos/modules/profiles/hardened.nix @@ -39,7 +39,7 @@ in nix.settings.allowed-users = mkDefault [ "@users" ]; environment.memoryAllocator.provider = mkDefault "scudo"; - environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1"; + environment.variables.SCUDO_OPTIONS = mkDefault "zero_contents=true"; security.lockKernelModules = mkDefault true; diff --git a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix index 9e67b2bff8e9..482185111994 100644 --- a/pkgs/development/compilers/llvm/common/compiler-rt/default.nix +++ b/pkgs/development/compilers/llvm/common/compiler-rt/default.nix @@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: { env = { NIX_CFLAGS_COMPILE = toString ( [ - "-DSCUDO_DEFAULT_OPTIONS=DeleteSizeMismatch=0:DeallocationTypeMismatch=0" + "-DSCUDO_DEFAULT_OPTIONS=delete_size_mismatch=false:dealloc_type_mismatch=false" ] ++ lib.optionals (!haveLibc) [ # The compiler got stricter about this, and there is a usellvm patch below