<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - libFuzzer + dlopen = ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address"
href="https://bugs.llvm.org/show_bug.cgi?id=43917">43917</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>libFuzzer + dlopen = ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address
</td>
</tr>
<tr>
<th>Product</th>
<td>clang
</td>
</tr>
<tr>
<th>Version</th>
<td>9.0
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Static Analyzer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>dcoughlin@apple.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>rjones@redhat.com
</td>
</tr>
<tr>
<th>CC</th>
<td>dcoughlin@apple.com, llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>I'm experimenting with libFuzzer on a larger program which (in a fundamental
way that is vital to its operation) uses loadable modules. Unfortunately when
the program is compiled with -fsanitize=fuzzer it segfaults shortly after
loading or unloading the module. It is quite easy to reproduce this in a
simple test case, see below.
It's possible to work around this by omitting the dlclose() call (and changing
the dlopen() so it is called once) but nevertheless this seems to be a bug in
clang of some kind. In the real program I am modifying it's not very simple to
change the code to never use dlclose.
--------------------- test.c
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <dlfcn.h>
int
LLVMFuzzerTestOneInput (const uint8_t *data, size_t size)
{
void *dl = dlopen ("./module.so", RTLD_NOW|RTLD_GLOBAL);
if (dl == NULL) {
fprintf (stderr, "%s\n", dlerror ());
exit (EXIT_FAILURE);
}
printf ("module loaded, dl=%p\n", dl);
dlclose (dl);
return 0;
}
--------------------- module.c
#include <stdio.h>
int
foo (void)
{
return 0;
}
$ clang -g -O1 -fsanitize=fuzzer -fPIC test.c -o test
$ clang -g -O1 -fsanitize=fuzzer -fPIC -shared module.c -o module.so
$ ./test
INFO: Seed: 2932099106
INFO: Loaded 1 modules (3 inline 8-bit counters): 3 [0x4900a0, 0x4900a3),
INFO: Loaded 1 PC tables (3 PCs): 3 [0x4900a8,0x4900d8),
INFO: -max_len is not provided; libFuzzer will not generate inputs larger than
4096 bytes
module loaded, dl=0x1c2aa20
INFO: A corpus is not provided, starting from an empty corpus
UndefinedBehaviorSanitizer:DEADLYSIGNAL
==206642==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address
0x7f1f76a2f030 (pc 0x7f1f76610209 bp 0x7ffd075c15e0 sp 0x7ffd075c15b8 T206642)
==206642==The signal is caused by a WRITE memory access.
#0 0x7f1f76610208 in __memset_avx2_unaligned_erms
(/lib64/libc.so.6+0x165208)
#1 0x44525c in fuzzer::TracePC::ClearInlineCounters()
(/var/tmp/fz/test+0x44525c)
#2 0x42aad6 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*,
unsigned long) (/var/tmp/fz/test+0x42aad6)
#3 0x42b710 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long,
bool, fuzzer::InputInfo*, bool*) (/var/tmp/fz/test+0x42b710)
#4 0x42cac0 in
fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::vector<fuzzer::SizedFile,
fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/var/tmp/fz/test+0x42cac0)
#5 0x42e26c in fuzzer::Fuzzer::Loop(std::vector<fuzzer::SizedFile,
fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) (/var/tmp/fz/test+0x42e26c)
#6 0x418c1b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char
const*, unsigned long)) (/var/tmp/fz/test+0x418c1b)
#7 0x408ba6 in main (/var/tmp/fz/test+0x408ba6)
#8 0x7f1f764d21a2 in __libc_start_main (/lib64/libc.so.6+0x271a2)
#9 0x408bfd in _start (/var/tmp/fz/test+0x408bfd)
UndefinedBehaviorSanitizer can not provide additional info.
==206642==ABORTING
MS: 0 ; base unit: 0000000000000000000000000000000000000000
0xa,
\x0a
artifact_prefix='./'; Test unit written to
./crash-adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
Base64: Cg==</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>