<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 3, 2015 at 12:34 PM, Brian Cain <span dir="ltr"><<a href="mailto:brian.cain@gmail.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=brian.cain@gmail.com&cc=&bcc=&su=&body=','_blank');return false;">brian.cain@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Oh I thought it was really recent (1-2 weeks behind ToT ). I must have done something wrong there -- I'll check.</p>
<p dir="ltr">Yes, it's extraordinarily slow </p></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">and it may do dlopen (), I'll find out.</p>
<p dir="ltr">No, I don't *believe* it's using other threads but I will check. </p>
<p dir="ltr">I would let it run for 24h before giving up on a crash though.</p></blockquote><div><br></div><div>This makes little sense because with such a rare reproducer it's hard to fix the bug. </div><div>So far my only idea is a race between libFuzzer's actions in the main thread and dlopen in a non-main thread. </div><div>And this is not the code I want to keep long term, so I am reluctant to fix it now. :( </div><div>And you have a workaround :) </div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr"> </p><div class="HOEnZb"><div class="h5">
<div class="gmail_quote">On Dec 3, 2015 2:15 PM, "Kostya Serebryany" <<a href="mailto:kcc@google.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=kcc@google.com&cc=&bcc=&su=&body=','_blank');return false;">kcc@google.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I am able to build the fuzzer, but not to reproduce the crash. <div><br></div><div>First: you seem to be using a not-the-most-recent libfuzzer source, please update. <br>You will need to change LLVMFuzzerTestOneInput to return 0.<br></div><div><br></div><div>Second, for some reason, the fuzzing is very slow, about 1 exec/s.</div><div>You probably want to fix that too. </div><div><br></div><div>Third: does this code have threads? dlopen? </div><div>Running it for a short period does not show either, but probably the fuzzer discovers some such input that triggers dlopen in a non-main thread. </div><div>I guess the sanitizer coverage has a race in this case. </div><div><br></div><div>So, just drop 8bit-counters. (This flag is far from optimal, we may actually remove it completely at some point). </div><div><br></div><div>hth, </div><div>--kcc </div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 3, 2015 at 11:14 AM, Brian Cain <span dir="ltr"><<a href="mailto:brian.cain@gmail.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=brian.cain@gmail.com&cc=&bcc=&su=&body=','_blank');return false;">brian.cain@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Ah, yes -- you need to clone with --recursive.</p>
<p dir="ltr">I will try the workaround though. </p><div><div>
<div class="gmail_quote">On Dec 3, 2015 1:12 PM, "Kostya Serebryany" <<a href="mailto:kcc@google.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=kcc@google.com&cc=&bcc=&su=&body=','_blank');return false;">kcc@google.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Dec 2, 2015 at 7:17 PM, Brian Cain <span dir="ltr"><<a href="mailto:brian.cain@gmail.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=brian.cain@gmail.com&cc=&bcc=&su=&body=','_blank');return false;">brian.cain@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr">Kostya,<div><br></div><div>Here's the git repo: <a href="https://bitbucket.org/ebadf/fuzzpy" target="_blank">https://bitbucket.org/ebadf/fuzzpy</a> </div><div><br></div><div>I've only tested it on arm7 and x86_64 linux, I expect there's a good chance it may not work on other OSs.</div><div><br></div><div>If you can build it successfully ("./build.sh", requires clang and clang++ in your path), then you should run the "testemail" case like so:</div><div><br></div></div></blockquote><div><br></div><div>Does not build for me out of the box:</div><div><pre style="color:rgb(0,0,0)">./build.sh: line 70: ./configure: No such file or directory</pre>I wonder if a smaller test possible here.</div><div>Meanwhile, here is a workaround for you. </div><div>Instead of </div><div>SANITIZE_COV_OPTS="-fsanitize-coverage=bb,indirect-calls,8bit-counters" <br></div><div>try using </div><div><div>SANITIZE_COV_OPTS="-fsanitize-coverage=edge,indirect-calls" <br></div></div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div></div><div><div>while true; do ITERS=1000 ./run.sh tests/build/testemail tests/testemail/inputs/; done</div></div><div><br></div><div>Let me know if you have any challenges building or running the test case.</div><div> </div></div><div class="gmail_extra"><div><div><br><div class="gmail_quote">On Tue, Dec 1, 2015 at 7:26 PM, Kostya Serebryany <span dir="ltr"><<a href="mailto:kcc@google.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=kcc@google.com&cc=&bcc=&su=&body=','_blank');return false;">kcc@google.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div>Hi Brian, </div>Yes, looks like a bug in sanitizer coverage, please send the reproducer. </div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Dec 1, 2015 at 5:22 PM, Brian Cain <span dir="ltr"><<a href="mailto:brian.cain@gmail.com" target="_blank" onclick="window.open('https://mail.google.com/mail/?view=cm&tf=1&to=brian.cain@gmail.com&cc=&bcc=&su=&body=','_blank');return false;">brian.cain@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div><br></div>Kostya,<div><br></div><div>I think I've found what looks like a reproducible bug in libFuzzer. The code under test is built with ASan and the first ASan CHECK failure shows fuzzer in the stack trace. (see below)</div><div><br></div><div>One of the factors that may be unique in my testing is that each iteration can take a very long time to execute (tens or hundreds of seconds).</div><div><br></div><div>Let me know if you need more info, I think it shouldn't take much test time to reproduce this.</div><div><br></div><div><div>================== Job 2 exited with exit code 256 ============</div><div>Flag: verbosity 3</div><div>Flag: use_traces 1</div><div>Flag: timeout 100</div><div>Flag: max_len 16384</div><div>Seed: <a href="tel:3259211893" value="+13259211893" target="_blank">3259211893</a></div><div>PreferSmall: 0</div><div>#0 READ units: 4975 exec/s: 0</div><div>#1 pulse cov: 32410 bits: 30791 indir: 714 units: 4975 exec/s: 0</div><div>NEW0: 32410 L 13869</div><div>==31301==AddressSanitizer CHECK failed: /home/brian/src/fuzzpy/llvm_src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_coverage_libcdep.cc:467 "((n % 16)) == ((0))" (0x1, 0x0)</div><div> #0 0x11d3b7 in __asan::AsanCheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /home/brian/src/fuzzpy/llvm_src/llvm/projects/compiler-rt/lib/asan/asan_rtl.cc:67:3</div><div> #1 0x122f1f in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) /home/brian/src/fuzzpy/llvm_src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common.cc:159:5</div><div> #2 0x134317 in __sanitizer::CoverageData::Update8bitCounterBitsetAndClearCounters(unsigned char*) /home/brian/src/fuzzpy/llvm_src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_coverage_libcdep.cc:467:5</div><div> #3 0x1b7b53 in fuzzer::Fuzzer::PrepareCoverageBeforeRun() /home/brian/src/fuzzpy/llvm_src//llvm/lib/Fuzzer/FuzzerLoop.cpp:264:5</div><div> #4 0x1b501b in fuzzer::Fuzzer::RunOne(std::vector<unsigned char, std::allocator<unsigned char> > const&) /home/brian/src/fuzzpy/llvm_src//llvm/lib/Fuzzer/FuzzerLoop.cpp:212:3</div><div> #5 0x1b6be3 in fuzzer::Fuzzer::ShuffleAndMinimize() /home/brian/src/fuzzpy/llvm_src//llvm/lib/Fuzzer/FuzzerLoop.cpp:195:11</div><div> #6 0x14477b in fuzzer::FuzzerDriver(std::vector<std::string, std::allocator<std::string> > const&, fuzzer::UserSuppliedFuzzer&) /home/brian/src/fuzzpy/llvm_src//llvm/lib/Fuzzer/FuzzerDriver.cpp:303:3</div><div> #7 0x14183f in fuzzer::FuzzerDriver(int, char**, fuzzer::UserSuppliedFuzzer&) /home/brian/src/fuzzpy/llvm_src//llvm/lib/Fuzzer/FuzzerDriver.cpp:201:10</div><div> #8 0x141427 in fuzzer::FuzzerDriver(int, char**, int (*)(unsigned char const*, unsigned int)) /home/brian/src/fuzzpy/llvm_src//llvm/lib/Fuzzer/FuzzerDriver.cpp:196:10 </div><div> #9 0x1873e3 in main /home/brian/src/fuzzpy/llvm_src//llvm/lib/Fuzzer/FuzzerMain.cpp:19:10</div><div> #10 0xb6c86775 in __libc_start_main /build/buildd/glibc-2.21/csu/libc-start.c:289</div><div><br></div><div>DEATH:</div><div>artifact_prefix='./'; Test unit written to ./crash-ec9fa023e9db127e2589d0ab4c506055e4174611</div><span><font color="#888888"><div><br></div><div><br></div>-- <br><div>-Brian</div>
</font></span></div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br><br clear="all"><div><br></div></div></div><span><font color="#888888">-- <br><div>-Brian</div>
</font></span></div>
</blockquote></div><br></div></div>
</blockquote></div>
</div></div></blockquote></div><br></div>
</blockquote></div>
</div></div></blockquote></div><br></div></div>