New issue
Advanced search Search tips

Issue 840111 link

Starred by 3 users

Issue metadata

Status: WontFix
Owner:
Closed: Sep 12
Cc:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug



Sign in to add a comment

Abrt in seq_handler_fuzzer.cc

Project Member Reported by ClusterFuzz, May 5 2018

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=4965019968864256

Fuzzer: libFuzzer_chromeos_midis_seq_handler_fuzzer
Job Type: libfuzzer_asan_chromeos
Platform Id: linux

Crash Type: Abrt
Crash Address: 0x000000000001
Crash State:
  seq_handler_fuzzer.cc
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=libfuzzer_asan_chromeos&range=2543205:2543809

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=4965019968864256

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reference.md for more information.
 
Project Member

Comment 1 by ClusterFuzz, May 5 2018

Cc: dgreid@chromium.org pmalani@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Owner: pmalani@chromium.org
Status: Assigned (was: Untriaged)
Cc: metzman@chromium.org
The "Reproducer Testcase" link leads to an empty file.
The "Regressed" link doesn't seem to work either.

I can't seem to reproduce this inside a chroot locally, so I'm going to CC metzman@ and wait for his findings before looking into this further.

I didn't get a chance to look at this yet. Will try today or tomorrow. 
The problem is that /dev/snd doesn't exist on the ClusterFuzz bots that run the fuzzer.
It's much better for fuzzers to not depend on the underlying system like this. Can the fuzzer be changed so that this file isn't needed or can be faked?
The daemon at a minimum needs the presence of the ALSA interface. All the ALSA library commands depend on it. In it's absence the daemon won't be able to initialize successfully (even in the absence of any connected h/w). Having the sound subsystem devnode present is required for running anything related to the daemon.

What is the work involved with enabling ALSA on the Clusterfuzz bot kernel?
My first impression is that this will not be possible (in a non-crazy way) with the current architecture of Chrome OS fuzzing on ClusterFuzz, since it is just a chroot on Linux. 

We've been discussing setting up more realistic environments for fuzzing Chrome OS but there are no definite plans yet. 

I will think more about this.
 Issue 873603  has been merged into this issue.
Project Member

Comment 9 by ClusterFuzz, Sep 12

Labels: -Reproducible Unreproducible
ClusterFuzz testcase 4965019968864256 appears to be flaky, updating reproducibility label.
Project Member

Comment 10 by ClusterFuzz, Sep 12

Status: WontFix (was: Assigned)
ClusterFuzz testcase 4965019968864256 is flaky and no longer crashes, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment