New issue
Advanced search Search tips

Issue 915422 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Dec 19
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 0
Type: Bug

Blocking:
issue 767901



Sign in to add a comment

audio_decoder_fuzzer crash stack changes after buildtools roll, close other open bugs.

Project Member Reported by infe...@chromium.org, Dec 15

Issue description

This regressed in https://chromium.googlesource.com/chromium/src/+log/4bc137c6dd5974507d858e6de28885fd8b64fcfc..9a085ba23156aba9ade0a08efd3d948f9527f01e?pretty=fuller&n=10000

ASAN_OPTIONS=redzone=16:print_suppressions=0:strict_memcmp=1:allow_user_segv_handler=0:allocator_may_return_null=1:handle_sigfpe=1:handle_sigbus=1:detect_stack_use_after_return=1:alloc_dealloc_mismatch=0:print_scariness=1:max_uar_stack_size_log=16:quarantine_size_mb=256:detect_odr_violation=0:handle_sigill=1:allocator_release_to_os_interval_ms=500:use_sigaltstack=1:fast_unwind_on_fatal=1:detect_leaks=1:print_summary=1:handle_abort=1:check_malloc_usable_size=0:detect_container_overflow=1:symbolize=1:handle_segv=1 out/lfasan/audio_decoder_fuzzer ~/Downloads/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-6121389930840064
INFO: Seed: 834382748
AddressSanitizer:DEADLYSIGNAL
=================================================================
==241027==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000004e (pc 0x55cc993e27dd bp 0x7ffc25fca200 sp 0x7ffc25fca1f0 T0)
==241027==The signal is caused by a READ memory access.
==241027==Hint: address points to the zero page.
SCARINESS: 10 (null-deref)
    #0 0x55cc993e27dc in fuzzer::FuzzingOptions::FuzzingOptions(fuzzer::FuzzingOptions const&) third_party/libFuzzer/src/FuzzerOptions.h:18
    #1 0x55cc993e1a38 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:645:48
    #2 0x55cc993f7f32 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10
    #3 0x7f7e93bf52b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV third_party/libFuzzer/src/FuzzerOptions.h:18 in fuzzer::FuzzingOptions::FuzzingOptions(fuzzer::FuzzingOptions const&)
==241027==ABORTING

Right now, the roll is reverted in https://bugs.chromium.org/p/chromium/issues/detail?id=910864#c25. Please don't reland, as this will break an unknown number of open testcases on ClusterFuzz.
 
steps to reproduce::

- rm -rf out/fuzz
- git checkout 9a085ba23156aba9ade0a08efd3d948f9527f01e
- gclient sync
- python tools/mb/mb.py gen -m chromium.fuzz -b "Libfuzzer Upload Linux ASan" out/fuzz
- ninja -C out/fuzz -j300 audio_decoder_fuzzer
- ASAN_OPTIONS=redzone=16:print_suppressions=0:strict_memcmp=1:allow_user_segv_handler=0:allocator_may_return_null=1:handle_sigfpe=1:handle_sigbus=1:detect_stack_use_after_return=1:alloc_dealloc_mismatch=0:print_scariness=1:max_uar_stack_size_log=16:quarantine_size_mb=256:detect_odr_violation=0:handle_sigill=1:allocator_release_to_os_interval_ms=500:use_sigaltstack=1:fast_unwind_on_fatal=1:detect_leaks=1:print_summary=1:handle_abort=1:check_malloc_usable_size=0:detect_container_overflow=1:symbolize=1:handle_segv=1 out/fuzz/audio_decoder_fuzzer ~/Downloads/clusterfuzz-testcase-minimized-audio_decoder_fuzzer-6121389930840064

testcase is from https://clusterfuzz.com/download?testcase_id=6121389930840064
you don't need the testcase, just run like

ASAN_OPTIONS=detect_odr_violation=0 out/fuzz/audio_decoder_fuzzer
INFO: Seed: 4096024004
AddressSanitizer:DEADLYSIGNAL
=================================================================
==180587==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000004e (pc 0x559264a7881d bp 0x7ffe06fd4b10 sp 0x7ffe06fd4b00 T0)
==180587==The signal is caused by a READ memory access.
==180587==Hint: address points to the zero page.
    #0 0x559264a7881c in fuzzer::FuzzingOptions::FuzzingOptions(fuzzer::FuzzingOptions const&) third_party/libFuzzer/src/FuzzerOptions.h:18
    #1 0x559264a77a78 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:645:48
    #2 0x559264a8df72 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10
    #3 0x7f62641d52b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV third_party/libFuzzer/src/FuzzerOptions.h:18 in fuzzer::FuzzingOptions::FuzzingOptions(fuzzer::FuzzingOptions const&)
==180587==ABORTING

Owner: thomasanderson@chromium.org
Status: Assigned (was: Untriaged)
looks like only this audio_decoder_fuzzer target is impacted, i have tried a lot of other fuzz targets like appcache_fuzzer, renderer_fuzzer, base_json_reader_fuzzer, dawn_wire_server_and_frontend_fuzzer, mediasource_ADTS_pipeline_integration_fuzzer, skia+path_fuzzers all seem to be ok. so, this bug is not scary as we expected before, looks like might be a buggy audio_decoder_fuzzer target. so, i think we might be able to reland on Monday. lets do it then to avoid any unpredicted weekend fires.
Status: Started (was: Assigned)
Summary: audio_decoder_fuzzer crash stack changes after buildtools roll, close other open bugs. (was: buildtools roll breaks libFuzzer)
Project Member

Comment 6 by bugdroid1@chromium.org, Dec 19

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/155ea8d1356528c9b75b136ce9c453f11c3ccda5

commit 155ea8d1356528c9b75b136ce9c453f11c3ccda5
Author: Tom Anderson <thomasanderson@chromium.org>
Date: Wed Dec 19 21:34:37 2018

Instrument libfuzzer in asan builds

This change prevents rolling buildtools/libc++ from breaking
audio_decoder_fuzzer.

BUG= 915422 
R=inferno
CC=metzman,mmoroz,thakis

Change-Id: I4463c50c171da05308fe053ff7547b198c8130ed
Reviewed-on: https://chromium-review.googlesource.com/c/1384622
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Reviewed-by: Jonathan Metzman <metzman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#617955}
[modify] https://crrev.com/155ea8d1356528c9b75b136ce9c453f11c3ccda5/third_party/libFuzzer/BUILD.gn

Status: Fixed (was: Started)
Blocking: 767901

Sign in to add a comment