New issue
Advanced search Search tips

Issue 921297 link

Starred by 1 user

Issue metadata

Status: Verified
Owner:
Closed: Jan 16
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Timeout in net_ftp_directory_listing_fuzzer

Project Member Reported by ClusterFuzz, Jan 12

Issue description

Detailed report: https://clusterfuzz.com/testcase?key=5708468430045184

Fuzzer: libFuzzer_net_ftp_directory_listing_fuzzer
Fuzz target binary: net_ftp_directory_listing_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  net_ftp_directory_listing_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=515012:515091

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5708468430045184

Issue filed automatically.

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions to reproduce this bug locally.
 
Project Member

Comment 1 by ClusterFuzz, Jan 12

Components: Internals>Core
Labels: Test-Predator-Auto-Components
Automatically applying components based on crash stacktrace and information from OWNERS files.

If this is incorrect, please apply the Test-Predator-Wrong-Components label.
Project Member

Comment 2 by ClusterFuzz, Jan 12

Cc: mmoroz@chromium.org
Labels: ClusterFuzz-Auto-CC
Automatically adding ccs based on OWNERS file / target commit history.

If this is incorrect, please add ClusterFuzz-Wrong label.
Project Member

Comment 3 by ClusterFuzz, Jan 12

Labels: Test-Predator-Auto-Owner
Owner: asvitk...@chromium.org
Status: Assigned (was: Untriaged)
Automatically assigning owner based on suspected regression changelist https://chromium.googlesource.com/chromium/src/+/dcb7897c8ab8914a67a8eb4467772432875685b1 (Switch Mac to use time_exploded_posix.cc.).

If this is incorrect, please let us know why and apply the Test-Predator-Wrong-CLs label. If you aren't the correct owner for this issue, please unassign yourself as soon as possible so it can be re-triaged.
Project Member

Comment 4 by ClusterFuzz, Jan 14

Labels: OS-Linux
Cc: asvitk...@chromium.org mmenke@chromium.org
Components: -Internals>Core Internals>Network>FTP
Owner: eroman@chromium.org
If OS=Linux is true, then the suspected CL is not correct, since it only affects Mac.

It's also possible the issue is cross-platform and happens with POSIX time implementation, which after that CL is used both on Mac and Linux. So that Mac "regressed" with that CL, but the issue existed on Linux before then.

Given that, I think the right person to look at it is an owner of net_ftp_directory_listing, so let me re-assign.
This is almost certainly not a regression.  See  issue 906192 ,  issue 898808 ,  issue 880216 ,  issue 815110 ,  issue 812143 .  Suggest just disabling the fuzzer.  Would also arbitrarily limit its input size, as if there's any regression here, it's likely due to increasing the fuzzer input size, or some ASAN perf regression.
Labels: -Pri-1 Pri-2
Agreed with #6 that this is not a regression in FTP code.

I don't have time to look at this right now, so will just disable the test for now.
Components: Tools>Stability>libFuzzer Tools>Stability>FuzzTarget
> If OS=Linux is true, then the suspected CL is not correct, since it only affects Mac.


I don't think that we dedupicate timeouts well (because stacktraces can be different for the same issue), that why CF might've collided a timeout on Mac and timeout on Linux together. However, if a fix lands and it fixes only one case, the other will be reported back in a couple days.


+kcc@ as FYI. Kostya, you've been thinking about timeout-resistant mode for libFuzzer. This fuzz target is a great example where it would be appreciated. See c#6, it keeps reporting timeouts which are not considered legit, therefore making the developers unhappy.


Project Member

Comment 9 by bugdroid1@chromium.org, Jan 16

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/230c1ed957a70558df6cc9ef3cb64ebc311defba

commit 230c1ed957a70558df6cc9ef3cb64ebc311defba
Author: Eric Roman <eroman@chromium.org>
Date: Wed Jan 16 00:40:23 2019

Disable net_ftp_directory_listing_fuzzer on clusterfuzz.

The test hits a 25-second timeout for certain inputs, which has not yet been investigated.

Bug:  921297 
Change-Id: I49a535c0c922ac4ffff44264102271b3c3977577
Reviewed-on: https://chromium-review.googlesource.com/c/1413060
Commit-Queue: Eric Roman <eroman@chromium.org>
Reviewed-by: Matt Menke <mmenke@chromium.org>
Cr-Commit-Position: refs/heads/master@{#622938}
[modify] https://crrev.com/230c1ed957a70558df6cc9ef3cb64ebc311defba/net/BUILD.gn

Project Member

Comment 10 by ClusterFuzz, Jan 16 (6 days ago)

ClusterFuzz has detected this issue as fixed in range 622873:623077.

Detailed report: https://clusterfuzz.com/testcase?key=5708468430045184

Fuzzer: libFuzzer_net_ftp_directory_listing_fuzzer
Fuzz target binary: net_ftp_directory_listing_fuzzer
Job Type: mac_libfuzzer_chrome_asan
Platform Id: mac

Crash Type: Timeout (exceeds 25 secs)
Crash Address: 
Crash State:
  net_ftp_directory_listing_fuzzer
  
Sanitizer: address (ASAN)

Regressed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=515012:515091
Fixed: https://clusterfuzz.com/revisions?job=mac_libfuzzer_chrome_asan&range=622873:623077

Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5708468430045184

See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for instructions to reproduce this bug locally.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
Project Member

Comment 11 by ClusterFuzz, Jan 16 (6 days ago)

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 5708468430045184 is verified as fixed, so closing issue as verified.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment