Skip to content

Commit 9df7ee3

Browse files
committed
[libFuzzer] Fix minimizing timeouts
When one tries to minimize timeouts using -minimize_crash=1, minimization immediately fails. The following sequence of events is responsible for this: [parent] SIGALRM occurs [parent] read() returns -EINTR (or -ERESTARTSYS according to strace) [parent] fgets() returns NULL [parent] ExecuteCommand() closes child's stdout and returns [child ] SIGALRM occurs [child ] AlarmCallback() attempts to write "ALARM: ..." to stdout [child ] Dies with SIGPIPE without calling DumpCurrentUnit() [parent] Does not see -exact_artifact_path and exits When minimizing, the timer in parent is not necessary, so fix by not setting it in this case. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D85359
1 parent 06d5670 commit 9df7ee3

File tree

6 files changed

+11
-3
lines changed

6 files changed

+11
-3
lines changed

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -767,6 +767,7 @@ int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
767767
#endif // LIBFUZZER_EMSCRIPTEN
768768

769769
Options.HandleAbrt = Flags.handle_abrt;
770+
Options.HandleAlrm = !Flags.minimize_crash;
770771
Options.HandleBus = Flags.handle_bus;
771772
Options.HandleFpe = Flags.handle_fpe;
772773
Options.HandleIll = Flags.handle_ill;

compiler-rt/lib/fuzzer/FuzzerOptions.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ struct FuzzingOptions {
6969
int PurgeAllocatorIntervalSec = 1;
7070
int TraceMalloc = 0;
7171
bool HandleAbrt = false;
72+
bool HandleAlrm = false;
7273
bool HandleBus = false;
7374
bool HandleFpe = false;
7475
bool HandleIll = false;

compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -354,7 +354,7 @@ void SetSignalHandler(const FuzzingOptions &Options) {
354354
Printf("%s", Buf);
355355

356356
// Set up alarm handler if needed.
357-
if (Options.UnitTimeoutSec > 0) {
357+
if (Options.HandleAlrm && Options.UnitTimeoutSec > 0) {
358358
std::thread T(AlarmHandler, Options.UnitTimeoutSec / 2 + 1);
359359
T.detach();
360360
}

compiler-rt/lib/fuzzer/FuzzerUtilPosix.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ void SetTimer(int Seconds) {
113113

114114
void SetSignalHandler(const FuzzingOptions& Options) {
115115
// setitimer is not implemented in emscripten.
116-
if (Options.UnitTimeoutSec > 0 && !LIBFUZZER_EMSCRIPTEN)
116+
if (Options.HandleAlrm && Options.UnitTimeoutSec > 0 && !LIBFUZZER_EMSCRIPTEN)
117117
SetTimer(Options.UnitTimeoutSec / 2 + 1);
118118
if (Options.HandleInt)
119119
SetSigaction(SIGINT, InterruptHandler);

compiler-rt/lib/fuzzer/FuzzerUtilWindows.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ static void CrashHandler(int) { Fuzzer::StaticCrashSignalCallback(); }
115115
void SetSignalHandler(const FuzzingOptions& Options) {
116116
HandlerOpt = &Options;
117117

118-
if (Options.UnitTimeoutSec > 0)
118+
if (Options.HandleAlrm && Options.UnitTimeoutSec > 0)
119119
Timer.SetTimer(Options.UnitTimeoutSec / 2 + 1);
120120

121121
if (Options.HandleInt || Options.HandleTerm)
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
RUN: %cpp_compiler %S/TimeoutTest.cpp -o %t-TimeoutTest
2+
RUN: mkdir -p %t.dir
3+
4+
RUN: echo 'Hi!?' > %t.dir/not_minimal_timeout
5+
RUN: %run %t-TimeoutTest -minimize_crash=1 %t.dir/not_minimal_timeout -timeout=1 -max_total_time=3 2>&1 | FileCheck %s
6+
CHECK: CRASH_MIN: failed to minimize beyond {{.*}}minimized-from{{.*}} (3 bytes), exiting

0 commit comments

Comments
 (0)