Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Need instrumented versions for system libs to make MSAN work #608

Closed
inferno-chromium opened this issue May 15, 2017 · 6 comments
Closed

Need instrumented versions for system libs to make MSAN work #608

inferno-chromium opened this issue May 15, 2017 · 6 comments

Comments

@inferno-chromium
Copy link
Collaborator

@inferno-chromium inferno-chromium commented May 15, 2017

This is needed for several projects that depend on system libraries. E.g see #607

@kcc
Copy link
Contributor

@kcc kcc commented May 23, 2017

I've looked at the existing warnings from libpng, freetype, libarchive,
and they are clearly caused by linking in non-instrumented system libs like -lz, lzma, or -larchive

So, I think any further msan roll up is blocked until we can provide msan-instrumented libs in the docker image for msan.

I suggest this order of steps:

  • add -lz and -larchive
  • observe at least png and freetype targets get clean, enable them
  • add -lbz2 -llzo2 -lxml2 -llzma -lcrypto -llz4 -licuuc
@oliverchang
Copy link
Collaborator

@oliverchang oliverchang commented Dec 7, 2017

Progress update:

We now have a set of scripts in https://github.com/google/oss-fuzz/tree/master/infra/base-images/msan-builder that attempt to build MSan instrumented libraries by hooking into debian's package build system.

This should hopefully work for most packages in a debian-based distro with some minor overrides.

At at high level this:

  • Install a compiler wrapper and sets up various other wrappers and environment variables.

  • Figure out package dependencies that are c/c++ libraries (and build those too)

  • Use apt-get source to get the source archive for them.

  • Do dpkg-buildpackage to do the build and create .deb files

  • Extract shared libraries from the .deb files, fixing symlinks and rpaths to be relative.

Our infra will build a set of libraries specified here

Some remaining work:

  • Make sure openssl gets --no-asm during configure
  • Some basic tests to make sure the .so files are actually msan instrumented
  • Enable more libraries to be built by default.
  • Include these libraries in MSan project builds.
@oliverchang
Copy link
Collaborator

@oliverchang oliverchang commented Dec 7, 2017

Also have a question for @eugenis :

To keep our build process simple, we're building libraries with -fsanitize-recover=memory. Are there any downsides to this? And can we use a binary compiled without -fsanitize-recover=memory with these libraries?

@eugenis
Copy link
Contributor

@eugenis eugenis commented Dec 7, 2017

oliverchang added a commit that referenced this issue Jan 11, 2018
@oliverchang
Copy link
Collaborator

@oliverchang oliverchang commented Jan 12, 2018

Progress update. MSan builds will now use static libraries available in this list. Builds will also have their rpaths patched to use any instrumented dynamic libraries available too.

2 projects I looked at:

  • libarchive. Many false positives closed, but 9 reports remain open. These all seem related to lz4, so either it's not instrumented properly or these are legitimate reports.

  • libpng had a libz dependency. https://oss-fuzz.com/v2/testcase-detail/5439055517974528 was closed after it started running with the instrumented libz.

@inferno-chromium
Copy link
Collaborator Author

@inferno-chromium inferno-chromium commented May 31, 2020

Done!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
4 participants