Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Several fuzzers seem to be failing to pass OSS-Fuzz build checks #10714

Closed
evverx opened this issue Nov 9, 2018 · 0 comments
Closed

Several fuzzers seem to be failing to pass OSS-Fuzz build checks #10714

evverx opened this issue Nov 9, 2018 · 0 comments
Labels
priority Stuff that should enter master quickly, since it fixes a major bug, unbreaks CI or stalls other work

Comments

@evverx
Copy link
Member

evverx commented Nov 9, 2018

It basically means that the build is broken there. The following is from https://oss-fuzz-build-logs.storage.googleapis.com/index.html:

Step #21: artifact_prefix='./'; Test unit written to ./crash-da39a3ee5e6b4b0d3255bfef95601890afd80709
Step #21: Base64: 
Step #21: fuzz-network-parser:
Step #21: BAD BUILD: /workspace/out/memory/fuzz-network-parser seems to have either startup crash or exit:
Step #21: INFO: Seed: 2794886359
Step #21: INFO: Loaded 2 modules   (49189 inline 8-bit counters): 39142 [0x7efc0bcfed79, 0x7efc0bd0865f), 10047 [0xba79e0, 0xbaa11f), 
Step #21: INFO: Loaded 2 PC tables (49189 PCs): 39142 [0x7efc0bd08660,0x7efc0bda14c0), 10047 [0xbaa120,0xbd1510), 
Step #21: INFO: -max_len is not provided; libFuzzer will not generate inputs larger than 4096 bytes
Step #21: ==379==WARNING: MemorySanitizer: use-of-uninitialized-value
Step #21:     #0 0x7efc0b66ee56 in rdrand64 /work/build/../../src/systemd/src/basic/random-util.c:59:13
Step #21:     #1 0x7efc0b66f248 in genuine_random_bytes /work/build/../../src/systemd/src/basic/random-util.c:93:29
Step #21:     #2 0x7efc0b66ffbf in random_bytes /work/build/../../src/systemd/src/basic/random-util.c:253:13
Step #21:     #3 0x7efc0b5ba580 in hashmap_base_new /work/build/../../src/systemd/src/basic/hashmap.c:792:17
Step #21:     #4 0x7efc0b5ba888 in hashmap_base_ensure_allocated /work/build/../../src/systemd/src/basic/hashmap.c:829:13
Step #21:     #5 0x7efc0b8ddd65 in sd_event_add_post /work/build/../../src/systemd/src/libsystemd/sd-event/sd-event.c:1412:13
Step #21:     #6 0x4ba54b in manager_new /work/build/../../src/systemd/src/network/networkd-manager.c:1362:13
Step #21:     #7 0x4ab18d in LLVMFuzzerTestOneInput /work/build/../../src/systemd/src/network/fuzz-network-parser.c:19:9
Step #21:     #8 0x6cf36b in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15
Step #21:     #9 0x6d56fe in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:761:3
Step #21:     #10 0x6d7583 in fuzzer::Fuzzer::Loop(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:806:3
Step #21:     #11 0x699fff in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:764:6
Step #21:     #12 0x686441 in main /src/libfuzzer/FuzzerMain.cpp:20:10
Step #21:     #13 0x7efc0a36682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
Step #21:     #14 0x427428 in _start (out/memory/fuzz-network-parser+0x427428)
Step #21: 
Step #21:   Uninitialized value was created by an allocation of 'err' in the stack frame of function 'rdrand64'
Step #21:     #0 0x7efc0b66ea70 in rdrand64 /work/build/../../src/systemd/src/basic/random-util.c:34
Step #21: 
Step #21: SUMMARY: MemorySanitizer: use-of-uninitialized-value /work/build/../../src/systemd/src/basic/random-util.c:59:13 in rdrand64
Step #21: Unique heap origins: 41
Step #21: Stack depot allocated bytes: 2688
Step #21: Unique origin histories: 6
Step #21: History depot allocated bytes: 144
Step #21: Exiting
Step #21: MS: 0 ; base unit: 0000000000000000000000000000000000000000
Step #21: 
Step #21: 
Step #21: artifact_prefix='./'; Test unit written to ./crash-da39a3ee5e6b4b0d3255bfef95601890afd80709
Step #21: Base64: 
Step #21: ERROR: 28% of fuzz targets seem to be broken. See the list above for a detailed information.
Finished Step #21
ERROR
ERROR: build step 21 "gcr.io/oss-fuzz-base/base-runner" failed: exit status 1

I'm pretty sure it was introduced in cc83d51, where genuine_random_bytes started to call rdrand64, which, in turn, includes an inline asm call that isn't instrumented by MSan.

@evverx evverx added the priority Stuff that should enter master quickly, since it fixes a major bug, unbreaks CI or stalls other work label Nov 9, 2018
@evverx evverx changed the title Several fuzzers seems to be failing to pass OSS-Fuzz build checks Several fuzzers seem to be failing to pass OSS-Fuzz build checks Nov 9, 2018
evverx added a commit to evverx/systemd that referenced this issue Nov 10, 2018
MSan doesn't instrument inline asm calls so let's help it
by marking err as initialized manually.

Fixes: systemd#10714.
poettering pushed a commit that referenced this issue Nov 10, 2018
MSan doesn't instrument inline asm calls so let's help it
by marking err as initialized manually.

Fixes: #10714.
Yamakuzure pushed a commit to elogind/elogind that referenced this issue Feb 13, 2019
MSan doesn't instrument inline asm calls so let's help it
by marking err as initialized manually.

Fixes: systemd/systemd#10714.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
priority Stuff that should enter master quickly, since it fixes a major bug, unbreaks CI or stalls other work
Development

No branches or pull requests

1 participant