Skip to content

Commit 1c53389

Browse files
author
jakehehrlich
committed
[libFuzzer] Always print DSO map on Fuchsia libFuzzer launch
Fuchsia doesn't have /proc/id/maps, so it relies on the kernel logging system to provide the DSO map to be able to symbolize in the context of ASLR. The DSO map is logged automatically on Fuchsia when encountering a crash or writing to the sanitizer log for the first time in a process. There are several cases where libFuzzer doesn't encounter a crash, e.g. on timeouts, OOMs, and when configured to print new PCs as they become covered, to name a few. Therefore, this change always writes to the sanitizer log on startup to ensure the DSO map is available in the log. Author: aarongreen Differential Revision: https://reviews.llvm.org/D66233 git-svn-id: https://llvm.org/svn/llvm-project/compiler-rt/trunk/lib/fuzzer@372056 91177308-0d34-0410-b5e6-96231b3b80d8
1 parent 30d6a96 commit 1c53389

File tree

2 files changed

+12
-0
lines changed

2 files changed

+12
-0
lines changed

FuzzerExtFunctions.def

+1
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ EXT_FUNC(__sanitizer_install_malloc_and_free_hooks, int,
3333
(void (*malloc_hook)(const volatile void *, size_t),
3434
void (*free_hook)(const volatile void *)),
3535
false);
36+
EXT_FUNC(__sanitizer_log_write, void, (const char *buf, size_t len), false);
3637
EXT_FUNC(__sanitizer_purge_allocator, void, (), false);
3738
EXT_FUNC(__sanitizer_print_memory_profile, void, (size_t, size_t), false);
3839
EXT_FUNC(__sanitizer_print_stack_trace, void, (), true);

FuzzerUtilFuchsia.cpp

+11
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,17 @@ bool Mprotect(void *Ptr, size_t Size, bool AllowReadWrite) {
311311

312312
// Platform specific functions.
313313
void SetSignalHandler(const FuzzingOptions &Options) {
314+
// Make sure information from libFuzzer and the sanitizers are easy to
315+
// reassemble. `__sanitizer_log_write` has the added benefit of ensuring the
316+
// DSO map is always available for the symbolizer.
317+
// A uint64_t fits in 20 chars, so 64 is plenty.
318+
char Buf[64];
319+
memset(Buf, 0, sizeof(Buf));
320+
snprintf(Buf, sizeof(Buf), "==%lu== INFO: libFuzzer starting.\n", GetPid());
321+
if (EF->__sanitizer_log_write)
322+
__sanitizer_log_write(Buf, sizeof(Buf));
323+
Printf("%s", Buf);
324+
314325
// Set up alarm handler if needed.
315326
if (Options.UnitTimeoutSec > 0) {
316327
std::thread T(AlarmHandler, Options.UnitTimeoutSec / 2 + 1);

0 commit comments

Comments
 (0)