llvm dev - Oct 2015 - Some feedback on Libfuzzer

On Tue, Oct 20, 2015 at 10:53 PM, Kostya Serebryany <kcc at google.com>
wrote:
> Can you open a separate bug with exact repro instructions?
Well the bug tracker seems to require an account.

But in any case I don't see anything specific to reproduce. I did an
svn update of llvm and clang and built and installed (I even tried
make clean and removed the old install but it didn't change anything).
Then any program I compile with -fsanitize=memory behaves just like it
did before the patch:

$ uname -a
Linux pixel 4.2.0-trunk-amd64 #1 SMP Debian 4.2-1~exp1 (2015-08-31)
x86_64 GNU/Linux

$ cat foo.c
int main(int argc, char *argv[], char *env[]) {
return 0;
}

$ clang -fPIE -pie -fsanitize=memory foo.c

$ ./a.out
FATAL: Code 0x562988448390 is out of application range. Non-PIE build?
FATAL: MemorySanitizer can not mmap the shadow memory.
FATAL: Make sure to compile with -fPIE and to link with -pie.
FATAL: Disabling ASLR is known to cause this error.
FATAL: If running under GDB, try 'set disable-randomization off'.
==3120==Process memory map follows:
0x56298842b000-0x5629884ca000 /tmp/a.out
0x5629886ca000-0x5629886ce000 /tmp/a.out
0x5629886ce000-0x56298ab41000
0x7f387d560000-0x7f387d8b2000
...


-- 
greg

On Wed, Oct 21, 2015 at 1:22 AM, Greg Stark <stark at mit.edu>
wrote:
> On Tue, Oct 20, 2015 at 10:53 PM, Kostya Serebryany <kcc at
google.com> wrote:
>> Can you open a separate bug with exact repro instructions?
>
> Well the bug tracker seems to require an account.
>
> But in any case I don't see anything specific to reproduce. I did an
> svn update of llvm and clang and built and installed (I even tried
> make clean and removed the old install but it didn't change anything).
> Then any program I compile with -fsanitize=memory behaves just like it
> did before the patch:
>
> $ uname -a
> Linux pixel 4.2.0-trunk-amd64 #1 SMP Debian 4.2-1~exp1 (2015-08-31)
> x86_64 GNU/Linux
>
> $ cat foo.c
> int main(int argc, char *argv[], char *env[]) {
> return 0;
> }
>
> $ clang -fPIE -pie -fsanitize=memory foo.c
>
> $ ./a.out
> FATAL: Code 0x562988448390 is out of application range. Non-PIE build?
> FATAL: MemorySanitizer can not mmap the shadow memory.
> FATAL: Make sure to compile with -fPIE and to link with -pie.
> FATAL: Disabling ASLR is known to cause this error.
> FATAL: If running under GDB, try 'set disable-randomization off'.
> ==3120==Process memory map follows:
> 0x56298842b000-0x5629884ca000 /tmp/a.out
> 0x5629886ca000-0x5629886ce000 /tmp/a.out
> 0x5629886ce000-0x56298ab41000
> 0x7f387d560000-0x7f387d8b2000
> ...
I've got no explanation for this. I've verified that 0x5555555daf34 is
not considered "out of application range" on linux/x86_64/3.13.0.
Reading the current source code,
  {0x510000000000ULL, 0x600000000000ULL, MappingDesc::APP, "app-2"},
which makes the following line impossible:
  FATAL: Code 0x562988448390 is out of application range.

Could you double-verify that you are using ToT clang? Does anything
change if you run in gdb (without set disable-randomization off)?

On Wed, Oct 21, 2015 at 7:29 PM, Evgenii Stepanov
<eugeni.stepanov at gmail.com> wrote:
> Could you double-verify that you are using ToT clang? Does anything
> change if you run in gdb (without set disable-randomization off)?
I think I finally figured out what I had done wrong here. I had done
an svn update for llvm and tools/clang but not for
projects/compiler-rt.

-- 
greg