LINUX: Deal gracefully with ASan nested crashes

While fuzzing ASan instrumented targets in Android it has
been noticed that sometimes ASan is crashing internally,
while generating reports for detected error (nested crashes).
Mostly null deref bugs or read addresses close to 0x0. In
case ASan internal error does not raise a SIGSEGV the
identified crash is lost since the AsanDie() procedure is
never invoked from compiler-rt.

If "abort_on_error" ASan flag is enabled (SIGABRT is
monitored for target application) there is nothing that can
be done if nested crash doesn't result to a SIGSEGV being
raised. On the other hand if SIGABRT is not monitored and
ASan reports are written in FS, an additional check is added
at the end of the worker actions to identify orphan reports
that match PIDs that have not exited with expected exitcode.
If such type of ASan reports are identified an attempt is made
to parse the info the save the current mutated seed using info
from corrupted report file.

This commit also effectively mitigates garbage ASan logs
left behind in fuzzing workspace if compiler-rt procs crashes
while processing identified errors at instrumented target.

Signed-off-by: Anestis Bechtsoudis <anestis@census-labs.com>
3 files changed
tree: 75afb6cc6a21654b300344280fa2aaf242842733
  1. android/
  2. docs/
  3. examples/
  4. interceptor/
  5. linux/
  6. mac/
  7. posix/
  8. third_party/
  9. tools/
  10. .gitignore
  11. arch.h
  12. CHANGELOG
  13. cmdline.c
  14. cmdline.h
  15. common.h
  16. CONTRIBUTING
  17. COPYING
  18. display.c
  19. display.h
  20. files.c
  21. files.h
  22. fuzz.c
  23. fuzz.h
  24. honggfuzz.c
  25. log.c
  26. log.h
  27. Makefile
  28. mangle.c
  29. mangle.h
  30. README.md
  31. report.c
  32. report.h
  33. util.c
  34. util.h
README.md

honggfuzz

Description

Code

Requirements

  • Linux - BFD library (libbfd-dev) and LibUnwind (libunwind-dev/libunwind8-dev)
  • FreeBSD - gmake
  • Android - Android SDK/NDK

Other

This is NOT an official Google product.