LINUX: Deal gracefully with ASan nested crashes While fuzzing ASan instrumented targets in Android it has been noticed that sometimes ASan is crashing internally, while generating reports for detected error (nested crashes). Mostly null deref bugs or read addresses close to 0x0. In case ASan internal error does not raise a SIGSEGV the identified crash is lost since the AsanDie() procedure is never invoked from compiler-rt. If "abort_on_error" ASan flag is enabled (SIGABRT is monitored for target application) there is nothing that can be done if nested crash doesn't result to a SIGSEGV being raised. On the other hand if SIGABRT is not monitored and ASan reports are written in FS, an additional check is added at the end of the worker actions to identify orphan reports that match PIDs that have not exited with expected exitcode. If such type of ASan reports are identified an attempt is made to parse the info the save the current mutated seed using info from corrupted report file. This commit also effectively mitigates garbage ASan logs left behind in fuzzing workspace if compiler-rt procs crashes while processing identified errors at instrumented target. Signed-off-by: Anestis Bechtsoudis <anestis@census-labs.com>
Description
Code
Requirements
Other
This is NOT an official Google product.