AFLplusplus / AFLplusplus/LibAFL

`ShMem` should probably require stored values to be `Sync`

Offen
#2,809 5 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
bug
Vorherrschende Sprache
Rust
Sterne
2.6k
Forks
481
Ø Merge
2 T. 30 Min.
Gemergte PRs (30 T.)
16

Beschreibung

`ShMem` can be used to create data-races if you use it to store non-`Sync` types such as `Cell`. For example, the assertion at the end of the following program fails:
```rust
use std::cell::Cell;

use libafl_bolts::os::{fork, ForkResult};
use libafl_bolts::shmem::{ShMem, ShMemProvider as _};

fn do_stuff(shmem: &impl ShMem) {
let p = shmem.as_ptr_of::>().unwrap();
for i in 0..128 {
let val = unsafe { (*p).get() };
println!("val = {val}");
unsafe { (*p).set(val + 1) };
}
}

fn main() {
let mut shmem_provider = libafl_bolts::shmem::MmapShMemProvider::default();
let shmem = shmem_provider.new_on_shmem(Cell::new(0usize)).unwrap();
shmem_provider.pre_fork().unwrap();
match unsafe { fork() }.unwrap() {
ForkResult::Parent(handle) => {
shmem_provider.post_fork(false).unwrap();
do_stuff(&shmem);
handle.status();
}
ForkResult::Child => {
shmem_provider.post_fork(true).unwrap();
do_stuff(&shmem);
std::process::abort();
}
}
let p = shmem.as_ptr_of::>().unwrap();
assert_eq!(256, unsafe { (*p).get() });
}
```
Of course, you can *also* create data-races just by using `as_mut_ptr`... But fixing that would require a whole different design, whereas it would be pretty easy to add a `Sync` bound to `ShMemProvider::new_on_shmem`, `ShMem::as_ptr_of`, etc..

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start by locating the ShMemProvider::new_on_shmem and ShMem::as_ptr_of entry points, then inspect the related as_mut_ptr APIs and the shared-memory example in the issue. Confirm which stored-value and pointer operations need Sync bounds, and consider existing tests around these APIs; done means non-Sync values such as Cell cannot be accepted through the affected safe interfaces.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
rust
Bereich
operating-systems
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Veraltet
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
42/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.