AFLplusplus / AFLplusplus/LibAFL

`ShMem` should probably require stored values to be `Sync`

Open
#2,809 5 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
2.6k
Forks
481
Avg merge
2d 30m
Merged PRs (30d)
16

Description

`ShMem` can be used to create data-races if you use it to store non-`Sync` types such as `Cell`. For example, the assertion at the end of the following program fails:
```rust
use std::cell::Cell;

use libafl_bolts::os::{fork, ForkResult};
use libafl_bolts::shmem::{ShMem, ShMemProvider as _};

fn do_stuff(shmem: &impl ShMem) {
let p = shmem.as_ptr_of::>().unwrap();
for i in 0..128 {
let val = unsafe { (*p).get() };
println!("val = {val}");
unsafe { (*p).set(val + 1) };
}
}

fn main() {
let mut shmem_provider = libafl_bolts::shmem::MmapShMemProvider::default();
let shmem = shmem_provider.new_on_shmem(Cell::new(0usize)).unwrap();
shmem_provider.pre_fork().unwrap();
match unsafe { fork() }.unwrap() {
ForkResult::Parent(handle) => {
shmem_provider.post_fork(false).unwrap();
do_stuff(&shmem);
handle.status();
}
ForkResult::Child => {
shmem_provider.post_fork(true).unwrap();
do_stuff(&shmem);
std::process::abort();
}
}
let p = shmem.as_ptr_of::>().unwrap();
assert_eq!(256, unsafe { (*p).get() });
}
```
Of course, you can *also* create data-races just by using `as_mut_ptr`... But fixing that would require a whole different design, whereas it would be pretty easy to add a `Sync` bound to `ShMemProvider::new_on_shmem`, `ShMem::as_ptr_of`, etc..

Contributor guide

Open the contributing guide

Research direction

Start by locating the ShMemProvider::new_on_shmem and ShMem::as_ptr_of entry points, then inspect the related as_mut_ptr APIs and the shared-memory example in the issue. Confirm which stored-value and pointer operations need Sync bounds, and consider existing tests around these APIs; done means non-Sync values such as Cell cannot be accepted through the affected safe interfaces.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.