DynamoRIO / DynamoRIO/dynamorio

CRASH in tool.drcacheoff.raw-zlib test: bug in zlib_istream.h

Open
#5,635 2 comments 0 reactions 0 assignees View on GitHub
Bug-ToolCrash Component-DrMemtrace
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

The tool.drcacheoff.raw-zlib test crashed on Jenkins but I don't think this
is limited to AArch64:
```
70/84 Test #220: code_api|tool.drcacheoff.raw-zlib ...............................***Failed 0.47 sec
Running cmd |/var/lib/jenkins/workspace/DynamoRIO-AArch64-Precommit/build/build_release-external-64/bin64/drrun;-s;90;-quiet;-killpg;-stderr_mask;0xC;-dumpcore_mask;0;-code_api;-t;drcachesim;-offline;-subdir_prefix;tool.drcacheoff.raw-zlib;-raw_compress;zlib;--;/var/lib/jenkins/workspace/DynamoRIO-AArch64-Precommit/build/build_release-external-64/suite/tests/bin/simple_app|
Running postcmd |/var/lib/jenkins/workspace/DynamoRIO-AArch64-Precommit/build/build_release-external-64/clients/bin64/drcachesim;-indir;/var/lib/jenkins/workspace/DynamoRIO-AArch64-Precommit/build/build_release-external-64/suite/tests/tool.drcacheoff.raw-zlib.simple_app.3622551.1757.dir|
CMake Error at /var/lib/jenkins/workspace/DynamoRIO-AArch64-Precommit/suite/tests/runmulti.cmake:108 (message):
*** postcmd failed (Segmentation fault): ***
```

On the same machine I managed to reproduce but only on the 2nd try.
Once I had a raw file that reproduces, it is a deterministic crash in raw2trace.

```
523692 [drmemtrace]: Thread 3631869 timestamp 0x002f461fc314fe80
<...>
561733 [drmemtrace]: Appending 5 instrs in bb 0xfffd8833c5f0 in mod 7 +0x95f0 = /usr/lib/aarch64-linux-gnu/ld-2.31.so
561734 [drmemtrace]: Caching last block summary 0xfffd8006d460 for 0xfffd8833c5f0
561735 0x0000ffff99a9c5f0 ldr (%x23)[4byte] -> %w1
561736 [drmemtrace]: Using last block summary 0xfffd8006d460 for 0xfffd8833c5f0
561737 [drmemtrace]: Appending delayed branch pc=0xffff99a9c5ec for thread 0
561738 [drmemtrace]: [get_next_entry]: type=0 val=ffff99403d60
561739 [drmemtrace]: Unreading last entry
561740 [drmemtrace]: [get_next_entry]: type=0 val=ffff99403d60
561741 [drmemtrace]: Appended memref type 0 size 4 to 0xffff99403d60
561742 xx/tool.drcacheoff.raw-zlib.simple_app.3631869.4821.dir/raw/uncompressed.raw

561733 [drmemtrace]: Appending 5 instrs in bb 0xfffd953f55f0 in mod 7 +0x95f0 = /usr/lib/aarch64-linux-gnu/ld-2.31.so
561734 [drmemtrace]: Caching last block summary 0xfffd8c06d460 for 0xfffd953f55f0
561735 0x0000ffff99a9c5f0 ldr (%x23)[4byte] -> %w1
561736 [drmemtrace]: Using last block summary 0xfffd8c06d460 for 0xfffd953f55f0
561737 [drmemtrace]: Appending delayed branch pc=0xffff99a9c5ec for thread 0
561738 [drmemtrace]: [get_next_entry]: type=0 val=ffff99403d60
561739 [drmemtrace]: Unreading last entry
561740 [drmemtrace]: [get_next_entry]: type=0 val=ffff99403d60
561741 [drmemtrace]: Appended memref type 0 size 4 to 0xffff99403d60
561742 [drmemtrace]: [get_next_entry]: type=1 val=2022000e00009604
561743 [drmemtrace]: Unreading last entry
561744 0x0000ffff99a9c5f4 orr %wzr %w1 lsl $0x00 -> %w0
561745 [drmemtrace]: Using last block summary 0xfffd8c06d460 for 0xfffd953f55f0
561746 [drmemtrace]: [get_next_entry]: type=1 val=2022000e00009604
561747 [drmemtrace]: Unreading last entry
561748 0x0000ffff99a9c5f8 eor %x0 %x28 lsl $0x00 -> %x0
561749 [drmemtrace]: Using last block summary 0xfffd8c06d460 for 0xfffd953f55f0
561750 [drmemtrace]: [get_next_entry]: type=1 val=2022000e00009604
561751 [drmemtrace]: Unreading last entry
561752 0x0000ffff99a9c5fc subs %xzr %x0 lsr $0x01 -> %xzr
561753 [drmemtrace]: Using last block summary 0xfffd8c06d460 for 0xfffd953f55f0
561754 [drmemtrace]: [get_next_entry]: type=1 val=2022000e00009604
561755 [drmemtrace]: Unreading last entry
561756 0x0000ffff99a9c600 b.ne $0x0000ffff99a9c5e8
561757 [drmemtrace]: Using last block summary 0xfffd8c06d460 for 0xfffd953f55f0
561758 [drmemtrace]: [get_next_entry]: type=1 val=2022000e00009604
561759 [drmemtrace]: Unreading last entry
561760 [drmemtrace]: [get_next_entry]: type=1 val=2022000e00009604
561761 [drmemtrace]: Appending 17 instrs in bb 0xfffd953f5604 in mod 7 +0x9604 = /usr/lib/aarch64-linux-gnu/ld-2.31.so
```

Contributor guide

Open the contributing guide

Research direction

Start with the tool.drcacheoff.raw-zlib test and the reported raw2trace crash, then inspect zlib_istream.h and the suite test invocation. Reproduce with the cited AArch64 raw file and compare compressed versus manually uncompressed input. Done means the compressed path no longer crashes and the test passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
testing, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.