DynamoRIO / DynamoRIO/dynamorio
CRASH: Visual C address sanitizer conflict with DynamoRIO
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
Context: Win 11 Pro x64 22H2 10.0.22621.1848 , Visual Studio 2022 17.7.4, DynamoRIO 10.0.19635
Command line: `\bin64\drrun.exe -- \se_fuzzer.exe`
se_fuzzer is x64 app. It was compiled with `/fsanitize=address` flag. Next to se_fuzzer.exe there is clang_rt.asan_dynamic-x86_64.dll (part of VC).
drrun.exe and se_fuzzer.exe exit with status: 0xc0000005
Break before crash (handled (?) exception inside clang_rt_asan_dynamic_x86_64):
```
1:004> g;r;kb
(5ff4.1c50): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
rax=0000043a93ceb0da rbx=0000126cf53585d8 rcx=0000024d9ea6b0bb
rdx=000001ecf5280000 rsi=0000043a93ceb0bb rdi=0000126cf53586d0
rip=00007ffaf1ce9100 rsp=0000009dbfafed00 rbp=0000000000000000
r8=000001ecf5280000 r9=0000043a93ceb0da r10=0000000000000000
r11=00007fffffffffff r12=0000000000000000 r13=0000000000000000
r14=0000126cf5341080 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
clang_rt_asan_dynamic_x86_64!_asan_region_is_poisoned+0x90:
00007ffa`f1ce9100 420fb60401 movzx eax,byte ptr [rcx+r8] ds:0000043a`93ceb0bb=??
# RetAddr : Args to Child : Call Site
00 00007ffa`f1cd1ca7 : 0000126c`f5341080 00000000`000000f8 00000000`00000000 000001ec`811a02e8 : clang_rt_asan_dynamic_x86_64!_asan_region_is_poisoned+0x90
01 00000000`71032951 : 0000126c`f5341080 00000000`00000000 0000126c`f5313fb0 0000126c`f5341080 : clang_rt_asan_dynamic_x86_64!_asan_wrap_memset+0xf7
02 00000000`71005d12 : 00000000`711af4b8 00000000`00000003 00000000`00000002 00000000`71184402 : dynamorio!monitor_thread_init+0x31 [D:\a\dynamorio\dynamorio\core\monitor.c @ 319]
03 00000000`71006209 : 00000000`711af4b8 00000000`00000000 00000000`00000000 00000000`711af4b8 : dynamorio!dynamo_thread_init+0x5a2 [D:\a\dynamorio\dynamorio\core\dynamo.c @ 2390]
04 00000000`710065a5 : 0000009d`bfaff750 00000000`00000000 00000000`00000000 00000000`00000000 : dynamorio!dynamorio_app_init_part_two_finalize+0x219 [D:\a\dynamorio\dynamorio\core\dynamo.c @ 675]
05 00000000`710a49ab : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dynamorio!dynamorio_earliest_init_takeover_C+0x35 [D:\a\dynamorio\dynamorio\core\dynamo.c @ 3067]
06 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : dynamorio!dynamorio_earliest_init_takeover+0x83 [D:\a\dynamorio\dynamorio\build_release-64\core\CMakeFiles\dynamorio.dir\arch\x86\x86.asm.obj.s @ 4931]
```
Next breakpoint = second chance:
```
1:004> g;r;kb
(5ff4.1c50): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WARNING: Stack pointer is outside the normal stack bounds. Stack unwinding can be inaccurate.
rax=0000000000000000 rbx=0000126cf5341080 rcx=0000126cf5341080
rdx=0000000000000000 rsi=0000000000000000 rdi=00000000ffffffff
rip=00000000710d862c rsp=0000126cf53546a0 rbp=0000000000000001
r8=0000000000000000 r9=0000000000000000 r10=00000000ffffffff
r11=0000000000000001 r12=0000126cf5354d60 r13=0000009dbfafed00
r14=0000126cf5341001 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
dynamorio!get_teb_field+0x19 [inlined in dynamorio!swap_peb_pointer_ex+0x8c]:
00000000`710d862c 4c8b5808 mov r11,qword ptr [rax+8] ds:00000000`00000008=????????????????
# RetAddr : Args to Child : Call Site
00 (Inline Function) : --------`-------- --------`-------- --------`-------- --------`-------- : dynamorio!get_teb_field+0x19 [D:\a\dynamorio\dynamorio\core\win32\loader.c @ 544]
01 00000000`71020240 : 00000000`00000000 0000126c`f5341080 0000126c`f5354810 0000126c`00000000 : dynamorio!swap_peb_pointer_ex+0x8c [D:\a\dynamorio\dynamorio\core\win32\loader.c @ 659]
02 00000000`710bcc20 : 0000126c`f5341080 0000009d`bfafe580 0000009d`bfafe580 0000126c`f5341080 : dynamorio!transfer_to_dispatch+0x60 [D:\a\dynamorio\dynamorio\core\dispatch.c @ 2356]
03 00000000`711a6141 : 0000043a`93ceb0bb 0000126c`f53586d0 00000000`00000000 00000000`00000000 : dynamorio!intercept_exception+0x7a0 [D:\a\dynamorio\dynamorio\core\win32\callback.c @ 5980]
04 0000043a`93ceb0bb : 0000126c`f53586d0 00000000`00000000 00000000`00000000 00000000`00000000 : dynamorio!interception_code_array+0x1141
05 0000126c`f53586d0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`711a61e1 : 0x0000043a`93ceb0bb
06 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`711a61e1 0000126c`f53586d0 : 0x0000126c`f53586d0
1:004> .exr -1
ExceptionAddress: 00000000710d862c (dynamorio!get_teb_field+0x0000000000000019)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000008
Attempt to read from address 0000000000000008
@rbx dcontext = 0x0000126c`f5341080
...
[+0x328] teb_base : 0x0 [Type: unsigned char *]
```
disasm of inlined `get_teb_field+0x19`:
`00000000710d862c 4c8b5808 mov r11,qword ptr [rax+8] ds:0000000000000008=????????????????`
Note that rsp's are not equal in two sequential breaks.
Contributor guide
Research direction
Reproduce the crash with the Windows 11 command line and the `/fsanitize=address` build described in the report. Start with `core/monitor.c` line 319, then inspect the related initialization and exception paths in `core/dynamo.c`, `core/win32/loader.c` lines 544 and 659, `core/dispatch.c`, and `core/win32/callback.c`. Done means the instrumented `se_fuzzer.exe` no longer exits with the reported access violations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100