google / google/oss-fuzz

[ruby] FATAL: forkserver is already up, but an instrumented dlopen() library loaded afterwards.

Open
#11,622 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 3h
Merged PRs (30d)
61

Description

Recently Ruby project started failing at build check stage: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66036

You can reproduce it with the following:

```console
$ python3 infra/helper.py check_build --sanitizer address --engine afl --architecture x86_64 ruby
```

And I pasted detailed error diagnostics below. The build failure started on Jan 21. I don't completely understand the AFL mechanism, but from Ruby side aspect, Ruby tries to load libraries at runtime via `dlopen` based on input scripts, so we cannot know all dlopen'ed libraries before interpreting given scripts.

```console
$ docker run --privileged --shm-size=2g --platform linux/amd64 -i -e FUZZING_ENGINE=afl -e SANITIZER=address -e ARCHITECTURE=x86_64 -e FUZZING_LANGUAGE=c -e HELPER=True -v /home/katei/ghq/github.com/google/oss-fuzz/build/out/ruby:/out -t gcr.io/oss-fuzz-base/base-runner /out/fuzz_ruby_gems
============================== INFO ================================
This binary is built for afl++.
To run the target function on individual input(s) execute:
/out/fuzz_ruby_gems INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute:
afl-fuzz [afl-flags] -- /out/fuzz_ruby_gems [-N]
afl-fuzz will run N iterations before re-spawning the process (default: INT_MAX)
You can also use AFL_FUZZER_LOOPCOUNT to set N
For stdin input processing, pass '-' as single command line option.
For file input processing, pass '@@' as single command line option.
To use with afl-cmin or afl-cmin.bash pass '-' as single command line option
===================================================================
exepath = /out
RUBYLIB = /out/lib/ruby/site_ruby/3.4.0+0:/out/lib/ruby/site_ruby/3.4.0+0/x86_64-linux:/out/lib/ruby/site_ruby:/out/lib/ruby/vendor_ruby/3.4.0+0:/out/lib/ruby/vendor_ruby/3.4.0+0/x86_64-linux:/out/lib/ruby/vendor_ruby:/out/lib/ruby/3.4.0+0:/out/lib/ruby/3.4.0+0/x86_64-linux
[-] FATAL: forkserver is already up, but an instrumented dlopen() library loaded afterwards. You must AFL_PRELOAD such libraries to be able to fuzz them or LD_PRELOAD to run outside of afl-fuzz.
To ignore this set AFL_IGNORE_PROBLEMS=1 but this will lead to ambiguous coverage data.
In addition, you can set AFL_IGNORE_PROBLEMS_COVERAGE=1 to ignore the additional coverage instead (use with caution!).
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1==ERROR: AddressSanitizer: ABRT on unknown address 0x000000000001 (pc 0x7f46df08400b bp 0x7fff4a6c6af0 sp 0x7fff4a6c6860 T0)
SCARINESS: 10 (signal)
#0 0x7f46df08400b in raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b) (BuildId: eebe5d5f4b608b8a53ec446b63981bba373ca0ca)
#1 0x7f46df063858 in abort (/lib/x86_64-linux-gnu/libc.so.6+0x22858) (BuildId: eebe5d5f4b608b8a53ec446b63981bba373ca0ca)
#2 0x4e0a5d in __sanitizer_cov_trace_pc_guard_init llvm_mode/llvm_mode/instrumentation/afl-compiler-rt.o.c
#3 0x7f46dcfa7ee6 in sancov.module_ctor_trace_pc_guard date_core.c
#4 0x7f46e0414b99 (/lib64/ld-linux-x86-64.so.2+0x11b99) (BuildId: 7ae2aaae1a0e5b262df913ee0885582d2e327982)
#5 0x7f46e0414ca0 (/lib64/ld-linux-x86-64.so.2+0x11ca0) (BuildId: 7ae2aaae1a0e5b262df913ee0885582d2e327982)
#6 0x7f46df1a1ba4 in _dl_catch_exception (/lib/x86_64-linux-gnu/libc.so.6+0x160ba4) (BuildId: eebe5d5f4b608b8a53ec446b63981bba373ca0ca)
#7 0x7f46e041943c (/lib64/ld-linux-x86-64.so.2+0x1643c) (BuildId: 7ae2aaae1a0e5b262df913ee0885582d2e327982)
#8 0x7f46df1a1b47 in _dl_catch_exception (/lib/x86_64-linux-gnu/libc.so.6+0x160b47) (BuildId: eebe5d5f4b608b8a53ec446b63981bba373ca0ca)
#9 0x7f46e0418609 (/lib64/ld-linux-x86-64.so.2+0x15609) (BuildId: 7ae2aaae1a0e5b262df913ee0885582d2e327982)
#10 0x7f46df25134b (/lib/x86_64-linux-gnu/libdl.so.2+0x134b) (BuildId: c05b0d2519f47ff40d60e3ce1a4993107d03fded)
#11 0x7f46df1a1b47 in _dl_catch_exception (/lib/x86_64-linux-gnu/libc.so.6+0x160b47) (BuildId: eebe5d5f4b608b8a53ec446b63981bba373ca0ca)
#12 0x7f46df1a1c12 in _dl_catch_error (/lib/x86_64-linux-gnu/libc.so.6+0x160c12) (BuildId: eebe5d5f4b608b8a53ec446b63981bba373ca0ca)
#13 0x7f46df251b58 (/lib/x86_64-linux-gnu/libdl.so.2+0x1b58) (BuildId: c05b0d2519f47ff40d60e3ce1a4993107d03fded)
#14 0x7f46df2513d9 in dlopen (/lib/x86_64-linux-gnu/libdl.so.2+0x13d9) (BuildId: c05b0d2519f47ff40d60e3ce1a4993107d03fded)
#15 0x471511 in dlopen /src/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:6383:15
#16 0x7f46df597587 in dln_open /src/ruby/dln.c:379:14
#17 0x7f46df5971a1 in dln_load /src/ruby/dln.c:495:20
#18 0x7f46dfe5fc22 in rb_vm_call_cfunc /src/ruby/vm.c:2862:11
#19 0x7f46df9a53fe in require_internal /src/ruby/load.c:1290:30
#20 0x7f46df9a1d76 in rb_require_string_internal /src/ruby/load.c:1383:18
#21 0x7f46df9a1d76 in rb_require_string /src/ruby/load.c:1376:12
#22 0x7f46df9a1d76 in rb_f_require /src/ruby/load.c:1018:12
#23 0x7f46dfe89f5c in vm_call_cfunc_with_frame_ /src/ruby/./vm_insnhelper.c:3492:11
#24 0x7f46dfe6ba86 in vm_call_method_each_type /src/ruby/./vm_insnhelper.c:4419:16
#25 0x7f46dfe6afff in vm_call_method /src/ruby/./vm_insnhelper.c
#26 0x7f46dfe1fc90 in vm_sendish /src/ruby/./vm_insnhelper.c:5603:15
#27 0x7f46dfe1fc90 in vm_exec_core /src/ruby/insns.def:867:11
#28 0x7f46dfe085b3 in rb_vm_exec /src/ruby/vm.c:2550:22
#29 0x7f46df9ab28a in load_iseq_eval /src/ruby/load.c:778:5
#30 0x7f46df9a5464 in require_internal /src/ruby/load.c:1284:21
#31 0x7f46df9a5f2d in rb_require_string_internal /src/ruby/load.c:1383:18
#32 0x7f46df9a5f2d in rb_require /src/ruby/load.c:1401:12
#33 0x7f46df84a126 in rb_protect /src/ruby/eval.c:977:9
#34 0x4dd6a0 in require /src/fuzz/fuzz_ruby_gems.c:68:7
#35 0x4dd6a0 in init_TargetFunction /src/fuzz/fuzz_ruby_gems.c:178:25
#36 0x4ddbcb in init_date_parse /src/fuzz/fuzz_ruby_gems.c:203:3
#37 0x4ddbcb in LLVMFuzzerTestOneInput /src/fuzz/fuzz_ruby_gems.c:401:7
#38 0x4dec65 in LLVMFuzzerRunDriver /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:395:3
#39 0x4de92d in main /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:311:10
#40 0x7f46df065082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: eebe5d5f4b608b8a53ec446b63981bba373ca0ca)
#41 0x41d51d in _start (/out/fuzz_ruby_gems+0x41d51d)

DEDUP_TOKEN: raise--abort--__sanitizer_cov_trace_pc_guard_init
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: ABRT (/lib/x86_64-linux-gnu/libc.so.6+0x4300b) (BuildId: eebe5d5f4b608b8a53ec446b63981bba373ca0ca) in raise
==1==ABORTING

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.