llvm / llvm/llvm-project

[libFuzzer] processes stop working using `-fork`

Open
#175,286 0 comments 0 reactions 0 assignees View on GitHub
compiler-rt:fuzzer
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Processes will stop working after while when running a fuzzer with `-fork`. The processes all still exists but they are not doing any work (i.e. no CPU usage). This deteriorates to the point where no process is doing any more work (in my case the last result was returned after 3275 seconds).

This does not appear to be related to any crashes (the detected amount is far less than the overall processes used) or timeouts (none detected and they are set to 5 seconds).

`ps axww`
```
66725 pts/1 S+ 0:00 sh -c -- ./oss-fuzz-client -only_ascii=1 -timeout=5 -ignore_crashes=1 -ignore_timeouts=1 -use_value_profile=1 -reload=0 -print_final_stats=1 -print_funcs=0 -max_total_time=186 -stop_file=/tmp/libFuzzerTemp.FuzzWithFork60004.dir/STOP -seed_inputs=@/tmp/libFuzzerTemp.FuzzWithFork60004.dir/186.seeds /tmp/libFuzzerTemp.FuzzWithFork60004.dir/C186 -features_dir=/tmp/libFuzzerTemp.FuzzWithFork60004.dir/F186 >/tmp/libFuzzerTemp.FuzzWithFork60004.dir/186.log 2>&1
66726 pts/1 Sl+ 0:54 ./oss-fuzz-client -only_ascii=1 -timeout=5 -ignore_crashes=1 -ignore_timeouts=1 -use_value_profile=1 -reload=0 -print_final_stats=1 -print_funcs=0 -max_total_time=186 -stop_file=/tmp/libFuzzerTemp.FuzzWithFork60004.dir/STOP -seed_inputs=@/tmp/libFuzzerTemp.FuzzWithFork60004.dir/186.seeds /tmp/libFuzzerTemp.FuzzWithFork60004.dir/C186 -features_dir=/tmp/libFuzzerTemp.FuzzWithFork60004.dir/F186
```

```
strace: Process 66725 attached
wait4(-1
```

```
strace: Process 66726 attached
futex(0x7f6e7e608ac0, FUTEX_WAIT_PRIVATE, 2, NULL
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the stall with libFuzzer's `-fork` command and inspect the waiting processes shown by `ps` and `strace`. Trace the `-fork` execution path and determine why worker processes stop making progress; done means the processes continue fuzzing and complete without becoming stuck.

Written by the indexing model from the issue text.

Assessment

Domain
testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.