Reserved ASAN ranges are slightly too small
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 10.7k
- Forks
- 662
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 2
Description
When we randomize mmaps during chaos mode, we try to avoid the ranges used by ASAN (e.g. https://github.com/rr-debugger/rr/blob/80981f6722fdf6d1761884de8a29c4e5c6d7abd1/src/RecordSession.cc#L2302). However, we don't take into account the AdditionalSize() that the sanitizers add to the reserved ranges in their headers (https://github.com/llvm/llvm-project/blob/e2040f5ba3c4f54599776e6f4118881c501bf1f8/compiler-rt/lib/sanitizer_common/sanitizer_allocator_primary64.h#L115).
Tyson has a trace where we randomize librrpreload.so to be at exactly the address we believe an ASAN range ends. However, because of the AdditionalSize(), the first two pages of librrpreload.so get wiped out by ASAN and we blow up. In Tyson's trace AdditionalSize() is 2 * PAGE_SIZE, but I don't know if it can be bigger on any other platform we care about.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the chaos-mode mmap randomization in src/RecordSession.cc around the referenced range calculation, then compare it with sanitizer_allocator_primary64.h's AdditionalSize(). Use Tyson's trace as the failure case if available. Done means randomized mappings no longer overlap the full ASAN-reserved ranges, including the sanitizer-added pages, on supported platforms.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, linux
- Domain
- devtools, operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100