Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ForkServerBuilder might reset config, causing hangs in persistent mode fuzzing #2539

Closed
bernhl opened this issue Sep 23, 2024 · 1 comment
Closed
Labels
bug Something isn't working

Comments

@bernhl
Copy link
Contributor

bernhl commented Sep 23, 2024

Describe the bug
When using ForkServerBuilder.shmem_provider(), this resets some of the fields already configured. E.g., the kill signal is reset to its default value: https://github.com/AFLplusplus/LibAFL/blob/main/libafl/src/executors/forkserver.rs#L1326
When the child processes encounters a timeout, the child is killed with the default value (sigterm). This might be insufficient, an causes a hang in the following situation:

  1. child executes a long-running input
  2. fuzzer detects a timeout, about to send sigterm (sigkill was configured, but reset by shmem_provider to sigterm)
  3. child issues the sigstop persistent mode signal
  4. fuzzer requests new child from forkserver, tells forkserver that the child needs to be reaped bc it was killed
  5. forkserver waitpids for child
  6. because the child hasn't been terminated properly, the forkserver waitpids indefinitely
  7. because the forkserver is not delivering a new child pid, the fuzzer waits indefinitely
@bernhl bernhl added the bug Something isn't working label Sep 23, 2024
@domenukk
Copy link
Member

Nice find. Most forkserver executors have to use the Unix Shmem provider that's probably why nobody noticed so far.
I tried to fix it in #2540

domenukk added a commit that referenced this issue Sep 23, 2024
* Fix ForkserverExecutorBuilder::shmem_provider (#2539)

* fmt
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants