5de8c7f138
On Fuchsia, killing or exiting a process that has a thread listening to its own process's debugger exception channel can hang. Zircon may kill all the threads, send a synthetic exceptions to debugger, and wait for the debugger to have received them. This means the thread listening to the debug exception channel may be killed even as Zircon is waiting for that thread to drain the exception channel, and the process can become stuck in a half-dead state. This situation is "weird" as it only arises when a process is trying to debug itself. Unfortunately, this is exactly the scenario for libFuzzer on Fuchsia: FuzzerUtilFuchsia spawns a crash-handling thread that acts like a debugger in order to be able to rewrite the crashed threads stack and resume them into libFuzzer's usual POSIX signal handlers. In practice, approximately 25% of fuzzers appear to hang on exit, after generating output and artifacts. These processes hang around until the platform is torn done, which is typically a ClusterFuzz VM. Thus, real-world impact has been somewhat mitigated. The issue should still be resolved for local users, though. This change improves the behavior of exit() in libFuzzer by adding an atexit handler which closes an event shared with the crash handling thread. This signals to the crash handler that it should close the exception channel and be joined before the process actually exits. Reviewed By: charco Differential Revision: https://reviews.llvm.org/D109258 |
||
|---|---|---|
| .. | ||
| afl | ||
| dataflow | ||
| scripts | ||
| standalone | ||
| tests | ||
| CMakeLists.txt | ||
| FuzzerBuiltins.h | ||
| FuzzerBuiltinsMsvc.h | ||
| FuzzerCommand.h | ||
| FuzzerCorpus.h | ||
| FuzzerCrossOver.cpp | ||
| FuzzerDataFlowTrace.cpp | ||
| FuzzerDataFlowTrace.h | ||
| FuzzerDefs.h | ||
| FuzzerDictionary.h | ||
| FuzzerDriver.cpp | ||
| FuzzerExtFunctions.def | ||
| FuzzerExtFunctions.h | ||
| FuzzerExtFunctionsDlsym.cpp | ||
| FuzzerExtFunctionsWeak.cpp | ||
| FuzzerExtFunctionsWindows.cpp | ||
| FuzzerExtraCounters.cpp | ||
| FuzzerExtraCountersDarwin.cpp | ||
| FuzzerExtraCountersWindows.cpp | ||
| FuzzerFlags.def | ||
| FuzzerFork.cpp | ||
| FuzzerFork.h | ||
| FuzzerIO.cpp | ||
| FuzzerIO.h | ||
| FuzzerIOPosix.cpp | ||
| FuzzerIOWindows.cpp | ||
| FuzzerInterceptors.cpp | ||
| FuzzerInterface.h | ||
| FuzzerInternal.h | ||
| FuzzerLoop.cpp | ||
| FuzzerMain.cpp | ||
| FuzzerMerge.cpp | ||
| FuzzerMerge.h | ||
| FuzzerMutate.cpp | ||
| FuzzerMutate.h | ||
| FuzzerOptions.h | ||
| FuzzerPlatform.h | ||
| FuzzerRandom.h | ||
| FuzzerSHA1.cpp | ||
| FuzzerSHA1.h | ||
| FuzzerTracePC.cpp | ||
| FuzzerTracePC.h | ||
| FuzzerUtil.cpp | ||
| FuzzerUtil.h | ||
| FuzzerUtilDarwin.cpp | ||
| FuzzerUtilFuchsia.cpp | ||
| FuzzerUtilLinux.cpp | ||
| FuzzerUtilPosix.cpp | ||
| FuzzerUtilWindows.cpp | ||
| FuzzerValueBitMap.h | ||
| README.txt | ||
| build.sh | ||
README.txt
See http://llvm.org/docs/LibFuzzer.html