cyruscyliu
commented
4 weeks ago Could you please format your patch to allow ViDeZZo to fuzz recent QEMU?
Closed Chan9Yan9 closed 3 weeks ago
cyruscyliu
commented
4 weeks ago Could you please format your patch to allow ViDeZZo to fuzz recent QEMU?
Chan9Yan9
commented
4 weeks ago I presented my patch in another issue issue 14, but I don't think the problem in this issue was introduced by my patch. I used the original videzzo script and set the QEMU branch being tested to stable-9.1 (a branch that supports the --enable-sanitizers option), and during testing, the sanitizer failed to allocate issue still occurred.
cyruscyliu
commented
4 weeks ago Thank you for your patch. However, I couldn't reproduce this issue in the Docker container. Could you please give me more concrete steps?
Chan9Yan9
commented
4 weeks ago Well, my host OS is Ubuntu22.04LTS, and my docker version is Docker version 24.0.7, build 24.0.7-0ubuntu2~22.04.1, I build videzzo-llvm-project myself, and use this script to run docker:
sudo docker run --rm \
-v $PWD/videzzo-llvm-project:/root/llvm-project \
-e PATH=$PATH:/root/llvm-project/build-custom/bin \
-v $PWD/videzzo:/root/videzzo \
-v /usr/src:/usr/src \
-v /dev:/dev \
-v /lib/modules:/lib/modules \
--privileged \
-it videzzo:latest /bin/bashI found the environment in docker missed the tomli package, so I installed it first
pip install tomliThen I enter the videzzo folder and run make qemu,
the making procedure seems to be normal before make cluster fuzz, when executing the
0004-zip-qemu-targets.sh sancommand, I met the issue, it showed that
make[2]: Leaving directory '/root/videzzo/videzzo_qemu'
bash -x 0004-zip-qemu-targets.sh san
+ CONTROL=san
+ DEST_DIR=/root/videzzo/videzzo_qemu/out-san
+ mkdir /root/videzzo/videzzo_qemu/out-san
+ pushd qemu/out-san
~/videzzo/videzzo_qemu/qemu/out-san ~/videzzo/videzzo_qemu
+ cp -r ../pc-bios /root/videzzo/videzzo_qemu/out-san/pc-bios
+ archs=(i386 x86_64 arm aarch64)
+ for arch in ${archs[@]}
++ ./qemu-videzzo-i386
++ awk '$1 ~ /\*/ {print $2}'
==8915==ERROR: AddressSanitizer failed to allocate 0x0 (0) bytes of SetAlternateSignalStack (error code: 22)
==8915==Process memory map follows:
0x00007fff7000-0x00008fff7000
......
==8915==End of process memory map.
==8915==AddressSanitizer CHECK failed: /home/kiki/videtest/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_common.cpp:54 "((0 && "unable to mmap")) != (0)" (0x0, 0x0)
<empty stack>
+ targets=
++ echo ''
++ head -n -1
+ for arch in ${archs[@]}
++ ./qemu-videzzo-x86_64
++ awk '$1 ~ /\*/ {print $2}'
==8921==ERROR: AddressSanitizer failed to allocate 0x0 (0) bytes of SetAlternateSignalStack (error code: 22)
==8921==Process memory map follows:When I run the compiled QEMU file(qemu-videzzo-i386, qemu-videzzo-x86-64) directly, the same error occurs. I guess the problem lies in the compilation process, but I currently do not know the root cause.
cyruscyliu
commented
3 weeks ago Thank you for your details. But I still couldn't reproduce it with my toolchain.
Did you try different QEMU versions? say 8.0, 9.0? Possibly, QEMU has introduced something that has side effects.
blabla-my
commented
3 weeks ago I also encountered this problem.
After debugging and searching, I found it is because videzzo-llvm-project is not compatible well with ubuntu 22.04, which is the base image of ViDeZZo container. I need to modifiy videzzo-llvm-project to mitgate the problem.
Here is the detailed root cause and solution: https://github.com/cyruscyliu/videzzo-llvm-project/pull/1
cyruscyliu
commented
3 weeks ago Amazing job. @Chan9Yan9 could you please test it?
cyruscyliu
commented
3 weeks ago Thank you @blabla-my !
Chan9Yan9
commented
3 weeks ago It's cool, it seems my issue has been resolved !
Hello, during the process of reproducing ViDeZZo, I found that after compiling QEMU, when the Makefile executes
make clusterfuzz, there is an AddressSanitizer issue where it cannot allocate space. I encountered this problem in both Docker and local deployments of ViDeZZo. Part of the specific error message is as follows：