jdbirdwell / afl

american fuzzy lop for network fuzzing (unofficial) -- official afl site is http://lcamtuf.coredump.cx/afl/
194 stars 40 forks source link

TLS transition from R_X86_64_TLSGD to R_X86_64_GOTTPOFF #5

Open dvolvox opened 7 years ago

dvolvox commented 7 years ago

Hi,

I'm trying to compile a Kafka-lib (librdkafka - the Apache Kafka C/C++ client library) with Afl-gcc (network) and the following messages appears:

./src/librdkafka.a(rdkafka.o): TLS transition from R_X86_64_TLSGD to R_X86_64_GOTTPOFF against `rd_kafka_last_error_code' at 0x2737 in section `.text' failed
../src/librdkafka.a: error adding symbols: Bad value
collect2: error: ld returned 1 exit status
make[1]: *** [rdkafka_example] Error 1
make[1]: Leaving directory `/pe/lib-pe/librdkafka/examples'
make: *** [examples] Error 2

Have you ever experience this issue?

Thank you.

jdbirdwell commented 7 years ago

Nope. But when you say you are compiling Kafka-lib with AF-gcc (network), what do you mean? Using my network version of Afl, you should compile two separate executables - and you will need some type of driver program (main.c) for Kafka-lib. Afl and the target only interact across the network.

Good luck, Doug Birdwell

On Fri, Aug 25, 2017 at 1:19 PM, Duarte Monteiro notifications@github.com wrote:

Hi,

I'm trying to compile a Kafka-lib (librdkafka - the Apache Kafka C/C++ client library) with Afl-gcc (network) and the following messages appears:

./src/librdkafka.a(rdkafka.o): TLS transition from R_X86_64_TLSGD to R_X86_64_GOTTPOFF against rd_kafka_last_error_code' at 0x2737 in section.text' failed ../src/librdkafka.a: error adding symbols: Bad value collect2: error: ld returned 1 exit status make[1]: [rdkafka_example] Error 1 make[1]: Leaving directory `/pe/lib-pe/librdkafka/examples' make: [examples] Error 2

Have you ever experience this issue?

Thank you.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/jdbirdwell/afl/issues/5, or mute the thread https://github.com/notifications/unsubscribe-auth/AOaIvcqJySWbvVcPwb0V2MgpV7_6sOQCks5sbwI7gaJpZM4PC8Sf .

RoelVdP commented 6 years ago

Same when compiling Percona Server (using afl-gcc and afl-g++) for me;

[+] Instrumented 228 locations (64-bit, non-hardened mode, ratio 100%).
Linking CXX executable tokudb_dump
afl-cc 2.52b by <lcamtuf@google.com>
/usr/bin/ld: ../../../innobase/libinnobase.a(srv0srv.cc.o): TLS transition from R_X86_64_TLSGD to R_X86_64_GOTTPOFF against `srv_current_thread_priority' at 0x21583 in section `.text' failed
../../../innobase/libinnobase.a: error adding symbols: Bad value
RoelVdP commented 6 years ago

Any help appreciated. I got to 56% but then this one happened.

RoelVdP commented 6 years ago

Another person who ran into it, also with AFL; https://groups.google.com/forum/#!topic/afl-users/CUYyEh4FRGw

RoelVdP commented 6 years ago

TLDR summary; updating binutils (and ar) to latest versions helps nothing here.

I read this report; https://gcc.gnu.org/bugzilla/show_bug.cgi?id=39508

Which got me to try the latest binutils, compiled, like so;

cd ~
mkdir binutils
cd binutils/
wget http://ftp.gnu.org/gnu/binutils/binutils-2.29.1.tar.xz
tar -xf binutils-2.29.1.tar.xz 
cd binutils-2.29.1
./configure 
make 
sudo make install
ld --version  # GNU ld (GNU Binutils) 2.29.1

But then I got this error instead (during compilation);

ar: error while loading shared libraries: libfl.so.2: cannot open shared object file: No such file or directory

Confirmed on command line;

-bash-4.2$ ar --version
ar: error while loading shared libraries: libfl.so.2: cannot open shared object file: No such file or directory

And apparently with reason;

-bash-4.2$ ldd /usr/local/bin/ar 
    linux-vdso.so.1 =>  (0x00007fff335fe000)
    libfl.so.2 => **not found**
    libdl.so.2 => /lib64/libdl.so.2 (0x00007f0193a17000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f0193654000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f0193c28000)

So I did;

wget https://github.com/westes/flex/releases/download/v2.6.4/flex-2.6.4.tar.gz
tar -xf flex-2.6.4.tar.gz
sudo cp ./flex-2.6.4/src/.libs/libfl.so.2 /lib64/
ar --version  # GNU ar (GNU Binutils) 2.29.1

In other words, binutils 2.29.1 is now installed and working fine.

Then recompiled Percona Server, but the result was the same.

RoelVdP commented 6 years ago

I did a temporary workaround by disabling all code related to the variable/symbol(?) in question (srv_current_thread_priority in my case - ref how it is shown in the error by looking at comment above). It then compiled fully. Still, this needs a better reason/explanation and eventual fix (somewhere). The GCC bug above had some interesting information in the "Jason Vas Dias 2009-03-22 22:32:05 UTC" comment about how to maybe see this??

Miserlou commented 5 years ago

I'm getting this in two different places in my project. The first I was able to get around with a bit of brute force, the second I am not. Any suggestions are welcome.

Miserlou commented 5 years ago

One is happening at compile time, the other is happening at link time:

Linking CXX executable salmon
afl-cc 2.52b by <lcamtuf@google.com>
../external/install/lib/libstaden-read.a(libstaden_read_la-open_trace_file.o): In function `find_file_url':
/salmon-0.9.1/external/staden-io_lib/io_lib/open_trace_file.c:490: warning: the use of `tempnam' is dangerous, better use `mkstemp'
/usr/bin/ld: libsalmon_core.a(VersionChecker.cpp.o): TLS transition from R_X86_64_TLSGD to R_X86_64_GOTTPOFF against `_ZN5boost4asio6detail15keyword_tss_ptrINS1_10call_stackINS1_15task_io_serviceENS1_27task_io_service_thread_infoEE7contextEE6value_E' at 0x103 in section `.text._ZN5boost4asio6detail15task_io_service25post_immediate_completionEPNS1_25task_io_service_operationEb[_ZN5boost4asio6detail15task_io_service25post_immediate_completionEPNS1_25task_io_service_operationEb]' failed
/usr/bin/ld: final link failed: Nonrepresentable section on output
collect2: error: ld returned 1 exit status
make[2]: *** [src/salmon] Error 1
make[1]: *** [src/CMakeFiles/salmon.dir/all] Error 2
make: *** [all] Error 2

EDIT: I just got rid of all the networking code, since that's wasn't what I wanted to fuzz anyway. Works.

edenhill commented 5 years ago

Using afl-clang rather than afl-gcc solves the issue. E.g.: CC=afl-clang ./configure && make -j in librdkafka

Nancy823 commented 3 years ago

Hi, i also encountered the same issue and i using afl-clang or alf-clang++ could be solved this issue. However, i have need to use afl to support our server program to be instrumented. And our server module consists of many depended sub-modules with using gcc8.2. So if we need to use afl, that could be using gcc8.2 (gcc/g++) for wrapper afl. and we wrap afl-gcc/afl-g++ successfully. When we combined gcc8.2 with alf-g++ for our server, it occurs to the above issues. I really sincerely consult to the solution for our case . Looking forward to your reply.

The issue like as follows, /home/opt/compiler/gcc-8.2/bin/../lib/gcc/x86_64-pc-linux-gnu/8.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: bc_out/baidu/undb/meta/output/lib/libdalton-meta.a(baidu_undb_meta_dalton-meta_lib_undb_meta_client_service.cpp.o): TLS transition from R_X86_64_TLSGD to R_X86_64_GOTTPOFF against_ZN4bvar6detail10AgentGroupINS0_13AgentCombinerIjjNS0_5AddToIjEEE5AgentEE13_s_tls_blocksE' at 0xfb3f in section .text' failed /home/opt/compiler/gcc-8.2/bin/../lib/gcc/x86_64-pc-linux-gnu/8.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: final link failed: nonrepresentable section on output collect2: error: ld returned 1 exit status

aibarito commented 3 years ago

Hi, i also encountered the same issue and i using afl-clang or alf-clang++ could be solved this issue. However, i have need to use afl to support our server program to be instrumented. And our server module consists of many depended sub-modules with using gcc8.2. So if we need to use afl, that could be using gcc8.2 (gcc/g++) for wrapper afl. and we wrap afl-gcc/afl-g++ successfully. When we combined gcc8.2 with alf-g++ for our server, it occurs to the above issues. I really sincerely consult to the solution for our case . Looking forward to your reply.

The issue like as follows, /home/opt/compiler/gcc-8.2/bin/../lib/gcc/x86_64-pc-linux-gnu/8.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: bc_out/baidu/undb/meta/output/lib/libdalton-meta.a(baidu_undb_meta_dalton-meta_lib_undb_meta_client_service.cpp.o): TLS transition from R_X86_64_TLSGD to R_X86_64_GOTTPOFF against_ZN4bvar6detail10AgentGroupINS0_13AgentCombinerIjjNS0_5AddToIjEEE5AgentEE13_s_tls_blocksE' at 0xfb3f in section .text' failed /home/opt/compiler/gcc-8.2/bin/../lib/gcc/x86_64-pc-linux-gnu/8.2.0/../../../../x86_64-pc-linux-gnu/bin/ld: final link failed: nonrepresentable section on output collect2: error: ld returned 1 exit status

did you find a solution?