[libFuzzer] Diff 7 - Improve Signal Handler interface.

[zturner]

looks good to me, but +rnk since he's the Level 99 exception handling warrior.

[rnk]

lgtm

lib/Fuzzer/FuzzerUtilWindows.cpp

132

Huh, I guess that works on Windows, but it just interacts with abort().

[kcc]

lib/Fuzzer/FuzzerUtil.h

44

do you need this level of indirection?

[mpividori]

lib/Fuzzer/FuzzerUtil.h

44

@kcc
+ This way we make explicit which callback function will be registered for a specific signal. In previous implementation, when calling functions like SetSigSegvHandler(), it's not clear which callback will be called for that given signal.
+ With these changes we decouple the implementation of FuzzerUtils from the rest of the Fuzzer's implementation. In fact, you can see I remove the includes: #include "FuzzerInternal.h" from the FuzzerUtil*.cpp implementations.
+ This changes simplify the implementation of Windows's exception handling.

[mpividori]

lib/Fuzzer/FuzzerUtil.h

44

Hi @kcc ,
Would you agree with these changes?

[kcc]

Dunno. As is the change increases the code size w/o solving any problem.

[rnk]

In D27238#614137, @kcc wrote:

Dunno. As is the change increases the code size w/o solving any problem.

The problem, as I see it, is that SetSigFooHandler pattern exposes the wrong cross-platform API. On Windows, we will install exactly one exception handler, switch on the exception code, and then decide whether to catch it based on the user's options.

Would you be OK with this direction if we had a struct of bools instead of a struct of callbacks?

[kcc]

One way here is to add these booleans to FuzzingOptions

[mpividori]

Hi, thanks for your comments. I think the 3 reasons I mentioned before justify this change. At least from my point of view:

1. This way we make explicit which callback function will be registered for a specific signal. In previous implementation, when calling functions like SetSigSegvHandler(), it's not clear which callback will be called for that given signal.
2. With these changes we decouple the implementation of FuzzerUtils from the rest of the Fuzzer's implementation. In fact, you can see I remove the includes: #include "FuzzerInternal.h" from the FuzzerUtil*.cpp implementations.
3. This changes simplify the implementation of Windows's exception handling.

+ I created a new struct SignalHandlerOptions to expose an independent interface for the signal handling, independent from the fuzzer implementation. Another option is to pass the Flags struct from Fuzzer's implementation. Then we can analyse the flags: flags.handle_segv, falgs.handle_ill, etc. (With the disadvantage that we are not decoupling the implementation of FuzzerUtils from the rest of the Fuzzer's implementation (1 and 2), and we are passing far more information that needed...).

+ Another option is to expose this interface:

SetSigSegvHandler(void (*cb)(void));
SetSigIll(void (*cb)(void));
.....

And then we register the callbacks like:

SetSigSegvHandler(Fuzzer::StaticCrashCallback);

This way we achieve the mentioned points 1) and 2), but not 3)

If you think the reasons I mentioned above are not very important, I can remove this diff. :)

Thanks

[kcc]

Your patch does make sense, but OTOH, indirection and encapsulation are a very powerful tool -- don't overuse them.
I still suggest that you add bool flags to FuzzerOptions and use them in FuzzerUtilWindows.cpp

lib/Fuzzer/FuzzerUtilPosix.cpp

58

Don't use lambda in such cases because you will see the lambda in the error messages and that will make the messages longer.

[mpividori]

Done. (Note that we are achieving 3), but not 1) and 2) ).
Thanks.

[kcc]

non-windows code LGTM

lib/Fuzzer/FuzzerUtilWindows.cpp

30–32

Why do you need a copy of the flags?

[mpividori]

lib/Fuzzer/FuzzerUtilWindows.cpp

30–32

@kcc,
We can't save a reference to Options, because we don't know when it will be destroyed. The ExceptionHandler() function must access to Handler option the entire life of the program.

[kcc]

lib/Fuzzer/FuzzerUtilWindows.cpp

30–32

you can rely on this FuzzingOptions object to be live throughout the process.

[mpividori]

lib/Fuzzer/FuzzerUtilWindows.cpp

30–32

@kcc I wanted to avoid that kind of assumptions. But if you prefer I can do that.....

[kcc]

lib/Fuzzer/FuzzerUtilWindows.cpp

30–32

the options is a global scope object. It's not an assumption, it's a contract, all of the rest of the code rely on it.

[mpividori]

lib/Fuzzer/FuzzerUtilWindows.cpp

30–32

@kcc , it is not strictly global, it is defined inside FuzzerDriver(). It will work fine now because we don't do anything after returning from FuzzerDriver(). In the future, if we change the code and do something else after executing FuzzerDriver() which generates an exception, we are in troubles. We must remember this assumption ....
Thanks,

[mpividori]

lib/Fuzzer/FuzzerUtilWindows.cpp

30–32

@zturner What is your opinion on this?

[mpividori]

@zturner Thanks. I include that changes in this new diff.

[mpividori]

@kcc Would you agree with this final diff? Can I push this commit? Thanks.

[kcc]

LGTM

lib/Fuzzer/FuzzerDriver.cpp

int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
   auto *MD = new MutationDispatcher(Rand, Options);
   auto *Corpus = new InputCorpus(Options.OutputCorpus);
   auto *F = new Fuzzer(Callback, *Corpus, *MD, Options);
 
   for (auto &U: Dictionary)
     if (U.size() <= Word::GetMaxSize())
       MD->AddWordToManualDictionary(Word(U.data(), U.size()));
 
-  StartRssThread(F, Flags.rss_limit_mb);
+  SignalHandlerOptions Opts;
+  if (Flags.timeout > 0) {
+    Opts.timeout = Flags.timeout / 2 + 1;
+    Opts.sigalrm_cb = Fuzzer::StaticAlarmCallback;
+  }
+  Opts.sigsegv_cb = Fuzzer::StaticCrashSignalCallback;
+  Opts.sigbus_cb = Fuzzer::StaticCrashSignalCallback;
+  Opts.sigabrt_cb = Fuzzer::StaticCrashSignalCallback;
+  Opts.sigill_cb = Fuzzer::StaticCrashSignalCallback;
+  Opts.sigfpe_cb = Fuzzer::StaticCrashSignalCallback;
+  Opts.sigint_cb = Fuzzer::StaticInterruptCallback;
+  Opts.sigterm_cb = Fuzzer::StaticInterruptCallback;
+  SetSignalHandler(Opts);
 
-  // Timer
-  if (Flags.timeout > 0)
-    SetTimer(Flags.timeout / 2 + 1);
-  if (Flags.handle_segv) SetSigSegvHandler();
-  if (Flags.handle_bus) SetSigBusHandler();
-  if (Flags.handle_abrt) SetSigAbrtHandler();
-  if (Flags.handle_ill) SetSigIllHandler();
-  if (Flags.handle_fpe) SetSigFpeHandler();
-  if (Flags.handle_int) SetSigIntHandler();
-  if (Flags.handle_term) SetSigTermHandler();
+  StartRssThread(F, Flags.rss_limit_mb);
 
   if (Flags.minimize_crash_internal_step)
     return MinimizeCrashInputInternalStep(F, Corpus);
 
   if (DoPlainRun) {
     Options.SaveArtifacts = false;
     int Runs = std::max(1, Flags.runs);
     Printf("%s: Running %zd inputs %d time(s) each.\n", ProgName->c_str(),

lib/Fuzzer/FuzzerUtil.h

 
 void PrintPC(const char *SymbolizedFMT, const char *FallbackFMT, uintptr_t PC);
 
 std::string DescribePC(const char *SymbolizedFMT, uintptr_t PC);
 
 int NumberOfCpuCores();
 
 // Platform specific functions.
-void SetTimer(int Seconds);
+struct SignalHandlerOptions {
+  typedef void (*HandlerT)();
+  int timeout = 0;
+  HandlerT sigalrm_cb = nullptr;
+  HandlerT sigsegv_cb = nullptr;
+  HandlerT sigbus_cb = nullptr;
+  HandlerT sigabrt_cb = nullptr;
+  HandlerT sigill_cb = nullptr;
+  HandlerT sigfpe_cb = nullptr;
+  HandlerT sigint_cb = nullptr;
+  HandlerT sigterm_cb = nullptr;
+};
 
-void SetSigSegvHandler();
-void SetSigBusHandler();
-void SetSigAbrtHandler();
-void SetSigIllHandler();
-void SetSigFpeHandler();
-void SetSigIntHandler();
-void SetSigTermHandler();
+void SetSignalHandler(const SignalHandlerOptions& Opt);
 
 void SleepSeconds(int Seconds);
 
 int GetPid();
 
 size_t GetPeakRSSMb();
 
 bool ExecuteCommandAndReadOutput(const std::string &Command, std::string *Out);

lib/Fuzzer/FuzzerUtilPosix.cpp

 //===- FuzzerUtilPosix.cpp - Misc utils for Posix. ------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 // Misc utils implementation using Posix API.
 //===----------------------------------------------------------------------===//
 
 #include "FuzzerDefs.h"
 #if LIBFUZZER_POSIX
-#include "FuzzerInternal.h"
+#include "FuzzerUtil.h"
 #include "FuzzerIO.h"
 #include <cassert>
 #include <chrono>
 #include <cstring>
 #include <errno.h>
 #include <iomanip>
 #include <signal.h>
 #include <sstream>
 #include <stdio.h>
 #include <sys/resource.h>
 #include <sys/syscall.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <thread>
 #include <unistd.h>
 
 namespace fuzzer {
 
-static void AlarmHandler(int, siginfo_t *, void *) {
-  Fuzzer::StaticAlarmCallback();
-}
-
-static void CrashHandler(int, siginfo_t *, void *) {
-  Fuzzer::StaticCrashSignalCallback();
-}
-
-static void InterruptHandler(int, siginfo_t *, void *) {
-  Fuzzer::StaticInterruptCallback();
-}
+static SignalHandlerOptions HandlerOpt;
 
 static void SetSigaction(int signum,
                          void (*callback)(int, siginfo_t *, void *)) {
   struct sigaction sigact;
   memset(&sigact, 0, sizeof(sigact));
   sigact.sa_sigaction = callback;
   if (sigaction(signum, &sigact, 0)) {
     Printf("libFuzzer: sigaction failed with %d\n", errno);
     exit(1);
   }
 }
 
-void SetTimer(int Seconds) {
-  struct itimerval T {{Seconds, 0}, {Seconds, 0}};
+void SetSignalHandler(const SignalHandlerOptions& Opt) {
+  HandlerOpt = Opt;
+
+  if (Opt.timeout > 0 && Opt.sigalrm_cb) {
+    struct itimerval T {{Opt.timeout, 0}, {Opt.timeout, 0}};
     if (setitimer(ITIMER_REAL, &T, nullptr)) {
       Printf("libFuzzer: setitimer failed with %d\n", errno);
       exit(1);
     }
-  SetSigaction(SIGALRM, AlarmHandler);
+    SetSigaction(SIGALRM, [](int,siginfo_t*,void*) {HandlerOpt.sigalrm_cb();});
+  }
+  if (Opt.sigint_cb)
+    SetSigaction(SIGINT, [](int,siginfo_t*,void*) {HandlerOpt.sigint_cb();});
+  if (Opt.sigterm_cb)
+    SetSigaction(SIGTERM, [](int,siginfo_t*,void*) {HandlerOpt.sigterm_cb();});
+  if (Opt.sigsegv_cb)
+    SetSigaction(SIGSEGV, [](int,siginfo_t*,void*) {HandlerOpt.sigsegv_cb();});
+  if (Opt.sigbus_cb)
+    SetSigaction(SIGBUS, [](int,siginfo_t*,void*) {HandlerOpt.sigbus_cb();});
+  if (Opt.sigabrt_cb)
+    SetSigaction(SIGABRT, [](int,siginfo_t*,void*) {HandlerOpt.sigabrt_cb();});
+  if (Opt.sigill_cb)
+    SetSigaction(SIGILL, [](int,siginfo_t*,void*) {HandlerOpt.sigill_cb();});
+  if (Opt.sigfpe_cb)
+    SetSigaction(SIGFPE, [](int,siginfo_t*,void*) {HandlerOpt.sigfpe_cb();});
 }
-
-void SetSigSegvHandler() { SetSigaction(SIGSEGV, CrashHandler); }
-void SetSigBusHandler() { SetSigaction(SIGBUS, CrashHandler); }
-void SetSigAbrtHandler() { SetSigaction(SIGABRT, CrashHandler); }
-void SetSigIllHandler() { SetSigaction(SIGILL, CrashHandler); }
-void SetSigFpeHandler() { SetSigaction(SIGFPE, CrashHandler); }
-void SetSigIntHandler() { SetSigaction(SIGINT, InterruptHandler); }
-void SetSigTermHandler() { SetSigaction(SIGTERM, InterruptHandler); }
 
 void SleepSeconds(int Seconds) {
   sleep(Seconds);  // Use C API to avoid coverage from instrumented libc++.
 }
 
 int GetPid() { return getpid(); }
 
 size_t GetPeakRSSMb() {

lib/Fuzzer/FuzzerUtilWindows.cpp

 //===- FuzzerUtilWindows.cpp - Misc utils for Windows. --------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 // Misc utils implementation for Windows.
 //===----------------------------------------------------------------------===//
 
 #include "FuzzerDefs.h"
 #if LIBFUZZER_WINDOWS
-#include "FuzzerInternal.h"
+#include "FuzzerUtil.h"
 #include "FuzzerIO.h"
 #include <cassert>
 #include <chrono>
 #include <cstring>
 #include <errno.h>
 #include <iomanip>
 #include <signal.h>
 #include <sstream>
 #include <stdio.h>
 #include <sys/types.h>
 #include <windows.h>
 #include <Psapi.h>
 
 namespace fuzzer {
 
-LONG WINAPI SEGVHandler(PEXCEPTION_POINTERS ExceptionInfo) {
+static SignalHandlerOptions HandlerOpt;
+
+LONG CALLBACK ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo) {
   switch (ExceptionInfo->ExceptionRecord->ExceptionCode) {
     case EXCEPTION_ACCESS_VIOLATION:
     case EXCEPTION_ARRAY_BOUNDS_EXCEEDED:
     case EXCEPTION_STACK_OVERFLOW:
-      Fuzzer::StaticCrashSignalCallback();
+      if (HandlerOpt.sigsegv_cb)
+        HandlerOpt.sigsegv_cb();
       break;
-  }
-  return EXCEPTION_CONTINUE_SEARCH;
-}
-
-LONG WINAPI BUSHandler(PEXCEPTION_POINTERS ExceptionInfo) {
-  switch (ExceptionInfo->ExceptionRecord->ExceptionCode) {
     case EXCEPTION_DATATYPE_MISALIGNMENT:
     case EXCEPTION_IN_PAGE_ERROR:
-      Fuzzer::StaticCrashSignalCallback();
+      if (HandlerOpt.sigbus_cb)
+        HandlerOpt.sigbus_cb();
       break;
-  }
-  return EXCEPTION_CONTINUE_SEARCH;
-}
-
-LONG WINAPI ILLHandler(PEXCEPTION_POINTERS ExceptionInfo) {
-  switch (ExceptionInfo->ExceptionRecord->ExceptionCode) {
     case EXCEPTION_ILLEGAL_INSTRUCTION:
     case EXCEPTION_PRIV_INSTRUCTION:
-      Fuzzer::StaticCrashSignalCallback();
+      if (HandlerOpt.sigill_cb)
+        HandlerOpt.sigill_cb();
       break;
-  }
-  return EXCEPTION_CONTINUE_SEARCH;
-}
-
-LONG WINAPI FPEHandler(PEXCEPTION_POINTERS ExceptionInfo) {
-  switch (ExceptionInfo->ExceptionRecord->ExceptionCode) {
     case EXCEPTION_FLT_DENORMAL_OPERAND:
     case EXCEPTION_FLT_DIVIDE_BY_ZERO:
     case EXCEPTION_FLT_INEXACT_RESULT:
     case EXCEPTION_FLT_INVALID_OPERATION:
     case EXCEPTION_FLT_OVERFLOW:
     case EXCEPTION_FLT_STACK_CHECK:
     case EXCEPTION_FLT_UNDERFLOW:
     case EXCEPTION_INT_DIVIDE_BY_ZERO:
     case EXCEPTION_INT_OVERFLOW:
-      Fuzzer::StaticCrashSignalCallback();
+      if (HandlerOpt.sigfpe_cb)
+        HandlerOpt.sigfpe_cb();
       break;
   }
   return EXCEPTION_CONTINUE_SEARCH;
 }
 
-BOOL WINAPI INTHandler(DWORD dwCtrlType) {
+BOOL WINAPI CtrlHandler(DWORD dwCtrlType) {
   switch (dwCtrlType) {
     case CTRL_C_EVENT:
-      Fuzzer::StaticInterruptCallback();
+      if (HandlerOpt.sigint_cb)
+        HandlerOpt.sigint_cb();
       return TRUE;
-    default:
-      return FALSE;
-  }
-}
-
-BOOL WINAPI TERMHandler(DWORD dwCtrlType) {
-  switch (dwCtrlType) {
     case CTRL_BREAK_EVENT:
-      Fuzzer::StaticInterruptCallback();
+      if (HandlerOpt.sigterm_cb)
+        HandlerOpt.sigterm_cb();
       return TRUE;
-    default:
-      return FALSE;
   }
+  return FALSE;
 }
 
 void CALLBACK AlarmHandler(PVOID, BOOLEAN) {
-  Fuzzer::StaticAlarmCallback();
+  HandlerOpt.sigalrm_cb();
 }
 
 class TimerQ {
   HANDLE TimerQueue;
  public:
   TimerQ() : TimerQueue(NULL) {};
   ~TimerQ() {
     if (TimerQueue)
if (!CreateTimerQueueTimer(&Timer, TimerQueue, AlarmHandler, NULL,
       Printf("libFuzzer: CreateTimerQueueTimer failed.\n");
       exit(1);
     }
   };
 };
 
 static TimerQ Timer;
 
-void SetTimer(int Seconds) {
-  Timer.SetTimer(Seconds);
-  return;
-}
+void SetSignalHandler(const SignalHandlerOptions& Opt) {
+  HandlerOpt = Opt;
 
-void SetSigSegvHandler() {
-  if (!AddVectoredExceptionHandler(1, SEGVHandler)) {
-    Printf("libFuzzer: AddVectoredExceptionHandler failed.\n");
-    exit(1);
-  }
-}
-
-void SetSigBusHandler() {
-  if (!AddVectoredExceptionHandler(1, BUSHandler)) {
-    Printf("libFuzzer: AddVectoredExceptionHandler failed.\n");
-    exit(1);
-  }
-}
-
-static void CrashHandler(int) {
-  Fuzzer::StaticCrashSignalCallback();
-}
-
-void SetSigAbrtHandler() { signal(SIGABRT, CrashHandler); }
-
-void SetSigIllHandler() {
-  if (!AddVectoredExceptionHandler(1, ILLHandler)) {
-    Printf("libFuzzer: AddVectoredExceptionHandler failed.\n");
-    exit(1);
-  }
-}
-
-void SetSigFpeHandler() {
-  if (!AddVectoredExceptionHandler(1, FPEHandler)) {
-    Printf("libFuzzer: AddVectoredExceptionHandler failed.\n");
-    exit(1);
-  }
-}
+  if (Opt.timeout > 0 && Opt.sigalrm_cb)
+    Timer.SetTimer(Opt.timeout);
 
-void SetSigIntHandler() {
-  if (!SetConsoleCtrlHandler(INTHandler, TRUE)) {
+  if (Opt.sigint_cb || Opt.sigterm_cb)
+    if (!SetConsoleCtrlHandler(CtrlHandler, TRUE)) {
       DWORD LastError = GetLastError();
       Printf("libFuzzer: SetConsoleCtrlHandler failed (Error code: %lu).\n",
         LastError);
       exit(1);
     }
+
+  if (Opt.sigsegv_cb || Opt.sigbus_cb || Opt.sigill_cb || Opt.sigfpe_cb)
+    if (!AddVectoredExceptionHandler(1, ExceptionHandler)) {
+      Printf("libFuzzer: AddVectoredExceptionHandler failed.\n");
+      exit(1);
     }
 
-void SetSigTermHandler() {
-  if (!SetConsoleCtrlHandler(TERMHandler, TRUE)) {
-    DWORD LastError = GetLastError();
-    Printf("libFuzzer: SetConsoleCtrlHandler failed (Error code: %lu).\n",
-      LastError);
+  if (Opt.sigabrt_cb)
+    if (SIG_ERR == signal(SIGABRT, [](int){HandlerOpt.sigabrt_cb();})) {
+      Printf("libFuzzer: signal failed with %d\n", errno);
       exit(1);
     }
 }
 
 void SleepSeconds(int Seconds) {
   Sleep(Seconds * 1000);
 }
 
 int GetPid() { return GetCurrentProcessId(); }