[libFuzzer] don't use /dev/null for DiscardOuput in Fuchsia.

[charco]

Summary

This commit adds a specialized version of DiscardOutput for fuchsia,
removing an usage of /dev/null.

In fuchsia, accessing /dev/null is not supported, and there's nothing
similar to a file that discards everything that is written to it. The
way of doing something similar in fuchsia is by using fdio_null_create
and binding that to a file descriptor with fdio_bind_to_fd.

This change should fix one of the issues with the -close_fd_mask flag
in libfuzzer, in which closing stdout was not working due to
fopen("/dev/null", "w") returning NULL.

[charco]

Hi Reviewers!

I have two versions of this change:

This version adds an ifdef guard to specialize the code for fuchsia, and I have another set of changes that fork FuzzerIOPosix into FuzzerIOFuchsia and adds the specialized version there:

• https://reviews.llvm.org/D69082
• https://reviews.llvm.org/D69084

Please review whichever you think it the best approach. So far, the only thing that has been causing issues in FuzzerIOPosix for Fuchsia is /dev/null usage, I am not sure whether there will be other changes that would justify the fork of this file. There's some usage of the getDevNull function that we also need to address, but that could be handled in fuchsia specific code (checking if some path == getDevNull, or refactoring the code to not assume that there is a devnull-like file).

[kcc]

please avoid #ifdefs -- they are pure evil.
Can you move this function to FuzzerUtil*.cpp?
In this case it will have it's own implementation in FuzzerUtilFuchsia.cpp

It sucks in a different way, but less than using #ifdefs

[charco]

Move DiscardOutput to FuzzerUtil*.

As suggested by the reviewers, I'm moving the DiscardOutput function to
FuzzerUtil(Darwin|Linux|Windows|Fuchsia).cpp, so now each platform can have
its own specialized version.

[charco]

Ping :)

[hctim]

In D69593#1742832, @charco wrote:

Ping :)

Sorry, missed this in email churn.

compiler-rt/lib/fuzzer/FuzzerUtilLinux.cpp

39

Nit: remove extra newline

compiler-rt/lib/fuzzer/FuzzerUtilPosix.cpp

163 ↗

(On Diff #227935)

Nit: no need to remove, pollutes diff only

[charco]

Fix reviewer comments.

[charco]

Add missing header for _dup2 in windows.

compiler-rt/lib/fuzzer/FuzzerIO.h

 
 int CloseFile(int Fd);
 
 int DuplicateFile(int Fd);
 
 void RemoveFile(const std::string &Path);
 void RenameFile(const std::string &OldPath, const std::string &NewPath);
 
-void DiscardOutput(int Fd);
-
 intptr_t GetHandleFromFd(int fd);
 
 void MkDir(const std::string &Path);
 void RmDir(const std::string &Path);
 
 const std::string &getDevNull();
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_IO_H

compiler-rt/lib/fuzzer/FuzzerIOPosix.cpp

 void RemoveFile(const std::string &Path) {
   unlink(Path.c_str());
 }
 
 void RenameFile(const std::string &OldPath, const std::string &NewPath) {
   rename(OldPath.c_str(), NewPath.c_str());
 }
 
-void DiscardOutput(int Fd) {
-  FILE* Temp = fopen("/dev/null", "w");
-  if (!Temp)
-    return;
-  dup2(fileno(Temp), Fd);
-  fclose(Temp);
-}
-
 intptr_t GetHandleFromFd(int fd) {
   return static_cast<intptr_t>(fd);
 }
 
 std::string DirName(const std::string &FileName) {
   char *Tmp = new char[FileName.size() + 1];
   memcpy(Tmp, FileName.c_str(), FileName.size() + 1);
   std::string Res = dirname(Tmp);

compiler-rt/lib/fuzzer/FuzzerIOWindows.cpp

 void RemoveFile(const std::string &Path) {
   _unlink(Path.c_str());
 }
 
 void RenameFile(const std::string &OldPath, const std::string &NewPath) {
   rename(OldPath.c_str(), NewPath.c_str());
 }
 
-void DiscardOutput(int Fd) {
-  FILE* Temp = fopen("nul", "w");
-  if (!Temp)
-    return;
-  _dup2(_fileno(Temp), Fd);
-  fclose(Temp);
-}
-
 intptr_t GetHandleFromFd(int fd) {
   return _get_osfhandle(fd);
 }
 
 static bool IsSeparator(char C) {
   return C == '\\' || C == '/';
 }
 

compiler-rt/lib/fuzzer/FuzzerUtil.h

 inline std::pair<std::string, std::string> SplitBefore(std::string X,
                                                        std::string S) {
   auto Pos = S.find(X);
   if (Pos == std::string::npos)
     return std::make_pair(S, "");
   return std::make_pair(S.substr(0, Pos), S.substr(Pos));
 }
 
+void DiscardOutput(int Fd);
+
 std::string DisassembleCmd(const std::string &FileName);
 
 std::string SearchRegexCmd(const std::string &Regex);
 
 size_t SimpleFastHash(const uint8_t *Data, size_t Size);
 
 inline uint32_t Log(uint32_t X) { return 32 - Clz(X) - 1; }
 

compiler-rt/lib/fuzzer/FuzzerUtilDarwin.cpp

 #include "FuzzerCommand.h"
 #include "FuzzerIO.h"
 #include <mutex>
 #include <signal.h>
 #include <spawn.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/wait.h>
+#include <unistd.h>
 
 // There is no header for this on macOS so declare here
 extern "C" char **environ;
 
 namespace fuzzer {
 
 static std::mutex SignalMutex;
 // Global variables used to keep track of how signal handling should be
if (ActiveThreadCount == 0) {
       }
       if (FailedRestore)
         ProcessStatus = -1;
     }
   }
   return ProcessStatus;
 }
 
+void DiscardOutput(int Fd) {
+  FILE* Temp = fopen("/dev/null", "w");
+  if (!Temp)
+    return;
+  dup2(fileno(Temp), Fd);
+  fclose(Temp);
+}
+
 } // namespace fuzzer
 
 #endif // LIBFUZZER_APPLE

compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp

 
 #include "FuzzerInternal.h"
 #include "FuzzerUtil.h"
 #include <cassert>
 #include <cerrno>
 #include <cinttypes>
 #include <cstdint>
 #include <fcntl.h>
+#include <lib/fdio/fdio.h>
 #include <lib/fdio/spawn.h>
 #include <string>
 #include <sys/select.h>
 #include <thread>
 #include <unistd.h>
 #include <zircon/errors.h>
 #include <zircon/process.h>
 #include <zircon/sanitizer.h>
int ExecuteCommand(const Command &Cmd) {
   return Info.return_code;
 }
 
 const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
                          size_t PattLen) {
   return memmem(Data, DataLen, Patt, PattLen);
 }
 
+// In fuchsia, accessing /dev/null is not supported. There's nothing
+// similar to a file that discards everything that is written to it.
+// The way of doing something similar in fuchsia is by using
+// fdio_null_create and binding that to a file descriptor.
+void DiscardOutput(int Fd) {
+  fdio_t *fdio_null = fdio_null_create();
+  if (fdio_null == nullptr) return;
+  int nullfd = fdio_bind_to_fd(fdio_null, -1, 0);
+  if (nullfd < 0) return;
+  dup2(nullfd, Fd);
+}
+
 } // namespace fuzzer
 
 #endif // LIBFUZZER_FUCHSIA

compiler-rt/lib/fuzzer/FuzzerUtilLinux.cpp

 #include "FuzzerDefs.h"
 #if LIBFUZZER_LINUX || LIBFUZZER_NETBSD || LIBFUZZER_FREEBSD ||                \
     LIBFUZZER_OPENBSD
 #include "FuzzerCommand.h"
 
 #include <stdlib.h>
 #include <sys/types.h>
 #include <sys/wait.h>
+#include <unistd.h>
 
 
 namespace fuzzer {
 
 int ExecuteCommand(const Command &Cmd) {
   std::string CmdLine = Cmd.toString();
   int exit_code = system(CmdLine.c_str());
   if (WIFEXITED(exit_code))
     return WEXITSTATUS(exit_code);
   return exit_code;
 }
 
+void DiscardOutput(int Fd) {
+  FILE* Temp = fopen("/dev/null", "w");
+  if (!Temp)
+    return;
+  dup2(fileno(Temp), Fd);
+  fclose(Temp);
+}
+
 } // namespace fuzzer
 
 #endif

compiler-rt/lib/fuzzer/FuzzerUtilWindows.cpp

 #if LIBFUZZER_WINDOWS
 #include "FuzzerCommand.h"
 #include "FuzzerIO.h"
 #include "FuzzerInternal.h"
 #include <cassert>
 #include <chrono>
 #include <cstring>
 #include <errno.h>
+#include <io.h>
 #include <iomanip>
 #include <signal.h>
 #include <stdio.h>
 #include <sys/types.h>
 #include <windows.h>
 
 // This must be included after windows.h.
 #include <psapi.h>
std::string DisassembleCmd(const std::string &FileName) {
   Printf("libFuzzer: couldn't find tool to disassemble (dumpbin)\n");
   exit(1);
 }
 
 std::string SearchRegexCmd(const std::string &Regex) {
   return "findstr /r \"" + Regex + "\"";
 }
 
+void DiscardOutput(int Fd) {
+  FILE* Temp = fopen("nul", "w");
+  if (!Temp)
+    return;
+  _dup2(_fileno(Temp), Fd);
+  fclose(Temp);
+}
+
 } // namespace fuzzer
 
 #endif // LIBFUZZER_WINDOWS