Extract and expose FuzzerMonitor C interface.

[aarongreen]

Summary

This change surfaces the static Fuzzer callbacks used to handle errors, in anticipation of them being called by a platform-specific IPC library to create cross-process fuzzers.

It also adds a PID parameter to process-specific diagnostic functions used by those callbacks, e.g. PrintStackTrace. Currently, this parameter is always 0, which indicates the local process.

This is change 9 of (at least) 18 for cross-process fuzzing support.

[aarongreen]

Rebase

[morehouse]

Interface change LGTM.

For the PID stuff, what is the plan for process-specific reports? To send a signal to the specified process to get a stack trace/memory profile?

compiler-rt/lib/fuzzer/FuzzerInternal.h

86–90

Should we use pid_t?

104

Why do we pass a PID to a function that returns a PID?

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

235

304

PID is unused.

[aarongreen]

In D94517#2604034, @morehouse wrote:

Interface change LGTM.

For the PID stuff, what is the plan for process-specific reports? To send a signal to the specified process to get a stack trace/memory profile?

That seemed the simplest way forward, yes. I realize I'm punting a bit on the question of where exactly the stack trace and memory profile get printed as it's OS-specific. As an example, for Linux, I assume the remote process is started by the engine process and inherits its stdout/stderr. The PrintStack/PrintMemoryProfile calls are not performance sensitive and should be synchronous, so this would put the process details in the "right" place. I recognize cases where Printf isn't going to stdout, but to a fuzz-N.log might need more attention.

compiler-rt/lib/fuzzer/FuzzerInternal.h

86–90

I'd be happy to, but ::fuzzer::GetPid() returns unsigned long. I'm willing to slip a change under this one that changes that everywhere, although I expect some spots will need a little more massaging (since pid_t is signed).

Would you prefer this?

104

The idea here is if you pass 0, you get the current PID, and otherwise you get whatever you pass. That way the error callbacks can have a default PID=0 that is replaced when called from a remote process, but isn't if called from the current process.

But there's things I don't like about it on reflection: a) it's private and doesn't touch the object, so it doesn't need to be a method, and b) both its name and function clearly lead to confusion. Since it's only used 3 times, I'm replacing it with PID ? PID : GetPid() (where GetPid here is ::fuzzer::GetPid from FuzzerUtil.h).

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

304

This is true, but at the risk of violating YAGNI, I'd like to pass along the identifier from the remote process to match the other remotely-callable error callbacks, and in case the implementation of LeakCallback changes in the future. Having the remote PID in the remote interface seems prudent to me, but WDYT?

[morehouse]

In D94517#2612323, @aarongreen wrote:

That seemed the simplest way forward, yes. I realize I'm punting a bit on the question of where exactly the stack trace and memory profile get printed as it's OS-specific. As an example, for Linux, I assume the remote process is started by the engine process and inherits its stdout/stderr. The PrintStack/PrintMemoryProfile calls are not performance sensitive and should be synchronous, so this would put the process details in the "right" place. I recognize cases where Printf isn't going to stdout, but to a fuzz-N.log might need more attention.

Sorry if I'm misunderstanding the design. But how will we prevent stack trace skew from signals being delivered asynchronously?

i.e. We need a stack trace *now*, so we send a signal to that process. But by the time that process receives the signal, the IP is somewhere else, maybe a different function. So our stack trace is wrong.

compiler-rt/lib/fuzzer/FuzzerInternal.h

86–90

pid_t seems more appropriate to me, but this is a nit.

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

304

Sounds good.

[aarongreen]

In D94517#2612598, @morehouse wrote:

Sorry if I'm misunderstanding the design. But how will we prevent stack trace skew from signals being delivered asynchronously?

i.e. We need a stack trace *now*, so we send a signal to that process. But by the time that process receives the signal, the IP is somewhere else, maybe a different function. So our stack trace is wrong.

You're correct. I've addressed this in both the implementations I've done so far, but I haven't stipulated it in the interface and I probably need to. On both Linux and Fuchsia, if an error callback is invoked, the calling thread in the remote process takes over handling responses from the engine process. It then sits in a loop handling any requests that come in until the connection is reset, at which point it exits. In this way, the code never returns from the stack frame above the error callback, and the stack trace is correct (modulo missing the actual call to, e.g., fuzzer::Fuzzer::LeakCallback). I'll add that requirement to the comments in FuzzerMonitor.h; if an implementer fails to do so, it should be obvious when the llvm-lit tests fail.

[morehouse]

In D94517#2617110, @aarongreen wrote:

In D94517#2612598, @morehouse wrote:

Sorry if I'm misunderstanding the design. But how will we prevent stack trace skew from signals being delivered asynchronously?

i.e. We need a stack trace *now*, so we send a signal to that process. But by the time that process receives the signal, the IP is somewhere else, maybe a different function. So our stack trace is wrong.

You're correct. I've addressed this in both the implementations I've done so far, but I haven't stipulated it in the interface and I probably need to. On both Linux and Fuchsia, if an error callback is invoked, the calling thread in the remote process takes over handling responses from the engine process. It then sits in a loop handling any requests that come in until the connection is reset, at which point it exits. In this way, the code never returns from the stack frame above the error callback, and the stack trace is correct (modulo missing the actual call to, e.g., fuzzer::Fuzzer::LeakCallback). I'll add that requirement to the comments in FuzzerMonitor.h; if an implementer fails to do so, it should be obvious when the llvm-lit tests fail.

Please add the comments, and I'll review this again.

[aarongreen]

Multiprocess fuzzing will not be supported by the libFuzzer maintainers. Fuchsia has implemented a new approach with their Component Fuzzing Framework (RFC-117).

compiler-rt/lib/fuzzer/CMakeLists.txt

set(LIBFUZZER_HEADERS
   FuzzerExtFunctions.def
   FuzzerExtFunctions.h
   FuzzerFlags.def
   FuzzerFork.h
   FuzzerIO.h
   FuzzerInterface.h
   FuzzerInternal.h
   FuzzerMerge.h
+  FuzzerMonitor.h
   FuzzerMutate.h
   FuzzerOptions.h
   FuzzerRandom.h
   FuzzerSHA1.h
   FuzzerTracePC.h
   FuzzerUtil.h
   FuzzerValueBitMap.h)
 

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

 
 #include "FuzzerCommand.h"
 #include "FuzzerCorpus.h"
 #include "FuzzerFork.h"
 #include "FuzzerIO.h"
 #include "FuzzerInterface.h"
 #include "FuzzerInternal.h"
 #include "FuzzerMerge.h"
+#include "FuzzerMonitor.h"
 #include "FuzzerMutate.h"
 #include "FuzzerPlatform.h"
 #include "FuzzerRandom.h"
 #include "FuzzerTracePC.h"
 #include <algorithm>
 #include <atomic>
 #include <chrono>
 #include <cstdlib>
 #include <cstring>
+#include <fstream>
 #include <mutex>
 #include <string>
 #include <thread>
-#include <fstream>
 
 // This function should be present in the libFuzzer so that the client
 // binary can test for its existence.
 #if LIBFUZZER_MSVC
 extern "C" void __libfuzzer_is_present() {}
 #if defined(_M_IX86) || defined(__i386__)
 #pragma comment(linker, "/include:___libfuzzer_is_present")
 #else
static int RunInMultipleProcesses(const Vector<std::string> &Args,
   Pulse.detach();
   for (unsigned i = 0; i < NumWorkers; i++)
     V.push_back(std::thread(WorkerThread, std::ref(Cmd), &Counter, NumJobs, &HasErrors));
   for (auto &T : V)
     T.join();
   return HasErrors ? 1 : 0;
 }
 
-static void RssThread(Fuzzer *F, size_t RssLimitMb) {
+static void RssThread(size_t RssLimitMb) {
   while (true) {
     SleepSeconds(1);
     size_t Peak = GetPeakRSSMb();
     if (Peak > RssLimitMb)
-      F->RssLimitCallback();
+      FuzzerRssLimitCallback(0);
   }
 }
 
-static void StartRssThread(Fuzzer *F, size_t RssLimitMb) {
+static void StartRssThread(size_t RssLimitMb) {
   if (!RssLimitMb)
     return;
-  std::thread T(RssThread, F, RssLimitMb);
+  std::thread T(RssThread, RssLimitMb);
   T.detach();
 }
 
 int RunOneTest(Fuzzer *F, const char *InputFilePath, size_t MaxLen) {
   Unit U = FileToVector(InputFilePath);
   if (MaxLen && MaxLen < U.size())
     U.resize(MaxLen);
   F->ExecuteCallback(U.data(), U.size());
int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
 
   for (auto &U: Dictionary)
     if (U.size() <= Word::GetMaxSize())
       MD->AddWordToManualDictionary(Word(U.data(), U.size()));
 
       // Threads are only supported by Chrome. Don't use them with emscripten
       // for now.
 #if !LIBFUZZER_EMSCRIPTEN
-  StartRssThread(F, Flags.rss_limit_mb);
+  StartRssThread(Flags.rss_limit_mb);
 #endif // LIBFUZZER_EMSCRIPTEN
 
   Options.HandleAbrt = Flags.handle_abrt;
   Options.HandleAlrm = !Flags.minimize_crash;
   Options.HandleBus = Flags.handle_bus;
   Options.HandleFpe = Flags.handle_fpe;
   Options.HandleIll = Flags.handle_ill;
   Options.HandleInt = Flags.handle_int;
   Options.HandleSegv = Flags.handle_segv;
   Options.HandleTerm = Flags.handle_term;
   Options.HandleXfsz = Flags.handle_xfsz;
   Options.HandleUsr1 = Flags.handle_usr1;
   Options.HandleUsr2 = Flags.handle_usr2;
   Options.HandleWinExcept = Flags.handle_winexcept;
 
   SetSignalHandler(Options);
 
-  std::atexit(Fuzzer::StaticExitCallback);
+  std::atexit([]() { FuzzerExitCallback(0); });
 
   if (Flags.minimize_crash)
     return MinimizeCrashInput(Args, Options);
 
   if (Flags.minimize_crash_internal_step)
     return MinimizeCrashInputInternalStep(F, Corpus);
 
   if (Flags.cleanse_crash)

compiler-rt/lib/fuzzer/FuzzerInternal.h

public:
 
   size_t execPerSec() {
     size_t Seconds = secondsSinceProcessStartUp();
     return Seconds ? TotalNumberOfRuns / Seconds : 0;
   }
 
   size_t getTotalNumberOfRuns() { return TotalNumberOfRuns; }
 
-  static void StaticAlarmCallback();
-  static void StaticCrashSignalCallback();
-  static void StaticExitCallback();
-  static void StaticInterruptCallback();
-  static void StaticFileSizeExceedCallback();
-  static void StaticGracefulExitCallback();
 
   void ExecuteCallback(const uint8_t *Data, size_t Size);
   bool RunOne(const uint8_t *Data, size_t Size, bool MayDeleteFile = false,
               InputInfo *II = nullptr, bool ForceAddToCorpus = false,
               bool *FoundUniqFeatures = nullptr);
   void TPCUpdateObservedPCs();
 
   // Merge Corpora[1:] into Corpora[0].
   void Merge(const Vector<std::string> &Corpora);
   void CrashResistantMergeInternalStep(const std::string &ControlFilePath);
   MutationDispatcher &GetMD() { return MD; }
   void PrintFinalStats();
   void SetMaxInputLen(size_t MaxInputLen);
   void SetMaxMutationLen(size_t MaxMutationLen);
-  void RssLimitCallback();
 
   bool InFuzzingThread() const { return IsMyThread; }
   size_t GetCurrentUnitInFuzzingThead(const uint8_t **Data) const;
   void TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
                                bool DuringInitialCorpusExecution);
 
   void HandleMalloc(size_t Size);
   static void MaybeExitGracefully();
   std::string WriteToOutputCorpus(const Unit &U);
 
-private:
   void AlarmCallback();
-  void CrashCallback();
-  void ExitCallback();
-  void CrashOnOverwrittenData();
+  void CrashCallback(unsigned long PID);
+  void DeathCallback();
+  void ExitCallback(unsigned long PID);
+  void FileSizeExceedCallback();
+  void GracefulExitCallback();
   void InterruptCallback();
+  void LeakCallback(unsigned long PID);
+  void OutOfMemoryCallback(unsigned long PID, size_t LastMalloc);
+
+private:
+  void CrashOnOverwrittenData();
   void MutateAndTestOne();
   void PurgeAllocator();
   void ReportNewCoverage(InputInfo *II, const Unit &U);
   void PrintPulseAndReportSlowInput(const uint8_t *Data, size_t Size);
   void WriteUnitToFileWithPrefix(const Unit &U, const char *Prefix);
+
+  // For these, PID == 0 refers to the current process.
+  unsigned long GetPid(unsigned long PID = 0);
+  void PrintStackTrace(unsigned long PID = 0);
+  void PrintMemoryProfile(unsigned long PID = 0);
+
   void PrintStats(const char *Where, const char *End = "\n", size_t Units = 0,
                   size_t Features = 0);
   void PrintStatusForNewUnit(const Unit &U, const char *Text);
   void CheckExitOnSrcPosOrItem();
 
-  static void StaticDeathCallback();
   void DumpCurrentUnit(const char *Prefix);
-  void DeathCallback();
 
   void AllocateCurrentUnitData();
   uint8_t *CurrentUnitData = nullptr;
   std::atomic<size_t> CurrentUnitSize;
   uint8_t BaseSha1[kSHA1NumBytes];  // Checksum of the base unit.
 
   bool GracefulExitRequested = false;
 
   size_t TotalNumberOfRuns = 0;
+  bool ExecutingSeedCorpora = false;
   size_t NumberOfNewUnitsAdded = 0;
 
   size_t LastCorpusUpdateRun = 0;
 
   bool HasMoreMallocsThanFrees = false;
   size_t NumberOfLeakDetectionAttempts = 0;
 
   system_clock::time_point LastAllocatorPurgeAttemptTime = system_clock::now();

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

 //===- FuzzerLoop.cpp - Fuzzer's main loop --------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 // Fuzzer's main loop.
 //===----------------------------------------------------------------------===//
 
 #include "FuzzerCorpus.h"
 #include "FuzzerFork.h"
 #include "FuzzerIO.h"
 #include "FuzzerInternal.h"
+#include "FuzzerMonitor.h"
 #include "FuzzerMutate.h"
 #include "FuzzerPlatform.h"
 #include "FuzzerRandom.h"
 #include "FuzzerTracePC.h"
 #include <algorithm>
 #include <cstring>
 #include <memory>
 #include <mutex>
void Fuzzer::HandleMalloc(size_t Size) {
   PrintFinalStats();
   _Exit(Options.OOMExitCode); // Stop right now.
 }
 
 Fuzzer::Fuzzer(UserCallback CB, InputCorpus &Corpus, MutationDispatcher &MD,
                FuzzingOptions Options)
     : CB(CB), Corpus(Corpus), MD(MD), Options(Options) {
   if (EF->__sanitizer_set_death_callback)
-    EF->__sanitizer_set_death_callback(StaticDeathCallback);
+    EF->__sanitizer_set_death_callback(FuzzerDeathCallback);
   assert(!F);
   F = this;
   TPC.ResetMaps();
   IsMyThread = true;
   if (Options.DetectLeaks && EF->__sanitizer_install_malloc_and_free_hooks)
     EF->__sanitizer_install_malloc_and_free_hooks(MallocHook, FreeHook);
   TPC.SetUseCounters(Options.UseCounters);
   TPC.SetUseValueProfileMask(Options.UseValueProfile);
-
   if (Options.Verbosity)
     TPC.PrintModuleInfo();
   if (!Options.OutputCorpus.empty() && Options.ReloadIntervalSec)
     EpochOfLastReadOfOutputCorpus = GetEpoch(Options.OutputCorpus);
   MaxInputLen = MaxMutationLen = Options.MaxLen;
   TmpMaxMutationLen = 0;  // Will be set once we load the corpus.
   AllocateCurrentUnitData();
   CurrentUnitSize = 0;
   memset(BaseSha1, 0, sizeof(BaseSha1));
 }
 
 Fuzzer::~Fuzzer() {}
 
 void Fuzzer::AllocateCurrentUnitData() {
   if (CurrentUnitData || MaxInputLen == 0)
     return;
   CurrentUnitData = new uint8_t[MaxInputLen];
 }
 
-void Fuzzer::StaticDeathCallback() {
-  assert(F);
-  F->DeathCallback();
-}
-
 void Fuzzer::DumpCurrentUnit(const char *Prefix) {
   if (!CurrentUnitData)
     return; // Happens when running individual inputs.
   ScopedDisableMsanInterceptorChecks S;
   MD.PrintMutationSequence();
   Printf("; base unit: %s\n", Sha1ToString(BaseSha1).c_str());
   size_t UnitSize = CurrentUnitSize;
   if (UnitSize <= kMaxUnitSizeToPrint) {
     PrintHexArray(CurrentUnitData, UnitSize, "\n");
     PrintASCII(CurrentUnitData, UnitSize, "\n");
   }
   WriteUnitToFileWithPrefix({CurrentUnitData, CurrentUnitData + UnitSize},
                             Prefix);
 }
 
 NO_SANITIZE_MEMORY
 void Fuzzer::DeathCallback() {
   DumpCurrentUnit("crash-");
   PrintFinalStats();
 }
 
-void Fuzzer::StaticAlarmCallback() {
-  assert(F);
-  F->AlarmCallback();
-}
-
-void Fuzzer::StaticCrashSignalCallback() {
-  assert(F);
-  F->CrashCallback();
-}
-
-void Fuzzer::StaticExitCallback() {
-  assert(F);
-  F->ExitCallback();
-}
-
-void Fuzzer::StaticInterruptCallback() {
-  assert(F);
-  F->InterruptCallback();
-}
-
-void Fuzzer::StaticGracefulExitCallback() {
-  assert(F);
-  F->GracefulExitRequested = true;
+void Fuzzer::GracefulExitCallback() {
+  GracefulExitRequested = true;
   Printf("INFO: signal received, trying to exit gracefully\n");
 }
 
-void Fuzzer::StaticFileSizeExceedCallback() {
+void Fuzzer::FileSizeExceedCallback() {
   Printf("==%lu== ERROR: libFuzzer: file size exceeded\n", GetPid());
   exit(1);
 }
 
-void Fuzzer::CrashCallback() {
+void Fuzzer::CrashCallback(unsigned long PID) {
   if (EF->__sanitizer_acquire_crash_state &&
       !EF->__sanitizer_acquire_crash_state())
     return;
-  Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid());
-  PrintStackTrace();
+  Printf("==%lu== ERROR: libFuzzer: deadly signal\n", GetPid(PID));
+  PrintStackTrace(PID);
   Printf("NOTE: libFuzzer has rudimentary signal handlers.\n"
          "      Combine libFuzzer with AddressSanitizer or similar for better "
          "crash reports.\n");
   Printf("SUMMARY: libFuzzer: deadly signal\n");
   DumpCurrentUnit("crash-");
   PrintFinalStats();
   _Exit(Options.ErrorExitCode); // Stop right now.
 }
 
-void Fuzzer::ExitCallback() {
+void Fuzzer::ExitCallback(unsigned long PID) {
   if (!RunningUserCallback)
     return; // This exit did not come from the user callback
   if (EF->__sanitizer_acquire_crash_state &&
       !EF->__sanitizer_acquire_crash_state())
     return;
-  Printf("==%lu== ERROR: libFuzzer: fuzz target exited\n", GetPid());
-  PrintStackTrace();
+  Printf("==%lu== ERROR: libFuzzer: fuzz target exited\n", GetPid(PID));
+  PrintStackTrace(PID);
   Printf("SUMMARY: libFuzzer: fuzz target exited\n");
   DumpCurrentUnit("crash-");
   PrintFinalStats();
   _Exit(Options.ErrorExitCode);
 }
 
 void Fuzzer::MaybeExitGracefully() {
-  if (!F->GracefulExitRequested) return;
-  Printf("==%lu== INFO: libFuzzer: exiting as requested\n", GetPid());
+  if (!F->GracefulExitRequested)
+    return;
+  Printf("==%lu== INFO: libFuzzer: exiting as requested\n", fuzzer::GetPid());
   RmDirRecursive(TempPath("FuzzWithFork", ".dir"));
   F->PrintFinalStats();
   _Exit(0);
 }
 
 void Fuzzer::InterruptCallback() {
   Printf("==%lu== libFuzzer: run interrupted; exiting\n", GetPid());
   PrintFinalStats();
Printf("==%lu== ERROR: libFuzzer: timeout after %d seconds\n", GetPid(),
            Seconds);
     PrintStackTrace();
     Printf("SUMMARY: libFuzzer: timeout\n");
     PrintFinalStats();
     _Exit(Options.TimeoutExitCode); // Stop right now.
   }
 }
 
-void Fuzzer::RssLimitCallback() {
+void Fuzzer::OutOfMemoryCallback(unsigned long PID, size_t LastMalloc) {
   if (EF->__sanitizer_acquire_crash_state &&
       !EF->__sanitizer_acquire_crash_state())
     return;
-  Printf(
-      "==%lu== ERROR: libFuzzer: out-of-memory (used: %zdMb; limit: %zdMb)\n",
-      GetPid(), GetPeakRSSMb(), Options.RssLimitMb);
+  Printf("==%lu== ERROR: libFuzzer: out-of-memory ", GetPid(PID));
+  if (LastMalloc) {
+    Printf("(malloc(%zd))\n", LastMalloc);
+    Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
+    PrintStackTrace();
+  } else {
+    Printf("(used: %zdMb; limit: %zdMb)\n", GetPeakRSSMb(), Options.RssLimitMb);
     Printf("   To change the out-of-memory limit use -rss_limit_mb=<N>\n\n");
-  PrintMemoryProfile();
+    PrintMemoryProfile(PID);
+  }
   DumpCurrentUnit("oom-");
   Printf("SUMMARY: libFuzzer: out-of-memory\n");
   PrintFinalStats();
   _Exit(Options.OOMExitCode); // Stop right now.
 }
 
+void Fuzzer::LeakCallback(unsigned long PID) {
+  if (EF->__sanitizer_acquire_crash_state &&
+      !EF->__sanitizer_acquire_crash_state())
+    return;
+  if (ExecutingSeedCorpora)
+    Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
+  Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
+  DumpCurrentUnit("leak-");
+  PrintFinalStats();
+  _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
+}
+
+unsigned long Fuzzer::GetPid(unsigned long PID) { return fuzzer::GetPid(); }
+
+void Fuzzer::PrintStackTrace(unsigned long PID) { fuzzer::PrintStackTrace(); }
+
+void Fuzzer::PrintMemoryProfile(unsigned long PID) {
+  fuzzer::PrintMemoryProfile();
+}
+
 void Fuzzer::PrintStats(const char *Where, const char *End, size_t Units,
                         size_t Features) {
   size_t ExecPerSec = execPerSec();
   if (!Options.Verbosity)
     return;
   Printf("#%zd\t%s", TotalNumberOfRuns, Where);
   if (size_t N = TPC.GetTotalPCCoverage())
     Printf(" cov: %zd", N);
void Fuzzer::TryDetectingAMemoryLeak(const uint8_t *Data, size_t Size,
   if (!DuringInitialCorpusExecution &&
       TotalNumberOfRuns >= Options.MaxNumberOfRuns)
     return;
   if (!&(EF->__lsan_enable) || !&(EF->__lsan_disable) ||
       !(EF->__lsan_do_recoverable_leak_check))
     return; // No lsan.
   // Run the target once again, but with lsan disabled so that if there is
   // a real leak we do not report it twice.
+  ExecutingSeedCorpora = DuringInitialCorpusExecution;
   EF->__lsan_disable();
   ExecuteCallback(Data, Size);
   EF->__lsan_enable();
   if (!HasMoreMallocsThanFrees)
     return; // a leak is unlikely.
   if (NumberOfLeakDetectionAttempts++ > 1000) {
     Options.DetectLeaks = false;
     Printf("INFO: libFuzzer disabled leak detection after every mutation.\n"
            "      Most likely the target function accumulates allocated\n"
            "      memory in a global state w/o actually leaking it.\n"
            "      You may try running this binary with -trace_malloc=[12]"
            "      to get a trace of mallocs and frees.\n"
            "      If LeakSanitizer is enabled in this process it will still\n"
            "      run on the process shutdown.\n");
     return;
   }
   // Now perform the actual lsan pass. This is expensive and we must ensure
   // we don't call it too often.
   if (EF->__lsan_do_recoverable_leak_check()) { // Leak is found, report it.
-    if (DuringInitialCorpusExecution)
-      Printf("\nINFO: a leak has been found in the initial corpus.\n\n");
-    Printf("INFO: to ignore leaks on libFuzzer side use -detect_leaks=0.\n\n");
     CurrentUnitSize = Size;
-    DumpCurrentUnit("leak-");
-    PrintFinalStats();
-    _Exit(Options.ErrorExitCode); // not exit() to disable lsan further on.
+    LeakCallback(0);
   }
 }
 
 void Fuzzer::MutateAndTestOne() {
   MD.StartMutationSequence();
 
   auto &II = Corpus.ChooseUnitToMutate(MD.GetRand());
   if (Options.DoCrossOver) {

 extern "C" {
 
 ATTRIBUTE_INTERFACE size_t
 LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
   assert(fuzzer::F);
   return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);
 }
 
+ATTRIBUTE_INTERFACE
+void FuzzerAlarmCallback() {
+  assert(fuzzer::F);
+  fuzzer::F->AlarmCallback();
+}
+
+ATTRIBUTE_INTERFACE
+void FuzzerDeathCallback() {
+  assert(fuzzer::F);
+  fuzzer::F->DeathCallback();
+}
+
+ATTRIBUTE_INTERFACE
+void FuzzerCrashSignalCallback(unsigned long PID) {
+  assert(fuzzer::F);
+  fuzzer::F->CrashCallback(PID);
+}
+
+ATTRIBUTE_INTERFACE
+void FuzzerExitCallback(unsigned long PID) {
+  assert(fuzzer::F);
+  fuzzer::F->ExitCallback(PID);
+}
+
+ATTRIBUTE_INTERFACE
+void FuzzerFileSizeExceedCallback() {
+  assert(fuzzer::F);
+  fuzzer::F->FileSizeExceedCallback();
+}
+
+ATTRIBUTE_INTERFACE
+void FuzzerGracefulExitCallback() {
+  assert(fuzzer::F);
+  fuzzer::F->GracefulExitCallback();
+}
+
+ATTRIBUTE_INTERFACE
+void FuzzerInterruptCallback() {
+  assert(fuzzer::F);
+  fuzzer::F->InterruptCallback();
+}
+
+ATTRIBUTE_INTERFACE
+void FuzzerLeakCallback(unsigned long PID) {
+  assert(fuzzer::F);
+  fuzzer::F->LeakCallback(PID);
+}
+
+ATTRIBUTE_INTERFACE
+void FuzzerMallocLimitCallback(unsigned long PID, size_t Size) {
+  assert(fuzzer::F);
+  fuzzer::F->OutOfMemoryCallback(PID, Size);
+}
+
+ATTRIBUTE_INTERFACE
+void FuzzerRssLimitCallback(unsigned long PID) {
+  assert(fuzzer::F);
+  fuzzer::F->OutOfMemoryCallback(PID, 0);
+}
+
 } // extern "C"

compiler-rt/lib/fuzzer/FuzzerMonitor.h

+//===- FuzzerMonitor.h ------------------------------------------*- C++ -* ===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+// Interfaces for trace mallocs/frees and calling back on errors.
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_FUZZER_MONITOR_H
+#define LLVM_FUZZER_MONITOR_H
+
+extern "C" {
+
+ATTRIBUTE_INTERFACE void FuzzerAlarmCallback();
+ATTRIBUTE_INTERFACE void FuzzerCrashSignalCallback(unsigned long PID);
+ATTRIBUTE_INTERFACE void FuzzerDeathCallback();
+ATTRIBUTE_INTERFACE void FuzzerExitCallback(unsigned long PID);
+ATTRIBUTE_INTERFACE void FuzzerFileSizeExceedCallback();
+ATTRIBUTE_INTERFACE void FuzzerGracefulExitCallback();
+ATTRIBUTE_INTERFACE void FuzzerInterruptCallback();
+ATTRIBUTE_INTERFACE void FuzzerLeakCallback(unsigned long PID);
+ATTRIBUTE_INTERFACE void FuzzerMallocLimitCallback(unsigned long PID,
+                                                   size_t Size);
+ATTRIBUTE_INTERFACE void FuzzerRssLimitCallback(unsigned long PID);
+
+} // extern "C"
+
+#endif // LLVM_FUZZER_MONITOR_H

compiler-rt/lib/fuzzer/FuzzerUtil.h

 
 std::string Base64(const Unit &U);
 
 void PrintPC(const char *SymbolizedFMT, const char *FallbackFMT, uintptr_t PC);
 
 std::string DescribePC(const char *SymbolizedFMT, uintptr_t PC);
 
 void PrintStackTrace();
-
 void PrintMemoryProfile();
 
 unsigned NumberOfCpuCores();
 
 // Platform specific functions.
 void SetSignalHandler(const FuzzingOptions& Options);
 
 void SleepSeconds(int Seconds);

compiler-rt/lib/fuzzer/FuzzerUtilFuchsia.cpp

Printf("libFuzzer: %s failed: %s\n", Syscall,
            _zx_status_get_string(Status));
     exit(1);
   }
 }
 
 void AlarmHandler(int Seconds) {
   while (true) {
     SleepSeconds(Seconds);
-    Fuzzer::StaticAlarmCallback();
+    FuzzerAlarmCallback();
   }
 }
 
 // CFAOffset is used to reference the stack pointer before entering the
 // trampoline (Stack Pointer + CFAOffset = prev Stack Pointer). Before jumping
 // to the trampoline we copy all the registers onto the stack. We need to make
 // sure that the new stack has enough space to store all the registers.
 //
 // The trampoline holds CFI information regarding the registers stored in the
 // stack, which is then used by the unwinder to restore them.
 #if defined(__x86_64__)
 // In x86_64 the crashing function might also be using the red zone (128 bytes
 // on top of their rsp).
 constexpr size_t CFAOffset = 128 + sizeof(zx_thread_state_general_regs_t);
 #elif defined(__aarch64__)
 // In aarch64 we need to always have the stack pointer aligned to 16 bytes, so we
 // make sure that we are keeping that same alignment.
 constexpr size_t CFAOffset = (sizeof(zx_thread_state_general_regs_t) + 15) & -(uintptr_t)16;
 #endif
 
-// For the crash handler, we need to call Fuzzer::StaticCrashSignalCallback
+// For the crash handler, we need to call FuzzerCrashSignalCallback
 // without POSIX signal handlers.  To achieve this, we use an assembly function
 // to add the necessary CFI unwinding information and a C function to bridge
 // from that back into C++.
 
 // FIXME: This works as a short-term solution, but this code really shouldn't be
 // architecture dependent. A better long term solution is to implement remote
 // unwinding and expose the necessary APIs through sanitizer_common and/or ASAN
 // to allow the exception handling thread to gather the crash state directly.
#define ASM_OPERAND_REG(reg) \
   [reg] "i"(offsetof(zx_thread_state_general_regs_t, reg) - CFAOffset),
 #define ASM_OPERAND_NUM(num)                                 \
   [x##num] "i"(offsetof(zx_thread_state_general_regs_t, r[num]) - CFAOffset),
 
 // Trampoline to bridge from the assembly below to the static C++ crash
 // callback.
 __attribute__((noreturn))
 static void StaticCrashHandler() {
-  Fuzzer::StaticCrashSignalCallback();
+  FuzzerCrashSignalCallback();
   for (;;) {
     _Exit(1);
   }
 }
 
 // Creates the trampoline with the necessary CFI information to unwind through
 // to the crashing call stack:
 //  * Defining the CFA so that it points to the stack pointer at the point

compiler-rt/lib/fuzzer/FuzzerUtilPosix.cpp

 //===- FuzzerUtilPosix.cpp - Misc utils for Posix. ------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 // Misc utils implementation using Posix API.
 //===----------------------------------------------------------------------===//
 #include "FuzzerPlatform.h"
 #if LIBFUZZER_POSIX
 #include "FuzzerIO.h"
 #include "FuzzerInternal.h"
+#include "FuzzerMonitor.h"
 #include "FuzzerTracePC.h"
 #include <cassert>
 #include <chrono>
 #include <cstring>
 #include <errno.h>
 #include <iomanip>
 #include <signal.h>
 #include <stdio.h>
 #include <sys/mman.h>
 #include <sys/resource.h>
 #include <sys/syscall.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <thread>
 #include <unistd.h>
 
 namespace fuzzer {
 
-static void AlarmHandler(int, siginfo_t *, void *) {
-  Fuzzer::StaticAlarmCallback();
-}
+static void AlarmHandler(int, siginfo_t *, void *) { FuzzerAlarmCallback(); }
 
 static void (*upstream_segv_handler)(int, siginfo_t *, void *);
 
 static void SegvHandler(int sig, siginfo_t *si, void *ucontext) {
   assert(si->si_signo == SIGSEGV);
   if (upstream_segv_handler)
     return upstream_segv_handler(sig, si, ucontext);
-  Fuzzer::StaticCrashSignalCallback();
+  FuzzerCrashSignalCallback(0);
 }
 
 static void CrashHandler(int, siginfo_t *, void *) {
-  Fuzzer::StaticCrashSignalCallback();
+  FuzzerCrashSignalCallback(0);
 }
 
 static void InterruptHandler(int, siginfo_t *, void *) {
-  Fuzzer::StaticInterruptCallback();
+  FuzzerInterruptCallback();
 }
 
 static void GracefulExitHandler(int, siginfo_t *, void *) {
-  Fuzzer::StaticGracefulExitCallback();
+  FuzzerGracefulExitCallback();
 }
 
 static void FileSizeExceedHandler(int, siginfo_t *, void *) {
-  Fuzzer::StaticFileSizeExceedCallback();
+  FuzzerFileSizeExceedCallback();
 }
 
 static void SetSigaction(int signum,
                          void (*callback)(int, siginfo_t *, void *)) {
   struct sigaction sigact = {};
   if (sigaction(signum, nullptr, &sigact)) {
     Printf("libFuzzer: sigaction failed with %d\n", errno);
     exit(1);

compiler-rt/lib/fuzzer/FuzzerUtilWindows.cpp

 static const FuzzingOptions* HandlerOpt = nullptr;
 
 static LONG CALLBACK ExceptionHandler(PEXCEPTION_POINTERS ExceptionInfo) {
   switch (ExceptionInfo->ExceptionRecord->ExceptionCode) {
     case EXCEPTION_ACCESS_VIOLATION:
     case EXCEPTION_ARRAY_BOUNDS_EXCEEDED:
     case EXCEPTION_STACK_OVERFLOW:
       if (HandlerOpt->HandleSegv)
-        Fuzzer::StaticCrashSignalCallback();
+        FuzzerCrashSignalCallback();
       break;
     case EXCEPTION_DATATYPE_MISALIGNMENT:
     case EXCEPTION_IN_PAGE_ERROR:
       if (HandlerOpt->HandleBus)
-        Fuzzer::StaticCrashSignalCallback();
+        FuzzerCrashSignalCallback();
       break;
     case EXCEPTION_ILLEGAL_INSTRUCTION:
     case EXCEPTION_PRIV_INSTRUCTION:
       if (HandlerOpt->HandleIll)
-        Fuzzer::StaticCrashSignalCallback();
+        FuzzerCrashSignalCallback();
       break;
     case EXCEPTION_FLT_DENORMAL_OPERAND:
     case EXCEPTION_FLT_DIVIDE_BY_ZERO:
     case EXCEPTION_FLT_INEXACT_RESULT:
     case EXCEPTION_FLT_INVALID_OPERATION:
     case EXCEPTION_FLT_OVERFLOW:
     case EXCEPTION_FLT_STACK_CHECK:
     case EXCEPTION_FLT_UNDERFLOW:
     case EXCEPTION_INT_DIVIDE_BY_ZERO:
     case EXCEPTION_INT_OVERFLOW:
       if (HandlerOpt->HandleFpe)
-        Fuzzer::StaticCrashSignalCallback();
+        FuzzerCrashSignalCallback();
       break;
     // This is an undocumented exception code corresponding to a Visual C++
     // Exception.
     //
     // See: https://devblogs.microsoft.com/oldnewthing/20100730-00/?p=13273
     case 0xE06D7363:
       if (HandlerOpt->HandleWinExcept)
         Fuzzer::StaticCrashSignalCallback();
       break;
       // TODO: Handle (Options.HandleXfsz)
   }
   return EXCEPTION_CONTINUE_SEARCH;
 }
 
 BOOL WINAPI CtrlHandler(DWORD dwCtrlType) {
   switch (dwCtrlType) {
     case CTRL_C_EVENT:
       if (HandlerOpt->HandleInt)
-        Fuzzer::StaticInterruptCallback();
+        FuzzerInterruptCallback();
       return TRUE;
     case CTRL_BREAK_EVENT:
       if (HandlerOpt->HandleTerm)
-        Fuzzer::StaticInterruptCallback();
+        FuzzerInterruptCallback();
       return TRUE;
   }
   return FALSE;
 }
 
-void CALLBACK AlarmHandler(PVOID, BOOLEAN) {
-  Fuzzer::StaticAlarmCallback();
-}
+void CALLBACK AlarmHandler(PVOID, BOOLEAN) { FuzzerAlarmCallback(); }
 
 class TimerQ {
   HANDLE TimerQueue;
  public:
   TimerQ() : TimerQueue(NULL) {}
   ~TimerQ() {
     if (TimerQueue)
       DeleteTimerQueueEx(TimerQueue, NULL);
if (!CreateTimerQueueTimer(&Timer, TimerQueue, AlarmHandler, NULL,
       Printf("libFuzzer: CreateTimerQueueTimer failed.\n");
       exit(1);
     }
   }
 };
 
 static TimerQ Timer;
 
-static void CrashHandler(int) { Fuzzer::StaticCrashSignalCallback(); }
+static void CrashHandler(int) { FuzzerCrashSignalCallback(); }
 
 void SetSignalHandler(const FuzzingOptions& Options) {
   HandlerOpt = &Options;
 
   if (Options.HandleAlrm && Options.UnitTimeoutSec > 0)
     Timer.SetTimer(Options.UnitTimeoutSec / 2 + 1);
 
   if (Options.HandleInt || Options.HandleTerm)