libfuzzer Go executable crashes with "non-Go code set up signal handler without SA_ONSTACK flag"

262 views Asked by At

I am using go-118-fuzz-build and some manual patching to build a libfuzzer executable from a native Go 1.18 fuzz test:

  1. Patch the test file, replacing *testing.F with *github.com/AdamKorcz/go-118-fuzz-build/utils.F, rename it, and move it into a temp folder.
  2. Compile the test go-118-fuzz-build -o fuzz_target.a -func $func ./tmp.
  3. Build an executable with clang -fsanitize=fuzzer fuzz_target.a -o fuzz_target.
  4. Run the fuzzer: ./fuzzer -print_final_stats=1 -artifact_prefix=./crashes/ -error_exitcode=76 -max_total_time=600 corpus -max_total_time=300 (via gitlab-cov-fuzz)

I get the following output:

signal 11 received but handler not on signal stack
fatal error: non-Go code set up signal handler without SA_ONSTACK flag
runtime stack:
(...)
==4126== ERROR: libFuzzer: deadly signal
    #0 0x4aec70 in __sanitizer_print_stack_trace (/builds/accumulatenetwork/accumulate/fuzzer+0x4aec70)
    #1 0x45a5c8 in fuzzer::PrintStackTrace() (/builds/accumulatenetwork/accumulate/fuzzer+0x45a5c8)
    #2 0x440603 in fuzzer::Fuzzer::CrashCallback() (/builds/accumulatenetwork/accumulate/fuzzer+0x440603)
    #3 0x7f900f75613f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1313f)
    #4 0x520f00 in runtime.raise.abi0 runtime/sys_linux_amd64.s:158
NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal

I assume the fuzzer input causes my code to raise SIGSEGV but libfuzzer's signal handler is interfering with Go so I don't get the actual stack trace. How do I fix "fatal error: non-Go code set up signal handler without SA_ONSTACK flag"?

0

There are 0 answers