From 386245b68ef4a24450a12d4f85d1835779dfef86 Mon Sep 17 00:00:00 2001 From: Khaled Yakdan Date: Thu, 9 Jun 2022 07:29:14 +0000 Subject: [PATCH] runtime: fix stack split at bad time when fuzzing Fix #53190 Change-Id: I6c1f9c3ab58818d3a9f05ddaa02fc247e53677d3 GitHub-Last-Rev: 13b0749c135598c97063b07e2b0266125f5da83e GitHub-Pull-Request: golang/go#53191 Reviewed-on: https://go-review.googlesource.com/c/go/+/410034 Reviewed-by: Michael Knyszek Reviewed-by: Dmitri Shuralyov --- src/runtime/libfuzzer.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/runtime/libfuzzer.go b/src/runtime/libfuzzer.go index 8c6642443c..02dcc18e7a 100644 --- a/src/runtime/libfuzzer.go +++ b/src/runtime/libfuzzer.go @@ -15,41 +15,53 @@ func libfuzzerCall4(fn *byte, fakePC uintptr, s1, s2 unsafe.Pointer, result uint // Keep in sync with the definition of ret_sled in src/runtime/libfuzzer_amd64.s const retSledSize = 512 +// In libFuzzer mode, the compiler inserts calls to libfuzzerTraceCmpN and libfuzzerTraceConstCmpN +// (where N can be 1, 2, 4, or 8) for encountered integer comparisons in the code to be instrumented. +// This may result in these functions having callers that are nosplit. That is why they must be nosplit. +// +//go:nosplit func libfuzzerTraceCmp1(arg0, arg1 uint8, fakePC int) { fakePC = fakePC % retSledSize libfuzzerCallTraceIntCmp(&__sanitizer_cov_trace_cmp1, uintptr(arg0), uintptr(arg1), uintptr(fakePC)) } +//go:nosplit func libfuzzerTraceCmp2(arg0, arg1 uint16, fakePC int) { fakePC = fakePC % retSledSize libfuzzerCallTraceIntCmp(&__sanitizer_cov_trace_cmp2, uintptr(arg0), uintptr(arg1), uintptr(fakePC)) } +//go:nosplit func libfuzzerTraceCmp4(arg0, arg1 uint32, fakePC int) { fakePC = fakePC % retSledSize libfuzzerCallTraceIntCmp(&__sanitizer_cov_trace_cmp4, uintptr(arg0), uintptr(arg1), uintptr(fakePC)) } +//go:nosplit func libfuzzerTraceCmp8(arg0, arg1 uint64, fakePC int) { fakePC = fakePC % retSledSize libfuzzerCallTraceIntCmp(&__sanitizer_cov_trace_cmp8, uintptr(arg0), uintptr(arg1), uintptr(fakePC)) } +//go:nosplit func libfuzzerTraceConstCmp1(arg0, arg1 uint8, fakePC int) { fakePC = fakePC % retSledSize libfuzzerCallTraceIntCmp(&__sanitizer_cov_trace_const_cmp1, uintptr(arg0), uintptr(arg1), uintptr(fakePC)) } +//go:nosplit func libfuzzerTraceConstCmp2(arg0, arg1 uint16, fakePC int) { fakePC = fakePC % retSledSize libfuzzerCallTraceIntCmp(&__sanitizer_cov_trace_const_cmp2, uintptr(arg0), uintptr(arg1), uintptr(fakePC)) } +//go:nosplit func libfuzzerTraceConstCmp4(arg0, arg1 uint32, fakePC int) { fakePC = fakePC % retSledSize libfuzzerCallTraceIntCmp(&__sanitizer_cov_trace_const_cmp4, uintptr(arg0), uintptr(arg1), uintptr(fakePC)) } +//go:nosplit func libfuzzerTraceConstCmp8(arg0, arg1 uint64, fakePC int) { fakePC = fakePC % retSledSize libfuzzerCallTraceIntCmp(&__sanitizer_cov_trace_const_cmp8, uintptr(arg0), uintptr(arg1), uintptr(fakePC)) -- 2.48.1