[Bug libdw/28715] New: There seems to be an infinite loop in dwfl_segment_report_module

[Bug libdw/28715] New: There seems to be an infinite loop in dwfl_segment_report_module

[evvers at ya dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

            Bug ID: 28715
           Summary: There seems to be an infinite loop in
                    dwfl_segment_report_module
           Product: elfutils
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libdw
          Assignee: unassigned at sourceware dot org
          Reporter: evvers at ya dot ru
                CC: elfutils-devel at sourceware dot org
  Target Milestone: ---

Created attachment 13863
  --> https://sourceware.org/bugzilla/attachment.cgi?id=13863&action=edit
File causing an infinite loop

It was reported today in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42645 . It can be
reproduced with `./src/stack`:
```
autoreconf -i -f
./configure --enable-maintainer-mode
make -j$(nproc) V=1
LD_LIBRARY_PATH="./libdw;./libelf" ./src/stack --core ../oss-fuzz-42645
```
According to eu-stack it's in dwfl_segment_report_module
```
PID 212089 - process
TID 212089:
#0  0x00007f6af3447cd5 dwfl_segment_report_module
#1  0x00007f6af344bf88 dwfl_core_file_report@@ELFUTILS_0.158
#2  0x0000000000402ec7 parse_opt
#3  0x00007f6af30da472 argp_parse
#4  0x00000000004024eb main
#5  0x00007f6af2fe9560 __libc_start_call_main
#6  0x00007f6af2fe960c __libc_start_main@@GLIBC_2.34
#7  0x0000000000402725 _start
```
Below is the backtrace OSS-Fuzz attached to the issue (with line numbers):
```
        ALARM: working on the last Unit for 61 seconds
       and the timeout value is 60 (use -timeout=N to change)
==822== ERROR: libFuzzer: timeout after 61 seconds
    #0 0x4b22d4 in __sanitizer_print_stack_trace
/src/llvm-project/compiler-rt/lib/ubsan/ubsan_diag_standalone.cpp:31:3
    #1 0x457438 in fuzzer::PrintStackTrace() cxa_noexception.cpp:0
    #2 0x43c329 in fuzzer::Fuzzer::AlarmCallback() cxa_noexception.cpp:0
    #3 0x7f1be648c3bf in libpthread.so.0
    #4 0x4aea5b in atomic_exchange<__sanitizer::atomic_uint32_t>
/src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_atomic_clang.h:67:7
    #5 0x4aea5b in acquire
/src/llvm-project/compiler-rt/lib/ubsan/ubsan_value.h:60:21
    #6 0x4aea5b in handleNegateOverflowImpl(__ubsan::OverflowData*, unsigned
long, __ubsan::ReportOptions)
/src/llvm-project/compiler-rt/lib/ubsan/ubsan_handlers.cpp:251:34
    #7 0x4aea2d in __ubsan_handle_negate_overflow
/src/llvm-project/compiler-rt/lib/ubsan/ubsan_handlers.cpp:277:3
    #8 0x517854 in dwfl_segment_report_module
/src/elfutils/libdwfl/dwfl_segment_report_module.c:581:58
    #9 0x4b8937 in dwfl_core_file_report
/src/elfutils/libdwfl/core-file.c:559:17
    #10 0x4b388e in LLVMFuzzerTestOneInput /src/fuzz-dwfl-core.c:52:6
    #11 0x43d953 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*,
unsigned long) cxa_noexception.cpp:0
    #12 0x429592 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned
long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6
    #13 0x42edec in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char
const*, unsigned long)) cxa_noexception.cpp:0
    #14 0x457bf2 in main
/src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #15 0x7f1be62800b2 in __libc_start_main
/build/glibc-eX1tMB/glibc-2.31/csu/libc-start.c:308:16
    #16 0x407d4d in _start
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28715] There seems to be an infinite loop in dwfl_segment_report_module

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

Mark Wielaard <mark at klomp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at sourceware dot org   |mark at klomp dot org
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2021-12-20
     Ever confirmed|0                           |1
                 CC|                            |mark at klomp dot org

--- Comment #1 from Mark Wielaard <mark at klomp dot org> ---
I couldn't replicate the infinite loop, which I assume has been fixed by:
https://sourceware.org/pipermail/elfutils-devel/2021q4/004557.html

But I saw it did trigger yet another xlate alignment issue for which I did
submit:
https://sourceware.org/pipermail/elfutils-devel/2021q4/004565.html

P.S. Note that the bugs.chromium.org link doesn't work for me, it apparently
requires a google account with permissions to even just look at that bug.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28715] There seems to be an infinite loop in dwfl_segment_report_module

[evvers at ya dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

--- Comment #2 from Evgeny Vereshchagin <evvers at ya dot ru> ---
(In reply to Mark Wielaard from comment #1)
> I couldn't replicate the infinite loop, which I assume has been fixed by:
> https://sourceware.org/pipermail/elfutils-devel/2021q4/004557.html
> 
> But I saw it did trigger yet another xlate alignment issue for which I did
> submit:
> https://sourceware.org/pipermail/elfutils-devel/2021q4/004565.html

Thanks! I'll try to take a look tomorrow.

There seem to be quite a few new patches on the mailing list. I wonder if it's
possible to somehow fetch a branch with all of them so that I could just rebase
the fuzzing infrastructure on top of it?

> P.S. Note that the bugs.chromium.org link doesn't work for me, it apparently
> requires a google account with permissions to even just look at that bug.

It's possible to make all the bug reports public by default. For example, in
https://github.com/google/oss-fuzz/pull/6741 the PHP project decided that bug
reports should be no longer restricted and flipped the flag. I can do the same
but I don't think I can do it without your approval.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28715] There seems to be an infinite loop in dwfl_segment_report_module

[evvers at ya dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

--- Comment #3 from Evgeny Vereshchagin <evvers at ya dot ru> ---
(In reply to Mark Wielaard from comment #1)
> I couldn't replicate the infinite loop, which I assume has been fixed by:
> https://sourceware.org/pipermail/elfutils-devel/2021q4/004557.html

I haven't backported that patch yet but as far as I can see the infinite loop
can't be triggered with the following patches applied:
```
afd19a71 libdwfl: Handle unaligned Phdr in dwfl_segment_report_module
cf41ae95 libdwfl: Handle unaligned Ehdr in dwfl_segment_report_module
7f5e5da8 libdwfl: Make sure note data is properly aligned.
```

> But I saw it did trigger yet another xlate alignment issue for which I did
> submit:
> https://sourceware.org/pipermail/elfutils-devel/2021q4/004565.html

I've just ran into that as well. I'll apply the patch and report back if it's
still there.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28715] There seems to be an infinite loop in dwfl_segment_report_module

[evvers at ya dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

--- Comment #4 from Evgeny Vereshchagin <evvers at ya dot ru> ---
(In reply to Evgeny Vereshchagin from comment #3)
> (In reply to Mark Wielaard from comment #1)
> > I couldn't replicate the infinite loop, which I assume has been fixed by:
> > https://sourceware.org/pipermail/elfutils-devel/2021q4/004557.html
> 
> I haven't backported that patch yet but as far as I can see the infinite
> loop can't be triggered with the following patches applied:
> ```
> afd19a71 libdwfl: Handle unaligned Phdr in dwfl_segment_report_module
> cf41ae95 libdwfl: Handle unaligned Ehdr in dwfl_segment_report_module
> 7f5e5da8 libdwfl: Make sure note data is properly aligned.
> ```

Looks like I was wrong. Packit along with run-fuzz-dwfl-core.sh actually caught
the infinite loop on 32 bit platforms:
```
Running:
/builddir/build/BUILD/elfutils-0.186/tests/fuzz-dwfl-core-crashes/oss-fuzz-42645
./test-subr.sh: line 84: 20115 Killed                 
LD_LIBRARY_PATH="${built_library_path}${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
$VALGRIND_CMD "$@"
```
I just didn't wait for it to finish.

I'll try to apply
https://sourceware.org/pipermail/elfutils-devel/2021q4/004557.html shortly and
report back.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28715] There seems to be an infinite loop in dwfl_segment_report_module

[evvers at ya dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

--- Comment #5 from Evgeny Vereshchagin <evvers at ya dot ru> ---
I can't seem to apply that patch:
```
$ git am --exclude=libdwfl/ChangeLog p4.patch
Applying: libdwfl: Rewrite GElf_Nhdr reading in dwfl_segment_report_module
error: patch failed: libdwfl/dwfl_segment_report_module.c:552
error: libdwfl/dwfl_segment_report_module.c: patch does not apply
Patch failed at 0001 libdwfl: Rewrite GElf_Nhdr reading in
dwfl_segment_report_module
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28715] There seems to be an infinite loop in dwfl_segment_report_module

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

--- Comment #6 from Mark Wielaard <mark at klomp dot org> ---
(In reply to Evgeny Vereshchagin from comment #5)
> I can't seem to apply that patch:

It might be easier to pick up the whole "fuzz" branch from my tree:
https://code.wildebeest.org/git/user/mjw/elfutils/log/?h=fuzz

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28715] There seems to be an infinite loop in dwfl_segment_report_module

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

--- Comment #7 from Mark Wielaard <mark at klomp dot org> ---
(In reply to Evgeny Vereshchagin from comment #2)
> There seem to be quite a few new patches on the mailing list. I wonder if
> it's possible to somehow fetch a branch with all of them so that I could
> just rebase the fuzzing infrastructure on top of it?

All patches sent to the list are also in patchwork:
https://patchwork.sourceware.org/project/elfutils/list/

I keep work in progress also in branch in my own git tree:
https://code.wildebeest.org/git/user/mjw/elfutils/

The fuzz branch has all recent patches based on your fuzzing reports and my own
finds running afl and afl++ on amd64 and i686 for eu-stack --core

> > P.S. Note that the bugs.chromium.org link doesn't work for me, it apparently
> > requires a google account with permissions to even just look at that bug.
> 
> It's possible to make all the bug reports public by default. For example, in
> https://github.com/google/oss-fuzz/pull/6741 the PHP project decided that
> bug reports should be no longer restricted and flipped the flag. I can do
> the same but I don't think I can do it without your approval.

I think it is better if the reports were public. But I think google really
should just report these issues upstream instead of hiding them in their own
bug tracker.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28715] There seems to be an infinite loop in dwfl_segment_report_module

[evvers at ya dot ru]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

--- Comment #8 from Evgeny Vereshchagin <evvers at ya dot ru> ---
(In reply to Mark Wielaard from comment #7)
> (In reply to Evgeny Vereshchagin from comment #2)
> > There seem to be quite a few new patches on the mailing list. I wonder if
> > it's possible to somehow fetch a branch with all of them so that I could
> > just rebase the fuzzing infrastructure on top of it?
> 
> All patches sent to the list are also in patchwork:
> https://patchwork.sourceware.org/project/elfutils/list/
> 
> I keep work in progress also in branch in my own git tree:
> https://code.wildebeest.org/git/user/mjw/elfutils/
> 
> The fuzz branch has all recent patches based on your fuzzing reports and my
> own finds running afl and afl++ on amd64 and i686 for eu-stack --core
> 

With https://code.wildebeest.org/git/user/mjw/elfutils/log/?h=fuzz rebased on
top of my "fuzzing" branch I can no longer reproduce this issue. Thanks!

> I think it is better if the reports were public.

Got it. I'll flip the flag there then. Would it be OK if I added your email
address to
https://github.com/google/oss-fuzz/blob/master/projects/elfutils/project.yaml
so that you could be notified when new bug reports were opened?

> But I think google really
> should just report these issues upstream instead of hiding them in their own
> bug tracker.

Unfortunately I can't change that (and I'm not affiliated with Google in any
way). I tried to use my main email address there but at some point I had to
create a gmail account to be able to look at systemd bug reports.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libdw/28715] There seems to be an infinite loop in dwfl_segment_report_module

[mark at klomp dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28715

Mark Wielaard <mark at klomp dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Mark Wielaard <mark at klomp dot org> ---
(In reply to Evgeny Vereshchagin from comment #8)
> (In reply to Mark Wielaard from comment #7)
> > (In reply to Evgeny Vereshchagin from comment #2)
> > > There seem to be quite a few new patches on the mailing list. I wonder if
> > > it's possible to somehow fetch a branch with all of them so that I could
> > > just rebase the fuzzing infrastructure on top of it?
> > 
> > All patches sent to the list are also in patchwork:
> > https://patchwork.sourceware.org/project/elfutils/list/
> > 
> > I keep work in progress also in branch in my own git tree:
> > https://code.wildebeest.org/git/user/mjw/elfutils/
> > 
> > The fuzz branch has all recent patches based on your fuzzing reports and my
> > own finds running afl and afl++ on amd64 and i686 for eu-stack --core
> > 
> 
> With https://code.wildebeest.org/git/user/mjw/elfutils/log/?h=fuzz rebased
> on top of my "fuzzing" branch I can no longer reproduce this issue. Thanks!

Thanks for testing, I pushed all 13 commits from my fuzz branch.

> > I think it is better if the reports were public.
> 
> Got it. I'll flip the flag there then. Would it be OK if I added your email
> address to
> https://github.com/google/oss-fuzz/blob/master/projects/elfutils/project.
> yaml so that you could be notified when new bug reports were opened?

Sure, or just add elfutils-devel@sourceware.org so everybody gets the reports.

-- 
You are receiving this mail because:
You are on the CC list for the bug.