On Wednesday, 2021-08-04 at 09:56:21 -04, Alexander Bulekov wrote:
> The timeout mechanism wont work if SIGALRM is blocked. This changes
NIT: s/wont/won't/
s/changes/change/
> unmasks SIGALRM when the timer is installed. This doesn't completely
> solve the problem, as the fuzzer could trigger some device activity that
> re-masks SIGALRM. However, there are currently no inputs on OSS-Fuzz
> that re-mask SIGALRM and timeout. If that turns out to be a real issue,
> we could try to hook sigmask-type calls, or use a separate timer thread.
>
> Based-on: <20210713150037.9297-1-alx...@bu.edu>
> Signed-off-by: Alexander Bulekov <alx...@bu.edu>
Reviewed-by: Darren Kenny <darren.ke...@oracle.com>
> ---
> tests/qtest/fuzz/generic_fuzz.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
> index de427a3727..dd7e25851c 100644
> --- a/tests/qtest/fuzz/generic_fuzz.c
> +++ b/tests/qtest/fuzz/generic_fuzz.c
> @@ -670,6 +670,7 @@ static void generic_fuzz(QTestState *s, const unsigned
> char *Data, size_t Size)
> if (fork() == 0) {
> struct sigaction sact;
> struct itimerval timer;
> + sigset_t set;
> /*
> * Sometimes the fuzzer will find inputs that take quite a long time
> to
> * process. Often times, these inputs do not result in new coverage.
> @@ -684,6 +685,10 @@ static void generic_fuzz(QTestState *s, const unsigned
> char *Data, size_t Size)
> sact.sa_handler = handle_timeout;
> sigaction(SIGALRM, &sact, NULL);
>
> + sigemptyset(&set);
> + sigaddset(&set, SIGALRM);
> + pthread_sigmask(SIG_UNBLOCK, &set, NULL);
> +
> memset(&timer, 0, sizeof(timer));
> timer.it_value.tv_sec = timeout / USEC_IN_SEC;
> timer.it_value.tv_usec = timeout % USEC_IN_SEC;
> --
> 2.30.2
