bughunt-rust icon indicating copy to clipboard operation
bughunt-rust copied to clipboard

Resolve OOM panics

Open blt opened this issue 7 years ago • 2 comments

As detailed in this post hunting for bugs is hampered right now because of Rust's panic strategy around allocation failures. We should introduce techniques to avoid these panics, related issues of edge-cases being masked by OOM panics.

blt avatar Oct 12 '18 06:10 blt

In 12e25c218ae538ca4c365fb56630c47b0e250ec1 I've introduced bh_alloc to avoid crashing when a fuzz target allocates too much memory. bh_alloc is a bump allocator with a fixed heap size. When it runs out of memory, it calls exit(0). This behaviour might still mask bugs that will only appear on large-memory systems. But, it's a start.

Credit for the idea of a gentle-exit OOM condition goes to @Shnatsel.

blt avatar Oct 12 '18 06:10 blt

As of e724077 bh_alloc has been removed. I experienced crashes that could not be reproduced in str_repeat target when the bump allocator, fuzzing variant, was in place. I did not investigate at any length, other than to confirm the cases were not reproducible. My temporary solution was to remove bh_alloc, especially since we were still artificially bounding inputs known to cause allocation panics to hit signal.

I still think a bump allocator strategy has promise for speeding up allocations in targets but, clearly, more investigation is needed before reintroduction.

blt avatar Mar 10 '19 14:03 blt