StrixOS/build_soong
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add $ORIGIN to fuzzer-coverage sanitized .so's.

Browse Source 
Build fuzzer-sanitized libraries with an $ORIGIN DT_RUNPATH. Android's linker
uses DT_RUNPATH, not DT_RPATH. When we deploy cc_fuzz targets and their
libraries to /data/fuzz/<arch>/lib, any transient shared library gets the
DT_RUNPATH from the shared library above it, and not the executable, meaning
that the lookup falls back to the system. Adding the $ORIGIN to the DT_RUNPATH
here means that transient shared libraries can be found colocated with their
parents.

This may have some interesting consequences if:

 1. Your fuzz target depends on a shared library which has `sanitize.fuzzer:
 false` (as the DT_RUNPATH won't have `$ORIGIN`, and so you may get missing
 libraries).
 2. A `SANITIZE_TARGET=fuzzer` platform has a shared object in two
 different directories (like system vs. ndk) and is depending on the linker
 implementation details to resolve this in some manner.

I don't believe either of these instances should reasonably happen in
practise.

Fixes: 145973404
Fixes: 145988908
Test: m example_fuzzer
Change-Id: I94cbf628fc1ce15c43283d72bdabd9817de1fef8
This commit is contained in:
Mitch Phillips
2019-12-10 08:44:52 -08:00
parent 4858e41719
commit 734b4cb62f
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
cc/sanitize.go
View File

@@ -494,6 +494,15 @@ func (sanitize *sanitize) flags(ctx ModuleContext, flags Flags) Flags {
// Disable fortify for fuzzing builds. Generally, we'll be building with
// UBSan or ASan here and the fortify checks pollute the stack traces.
flags.Local.CFlags = append(flags.Local.CFlags, "-U_FORTIFY_SOURCE")
// Build fuzzer-sanitized libraries with an $ORIGIN DT_RUNPATH. Android's
// linker uses DT_RUNPATH, not DT_RPATH. When we deploy cc_fuzz targets and
// their libraries to /data/fuzz/<arch>/lib, any transient shared library gets
// the DT_RUNPATH from the shared library above it, and not the executable,
// meaning that the lookup falls back to the system. Adding the $ORIGIN to the
// DT_RUNPATH here means that transient shared libraries can be found
// colocated with their parents.
flags.Local.LdFlags = append(flags.Local.LdFlags, `-Wl,-rpath,\$$ORIGIN`)
}
if Bool(sanitize.Properties.Sanitize.Cfi) {