Home | History | Annotate | Download | only in linux
      1 /*
      2  *
      3  * honggfuzz - architecture dependent code (LINUX/PTRACE)
      4  * -----------------------------------------
      5  *
      6  * Author: Robert Swiecki <swiecki (at) google.com>
      7  *
      8  * Copyright 2010-2015 by Google Inc. All Rights Reserved.
      9  *
     10  * Licensed under the Apache License, Version 2.0 (the "License"); you may
     11  * not use this file except in compliance with the License. You may obtain
     12  * a copy of the License at
     13  *
     14  * http://www.apache.org/licenses/LICENSE-2.0
     15  *
     16  * Unless required by applicable law or agreed to in writing, software
     17  * distributed under the License is distributed on an "AS IS" BASIS,
     18  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
     19  * implied. See the License for the specific language governing
     20  * permissions and limitations under the License.
     21  *
     22  */
     23 
     24 #include "linux/trace.h"
     25 
     26 #include <ctype.h>
     27 #include <dirent.h>
     28 #include <elf.h>
     29 #include <endian.h>
     30 #include <errno.h>
     31 #include <fcntl.h>
     32 #include <inttypes.h>
     33 #include <signal.h>
     34 #include <stdio.h>
     35 #include <stdlib.h>
     36 #include <string.h>
     37 #include <sys/cdefs.h>
     38 #include <sys/personality.h>
     39 #include <sys/ptrace.h>
     40 #include <sys/resource.h>
     41 #include <sys/stat.h>
     42 #include <sys/syscall.h>
     43 #include <sys/time.h>
     44 #include <sys/types.h>
     45 #include <sys/uio.h>
     46 #include <sys/user.h>
     47 #include <sys/wait.h>
     48 #include <time.h>
     49 #include <unistd.h>
     50 
     51 #include "libcommon/common.h"
     52 #include "libcommon/files.h"
     53 #include "libcommon/log.h"
     54 #include "libcommon/util.h"
     55 #include "linux/bfd.h"
     56 #include "linux/unwind.h"
     57 #include "sancov.h"
     58 #include "sanitizers.h"
     59 #include "subproc.h"
     60 
     61 #if defined(__ANDROID__)
     62 #include "capstone.h"
     63 #endif
     64 
     65 #if defined(__i386__) || defined(__arm__) || defined(__powerpc__)
     66 #define REG_TYPE uint32_t
     67 #define REG_PM PRIx32
     68 #define REG_PD "0x%08"
     69 #elif defined(__x86_64__) || defined(__aarch64__) || defined(__powerpc64__) || \
     70     defined(__mips__) || defined(__mips64__)
     71 #define REG_TYPE uint64_t
     72 #define REG_PM PRIx64
     73 #define REG_PD "0x%016"
     74 #endif
     75 
     76 /*
     77  * Size in characters required to store a string representation of a
     78  * register value (0xdeadbeef style))
     79  */
     80 #define REGSIZEINCHAR (2 * sizeof(REG_TYPE) + 3)
     81 
     82 #if defined(__i386__) || defined(__x86_64__)
     83 #define MAX_INSTR_SZ 16
     84 #elif defined(__arm__) || defined(__powerpc__) || defined(__powerpc64__)
     85 #define MAX_INSTR_SZ 4
     86 #elif defined(__aarch64__)
     87 #define MAX_INSTR_SZ 8
     88 #elif defined(__mips__) || defined(__mips64__)
     89 #define MAX_INSTR_SZ 8
     90 #endif
     91 
     92 #if defined(__i386__) || defined(__x86_64__)
     93 struct user_regs_struct_32 {
     94     uint32_t ebx;
     95     uint32_t ecx;
     96     uint32_t edx;
     97     uint32_t esi;
     98     uint32_t edi;
     99     uint32_t ebp;
    100     uint32_t eax;
    101     uint16_t ds, __ds;
    102     uint16_t es, __es;
    103     uint16_t fs, __fs;
    104     uint16_t gs, __gs;
    105     uint32_t orig_eax;
    106     uint32_t eip;
    107     uint16_t cs, __cs;
    108     uint32_t eflags;
    109     uint32_t esp;
    110     uint16_t ss, __ss;
    111 };
    112 
    113 struct user_regs_struct_64 {
    114     uint64_t r15;
    115     uint64_t r14;
    116     uint64_t r13;
    117     uint64_t r12;
    118     uint64_t bp;
    119     uint64_t bx;
    120     uint64_t r11;
    121     uint64_t r10;
    122     uint64_t r9;
    123     uint64_t r8;
    124     uint64_t ax;
    125     uint64_t cx;
    126     uint64_t dx;
    127     uint64_t si;
    128     uint64_t di;
    129     uint64_t orig_ax;
    130     uint64_t ip;
    131     uint64_t cs;
    132     uint64_t flags;
    133     uint64_t sp;
    134     uint64_t ss;
    135     uint64_t fs_base;
    136     uint64_t gs_base;
    137     uint64_t ds;
    138     uint64_t es;
    139     uint64_t fs;
    140     uint64_t gs;
    141 };
    142 #define HEADERS_STRUCT struct user_regs_struct_64
    143 #endif /* defined(__i386__) || defined(__x86_64__) */
    144 
    145 #if defined(__arm__) || defined(__aarch64__)
    146 #ifndef ARM_pc
    147 #ifdef __ANDROID__ /* Building with NDK headers */
    148 #define ARM_pc uregs[15]
    149 #else /* Building with glibc headers */
    150 #define ARM_pc 15
    151 #endif
    152 #endif /* ARM_pc */
    153 #ifndef ARM_cpsr
    154 #ifdef __ANDROID__ /* Building with NDK headers */
    155 #define ARM_cpsr uregs[16]
    156 #else /* Building with glibc headers */
    157 #define ARM_cpsr 16
    158 #endif
    159 #endif /* ARM_cpsr */
    160 struct user_regs_struct_32 {
    161     uint32_t uregs[18];
    162 };
    163 
    164 struct user_regs_struct_64 {
    165     uint64_t regs[31];
    166     uint64_t sp;
    167     uint64_t pc;
    168     uint64_t pstate;
    169 };
    170 #define HEADERS_STRUCT struct user_regs_struct_64
    171 #endif /* defined(__arm__) || defined(__aarch64__) */
    172 
    173 #if defined(__powerpc64__) || defined(__powerpc__)
    174 #define HEADERS_STRUCT struct pt_regs
    175 struct user_regs_struct_32 {
    176     uint32_t gpr[32];
    177     uint32_t nip;
    178     uint32_t msr;
    179     uint32_t orig_gpr3;
    180     uint32_t ctr;
    181     uint32_t link;
    182     uint32_t xer;
    183     uint32_t ccr;
    184     uint32_t mq;
    185     uint32_t trap;
    186     uint32_t dar;
    187     uint32_t dsisr;
    188     uint32_t result;
    189     /*
    190      * elf.h's ELF_NGREG says it's 48 registers, so kernel fills it in
    191      * with some zeros
    192      */
    193     uint32_t zero0;
    194     uint32_t zero1;
    195     uint32_t zero2;
    196     uint32_t zero3;
    197 };
    198 struct user_regs_struct_64 {
    199     uint64_t gpr[32];
    200     uint64_t nip;
    201     uint64_t msr;
    202     uint64_t orig_gpr3;
    203     uint64_t ctr;
    204     uint64_t link;
    205     uint64_t xer;
    206     uint64_t ccr;
    207     uint64_t softe;
    208     uint64_t trap;
    209     uint64_t dar;
    210     uint64_t dsisr;
    211     uint64_t result;
    212     /*
    213      * elf.h's ELF_NGREG says it's 48 registers, so kernel fills it in
    214      * with some zeros
    215      */
    216     uint64_t zero0;
    217     uint64_t zero1;
    218     uint64_t zero2;
    219     uint64_t zero3;
    220 };
    221 #endif /* defined(__powerpc64__) || defined(__powerpc__) */
    222 
    223 #if defined(__mips__) || defined(__mips64__)
    224 struct user_regs_struct {
    225     uint64_t regs[32];
    226 
    227     uint64_t lo;
    228     uint64_t hi;
    229     uint64_t cp0_epc;
    230     uint64_t cp0_badvaddr;
    231     uint64_t cp0_status;
    232     uint64_t cp0_cause;
    233 };
    234 #define HEADERS_STRUCT struct user_regs_struct
    235 #endif /* defined(__mips__) || defined(__mips64__) */
    236 
    237 #if defined(__ANDROID__)
    238 /*
    239  * Some Android ABIs don't implement PTRACE_GETREGS (e.g. aarch64)
    240  */
    241 #if defined(PTRACE_GETREGS)
    242 #define PTRACE_GETREGS_AVAILABLE 1
    243 #else
    244 #define PTRACE_GETREGS_AVAILABLE 0
    245 #endif /* defined(PTRACE_GETREGS) */
    246 #endif /* defined(__ANDROID__) */
    247 
    248 static struct {
    249     const char* descr;
    250     bool important;
    251 } arch_sigs[_NSIG + 1] = {
    252     [0 ...(_NSIG)].important = false,
    253     [0 ...(_NSIG)].descr = "UNKNOWN",
    254 
    255     [SIGTRAP].important = false,
    256     [SIGTRAP].descr = "SIGTRAP",
    257 
    258     [SIGILL].important = true,
    259     [SIGILL].descr = "SIGILL",
    260 
    261     [SIGFPE].important = true,
    262     [SIGFPE].descr = "SIGFPE",
    263 
    264     [SIGSEGV].important = true,
    265     [SIGSEGV].descr = "SIGSEGV",
    266 
    267     [SIGBUS].important = true,
    268     [SIGBUS].descr = "SIGBUS",
    269 
    270     /* Is affected from monitorSIGABRT flag */
    271     [SIGABRT].important = false,
    272     [SIGABRT].descr = "SIGABRT",
    273 
    274     /* Is affected from tmoutVTALRM flag */
    275     [SIGVTALRM].important = false,
    276     [SIGVTALRM].descr = "SIGVTALRM-TMOUT",
    277 
    278     /* seccomp-bpf kill */
    279     [SIGSYS].important = true,
    280     [SIGSYS].descr = "SIGSYS",
    281 };
    282 
    283 #ifndef SI_FROMUSER
    284 #define SI_FROMUSER(siptr) ((siptr)->si_code <= 0)
    285 #endif /* SI_FROMUSER */
    286 
    287 extern const char* sys_sigabbrev[];
    288 
    289 static __thread char arch_signame[32];
    290 static const char* arch_sigName(int signo) {
    291     if (signo < 0 || signo > _NSIG) {
    292         snprintf(arch_signame, sizeof(arch_signame), "UNKNOWN-%d", signo);
    293         return arch_signame;
    294     }
    295     if (signo > __SIGRTMIN) {
    296         snprintf(arch_signame, sizeof(arch_signame), "SIG%d-RTMIN+%d", signo, signo - __SIGRTMIN);
    297         return arch_signame;
    298     }
    299 #ifdef __ANDROID__
    300     return arch_sigs[signo].descr;
    301 #else
    302     if (sys_sigabbrev[signo] == NULL) {
    303         snprintf(arch_signame, sizeof(arch_signame), "SIG%d", signo);
    304     } else {
    305         snprintf(arch_signame, sizeof(arch_signame), "SIG%s", sys_sigabbrev[signo]);
    306     }
    307     return arch_signame;
    308 #endif /* __ANDROID__ */
    309 }
    310 
    311 static size_t arch_getProcMem(pid_t pid, uint8_t* buf, size_t len, REG_TYPE pc) {
    312     /*
    313      * Let's try process_vm_readv first
    314      */
    315     const struct iovec local_iov = {
    316         .iov_base = buf,
    317         .iov_len = len,
    318     };
    319     const struct iovec remote_iov = {
    320         .iov_base = (void*)(uintptr_t)pc,
    321         .iov_len = len,
    322     };
    323     if (process_vm_readv(pid, &local_iov, 1, &remote_iov, 1, 0) == (ssize_t)len) {
    324         return len;
    325     }
    326     // Debug if failed since it shouldn't happen very often
    327     PLOG_D("process_vm_readv() failed");
    328 
    329     /*
    330      * Ok, let's do it via ptrace() then.
    331      * len must be aligned to the sizeof(long)
    332      */
    333     int cnt = len / sizeof(long);
    334     size_t memsz = 0;
    335 
    336     for (int x = 0; x < cnt; x++) {
    337         uint8_t* addr = (uint8_t*)(uintptr_t)pc + (int)(x * sizeof(long));
    338         long ret = ptrace(PTRACE_PEEKDATA, pid, addr, NULL);
    339 
    340         if (errno != 0) {
    341             PLOG_W("Couldn't PT_READ_D on pid %d, addr: %p", pid, addr);
    342             break;
    343         }
    344 
    345         memsz += sizeof(long);
    346         memcpy(&buf[x * sizeof(long)], &ret, sizeof(long));
    347     }
    348     return memsz;
    349 }
    350 
    351 static size_t arch_getPC(pid_t pid, REG_TYPE* pc, REG_TYPE* status_reg UNUSED) {
    352 /*
    353  * Some old ARM android kernels are failing with PTRACE_GETREGS to extract
    354  * the correct register values if struct size is bigger than expected. As such the
    355  * 32/64-bit multiplexing trick is not working for them in case PTRACE_GETREGSET
    356  * fails or is not implemented. To cover such cases we explicitly define
    357  * the struct size to 32bit version for arm CPU.
    358  */
    359 #if defined(__arm__)
    360     struct user_regs_struct_32 regs;
    361 #else
    362     HEADERS_STRUCT regs;
    363 #endif
    364     struct iovec pt_iov = {
    365         .iov_base = &regs,
    366         .iov_len = sizeof(regs),
    367     };
    368 
    369     if (ptrace(PTRACE_GETREGSET, pid, NT_PRSTATUS, &pt_iov) == -1L) {
    370         PLOG_D("ptrace(PTRACE_GETREGSET) failed");
    371 
    372 // If PTRACE_GETREGSET fails, try PTRACE_GETREGS if available
    373 #if PTRACE_GETREGS_AVAILABLE
    374         if (ptrace(PTRACE_GETREGS, pid, 0, &regs)) {
    375             PLOG_D("ptrace(PTRACE_GETREGS) failed");
    376             LOG_W("ptrace PTRACE_GETREGSET & PTRACE_GETREGS failed to extract target registers");
    377             return 0;
    378         }
    379 #else
    380         return 0;
    381 #endif
    382     }
    383 #if defined(__i386__) || defined(__x86_64__)
    384     /*
    385      * 32-bit
    386      */
    387     if (pt_iov.iov_len == sizeof(struct user_regs_struct_32)) {
    388         struct user_regs_struct_32* r32 = (struct user_regs_struct_32*)&regs;
    389         *pc = r32->eip;
    390         *status_reg = r32->eflags;
    391         return pt_iov.iov_len;
    392     }
    393 
    394     /*
    395      * 64-bit
    396      */
    397     if (pt_iov.iov_len == sizeof(struct user_regs_struct_64)) {
    398         struct user_regs_struct_64* r64 = (struct user_regs_struct_64*)&regs;
    399         *pc = r64->ip;
    400         *status_reg = r64->flags;
    401         return pt_iov.iov_len;
    402     }
    403     LOG_W("Unknown registers structure size: '%zd'", pt_iov.iov_len);
    404     return 0;
    405 #endif /* defined(__i386__) || defined(__x86_64__) */
    406 
    407 #if defined(__arm__) || defined(__aarch64__)
    408     /*
    409      * 32-bit
    410      */
    411     if (pt_iov.iov_len == sizeof(struct user_regs_struct_32)) {
    412         struct user_regs_struct_32* r32 = (struct user_regs_struct_32*)&regs;
    413 #ifdef __ANDROID__
    414         *pc = r32->ARM_pc;
    415         *status_reg = r32->ARM_cpsr;
    416 #else
    417         *pc = r32->uregs[ARM_pc];
    418         *status_reg = r32->uregs[ARM_cpsr];
    419 #endif
    420         return pt_iov.iov_len;
    421     }
    422 
    423     /*
    424      * 64-bit
    425      */
    426     if (pt_iov.iov_len == sizeof(struct user_regs_struct_64)) {
    427         struct user_regs_struct_64* r64 = (struct user_regs_struct_64*)&regs;
    428         *pc = r64->pc;
    429         *status_reg = r64->pstate;
    430         return pt_iov.iov_len;
    431     }
    432     LOG_W("Unknown registers structure size: '%zd'", pt_iov.iov_len);
    433     return 0;
    434 #endif /* defined(__arm__) || defined(__aarch64__) */
    435 
    436 #if defined(__powerpc64__) || defined(__powerpc__)
    437     /*
    438      * 32-bit
    439      */
    440     if (pt_iov.iov_len == sizeof(struct user_regs_struct_32)) {
    441         struct user_regs_struct_32* r32 = (struct user_regs_struct_32*)&regs;
    442         *pc = r32->nip;
    443         return pt_iov.iov_len;
    444     }
    445 
    446     /*
    447      * 64-bit
    448      */
    449     if (pt_iov.iov_len == sizeof(struct user_regs_struct_64)) {
    450         struct user_regs_struct_64* r64 = (struct user_regs_struct_64*)&regs;
    451         *pc = r64->nip;
    452         return pt_iov.iov_len;
    453     }
    454 
    455     LOG_W("Unknown registers structure size: '%zd'", pt_iov.iov_len);
    456     return 0;
    457 #endif /* defined(__powerpc64__) || defined(__powerpc__) */
    458 
    459 #if defined(__mips__) || defined(__mips64__)
    460     *pc = regs.cp0_epc;
    461     return pt_iov.iov_len;
    462 #endif /* defined(__mips__) || defined(__mips64__) */
    463 
    464     LOG_D("Unknown/unsupported CPU architecture");
    465     return 0;
    466 }
    467 
    468 static void arch_getInstrStr(pid_t pid, REG_TYPE* pc, char* instr) {
    469     /*
    470      * We need a value aligned to 8
    471      * which is sizeof(long) on 64bit CPU archs (on most of them, I hope;)
    472      */
    473     uint8_t buf[MAX_INSTR_SZ];
    474     size_t memsz;
    475     REG_TYPE status_reg = 0;
    476 
    477     snprintf(instr, _HF_INSTR_SZ, "%s", "[UNKNOWN]");
    478 
    479     size_t pcRegSz = arch_getPC(pid, pc, &status_reg);
    480     if (!pcRegSz) {
    481         LOG_W("Current architecture not supported for disassembly");
    482         return;
    483     }
    484 
    485     if ((memsz = arch_getProcMem(pid, buf, sizeof(buf), *pc)) == 0) {
    486         snprintf(instr, _HF_INSTR_SZ, "%s", "[NOT_MMAPED]");
    487         return;
    488     }
    489 #if !defined(__ANDROID__)
    490     arch_bfdDisasm(pid, buf, memsz, instr);
    491 #else
    492     cs_arch arch;
    493     cs_mode mode;
    494 #if defined(__arm__) || defined(__aarch64__)
    495     arch = (pcRegSz == sizeof(struct user_regs_struct_64)) ? CS_ARCH_ARM64 : CS_ARCH_ARM;
    496     if (arch == CS_ARCH_ARM) {
    497         mode = (status_reg & 0x20) ? CS_MODE_THUMB : CS_MODE_ARM;
    498     } else {
    499         mode = CS_MODE_ARM;
    500     }
    501 #elif defined(__i386__) || defined(__x86_64__)
    502     arch = CS_ARCH_X86;
    503     mode = (pcRegSz == sizeof(struct user_regs_struct_64)) ? CS_MODE_64 : CS_MODE_32;
    504 #else
    505     LOG_E("Unknown/Unsupported Android CPU architecture");
    506 #endif
    507 
    508     csh handle;
    509     cs_err err = cs_open(arch, mode, &handle);
    510     if (err != CS_ERR_OK) {
    511         LOG_W("Capstone initialization failed: '%s'", cs_strerror(err));
    512         return;
    513     }
    514 
    515     cs_insn* insn;
    516     size_t count = cs_disasm(handle, buf, sizeof(buf), *pc, 0, &insn);
    517 
    518     if (count < 1) {
    519         LOG_W("Couldn't disassemble the assembler instructions' stream: '%s'",
    520             cs_strerror(cs_errno(handle)));
    521         cs_close(&handle);
    522         return;
    523     }
    524 
    525     snprintf(instr, _HF_INSTR_SZ, "%s %s", insn[0].mnemonic, insn[0].op_str);
    526     cs_free(insn, count);
    527     cs_close(&handle);
    528 #endif /* defined(__ANDROID__) */
    529 
    530     for (int x = 0; instr[x] && x < _HF_INSTR_SZ; x++) {
    531         if (instr[x] == '/' || instr[x] == '\\' || isspace(instr[x]) || !isprint(instr[x])) {
    532             instr[x] = '_';
    533         }
    534     }
    535 
    536     return;
    537 }
    538 
    539 static void arch_hashCallstack(run_t* run, funcs_t* funcs, size_t funcCnt, bool enableMasking) {
    540     uint64_t hash = 0;
    541     for (size_t i = 0; i < funcCnt && i < run->global->linux.numMajorFrames; i++) {
    542         /*
    543          * Convert PC to char array to be compatible with hash function
    544          */
    545         char pcStr[REGSIZEINCHAR] = {0};
    546         snprintf(pcStr, REGSIZEINCHAR, REG_PD REG_PM, (REG_TYPE)(long)funcs[i].pc);
    547 
    548         /*
    549          * Hash the last three nibbles
    550          */
    551         hash ^= util_hash(&pcStr[strlen(pcStr) - 3], 3);
    552     }
    553 
    554     /*
    555      * If only one frame, hash is not safe to be used for uniqueness. We mask it
    556      * here with a constant prefix, so analyzers can pick it up and create filenames
    557      * accordingly. 'enableMasking' is controlling masking for cases where it should
    558      * not be enabled (e.g. fuzzer worker is from verifier).
    559      */
    560     if (enableMasking && funcCnt == 1) {
    561         hash |= _HF_SINGLE_FRAME_MASK;
    562     }
    563     run->backtrace = hash;
    564 }
    565 
    566 static void arch_traceGenerateReport(
    567     pid_t pid, run_t* run, funcs_t* funcs, size_t funcCnt, siginfo_t* si, const char* instr) {
    568     run->report[0] = '\0';
    569     util_ssnprintf(run->report, sizeof(run->report), "ORIG_FNAME: %s\n", run->origFileName);
    570     util_ssnprintf(run->report, sizeof(run->report), "FUZZ_FNAME: %s\n", run->crashFileName);
    571     util_ssnprintf(run->report, sizeof(run->report), "PID: %d\n", pid);
    572     util_ssnprintf(run->report, sizeof(run->report), "SIGNAL: %s (%d)\n",
    573         arch_sigName(si->si_signo), si->si_signo);
    574     util_ssnprintf(run->report, sizeof(run->report), "FAULT ADDRESS: %p\n",
    575         SI_FROMUSER(si) ? NULL : si->si_addr);
    576     util_ssnprintf(run->report, sizeof(run->report), "INSTRUCTION: %s\n", instr);
    577     util_ssnprintf(run->report, sizeof(run->report), "STACK HASH: %016llx\n", run->backtrace);
    578     util_ssnprintf(run->report, sizeof(run->report), "STACK:\n");
    579     for (size_t i = 0; i < funcCnt; i++) {
    580 #ifdef __HF_USE_CAPSTONE__
    581         util_ssnprintf(
    582             run->report, sizeof(run->report), " <" REG_PD REG_PM "> ", (REG_TYPE)(long)funcs[i].pc);
    583         if (funcs[i].func[0] != '\0')
    584             util_ssnprintf(run->report, sizeof(run->report), "[%s() + 0x%x at %s]\n", funcs[i].func,
    585                 funcs[i].line, funcs[i].mapName);
    586         else
    587             util_ssnprintf(run->report, sizeof(run->report), "[]\n");
    588 #else
    589         util_ssnprintf(run->report, sizeof(run->report), " <" REG_PD REG_PM "> [%s():%u at %s]\n",
    590             (REG_TYPE)(long)funcs[i].pc, funcs[i].func, funcs[i].line, funcs[i].mapName);
    591 #endif
    592     }
    593 
    594 // libunwind is not working for 32bit targets in 64bit systems
    595 #if defined(__aarch64__)
    596     if (funcCnt == 0) {
    597         util_ssnprintf(run->report, sizeof(run->report),
    598             " !ERROR: If 32bit fuzz target"
    599             " in aarch64 system, try ARM 32bit build\n");
    600     }
    601 #endif
    602 
    603     return;
    604 }
    605 
    606 static void arch_traceAnalyzeData(run_t* run, pid_t pid) {
    607     REG_TYPE pc = 0, status_reg = 0;
    608     size_t pcRegSz = arch_getPC(pid, &pc, &status_reg);
    609     if (!pcRegSz) {
    610         LOG_W("ptrace arch_getPC failed");
    611         return;
    612     }
    613 
    614     /*
    615      * Unwind and resolve symbols
    616      */
    617     funcs_t* funcs = util_Malloc(_HF_MAX_FUNCS * sizeof(funcs_t));
    618     defer { free(funcs); };
    619     memset(funcs, 0, _HF_MAX_FUNCS * sizeof(funcs_t));
    620 
    621 #if !defined(__ANDROID__)
    622     size_t funcCnt = arch_unwindStack(pid, funcs);
    623     arch_bfdResolveSyms(pid, funcs, funcCnt);
    624 #else
    625     size_t funcCnt = arch_unwindStack(pid, funcs);
    626 #endif
    627 
    628     /*
    629      * If unwinder failed (zero frames), use PC from ptrace GETREGS if not zero.
    630      * If PC reg zero return and callers should handle zero hash case.
    631      */
    632     if (funcCnt == 0) {
    633         if (pc) {
    634             /* Manually update major frame PC & frames counter */
    635             funcs[0].pc = (void*)(uintptr_t)pc;
    636             funcCnt = 1;
    637         } else {
    638             return;
    639         }
    640     }
    641 
    642     /*
    643      * Calculate backtrace callstack hash signature
    644      */
    645     arch_hashCallstack(run, funcs, funcCnt, false);
    646 }
    647 
    648 static void arch_traceSaveData(run_t* run, pid_t pid) {
    649     REG_TYPE pc = 0;
    650 
    651     /* Local copy since flag is overridden for some crashes */
    652     bool saveUnique = run->global->io.saveUnique;
    653 
    654     char instr[_HF_INSTR_SZ] = "\x00";
    655     siginfo_t si;
    656     bzero(&si, sizeof(si));
    657 
    658     if (ptrace(PTRACE_GETSIGINFO, pid, 0, &si) == -1) {
    659         PLOG_W("Couldn't get siginfo for pid %d", pid);
    660     }
    661 
    662     arch_getInstrStr(pid, &pc, instr);
    663 
    664     LOG_D("Pid: %d, signo: %d, errno: %d, code: %d, addr: %p, pc: %" REG_PM ", instr: '%s'", pid,
    665         si.si_signo, si.si_errno, si.si_code, si.si_addr, pc, instr);
    666 
    667     if (!SI_FROMUSER(&si) && pc && si.si_addr < run->global->linux.ignoreAddr) {
    668         LOG_I("'%s' is interesting (%s), but the si.si_addr is %p (below %p), skipping",
    669             run->fileName, arch_sigName(si.si_signo), si.si_addr, run->global->linux.ignoreAddr);
    670         return;
    671     }
    672 
    673     /*
    674      * Unwind and resolve symbols
    675      */
    676     funcs_t* funcs = util_Malloc(_HF_MAX_FUNCS * sizeof(funcs_t));
    677     defer { free(funcs); };
    678     memset(funcs, 0, _HF_MAX_FUNCS * sizeof(funcs_t));
    679 
    680 #if !defined(__ANDROID__)
    681     size_t funcCnt = arch_unwindStack(pid, funcs);
    682     arch_bfdResolveSyms(pid, funcs, funcCnt);
    683 #else
    684     size_t funcCnt = arch_unwindStack(pid, funcs);
    685 #endif
    686 
    687     /*
    688      * If unwinder failed (zero frames), use PC from ptrace GETREGS if not zero.
    689      * If PC reg zero, temporarily disable uniqueness flag since callstack
    690      * hash will be also zero, thus not safe for unique decisions.
    691      */
    692     if (funcCnt == 0) {
    693         if (pc) {
    694             /* Manually update major frame PC & frames counter */
    695             funcs[0].pc = (void*)(uintptr_t)pc;
    696             funcCnt = 1;
    697         } else {
    698             saveUnique = false;
    699         }
    700     }
    701 
    702     /*
    703      * Temp local copy of previous backtrace value in case worker hit crashes into multiple
    704      * tids for same target master thread. Will be 0 for first crash against target.
    705      */
    706     uint64_t oldBacktrace = run->backtrace;
    707 
    708     /*
    709      * Calculate backtrace callstack hash signature
    710      */
    711     arch_hashCallstack(run, funcs, funcCnt, saveUnique);
    712 
    713     /*
    714      * If fuzzing with sanitizer coverage feedback increase crashes counter used
    715      * as metric for dynFile evolution
    716      */
    717     if (run->global->useSanCov) {
    718         run->sanCovCnts.crashesCnt++;
    719     }
    720 
    721     /*
    722      * If unique flag is set and single frame crash, disable uniqueness for this crash
    723      * to always save (timestamp will be added to the filename)
    724      */
    725     if (saveUnique && (funcCnt == 1)) {
    726         saveUnique = false;
    727     }
    728 
    729     /*
    730      * If worker crashFileName member is set, it means that a tid has already crashed
    731      * from target master thread.
    732      */
    733     if (run->crashFileName[0] != '\0') {
    734         LOG_D("Multiple crashes detected from worker against attached tids group");
    735 
    736         /*
    737          * If stackhashes match, don't re-analyze. This will avoid duplicates
    738          * and prevent verifier from running multiple passes. Depth of check is
    739          * always 1 (last backtrace saved only per target iteration).
    740          */
    741         if (oldBacktrace == run->backtrace) {
    742             return;
    743         }
    744     }
    745 
    746     /* Increase global crashes counter */
    747     ATOMIC_POST_INC(run->global->cnts.crashesCnt);
    748 
    749     /*
    750      * Check if backtrace contains whitelisted symbol. Whitelist overrides
    751      * both stackhash and symbol blacklist. Crash is always kept regardless
    752      * of the status of uniqueness flag.
    753      */
    754     if (run->global->linux.symsWl) {
    755         char* wlSymbol = arch_btContainsSymbol(
    756             run->global->linux.symsWlCnt, run->global->linux.symsWl, funcCnt, funcs);
    757         if (wlSymbol != NULL) {
    758             saveUnique = false;
    759             LOG_D("Whitelisted symbol '%s' found, skipping blacklist checks", wlSymbol);
    760         }
    761     } else {
    762         /*
    763          * Check if stackhash is blacklisted
    764          */
    765         if (run->global->blacklist && (fastArray64Search(run->global->blacklist,
    766                                            run->global->blacklistCnt, run->backtrace) != -1)) {
    767             LOG_I("Blacklisted stack hash '%" PRIx64 "', skipping", run->backtrace);
    768             ATOMIC_POST_INC(run->global->cnts.blCrashesCnt);
    769             return;
    770         }
    771 
    772         /*
    773          * Check if backtrace contains blacklisted symbol
    774          */
    775         char* blSymbol = arch_btContainsSymbol(
    776             run->global->linux.symsBlCnt, run->global->linux.symsBl, funcCnt, funcs);
    777         if (blSymbol != NULL) {
    778             LOG_I("Blacklisted symbol '%s' found, skipping", blSymbol);
    779             ATOMIC_POST_INC(run->global->cnts.blCrashesCnt);
    780             return;
    781         }
    782     }
    783 
    784     /* If non-blacklisted crash detected, zero set two MSB */
    785     ATOMIC_POST_ADD(run->global->dynFileIterExpire, _HF_DYNFILE_SUB_MASK);
    786 
    787     void* sig_addr = si.si_addr;
    788     if (run->global->linux.disableRandomization == false) {
    789         pc = 0UL;
    790         sig_addr = NULL;
    791     }
    792 
    793     /* User-induced signals don't set si.si_addr */
    794     if (SI_FROMUSER(&si)) {
    795         sig_addr = NULL;
    796     }
    797 
    798     /* If dry run mode, copy file with same name into workspace */
    799     if (run->global->mutationsPerRun == 0U && run->global->useVerifier) {
    800         snprintf(run->crashFileName, sizeof(run->crashFileName), "%s/%s", run->global->io.crashDir,
    801             run->origFileName);
    802     } else if (saveUnique) {
    803         snprintf(run->crashFileName, sizeof(run->crashFileName),
    804             "%s/%s.PC.%" REG_PM ".STACK.%" PRIx64 ".CODE.%d.ADDR.%p.INSTR.%s.%s",
    805             run->global->io.crashDir, arch_sigName(si.si_signo), pc, run->backtrace, si.si_code,
    806             sig_addr, instr, run->global->io.fileExtn);
    807     } else {
    808         char localtmstr[PATH_MAX];
    809         util_getLocalTime("%F.%H:%M:%S", localtmstr, sizeof(localtmstr), time(NULL));
    810         snprintf(run->crashFileName, sizeof(run->crashFileName),
    811             "%s/%s.PC.%" REG_PM ".STACK.%" PRIx64 ".CODE.%d.ADDR.%p.INSTR.%s.%s.%d.%s",
    812             run->global->io.crashDir, arch_sigName(si.si_signo), pc, run->backtrace, si.si_code,
    813             sig_addr, instr, localtmstr, pid, run->global->io.fileExtn);
    814     }
    815 
    816     if (files_exists(run->crashFileName)) {
    817         LOG_I("It seems that '%s' already exists, skipping", run->crashFileName);
    818         // Clear filename so that verifier can understand we hit a duplicate
    819         memset(run->crashFileName, 0, sizeof(run->crashFileName));
    820         return;
    821     }
    822 
    823     if (files_writeBufToFile(run->crashFileName, run->dynamicFile, run->dynamicFileSz,
    824             O_CREAT | O_EXCL | O_WRONLY | O_CLOEXEC) == false) {
    825         LOG_E("Couldn't copy '%s' to '%s'", run->fileName, run->crashFileName);
    826         return;
    827     }
    828 
    829     LOG_I("Ok, that's interesting, saved '%s' as '%s'", run->fileName, run->crashFileName);
    830 
    831     ATOMIC_POST_INC(run->global->cnts.uniqueCrashesCnt);
    832     /* If unique crash found, reset dynFile counter */
    833     ATOMIC_CLEAR(run->global->dynFileIterExpire);
    834 
    835     arch_traceGenerateReport(pid, run, funcs, funcCnt, &si, instr);
    836 }
    837 
    838 /* TODO: Add report parsing support for other sanitizers too */
    839 static int arch_parseAsanReport(
    840     run_t* run, pid_t pid, funcs_t* funcs, void** crashAddr, char** op) {
    841     char crashReport[PATH_MAX] = {0};
    842     const char* const crashReportCpy = crashReport;
    843     snprintf(
    844         crashReport, sizeof(crashReport), "%s/%s.%d", run->global->io.workDir, kLOGPREFIX, pid);
    845 
    846     FILE* fReport = fopen(crashReport, "rb");
    847     if (fReport == NULL) {
    848         PLOG_D("Couldn't open '%s' - R/O mode", crashReport);
    849         return -1;
    850     }
    851     defer { fclose(fReport); };
    852     defer { unlink(crashReportCpy); };
    853 
    854     char header[35] = {0};
    855     snprintf(header, sizeof(header), "==%d==ERROR: AddressSanitizer:", pid);
    856     size_t headerSz = strlen(header);
    857     bool headerFound = false;
    858 
    859     uint8_t frameIdx = 0;
    860     char framePrefix[5] = {0};
    861     snprintf(framePrefix, sizeof(framePrefix), "#%" PRIu8, frameIdx);
    862 
    863     char *lineptr = NULL, *cAddr = NULL;
    864     size_t n = 0;
    865     defer { free(lineptr); };
    866     for (;;) {
    867         if (getline(&lineptr, &n, fReport) == -1) {
    868             break;
    869         }
    870 
    871         /* First step is to identify header */
    872         if (headerFound == false) {
    873             if ((strlen(lineptr) > headerSz) && (strncmp(header, lineptr, headerSz) == 0)) {
    874                 headerFound = true;
    875 
    876                 /* Parse crash address */
    877                 cAddr = strstr(lineptr, "address 0x");
    878                 if (cAddr) {
    879                     cAddr = cAddr + strlen("address ");
    880                     char* endOff = strchr(cAddr, ' ');
    881                     cAddr[endOff - cAddr] = '\0';
    882                     *crashAddr = (void*)((size_t)strtoull(cAddr, NULL, 16));
    883                 } else {
    884                     *crashAddr = 0x0;
    885                 }
    886             }
    887             continue;
    888         } else {
    889             char* pLineLC = lineptr;
    890             /* Trim leading spaces */
    891             while (*pLineLC != '\0' && isspace(*pLineLC)) {
    892                 ++pLineLC;
    893             }
    894 
    895             /* End separator for crash thread stack trace is an empty line */
    896             if ((*pLineLC == '\0') && (frameIdx != 0)) {
    897                 break;
    898             }
    899 
    900             /* Basic length checks */
    901             if (strlen(pLineLC) < 10) {
    902                 continue;
    903             }
    904 
    905             /* If available parse the type of error (READ/WRITE) */
    906             if (cAddr && strstr(pLineLC, cAddr)) {
    907                 if (strncmp(pLineLC, "READ", 4) == 0) {
    908                     *op = "READ";
    909                 } else if (strncmp(pLineLC, "WRITE", 5) == 0) {
    910                     *op = "WRITE";
    911                 }
    912                 cAddr = NULL;
    913             }
    914 
    915             /* Check for crash thread frames */
    916             if (strncmp(pLineLC, framePrefix, strlen(framePrefix)) == 0) {
    917                 /* Abort if max depth */
    918                 if (frameIdx >= _HF_MAX_FUNCS) {
    919                     break;
    920                 }
    921 
    922                 /*
    923                  * Frames have following format:
    924                  #0 0xaa860177  (/system/lib/libc.so+0x196177)
    925                  */
    926                 char* savePtr = NULL;
    927                 strtok_r(pLineLC, " ", &savePtr);
    928                 funcs[frameIdx].pc =
    929                     (void*)((size_t)strtoull(strtok_r(NULL, " ", &savePtr), NULL, 16));
    930 
    931                 /* DSO & code offset parsing */
    932                 char* targetStr = strtok_r(NULL, " ", &savePtr);
    933                 char* startOff = strchr(targetStr, '(') + 1;
    934                 char* plusOff = strchr(targetStr, '+');
    935                 char* endOff = strrchr(targetStr, ')');
    936                 targetStr[endOff - startOff] = '\0';
    937                 if ((startOff == NULL) || (endOff == NULL) || (plusOff == NULL)) {
    938                     LOG_D("Invalid ASan report entry (%s)", lineptr);
    939                 } else {
    940                     size_t dsoSz =
    941                         MIN(sizeof(funcs[frameIdx].mapName), (size_t)(plusOff - startOff));
    942                     memcpy(funcs[frameIdx].mapName, startOff, dsoSz);
    943                     char* codeOff = targetStr + (plusOff - startOff) + 1;
    944                     funcs[frameIdx].line = strtoull(codeOff, NULL, 16);
    945                 }
    946 
    947                 frameIdx++;
    948                 snprintf(framePrefix, sizeof(framePrefix), "#%" PRIu8, frameIdx);
    949             }
    950         }
    951     }
    952 
    953     return frameIdx;
    954 }
    955 
    956 /*
    957  * Special book keeping for cases where crashes are detected based on exitcode and not
    958  * a raised signal. Such case is the ASan fuzzing for Android. Crash file name maintains
    959  * the same format for compatibility with post campaign tools.
    960  */
    961 static void arch_traceExitSaveData(run_t* run, pid_t pid) {
    962     REG_TYPE pc = 0;
    963     void* crashAddr = 0;
    964     char* op = "UNKNOWN";
    965     pid_t targetPid = (run->global->linux.pid > 0) ? run->global->linux.pid : run->pid;
    966 
    967     /* Save only the first hit for each worker */
    968     if (run->crashFileName[0] != '\0') {
    969         return;
    970     }
    971 
    972     /* Increase global crashes counter */
    973     ATOMIC_POST_INC(run->global->cnts.crashesCnt);
    974     ATOMIC_POST_AND(run->global->dynFileIterExpire, _HF_DYNFILE_SUB_MASK);
    975 
    976     /*
    977      * If fuzzing with sanitizer coverage feedback increase crashes counter used
    978      * as metric for dynFile evolution
    979      */
    980     if (run->global->useSanCov) {
    981         run->sanCovCnts.crashesCnt++;
    982     }
    983 
    984     /* If sanitizer produces reports with stack traces (e.g. ASan), they're parsed manually */
    985     int funcCnt = 0;
    986     funcs_t* funcs = util_Malloc(_HF_MAX_FUNCS * sizeof(funcs_t));
    987     defer { free(funcs); };
    988     memset(funcs, 0, _HF_MAX_FUNCS * sizeof(funcs_t));
    989 
    990     /* Sanitizers save reports against parent PID */
    991     if (targetPid != pid) {
    992         return;
    993     }
    994     funcCnt = arch_parseAsanReport(run, pid, funcs, &crashAddr, &op);
    995 
    996     /*
    997      * -1 error indicates a file not found for report. This is expected to happen often since
    998      * ASan report is generated once for crashing TID. Ptrace arch is not guaranteed to parse
    999      * that TID first. Not setting the 'crashFileName' variable will ensure that this branch
   1000      * is executed again for all TIDs until the matching report is found
   1001      */
   1002     if (funcCnt == -1) {
   1003         return;
   1004     }
   1005 
   1006     /* Since crash address is available, apply ignoreAddr filters */
   1007     if (crashAddr < run->global->linux.ignoreAddr) {
   1008         LOG_I("'%s' is interesting, but the crash addr is %p (below %p), skipping", run->fileName,
   1009             crashAddr, run->global->linux.ignoreAddr);
   1010         return;
   1011     }
   1012 
   1013     /* If frames successfully recovered, calculate stack hash & populate crash PC */
   1014     arch_hashCallstack(run, funcs, funcCnt, false);
   1015     pc = (uintptr_t)funcs[0].pc;
   1016 
   1017     /*
   1018      * Check if stackhash is blacklisted
   1019      */
   1020     if (run->global->blacklist && (fastArray64Search(run->global->blacklist,
   1021                                        run->global->blacklistCnt, run->backtrace) != -1)) {
   1022         LOG_I("Blacklisted stack hash '%" PRIx64 "', skipping", run->backtrace);
   1023         ATOMIC_POST_INC(run->global->cnts.blCrashesCnt);
   1024         return;
   1025     }
   1026 
   1027     /* If dry run mode, copy file with same name into workspace */
   1028     if (run->global->mutationsPerRun == 0U && run->global->useVerifier) {
   1029         snprintf(run->crashFileName, sizeof(run->crashFileName), "%s/%s", run->global->io.crashDir,
   1030             run->origFileName);
   1031     } else {
   1032         /* Keep the crashes file name format identical */
   1033         if (run->backtrace != 0ULL && run->global->io.saveUnique) {
   1034             snprintf(run->crashFileName, sizeof(run->crashFileName),
   1035                 "%s/%s.PC.%" REG_PM ".STACK.%" PRIx64 ".CODE.%s.ADDR.%p.INSTR.%s.%s",
   1036                 run->global->io.crashDir, "SAN", pc, run->backtrace, op, crashAddr, "[UNKNOWN]",
   1037                 run->global->io.fileExtn);
   1038         } else {
   1039             /* If no stack hash available, all crashes treated as unique */
   1040             char localtmstr[PATH_MAX];
   1041             util_getLocalTime("%F.%H:%M:%S", localtmstr, sizeof(localtmstr), time(NULL));
   1042             snprintf(run->crashFileName, sizeof(run->crashFileName),
   1043                 "%s/%s.PC.%" REG_PM ".STACK.%" PRIx64 ".CODE.%s.ADDR.%p.INSTR.%s.%s.%s",
   1044                 run->global->io.crashDir, "SAN", pc, run->backtrace, op, crashAddr, "[UNKNOWN]",
   1045                 localtmstr, run->global->io.fileExtn);
   1046         }
   1047     }
   1048 
   1049     bool dstFileExists = false;
   1050     if (files_copyFile(run->fileName, run->crashFileName, &dstFileExists, true /* try_link */)) {
   1051         LOG_I("Ok, that's interesting, saved '%s' as '%s'", run->fileName, run->crashFileName);
   1052 
   1053         /* Increase unique crashes counters */
   1054         ATOMIC_POST_INC(run->global->cnts.uniqueCrashesCnt);
   1055         ATOMIC_CLEAR(run->global->dynFileIterExpire);
   1056     } else {
   1057         if (dstFileExists) {
   1058             LOG_I("It seems that '%s' already exists, skipping", run->crashFileName);
   1059 
   1060             /* Clear stack hash so that verifier can understand we hit a duplicate */
   1061             run->backtrace = 0ULL;
   1062         } else {
   1063             LOG_E("Couldn't copy '%s' to '%s'", run->fileName, run->crashFileName);
   1064 
   1065             /* In case of write error, clear crashFileName to so that other monitored TIDs can retry
   1066              */
   1067             memset(run->crashFileName, 0, sizeof(run->crashFileName));
   1068         }
   1069 
   1070         /* Don't bother generating reports for duplicate or non-saved crashes */
   1071         return;
   1072     }
   1073 
   1074     /* Generate report */
   1075     run->report[0] = '\0';
   1076     util_ssnprintf(run->report, sizeof(run->report), "EXIT_CODE: %s\n", HF_SAN_EXIT_CODE);
   1077     util_ssnprintf(run->report, sizeof(run->report), "ORIG_FNAME: %s\n", run->origFileName);
   1078     util_ssnprintf(run->report, sizeof(run->report), "FUZZ_FNAME: %s\n", run->crashFileName);
   1079     util_ssnprintf(run->report, sizeof(run->report), "PID: %d\n", pid);
   1080     util_ssnprintf(run->report, sizeof(run->report), "OPERATION: %s\n", op);
   1081     util_ssnprintf(run->report, sizeof(run->report), "FAULT ADDRESS: %p\n", crashAddr);
   1082     if (funcCnt > 0) {
   1083         util_ssnprintf(run->report, sizeof(run->report), "STACK HASH: %016llx\n", run->backtrace);
   1084         util_ssnprintf(run->report, sizeof(run->report), "STACK:\n");
   1085         for (int i = 0; i < funcCnt; i++) {
   1086             util_ssnprintf(run->report, sizeof(run->report), " <" REG_PD REG_PM "> ",
   1087                 (REG_TYPE)(long)funcs[i].pc);
   1088             if (funcs[i].mapName[0] != '\0') {
   1089                 util_ssnprintf(run->report, sizeof(run->report), "[%s + 0x%x]\n", funcs[i].mapName,
   1090                     funcs[i].line);
   1091             } else {
   1092                 util_ssnprintf(run->report, sizeof(run->report), "[]\n");
   1093             }
   1094         }
   1095     }
   1096 }
   1097 
   1098 static void arch_traceExitAnalyzeData(run_t* run, pid_t pid) {
   1099     void* crashAddr = 0;
   1100     char* op = "UNKNOWN";
   1101     int funcCnt = 0;
   1102     funcs_t* funcs = util_Malloc(_HF_MAX_FUNCS * sizeof(funcs_t));
   1103     defer { free(funcs); };
   1104     memset(funcs, 0, _HF_MAX_FUNCS * sizeof(funcs_t));
   1105 
   1106     funcCnt = arch_parseAsanReport(run, pid, funcs, &crashAddr, &op);
   1107 
   1108     /*
   1109      * -1 error indicates a file not found for report. This is expected to happen often since
   1110      * ASan report is generated once for crashing TID. Ptrace arch is not guaranteed to parse
   1111      * that TID first. Not setting the 'crashFileName' variable will ensure that this branch
   1112      * is executed again for all TIDs until the matching report is found
   1113      */
   1114     if (funcCnt == -1) {
   1115         return;
   1116     }
   1117 
   1118     /* If frames successfully recovered, calculate stack hash & populate crash PC */
   1119     arch_hashCallstack(run, funcs, funcCnt, false);
   1120 }
   1121 
   1122 void arch_traceExitAnalyze(run_t* run, pid_t pid) {
   1123     if (run->mainWorker) {
   1124         /* Main fuzzing threads */
   1125         arch_traceExitSaveData(run, pid);
   1126     } else {
   1127         /* Post crash analysis (e.g. crashes verifier) */
   1128         arch_traceExitAnalyzeData(run, pid);
   1129     }
   1130 }
   1131 
   1132 #define __WEVENT(status) ((status & 0xFF0000) >> 16)
   1133 static void arch_traceEvent(run_t* run, int status, pid_t pid) {
   1134     LOG_D("PID: %d, Ptrace event: %d", pid, __WEVENT(status));
   1135     switch (__WEVENT(status)) {
   1136         case PTRACE_EVENT_EXIT: {
   1137             unsigned long event_msg;
   1138             if (ptrace(PTRACE_GETEVENTMSG, pid, NULL, &event_msg) == -1) {
   1139                 PLOG_E("ptrace(PTRACE_GETEVENTMSG,%d) failed", pid);
   1140                 return;
   1141             }
   1142 
   1143             if (WIFEXITED(event_msg)) {
   1144                 LOG_D("PID: %d exited with exit_code: %lu", pid,
   1145                     (unsigned long)WEXITSTATUS(event_msg));
   1146                 if (WEXITSTATUS(event_msg) == (unsigned long)HF_SAN_EXIT_CODE) {
   1147                     arch_traceExitAnalyze(run, pid);
   1148                 }
   1149             } else if (WIFSIGNALED(event_msg)) {
   1150                 LOG_D(
   1151                     "PID: %d terminated with signal: %lu", pid, (unsigned long)WTERMSIG(event_msg));
   1152             } else {
   1153                 LOG_D("PID: %d exited with unknown status: %lu", pid, event_msg);
   1154             }
   1155         } break;
   1156         default:
   1157             break;
   1158     }
   1159 
   1160     ptrace(PTRACE_CONT, pid, 0, 0);
   1161 }
   1162 
   1163 void arch_traceAnalyze(run_t* run, int status, pid_t pid) {
   1164     /*
   1165      * It's a ptrace event, deal with it elsewhere
   1166      */
   1167     if (WIFSTOPPED(status) && __WEVENT(status)) {
   1168         return arch_traceEvent(run, status, pid);
   1169     }
   1170 
   1171     if (WIFSTOPPED(status)) {
   1172         /*
   1173          * If it's an interesting signal, save the testcase
   1174          */
   1175         if (arch_sigs[WSTOPSIG(status)].important) {
   1176             /*
   1177              * If fuzzer worker is from core fuzzing process run full
   1178              * analysis. Otherwise just unwind and get stack hash signature.
   1179              */
   1180             if (run->mainWorker) {
   1181                 arch_traceSaveData(run, pid);
   1182             } else {
   1183                 arch_traceAnalyzeData(run, pid);
   1184             }
   1185         }
   1186         /* Do not deliver SIGSTOP, as we don't support PTRACE_LISTEN anyway */
   1187         int sig = (WSTOPSIG(status) != SIGSTOP) ? WSTOPSIG(status) : 0;
   1188         ptrace(PTRACE_CONT, pid, 0, sig);
   1189         return;
   1190     }
   1191 
   1192     /*
   1193      * Resumed by delivery of SIGCONT
   1194      */
   1195     if (WIFCONTINUED(status)) {
   1196         return;
   1197     }
   1198 
   1199     /*
   1200      * Process exited
   1201      */
   1202     if (WIFEXITED(status)) {
   1203         /*
   1204          * Target exited with sanitizer defined exitcode (used when SIGABRT is not monitored)
   1205          */
   1206         if (WEXITSTATUS(status) == (unsigned long)HF_SAN_EXIT_CODE) {
   1207             arch_traceExitAnalyze(run, pid);
   1208         }
   1209         return;
   1210     }
   1211 
   1212     if (WIFSIGNALED(status)) {
   1213         return;
   1214     }
   1215 
   1216     abort(); /* NOTREACHED */
   1217 }
   1218 
   1219 static bool arch_listThreads(int tasks[], size_t thrSz, int pid) {
   1220     char path[512];
   1221     snprintf(path, sizeof(path), "/proc/%d/task", pid);
   1222 
   1223     /* An optimization, the number of threads is st.st_nlink - 2 (. and ..) */
   1224     struct stat st;
   1225     if (stat(path, &st) != -1) {
   1226         if (st.st_nlink == 3) {
   1227             tasks[0] = pid;
   1228             tasks[1] = 0;
   1229             return true;
   1230         }
   1231     }
   1232 
   1233     size_t count = 0;
   1234     DIR* dir = opendir(path);
   1235     if (!dir) {
   1236         PLOG_E("Couldn't open dir '%s'", path);
   1237         return false;
   1238     }
   1239     defer { closedir(dir); };
   1240 
   1241     for (;;) {
   1242         errno = 0;
   1243         struct dirent* res = readdir(dir);
   1244         if (res == NULL && errno != 0) {
   1245             PLOG_E("Couldn't read contents of '%s'", path);
   1246             return false;
   1247         }
   1248 
   1249         if (res == NULL) {
   1250             break;
   1251         }
   1252 
   1253         pid_t pid = (pid_t)strtol(res->d_name, (char**)NULL, 10);
   1254         if (pid == 0) {
   1255             LOG_D("The following dir entry couldn't be converted to pid_t '%s'", res->d_name);
   1256             continue;
   1257         }
   1258 
   1259         tasks[count++] = pid;
   1260         LOG_D("Added pid '%d' from '%s/%s'", pid, path, res->d_name);
   1261 
   1262         if (count >= thrSz) {
   1263             break;
   1264         }
   1265     }
   1266     PLOG_D("Total number of threads in pid '%d': '%zd'", pid, count);
   1267     tasks[count + 1] = 0;
   1268     if (count < 1) {
   1269         return false;
   1270     }
   1271     return true;
   1272 }
   1273 
   1274 bool arch_traceWaitForPidStop(pid_t pid) {
   1275     for (;;) {
   1276         int status;
   1277         pid_t ret = wait4(pid, &status, __WALL | WUNTRACED, NULL);
   1278         if (ret == -1 && errno == EINTR) {
   1279             continue;
   1280         }
   1281         if (ret == -1) {
   1282             PLOG_W("wait4(pid=%d) failed", pid);
   1283             return false;
   1284         }
   1285         if (!WIFSTOPPED(status)) {
   1286             LOG_W("PID %d not in a stopped state - status:%d", pid, status);
   1287             return false;
   1288         }
   1289         return true;
   1290     }
   1291 }
   1292 
   1293 #define MAX_THREAD_IN_TASK 4096
   1294 bool arch_traceAttach(run_t* run, pid_t pid) {
   1295 /*
   1296  * It should be present since, at least, Linux kernel 3.8, but
   1297  * not always defined in kernel-headers
   1298  */
   1299 #if !defined(PTRACE_O_EXITKILL)
   1300 #define PTRACE_O_EXITKILL (1 << 20)
   1301 #endif /* !defined(PTRACE_O_EXITKILL) */
   1302     long seize_options = PTRACE_O_TRACECLONE | PTRACE_O_TRACEFORK | PTRACE_O_TRACEVFORK;
   1303     if (run->global->linux.pid == 0) {
   1304         seize_options |= PTRACE_O_EXITKILL;
   1305     }
   1306     /* The event is only used with sanitizers */
   1307     if (run->global->enableSanitizers) {
   1308         seize_options |= PTRACE_O_TRACEEXIT;
   1309     }
   1310 
   1311     if (run->global->linux.pid == 0 && arch_traceWaitForPidStop(pid) == false) {
   1312         return false;
   1313     }
   1314 
   1315     if (ptrace(PTRACE_SEIZE, pid, NULL, seize_options) == -1) {
   1316         PLOG_W("Couldn't ptrace(PTRACE_SEIZE) to pid: %d", pid);
   1317         return false;
   1318     }
   1319 
   1320     LOG_D("Attached to PID: %d", pid);
   1321 
   1322     /* It only makes sense to attach to threads with -p */
   1323     if (run->global->linux.pid == 0) {
   1324         return true;
   1325     }
   1326 
   1327     int tasks[MAX_THREAD_IN_TASK + 1] = {0};
   1328     if (!arch_listThreads(tasks, MAX_THREAD_IN_TASK, pid)) {
   1329         LOG_E("Couldn't read thread list for pid '%d'", pid);
   1330         return false;
   1331     }
   1332 
   1333     for (int i = 0; i < MAX_THREAD_IN_TASK && tasks[i]; i++) {
   1334         if (tasks[i] == pid) {
   1335             continue;
   1336         }
   1337         if (ptrace(PTRACE_SEIZE, tasks[i], NULL, seize_options) == -1) {
   1338             PLOG_W("Couldn't ptrace(PTRACE_SEIZE) to pid: %d", tasks[i]);
   1339             continue;
   1340         }
   1341         LOG_D("Attached to PID: %d (thread_group:%d)", tasks[i], pid);
   1342     }
   1343     return true;
   1344 }
   1345 
   1346 void arch_traceDetach(pid_t pid) {
   1347     if (syscall(__NR_kill, pid, 0) == -1 && errno == ESRCH) {
   1348         LOG_D("PID: %d no longer exists", pid);
   1349         return;
   1350     }
   1351 
   1352     int tasks[MAX_THREAD_IN_TASK + 1] = {0};
   1353     if (!arch_listThreads(tasks, MAX_THREAD_IN_TASK, pid)) {
   1354         LOG_E("Couldn't read thread list for pid '%d'", pid);
   1355         return;
   1356     }
   1357 
   1358     for (int i = 0; i < MAX_THREAD_IN_TASK && tasks[i]; i++) {
   1359         ptrace(PTRACE_INTERRUPT, tasks[i], NULL, NULL);
   1360         arch_traceWaitForPidStop(tasks[i]);
   1361         ptrace(PTRACE_DETACH, tasks[i], NULL, NULL);
   1362     }
   1363 }
   1364 
   1365 void arch_traceSignalsInit(honggfuzz_t* hfuzz) {
   1366     /* Default is true for all platforms except Android */
   1367     arch_sigs[SIGABRT].important = hfuzz->monitorSIGABRT;
   1368 
   1369     /* Default is false */
   1370     arch_sigs[SIGVTALRM].important = hfuzz->timing.tmoutVTALRM;
   1371 }
   1372