Commit 010dcd6a9b64d5bd13579a4b0c4c70a5aee5c967 | zig

author	Matthew Lugg <mlugg@mlugg.co.uk> 2025-11-19 12:55:17+00:00
committer	Matthew Lugg <mlugg@mlugg.co.uk> 2025-11-20 10:42:20+00:00
log	010dcd6a9b64d5bd13579a4b0c4c70a5aee5c967
tree	06b820caa177d8ea5dd0b6d19302b7535af054ae
parent	0a330d4f947c1b05ac9f7d624443e2f80db2912f
signature	Commit is signed but in an unrecognized format.

fuzzer: account for runtime address slide

This is relevant to PIEs, which are notably enabled by default on macOS.
The build system needs to only see virtual addresses, that is, those
which do not have the slide applied; but the fuzzer itself naturally
sees relocated addresses (i.e. with the slide applied). We just need to
subtract the slide when we communicate addresses to the build system.

7 files changed, 56 insertions(+), 8 deletions(-)

lib
- compiler
  - test_runner.zig
- fuzzer.zig
- std
  - Build
    abi.zig
  - debug.zig
  - debug
    SelfInfo
    Elf.zig
    MachO.zig
    Windows.zig

lib/compiler/test_runner.zig+1-1

...	...	@@ -184,7 +184,7 @@ fn mainServer() !void {
184	184	const test_fn = builtin.test_functions[index];
185	185	const entry_addr = @intFromPtr(test_fn.func);
186	186
187		try server.serveU64Message(.fuzz_start_addr, entry_addr);
	187	try server.serveU64Message(.fuzz_start_addr, fuzz_abi.fuzzer_unslide_address(entry_addr));
188	188	defer if (testing.allocator_instance.deinit() == .leak) std.process.exit(1);
189	189	is_fuzz_test = false;
190	190	fuzz_test_index = index;

lib/fuzzer.zig+28-6

...	...	@@ -116,13 +116,18 @@ const Executable = struct {
116	116	"failed to init memory map for coverage file '{s}': {t}",
117	117	.{ &coverage_file_name, e },
118	118	);
119		map.appendSliceAssumeCapacity(mem.asBytes(&abi.SeenPcsHeader{
	119	map.appendSliceAssumeCapacity(@ptrCast(&abi.SeenPcsHeader{
120	120	.n_runs = 0,
121	121	.unique_runs = 0,
122	122	.pcs_len = pcs.len,
123	123	}));
124	124	map.appendNTimesAssumeCapacity(0, pc_bitset_usizes * @sizeOf(usize));
125		map.appendSliceAssumeCapacity(mem.sliceAsBytes(pcs));
	125	// Relocations have been applied to `pcs` so it contains runtime addresses (with slide
	126	// applied). We need to translate these to the virtual addresses as on disk.
	127	for (pcs) \|pc\| {
	128	const pc_vaddr = fuzzer_unslide_address(pc);
	129	map.appendSliceAssumeCapacity(@ptrCast(&pc_vaddr));
	130	}
126	131	return map;
127	132	} else {
128	133	const size = coverage_file.getEndPos() catch \|e\| panic(
...	...	@@ -215,7 +220,16 @@ const Executable = struct {
215	220	.{ self.pc_counters.len, pcs.len },
216	221	);
217	222
218		self.pc_digest = std.hash.Wyhash.hash(0, mem.sliceAsBytes(pcs));
	223	self.pc_digest = digest: {
	224	// Relocations have been applied to `pcs` so it contains runtime addresses (with slide
	225	// applied). We need to translate these to the virtual addresses as on disk.
	226	var h: std.hash.Wyhash = .init(0);
	227	for (pcs) \|pc\| {
	228	const pc_vaddr = fuzzer_unslide_address(pc);
	229	h.update(@ptrCast(&pc_vaddr));
	230	}
	231	break :digest h.final();
	232	};
219	233	self.shared_seen_pcs = getCoverageFile(cache_dir, pcs, self.pc_digest);
220	234
221	235	return self;
...	...	@@ -622,6 +636,14 @@ export fn fuzzer_main(limit_kind: abi.LimitKind, amount: u64) void {
622	636	}
623	637	}
624	638
	639	export fn fuzzer_unslide_address(addr: usize) usize {
	640	const si = std.debug.getSelfDebugInfo() catch @compileError("unsupported");
	641	const slide = si.getModuleSlide(std.debug.getDebugInfoAllocator(), addr) catch \|err\| {
	642	std.debug.panic("failed to find virtual address slide: {t}", .{err});
	643	};
	644	return addr - slide;
	645	}
	646
625	647	/// Helps determine run uniqueness in the face of recursion.
626	648	/// Currently not used by the fuzzer.
627	649	export threadlocal var __sancov_lowest_stack: usize = 0;
...	...	@@ -1185,13 +1207,13 @@ const Mutation = enum {
1185	1207	const j = rng.uintAtMostBiased(usize, corpus[splice_i].len - len);
1186	1208	out.appendSliceAssumeCapacity(corpus[splice_i][j..][0..len]);
1187	1209	},
1188		.@"const" => out.appendSliceAssumeCapacity(mem.asBytes(
	1210	.@"const" => out.appendSliceAssumeCapacity(@ptrCast(
1189	1211	&data_ctx[rng.uintLessThanBiased(usize, data_ctx.len)],
1190	1212	)),
1191		.small => out.appendSliceAssumeCapacity(mem.asBytes(
	1213	.small => out.appendSliceAssumeCapacity(@ptrCast(
1192	1214	&mem.nativeTo(data_ctx[0], rng.int(SmallValue), data_ctx[1]),
1193	1215	)),
1194		.few => out.appendSliceAssumeCapacity(mem.asBytes(
	1216	.few => out.appendSliceAssumeCapacity(@ptrCast(
1195	1217	&fewValue(rng, data_ctx[0], data_ctx[1]),
1196	1218	)),
1197	1219	}

lib/std/Build/abi.zig+1

...	...	@@ -145,6 +145,7 @@ pub const fuzz = struct {
145	145	pub extern fn fuzzer_init_test(test_one: TestOne, unit_test_name: Slice) void;
146	146	pub extern fn fuzzer_new_input(bytes: Slice) void;
147	147	pub extern fn fuzzer_main(limit_kind: LimitKind, amount: u64) void;
	148	pub extern fn fuzzer_unslide_address(addr: usize) usize;
148	149
149	150	pub const Slice = extern struct {
150	151	ptr: [*]const u8,

lib/std/debug.zig+1-1

...	...	@@ -1367,7 +1367,7 @@ test printLineFromFile {
1367	1367
1368	1368	/// The returned allocator should be thread-safe if the compilation is multi-threaded, because
1369	1369	/// multiple threads could capture and/or print stack traces simultaneously.
1370		fn getDebugInfoAllocator() Allocator {
	1370	pub fn getDebugInfoAllocator() Allocator {
1371	1371	// Allow overriding the debug info allocator by exposing `root.debug.getDebugInfoAllocator`.
1372	1372	if (@hasDecl(root, "debug") and @hasDecl(root.debug, "getDebugInfoAllocator")) {
1373	1373	return root.debug.getDebugInfoAllocator();

lib/std/debug/SelfInfo/Elf.zig+5

...	...	@@ -80,6 +80,11 @@ pub fn getModuleName(si: *SelfInfo, gpa: Allocator, address: usize) Error![]cons
80	80	if (module.name.len == 0) return error.MissingDebugInfo;
81	81	return module.name;
82	82	}
	83	pub fn getModuleSlide(si: *SelfInfo, gpa: Allocator, address: usize) Error!usize {
	84	const module = try si.findModule(gpa, address, .shared);
	85	defer si.rwlock.unlockShared();
	86	return module.load_offset;
	87	}
83	88
84	89	pub const can_unwind: bool = s: {
85	90	// The DWARF code can't deal with ILP32 ABIs yet: https://github.com/ziglang/zig/issues/25447

lib/std/debug/SelfInfo/MachO.zig+14

...	...	@@ -82,6 +82,20 @@ pub fn getModuleName(si: *SelfInfo, gpa: Allocator, address: usize) Error![]cons
82	82	defer si.mutex.unlock();
83	83	return module.name;
84	84	}
	85	pub fn getModuleSlide(si: *SelfInfo, gpa: Allocator, address: usize) Error!usize {
	86	const module = try si.findModule(gpa, address);
	87	defer si.mutex.unlock();
	88	const header: *std.macho.mach_header_64 = @ptrFromInt(module.text_base);
	89	const raw_macho: [*]u8 = @ptrCast(header);
	90	var it = macho.LoadCommandIterator.init(header, raw_macho[@sizeOf(macho.mach_header_64)..][0..header.sizeofcmds]) catch unreachable;
	91	const text_vmaddr = while (it.next() catch unreachable) \|load_cmd\| {
	92	if (load_cmd.hdr.cmd != .SEGMENT_64) continue;
	93	const segment_cmd = load_cmd.cast(macho.segment_command_64).?;
	94	if (!mem.eql(u8, segment_cmd.segName(), "__TEXT")) continue;
	95	break segment_cmd.vmaddr;
	96	} else unreachable;
	97	return module.text_base - text_vmaddr;
	98	}
85	99
86	100	pub const can_unwind: bool = true;
87	101	pub const UnwindContext = std.debug.Dwarf.SelfUnwinder;

lib/std/debug/SelfInfo/Windows.zig+6

...	...	@@ -33,6 +33,12 @@ pub fn getModuleName(si: *SelfInfo, gpa: Allocator, address: usize) Error![]cons
33	33	const module = try si.findModule(gpa, address);
34	34	return module.name;
35	35	}
	36	pub fn getModuleSlide(si: *SelfInfo, gpa: Allocator, address: usize) Error!usize {
	37	si.mutex.lock();
	38	defer si.mutex.unlock();
	39	const module = try si.findModule(gpa, address);
	40	return module.base_address;
	41	}
36	42
37	43	pub const can_unwind: bool = switch (builtin.cpu.arch) {
38	44	else => true,