Replace timer with select in forkserver, where possible (#246)

src/afl-fuzz-run.c

@@ -39,10 +39,10 @@ void timeout_handle(union sigval timer_data) {
 
 u8 run_target(afl_state_t *afl, u32 timeout) {
 
-  // static struct itimerval it;
   struct sigevent          timer_signal_event;
   static timer_t           timer;
   static struct itimerspec timer_period;
+  static struct timeval    it;
   static u32               prev_timed_out = 0;
   static u64               exec_ms = 0;
 
@@ -151,33 +151,10 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
 
     }
 
-  } else {
+    /* Configure timeout using POSIX timers in dumb-mode,
-
+        as requested by user, then wait for child to terminate.
-    s32 res;
-
-    /* In non-dumb mode, we have the fork server up and running, so simply
-       tell it to have at it, and then read back PID. */
-
-    if ((res = write(afl->fsrv.fsrv_ctl_fd, &prev_timed_out, 4)) != 4) {
-
-      if (afl->stop_soon) goto handle_stop_soon;
-      RPFATAL(res, "Unable to request new process from fork server (OOM?)");
-
-    }
-
-    if ((res = read(afl->fsrv.fsrv_st_fd, &afl->fsrv.child_pid, 4)) != 4) {
-
-      if (afl->stop_soon) goto handle_stop_soon;
-      RPFATAL(res, "Unable to request new process from fork server (OOM?)");
-
-    }
-
-    if (afl->fsrv.child_pid <= 0) FATAL("Fork server is misbehaving (OOM?)");
-
-  }
-
-  /* Configure timeout, as requested by user, then wait for child to terminate.
      */
+
     timer_signal_event.sigev_value.sival_int = afl->fsrv.child_pid;
     timer_status = timer_create(CLOCK_MONOTONIC, &timer_signal_event, &timer);
 
@@ -205,8 +182,30 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
 
     }
 
-  /* The SIGALRM handler simply kills the afl->fsrv.child_pid and sets
+  } else {
-   * afl->fsrv.child_timed_out. */
+
+    /* In non-dumb mode, we have the fork server up and running, so simply
+       tell it to have at it, and then read back PID. */
+
+    int res;
+
+    if ((res = write(afl->fsrv.fsrv_ctl_fd, &prev_timed_out, 4)) != 4) {
+
+      if (afl->stop_soon) return 0;
+      RPFATAL(res, "Unable to request new process from fork server (OOM?)");
+
+    }
+
+    if ((res = read(afl->fsrv.fsrv_st_fd, &afl->fsrv.child_pid, 4)) != 4) {
+
+      if (afl->stop_soon) return 0;
+      RPFATAL(res, "Unable to request new process from fork server (OOM?)");
+
+    }
+
+    if (afl->fsrv.child_pid <= 0) FATAL("Fork server is misbehaving (OOM?)");
+
+  }
 
   if (afl->dumb_mode == 1 || afl->no_forkserver) {
 
@@ -217,48 +216,9 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
 
     }
 
-  } else {
-
-    s32 res;
-
-    if ((res = read(afl->fsrv.fsrv_st_fd, &status, 4)) != 4) {
-
-      if (afl->stop_soon) goto handle_stop_soon;
-      SAYF(
-          "\n" cLRD "[-] " cRST
-          "Unable to communicate with fork server. Some possible reasons:\n\n"
-          "    - You've run out of memory. Use -m to increase the the memory "
-          "limit\n"
-          "      to something higher than %lld.\n"
-          "    - The binary or one of the libraries it uses manages to create\n"
-          "      threads before the forkserver initializes.\n"
-          "    - The binary, at least in some circumstances, exits in a way "
-          "that\n"
-          "      also kills the parent process - raise() could be the "
-          "culprit.\n"
-          "    - If using persistent mode with QEMU, AFL_QEMU_PERSISTENT_ADDR "
-          "is\n"
-          "      probably not valid (hint: add the base address in case of PIE)"
-          "\n\n"
-          "If all else fails you can disable the fork server via "
-          "AFL_NO_FORKSRV=1.\n",
-          afl->fsrv.mem_limit);
-      timer_delete(timer);
-      RPFATAL(res, "Unable to communicate with fork server");
-
-    }
-
-  }
-
-  if (!WIFSTOPPED(status)) afl->fsrv.child_pid = 0;
-
     timer_gettime(timer, &timer_period);
     exec_ms = (u64)timeout - (timer_period.it_value.tv_sec * 1000 +
                               timer_period.it_value.tv_nsec / 1000000);
-  if (afl->slowest_exec_ms < exec_ms) afl->slowest_exec_ms = exec_ms;
-
-  if (exec_ms >= timeout) { afl->fsrv.child_timed_out = 1; }
-
     timer_period.it_value.tv_sec = 0;
     timer_period.it_value.tv_nsec = 0;
 
@@ -273,6 +233,69 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
 
     timer_delete(timer);
 
+  } else {
+
+    /* In non-dumb mode, use select to monitor the forkserver for timeouts.
+     */
+
+    s32 res;
+    int sret;
+
+    fd_set readfds;
+    FD_ZERO(&readfds);
+    FD_SET(afl->fsrv.fsrv_st_fd, &readfds);
+    it.tv_sec = ((timeout) / 1000);
+    it.tv_usec = ((timeout) % 1000) * 1000;
+
+    sret = select(afl->fsrv.fsrv_st_fd + 1, &readfds, NULL, NULL, &it);
+
+    if (sret == 0) {
+
+      kill(afl->fsrv.child_pid, SIGKILL);
+
+    } else {
+
+      if ((res = read(afl->fsrv.fsrv_st_fd, &status, 4)) != 4) {
+
+        if (afl->stop_soon) return 0;
+        SAYF(
+            "\n" cLRD "[-] " cRST
+            "Unable to communicate with fork server. Some possible reasons:\n\n"
+            "    - You've run out of memory. Use -m to increase the the memory "
+            "limit\n"
+            "      to something higher than %lld.\n"
+            "    - The binary or one of the libraries it uses manages to "
+            "create\n"
+            "      threads before the forkserver initializes.\n"
+            "    - The binary, at least in some circumstances, exits in a way "
+            "that\n"
+            "      also kills the parent process - raise() could be the "
+            "culprit.\n"
+            "    - If using persistent mode with QEMU, "
+            "AFL_QEMU_PERSISTENT_ADDR "
+            "is\n"
+            "      probably not valid (hint: add the base address in case of "
+            "PIE)"
+            "\n\n"
+            "If all else fails you can disable the fork server via "
+            "AFL_NO_FORKSRV=1.\n",
+            afl->fsrv.mem_limit);
+        RPFATAL(res, "Unable to communicate with fork server");
+
+      }
+
+    }
+
+    exec_ms = (u64)timeout - (it.tv_sec * 1000 + it.tv_usec / 1000);
+    it.tv_sec = 0;
+    it.tv_usec = 0;
+
+  }
+
+  if (!WIFSTOPPED(status)) afl->fsrv.child_pid = 0;
+
+  if (exec_ms >= timeout) { afl->fsrv.child_timed_out = 1; }
+
   ++afl->total_execs;
 
   /* Any subsequent operations on afl->fsrv.trace_bits must not be moved by the
@@ -319,10 +342,6 @@ u8 run_target(afl_state_t *afl, u32 timeout) {
 
   return FAULT_NONE;
 
-handle_stop_soon:
-  timer_delete(timer);
-  return 0;
-
 }
 
 /* Write modified data to file for testing. If afl->fsrv.out_file is set, the