Panic from postcard when using Launcher

[langston-barrett]

I have a fuzzer that uses Launcher like so:

    let mut run_client = |state: Option<_>, mut mgr, _core_id| -> Result<(), Error> { /* ... */ }
    {
        use libafl::bolts::{
            core_affinity::Cores,
            launcher::Launcher,
            shmem::{ShMemProvider, StdShMemProvider},
        };
        use libafl::monitors::MultiMonitor;
        use libafl::prelude::EventConfig;

        let shmem_provider = StdShMemProvider::new().expect("Failed to init shared memory");
        let monitor = MultiMonitor::new(|s| println!("{s}"));
        let broker_port = 1337; // TODO(lb): configurable
        let cores = Cores::from_cmdline("1-4").unwrap(); // TODO(lb): configurable

        // Build and run a Launcher
        match Launcher::builder()
            .shmem_provider(shmem_provider)
            .broker_port(broker_port)
            .configuration(EventConfig::from_build_id())
            .monitor(monitor)
            .run_client(&mut run_client)
            .cores(&cores)
            .stdout_file(Some("log"))
            .build()
            .launch()
        {
            Ok(()) => (),
            Err(Error::ShuttingDown) => println!("Fuzzing stopped by user. Bye!"),
            Err(err) => panic!("Failed to run launcher: {err:?}"),
        }
    }

However, it panics with:

    thread 'main' panicked at 'An error occurred when brokering. Exiting.: Serialize("WontImplement", ErrorBacktrace)', /home/langston/.cargo/git/checkouts/detect-libafl-ee5dccf8ba74c2f8/be25e73/libafl/src/bolts/llmp.rs:2265:18
    stack backtrace:
       0: rust_begin_unwind
                 at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library/std/src/panicking.rs:578:5
       1: core::panicking::panic_fmt
                 at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library/core/src/panicking.rs:67:14
       2: core::result::unwrap_failed
                 at /rustc/90c541806f23a127002de5b4038be731ba1458ca/library/core/src/result.rs:1687:5
       3: core::result::Result<T,E>::expect
       4: libafl::bolts::llmp::LlmpBroker<SP>::loop_forever
       5: libafl::events::llmp::LlmpEventBroker<I,MT,SP>::broker_loop
       6: libafl::events::llmp::RestartingMgr<MT,S,SP>::launch::{{closure}}
       7: libafl::events::llmp::RestartingMgr<MT,S,SP>::launch
       8: libafl::bolts::launcher::Launcher<CF,MT,S,SP>::launch
       9: dxezz::fuzz::fuzz
      10: dxezz::main
      11: core::ops::function::FnOnce::call_once
    note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

After a bit of digging, it appears likely that this is coming from postcard::Deserializer::deserialize_any. Is this expected behavior? If so, is there a way I can modify my fuzzer to avoid this?

[domenukk]

I don't see where you are deserializing, and what?

[domenukk]

Also, why a discussion and not an issue?

[langston-barrett]

I don't see where you are deserializing, and what?

Right, I also don't see where I'm deserializing anything, hence my confusion! The fuzzer works fine if I instead run it with

    let monitor = libafl::prelude::SimpleMonitor::new(|s| println!("{s}"));
    let mgr = libafl::prelude::SimpleEventManager::new(monitor);
    run_client(None, mgr, 0).unwrap();

So the issue is somehow arising from the use of Launcher.

Also, why a discussion and not an issue?

I just wasn't sure if I was seeing a bug or an expected behavior. Happy to refile if that's helpful.

[domenukk]

It definitely sounds like a bug to me

[domenukk]

Would be important to know what message we tried to receive here. maybe you'll have to add some more debugging into LlmpBroker::handle_new_msgs (or wherever the error gets thrown)

[domenukk]

Moving to issue #1400