[Ubuntu Upgrade] Disable MSAN builds on projects that will break.

[jonathanmetzman]

Related: #6180

[jonathanmetzman]

Note to any project maintainers coming across this: We will explain what's going on here shortly.

[asraa]

might just be one minor false positive

oss-fuzz/projects/freeimage/project.yaml

Line 10 in 30f3a8f

load_from_memory_fuzzer:

edit might also impact the yaml rewrite below

[asraa]

oh did you manually track this one?

[jonathanmetzman]

I think I wont commit this script. Just wanted to include it so I wouldn't lose track of it.

[jonathanmetzman]

So my testing revealed that the method we used, looking at instrumented_libraries, does not work.
There are about 44 projects that break with MSAN after the upgrade.
Worse, this method may have false positives.
For example, it says systemd doesn't work with MSAN even though testing (through bad build check) reveals no issue.
Maybe bad build check is not thorough enough. Another possibility explanation for false positives is not every linked library is used at runtime.
I'm not sure why there are so many false negatives. Maybe because of dynamic linking and copying libs to /out? I doubt that explains all of this.
I'm leaning towards ignoring this method and using bad_build_check for determining if MSAN should be disabled. What do you all think?

[asraa]

I'm leaning towards ignoring this method and using bad_build_check for determining if MSAN should be disabled. What do you all think?

Do you think the small number of runs for bad_build_check will catch all the errors? (like maybe some weird runtime errors might pop up later?) What about checking against the seed corpus? I think that's currently disabled, so not sure if there were existing problems with that. Or, are all fuzzers guaranteed to run ok on their GCS corpuses (are crashing entries only uploaded on success?) if so maybe that suffices but that seems like added code to try out

[jonathanmetzman]

Do you think the small number of runs for bad_build_check will catch all the errors? (like maybe some weird runtime errors might pop up later?)

Good point. bad build check probably doesn't catch everything. Maybe we should disable msan on the union of this method and bad build check.

What about checking against the seed corpus? I think that's currently disabled, so not sure if there were existing problems with that.

Yes, that feature is disabled, we aren't even testing against the seed corpus.

Or, are all fuzzers guaranteed to run ok on their GCS corpuses (are crashing entries only uploaded on success?) if so maybe that suffices but that seems like added code to try out

Nope we don't do this.