Windows Version
Microsoft Windows [Version 10.0.22631.4169]
WSL Version
2.6.3.0
Are you using WSL 1 or WSL 2?
Kernel Version
Linux version 6.6.87.2-microsoft-standard-WSL2
Distro Version
Ubuntu 22.04.5 LTS
Other Software
Clang/LLVM 14.0.0 (Ubuntu clang version 14.0.0-1ubuntu1.1)
AFL++ 4.33c
Repro Steps
-
Create a minimal C file:
cat > test_asan.c << 'EOF'
int main() { return 0; }
EOF
-
Compile with ASAN:
clang -fsanitize=address -g test_asan.c -o test_asan
-
Run 20 times in a loop:
for i in $(seq 1 20); do
./test_asan 2>/dev/null || echo "CRASH run $i (exit $?)"
done
Expected Behavior
All 20 runs should exit with code 0.
A program that does nothing (main returns 0) should never crash.
Actual Behavior
~30% of runs exit with SIGSEGV (exit 139), with no ASAN output.
Root cause (identified via strace): ASAN shadow memory initialization
uses mmap(MAP_FIXED) to reserve specific virtual address ranges:
mmap(0x603000000000, ..., MAP_FIXED, ...)
mmap(0x603e00000000, ..., MAP_FIXED, ...)
mmap(0x60b000000000, ..., MAP_FIXED, ...)
... (several more fixed-address mappings)
On successful runs, all mappings succeed. On failing runs,
WSL2's ASLR has already placed other mappings at these addresses,
causing MAP_FIXED to fail → SIGSEGV during ASAN initialization,
before any user code executes.
Note: The bug does not reproduce under strace (strace changes the
memory layout, avoiding the conflict).
Setting ASAN_OPTIONS=detect_leaks=0 does NOT fix the issue.
Diagnostic Logs
Windows Version
Microsoft Windows [Version 10.0.22631.4169]
WSL Version
2.6.3.0
Are you using WSL 1 or WSL 2?
Kernel Version
Linux version 6.6.87.2-microsoft-standard-WSL2
Distro Version
Ubuntu 22.04.5 LTS
Other Software
Clang/LLVM 14.0.0 (Ubuntu clang version 14.0.0-1ubuntu1.1)
AFL++ 4.33c
Repro Steps
Create a minimal C file:
cat > test_asan.c << 'EOF'
int main() { return 0; }
EOF
Compile with ASAN:
clang -fsanitize=address -g test_asan.c -o test_asan
Run 20 times in a loop:
for i in $(seq 1 20); do$i (exit $ ?)"
./test_asan 2>/dev/null || echo "CRASH run
done
Expected Behavior
All 20 runs should exit with code 0.
A program that does nothing (main returns 0) should never crash.
Actual Behavior
~30% of runs exit with SIGSEGV (exit 139), with no ASAN output.
Root cause (identified via strace): ASAN shadow memory initialization
uses mmap(MAP_FIXED) to reserve specific virtual address ranges:
On successful runs, all mappings succeed. On failing runs,
WSL2's ASLR has already placed other mappings at these addresses,
causing MAP_FIXED to fail → SIGSEGV during ASAN initialization,
before any user code executes.
Note: The bug does not reproduce under strace (strace changes the
memory layout, avoiding the conflict).
Setting ASAN_OPTIONS=detect_leaks=0 does NOT fix the issue.
Diagnostic Logs