From: Alexander Bulekov <alxndr@bu.edu>
To: qemu-devel@nongnu.org
Cc: Alexander Bulekov <alxndr@bu.edu>,
Stefan Hajnoczi <stefanha@redhat.com>,
Bandan Das <bsd@redhat.com>,
Darren Kenny <darren.kenny@oracle.com>,
Paolo Bonzini <pbonzini@redhat.com>
Subject: [PATCH 00/10] Retire Fork-Based Fuzzing
Date: Sat, 4 Feb 2023 23:29:41 -0500 [thread overview]
Message-ID: <20230205042951.3570008-1-alxndr@bu.edu> (raw)
Hello,
This series removes fork-based fuzzing.
How does fork-based fuzzing work?
* A single parent process initializes QEMU
* We identify the devices we wish to fuzz (fuzzer-dependent)
* Use QTest to PCI enumerate the devices
* After that we start a fork-server which forks the process and executes
fuzzer inputs inside the disposable children.
In a normal fuzzing process, everything happens in a single process.
Pros of fork-based fuzzing:
* We only need to do common configuration once (e.g. PCI enumeration).
* Fork provides a strong guarantee that fuzzer inputs will not interfere with
each-other
* The fuzzing process can continue even after a child-process crashes
* We can apply our-own timers to child-processes to exit slow inputs, early
Cons of fork-based fuzzing:
* Fork-based fuzzing is not supported by libfuzzer. We had to build our own
fork-server and rely on tricks using linker-scripts and shared-memory to
support fuzzing. ( https://physics.bu.edu/~alxndr/libfuzzer-forkserver/ )
* Fork-based fuzzing is currently the main blocker preventing us from enabling
other fuzzers such as AFL++ on OSS-Fuzz
* Fork-based fuzzing may be a reason why coverage-builds are failing on
OSS-Fuzz. Coverage is an important fuzzing metric which would allow us to
find parts of the code that are not well-covered.
* Fork-based fuzzing has high overhead. fork() is an expensive system-call,
especially for processes running ASAN (with large/complex) VMA layouts.
* Fork prevents us from effectively fuzzing devices that rely on
threads (e.g. qxl).
These patches remove fork-based fuzzing and replace it with reboot-based
fuzzing for most cases. Misc notes about this change:
* libfuzzer appears to be no longer in active development. As such, the
current implementation of fork-based fuzzing (while having some nice
advantages) is likely to hold us back in the future. If these changes
are approved and appear to run successfully on OSS-Fuzz, we should be
able to easily experiment with other fuzzing engines (AFL++).
* Some device do not completely reset their state. This can lead to
non-reproducible crashes. However, in my local tests, most crashes
were reproducible. OSS-Fuzz shouldn't send us reports unless it can
consistently reproduce a crash.
* In theory, the corpus-format should not change, so the existing
corpus-inputs on OSS-Fuzz will transfer to the new reset()-able
fuzzers.
* Each fuzzing process will now exit after a single crash is found. To
continue the fuzzing process, use libfuzzer flags such as -jobs=-1
* We no long control input-timeouts (those are handled by libfuzzer).
Since timeouts on oss-fuzz can be many seconds long, I added a limit
on the number of DMA bytes written.
Alexander Bulekov (10):
hw/sparse-mem: clear memory on reset
fuzz: add fuzz_reboot API
fuzz/generic-fuzz: use reboots instead of forks to reset state
fuzz/generic-fuzz: add a limit on DMA bytes written
fuzz/virtio-scsi: remove fork-based fuzzer
fuzz/virtio-net: remove fork-based fuzzer
fuzz/virtio-blk: remove fork-based fuzzer
fuzz/i440fx: remove fork-based fuzzer
fuzz: remove fork-fuzzing scaffolding
docs/fuzz: remove mentions of fork-based fuzzing
docs/devel/fuzzing.rst | 22 +-----
hw/mem/sparse-mem.c | 13 +++-
meson.build | 4 -
tests/qtest/fuzz/fork_fuzz.c | 41 ----------
tests/qtest/fuzz/fork_fuzz.h | 23 ------
tests/qtest/fuzz/fork_fuzz.ld | 56 --------------
tests/qtest/fuzz/fuzz.c | 6 ++
tests/qtest/fuzz/fuzz.h | 2 +-
tests/qtest/fuzz/generic_fuzz.c | 111 +++++++---------------------
tests/qtest/fuzz/i440fx_fuzz.c | 27 +------
tests/qtest/fuzz/meson.build | 6 +-
tests/qtest/fuzz/virtio_blk_fuzz.c | 51 ++-----------
tests/qtest/fuzz/virtio_net_fuzz.c | 54 ++------------
tests/qtest/fuzz/virtio_scsi_fuzz.c | 51 ++-----------
14 files changed, 72 insertions(+), 395 deletions(-)
delete mode 100644 tests/qtest/fuzz/fork_fuzz.c
delete mode 100644 tests/qtest/fuzz/fork_fuzz.h
delete mode 100644 tests/qtest/fuzz/fork_fuzz.ld
--
2.39.0
next reply other threads:[~2023-02-05 4:31 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-05 4:29 Alexander Bulekov [this message]
2023-02-05 4:29 ` [PATCH 01/10] hw/sparse-mem: clear memory on reset Alexander Bulekov
2023-02-05 10:40 ` Philippe Mathieu-Daudé
2023-02-13 14:15 ` Darren Kenny
2023-02-05 4:29 ` [PATCH 02/10] fuzz: add fuzz_reboot API Alexander Bulekov
2023-02-05 10:50 ` Philippe Mathieu-Daudé
2023-02-13 14:19 ` Darren Kenny
2023-02-05 4:29 ` [PATCH 03/10] fuzz/generic-fuzz: use reboots instead of forks to reset state Alexander Bulekov
2023-02-13 14:26 ` Darren Kenny
2023-02-17 4:01 ` Alexander Bulekov
2023-02-05 4:29 ` [PATCH 04/10] fuzz/generic-fuzz: add a limit on DMA bytes written Alexander Bulekov
2023-02-05 10:42 ` Philippe Mathieu-Daudé
2023-02-13 14:38 ` Darren Kenny
2023-02-17 3:59 ` Alexander Bulekov
2023-02-05 4:29 ` [PATCH 05/10] fuzz/virtio-scsi: remove fork-based fuzzer Alexander Bulekov
2023-02-13 14:42 ` Darren Kenny
2023-02-05 4:29 ` [PATCH 06/10] fuzz/virtio-net: " Alexander Bulekov
2023-02-13 14:44 ` Darren Kenny
2023-02-05 4:29 ` [PATCH 07/10] fuzz/virtio-blk: " Alexander Bulekov
2023-02-13 14:45 ` Darren Kenny
2023-02-05 4:29 ` [PATCH 08/10] fuzz/i440fx: " Alexander Bulekov
2023-02-13 14:46 ` Darren Kenny
2023-02-05 4:29 ` [PATCH 09/10] fuzz: remove fork-fuzzing scaffolding Alexander Bulekov
2023-02-13 14:47 ` Darren Kenny
2023-02-05 4:29 ` [PATCH 10/10] docs/fuzz: remove mentions of fork-based fuzzing Alexander Bulekov
2023-02-13 14:48 ` Darren Kenny
2023-02-05 10:39 ` [PATCH 00/10] Retire Fork-Based Fuzzing Philippe Mathieu-Daudé
2023-02-06 14:09 ` Alexander Bulekov
2023-02-13 2:11 ` Alexander Bulekov
2023-02-14 15:38 ` Stefan Hajnoczi
2023-02-14 16:08 ` Philippe Mathieu-Daudé
2023-02-14 17:58 ` Laurent Vivier
2023-02-14 18:46 ` Stefan Hajnoczi
2023-02-14 19:09 ` Thomas Huth
2023-02-14 19:14 ` Alexander Bulekov
2023-02-14 21:08 ` Thomas Huth
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230205042951.3570008-1-alxndr@bu.edu \
--to=alxndr@bu.edu \
--cc=bsd@redhat.com \
--cc=darren.kenny@oracle.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.