Re: [PATCH 3/4] fuzz: setting bits in operand of out/write to zero

[Qiuhao Li <Qiuhao.Li@outlook.com>]

On Mon, 2020-12-21 at 15:35 -0500, Alexander Bulekov wrote:
> On 201220 0256, Qiuhao Li wrote:
> > Simplifying the crash cases by opportunistically setting bits in
> > operands of
> > out/write to zero may help to debug, since usually bit one means
> > turn on
> > or
> > trigger a function while zero is the default turn-off setting.
> > 
> > Tested Bug 1908062. Refined vs. Original result:
> > 
> > outl 0xcf8 0x8000081c            outl 0xcf8 0x8000081c
> > outb 0xcfc 0xc3                  outb 0xcfc 0xc3
> > outl 0xcf8 0x0               <-- outl 0xcf8 0x8000082f
> > outl 0xcf8 0x80000804            outl 0xcf8 0x80000804
> > outl 0xcfc 0x10000006        <-- outl 0xcfc 0x9b2765be
> > write 0xc300001024 0x2 0x10  <-- write 0xc300001024 0x2 0x0055
> > write 0xc300001028 0x1 0x5a      write 0xc300001028 0x1 0x5a
> > write 0xc30000101c 0x1 0x01      write 0xc30000101c 0x1 0x01
> > writel 0xc30000100c 0x2a6f6c63   writel 0xc30000100c 0x2a6f6c63
> > write 0xc300001018 0x1 0x80  <-- write 0xc300001018 0x1 0xa4
> > write 0x5c 0x1 0x10          <-- write 0x5c 0x1 0x19
> > write 0xc300003002 0x1 0x0   <-- write 0xc300003002 0x1 0x8a
> > 
> > Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
> 
> Looks good. One nit below.
> 
> Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
> 
> 
> > ---
> >  scripts/oss-fuzz/minimize_qtest_trace.py | 42
> > +++++++++++++++++++++++-
> >  1 file changed, 41 insertions(+), 1 deletion(-)
> > 
> > diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
> > b/scripts/oss-fuzz/minimize_qtest_trace.py
> > index 855c3bcb54..f3e88064c4 100755
> > --- a/scripts/oss-fuzz/minimize_qtest_trace.py
> > +++ b/scripts/oss-fuzz/minimize_qtest_trace.py
> > @@ -172,7 +172,47 @@ def minimize_trace(inpath, outpath):
> >                      newtrace[i] = prior
> >                      del newtrace[i+1]
> >          i += 1
> > -    check_if_trace_crashes(newtrace, outpath)
> > +
> > +    assert(check_if_trace_crashes(newtrace, outpath))
> > +
> > +    TIMEOUT = (end-start)*2 # input is short now
> > +
> > +    # try setting bits in operands of out/write to zero
> > +    i = 0
> > +    while i < len(newtrace):
> > +        if (not newtrace[i].startswith("write ") and not
> > +           newtrace[i].startswith("out")):
> > +           i += 1
> > +           continue
> > +        # write ADDR SIZE DATA
> > +        # outx ADDR VALUE
> > +        print("\nzero setting bits: {}".format(newtrace[i]))
> > +
> > +        prefix = " ".join(newtrace[i].split()[:-1])
> > +        data = newtrace[i].split()[-1]
> > +        data_bin = bin(int(data, 16))
> > +        data_bin_list = list(data_bin)
> > +
> > +        for j in range(2, len(data_bin_list)):
> > +            prior = newtrace[i]
> > +            if (data_bin_list[j] == '1'):
> > +                data_bin_list[j] = '0'
> > +                data_try = hex(int("".join(data_bin_list), 2))
> > +                # It seems qtest only accect hex with one byte
> > zero padding
>                                          ^^ "accepts padded hex-
> values."

Thanks.

> 
> > +                if len(data_try) % 2 == 1:
> > +                    data_try = data_try[:2] + "0" + data_try[2:-1]
> > +
> > +                newtrace[i] = "{prefix} {data_try}\n".format(
> > +                        prefix=prefix,
> > +                        data_try=data_try)
> > +
> > +                if not check_if_trace_crashes(newtrace, outpath):
> > +                    data_bin_list[j] = '1'
> > +                    newtrace[i] = prior
> > +
> > +        i += 1
> > +
> > +    assert(check_if_trace_crashes(newtrace, outpath))
> >  
> >  
> >  if __name__ == '__main__':
> > -- 
> > 2.25.1
> >