[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 07/15] fuzz: remove IO commands iteratively
From: |
Thomas Huth |
Subject: |
[PULL 07/15] fuzz: remove IO commands iteratively |
Date: |
Mon, 11 Jan 2021 14:43:20 +0100 |
From: Qiuhao Li <Qiuhao.Li@outlook.com>
Now we use a one-time scan and remove strategy in the minimizer,
which is not suitable for timing dependent instructions.
For example, instruction A will indicate an address where the config
chunk locates, and instruction B will make the configuration active.
If we have the following instruction sequence:
...
A1
B1
A2
B2
...
A2 and B2 are the actual instructions that trigger the bug.
If we scan from top to bottom, after we remove A1, the behavior of B1
might be unknowable, including not to crash the program. But we will
successfully remove B1 later cause A2 and B2 will crash the process
anyway:
...
A1
A2
B2
...
Now one more trimming will remove A1.
In the perfect case, we would need to be able to remove A and B (or C!) at
the same time. But for now, let's just add a loop around the minimizer.
Since we only remove instructions, this iterative algorithm is converging.
Tested with Bug 1908062.
Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id:
<SYCPR01MB350263004448040ACCB9A9F1FCAB0@SYCPR01MB3502.ausprd01.prod.outlook.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41 +++++++++++++++---------
1 file changed, 26 insertions(+), 15 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index af9767f7e4..59e91de7e2 100755
--- a/scripts/oss-fuzz/minimize_qtest_trace.py
+++ b/scripts/oss-fuzz/minimize_qtest_trace.py
@@ -74,21 +74,9 @@ def check_if_trace_crashes(trace, path):
return False
-def minimize_trace(inpath, outpath):
- global TIMEOUT
- with open(inpath) as f:
- trace = f.readlines()
- start = time.time()
- if not check_if_trace_crashes(trace, outpath):
- sys.exit("The input qtest trace didn't cause a crash...")
- end = time.time()
- print("Crashed in {} seconds".format(end-start))
- TIMEOUT = (end-start)*5
- print("Setting the timeout for {} seconds".format(TIMEOUT))
-
- i = 0
- newtrace = trace[:]
+def remove_lines(newtrace, outpath):
remove_step = 1
+ i = 0
while i < len(newtrace):
# 1.) Try to remove lines completely and reproduce the crash.
# If it works, we're done.
@@ -177,7 +165,30 @@ def minimize_trace(inpath, outpath):
newtrace[i] = prior[0]
del newtrace[i+1]
i += 1
- check_if_trace_crashes(newtrace, outpath)
+
+
+def minimize_trace(inpath, outpath):
+ global TIMEOUT
+ with open(inpath) as f:
+ trace = f.readlines()
+ start = time.time()
+ if not check_if_trace_crashes(trace, outpath):
+ sys.exit("The input qtest trace didn't cause a crash...")
+ end = time.time()
+ print("Crashed in {} seconds".format(end-start))
+ TIMEOUT = (end-start)*5
+ print("Setting the timeout for {} seconds".format(TIMEOUT))
+
+ newtrace = trace[:]
+
+ # remove lines
+ old_len = len(newtrace) + 1
+ while(old_len > len(newtrace)):
+ old_len = len(newtrace)
+ remove_lines(newtrace, outpath)
+ newtrace = list(filter(lambda s: s != "", newtrace))
+
+ assert(check_if_trace_crashes(newtrace, outpath))
if __name__ == '__main__':
--
2.27.0
- [PULL 00/15] Testing, CI and bsd-user patches, Thomas Huth, 2021/01/11
- [PULL 02/15] qtest/libqtest: fix heap-buffer-overflow in qtest_cb_for_every_machine(), Thomas Huth, 2021/01/11
- [PULL 01/15] gitlab-ci.yml: Add openSUSE Leap 15.2 for gitlab CI/CD, Thomas Huth, 2021/01/11
- [PULL 03/15] util/oslib-win32: Fix _aligned_malloc() arguments order, Thomas Huth, 2021/01/11
- [PULL 05/15] fuzz: double the IOs to remove for every loop, Thomas Huth, 2021/01/11
- [PULL 04/15] fuzz: accelerate non-crash detection, Thomas Huth, 2021/01/11
- [PULL 09/15] fuzz: add minimization options, Thomas Huth, 2021/01/11
- [PULL 08/15] fuzz: set bits in operand of write/out to zero, Thomas Huth, 2021/01/11
- [PULL 10/15] fuzz: heuristic split write based on past IOs, Thomas Huth, 2021/01/11
- [PULL 07/15] fuzz: remove IO commands iteratively,
Thomas Huth <=
- [PULL 06/15] fuzz: split write operand using binary approach, Thomas Huth, 2021/01/11
- [PULL 11/15] bsd-user: regenerate FreeBSD's system call numbers, Thomas Huth, 2021/01/11
- [PULL 13/15] bsd-user: Update strace.list for FreeBSD's latest syscalls, Thomas Huth, 2021/01/11
- [PULL 12/15] bsd-user: move strace OS/arch dependent code to host/arch dirs, Thomas Huth, 2021/01/11
- [PULL 14/15] tests/acceptance: Fix race conditions in s390x tests & skip fedora on gitlab-CI, Thomas Huth, 2021/01/11
- [PULL 15/15] fuzz: map all BARs and enable PCI devices, Thomas Huth, 2021/01/11
- Re: [PULL 00/15] Testing, CI and bsd-user patches, Peter Maydell, 2021/01/11