[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL v2 4/8] fuzz: add an instrumentation filter
From: |
Alexander Bulekov |
Subject: |
[PULL v2 4/8] fuzz: add an instrumentation filter |
Date: |
Wed, 25 Aug 2021 09:42:28 -0400 |
By default, -fsanitize=fuzzer instruments all code with coverage
information. However, this means that libfuzzer will track coverage over
hundreds of source files that are unrelated to virtual-devices. This
means that libfuzzer will optimize inputs for coverage observed in timer
code, memory APIs etc. This slows down the fuzzer and stores many inputs
that are not relevant to the actual virtual-devices.
With this change, clang versions that support the
"-fsanitize-coverage-allowlist" will only instrument a subset of the
compiled code, that is directly related to virtual-devices.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
---
configure | 28 +++++++++++++++----
.../oss-fuzz/instrumentation-filter-template | 15 ++++++++++
2 files changed, 37 insertions(+), 6 deletions(-)
create mode 100644 scripts/oss-fuzz/instrumentation-filter-template
diff --git a/configure b/configure
index 9a79a004d7..dcdbe3f068 100755
--- a/configure
+++ b/configure
@@ -4198,13 +4198,21 @@ fi
##########################################
# checks for fuzzer
-if test "$fuzzing" = "yes" && test -z "${LIB_FUZZING_ENGINE+xxx}"; then
+if test "$fuzzing" = "yes" ; then
write_c_fuzzer_skeleton
- if compile_prog "$CPU_CFLAGS -Werror -fsanitize=fuzzer" ""; then
- have_fuzzer=yes
- else
- error_exit "Your compiler doesn't support -fsanitize=fuzzer"
- exit 1
+ if test -z "${LIB_FUZZING_ENGINE+xxx}"; then
+ if compile_prog "$CPU_CFLAGS -Werror -fsanitize=fuzzer" ""; then
+ have_fuzzer=yes
+ else
+ error_exit "Your compiler doesn't support -fsanitize=fuzzer"
+ exit 1
+ fi
+ fi
+
+ have_clang_coverage_filter=no
+ echo > $TMPTXT
+ if compile_prog "$CPU_CFLAGS -Werror -fsanitize=fuzzer
-fsanitize-coverage-allowlist=$TMPTXT" ""; then
+ have_clang_coverage_filter=yes
fi
fi
@@ -4884,6 +4892,14 @@ if test "$fuzzing" = "yes" ; then
else
FUZZ_EXE_LDFLAGS="$LIB_FUZZING_ENGINE"
fi
+
+ # Specify a filter to only instrument code that is directly related to
+ # virtual-devices.
+ if test "$have_clang_coverage_filter" = "yes" ; then
+ cp "$source_path/scripts/oss-fuzz/instrumentation-filter-template" \
+ instrumentation-filter
+ QEMU_CFLAGS="$QEMU_CFLAGS
-fsanitize-coverage-allowlist=instrumentation-filter"
+ fi
fi
if test "$plugins" = "yes" ; then
diff --git a/scripts/oss-fuzz/instrumentation-filter-template
b/scripts/oss-fuzz/instrumentation-filter-template
new file mode 100644
index 0000000000..76d2b6139a
--- /dev/null
+++ b/scripts/oss-fuzz/instrumentation-filter-template
@@ -0,0 +1,15 @@
+# Code that we actually want the fuzzer to target
+# See:
https://clang.llvm.org/docs/SanitizerCoverage.html#disabling-instrumentation-without-source-modification
+#
+src:*/hw/*
+src:*/include/hw/*
+src:*/slirp/*
+src:*/net/*
+
+# We don't care about coverage over fuzzer-specific code, however we should
+# instrument the fuzzer entry-point so libFuzzer always sees at least some
+# coverage - otherwise it will exit after the first input
+src:*/tests/qtest/fuzz/fuzz.c
+
+# Enable instrumentation for all functions in those files
+fun:*
--
2.30.2
- [PULL v2 0/8] Fuzzing Patches for 2021-08-25, Alexander Bulekov, 2021/08/25
- [PULL v2 1/8] fuzz: fix sparse memory access in the DMA callback, Alexander Bulekov, 2021/08/25
- [PULL v2 2/8] fuzz: adjust timeout to allow for longer inputs, Alexander Bulekov, 2021/08/25
- [PULL v2 3/8] fuzz: make object-name matching case-insensitive, Alexander Bulekov, 2021/08/25
- [PULL v2 4/8] fuzz: add an instrumentation filter,
Alexander Bulekov <=
- [PULL v2 5/8] fuzz: use ITIMER_REAL for timeouts, Alexander Bulekov, 2021/08/25
- [PULL v2 6/8] fuzz: unblock SIGALRM so the timeout works, Alexander Bulekov, 2021/08/25
- [PULL v2 7/8] MAINTAINERS: Add myself as a reviewer for Device Fuzzing, Alexander Bulekov, 2021/08/25
- [PULL v2 8/8] MAINTAINERS: add fuzzing reviewer, Alexander Bulekov, 2021/08/25
- Re: [PULL SUBSYSTEM v2 0/8] Fuzzing Patches for 2021-08-25, Alexander Bulekov, 2021/08/25