aboutsummaryrefslogtreecommitdiff
path: root/compiler-rt/lib/fuzzer/FuzzerTracePC.cpp
AgeCommit message (Collapse)AuthorFilesLines
2025-09-19Fix libFuzzer array alignment with empty modules (#159661)Bitshift1-0/+3
The following assertion was being triggered: ``` assert.h assertion failed at llvm-project/compiler-rt/lib/fuzzer/FuzzerTracePC.cpp:237 in void fuzzer::TracePC::UpdateObservedPCs(): M.Size() == (size_t)(ModulePCTable[i].Stop - ModulePCTable[i].Start) ``` # The bug When built with `-fsanitize=fuzzer`, each “module” (.so file, or the binary itself) will be instrumented, and when loaded into the process will make a call to these two functions: - `__sanitizer_cov_8bit_counters_init` - `__sanitizer_cov_pcs_init` Each of these is called with start and end pointers defining an array. In libFuzzer, these functions are implemented with `HandleInline8bitCountersInit` and `HandlePCsInit`. Each of them pushes back the provided pointers into a separate array, `Modules` and `ModulePCTable` respectively. These arrays are meant to be kept in-sync; index i into Modules should refer to the same `.so` as index i into ModulePCTable. The assertion was triggering because these lists got out-of-sync. The problem is that the 8bit handler contains this line: ``` if (Start == Stop) return; ``` but the PC handler contains no such corresponding line. This meant that if a module was ever instrumented but “empty” (its 8bit counter and PC arrays were both of length 0), then its PC array would still be added but its 8bit counter array would not. # Why this issue was never seen before The circumstances to trigger this issue are unusual: - You need a compilation unit that doesn't contain any code (though it may contain global variable declarations and similar). That doesn't happen very often. - That compilation unit must be dynamically linked, not statically linked. If statically linked, it’ll be merged into a single “module” with the main binary, and the arrays will be merged as well; you won’t end up with length-0 arrays. - To notice the issue, assertions must be enabled. If disabled, libFuzzer will be buggy (it may have worse coverage), but it won't crash, and "worse coverage" is extremely unlikely to be noticed. # This change This change solves the issue by adding the same `if (Start == Stop) return;` check to `HandlePCsInit`. This prevents the arrays from getting out-of-sync. This change also adds a test that identifies the previous issue when compiled with assertions enabled, but now passes with the fix.
2023-07-18[fuzzer] Enable loongarch64Youling Tang1-2/+2
Enable fuzzer on loongarch64. Reviewed By: SixWeining, xen0n, MaskRay Differential Revision: https://reviews.llvm.org/D140601
2022-02-22[libFuzzer] Refactor GetNextInstructionPc/GetPreviousInstructionPcFangrui Song1-4/+5
Port the change to compiler-rt/lib/fuzzer/FuzzerTracePC.cpp . Update RISCV to use PC-2: this is coarse (C extension may be disabled) but sufficient for pure symbolization purpose. The commit is separate from D120362 so that bisecting/reverting is easier.
2021-11-05[libFuzzer] Disable Msan on InternalStrnlenVitaly Buka1-0/+2
It's called from ATTRIBUTE_NO_SANITIZE_MEMORY code. It worked as expected if inlined and complained otherwise. Reviewed By: eugenis Differential Revision: https://reviews.llvm.org/D113323
2021-09-04[compiler-rt] NFC: Fix trivial typoKazuaki Ishizaki1-1/+1
Reviewed By: xgupta Differential Revision: https://reviews.llvm.org/D77457
2021-08-03[libFuzzer] replace Vector/Set with std::vector/std::set. The custom names ↵Kostya Serebryany1-3/+3
are not required any more since we now build with a private version of libc++. Fix some of the 81+ character lines. Mechanical change, NFC expected. [libFuzzer] replace Vector/Set with std::vector/std::set. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D107374
2021-07-02Revert "Refactor mutation strategies into a standalone library"Marco Vanotti1-0/+1
This reverts commit 361f742f168de0f0f256802a329c19d081615d0d.
2021-07-02Refactor mutation strategies into a standalone libraryAaron Green1-1/+0
This change introduces libMutagen/libclang_rt.mutagen.a as a subset of libFuzzer/libclang_rt.fuzzer.a. This library contains only the fuzzing strategies used by libFuzzer to produce new test inputs from provided inputs, dictionaries, and SanitizerCoverage feedback. Most of this change is simply moving sections of code to one side or the other of the library boundary. The only meaningful new code is: * The Mutagen.h interface and its implementation in Mutagen.cpp. * The following methods in MutagenDispatcher.cpp: * UseCmp * UseMemmem * SetCustomMutator * SetCustomCrossOver * LateInitialize (similar to the MutationDispatcher's original constructor) * Mutate_AddWordFromTORC (uses callbacks instead of accessing TPC directly) * StartMutationSequence * MutationSequence * DictionaryEntrySequence * RecommendDictionary * RecommendDictionaryEntry * FuzzerMutate.cpp (which now justs sets callbacks and handles printing) * MutagenUnittest.cpp (which adds tests of Mutagen.h) A note on performance: This change was tested with a 100 passes of test/fuzzer/LargeTest.cpp with 1000 runs per pass, both with and without the change. The running time distribution was qualitatively similar both with and without the change, and the average difference was within 30 microseconds (2.240 ms/run vs 2.212 ms/run, respectively). Both times were much higher than observed with the fully optimized system clang (~0.38 ms/run), most likely due to the combination of CMake "dev mode" settings (e.g. CMAKE_BUILD_TYPE="Debug", LLVM_ENABLE_LTO=OFF, etc.). The difference between the two versions built similarly seems to be "in the noise" and suggests no meaningful performance degradation. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D102447
2021-05-26Revert "Refactor mutation strategies into a standalone library"Matt Morehouse1-0/+1
This reverts commit c4a41cd77c15c2905ac74beeec09f8343a65a549 due to buildbot failure.
2021-05-26Refactor mutation strategies into a standalone libraryAaron Green1-1/+0
This change introduces libMutagen/libclang_rt.mutagen.a as a subset of libFuzzer/libclang_rt.fuzzer.a. This library contains only the fuzzing strategies used by libFuzzer to produce new test inputs from provided inputs, dictionaries, and SanitizerCoverage feedback. Most of this change is simply moving sections of code to one side or the other of the library boundary. The only meaningful new code is: * The Mutagen.h interface and its implementation in Mutagen.cpp. * The following methods in MutagenDispatcher.cpp: * UseCmp * UseMemmem * SetCustomMutator * SetCustomCrossOver * LateInitialize (similar to the MutationDispatcher's original constructor) * Mutate_AddWordFromTORC (uses callbacks instead of accessing TPC directly) * StartMutationSequence * MutationSequence * DictionaryEntrySequence * RecommendDictionary * RecommendDictionaryEntry * FuzzerMutate.cpp (which now justs sets callbacks and handles printing) * MutagenUnittest.cpp (which adds tests of Mutagen.h) A note on performance: This change was tested with a 100 passes of test/fuzzer/LargeTest.cpp with 1000 runs per pass, both with and without the change. The running time distribution was qualitatively similar both with and without the change, and the average difference was within 30 microseconds (2.240 ms/run vs 2.212 ms/run, respectively). Both times were much higher than observed with the fully optimized system clang (~0.38 ms/run), most likely due to the combination of CMake "dev mode" settings (e.g. CMAKE_BUILD_TYPE="Debug", LLVM_ENABLE_LTO=OFF, etc.). The difference between the two versions built similarly seems to be "in the noise" and suggests no meaningful performance degradation. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D102447
2021-03-11[crt][fuzzer] Fix up various numeric conversionsAaron Green1-1/+10
Attempting to build a standalone libFuzzer in Fuchsia's default toolchain for the purpose of cross-compiling the unit tests revealed a number of not-quite-proper type conversions. Fuchsia's toolchain include `-std=c++17` and `-Werror`, among others, leading to many errors like `-Wshorten-64-to-32`, `-Wimplicit-float-conversion`, etc. Most of these have been addressed by simply making the conversion explicit with a `static_cast`. These typically fell into one of two categories: 1) conversions between types where high precision isn't critical, e.g. the "energy" calculations for `InputInfo`, and 2) conversions where the values will never reach the bits being truncated, e.g. `DftTimeInSeconds` is not going to exceed 136 years. The major exception to this is the number of features: there are several places that treat features as `size_t`, and others as `uint32_t`. This change makes the decision to cap the features at 32 bits. The maximum value of a feature as produced by `TracePC::CollectFeatures` is roughly: (NumPCsInPCTables + ValueBitMap::kMapSizeInBits + ExtraCountersBegin() - ExtraCountersEnd() + log2(SIZE_MAX)) * 8 It's conceivable for extremely large targets and/or extra counters that this limit could be reached. This shouldn't break fuzzing, but it will cause certain features to collide and lower the fuzzers overall precision. To address this, this change adds a warning to TracePC::PrintModuleInfo about excessive feature size if it is detected, and recommends refactoring the fuzzer into several smaller ones. Reviewed By: morehouse Differential Revision: https://reviews.llvm.org/D97992
2020-10-23[libFuzzer] Added -print_full_coverage flag.Max Moroz1-9/+25
-print_full_coverage=1 produces a detailed branch coverage dump when run on a single file. Uses same infrastructure as -print_coverage flag, but prints all branches (regardless of coverage status) in an easy-to-parse format. Usage: For internal use with machine learning fuzzing models which require detailed coverage information on seed files to generate mutations. Differential Revision: https://reviews.llvm.org/D85928
2020-07-14[libFuzzer] Separate platform related macros out from FuzzerDefs.h into ↵Dokyung Song1-0/+1
FuzzerPlatform.h, and adjust includes in other files. Summary: This patch separates platform related macros in lib/fuzzer/FuzzerDefs.h into lib/fuzzer/FuzzerPlatform.h, and use FuzzerPlatform.h where necessary. This separation helps when compiling libFuzzer's interceptor module (under review); an unnecessary include of standard headers (such as string.h) may produce conflicts/ambiguation with the interceptor's declarations/definitions of library functions, which complicates interceptor implementation. Reviewers: morehouse, hctim Reviewed By: morehouse Subscribers: krytarowski, #sanitizers Tags: #sanitizers Differential Revision: https://reviews.llvm.org/D83805
2020-02-03[libFuzzer] Make dataflow and focus functions more user friendly.Max Moroz1-1/+7
Summary: - Fail loudly if SetFocusFunction failed when it should not. For more info see - https://github.com/google/oss-fuzz/issues/3311 - https://github.com/google/sanitizers/issues/1190 - Fail loudly if CollectDataFlow is called without seed corpus. Reviewers: kcc, metzman Subscribers: #sanitizers, llvm-commits Tags: #sanitizers, #llvm Differential Revision: https://reviews.llvm.org/D73813
2019-10-01[libFuzzer] Remove lazy counters.Matt Morehouse1-39/+0
Summary: Lazy counters haven't improved performance for large fuzz targets. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits Tags: #llvm Differential Revision: https://reviews.llvm.org/D67476 llvm-svn: 373403
2019-07-31compiler-rt: Rename .cc file in lib/sanitizer_common to .cppNico Weber1-1/+1
See https://reviews.llvm.org/D58620 for discussion, and for the commands I ran. In addition I also ran for f in $(svn diff | diffstat | grep .cc | cut -f 2 -d ' '); do rg $f . ; done and manually updated (many) references to renamed files found by that. llvm-svn: 367463
2019-05-09[libFuzzer] perform more agressive value profiling in memcmpKostya Serebryany1-2/+7
llvm-svn: 360385
2019-02-15[libFuzzer] print new functions as they are discovered in the fork modeKostya Serebryany1-5/+15
llvm-svn: 354092
2019-02-14[libFuzzer] when doing the merge, keep track of the coveraged edges, not ↵Kostya Serebryany1-10/+22
just features llvm-svn: 354076
2019-02-12[libFuzzer] simplify the code for print_coverage=1 so that it doesn't fail ↵Kostya Serebryany1-2/+2
on broken debug info llvm-svn: 353781
2019-01-31[fuzzer] Use RawPrint instead of Printf for instrumentation warningJonathan Metzman1-6/+10
Summary: Use RawPrint instead of Printf for instrumentation warning because Printf doesn't work on Win when instrumentation is being initialized (since OutputFile is not yet initialized). Reviewers: kcc Reviewed By: kcc Differential Revision: https://reviews.llvm.org/D57531 llvm-svn: 352789
2019-01-31[libFuzzer] experimental performance optimization -lazy_counters, off by ↵Kostya Serebryany1-0/+39
default. Posix-only for now, tested on Linux llvm-svn: 352700
2019-01-30[libFuzzer] refactor the handling of instrumentation counters so that they ↵Kostya Serebryany1-35/+51
are grouped in regions one full page each. Needed for future optimization. NFC llvm-svn: 352603
2019-01-29[libFuzzer] remove stale code Kostya Serebryany1-71/+2
llvm-svn: 352571
2019-01-29[libFuzzer] revert an accidental commitKostya Serebryany1-3/+35
llvm-svn: 352567
2019-01-29[libFuzzer] remove deprecated support for -fsanitize-coverage=trace-pc[-guard]Kostya Serebryany1-35/+3
llvm-svn: 352566
2019-01-29[libFuzzer] remove deprecated support for -fsanitize-coverage=trace-pc[-guard]Kostya Serebryany1-9/+12
llvm-svn: 352564
2019-01-26[libFuzzer] print uncovered functions when doing -print_coverage=1Kostya Serebryany1-6/+6
llvm-svn: 352263
2019-01-24[libFuzzer] more agressive value profiling and CMP tracing for switch statementsKostya Serebryany1-11/+31
llvm-svn: 352107
2019-01-19Update the file headers across all of the LLVM projects in the monorepoChandler Carruth1-4/+3
to reflect the new license. We understand that people may be surprised that we're moving the header entirely to discuss the new license. We checked this carefully with the Foundation's lawyer and we believe this is the correct approach. Essentially, all code in the project is now made available by the LLVM project under our new license, so you will see that the license headers include that license only. Some of our contributors have contributed code under our old license, and accordingly, we have retained a copy of our old license notice in the top-level files in each project and repository. llvm-svn: 351636
2019-01-15[libFuzzer] Remove unstable edge handlingJonathan Metzman1-78/+9
Summary: Remove code for handling unstable edges from libFuzzer since it has not been found useful. Differential Revision: https://reviews.llvm.org/D56730 llvm-svn: 351262
2019-01-09[libfuzzer][MSVC] Make calls to builtin functions work with MSVCJonathan Metzman1-18/+19
Summary: Replace calls to builtin functions with macros or functions that call the Windows-equivalents when targeting windows and call the original builtin functions everywhere else. This change makes more parts of libFuzzer buildable with MSVC. Reviewers: vitalybuka Reviewed By: vitalybuka Subscribers: mgorny, rnk, thakis Differential Revision: https://reviews.llvm.org/D56439 llvm-svn: 350766
2018-10-10[libFuzzer] Generalize the code for getting the previous offset for ↵George Karpenkov1-13/+33
different architectures Without this change, tests in coverage.test and dump_coverage.test are failing on non-x86_64 platforms. The diff is copied from sanitizer_common library, an alternative would be to link it together with libFuzzer. Differential Revision: https://reviews.llvm.org/D53040 llvm-svn: 344104
2018-08-30[libFuzzer] Port to WindowsMatt Morehouse1-2/+1
Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Patch By: metzman Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: #sanitizers, delcypher, morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 341082
2018-08-29Revert "[libFuzzer] Port to Windows"Matt Morehouse1-1/+2
This reverts r340949 due to bot breakage again. llvm-svn: 340954
2018-08-29[libFuzzer] Port to WindowsMatt Morehouse1-2/+1
Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: #sanitizers, delcypher, morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 340949
2018-08-28Revert "[libFuzzer] Port to Windows"Matt Morehouse1-1/+2
This reverts commit r340860 due to failing tests. llvm-svn: 340867
2018-08-28[libFuzzer] Port to WindowsMatt Morehouse1-2/+1
Summary: Port libFuzzer to windows-msvc. This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well. It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch. It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them. Patch By: metzman Reviewers: morehouse, rnk Reviewed By: morehouse, rnk Subscribers: morehouse, kcc, eraman Differential Revision: https://reviews.llvm.org/D51022 llvm-svn: 340860
2018-08-08[libFuzzer] Optimize handle unstable checks by reducing iterationsMax Moroz1-4/+14
Summary: We only run the 3rd check if 2nd check finds unstable edges. 3rd UpdateUnstableCounters is now merged with ApplyUnstableCounters to only run 1 iteration. Patch by Kyungtak Woo (@kevinwkt). Reviewers: Dor1s, metzman, morehouse Reviewed By: Dor1s, morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Differential Revision: https://reviews.llvm.org/D50411 llvm-svn: 339249
2018-08-06[libFuzzer] Add unstable function printing to print_unstable_stats flagMax Moroz1-2/+14
Summary: There may be cases in which a user wants to know which part of their code is unstable. We use ObservedFuncs and UnstableCounters to print at exit which of the ObservedFunctions are unstable under the -print_unstable_stats flag. Patch by Kyungtak Woo (@kevinwkt). Reviewers: Dor1s, metzman, morehouse Reviewed By: Dor1s, metzman, morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Differential Revision: https://reviews.llvm.org/D50264 llvm-svn: 339081
2018-08-02[libFuzzer] use absolute distance in addition to the hamming distance in ↵Kostya Serebryany1-10/+5
value profiling; our A/B testing have (somewhat weak) indication that this provides an additional signal for corpus expansion llvm-svn: 338661
2018-07-24[libFuzzer] Handle unstable edges by disregarding unstable edgesMax Moroz1-4/+7
Summary: Added a new mode within flag -handle_unstable for new unstable handling algorithm that does the following: When an edge is shown as unstable, copy to UnstableCounters the value 0. During ApplyUnstableCounters we copy back the value 0 to ModuleInline8bitCounters if the edge was unstable. This way we would be ignoring completely features that were collected through non-determinism. Unstable hits would be counted as if it never hit. Reviewers: metzman, Dor1s, kcc, morehouse Reviewed By: metzman, morehouse Subscribers: delcypher, llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D49684 llvm-svn: 337853
2018-07-23[libFuzzer] Handle unstable edges by using minimum hit countsMax Moroz1-6/+15
Summary: Created unstable_handle flag that takes 1 or 2, depending on the handling type. Modified RunOne to accommodate the following heuristic: Use the first CollectFeatures to count how many features there are. If no new features, CollectFeatures like before. If there is new feature, we run CB 2 more times, Check which edges are unstable per input and we store the least amount of hit counts for each edge. Apply these hit counts back to inline8bitcounters so that CollectFeatures can work as intended. Modified UnstableCounters to 8int_t and created a bitset UnstableSet to tell which edges are unstable. Patch by Kyungtak Woo (@kevinwkt). Reviewers: Dor1s, metzman, morehouse Reviewed By: Dor1s, morehouse Subscribers: delcypher, #sanitizers, llvm-commits, kcc Differential Revision: https://reviews.llvm.org/D49525 llvm-svn: 337696
2018-07-19[libFuzzer] when -print_coverage=1 is given, print more stats (the number of ↵Kostya Serebryany1-13/+16
seeds that hit every given function) llvm-svn: 337501
2018-07-18[libFuzzer] Create single template for visiting Inline8bitCountersMax Moroz1-27/+22
Summary: Created IterateInline8bitCounters, a single template for visiting Inline8bitCounters (nested for loop) Made InitializeUnstableCounters and UpdateUnstableCounters both send a lambda to IterateInline8bitCounters. Patch by Kyungtak Woo (@kevinwkt). Reviewers: Dor1s, metzman, kcc, morehouse Reviewed By: metzman, morehouse Subscribers: delcypher, llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D49453 llvm-svn: 337403
2018-07-17libFuzzer: prevent irrelevant strings from leaking into auto-dictionaryMatt Morehouse1-10/+8
This is a fix for bug 37047. https://bugs.llvm.org/show_bug.cgi?id=37047 Implemented by basically reversing the logic. Previously all strings were considered, with some operations excluded. Now strings are excluded by default, and only strings during the CB considered. Patch By: pdknsk Differential Revision: https://reviews.llvm.org/D48800 llvm-svn: 337296
2018-07-16[libFuzzer] Implement stat::stability_rate based on the percentage of ↵Max Moroz1-0/+40
unstable edges. Summary: Created a -print_unstable_stats flag. When -print_unstable_stats=1, we run it 2 more times on interesting inputs poisoning unstable edges in an array. On program termination, we run PrintUnstableStats() which will print a line with a stability percentage like AFL does. Patch by Kyungtak Woo (@kevinwkt). Reviewers: metzman, Dor1s, kcc, morehouse Reviewed By: metzman, Dor1s, morehouse Subscribers: delcypher, llvm-commits, #sanitizers, kcc, morehouse, Dor1s Differential Revision: https://reviews.llvm.org/D49212 llvm-svn: 337187
2018-07-16Revert r337175 (https://reviews.llvm.org/D49212) due to unintentional format ↵Max Moroz1-43/+3
changes. llvm-svn: 337180
2018-07-16[libFuzzer] Implement stat::stability_rate based on the percentage of ↵Max Moroz1-3/+43
unstable edges. Summary: Created a -print_unstable_stats flag. When -print_unstable_stats=1, we run it 2 more times on interesting inputs poisoning unstable edges in an array. On program termination, we run PrintUnstableStats() which will print a line with a stability percentage like AFL does. Patch by Kyungtak Woo (@kevinwkt). Reviewers: metzman, Dor1s, kcc, morehouse Reviewed By: metzman, Dor1s, morehouse Subscribers: delcypher, llvm-commits, #sanitizers, kcc, morehouse, Dor1s Differential Revision: https://reviews.llvm.org/D49212 llvm-svn: 337175
2018-07-06libFuzzer: always print line-break for NEW_FUNC/PC outputKostya Serebryany1-3/+6
Summary: This is a minor cosmetic change. When function/path exceed ~1000 characters, the output is truncated before the line-break. I noticed this for NEW_FUNC. Reviewers: kcc Reviewed By: kcc Subscribers: llvm-commits, #sanitizers Differential Revision: https://reviews.llvm.org/D48799 llvm-svn: 336461
generated by cgit v1.1 at 2025-10-04 09:12:05 +0000