Update AFL++ commit id #9461

vanhauser-thc · 2023-01-19T13:09:39Z

minor fixes and enhancements. does not depend on the PR in clusterfuzz.

jonathanmetzman · 2023-01-20T14:12:16Z

/gcbrun trial_build.py all --sanitizer coverage --fuzzing-engine afl

jonathanmetzman · 2023-01-20T14:12:31Z

/gcbrun trial_build.py skcms --sanitizer address --fuzzing-engine libfuzzer

jonathanmetzman · 2023-01-23T14:31:44Z

/gcbrun trial_build.py all --sanitizer address --fuzzing-engine afl

jonathanmetzman · 2023-01-23T18:55:30Z

This breaks three projects. Because the breakage is a runtime, I'm a little nervous about merging this. maybe worth looking into why they break:

Step #20 - "build-check-afl-address-x86_64": [*] Attempting dry run with 'id:000000,time:0,execs:0,orig:input'...
Step #20 - "build-check-afl-address-x86_64": 
Step #20 - "build-check-afl-address-x86_64": [-] Oops, the program crashed with one of the test cases provided. There are
Step #20 - "build-check-afl-address-x86_64":     several possible explanations:
Step #20 - "build-check-afl-address-x86_64": 
Step #20 - "build-check-afl-address-x86_64":     - The test case causes known crashes under normal working conditions. If
Step #20 - "build-check-afl-address-x86_64":       so, please remove it. The fuzzer should be seeded with interesting
Step #20 - "build-check-afl-address-x86_64":       inputs - but not ones that cause an outright crash.
Step #20 - "build-check-afl-address-x86_64": 
Step #20 - "build-check-afl-address-x86_64":     - In QEMU persistent mode the selected address(es) for the loop are not
Step #20 - "build-check-afl-address-x86_64":       properly cleaning up variables and memory. Try adding
Step #20 - "build-check-afl-address-x86_64":       AFL_QEMU_PERSISTENT_GPR=1 or select better addresses in the binary.
Step #20 - "build-check-afl-address-x86_64": 
Step #20 - "build-check-afl-address-x86_64":     - Least likely, there is a horrible bug in the fuzzer. If other options
Step #20 - "build-check-afl-address-x86_64":       fail, poke <afl-users@googlegroups.com> for troubleshooting tips.
Step #20 - "build-check-afl-address-x86_64": [!] WARNING: Test case 'id:000000,time:0,execs:0,orig:input' results in a crash, skipping
Step #20 - "build-check-afl-address-x86_64": [+] All test cases processed.
Step #20 - "build-check-afl-address-x86_64": �
Step #20 - "build-check-afl-address-x86_64": [-] PROGRAM ABORT : We need at least one valid input seed that does not crash!
Step #20 - "build-check-afl-address-x86_64":          Location : main(), src/afl-fuzz.c:2228
Step #20 - "build-check-afl-address-x86_64": 
Step #20 - "build-check-afl-address-x86_64": 
Step #20 - "build-check-afl-address-x86_64": ERROR: 100.0% of fuzz targets seem to be broken. See the list above for a detailed information.

tor, woff2, pcre2

To repro:
docker pull gcr.io/oss-fuzz-base/base-builder-testing-master
docker tag gcr.io/oss-fuzz-base/base-builder-testing-master gcr.io/oss-fuzz-base/base-builder # Let's use your update AFL++
python infra/helper.py build_fuzzers --engine afl
python infra/helper.py check_build --engine afl

DonggeLiu · 2023-05-24T12:34:25Z

what do you mean? that is what this PR is about, right?

Oh, sorry if I misunderstood.
Does this PR update AFL++ to a version with the regression fix (e.g., later than d822181467ec41f1ee2d840c3c5b1918c72ffc86)?

vanhauser-thc · 2023-05-24T12:38:55Z

yes it is the most current state :)

jonathanmetzman · 2023-05-24T14:38:27Z

poppler seems to fail again but it's a different issue and it passed once. I'm going to ignore that. immer - is broken outside of this PR.failed to parse default search paths from compiler output

jonathanmetzman · 2023-05-24T14:39:13Z

infra/base-images/base-builder/compile_afl

@@ -16,8 +16,8 @@
 ################################################################################

 # Temporarily disable randomization and enforce a safe and sane setup
-export AFL_SKIP_OSSFUZZ=1


Is this reenabling randomization? I don't want to do this, sorry

It does not but however set this made a m mistake which cost afl++ a lot of effectiveness. In the future it is better to talk to me about changes.

Sorry, I'm not great at bash, but this change seems to the block here to be taken and thus randomization being reenabled. Am I misunderstanding something?

Ah you talk about the ossfuzz skip, you are right that this enables randomization. When I enabled this it was because nobody told me that this was necessary. It looked like a mistake because the line below is. Classic instrumentation is a very bad idea. In cases where targets do asm stuff a target specific “native” should be used

This pr is now 4 months old and I am not at my computer so I have little memory on this … ;)

Sure. Let me skip the randomization and try again.

jonathanmetzman · 2023-05-24T14:40:19Z

If this doesn't reenable randomization, I'm fine with it, and will merge. I don't want randomization reenabled because it's too frustrating for devs to debug builds.

jonathanmetzman · 2023-05-24T18:46:23Z

/gcbrun trial_build.py all --fuzzing-engine afl --sanitizer address

DonggeLiu · 2023-05-24T23:42:19Z

yes it is the most current state :)

Amazing, thanks!

jonathanmetzman · 2023-05-25T05:21:36Z

All of these failures look spurious.

jonathanmetzman

LGTM

vanhauser-thc · 2023-05-25T07:38:02Z

yay! :) sorry for the mix up about the random compile option feature.
please ping me for any changes you make to the afl++ setup in the future.

maflcko · 2023-05-30T10:28:16Z

Looks like this has issues building libevent for us? libfuzzer works, afl doesn't. To reproduce:

OSS_FUZZ_CI=1 python3 infra/helper.py build_fuzzers --sanitizer undefined  --engine afl bitcoin-core

...
Configuring libevent...
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /usr/bin/mkdir -p
checking for gawk... no
checking for mawk... mawk
checking whether make sets $(MAKE)... yes
checking whether make supports nested variables... yes
checking whether make supports nested variables... (cached) yes
checking whether make supports the include directive... yes (GNU style)
checking for x86_64-pc-linux-gnu-gcc... /src/aflplusplus/afl-clang-fast
checking whether the C compiler works... no
configure: error: in `/src/bitcoin-core/depends/work/build/x86_64-pc-linux-gnu/libevent/2.1.12-stable-4246a966c2d':
configure: error: C compiler cannot create executables
See `config.log' for more details
make: *** [funcs.mk:291: /src/bitcoin-core/depends/x86_64-pc-linux-gnu/.libevent_stamp_configured] Error 77

Not sure how to get the config log out of there. cc @dergoegge @fanquake

As a workaround we can revert thin LTO.

@dergoegge

LTO=1 temporarily disabled due to #9461 (comment) Also, avoid wasting storage space on a docker layer by merging the two layers. cc @dergoegge @fanquake

fanquake · 2023-05-30T15:46:30Z

Not sure how to get the config log out of there. cc @dergoegge @fanquake

configure:3759: checking whether the C compiler works
configure:3781: /src/aflplusplus/afl-clang-fast  -O1 -fno-omit-frame-pointer -gline-tables-only -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -fsanitize=array-bounds,bool,builtin,enum,float-divide-by-zero,function,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unsigned-integer-overflow,unreachable,vla-bound,vptr -fno-sanitize-recover=array-bounds,bool,builtin,enum,float-divide-by-zero,function,integer-divide-by-zero,null,object-size,return,returns-nonnull-attribute,shift,signed-integer-overflow,unreachable,vla-bound,vptr        -I/src/bitcoin-core/depends/x86_64-pc-linux-gnu/include -D_FORTIFY_SOURCE=3     -flto=thin  -L/src/bitcoin-core/depends/x86_64-pc-linux-gnu/lib     conftest.c  >&5
/usr/bin/ld: error: LLVM gold plugin: Invalid record (Producer: 'LLVM15.0.0git' Reader: 'LLVM 15.0.0git')
clang-15: error: linker command failed with exit code 1 (use -v to see invocation)
configure:3785: $? = 1
configure:3823: result: no

vanhauser-thc · 2023-05-31T10:51:41Z

an alternative solution is to set export AFL_LLVM_INSTRUMENT=LLVM-NATIVE in the build.sh script.

the problem is that pcguard 15+ produces code specific to an llvm version as it seems, and we do not build our pcguard to the specific variant of what llvm 15+ expects this breaks.

this will be quite an effort to have an own pcguard that changes behaviour based on the llvm version used ... for the time being I will make a PR to oss-fuzz that switches to llvm native instrumentation. that will be a 3%+ performance decrease though as ours is quite a bit better.

fanquake · 2023-05-31T10:59:27Z

@vanhauser-thc thanks for following up.

an alternative solution is to set export AFL_LLVM_INSTRUMENT=LLVM-NATIVE in the build.sh script.

I can confirm that using AFL_LLVM_INSTRUMENT=LLVM-NATIVE fixes configuring in our build (after re-enabling ThinLTO).

Only for merge after google#10427, which fixes the issue we saw: google#9461 (comment).

@MarcoFalke

For merge after #10427, which fixes the issue we saw with AFL++: #9461 (comment). cc @MarcoFalke @dergoegge

vanhauser-thc and others added 25 commits January 26, 2022 11:20

update to afl++ release version

41806bb

Merge branch 'google:master' into master

43cdc3a

Merge branch 'google:master' into master

fcac759

Merge branch 'google:master' into master

7fc1bae

update afl++

e77a010

Merge branch 'master' into master

7de88bf

update to support new runtime feature (activated in clusterfuzz)

fab089d

Merge branch 'google:master' into master

1955441

Merge branch 'google:master' into master

58d7b15

Merge branch 'google:master' into master

c2528fd

Merge branch 'google:master' into master

2e9f17d

Merge branch 'google:master' into master

337ee63

update afl++ commit id

5dc3d81

update afl++ commit

33ba9d9

Merge branch 'master' into master

e85016a

fix for afl-showmap for very large maps

daaf6af

Merge branch 'google:master' into master

2d175a5

update afl++ commit id

29fd2f4

Merge branch 'master' into master

c50db53

Merge branch 'google:master' into master

1923574

update afl++ commit id for llvm 15 fixes

2048069

Merge branch 'master' into master

9d64b16

Merge branch 'master' into master

7c42571

Merge branch 'google:master' into master

e9fc38b

update afl++ commit id

3510c9e

Merge branch 'master' into master

9e1bb01

jonathanmetzman reviewed May 24, 2023

View reviewed changes

Update compile_afl

9898344

jonathanmetzman approved these changes May 25, 2023

View reviewed changes

jonathanmetzman merged commit 10473b7 into google:master May 25, 2023

maflcko mentioned this pull request May 30, 2023

bitcoin-core: Temporarily disable LTO=1 #10423

Merged

DavidKorczynski pushed a commit that referenced this pull request May 30, 2023

bitcoin-core: Temporarily disable LTO=1 (#10423)

58ff523

LTO=1 temporarily disabled due to #9461 (comment) Also, avoid wasting storage space on a docker layer by merging the two layers. cc @dergoegge @fanquake

vanhauser-thc mentioned this pull request May 31, 2023

switch to AFL++'s new pcguard instrumentation #10427

Merged

fanquake mentioned this pull request May 31, 2023

bitcoin-core: re-enable LTO (take 4) #10428

Merged

fanquake added a commit to fanquake/oss-fuzz that referenced this pull request Jul 14, 2023

bitcoin-core: re-enable LTO (take 4)

b00c2be

Only for merge after google#10427, which fixes the issue we saw: google#9461 (comment).

DavidKorczynski pushed a commit that referenced this pull request Jul 14, 2023

bitcoin-core: re-enable LTO (take 4) (#10428)

a2cf9fa

For merge after #10427, which fixes the issue we saw with AFL++: #9461 (comment). cc @MarcoFalke @dergoegge

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update AFL++ commit id #9461

Update AFL++ commit id #9461

vanhauser-thc commented Jan 19, 2023

jonathanmetzman commented Jan 20, 2023

jonathanmetzman commented Jan 20, 2023

jonathanmetzman commented Jan 23, 2023

jonathanmetzman commented Jan 23, 2023

DonggeLiu commented May 24, 2023

vanhauser-thc commented May 24, 2023

jonathanmetzman commented May 24, 2023

jonathanmetzman May 24, 2023 •

edited

Loading

vanhauser-thc May 24, 2023

jonathanmetzman May 24, 2023

vanhauser-thc May 24, 2023

vanhauser-thc May 24, 2023

jonathanmetzman May 24, 2023

jonathanmetzman commented May 24, 2023 •

edited

Loading

jonathanmetzman commented May 24, 2023

DonggeLiu commented May 24, 2023

jonathanmetzman commented May 25, 2023

jonathanmetzman left a comment

vanhauser-thc commented May 25, 2023

maflcko commented May 30, 2023

fanquake commented May 30, 2023

vanhauser-thc commented May 31, 2023

fanquake commented May 31, 2023

Update AFL++ commit id #9461

Update AFL++ commit id #9461

Conversation

vanhauser-thc commented Jan 19, 2023

jonathanmetzman commented Jan 20, 2023

jonathanmetzman commented Jan 20, 2023

jonathanmetzman commented Jan 23, 2023

jonathanmetzman commented Jan 23, 2023

DonggeLiu commented May 24, 2023

vanhauser-thc commented May 24, 2023

jonathanmetzman commented May 24, 2023

jonathanmetzman May 24, 2023 • edited Loading

Choose a reason for hiding this comment

vanhauser-thc May 24, 2023

Choose a reason for hiding this comment

jonathanmetzman May 24, 2023

Choose a reason for hiding this comment

vanhauser-thc May 24, 2023

Choose a reason for hiding this comment

vanhauser-thc May 24, 2023

Choose a reason for hiding this comment

jonathanmetzman May 24, 2023

Choose a reason for hiding this comment

jonathanmetzman commented May 24, 2023 • edited Loading

jonathanmetzman commented May 24, 2023

DonggeLiu commented May 24, 2023

jonathanmetzman commented May 25, 2023

jonathanmetzman left a comment

Choose a reason for hiding this comment

vanhauser-thc commented May 25, 2023

maflcko commented May 30, 2023

fanquake commented May 30, 2023

vanhauser-thc commented May 31, 2023

fanquake commented May 31, 2023

jonathanmetzman May 24, 2023 •

edited

Loading

jonathanmetzman commented May 24, 2023 •

edited

Loading