Commit Graph

291 Commits

Author SHA1 Message Date
Diana Picus 0bf0b8ff7c [libFuzzer] Disable fork.test on AArch64
This crashes sporadically on our AArch64 buildbots. Disable for now.

llvm-svn: 366055
2019-07-15 11:33:41 +00:00
Reid Kleckner 1a285c27fd Use clang driver for libfuzzer tests on Windows
Summary:
There's no real reason to use clang-cl on Windows, the clang driver
works just as well. This fixes a test which uses the -O0 flag, which was
recently removed from clang-cl to match MSVC, which lacks this flag.

While I'm here, remove the explicit -std=c++11 flag. Previously, this
flag was necessary when the default C++ standard was C++98. Now that the
default is C++14, this is no longer necessary. It's problematic on
Windows, because the Visual C++ standard library relies on C++14
features, and attempting to compile it with C++11 results in errors.
Rather than adding logic to conditionally set the standard to C++11 only
on non-Win, this flag can be removed.

See http://lab.llvm.org:8011/builders/clang-x64-windows-msvc and
https://reviews.llvm.org/D64506.

Reviewers: morehouse, thakis

Subscribers: #sanitizers, llvm-commits

Tags: #sanitizers, #llvm

Differential Revision: https://reviews.llvm.org/D64587

llvm-svn: 365841
2019-07-11 23:20:04 +00:00
Julian Lettner 611c122045 Revert "[TSan] Attempt to fix iOS on-device test"
This reverts commit a2ca358291.

llvm-svn: 365375
2019-07-08 19:26:21 +00:00
Julian Lettner a2ca358291 [TSan] Attempt to fix iOS on-device test
llvm-svn: 365257
2019-07-06 00:49:44 +00:00
Julian Lettner b6654319f7 Remove `XFAIL: ios` from test that passes in CI
llvm-svn: 365253
2019-07-05 22:53:18 +00:00
Reid Kleckner 8007ff1ab1 [compiler-rt] Rename lit.*.cfg.* -> lit.*.cfg.py.*
These lit configuration files are really Python source code. Using the
.py file extension helps editors and tools use the correct language
mode. LLVM and Clang already use this convention for lit configuration,
this change simply applies it to all of compiler-rt.

Reviewers: vitalybuka, dberris

Differential Revision: https://reviews.llvm.org/D63658

llvm-svn: 364591
2019-06-27 20:56:04 +00:00
Kostya Serebryany 679669a77e [libFuzzer] split DataFlow.cpp into two .cpp files, one of which can be compiled w/o dfsan to speed things up (~25% speedup)
llvm-svn: 364002
2019-06-21 01:39:35 +00:00
Kostya Serebryany 27cf743bff [libFuzzer] ensure that DFT and autofocus works for C++ (mangled) functions
llvm-svn: 363905
2019-06-20 01:48:45 +00:00
Hans Wennborg 2cf990fa27 Revert r363633 "[CMake] Fix the value of `config.target_cflags` for non-macOS Apple platforms. Attempt #2."
This caused Chromium's clang package to stop building, see comment on
https://reviews.llvm.org/D61242 for details.

> Summary:
> The main problem here is that `-*-version_min=` was not being passed to
> the compiler when building test cases. This can cause problems when
> testing on devices running older OSs because Clang would previously
> assume the minimum deployment target is the the latest OS in the SDK
> which could be much newer than what the device is running.
>
> Previously the generated value looked like this:
>
> `-arch arm64 -isysroot
> <path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`
>
> With this change it now looks like:
>
> `-arch arm64 -stdlib=libc++ -miphoneos-version-min=8.0 -isysroot
> <path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`
>
> This mirrors the setting of `config.target_cflags` on macOS.
>
> This change is made for ASan, LibFuzzer, TSan, and UBSan.
>
> To implement this a new `get_test_cflags_for_apple_platform()` function
> has been added that when given an Apple platform name and architecture
> returns a string containing the C compiler flags to use when building
> tests. This also calls a new helper function `is_valid_apple_platform()`
> that validates Apple platform names.
>
> This is the second attempt at landing the patch. The first attempt (r359305)
> had to be reverted (r359327) due to a buildbot failure. The problem was
> that calling `get_test_cflags_for_apple_platform()` can trigger a CMake
> error if the provided architecture is not supported by the current
> CMake configuration. Previously, this could be triggered by passing
> `-DCOMPILER_RT_ENABLE_IOS=OFF` to CMake. The root cause is that we were
> generating test configurations for a list of architectures without
> checking if the relevant Sanitizer actually supported that architecture.
> We now intersect the list of architectures for an Apple platform
> with `<SANITIZER>_SUPPORTED_ARCH` (where `<SANITIZER>` is a Sanitizer
> name) to iterate through the correct list of architectures.
>
> rdar://problem/50124489
>
> Reviewers: kubamracek, yln, vsk, juliehockett, phosek
>
> Subscribers: mgorny, javed.absar, kristof.beyls, #sanitizers, llvm-commits
>
> Tags: #llvm, #sanitizers
>
> Differential Revision: https://reviews.llvm.org/D61242

llvm-svn: 363779
2019-06-19 09:09:39 +00:00
Dan Liew 964909e4a6 [CMake] Fix the value of `config.target_cflags` for non-macOS Apple platforms. Attempt #2.
Summary:
The main problem here is that `-*-version_min=` was not being passed to
the compiler when building test cases. This can cause problems when
testing on devices running older OSs because Clang would previously
assume the minimum deployment target is the the latest OS in the SDK
which could be much newer than what the device is running.

Previously the generated value looked like this:

`-arch arm64 -isysroot
<path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`

With this change it now looks like:

`-arch arm64 -stdlib=libc++ -miphoneos-version-min=8.0 -isysroot
<path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`

This mirrors the setting of `config.target_cflags` on macOS.

This change is made for ASan, LibFuzzer, TSan, and UBSan.

To implement this a new `get_test_cflags_for_apple_platform()` function
has been added that when given an Apple platform name and architecture
returns a string containing the C compiler flags to use when building
tests. This also calls a new helper function `is_valid_apple_platform()`
that validates Apple platform names.

This is the second attempt at landing the patch. The first attempt (r359305)
had to be reverted (r359327) due to a buildbot failure. The problem was
that calling `get_test_cflags_for_apple_platform()` can trigger a CMake
error if the provided architecture is not supported by the current
CMake configuration. Previously, this could be triggered by passing
`-DCOMPILER_RT_ENABLE_IOS=OFF` to CMake. The root cause is that we were
generating test configurations for a list of architectures without
checking if the relevant Sanitizer actually supported that architecture.
We now intersect the list of architectures for an Apple platform
with `<SANITIZER>_SUPPORTED_ARCH` (where `<SANITIZER>` is a Sanitizer
name) to iterate through the correct list of architectures.

rdar://problem/50124489

Reviewers: kubamracek, yln, vsk, juliehockett, phosek

Subscribers: mgorny, javed.absar, kristof.beyls, #sanitizers, llvm-commits

Tags: #llvm, #sanitizers

Differential Revision: https://reviews.llvm.org/D61242

llvm-svn: 363633
2019-06-17 23:37:46 +00:00
Kostya Serebryany db88fc56b9 [libFuzzer] implement a better queue for the fork mode. Add an internal flag -stop_file to allow graceful shutdown of fuzzing. Enhance the logging in the fork mode
llvm-svn: 363470
2019-06-14 22:56:50 +00:00
Kostya Serebryany 3f39123d15 [libFuzzer] simplify the DFT trace collection using the new faster DFSan mode that traces up to 16 labels at a time and never runs out of labels. Second attempt. This time with a fix for windows (putenv instead of setenv))
llvm-svn: 363445
2019-06-14 19:54:32 +00:00
Max Moroz 0784e01a98 [libFuzzer] Disable len_control by default if LLVMFuzzerCustomMutator is used.
Summary:
Some custom mutators may not peform well when size restriction is
enforced by len_control. Because of that, it's safer to disable len_control
by default in such cases, but still allow users to enable it manually.
Bug example: https://bugs.chromium.org/p/chromium/issues/detail?id=919530.

Tested manually with LPM-based and regular fuzz targets.

Reviewers: kcc, vitalybuka, metzman

Reviewed By: kcc, metzman

Subscribers: delcypher, #sanitizers, llvm-commits

Tags: #llvm, #sanitizers

Differential Revision: https://reviews.llvm.org/D63334

llvm-svn: 363443
2019-06-14 19:34:11 +00:00
Hans Wennborg 9bc707c0e5 Revert r363326 "[libFuzzer] simplify the DFT trace collection using the new faster DFSan mode that traces up to 16 labels at a time and never runs out of labels."
It broke the Windows build:

C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\fuzzer\FuzzerDataFlowTrace.cpp(243): error C3861: 'setenv': identifier not found

This also reverts the follow-up r363327.

llvm-svn: 363358
2019-06-14 07:32:22 +00:00
Kostya Serebryany a5b12be60f fix whitespaces
llvm-svn: 363327
2019-06-13 21:17:49 +00:00
Kostya Serebryany 2fa83cb7ee [libFuzzer] simplify the DFT trace collection using the new faster DFSan mode that traces up to 16 labels at a time and never runs out of labels.
llvm-svn: 363326
2019-06-13 21:17:49 +00:00
Max Moroz 10ed68189a Add FuzzedDataProvider helper class / single header library.
Summary:
This class is useful for writing fuzz target that have multiple inputs.

Current CL imports the existing `FuzzedDataProvider` from Chromium
without any modifications. Feel free to review it thoroughly, if you're
interested, but I'd prefer changing the class in a follow up CL.

The CL also introduces an exhaustive test for the library, as the behavior
of `FuzzedDataProvider` must not change over time.

In follow up CLs I'm planning on changing some implementation details
(I can share a doc with some comments to be addressed). After that, we
will document how `FuzzedDataProvider` should be used.

I have tested this on Linux, Windows and Mac platforms.

Reviewers: morehouse, metzman, kcc

Reviewed By: morehouse

Subscribers: metzman, thakis, rnk, mgorny, ormris, delcypher, #sanitizers, llvm-commits

Tags: #llvm, #sanitizers

Differential Revision: https://reviews.llvm.org/D62733

llvm-svn: 363071
2019-06-11 14:30:18 +00:00
Kostya Serebryany 060f4b48d5 [libFuzzer] when using data-flow-trace (DFT) only load the DFT for the files present in the corpus
llvm-svn: 361579
2019-05-24 00:43:52 +00:00
Kostya Serebryany eac9a7830b [libFuzzer] remove the data-flow-trace (DFT) python scripts; their functionality is now part of libFuzzer proper; also write functions.txt to the disk only if this file doesn't exist yet
llvm-svn: 361452
2019-05-23 01:03:42 +00:00
Kostya Serebryany b7cc3d9953 [libFuzzer] automatically collect the data flow trace (DFT) in the fork mode if -collect_data_flow= is given
llvm-svn: 361448
2019-05-23 00:22:46 +00:00
Matt Morehouse 4d7a6142de [libFuzzer] Sleep after process exits in merge-sigusr.test.
Ensure that log file has been fully updated before trying to read it.

llvm-svn: 361339
2019-05-22 00:41:54 +00:00
Matt Morehouse 9e0f6cc3a3 [libFuzzer] Kill by session ID in merge-sigusr.test.
Ensures that parent and all child processes are killed at once.

llvm-svn: 361336
2019-05-21 23:54:39 +00:00
Matt Morehouse db62d375dc [libFuzzer] Ignore exit status of wait in merge-sigusr.test.
If process $PID has already exited, wait will give a non-zero exit
status.

llvm-svn: 361326
2019-05-21 22:48:40 +00:00
Matt Morehouse df17ddf9fc [libFuzzer] Reduce flakiness of merge-sigusr.test.
Double the number of files to merge, and use wait instead of sleep.

llvm-svn: 361313
2019-05-21 21:15:51 +00:00
Matt Morehouse ef7e4d530c [libFuzzer] Disable fork-sigusr.test on AArch64.
Test fails on the clang-cmake-aarch64-lld build and I'm not sure why.

llvm-svn: 361185
2019-05-20 18:38:58 +00:00
Matt Morehouse 2fd318e543 [libFuzzer] Dump input on failure for sigusr tests.
Should help with debugging failures on the bots.

llvm-svn: 361070
2019-05-17 19:33:31 +00:00
Matt Morehouse 012ef1cca7 [libFuzzer] Use SleepOneSecondTest.cpp for fork-sigusr.test.
ShallowOOMDeepCrash.cpp may hit libFuzzer's RSS limit before the SIGUSR2
is delivered, causing the test to be flaky when bots are under load.
SleepOneSecondTest.cpp will keep running until the signal is delivered.

llvm-svn: 361048
2019-05-17 16:56:01 +00:00
Matt Morehouse 8779b74db1 [libFuzzer] Disable merge-sigusr.test on linux.
Make buildbot green while I rethink the test.

llvm-svn: 360914
2019-05-16 16:42:45 +00:00
Matt Morehouse f2669eebd5 [libFuzzer] Increase merge-sigusr sleep after sending signal.
Test is flaky on buildbot at least partially due to the fuzz target not
exiting before we read its output.

llvm-svn: 360848
2019-05-16 04:00:41 +00:00
Matt Morehouse d5529629fb [libFuzzer] Also kill parent process in merge-siguser.test.
llvm-svn: 360840
2019-05-16 03:04:44 +00:00
Matt Morehouse f9d382946f [libFuzzer] Fix typo in merge-sigusr.test.
llvm-svn: 360836
2019-05-16 01:56:11 +00:00
Matt Morehouse ab10de8bab [libFuzzer] Use PID to send signals rather than process name.
pkill reads the process name as a pattern, not a raw name.  This means
that if the process name contains + or other regex characters, pkill
fails.

llvm-svn: 360835
2019-05-16 01:32:39 +00:00
Matt Morehouse a05ffdbfc7 [libFuzzer] Echo fuzzer output on sigusr tests.
Improves debuggability when the fuzz target crashes.

llvm-svn: 360824
2019-05-15 22:26:48 +00:00
Kostya Serebryany 27d22b6b7a [libFuzzer] reimplement DFT's collect_data_flow inside libFuzzer so that we don't need external python scripts
llvm-svn: 360712
2019-05-14 21:47:35 +00:00
Matt Morehouse 3478494c1f [libFuzzer] Unpoison parameters before calling user callback.
Summary:
Fixes an MSan false positive when compiling with
-fsanitize=memory,fuzzer.

See https://github.com/google/oss-fuzz/issues/2369 for more details.

Reviewers: kcc

Reviewed By: kcc

Subscribers: llvm-commits, metzman, eugenis

Tags: #llvm

Differential Revision: https://reviews.llvm.org/D61753

llvm-svn: 360390
2019-05-09 22:48:46 +00:00
Kostya Serebryany 4a5793f7d0 [libFuzzer] perform more agressive value profiling in memcmp
llvm-svn: 360385
2019-05-09 22:09:25 +00:00
Kostya Serebryany e9aaa5582f [libFuzzer] implement -focus_function=auto, to be used with Data Flow Traces
llvm-svn: 360378
2019-05-09 21:29:45 +00:00
Kostya Serebryany 194b1c3078 [libFuzzer] simplify value-profile-mem.test a little bit
llvm-svn: 360372
2019-05-09 20:20:36 +00:00
Kostya Serebryany e13eff293d [libFuzzer] DFT: when dumping coverage, also dump the total number of instrumented blocks in a function; update merge_data_flow.py to merge coverage
llvm-svn: 360272
2019-05-08 17:20:09 +00:00
Kostya Serebryany ba670b404e [libFuzzer] extend the test for data flow tracer and coverage; also hopefully fix it on the bot
llvm-svn: 360215
2019-05-08 01:03:05 +00:00
Kostya Serebryany 219b2b3a4a [libFuzzer] extend the data flow tracer to also produce basic block coverage for every input. An extended test coming in a separte change.
llvm-svn: 360213
2019-05-08 00:51:15 +00:00
Kostya Serebryany a27a0914d3 [libFuzzer] disable two tests on i386 that are causing timeouts on the bots
llvm-svn: 360211
2019-05-08 00:43:12 +00:00
Peter Smith 3f585ae3ce [libFuzzer] Increase timeouts on fork tests and skip one on aarch64
The tests fork.text, fork.sigusr.test and fork-ubsan.test intermittently
fail on the aarch64 buildbots. Input gathered from the fork.sigusr.test
implies that when the builder is under load the timeout value is not
sufficient. The fork-ubsan.test doesn't have a timeout and I think is not
always finding the error after 10000 runs so I've marked it as unsupported
for now.

Differential Revision: https://reviews.llvm.org/D61449

llvm-svn: 360126
2019-05-07 09:31:14 +00:00
Jonathan Metzman 3d1d3ad50e [libFuzzer] Re-enable libFuzzer on i386 Linux and fix test
Summary:
Re-enable libFuzzer on i386 Linux after it was accidentally
disabled.

Also disable gc-sections.test on i386 since lld isn't
garbage collecting properly with ASAN on i386.

Reviewers: morehouse

Reviewed By: morehouse

Subscribers: srhines, mgorny, #sanitizers, llvm-commits

Tags: #sanitizers, #llvm

Differential Revision: https://reviews.llvm.org/D61415

llvm-svn: 359802
2019-05-02 16:45:17 +00:00
Peter Smith 101bf520d1 [libFuzzer] Add --dump-input-on-failure to help diagnose AArch64 failures
The fork-siguser.test and fork.test intermittently fail on the AArch64
buildbot. Unfortunately these failures are not reproducible on a similar
machine and seem to fail when the machines are under load. Before
suggesting the tests be marked unsupported for AArch64 we'd like to see
if we can get some more information about the failures to see if it helps
us reproduce. This patch adds --dump-input-on-failure to the FileCheck
commands to see if we can get some more information about the failures.

Differential Revision: https://reviews.llvm.org/D61315

llvm-svn: 359675
2019-05-01 12:30:04 +00:00
Jonathan Metzman c0806e0d24 [libFuzzer] Fix failing test: sigint.test
Summary:
Fix sigint.test by making it require msan rather
than enumerating unsupported platforms.

Reviewers: kcc

Reviewed By: kcc

Subscribers: #sanitizers, llvm-commits

Tags: #sanitizers, #llvm

Differential Revision: https://reviews.llvm.org/D61353

llvm-svn: 359638
2019-04-30 23:46:52 +00:00
Kostya Serebryany 905e60c422 [libFuzzer] temporarily disable a test on windows, where there is no memmem in the usual place
llvm-svn: 359624
2019-04-30 22:27:38 +00:00
Kostya Serebryany c239eda8a0 [libFuzzer] add MagicSeparatorTest
llvm-svn: 359620
2019-04-30 22:05:55 +00:00
Jonathan Metzman f3ee97731e [libFuzzer] Replace -seed_corpus to better support fork mode on Win
Summary:
Pass seed corpus list in a file to get around argument length limits on Windows.
This limit was preventing many uses of fork mode on Windows.

Reviewers: kcc, morehouse

Reviewed By: kcc

Subscribers: #sanitizers, llvm-commits

Tags: #sanitizers, #llvm

Differential Revision: https://reviews.llvm.org/D60980

llvm-svn: 359610
2019-04-30 20:56:18 +00:00
Jonathan Metzman 7a2ce3790b fix broken test
llvm-svn: 359590
2019-04-30 17:58:59 +00:00