Commit Graph

297 Commits

Author SHA1 Message Date
Evgenii Stepanov 3f345732b4 Add missing lld checks in sanitizer tests.
Do not add an lld dependency when this target does not exist. In this
case the system installation of lld is used (or whatever is detected
with -fuse-ld=lld by default).
2019-10-28 10:32:46 -07:00
Dan Liew bbde056b88 [CMake] Fix the value of `config.target_cflags` for non-macOS Apple platforms. Attempt #3.
The main problem here is that `-*-version_min=` was not being passed to
the compiler when building test cases. This can cause problems when
testing on devices running older OSs because Clang would previously
assume the minimum deployment target is the the latest OS in the SDK
which could be much newer than what the device is running.

Previously the generated value looked like this:

`-arch arm64 -isysroot
<path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`

With this change it now looks like:

`-arch arm64 -stdlib=libc++ -miphoneos-version-min=8.0 -isysroot
<path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`

This mirrors the setting of config.target_cflags on macOS.

This change is made for ASan, LibFuzzer, TSan, and UBSan.

To implement this a new `get_test_cflags_for_apple_platform()` function
has been added that when given an Apple platform name and architecture
returns a string containing the C compiler flags to use when building
tests. This also calls a new helper function `is_valid_apple_platform()`
that validates Apple platform names.

This is the third attempt at landing the patch.

The first attempt (r359305) had to be reverted (r359327) due to a buildbot
failure. The problem was that calling `get_test_cflags_for_apple_platform()`
can trigger a CMake error if the provided architecture is not supported by the
current CMake configuration. Previously, this could be triggered by passing
`-DCOMPILER_RT_ENABLE_IOS=OFF` to CMake. The root cause is that we were
generating test configurations for a list of architectures without checking if
the relevant Sanitizer actually supported that architecture. We now intersect
the list of architectures for an Apple platform with
`<SANITIZER>_SUPPORTED_ARCH` (where `<SANITIZER>` is a Sanitizer name) to
iterate through the correct list of architectures.

The second attempt (r363633) had to be reverted (r363779) due to a build
failure. The failed build was using a modified Apple toolchain where the iOS
simulator SDK was missing. This exposed a bug in the existing UBSan test
generation code where it was assumed that `COMPILER_RT_ENABLE_IOS` implied that
the toolchain supported both iOS and the iOS simulator. This is not true. This
has been fixed by using the list `SANITIZER_COMMON_SUPPORTED_OS` for the list
of supported Apple platforms for UBSan. For consistency with the other
Sanitizers we also now intersect the list of architectures with
UBSAN_SUPPORTED_ARCH.

rdar://problem/50124489

Differential Revision: https://reviews.llvm.org/D61242

llvm-svn: 373405
2019-10-01 23:08:18 +00:00
Matt Morehouse 1c8e05110c [libFuzzer] Remove lazy counters.
Summary: Lazy counters haven't improved performance for large fuzz targets.

Reviewers: kcc

Reviewed By: kcc

Subscribers: llvm-commits

Tags: #llvm

Differential Revision: https://reviews.llvm.org/D67476

llvm-svn: 373403
2019-10-01 22:49:06 +00:00
Mitch Phillips da3cf61654 [libFuzzer] [NFC] Fix grammar error with "it's"
llvm-svn: 372937
2019-09-26 00:54:30 +00:00
Max Moroz aff633f68d [libFuzzer] Remove hardcoded number of new features in merge_two_step.test.
Summary:
The number of features can be different on different platforms.

This should fixed broken builders, e.g.
http://lab.llvm.org:8011/builders/clang-cmake-aarch64-full/builds/7946

Reviewers: Dor1s

Reviewed By: Dor1s

Subscribers: kristof.beyls, delcypher, #sanitizers, llvm-commits

Tags: #llvm, #sanitizers

Differential Revision: https://reviews.llvm.org/D67458

llvm-svn: 371647
2019-09-11 19:43:03 +00:00
Max Moroz f054067f27 [libFuzzer] Make -merge=1 to reuse coverage information from the control file.
Summary:
This change allows to perform corpus merging in two steps. This is useful when
the user wants to address the following two points simultaneously:

1) Get trustworthy incremental stats for the coverage and corpus size changes
    when adding new corpus units.
2) Make sure the shorter units will be preferred when two or more units give the
    same unique signal (equivalent to the `REDUCE` logic).

This solution was brainstormed together with @kcc, hopefully it looks good to
the other people too. The proposed use case scenario:

1) We have a `fuzz_target` binary and `existing_corpus` directory.
2) We do fuzzing and write new units into the `new_corpus` directory.
3) We want to merge the new corpus into the existing corpus and satisfy the
    points mentioned above.
4) We create an empty directory `merged_corpus` and run the first merge step:

    `
    ./fuzz_target -merge=1 -merge_control_file=MCF ./merged_corpus ./existing_corpus
    `

    this provides the initial stats for `existing_corpus`, e.g. from the output:

    `
    MERGE-OUTER: 3 new files with 11 new features added; 11 new coverage edges
    `

5) We recreate `merged_corpus` directory and run the second merge step:

    `
    ./fuzz_target -merge=1 -merge_control_file=MCF ./merged_corpus ./existing_corpus ./new_corpus
    `

    this provides the final stats for the merged corpus, e.g. from the output:

    `
    MERGE-OUTER: 6 new files with 14 new features added; 14 new coverage edges
    `

Alternative solutions to this approach are:

A) Store precise coverage information for every unit (not only unique signal).
B) Execute the same two steps without reusing the control file.

Either of these would be suboptimal as it would impose an extra disk or CPU load
respectively, which is bad given the quadratic complexity in the worst case.

Tested on Linux, Mac, Windows.

Reviewers: morehouse, metzman, hctim, kcc

Reviewed By: morehouse

Subscribers: JDevlieghere, delcypher, mgrang, #sanitizers, llvm-commits, kcc

Tags: #llvm, #sanitizers

Differential Revision: https://reviews.llvm.org/D66107

llvm-svn: 371620
2019-09-11 14:11:08 +00:00
Diana Picus 0bf0b8ff7c [libFuzzer] Disable fork.test on AArch64
This crashes sporadically on our AArch64 buildbots. Disable for now.

llvm-svn: 366055
2019-07-15 11:33:41 +00:00
Reid Kleckner 1a285c27fd Use clang driver for libfuzzer tests on Windows
Summary:
There's no real reason to use clang-cl on Windows, the clang driver
works just as well. This fixes a test which uses the -O0 flag, which was
recently removed from clang-cl to match MSVC, which lacks this flag.

While I'm here, remove the explicit -std=c++11 flag. Previously, this
flag was necessary when the default C++ standard was C++98. Now that the
default is C++14, this is no longer necessary. It's problematic on
Windows, because the Visual C++ standard library relies on C++14
features, and attempting to compile it with C++11 results in errors.
Rather than adding logic to conditionally set the standard to C++11 only
on non-Win, this flag can be removed.

See http://lab.llvm.org:8011/builders/clang-x64-windows-msvc and
https://reviews.llvm.org/D64506.

Reviewers: morehouse, thakis

Subscribers: #sanitizers, llvm-commits

Tags: #sanitizers, #llvm

Differential Revision: https://reviews.llvm.org/D64587

llvm-svn: 365841
2019-07-11 23:20:04 +00:00
Julian Lettner 611c122045 Revert "[TSan] Attempt to fix iOS on-device test"
This reverts commit a2ca358291.

llvm-svn: 365375
2019-07-08 19:26:21 +00:00
Julian Lettner a2ca358291 [TSan] Attempt to fix iOS on-device test
llvm-svn: 365257
2019-07-06 00:49:44 +00:00
Julian Lettner b6654319f7 Remove `XFAIL: ios` from test that passes in CI
llvm-svn: 365253
2019-07-05 22:53:18 +00:00
Reid Kleckner 8007ff1ab1 [compiler-rt] Rename lit.*.cfg.* -> lit.*.cfg.py.*
These lit configuration files are really Python source code. Using the
.py file extension helps editors and tools use the correct language
mode. LLVM and Clang already use this convention for lit configuration,
this change simply applies it to all of compiler-rt.

Reviewers: vitalybuka, dberris

Differential Revision: https://reviews.llvm.org/D63658

llvm-svn: 364591
2019-06-27 20:56:04 +00:00
Kostya Serebryany 679669a77e [libFuzzer] split DataFlow.cpp into two .cpp files, one of which can be compiled w/o dfsan to speed things up (~25% speedup)
llvm-svn: 364002
2019-06-21 01:39:35 +00:00
Kostya Serebryany 27cf743bff [libFuzzer] ensure that DFT and autofocus works for C++ (mangled) functions
llvm-svn: 363905
2019-06-20 01:48:45 +00:00
Hans Wennborg 2cf990fa27 Revert r363633 "[CMake] Fix the value of `config.target_cflags` for non-macOS Apple platforms. Attempt #2."
This caused Chromium's clang package to stop building, see comment on
https://reviews.llvm.org/D61242 for details.

> Summary:
> The main problem here is that `-*-version_min=` was not being passed to
> the compiler when building test cases. This can cause problems when
> testing on devices running older OSs because Clang would previously
> assume the minimum deployment target is the the latest OS in the SDK
> which could be much newer than what the device is running.
>
> Previously the generated value looked like this:
>
> `-arch arm64 -isysroot
> <path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`
>
> With this change it now looks like:
>
> `-arch arm64 -stdlib=libc++ -miphoneos-version-min=8.0 -isysroot
> <path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`
>
> This mirrors the setting of `config.target_cflags` on macOS.
>
> This change is made for ASan, LibFuzzer, TSan, and UBSan.
>
> To implement this a new `get_test_cflags_for_apple_platform()` function
> has been added that when given an Apple platform name and architecture
> returns a string containing the C compiler flags to use when building
> tests. This also calls a new helper function `is_valid_apple_platform()`
> that validates Apple platform names.
>
> This is the second attempt at landing the patch. The first attempt (r359305)
> had to be reverted (r359327) due to a buildbot failure. The problem was
> that calling `get_test_cflags_for_apple_platform()` can trigger a CMake
> error if the provided architecture is not supported by the current
> CMake configuration. Previously, this could be triggered by passing
> `-DCOMPILER_RT_ENABLE_IOS=OFF` to CMake. The root cause is that we were
> generating test configurations for a list of architectures without
> checking if the relevant Sanitizer actually supported that architecture.
> We now intersect the list of architectures for an Apple platform
> with `<SANITIZER>_SUPPORTED_ARCH` (where `<SANITIZER>` is a Sanitizer
> name) to iterate through the correct list of architectures.
>
> rdar://problem/50124489
>
> Reviewers: kubamracek, yln, vsk, juliehockett, phosek
>
> Subscribers: mgorny, javed.absar, kristof.beyls, #sanitizers, llvm-commits
>
> Tags: #llvm, #sanitizers
>
> Differential Revision: https://reviews.llvm.org/D61242

llvm-svn: 363779
2019-06-19 09:09:39 +00:00
Dan Liew 964909e4a6 [CMake] Fix the value of `config.target_cflags` for non-macOS Apple platforms. Attempt #2.
Summary:
The main problem here is that `-*-version_min=` was not being passed to
the compiler when building test cases. This can cause problems when
testing on devices running older OSs because Clang would previously
assume the minimum deployment target is the the latest OS in the SDK
which could be much newer than what the device is running.

Previously the generated value looked like this:

`-arch arm64 -isysroot
<path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`

With this change it now looks like:

`-arch arm64 -stdlib=libc++ -miphoneos-version-min=8.0 -isysroot
<path_to_xcode>/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS12.1.sdk`

This mirrors the setting of `config.target_cflags` on macOS.

This change is made for ASan, LibFuzzer, TSan, and UBSan.

To implement this a new `get_test_cflags_for_apple_platform()` function
has been added that when given an Apple platform name and architecture
returns a string containing the C compiler flags to use when building
tests. This also calls a new helper function `is_valid_apple_platform()`
that validates Apple platform names.

This is the second attempt at landing the patch. The first attempt (r359305)
had to be reverted (r359327) due to a buildbot failure. The problem was
that calling `get_test_cflags_for_apple_platform()` can trigger a CMake
error if the provided architecture is not supported by the current
CMake configuration. Previously, this could be triggered by passing
`-DCOMPILER_RT_ENABLE_IOS=OFF` to CMake. The root cause is that we were
generating test configurations for a list of architectures without
checking if the relevant Sanitizer actually supported that architecture.
We now intersect the list of architectures for an Apple platform
with `<SANITIZER>_SUPPORTED_ARCH` (where `<SANITIZER>` is a Sanitizer
name) to iterate through the correct list of architectures.

rdar://problem/50124489

Reviewers: kubamracek, yln, vsk, juliehockett, phosek

Subscribers: mgorny, javed.absar, kristof.beyls, #sanitizers, llvm-commits

Tags: #llvm, #sanitizers

Differential Revision: https://reviews.llvm.org/D61242

llvm-svn: 363633
2019-06-17 23:37:46 +00:00
Kostya Serebryany db88fc56b9 [libFuzzer] implement a better queue for the fork mode. Add an internal flag -stop_file to allow graceful shutdown of fuzzing. Enhance the logging in the fork mode
llvm-svn: 363470
2019-06-14 22:56:50 +00:00
Kostya Serebryany 3f39123d15 [libFuzzer] simplify the DFT trace collection using the new faster DFSan mode that traces up to 16 labels at a time and never runs out of labels. Second attempt. This time with a fix for windows (putenv instead of setenv))
llvm-svn: 363445
2019-06-14 19:54:32 +00:00
Max Moroz 0784e01a98 [libFuzzer] Disable len_control by default if LLVMFuzzerCustomMutator is used.
Summary:
Some custom mutators may not peform well when size restriction is
enforced by len_control. Because of that, it's safer to disable len_control
by default in such cases, but still allow users to enable it manually.
Bug example: https://bugs.chromium.org/p/chromium/issues/detail?id=919530.

Tested manually with LPM-based and regular fuzz targets.

Reviewers: kcc, vitalybuka, metzman

Reviewed By: kcc, metzman

Subscribers: delcypher, #sanitizers, llvm-commits

Tags: #llvm, #sanitizers

Differential Revision: https://reviews.llvm.org/D63334

llvm-svn: 363443
2019-06-14 19:34:11 +00:00
Hans Wennborg 9bc707c0e5 Revert r363326 "[libFuzzer] simplify the DFT trace collection using the new faster DFSan mode that traces up to 16 labels at a time and never runs out of labels."
It broke the Windows build:

C:\b\s\w\ir\cache\builder\src\third_party\llvm\compiler-rt\lib\fuzzer\FuzzerDataFlowTrace.cpp(243): error C3861: 'setenv': identifier not found

This also reverts the follow-up r363327.

llvm-svn: 363358
2019-06-14 07:32:22 +00:00
Kostya Serebryany a5b12be60f fix whitespaces
llvm-svn: 363327
2019-06-13 21:17:49 +00:00
Kostya Serebryany 2fa83cb7ee [libFuzzer] simplify the DFT trace collection using the new faster DFSan mode that traces up to 16 labels at a time and never runs out of labels.
llvm-svn: 363326
2019-06-13 21:17:49 +00:00
Max Moroz 10ed68189a Add FuzzedDataProvider helper class / single header library.
Summary:
This class is useful for writing fuzz target that have multiple inputs.

Current CL imports the existing `FuzzedDataProvider` from Chromium
without any modifications. Feel free to review it thoroughly, if you're
interested, but I'd prefer changing the class in a follow up CL.

The CL also introduces an exhaustive test for the library, as the behavior
of `FuzzedDataProvider` must not change over time.

In follow up CLs I'm planning on changing some implementation details
(I can share a doc with some comments to be addressed). After that, we
will document how `FuzzedDataProvider` should be used.

I have tested this on Linux, Windows and Mac platforms.

Reviewers: morehouse, metzman, kcc

Reviewed By: morehouse

Subscribers: metzman, thakis, rnk, mgorny, ormris, delcypher, #sanitizers, llvm-commits

Tags: #llvm, #sanitizers

Differential Revision: https://reviews.llvm.org/D62733

llvm-svn: 363071
2019-06-11 14:30:18 +00:00
Kostya Serebryany 060f4b48d5 [libFuzzer] when using data-flow-trace (DFT) only load the DFT for the files present in the corpus
llvm-svn: 361579
2019-05-24 00:43:52 +00:00
Kostya Serebryany eac9a7830b [libFuzzer] remove the data-flow-trace (DFT) python scripts; their functionality is now part of libFuzzer proper; also write functions.txt to the disk only if this file doesn't exist yet
llvm-svn: 361452
2019-05-23 01:03:42 +00:00
Kostya Serebryany b7cc3d9953 [libFuzzer] automatically collect the data flow trace (DFT) in the fork mode if -collect_data_flow= is given
llvm-svn: 361448
2019-05-23 00:22:46 +00:00
Matt Morehouse 4d7a6142de [libFuzzer] Sleep after process exits in merge-sigusr.test.
Ensure that log file has been fully updated before trying to read it.

llvm-svn: 361339
2019-05-22 00:41:54 +00:00
Matt Morehouse 9e0f6cc3a3 [libFuzzer] Kill by session ID in merge-sigusr.test.
Ensures that parent and all child processes are killed at once.

llvm-svn: 361336
2019-05-21 23:54:39 +00:00
Matt Morehouse db62d375dc [libFuzzer] Ignore exit status of wait in merge-sigusr.test.
If process $PID has already exited, wait will give a non-zero exit
status.

llvm-svn: 361326
2019-05-21 22:48:40 +00:00
Matt Morehouse df17ddf9fc [libFuzzer] Reduce flakiness of merge-sigusr.test.
Double the number of files to merge, and use wait instead of sleep.

llvm-svn: 361313
2019-05-21 21:15:51 +00:00
Matt Morehouse ef7e4d530c [libFuzzer] Disable fork-sigusr.test on AArch64.
Test fails on the clang-cmake-aarch64-lld build and I'm not sure why.

llvm-svn: 361185
2019-05-20 18:38:58 +00:00
Matt Morehouse 2fd318e543 [libFuzzer] Dump input on failure for sigusr tests.
Should help with debugging failures on the bots.

llvm-svn: 361070
2019-05-17 19:33:31 +00:00
Matt Morehouse 012ef1cca7 [libFuzzer] Use SleepOneSecondTest.cpp for fork-sigusr.test.
ShallowOOMDeepCrash.cpp may hit libFuzzer's RSS limit before the SIGUSR2
is delivered, causing the test to be flaky when bots are under load.
SleepOneSecondTest.cpp will keep running until the signal is delivered.

llvm-svn: 361048
2019-05-17 16:56:01 +00:00
Matt Morehouse 8779b74db1 [libFuzzer] Disable merge-sigusr.test on linux.
Make buildbot green while I rethink the test.

llvm-svn: 360914
2019-05-16 16:42:45 +00:00
Matt Morehouse f2669eebd5 [libFuzzer] Increase merge-sigusr sleep after sending signal.
Test is flaky on buildbot at least partially due to the fuzz target not
exiting before we read its output.

llvm-svn: 360848
2019-05-16 04:00:41 +00:00
Matt Morehouse d5529629fb [libFuzzer] Also kill parent process in merge-siguser.test.
llvm-svn: 360840
2019-05-16 03:04:44 +00:00
Matt Morehouse f9d382946f [libFuzzer] Fix typo in merge-sigusr.test.
llvm-svn: 360836
2019-05-16 01:56:11 +00:00
Matt Morehouse ab10de8bab [libFuzzer] Use PID to send signals rather than process name.
pkill reads the process name as a pattern, not a raw name.  This means
that if the process name contains + or other regex characters, pkill
fails.

llvm-svn: 360835
2019-05-16 01:32:39 +00:00
Matt Morehouse a05ffdbfc7 [libFuzzer] Echo fuzzer output on sigusr tests.
Improves debuggability when the fuzz target crashes.

llvm-svn: 360824
2019-05-15 22:26:48 +00:00
Kostya Serebryany 27d22b6b7a [libFuzzer] reimplement DFT's collect_data_flow inside libFuzzer so that we don't need external python scripts
llvm-svn: 360712
2019-05-14 21:47:35 +00:00
Matt Morehouse 3478494c1f [libFuzzer] Unpoison parameters before calling user callback.
Summary:
Fixes an MSan false positive when compiling with
-fsanitize=memory,fuzzer.

See https://github.com/google/oss-fuzz/issues/2369 for more details.

Reviewers: kcc

Reviewed By: kcc

Subscribers: llvm-commits, metzman, eugenis

Tags: #llvm

Differential Revision: https://reviews.llvm.org/D61753

llvm-svn: 360390
2019-05-09 22:48:46 +00:00
Kostya Serebryany 4a5793f7d0 [libFuzzer] perform more agressive value profiling in memcmp
llvm-svn: 360385
2019-05-09 22:09:25 +00:00
Kostya Serebryany e9aaa5582f [libFuzzer] implement -focus_function=auto, to be used with Data Flow Traces
llvm-svn: 360378
2019-05-09 21:29:45 +00:00
Kostya Serebryany 194b1c3078 [libFuzzer] simplify value-profile-mem.test a little bit
llvm-svn: 360372
2019-05-09 20:20:36 +00:00
Kostya Serebryany e13eff293d [libFuzzer] DFT: when dumping coverage, also dump the total number of instrumented blocks in a function; update merge_data_flow.py to merge coverage
llvm-svn: 360272
2019-05-08 17:20:09 +00:00
Kostya Serebryany ba670b404e [libFuzzer] extend the test for data flow tracer and coverage; also hopefully fix it on the bot
llvm-svn: 360215
2019-05-08 01:03:05 +00:00
Kostya Serebryany 219b2b3a4a [libFuzzer] extend the data flow tracer to also produce basic block coverage for every input. An extended test coming in a separte change.
llvm-svn: 360213
2019-05-08 00:51:15 +00:00
Kostya Serebryany a27a0914d3 [libFuzzer] disable two tests on i386 that are causing timeouts on the bots
llvm-svn: 360211
2019-05-08 00:43:12 +00:00
Peter Smith 3f585ae3ce [libFuzzer] Increase timeouts on fork tests and skip one on aarch64
The tests fork.text, fork.sigusr.test and fork-ubsan.test intermittently
fail on the aarch64 buildbots. Input gathered from the fork.sigusr.test
implies that when the builder is under load the timeout value is not
sufficient. The fork-ubsan.test doesn't have a timeout and I think is not
always finding the error after 10000 runs so I've marked it as unsupported
for now.

Differential Revision: https://reviews.llvm.org/D61449

llvm-svn: 360126
2019-05-07 09:31:14 +00:00
Jonathan Metzman 3d1d3ad50e [libFuzzer] Re-enable libFuzzer on i386 Linux and fix test
Summary:
Re-enable libFuzzer on i386 Linux after it was accidentally
disabled.

Also disable gc-sections.test on i386 since lld isn't
garbage collecting properly with ASAN on i386.

Reviewers: morehouse

Reviewed By: morehouse

Subscribers: srhines, mgorny, #sanitizers, llvm-commits

Tags: #sanitizers, #llvm

Differential Revision: https://reviews.llvm.org/D61415

llvm-svn: 359802
2019-05-02 16:45:17 +00:00