513 Commits

Author SHA1 Message Date
Paweł Bylica
091741a880
[libfuzzer] Clarify -max_len behavior on bigger files (#123095) 2025-01-23 09:19:21 +01:00
Florian Mayer
f9125ddc1f
Revert "[libfuzzer] use timer_create() instead of setitimer() for linux" (#115811)
Reverts llvm/llvm-project#110274

Buildbots broke
2024-11-11 19:50:30 -08:00
Min
3b29a8a008
[libfuzzer] use timer_create() instead of setitimer() for linux (#110274)
SetTimer() now uses setitimer() to sending SIGALRM every `
UnitTimeoutSec/2 + 1` s
Set UnitTimeoutSec with the `-timeout=` option

"POSIX.1-2008 marks getitimer() and setitimer() obsolete" and also has
some issues regarding accuracy of the timers under load . See
https://linux.die.net/man/2/setitimer.
I propose using timer_create() and sigaction() ,See
http://man7.org/linux/man-pages/man2/timer_create.2.html

# test result on my x86_64 linux
`make check-fuzzer`

![image](https://github.com/user-attachments/assets/19b4e073-16a5-4daa-95ed-2cf4830c042f)
2024-11-11 19:12:30 -08:00
Alexander Richardson
5082acce4f
[compiler-rt] Add custom libc++ workaround for CMake < 3.26
The INSTALL_BYPRODUCTS ExternalProject_Add() argument was only added in
CMake 3.26 and the current minimum is 3.20. Work around this by using an
explicit ExternalProject_Add_Step() call for the install step with a
BYPRODUCTS argument. We can't keep using the `install` name here since that
is reserved by the CMake implementation and results in errors when used.

This commit should be reverted once LLVM depends on CMake 3.26.

Pull Request: https://github.com/llvm/llvm-project/pull/115677
2024-11-10 20:30:23 -08:00
Martin Storsjö
87f4bc0aca
[compiler-rt] [fuzzer] Skip trying to set the thread name on MinGW (#115167)
Since b4130bee6bfd34d8045f02fc9f951bcb5db9d85c, we check for
_LIBCPP_HAS_THREAD_API_PTHREAD to decide between using
SetThreadDescription or pthread_setname_np for setting the thread name.

c6f3b7bcd0596d30f8dabecdfb9e44f9a07b6e4c changed how libcxx defines
their configuration macros - now they are always defined, but defined to
0 or 1, while they previously were either defined or undefined.

As these libcxx defines used to be defined to an empty string (rather
than expanding to 1) if enabled, we can't easily produce an expression
that works both with older and newer libcxx. Additionally, these defines
are libcxx internal config macros that aren't a detail that isn't
supported and isn't meant to be relied upon.

Simply skip trying to set thread name on MinGW as we can't easily know
which kind of thread native handle we have. Setting the thread name is
only a nice to have, quality of life improvement - things should work
the same even without it.

Additionally, libfuzzer isn't generally usable on MinGW targets yet
(Clang doesn't include it in the getSupportedSanitizers() method for the
MinGW target), so this shouldn't make any difference in practice anyway.
2024-11-07 00:18:57 +02:00
Alexander Richardson
e7bad34475
[compiler-rt] Use installed libc++(abi) for tests instead of build tree
Using the build tree is somewhat fragile since the layout is not
guaranteed to be stable and means the tests are tightly coupled to the
libc++/libc++abi build tree layout. Instead update the ExternalProject
to install the library and headers and do not add the build tree to
the include/linker flags.

Pull Request: https://github.com/llvm/llvm-project/pull/115077
2024-11-06 11:57:47 -08:00
Nico Weber
a6fdfefbd0
[compiler-rt] Include stdlib.h for exit() (#115025)
It was originally included transitively, but no longer is after recent
<vector> cleanups in libc++.

Similar to #113951.
2024-11-05 12:30:23 -05:00
Wu Yingcong
d54953ef47
[fuzzer] fix clang-cl build fuzzer lit test failure (#112339)
The `check-fuzzer` runs fine with cl build llvm, but the following lit
tests fail with clang-cl build llvm
```
********************
Timed Out Tests (2):
  libFuzzer-x86_64-default-Windows :: fork-ubsan.test
  libFuzzer-x86_64-default-Windows :: fuzzer-oom.test

********************
Failed Tests (22):
  libFuzzer-x86_64-default-Windows :: acquire-crash-state.test
  libFuzzer-x86_64-default-Windows :: cross_over_copy.test
  libFuzzer-x86_64-default-Windows :: cross_over_insert.test
  libFuzzer-x86_64-default-Windows :: exit_on_src_pos.test
  libFuzzer-x86_64-default-Windows :: fuzzer-alignment-assumption.test
  libFuzzer-x86_64-default-Windows :: fuzzer-implicit-integer-sign-change.test
  libFuzzer-x86_64-default-Windows :: fuzzer-implicit-signed-integer-truncation-or-sign-change.test
  libFuzzer-x86_64-default-Windows :: fuzzer-implicit-signed-integer-truncation.test
  libFuzzer-x86_64-default-Windows :: fuzzer-implicit-unsigned-integer-truncation.test
  libFuzzer-x86_64-default-Windows :: fuzzer-printcovpcs.test
  libFuzzer-x86_64-default-Windows :: fuzzer-timeout.test
  libFuzzer-x86_64-default-Windows :: fuzzer-ubsan.test
  libFuzzer-x86_64-default-Windows :: minimize_crash.test
  libFuzzer-x86_64-default-Windows :: minimize_two_crashes.test
  libFuzzer-x86_64-default-Windows :: null-deref-on-empty.test
  libFuzzer-x86_64-default-Windows :: null-deref.test
  libFuzzer-x86_64-default-Windows :: print-func.test
  libFuzzer-x86_64-default-Windows :: stack-overflow-with-asan.test
  libFuzzer-x86_64-default-Windows :: trace-malloc-2.test
  libFuzzer-x86_64-default-Windows :: trace-malloc-unbalanced.test
  libFuzzer-x86_64-default-Windows :: trace-malloc.test
```

The related commits are
53a81d4d26
and
e31efd8f6f.
Following the change in
e31efd8f6f
can fix these failures.

As for the issue mentioned in the comment that alternatename support in
clang not good enough(https://bugs.llvm.org/show_bug.cgi?id=40218). I
find that using `__builtin_function_start(func)` instead of directly
using `func` would make it work as intended.
2024-10-17 10:17:16 +08:00
Zentrik
b4130bee6b
Fix libFuzzer not building with pthreads on Windows (#109525)
Fixes https://github.com/llvm/llvm-project/issues/106871
2024-09-24 23:33:57 +03:00
Martin Storsjö
b32dc67732 Revert "[compiler-rt][fuzzer] SetThreadName build fix for Mingwin attempt (#106902)"
This reverts commit 7c4cffd9d8be424e9e9542be9aec3b5a6f69073e.

This commit broke compilation in environments that don't use
winpthreads.
2024-09-02 15:25:56 +03:00
David CARLIER
7c4cffd9d8
[compiler-rt][fuzzer] SetThreadName build fix for Mingwin attempt (#106902) 2024-09-01 13:35:10 +01:00
David CARLIER
f47966b1de
[compiler-rt] Reland "SetThreadName implementation for Fuchsia" (#105179) 2024-08-21 08:37:26 +01:00
David CARLIER
ddaa8284f5
Revert "[compiler-rt][fuzzer] implements SetThreadName for fuchsia." (#105162)
Reverts llvm/llvm-project#99953
2024-08-20 18:42:11 +01:00
David CARLIER
31cc4ccdea
[compiler-rt][fuzzer] implements SetThreadName for fuchsia. (#99953) 2024-08-19 23:40:54 +01:00
David Benjamin
bde4ffe752
Don't pass null pointers to memcmp and memcpy in libFuzzer (#96775)
In C, it is UB to call `memcmp(NULL, NULL, 0)`, `memcpy(NULL, NULL, 0)`,
etc. Unfortunately, `(NULL, 0)` is the natural representation of an
empty sequence of objects and extremely common in real world code. As a
result, all C code, and C++ code which calls into C functions, must
carefully guard all calls to `memcpy`.

This is a serious, real world usability issue in C and should be fixed
in the language (see #49459). In the meantime, pay the cost of the extra
branch to avoid tripping UBSan in libFuzzer. Once the usability problem
in C has been fixed, these checks can be removed.

Fixes #96772
2024-08-13 15:26:40 -07:00
Alexandre Ganea
7202fe5829 [compiler-rt] Silence warnings
This fixes a few of these warnings, when building with Clang ToT on
Windows:
```
[622/7618] Building CXX object
projects\compiler-rt\lib\sanitizer_common\CMakeFiles\RTSanitizerCommonSymbolizer.x86_64.dir\sanitizer_symbolizer_win.cpp.obj
C:\src\git\llvm-project\compiler-rt\lib\sanitizer_common\sanitizer_symbolizer_win.cpp(74,3):
warning: cast from 'FARPROC' (aka 'long long (*)()') to
'decltype(::StackWalk64) *' (aka 'int (*)(unsigned long, void *, void *,
_tagSTACKFRAME64 *, void *, int (*)(void *, unsigned long long, void *,
unsigned long, unsigned long *), void *(*)(void *, unsigned long long),
unsigned long long (*)(void *, unsigned long long), unsigned long long
(*)(void *, void *, _tagADDRESS64 *))') converts to incompatible
function type [-Wcast-function-type-mismatch]
```

This is similar to https://github.com/llvm/llvm-project/pull/97905
2024-08-11 19:01:12 -04:00
Scallop Ye
83251a22f6
[libFuzzer] Fix incorrect coverage number in fork mode (#82335)
Closes #82307.

I built LLVM with the changes and tested fuzzing in fork mode. The
coverage number was correct:
```
[ye@ye-arch ~]$ /home/ye/work/llvm-project/build/bin/clang++ -fsanitize=fuzzer test_fuzzer.cc
[ye@ye-arch ~]$ ./a.out corpus -fork=4
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 3152497917
INFO: Loaded 1 modules   (40 inline 8-bit counters): 40 [0x5aa6f7b310d0, 0x5aa6f7b310f8), 
INFO: Loaded 1 PC tables (40 PCs): 40 [0x5aa6f7b310f8,0x5aa6f7b31378), 
INFO: -fork=4: fuzzing in separate process(s)
INFO: -fork=4: 56 seed inputs, starting to fuzz in /tmp/libFuzzerTemp.FuzzWithFork54465.dir
#600649: cov: 36 ft: 224 corp: 56 exec/s: 300324 oom/timeout/crash: 0/0/0 time: 2s job: 1 dft_time: 0
#1548208: cov: 36 ft: 224 corp: 56 exec/s: 315853 oom/timeout/crash: 0/0/0 time: 3s job: 2 dft_time: 0
#2465991: cov: 36 ft: 224 corp: 56 exec/s: 229445 oom/timeout/crash: 0/0/0 time: 4s job: 3 dft_time: 0
#3887877: cov: 36 ft: 224 corp: 56 exec/s: 284377 oom/timeout/crash: 0/0/0 time: 5s job: 4 dft_time: 0
```
2024-07-17 15:55:41 -07:00
Alexandre Ganea
b4b17d9763 Revert "[compiler-rt] Silence function cast warning when building with Clang ToT targetting Windows"
This reverts commit 10e1b935e5d9017067207d62ababa733df088ecd.
2024-07-06 12:00:28 -04:00
Alexandre Ganea
10e1b935e5 [compiler-rt] Silence function cast warning when building with Clang ToT targetting Windows 2024-07-05 20:49:40 -04:00
Michael Kruse
a35ac42fac
[compiler-rt] Revise IDE folder structure (#89753)
Update the folder titles for targets in the monorepository that have not
seen taken care of for some time. These are the folders that targets are
organized in Visual Studio and XCode
(`set_property(TARGET <target> PROPERTY FOLDER "<title>")`)
when using the respective CMake's IDE generator.

 * Ensure that every target is in a folder
 * Use a folder hierarchy with each LLVM subproject as a top-level folder
 * Use consistent folder names between subprojects
 * When using target-creating functions from AddLLVM.cmake, automatically
deduce the folder. This reduces the number of
`set_property`/`set_target_property`, but are still necessary when
`add_custom_target`, `add_executable`, `add_library`, etc. are used. A
LLVM_SUBPROJECT_TITLE definition is used for that in each subproject's
root CMakeLists.txt.
2024-06-04 09:26:45 +02:00
Thurston Dang
d9ce33a0ee
[libfuzzer] Prevent MSan false positive when printing log with -jobs (#91679)
libfuzzer's -jobs option will, depending on the number of CPUs, spin up
a
WorkerThread and end up printing the log file using CopyFileToErr.
This leads to an MSan false positive. This patch disables the MSan
interceptor checks,
similarly to other instances in https://reviews.llvm.org/D48891

Side-note: this false positive issue first appeared when printf()
was replaced by puts() (90b4d1bcb20180c591385131b12fa90d2e4860b1).
The interceptor check was always present; however, MSan does not
check_printf by default.
2024-05-10 15:36:55 -07:00
Frederic Cambus
791161516f
[compiler-rt] Update libFuzzer build script to use C++17. (#89604)
libFuzzer uses std::clamp which was introduced in C++17.
2024-04-24 21:18:24 +02:00
Alexander Richardson
55b90b5140
[compiler-rt] Remove llvm_gtest dependency from unit tests
All these unit tests already include ${COMPILER_RT_GTEST_SOURCE} as an
input source file and the target llvm_gtest does not exist for
standalone builds. Currently the DEPS argument is ignored for standalone
builds so the missing target is not a problem, but as part of fixing a
build race for standalone builds I am planning to include those
dependencies in COMPILER_RT_TEST_STANDALONE_BUILD_LIBS configurations.

Reviewed By: vitalybuka

Pull Request: https://github.com/llvm/llvm-project/pull/83649
2024-03-13 11:28:44 -07:00
David CARLIER
e371ada409
[compiler-rt] reimplements GetMemoryProfile for netbsd. (#84841)
The actual solution relies on the premise /proc/self/smaps existence.
instead relying on native api like freebsd.
fixing fuzzer build too.
2024-03-13 09:25:43 +00:00
David CARLIER
e932fe880b
[compiler-rt][Fuzzer] fix windows typo (#84407) 2024-03-08 00:15:22 +00:00
David CARLIER
8bf8d36f8e
[compiler-rt][fuzzer] Reland "SetThreadName windows implementation" (#83562)
Following-up on GH-76761.
2024-03-07 23:53:27 +00:00
David CARLIER
d1538c15f9
Revert fuzzer windows changes (#83551) 2024-03-01 10:32:10 +00:00
David CARLIER
062d78ef58
[compiler-rt][fuzzer] windows build unbreak proposal. (#83538)
shuffling the order of its includes.
2024-03-01 09:13:11 +00:00
David CARLIER
2cdf611c02
[compiler-rt][Fuzzer] SetThreadName windows implementation new try. (#76761)
SetThreadDescription symbol needs to be dynamically loaded before usage.
Then using a wide string buffer, since we re using a null terminated
string, we can use MultiByteToWideChar -1 as 4th argument to finally set
the thread name.

Previously `SetThreadDescription` was called directly causing crash.
It was reverted in dd3aa26fc8e9de37a39611f7a6a602bcb4153784
2024-02-29 17:47:05 -08:00
James Robinson
7f3980a7b2
[Fuzzer] Use user signal to coordinate handler shutdown (#82067)
This updates the signal handle thread coordinating to use a user signal
bit on the SignalHandlerEvent to coordinate shutdown instead of closing
the event handle. Closing the event handle is racy as the handle may be
closed before the signal handler thread resolves the handle value in
_zx_object_wait_many() and we would like to make this an explicit error.
Using the user signal bit 1 instead and then closing the event object
after the signal handler thread is joined cannot race as the wait will
terminate whether the signal is raised before or after the wait begins.
2024-02-20 09:49:20 -08:00
Ryan Prichard
3747cde5e8
[Fuzzer] Enable custom libc++ for Android (#70407)
The Android LLVM build system builds the arm64 fuzzer lib without
HWASan, but then applications that enable HWASan can generated an object
file with a HWASan-ified version of some libc++ symbols (e.g.
`std::__1::piecewise_construct`). The linker can choose the HWASan-ified
definition, but then it cannot resolve the relocation from
libclang_rt.fuzzer-aarch64-android.a to this symbol because the high
bits of the address are unexpectedly set. This produces an error:

```
relocation R_AARCH64_ADR_PREL_PG_HI21 out of range
```

Fix this problem by linking a custom isolated libc++ into Android's
fuzzer library.

We need to pass through ANDROID_NATIVE_API_LEVEL so that the libc++ for
32-bit Android (API < 24) uses LLVM_FORCE_SMALLFILE_FOR_ANDROID.
2023-11-02 14:07:39 -07:00
Kazu Hirata
747e0d9f0a [compiler-rt] Use std::clamp (NFC) 2023-10-22 12:32:20 -07:00
Arseny Kapoulkine
bede46f57e
[Fuzzer] Optimize UpdateFeatureFrequency (#65288)
Instead of a linear scan, use a bitset to track rarity of features. This
improves fuzzer throughput rather dramatically (close to 2x) in early
exploratory phases; in steady state this seems to improve fuzzing
throughput by ~15% according to perf.

The benchmarks are done on an executable with ~100k features, so the
results may change based on the executable that's being fuzzed.

kFeatureSetSize is 2M so the bitset is adding 256 KB to
sizeof(InputCorpus), but this should be fine since there's already three
arrays indexed by feature index for a total of 200 MB.
2023-09-07 16:51:05 -07:00
Arseny Kapoulkine
d3440304b1
[Fuzzer] Update build.sh to fix build errors (#65496)
Switch from C++11 to C++14 as fuzzer requires std::chrono and stdlibc++
doesn't provide chrono literals when using -std=c++11.

Also remove 'u' from ar command to fix this warning: ar: `u' modifier
ignored since `D' is the default (see `U')
2023-09-07 16:38:28 -07:00
Vitaly Buka
dd3aa26fc8 Revert "[Fuzzer] SetThreadName implementation for Windows"
Fails with "The procedure entry point SetThreadDescription could not be located in the dynamic link library..."

This reverts commit cf76ddcbeb10be1f3eee5fa86dc41f9ca2435d50.
2023-08-28 12:27:00 -07:00
Vitaly Buka
151e33c768 [NFC][fuzzer] Cleanup SetThreadName after D156317 2023-08-28 10:59:39 -07:00
Vitaly Buka
45eb6026d9 [fuzzer] Try to fix windows build after D156317 2023-08-28 10:55:16 -07:00
Vitaly Buka
e0e8695a60 Revert "[fuzzer] Try to fix windows build after D156317"
Will not work, string::data() returns const char*;

This reverts commit d364597f8a479a4e223bc3194f5584f26b5aa7a5.
2023-08-28 10:50:51 -07:00
Vitaly Buka
d364597f8a [fuzzer] Try to fix windows build after D156317 2023-08-28 10:47:38 -07:00
David CARLIER
cf76ddcbeb [Fuzzer] SetThreadName implementation for Windows
Api available since Windows Server 2016/Windows 10 1607

Reviewers: vitalybuka

Reviewed-By: vitalybuka

Differential Revison: https://reviews.llvm.org/D156317
2023-08-28 13:14:47 +01:00
MarcoFalke
52526065bc [NFC][compiler-rt] Add missing space in libfuzzer -help docs 2023-07-28 09:59:32 +02:00
David Carlier
cb924ddca5 Revert "[Fuzzer] SetThreadName implementation for Windows"
This reverts commit 885275bff21512fca5dcdaf1b3a30c62dcc585e6.
2023-07-28 06:00:42 +01:00
David CARLIER
885275bff2 [Fuzzer] SetThreadName implementation for Windows
Api available since Windows Server 2016/Windows 10 1607

Reviewed By: vitalybuka

Differential Revision: https://reviews.llvm.org/D156317
2023-07-27 18:10:17 -07:00
Vitaly Buka
f4aa7b5b8d Revert "[Fuzzer] SetThreadName implementation for Windows"
Breaks window bot.

This reverts commit e3f935c7f80cfb8bdcbe0479672bc92485eecd85.
2023-07-27 09:08:56 -07:00
David CARLIER
e3f935c7f8 [Fuzzer] SetThreadName implementation for Windows
Api available since Windows Server 2016/Windows 10 1607.

Reviewers: vitalybuka

Reviewed-By: vitalybuka

Differential Revision: https://reviews.llvm.org/D156317
2023-07-27 06:55:00 +01:00
David CARLIER
b2a253855f [Fuzzer] Assign names to workers
Allow to have a name for workers in case the fuzzed code is itself using threads.

Reviewers: vitalybuka

Reviewed-By: vitalybuka

Differential Revision: https://reviews.llvm.org/D155754
2023-07-26 05:49:35 +01:00
Youling Tang
9c2f792dce [fuzzer] Enable loongarch64
Enable fuzzer on loongarch64.

Reviewed By: SixWeining, xen0n, MaskRay

Differential Revision: https://reviews.llvm.org/D140601
2023-07-18 09:40:25 +08:00
Roland McGrath
42564f97e8 [fuzzer][fuchsia] Support RISC-V
Reviewed By: phosek

Differential Revision: https://reviews.llvm.org/D153082
2023-06-16 11:39:32 -07:00
Vitaly Buka
facf22b8b0 [fuzzer] Platfom specific version of PageSize 2023-05-25 21:00:14 -07:00
zhanglimin
baa1488c16 [fuzzer] Don't hard-code page size in FuzzerUtil.h
Don't hard code the page in FuzzerUtil.h, this breaks on
e.g. LoongArch which defaults to a 16KiB page size.

Reviewed By: #sanitizers, vitalybuka

Differential Revision: https://reviews.llvm.org/D140607
2023-05-25 20:24:24 -07:00