Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add cras fuzzer #880

Merged
merged 1 commit into from
Oct 9, 2017
Merged

Add cras fuzzer #880

merged 1 commit into from
Oct 9, 2017

Conversation

dgreid
Copy link
Contributor

@dgreid dgreid commented Oct 6, 2017

cras is the audio server that runs on ChromeOS.

The first cras fuzzer tests the client's message interface.

Signed-off-by: Dylan Reid dgreid@chromium.org

@dgreid
Add cras fuzzer
d06f4e7 
cras is the audio server that runs on ChromeOS.

The first cras fuzzer tests the client's message interface.

Signed-off-by: Dylan Reid <dgreid@chromium.org>
@googlebot
Copy link

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks.

  • If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
  • If your company signed a CLA, they designated a Point of Contact who decides which employees are authorized to participate. You may need to contact the Point of Contact for your company and ask to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the project maintainer to go/cla#troubleshoot.
  • In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again.

@oliverchang oliverchang merged commit a86b333 into google:master Oct 9, 2017
@kcc
Copy link
Contributor

kcc commented Oct 10, 2017

@dgreid you don't provide any seed corpus, do you?

@dgreid
Copy link
Contributor Author

dgreid commented Oct 10, 2017 via email

@kcc
Copy link
Contributor

kcc commented Oct 10, 2017

@dgreid does this fuzz target create a thread per input?

This is not a huge problem and most of the things will work, but
a) you may occasionally see crashes like this:

==16==AddressSanitizer: Thread limit (4194304 threads) exceeded. Dying.

(asan has a hard limit on the total number of threads ever created. You may consider it a hard-to-fix asan bug)

b) this may cost you some efficiency and effectiveness.

Does the logic of fuzzing this code require more than one thread?
If not, and if it's a simple change, I recommend to make the fuzz target single-threaded.

@dgreid
Copy link
Contributor Author

dgreid commented Oct 10, 2017 via email

@kcc
Copy link
Contributor

kcc commented Oct 10, 2017 •
edited
Loading

Does this help? http://llvm.org/docs/LibFuzzer.html#startup-initialization

and provide slightly better coverage.

Why?

@dgreid
Copy link
Contributor Author

dgreid commented Oct 11, 2017 via email •
edited by kcc
Loading

@kcc
Copy link
Contributor

kcc commented Oct 11, 2017

The target is not working on oss-fuzz :(

This is what I see in every log file:

Bot: oss-fuzz-linux-zone1-worker-cras-5554
Time ran: 0.047016
INFO: Seed: 388265914
INFO: Loaded 1 modules   (6735 guards): 6735 [0xa07980, 0xa0e2bc),
INFO:        0 files found in /new
INFO:        0 files found in /cras_rclient_message
INFO: A corpus is not provided, starting from an empty corpus
==1== ERROR: libFuzzer: fuzz target exited
    #0 0x4ec213 in __sanitizer_print_stack_trace _asan_rtl_
    #1 0x5dd884 in fuzzer::Fuzzer::ExitCallback() /src/libfuzzer/FuzzerLoop.cpp:212:5
    #2 0x7fbc3dc82ff7 in __run_exit_handlers /build/glibc-9tT8Do/glibc-2.23/stdlib/exit.c:82
    #3 0x7fbc3dc83044 in exit /build/glibc-9tT8Do/glibc-2.23/stdlib/exit.c:104
    #4 0x531646 in cras_system_state_init /src/adhd/cras/src/server/cras_system_state.c:82:3
    #5 0x51b1b3 in LLVMFuzzerTestOneInput /src/adhd/cras/src/fuzz/rclient_message.cc:19:3

It does work locally inside the docker.
Does cras_system_state_init do something interesting e.g. with the network that might be banned by our sandbox?

@dgreid
Copy link
Contributor Author

dgreid commented Oct 11, 2017 via email

@kcc
Copy link
Contributor

kcc commented Oct 11, 2017

Yea, I'd expect shm is banned by the sandbox (@oliverchang should know better).

@oliverchang
Copy link
Collaborator

Yep, /dev/shm is not available right now for the time being.

@dgreid
Copy link
Contributor Author

dgreid commented Oct 11, 2017 via email

@kcc
Copy link
Contributor

kcc commented Oct 12, 2017

and later today.

Did it?

@dgreid
Copy link
Contributor Author

dgreid commented Oct 12, 2017 via email

@dgreid
Copy link
Contributor Author

dgreid commented Oct 13, 2017 via email

@kcc
Copy link
Contributor

kcc commented Oct 16, 2017

The logs still show immediate failure.

Command: /mnt/scratch0/clusterfuzz/slave-bot/builds/clusterfuzz-builds_cras_9b2e9c12841ab250480d510b6121c52d772a4954/revisions/rclient_message -timeout=25 -rss_limit_mb=2048 -max_len=4509 -artifact_prefix=/ -max_total_time=2650 -print_final_stats=1 /new /cras_rclient_message
Bot: oss-fuzz-linux-zone1-worker-cras-wbhg
Time ran: 0.021619

Merging new testcases failed:

Is there an easy way for me to test with a sandbox setup similar to the one used for OSSFuzz?

I think you need this:
https://github.com/google/oss-fuzz/blob/master/docs/new_project_guide.md#testing-locally
@oliverchang please confirm

@oliverchang
Copy link
Collaborator

Setting up the exact sandbox environment is a little difficult, but I've added a script to simulate most of it.

Do test this, try doing:

$ python infra/helper.py pull_images
$ python infra/helper.py build_image cras
$ python infra/helper.py build_fuzzers cras
$ python infra/helper.py shell base-runner

(within base-runner ocker)
# run_minijail /out/cras/rclient_message

Right now this is instantly exiting.

I did some debugging and found that the exit is happening here:

(gdb) bt
#0  __GI_exit (status=-1) at exit.c:104
#1  0x000000000051b31b in LLVMFuzzerInitialize () at /src/adhd/cras/src/fuzz/rclient_message.cc:39
#2  0x00000000005c867f in FuzzerDriver () at /src/libfuzzer/FuzzerDriver.cpp:531
#3  0x00000000005bf8f9 in main () at /src/libfuzzer/FuzzerMain.cpp:20

which is this line: https://chromium.googlesource.com/chromiumos/third_party/adhd/+/e83ecfea08763ad5f6c9f1758432a7d56aaf5e47/cras/src/fuzz/rclient_message.cc#39

(Note that this particular sandbox is mostly redundant after recent refactoring, and will be removed in the near future after some blockers are addressed.)

@dgreid
Copy link
Contributor Author

dgreid commented Oct 17, 2017 via email

@dgreid
Copy link
Contributor Author

dgreid commented Oct 17, 2017 via email

@oliverchang
Copy link
Collaborator

Could you please do a git pull and run python infra/helper.py pull_images ?

@dgreid
Copy link
Contributor Author

dgreid commented Oct 17, 2017 via email

@kcc
Copy link
Contributor

kcc commented Oct 21, 2017

@dgreid we had two full days of fuzzing, please check the coverage dashboard now (via oss-fuzz.com)
to see if the coverage is sane.

@dgreid
Copy link
Contributor Author

dgreid commented Oct 21, 2017 via email

@kcc
Copy link
Contributor

kcc commented Oct 22, 2017

your chromium account has the access.
Add any other e-mail you want here: https://github.com/google/oss-fuzz/blob/master/projects/cras/project.yaml

@dgreid
Copy link
Contributor Author

dgreid commented Oct 23, 2017 via email

tmatth pushed a commit to tmatth/oss-fuzz that referenced this pull request Oct 22, 2018
@dgreid @tmatth
Add cras fuzzer (google#880)
49524f4 
cras is the audio server that runs on ChromeOS.

The first cras fuzzer tests the client's message interface.

Signed-off-by: Dylan Reid <dgreid@chromium.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@dgreid @googlebot @kcc @oliverchang