Re: [PATCH-for-6.1 v6] fuzz: add an instrumentation filter

[Darren Kenny <darren.kenny@oracle.com>]

On Friday, 2021-07-09 at 16:08:44 -04, Alexander Bulekov wrote:
> By default, -fsanitize=fuzzer instruments all code with coverage
> information. However, this means that libfuzzer will track coverage over
> hundreds of source files that are unrelated to virtual-devices. This
> means that libfuzzer will optimize inputs for coverage observed in timer
> code, memory APIs etc. This slows down the fuzzer and stores many inputs
> that are not relevant to the actual virtual-devices.
>
> With this change, clang versions that support the
> "-fsanitize-coverage-allowlist" will only instrument a subset of the
> compiled code, that is directly related to virtual-devices.
>
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

> ---
>
> Hi,
> Resending this one, as this did not work with the OSS-Fuzz containers.
> (The instrumentation filter support was only checked/applied when
> LIB_FUZZING_ENGINE was not set). I had to shift a couple things around
> in the configure script, since this was last reviewed.
> Thank you
>
>  configure                                     | 28 +++++++++++++++----
>  .../oss-fuzz/instrumentation-filter-template  | 15 ++++++++++
>  2 files changed, 37 insertions(+), 6 deletions(-)
>  create mode 100644 scripts/oss-fuzz/instrumentation-filter-template
>
> diff --git a/configure b/configure
> index e799d908a3..99d6182af9 100755
> --- a/configure
> +++ b/configure
> @@ -4943,13 +4943,21 @@ fi
>  
>  ##########################################
>  # checks for fuzzer
> -if test "$fuzzing" = "yes" && test -z "${LIB_FUZZING_ENGINE+xxx}"; then
> +if test "$fuzzing" = "yes" ; then
>    write_c_fuzzer_skeleton
> -  if compile_prog "$CPU_CFLAGS -Werror -fsanitize=fuzzer" ""; then
> -    have_fuzzer=yes
> -  else
> -    error_exit "Your compiler doesn't support -fsanitize=fuzzer"
> -    exit 1
> +  if test -z "${LIB_FUZZING_ENGINE+xxx}"; then
> +    if compile_prog "$CPU_CFLAGS -Werror -fsanitize=fuzzer" ""; then
> +      have_fuzzer=yes
> +    else
> +      error_exit "Your compiler doesn't support -fsanitize=fuzzer"
> +      exit 1
> +    fi
> +  fi
> +
> +  have_clang_coverage_filter=no
> +  echo > $TMPTXT
> +  if compile_prog "$CPU_CFLAGS -Werror -fsanitize=fuzzer -fsanitize-coverage-allowlist=$TMPTXT" ""; then
> +    have_clang_coverage_filter=yes
>    fi
>  fi
>  
> @@ -5843,6 +5851,14 @@ if test "$fuzzing" = "yes" ; then
>    else
>      FUZZ_EXE_LDFLAGS="$LIB_FUZZING_ENGINE"
>    fi
> +
> +  # Specify a filter to only instrument code that is directly related to
> +  # virtual-devices.
> +  if test "$have_clang_coverage_filter" = "yes" ; then
> +    cp "$source_path/scripts/oss-fuzz/instrumentation-filter-template" \
> +       instrumentation-filter
> +    QEMU_CFLAGS="$QEMU_CFLAGS -fsanitize-coverage-allowlist=instrumentation-filter"
> +  fi
>  fi
>  
>  if test "$plugins" = "yes" ; then
> diff --git a/scripts/oss-fuzz/instrumentation-filter-template b/scripts/oss-fuzz/instrumentation-filter-template
> new file mode 100644
> index 0000000000..76d2b6139a
> --- /dev/null
> +++ b/scripts/oss-fuzz/instrumentation-filter-template
> @@ -0,0 +1,15 @@
> +# Code that we actually want the fuzzer to target
> +# See: https://clang.llvm.org/docs/SanitizerCoverage.html#disabling-instrumentation-without-source-modification
> +#
> +src:*/hw/*
> +src:*/include/hw/*
> +src:*/slirp/*
> +src:*/net/*
> +
> +# We don't care about coverage over fuzzer-specific code, however we should
> +# instrument the fuzzer entry-point so libFuzzer always sees at least some
> +# coverage - otherwise it will exit after the first input
> +src:*/tests/qtest/fuzz/fuzz.c
> +
> +# Enable instrumentation for all functions in those files
> +fun:*
> -- 
> 2.28.0