[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] fuzz: add information about useful libFuzzer flags
From: |
Philippe Mathieu-Daudé |
Subject: |
Re: [PATCH] fuzz: add information about useful libFuzzer flags |
Date: |
Sun, 24 May 2020 18:43:22 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.5.0 |
On 5/24/20 4:37 PM, Alexander Bulekov wrote:
> Signed-off-by: Alexander Bulekov <address@hidden>
> ---
> docs/devel/fuzzing.txt | 33 +++++++++++++++++++++++++++++++++
> 1 file changed, 33 insertions(+)
>
> diff --git a/docs/devel/fuzzing.txt b/docs/devel/fuzzing.txt
> index 324d2cd92b..3458763e53 100644
> --- a/docs/devel/fuzzing.txt
> +++ b/docs/devel/fuzzing.txt
> @@ -45,6 +45,39 @@ Information about these is available by passing -help=1
> Now the only thing left to do is wait for the fuzzer to trigger potential
> crashes.
>
> +== Useful libFuzzer flags ==
> +
> +As mentioned above, libFuzzer accepts some arguments. Passing -help=1 will
> list
> +the available arguments. In particular, these arguments might be helpful:
> +
> +$CORPUS_DIR/ : Specify a directory as the last argument to libFuzzer.
> libFuzzer
> +stores each "interesting" input in this corpus directory. The next time you
> run
> +libFuzzer, it will read all of the inputs from the corpus, and continue
> fuzzing
> +from there.
Maybe describe we can use multiple directories, the first one is where
new inputs are written.
> +
> +-max_len=4096 : specify the maximum byte-length of the inputs libFuzzer will
> +generate.
> +
> +-close_fd_mask={1,2,3} : close, stderr, or both. Useful for targets that
> +trigger many debug/error messages, or create output on the serial console.
> +
> +-jobs=4 -workers=4 : These arguments configure libFuzzer to run 4 fuzzers in
> +parallel.
The difference between job/worker is not clear...
> Replace 4 with a number appropriate for your machine. Make sure to
> +specify a $CORPUS_DIR, which will allow the parallel fuzzers to share
> +information about the interesting inputs they find.
> +
> +-use_value_profile=1 : For each comparison operation, libFuzzer computes
> +(caller_pc&4095) | (popcnt(Arg1 ^ Arg2) << 12) and places this in the
> coverage
> +table. Useful for targets with "magic" constants. If Arg1 came from the
> fuzzer's
> +input and Arg2 is a magic constant, then each time the hamming distance
"Hamming" (lastname).
Thanks!
> +between Arg1 and Arg2 decreases, libFuzzer adds the input to the corpus.
> +
> +-shrink=1 : Tries to make elements of the corpus "smaller". Might lead to
> +better coverage performance, depending on the target.
> +
> +Note that libFuzzer's exact behavior will depend on the version of
> +clang and libFuzzer used to build the device fuzzers.
> +
> == Adding a new fuzzer ==
> Coverage over virtual devices can be improved by adding additional fuzzers.
> Fuzzers are kept in tests/qtest/fuzz/ and should be added to
>