[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 07/11] fuzz: add instructions for building reproducers
From: |
Alexander Bulekov |
Subject: |
[PULL 07/11] fuzz: add instructions for building reproducers |
Date: |
Mon, 15 Mar 2021 14:38:08 -0400 |
We have several scripts that help build reproducers, but no
documentation for how they should be used. Add some documentation
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
---
docs/devel/fuzzing.rst | 45 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 45 insertions(+)
diff --git a/docs/devel/fuzzing.rst b/docs/devel/fuzzing.rst
index 97797c4f8c..025fb0c19b 100644
--- a/docs/devel/fuzzing.rst
+++ b/docs/devel/fuzzing.rst
@@ -210,6 +210,51 @@ Build details:
- The script responsible for building the fuzzers can be found in the
QEMU source tree at ``scripts/oss-fuzz/build.sh``
+Building Crash Reproducers
+-----------------------------------------
+When we find a crash, we should try to create an independent reproducer, that
+can be used on a non-fuzzer build of QEMU. This filters out any potential
+false-positives, and improves the debugging experience for developers.
+Here are the steps for building a reproducer for a crash found by the
+generic-fuzz target.
+ - Ensure the crash reproduces::
+ qemu-fuzz-i386 --fuzz-target... ./crash-...
+
+ - Gather the QTest output for the crash::
+ QEMU_FUZZ_TIMEOUT=0 QTEST_LOG=1 FUZZ_SERIALIZE_QTEST=1 \
+ qemu-fuzz-i386 --fuzz-target... ./crash-... &> /tmp/trace
+
+ - Reorder and clean-up the resulting trace::
+ scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py /tmp/trace > /tmp/reproducer
+
+ - Get the arguments needed to start qemu, and provide a path to qemu::
+ less /tmp/trace # The args should be logged at the top of this file
+ export QEMU_ARGS="-machine ..."
+ export QEMU_PATH="path/to/qemu-system"
+
+ - Ensure the crash reproduces in qemu-system::
+ $QEMU_PATH $QEMU_ARGS -qtest stdio < /tmp/reproducer
+
+ - From the crash output, obtain some string that identifies the crash. This
+ can be a line in the stack-trace, for example::
+ export CRASH_TOKEN="hw/usb/hcd-xhci.c:1865"
+
+ - Minimize the reproducer::
+ scripts/oss-fuzz/minimize_qtest_trace.py -M1 -M2 \
+ /tmp/reproducer /tmp/reproducer-minimized
+
+ - Confirm that the minimized reproducer still crashes::
+ $QEMU_PATH $QEMU_ARGS -qtest stdio < /tmp/reproducer-minimized
+
+ - Create a one-liner reproducer that can be sent over email::
+ ./scripts/oss-fuzz/output_reproducer.py -bash /tmp/reproducer-minimized
+
+ - Output the C source code for a test case that will reproduce the bug ::
+ ./scripts/oss-fuzz/output_reproducer.py -owner "John Smith
<john@smith.com>"\
+ -name "test_function_name" /tmp/reproducer-minimized
+
+ - Report the bug and send a patch with the C reproducer upstream
+
Implementation Details / Fuzzer Lifecycle
-----------------------------------------
--
2.27.0
- [PULL 00/11] 20210315 patches, Alexander Bulekov, 2021/03/15
- [PULL 02/11] tests/qtest: Only run fuzz-virtio-scsi when virtio-scsi is available, Alexander Bulekov, 2021/03/15
- [PULL 01/11] tests/qtest: Only run fuzz-megasas-test if megasas device is available, Alexander Bulekov, 2021/03/15
- [PULL 08/11] fuzz: add a am53c974 generic-fuzzer config, Alexander Bulekov, 2021/03/15
- [PULL 07/11] fuzz: add instructions for building reproducers,
Alexander Bulekov <=
- [PULL 03/11] MAINTAINERS: Cover fuzzer reproducer tests within 'Device Fuzzing', Alexander Bulekov, 2021/03/15
- [PULL 04/11] fuzz: fix the pro100 generic-fuzzer config, Alexander Bulekov, 2021/03/15
- [PULL 06/11] fuzz: add a script to build reproducers, Alexander Bulekov, 2021/03/15
- [PULL 05/11] fuzz: don't leave orphan llvm-symbolizers around, Alexander Bulekov, 2021/03/15
- [PULL 09/11] memory: add a sparse memory device for fuzzing, Alexander Bulekov, 2021/03/15
- [PULL 10/11] fuzz: configure a sparse-mem device, by default, Alexander Bulekov, 2021/03/15
- [PULL 11/11] fuzz: move some DMA hooks, Alexander Bulekov, 2021/03/15
- Re: [PULL 00/11] 20210315 patches, Paolo Bonzini, 2021/03/16