initial support for integrated fuzzing #20725
Conversation
andrewrk
force-pushed
the
fuzz
branch
2 times, most recently
from
a2fdc16 to
25fc237
Compare
* Add the `-ffuzz` and `-fno-fuzz` CLI arguments. * Detect fuzz testing flags from zig cc. * Set the correct clang flags when fuzz testing is requested. It can be combined with TSAN and UBSAN. * Compilation: build fuzzer library when needed which is currently an empty zig file. * Add optforfuzzing to every function in the llvm backend for modules that have requested fuzzing. * In ZigLLVMTargetMachineEmitToFile, add the optimization passes for sanitizer coverage. * std.mem.eql uses a naive implementation optimized for fuzzing when builtin.fuzz is true. Tracked by #20702
This is needed to ensure that start code does not try to access thread local storage before it has set up thread local storage.
I have committed to implementing this next month this as part of my term project. Is there a space for collaboration? I have to implement this either way and I would love to contribute my implementation upstream. |
Sure. I'll have the system wired together shortly, so you can see how it is all supposed to work. Then it is a matter of improving the genetic algorithm. We can look at afl-fuzz.c for inspiration. |
This prevents it from trying to access thread local storage before it has set up thread local storage, particularly when code coverage instrumentation is enabled.
`-fno-sanitize=function` must come after `-fsanitize=undefined` or it has no effect.
| }, | ||
| }, | ||
| .{ | ||
| "@disableInstrumentation", |
There was a problem hiding this comment.
Should we add this built-in to the langref?
There was a problem hiding this comment.
i think it makes sense to leave out of the langref but include in the spec
There was a problem hiding this comment.
Should we add this built-in to the langref?
Yes of course
i think it makes sense to leave out of the langref but include in the spec
This not Meghan's Opinion Tracker. Provide technical arguments, or keep your opinion to yourself.
5 participants
Initial implementation of #20702.
-ffuzzand-fno-fuzzCLI arguments.combined with TSAN and UBSAN.
empty zig file.
that have requested fuzzing.
sanitizer coverage.
builtin.fuzz is true.
@disableInstrumentationbuiltin and use it in start code to prevent using threadlocal variables before threadlocal storage is initialized.Current status:
I'm putting this up because I think it will already benefit zig-afl-kit mainly because of making
std.mem.eqloptimize for fuzzing when-ffuzzis selected. Probably also because of theoptforfuzzingattribute on all the functions in the LLVM backend.Closes #5484. See #20702 for follow-up issues.
Next steps: