Skip to content

No public description #2116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
copybara-service wants to merge 1 commit into
base: main
Choose a base branch
from
Open

No public description #2116

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 44 additions & 37 deletions centipede/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -975,38 +975,6 @@ cc_library(
],
)

cc_library(
name = "engine_worker",
srcs = [
"engine_worker.cc",
"runner_utils.cc",
"runner_utils.h",
],
hdrs = ["engine_worker_abi.h"],
deps = [
":engine_abi",
":execution_metadata",
":feature",
":runner_request",
":runner_result",
":shared_memory_blob_sequence",
"@abseil-cpp//absl/base:nullability",
"@abseil-cpp//absl/random",
"@abseil-cpp//absl/random:bit_gen_ref",
"@com_google_fuzztest//common:defs",
],
)

cc_library(
name = "engine_controller_with_subprocess",
srcs = ["engine_controller_with_subprocess.cc"],
hdrs = ["engine_controller_abi.h"],
deps = [
"@com_google_fuzztest//centipede:engine_abi",
"@com_google_fuzztest//fuzztest/internal:escaping",
],
)

# The runner library is special:
# * It must not be instrumented with asan, sancov, etc.
# * It must not have heavy dependencies, and ideally not at all.
Expand All @@ -1027,8 +995,6 @@ RUNNER_SOURCES_NO_MAIN = [
"runner_dl_info.cc",
"runner_dl_info.h",
"runner_interface.h",
"runner_utils.cc",
"runner_utils.h",
"sancov_callbacks.cc",
"sancov_interceptors.cc",
"sancov_object_array.cc",
Expand Down Expand Up @@ -1076,11 +1042,13 @@ RUNNER_DEPS = [
":knobs",
":mutation_data",
":rolling_hash",
":engine_abi",
":runner_cmp_trace",
":runner_fork_server",
":runner_request",
":runner_result",
":runner_utils",
":engine_abi",
":engine_worker",
":shared_memory_blob_sequence",
"@com_google_fuzztest//common:defs",
"@abseil-cpp//absl/base:core_headers",
Expand All @@ -1089,6 +1057,46 @@ RUNNER_DEPS = [
"@abseil-cpp//absl/types:span",
]

cc_library(
name = "runner_utils",
srcs = ["runner_utils.cc"],
hdrs = ["runner_utils.h"],
copts = RUNNER_COPTS,
deps = ["@abseil-cpp//absl/base:nullability"],
)

cc_library(
name = "engine_worker",
srcs = [
"engine_worker.cc",
],
hdrs = ["engine_worker_abi.h"],
copts = RUNNER_COPTS,
deps = [
":engine_abi",
":execution_metadata",
":feature",
":runner_request",
":runner_result",
":runner_utils",
":shared_memory_blob_sequence",
"@abseil-cpp//absl/base:nullability",
"@abseil-cpp//absl/random",
"@abseil-cpp//absl/random:bit_gen_ref",
"@com_google_fuzztest//common:defs",
],
)

cc_library(
name = "engine_controller_with_subprocess",
srcs = ["engine_controller_with_subprocess.cc"],
hdrs = ["engine_controller_abi.h"],
deps = [
"@com_google_fuzztest//centipede:engine_abi",
"@com_google_fuzztest//fuzztest/internal:escaping",
],
)

# A fuzz target needs to link with this library in order to run with Centipede.
# The fuzz target must provide its own main().
#
Expand Down Expand Up @@ -1217,8 +1225,6 @@ cc_library(
"reverse_pc_table.h",
"runner_dl_info.cc",
"runner_dl_info.h",
"runner_utils.cc",
"runner_utils.h",
"sancov_callbacks.cc",
"sancov_interceptors.cc",
"sancov_object_array.cc",
Expand All @@ -1240,6 +1246,7 @@ cc_library(
":foreach_nonzero",
":int_utils",
":runner_cmp_trace",
":runner_utils",
"@abseil-cpp//absl/base:core_headers",
"@abseil-cpp//absl/base:nullability",
"@abseil-cpp//absl/numeric:bits",
Expand Down
13 changes: 4 additions & 9 deletions centipede/centipede_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -963,14 +963,8 @@ TEST_F(CentipedeWithTemporaryLocalDir, GetsSeedInputs) {
CentipedeDefaultCallbacks callbacks(env, stop_condition);

std::vector<ByteArray> seeds;
EXPECT_EQ(callbacks.GetSeeds(10, seeds), 10);
EXPECT_THAT(seeds, testing::ContainerEq(std::vector<ByteArray>{
{0}, {1}, {2}, {3}, {4}, {5}, {6}, {7}, {8}, {9}}));
EXPECT_EQ(callbacks.GetSeeds(5, seeds), 10);
EXPECT_THAT(seeds, testing::ContainerEq(
std::vector<ByteArray>{{0}, {1}, {2}, {3}, {4}}));
EXPECT_EQ(callbacks.GetSeeds(100, seeds), 10);
EXPECT_THAT(seeds, testing::ContainerEq(std::vector<ByteArray>{
callbacks.GetSeeds(10, seeds);
EXPECT_THAT(seeds, testing::IsSupersetOf(std::vector<ByteArray>{
{0}, {1}, {2}, {3}, {4}, {5}, {6}, {7}, {8}, {9}}));
}

Expand Down Expand Up @@ -1400,8 +1394,9 @@ TEST_F(CentipedeWithTemporaryLocalDir, EngineWorksInWorkerMode) {
env.test_name = "some_test";
env.populate_binary_info = false;
env.fork_server = false;
env.persistent_mode = false;
env.persistent_mode = true;
env.exit_on_crash = true;
env.stop_at = absl::Now() + absl::Seconds(10);
fuzztest::internal::DefaultCallbacksFactory<
fuzztest::internal::CentipedeDefaultCallbacks>
callbacks;
Expand Down
137 changes: 131 additions & 6 deletions centipede/engine_worker.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@
// See the License for the specific language governing permissions and
// limitations under the License.
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <unistd.h>

#include <algorithm>
Expand Down Expand Up @@ -105,7 +107,7 @@ struct WorkerFlags {
};

// The first call of this function must be outside of signal handlers since it
// allocates memory (enforced by `GetWorkerFlagsEarly`). After that it would be
// allocates memory (enforced by `WorkerInitEarly`). After that it would be
// signal-safe.
//
// The worker flags format is `:(NAME=VALUE|SWITCH:)+`. `GetWorkerFlags`
Expand Down Expand Up @@ -137,10 +139,6 @@ const WorkerFlags& GetWorkerFlags() {
return worker_flags;
}

__attribute__((constructor(200))) void GetWorkerFlagsEarly() {
(void)GetWorkerFlags();
}

// `header` should be in the form of `FLAG_NAME=`.
//
// Extracts "value" as a null-terminated string from "\0FLAG_NAME=value\0" in
Expand Down Expand Up @@ -237,6 +235,9 @@ constexpr std::string_view kWorkerInputsBlobSequencePathFlagHeader =
"arg1="; // TODO: Use better flag names when standardizing the protocol.
constexpr std::string_view kWorkerOutputsBlobSequencePathFlagHeader =
"arg2="; // TODO: Use better flag names when standardizing the protocol.
constexpr std::string_view kWorkerPersistentModeSocketPathFlagHeader =
"persistent_mode_socket="; // TODO: Use better flag names when
// standardizing the protocol.

struct WorkerState {
std::atomic<bool> has_failure_output = false;
Expand Down Expand Up @@ -323,6 +324,64 @@ inline std::string_view ToStringView(const std::vector<uint8_t>& bytes) {
return {reinterpret_cast<const char*>(bytes.data()), bytes.size()};
}

// Zero initialized.
static int persistent_mode_socket;

__attribute__((constructor(200))) void WorkerInitEarly() {
const char* persistent_mode_socket_path =
GetWorkerFlag(kWorkerPersistentModeSocketPathFlagHeader);
if (persistent_mode_socket_path == nullptr) return;
persistent_mode_socket = socket(AF_UNIX, SOCK_STREAM, 0);
if (persistent_mode_socket < 0) {
WorkerLog(
"Failed to create persistent mode socket - not running persistent "
"mode.",
LogLnSync{});
return;
}

struct sockaddr_un addr{};
addr.sun_family = AF_UNIX;
const size_t socket_path_len = strlen(persistent_mode_socket_path);
WorkerCheck(
socket_path_len < sizeof(addr.sun_path),
"persistent mode socket path string must be fit in sockaddr_un.sun_path");
std::memcpy(addr.sun_path, persistent_mode_socket_path, socket_path_len);

int connect_ret = 0;
do {
connect_ret =
connect(persistent_mode_socket, (struct sockaddr*)&addr, sizeof(addr));
} while (connect_ret == -1 && errno == EINTR);
if (connect_ret == -1) {
WorkerLog("Failed to connect the persistent mode socket to ",
persistent_mode_socket_path, LogLnSync{});
(void)close(persistent_mode_socket);
persistent_mode_socket = -1;
}

int flags = fcntl(persistent_mode_socket, F_GETFD);
if (flags == -1) {
WorkerLog(
"fcntl(F_GETFD) failed on the persistent mode socket - exiting "
"persistent mode",
LogLnSync{});
(void)close(persistent_mode_socket);
persistent_mode_socket = -1;
}
flags |= FD_CLOEXEC;
if (fcntl(persistent_mode_socket, F_SETFD, flags) == -1) {
WorkerLog(
"fcntl(F_SETFD) failed on the persistent mode socket - exiting "
"persistent mode",
LogLnSync{});
(void)close(persistent_mode_socket);
persistent_mode_socket = -1;
}
WorkerLog("Persistent mode: connected to ", persistent_mode_socket_path,
LogLnSync{});
}

BlobSequence* GetInputsBlobSequence() {
static auto result = []() -> BlobSequence* {
if (!HasWorkerSwitchFlag("shmem")) {
Expand Down Expand Up @@ -695,6 +754,70 @@ const char* FuzzTestWorkerGetTestName() {
return test_name;
}

void HandlePersistentMode(const FuzzTestAdapter& adapter) {
auto* inputs_blobseq = GetInputsBlobSequence();
auto* outputs_blobseq = GetOutputsBlobSequence();
bool first = true;
while (true) {
PersistentModeRequest req;
if (!ReadAll(persistent_mode_socket, reinterpret_cast<char*>(&req), 1)) {
WorkerLog("Failed to read request from persistent mode socket: ",
LogErrNo{}, LogLnSync{});
return;
}
if (first) {
first = false;
WorkerLog("FuzzTest engine worker enter persistent mode", LogLnSync{});
} else {
// Reset stdout/stderr.
for (int fd = 1; fd <= 2; fd++) {
lseek(fd, 0, SEEK_SET);
// NOTE: Allow ftruncate() to fail by ignoring its return; that's okay
// to happen when the stdout/stderr are not redirected to a file.
(void)ftruncate(fd, 0);
}
WorkerLog(
"FuzzTest engine worker (",
req == PersistentModeRequest::kExit ? "exiting persistent mode"
: "persistent mode batch",
"); flags: ",
GetWorkerFlags().present
? std::string_view{GetWorkerFlags().str, GetWorkerFlags().len}
: "",
LogLnSync{});
}
if (req == PersistentModeRequest::kExit) break;
WorkerCheck(req == PersistentModeRequest::kRunBatch,
"Unknown persistent mode request");

inputs_blobseq->Reset();
outputs_blobseq->Reset();

// Read the first blob. It indicates what further actions to take.
auto request_type_blob = inputs_blobseq->Read();
if (IsMutationRequest(request_type_blob)) {
inputs_blobseq->Reset();
WorkerDoMutate(adapter);
} else if (IsExecutionRequest(request_type_blob)) {
inputs_blobseq->Reset();
WorkerDoExecute(adapter);
} else {
WorkerCheck(false, "Unknown shmem request");
}

const int result =
GetWorkerState().has_finding.load(std::memory_order_relaxed)
? EXIT_FAILURE
: EXIT_SUCCESS;
if (!WriteAll(persistent_mode_socket,
reinterpret_cast<const char*>(&result), sizeof(result))) {
WorkerLog("Failed to write response to the persistent mode socket: ",
LogErrNo{}, LogLnSync{});
return;
}
}
}

FuzzTestWorkerStatus WorkerRun(const FuzzTestAdapterManager& manager) {
const auto& flags = GetWorkerFlags();
WorkerCheck(flags.present, "worker flags must present");
Expand Down Expand Up @@ -764,7 +887,9 @@ FuzzTestWorkerStatus WorkerRun(const FuzzTestAdapterManager& manager) {
WorkerCheck(adapter.FreeInput != nullptr, "FreeInput must be defined");
WorkerCheck(adapter.FreeCtx != nullptr, "FreeCtx must be defined");

if (action == WorkerAction::kTestGetSeeds) {
if (persistent_mode_socket > 0) {
HandlePersistentMode(adapter);
} else if (action == WorkerAction::kTestGetSeeds) {
WorkerDoGetSeeds(adapter);
} else if (action == WorkerAction::kTestMutate) {
WorkerDoMutate(adapter);
Expand Down
Loading
Loading