On 210629 2341, Alexander Bulekov wrote:
> By default, -fsanitize=fuzzer instruments all code with coverage
> information. However, this means that libfuzzer will track coverage over
> hundreds of source files that are unrelated to virtual-devices. This
> means that libfuzzer will optimize inputs for coverage observed in timer
> code, memory APIs etc. This slows down the fuzzer and stores many inputs
> that are not relevant to the actual virtual-devices.
>
> With this change, clang versions that support the
> "-fsanitize-coverage-allowlist" will only instrument a subset of the
> compiled code, that is directly related to virtual-devices.
>
> Signed-off-by: Alexander Bulekov <alx...@bu.edu>
Ping?
Are there any other device-related subdirectories we should add to the
filter besides slirp? I'm considering net/ , since it do not seem to
generate much coverage noise, and there might be some tricky codepaths
there that benefit from the coverage guidance.
-Alex
> ---
> configure | 13 +++++++++++++
> scripts/oss-fuzz/instrumentation-filter-template | 14 ++++++++++++++
> 2 files changed, 27 insertions(+)
> create mode 100644 scripts/oss-fuzz/instrumentation-filter-template
>
> diff --git a/configure b/configure
> index 38704b4e11..3b6ca054b9 100755
> --- a/configure
> +++ b/configure
> @@ -5189,6 +5189,11 @@ if test "$fuzzing" = "yes" && test -z
> "${LIB_FUZZING_ENGINE+xxx}"; then
> error_exit "Your compiler doesn't support -fsanitize=fuzzer"
> exit 1
> fi
> + have_clang_coverage_filter=no
> + echo > $TMPTXT
> + if compile_prog "$CPU_CFLAGS -Werror -fsanitize=fuzzer
> -fsanitize-coverage-allowlist=$TMPTXT" ""; then
> + have_clang_coverage_filter=yes
> + fi
> fi
>
> # Thread sanitizer is, for now, much noisier than the other sanitizers;
> @@ -6120,6 +6125,14 @@ if test "$fuzzing" = "yes" ; then
> # rule for the fuzzer adds these to the link_args. They need to be
> # configurable, to support OSS-Fuzz
> FUZZ_EXE_LDFLAGS="-fsanitize=fuzzer"
> +
> + # Specify a filter to only instrument code that is directly related to
> + # virtual-devices.
> + if test "$have_clang_coverage_filter" = "yes" ; then
> + cp "$source_path/scripts/oss-fuzz/instrumentation-filter-template" \
> + instrumentation-filter
> + QEMU_CFLAGS="$QEMU_CFLAGS
> -fsanitize-coverage-allowlist=instrumentation-filter"
> + fi
> else
> FUZZ_EXE_LDFLAGS="$LIB_FUZZING_ENGINE"
> fi
> diff --git a/scripts/oss-fuzz/instrumentation-filter-template
> b/scripts/oss-fuzz/instrumentation-filter-template
> new file mode 100644
> index 0000000000..44e853159c
> --- /dev/null
> +++ b/scripts/oss-fuzz/instrumentation-filter-template
> @@ -0,0 +1,14 @@
> +# Code that we actually want the fuzzer to target
> +# See:
> https://clang.llvm.org/docs/SanitizerCoverage.html#disabling-instrumentation-without-source-modification
> +#
> +src:*/hw/*
> +src:*/include/hw/*
> +src:*/slirp/*
> +
> +# We don't care about coverage over fuzzer-specific code, however we should
> +# instrument the fuzzer entry-point so libFuzzer always sees at least some
> +# coverage - otherwise it will exit after the first input
> +src:*/tests/qtest/fuzz/fuzz.c
> +
> +# Enable instrumentation for all functions in those files
> +fun:*
> --
> 2.28.0
>
