honggfuzz: update to 2.6

lib/bolero-honggfuzz/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "bolero-honggfuzz"
-version = "0.11.0"
+version = "0.11.2"
 authors = ["Cameron Bytheway <bytheway.cameron@gmail.com>"]
 description = "honggfuzz plugin for bolero"
 homepage = "https://github.com/camshaft/bolero"

lib/bolero-honggfuzz/build.rs

@@ -20,6 +20,7 @@ fn build(target: &str, file: &str, lib: &str) -> String {
 
     let status = Command::new(MAKE_COMMAND)
         .args(["-C", "honggfuzz", target, "libhfcommon/libhfcommon.a"])
+        .env("CFLAGS", "-O3 -mtune=native -funroll-loops -fPIE")
         .status()
         .unwrap();
     assert!(status.success());

lib/bolero-honggfuzz/honggfuzz/Android.mk

@@ -137,7 +137,7 @@ COMMON_CFLAGS := -std=c11 \
   -Wall -Wextra -Wno-initializer-overrides -Wno-override-init \
   -Wno-atomic-alignment -Wno-unknown-warning-option \
   -Werror -funroll-loops -O2 \
-  -Wframe-larger-than=1048576 -Wno-format-truncation \
+  -Wno-format-truncation \
 
 ifneq (,$(findstring clang,$(NDK_TOOLCHAIN)))
   COMMON_CFLAGS += -fblocks -fno-sanitize=address,undefined,memory,thread -fsanitize-coverage=0
@@ -146,7 +146,7 @@ endif
 
 # libhfcommon module
 include $(CLEAR_VARS)
-LOCAL_MODULE := common
+LOCAL_MODULE := hfcommon
 LOCAL_SRC_FILES := $(wildcard libhfcommon/*.c)
 LOCAL_CFLAGS := -D_HF_ARCH_${ARCH} $(COMMON_CFLAGS)
 LOCAL_STATIC_LIBRARIES := $(COMMON_STATIC_LIBS)
@@ -175,8 +175,8 @@ include $(CLEAR_VARS)
 LOCAL_MODULE := honggfuzz
 LOCAL_SRC_FILES := $(wildcard *.c)
 LOCAL_CFLAGS := $(COMMON_CFLAGS)
-LOCAL_LDFLAGS := -lm -latomic
-LOCAL_STATIC_LIBRARIES := $(COMMON_STATIC_LIBS) common
+LOCAL_LDFLAGS := -lm -latomic -lz
+LOCAL_STATIC_LIBRARIES := $(COMMON_STATIC_LIBS) hfcommon
 
 ifeq ($(ANDROID_WITH_PTRACE),true)
   LOCAL_STATIC_LIBRARIES += libunwind-arch \

lib/bolero-honggfuzz/honggfuzz/Makefile

@@ -27,7 +27,7 @@ BIN := honggfuzz
 HFUZZ_CC_BIN := hfuzz_cc/hfuzz-cc
 HFUZZ_CC_SRCS := hfuzz_cc/hfuzz-cc.c
 COMMON_CFLAGS := -std=c11 -I/usr/local/include -D_GNU_SOURCE -Wall -Wextra -Werror -Wno-format-truncation -Wno-override-init -I.
-COMMON_LDFLAGS := -pthread -lm
+COMMON_LDFLAGS := -pthread -L/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib -lm
 COMMON_SRCS := $(sort $(wildcard *.c))
 CFLAGS ?= -O3 -mtune=native -funroll-loops
 LDFLAGS ?=
@@ -36,6 +36,7 @@ GREP_COLOR ?=
 BUILD_OSSFUZZ_STATIC ?= false # for https://github.com/google/oss-fuzz
 BUILD_LINUX_NO_BFD ?= false # for users who don't want to use libbfd/binutils
 
+REALOS = $(shell uname -s)
 OS ?= $(shell uname -s)
 MARCH ?= $(shell uname -m)
 KERNEL ?= $(shell uname -r)
@@ -82,24 +83,37 @@ else ifeq ($(OS),Darwin)
     # Figure out which crash reporter to use.
     CRASHWRANGLER := third_party/mac
     OS_VERSION := $(shell sw_vers -productVersion)
-    ifneq (,$(findstring 10.15,$(OS_VERSION)))
-        CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Sierra.o
-    else ifneq (,$(findstring 10.14,$(OS_VERSION)))
+    OS_MAJOR_VERSION := $(shell echo $(OS_VERSION) | cut -f1 -d.)
+    OS_MINOR_VERSION := $(shell echo $(OS_VERSION) | cut -f2 -d.)
+
+    ifeq ($(OS_MAJOR_VERSION), 13)
         CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Sierra.o
-    else ifneq (,$(findstring 10.13,$(OS_VERSION)))
+    else ifeq ($(OS_MAJOR_VERSION), 12)
         CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Sierra.o
-    else ifneq (,$(findstring 10.12,$(OS_VERSION)))
+    else ifeq ($(OS_MAJOR_VERSION), 11)
         CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Sierra.o
-    else ifneq (,$(findstring 10.11,$(OS_VERSION)))
-        # El Capitan didn't break compatibility
-        CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Yosemite.o
-    else ifneq (,$(findstring 10.10,$(OS_VERSION)))
-        CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Yosemite.o
-    else ifneq (,$(findstring 10.9,$(OS_VERSION)))
-        CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Mavericks.o
-    else ifneq (,$(findstring 10.8,$(OS_VERSION)))
-        CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Mountain_Lion.o
-    else
+    else ifeq ($(OS_MAJOR_VERSION), 10)
+        ifeq ($(OS_MINOR_VERSION), 15)
+            CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Sierra.o
+        else ifeq ($(OS_MINOR_VERSION), 14)
+            CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Sierra.o
+        else ifeq ($(OS_MINOR_VERSION), 13)
+            CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Sierra.o
+        else ifeq ($(OS_MINOR_VERSION), 12)
+            CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Sierra.o
+        else ifeq ($(OS_MINOR_VERSION), 11)
+            # El Capitan didn't break compatibility
+            CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Yosemite.o
+        else ifeq ($(OS_MINOR_VERSION), 10)
+            CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Yosemite.o
+        else ifeq ($(OS_MINOR_VERSION), 9)
+            CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Mavericks.o
+        else ifeq ($(OS_MINOR_VERSION), 8)
+            CRASH_REPORT := $(CRASHWRANGLER)/CrashReport_Mountain_Lion.o
+        endif
+    endif
+
+    ifeq ($(CRASH_REPORT), )
         $(error Unsupported MAC OS X version)
     endif
 
@@ -121,7 +135,7 @@ else ifeq ($(OS),Darwin)
                    -Wno-embedded-directive
     ARCH_LDFLAGS := -F/System/Library/PrivateFrameworks -framework CoreSymbolication -framework IOKit \
                     -F$(SDK_V)/System/Library/Frameworks -F$(SDK_V)/System/Library/PrivateFrameworks \
-                    -F$(SDK)/System/Library/Frameworks \
+                    -F$(SDK)/System/Library/Frameworks -F$(SDK)/System/Library/PrivateFrameworks \
                     -framework Foundation -framework ApplicationServices -framework Symbolication \
                     -framework CoreServices -framework CrashReporterSupport -framework CoreFoundation \
                     -framework CommerceKit $(CRASH_REPORT)
@@ -150,9 +164,11 @@ else
         ARCH_CFLAGS += -D_POSIX_C_SOURCE=200809L -D__EXTENSIONS__=1
 	ARCH_LDFLAGS += -lkstat -lsocket -lnsl
     endif
-    ifneq ($(OS),OpenBSD)
+    ifneq ($(REALOS),OpenBSD)
+    ifneq ($(REALOS),Darwin)
         ARCH_LDFLAGS += -lrt
     endif
+    endif
 # OS Posix
 endif
 
@@ -167,7 +183,7 @@ ifeq ($(COMPILER),clang)
   ARCH_CFLAGS += -mllvm -inline-threshold=2000
   CFLAGS_BLOCKS = -fblocks
 
-  ifneq ($(OS),Darwin)
+  ifneq ($(REALOS),Darwin)
     ARCH_LDFLAGS += -Wl,-Bstatic -lBlocksRuntime -Wl,-Bdynamic
   endif
 endif
@@ -202,9 +218,9 @@ ifdef DEBUG
 endif
 
 # Control Android builds
-ANDROID_API           ?= android-26 # Minimal working version is android-23
+ANDROID_API           ?= android-30 # Minimal working version is android-30 (ndk 22)
 ANDROID_DEBUG_ENABLED ?= false
-ANDROID_APP_ABI       ?= armeabi-v7a
+ANDROID_APP_ABI       ?= arm64-v8a
 ANDROID_SKIP_CLEAN    ?= false
 NDK_BUILD_ARGS :=
 
@@ -317,7 +333,7 @@ depend: all
 .PHONY: android
 android:
 	$(info ***************************************************************)
-	$(info *                 Use Android NDK 20 or newer                 *)
+	$(info *                 Use Android NDK 22 or newer                 *)
 	$(info ***************************************************************)
 	@ANDROID_API=$(ANDROID_API) ANDROID_NDK_COMPILER_PREFIX=$(ANDROID_NDK_COMPILER_PREFIX) third_party/android/scripts/compile-libunwind.sh \
 	third_party/android/libunwind $(ANDROID_ARCH_CPU)
@@ -415,7 +431,7 @@ libhfcommon/files.o: libhfcommon/common.h libhfcommon/log.h
 libhfcommon/files.o: libhfcommon/util.h
 libhfcommon/log.o: libhfcommon/log.h libhfcommon/common.h libhfcommon/util.h
 libhfcommon/ns.o: libhfcommon/ns.h libhfcommon/common.h libhfcommon/files.h
-libhfcommon/ns.o: libhfcommon/common.h libhfcommon/log.h
+libhfcommon/ns.o: libhfcommon/common.h libhfcommon/log.h libhfcommon/util.h
 libhfcommon/util.o: libhfcommon/util.h libhfcommon/common.h
 libhfcommon/util.o: libhfcommon/files.h libhfcommon/common.h
 libhfcommon/util.o: libhfcommon/log.h

lib/bolero-honggfuzz/honggfuzz/arch.h

@@ -36,6 +36,8 @@ extern pid_t arch_fork(run_t* run);
 
 extern void arch_reapChild(run_t* run);
 
+extern void arch_reapKill(void);
+
 extern void arch_prepareParent(run_t* run);
 
 extern void arch_prepareParentAfterFork(run_t* run);

lib/bolero-honggfuzz/honggfuzz/cmdline.c

@@ -355,6 +355,7 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
                 .runEndTime             = 0,
                 .tmOut                  = 1,
                 .lastCovUpdate          = time(NULL),
+                .exitOnTime             = 0,
                 .timeOfLongestUnitUSecs = 0,
                 .tmoutVTALRM            = false,
             },
@@ -500,6 +501,7 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
         { { "pprocess_cmd", required_argument, NULL, 0x111 }, "External command postprocessing files produced by internal mutators" },
         { { "ffmutate_cmd", required_argument, NULL, 0x110 }, "External command mutating files which have effective coverage feedback" },
         { { "run_time", required_argument, NULL, 0x109 }, "Number of seconds this fuzzing session will last (default: 0 [no limit])" },
+        { { "exit_on_time", required_argument, NULL, 0x10A }, "Stop fuzzing session if no new coverage was found for this number of seconds (default: 0 [no limit])" },
         { { "iterations", required_argument, NULL, 'N' }, "Number of fuzzing iterations (default: 0 [no limit])" },
         { { "rlimit_as", required_argument, NULL, 0x100 }, "Per process RLIMIT_AS in MiB (default: 0 [default limit])" },
         { { "rlimit_rss", required_argument, NULL, 0x101 }, "Per process RLIMIT_RSS in MiB (default: 0 [default limit]). It will also set *SAN's soft_rss_limit_mb" },
@@ -525,6 +527,8 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
         { { "export_feedback", no_argument, NULL, 0x10E }, "Export the coverage feedback structure as ./hfuzz-feedback" },
         { { "const_feedback", required_argument, NULL, 0x112 }, "Use constant integer/string values from fuzzed programs to mangle input files via a dynamic dictionary (default: true)" },
         { { "pin_thread_cpu", required_argument, NULL, 0x114 }, "Pin a single execution thread to this many consecutive CPUs (default: 0 = no CPU pinning)" },
+        { { "dynamic_input", required_argument, NULL, 0x115 }, "Path to a directory containing the dynamic file corpus" },
+        { { "statsfile", required_argument, NULL, 0x116 }, "Stats file" },
 
 #if defined(_HF_ARCH_LINUX)
         { { "linux_symbols_bl", required_argument, NULL, 0x504 }, "Symbols blocklist filter file (one entry per line)" },
@@ -549,6 +553,9 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
         { { "netbsd_symbols_al", required_argument, NULL, 0x505 }, "Symbols allowlist filter file (one entry per line)" },
         { { "netbsd_addr_low_limit", required_argument, NULL, 0x500 }, "Address limit (from si.si_addr) below which crashes are not reported, (default: 0)" },
 #endif // defined(_HF_ARCH_NETBSD)
+#if defined(__FreeBSD__)
+        { { "fbsd_keep_aslr", no_argument, NULL, 0x501 }, "Don't disable ASLR randomization, might be useful with MSAN" },
+#endif
         { { 0, 0, 0, 0 }, NULL },
     };
     // clang-format on
@@ -685,6 +692,9 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
                     hfuzz->timing.runEndTime = time(NULL) + p;
                 }
             } break;
+            case 0x10A:
+                hfuzz->timing.exitOnTime = atol(optarg);
+                break;
             case 'N':
                 hfuzz->mutate.mutationsMax = atol(optarg);
                 break;
@@ -796,6 +806,17 @@ bool cmdlineParse(int argc, char* argv[], honggfuzz_t* hfuzz) {
                 hfuzz->arch_netbsd.symsWlFile = optarg;
                 break;
 #endif /* defined(_HF_ARCH_NETBSD) */
+#if defined(__FreeBSD__)
+            case 0x501:
+                hfuzz->arch_linux.disableRandomization = false;
+                break;
+#endif
+            case 0x115:
+                hfuzz->io.dynamicInputDir = optarg;
+                break;
+            case 0x116:
+                hfuzz->io.statsFileName = optarg;
+                break;
             default:
                 cmdlineHelp(argv[0], custom_opts);
                 return false;

lib/bolero-honggfuzz/honggfuzz/display.c

@@ -114,7 +114,7 @@ static unsigned getCpuUse(int numCpus) {
 
 #if defined(__linux__) || defined(__CYGWIN__)
     FILE* f = fopen("/proc/stat", "re");
-    if (f == NULL) {
+    if (UNLIKELY(f == NULL)) {
         return 0;
     }
     defer {
@@ -130,7 +130,7 @@ static unsigned getCpuUse(int numCpus) {
     long   off        = 0;
     size_t cpuDataLen = sizeof(long) * CPUSTATES * numCpus;
     long*  cpuData    = malloc(cpuDataLen);
-    if (cpuData == NULL) {
+    if (UNLIKELY(cpuData == NULL)) {
         return 0;
     }
 
@@ -233,7 +233,7 @@ static unsigned getCpuUse(int numCpus) {
     prevIdleT   = idleT;
 
     uint64_t allCycles = userCycles + niceCycles + systemCycles + idleCycles;
-    if (allCycles == 0) {
+    if (UNLIKELY(allCycles == 0)) {
         return 0;
     }
 
@@ -417,7 +417,7 @@ void display_display(honggfuzz_t* hfuzz) {
         uint64_t softCntCmp  = ATOMIC_GET(hfuzz->feedback.hwCnts.softCntCmp);
         uint64_t guardNb     = ATOMIC_GET(hfuzz->feedback.covFeedbackMap->guardNb);
         display_put(" edge: " ESC_BOLD "%" _HF_NONMON_SEP PRIu64 ESC_RESET "/"
-                    "%" _HF_NONMON_SEP                           PRIu64 " [%" PRId64 "%%]",
+                    "%" _HF_NONMON_SEP PRIu64 " [%" PRId64 "%%]",
             softCntEdge, guardNb, guardNb ? ((softCntEdge * 100) / guardNb) : 0);
         display_put(" pc: " ESC_BOLD "%" _HF_NONMON_SEP PRIu64 ESC_RESET, softCntPc);
         display_put(" cmp: " ESC_BOLD "%" _HF_NONMON_SEP PRIu64 ESC_RESET, softCntCmp);

lib/bolero-honggfuzz/honggfuzz/fuzz.c

@@ -178,29 +178,38 @@ static void fuzz_perfFeedback(run_t* run) {
     if (run->global->feedback.skipFeedbackOnTimeout && run->tmOutSignaled) {
         return;
     }
+    if (run->global->feedback.dynFileMethod == _HF_DYNFILE_NONE) {
+        return;
+    }
 
     MX_SCOPED_LOCK(&run->global->mutex.feedback);
     defer {
         wmb();
     };
 
-    uint64_t softNewPC = ATOMIC_GET(run->global->feedback.covFeedbackMap->pidNewPC[run->fuzzNo]);
-    ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidNewPC[run->fuzzNo]);
-    uint64_t softCurPC = ATOMIC_GET(run->global->feedback.covFeedbackMap->pidTotalPC[run->fuzzNo]);
-    ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidTotalPC[run->fuzzNo]);
+    uint64_t softNewPC   = 0;
+    uint64_t softCurPC   = 0;
+    uint64_t softNewEdge = 0;
+    uint64_t softCurEdge = 0;
+    uint64_t softNewCmp  = 0;
+    uint64_t softCurCmp  = 0;
 
-    uint64_t softNewEdge =
-        ATOMIC_GET(run->global->feedback.covFeedbackMap->pidNewEdge[run->fuzzNo]);
-    ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidNewEdge[run->fuzzNo]);
-    uint64_t softCurEdge =
-        ATOMIC_GET(run->global->feedback.covFeedbackMap->pidTotalEdge[run->fuzzNo]);
-    ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidTotalEdge[run->fuzzNo]);
+    if (run->global->feedback.dynFileMethod & _HF_DYNFILE_SOFT) {
+        softNewPC = ATOMIC_GET(run->global->feedback.covFeedbackMap->pidNewPC[run->fuzzNo]);
+        ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidNewPC[run->fuzzNo]);
+        softCurPC = ATOMIC_GET(run->global->feedback.covFeedbackMap->pidTotalPC[run->fuzzNo]);
+        ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidTotalPC[run->fuzzNo]);
 
-    uint64_t softNewCmp = ATOMIC_GET(run->global->feedback.covFeedbackMap->pidNewCmp[run->fuzzNo]);
-    ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidNewCmp[run->fuzzNo]);
-    uint64_t softCurCmp =
-        ATOMIC_GET(run->global->feedback.covFeedbackMap->pidTotalCmp[run->fuzzNo]);
-    ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidTotalCmp[run->fuzzNo]);
+        softNewEdge = ATOMIC_GET(run->global->feedback.covFeedbackMap->pidNewEdge[run->fuzzNo]);
+        ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidNewEdge[run->fuzzNo]);
+        softCurEdge = ATOMIC_GET(run->global->feedback.covFeedbackMap->pidTotalEdge[run->fuzzNo]);
+        ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidTotalEdge[run->fuzzNo]);
+
+        softNewCmp = ATOMIC_GET(run->global->feedback.covFeedbackMap->pidNewCmp[run->fuzzNo]);
+        ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidNewCmp[run->fuzzNo]);
+        softCurCmp = ATOMIC_GET(run->global->feedback.covFeedbackMap->pidTotalCmp[run->fuzzNo]);
+        ATOMIC_CLEAR(run->global->feedback.covFeedbackMap->pidTotalCmp[run->fuzzNo]);
+    }
 
     rmb();
 
@@ -229,6 +238,37 @@ static void fuzz_perfFeedback(run_t* run) {
             softNewPC, softNewCmp, run->hwCnts.cpuInstrCnt, run->hwCnts.cpuBranchCnt,
             run->hwCnts.bbCnt, softCurEdge, softCurPC, softCurCmp);
 
+        if (run->global->io.statsFileName) {
+            const time_t curr_sec      = time(NULL);
+            const time_t elapsed_sec   = curr_sec - run->global->timing.timeStart;
+            size_t       curr_exec_cnt = ATOMIC_GET(run->global->cnts.mutationsCnt);
+            /*
+             * We increase the mutation counter unconditionally in threads, but if it's
+             * above hfuzz->mutationsMax we don't really execute the fuzzing loop.
+             * Therefore at the end of fuzzing, the mutation counter might be higher
+             * than hfuzz->mutationsMax
+             */
+            if (run->global->mutate.mutationsMax > 0 &&
+                curr_exec_cnt > run->global->mutate.mutationsMax) {
+                curr_exec_cnt = run->global->mutate.mutationsMax;
+            }
+            size_t tot_exec_per_sec = elapsed_sec ? (curr_exec_cnt / elapsed_sec) : 0;
+
+            dprintf(run->global->io.statsFileFd,
+                "%lu, %lu, %lu, %lu, "
+                "%" PRIu64 ", %" PRIu64 ", %" PRIu64 ", %" PRIu64 ", %" PRIu64 "\n",
+                curr_sec,                                 /* unix_time */
+                run->global->timing.lastCovUpdate,        /* last_cov_update */
+                curr_exec_cnt,                            /* total_exec */
+                tot_exec_per_sec,                         /* exec_per_sec */
+                run->global->cnts.crashesCnt,             /* crashes */
+                run->global->cnts.uniqueCrashesCnt,       /* unique_crashes */
+                run->global->cnts.timeoutedCnt,           /* hangs */
+                run->global->feedback.hwCnts.softCntEdge, /* edge_cov */
+                run->global->feedback.hwCnts.softCntPc    /* block_cov */
+            );
+        }
+
         /* Update per-input coverage metrics */
         run->dynfile->cov[0] = softCurEdge + softCurPC + run->hwCnts.bbCnt;
         run->dynfile->cov[1] = softCurCmp;
@@ -488,6 +528,9 @@ static void* fuzz_threadNew(void* arg) {
         .persistentSock = -1,
         .tmOutSignaled  = false,
     };
+    defer {
+        free(run.dynfile);
+    };
 
     /* Do not try to handle input files with socketfuzzer */
     char mapname[32];
@@ -553,6 +596,8 @@ static void* fuzz_threadNew(void* arg) {
         }
     }
 
+    arch_reapKill();
+
     if (run.pid) {
         kill(run.pid, SIGKILL);
     }