[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 05/15] fuzz: double the IOs to remove for every loop
From: |
Thomas Huth |
Subject: |
[PULL 05/15] fuzz: double the IOs to remove for every loop |
Date: |
Mon, 11 Jan 2021 14:43:18 +0100 |
From: Qiuhao Li <Qiuhao.Li@outlook.com>
Instead of removing IO instructions one by one, we can try deleting multiple
instructions at once. According to the locality of reference, we double the
number of instructions to remove for the next round and recover it to one
once we fail.
This patch is usually significant for large input.
Test with quadrupled trace input at:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Patched 1/6 version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Refined version:
real 0m11.412s
user 0m6.888s
sys 0m3.325s
Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id:
<SYCPR01MB350280A67BB55C3FADF173E3FCAB0@SYCPR01MB3502.ausprd01.prod.outlook.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
scripts/oss-fuzz/minimize_qtest_trace.py | 33 +++++++++++++++---------
1 file changed, 21 insertions(+), 12 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index a28913a2a7..cacabf2638 100755
--- a/scripts/oss-fuzz/minimize_qtest_trace.py
+++ b/scripts/oss-fuzz/minimize_qtest_trace.py
@@ -88,19 +88,28 @@ def minimize_trace(inpath, outpath):
i = 0
newtrace = trace[:]
- # For each line
+ remove_step = 1
while i < len(newtrace):
- # 1.) Try to remove it completely and reproduce the crash. If it works,
- # we're done.
- prior = newtrace[i]
- print("Trying to remove {}".format(newtrace[i]))
- # Try to remove the line completely
- newtrace[i] = ""
+ # 1.) Try to remove lines completely and reproduce the crash.
+ # If it works, we're done.
+ if (i+remove_step) >= len(newtrace):
+ remove_step = 1
+ prior = newtrace[i:i+remove_step]
+ for j in range(i, i+remove_step):
+ newtrace[j] = ""
+ print("Removing {lines} ...".format(lines=prior))
if check_if_trace_crashes(newtrace, outpath):
- i += 1
+ i += remove_step
+ # Double the number of lines to remove for next round
+ remove_step *= 2
continue
- newtrace[i] = prior
-
+ # Failed to remove multiple IOs, fast recovery
+ if remove_step > 1:
+ for j in range(i, i+remove_step):
+ newtrace[j] = prior[j-i]
+ remove_step = 1
+ continue
+ newtrace[i] = prior[0] # remove_step = 1
# 2.) Try to replace write{bwlq} commands with a write addr, len
# command. Since this can require swapping endianness, try both LE and
# BE options. We do this, so we can "trim" the writes in (3)
@@ -121,7 +130,7 @@ def minimize_trace(inpath, outpath):
if(check_if_trace_crashes(newtrace, outpath)):
break
else:
- newtrace[i] = prior
+ newtrace[i] = prior[0]
# 3.) If it is a qtest write command: write addr len data, try to split
# it into two separate write commands. If splitting the write down the
@@ -154,7 +163,7 @@ def minimize_trace(inpath, outpath):
if check_if_trace_crashes(newtrace, outpath):
i -= 1
else:
- newtrace[i] = prior
+ newtrace[i] = prior[0]
del newtrace[i+1]
i += 1
check_if_trace_crashes(newtrace, outpath)
--
2.27.0
- [PULL 00/15] Testing, CI and bsd-user patches, Thomas Huth, 2021/01/11
- [PULL 02/15] qtest/libqtest: fix heap-buffer-overflow in qtest_cb_for_every_machine(), Thomas Huth, 2021/01/11
- [PULL 01/15] gitlab-ci.yml: Add openSUSE Leap 15.2 for gitlab CI/CD, Thomas Huth, 2021/01/11
- [PULL 03/15] util/oslib-win32: Fix _aligned_malloc() arguments order, Thomas Huth, 2021/01/11
- [PULL 05/15] fuzz: double the IOs to remove for every loop,
Thomas Huth <=
- [PULL 04/15] fuzz: accelerate non-crash detection, Thomas Huth, 2021/01/11
- [PULL 09/15] fuzz: add minimization options, Thomas Huth, 2021/01/11
- [PULL 08/15] fuzz: set bits in operand of write/out to zero, Thomas Huth, 2021/01/11
- [PULL 10/15] fuzz: heuristic split write based on past IOs, Thomas Huth, 2021/01/11
- [PULL 07/15] fuzz: remove IO commands iteratively, Thomas Huth, 2021/01/11
- [PULL 06/15] fuzz: split write operand using binary approach, Thomas Huth, 2021/01/11
- [PULL 11/15] bsd-user: regenerate FreeBSD's system call numbers, Thomas Huth, 2021/01/11
- [PULL 13/15] bsd-user: Update strace.list for FreeBSD's latest syscalls, Thomas Huth, 2021/01/11
- [PULL 12/15] bsd-user: move strace OS/arch dependent code to host/arch dirs, Thomas Huth, 2021/01/11
- [PULL 14/15] tests/acceptance: Fix race conditions in s390x tests & skip fedora on gitlab-CI, Thomas Huth, 2021/01/11