From ba22647276a63912312fb6636287cc266da19683 Mon Sep 17 00:00:00 2001 From: "Dongjia \"toka\" Zhang" Date: Fri, 13 Oct 2023 03:26:00 +0200 Subject: [PATCH] Update LibAFL (#1902) and the rust compiler it uses CC @andreafioraldi @addisoncrump --- fuzzers/aflrustrust/builder.Dockerfile | 6 +- fuzzers/aflrustrust/fuzzer.py | 2 +- fuzzers/libafl/builder.Dockerfile | 6 +- fuzzers/libafl/fuzzer.py | 10 ++- fuzzers/libafl/runner.Dockerfile | 2 + .../builder.Dockerfile | 48 +++++++------ fuzzers/libafl_27042023/description.md | 11 +++ fuzzers/libafl_27042023/fuzzer.py | 67 +++++++++++++++++++ .../runner.Dockerfile | 0 fuzzers/libafl_forkserver/description.md | 13 ---- fuzzers/libafl_forkserver/fuzzer.py | 67 ------------------- service/gcbrun_experiment.py | 1 + 12 files changed, 118 insertions(+), 115 deletions(-) rename fuzzers/{libafl_forkserver => libafl_27042023}/builder.Dockerfile (53%) create mode 100644 fuzzers/libafl_27042023/description.md create mode 100755 fuzzers/libafl_27042023/fuzzer.py rename fuzzers/{libafl_forkserver => libafl_27042023}/runner.Dockerfile (100%) delete mode 100644 fuzzers/libafl_forkserver/description.md delete mode 100755 fuzzers/libafl_forkserver/fuzzer.py diff --git a/fuzzers/aflrustrust/builder.Dockerfile b/fuzzers/aflrustrust/builder.Dockerfile index 7835c03b7..ccc7afc4f 100644 --- a/fuzzers/aflrustrust/builder.Dockerfile +++ b/fuzzers/aflrustrust/builder.Dockerfile @@ -24,7 +24,7 @@ RUN apt-get update && \ # Uninstall old Rust & Install the latest one. RUN if which rustup; then rustup self uninstall -y; fi && \ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \ - sh /rustup.sh --default-toolchain nightly -y && \ + sh /rustup.sh --default-toolchain nightly-2023-09-21 -y && \ rm /rustup.sh # Download afl++. @@ -46,11 +46,11 @@ RUN cd /afl && \ RUN git clone https://github.com/AFLplusplus/LibAFL /libafl # Checkout a current commit -RUN cd /libafl && git checkout 8bffd28b4c357b315acb9cecd92cbf2b734a625a +RUN cd /libafl && git checkout c103444396697af102dce2b936a00e93017057ba # Compile libafl. RUN cd /libafl && \ unset CFLAGS CXXFLAGS && \ cd ./fuzzers/fuzzbench_forkserver && \ - PATH="/root/.cargo/bin/:$PATH" cargo build --release + PATH="/root/.cargo/bin/:$PATH" cargo build --profile release-fuzzbench diff --git a/fuzzers/aflrustrust/fuzzer.py b/fuzzers/aflrustrust/fuzzer.py index c8b66976f..81cc4b2f2 100755 --- a/fuzzers/aflrustrust/fuzzer.py +++ b/fuzzers/aflrustrust/fuzzer.py @@ -30,7 +30,7 @@ def build(): # Copy to fuzzer to OUT build_directory = os.environ['OUT'] fuzzer = '/libafl/fuzzers/fuzzbench_forkserver/' \ - 'target/release/fuzzbench_forkserver' + 'target/release-fuzzbench/fuzzbench_forkserver' shutil.copy(fuzzer, build_directory) diff --git a/fuzzers/libafl/builder.Dockerfile b/fuzzers/libafl/builder.Dockerfile index f1d027780..cef4659cc 100644 --- a/fuzzers/libafl/builder.Dockerfile +++ b/fuzzers/libafl/builder.Dockerfile @@ -18,7 +18,7 @@ FROM $parent_image # Uninstall old Rust & Install the latest one. RUN if which rustup; then rustup self uninstall -y; fi && \ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \ - sh /rustup.sh --default-toolchain nightly-2023-03-29 -y && \ + sh /rustup.sh --default-toolchain nightly-2023-09-21 -y && \ rm /rustup.sh # Install dependencies. @@ -38,7 +38,7 @@ RUN apt-get update && \ RUN git clone https://github.com/AFLplusplus/LibAFL /libafl # Checkout a current commit -RUN cd /libafl && git checkout 8ff8ae41f1ed2956bb1e906c5c7bd0505ca110c0 || true +RUN cd /libafl && git pull && git checkout b20fda2a4ada2a6462718dc661e139e6c7a29807 || true # Note that due a nightly bug it is currently fixed to a known version on top! # Compile libafl. @@ -46,7 +46,7 @@ RUN cd /libafl && \ unset CFLAGS CXXFLAGS && \ export LIBAFL_EDGES_MAP_SIZE=2621440 && \ cd ./fuzzers/fuzzbench && \ - PATH="/root/.cargo/bin/:$PATH" cargo build --release --features no_link_main + PATH="/root/.cargo/bin/:$PATH" cargo build --profile release-fuzzbench --features no_link_main # Auxiliary weak references. RUN cd /libafl/fuzzers/fuzzbench && \ diff --git a/fuzzers/libafl/fuzzer.py b/fuzzers/libafl/fuzzer.py index d00bb1dd5..cfd2a64d7 100755 --- a/fuzzers/libafl/fuzzer.py +++ b/fuzzers/libafl/fuzzer.py @@ -40,8 +40,10 @@ def prepare_fuzz_environment(input_corpus): def build(): # pylint: disable=too-many-branches,too-many-statements """Build benchmark.""" - os.environ['CC'] = '/libafl/fuzzers/fuzzbench/target/release/libafl_cc' - os.environ['CXX'] = '/libafl/fuzzers/fuzzbench/target/release/libafl_cxx' + os.environ[ + 'CC'] = '/libafl/fuzzers/fuzzbench/target/release-fuzzbench/libafl_cc' + os.environ[ + 'CXX'] = '/libafl/fuzzers/fuzzbench/target/release-fuzzbench/libafl_cxx' os.environ['ASAN_OPTIONS'] = 'abort_on_error=0:allocator_may_return_null=1' os.environ['UBSAN_OPTIONS'] = 'abort_on_error=0' @@ -63,5 +65,7 @@ def fuzz(input_corpus, output_corpus, target_binary): if dictionary_path: command += (['-x', dictionary_path]) command += (['-o', output_corpus, '-i', input_corpus]) + fuzzer_env = os.environ.copy() + fuzzer_env['LD_PRELOAD'] = '/usr/lib/x86_64-linux-gnu/libjemalloc.so.2' print(command) - subprocess.check_call(command, cwd=os.environ['OUT']) + subprocess.check_call(command, cwd=os.environ['OUT'], env=fuzzer_env) diff --git a/fuzzers/libafl/runner.Dockerfile b/fuzzers/libafl/runner.Dockerfile index 7aa1da8e4..f0c5eb6cc 100644 --- a/fuzzers/libafl/runner.Dockerfile +++ b/fuzzers/libafl/runner.Dockerfile @@ -14,6 +14,8 @@ FROM gcr.io/fuzzbench/base-image +RUN apt install libjemalloc2 + # This makes interactive docker runs painless: ENV LD_LIBRARY_PATH="$LD_LIBRARY_PATH:/out" #ENV AFL_MAP_SIZE=2621440 diff --git a/fuzzers/libafl_forkserver/builder.Dockerfile b/fuzzers/libafl_27042023/builder.Dockerfile similarity index 53% rename from fuzzers/libafl_forkserver/builder.Dockerfile rename to fuzzers/libafl_27042023/builder.Dockerfile index d0894e72f..01141c74e 100644 --- a/fuzzers/libafl_forkserver/builder.Dockerfile +++ b/fuzzers/libafl_27042023/builder.Dockerfile @@ -15,42 +15,40 @@ ARG parent_image FROM $parent_image -# Install dependencies. -RUN apt-get update && \ - apt-get install -y build-essential libstdc++5 libtool-bin automake flex \ - bison libglib2.0-dev python3-setuptools unzip python3-dev joe curl \ - cmake git apt-utils apt-transport-https ca-certificates libdbus-1-dev - # Uninstall old Rust & Install the latest one. RUN if which rustup; then rustup self uninstall -y; fi && \ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs > /rustup.sh && \ - sh /rustup.sh --default-toolchain nightly -y && \ + sh /rustup.sh --default-toolchain nightly-2023-03-29 -y && \ rm /rustup.sh -# Download afl++. -RUN git clone https://github.com/AFLplusplus/AFLplusplus /afl - -# Checkout a current commit -RUN cd /afl && git checkout 8cdc48f73a17ddd557897f2098937a8ba3bfe184 - -# Build without Python support as we don't need it. -# Set AFL_NO_X86 to skip flaky tests. -RUN cd /afl && \ - unset CFLAGS CXXFLAGS && \ - export CC=clang AFL_NO_X86=1 && \ - PYTHON_INCLUDE=/ make && \ - make install && \ - cp utils/aflpp_driver/libAFLDriver.a / +# Install dependencies. +RUN apt-get update && \ + apt-get remove -y llvm-10 && \ + apt-get install -y \ + build-essential \ + llvm-11 \ + clang-12 \ + cargo && \ + apt-get install -y wget libstdc++5 libtool-bin automake flex bison \ + libglib2.0-dev libpixman-1-dev python3-setuptools unzip \ + apt-utils apt-transport-https ca-certificates joe curl && \ + PATH="/root/.cargo/bin/:$PATH" cargo install cargo-make # Download libafl. RUN git clone https://github.com/AFLplusplus/LibAFL /libafl # Checkout a current commit -RUN cd /libafl && git checkout 664e87809e6005f1814df1b55a345e7b2247f15b +RUN cd /libafl && git checkout 3ce0c102affeace754072368013422e97b9dce9c || true +# Note that due a nightly bug it is currently fixed to a known version on top! # Compile libafl. RUN cd /libafl && \ unset CFLAGS CXXFLAGS && \ - cd ./fuzzers/fuzzbench_forkserver && \ - PATH="/root/.cargo/bin/:$PATH" cargo build --release - + export LIBAFL_EDGES_MAP_SIZE=2621440 && \ + cd ./fuzzers/fuzzbench && \ + PATH="/root/.cargo/bin/:$PATH" cargo build --release --features no_link_main + +# Auxiliary weak references. +RUN cd /libafl/fuzzers/fuzzbench && \ + clang -c stub_rt.c && \ + ar r /stub_rt.a stub_rt.o diff --git a/fuzzers/libafl_27042023/description.md b/fuzzers/libafl_27042023/description.md new file mode 100644 index 000000000..ea9b947d6 --- /dev/null +++ b/fuzzers/libafl_27042023/description.md @@ -0,0 +1,11 @@ +# libafl + +libafl fuzzer instance + - cmplog feature + - persistent mode + +Repository: [https://github.com/AFLplusplus/libafl/](https://github.com/AFLplusplus/libafl/) + +[builder.Dockerfile](builder.Dockerfile) +[fuzzer.py](fuzzer.py) +[runner.Dockerfile](runner.Dockerfile) diff --git a/fuzzers/libafl_27042023/fuzzer.py b/fuzzers/libafl_27042023/fuzzer.py new file mode 100755 index 000000000..d00bb1dd5 --- /dev/null +++ b/fuzzers/libafl_27042023/fuzzer.py @@ -0,0 +1,67 @@ +# Copyright 2020 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +"""Integration code for a LibAFL-based fuzzer.""" + +import os +import subprocess + +from fuzzers import utils + + +def prepare_fuzz_environment(input_corpus): + """Prepare to fuzz with a LibAFL-based fuzzer.""" + os.environ['ASAN_OPTIONS'] = 'abort_on_error=1:detect_leaks=0:'\ + 'malloc_context_size=0:symbolize=0:'\ + 'allocator_may_return_null=1:'\ + 'detect_odr_violation=0:handle_segv=0:'\ + 'handle_sigbus=0:handle_abort=0:'\ + 'handle_sigfpe=0:handle_sigill=0' + os.environ['UBSAN_OPTIONS'] = 'abort_on_error=1:'\ + 'allocator_release_to_os_interval_ms=500:'\ + 'handle_abort=0:handle_segv=0:'\ + 'handle_sigbus=0:handle_sigfpe=0:'\ + 'handle_sigill=0:print_stacktrace=0:'\ + 'symbolize=0:symbolize_inline_frames=0' + # Create at least one non-empty seed to start. + utils.create_seed_file_for_empty_corpus(input_corpus) + + +def build(): # pylint: disable=too-many-branches,too-many-statements + """Build benchmark.""" + os.environ['CC'] = '/libafl/fuzzers/fuzzbench/target/release/libafl_cc' + os.environ['CXX'] = '/libafl/fuzzers/fuzzbench/target/release/libafl_cxx' + + os.environ['ASAN_OPTIONS'] = 'abort_on_error=0:allocator_may_return_null=1' + os.environ['UBSAN_OPTIONS'] = 'abort_on_error=0' + + cflags = ['--libafl'] + utils.append_flags('CFLAGS', cflags) + utils.append_flags('CXXFLAGS', cflags) + utils.append_flags('LDFLAGS', cflags) + + os.environ['FUZZER_LIB'] = '/stub_rt.a' + utils.build_benchmark() + + +def fuzz(input_corpus, output_corpus, target_binary): + """Run fuzzer.""" + prepare_fuzz_environment(input_corpus) + dictionary_path = utils.get_dictionary_path(target_binary) + command = [target_binary] + if dictionary_path: + command += (['-x', dictionary_path]) + command += (['-o', output_corpus, '-i', input_corpus]) + print(command) + subprocess.check_call(command, cwd=os.environ['OUT']) diff --git a/fuzzers/libafl_forkserver/runner.Dockerfile b/fuzzers/libafl_27042023/runner.Dockerfile similarity index 100% rename from fuzzers/libafl_forkserver/runner.Dockerfile rename to fuzzers/libafl_27042023/runner.Dockerfile diff --git a/fuzzers/libafl_forkserver/description.md b/fuzzers/libafl_forkserver/description.md deleted file mode 100644 index 445a27663..000000000 --- a/fuzzers/libafl_forkserver/description.md +++ /dev/null @@ -1,13 +0,0 @@ -# aflplusplus - -AFL++ fuzzer instance that has the following config active for all benchmarks: - - PCGUARD instrumentation - - cmplog feature - - "fast" power schedule - - persistent mode + shared memory test cases - -Repository: [https://github.com/AFLplusplus/AFLplusplus/](https://github.com/AFLplusplus/AFLplusplus/) - -[builder.Dockerfile](builder.Dockerfile) -[fuzzer.py](fuzzer.py) -[runner.Dockerfile](runner.Dockerfile) diff --git a/fuzzers/libafl_forkserver/fuzzer.py b/fuzzers/libafl_forkserver/fuzzer.py deleted file mode 100755 index c8b66976f..000000000 --- a/fuzzers/libafl_forkserver/fuzzer.py +++ /dev/null @@ -1,67 +0,0 @@ -# Copyright 2020 Google LLC -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -"""Integration code for a LibAFL fuzzer with an AFL++ forkserver.""" - -import os -import shutil -import subprocess - -from fuzzers import utils -from fuzzers.aflplusplus import fuzzer as aflplusplus_fuzzer -from fuzzers.libafl import fuzzer as libafl_fuzzer - - -def build(): - """Build benchmark.""" - # Build the target with AFL++ - aflplusplus_fuzzer.build('tracepc', 'cmplog', 'dict2file') - - # Copy to fuzzer to OUT - build_directory = os.environ['OUT'] - fuzzer = '/libafl/fuzzers/fuzzbench_forkserver/' \ - 'target/release/fuzzbench_forkserver' - shutil.copy(fuzzer, build_directory) - - -def fuzz(input_corpus, output_corpus, target_binary): - """Run fuzzer.""" - # Calculate CmpLog binary path from the instrumented target binary. - target_binary_directory = os.path.dirname(target_binary) - cmplog_target_binary_directory = \ - aflplusplus_fuzzer.get_cmplog_build_directory(target_binary_directory) - target_binary_name = os.path.basename(target_binary) - cmplog_target_binary = os.path.join(cmplog_target_binary_directory, - target_binary_name) - - # Setup env vars - libafl_fuzzer.prepare_fuzz_environment(input_corpus) - - # Merge dictionaries - dictionary_path = utils.get_dictionary_path(target_binary) - if os.path.exists('./afl++.dict'): - if dictionary_path: - with open('./afl++.dict', encoding='utf-8') as dictfile: - autodict = dictfile.read() - with open(dictionary_path, 'a', encoding='utf-8') as dictfile: - dictfile.write(autodict) - else: - dictionary_path = './afl++.dict' - - # Run the fuzzer - command = ['./fuzzbench_forkserver', '-c', cmplog_target_binary] - if dictionary_path: - command += (['-x', dictionary_path]) - command += (['-o', output_corpus, '-i', input_corpus, target_binary]) - print(command) - subprocess.check_call(command) diff --git a/service/gcbrun_experiment.py b/service/gcbrun_experiment.py index bbebcf1b9..f19ab493d 100644 --- a/service/gcbrun_experiment.py +++ b/service/gcbrun_experiment.py @@ -28,6 +28,7 @@ TRIGGER_COMMAND = '/gcbrun' RUN_EXPERIMENT_COMMAND_STR = f'{TRIGGER_COMMAND} run_experiment.py ' SKIP_COMMAND_STR = f'{TRIGGER_COMMAND} skip' +# A DUMMY COMMENT def get_comments(pull_request_number):