aboutsummaryrefslogtreecommitdiff
path: root/src/runtime/libfuzzer.go
AgeCommit message (Collapse)Author
2022-12-23cmd/link, runtime: use a different section for Go libfuzzer countersCherry Mui
Currently in libfuzzer mode, we put our counters in section __sancov_cntrs. When linking with C/C++ code that also has fuzzer counters, apparently the C linker combines our counters and their counters and registers them together. But in the Go runtime we also have code to register our counters. So the Go counters ended up registered twice, causing problems. Since we already have code to register our counters, put them in a Go-specific section so it won't be combined with the C counters. Fixes #57449. Change-Id: If3d41735124e7e301572d4b7aecf7d057ac134c0 Reviewed-on: https://go-review.googlesource.com/c/go/+/459055 Reviewed-by: Nicolas Hillegeer <aktau@google.com> Reviewed-by: Than McIntosh <thanm@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Cherry Mui <cherryyz@google.com>
2022-10-12all: prevent fakePC overflow on 386 in libfuzzer modeCuong Manh Le
fakePC uses hash.Sum32, which returns an uint32. However, libfuzzer trace/hook functions declare fakePC argument as int, causing overflow on 386 archs. Fixing this by changing fakePC argument to uint to prevent the overflow. Fixes #56141 Change-Id: I3994c461319983ab70065f90bf61539a363e0a2a Reviewed-on: https://go-review.googlesource.com/c/go/+/441996 Auto-Submit: Cuong Manh Le <cuong.manhle.vn@gmail.com> Reviewed-by: Keith Randall <khr@google.com> Run-TryBot: Cuong Manh Le <cuong.manhle.vn@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Matthew Dempsky <mdempsky@google.com>
2022-06-25runtime: mark string comparison hooks as no splitKhaled Yakdan
These functions can be inserted by the compiler into the code to be instrumented. This may result in these functions having callers that are nosplit. That is why they must be nosplit. This is a followup for CL 410034 in order to fix #53190. Change-Id: I03746208a2a302a581a1eaad6c9d0672bb1e949a GitHub-Last-Rev: 6506d86f221d745de083fad862bba7ba04a80455 GitHub-Pull-Request: golang/go#53544 Reviewed-on: https://go-review.googlesource.com/c/go/+/413978 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Keith Randall <khr@golang.org> Reviewed-by: Keith Randall <khr@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
2022-06-10runtime: fix stack split at bad time when fuzzingKhaled Yakdan
Fix #53190 Change-Id: I6c1f9c3ab58818d3a9f05ddaa02fc247e53677d3 GitHub-Last-Rev: 13b0749c135598c97063b07e2b0266125f5da83e GitHub-Pull-Request: golang/go#53191 Reviewed-on: https://go-review.googlesource.com/c/go/+/410034 Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2022-06-08runtime: gofmtMichael Pratt
libfuzzerHookStrCmp is manually reformatted into a proper go doc list. We don't always format testdata, but these test programs are standard Go programs that can be formatted. Change-Id: I4dde398bca225ae8c72e787e4d43fd0ccfd0a90b Reviewed-on: https://go-review.googlesource.com/c/go/+/411114 Auto-Submit: Michael Pratt <mpratt@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Michael Pratt <mpratt@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2022-05-23cmd/compile: support libFuzzer value profiling mode for integer comparesKhaled Yakdan
libFuzzer provides a special mode known as “value profiling” in which it tracks the bit-wise progress made by the fuzzer in satisfying tracked comparisons. Furthermore, libFuzzer uses the value of the return address in its hooks to distinguish the progress for different comparisons. The original implementation of the interception for integer comparisons in Go simply called the libFuzzer hooks from a function written in Go assembly. The libFuzzer hooks thus always see the same return address (i.e., the address of the call instruction in the assembly snippet) and thus can’t distinguish individual comparisons anymore. This drastically reduces the usefulness of value profiling. This is fixed by using an assembly trampoline that injects synthetic but valid return addresses on the stack before calling the libFuzzer hook, otherwise preserving the calling convention of the respective platform (for starters, x86_64 Windows or Unix). These fake PCs are generated deterministically based on the location of the compare instruction in the IR representation. Change-Id: Iea68057c83aea7f9dc226fba7128708e8637d07a GitHub-Last-Rev: f9184baafd507eb4c31f7d99b3894595689d8f89 GitHub-Pull-Request: golang/go#51321 Reviewed-on: https://go-review.googlesource.com/c/go/+/387336 Reviewed-by: Michael Knyszek <mknyszek@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Keith Randall <khr@golang.org> Reviewed-by: Keith Randall <khr@golang.org> Reviewed-by: Keith Randall <khr@google.com>
2022-05-20cmd/compile: intercept string compares in libFuzzer modeKhaled Yakdan
IR string compares as well as calls to string comparison functions such as `strings.EqualFold` are intercepted and the corresponding libFuzzer callbacks are invoked with the corresponding arguments. As a result, the compared strings will be added to libFuzzer’s table of recent compares, which feeds future mutations performed by the fuzzer and thus allow it to reach into branches guarded by string comparisons. The list of methods to intercept is maintained in `cmd/compile/internal/walk/expr.go` and can easily be extended to cover more standard library functions in the future. Change-Id: I5c8b89499c4e19459406795dea923bf777779c51 GitHub-Last-Rev: 6b8529b55561faf57ea59cb7cff1caf8c9c94ecd GitHub-Pull-Request: golang/go#51319 Reviewed-on: https://go-review.googlesource.com/c/go/+/387335 Reviewed-by: Keith Randall <khr@golang.org> Reviewed-by: Michael Knyszek <mknyszek@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Keith Randall <khr@google.com> Run-TryBot: Keith Randall <khr@golang.org>
2022-05-20cmd/compile, cmd/link: use libFuzzer 8-bit instead of extra countersKhaled Yakdan
By using libFuzzer’s 8-bit counters instead of extra counters, the coverage instrumentation in libFuzzer mode is improved in three ways: 1- 8-bit counters are supported on all platforms, including macOS and Windows, with all relevant versions of libFuzzer, whereas extra counters are a Linux-only feature that only recently received support on Windows. 2- Newly covered blocks are now properly reported as new coverage by libFuzzer, not only as new features. 3- The NeverZero strategy is used to ensure that coverage counters never become 0 again after having been positive once. This resolves issues encountered when fuzzing loops with iteration counts that are multiples of 256 (e.g., larger powers of two). Change-Id: I9021210d7fbffd07c891ad08750402ee91cb3df5 GitHub-Last-Rev: 9057e4b21d146ce9ffb3993982bfb84b96705989 GitHub-Pull-Request: golang/go#51318 Reviewed-on: https://go-review.googlesource.com/c/go/+/387334 Reviewed-by: Keith Randall <khr@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Keith Randall <khr@golang.org>
2021-10-28all: go fix -fix=buildtag std cmd (except for bootstrap deps, vendor)Russ Cox
When these packages are released as part of Go 1.18, Go 1.16 will no longer be supported, so we can remove the +build tags in these files. Ran go fix -fix=buildtag std cmd and then reverted the bootstrapDirs as defined in src/cmd/dist/buildtool.go, which need to continue to build with Go 1.4 for now. Also reverted src/vendor and src/cmd/vendor, which will need to be updated in their own repos first. Manual changes in runtime/pprof/mprof_test.go to adjust line numbers. For #41184. Change-Id: Ic0f93f7091295b6abc76ed5cd6e6746e1280861e Reviewed-on: https://go-review.googlesource.com/c/go/+/344955 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2021-02-20all: go fmt std cmd (but revert vendor)Russ Cox
Make all our package sources use Go 1.17 gofmt format (adding //go:build lines). Part of //go:build change (#41184). See https://golang.org/design/draft-gobuild Change-Id: Ia0534360e4957e58cd9a18429c39d0e32a6addb4 Reviewed-on: https://go-review.googlesource.com/c/go/+/294430 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2019-11-05cmd/compile, runtime: add comparison tracing for libFuzzerMatthew Dempsky
This CL extends cmd/compile's experimental libFuzzer support with calls to __sanitizer_cov_trace_{,const_}cmp{1,2,4,8}. This allows much more efficient fuzzing of comparisons. Only supports amd64 and arm64 for now. Updates #14565. Change-Id: Ibf82a8d9658f2bc50d955bdb1ae26723a3f0584d Reviewed-on: https://go-review.googlesource.com/c/go/+/203887 Run-TryBot: Matthew Dempsky <mdempsky@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Keith Randall <khr@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-16 23:28:05 +0000