Skip to content

Conversation

fjahr
Copy link
Contributor

@fjahr fjahr commented Jan 16, 2020

Adds several helpful hints for macOS users trying to get fuzzers to run locally using AFL or libFuzzer. These are partly based on this comment #17657 (comment) and discussions in the review club for #17860. See: https://bitcoincore.reviews/17860.html

Based on the doc in the current state I could not compile fuzzers for AFL or libFuzzer. Using these hints, I can

  • compile and run fuzzers with AFL
  • compile but not run fuzzers with libFuzzer

Fuzzers compiled with libFuzzers may be running but don't produce any output. Looking for others to test this to see if it is an issue with my local system. Especially interesting if you have been running libFuzzer fuzzers successfully on macOS before.

Edit: Closes #17914

@DrahtBot DrahtBot added the Docs label Jan 16, 2020
@laanwj laanwj added the macOS label Jan 16, 2020
@maflcko
Copy link
Member

maflcko commented Jan 16, 2020

Thanks. Much needed!

Copy link
Member

@fanquake fanquake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Concept ACK

doc/fuzzing.md Outdated
fuzzing libraries, so macOS users will need to install a full version, for
example using `brew install llvm`.

When executing ./configure you should put --disable-asm to avoid errors
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What errors are you seeing with the asm? Can you post logs?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, I am sure I had an issue without it before but I can not reproduce it right now and I did not keep the logs since I tried libFuzzer one week ago. So it is possible that it is not an issue anymore or I simply mistook this as fixing an unrelated issue. However, the issue is also noted in the docs on sanitizers: https://github.com/bitcoin/bitcoin/blob/master/doc/developer-notes.md#sanitizers

@jonasschnelli
Copy link
Contributor

Thanks!
utACK 76f589d

@fjahr
Copy link
Contributor Author

fjahr commented Jan 23, 2020

Updated to include feedback by @eriknylund and @fanquake .

@fjahr
Copy link
Contributor Author

fjahr commented Jan 28, 2020

With the fix in #18008 the fuzzers compiled with libFuzzer run for me now. I did not need to specify the system path or --disable-asm. After looking at some of the build code I agree with @fanquake that the system path should not be necessary in any case, so I removed it. But I left --disable-asm and linked to the mention of the problem in the developer notes. I also made some minor editing changes.

Copy link
Member

@fanquake fanquake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for following up again. This is looking pretty good now 👍.

Copy link
Member

@Sjors Sjors left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was able to follow along with the AFL instructions.

Copy link
Member

@Sjors Sjors left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I'm also able to run with libFuzzer (with #18008).

Copy link
Member

@Sjors Sjors left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK b6c3e84

Nit: maybe add qa-assets/ to .gitignore

From the other thread, @fanquake wrote:

With this branch it just exits after Fuzz targets selected: ['bech32']

@Sjors It doesn't just exit, the bech32 fuzzer is run. However the log level defaults to INFO, which doesn't generate any output. Pass -l DEBUG and you'll see:

I'm a bit surprised by how fast it completes.

make
```

If you are using clang you will need to substitute `afl-gcc` with `afl-clang`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: using clang, e.g. on macOS, you will

Copy link
Member

@fanquake fanquake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK b6c3e84 - I think this has been nitpicked enough, and importantly the commands look better now.

@maflcko
Copy link
Member

maflcko commented Jan 29, 2020

ACK b6c3e84

maflcko pushed a commit that referenced this pull request Jan 29, 2020
b6c3e84 doc: Improve fuzzing docs for macOS users (Fabian Jahr)

Pull request description:

  Adds several helpful hints for macOS users trying to get fuzzers to run locally using AFL or libFuzzer. These are partly based on this comment #17657 (comment) and discussions in the review club for #17860. See: https://bitcoincore.reviews/17860.html

  Based on the doc in the current state I could not compile fuzzers for AFL or libFuzzer. Using these hints, I can
  - compile and run fuzzers with AFL
  - compile but **not** run fuzzers with libFuzzer

  Fuzzers compiled with libFuzzers may be running but don't produce any output. Looking for others to test this to see if it is an issue with my local system. Especially interesting if you have been running libFuzzer fuzzers successfully on macOS before.

  Edit: Closes #17914

ACKs for top commit:
  MarcoFalke:
    ACK b6c3e84
  Sjors:
    ACK b6c3e84
  fanquake:
    ACK b6c3e84 - I think this has been nitpicked enough, and importantly the commands look better now.

Tree-SHA512: fdbacbcf10e9353a4ac3d22edf88663e33185ad2f244b986ff74c513de05f9fa62c4d8b17985d2f9288834c124b352cf52280627b5ff095735b411b12482e2ec
@maflcko maflcko merged commit b6c3e84 into bitcoin:master Jan 29, 2020
Fabcien pushed a commit to Bitcoin-ABC/bitcoin-abc that referenced this pull request Jan 19, 2021
Summary:
This makes it possible to build with libfuzzer on macOS ([[bitcoin/bitcoin#18008 | PR18008]]), fix
the issue that this PR introduced for other platforms ([[bitcoin/bitcoin#19366 | PR19366]]) and add
the corresponding documentation ([[bitcoin/bitcoin#17942 | PR17942]]).

This is a backport of core [[bitcoin/bitcoin#17942 | PR17942]], [[bitcoin/bitcoin#18008 | PR18008]] and [[bitcoin/bitcoin#19366 | PR19366]].

Test Plan:
On macOS, read the documentation and follow the instructions.
I only ran the instructions for libfuzzer.

  ninja bitcoin-fuzzers
  ./test/fuzz/test_runner.py <path_to_corpus>

Reviewers: #bitcoin_abc, PiRK

Reviewed By: #bitcoin_abc, PiRK

Differential Revision: https://reviews.bitcoinabc.org/D8956
random-zebra added a commit to PIVX-Project/PIVX that referenced this pull request May 28, 2021
d059544 [Build] fuzz target, change LIBBITCOIN_ZEROCOIN link order. (furszy)
2396e6b [fuzz] Add ContextualCheckTransaction call to transaction target. (furszy)
f0887a0 Fuzzing documentation "PIVX-fication" (furszy)
9631f46 [doc] add sanitizers documentation in developer-notes.md (furszy)
70a0ace tests: Test serialisation as part of deserialisation fuzzing. Test round-trip equality where possible. Avoid code repetition. (practicalswift)
e1b92b6 ignore new fuzz targets gitignore (furszy)
d058d8c tests: Add deserialization fuzzing harnesses (furszy)
e1f666c tests: Remove TRANSACTION_DESERIALIZE (replaced by transaction fuzzer) (practicalswift)
b5f291c tests: Add fuzzing harness for CheckTransaction(...), IsStandardTx(...) and other CTransaction related functions (furszy)
3205871 fuzz: Remove option --export_coverage from test_runner (MarcoFalke)
52693ee fuzz: Add option to merge input dir to test runner (MarcoFalke)
2b4f8aa doc: Remove --disable-ccache from docs (MarcoFalke)
b54b1d6 tests: Improve test runner output in case of target errors (practicalswift)
cd6134f test: Log output even if fuzzer failed (MarcoFalke)
48cd0c8 doc: Improve fuzzing docs for macOS users (Fabian Jahr)
d642b67 [Build] Do not disable wallet when fuzz is enabled. (furszy)
c3447b5 Update doc and CI config (qmma)
1266d3e Disable other targets when enable-fuzz is set (qmma)
f28ac9a build: Allow to configure --with-sanitizers=fuzzer (MarcoFalke)
425742c fuzz: test_runner: Better error message when built with afl (MarcoFalke)
541f442 qa: Add test/fuzz/test_runner.py (MarcoFalke)
89fe5b2 Add missing LIBBITCOIN_ZMQ to test target (furszy)
58dbe79 add fuzzing binaries to gitignore. (furszy)
393a126 fuzz: Move deserialize tests to test/fuzz/deserialize.cpp (MarcoFalke)
a568df5 test: Build fuzz targets into separate executables (furszy)
d5dddde [test] fuzz: make test_one_input return void (MarcoFalke)
2e4ec58 [fuzzing] initialize chain params by default. (furszy)
08d8ebe [tests] Add libFuzzer support. (practicalswift)
84f72da [test] Speed up fuzzing by ~200x when using afl-fuzz (practicalswift)
faf2be6 Init ECC context for test_bitcoin_fuzzy. (Gregory Maxwell)
11150df Make fuzzer actually test CTxOutCompressor (Pieter Wuille)
d6f6a85 doc: Add bare-bones documentation for fuzzing (Wladimir J. van der Laan)
5c3b550 Simple fuzzing framework (pstratem)

Pull request description:

  As the title says, adding fuzzing framework support so we can start getting serious on this area as well.

  Adapted the following PRs:

  * bitcoin#9172.
  * bitcoin#9354.
  * bitcoin#9691.
  * bitcoin#10415.
  * bitcoin#10440.
  * bitcoin#15043.
  * bitcoin#15047.
  * bitcoin#15295.
  * bitcoin#15399 (fabcfa5 only).
  * bitcoin#16338.
  * bitcoin#17051.
  * bitcoin#17076.
  * bitcoin#17225.
  * bitcoin#17942.
  * bitcoin#16236 (only fa35c42).
  * bitcoin#18166 (only f2472f6).
  * bitcoin#18300.
  * And.. probably will go further and continue adapting more PRs..

ACKs for top commit:
  random-zebra:
    utACK d059544 and merging...

Tree-SHA512: c0b05bca47bf99bafd8abf1453c5636fe05df75f16d0e9c750368ea2aed8142f0b28d28af1d23468b8829188412a80fd3b7bdbbda294b940d78aec80c1c7d03a
kwvg added a commit to kwvg/dash that referenced this pull request Aug 2, 2021
kwvg added a commit to kwvg/dash that referenced this pull request Aug 5, 2021
kwvg added a commit to kwvg/dash that referenced this pull request Aug 5, 2021
kwvg added a commit to kwvg/dash that referenced this pull request Aug 5, 2021
PastaPastaPasta pushed a commit to PastaPastaPasta/dash that referenced this pull request Aug 6, 2021
kwvg added a commit to kwvg/dash that referenced this pull request Aug 8, 2021
kwvg added a commit to kwvg/dash that referenced this pull request Aug 11, 2021
5tefan pushed a commit to 5tefan/dash that referenced this pull request Aug 12, 2021
@bitcoin bitcoin locked as resolved and limited conversation to collaborators Feb 15, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

docs/fuzzing.md: mention that afl-clang(++) may be needed for MacOS builds
9 participants