FuzzerFork.cpp

//===- FuzzerFork.cpp - run fuzzing in separate subprocesses --------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
// Spawn an orchestrate separate fuzzing processes.
//===----------------------------------------------------------------------===//

#include "FuzzerCommand.h"
#include "FuzzerFork.h"
#include "FuzzerIO.h"
#include "FuzzerMerge.h"
#include "FuzzerSHA1.h"
#include "FuzzerUtil.h"

namespace fuzzer {

// This is just a skeleton of an experimental -fork=1 feature.
void FuzzWithFork(Random &Rand, const FuzzingOptions &Options,
                  const Vector<std::string> &Args,
                  const Vector<std::string> &CorpusDirs) {
  Printf("INFO: -fork=1: doing fuzzing in a separate process in order to "
         "be more resistant to crashes, timeouts, and OOMs\n");

  Vector<SizedFile> SeedFiles;
  for (auto &Dir : CorpusDirs)
    GetSizedFilesFromDir(Dir, &SeedFiles);
  std::sort(SeedFiles.begin(), SeedFiles.end());
  auto CFPath = TempPath(".fork");
  auto LogPath = TempPath(".log");
  auto TempDir = TempPath(".scratch_dir");
  std::string MainCorpusDir;
  if (CorpusDirs.empty())
    MkDir(MainCorpusDir = TempPath(".corpus_dir"));
  else
    MainCorpusDir = CorpusDirs[0];
  MkDir(TempDir);

  Vector<std::string> Files;
  Set<uint32_t> Features;
  if (!SeedFiles.empty()) {
    CrashResistantMerge(Args, {}, SeedFiles, &Files, {}, &Features, CFPath,
                        false);
    RemoveFile(CFPath);
  }
  Printf("INFO: -fork=1: %zd seeds, starting to fuzz; scratch: %s\n",
         Files.size(), TempDir.c_str());

  Command BaseCmd(Args);
  BaseCmd.removeFlag("fork");
  for (auto &C : CorpusDirs) // Remove all corpora from the args.
    BaseCmd.removeArgument(C);
  BaseCmd.addArgument(TempDir);
  BaseCmd.addFlag("len_control", "0");  // len_control is bad for short runs.
  BaseCmd.addFlag("reload", "0");  // working in an isolated dir, no reload.
  int ExitCode = 0;
  int max_total_time = 1;
  for (size_t i = 0; i < 1000000; i++) {
    // TODO: take new files from disk e.g. those generated by another process.
    Command Cmd(BaseCmd);
    if (size_t CorpusSubsetSize = std::min(Files.size(), (size_t)10)) {
      std::string Seeds;
      for (size_t i = 0; i < CorpusSubsetSize; i++) {
        if (i) Seeds += ",";
        Seeds += Files[Rand.SkewTowardsLast(Files.size())];
      }
      Cmd.addFlag("seed_inputs", Seeds);
    }
    if (Options.MaxTotalTimeSec > max_total_time)
      max_total_time++;
    if (!Cmd.hasFlag("max_total_time"))
      Cmd.addFlag("max_total_time", std::to_string(max_total_time));
    Cmd.setOutputFile(LogPath);
    Cmd.combineOutAndErr();
    RmFilesInDir(TempDir);
    ExitCode = ExecuteCommand(Cmd);
    // Printf("done [%d] %s\n", ExitCode, Cmd.toString().c_str());
    if (ExitCode == Options.InterruptExitCode)
      break;
    Vector<SizedFile> TempFiles;
    Vector<std::string>FilesToAdd;
    Set<uint32_t> NewFeatures;
    GetSizedFilesFromDir(TempDir, &TempFiles);
    if (!TempFiles.empty())
      CrashResistantMerge(Args, {}, TempFiles, &FilesToAdd, Features,
                          &NewFeatures, CFPath, false);
    RemoveFile(CFPath);
    for (auto &Path : FilesToAdd) {
      auto U = FileToVector(Path);
      auto NewPath = DirPlusFile(MainCorpusDir, Hash(U));
      WriteToFile(U, NewPath);
      Files.push_back(NewPath);
    }
    Features.insert(NewFeatures.begin(), NewFeatures.end());
    Printf("INFO: temp_files: %zd files_added: %zd newft: %zd ft: %zd\n",
           TempFiles.size(), FilesToAdd.size(), NewFeatures.size(),
           Features.size());
    // Continue if our crash is one of the ignorred ones.
    if (Options.IgnoreTimeouts && ExitCode == Options.TimeoutExitCode)
      continue;
    if (Options.IgnoreOOMs && ExitCode == Options.OOMExitCode)
      continue;
    // And exit if we don't ignore this crash.
    if (ExitCode != 0) {
      Printf("INFO: log from the inner process:\n%s",
             FileToString(LogPath).c_str());
      break;
    }
  }

  RmFilesInDir(TempDir);
  RmDir(TempDir);

  if (CorpusDirs.empty()) {
    RmFilesInDir(MainCorpusDir);
    RmDir(MainCorpusDir);
  }

  // Use the exit code from the last child process.
  Printf("Fork: exiting: %d\n", ExitCode);
  exit(ExitCode);
}

} // namespace fuzzer