Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

internal/fuzz: ensure coordinator can reconstruct input during minimization #48165

Closed
jayconrod opened this issue Sep 2, 2021 · 2 comments
Closed
Labels
FrozenDueToAge fuzz Issues related to native fuzzing support NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. release-blocker
Milestone

Comments

@jayconrod
Copy link
Contributor

Currently, I think there's a scenario where the fuzzing engine finds a value that causes a crash but can't reconstruct or record it.

  1. Worker finds a random mutation that expands coverage.
  2. Worker sends that entry back to the coordinator.
  3. Coordinator confirms entry expands coverage and sends it back to a worker for minimization.
  4. During minimization, worker terminates unexpectedly.

During normal fuzzing, if a worker terminates unexpectedly, the coordinator can reconstruct the entry that caused the crash using the initial entry and the execution count and PRNG state in shared memory. That process is deterministic.

That won't work during minimization since the worker makes many small decisions along the way. For example, after removing a byte from a string, the worker might proceed with the shorter string or revert the change depending on whether the shorter string triggered the same coverage.

One possible solution is to log these minimization decisions in shared memory so the coordinator can reconstruct the minimized input after a crash.

@jayconrod jayconrod added NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. fuzz Issues related to native fuzzing support labels Sep 2, 2021
@jayconrod jayconrod added this to the Go1.18 milestone Sep 2, 2021
@jayconrod jayconrod self-assigned this Sep 15, 2021
@rsc rsc changed the title [dev.fuzz] internal/fuzz: ensure coordinator can reconstruct input during minimization internal/fuzz: ensure coordinator can reconstruct input during minimization Sep 21, 2021
@toothrot
Copy link
Contributor

Checking in on this issue as it's labeled a release blocker for Go 1.18. Is there any update?

@jayconrod
Copy link
Contributor Author

Closing as duplicate of #48165.

@golang golang locked and limited conversation to collaborators Jun 23, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge fuzz Issues related to native fuzzing support NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. release-blocker
Projects
Status: No status
Development

No branches or pull requests

4 participants