From nobody Mon Feb 9 04:03:32 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1610373183; cv=none; d=zohomail.com; s=zohoarc; b=LVQQVD23kKWPE0g/0Z+v73Z5oF94czMFwSTJcJsY5OwH+DV0kMHxKTtRxCzix1RFSbftmn0HfpvWWUTY40Qj2jat4MYmnUfFpd9syv+ZS+8jGwVEA9HInYaicOMqlhgPmzdv6b1lMig0Ilr+4AJRw+NqAgLJknsjpKjXRDQwodw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1610373183; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=tpXo9NxnStxZTiwWw1rETdyPzvAR8Hk9md1s67byzNs=; b=awDG6zPyOWfcOiibJcAlZXrUjVj/v1Oh8r8jDW+1dgXRuuaJSaJw8aWI9FgqOedgBm5D2YVvAnUC4yJNXfxEtF+TZkSgM2JCVl6OcjYUXA5QqD3dwget+bF446bibmVesx93w5J0ipnz8TrT2G5PttNlCM7XBA1uMivPs2kxpgY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1610373183725961.4439834586526; Mon, 11 Jan 2021 05:53:03 -0800 (PST) Received: from localhost ([::1]:42884 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kyxbz-0003PM-8j for importer@patchew.org; Mon, 11 Jan 2021 08:51:59 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:52750) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kyxUN-0002j8-KF for qemu-devel@nongnu.org; Mon, 11 Jan 2021 08:44:07 -0500 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:29114) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1kyxUE-00082i-Va for qemu-devel@nongnu.org; Mon, 11 Jan 2021 08:44:07 -0500 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-399-3zid_wITNP6NHd4mnMRIOw-1; Mon, 11 Jan 2021 08:43:49 -0500 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 7AE69107ACF8; Mon, 11 Jan 2021 13:43:48 +0000 (UTC) Received: from thuth.com (ovpn-112-147.ams2.redhat.com [10.36.112.147]) by smtp.corp.redhat.com (Postfix) with ESMTP id 51B0B17C5F; Mon, 11 Jan 2021 13:43:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1610372633; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tpXo9NxnStxZTiwWw1rETdyPzvAR8Hk9md1s67byzNs=; b=ZprC77DCHLp4aznZd/jARBQ2rrD/y5mFcXGeKkwZa0tP9z+K0BGDSuJ/zyAkroXsEHNPYL Xb4IrbLAW7K3PQiXLZGvMBd1NWmOizm8MUWmmeAeK7DzDP1jKd+hFNrBZxanQTeM8R/3D/ /eo1YL7jZwN1oapNdAu7wfHIGLQ4J/8= X-MC-Unique: 3zid_wITNP6NHd4mnMRIOw-1 From: Thomas Huth To: qemu-devel@nongnu.org, Peter Maydell Subject: [PULL 04/15] fuzz: accelerate non-crash detection Date: Mon, 11 Jan 2021 14:43:17 +0100 Message-Id: <20210111134328.157775-5-thuth@redhat.com> In-Reply-To: <20210111134328.157775-1-thuth@redhat.com> References: <20210111134328.157775-1-thuth@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=thuth@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=216.205.24.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -29 X-Spam_score: -3.0 X-Spam_bar: --- X-Spam_report: (-3.0 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.251, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Alexander Bulekov , Warner Losh , Qiuhao Li Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" From: Qiuhao Li We spend much time waiting for the timeout program during the minimization process until it passes a time limit. This patch hacks the CLOSED (indicates the redirection file closed) notification in QTest's output if it doesn't crash. Test with quadrupled trace input at: https://bugs.launchpad.net/qemu/+bug/1890333/comments/1 Original version: real 1m37.246s user 0m13.069s sys 0m8.399s Refined version: real 0m45.904s user 0m16.874s sys 0m10.042s Note: Sometimes the mutated or the same trace may trigger a different crash summary (second-to-last line) but indicates the same bug. For example, Bug 1910826 [1], which will trigger a stack overflow, may output summaries like: SUMMARY: AddressSanitizer: stack-overflow /home/qiuhao/hack/qemu/build/../softmmu/physmem.c:488 in flatview_do_translate or SUMMARY: AddressSanitizer: stack-overflow (/home/qiuhao/hack/qemu/build/qemu-system-i386+0x27ca049) in __asan_memcpy Etc. If we use the whole summary line as the token, we may be prevented from further minimization. So in this patch, we only use the first three words which indicate the type of crash: SUMMARY: AddressSanitizer: stack-overflow [1] https://bugs.launchpad.net/qemu/+bug/1910826 Signed-off-by: Qiuhao Li Reviewed-by: Alexander Bulekov Tested-by: Alexander Bulekov Message-Id: Signed-off-by: Thomas Huth --- scripts/oss-fuzz/minimize_qtest_trace.py | 44 +++++++++++++++++------- 1 file changed, 31 insertions(+), 13 deletions(-) diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/mi= nimize_qtest_trace.py index 5e405a0d5f..a28913a2a7 100755 --- a/scripts/oss-fuzz/minimize_qtest_trace.py +++ b/scripts/oss-fuzz/minimize_qtest_trace.py @@ -29,8 +29,14 @@ whether the crash occred. Optionally, manually set a str= ing that idenitifes the crash by setting CRASH_TOKEN=3D """.format((sys.argv[0]))) =20 +deduplication_note =3D """\n\ +Note: While trimming the input, sometimes the mutated trace triggers a dif= ferent +type crash but indicates the same bug. Under this situation, our minimizer= is +incapable of recognizing and stopped from removing it. In the future, we m= ay +use a more sophisticated crash case deduplication method. +\n""" + def check_if_trace_crashes(trace, path): - global CRASH_TOKEN with open(path, "w") as tracefile: tracefile.write("".join(trace)) =20 @@ -41,18 +47,31 @@ def check_if_trace_crashes(trace, path): trace_path=3Dpath), shell=3DTrue, stdin=3Dsubprocess.PIPE, - stdout=3Dsubprocess.PIPE) - stdo =3D rc.communicate()[0] - output =3D stdo.decode('unicode_escape') - if rc.returncode =3D=3D 137: # Timed Out - return False - if len(output.splitlines()) < 2: - return False - + stdout=3Dsubprocess.PIPE, + encoding=3D"utf-8") + global CRASH_TOKEN if CRASH_TOKEN is None: - CRASH_TOKEN =3D output.splitlines()[-2] - - return CRASH_TOKEN in output + try: + outs, _ =3D rc.communicate(timeout=3D5) + CRASH_TOKEN =3D " ".join(outs.splitlines()[-2].split()[0:3]) + except subprocess.TimeoutExpired: + print("subprocess.TimeoutExpired") + return False + print("Identifying Crashes by this string: {}".format(CRASH_TOKEN)) + global deduplication_note + print(deduplication_note) + return True + + for line in iter(rc.stdout.readline, ""): + if "CLOSED" in line: + return False + if CRASH_TOKEN in line: + return True + + print("\nWarning:") + print(" There is no 'CLOSED'or CRASH_TOKEN in the stdout of subproces= s.") + print(" Usually this indicates a different type of crash.\n") + return False =20 =20 def minimize_trace(inpath, outpath): @@ -66,7 +85,6 @@ def minimize_trace(inpath, outpath): print("Crashed in {} seconds".format(end-start)) TIMEOUT =3D (end-start)*5 print("Setting the timeout for {} seconds".format(TIMEOUT)) - print("Identifying Crashes by this string: {}".format(CRASH_TOKEN)) =20 i =3D 0 newtrace =3D trace[:] --=20 2.27.0