With --enable-fuzzing, QEMU_CFLAGS include -fsanitize=fuzzer-no-link.
This should allow us to build non-fuzzer binaries using objects
instrumented for fuzzing. However, to do that, we also need to link with
-fsanitize=fuzzer-no-link. We were not doing that.
Reported-by: Li Qiang <liq3ea@163.com>,
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
---
v2: Fix a mistake in the added QEMU_LDFLAGS line
configure | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/configure b/configure
index a79b3746d4..19f2b88589 100755
--- a/configure
+++ b/configure
@@ -6096,7 +6096,17 @@ if test "$fuzzing" = "yes" ; then
# If LIB_FUZZING_ENGINE is set, assume we are running on OSS-Fuzz, and the
# needed CFLAGS have already been provided
if test -z "${LIB_FUZZING_ENGINE+xxx}" ; then
+ # Add CFLAGS to tell clang to add fuzzer-related instrumentation to all the
+ # compiled code.
QEMU_CFLAGS="$QEMU_CFLAGS -fsanitize=fuzzer-no-link"
+ # To build non-fuzzer binaries with --enable-fuzzing, link everything with
+ # fsanitize=fuzzer-no-link. Otherwise, the linker will be unable to bind
+ # the fuzzer-related callbacks added by instrumentation.
+ QEMU_LDFLAGS="$QEMU_LDFLAGS -fsanitize=fuzzer-no-link"
+ # For the actual fuzzer binaries, we need to link against the libfuzzer
+ # library. Provide the flags for doing this in FUZZ_EXE_LDFLAGS. The meson
+ # rule for the fuzzer adds these to the link_args. They need to be
+ # configurable, to support OSS-Fuzz
FUZZ_EXE_LDFLAGS="-fsanitize=fuzzer"
else
FUZZ_EXE_LDFLAGS="$LIB_FUZZING_ENGINE"
--
2.27.0
On 21/02/2021 18.45, Alexander Bulekov wrote:
> With --enable-fuzzing, QEMU_CFLAGS include -fsanitize=fuzzer-no-link.
> This should allow us to build non-fuzzer binaries using objects
> instrumented for fuzzing. However, to do that, we also need to link with
> -fsanitize=fuzzer-no-link. We were not doing that.
>
> Reported-by: Li Qiang <liq3ea@163.com>,
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> v2: Fix a mistake in the added QEMU_LDFLAGS line
>
> configure | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/configure b/configure
> index a79b3746d4..19f2b88589 100755
> --- a/configure
> +++ b/configure
> @@ -6096,7 +6096,17 @@ if test "$fuzzing" = "yes" ; then
> # If LIB_FUZZING_ENGINE is set, assume we are running on OSS-Fuzz, and the
> # needed CFLAGS have already been provided
> if test -z "${LIB_FUZZING_ENGINE+xxx}" ; then
> + # Add CFLAGS to tell clang to add fuzzer-related instrumentation to all the
> + # compiled code.
> QEMU_CFLAGS="$QEMU_CFLAGS -fsanitize=fuzzer-no-link"
> + # To build non-fuzzer binaries with --enable-fuzzing, link everything with
> + # fsanitize=fuzzer-no-link. Otherwise, the linker will be unable to bind
> + # the fuzzer-related callbacks added by instrumentation.
> + QEMU_LDFLAGS="$QEMU_LDFLAGS -fsanitize=fuzzer-no-link"
> + # For the actual fuzzer binaries, we need to link against the libfuzzer
> + # library. Provide the flags for doing this in FUZZ_EXE_LDFLAGS. The meson
> + # rule for the fuzzer adds these to the link_args. They need to be
> + # configurable, to support OSS-Fuzz
> FUZZ_EXE_LDFLAGS="-fsanitize=fuzzer"
> else
> FUZZ_EXE_LDFLAGS="$LIB_FUZZING_ENGINE"
>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Alexander Bulekov <alxndr@bu.edu> 于2021年2月22日周一 上午1:48写道:
>
> With --enable-fuzzing, QEMU_CFLAGS include -fsanitize=fuzzer-no-link.
> This should allow us to build non-fuzzer binaries using objects
> instrumented for fuzzing. However, to do that, we also need to link with
> -fsanitize=fuzzer-no-link. We were not doing that.
>
> Reported-by: Li Qiang <liq3ea@163.com>,
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Tested-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
> ---
> v2: Fix a mistake in the added QEMU_LDFLAGS line
>
> configure | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/configure b/configure
> index a79b3746d4..19f2b88589 100755
> --- a/configure
> +++ b/configure
> @@ -6096,7 +6096,17 @@ if test "$fuzzing" = "yes" ; then
> # If LIB_FUZZING_ENGINE is set, assume we are running on OSS-Fuzz, and the
> # needed CFLAGS have already been provided
> if test -z "${LIB_FUZZING_ENGINE+xxx}" ; then
> + # Add CFLAGS to tell clang to add fuzzer-related instrumentation to all the
> + # compiled code.
> QEMU_CFLAGS="$QEMU_CFLAGS -fsanitize=fuzzer-no-link"
> + # To build non-fuzzer binaries with --enable-fuzzing, link everything with
> + # fsanitize=fuzzer-no-link. Otherwise, the linker will be unable to bind
> + # the fuzzer-related callbacks added by instrumentation.
> + QEMU_LDFLAGS="$QEMU_LDFLAGS -fsanitize=fuzzer-no-link"
> + # For the actual fuzzer binaries, we need to link against the libfuzzer
> + # library. Provide the flags for doing this in FUZZ_EXE_LDFLAGS. The meson
> + # rule for the fuzzer adds these to the link_args. They need to be
> + # configurable, to support OSS-Fuzz
> FUZZ_EXE_LDFLAGS="-fsanitize=fuzzer"
> else
> FUZZ_EXE_LDFLAGS="$LIB_FUZZING_ENGINE"
> --
> 2.27.0
>
>
On 21/02/21 18:45, Alexander Bulekov wrote:
> With --enable-fuzzing, QEMU_CFLAGS include -fsanitize=fuzzer-no-link.
> This should allow us to build non-fuzzer binaries using objects
> instrumented for fuzzing. However, to do that, we also need to link with
> -fsanitize=fuzzer-no-link. We were not doing that.
>
> Reported-by: Li Qiang <liq3ea@163.com>,
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> v2: Fix a mistake in the added QEMU_LDFLAGS line
>
> configure | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/configure b/configure
> index a79b3746d4..19f2b88589 100755
> --- a/configure
> +++ b/configure
> @@ -6096,7 +6096,17 @@ if test "$fuzzing" = "yes" ; then
> # If LIB_FUZZING_ENGINE is set, assume we are running on OSS-Fuzz, and the
> # needed CFLAGS have already been provided
> if test -z "${LIB_FUZZING_ENGINE+xxx}" ; then
> + # Add CFLAGS to tell clang to add fuzzer-related instrumentation to all the
> + # compiled code.
> QEMU_CFLAGS="$QEMU_CFLAGS -fsanitize=fuzzer-no-link"
> + # To build non-fuzzer binaries with --enable-fuzzing, link everything with
> + # fsanitize=fuzzer-no-link. Otherwise, the linker will be unable to bind
> + # the fuzzer-related callbacks added by instrumentation.
> + QEMU_LDFLAGS="$QEMU_LDFLAGS -fsanitize=fuzzer-no-link"
> + # For the actual fuzzer binaries, we need to link against the libfuzzer
> + # library. Provide the flags for doing this in FUZZ_EXE_LDFLAGS. The meson
> + # rule for the fuzzer adds these to the link_args. They need to be
> + # configurable, to support OSS-Fuzz
> FUZZ_EXE_LDFLAGS="-fsanitize=fuzzer"
> else
> FUZZ_EXE_LDFLAGS="$LIB_FUZZING_ENGINE"
>
Queued, thanks.
Paolo
© 2016 - 2026 Red Hat, Inc.