[libFuzzer] Add experimental feature to not use AFL's deferred forkserver.

[metzman]

Summary

A small but substantial minority of libFuzzer-based fuzzers run code that does not play well with fork in global constructors or LLVMFuzzerInitialize.
This patch allows these fuzzers to use afl_driver by allowing them to opt-out of using AFL's deferred forkserver which deferres calling fork until after this code.

[morehouse]

Won't this cause LLVMFuzzerInitialize to run every time AFL tries an input?

[metzman]

• Don't manually init the forkserver if we are not using the deferred one.

[metzman]

In D45744#1070497, @morehouse wrote:

Won't this cause LLVMFuzzerInitialize to run every time AFL tries an input?

I don't think so. What makes you think this?
My understanding is that every time AFL tries a new input, lines 350-376 are executed, nothing here is really changed by this commit.

[morehouse]

Oh, I see. It still looks like the process is only forked every 1000 inputs by default. So LLVMFuzzerInitialize will only run every 1000 inputs, or less if a higher N is specified on the command line.

This patch seems reasonable to me, but let Kostya comment on it.

If the Chromium fuzzers are currently using the default N, you may want to bump it up so you're not calling LLVMFuzzerInitialize multiple times a second.

[metzman]

In D45744#1071100, @morehouse wrote:

Oh, I see. It still looks like the process is only forked every 1000 inputs by default. So LLVMFuzzerInitialize will only run every 1000 inputs, or less if a higher N is specified on the command line.

Right (unless the process is restarted because it OOMs or times out).

This patch seems reasonable to me, but let Kostya comment on it.

If the Chromium fuzzers are currently using the default N, you may want to bump it up so you're not calling LLVMFuzzerInitialize multiple times a second.

This makes sense. But I don't think it is necessary since, as you said N can be specified on the command line (we do this on ClusterFuzz so it isn't useful for me personally).

[kcc]

is this testable?

[metzman]

I don't believe it is without AFL.

[kcc]

LGTM

lib/fuzzer/afl/afl_driver.cpp

 // Variables we need for writing to the extra stats file.
 static FILE *extra_stats_file = NULL;
 static uint32_t previous_peak_rss = 0;
 static time_t slowest_unit_time_secs = 0;
 static const int kNumExtraStats = 2;
 static const char *kExtraStatsFormatString = "peak_rss_mb            : %u\n"
                                              "slowest_unit_time_sec  : %u\n";
 
+// Experimental feature to use afl_driver without AFL's deferred mode.
+// Needs to run before __afl_auto_init.
+__attribute__((constructor(0))) void __decide_deferred_forkserver(void) {
+  if (getenv("AFL_DRIVER_DONT_DEFER")) {
+    if (unsetenv("__AFL_DEFER_FORKSRV")) {
+      perror("Failed to unset __AFL_DEFER_FORKSRV");
+      abort();
+    }
+  }
+}
+
 // Copied from FuzzerUtil.cpp.
 size_t GetPeakRSSMb() {
   struct rusage usage;
   if (getrusage(RUSAGE_SELF, &usage))
     return 0;
   if (LIBFUZZER_LINUX || LIBFUZZER_NETBSD || LIBFUZZER_FREEBSD ||
       LIBFUZZER_OPENBSD) {
     // ru_maxrss is in KiB