Add remote flags and external functions

[aarongreen]

Summary

This change modifies FuzzerFlags.def and FuzzerExtFunctions.def to specify the command-line flag and optional library functions that can be provided to enable cross-process support.

The external functions will be provided by a platform-specific IPC library.

this is change 15 of (at least) 20 for cross-process fuzzing support.

[aarongreen]

Rebase

[morehouse]

LGTM

[aarongreen]

Multiprocess fuzzing will not be supported by the libFuzzer maintainers. Fuchsia has implemented a new approach with their Component Fuzzing Framework (RFC-117).

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

int FuzzerDriver(int *argc, char ***argv, UserCallback Callback) {
   Options.LenControl = Flags.len_control;
   Options.KeepSeed = Flags.keep_seed;
   Options.UnitTimeoutSec = Flags.timeout;
   Options.ErrorExitCode = Flags.error_exitcode;
   Options.TimeoutExitCode = Flags.timeout_exitcode;
   Options.IgnoreTimeouts = Flags.ignore_timeouts;
   Options.IgnoreOOMs = Flags.ignore_ooms;
   Options.IgnoreCrashes = Flags.ignore_crashes;
+  Options.IgnoreRemoteExits = Flags.ignore_remote_exits;
   Options.MaxTotalTimeSec = Flags.max_total_time;
   Options.DoCrossOver = Flags.cross_over;
   Options.CrossOverUniformDist = Flags.cross_over_uniform_dist;
   Options.MutateDepth = Flags.mutate_depth;
   Options.ReduceDepth = Flags.reduce_depth;
   Options.UseCounters = Flags.use_counters;
   Options.UseMemmem = Flags.use_memmem;
   Options.UseCmp = Flags.use_cmp;
   Options.UseValueProfile = Flags.use_value_profile;
+  Options.UseRemote = Flags.remote;
   Options.Shrink = Flags.shrink;
   Options.ReduceInputs = Flags.reduce_inputs;
   Options.ShuffleAtStartUp = Flags.shuffle;
   Options.PreferSmall = Flags.prefer_small;
   Options.ReloadIntervalSec = Flags.reload;
   Options.OnlyASCII = Flags.only_ascii;
   Options.DetectLeaks = Flags.detect_leaks;
   Options.PurgeAllocatorIntervalSec = Flags.purge_allocator_interval;

compiler-rt/lib/fuzzer/FuzzerExtFunctions.def

EXT_FUNC(LLVMFuzzerCustomCrossOver, size_t,
          (const uint8_t *Data1, size_t Size1,
           const uint8_t *Data2, size_t Size2,
           uint8_t *Out, size_t MaxOutSize, unsigned int Seed),
          false);
 
 // Sanitizer functions
 EXT_FUNC(__lsan_enable, void, (), false);
 EXT_FUNC(__lsan_disable, void, (), false);
+EXT_FUNC(__lsan_do_leak_check, void, (), false);
 EXT_FUNC(__lsan_do_recoverable_leak_check, int, (), false);
 EXT_FUNC(__sanitizer_acquire_crash_state, int, (), true);
 EXT_FUNC(__sanitizer_install_malloc_and_free_hooks, int,
          (void (*malloc_hook)(const volatile void *, size_t),
           void (*free_hook)(const volatile void *)),
          false);
 EXT_FUNC(__sanitizer_log_write, void, (const char *buf, size_t len), false);
 EXT_FUNC(__sanitizer_purge_allocator, void, (), false);
 EXT_FUNC(__sanitizer_print_memory_profile, void, (size_t, size_t), false);
 EXT_FUNC(__sanitizer_print_stack_trace, void, (), true);
 EXT_FUNC(__sanitizer_symbolize_pc, void,
          (void *, const char *fmt, char *out_buf, size_t out_buf_size), false);
 EXT_FUNC(__sanitizer_get_module_and_offset_for_pc, int,
          (void *pc, char *module_path,
          size_t module_path_len,void **pc_offset), false);
 EXT_FUNC(__sanitizer_set_death_callback, void, (void (*)(void)), true);
 EXT_FUNC(__sanitizer_set_report_fd, void, (void*), false);
 EXT_FUNC(__msan_scoped_disable_interceptor_checks, void, (), false);
 EXT_FUNC(__msan_scoped_enable_interceptor_checks, void, (), false);
 EXT_FUNC(__msan_unpoison, void, (const volatile void *, size_t size), false);
 EXT_FUNC(__msan_unpoison_param, void, (size_t n), false);
+
+// IPC functions
+EXT_FUNC(FuzzerAcceptRemotes, void, (), false);
+EXT_FUNC(FuzzerShutdownRemotes, void, (), false);
+EXT_FUNC(FuzzerRemoteStartExecution, void, (unsigned long, uint32_t), false);
+EXT_FUNC(FuzzerRemoteFinishExecution, void, (unsigned long), false);
+EXT_FUNC(FuzzerRemotePrintPC, void, (unsigned long, const char *, const char *, uintptr_t), false);
+EXT_FUNC(FuzzerRemoteDescribePC, void, (unsigned long, const char *, uintptr_t, char *, size_t), false);
+EXT_FUNC(FuzzerRemotePrintStackTrace, void, (unsigned long), false);
+EXT_FUNC(FuzzerRemotePrintMemoryProfile, void, (unsigned long), false);
+EXT_FUNC(FuzzerRemoteDetectLeaksAtExit, void, (unsigned long), false);

compiler-rt/lib/fuzzer/FuzzerFlags.def

 FUZZER_FLAG_INT(max_total_time, 0, "If positive, indicates the maximal total "
                                    "time in seconds to run the fuzzer.")
 FUZZER_FLAG_INT(help, 0, "Print help.")
 FUZZER_FLAG_INT(fork, 0, "Experimental mode where fuzzing happens "
                 "in a subprocess")
 FUZZER_FLAG_INT(ignore_timeouts, 1, "Ignore timeouts in fork mode")
 FUZZER_FLAG_INT(ignore_ooms, 1, "Ignore OOMs in fork mode")
 FUZZER_FLAG_INT(ignore_crashes, 0, "Ignore crashes in fork mode")
+FUZZER_FLAG_INT(ignore_remote_exits, 0, "Ignore remote processes exiting normally")
 FUZZER_FLAG_INT(merge, 0, "If 1, the 2-nd, 3-rd, etc corpora will be "
   "merged into the 1-st corpus. Only interesting units will be taken. "
   "This flag can be used to minimize a corpus.")
 FUZZER_FLAG_STRING(stop_file, "Stop fuzzing ASAP if this file exists")
 FUZZER_FLAG_STRING(merge_inner, "internal flag")
 FUZZER_FLAG_STRING(merge_control_file,
                    "Specify a control file used for the merge process. "
                    "If a merge process gets killed it tries to leave this file "
FUZZER_FLAG_STRING(mutation_graph_file, "Saves a graph (in DOT format) to"
   " where the child has unique coverage, and are recorded with the type of"
   " mutation that caused the child.")
 FUZZER_FLAG_INT(use_counters, 1, "Use coverage counters")
 FUZZER_FLAG_INT(use_memmem, 1,
                 "Use hints from intercepting memmem, strstr, etc")
 FUZZER_FLAG_INT(use_value_profile, 0,
                 "Experimental. Use value profile to guide fuzzing.")
 FUZZER_FLAG_INT(use_cmp, 1, "Use CMP traces to guide mutations")
+FUZZER_FLAG_INT(remote, 0, "Experimental. Allow remote processes to connect and"
+                          " forward coverage information. Used to fuzz"
+                          " interprocess communication.")
 FUZZER_FLAG_INT(shrink, 0, "Experimental. Try to shrink corpus inputs.")
 FUZZER_FLAG_INT(reduce_inputs, 1,
   "Try to reduce the size of inputs while preserving their full feature sets")
 FUZZER_FLAG_UNSIGNED(jobs, 0, "Number of jobs to run. If jobs >= 1 we spawn"
                           " this number of jobs in separate worker processes"
                           " with stdout/stderr redirected to fuzz-JOB.log.")
 FUZZER_FLAG_UNSIGNED(workers, 0,
             "Number of simultaneous worker processes to run the jobs."

compiler-rt/lib/fuzzer/FuzzerOptions.h

struct FuzzingOptions {
   int UnitTimeoutSec = 300;
   int TimeoutExitCode = 70;
   int OOMExitCode = 71;
   int InterruptExitCode = 72;
   int ErrorExitCode = 77;
   bool IgnoreTimeouts = true;
   bool IgnoreOOMs = true;
   bool IgnoreCrashes = false;
+  bool IgnoreRemoteExits = false;
   int MaxTotalTimeSec = 0;
   int RssLimitMb = 0;
   int MallocLimitMb = 0;
   bool DoCrossOver = true;
   bool CrossOverUniformDist = false;
   int MutateDepth = 5;
   bool ReduceDepth = false;
   bool UseCounters = false;
   bool UseMemmem = true;
   bool UseCmp = false;
   int UseValueProfile = false;
+  bool UseRemote = false;
   bool Shrink = false;
   bool ReduceInputs = false;
   int ReloadIntervalSec = 1;
   bool ShuffleAtStartUp = true;
   bool PreferSmall = true;
   size_t MaxNumberOfRuns = -1L;
   int ReportSlowUnits = 10;
   bool OnlyASCII = false;

compiler-rt/lib/fuzzer/tests/FuzzerTestUtil.h

 #include <initializer_list>
 #include <memory>
 
 namespace fuzzer {
 
 // Helper environment to ensure that:
 // * The PRNG is seeded deterministically.
 // * The ExternalFunctions are allocated.
+// * No-op versions of the FuzzerRemote* methods are provided.
 class TestEnvironment : public testing::Environment {
 public:
   void SetUp() override {
     srand(0);
     ExtFuncs.reset(new ExternalFunctions());
     EF = ExtFuncs.get();
+    EF->FuzzerAcceptRemotes = []() {};
+    EF->FuzzerShutdownRemotes = []() {};
+    EF->FuzzerRemoteStartExecution = [](unsigned long PID, uint32_t Flags) {};
+    EF->FuzzerRemoteFinishExecution = [](unsigned long PID) {};
+    EF->FuzzerRemotePrintPC = [](unsigned long PID, const char *SymbolizedFMT,
+                                 const char *FallbackFMT, uintptr_t PC) {};
+    EF->FuzzerRemoteDescribePC = [](unsigned long PID,
+                                    const char *SymbolizedFMT, uintptr_t PC,
+                                    char *Out, size_t OutLen) {};
+    EF->FuzzerRemotePrintStackTrace = [](unsigned long PID) {};
+    EF->FuzzerRemotePrintMemoryProfile = [](unsigned long PID) {};
   }
 
   void TearDown() override { EF = nullptr; }
 
 private:
   std::unique_ptr<ExternalFunctions> ExtFuncs;
 };