1#!/bin/bash -u 2# Copyright 2018 Google Inc. 3# 4# Licensed under the Apache License, Version 2.0 (the "License"); 5# you may not use this file except in compliance with the License. 6# You may obtain a copy of the License at 7# 8# http://www.apache.org/licenses/LICENSE-2.0 9# 10# Unless required by applicable law or agreed to in writing, software 11# distributed under the License is distributed on an "AS IS" BASIS, 12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13# See the License for the specific language governing permissions and 14# limitations under the License. 15# 16################################################################################ 17cd $OUT 18 19if (( $# > 0 )); then 20 FUZZ_TARGETS="$@" 21else 22 FUZZ_TARGETS="$(find . -maxdepth 1 -type f -executable -printf '%P\n')" 23fi 24 25DUMPS_DIR="$OUT/dumps" 26FUZZER_STATS_DIR="$OUT/fuzzer_stats" 27LOGS_DIR="$OUT/logs" 28REPORT_ROOT_DIR="$OUT/report" 29REPORT_PLATFORM_DIR="$OUT/report/linux" 30 31for directory in $DUMPS_DIR $FUZZER_STATS_DIR $LOGS_DIR $REPORT_ROOT_DIR \ 32 $REPORT_PLATFORM_DIR; do 33 rm -rf $directory 34 mkdir -p $directory 35done 36 37PROFILE_FILE="$DUMPS_DIR/merged.profdata" 38SUMMARY_FILE="$REPORT_PLATFORM_DIR/summary.json" 39 40# Use path mapping, as $SRC directory from the builder is copied into $OUT/$SRC. 41PATH_EQUIVALENCE_ARGS="-path-equivalence=/,$OUT" 42 43# It's important to use $COVERAGE_EXTRA_ARGS as the last argument, because it 44# can contain paths to source files / directories which are positional args. 45LLVM_COV_COMMON_ARGS="$PATH_EQUIVALENCE_ARGS \ 46 -ignore-filename-regex=.*src/libfuzzer/.* $COVERAGE_EXTRA_ARGS" 47 48# Timeout for running a single fuzz target. 49TIMEOUT=1h 50 51# This will be used by llvm-cov command to generate the actual report. 52objects="" 53 54# Number of CPUs available, this is needed for running tests in parallel. 55NPROC=$(nproc) 56 57function run_fuzz_target { 58 local target=$1 59 60 # '%1m' will produce separate dump files for every object. For example, if a 61 # fuzz target loads a shared library, we will have dumps for both of them. 62 local profraw_file="$DUMPS_DIR/$target.%1m.profraw" 63 local profraw_file_mask="$DUMPS_DIR/$target.*.profraw" 64 local profdata_file="$DUMPS_DIR/$target.profdata" 65 local corpus_real="/corpus/${target}" 66 67 # -merge=1 requires an output directory, create a new, empty dir for that. 68 local corpus_dummy="$OUT/dummy_corpus_dir_for_${target}" 69 rm -rf $corpus_dummy && mkdir -p $corpus_dummy 70 71 # Use -merge=1 instead of -runs=0 because merge is crash resistant and would 72 # let to get coverage using all corpus files even if there are crash inputs. 73 # Merge should not introduce any significant overhead compared to -runs=0, 74 # because (A) corpuses are already minimized; (B) we do not use sancov, and so 75 # libFuzzer always finishes merge with an empty output dir. 76 # Use 100s timeout instead of 25s as code coverage builds can be very slow. 77 local args="-merge=1 -timeout=100 -close_fd_mask=3 $corpus_dummy $corpus_real" 78 79 export LLVM_PROFILE_FILE=$profraw_file 80 timeout $TIMEOUT $OUT/$target $args &> $LOGS_DIR/$target.log 81 if (( $? != 0 )); then 82 echo "Error occured while running $target:" 83 cat $LOGS_DIR/$target.log 84 fi 85 86 rm -rf $corpus_dummy 87 88 if (( $(du -c $profraw_file_mask | tail -n 1 | cut -f 1) == 0 )); then 89 # Skip fuzz targets that failed to produce profile dumps. 90 return 0 91 fi 92 93 llvm-profdata merge -j=1 -sparse $profraw_file_mask -o $profdata_file 94 95 # Delete unnecessary and (potentially) large .profraw files. 96 rm $profraw_file_mask 97 98 shared_libraries=$(coverage_helper shared_libs -build-dir=$OUT -object=$target) 99 100 llvm-cov export -summary-only -instr-profile=$profdata_file -object=$target \ 101 $shared_libraries $LLVM_COV_COMMON_ARGS > $FUZZER_STATS_DIR/$target.json 102 103 if [ -n "${FULL_SUMMARY_PER_TARGET-}" ]; then 104 # This is needed for dataflow strategy analysis, can be removed later. See 105 # - https://github.com/google/oss-fuzz/pull/3306 106 # - https://github.com/google/oss-fuzz/issues/1632 107 # Intentionally writing these to the logs dir in order to hide the dumps 108 # from the ClusterFuzz cron job. 109 llvm-cov export -instr-profile=$profdata_file -object=$target \ 110 $shared_libraries $LLVM_COV_COMMON_ARGS > $LOGS_DIR/$target.json 111 fi 112} 113 114function run_go_fuzz_target { 115 local target=$1 116 117 echo "Running go target $target" 118 export FUZZ_CORPUS_DIR="/corpus/${target}/" 119 export FUZZ_PROFILE_NAME="$DUMPS_DIR/$target.perf" 120 $OUT/$target -test.coverprofile $DUMPS_DIR/$target.profdata &> $LOGS_DIR/$target.log 121 # translate from golangish paths to current absolute paths 122 cat $OUT/$target.gocovpath | while read i; do sed -i $i $DUMPS_DIR/$target.profdata; done 123 # cf PATH_EQUIVALENCE_ARGS 124 sed -i 's=/='$OUT'/=' $DUMPS_DIR/$target.profdata 125 $SYSGOPATH/bin/gocovsum $DUMPS_DIR/$target.profdata > $FUZZER_STATS_DIR/$target.json 126} 127 128export SYSGOPATH=$GOPATH 129export GOPATH=$OUT/$GOPATH 130# Run each fuzz target, generate raw coverage dumps. 131for fuzz_target in $FUZZ_TARGETS; do 132 # Test if fuzz target is a golang one. 133 if [[ $FUZZING_LANGUAGE == "go" ]]; then 134 # Continue if not a fuzz target. 135 if [[ $FUZZING_ENGINE != "none" ]]; then 136 grep "FUZZ_CORPUS_DIR" $fuzz_target > /dev/null 2>&1 || continue 137 fi 138 run_go_fuzz_target $fuzz_target & 139 else 140 # Continue if not a fuzz target. 141 if [[ $FUZZING_ENGINE != "none" ]]; then 142 grep "LLVMFuzzerTestOneInput" $fuzz_target > /dev/null 2>&1 || continue 143 fi 144 145 echo "Running $fuzz_target" 146 run_fuzz_target $fuzz_target & 147 148 if [[ -z $objects ]]; then 149 # The first object needs to be passed without -object= flag. 150 objects="$fuzz_target" 151 else 152 objects="$objects -object=$fuzz_target" 153 fi 154 fi 155 156 # Do not spawn more processes than the number of CPUs available. 157 n_child_proc=$(jobs -rp | wc -l) 158 while [ "$n_child_proc" -eq "$NPROC" ]; do 159 sleep 4 160 n_child_proc=$(jobs -rp | wc -l) 161 done 162done 163 164# Wait for background processes to finish. 165wait 166 167if [[ $FUZZING_LANGUAGE == "go" ]]; then 168 $SYSGOPATH/bin/gocovmerge $DUMPS_DIR/*.profdata > fuzz.cov 169 go tool cover -html=fuzz.cov -o $REPORT_ROOT_DIR/index.html 170 $SYSGOPATH/bin/gocovsum fuzz.cov > $SUMMARY_FILE 171 cp $REPORT_ROOT_DIR/index.html $REPORT_PLATFORM_DIR/index.html 172 $SYSGOPATH/bin/pprof-merge $DUMPS_DIR/*.perf.cpu.prof 173 mv merged.data $REPORT_ROOT_DIR/cpu.prof 174 $SYSGOPATH/bin/pprof-merge $DUMPS_DIR/*.perf.heap.prof 175 mv merged.data $REPORT_ROOT_DIR/heap.prof 176 #TODO some proxy for go tool pprof -http=127.0.0.1:8001 $DUMPS_DIR/cpu.prof 177 echo "Finished generating code coverage report for Go fuzz targets." 178else 179 180 # From this point on the script does not tolerate any errors. 181 set -e 182 183 # Merge all dumps from the individual targets. 184 rm -f $PROFILE_FILE 185 llvm-profdata merge -sparse $DUMPS_DIR/*.profdata -o $PROFILE_FILE 186 187 # TODO(mmoroz): add script from Chromium for rendering directory view reports. 188 # The first path in $objects does not have -object= prefix (llvm-cov format). 189 shared_libraries=$(coverage_helper shared_libs -build-dir=$OUT -object=$objects) 190 objects="$objects $shared_libraries" 191 192 # It's important to use $LLVM_COV_COMMON_ARGS as the last argument due to 193 # positional arguments (SOURCES) that can be passed via $COVERAGE_EXTRA_ARGS. 194 LLVM_COV_ARGS="-instr-profile=$PROFILE_FILE $objects $LLVM_COV_COMMON_ARGS" 195 196 # Generate HTML report. 197 llvm-cov show -format=html -output-dir=$REPORT_ROOT_DIR \ 198 -Xdemangler rcfilt $LLVM_COV_ARGS 199 200 # Export coverage summary in JSON format. 201 llvm-cov export -summary-only $LLVM_COV_ARGS > $SUMMARY_FILE 202 203 # Post process HTML report. 204 coverage_helper -v post_process -src-root-dir=/ -summary-file=$SUMMARY_FILE \ 205 -output-dir=$REPORT_ROOT_DIR $PATH_EQUIVALENCE_ARGS 206 207fi 208 209if [[ -n $HTTP_PORT ]]; then 210 # Serve the report locally. 211 echo "Serving the report on http://127.0.0.1:$HTTP_PORT/linux/index.html" 212 cd $REPORT_ROOT_DIR 213 python3 -m http.server $HTTP_PORT 214fi 215