bwlp/qemu.git/scripts/oss-fuzz, branch master

oss-fuzz: ensure base_copy is a generic-fuzzer

2022-07-22T17:01:44+00:00

Depending on how the target list is sorted in by qemu, the first target (used as the base copy of the fuzzer, to which all others are linked) might not be a generic-fuzzer. Since we are trying to only use generic-fuzz, on oss-fuzz, fix that, to ensure the base copy is a generic-fuzzer. Signed-off-by: Alexander Bulekov Message-Id: <20220720180946.2264253-1-alxndr@bu.edu> Signed-off-by: Paolo Bonzini

oss-fuzz: remove binaries from qemu-bundle tree

2022-07-22T17:01:44+00:00

oss-fuzz is finding possible fuzzing targets even under qemu-bundle/.../bin, but they cannot be used because the required shared libraries are missing. Since the fuzzing targets are already placed manually in $OUT, the bindir and libexecdir subtrees are not needed; remove them. Cc: Alexander Bulekov Signed-off-by: Paolo Bonzini

datadir: Use bundle mechanism

2022-07-13T14:58:57+00:00

softmmu/datadir.c had its own implementation to find files in the build tree, but now bundle mechanism provides the unified implementation which works for datadir and the other files. Signed-off-by: Akihiko Odaki Message-Id: <20220624145039.49929-4-akihiko.odaki@gmail.com> Signed-off-by: Paolo Bonzini

fuzz: only use generic-fuzz targets on oss-fuzz

2022-07-08T09:03:36+00:00

The non-generic-fuzz targets often time-out, or run out of memory. Additionally, they create unreproducible bug-reports. It is possible that this is resulting in failing coverage-reports on OSS-Fuzz. In the future, these test-cases should be fixed, or removed. Reviewed-by: Darren Kenny Signed-off-by: Alexander Bulekov Message-Id: <20220623125505.2137534-1-alxndr@bu.edu> Signed-off-by: Paolo Bonzini

tests: move libqtest.h back under qtest/

2022-05-03T11:16:51+00:00

Since commit a2ce7dbd917 ("meson: convert tests/qtest to meson"), libqtest.h is under libqos/ directory, while libqtest.c is still in qtest/. Move back to its original location to avoid mixing with libqos/. Suggested-by: Thomas Huth Signed-off-by: Marc-André Lureau Reviewed-by: Thomas Huth Reviewed-by: Stefan Berger

fuzz: add an instrumentation filter

2021-09-01T11:33:13+00:00

By default, -fsanitize=fuzzer instruments all code with coverage information. However, this means that libfuzzer will track coverage over hundreds of source files that are unrelated to virtual-devices. This means that libfuzzer will optimize inputs for coverage observed in timer code, memory APIs etc. This slows down the fuzzer and stores many inputs that are not relevant to the actual virtual-devices. With this change, clang versions that support the "-fsanitize-coverage-allowlist" will only instrument a subset of the compiled code, that is directly related to virtual-devices. Signed-off-by: Alexander Bulekov Reviewed-by: Darren Kenny

fuzz: avoid building twice, when running on gitlab

2021-08-11T11:40:01+00:00

On oss-fuzz, we build twice, to put together a build that is portable to the runner containers. On gitlab ci, this is wasteful and contributes to timeouts on the build-oss-fuzz job. Avoid building twice on gitlab, at the remote cost of potentially missing some cases that break oss-fuzz builds. Signed-off-by: Alexander Bulekov Reviewed-by: Darren Kenny Message-Id: <20210809111621.54454-1-alxndr@bu.edu> Signed-off-by: Thomas Huth

scripts/oss-fuzz: Fix typo in documentation

2021-06-05T19:29:39+00:00

While we only use stdin, the chardev is named 'stdio'. Signed-off-by: Philippe Mathieu-Daudé Reviewed-by: Alexander Bulekov Message-Id: <20210602170759.2500248-4-f4bug@amsat.org> Signed-off-by: Laurent Vivier

fuzz: add a script to build reproducers

2021-03-16T18:19:54+00:00

Currently, bash and C crash reproducers are be built manually. This is a problem, as we want to integrate reproducers into the tree, for regression testing. This patch adds a script that converts a sequence of QTest commands into a pasteable Bash reproducer, or a libqtest-based C program. This will try to wrap pasteable reproducers to 72 chars, but the generated C code will not have nice formatting. Therefore, the C output of this script should be piped through an auto-formatter, such as clang-format Signed-off-by: Alexander Bulekov Reviewed-by: Darren Kenny Signed-off-by: Paolo Bonzini

fuzz: fix wrong index in clear_bits

2021-02-08T13:43:54+00:00

Signed-off-by: Qiuhao Li Message-Id: Signed-off-by: Paolo Bonzini