| Message ID | ME3P282MB149243C4D0FE93B71E6B8AA6FCC20@ME3P282MB1492.AUSP282.PROD.OUTLOOK.COM (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | improve crash case minimization | expand |
On 201220 0256, Qiuhao Li wrote: > Simplifying the crash cases by opportunistically setting bits in > operands of > out/write to zero may help to debug, since usually bit one means turn on > or > trigger a function while zero is the default turn-off setting. > > Tested Bug 1908062. Refined vs. Original result: > > outl 0xcf8 0x8000081c outl 0xcf8 0x8000081c > outb 0xcfc 0xc3 outb 0xcfc 0xc3 > outl 0xcf8 0x0 <-- outl 0xcf8 0x8000082f > outl 0xcf8 0x80000804 outl 0xcf8 0x80000804 > outl 0xcfc 0x10000006 <-- outl 0xcfc 0x9b2765be > write 0xc300001024 0x2 0x10 <-- write 0xc300001024 0x2 0x0055 > write 0xc300001028 0x1 0x5a write 0xc300001028 0x1 0x5a > write 0xc30000101c 0x1 0x01 write 0xc30000101c 0x1 0x01 > writel 0xc30000100c 0x2a6f6c63 writel 0xc30000100c 0x2a6f6c63 > write 0xc300001018 0x1 0x80 <-- write 0xc300001018 0x1 0xa4 > write 0x5c 0x1 0x10 <-- write 0x5c 0x1 0x19 > write 0xc300003002 0x1 0x0 <-- write 0xc300003002 0x1 0x8a > > Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com> Looks good. One nit below. Reviewed-by: Alexander Bulekov <alxndr@bu.edu> > --- > scripts/oss-fuzz/minimize_qtest_trace.py | 42 +++++++++++++++++++++++- > 1 file changed, 41 insertions(+), 1 deletion(-) > > diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/minimize_qtest_trace.py > index 855c3bcb54..f3e88064c4 100755 > --- a/scripts/oss-fuzz/minimize_qtest_trace.py > +++ b/scripts/oss-fuzz/minimize_qtest_trace.py > @@ -172,7 +172,47 @@ def minimize_trace(inpath, outpath): > newtrace[i] = prior > del newtrace[i+1] > i += 1 > - check_if_trace_crashes(newtrace, outpath) > + > + assert(check_if_trace_crashes(newtrace, outpath)) > + > + TIMEOUT = (end-start)*2 # input is short now > + > + # try setting bits in operands of out/write to zero > + i = 0 > + while i < len(newtrace): > + if (not newtrace[i].startswith("write ") and not > + newtrace[i].startswith("out")): > + i += 1 > + continue > + # write ADDR SIZE DATA > + # outx ADDR VALUE > + print("\nzero setting bits: {}".format(newtrace[i])) > + > + prefix = " ".join(newtrace[i].split()[:-1]) > + data = newtrace[i].split()[-1] > + data_bin = bin(int(data, 16)) > + data_bin_list = list(data_bin) > + > + for j in range(2, len(data_bin_list)): > + prior = newtrace[i] > + if (data_bin_list[j] == '1'): > + data_bin_list[j] = '0' > + data_try = hex(int("".join(data_bin_list), 2)) > + # It seems qtest only accect hex with one byte zero padding ^^ "accepts padded hex-values." > + if len(data_try) % 2 == 1: > + data_try = data_try[:2] + "0" + data_try[2:-1] > + > + newtrace[i] = "{prefix} {data_try}\n".format( > + prefix=prefix, > + data_try=data_try) > + > + if not check_if_trace_crashes(newtrace, outpath): > + data_bin_list[j] = '1' > + newtrace[i] = prior > + > + i += 1 > + > + assert(check_if_trace_crashes(newtrace, outpath)) > > > if __name__ == '__main__': > -- > 2.25.1 >
On Mon, 2020-12-21 at 15:35 -0500, Alexander Bulekov wrote: > On 201220 0256, Qiuhao Li wrote: > > Simplifying the crash cases by opportunistically setting bits in > > operands of > > out/write to zero may help to debug, since usually bit one means > > turn on > > or > > trigger a function while zero is the default turn-off setting. > > > > Tested Bug 1908062. Refined vs. Original result: > > > > outl 0xcf8 0x8000081c outl 0xcf8 0x8000081c > > outb 0xcfc 0xc3 outb 0xcfc 0xc3 > > outl 0xcf8 0x0 <-- outl 0xcf8 0x8000082f > > outl 0xcf8 0x80000804 outl 0xcf8 0x80000804 > > outl 0xcfc 0x10000006 <-- outl 0xcfc 0x9b2765be > > write 0xc300001024 0x2 0x10 <-- write 0xc300001024 0x2 0x0055 > > write 0xc300001028 0x1 0x5a write 0xc300001028 0x1 0x5a > > write 0xc30000101c 0x1 0x01 write 0xc30000101c 0x1 0x01 > > writel 0xc30000100c 0x2a6f6c63 writel 0xc30000100c 0x2a6f6c63 > > write 0xc300001018 0x1 0x80 <-- write 0xc300001018 0x1 0xa4 > > write 0x5c 0x1 0x10 <-- write 0x5c 0x1 0x19 > > write 0xc300003002 0x1 0x0 <-- write 0xc300003002 0x1 0x8a > > > > Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com> > > Looks good. One nit below. > > Reviewed-by: Alexander Bulekov <alxndr@bu.edu> > > > > --- > > scripts/oss-fuzz/minimize_qtest_trace.py | 42 > > +++++++++++++++++++++++- > > 1 file changed, 41 insertions(+), 1 deletion(-) > > > > diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py > > b/scripts/oss-fuzz/minimize_qtest_trace.py > > index 855c3bcb54..f3e88064c4 100755 > > --- a/scripts/oss-fuzz/minimize_qtest_trace.py > > +++ b/scripts/oss-fuzz/minimize_qtest_trace.py > > @@ -172,7 +172,47 @@ def minimize_trace(inpath, outpath): > > newtrace[i] = prior > > del newtrace[i+1] > > i += 1 > > - check_if_trace_crashes(newtrace, outpath) > > + > > + assert(check_if_trace_crashes(newtrace, outpath)) > > + > > + TIMEOUT = (end-start)*2 # input is short now > > + > > + # try setting bits in operands of out/write to zero > > + i = 0 > > + while i < len(newtrace): > > + if (not newtrace[i].startswith("write ") and not > > + newtrace[i].startswith("out")): > > + i += 1 > > + continue > > + # write ADDR SIZE DATA > > + # outx ADDR VALUE > > + print("\nzero setting bits: {}".format(newtrace[i])) > > + > > + prefix = " ".join(newtrace[i].split()[:-1]) > > + data = newtrace[i].split()[-1] > > + data_bin = bin(int(data, 16)) > > + data_bin_list = list(data_bin) > > + > > + for j in range(2, len(data_bin_list)): > > + prior = newtrace[i] > > + if (data_bin_list[j] == '1'): > > + data_bin_list[j] = '0' > > + data_try = hex(int("".join(data_bin_list), 2)) > > + # It seems qtest only accect hex with one byte > > zero padding > ^^ "accepts padded hex- > values." Thanks. > > > + if len(data_try) % 2 == 1: > > + data_try = data_try[:2] + "0" + data_try[2:-1] > > + > > + newtrace[i] = "{prefix} {data_try}\n".format( > > + prefix=prefix, > > + data_try=data_try) > > + > > + if not check_if_trace_crashes(newtrace, outpath): > > + data_bin_list[j] = '1' > > + newtrace[i] = prior > > + > > + i += 1 > > + > > + assert(check_if_trace_crashes(newtrace, outpath)) > > > > > > if __name__ == '__main__': > > -- > > 2.25.1 > >
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/minimize_qtest_trace.py index 855c3bcb54..f3e88064c4 100755 --- a/scripts/oss-fuzz/minimize_qtest_trace.py +++ b/scripts/oss-fuzz/minimize_qtest_trace.py @@ -172,7 +172,47 @@ def minimize_trace(inpath, outpath): newtrace[i] = prior del newtrace[i+1] i += 1 - check_if_trace_crashes(newtrace, outpath) + + assert(check_if_trace_crashes(newtrace, outpath)) + + TIMEOUT = (end-start)*2 # input is short now + + # try setting bits in operands of out/write to zero + i = 0 + while i < len(newtrace): + if (not newtrace[i].startswith("write ") and not + newtrace[i].startswith("out")): + i += 1 + continue + # write ADDR SIZE DATA + # outx ADDR VALUE + print("\nzero setting bits: {}".format(newtrace[i])) + + prefix = " ".join(newtrace[i].split()[:-1]) + data = newtrace[i].split()[-1] + data_bin = bin(int(data, 16)) + data_bin_list = list(data_bin) + + for j in range(2, len(data_bin_list)): + prior = newtrace[i] + if (data_bin_list[j] == '1'): + data_bin_list[j] = '0' + data_try = hex(int("".join(data_bin_list), 2)) + # It seems qtest only accect hex with one byte zero padding + if len(data_try) % 2 == 1: + data_try = data_try[:2] + "0" + data_try[2:-1] + + newtrace[i] = "{prefix} {data_try}\n".format( + prefix=prefix, + data_try=data_try) + + if not check_if_trace_crashes(newtrace, outpath): + data_bin_list[j] = '1' + newtrace[i] = prior + + i += 1 + + assert(check_if_trace_crashes(newtrace, outpath)) if __name__ == '__main__':
Simplifying the crash cases by opportunistically setting bits in operands of out/write to zero may help to debug, since usually bit one means turn on or trigger a function while zero is the default turn-off setting. Tested Bug 1908062. Refined vs. Original result: outl 0xcf8 0x8000081c outl 0xcf8 0x8000081c outb 0xcfc 0xc3 outb 0xcfc 0xc3 outl 0xcf8 0x0 <-- outl 0xcf8 0x8000082f outl 0xcf8 0x80000804 outl 0xcf8 0x80000804 outl 0xcfc 0x10000006 <-- outl 0xcfc 0x9b2765be write 0xc300001024 0x2 0x10 <-- write 0xc300001024 0x2 0x0055 write 0xc300001028 0x1 0x5a write 0xc300001028 0x1 0x5a write 0xc30000101c 0x1 0x01 write 0xc30000101c 0x1 0x01 writel 0xc30000100c 0x2a6f6c63 writel 0xc30000100c 0x2a6f6c63 write 0xc300001018 0x1 0x80 <-- write 0xc300001018 0x1 0xa4 write 0x5c 0x1 0x10 <-- write 0x5c 0x1 0x19 write 0xc300003002 0x1 0x0 <-- write 0xc300003002 0x1 0x8a Signed-off-by: Qiuhao Li <Qiuhao.Li@outlook.com> --- scripts/oss-fuzz/minimize_qtest_trace.py | 42 +++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-)