Skip to content

Commit 5b7d307

Browse files
tokatokatokatoka
authored
Add avoid_crash option to scheduler (#2530)
* chg * add avoid_crash * a * clp * just use .00 at this point * libafl-fuzz chg
1 parent 902571c commit 5b7d307

File tree

21 files changed

+189
-59
lines changed

21 files changed

+189
-59
lines changed

‎fuzzers/fuzzbench/fuzzbench/src/lib.rs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,11 @@ fn fuzz(
310310
// A minimization+queue policy to get testcasess from the corpus
311311
let scheduler = IndexesLenTimeMinimizerScheduler::new(
312312
&edges_observer,
313-
StdWeightedScheduler::with_schedule(&mut state, &edges_observer, Some(PowerSchedule::FAST)),
313+
StdWeightedScheduler::with_schedule(
314+
&mut state,
315+
&edges_observer,
316+
Some(PowerSchedule::fast()),
317+
),
314318
);
315319

316320
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/fuzzbench/fuzzbench_ctx/src/lib.rs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -320,7 +320,11 @@ fn fuzz(
320320
// A minimization+queue policy to get testcasess from the corpus
321321
let scheduler = IndexesLenTimeMinimizerScheduler::new(
322322
&edges_observer,
323-
StdWeightedScheduler::with_schedule(&mut state, &edges_observer, Some(PowerSchedule::FAST)),
323+
StdWeightedScheduler::with_schedule(
324+
&mut state,
325+
&edges_observer,
326+
Some(PowerSchedule::fast()),
327+
),
324328
);
325329

326330
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/fuzzbench/fuzzbench_fork_qemu/src/fuzzer.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -313,7 +313,7 @@ fn fuzz(
313313
// A minimization+queue policy to get testcasess from the corpus
314314
let scheduler = IndexesLenTimeMinimizerScheduler::new(
315315
&edges_observer,
316-
PowerQueueScheduler::new(&mut state, &edges_observer, PowerSchedule::FAST),
316+
PowerQueueScheduler::new(&mut state, &edges_observer, PowerSchedule::fast()),
317317
);
318318

319319
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/fuzzbench/fuzzbench_forkserver/src/main.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ fn fuzz(
308308
StdWeightedScheduler::with_schedule(
309309
&mut state,
310310
&edges_observer,
311-
Some(PowerSchedule::EXPLORE),
311+
Some(PowerSchedule::explore()),
312312
),
313313
);
314314

‎fuzzers/fuzzbench/fuzzbench_forkserver_cmplog/src/main.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,7 @@ fn fuzz(
309309
StdWeightedScheduler::with_schedule(
310310
&mut state,
311311
&edges_observer,
312-
Some(PowerSchedule::EXPLORE),
312+
Some(PowerSchedule::explore()),
313313
),
314314
);
315315

‎fuzzers/fuzzbench/fuzzbench_qemu/src/fuzzer.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -319,7 +319,7 @@ fn fuzz(
319319
// A minimization+queue policy to get testcasess from the corpus
320320
let scheduler = IndexesLenTimeMinimizerScheduler::new(
321321
&edges_observer,
322-
PowerQueueScheduler::new(&mut state, &edges_observer, PowerSchedule::FAST),
322+
PowerQueueScheduler::new(&mut state, &edges_observer, PowerSchedule::fast()),
323323
);
324324

325325
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/fuzzbench/fuzzbench_text/src/lib.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,7 @@ fn fuzz_binary(
380380
StdWeightedScheduler::with_schedule(
381381
&mut state,
382382
&edges_observer,
383-
Some(PowerSchedule::EXPLORE),
383+
Some(PowerSchedule::explore()),
384384
),
385385
);
386386

@@ -605,7 +605,7 @@ fn fuzz_text(
605605
StdWeightedScheduler::with_schedule(
606606
&mut state,
607607
&edges_observer,
608-
Some(PowerSchedule::EXPLORE),
608+
Some(PowerSchedule::explore()),
609609
),
610610
);
611611

‎fuzzers/libpng/libfuzzer_libpng/src/lib.rs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,11 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
149149
// A minimization+queue policy to get testcasess from the corpus
150150
let scheduler = IndexesLenTimeMinimizerScheduler::new(
151151
&edges_observer,
152-
StdWeightedScheduler::with_schedule(&mut state, &edges_observer, Some(PowerSchedule::FAST)),
152+
StdWeightedScheduler::with_schedule(
153+
&mut state,
154+
&edges_observer,
155+
Some(PowerSchedule::fast()),
156+
),
153157
);
154158

155159
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/libpng/libfuzzer_libpng_cmin/src/lib.rs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,11 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
149149
// A minimization+queue policy to get testcasess from the corpus
150150
let scheduler = IndexesLenTimeMinimizerScheduler::new(
151151
&edges_observer,
152-
StdWeightedScheduler::with_schedule(&mut state, &edges_observer, Some(PowerSchedule::FAST)),
152+
StdWeightedScheduler::with_schedule(
153+
&mut state,
154+
&edges_observer,
155+
Some(PowerSchedule::fast()),
156+
),
153157
);
154158

155159
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/libpng/libfuzzer_libpng_tcp_manager/src/lib.rs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,11 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
147147
// A minimization+queue policy to get testcasess from the corpus
148148
let scheduler = IndexesLenTimeMinimizerScheduler::new(
149149
&edges_observer,
150-
StdWeightedScheduler::with_schedule(&mut state, &edges_observer, Some(PowerSchedule::FAST)),
150+
StdWeightedScheduler::with_schedule(
151+
&mut state,
152+
&edges_observer,
153+
Some(PowerSchedule::fast()),
154+
),
151155
);
152156

153157
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/others/dynamic_analysis/src/lib.rs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -316,7 +316,11 @@ fn fuzz(
316316
// A minimization+queue policy to get testcasess from the corpus
317317
let scheduler = IndexesLenTimeMinimizerScheduler::new(
318318
&edges_observer,
319-
StdWeightedScheduler::with_schedule(&mut state, &edges_observer, Some(PowerSchedule::FAST)),
319+
StdWeightedScheduler::with_schedule(
320+
&mut state,
321+
&edges_observer,
322+
Some(PowerSchedule::fast()),
323+
),
320324
);
321325

322326
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/others/libafl-fuzz/src/fuzzer.rs

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ use libafl::{
1616
},
1717
observers::{CanTrack, HitcountsMapObserver, StdMapObserver, TimeObserver},
1818
schedulers::{
19-
powersched::PowerSchedule, IndexesLenTimeMinimizerScheduler, QueueScheduler,
20-
StdWeightedScheduler,
19+
powersched::{BaseSchedule, PowerSchedule},
20+
IndexesLenTimeMinimizerScheduler, QueueScheduler, StdWeightedScheduler,
2121
},
2222
stages::{
2323
mutational::MultiMutationalStage, CalibrationStage, ColorizationStage, IfStage,
@@ -185,7 +185,7 @@ where
185185
)
186186
};
187187
let mutational_stage = TimeTrackingStageWrapper::<FuzzTime, _, _>::new(inner_mutational_stage);
188-
let strategy = opt.power_schedule.unwrap_or(PowerSchedule::EXPLORE);
188+
let strategy = opt.power_schedule.unwrap_or(BaseSchedule::EXPLORE);
189189

190190
// Create our ColorizationStage
191191
let colorization = ColorizationStage::new(&edges_observer);
@@ -197,8 +197,9 @@ where
197197
if opt.sequential_queue {
198198
scheduler = SupportedSchedulers::Queue(QueueScheduler::new(), PhantomData);
199199
} else {
200+
let ps = PowerSchedule::new(strategy);
200201
let mut weighted_scheduler =
201-
StdWeightedScheduler::with_schedule(&mut state, &edges_observer, Some(strategy));
202+
StdWeightedScheduler::with_schedule(&mut state, &edges_observer, Some(ps));
202203
if opt.cycle_schedules {
203204
weighted_scheduler = weighted_scheduler.cycling_scheduler();
204205
}

‎fuzzers/others/libafl-fuzz/src/hooks.rs

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,6 @@ pub struct LibAflFuzzEventHook {
1010
exit_on_solution: bool,
1111
}
1212

13-
impl LibAflFuzzEventHook {
14-
pub fn new(exit_on_solution: bool) -> Self {
15-
Self { exit_on_solution }
16-
}
17-
}
18-
1913
impl<S> EventManagerHook<S> for LibAflFuzzEventHook
2014
where
2115
S: State + Stoppable,

‎fuzzers/others/libafl-fuzz/src/main.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ use fuzzer::run_client;
2525
use libafl::{
2626
events::{CentralizedLauncher, EventConfig},
2727
monitors::MultiMonitor,
28-
schedulers::powersched::PowerSchedule,
28+
schedulers::powersched::BaseSchedule,
2929
Error,
3030
};
3131
use libafl_bolts::{
@@ -126,7 +126,7 @@ struct Opt {
126126
rng_seed: Option<u64>,
127127
/// power schedules compute a seed's performance score: explore(default), fast, exploit, seek, rare, mmopt, coe, lin
128128
#[arg(short = 'p')]
129-
power_schedule: Option<PowerSchedule>,
129+
power_schedule: Option<BaseSchedule>,
130130
/// enable `CmpLog` by specifying a binary compiled for it.
131131
#[arg(short = 'c')]
132132
cmplog: Option<String>,

‎fuzzers/others/libfuzzer_windows_asan/src/lib.rs

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,11 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
114114
// A minimization+queue policy to get testcasess from the corpus
115115
let scheduler = IndexesLenTimeMinimizerScheduler::new(
116116
&edges_observer,
117-
StdWeightedScheduler::with_schedule(&mut state, &edges_observer, Some(PowerSchedule::FAST)),
117+
StdWeightedScheduler::with_schedule(
118+
&mut state,
119+
&edges_observer,
120+
Some(PowerSchedule::fast()),
121+
),
118122
);
119123

120124
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/others/tutorial/src/lib.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ fn fuzz(corpus_dirs: &[PathBuf], objective_dir: PathBuf, broker_port: u16) -> Re
135135
// A minimization+queue policy to get testcasess from the corpus
136136
let scheduler = PacketLenMinimizerScheduler::new(
137137
&edges_observer,
138-
PowerQueueScheduler::new(&mut state, &edges_observer, PowerSchedule::FAST),
138+
PowerQueueScheduler::new(&mut state, &edges_observer, PowerSchedule::fast()),
139139
);
140140

141141
// A fuzzer with feedbacks and a corpus scheduler

‎fuzzers/qemu/qemu_launcher/src/instance.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ impl<'a, M: Monitor> Instance<'a, M> {
127127
// A minimization+queue policy to get testcasess from the corpus
128128
let scheduler = IndexesLenTimeMinimizerScheduler::new(
129129
&edges_observer,
130-
PowerQueueScheduler::new(&mut state, &edges_observer, PowerSchedule::FAST),
130+
PowerQueueScheduler::new(&mut state, &edges_observer, PowerSchedule::fast()),
131131
);
132132

133133
let observers = tuple_list!(edges_observer, time_observer);

‎libafl/src/schedulers/powersched.rs

Lines changed: 95 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,10 +155,104 @@ impl SchedulerMetadata {
155155
}
156156
}
157157

158+
/// The struct for the powerschedule algorithm
159+
#[derive(Debug, Clone, Serialize, Deserialize, Copy)]
160+
pub struct PowerSchedule {
161+
base: BaseSchedule,
162+
avoid_crash: bool,
163+
}
164+
165+
impl PowerSchedule {
166+
#[must_use]
167+
/// Constructor
168+
pub fn new(base: BaseSchedule) -> Self {
169+
Self {
170+
base,
171+
avoid_crash: false,
172+
}
173+
}
174+
175+
/// Use `explore` power schedule
176+
#[must_use]
177+
pub fn explore() -> Self {
178+
Self {
179+
base: BaseSchedule::EXPLORE,
180+
avoid_crash: false,
181+
}
182+
}
183+
184+
/// Use `exploit` power schedule
185+
#[must_use]
186+
pub fn exploit() -> Self {
187+
Self {
188+
base: BaseSchedule::EXPLOIT,
189+
avoid_crash: false,
190+
}
191+
}
192+
193+
/// Use `fast` power schedule
194+
#[must_use]
195+
pub fn fast() -> Self {
196+
Self {
197+
base: BaseSchedule::FAST,
198+
avoid_crash: false,
199+
}
200+
}
201+
202+
/// Use `coe` power schedule
203+
#[must_use]
204+
pub fn coe() -> Self {
205+
Self {
206+
base: BaseSchedule::COE,
207+
avoid_crash: false,
208+
}
209+
}
210+
211+
/// Use `lin` power schedule
212+
#[must_use]
213+
pub fn lin() -> Self {
214+
Self {
215+
base: BaseSchedule::LIN,
216+
avoid_crash: false,
217+
}
218+
}
219+
220+
/// Use `quad` power schedule
221+
#[must_use]
222+
pub fn quad() -> Self {
223+
Self {
224+
base: BaseSchedule::QUAD,
225+
avoid_crash: false,
226+
}
227+
}
228+
229+
/// Getter to `avoid_crash`
230+
#[must_use]
231+
pub fn avoid_crash(&self) -> bool {
232+
self.avoid_crash
233+
}
234+
235+
/// Avoid scheduling testcases that caused crashes
236+
pub fn set_avoid_crash(&mut self) {
237+
self.avoid_crash = true;
238+
}
239+
240+
/// Getter to the base scheduler
241+
#[must_use]
242+
pub fn base(&self) -> &BaseSchedule {
243+
&self.base
244+
}
245+
246+
/// Setter to the base scheduler
247+
pub fn set_base(&mut self, base: BaseSchedule) {
248+
self.base = base;
249+
}
250+
}
251+
158252
/// The power schedule to use
159253
#[derive(Serialize, Deserialize, Clone, Copy, Debug, PartialEq, Eq)]
160254
#[cfg_attr(feature = "clap", derive(clap::ValueEnum))]
161-
pub enum PowerSchedule {
255+
pub enum BaseSchedule {
162256
/// The `explore` power schedule
163257
EXPLORE,
164258
/// The `exploit` power schedule

0 commit comments

Comments
 (0)