encounter/dawn-cmake
1
0
Fork 0
mirror of https://github.com/encounter/dawn-cmake.git synced 2025-05-13 19:01:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
dawn-cmake/docs/fuzzing.md
Austin Eng 470921fe46 Reland "fuzzing: Add supportsErrorInjection option to DawnWireServerFuzzer" 
This is a reland of f58f69f66bacefb0aaf78e91b462b5db97cea391

The whitebox dawn_end2end_tests are updated to link statically against
libdawn_native. This is required because the test link against and use
libdawn_native as sources. It is an error with MSVC to both import and
export symbols from libdawn_native.

Original change's description:
> fuzzing: Add supportsErrorInjection option to DawnWireServerFuzzer
>
> This option will be used by backends that support error injection so
> that errors can be injected into a "clean" corpus to generate a seed
> corpus with good examples of injected error conditions.
>
> Bug: dawn:295
> Change-Id: I837acdde6dd4274adb56edf8e4307427f8d6333b
> Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/14681
> Reviewed-by: Corentin Wallez <cwallez@chromium.org>
> Commit-Queue: Austin Eng <enga@chromium.org>

Bug: dawn:295
Change-Id: Ifa092d28aa7ac57cfb197aa4daeb8408f8036d4a
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/14820
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Austin Eng <enga@chromium.org>
2020-01-06 19:56:17 +00:00

2.3 KiB
Raw Blame History

Fuzzing Dawn

dawn_wire_server_and_frontend_fuzzer

The dawn_wire_server_and_frontend_fuzzer sets up Dawn using the Null backend, and passes inputs to the wire server. This fuzzes the dawn_wire deserialization, as well as Dawn's frontend validation.

dawn_wire_server_and_vulkan_backend_fuzzer

The dawn_wire_server_and_vulkan_backend_fuzzer is like dawn_wire_server_and_frontend_fuzzer but it runs using a Vulkan CPU backend such as Swiftshader. This fuzzer supports error injection by using the first bytes of the fuzzing input as a Vulkan call index for which to mock a failure.

Updating the Seed Corpus

Using a seed corpus significantly improves the efficiency of fuzzing. Dawn's fuzzers use interesting testcases discovered in previous fuzzing runs to seed future runs. Fuzzing can be further improved by using Dawn tests as a example of API usage which allows the fuzzer to quickly discover and use new API entrypoints and usage patterns.

The script update_fuzzer_seed_corpus.sh can be used to capture a trace while running Dawn tests, and upload it to the existing fuzzer seed corpus. It does the following steps:

  1. Builds the provided test and fuzzer targets.
  2. Runs the provided test target with --use-wire --wire-trace-dir=tmp_dir1 [additional_test_args] to dump traces of the tests.
  3. Generates one variant of each trace for every possible error index, by running the fuzzer target with --injected-error-testcase-dir=tmp_dir2 ....
  4. Minimizes all testcases by running the fuzzer target with -merge=1 tmp_dir3 tmp_dir1 tmp_dir2.

To run the script:

  1. You must be in a Chromium checkout using the GN arg use_libfuzzer=true

  2. Run ./third_party/dawn/scripts/update_fuzzer_seed_corpus.sh <out_dir> <fuzzer> <test> [additional_test_args].

    Example: ./third_party/dawn/scripts/update_fuzzer_seed_corpus.sh out/fuzz dawn_wire_server_and_vulkan_backend_fuzzer dawn_end2end_tests --gtest_filter=*Vulkan

  3. The script will print instructions for testing, and then uploading new inputs. Please, only upload inputs after testing the fuzzer with new inputs, and verifying there is a meaningful change in coverage. Uploading requires gcloud to be logged in with @google.com credentials: gcloud auth login.