Skip to content

Commit 6695934

Browse files
authored
Remove LibAFL InProcess Executor Timeout (#77)
1 parent d3072c1 commit 6695934

File tree

9 files changed

+510
-41
lines changed

9 files changed

+510
-41
lines changed

docs/src/config/common-options.md

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -41,18 +41,6 @@ Note that this timeout is in virtual time, not real time. This means that whethe
4141
simulation runs faster or slower than real time, the timeout will be accurate to the
4242
target software's execution speed.
4343

44-
The fuzzing executor also has a timeout, which runs in real time. This timeout
45-
is intended to detect situations where the fuzzer reaches a broken state where
46-
it is no longer able to iterate (e.g. the virtual time timeout is not working)
47-
and stop. By default, this timeout is set to 60 seconds and resets each
48-
iteration. Only iterations which take more than 60 seconds will trigger the
49-
timeout, but some very large fuzzing cases could exceed this time. To increase
50-
it, for example to set the timeout to 10 minutes:
51-
52-
```python
53-
@tsffs.executor_timeout = 600
54-
```
55-
5644
### Setting Exception Solutions
5745

5846
The primary way TSFFS detects bugs is via CPU exceptions that are raised, but should not

simics-rs/cargo-simics-build/src/lib.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,7 @@ impl App {
197197

198198
let mut signed = Sign::new(&module_cdylib)?;
199199

200-
let mut signed_module_cdylib = module_cdylib
200+
let signed_module_cdylib = module_cdylib
201201
.parent()
202202
.ok_or_else(|| Error::NoParentDirectory {
203203
path: module_cdylib.to_path_buf(),
Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
use core::{
2+
ffi::c_void,
3+
fmt::{self, Debug, Formatter},
4+
marker::PhantomData,
5+
};
6+
7+
use libafl::{
8+
events::{EventFirer, EventRestarter},
9+
executors::{hooks::ExecutorHooksTuple, HasObservers},
10+
fuzzer::HasObjective,
11+
inputs::UsesInput,
12+
observers::{ObserversTuple, UsesObservers},
13+
state::{HasCorpus, HasExecutions, HasSolutions, State, UsesState},
14+
Error,
15+
};
16+
17+
/// The internal state of `GenericInProcessExecutor`.
18+
pub(crate) struct GenericInProcessExecutorInner<HT, OT, S>
19+
where
20+
HT: ExecutorHooksTuple<S>,
21+
OT: ObserversTuple<S>,
22+
S: State,
23+
{
24+
/// The observers, observing each run
25+
pub(super) observers: OT,
26+
// Crash and timeout hah
27+
pub(super) hooks: HT,
28+
phantom: PhantomData<S>,
29+
}
30+
31+
impl<HT, OT, S> Debug for GenericInProcessExecutorInner<HT, OT, S>
32+
where
33+
HT: ExecutorHooksTuple<S>,
34+
OT: ObserversTuple<S> + Debug,
35+
S: State,
36+
{
37+
fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
38+
f.debug_struct("GenericInProcessExecutorState")
39+
.field("observers", &self.observers)
40+
.finish_non_exhaustive()
41+
}
42+
}
43+
44+
impl<HT, OT, S> UsesState for GenericInProcessExecutorInner<HT, OT, S>
45+
where
46+
HT: ExecutorHooksTuple<S>,
47+
OT: ObserversTuple<S>,
48+
S: State,
49+
{
50+
type State = S;
51+
}
52+
53+
impl<HT, OT, S> UsesObservers for GenericInProcessExecutorInner<HT, OT, S>
54+
where
55+
HT: ExecutorHooksTuple<S>,
56+
OT: ObserversTuple<S>,
57+
S: State,
58+
{
59+
type Observers = OT;
60+
}
61+
62+
impl<HT, OT, S> HasObservers for GenericInProcessExecutorInner<HT, OT, S>
63+
where
64+
HT: ExecutorHooksTuple<S>,
65+
OT: ObserversTuple<S>,
66+
S: State,
67+
{
68+
#[inline]
69+
fn observers(&self) -> &OT {
70+
&self.observers
71+
}
72+
73+
#[inline]
74+
fn observers_mut(&mut self) -> &mut OT {
75+
&mut self.observers
76+
}
77+
}
78+
79+
impl<HT, OT, S> GenericInProcessExecutorInner<HT, OT, S>
80+
where
81+
HT: ExecutorHooksTuple<S>,
82+
OT: ObserversTuple<S>,
83+
S: State,
84+
{
85+
/// This function marks the boundary between the fuzzer and the target
86+
#[inline]
87+
pub(crate) unsafe fn enter_target<EM, Z>(
88+
&mut self,
89+
_fuzzer: &mut Z,
90+
_state: &mut <Self as UsesState>::State,
91+
_mgr: &mut EM,
92+
_input: &<Self as UsesInput>::Input,
93+
_executor_ptr: *const c_void,
94+
) {
95+
}
96+
97+
/// This function marks the boundary between the fuzzer and the target
98+
#[inline]
99+
pub(crate) fn leave_target<EM, Z>(
100+
&mut self,
101+
_fuzzer: &mut Z,
102+
_state: &mut <Self as UsesState>::State,
103+
_mgr: &mut EM,
104+
_input: &<Self as UsesInput>::Input,
105+
) {
106+
}
107+
}
108+
109+
impl<HT, OT, S> GenericInProcessExecutorInner<HT, OT, S>
110+
where
111+
HT: ExecutorHooksTuple<S>,
112+
OT: ObserversTuple<S>,
113+
S: HasExecutions + HasSolutions + HasCorpus + State,
114+
{
115+
/// Create a new in mem executor.
116+
/// Caution: crash and restart in one of them will lead to odd behavior if multiple are used,
117+
/// depending on different corpus or state.
118+
/// * `hooks` - the hooks run before and after the harness's execution
119+
/// * `harness_fn` - the harness, executing the function
120+
/// * `observers` - the observers observing the target during execution
121+
/// This may return an error on unix, if signal handler setup fails
122+
pub(crate) fn new<EM, OF, Z>(
123+
hooks: HT,
124+
observers: OT,
125+
_fuzzer: &mut Z,
126+
_event_mgr: &mut EM,
127+
) -> Result<Self, Error>
128+
where
129+
EM: EventFirer<State = S> + EventRestarter,
130+
Z: HasObjective<Objective = OF, State = S>,
131+
{
132+
Ok(Self {
133+
observers,
134+
hooks,
135+
phantom: PhantomData,
136+
})
137+
}
138+
139+
/// The inprocess handlers
140+
#[inline]
141+
pub(crate) fn hooks(&self) -> &HT {
142+
&self.hooks
143+
}
144+
145+
/// The inprocess handlers (mutable)
146+
#[inline]
147+
pub(crate) fn hooks_mut(&mut self) -> &mut HT {
148+
&mut self.hooks
149+
}
150+
}

0 commit comments

Comments
 (0)