Skip to content

Commit 709b484

Browse files
authored
fuzzing: change linkerd_dns::fuzz_target_1 to single-threaded (#1191)
* fuzzing: change `linkerd_dns::fuzz_target_1` to single-threaded Something about the behavior of the fuzz logic for `linkerd_dns` is hitting [a recently added assertion][1] in Tokio's multithreaded runtime when shutting down. It's unclear what exactly triggers the assertion, but it appears to be environment-dependent in some way: I can't reproduce the failure on my machine using the reproducer generated by `cargo-fuzz`, but it fails reliably in cluster-fuzz (possibly related to the number of CPU cores on the cluster-fuzz servers?). Since the purpose of this fuzz test is to fuzz the DNS name parsing behavior, and this failure isn't actually related to the code being fuzzed, just the environment the fuzz test runs in, this branch changes the fuzz logic to use a single-threaded Tokio runtime. We'll continue trying to get a minimal repro of the crash to report upstream, but this should fix the fuzz test so that it can continue exercizing the DNS code we actually care about here. [1]: https://github.com/tokio-rs/tokio/blob/362df5a3172f6e1bdee2fd3808e5cfc730a111f6/tokio/src/runtime/thread_pool/worker.rs#L603 * use single-threaded rt in all fuzz targets (or, in all the ones that use tokio, anyway) Signed-off-by: Eliza Weisman <[email protected]>
1 parent f289aaf commit 709b484

File tree

3 files changed

+12
-3
lines changed

3 files changed

+12
-3
lines changed

linkerd/app/inbound/fuzz/fuzz_targets/fuzz_target_1.rs

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,10 @@ fuzz_target!(|requests: Vec<http_fuzz::HttpRequestSpec>| {
1313
return;
1414
}
1515

16-
tokio::runtime::Runtime::new()
16+
tokio::runtime::Builder::new_current_thread()
17+
.enable_time()
18+
.enable_io()
19+
.build()
1720
.unwrap()
1821
.block_on(http_fuzz::fuzz_entry_raw(requests));
1922
});

linkerd/dns/fuzz/fuzz_targets/fuzz_target_1.rs

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,10 @@ fuzz_target!(|data: &[u8]| {
1010
let _trace = linkerd_tracing::test::with_default_filter("off");
1111
if let Ok(s) = std::str::from_utf8(data) {
1212
tracing::info!(data = ?s, "running with input");
13-
tokio::runtime::Runtime::new()
13+
tokio::runtime::Builder::new_current_thread()
14+
.enable_time()
15+
.enable_io()
16+
.build()
1417
.unwrap()
1518
.block_on(linkerd_dns::fuzz_logic::fuzz_entry(s))
1619
}

linkerd/proxy/http/fuzz/fuzz_targets/fuzz_target_1.rs

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,10 @@ fuzz_target!(|data: &[u8]| {
88
// Don't enable tracing in `cluster-fuzz`, since we would emit verbose
99
// traces for *every* generated fuzz input...
1010
let _trace = linkerd_tracing::test::with_default_filter("off");
11-
tokio::runtime::Runtime::new()
11+
tokio::runtime::Builder::new_current_thread()
12+
.enable_time()
13+
.enable_io()
14+
.build()
1215
.unwrap()
1316
.block_on(linkerd_proxy_http::detect::fuzz_logic::fuzz_entry(data))
1417
});

0 commit comments

Comments
 (0)