Search for other free cores when bind fails #68

qlyoung · 2020-01-18T05:18:31Z

Edit:
I just noticed this is quite similar to #63... coincidence! How should we handle this? Looks like #63 can be rebased on top of mine to add #ifdef ANDROID bits for inverting the search order and drop the rest? @JoeyJiao thoughts?

Under some circumstances, /proc may transparently lie to us, or we may
have cgroups invisibly that prevent us from binding to certain CPUs but
not others. In particular this shows up when running inside containers
with resource limits applied to them. This patch makes AFL continue to
try other CPU cores if the kernel rejects our attempt to bind to an
apparently free one, since others may succeed.

At first I wasn't sure this patch belonged in AFL, but since AFL generally tries to be smart about its environment when it helps the user, and this is a realistic case that AFL can solve itself without much overhead, I think it's appropriate.

I put some more details on how/why this manifests here: https://gist.github.com/qlyoung/abd217f977399003ba0cc277feca2af9

Here's how it looks after this patch when running in a Docker container with --cpuset-cpus 5,6:

afl-fuzz 2.56b by <[email protected]>
[+] You have 8 CPU cores and 4 runnable tasks (utilization: 50%).
[+] Try parallel jobs - see /usr/local/share/doc/afl/parallel_fuzzing.txt.
[*] Checking CPU core loadout...
[+] Found a free CPU core, attempting bind to #0.
[!] WARNING: Binding attempt failed; looking for another core...
[+] Found a free CPU core, attempting bind to #1.
[!] WARNING: Binding attempt failed; looking for another core...
[+] Found a free CPU core, attempting bind to #2.
[!] WARNING: Binding attempt failed; looking for another core...
[+] Found a free CPU core, attempting bind to #3.
[!] WARNING: Binding attempt failed; looking for another core...
[+] Found a free CPU core, attempting bind to #4.
[!] WARNING: Binding attempt failed; looking for another core...
[+] Found a free CPU core, attempting bind to #5.
[*] Checking core_pattern...
[*] Checking CPU scaling governor...
...

AFL continues as normal after that. Prior to this patch it simply aborted on a failed sched_setaffinity.

Signed-off-by: Quentin Young [email protected]

googlebot · 2020-01-18T05:18:34Z

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

What to do if you already signed the CLA

Individual signers

It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

googlebot · 2020-01-18T05:18:35Z

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.

What to do if you already signed the CLA

Individual signers

It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

qlyoung · 2020-01-18T05:22:31Z

@googlebot I signed it!

googlebot · 2020-01-18T05:22:34Z

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

googlebot · 2020-01-18T05:22:35Z

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

Under some circumstances, /proc may transparently lie to us, or we may have cgroups invisibly that prevent us from binding to certain CPUs but not others. In particular this shows up when running inside containers with resource limits applied to them. This patch makes AFL continue to try other CPU cores if the kernel rejects our attempt to bind to an apparently free one, since others may succeed. Signed-off-by: Quentin Young <[email protected]>

JoeyJiao · 2020-01-19T02:18:48Z

@qlyoung yes, they are similar but #63 has more change I think
For most android devices, cpu#0-3 is less power than cpu#4-7, so #63 prefers cpu#7 as the first candidate.
For intel platform, start from cpu#0 is better.

qlyoung · 2020-01-22T06:47:17Z

@JoeyJiao yeah I'd like to use your search method since that works for Android too, and I'd also like to keep my error messages / suggestions since they work for both android and my particular scenario, so I was thinking you could rebase on top of my commit to change the search algorithm in my patch to yours and we could merge the 2 commits, that seems like the cleanest resultant history and we both keep authorship.

Of course I could also rebase mine onto yours but my diff is bigger so it seemed easier to do it the other way round.

Dor1s

thanks for the patch, the logic looks good to me, I've just added some suggestions regarding coding style

Dor1s · 2020-08-05T23:22:01Z

afl-fuzz.c

-         cpu_core_count);
+  for (i = 0; i < cpu_core_count; i++) {
+
+    if (!cpu_used[i]) {


let's decrease the indentation by inverting the condition:

for (i = 0; i < cpu_core_count; i++) { if (cpu_used[i]) continue; <the code trying to bind> }

Dor1s · 2020-08-05T23:24:45Z

afl-fuzz.c

+      CPU_ZERO(&c);
+      CPU_SET(i, &c);
+
+      if (sched_setaffinity(0, sizeof(c), &c)) {


similar suggestion here:

if (!sched_setaffinity(0, sizeof(c), &c)) { cpu_aff = i; bound = 1; break; } saved_errno = errno; tried_bind++; WARNF("Binding attempt failed; looking for another core...");

Dor1s · 2020-08-05T23:25:26Z

afl-fuzz.c


-  if (i == cpu_core_count) {
+  int bound = 0;
+  int tried_bind = 0;


rename to bind_attempts

Dor1s · 2020-08-05T23:26:41Z

afl-fuzz.c

  }

-  OKF("Found a free CPU core, binding to #%u.", i);
+  if (!bound) {


... if (bound) return; <error reporting code here> }

qlyoung force-pushed the afl-continue-core-search branch from 55feb44 to ad6314b Compare January 18, 2020 05:32

Dor1s reviewed Aug 5, 2020

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Search for other free cores when bind fails #68

Search for other free cores when bind fails #68

qlyoung commented Jan 18, 2020 •

edited

Loading

googlebot commented Jan 18, 2020

googlebot commented Jan 18, 2020

qlyoung commented Jan 18, 2020

googlebot commented Jan 18, 2020

googlebot commented Jan 18, 2020

JoeyJiao commented Jan 19, 2020

qlyoung commented Jan 22, 2020 •

edited

Loading

Dor1s left a comment

Dor1s Aug 5, 2020

Dor1s Aug 5, 2020

Dor1s Aug 5, 2020

Dor1s Aug 5, 2020

Search for other free cores when bind fails #68

Are you sure you want to change the base?

Search for other free cores when bind fails #68

Conversation

qlyoung commented Jan 18, 2020 • edited Loading

googlebot commented Jan 18, 2020

What to do if you already signed the CLA

Individual signers

Corporate signers

googlebot commented Jan 18, 2020

What to do if you already signed the CLA

Individual signers

Corporate signers

qlyoung commented Jan 18, 2020

googlebot commented Jan 18, 2020

googlebot commented Jan 18, 2020

JoeyJiao commented Jan 19, 2020

qlyoung commented Jan 22, 2020 • edited Loading

Dor1s left a comment

Choose a reason for hiding this comment

Dor1s Aug 5, 2020

Choose a reason for hiding this comment

Dor1s Aug 5, 2020

Choose a reason for hiding this comment

Dor1s Aug 5, 2020

Choose a reason for hiding this comment

Dor1s Aug 5, 2020

Choose a reason for hiding this comment

qlyoung commented Jan 18, 2020 •

edited

Loading

qlyoung commented Jan 22, 2020 •

edited

Loading