Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-66464

use LLVMFuzzerRunDriver for OpMsgFuzzerFixture

    • Type: Icon: Bug Bug
    • Resolution: Unresolved
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • None
    • Service Arch
    • ALL

      The shutdown of the OpMsgFuzzer has been a persistent source of problems, becuase it currently demands that several objects survive into the static destructor phase, a requirement that never happens in other production or unit test code. It's going to be difficult to keep it working with hacky fixes as these objects and their dependencies evolve. We can avoid this lifespan requirement, though!

      The current state of ~OpMsgFuzzerFixture makes a new thread during process shutdown just to run its destructor. It's not clear that it's ok to launch new threads and create decorations etc during process shutdown. Not everything that this code touches is guaranteed to still be valid, and new static duration dependencies can arrive at any time. The idea of having a static duration object simulating a mongod interpreter is technically unsound.

      We should invoke Libfuzzer ourselves because we have special shutdown requirements.
      https://llvm.org/docs/LibFuzzer.html#using-libfuzzer-as-a-library

      That is, we should call this function from a main function that we control.
      The OpMsgFuzzerFixture could be local to that main function and have a more conventional lifetime.

      extern "C" int LLVMFuzzerRunDriver(int *argc, char ***argv,
                        int (*UserCb)(const uint8_t *Data, size_t Size));
      

      We are using the technique from the intro tutorial of using a static duration fixture, and providing an

      extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
      

      function, which doesn't work well for stateful tests. The problem with this simplified approach is that the fixture never knows when the last call to that function has occurred and it's time to shut down. Our needs are more sophisticated.

            Assignee:
            backlog-server-servicearch [DO NOT USE] Backlog - Service Architecture
            Reporter:
            billy.donahue@mongodb.com Billy Donahue
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: