New issue
Advanced search Search tips

Issue 900487 link

Starred by 2 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: 2018-11-27
OS: ----
Pri: 1
Type: Bug

Blocked on:
issue 908887



Sign in to add a comment

More ANGLE fuzzing

Project Member Reported by och...@chromium.org, Oct 31

Issue description

We've seen quite a few bugs in ANGLE, which runs in the GPU process.  https://bugs.chromium.org/p/chromium/issues/list?can=1&q=component%3AInternals>GPU>ANGLE+type%3DBug-Security

Our fuzzing coverage is decent at 57% (https://chromium-coverage.appspot.com/reports/601457_fuzzers_only/linux/chromium/src/third_party/angle/src/report.html) but there is still plenty of code uncovered. 
 
(bulk comment)

To see the most recent code coverage report produced by the fuzz targets, use "latest" instead of the revision number in the URL to https://chromium-coverage.appspot.com/.

For example, https://chromium-coverage.appspot.com/reports/601457_fuzzers_only/linux/index.html needs to be changed to https://chromium-coverage.appspot.com/reports/latest_fuzzers_only/linux/index.html.
In particular, I think the D3D backend for ANGLE and other GPU code is untested because libFuzzer wasn't available on Windows. 
Now that libFuzzer works on Windows, this seems like a good target.
Cc: wfh@chromium.org
+wfh@

Here's a target that needs some Windows-specific coverage. :)
Components: Internals>GPU>ANGLE
yes, this does seem like a good target.
Regarding D3D fuzzing, we'd need some implementation of a D3D driver. What kind of systems do the fuzzing tests run on? Do they have a version of Windows that can use the "NULL" D3D device?

See https://docs.microsoft.com/en-us/windows/desktop/api/d3dcommon/ne-d3dcommon-d3d_driver_type - namely D3D_DRIVER_TYPE_NULL . This would at least remove the driver from the fuzzing.
Cc: metzman@chromium.org infe...@chromium.org
+ metzman@ and inferno@ regarding c#5.
>Regarding D3D fuzzing, we'd need some implementation of a D3D driver. What kind of systems do the fuzzing tests run on?

They are run on Windows Server 2016 on Google Cloud with no GPU (though this can be changed).

I think the OS supports D3D_DRIVER_TYPE_NULL but I'm not sure if it can do so with the hardware it has. Looking into how I can determine this.
If all we need to do is install the directx sdk as the document implies, then I think we can do that.
The documentation is maybe a decade out of date. There's no more directx SDK. But, the work would be figuring out what you need to install to support it. Likely either the Windows SDK or the Windows optional feature "graphics tools".
I'll try figuring this out. If there is some way you recommend for determining if the server supports the null driver (perhaps a command or small program) that would be very helpful, otherwise I can look into that too.
You can probably pretty easily download an isolate for Windows angle_perftests onto one of these machines and try running with the flag --gtest_filter=*d3d11_null* .

You can get the isolate from here for example:

https://chromium-swarm.appspot.com/task?id=414b7bf2cfac5510&refresh=10&show_raw=1

"Download inputs files into directory foo:
# (if needed) git clone https://chromium.googlesource.com/infra/luci/client-py
python ./client-py/isolateserver.py download -I https://isolateserver.appspot.com --namespace default-gzip -s 65103f0d3a12d317476d2ba8225233bf3972aee1 --target foo"

If you have access to depot_tools, you can clone the luci client here:

https://github.com/luci/luci-py

There's also a similar check we could do with angle_end2end_tests if perftests doesn't work for some reason.
NextAction: 2018-11-27
The commands you gave me were a bit hard to follow on the ClusterFuzz bots. 
Instead I built a local copy of angle_perftests and copied it to the bot. 
From the results of running the tests, it looks like the bots don't support null canvases:

PS C:\Users\clusterfuzz\Downloads> ./angle_perftests.exe --gtest_filter=*d3d11_null* .
Skipping tests using configuration ES2_OPENGL_NULL because it is not available.
Skipping tests using configuration ES2_VULKAN_NULL because it is not available.
Skipping tests using configuration ES2_OPENGL because it is not available.
Skipping tests using configuration ES2_VULKAN because it is not available.
Skipping tests using configuration ES3_1_OPENGL_NULL because it is not available.
Skipping tests using configuration ES3_1_OPENGL because it is not available.
Skipping tests using configuration ES2_OPENGLES because it is not available.
Skipping tests using configuration ES3_OPENGL because it is not available.

And then crashes that also seem to happen when I copy the perftests from out.


I'll try installing the Windows SDK or enabling graphics tools next.
The NextAction date has arrived: 2018-11-27
Blockedon: 908887
Cc: -wfh@chromium.org
Owner: wfh@chromium.org
Status: Assigned (was: Untriaged)
Will, did you plan to work on writing fuzzer(s) for this?

Sign in to add a comment