Sfoglia il codice sorgente

fuzz: improve docs for memory settings (#208)

* fuzz: improve docs for memory settings

* wording improvement

* Add instructions for more optimal fuzzing

---------

Co-authored-by: y <y>
greptile 2 anni fa
parent
commit
8a806b2cfc
2 ha cambiato i file con 52 aggiunte e 1 eliminazioni
  1. 3 1
      doc/src/development/contribute.md
  2. 49 0
      fuzz/README.md

+ 3 - 1
doc/src/development/contribute.md

@@ -82,13 +82,15 @@ This will list the available fuzzing targets. Choose one and run it with:
 ```
 ```
 # format: cargo fuzz run TARGET
 # format: cargo fuzz run TARGET
 # e.g. if `serial` is your target:
 # e.g. if `serial` is your target:
-$ cargo fuzz run --all-features serial 
+$ cargo fuzz run --all-features -s none --jobs $(nproc) serial 
 ```
 ```
 
 
 This process will run infinitely until a crash occurs or until it is cancelled by the user.
 This process will run infinitely until a crash occurs or until it is cancelled by the user.
 
 
 If you are able to trigger a crash, get in touch with the DarkFi team via irc.
 If you are able to trigger a crash, get in touch with the DarkFi team via irc.
 
 
+Further information on fuzzing in DarkFi is available [here](https://github.com/darkrenaissance/darkfi/blob/master/fuzz/README.md).
+
 ## Troubleshooting
 ## Troubleshooting
 
 
 The `master` branch is considered bleeding-edge so stability issues can occur. If you
 The `master` branch is considered bleeding-edge so stability issues can occur. If you

+ 49 - 0
fuzz/README.md

@@ -6,6 +6,49 @@ re-organized as we expand the complexity of the tests.
 This document covers the usage of `libfuzzer`. An alternative fuzzing
 This document covers the usage of `libfuzzer`. An alternative fuzzing
 tool `honggfuzz` and its related files are located in `fuzz/honggfuzz`.
 tool `honggfuzz` and its related files are located in `fuzz/honggfuzz`.
 
 
+## Install
+```sh
+cargo install cargo-fuzz
+```
+
+## Usage
+```sh
+# List available targets
+$ cargo fuzz list
+# Run fuzzer on a target
+# format: cargo fuzz run TARGET
+# e.g. if `serial` is your target:
+$ cargo fuzz run serial 
+```
+
+This process will run infinitely until a crash occurs or until it is cancelled by the user.
+
+### Optimization
+Fuzzing benefits from running as many tests as possible, so optimizing our time
+and throughput is very important. The number of jobs used by the computer
+can be increased by passing the following argument:
+
+```sh
+--jobs $(nproc)
+```
+
+The Address Sanitizer can be disabled for any Rust code that does not use `unsafe`:
+
+```sh
+-s none
+```
+
+The flags `--release`, `--debug-assertions` also improve throughput and are enabled
+by default.
+
+In the case of DarkFi, we also want to supply `--all-features`.
+
+In summary, a more efficient way to fuzz safe Rust code is the following:
+
+```sh
+cargo fuzz run --jobs $(nproc) -s none --all-features TARGET 
+```
+
 ## Building the corpora
 ## Building the corpora
 
 
 ### Motivation
 ### Motivation
@@ -57,6 +100,7 @@ simplify the fuzz harness instead to reduce its code coverage. If the
 harness is targeting a high-level function, try isolating the problem
 harness is targeting a high-level function, try isolating the problem
 and fuzzing a lower-level function instead.
 and fuzzing a lower-level function instead.
 
 
+### Increasing allowed memory usage
 It is possible to increase the amount of memory libFuzzer is allowed to use by passing an argument
 It is possible to increase the amount of memory libFuzzer is allowed to use by passing an argument
 to it via libFuzzer like so:
 to it via libFuzzer like so:
 
 
@@ -64,6 +108,11 @@ to it via libFuzzer like so:
 cargo fuzz run --all-features zkas-decoder -- "-rss_limit_mb=4096"
 cargo fuzz run --all-features zkas-decoder -- "-rss_limit_mb=4096"
 ```
 ```
 
 
+To disable memory limits entirely, pass the argument:
+```sh
+"-rss_limit_mb=0"
+```
+
 However, this is unlikely to resolve the issue due to differences in
 However, this is unlikely to resolve the issue due to differences in
 the fuzzing architecure vs. DarkFi's intended build targets.
 the fuzzing architecure vs. DarkFi's intended build targets.