Skip to content
  • Qiuhao Li's avatar
    e72203ab
    fuzz: split write operand using binary approach · e72203ab
    Qiuhao Li authored
    
    
    Currently, we split the write commands' data from the middle. If it does not
    work, try to move the pivot left by one byte and retry until there is no
    space.
    
    But, this method has two flaws:
    
    1. It may fail to trim all unnecessary bytes on the right side.
    
    For example, there is an IO write command:
    
      write addr uuxxxxuu
    
    u is the unnecessary byte for the crash. Unlike ram write commands, in most
    case, a split IO write won't trigger the same crash, So if we split from the
    middle, we will get:
    
      write addr uu (will be removed in next round)
      write addr xxxxuu
    
    For xxxxuu, since split it from the middle and retry to the leftmost byte
    won't get the same crash, we will be stopped from removing the last two
    bytes.
    
    2. The algorithm complexity is O(n) since we move the pivot byte by byte.
    
    To solve the first issue, we can try a symmetrical position on the right if
    we fail on the left. As for the second issue, instead moving by one byte, we
    can approach the boundary exponentially, achieving O(log(n)).
    
    Give an example:
    
                       xxxxuu len=6
                            +
                            |
                            +
                     xxx,xuu 6/2=3 fail
                            +
             +--------------+-------------+
             |                            |
             +                            +
      xx,xxuu 6/2^2=1 fail         xxxxu,u 6-1=5 success
                                     +   +
             +------------------+----+   |
             |                  |        +-------------+ u removed
             +                  +
       xx,xxu 5/2=2 fail  xxxx,u 6-2=4 success
                               +
                               |
                               +-----------+ u removed
    
    In some rare cases, this algorithm will fail to trim all unnecessary bytes:
    
      xxxxxxxxxuxxxxxx
      xxxxxxxx-xuxxxxxx Fail
      xxxx-xxxxxuxxxxxx Fail
      xxxxxxxxxuxx-xxxx Fail
      ...
    
    I think the trade-off is worth it.
    
    Signed-off-by: default avatarQiuhao Li <Qiuhao.Li@outlook.com>
    Reviewed-by: default avatarAlexander Bulekov <alxndr@bu.edu>
    Tested-by: default avatarAlexander Bulekov <alxndr@bu.edu>
    Message-Id: <SYCPR01MB3502D26F1BEB680CBBC169E5FCAB0@SYCPR01MB3502.ausprd01.prod.outlook.com>
    Signed-off-by: default avatarThomas Huth <thuth@redhat.com>
    e72203ab
    fuzz: split write operand using binary approach
    Qiuhao Li authored
    
    
    Currently, we split the write commands' data from the middle. If it does not
    work, try to move the pivot left by one byte and retry until there is no
    space.
    
    But, this method has two flaws:
    
    1. It may fail to trim all unnecessary bytes on the right side.
    
    For example, there is an IO write command:
    
      write addr uuxxxxuu
    
    u is the unnecessary byte for the crash. Unlike ram write commands, in most
    case, a split IO write won't trigger the same crash, So if we split from the
    middle, we will get:
    
      write addr uu (will be removed in next round)
      write addr xxxxuu
    
    For xxxxuu, since split it from the middle and retry to the leftmost byte
    won't get the same crash, we will be stopped from removing the last two
    bytes.
    
    2. The algorithm complexity is O(n) since we move the pivot byte by byte.
    
    To solve the first issue, we can try a symmetrical position on the right if
    we fail on the left. As for the second issue, instead moving by one byte, we
    can approach the boundary exponentially, achieving O(log(n)).
    
    Give an example:
    
                       xxxxuu len=6
                            +
                            |
                            +
                     xxx,xuu 6/2=3 fail
                            +
             +--------------+-------------+
             |                            |
             +                            +
      xx,xxuu 6/2^2=1 fail         xxxxu,u 6-1=5 success
                                     +   +
             +------------------+----+   |
             |                  |        +-------------+ u removed
             +                  +
       xx,xxu 5/2=2 fail  xxxx,u 6-2=4 success
                               +
                               |
                               +-----------+ u removed
    
    In some rare cases, this algorithm will fail to trim all unnecessary bytes:
    
      xxxxxxxxxuxxxxxx
      xxxxxxxx-xuxxxxxx Fail
      xxxx-xxxxxuxxxxxx Fail
      xxxxxxxxxuxx-xxxx Fail
      ...
    
    I think the trade-off is worth it.
    
    Signed-off-by: default avatarQiuhao Li <Qiuhao.Li@outlook.com>
    Reviewed-by: default avatarAlexander Bulekov <alxndr@bu.edu>
    Tested-by: default avatarAlexander Bulekov <alxndr@bu.edu>
    Message-Id: <SYCPR01MB3502D26F1BEB680CBBC169E5FCAB0@SYCPR01MB3502.ausprd01.prod.outlook.com>
    Signed-off-by: default avatarThomas Huth <thuth@redhat.com>
Loading