0% stability on v3

[wtdcode]

@Evian-Zhang

https://github.com/AFLplusplus/unicornafl/blob/v3/src/forkserver.rs#L262-L264

Could you confirm this write is really necessary?

[wtdcode]

Current unicornafl has 0% stability. I guess the root cause is also this.

[Evian-Zhang]

I will check this a few hours later.

[wtdcode]

The logic seems from old uincornafl but I can't understand my old code =(.

Anyway the isssue I'm trying resolve is that unicornafl (v3) now reports 0% stability.

[wtdcode]

https://github.com/AFLplusplus/unicornafl/blob/main/unicornafl.cpp#L309-L312

These lines seem missing.

[wtdcode]

I confirm using std::process::exit(0) here does the trick.

Sorry I should not use this hack =p.

[Evian-Zhang]

I saw this commit. Does this solve the 0-stability issue?

I really doubt the effectiveness, in the version before this commit, the whole communication of last round is:

1. child finishes execution, sends NEXT, and exit since the loop is done
2. parent get this message in the loop of handle_child_requests, and since it is NEXT, the loop is break out to continue the next persistent loop.
3. In the next persistent loop, the parent try to spawn a child, and since the last_child_ret is NEXT, it tries to write to the parent pipe. However, since child has exited, the write fails, and we set the last_child_ret to EXITED, and retry spawning.

I think this procedure is the same as the version after this commit.🤔

[wtdcode]

In the next persistent loop, the parent try to spawn a child, and since the last_child_ret is NEXT, it tries to write to the parent pipe. However, since child has exited, the write fails, and we set the last_child_ret to EXITED, and retry spawning.

This is racy. We might complete the write to child before child exits.

[Evian-Zhang]

Make sense. So does the 0-stability issue remain?

[wtdcode]

I'm having 100% stability now, and we should resolve the cmplog issue now. Also see AFLplusplus/LibAFL#3238

Currently enabling cmplog fails to solve the most simple case in sample.rs. You might have a try too.

Note it doesn't require AFLplusplus/AFLplusplus#2419 and you can simply do:

afl-fuzz -i /tmp/
input -o /tmp/test -g 8 -G8 -c ./target/release/examples/sample  -- ./target/release/examples/sample @@

[wtdcode]

Closing and move to #41 for cmplog issue.

[Evian-Zhang]

Sure. I will see to the cmplog issue. I also send a PR (#42 ) since the crash state also may lead to a race condition. (Sry for the bug, anyway🥺)