AFLplusplus / AFLplusplus/LibAFL

Unmap LLMP Broker Pages eventually

Đang mở
#848 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
enhancement
Ngôn ngữ chính
Rust
Star
2.6k
Fork
481
Merge trung bình
2 ngày 30 phút
Pull request đã merge (30 ngày)
16

Mô tả

Right now, LLMP keeps pages from broker to the clients around indefinitely.
This is a deliberate choice: this way, a new client can be spawned and join fuzzing at any point in time and still replay all of the state.

However, this is an issue on low memory systems (...that cannot add enough swap) since all testcases may also be stored in memory, indefinitely this way.

Ideally, we'd have an optional feature in LLMP to delete old and unused broker pages.
To not crash newly spawned children, we are never allowed to remove the initial page, and we need to link the initial page to the currently active page before unmapping the next one.

It's definitely spicy WRT memory safety :)

For the pages from client to broker, we already have a method to reliably do this:
https://github.com/AFLplusplus/LibAFL/blob/4ccd85f568fe23f3012cb959a05e317c5ec405bd/libafl/src/bolts/llmp.rs#L928

From broker to client, we'll need proper ref counts on pages, and we have to unmap from oldest to newest page for this to work.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.