<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/87468>87468</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
[libfuzzer] coverage output of libfuzzer doesn't show correct number when you are using __libfuzzer_extra_counters
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
R00tkitSMM
</td>
</tr>
</table>
<pre>
when you are useing __libfuzzer_extra_counters to update the coverage with kcov ( or any other coverage feedback)
you don't get correct **cov** number in output.
maybe I have to configure something.
```
#include <errno.h>
#include <fcntl.h>
#include <linux/bpf.h>
#include <memory.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <stddef.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <time.h>
void fail(const char* msg, ...);
void cover_start();
void cover_stop();
extern "C" int LLVMFuzzerTestOneInput(const char* data, long size)
{
cover_start();
truncate(data, size);
cover_stop();
return 0;
}
#define KCOV_COVER_SIZE (256 << 10)
#define KCOV_TRACE_PC 0
#define KCOV_INIT_TRACE64 _IOR('c', 1, uint64_t)
#define KCOV_ENABLE _IO('c', 100)
__attribute__((section("__libfuzzer_extra_counters"))) unsigned char libfuzzer_coverage[32 << 10];
uint64_t* kcov_data;
extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv) {
int kcov = open("/sys/kernel/debug/kcov", O_RDWR);
if (kcov == -1)
fail("open of /sys/kernel/debug/kcov failed");
if (ioctl(kcov, KCOV_INIT_TRACE64, KCOV_COVER_SIZE))
fail("cover init trace write failed");
kcov_data = (uint64_t*)mmap(NULL, KCOV_COVER_SIZE * sizeof(kcov_data[0]),
PROT_READ | PROT_WRITE, MAP_SHARED, kcov, 0);
if (kcov_data == MAP_FAILED)
fail("cover mmap failed");
if (ioctl(kcov, KCOV_ENABLE, KCOV_TRACE_PC))
fail("cover enable write trace failed");
close(kcov);
return 0;
}
void cover_start()
{
__atomic_store_n(&kcov_data[0], 0, __ATOMIC_RELAXED);
}
#include <iostream>
#include <set>
std::set<uint64_t> uniqueNumbers;
void cover_stop()
{
uint64_t ncov = __atomic_load_n(&kcov_data[0], __ATOMIC_RELAXED);
if (ncov >= KCOV_COVER_SIZE)
fail("too much cover: %llu", ncov);
for (uint64_t i = 0; i < ncov; i++) {
uint64_t pc = __atomic_load_n(&kcov_data[i + 1], __ATOMIC_RELAXED);
auto it = uniqueNumbers.find(pc);
if (it == uniqueNumbers.end()) {
uniqueNumbers.insert(pc);
printf("all pc %lu new uniq pc %lx\n",uniqueNumbers.size(), pc);
}
libfuzzer_coverage[pc % sizeof(libfuzzer_coverage)]++;
}
}
void fail(const char* msg, ...)
{
int e = errno;
va_list args;
va_start(args, msg);
vfprintf(stderr, msg, args);
va_end(args);
fprintf(stderr, " (errno %d)\n", e);
_exit(1);
}
```
so my printf shoes huge amount of new hits but output is not
after some seconds:
```
all 1058 new uniq pc ffffffff823d8cc1
all 1059 new uniq pc ffffffff81a294b4
all 1060 new uniq pc ffffffff81a27a28
all 1061 new uniq pc ffffffff81a27a53
#9064 NEW cov: 77 ft: 1409 corp: 70/481b lim: 29 exec/s: 1812 rss: 27Mb L: 29/29 MS: 2 CopyPart-InsertRepeatedBytes-
#9125 REDUCE cov: 77 ft: 1427 corp: 71/496b lim: 29 exec/s: 1825 rss: 27Mb L: 15/29 MS: 1 CopyPart-
#9141 NEW cov: 77 ft: 1430 corp: 72/525b lim: 29 exec/s: 1828 rss: 27Mb L: 29/29 MS: 1 CopyPart-
#9690 REDUCE cov: 77 ft: 1430 corp: 72/522b lim: 33 exec/s: 1938 rss: 27Mb L: 18/29 MS: 4 ChangeByte-EraseBytes-EraseBytes-PersAutoDict- DE: "\331\\\302\201\377\377\377\377"-
#10037 REDUCE cov: 77 ft: 1430 corp: 72/521b lim: 33 exec/s: 1672 rss: 27Mb L: 17/29 MS: 2 InsertRepeatedBytes-EraseBytes-
#10098 REDUCE cov: 77 ft: 1430 corp: 72/510b lim: 33 exec/s: 1683 rss: 27Mb L: 18/29 MS: 1 EraseBytes-
#10401 NEW cov: 77 ft: 1453 corp: 73/537b lim: 33 exec/s: 1733 rss: 27Mb L: 27/29 MS: 3 CopyPart-CrossOver-CopyPart-
#11827 REDUCE cov: 77 ft: 1453 corp: 73/536b lim: 43 exec/s: 1689 rss: 27Mb L: 8/29 MS: 1 EraseBytes-
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJy0WF9zozgS_zTKS1dSIIyBhzw42K5zXTKZ8mR3r-6FEtDYusGSTxKZeD_9lYT_YBuc7F3dlIsBdav71_8VMa35SiA-kvCJhNM71pi1VI9LzzM_ufnx8nKXy3L3-GuNAnayAaYQGo1crACyrOZ51fz5J6oMP4xiWSEbYVBpMBKabckMglkjFPIdFVsh_OJmDT8L-Q6ExiAVMLEDadaoTjwVYpmz4iehCRBvSryJ1VtKQWhkYIUGCqkUFgYInRA6KeR7-wKi2eSogAuQjdk25qHd3j43bJcjLGDN3tHCK6So-KpRCFpu0Ky5WJ3xk7G3_7WfNOCiqJsSgQQpKiXkw5oEsz5qVQhTD1JrLpoPQuf5thrk2eBGqt0gWZuSqdUtMhfmJnkYvDZlzfNh8k4TOueyuGFhy7PZMPEJizbsBsyWZacLVn-my-y2qAd5GsG1Kf9P_jDKZs4gma8Eu4HelCUOp4FAwwUa6_BhV3aYtl9gMsUwF1Nb5pThZ2G57fCvR1cWP2_o-l_K7AtJaPgGu8Sr57vkJVSM14TGhRTaQLFmyraajV4RmsLDwwOhCQmeOvyukWXaMGUIjQfJcntBbZ_4YVAJIJSmhFLgwsDz8-8vc9dl31CbV4ELsW3MFaSSGWYx1VKsQPM_0QpvJUdHFckwOuIlRjWiYAYJjQ_SDoIOXNCRcWUCAIBC0ygBXlcuiaY9LqZBiRUXCH9PX3_P0tffZ8vsx-KfMzsbaDi2ESJBCr53MuR8y9tyks6y7yl4veTFt8VbyzMeQbZ4XTq0UUFoZC3z7aPhwoxHmRlSMfs2eXqe2d0Xm70OKvfMMmaM4nljMMscc6yxMNzOrZhQOjwsCaVWlvtBI9w8Ll1Y4bTlMB5J-BTQjmvC6dHRJ1smbsZmLobn6fWFJFsIbjirXdxjSyJ0wtSqsGY7UO20bVff3ZTu5Jfd0A74YApyi3vr205O6PwnKoE1ofMS82ZlF9z8plb6a7ac_rG8yEle2Xw4iLRS7_2O6xPiJfsKJZRahSDtjlvqXEljuff7lS433PY6LayrZDounnJ2H8BeUC50wAU3YBQrEH4pbnAQxDF0zoWExp24EppsNsyW3bffnp97cNjguJqV1d6CNgvCJ5cqFmXaRdn-bN1-X76-ZcvZZAokStuvP5aLt5lV8jL5nv3422Q5m9qvg1-8wUgd4VsL7Ob5ZPE8m37iIWvZfxOatkaPn4eu8HlIULC8PoSjDc2Q-qKWGo-KL5u2bYrXfe-86Q3MhqsGbfuI3PDC9leFWVs_4-tIOv-nkGWTt9eXRZotZ8-Tf7Q-HkDQNwK51EYh2wwNUTRHijYlCSYkmLjF9JiVwQwawf_d4Dd3_NYXvukfeldmH8SBODSPoyNqycpbfrjpgkPm7MXOrOSe2u3NEiMlbJpi3cInwQQIDeu62bcrcZULJzmVVN3SBe5MssnhXveb7RehT-533ka7HtkWX_MHB0KfwP-aV7pgiZewxkjgxik6i-ZDxUVJaLwtLk8Bp6I0h1I_34lu436uHY3bbz1n5UKjK4lzNd0etVVcmKoNDKtr5xUa1g0I_OUUH1Y-SJiKNkTnStqjTAsohV6D-ivGkXpHcavy1HB7mGjiAuKC3Hsk6lP51YPnVRnZ8Ysuiu7s3NX4zrKaawNMrfTF-qEhORJNWyVnYXivjv7XpkSljmxpK_CCnWVt9HtofZLsKYTQ2GG2Hi2d2w5hBLwQkeEHt3j9W93u4u_3zlNL2OyghQF6LVHDulkhsI09kdnzg82pNTca8sbsLxOAaxDSQFcQqwwqd38AGgspSm075HUCHaDsN9v09b0whrPcrfb_YhqUcVH4Z7zJAK_PaDLKR13esTfMGzEan_H6t3jD4DgTEm88Il7ybfaHPSu43jWBKILK2Bd_5CVQSLV1qx6h81Hs51DzjV2gCeAHFvZM5phjn4LS7p1GLzk8t0yEzmkCLz_cF6Ryu_vOlLlfuNawxC0yg-XTzqC-P8HyaUi8ZDmb_pbOemDR6ATLt7CS8TAsGl7D8sMuLP8EqwNh5N_yTOCdINhjcEjDGxDizzzTC2GceLe8cA2BHiEEwTmEJOiB4MddCCNI10ys0MbifqaYxjYqndfvqPSkMXLKC3MP01k7OykJ0yDwSZi2v8CzK9SzK0EU9TwpPVnpe14Q_TUz_UEzx1FPDvrReQ72pV7HyC6yJP5LyHxvGFkcfBYAH_pRjLybmRgGJxSBRRFEgyiioAcFPfNPcMrEVEmtX99R3V8np-_H9GbYrmGdanR05ZzkGtanvhmeBHflY1AmQcLu8NGPfOoHY28U3q0fAy8ahVjEZVKVdFRFZR74RZXneVGVeZmP7vgj9ejIG3mBl1BvFD7EYVRUccCoV3pVFRRk5OGG8fqhrt83D1Kt7rjWDT7G0Wgc39Usx1q7S3dKbQd2RFci0zv1aPfc581Kk5Fnh7Y-STHc1O62_njWIOH0dHu-H1ayOt0dQClRt7fnei1_Ha_P99flF1f7XKxuXOzfNap-XBuzdZOOzgmdr7hZN_lDITeEzi3M_X_3WyX_hYW7mLTG2T_HnfH_CQAA__9zjuzh">