Repository navigation
fuzz: v8 page targets that reach their decoders; keep the corpus between runs (#387, #375) - #498
Merged
Merged
Conversation
…een runs (#387, #375) On v3, btree_page and fact_page still wrote the pre-release single-header layout and stopped at STG-032 on every input; file_header rarely got past the meta CRC. The page targets now start from a v8 file built through the public API and rewritten with LogWriter at fixed tx times, so its bytes and the seeds cut from it are the same in every process. A target overwrites one page with the input and recomputes that page's checksum, so the input reaches the decoder: - btree_page: any leaf or internal node of the five trees (#375) - file_header: either meta slot, with or without a matching CRC - fact_page: the fact page of a v7 golden file, migrated or loaded read-only Each run executes one input-chosen probe query or verify(), which keeps executions fast under ASan. The nightly workflow runs every target in its own parallel job, on main and v3 on alternating crons (scheduled runs use main's copy of the file), and keeps each target's corpus in the Actions cache. fuzz-corpus.yml minimizes the cached corpus weekly, keeps committed seed_* files, and proposes it as a pull request. The new targets found #496 (a v7 fact page with a damaged type byte is dropped by migration) and #497 (open trusts the meta page_count). Refs #387 Refs #375 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012wXxZguv7PgKQjMMH4yJ5h
This was referenced Oct 9, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This was referenced Oct 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #387, Refs #375 (tracker #383). PR A of two for #387; PR B adds the
ops_sequenceandcorrupt_filetargets. A workflow-only PR tomainfollows, because scheduled runs usemain's copy offuzz.yml.Why
v3,btree_pageandfact_pagestill wrote the pre-release single-header layout and stopped atSTG-032on every input.file_headerrarely got past the meta CRC. So v8 node, meta and v7-migration decoding got no fuzz coverage.main. v3 code has not been fuzzed at night.What
Page targets (
fuzz/fuzz_targets/common/mod.rs): a v8 template built through the public API (90 entities, a long value, a fact-level window, a retraction), rewritten withLogWriterat fixed tx times. Its bytes and the seeds cut from it are therefore the same in every process. One batch means every tree page is reachable and nothing is freed. A target overwrites one page and recomputes that page's CRC (crc32fast, per spec §4), so the input reaches the decoder:btree_pagefile_headerfact_pagetests/golden/v7_basic.graph, through migration or the read-only loadEach run executes one input-chosen probe: a query over EAVT, AEVT, AVET, VAET, the DICT,
:valid-ator:as-of, orverify(). With all of them on every input, the targets managed only ~8 exec/s under ASan.Workflows (identical on
mainandv3):fuzz.yml: two crons,mainat 04:00 andv3at 16:00, likebench.yml/crash-kill.yml. Atargetsjob reads the branch's[[bin]]list, each target fuzzes in its own parallel job (wall time ~1 h instead of ~5.5 h), and the corpus is restored from and saved toactions/cacheper branch and target.-timeout=60catches a hang quickly instead of after libFuzzer's default 1200 s. Failures go to "Nightly fuzz failure ()".fuzz-corpus.yml: weeklycargo fuzz cminper target. It keeps every committedseed_*file, saves the result to the cache, and force-pushesbot/fuzz-corpus-<branch>, then opens or updates a PR. The repository setting "Allow GitHub Actions to create and approve pull requests" is off. Until it is turned on, the job pushes the branch and puts a compare link in the job summary.Spec:
docs/superpowers/specs/2026-10-09-fuzz-corpus-and-ops-target-design.md. Plan:docs/superpowers/plans/2026-10-09-fuzz-corpus-and-page-targets.md.Verification
storage/node.rs(not committed). The valid leaf and internal seeds decode the fuzzed page, every probe returns the full answer, andverify()is clean. The truncated-slot and type-flipped seeds decode the fuzzed page and fail withINT-049.btree_page(~57 exec/s),fact_page(~900),wal_entry,datalog_parserordatalog_eval.file_headerfound a hang within seconds. That is Open trusts the meta page_count: truncated files open, a page_count past EOF grows the file to EiB, verify() hangs #497 below.workflow_dispatchsmoke run (60 s per target) on this branch: see the run linked in the comments.Findings (filed, not fixed here)
fact_page.page_count. A truncated file opens, a CRC-validpage_countpast EOF opens and the next checkpoint grows the file to 4 EiB (sparse), andverify()hangs on it. Found byfile_header. Until Open trusts the meta page_count: truncated files open, a page_count past EOF grows the file to EiB, verify() hangs #497 is fixed, the nightlyv3run offile_headerwill report this hang. The input is on the issue and becomes a seed with the fix.No library code changes. The fuzz crate is not part of the published package.
🤖 Generated with Claude Code
https://claude.ai/code/session_012wXxZguv7PgKQjMMH4yJ5h