Skip to content

Multi-Core Slowdown on LibZAFL linked Binaries

First issue here, so sorry if I don't meet the normal standards :).

When running multiple binaries linked with LibZAFL, a noticeable slowdown occurs in fuzzing executions per second. As an example, ZAFLize objdump from binutils, and run it with this script:

for i in `seq 1 16`; do
    AFL_SKIP_BIN_CHECK=1 afl-fuzz -S $i -i input/ -o output/ -- ./objdump.zafl -D -h @@ >/dev/null 2>&1 &
done
AFL_SKIP_BIN_CHECK=1 afl-fuzz -M master -i input/ -o output/ -- ./objdump.zafl -D -h @@
pkill afl-fuzz

For the most part, this should launch 16 instances fuzzing objdump.zafl. When fuzzing the ZAFLed binary with a single core, you should notice a considerably high speed as compared to a QEMU fuzzed version. The speed on one core should be around 1100/sec. If you run that same ZAFLed binary in 16 cores with the above code, you will notice a considerable slowdown. On 16 cores (give or take since core scheduling can collide), you will get 750/sec. This number gets progressively worse with cores. Running this on 32 cores I get 125/sec.

It's important to note that when testing QEMU based fuzzing (-Q in AFL on non ZAFLed binary), the impact of multi-core is non-consequential (around 50 exec/sec lost).

Attached is the binaries used for fuzzing. Please run on Ubuntu 18.04. objdump objdump.zafl