fuzz: port solana-rbpf's fuzzer

[hsqStephenZhang]

I'm intended to port https://github.com/solana-labs/rbpf/tree/main/fuzz back here. Just to ask, is it wanted?

Compared with ubpf's fuzz, solana-rbpf used arbitrary for structured fuzz, which is more efficient.

[qmonnet]

Thanks a lot for asking first.

I can't tell for sure until we've got a PR, obviously, but it doesn't look too big so I've got no objection. My only experience with Rust fuzzing is with Bolero, I've never looked at arbitrary. I suppose the objective is to find bugs in the interpreter or JIT? Do you know how solana_rbpf used to run it? I haven't checked their GH workflows. Is there any particular maintenance for the fuzzer that is to be expected, other than fixing the bugs that it finds? For example, does it require to be updated often if the code of rbpf changes?

Thanks for the other PRs by the way. May I ask what you're using rbpf for, and what drives you to port the fuzzer?

[hsqStephenZhang]

Thanks for the reply.

It still takes some time to dig into solana-rbpf's fuzz, since it might involve changes to other parts of the project. But in general, I think a fuzzer would be very helpful.

In fact, the previous several bugs are found by cargo-fuzz, where i ported some logic from ubpf. But it's based on totally randomized bytes input(and then try to parse as valid instructions), so it has very low efficiency to generate valid ones. That's why solana-rbpf's structured ebpf fuzzer shines.

I had built https://github.com/hsqStephenZhang/ubpf-rs long time a log, but mostly for fun and learn, and that project is not well-maintained. I'm trying to make rbpf better since it's more used. https://github.com/DragonOS-Community/DragonOS is one of rbpf's biggest users, I thought it would be great if rbpf is more robust(it already is actually).