fuzz: improve ipc fuzz coverage #35916

enirox001 commented at 1:16 PM on August 6, 2026: contributor

This PR follows up on #35118 and continues the IPC fuzzing work proposed in #23015.

The initial ipc fuzz target exercised normal calls through a libmultiprocess client and server. This PR extends the target with

Server side assertions that verify arguments arrive unchanged (https://github.com/bitcoin/bitcoin/pull/35118#issuecomment-4452992198 and #35118#pullrequestreview-4539477599)
A callback call that exercises ipc communication in both directions.
Raw capnp requests containing arbitrary transaction and UniValue payloads, which are deserialized by a normal libmultiprocess server.
Raw capnp responses containing arbitrary transaction and UniValue payloads, which are deserialized by a normal libmultiprocess client.

The raw request and response cases allow the fuzz target to exercise deserialization with data that was not first produced by libmultiprocess serialization.

The ipc setup and callback handling closely follow the existing libmultiprocess tests, particularly their use of EventLoop, ProxyClient, ProxyServer, two-way pipes, and initThreadMap.

The transaction and UniValue payload cases exercise the serialization hooks defined in common-types.h.

These files may provide useful background when reviewing the changes.

Generated coverage report after fuzzing the IPC target for a while using the qa-assets corpus.

fuzz: assert IPC arguments on server side

Keep a reference to the IPC fuzz implementation so fuzz inputs can be compared
directly with values deserialized by the proxy server.

This ensures serialization errors are detected on the client to server path instead
of potentially being hidden by the return trip.

9270ace9bb

fuzz: exercise IPC callback

Add a callback interface to the IPC fuzz target so requests exercise communication
from the server back to the client.

Check the callback argument and return value on both sides.

7bae915235

DrahtBot added the label Fuzzing on Aug 6, 2026

DrahtBot commented at 1:16 PM on August 6, 2026: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35916.

Reviews

See the guideline and AI policy for information on the review process.

Type	Reviewers
Stale ACK	jeanpablojp

If your review is incorrectly listed, please copy-paste <code></code> into the comment that the bot should ignore.

Conflicts

Reviewers, this pull request conflicts with the following ones:

#36087 (util: Add and use AssertUnreachable by maflcko)
#35975 (wallet: Fix CWalletTx malleated transaction metadata sync by achow101)
#32387 (ipc: add windows support by ryanofsky)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

enirox001 renamed this:
~~fuzz: improve IPC fuzz coverage~~
fuzz: improve ipc fuzz coverage
on Aug 6, 2026

jeanpablojp commented at 3:40 PM on August 15, 2026: contributor

tACK bd24122dfbfbaded49ef551c01184b4b5b48e27f

All green, and it matches the follow-up #35118 asked for.

in src/ipc/test/fuzz/ipc.cpp:180 in bd24122dfb outdated

 175 | +            m_client->m_context.loop->m_task_set->add(request.send().then(
 176 | +                [&](auto&&) {
 177 | +                    done.set_value();
 178 | +                },
 179 | +                [&](kj::Exception&& exception) {
 180 | +                    done.set_exception(std::make_exception_ptr(

jeanpablojp commented at 3:40 PM on August 15, 2026:

Took me a bit to see why sendTransactionPayload swallows FAILED while sendUniValuePayload treats any kj error as fatal. That's correct, but you only get it by reading the hooks. A one-line comment would have helped, feel free to ignore.

                    // UniValue deserialization never throws (read() failure is ignored), so any kj error is unexpected.
                    done.set_exception(std::make_exception_ptr(

enirox001 commented at 11:33 AM on August 26, 2026:

Yes, I agree that this can be clarified a bit more, added the suggested comment to clarify why any KJ error is unexpected here. Thanks

enirox001 force-pushed on Aug 26, 2026

fuzz: send malformed IPC request payloads

Use the underlying capnp client to send arbitrary transaction data and JSON text to the
libmultiprocess server.

Accept normal transaction deserialization failures while surfacing unexpected IPC errors.

4a2bdca741

fuzz: return malformed IPC response payloads

Connect a normal libmultiprocess client to a manual capnp server.

Return arbitrary transaction data and json text to exercise client side
deserialization.

82bed574e4

enirox001 force-pushed on Aug 26, 2026

DrahtBot added the label CI failed on Aug 26, 2026

DrahtBot commented at 12:34 PM on August 26, 2026: contributor

🚧 At least one of the CI tasks failed. <sub>Task Windows native, fuzz, VS: https://github.com/bitcoin/bitcoin/actions/runs/32963804197/job/98161775031</sub> <sub>LLM reason (✨ experimental): CI failed because the fuzz target rpc crashed with Windows exit code 3221225477 (access violation).</sub>

<details><summary>Hints</summary>

Try to run the tests locally, according to the documentation. However, a CI failure may still happen due to a number of reasons, for example:

Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.
A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.
An intermittent issue.

Leave a comment here, if you need help tracking down a confusing failure.

</details>

DrahtBot removed the label CI failed on Aug 26, 2026

enirox001 commented at 7:57 AM on August 28, 2026: contributor

See the generated coverage report after fuzzing the IPC target for a while using the qa-assets corpus.

Also included in the pr description