[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v3 02/16] fuzz: Add general virtual-device fuzzer
From: |
Philippe Mathieu-Daudé |
Subject: |
Re: [PATCH v3 02/16] fuzz: Add general virtual-device fuzzer |
Date: |
Mon, 21 Sep 2020 07:43:05 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 |
Hi Alexander,
On 9/21/20 4:24 AM, Alexander Bulekov wrote:
> This is a generic fuzzer designed to fuzz a virtual device's
> MemoryRegions, as long as they exist within the Memory or Port IO (if it
> exists) AddressSpaces. The fuzzer's input is interpreted into a sequence
> of qtest commands (outb, readw, etc). The interpreted commands are
> separated by a magic seaparator, which should be easy for the fuzzer to
> guess. Without ASan, the separator can be specified as a "dictionary
> value" using the -dict argument (see libFuzzer documentation).
>
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> tests/qtest/fuzz/general_fuzz.c | 498 ++++++++++++++++++++++++++++++++
> tests/qtest/fuzz/meson.build | 1 +
> 2 files changed, 499 insertions(+)
> create mode 100644 tests/qtest/fuzz/general_fuzz.c
>
> diff --git a/tests/qtest/fuzz/general_fuzz.c b/tests/qtest/fuzz/general_fuzz.c
> new file mode 100644
> index 0000000000..bf75b215ca
> --- /dev/null
> +++ b/tests/qtest/fuzz/general_fuzz.c
> @@ -0,0 +1,498 @@
> +/*
> + * General Virtual-Device Fuzzing Target
> + *
> + * Copyright Red Hat Inc., 2020
> + *
> + * Authors:
> + * Alexander Bulekov <alxndr@bu.edu>
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
> + * See the COPYING file in the top-level directory.
> + */
> +
> +#include "qemu/osdep.h"
> +
> +#include <wordexp.h>
> +
> +#include "hw/core/cpu.h"
> +#include "tests/qtest/libqos/libqtest.h"
> +#include "fuzz.h"
> +#include "fork_fuzz.h"
> +#include "exec/address-spaces.h"
> +#include "string.h"
> +#include "exec/memory.h"
> +#include "exec/ramblock.h"
> +#include "exec/address-spaces.h"
> +#include "hw/qdev-core.h"
> +
> +/*
> + * SEPARATOR is used to separate "operations" in the fuzz input
> + */
> +#define SEPARATOR "FUZZ"
Why use a separator when all pkt sizes are known?
Can you fuzz writing "FUZZ" in memory? Like:
OP_WRITE(0x100000, "UsingLibFUZZerString")?
> +
> +enum cmds {
> + OP_IN,
> + OP_OUT,
> + OP_READ,
> + OP_WRITE,
> + OP_CLOCK_STEP,
> +};
> +
> +#define DEFAULT_TIMEOUT_US 100000
> +#define USEC_IN_SEC 100000000
Are you sure this definition is correct?
> +
> +typedef struct {
> + ram_addr_t addr;
> + ram_addr_t size; /* The number of bytes until the end of the I/O region
> */
> +} address_range;
> +
> +static useconds_t timeout = 100000;
[...]
- [PATCH v3 00/16] Add a General Virtual Device Fuzzer, Alexander Bulekov, 2020/09/20
- [PATCH v3 01/16] memory: Add FlatView foreach function, Alexander Bulekov, 2020/09/20
- [PATCH v3 03/16] fuzz: Add PCI features to the general fuzzer, Alexander Bulekov, 2020/09/20
- [PATCH v3 02/16] fuzz: Add general virtual-device fuzzer, Alexander Bulekov, 2020/09/20
- [PATCH v3 04/16] fuzz: Add DMA support to the generic-fuzzer, Alexander Bulekov, 2020/09/20
- [PATCH v3 06/16] fuzz: Add fuzzer callbacks to DMA-read functions, Alexander Bulekov, 2020/09/20
- [PATCH v3 05/16] fuzz: Declare DMA Read callback function, Alexander Bulekov, 2020/09/20
- [PATCH v3 08/16] fuzz: add a DISABLE_PCI op to general-fuzzer, Alexander Bulekov, 2020/09/20
- [PATCH v3 07/16] fuzz: Add support for custom crossover functions, Alexander Bulekov, 2020/09/20
- [PATCH v3 09/16] fuzz: add a crossover function to generic-fuzzer, Alexander Bulekov, 2020/09/20
- [PATCH v3 10/16] scripts/oss-fuzz: Add wrapper program for generic fuzzer, Alexander Bulekov, 2020/09/20
- [PATCH v3 11/16] scripts/oss-fuzz: Add general-fuzzer build script, Alexander Bulekov, 2020/09/20