ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fuzz/generic-fuzz: use reboots instead of forks to reset state 

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
This commit is contained in:
Alexander Bulekov 2023-02-04 23:29:44 -05:00
parent 8d1e76b35b
commit 1375104370
1 changed files with 23 additions and 93 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

116
tests/qtest/fuzz/generic_fuzz.c
View File

@ -18,7 +18,6 @@
#include "tests/qtest/libqtest.h" #include "tests/qtest/libqtest.h"
#include "tests/qtest/libqos/pci-pc.h" #include "tests/qtest/libqos/pci-pc.h"
#include "fuzz.h" #include "fuzz.h"
#include "fork_fuzz.h"
#include "string.h" #include "string.h"
#include "exec/memory.h" #include "exec/memory.h"
#include "exec/ramblock.h" #include "exec/ramblock.h"
@ -29,6 +28,8 @@
#include "generic_fuzz_configs.h" #include "generic_fuzz_configs.h"
#include "hw/mem/sparse-mem.h" #include "hw/mem/sparse-mem.h"
static void pci_enum(gpointer pcidev, gpointer bus);
/* /*
* SEPARATOR is used to separate "operations" in the fuzz input * SEPARATOR is used to separate "operations" in the fuzz input
*/ */
@ -47,7 +48,6 @@ enum cmds {
OP_CLOCK_STEP, OP_CLOCK_STEP,
}; };
#define DEFAULT_TIMEOUT_US 100000
#define USEC_IN_SEC 1000000000 #define USEC_IN_SEC 1000000000
#define MAX_DMA_FILL_SIZE 0x10000 #define MAX_DMA_FILL_SIZE 0x10000
@ -60,8 +60,6 @@ typedef struct {
ram_addr_t size; /* The number of bytes until the end of the I/O region */ ram_addr_t size; /* The number of bytes until the end of the I/O region */
} address_range; } address_range;
static useconds_t timeout = DEFAULT_TIMEOUT_US;
static bool qtest_log_enabled; static bool qtest_log_enabled;
MemoryRegion *sparse_mem_mr; MemoryRegion *sparse_mem_mr;
@ -589,30 +587,6 @@ static void op_disable_pci(QTestState *s, const unsigned char *data, size_t len)
pci_disabled = true; pci_disabled = true;
} }
static void handle_timeout(int sig)
{
if (qtest_log_enabled) {
fprintf(stderr, "[Timeout]\n");
fflush(stderr);
}
/*
* If there is a crash, libfuzzer/ASAN forks a child to run an
* "llvm-symbolizer" process for printing out a pretty stacktrace. It
* communicates with this child using a pipe. If we timeout+Exit, while
* libfuzzer is still communicating with the llvm-symbolizer child, we will
* be left with an orphan llvm-symbolizer process. Sometimes, this appears
* to lead to a deadlock in the forkserver. Use waitpid to check if there
* are any waitable children. If so, exit out of the signal-handler, and
* let libfuzzer finish communicating with the child, and exit, on its own.
*/
if (waitpid(-1, NULL, WNOHANG) == 0) {
return;
}
_Exit(0);
}
/* /*
* Here, we interpret random bytes from the fuzzer, as a sequence of commands. * Here, we interpret random bytes from the fuzzer, as a sequence of commands.
* Some commands can be variable-width, so we use a separator, SEPARATOR, to * Some commands can be variable-width, so we use a separator, SEPARATOR, to
@ -669,64 +643,32 @@ static void generic_fuzz(QTestState *s, const unsigned char *Data, size_t Size)
size_t cmd_len; size_t cmd_len;
uint8_t op; uint8_t op;
if (fork() == 0) { op_clear_dma_patterns(s, NULL, 0);
struct sigaction sact; pci_disabled = false;
struct itimerval timer;
sigset_t set;
/*
* Sometimes the fuzzer will find inputs that take quite a long time to
* process. Often times, these inputs do not result in new coverage.
* Even if these inputs might be interesting, they can slow down the
* fuzzer, overall. Set a timeout for each command to avoid hurting
* performance, too much
*/
if (timeout) {
sigemptyset(&sact.sa_mask); QPCIBus *pcibus = qpci_new_pc(s, NULL);
sact.sa_flags = SA_NODEFER; g_ptr_array_foreach(fuzzable_pci_devices, pci_enum, pcibus);
sact.sa_handler = handle_timeout; qpci_free_pc(pcibus);
sigaction(SIGALRM, &sact, NULL);
sigemptyset(&set); while (cmd && Size) {
sigaddset(&set, SIGALRM); /* Get the length until the next command or end of input */
pthread_sigmask(SIG_UNBLOCK, &set, NULL); nextcmd = memmem(cmd, Size, SEPARATOR, strlen(SEPARATOR));
cmd_len = nextcmd ? nextcmd - cmd : Size;
memset(&timer, 0, sizeof(timer)); if (cmd_len > 0) {
timer.it_value.tv_sec = timeout / USEC_IN_SEC; /* Interpret the first byte of the command as an opcode */
timer.it_value.tv_usec = timeout % USEC_IN_SEC; op = *cmd % (sizeof(ops) / sizeof((ops)[0]));
ops[op](s, cmd + 1, cmd_len - 1);
/* Run the main loop */
flush_events(s);
} }
/* Advance to the next command */
op_clear_dma_patterns(s, NULL, 0); cmd = nextcmd ? nextcmd + sizeof(SEPARATOR) - 1 : nextcmd;
pci_disabled = false; Size = Size - (cmd_len + sizeof(SEPARATOR) - 1);
g_array_set_size(dma_regions, 0);
while (cmd && Size) {
/* Reset the timeout, each time we run a new command */
if (timeout) {
setitimer(ITIMER_REAL, &timer, NULL);
}
/* Get the length until the next command or end of input */
nextcmd = memmem(cmd, Size, SEPARATOR, strlen(SEPARATOR));
cmd_len = nextcmd ? nextcmd - cmd : Size;
if (cmd_len > 0) {
/* Interpret the first byte of the command as an opcode */
op = *cmd % (sizeof(ops) / sizeof((ops)[0]));
ops[op](s, cmd + 1, cmd_len - 1);
/* Run the main loop */
flush_events(s);
}
/* Advance to the next command */
cmd = nextcmd ? nextcmd + sizeof(SEPARATOR) - 1 : nextcmd;
Size = Size - (cmd_len + sizeof(SEPARATOR) - 1);
g_array_set_size(dma_regions, 0);
}
_Exit(0);
} else {
flush_events(s);
wait(0);
} }
fuzz_reset(s);
} }
static void usage(void) static void usage(void)
@ -738,8 +680,6 @@ static void usage(void)
printf("Optionally: QEMU_AVOID_DOUBLE_FETCH= " printf("Optionally: QEMU_AVOID_DOUBLE_FETCH= "
"Try to avoid racy DMA double fetch bugs? %d by default\n", "Try to avoid racy DMA double fetch bugs? %d by default\n",
avoid_double_fetches); avoid_double_fetches);
printf("Optionally: QEMU_FUZZ_TIMEOUT= Specify a custom timeout (us). "
"0 to disable. %d by default\n", timeout);
exit(0); exit(0);
} }
@ -825,7 +765,6 @@ static void generic_pre_fuzz(QTestState *s)
{ {
GHashTableIter iter; GHashTableIter iter;
MemoryRegion *mr; MemoryRegion *mr;
QPCIBus *pcibus;
char **result; char **result;
GString *name_pattern; GString *name_pattern;
@ -838,9 +777,6 @@ static void generic_pre_fuzz(QTestState *s)
if (getenv("QEMU_AVOID_DOUBLE_FETCH")) { if (getenv("QEMU_AVOID_DOUBLE_FETCH")) {
avoid_double_fetches = 1; avoid_double_fetches = 1;
} }
if (getenv("QEMU_FUZZ_TIMEOUT")) {
timeout = g_ascii_strtoll(getenv("QEMU_FUZZ_TIMEOUT"), NULL, 0);
}
qts_global = s; qts_global = s;
/* /*
@ -883,12 +819,6 @@ static void generic_pre_fuzz(QTestState *s)
printf("No fuzzable memory regions found...\n"); printf("No fuzzable memory regions found...\n");
exit(1); exit(1);
} }
pcibus = qpci_new_pc(s, NULL);
g_ptr_array_foreach(fuzzable_pci_devices, pci_enum, pcibus);
qpci_free_pc(pcibus);
counter_shm_init();
} }
/* /*