ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fuzz/virtio-scsi: remove fork-based fuzzer 

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
This commit is contained in:
Alexander Bulekov 2023-02-04 23:29:46 -05:00
parent b8b52178e2
commit 5d3c73e27e
1 changed files with 7 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
tests/qtest/fuzz/virtio_scsi_fuzz.c
View File

@ -20,7 +20,6 @@
#include "standard-headers/linux/virtio_pci.h" #include "standard-headers/linux/virtio_pci.h"
#include "standard-headers/linux/virtio_scsi.h" #include "standard-headers/linux/virtio_scsi.h"
#include "fuzz.h" #include "fuzz.h"
#include "fork_fuzz.h"
#include "qos_fuzz.h" #include "qos_fuzz.h"
#define PCI_SLOT 0x02 #define PCI_SLOT 0x02
@ -132,48 +131,24 @@ static void virtio_scsi_fuzz(QTestState *s, QVirtioSCSIQueues* queues,
} }
} }
static void virtio_scsi_fork_fuzz(QTestState *s,
const unsigned char *Data, size_t Size)
{
QVirtioSCSI *scsi = fuzz_qos_obj;
static QVirtioSCSIQueues *queues;
if (!queues) {
queues = qvirtio_scsi_init(scsi->vdev, 0);
}
if (fork() == 0) {
virtio_scsi_fuzz(s, queues, Data, Size);
flush_events(s);
_Exit(0);
} else {
flush_events(s);
wait(NULL);
}
}
static void virtio_scsi_with_flag_fuzz(QTestState *s, static void virtio_scsi_with_flag_fuzz(QTestState *s,
const unsigned char *Data, size_t Size) const unsigned char *Data, size_t Size)
{ {
QVirtioSCSI *scsi = fuzz_qos_obj; QVirtioSCSI *scsi = fuzz_qos_obj;
static QVirtioSCSIQueues *queues; static QVirtioSCSIQueues *queues;
if (fork() == 0) { if (Size >= sizeof(uint64_t)) {
if (Size >= sizeof(uint64_t)) { queues = qvirtio_scsi_init(scsi->vdev, *(uint64_t *)Data);
queues = qvirtio_scsi_init(scsi->vdev, *(uint64_t *)Data); virtio_scsi_fuzz(s, queues,
virtio_scsi_fuzz(s, queues, Data + sizeof(uint64_t), Size - sizeof(uint64_t));
Data + sizeof(uint64_t), Size - sizeof(uint64_t));
flush_events(s);
}
_Exit(0);
} else {
flush_events(s); flush_events(s);
wait(NULL);
} }
fuzz_reset(s);
} }
static void virtio_scsi_pre_fuzz(QTestState *s) static void virtio_scsi_pre_fuzz(QTestState *s)
{ {
qos_init_path(s); qos_init_path(s);
counter_shm_init();
} }
static void *virtio_scsi_test_setup(GString *cmd_line, void *arg) static void *virtio_scsi_test_setup(GString *cmd_line, void *arg)
@ -189,22 +164,10 @@ static void *virtio_scsi_test_setup(GString *cmd_line, void *arg)
static void register_virtio_scsi_fuzz_targets(void) static void register_virtio_scsi_fuzz_targets(void)
{ {
fuzz_add_qos_target(&(FuzzTarget){
.name = "virtio-scsi-fuzz",
.description = "Fuzz the virtio-scsi virtual queues, forking "
"for each fuzz run",
.pre_vm_init = &counter_shm_init,
.pre_fuzz = &virtio_scsi_pre_fuzz,
.fuzz = virtio_scsi_fork_fuzz,},
"virtio-scsi",
&(QOSGraphTestOptions){.before = virtio_scsi_test_setup}
);
fuzz_add_qos_target(&(FuzzTarget){ fuzz_add_qos_target(&(FuzzTarget){
.name = "virtio-scsi-flags-fuzz", .name = "virtio-scsi-flags-fuzz",
.description = "Fuzz the virtio-scsi virtual queues, forking " .description = "Fuzz the virtio-scsi virtual queues. "
"for each fuzz run (also fuzzes the virtio flags)", "Also fuzzes the virtio flags",
.pre_vm_init = &counter_shm_init,
.pre_fuzz = &virtio_scsi_pre_fuzz, .pre_fuzz = &virtio_scsi_pre_fuzz,
.fuzz = virtio_scsi_with_flag_fuzz,}, .fuzz = virtio_scsi_with_flag_fuzz,},
"virtio-scsi", "virtio-scsi",