aboutsummaryrefslogtreecommitdiff
path: root/tests/qtest/fuzz
AgeCommit message (Collapse)Author
2020-10-26fuzz: register predefined generic-fuzz configsAlexander Bulekov
We call get_generic_fuzz_configs, which fills an array with predefined {name, args, objects} triples. For each of these, we add a new FuzzTarget, that uses a small wrapper to set QEMU_FUZZ_{ARGS,OBJECTS} to the corresponding predefined values. Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201023150746.107063-16-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-10-26fuzz: add generic-fuzz configs for oss-fuzzAlexander Bulekov
Predefine some generic-fuzz configs. For each of these, we will create a separate FuzzTarget that can be selected through argv0 and, therefore, fuzzed on oss-fuzz. Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201023150746.107063-15-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-10-26fuzz: add an "opaque" to the FuzzTarget structAlexander Bulekov
It can be useful to register FuzzTargets that have nearly-identical initialization handlers (e.g. for using the same fuzzing code, with different configuration options). Add an opaque pointer to the FuzzTarget struct, so that FuzzTargets can hold some data, useful for storing target-specific configuration options, that can be read by the get_init_cmdline function. Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201023150746.107063-14-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-10-26fuzz: add a crossover function to generic-fuzzerAlexander Bulekov
Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201023150746.107063-10-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-10-26fuzz: add a DISABLE_PCI op to generic-fuzzerAlexander Bulekov
This new operation is used in the next commit, which concatenates two fuzzer-generated inputs. With this operation, we can prevent the second input from clobbering the PCI configuration performed by the first. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20201023150746.107063-9-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-10-26fuzz: Add support for custom crossover functionsAlexander Bulekov
libfuzzer supports a "custom crossover function". Libfuzzer often tries to blend two inputs to create a new interesting input. Sometimes, we have a better idea about how to blend inputs together. This change allows fuzzers to specify a custom function for blending two inputs together. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20201023150746.107063-8-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-10-26fuzz: Add DMA support to the generic-fuzzerAlexander Bulekov
When a virtual-device tries to access some buffer in memory over DMA, we add call-backs into the fuzzer(next commit). The fuzzer checks verifies that the DMA request maps to a physical RAM address and fills the memory with fuzzer-provided data. The patterns that we use to fill this memory are specified using add_dma_pattern and clear_dma_patterns operations. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20201023150746.107063-5-alxndr@bu.edu> [thuth: Reformatted one comment according to the QEMU coding style] Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-10-24fuzz: Add PCI features to the generic fuzzerAlexander Bulekov
This patch compares TYPE_PCI_DEVICE objects against the user-provided matching pattern. If there is a match, we use some hacks and leverage QOS to map each possible BAR for that device. Now fuzzed inputs might be converted to pci_read/write commands which target specific. This means that we can fuzz a particular device's PCI configuration space, Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-Id: <20201023150746.107063-4-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-10-24fuzz: Add generic virtual-device fuzzerAlexander Bulekov
This is a generic fuzzer designed to fuzz a virtual device's MemoryRegions, as long as they exist within the Memory or Port IO (if it exists) AddressSpaces. The fuzzer's input is interpreted into a sequence of qtest commands (outb, readw, etc). The interpreted commands are separated by a magic seaparator, which should be easy for the fuzzer to guess. Without ASan, the separator can be specified as a "dictionary value" using the -dict argument (see libFuzzer documentation). Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201023150746.107063-3-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-10-17fuzz: Disable QEMU's SIG{INT,HUP,TERM} handlersAlexander Bulekov
Prior to this patch, the only way I found to terminate the fuzzer was either to: 1. Explicitly specify the number of fuzzer runs with the -runs= flag 2. SIGKILL the process with "pkill -9 qemu-fuzz-*" or similar In addition to being annoying to deal with, SIGKILLing the process skips over any exit handlers(e.g. registered with atexit()). This is bad, since some fuzzers might create temporary files that should ideally be removed on exit using an exit handler. The only way to achieve a clean exit now is to specify -runs=N , but the desired "N" is tricky to identify prior to fuzzing. Why doesn't the process exit with standard SIGINT,SIGHUP,SIGTERM signals? QEMU installs its own handlers for these signals in os-posix.c:os_setup_signal_handling, which notify the main loop that an exit was requested. The fuzzer, however, does not run qemu_main_loop, which performs the main_loop_should_exit() check. This means that the fuzzer effectively ignores these signals. As we don't really care about cleanly stopping the disposable fuzzer "VM", this patch uninstalls QEMU's signal handlers. Thus, we can stop the fuzzer with SIG{INT,HUP,TERM} and the fuzzing code can optionally use atexit() to clean up temporary files/resources. Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20201014142157.46028-1-alxndr@bu.edu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-09-30vl: relocate paths to data directoriesPaolo Bonzini
As an additional advantage, the logic is now unified between POSIX and Win32 systems. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-09-30fuzz: use qemu_get_exec_dirPaolo Bonzini
Make things consistent with how softmmu/vl.c uses os_find_datadir. Initializing the path to the executables will also be needed for get_relocatable_path to work. Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-09-30oslib: do not call g_strdup from qemu_get_exec_dirPaolo Bonzini
Just return the directory without requiring the caller to free it. This also removes a bogus check for NULL in os_find_datadir and module_load_one; g_strdup of a static variable cannot return NULL. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-09-16fuzz: Change the way we write qtest log to stderrAlexander Bulekov
Telling QTest to log to /dev/fd/2, essentially results in dup(2). This is fine, if other code isn't logging to stderr. Otherwise, the order of the logs is mixed due to buffering issues, since two file-descriptors are used to write to the same file. We can avoid this, since just specifying "-qtest" sets the log fd to stderr. If we want to disable qtest logs, we can just add -qtest-log none. Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200819061110.1320568-2-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-09-08fuzz: Add support for custom fuzzing libraryAlexander Bulekov
On oss-fuzz, we must use the LIB_FUZZING_ENGINE and CFLAGS environment variables, rather than -fsanitize=fuzzer. With this change, when LIB_FUZZING_ENGINE is set, the --enable-fuzzing configure option will use that environment variable during the linking stage, rather than -fsanitize=fuzzer Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200902173652.307222-3-alxndr@bu.edu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-09-08meson: specify fuzz linker script as a project argAlexander Bulekov
With this change, the fuzzer-linker script should be specified outside any --start-group/--end-group pairs. We need this on oss-fuzz, where partially applying the linker-script results in a linker failure Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200902173652.307222-2-alxndr@bu.edu> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-08-21meson: link emulators without Makefile.targetPaolo Bonzini
The binaries move to the root directory, e.g. qemu-system-i386 or qemu-arm. This requires changes to qtests, CI, etc. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-08-21meson: convert tests/qtest to mesonPaolo Bonzini
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2020-07-21fuzz: Fix leak when assembling datadir path stringAlexander Bulekov
We freed the string containing the final datadir path, but did not free the path to the executable's directory that we get from g_path_get_dirname(). Fix that. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200717163523.1591-1-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-07-17fuzz: Expect the cmdline in a freeable GStringAlexander Bulekov
In the initial FuzzTarget, get_init_cmdline returned a char *. With this API, we had no guarantee about where the string came from. For example, i440fx-qtest-reboot-fuzz simply returned a pointer to a string literal, while the QOS-based targets build the arguments out in a GString an return the gchar *str pointer. Since we did not try to free the cmdline, we have a leak for any targets that do not simply return string literals. Clean up this mess by forcing fuzz-targets to return a GString, that we can free. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200714174616.20709-1-alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-07-13tests/qtest/fuzz: Add missing spaces in descriptionThomas Huth
There should be a space between "forking" and "for". Message-Id: <20200709083719.22221-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-07-13fuzz: add missing header for rcu_enable_atforkAlexander Bulekov
In 45222b9a90, I fixed a broken check for rcu_enable_atfork introduced in d6919e4cb6. I added a call to rcu_enable_atfork after the call to qemu_init in fuzz.c, but forgot to include the corresponding header, breaking --enable-fuzzing --enable-werror builds. Fixes: 45222b9a90 ("fuzz: fix broken qtest check at rcu_disable_atfork") Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200708200104.21978-3-alxndr@bu.edu> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-07-06fuzz: do not use POSIX shm for coverage bitmapAlexander Bulekov
We used shm_open with mmap to share libfuzzer's coverage bitmap with child (runner) processes. The same functionality can be achieved with MAP_SHARED | MAP_ANONYMOUS, since we do not care about naming or permissioning the shared memory object. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200622165040.15121-1-alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-07-06fuzz: fix broken qtest check at rcu_disable_atforkAlexander Bulekov
The qtest_enabled check introduced in d6919e4 always returns false, as it is called prior to configure_accelerators(). Instead of trying to skip rcu_disable_atfork in qemu_main, simply call rcu_enable_atfork in the fuzzer, after qemu_main returns. Reported-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200618160516.2817-1-alxndr@bu.edu> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-06-15tests/qtest: Fix LGPL information in the file headersThomas Huth
It's either "GNU *Library* General Public License version 2" or "GNU Lesser General Public License version *2.1*", but there was no "version 2.0" of the "Lesser" license. So assume that version 2.1 is meant here. Message-Id: <20200605100645.6506-1-thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-06-15fuzz: Add support for logging QTest commandsAlexander Bulekov
Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200529221450.26673-3-alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-06-15fuzz: skip QTest serializationAlexander Bulekov
The QTest server usually parses ASCII commands from clients. Since we fuzz within the QEMU process, skip the QTest serialization and server for most QTest commands. Leave the option to use the ASCII protocol, to generate readable traces for crash reproducers. Inspired-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20200529221450.26673-2-alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
2020-06-05fuzz: run the main-loop in fork-server processAlexander Bulekov
Without this, the time since the last main-loop keeps increasing, as the fuzzer runs. The forked children need to handle all the "past-due" timers, slowing them down, over time. With this change, the parent/fork-server process runs the main-loop, while waiting on the child, ensuring that the timer events do not pile up, over time. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200512030133.29896-5-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05fuzz: add mangled object name to linker scriptAlexander Bulekov
Previously, we relied on "FuzzerTracePC*(.bss*)" to place libfuzzer's fuzzer::TPC object into our contiguous shared-memory region. This does not work for some libfuzzer builds, so this addition identifies the region by its mangled name: *(.bss._ZN6fuzzer3TPCE); Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200512030133.29896-4-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05fuzz: fix typo in i440fx-qtest-reboot argumentsAlexander Bulekov
Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200512030133.29896-3-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-06-05fuzz: add datadir for oss-fuzz compatabilityAlexander Bulekov
This allows us to keep pc-bios in executable_dir/pc-bios, rather than executable_dir/../pc-bios, which is incompatible with oss-fuzz' file structure. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200512030133.29896-2-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-05-15tests/fuzz: Extract ioport_fuzz_qtest() methodPhilippe Mathieu-Daudé
Extract generic ioport_fuzz_qtest() method from i440fx_fuzz_qtest(). This will help to write tests not specific to the i440FX controller. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-7-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-05-15tests/fuzz: Extract pciconfig_fuzz_qos() methodPhilippe Mathieu-Daudé
Extract the generic pciconfig_fuzz_qos() method from i440fx_fuzz_qos(). This will help to write tests not specific to the i440FX controller. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-6-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-05-15tests/fuzz: Remove unuseful/unused typedefsPhilippe Mathieu-Daudé
These typedefs are not used. Use a simple structure, remote the typedefs. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-5-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-05-15tests/fuzz: Add missing space in test descriptionPhilippe Mathieu-Daudé
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-4-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-05-15tests/fuzz/Makefile: Do not link code using unavailable devicesPhilippe Mathieu-Daudé
Some devices availability depends on CONFIG options. Use these options to only link tests when requested device is available. Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Message-id: 20200514143433.18569-2-philmd@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-05-04fuzz: select fuzz target using executable nameAlexander Bulekov
The fuzzers are built into a binary (e.g. qemu-fuzz-i386). To select the device to fuzz/fuzz target, we usually use the --fuzz-target= argument. This commit allows the fuzz-target to be specified using the name of the executable. If the executable name ends with -target-FUZZ_TARGET, then we select the fuzz target based on this name, rather than the --fuzz-target argument. This is useful for systems such as oss-fuzz where we don't have control of the arguments passed to the fuzzer. [Fixed incorrect indentation. --Stefan] Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200421182230.6313-1-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-04-29fuzz: Simplify how we compute available machines and typesMarkus Armbruster
apply_to_qlist(), apply_to_node() work with QObjects. This is designed for use by tests/qtest/qos-test.c, which gets the data in that form via QMP. Goes back to commit fc281c8020 "tests: qgraph API for the qtest driver framework". Commit 275ab39d86 "fuzz: add support for qos-assisted fuzz targets" added another user: qtest/fuzz/qos_fuzz.c. To get the data as QObjects, it uses qmp_marshal_query_machines() and qmp_marshal_qom_list_types(). All this code is rather cumbersome. Switch to working with generated QAPI types instead: * Replace apply_to_qlist() & friends by machines_apply_to_node() and types_apply_to_node(). * Have qos_fuzz.c use qmp_query_machines() and qmp_qom_list_types() instead. * Have qos_test.c convert from QObject to the QAPI types. Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200424071142.3525-3-armbru@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
2020-03-17Use &error_abort instead of separate assert()Markus Armbruster
Signed-off-by: Markus Armbruster <armbru@redhat.com> Message-Id: <20200313170517.22480-2-armbru@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Acked-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> [Unused Error *variable deleted]
2020-03-06qtest: fix fuzzer-related 80-char limit violationsAlexander Bulekov
Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200227031439.31386-3-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-03-06fuzz: fix style/typos in linker-script commentsAlexander Bulekov
Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Eric Blake <eblake@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200227031439.31386-2-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-02-22fuzz: add virtio-scsi fuzz targetAlexander Bulekov
The virtio-scsi fuzz target sets up and fuzzes the available virtio-scsi queues. After an element is placed on a queue, the fuzzer can select whether to perform a kick, or continue adding elements. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-22-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-02-22fuzz: add virtio-net fuzz targetAlexander Bulekov
The virtio-net fuzz target feeds inputs to all three virtio-net virtqueues, and uses forking to avoid leaking state between fuzz runs. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-21-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-02-22fuzz: add i440fx fuzz targetsAlexander Bulekov
These three targets should simply fuzz reads/writes to a couple ioports, but they mostly serve as examples of different ways to write targets. They demonstrate using qtest and qos for fuzzing, as well as using rebooting and forking to reset state, or not resetting it at all. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-20-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-02-22fuzz: add support for qos-assisted fuzz targetsAlexander Bulekov
Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-17-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-02-22fuzz: support for fork-based fuzzing.Alexander Bulekov
fork() is a simple way to ensure that state does not leak in between fuzzing runs. Unfortunately, the fuzzer mutation engine relies on bitmaps which contain coverage information for each fuzzing run, and these bitmaps should be copied from the child to the parent(where the mutation occurs). These bitmaps are created through compile-time instrumentation and they are not shared with fork()-ed processes, by default. To address this, we create a shared memory region, adjust its size and map it _over_ the counter region. Furthermore, libfuzzer doesn't generally expose the globals that specify the location of the counters/coverage bitmap. As a workaround, we rely on a custom linker script which forces all of the bitmaps we care about to be placed in a contiguous region, which is easy to locate and mmap over. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-16-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2020-02-22fuzz: add fuzzer skeletonAlexander Bulekov
tests/fuzz/fuzz.c serves as the entry point for the virtual-device fuzzer. Namely, libfuzzer invokes the LLVMFuzzerInitialize and LLVMFuzzerTestOneInput functions, both of which are defined in this file. This change adds a "FuzzTarget" struct, along with the fuzz_add_target function, which should be used to define new fuzz targets. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Message-id: 20200220041118.23264-13-alxndr@bu.edu Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
generated by cgit v1.2.3 (git 2.26.2) at 2025-03-16 22:58:05 +0000