From: "Oleinik, Alexander" <alxndr@bu.edu>
To: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>
Cc: "pbonzini@redhat.com" <pbonzini@redhat.com>,
"bsd@redhat.com" <bsd@redhat.com>,
"stefanha@redhat.com" <stefanha@redhat.com>,
"Oleinik, Alexander" <alxndr@bu.edu>
Subject: [Qemu-devel] [RFC PATCH v2 00/17] Add virtual device fuzzing support
Date: Mon, 5 Aug 2019 07:11:02 +0000 [thread overview]
Message-ID: <20190805071038.32146-1-alxndr@bu.edu> (raw)
Changes since v1
* Split off changes to qos virtio-net and qtest server to other patches
* Move vl:main initialization into new func: qemu_init
* Moved useful functions from qos-test.c to a separate object
* Use struct of function pointers for add_fuzz_target(), instead of
arguments
* Move ramfile to migration/qemu-file
* Rewrite fork-based fuzzer pending patch to libfuzzer
* Pass check-patch
Based-on: 20190805032400.8054-1-alxndr@bu.edu
Based-on: 20190805031240.6024-1-alxndr@bu.edu
---
As part of Google Summer of Code 2019, I'm working on integrating
fuzzing of virtual devices into QEMU [1]. This is a highly WIP patchset
adding this functionality.
Fuzzers provide random data to a program and monitor its execution for
errors. Coverage-guided fuzzers also observe the parts of the program
that are exercised by each input, and use this information to
mutate/guide the inputs to reach additional parts of the program. They
are quite effective for finding bugs in a wide range of software.
Summary:
- The virtual-device fuzzers use libfuzzer [2] for coverage-guided
in-process fuzzing.
- To fuzz a device, create a new fuzz "target" - i.e. a function that
exercises QEMU based on inputs provided by the fuzzer.
- Fuzz targets rely on qtest and libqos to turn inputs into actions.
- Since libfuzzer does in-process fuzzing, the QEMU state needs to be
reset after each fuzz run. These patches provide three methods for
resetting state.
- There are currently few targets, but they have already helped
discover bugs in the console, and virtio-net, and have reproduced
previously-reported vulnerabilities.
Alexander Oleinik (17):
fuzz: Move initialization from main to qemu_init
fuzz: Add fuzzer configure options
fuzz: Keep memory mapped for fork-based fuzzer
fuzz: Skip modules that were already initialized
fuzz: Add direct receive function for qtest server
fuzz: Add FUZZ_TARGET module type
fuzz: Add ramfile qemu-file type
fuzz: Export the qemu_savevm_live_state function
fuzz: hardcode needed objects into i386 target
fuzz: qtest client directly interacts with server
fuzz: Move useful qos functions to separate object
fuzz: Add fuzzer skeleton
fuzz: Add libqos support to the fuzzer
fuzz: Add forking support to the fuzzer
fuzz: Add general qtest fuzz-target
fuzz: Add virtio-net fuzz targets
fuzz: Add fuzz accelerator type
accel/fuzz.c | 48 +++++++
configure | 15 ++
exec.c | 2 +
include/qemu/module.h | 4 +-
include/sysemu/fuzz.h | 15 ++
include/sysemu/qtest.h | 4 +
include/sysemu/sysemu.h | 5 +
migration/qemu-file.c | 84 +++++++++++
migration/qemu-file.h | 11 ++
migration/savevm.c | 9 +-
migration/savevm.h | 2 +
qtest.c | 14 ++
target/i386/Makefile.objs | 20 +++
tests/fuzz/fuzz.c | 245 +++++++++++++++++++++++++++++++++
tests/fuzz/fuzz.h | 70 ++++++++++
tests/fuzz/fuzzer_hooks.c | 62 +++++++++
tests/fuzz/fuzzer_hooks.h | 21 +++
tests/fuzz/qos_fuzz.c | 58 ++++++++
tests/fuzz/qos_fuzz.h | 23 ++++
tests/fuzz/qos_helpers.c | 190 +++++++++++++++++++++++++
tests/fuzz/qos_helpers.h | 17 +++
tests/fuzz/qtest_fuzz.c | 260 +++++++++++++++++++++++++++++++++++
tests/fuzz/qtest_fuzz.h | 37 +++++
tests/fuzz/virtio-net-fuzz.c | 254 ++++++++++++++++++++++++++++++++++
tests/libqos/qos_external.c | 149 ++++++++++++++++++++
tests/libqos/qos_external.h | 8 ++
tests/libqtest.c | 61 +++++++-
tests/libqtest.h | 6 +
tests/qos-test.c | 132 +-----------------
util/module.c | 7 +
vl.c | 25 +++-
31 files changed, 1720 insertions(+), 138 deletions(-)
create mode 100644 accel/fuzz.c
create mode 100644 include/sysemu/fuzz.h
create mode 100644 tests/fuzz/fuzz.c
create mode 100644 tests/fuzz/fuzz.h
create mode 100644 tests/fuzz/fuzzer_hooks.c
create mode 100644 tests/fuzz/fuzzer_hooks.h
create mode 100644 tests/fuzz/qos_fuzz.c
create mode 100644 tests/fuzz/qos_fuzz.h
create mode 100644 tests/fuzz/qos_helpers.c
create mode 100644 tests/fuzz/qos_helpers.h
create mode 100644 tests/fuzz/qtest_fuzz.c
create mode 100644 tests/fuzz/qtest_fuzz.h
create mode 100644 tests/fuzz/virtio-net-fuzz.c
create mode 100644 tests/libqos/qos_external.c
create mode 100644 tests/libqos/qos_external.h
--
2.20.1
next reply other threads:[~2019-08-05 7:11 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-05 7:11 Oleinik, Alexander [this message]
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 01/17] fuzz: Move initialization from main to qemu_init Oleinik, Alexander
2019-08-05 7:43 ` Paolo Bonzini
2019-08-15 12:41 ` Darren Kenny
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 02/17] fuzz: Add fuzzer configure options Oleinik, Alexander
2019-08-05 7:44 ` Paolo Bonzini
2019-08-12 22:39 ` Bandan Das
2019-08-13 18:46 ` Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 03/17] fuzz: Keep memory mapped for fork-based fuzzer Oleinik, Alexander
2019-08-09 9:01 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 04/17] fuzz: Skip modules that were already initialized Oleinik, Alexander
2019-08-05 7:44 ` Paolo Bonzini
2019-08-09 9:04 ` Stefan Hajnoczi
2019-08-13 18:53 ` Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 05/17] fuzz: Add direct receive function for qtest server Oleinik, Alexander
2019-08-09 9:23 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 06/17] fuzz: Add FUZZ_TARGET module type Oleinik, Alexander
2019-08-09 9:07 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 07/17] fuzz: Add ramfile qemu-file type Oleinik, Alexander
2019-08-05 7:50 ` Paolo Bonzini
2019-08-05 10:46 ` Dr. David Alan Gilbert
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 08/17] fuzz: Export the qemu_savevm_live_state function Oleinik, Alexander
2019-08-05 10:54 ` Dr. David Alan Gilbert
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 09/17] fuzz: hardcode needed objects into i386 target Oleinik, Alexander
2019-08-09 9:33 ` Stefan Hajnoczi
2019-08-16 12:51 ` Darren Kenny
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 10/17] fuzz: qtest client directly interacts with server Oleinik, Alexander
2019-08-09 9:37 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 11/17] fuzz: Move useful qos functions to separate object Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 12/17] fuzz: Add fuzzer skeleton Oleinik, Alexander
2019-08-09 9:43 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 13/17] fuzz: Add libqos support to the fuzzer Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 14/17] fuzz: Add forking " Oleinik, Alexander
2019-08-09 9:46 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 15/17] fuzz: Add general qtest fuzz-target Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 16/17] fuzz: Add virtio-net fuzz targets Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 17/17] fuzz: Add fuzz accelerator type Oleinik, Alexander
2019-08-05 8:19 ` [Qemu-devel] [RFC PATCH v2 00/17] Add virtual device fuzzing support no-reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190805071038.32146-1-alxndr@bu.edu \
--to=alxndr@bu.edu \
--cc=bsd@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).