All of lore.kernel.org
 help / color / mirror / Atom feed
From: Alexander Bulekov <alxndr@bu.edu>
To: qemu-devel@nongnu.org
Cc: bonzini@redhat.com, peter.maydell@linaro.org,
	Darren Kenny <darren.kenny@oracle.com>,
	Alexander Bulekov <alxndr@bu.edu>
Subject: [PULL v3 6/8] fuzz: unblock SIGALRM so the timeout works
Date: Wed,  1 Sep 2021 07:50:02 -0400	[thread overview]
Message-ID: <20210901115004.34768-7-alxndr@bu.edu> (raw)
In-Reply-To: <20210901115004.34768-1-alxndr@bu.edu>

The timeout mechanism won't work if SIGALRM is blocked. This changes
unmasks SIGALRM when the timer is installed. This doesn't completely
solve the problem, as the fuzzer could trigger some device activity that
re-masks SIGALRM. However, there are currently no inputs on OSS-Fuzz
that re-mask SIGALRM and timeout. If that turns out to be a real issue,
we could try to hook sigmask-type calls, or use a separate timer thread.

Based-on: <20210713150037.9297-1-alxndr@bu.edu>
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
---
 tests/qtest/fuzz/generic_fuzz.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
index de427a3727..dd7e25851c 100644
--- a/tests/qtest/fuzz/generic_fuzz.c
+++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -670,6 +670,7 @@ static void generic_fuzz(QTestState *s, const unsigned char *Data, size_t Size)
     if (fork() == 0) {
         struct sigaction sact;
         struct itimerval timer;
+        sigset_t set;
         /*
          * Sometimes the fuzzer will find inputs that take quite a long time to
          * process. Often times, these inputs do not result in new coverage.
@@ -684,6 +685,10 @@ static void generic_fuzz(QTestState *s, const unsigned char *Data, size_t Size)
             sact.sa_handler = handle_timeout;
             sigaction(SIGALRM, &sact, NULL);
 
+            sigemptyset(&set);
+            sigaddset(&set, SIGALRM);
+            pthread_sigmask(SIG_UNBLOCK, &set, NULL);
+
             memset(&timer, 0, sizeof(timer));
             timer.it_value.tv_sec = timeout / USEC_IN_SEC;
             timer.it_value.tv_usec = timeout % USEC_IN_SEC;
-- 
2.30.2



  parent reply	other threads:[~2021-09-01 12:05 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-01 11:49 [PULL v3 0/8] Fuzzing Patches for 2021-09-01 Alexander Bulekov
2021-09-01 11:49 ` [PULL v3 1/8] fuzz: fix sparse memory access in the DMA callback Alexander Bulekov
2021-09-01 11:49 ` [PULL v3 2/8] fuzz: adjust timeout to allow for longer inputs Alexander Bulekov
2021-09-01 11:49 ` [PULL v3 3/8] fuzz: make object-name matching case-insensitive Alexander Bulekov
2021-09-01 11:50 ` [PULL v3 4/8] fuzz: add an instrumentation filter Alexander Bulekov
2021-09-01 11:50 ` [PULL v3 5/8] fuzz: use ITIMER_REAL for timeouts Alexander Bulekov
2021-09-01 11:50 ` Alexander Bulekov [this message]
2021-09-01 11:50 ` [PULL v3 7/8] MAINTAINERS: Add myself as a reviewer for Device Fuzzing Alexander Bulekov
2021-09-01 11:50 ` [PULL v3 8/8] MAINTAINERS: add fuzzing reviewer Alexander Bulekov
2021-09-03  7:26 ` [PULL v3 0/8] Fuzzing Patches for 2021-09-01 Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210901115004.34768-7-alxndr@bu.edu \
    --to=alxndr@bu.edu \
    --cc=bonzini@redhat.com \
    --cc=darren.kenny@oracle.com \
    --cc=peter.maydell@linaro.org \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.