From: "Oleinik, Alexander" <alxndr@bu.edu>
To: "qemu-devel@nongnu.org" <qemu-devel@nongnu.org>
Cc: "pbonzini@redhat.com" <pbonzini@redhat.com>,
"bsd@redhat.com" <bsd@redhat.com>,
"stefanha@redhat.com" <stefanha@redhat.com>,
"Oleinik, Alexander" <alxndr@bu.edu>
Subject: [Qemu-devel] [RFC PATCH v2 16/17] fuzz: Add virtio-net fuzz targets
Date: Mon, 5 Aug 2019 07:11:16 +0000 [thread overview]
Message-ID: <20190805071038.32146-17-alxndr@bu.edu> (raw)
In-Reply-To: <20190805071038.32146-1-alxndr@bu.edu>
Signed-off-by: Alexander Oleinik <alxndr@bu.edu>
---
tests/fuzz/virtio-net-fuzz.c | 254 +++++++++++++++++++++++++++++++++++
1 file changed, 254 insertions(+)
create mode 100644 tests/fuzz/virtio-net-fuzz.c
diff --git a/tests/fuzz/virtio-net-fuzz.c b/tests/fuzz/virtio-net-fuzz.c
new file mode 100644
index 0000000000..dfba2e3ca7
--- /dev/null
+++ b/tests/fuzz/virtio-net-fuzz.c
@@ -0,0 +1,254 @@
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "exec/memory.h"
+#include "sysemu/sysemu.h"
+#include "qemu/main-loop.h"
+
+#include "hw/virtio/virtio-net.h"
+#include "hw/virtio/virtio.h"
+#include "tests/libqos/virtio-net.h"
+#include "fuzzer_hooks.h"
+#include "snapshotting.h"
+
+#include "fuzz.h"
+#include "qos_fuzz.h"
+
+#define MAX_INPUT_BUFFERS 10
+
+typedef struct vq_action {
+ uint8_t queue;
+ uint8_t length;
+ uint8_t write;
+ uint8_t next;
+ bool kick;
+} vq_action;
+
+static void virtio_net_ctrl_fuzz(const unsigned char *Data, size_t Size)
+{
+ uint64_t req_addr[10];
+ int reqi = 0;
+ uint32_t free_head;
+
+ QGuestAllocator *t_alloc = qos_alloc;
+
+ QVirtioNet *net_if = qos_obj;
+ QVirtioDevice *dev = net_if->vdev;
+ QVirtQueue *q;
+ vq_action vqa;
+ int iters = 0;
+ while (true) {
+ if (Size < sizeof(vqa)) {
+ break;
+ }
+ vqa = *((vq_action *)Data);
+ Data += sizeof(vqa);
+ Size -= sizeof(vqa);
+
+ q = net_if->queues[2];
+
+ vqa.length = vqa.length >= Size ? Size : vqa.length;
+
+ req_addr[reqi] = guest_alloc(t_alloc, vqa.length);
+ memwrite(req_addr[reqi], Data, vqa.length);
+ if (iters == 0) {
+ free_head = qvirtqueue_add(q, req_addr[reqi], vqa.length,
+ vqa.write, vqa.next);
+ } else {
+ qvirtqueue_add(q, req_addr[reqi], vqa.length, vqa.write , vqa.next);
+ }
+ iters++;
+ reqi++;
+ if (iters == 10) {
+ break;
+ }
+ Data += vqa.length;
+ Size -= vqa.length;
+ }
+ if (iters) {
+ qvirtqueue_kick(dev, q, free_head);
+ /* qtest_clock_step_next(s); */
+ main_loop_wait(false);
+ for (int i = 0; i < reqi; i++) {
+ guest_free(t_alloc, req_addr[i]);
+ }
+ }
+ qtest_clear_rxbuf(s);
+ qos_object_queue_destroy(qos_obj);
+}
+
+static void virtio_net_ctrl_fuzz_multi(const unsigned char *Data, size_t Size)
+{
+ uint64_t req_addr[10];
+ int reqi = 0;
+ uint32_t free_head;
+
+ QGuestAllocator *t_alloc = qos_alloc;
+
+ QVirtioNet *net_if = qos_obj;
+ QVirtioDevice *dev = net_if->vdev;
+ QVirtQueue *q;
+ vq_action vqa;
+ int iters = 0;
+ while (Size >= sizeof(vqa)) {
+ vqa = *((vq_action *)Data);
+ Data += sizeof(vqa);
+ Size -= sizeof(vqa);
+ if (vqa.kick && free_head) {
+ qvirtqueue_kick(dev, q, free_head);
+ qtest_clock_step_next(s);
+ main_loop_wait(false);
+ for (int i = 0; i < reqi; i++) {
+ guest_free(t_alloc, req_addr[i]);
+ }
+ reqi = 0;
+ } else {
+ q = net_if->queues[2];
+
+ vqa.length = vqa.length >= Size ? Size : vqa.length;
+
+ req_addr[reqi] = guest_alloc(t_alloc, vqa.length);
+ memwrite(req_addr[reqi], Data, vqa.length);
+ if (iters == 0) {
+ free_head = qvirtqueue_add(q, req_addr[reqi], vqa.length,
+ vqa.write, vqa.next);
+ } else {
+ qvirtqueue_add(q, req_addr[reqi], vqa.length, vqa.write,
+ vqa.next) ;
+ }
+ iters++;
+ reqi++;
+ if (iters == 10) {
+ break;
+ }
+ Data += vqa.length;
+ Size -= vqa.length;
+ }
+ }
+ qtest_clear_rxbuf(s);
+ qos_object_queue_destroy(qos_obj);
+}
+
+int *sv;
+static void virtio_net_tx_fuzz(const unsigned char *Data, size_t Size)
+{
+ uint64_t req_addr[10];
+ int reqi = 0;
+ uint32_t free_head;
+
+ QGuestAllocator *t_alloc = qos_alloc;
+
+ QVirtioNet *net_if = qos_obj;
+ QVirtioDevice *dev = net_if->vdev;
+ QVirtQueue *q;
+ vq_action vqa;
+ int iters = 0;
+ while (true) {
+ if (Size < sizeof(vqa)) {
+ break;
+ }
+ vqa = *((vq_action *)Data);
+ Data += sizeof(vqa);
+ Size -= sizeof(vqa);
+
+ q = net_if->queues[1];
+
+ vqa.length = vqa.length >= Size ? Size : vqa.length;
+
+ req_addr[reqi] = guest_alloc(t_alloc, vqa.length);
+ memwrite(req_addr[reqi], Data, vqa.length);
+ if (iters == 0) {
+ free_head = qvirtqueue_add(q, req_addr[reqi], vqa.length,
+ vqa.write, vqa.next);
+ } else {
+ qvirtqueue_add(q, req_addr[reqi], vqa.length, vqa.write, vqa.next);
+ }
+ iters++;
+ reqi++;
+ if (iters == 10) {
+ break;
+ }
+ Data += vqa.length;
+ Size -= vqa.length;
+ }
+ if (iters) {
+ qvirtqueue_kick(dev, q, free_head);
+ qtest_clock_step_next(s);
+ main_loop_wait(false);
+ for (int i = 0; i < reqi; i++) {
+ guest_free(t_alloc, req_addr[i]);
+ }
+ }
+ qtest_clear_rxbuf(s);
+ qos_object_queue_destroy(qos_obj);
+}
+
+static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
+{
+ if (!sv) {
+ sv = g_new(int, 2);
+ int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sv);
+ fcntl(sv[0], F_SETFL, O_NONBLOCK);
+ g_assert_cmpint(ret, !=, -1);
+ }
+ g_string_append_printf(cmd_line, " -netdev socket,fd=%d,id=hs0 ", sv[1]);
+ return arg;
+}
+
+static void fuzz_fork(const unsigned char *Data, size_t Size)
+{
+ if (fork() == 0) {
+ main_loop_wait(false);
+ virtio_net_ctrl_fuzz(Data, Size);
+ counter_shm_store();
+ _Exit(0);
+ } else {
+ wait(NULL);
+ counter_shm_load();
+ }
+}
+
+static void fork_pre_main(void)
+{
+ qos_setup();
+ counter_shm_init();
+}
+
+static void register_virtio_net_fuzz_targets(void)
+{
+ QOSGraphTestOptions opts = {
+ .before = virtio_net_test_setup_socket,
+ };
+ FuzzTarget fuzz_opts = {
+ .pre_main = qos_setup,
+ .pre_save_state = NULL,
+ .save_state = NULL,
+ .reset = &reboot,
+ .pre_fuzz = &qos_init_path,
+ .fuzz = &virtio_net_ctrl_fuzz,
+ .post_fuzz = NULL,
+ };
+ fuzz_add_qos_target("virtio-net-ctrl-fuzz", "virtio-net ctrl virtqueue \
+ fuzzer", "virtio-net", &opts, &fuzz_opts);
+
+ fuzz_opts.fuzz = &virtio_net_ctrl_fuzz_multi;
+ fuzz_add_qos_target("virtio-net-ctrl-multi-fuzz", "virtio-net ctrl\
+ virtqueue fuzzer with multiple kicks", "virtio-net", &opts,
+ &fuzz_opts);
+
+ fuzz_opts.fuzz = &virtio_net_tx_fuzz;
+ fuzz_add_qos_target("virtio-net-tx-fuzz", "virtio-net tx virtqueue fuzzer",
+ "virtio-net", &opts, &fuzz_opts);
+
+ fuzz_opts.pre_main = &fork_pre_main;
+ fuzz_opts.pre_save_state = &qos_init_path;
+ fuzz_opts.reset = NULL;
+ fuzz_opts.pre_fuzz = NULL;
+ fuzz_opts.fuzz = &fuzz_fork;
+ fuzz_add_qos_target("virtio-net-fork", "virtio-net tx virtqueue",
+ "virtio-net", &opts, &fuzz_opts);
+
+}
+
+fuzz_target_init(register_virtio_net_fuzz_targets);
--
2.20.1
next prev parent reply other threads:[~2019-08-05 7:19 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-05 7:11 [Qemu-devel] [RFC PATCH v2 00/17] Add virtual device fuzzing support Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 01/17] fuzz: Move initialization from main to qemu_init Oleinik, Alexander
2019-08-05 7:43 ` Paolo Bonzini
2019-08-15 12:41 ` Darren Kenny
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 02/17] fuzz: Add fuzzer configure options Oleinik, Alexander
2019-08-05 7:44 ` Paolo Bonzini
2019-08-12 22:39 ` Bandan Das
2019-08-13 18:46 ` Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 03/17] fuzz: Keep memory mapped for fork-based fuzzer Oleinik, Alexander
2019-08-09 9:01 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 04/17] fuzz: Skip modules that were already initialized Oleinik, Alexander
2019-08-05 7:44 ` Paolo Bonzini
2019-08-09 9:04 ` Stefan Hajnoczi
2019-08-13 18:53 ` Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 05/17] fuzz: Add direct receive function for qtest server Oleinik, Alexander
2019-08-09 9:23 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 06/17] fuzz: Add FUZZ_TARGET module type Oleinik, Alexander
2019-08-09 9:07 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 07/17] fuzz: Add ramfile qemu-file type Oleinik, Alexander
2019-08-05 7:50 ` Paolo Bonzini
2019-08-05 10:46 ` Dr. David Alan Gilbert
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 08/17] fuzz: Export the qemu_savevm_live_state function Oleinik, Alexander
2019-08-05 10:54 ` Dr. David Alan Gilbert
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 09/17] fuzz: hardcode needed objects into i386 target Oleinik, Alexander
2019-08-09 9:33 ` Stefan Hajnoczi
2019-08-16 12:51 ` Darren Kenny
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 10/17] fuzz: qtest client directly interacts with server Oleinik, Alexander
2019-08-09 9:37 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 11/17] fuzz: Move useful qos functions to separate object Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 12/17] fuzz: Add fuzzer skeleton Oleinik, Alexander
2019-08-09 9:43 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 13/17] fuzz: Add libqos support to the fuzzer Oleinik, Alexander
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 14/17] fuzz: Add forking " Oleinik, Alexander
2019-08-09 9:46 ` Stefan Hajnoczi
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 15/17] fuzz: Add general qtest fuzz-target Oleinik, Alexander
2019-08-05 7:11 ` Oleinik, Alexander [this message]
2019-08-05 7:11 ` [Qemu-devel] [RFC PATCH v2 17/17] fuzz: Add fuzz accelerator type Oleinik, Alexander
2019-08-05 8:19 ` [Qemu-devel] [RFC PATCH v2 00/17] Add virtual device fuzzing support no-reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190805071038.32146-17-alxndr@bu.edu \
--to=alxndr@bu.edu \
--cc=bsd@redhat.com \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).