From: Stefan Hajnoczi <stefanha@redhat.com>
To: qemu-devel@nongnu.org
Cc: "Kevin Wolf" <kwolf@redhat.com>,
"Peter Maydell" <peter.maydell@linaro.org>,
"Thomas Huth" <thuth@redhat.com>,
"Eduardo Habkost" <ehabkost@redhat.com>,
qemu-block@nongnu.org, "Michael S. Tsirkin" <mst@redhat.com>,
"Laurent Vivier" <lvivier@redhat.com>,
"Max Reitz" <mreitz@redhat.com>,
"Alexander Bulekov" <alxndr@bu.edu>,
"Bandan Das" <bsd@redhat.com>,
"Stefan Hajnoczi" <stefanha@redhat.com>,
"Marc-André Lureau" <marcandre.lureau@redhat.com>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Fam Zheng" <fam@euphon.net>,
"Darren Kenny" <darren.kenny@oracle.com>,
"Richard Henderson" <rth@twiddle.net>
Subject: [PULL 29/31] fuzz: add virtio-net fuzz target
Date: Sat, 22 Feb 2020 08:50:28 +0000 [thread overview]
Message-ID: <20200222085030.1760640-30-stefanha@redhat.com> (raw)
In-Reply-To: <20200222085030.1760640-1-stefanha@redhat.com>
From: Alexander Bulekov <alxndr@bu.edu>
The virtio-net fuzz target feeds inputs to all three virtio-net
virtqueues, and uses forking to avoid leaking state between fuzz runs.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-id: 20200220041118.23264-21-alxndr@bu.edu
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
tests/qtest/fuzz/Makefile.include | 1 +
tests/qtest/fuzz/virtio_net_fuzz.c | 198 +++++++++++++++++++++++++++++
2 files changed, 199 insertions(+)
create mode 100644 tests/qtest/fuzz/virtio_net_fuzz.c
diff --git a/tests/qtest/fuzz/Makefile.include b/tests/qtest/fuzz/Makefile.include
index 38b8cdd9f1..77385777ef 100644
--- a/tests/qtest/fuzz/Makefile.include
+++ b/tests/qtest/fuzz/Makefile.include
@@ -8,6 +8,7 @@ fuzz-obj-y += tests/qtest/fuzz/qos_fuzz.o
# Targets
fuzz-obj-y += tests/qtest/fuzz/i440fx_fuzz.o
+fuzz-obj-y += tests/qtest/fuzz/virtio_net_fuzz.o
FUZZ_CFLAGS += -I$(SRC_PATH)/tests -I$(SRC_PATH)/tests/qtest
diff --git a/tests/qtest/fuzz/virtio_net_fuzz.c b/tests/qtest/fuzz/virtio_net_fuzz.c
new file mode 100644
index 0000000000..d08a47e278
--- /dev/null
+++ b/tests/qtest/fuzz/virtio_net_fuzz.c
@@ -0,0 +1,198 @@
+/*
+ * virtio-net Fuzzing Target
+ *
+ * Copyright Red Hat Inc., 2019
+ *
+ * Authors:
+ * Alexander Bulekov <alxndr@bu.edu>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "standard-headers/linux/virtio_config.h"
+#include "tests/qtest/libqtest.h"
+#include "tests/qtest/libqos/virtio-net.h"
+#include "fuzz.h"
+#include "fork_fuzz.h"
+#include "qos_fuzz.h"
+
+
+#define QVIRTIO_NET_TIMEOUT_US (30 * 1000 * 1000)
+#define QVIRTIO_RX_VQ 0
+#define QVIRTIO_TX_VQ 1
+#define QVIRTIO_CTRL_VQ 2
+
+static int sockfds[2];
+static bool sockfds_initialized;
+
+static void virtio_net_fuzz_multi(QTestState *s,
+ const unsigned char *Data, size_t Size, bool check_used)
+{
+ typedef struct vq_action {
+ uint8_t queue;
+ uint8_t length;
+ uint8_t write;
+ uint8_t next;
+ uint8_t rx;
+ } vq_action;
+
+ uint32_t free_head = 0;
+
+ QGuestAllocator *t_alloc = fuzz_qos_alloc;
+
+ QVirtioNet *net_if = fuzz_qos_obj;
+ QVirtioDevice *dev = net_if->vdev;
+ QVirtQueue *q;
+ vq_action vqa;
+ while (Size >= sizeof(vqa)) {
+ memcpy(&vqa, Data, sizeof(vqa));
+ Data += sizeof(vqa);
+ Size -= sizeof(vqa);
+
+ q = net_if->queues[vqa.queue % 3];
+
+ vqa.length = vqa.length >= Size ? Size : vqa.length;
+
+ /*
+ * Only attempt to write incoming packets, when using the socket
+ * backend. Otherwise, always place the input on a virtqueue.
+ */
+ if (vqa.rx && sockfds_initialized) {
+ write(sockfds[0], Data, vqa.length);
+ } else {
+ vqa.rx = 0;
+ uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
+ /*
+ * If checking used ring, ensure that the fuzzer doesn't trigger
+ * trivial asserion failure on zero-zied buffer
+ */
+ qtest_memwrite(s, req_addr, Data, vqa.length);
+
+
+ free_head = qvirtqueue_add(s, q, req_addr, vqa.length,
+ vqa.write, vqa.next);
+ qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
+ qvirtqueue_kick(s, dev, q, free_head);
+ }
+
+ /* Run the main loop */
+ qtest_clock_step(s, 100);
+ flush_events(s);
+
+ /* Wait on used descriptors */
+ if (check_used && !vqa.rx) {
+ gint64 start_time = g_get_monotonic_time();
+ /*
+ * normally, we could just use qvirtio_wait_used_elem, but since we
+ * must manually run the main-loop for all the bhs to run, we use
+ * this hack with flush_events(), to run the main_loop
+ */
+ while (!vqa.rx && q != net_if->queues[QVIRTIO_RX_VQ]) {
+ uint32_t got_desc_idx;
+ /* Input led to a virtio_error */
+ if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET) {
+ break;
+ }
+ if (dev->bus->get_queue_isr_status(dev, q) &&
+ qvirtqueue_get_buf(s, q, &got_desc_idx, NULL)) {
+ g_assert_cmpint(got_desc_idx, ==, free_head);
+ break;
+ }
+ g_assert(g_get_monotonic_time() - start_time
+ <= QVIRTIO_NET_TIMEOUT_US);
+
+ /* Run the main loop */
+ qtest_clock_step(s, 100);
+ flush_events(s);
+ }
+ }
+ Data += vqa.length;
+ Size -= vqa.length;
+ }
+}
+
+static void virtio_net_fork_fuzz(QTestState *s,
+ const unsigned char *Data, size_t Size)
+{
+ if (fork() == 0) {
+ virtio_net_fuzz_multi(s, Data, Size, false);
+ flush_events(s);
+ _Exit(0);
+ } else {
+ wait(NULL);
+ }
+}
+
+static void virtio_net_fork_fuzz_check_used(QTestState *s,
+ const unsigned char *Data, size_t Size)
+{
+ if (fork() == 0) {
+ virtio_net_fuzz_multi(s, Data, Size, true);
+ flush_events(s);
+ _Exit(0);
+ } else {
+ wait(NULL);
+ }
+}
+
+static void virtio_net_pre_fuzz(QTestState *s)
+{
+ qos_init_path(s);
+ counter_shm_init();
+}
+
+static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
+{
+ int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sockfds);
+ g_assert_cmpint(ret, !=, -1);
+ fcntl(sockfds[0], F_SETFL, O_NONBLOCK);
+ sockfds_initialized = true;
+ g_string_append_printf(cmd_line, " -netdev socket,fd=%d,id=hs0 ",
+ sockfds[1]);
+ return arg;
+}
+
+static void *virtio_net_test_setup_user(GString *cmd_line, void *arg)
+{
+ g_string_append_printf(cmd_line, " -netdev user,id=hs0 ");
+ return arg;
+}
+
+static void register_virtio_net_fuzz_targets(void)
+{
+ fuzz_add_qos_target(&(FuzzTarget){
+ .name = "virtio-net-socket",
+ .description = "Fuzz the virtio-net virtual queues. Fuzz incoming "
+ "traffic using the socket backend",
+ .pre_fuzz = &virtio_net_pre_fuzz,
+ .fuzz = virtio_net_fork_fuzz,},
+ "virtio-net",
+ &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
+ );
+
+ fuzz_add_qos_target(&(FuzzTarget){
+ .name = "virtio-net-socket-check-used",
+ .description = "Fuzz the virtio-net virtual queues. Wait for the "
+ "descriptors to be used. Timeout may indicate improperly handled "
+ "input",
+ .pre_fuzz = &virtio_net_pre_fuzz,
+ .fuzz = virtio_net_fork_fuzz_check_used,},
+ "virtio-net",
+ &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
+ );
+ fuzz_add_qos_target(&(FuzzTarget){
+ .name = "virtio-net-slirp",
+ .description = "Fuzz the virtio-net virtual queues with the slirp "
+ " backend. Warning: May result in network traffic emitted from the "
+ " process. Run in an isolated network environment.",
+ .pre_fuzz = &virtio_net_pre_fuzz,
+ .fuzz = virtio_net_fork_fuzz,},
+ "virtio-net",
+ &(QOSGraphTestOptions){.before = virtio_net_test_setup_user}
+ );
+}
+
+fuzz_target_init(register_virtio_net_fuzz_targets);
--
2.24.1
next prev parent reply other threads:[~2020-02-22 9:08 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-22 8:49 [PULL 00/31] Block patches Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 01/31] virtio: increase virtqueue size for virtio-scsi and virtio-blk Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 02/31] aio-posix: avoid reacquiring rcu_read_lock() when polling Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 03/31] rcu_queue: add QSLIST functions Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 04/31] util/async: make bh_aio_poll() O(1) Stefan Hajnoczi
2020-03-16 16:42 ` Marc-André Lureau
2020-02-22 8:50 ` [PULL 05/31] aio-posix: fix use after leaving scope in aio_poll() Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 06/31] aio-posix: don't pass ns timeout to epoll_wait() Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 07/31] qemu/queue.h: add QLIST_SAFE_REMOVE() Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 08/31] aio-posix: make AioHandler deletion O(1) Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 09/31] aio-posix: make AioHandler dispatch O(1) with epoll Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 10/31] softmmu: move vl.c to softmmu/ Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 11/31] softmmu: split off vl.c:main() into main.c Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 12/31] module: check module wasn't already initialized Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 13/31] fuzz: add FUZZ_TARGET module type Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 14/31] qtest: add qtest_server_send abstraction Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 15/31] libqtest: add a layer of abstraction to send/recv Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 16/31] libqtest: make bufwrite rely on the TransportOps Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 17/31] qtest: add in-process incoming command handler Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 18/31] libqos: rename i2c_send and i2c_recv Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 19/31] libqos: split qos-test and libqos makefile vars Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 20/31] libqos: move useful qos-test funcs to qos_external Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 21/31] fuzz: add fuzzer skeleton Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 22/31] exec: keep ram block across fork when using qtest Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 23/31] main: keep rcu_atfork callback enabled for qtest Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 24/31] fuzz: support for fork-based fuzzing Stefan Hajnoczi
2020-02-22 11:34 ` Eric Blake
2020-02-24 11:35 ` Stefan Hajnoczi
2020-02-27 2:50 ` Alexander Bulekov
2020-02-22 8:50 ` [PULL 25/31] fuzz: add support for qos-assisted fuzz targets Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 26/31] fuzz: add target/fuzz makefile rules Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 27/31] fuzz: add configure flag --enable-fuzzing Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 28/31] fuzz: add i440fx fuzz targets Stefan Hajnoczi
2020-02-22 8:50 ` Stefan Hajnoczi [this message]
2020-02-22 8:50 ` [PULL 30/31] fuzz: add virtio-scsi fuzz target Stefan Hajnoczi
2020-02-22 8:50 ` [PULL 31/31] fuzz: add documentation to docs/devel/ Stefan Hajnoczi
2020-02-22 9:13 ` [PULL 00/31] Block patches no-reply
2020-02-24 11:33 ` Stefan Hajnoczi
2020-02-24 12:47 ` Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200222085030.1760640-30-stefanha@redhat.com \
--to=stefanha@redhat.com \
--cc=alxndr@bu.edu \
--cc=bsd@redhat.com \
--cc=darren.kenny@oracle.com \
--cc=ehabkost@redhat.com \
--cc=fam@euphon.net \
--cc=kwolf@redhat.com \
--cc=lvivier@redhat.com \
--cc=marcandre.lureau@redhat.com \
--cc=mreitz@redhat.com \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=rth@twiddle.net \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).