jcs.org
qemu with hax to log dma reads & writes
jcs.org/2018/11/12/vfio
fuzz: add fuzzer skeleton
tests/fuzz/fuzz.c serves as the entry point for the virtual-device
fuzzer. Namely, libfuzzer invokes the LLVMFuzzerInitialize and
LLVMFuzzerTestOneInput functions, both of which are defined in this
file. This change adds a "FuzzTarget" struct, along with the
fuzz_add_target function, which should be used to define new fuzz
targets.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-id: 20200220041118.23264-13-alxndr@bu.edu
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
authored by
Alexander Bulekov
and committed by
Stefan Hajnoczi
5f6fd09a
f62a0bff
+288
+8
MAINTAINERS
+8
MAINTAINERS
···
2184
2184
F: accel/qtest.c
2185
2185
F: tests/qtest/
2186
2186
2187
+
Device Fuzzing
2188
+
M: Alexander Bulekov <alxndr@bu.edu>
2189
+
R: Paolo Bonzini <pbonzini@redhat.com>
2190
+
R: Bandan Das <bsd@redhat.com>
2191
+
R: Stefan Hajnoczi <stefanha@redhat.com>
2192
+
S: Maintained
2193
+
F: tests/qtest/fuzz/
2194
+
2187
2195
Register API
2188
2196
M: Alistair Francis <alistair@alistair23.me>
2189
2197
S: Maintained
+6
tests/qtest/fuzz/Makefile.include
+6
tests/qtest/fuzz/Makefile.include
+179
tests/qtest/fuzz/fuzz.c
+179
tests/qtest/fuzz/fuzz.c
···
1
+
/*
2
+
* fuzzing driver
3
+
*
4
+
* Copyright Red Hat Inc., 2019
5
+
*
6
+
* Authors:
7
+
* Alexander Bulekov <alxndr@bu.edu>
8
+
*
9
+
* This work is licensed under the terms of the GNU GPL, version 2 or later.
10
+
* See the COPYING file in the top-level directory.
11
+
*
12
+
*/
13
+
14
+
#include "qemu/osdep.h"
15
+
16
+
#include <wordexp.h>
17
+
18
+
#include "sysemu/qtest.h"
19
+
#include "sysemu/runstate.h"
20
+
#include "sysemu/sysemu.h"
21
+
#include "qemu/main-loop.h"
22
+
#include "tests/qtest/libqtest.h"
23
+
#include "tests/qtest/libqos/qgraph.h"
24
+
#include "fuzz.h"
25
+
26
+
#define MAX_EVENT_LOOPS 10
27
+
28
+
typedef struct FuzzTargetState {
29
+
FuzzTarget *target;
30
+
QSLIST_ENTRY(FuzzTargetState) target_list;
31
+
} FuzzTargetState;
32
+
33
+
typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList;
34
+
35
+
static const char *fuzz_arch = TARGET_NAME;
36
+
37
+
static FuzzTargetList *fuzz_target_list;
38
+
static FuzzTarget *fuzz_target;
39
+
static QTestState *fuzz_qts;
40
+
41
+
42
+
43
+
void flush_events(QTestState *s)
44
+
{
45
+
int i = MAX_EVENT_LOOPS;
46
+
while (g_main_context_pending(NULL) && i-- > 0) {
47
+
main_loop_wait(false);
48
+
}
49
+
}
50
+
51
+
static QTestState *qtest_setup(void)
52
+
{
53
+
qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts);
54
+
return qtest_inproc_init(&fuzz_qts, false, fuzz_arch,
55
+
&qtest_server_inproc_recv);
56
+
}
57
+
58
+
void fuzz_add_target(const FuzzTarget *target)
59
+
{
60
+
FuzzTargetState *tmp;
61
+
FuzzTargetState *target_state;
62
+
if (!fuzz_target_list) {
63
+
fuzz_target_list = g_new0(FuzzTargetList, 1);
64
+
}
65
+
66
+
QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
67
+
if (g_strcmp0(tmp->target->name, target->name) == 0) {
68
+
fprintf(stderr, "Error: Fuzz target name %s already in use\n",
69
+
target->name);
70
+
abort();
71
+
}
72
+
}
73
+
target_state = g_new0(FuzzTargetState, 1);
74
+
target_state->target = g_new0(FuzzTarget, 1);
75
+
*(target_state->target) = *target;
76
+
QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list);
77
+
}
78
+
79
+
80
+
81
+
static void usage(char *path)
82
+
{
83
+
printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path);
84
+
printf("where FUZZ_TARGET is one of:\n");
85
+
FuzzTargetState *tmp;
86
+
if (!fuzz_target_list) {
87
+
fprintf(stderr, "Fuzz target list not initialized\n");
88
+
abort();
89
+
}
90
+
QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
91
+
printf(" * %s : %s\n", tmp->target->name,
92
+
tmp->target->description);
93
+
}
94
+
exit(0);
95
+
}
96
+
97
+
static FuzzTarget *fuzz_get_target(char* name)
98
+
{
99
+
FuzzTargetState *tmp;
100
+
if (!fuzz_target_list) {
101
+
fprintf(stderr, "Fuzz target list not initialized\n");
102
+
abort();
103
+
}
104
+
105
+
QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
106
+
if (strcmp(tmp->target->name, name) == 0) {
107
+
return tmp->target;
108
+
}
109
+
}
110
+
return NULL;
111
+
}
112
+
113
+
114
+
/* Executed for each fuzzing-input */
115
+
int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size)
116
+
{
117
+
/*
118
+
* Do the pre-fuzz-initialization before the first fuzzing iteration,
119
+
* instead of before the actual fuzz loop. This is needed since libfuzzer
120
+
* may fork off additional workers, prior to the fuzzing loop, and if
121
+
* pre_fuzz() sets up e.g. shared memory, this should be done for the
122
+
* individual worker processes
123
+
*/
124
+
static int pre_fuzz_done;
125
+
if (!pre_fuzz_done && fuzz_target->pre_fuzz) {
126
+
fuzz_target->pre_fuzz(fuzz_qts);
127
+
pre_fuzz_done = true;
128
+
}
129
+
130
+
fuzz_target->fuzz(fuzz_qts, Data, Size);
131
+
return 0;
132
+
}
133
+
134
+
/* Executed once, prior to fuzzing */
135
+
int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
136
+
{
137
+
138
+
char *target_name;
139
+
140
+
/* Initialize qgraph and modules */
141
+
qos_graph_init();
142
+
module_call_init(MODULE_INIT_FUZZ_TARGET);
143
+
module_call_init(MODULE_INIT_QOM);
144
+
module_call_init(MODULE_INIT_LIBQOS);
145
+
146
+
if (*argc <= 1) {
147
+
usage(**argv);
148
+
}
149
+
150
+
/* Identify the fuzz target */
151
+
target_name = (*argv)[1];
152
+
if (!strstr(target_name, "--fuzz-target=")) {
153
+
usage(**argv);
154
+
}
155
+
156
+
target_name += strlen("--fuzz-target=");
157
+
158
+
fuzz_target = fuzz_get_target(target_name);
159
+
if (!fuzz_target) {
160
+
usage(**argv);
161
+
}
162
+
163
+
fuzz_qts = qtest_setup();
164
+
165
+
if (fuzz_target->pre_vm_init) {
166
+
fuzz_target->pre_vm_init();
167
+
}
168
+
169
+
/* Run QEMU's softmmu main with the fuzz-target dependent arguments */
170
+
const char *init_cmdline = fuzz_target->get_init_cmdline(fuzz_target);
171
+
172
+
/* Split the runcmd into an argv and argc */
173
+
wordexp_t result;
174
+
wordexp(init_cmdline, &result, 0);
175
+
176
+
qemu_init(result.we_wordc, result.we_wordv, NULL);
177
+
178
+
return 0;
179
+
}
+95
tests/qtest/fuzz/fuzz.h
+95
tests/qtest/fuzz/fuzz.h
···
1
+
/*
2
+
* fuzzing driver
3
+
*
4
+
* Copyright Red Hat Inc., 2019
5
+
*
6
+
* Authors:
7
+
* Alexander Bulekov <alxndr@bu.edu>
8
+
*
9
+
* This work is licensed under the terms of the GNU GPL, version 2 or later.
10
+
* See the COPYING file in the top-level directory.
11
+
*
12
+
*/
13
+
14
+
#ifndef FUZZER_H_
15
+
#define FUZZER_H_
16
+
17
+
#include "qemu/osdep.h"
18
+
#include "qemu/units.h"
19
+
#include "qapi/error.h"
20
+
21
+
#include "tests/qtest/libqtest.h"
22
+
23
+
/**
24
+
* A libfuzzer fuzzing target
25
+
*
26
+
* The QEMU fuzzing binary is built with all available targets, each
27
+
* with a unique @name that can be specified on the command-line to
28
+
* select which target should run.
29
+
*
30
+
* A target must implement ->fuzz() to process a random input. If QEMU
31
+
* crashes in ->fuzz() then libfuzzer will record a failure.
32
+
*
33
+
* Fuzzing targets are registered with fuzz_add_target():
34
+
*
35
+
* static const FuzzTarget fuzz_target = {
36
+
* .name = "my-device-fifo",
37
+
* .description = "Fuzz the FIFO buffer registers of my-device",
38
+
* ...
39
+
* };
40
+
*
41
+
* static void register_fuzz_target(void)
42
+
* {
43
+
* fuzz_add_target(&fuzz_target);
44
+
* }
45
+
* fuzz_target_init(register_fuzz_target);
46
+
*/
47
+
typedef struct FuzzTarget {
48
+
const char *name; /* target identifier (passed to --fuzz-target=)*/
49
+
const char *description; /* help text */
50
+
51
+
52
+
/*
53
+
* returns the arg-list that is passed to qemu/softmmu init()
54
+
* Cannot be NULL
55
+
*/
56
+
const char* (*get_init_cmdline)(struct FuzzTarget *);
57
+
58
+
/*
59
+
* will run once, prior to running qemu/softmmu init.
60
+
* eg: set up shared-memory for communication with the child-process
61
+
* Can be NULL
62
+
*/
63
+
void(*pre_vm_init)(void);
64
+
65
+
/*
66
+
* will run once, after QEMU has been initialized, prior to the fuzz-loop.
67
+
* eg: detect the memory map
68
+
* Can be NULL
69
+
*/
70
+
void(*pre_fuzz)(QTestState *);
71
+
72
+
/*
73
+
* accepts and executes an input from libfuzzer. this is repeatedly
74
+
* executed during the fuzzing loop. Its should handle setup, input
75
+
* execution and cleanup.
76
+
* Cannot be NULL
77
+
*/
78
+
void(*fuzz)(QTestState *, const unsigned char *, size_t);
79
+
80
+
} FuzzTarget;
81
+
82
+
void flush_events(QTestState *);
83
+
void reboot(QTestState *);
84
+
85
+
/*
86
+
* makes a copy of *target and adds it to the target-list.
87
+
* i.e. fine to set up target on the caller's stack
88
+
*/
89
+
void fuzz_add_target(const FuzzTarget *target);
90
+
91
+
int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size);
92
+
int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp);
93
+
94
+
#endif
95
+