jcs.org
qemu with hax to log dma reads & writes
jcs.org/2018/11/12/vfio
fuzz: add virtio-net fuzz target
The virtio-net fuzz target feeds inputs to all three virtio-net
virtqueues, and uses forking to avoid leaking state between fuzz runs.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-id: 20200220041118.23264-21-alxndr@bu.edu
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
authored by
Alexander Bulekov
and committed by
Stefan Hajnoczi
b1db8c63
04f71324
+199
+1
tests/qtest/fuzz/Makefile.include
+1
tests/qtest/fuzz/Makefile.include
+198
tests/qtest/fuzz/virtio_net_fuzz.c
+198
tests/qtest/fuzz/virtio_net_fuzz.c
···
1
+
/*
2
+
* virtio-net Fuzzing Target
3
+
*
4
+
* Copyright Red Hat Inc., 2019
5
+
*
6
+
* Authors:
7
+
* Alexander Bulekov <alxndr@bu.edu>
8
+
*
9
+
* This work is licensed under the terms of the GNU GPL, version 2 or later.
10
+
* See the COPYING file in the top-level directory.
11
+
*/
12
+
13
+
#include "qemu/osdep.h"
14
+
15
+
#include "standard-headers/linux/virtio_config.h"
16
+
#include "tests/qtest/libqtest.h"
17
+
#include "tests/qtest/libqos/virtio-net.h"
18
+
#include "fuzz.h"
19
+
#include "fork_fuzz.h"
20
+
#include "qos_fuzz.h"
21
+
22
+
23
+
#define QVIRTIO_NET_TIMEOUT_US (30 * 1000 * 1000)
24
+
#define QVIRTIO_RX_VQ 0
25
+
#define QVIRTIO_TX_VQ 1
26
+
#define QVIRTIO_CTRL_VQ 2
27
+
28
+
static int sockfds[2];
29
+
static bool sockfds_initialized;
30
+
31
+
static void virtio_net_fuzz_multi(QTestState *s,
32
+
const unsigned char *Data, size_t Size, bool check_used)
33
+
{
34
+
typedef struct vq_action {
35
+
uint8_t queue;
36
+
uint8_t length;
37
+
uint8_t write;
38
+
uint8_t next;
39
+
uint8_t rx;
40
+
} vq_action;
41
+
42
+
uint32_t free_head = 0;
43
+
44
+
QGuestAllocator *t_alloc = fuzz_qos_alloc;
45
+
46
+
QVirtioNet *net_if = fuzz_qos_obj;
47
+
QVirtioDevice *dev = net_if->vdev;
48
+
QVirtQueue *q;
49
+
vq_action vqa;
50
+
while (Size >= sizeof(vqa)) {
51
+
memcpy(&vqa, Data, sizeof(vqa));
52
+
Data += sizeof(vqa);
53
+
Size -= sizeof(vqa);
54
+
55
+
q = net_if->queues[vqa.queue % 3];
56
+
57
+
vqa.length = vqa.length >= Size ? Size : vqa.length;
58
+
59
+
/*
60
+
* Only attempt to write incoming packets, when using the socket
61
+
* backend. Otherwise, always place the input on a virtqueue.
62
+
*/
63
+
if (vqa.rx && sockfds_initialized) {
64
+
write(sockfds[0], Data, vqa.length);
65
+
} else {
66
+
vqa.rx = 0;
67
+
uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
68
+
/*
69
+
* If checking used ring, ensure that the fuzzer doesn't trigger
70
+
* trivial asserion failure on zero-zied buffer
71
+
*/
72
+
qtest_memwrite(s, req_addr, Data, vqa.length);
73
+
74
+
75
+
free_head = qvirtqueue_add(s, q, req_addr, vqa.length,
76
+
vqa.write, vqa.next);
77
+
qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
78
+
qvirtqueue_kick(s, dev, q, free_head);
79
+
}
80
+
81
+
/* Run the main loop */
82
+
qtest_clock_step(s, 100);
83
+
flush_events(s);
84
+
85
+
/* Wait on used descriptors */
86
+
if (check_used && !vqa.rx) {
87
+
gint64 start_time = g_get_monotonic_time();
88
+
/*
89
+
* normally, we could just use qvirtio_wait_used_elem, but since we
90
+
* must manually run the main-loop for all the bhs to run, we use
91
+
* this hack with flush_events(), to run the main_loop
92
+
*/
93
+
while (!vqa.rx && q != net_if->queues[QVIRTIO_RX_VQ]) {
94
+
uint32_t got_desc_idx;
95
+
/* Input led to a virtio_error */
96
+
if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET) {
97
+
break;
98
+
}
99
+
if (dev->bus->get_queue_isr_status(dev, q) &&
100
+
qvirtqueue_get_buf(s, q, &got_desc_idx, NULL)) {
101
+
g_assert_cmpint(got_desc_idx, ==, free_head);
102
+
break;
103
+
}
104
+
g_assert(g_get_monotonic_time() - start_time
105
+
<= QVIRTIO_NET_TIMEOUT_US);
106
+
107
+
/* Run the main loop */
108
+
qtest_clock_step(s, 100);
109
+
flush_events(s);
110
+
}
111
+
}
112
+
Data += vqa.length;
113
+
Size -= vqa.length;
114
+
}
115
+
}
116
+
117
+
static void virtio_net_fork_fuzz(QTestState *s,
118
+
const unsigned char *Data, size_t Size)
119
+
{
120
+
if (fork() == 0) {
121
+
virtio_net_fuzz_multi(s, Data, Size, false);
122
+
flush_events(s);
123
+
_Exit(0);
124
+
} else {
125
+
wait(NULL);
126
+
}
127
+
}
128
+
129
+
static void virtio_net_fork_fuzz_check_used(QTestState *s,
130
+
const unsigned char *Data, size_t Size)
131
+
{
132
+
if (fork() == 0) {
133
+
virtio_net_fuzz_multi(s, Data, Size, true);
134
+
flush_events(s);
135
+
_Exit(0);
136
+
} else {
137
+
wait(NULL);
138
+
}
139
+
}
140
+
141
+
static void virtio_net_pre_fuzz(QTestState *s)
142
+
{
143
+
qos_init_path(s);
144
+
counter_shm_init();
145
+
}
146
+
147
+
static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
148
+
{
149
+
int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sockfds);
150
+
g_assert_cmpint(ret, !=, -1);
151
+
fcntl(sockfds[0], F_SETFL, O_NONBLOCK);
152
+
sockfds_initialized = true;
153
+
g_string_append_printf(cmd_line, " -netdev socket,fd=%d,id=hs0 ",
154
+
sockfds[1]);
155
+
return arg;
156
+
}
157
+
158
+
static void *virtio_net_test_setup_user(GString *cmd_line, void *arg)
159
+
{
160
+
g_string_append_printf(cmd_line, " -netdev user,id=hs0 ");
161
+
return arg;
162
+
}
163
+
164
+
static void register_virtio_net_fuzz_targets(void)
165
+
{
166
+
fuzz_add_qos_target(&(FuzzTarget){
167
+
.name = "virtio-net-socket",
168
+
.description = "Fuzz the virtio-net virtual queues. Fuzz incoming "
169
+
"traffic using the socket backend",
170
+
.pre_fuzz = &virtio_net_pre_fuzz,
171
+
.fuzz = virtio_net_fork_fuzz,},
172
+
"virtio-net",
173
+
&(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
174
+
);
175
+
176
+
fuzz_add_qos_target(&(FuzzTarget){
177
+
.name = "virtio-net-socket-check-used",
178
+
.description = "Fuzz the virtio-net virtual queues. Wait for the "
179
+
"descriptors to be used. Timeout may indicate improperly handled "
180
+
"input",
181
+
.pre_fuzz = &virtio_net_pre_fuzz,
182
+
.fuzz = virtio_net_fork_fuzz_check_used,},
183
+
"virtio-net",
184
+
&(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
185
+
);
186
+
fuzz_add_qos_target(&(FuzzTarget){
187
+
.name = "virtio-net-slirp",
188
+
.description = "Fuzz the virtio-net virtual queues with the slirp "
189
+
" backend. Warning: May result in network traffic emitted from the "
190
+
" process. Run in an isolated network environment.",
191
+
.pre_fuzz = &virtio_net_pre_fuzz,
192
+
.fuzz = virtio_net_fork_fuzz,},
193
+
"virtio-net",
194
+
&(QOSGraphTestOptions){.before = virtio_net_test_setup_user}
195
+
);
196
+
}
197
+
198
+
fuzz_target_init(register_virtio_net_fuzz_targets);