| Message ID | 20210120060745.558970-1-alxndr@bu.edu (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | fuzz: refine the ide/ahci fuzzer configs | expand |
On 1/20/21 7:07 AM, Alexander Bulekov wrote: > Disks work differently depending on the x86 machine type (SATA vs PATA). > Additionally, we should fuzz the atapi code paths, which might contain > vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and > cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA) > machine types. Yet another point for using qgraph generated configs ;)
On 20/01/2021 07.07, Alexander Bulekov wrote: > Disks work differently depending on the x86 machine type (SATA vs PATA). > Additionally, we should fuzz the atapi code paths, which might contain > vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and > cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA) > machine types. > > Signed-off-by: Alexander Bulekov <alxndr@bu.edu> > --- > tests/qtest/fuzz/generic_fuzz_configs.h | 20 +++++++++++++++++++- > 1 file changed, 19 insertions(+), 1 deletion(-) > > diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h b/tests/qtest/fuzz/generic_fuzz_configs.h > index 7fed035345..2ec52fbb63 100644 > --- a/tests/qtest/fuzz/generic_fuzz_configs.h > +++ b/tests/qtest/fuzz/generic_fuzz_configs.h > @@ -85,10 +85,28 @@ const generic_fuzz_config predefined_configs[] = { > .objects = "intel-hda", > },{ > .name = "ide-hd", > + .args = "-machine pc -nodefaults " > + "-drive file=null-co://,if=none,format=raw,id=disk0 " > + "-device ide-hd,drive=disk0", > + .objects = "*ide*", > + },{ > + .name = "ide-atapi", > + .args = "-machine pc -nodefaults " > + "-drive file=null-co://,if=none,format=raw,id=disk0 " > + "-device ide-cd,drive=disk0", > + .objects = "*ide*", > + },{ > + .name = "ahci-hd", > + .args = "-machine q35 -nodefaults " > + "-drive file=null-co://,if=none,format=raw,id=disk0 " > + "-device ide-hd,drive=disk0", > + .objects = "*ahci*", > + },{ > + .name = "ahci-atapi", > .args = "-machine q35 -nodefaults " > "-drive file=null-co://,if=none,format=raw,id=disk0 " > "-device ide-hd,drive=disk0", Shouldn't that be ide-cd now for ahci-atapi? Thomas
On 210120 1053, Thomas Huth wrote: > On 20/01/2021 07.07, Alexander Bulekov wrote: > > Disks work differently depending on the x86 machine type (SATA vs PATA). > > Additionally, we should fuzz the atapi code paths, which might contain > > vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and > > cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA) > > machine types. > > > > Signed-off-by: Alexander Bulekov <alxndr@bu.edu> > > --- > > tests/qtest/fuzz/generic_fuzz_configs.h | 20 +++++++++++++++++++- > > 1 file changed, 19 insertions(+), 1 deletion(-) > > > > diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h b/tests/qtest/fuzz/generic_fuzz_configs.h > > index 7fed035345..2ec52fbb63 100644 > > --- a/tests/qtest/fuzz/generic_fuzz_configs.h > > +++ b/tests/qtest/fuzz/generic_fuzz_configs.h > > @@ -85,10 +85,28 @@ const generic_fuzz_config predefined_configs[] = { > > .objects = "intel-hda", > > },{ > > .name = "ide-hd", > > + .args = "-machine pc -nodefaults " > > + "-drive file=null-co://,if=none,format=raw,id=disk0 " > > + "-device ide-hd,drive=disk0", > > + .objects = "*ide*", > > + },{ > > + .name = "ide-atapi", > > + .args = "-machine pc -nodefaults " > > + "-drive file=null-co://,if=none,format=raw,id=disk0 " > > + "-device ide-cd,drive=disk0", > > + .objects = "*ide*", > > + },{ > > + .name = "ahci-hd", > > + .args = "-machine q35 -nodefaults " > > + "-drive file=null-co://,if=none,format=raw,id=disk0 " > > + "-device ide-hd,drive=disk0", > > + .objects = "*ahci*", > > + },{ > > + .name = "ahci-atapi", > > .args = "-machine q35 -nodefaults " > > "-drive file=null-co://,if=none,format=raw,id=disk0 " > > "-device ide-hd,drive=disk0", > > Shouldn't that be ide-cd now for ahci-atapi? Thanks for catching that. -Alex > > Thomas >
On 210120 1003, Philippe Mathieu-Daudé wrote: > On 1/20/21 7:07 AM, Alexander Bulekov wrote: > > Disks work differently depending on the x86 machine type (SATA vs PATA). > > Additionally, we should fuzz the atapi code paths, which might contain > > vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and > > cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA) > > machine types. > > Yet another point for using qgraph generated configs ;) > Yes. Though in this particular case, ahci-test.c and ide-test.c still do their own disk setup, and -drive arguments. I don't think PATA is built out within libqos at all, yet.
diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h b/tests/qtest/fuzz/generic_fuzz_configs.h index 7fed035345..2ec52fbb63 100644 --- a/tests/qtest/fuzz/generic_fuzz_configs.h +++ b/tests/qtest/fuzz/generic_fuzz_configs.h @@ -85,10 +85,28 @@ const generic_fuzz_config predefined_configs[] = { .objects = "intel-hda", },{ .name = "ide-hd", + .args = "-machine pc -nodefaults " + "-drive file=null-co://,if=none,format=raw,id=disk0 " + "-device ide-hd,drive=disk0", + .objects = "*ide*", + },{ + .name = "ide-atapi", + .args = "-machine pc -nodefaults " + "-drive file=null-co://,if=none,format=raw,id=disk0 " + "-device ide-cd,drive=disk0", + .objects = "*ide*", + },{ + .name = "ahci-hd", + .args = "-machine q35 -nodefaults " + "-drive file=null-co://,if=none,format=raw,id=disk0 " + "-device ide-hd,drive=disk0", + .objects = "*ahci*", + },{ + .name = "ahci-atapi", .args = "-machine q35 -nodefaults " "-drive file=null-co://,if=none,format=raw,id=disk0 " "-device ide-hd,drive=disk0", - .objects = "ahci*", + .objects = "*ahci*", },{ .name = "floppy", .args = "-machine pc -nodefaults -device floppy,id=floppy0 "
Disks work differently depending on the x86 machine type (SATA vs PATA). Additionally, we should fuzz the atapi code paths, which might contain vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA) machine types. Signed-off-by: Alexander Bulekov <alxndr@bu.edu> --- tests/qtest/fuzz/generic_fuzz_configs.h | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)