| Message ID | 20191030144926.11873-16-alxndr@bu.edu (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Add virtual device fuzzing support | expand |
On Wed, Oct 30, 2019 at 02:50:00PM +0000, Oleinik, Alexander wrote: > diff --git a/tests/fuzz/fuzz.c b/tests/fuzz/fuzz.c > new file mode 100644 > index 0000000000..0e38f81c48 > --- /dev/null > +++ b/tests/fuzz/fuzz.c > @@ -0,0 +1,177 @@ > +/* > + * fuzzing driver > + * > + * Copyright Red Hat Inc., 2019 > + * > + * Authors: > + * Alexander Bulekov <alxndr@bu.edu> Bulekov instead of Oleinik? > + * > + * This work is licensed under the terms of the GNU GPL, version 2 or later. > + * See the COPYING file in the top-level directory. > + * > + */ > + > +#include "qemu/osdep.h" > + > +#include <stdio.h> > +#include <stdlib.h> stdio.h and stdlib.h are already included by qemu/osdep.h. > +/* Executed for each fuzzing-input */ > +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) > +{ > + if (fuzz_target->fuzz) { Will this ever be NULL? > + fuzz_target->fuzz(fuzz_qts, Data, Size); > + } > + return 0; > +} > + > +/* Executed once, prior to fuzzing */ > +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) > +{ > + > + char *target_name; > + > + /* Initialize qgraph and modules */ > + qos_graph_init(); > + module_call_init(MODULE_INIT_FUZZ_TARGET); > + module_call_init(MODULE_INIT_QOM); > + module_call_init(MODULE_INIT_LIBQOS); > + > + if (*argc <= 1) { > + usage(**argv); > + } > + > + /* Identify the fuzz target */ > + target_name = (*argv)[1]; > + if (!strstr(target_name, "--fuzz-target=")) { > + usage(**argv); > + } > + > + target_name += strlen("--fuzz-target="); > + > + fuzz_target = fuzz_get_target(target_name); > + if (!fuzz_target) { > + usage(**argv); > + } > + > + fuzz_qts = qtest_setup(); > + > + if (!fuzz_target) { This is dead code since fuzz_target was already checked above. Please remove this if statement. > + fprintf(stderr, "Error: Fuzz fuzz_target name %s not found\n", > + target_name); > + usage(**argv); > + } > + > + if (fuzz_target->pre_vm_init) { > + fuzz_target->pre_vm_init(); > + } > + > + /* Run QEMU's softmmu main with the fuzz-target dependent arguments */ > + char *init_cmdline = fuzz_target->get_init_cmdline(fuzz_target); Where is init_cmdline freed or should this be const char *? > + wordexp_t result; > + wordexp(init_cmdline, &result, 0); What is the purpose of word expansion here? > + > + qemu_init(result.we_wordc, result.we_wordv, NULL); > + > + if (fuzz_target->pre_fuzz) { > + fuzz_target->pre_fuzz(fuzz_qts); > + } > + > + return 0; > +} > diff --git a/tests/fuzz/fuzz.h b/tests/fuzz/fuzz.h > new file mode 100644 > index 0000000000..b569b622d7 > --- /dev/null > +++ b/tests/fuzz/fuzz.h > @@ -0,0 +1,66 @@ > +/* > + * fuzzing driver > + * > + * Copyright Red Hat Inc., 2019 > + * > + * Authors: > + * Alexander Bulekov <alxndr@bu.edu> > + * > + * This work is licensed under the terms of the GNU GPL, version 2 or later. > + * See the COPYING file in the top-level directory. > + * > + */ > + > +#ifndef FUZZER_H_ > +#define FUZZER_H_ > + > +#include "qemu/osdep.h" > +#include "qemu/units.h" > +#include "qapi/error.h" > +#include "exec/memory.h" > +#include "tests/libqtest.h" > + > + Some documentation would be nice: /** * A libfuzzer fuzzing target * * The QEMU fuzzing binary is built with all available targets, each * with a unique @name that can be specified on the command-line to * select which target should run. * * A target must implement ->fuzz() to process a random input. If QEMU * crashes in ->fuzz() then libfuzzer will record a failure. * * Fuzzing targets are registered with fuzz_add_target(): * * static const FuzzTarget fuzz_target = { * .name = "my-device-fifo", * .description = "Fuzz the FIFO buffer registers of my-device", * ... * }; * * static void register_fuzz_target(void) * { * fuzz_add_target(&fuzz_target); * } * fuzz_target_init(register_fuzz_target); */ > +typedef struct FuzzTarget { > + const char *name; /* command-line option(FUZZ_TARGET) for the target */ > + const char *description; /* help text */ > + If any of the function pointers can be NULL, please document this. > + /* returns the arg-list that is passed to qemu/softmmu init() */ > + char* (*get_init_cmdline)(struct FuzzTarget *); Does the caller need to call g_free() on the returned string? Please document this. > + > + /* > + * will run once, prior to running qemu/softmmu init. > + * eg: set up shared-memory for communication with the child-process > + */ > + void(*pre_vm_init)(void); > + > + /* > + * will run once, prior to to the fuzz-loop. s/to to/to/ > + * eg: detect the memory map > + */ > + void(*pre_fuzz)(QTestState *); Please also mention that QEMU has been initialized at this point. > + > + /* > + * accepts and executes an input from libfuzzer. this is repeatedly > + * executed during the fuzzing loop. Its should handle setup, input > + * execution and cleanup > + */ > + void(*fuzz)(QTestState *, const unsigned char *, size_t); > + > +} FuzzTarget; > + > +void flush_events(QTestState *); > +void reboot(QTestState *); > + > +/* > + * makes a copy of *target and adds it to the target-list. > + * i.e. fine to set up target on the caller's stack > + */ > +void fuzz_add_target(FuzzTarget *target); "makes a copy of *target" -> does this mean the argument type can be const FuzzTarget *target?
On 11/7/19 7:55 AM, Stefan Hajnoczi wrote: > On Wed, Oct 30, 2019 at 02:50:00PM +0000, Oleinik, Alexander wrote: >> diff --git a/tests/fuzz/fuzz.c b/tests/fuzz/fuzz.c >> new file mode 100644 >> index 0000000000..0e38f81c48 >> --- /dev/null >> +++ b/tests/fuzz/fuzz.c >> @@ -0,0 +1,177 @@ >> +/* >> + * fuzzing driver >> + * >> + * Copyright Red Hat Inc., 2019 >> + * >> + * Authors: >> + * Alexander Bulekov <alxndr@bu.edu> > > Bulekov instead of Oleinik? Yes I changed my last name and the approval from the court finally came through last week :) I'll make sure its consistent across v5. >> + * >> + * This work is licensed under the terms of the GNU GPL, version 2 or later. >> + * See the COPYING file in the top-level directory. >> + * >> + */ >> + >> +#include "qemu/osdep.h" >> + >> +#include <stdio.h> >> +#include <stdlib.h> > > stdio.h and stdlib.h are already included by qemu/osdep.h. > >> +/* Executed for each fuzzing-input */ >> +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) >> +{ >> + if (fuzz_target->fuzz) { > > Will this ever be NULL? I'll remove the check >> + fuzz_target->fuzz(fuzz_qts, Data, Size); >> + } >> + return 0; >> +} >> + >> +/* Executed once, prior to fuzzing */ >> +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) >> +{ >> + >> + char *target_name; >> + >> + /* Initialize qgraph and modules */ >> + qos_graph_init(); >> + module_call_init(MODULE_INIT_FUZZ_TARGET); >> + module_call_init(MODULE_INIT_QOM); >> + module_call_init(MODULE_INIT_LIBQOS); >> + >> + if (*argc <= 1) { >> + usage(**argv); >> + } >> + >> + /* Identify the fuzz target */ >> + target_name = (*argv)[1]; >> + if (!strstr(target_name, "--fuzz-target=")) { >> + usage(**argv); >> + } >> + >> + target_name += strlen("--fuzz-target="); >> + >> + fuzz_target = fuzz_get_target(target_name); >> + if (!fuzz_target) { >> + usage(**argv); >> + } >> + >> + fuzz_qts = qtest_setup(); >> + >> + if (!fuzz_target) { > > This is dead code since fuzz_target was already checked above. Please > remove this if statement. > >> + fprintf(stderr, "Error: Fuzz fuzz_target name %s not found\n", >> + target_name); >> + usage(**argv); >> + } >> + >> + if (fuzz_target->pre_vm_init) { >> + fuzz_target->pre_vm_init(); >> + } >> + >> + /* Run QEMU's softmmu main with the fuzz-target dependent arguments */ >> + char *init_cmdline = fuzz_target->get_init_cmdline(fuzz_target); > > Where is init_cmdline freed or should this be const char *? > >> + wordexp_t result; >> + wordexp(init_cmdline, &result, 0); > > What is the purpose of word expansion here? The fuzz target devs can specify arguments in a single string and not worry about calculating the argc and **argv - we take care of it for them. >> + >> + qemu_init(result.we_wordc, result.we_wordv, NULL); >> + >> + if (fuzz_target->pre_fuzz) { >> + fuzz_target->pre_fuzz(fuzz_qts); >> + } >> + >> + return 0; >> +} >> diff --git a/tests/fuzz/fuzz.h b/tests/fuzz/fuzz.h >> new file mode 100644 >> index 0000000000..b569b622d7 >> --- /dev/null >> +++ b/tests/fuzz/fuzz.h >> @@ -0,0 +1,66 @@ >> +/* >> + * fuzzing driver >> + * >> + * Copyright Red Hat Inc., 2019 >> + * >> + * Authors: >> + * Alexander Bulekov <alxndr@bu.edu> >> + * >> + * This work is licensed under the terms of the GNU GPL, version 2 or later. >> + * See the COPYING file in the top-level directory. >> + * >> + */ >> + >> +#ifndef FUZZER_H_ >> +#define FUZZER_H_ >> + >> +#include "qemu/osdep.h" >> +#include "qemu/units.h" >> +#include "qapi/error.h" >> +#include "exec/memory.h" >> +#include "tests/libqtest.h" >> + >> + > > Some documentation would be nice: > ... > Does the caller need to call g_free() on the returned string? Please > document this. ... > s/to to/to/ ... > Please also mention that QEMU has been initialized at this point. > ... > "makes a copy of *target" -> does this mean the argument type can be > const FuzzTarget *target? > Thanks - I made changes to address these. -Alex
diff --git a/tests/fuzz/Makefile.include b/tests/fuzz/Makefile.include index 324e6c1433..b415b056b0 100644 --- a/tests/fuzz/Makefile.include +++ b/tests/fuzz/Makefile.include @@ -1,4 +1,4 @@ -# QEMU_PROG_FUZZ=qemu-fuzz-$(TARGET_NAME)$(EXESUF) +QEMU_PROG_FUZZ=qemu-fuzz-$(TARGET_NAME)$(EXESUF) fuzz-obj-y = $(libqos-obj-y) fuzz-obj-y += tests/libqtest.o - +fuzz-obj-y += tests/fuzz/fuzz.o diff --git a/tests/fuzz/fuzz.c b/tests/fuzz/fuzz.c new file mode 100644 index 0000000000..0e38f81c48 --- /dev/null +++ b/tests/fuzz/fuzz.c @@ -0,0 +1,177 @@ +/* + * fuzzing driver + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#include "qemu/osdep.h" + +#include <stdio.h> +#include <stdlib.h> +#include <wordexp.h> + + +#include "tests/libqtest.h" +#include "sysemu/qtest.h" +#include "fuzz.h" +#include "tests/libqos/qgraph.h" +#include "sysemu/runstate.h" +#include "sysemu/sysemu.h" +#include "qemu/main-loop.h" + +typedef struct FuzzTargetState { + FuzzTarget *target; + QSLIST_ENTRY(FuzzTargetState) target_list; +} FuzzTargetState; + +typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList; + +static const char *fuzz_arch = TARGET_NAME; + +static FuzzTargetList *fuzz_target_list; +static FuzzTarget *fuzz_target; +static QTestState *fuzz_qts; + + + +void flush_events(QTestState *s) +{ + int i = 10; + while (g_main_context_pending(NULL) && i-- > 0) { + main_loop_wait(false); + } +} + +static QTestState *qtest_setup(void) +{ + qtest_server_set_tx_handler(&qtest_client_inproc_recv, NULL); + return qtest_inproc_init(false, fuzz_arch, &qtest_server_inproc_recv); +} + +void fuzz_add_target(FuzzTarget *target) +{ + FuzzTargetState *tmp; + FuzzTargetState *target_state; + if (!fuzz_target_list) { + fuzz_target_list = g_new0(FuzzTargetList, 1); + } + + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + if (g_strcmp0(tmp->target->name, target->name) == 0) { + fprintf(stderr, "Error: Fuzz target name %s already in use\n", + target->name); + abort(); + } + } + target_state = g_new0(FuzzTargetState, 1); + target_state->target = g_new0(FuzzTarget, 1); + *(target_state->target) = *target; + QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list); +} + + + +static void usage(char *path) +{ + printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path); + printf("where FUZZ_TARGET is one of:\n"); + FuzzTargetState *tmp; + if (!fuzz_target_list) { + fprintf(stderr, "Fuzz target list not initialized\n"); + abort(); + } + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + printf(" %s : %s\n", tmp->target->name, + tmp->target->description); + } + exit(0); +} + +static FuzzTarget *fuzz_get_target(char* name) +{ + FuzzTargetState *tmp; + if (!fuzz_target_list) { + fprintf(stderr, "Fuzz target list not initialized\n"); + abort(); + } + + QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { + if (strcmp(tmp->target->name, name) == 0) { + return tmp->target; + } + } + return NULL; +} + + +/* Executed for each fuzzing-input */ +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) +{ + if (fuzz_target->fuzz) { + fuzz_target->fuzz(fuzz_qts, Data, Size); + } + return 0; +} + +/* Executed once, prior to fuzzing */ +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) +{ + + char *target_name; + + /* Initialize qgraph and modules */ + qos_graph_init(); + module_call_init(MODULE_INIT_FUZZ_TARGET); + module_call_init(MODULE_INIT_QOM); + module_call_init(MODULE_INIT_LIBQOS); + + if (*argc <= 1) { + usage(**argv); + } + + /* Identify the fuzz target */ + target_name = (*argv)[1]; + if (!strstr(target_name, "--fuzz-target=")) { + usage(**argv); + } + + target_name += strlen("--fuzz-target="); + + fuzz_target = fuzz_get_target(target_name); + if (!fuzz_target) { + usage(**argv); + } + + fuzz_qts = qtest_setup(); + + if (!fuzz_target) { + fprintf(stderr, "Error: Fuzz fuzz_target name %s not found\n", + target_name); + usage(**argv); + } + + if (fuzz_target->pre_vm_init) { + fuzz_target->pre_vm_init(); + } + + /* Run QEMU's softmmu main with the fuzz-target dependent arguments */ + char *init_cmdline = fuzz_target->get_init_cmdline(fuzz_target); + + wordexp_t result; + wordexp(init_cmdline, &result, 0); + + qemu_init(result.we_wordc, result.we_wordv, NULL); + + if (fuzz_target->pre_fuzz) { + fuzz_target->pre_fuzz(fuzz_qts); + } + + return 0; +} diff --git a/tests/fuzz/fuzz.h b/tests/fuzz/fuzz.h new file mode 100644 index 0000000000..b569b622d7 --- /dev/null +++ b/tests/fuzz/fuzz.h @@ -0,0 +1,66 @@ +/* + * fuzzing driver + * + * Copyright Red Hat Inc., 2019 + * + * Authors: + * Alexander Bulekov <alxndr@bu.edu> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + * + */ + +#ifndef FUZZER_H_ +#define FUZZER_H_ + +#include "qemu/osdep.h" +#include "qemu/units.h" +#include "qapi/error.h" +#include "exec/memory.h" +#include "tests/libqtest.h" + + +typedef struct FuzzTarget { + const char *name; /* command-line option(FUZZ_TARGET) for the target */ + const char *description; /* help text */ + + + /* returns the arg-list that is passed to qemu/softmmu init() */ + char* (*get_init_cmdline)(struct FuzzTarget *); + + /* + * will run once, prior to running qemu/softmmu init. + * eg: set up shared-memory for communication with the child-process + */ + void(*pre_vm_init)(void); + + /* + * will run once, prior to to the fuzz-loop. + * eg: detect the memory map + */ + void(*pre_fuzz)(QTestState *); + + /* + * accepts and executes an input from libfuzzer. this is repeatedly + * executed during the fuzzing loop. Its should handle setup, input + * execution and cleanup + */ + void(*fuzz)(QTestState *, const unsigned char *, size_t); + +} FuzzTarget; + +void flush_events(QTestState *); +void reboot(QTestState *); + +/* + * makes a copy of *target and adds it to the target-list. + * i.e. fine to set up target on the caller's stack + */ +void fuzz_add_target(FuzzTarget *target); + +int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size); +int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp); + +#endif +