@@ -65,22 +65,21 @@ static void virtio_net_fuzz_multi(QTestState *s,
} else {
vqa.rx = 0;
uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
- /*
- * If checking used ring, ensure that the fuzzer doesn't trigger
- * trivial asserion failure on zero-zied buffer
- */
qtest_memwrite(s, req_addr, Data, vqa.length);
-
free_head = qvirtqueue_add(s, q, req_addr, vqa.length,
vqa.write, vqa.next);
- qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
qvirtqueue_kick(s, dev, q, free_head);
}
/* Run the main loop */
qtest_clock_step(s, 100);
flush_events(s);
+ /* Input led to a virtio_error */
+ if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET ||
+ !(dev->bus->get_status(dev) & VIRTIO_CONFIG_S_DRIVER_OK)) {
+ return;
+ }
/* Wait on used descriptors */
if (check_used && !vqa.rx) {
@@ -92,10 +91,6 @@ static void virtio_net_fuzz_multi(QTestState *s,
*/
while (!vqa.rx && q != net_if->queues[QVIRTIO_RX_VQ]) {
uint32_t got_desc_idx;
- /* Input led to a virtio_error */
- if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET) {
- break;
- }
if (dev->bus->get_queue_isr_status(dev, q) &&
qvirtqueue_get_buf(s, q, &got_desc_idx, NULL)) {
g_assert_cmpint(got_desc_idx, ==, free_head);
@@ -107,6 +102,11 @@ static void virtio_net_fuzz_multi(QTestState *s,
/* Run the main loop */
qtest_clock_step(s, 100);
flush_events(s);
+ /* Input led to a virtio_error */
+ if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET ||
+ !(dev->bus->get_status(dev) & VIRTIO_CONFIG_S_DRIVER_OK)) {
+ return;
+ }
}
}
Data += vqa.length;
The main loop is executed during flush_events(), where virtio error may occur. This behavior is legit and should not produce any crash report. But the test is waiting on used descriptors w/o a check, and, in case of error fails with message: "assertion timer != NULL failed". Thus, any invalid input data produces a meaningless crash report. Debuging the problem, I found that in case of virtio error in the main loop, dev->bus->get_status(dev) is 0 in most cases. In rare cases VIRTIO_CONFIG_S_NEEDS_RESET bit is set. So, checking only for VIRTIO_CONFIG_S_NEEDS_RESET bit is not enough. Also, the second qvirtqueue_add() call with corresponding comment are redundant. v1: https://patchew.org/QEMU/20240523102813.396750-2-frolov@swemel.ru/ v2: modified error-check & clean-up Signed-off-by: Dmitry Frolov <frolov@swemel.ru> --- tests/qtest/fuzz/virtio_net_fuzz.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)