From patchwork Fri Apr 14 18:17:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: f4da1594@opayq.com X-Patchwork-Id: 9681539 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5578D60384 for ; Fri, 14 Apr 2017 18:25:00 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 46C24285F3 for ; Fri, 14 Apr 2017 18:25:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 39955286CD; Fri, 14 Apr 2017 18:25:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=2.0 tests=BAYES_00, HTML_IMAGE_ONLY_16, HTML_MESSAGE,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 3F289285F3 for ; Fri, 14 Apr 2017 18:24:58 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cz5qS-0003RX-27; Fri, 14 Apr 2017 18:21:20 +0000 Received: from mail6.bemta6.messagelabs.com ([193.109.254.103]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cz5qQ-0003RR-OE for xen-devel@lists.xensource.com; Fri, 14 Apr 2017 18:21:18 +0000 Received: from [193.109.254.147] by server-3.bemta-6.messagelabs.com id E3/8C-27751-E1311F85; Fri, 14 Apr 2017 18:21:18 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrFIsWRWlGSWpSXmKPExsUiLtpvoysj/DH C4OMmLYt7U96zOzB6bO/bxR7AGMWamZeUX5HAmnHp4HO2gkNNjBUTdjcxNTA+KO9i5OTgFRCU ODnzCQuIzSYgIXGuv48JxBYRUJRYt/odC0SNp8TrE33sILaEgLjE54bvrBB2ncSyZeeZIOxKi Zar25hBbGaBJIlJJw+C1TAKyEicmnSDDcQWFtCV+Nd0lhHEZhHQltj96CD7BEbuWUjOmIWkHc J2k2hp3c8MYXtJHL76EcjmALLVJdbPE4IIq0nc3naVHSKsIXFgYTyEaSKxvd8KokJRYkr3Q3Y IW0ziyOXLUMNVJWbtamCDKJeR6FkqCxHWlli28DXzAkbeVYwaxalFZalFuoYWeklFmekZJbmJ mTm6hgZmermpxcWJ6ak5iUnFesn5uZsYgfHAAAQ7GG9uDDjEKMnBpCTKu+DVhwghvqT8lMqMx OKM+KLSnNTiQ4wyHBxKErxxQh8jhASLUtNTK9Iyc4CRCZOW4OBREuH9LAiU5i0uSMwtzkyHSJ 1i1OV4t/TDeyYhlrz8vFQpcV4ekBkCIEUZpXlwI2BJ4hKjrJQwLyPQUUI8BalFuZklqPKvGMU 5GJWEeflBpvBk5pXAbXoFdAQT0BEMkz+AHFGSiJCSamCc/u1D6bPQqdEXBV3uLHa8dU9k1QWX Epe/j3ncWQ3tfdboP+d4veOV78OIxWHVQuvk7li/+lu6eOZGmyVtIeu4c/48nhN1qOZriNLv4 ovtd9jTPj8L1ud6Wsd6dobf5s/lpx4ETO1buu7IUSajkuMsXUIijs6R4QIJJ2fPayxyYzv6YN GmG3IaSizFGYmGWsxFxYkA7yFGRg0DAAA= X-Env-Sender: f4da1594@opayq.com X-Msg-Ref: server-2.tower-27.messagelabs.com!1492194075!44877648!1 X-Originating-IP: [23.21.143.60] X-SpamReason: No, hits=0.7 required=7.0 tests=HTML_IMAGE_ONLY_16, HTML_MESSAGE, ML_IS_POSSIBLE_BOUNCE, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 9.4.12; banners=-,-,- X-VirusChecked: Checked Received: (qmail 64188 invoked from network); 14 Apr 2017 18:21:16 -0000 Received: from smtp4.opayq.com (HELO ?23.21.143.60?) (23.21.143.60) by server-2.tower-27.messagelabs.com with AES256-SHA256 encrypted SMTP; 14 Apr 2017 18:21:16 -0000 MIME-Version: 1.0 From: f4da1594@opayq.com To: xen-devel@lists.xensource.com Message-ID: <771113240.70927.1492193825522.JavaMail.root@smtp4.opayq.com> X-GetAbine-Processed: 1 X-Gm-Message-State: AN3rC/79MaeMXD8CrXYqbkKAX+IppTgscEBeoaS3V6w7MyH4GJqvcchK AmXOeS3eRuPJYWBB4T51TyTs2WqkLrW8SweeaTkGQcK7jQ== X-Received: by 10.55.24.101 with SMTP id j98mr7866349qkh.178.1492193825083; Fri, 14 Apr 2017 11:17:05 -0700 (PDT) Auto-Submitted: auto-replied Date: Fri, 14 Apr 2017 11:17:05 -0700 (PDT) Subject: [Xen-devel] Delivery Status Notification (Delay) X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP ** Delivery incomplete ** There was a temporary problem delivering your message to curtiskwong9@gmail.com. Gmail will retry for 21 more hours. You'll be notified if the delivery fails permanently. The response was: Receive rate too high ; Wed, 12 Apr 2017 09:02:31 -0700 (PDT) Return-Path: Received: from [23.21.143.60] (smtp4.opayq.com. [23.21.143.60]) by mx.google.com with ESMTPS id f7si19900306qtf.104.2017.04.12.09.0= 2.31 for (version=3DTLS1_2 cipher=3DAES128-SHA bits=3D128/128); Wed, 12 Apr 2017 09:02:31 -0700 (PDT) Received-SPF: pass (google.com: domain of fwd-737qhysmhvayqaucaoiqbdaagaqlm= a2yamheccjdlibayawyakiazaqhsmccwmblia4uanqueigcimbkmazuz4aaeaaca=3D=3D=3D@o= payq.com designates 23.21.143.60 as permitted sender) client-ip=3D23.21.143= .60; Authentication-Results: mx.google.com; dkim=3Dpass header.i=3D@opayq.com; spf=3Dpass (google.com: domain of fwd-737qhysmhvayqaucaoiqbdaagaqlma= 2yamheccjdlibayawyakiazaqhsmccwmblia4uanqueigcimbkmazuz4aaeaaca=3D=3D=3D@op= ayq.com designates 23.21.143.60 as permitted sender) smtp.mailfrom=3DFWD-73= 7QHYSMHVAYQAUCAOIQBDAAGAQLMA2YAMHECCJDLIBAYAWYAKIAZAQHSMCCWMBLIA4UANQUEIGCI= MBKMAZUZ4AAEAACA=3D=3D=3D@opayq.com DKIM-Signature: v=3D1; d=3Dopayq.com; t=3D1492012949; b=3DlNMvW4qO5SAnjc5qB= h7LE8l9d5rNgWOFXIFXbpT6PHyjWh5VSrCSTbyO7DCgBgrtQgELCZHlxgr6C/iwLDEJj07+8B4X= 4Go+m7rOYgQHjN4UoKU5modxwch+KikuuLi/X6aC1gCb0lp23cdQQhQZWaFFjUeF9MGmT42gYYt= LEK0=3D; s=3Dabine; c=3Drelaxed/relaxed; a=3Drsa-sha256; bh=3DmR+bU3SgWYDwE= +TQsgekraNC5ZywMSIHKTctywSxFdY=3D; h=3DDate:From:Reply-To:Subject:To:List-U= nsubscribe; MIME-Version: 1.0 Content-Type: text/plain; charset=3D"utf-8" Content-Transfer-Encoding: 7bit X-GetAbine-Processed: 1 From: "lists.xen.org [Masked]" Sender: "lists.xen.org [Masked]" Reply-To:=20 FWD-737QHYSMHVAYQAUCAOIQBDAAGAQLMA2YAMHECCJDLIBAYAWYAKIAZAQHSMCCWMBLIA4UAN= QUEIGCIMBKMAZUZ4AAEAACA=3D=3D=3D@opayq.com To: f4da1594@opayq.com X-GetAbine-Sender: xen-changelog-bounces@lists.xen.org X-GetAbine-Disposable: f4da1594@opayq.com X-GetAbine-Host-Address: 23.21.143.60 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrDLMWRWlGSWpSXmKPExsWS0XRdVVdW412 EwZn7yhYTthk4MHps79vFHsAYxZqZl5RfkcCasXv5VraC4/UVK2ZXNDBuTehi5OIQEvjCKNG/ uY0RwjnPKLFy23KmLkYODjYBMYm5exW6GDk5RARUJWatWM4MYgsJqEs0/W5gA7GFBdwk9h07C xbnFTCTeNN0AizOAlT/8t5mxgmMHAsYGVYxahSnFpWlFukaGuolFWWmZ5TkJmbm6BoamOnlph YXJ6an5iQmFesl5+duYgT6hAEIdjB+WhZwiFGSg0lJlPeywtsIIb6k/JTKjMTijPii0pzU4kO MMhwcShK8R9XeRQgJFqWmp1akZeYAgwMmLcHBoyTCmwKS5i0uSMwtzkyHSJ1i1OV4t/TDeyYh lrz8vFQpcV5jdaAiAZCijNI8uBGwQL3EKCslzMsIdJQQT0FqUW5mCar8K0ZxDkYlYd6XIKt4M vNK4Da9AjqCCeiItXvfghxRkoiQkmpg3Peqe5tfzYmvKZbTljupPYyqfxx3drF5WcbzN3tjDp xuvCP8xVbZe5qC/eeO9PtBBydnfqjSP9H1Wdxe8KPZ1evPnSa2Hfu8b2PopJpEucPXnhxuPbv hwJmnzrG1TGyPqnp5+csffp995rbymo/npeR2c++NPXpIWVOxt9zRdvX/W4pa4nxfpyuxFGck GmoxFxUnAgC7LLY0TwIAAA=3D=3D X-Env-Sender: ian.jackson@eu.citrix.com X-Msg-Ref: server-14.tower-27.messagelabs.com!1492002844!84565039!1 X-Originating-IP: [104.130.215.37] X-SpamReason: No, hits=3D0.5 required=3D7.0 tests=3DBODY_RANDOM_LONG X-StarScan-Received:=20 X-StarScan-Version: 9.4.12; banners=3D-,-,- X-VirusChecked: Checked Message-Id: Date: Wed, 12 Apr 2017 13:14:04 +0000 Subject: [Xen-changelog] [xen master] tools/insn-fuzz: Avoid making use of static data X-BeenThere: xen-changelog@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: "Change log for Mercurial \(receive only\)" List-Unsubscribe: ,=20 List-Unsubscribe: , List-Post: List-Help: List-Subscribe: ,=20 -------------------------Blur------------------------- This email is forwarded from a MASKED EMAIL you created using Blur. (https= ://dnt.abine.com/#help/faq/faq-whataremaskedemails). IF THIS IS SPAM, CLICK HERE TO BLOCK: https://dnt.abine.com/#/block_email/f4da1594@opayq.com/FWD-737QHYSMHVAYQAUC= AOIQBDAAGAQLMA2YAMHECCJDLIBAYAWYAKIAZAQHSMCCWMBLIA4UANQUEIGCIMBKMAZUZ4AAEAA= CA=3D=3D=3D@opayq.com Want to shop safely and privately online? Go Premium: https://dnt.abine.com= /?pk_campaign=3DmaskHeader#premium -------------------------by Abine------------------------- commit b163e550df2127b2bd1fbce682bed87e8d18d0dc Author: Andrew Cooper AuthorDate: Mon Mar 20 18:33:59 2017 +0000 Commit: Andrew Cooper CommitDate: Thu Apr 6 18:42:49 2017 +0100 tools/insn-fuzz: Avoid making use of static data =20 AFL has a measure of stability, where it passes the same corpus into th= e fuzzing harness and observes whether the execution path changes from be= fore. Any instability in the fuzzing harness reduces its effectiveness, as an observed crash may not reliably be caused by the original corpus. =20 In preparation to fix a stability bug, introduce struct fuzz_state, all= ocated on the stack and passed around via struct x86_emulate_ctxt's data param= eter. Propagate ctxt into the helpers such as maybe_fail(), so the state can = be retrieved. =20 Move the previously-static data_{index,num} into struct fuzz_state. =20 Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- tools/fuzz/x86_instruction_emulator/fuzz-emul.c | 181 +++++++++++++++-----= ---- 1 file changed, 116 insertions(+), 65 deletions(-) { @@ -50,13 +69,13 @@ static int maybe_fail(const char *why, bool exception) * 25% unhandlable * 25% exception */ - if ( input.data[data_index] > 0xc0 ) + if ( c->data[s->data_index] > 0xc0 ) rc =3D X86EMUL_EXCEPTION; - else if ( input.data[data_index] > 0x80 ) + else if ( c->data[s->data_index] > 0x80 ) rc =3D X86EMUL_UNHANDLEABLE; else rc =3D X86EMUL_OKAY; - data_index++; + s->data_index++; } =20 =20 ----- Message truncated ----- diff --git a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c b/tools/fuzz/x= 86_instruction_emulator/fuzz-emul.c index 64b7fb2..db0719e 100644 --- a/tools/fuzz/x86_instruction_emulator/fuzz-emul.c +++ b/tools/fuzz/x86_instruction_emulator/fuzz-emul.c @@ -21,7 +21,9 @@ =20 #define SEG_NUM x86_seg_none =20 -struct input_struct { +/* Layout of data expected as fuzzing input. */ +struct fuzz_corpus +{ unsigned long cr[5]; uint64_t msr[MSR_INDEX_MAX]; struct cpu_user_regs regs; @@ -29,19 +31,36 @@ struct input_struct { unsigned long options; unsigned char data[4096]; } input; -#define DATA_OFFSET offsetof(struct input_struct, data) -static unsigned int data_index; -static unsigned int data_num; +#define DATA_OFFSET offsetof(struct fuzz_corpus, data) + +/* + * Internal state of the fuzzing harness. Calculated initially from the i= nput + * corpus, and later mutates by the emulation callbacks. + */ +struct fuzz_state +{ + /* Fuzzer's input data. */ + struct fuzz_corpus *corpus; + + /* Real amount of data backing corpus->data[]. */ + size_t data_num; + + /* Amount of corpus->data[] consumed thus far. */ + size_t data_index; +}; =20 /* * Randomly return success or failure when processing data. If * `exception` is false, this function turns _EXCEPTION to _OKAY. */ -static int maybe_fail(const char *why, bool exception) +static int maybe_fail(struct x86_emulate_ctxt *ctxt, + const char *why, bool exception) { + struct fuzz_state *s =3D ctxt->data; + const struct fuzz_corpus *c =3D s->corpus; int rc; =20 - if ( data_index >=3D data_num ) + if ( s->data_index >=3D s->data_num ) rc =3D X86EMUL_EXCEPTION; else