[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 2/6] fuzz: do not use POSIX shm for coverage bitmap
From: |
Thomas Huth |
Subject: |
[PULL 2/6] fuzz: do not use POSIX shm for coverage bitmap |
Date: |
Mon, 6 Jul 2020 09:28:31 +0200 |
From: Alexander Bulekov <alxndr@bu.edu>
We used shm_open with mmap to share libfuzzer's coverage bitmap with
child (runner) processes. The same functionality can be achieved with
MAP_SHARED | MAP_ANONYMOUS, since we do not care about naming or
permissioning the shared memory object.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20200622165040.15121-1-alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
tests/qtest/fuzz/fork_fuzz.c | 40 ++++++++++++------------------------
1 file changed, 13 insertions(+), 27 deletions(-)
diff --git a/tests/qtest/fuzz/fork_fuzz.c b/tests/qtest/fuzz/fork_fuzz.c
index 2bd0851903..6ffb2a7937 100644
--- a/tests/qtest/fuzz/fork_fuzz.c
+++ b/tests/qtest/fuzz/fork_fuzz.c
@@ -17,39 +17,25 @@
void counter_shm_init(void)
{
- char *shm_path = g_strdup_printf("/qemu-fuzz-cntrs.%d", getpid());
- int fd = shm_open(shm_path, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
- g_free(shm_path);
-
- if (fd == -1) {
- perror("Error: ");
- exit(1);
- }
- if (ftruncate(fd, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START) == -1) {
- perror("Error: ");
- exit(1);
- }
- /* Copy what's in the counter region to the shm.. */
- void *rptr = mmap(NULL ,
- &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START,
- PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
- memcpy(rptr,
+ /* Copy what's in the counter region to a temporary buffer.. */
+ void *copy = malloc(&__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
+ memcpy(copy,
&__FUZZ_COUNTERS_START,
&__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
- munmap(rptr, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
-
- /* And map the shm over the counter region */
- rptr = mmap(&__FUZZ_COUNTERS_START,
- &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START,
- PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, fd, 0);
-
- close(fd);
-
- if (!rptr) {
+ /* Map a shared region over the counter region */
+ if (mmap(&__FUZZ_COUNTERS_START,
+ &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START,
+ PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED | MAP_ANONYMOUS,
+ 0, 0) == MAP_FAILED) {
perror("Error: ");
exit(1);
}
+
+ /* Copy the original data back to the counter-region */
+ memcpy(&__FUZZ_COUNTERS_START, copy,
+ &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
+ free(copy);
}
--
2.18.1
- [PULL 0/6] qtest and misc patches, Thomas Huth, 2020/07/06
- [PULL 2/6] fuzz: do not use POSIX shm for coverage bitmap,
Thomas Huth <=
- [PULL 1/6] fuzz: fix broken qtest check at rcu_disable_atfork, Thomas Huth, 2020/07/06
- [PULL 4/6] configure / util: Auto-detect the availability of openpty(), Thomas Huth, 2020/07/06
- [PULL 3/6] tests/qtest: Unify the test for the xenfv and xenpv machines, Thomas Huth, 2020/07/06
- [PULL 5/6] hw/m68k/mcf5206: Replace remaining hw_error()s by qemu_log_mask(), Thomas Huth, 2020/07/06
- [PULL 6/6] tests/acceptance: Add a test for the sun4u sparc64 machine, Thomas Huth, 2020/07/06
- Re: [PULL 0/6] qtest and misc patches, Peter Maydell, 2020/07/07