[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing
From: |
Christian Schoenebeck |
Subject: |
Re: [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing |
Date: |
Mon, 18 Jan 2021 13:34:32 +0100 |
On Montag, 18. Januar 2021 00:09:24 CET Alexander Bulekov wrote:
> virtio-9p devices are often used to expose a virtual-filesystem to the
> guest. There have been some bugs reported in this device, such as
> CVE-2018-19364, and CVE-2021-20181. We should fuzz this device
>
> This patch adds two virtio-9p configurations:
> * One with the widely used -fsdev local driver. This driver leaks some
> state in the form of files/directories created in the shared dir.
> * One with the synth driver. While it is not used in the real world, this
> driver won't leak leak state between fuzz inputs.
>
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> CC: Christian Schoenebeck <qemu_oss@crudebyte.com>
> CC: Greg Kurz <groug@kaod.org>
>
> I considered adding an atexit handler to remove the temp directory,
> however I am worried that there might be some error that results in a
> call to exit(), rather than abort(), which will cause problems for
> future fork()-ed fuzzers. I don't think there are such calls in the 9p
> code, however there might be something in the APIs used by 9p. As this
> code is primarily for ephemeral OSS-Fuzz conainers, this shouldn't be
> too much of an issue.
Yes, dealing with signal handlers for that is probably a bit intransparent and
would leave a questionable feeling about its reliability.
What about __attribute__((destructor)) to auto delete the fuzzer directory,
like virtio-9p-test.c does for the same task?
> tests/qtest/fuzz/generic_fuzz_configs.h | 20 ++++++++++++++++++++
> 1 file changed, 20 insertions(+)
>
> diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h
> b/tests/qtest/fuzz/generic_fuzz_configs.h index 1a133655ee..f99657cdbc
> 100644
> --- a/tests/qtest/fuzz/generic_fuzz_configs.h
> +++ b/tests/qtest/fuzz/generic_fuzz_configs.h
> @@ -19,6 +19,16 @@ typedef struct generic_fuzz_config {
> gchar* (*argfunc)(void); /* Result must be freeable by g_free() */
> } generic_fuzz_config;
>
> +static inline gchar *generic_fuzzer_virtio_9p_args(void){
> + char tmpdir[] = "/tmp/qemu-fuzz.XXXXXX";
> + g_assert_nonnull(mkdtemp(tmpdir));
> +
> + return g_strdup_printf("-machine q35 -nodefaults "
> + "-device virtio-9p,fsdev=hshare,mount_tag=hshare "
> + "-fsdev local,id=hshare,path=%s,security_model=mapped-xattr,"
> + "writeout=immediate,fmode=0600,dmode=0700", tmpdir);
> +}
> +
> const generic_fuzz_config predefined_configs[] = {
> {
> .name = "virtio-net-pci-slirp",
> @@ -60,6 +70,16 @@ const generic_fuzz_config predefined_configs[] = {
> .name = "virtio-mouse",
> .args = "-machine q35 -nodefaults -device virtio-mouse",
> .objects = "virtio*",
> + },{
> + .name = "virtio-9p",
> + .argfunc = generic_fuzzer_virtio_9p_args,
> + .objects = "virtio*",
> + },{
> + .name = "virtio-9p-synth",
> + .args = "-machine q35 -nodefaults "
> + "-device virtio-9p,fsdev=hshare,mount_tag=hshare "
> + "-fsdev synth,id=hshare",
> + .objects = "virtio*",
> },{
> .name = "e1000",
> .args = "-M q35 -nodefaults "
- [PATCH v2 0/3] fuzz: Add 9p generic-fuzz configs, Alexander Bulekov, 2021/01/17
- [PATCH v2 1/3] fuzz: enable dynamic args for generic-fuzz configs, Alexander Bulekov, 2021/01/17
- [PATCH v2 2/3] docs/fuzz: add some information about OSS-Fuzz, Alexander Bulekov, 2021/01/17
- [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing, Alexander Bulekov, 2021/01/17
- Re: [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing,
Christian Schoenebeck <=
- Re: [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing, Alexander Bulekov, 2021/01/18
- Re: [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing, Darren Kenny, 2021/01/18
- Re: [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing, Alexander Bulekov, 2021/01/19
- Re: [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing, Darren Kenny, 2021/01/19
- Re: [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing, Christian Schoenebeck, 2021/01/19
Re: [PATCH v2 3/3] fuzz: add virtio-9p configurations for fuzzing, Darren Kenny, 2021/01/18