[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 04/10] fuzz/generic-fuzz: add a limit on DMA bytes written
From: |
Alexander Bulekov |
Subject: |
[PULL 04/10] fuzz/generic-fuzz: add a limit on DMA bytes written |
Date: |
Thu, 16 Feb 2023 23:08:49 -0500 |
As we have repplaced fork-based fuzzing, with reboots - we can no longer
use a timeout+exit() to avoid slow inputs. Libfuzzer has its own timer
that it uses to catch slow inputs, however these timeouts are usually
seconds-minutes long: more than enough to bog-down the fuzzing process.
However, I found that slow inputs often attempt to fill overly large DMA
requests. Thus, we can mitigate most timeouts by setting a cap on the
total number of DMA bytes written by an input.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
---
tests/qtest/fuzz/generic_fuzz.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuzz.c
index f4acfa45cc..c525d22951 100644
--- a/tests/qtest/fuzz/generic_fuzz.c
+++ b/tests/qtest/fuzz/generic_fuzz.c
@@ -51,6 +51,7 @@ enum cmds {
#define USEC_IN_SEC 1000000000
#define MAX_DMA_FILL_SIZE 0x10000
+#define MAX_TOTAL_DMA_SIZE 0x10000000
#define PCI_HOST_BRIDGE_CFG 0xcf8
#define PCI_HOST_BRIDGE_DATA 0xcfc
@@ -61,6 +62,7 @@ typedef struct {
} address_range;
static bool qtest_log_enabled;
+size_t dma_bytes_written;
MemoryRegion *sparse_mem_mr;
@@ -194,6 +196,7 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion
*mr)
*/
if (dma_patterns->len == 0
|| len == 0
+ || dma_bytes_written + len > MAX_TOTAL_DMA_SIZE
|| (mr != current_machine->ram && mr != sparse_mem_mr)) {
return;
}
@@ -266,6 +269,7 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion
*mr)
fflush(stderr);
}
qtest_memwrite(qts_global, addr, buf, l);
+ dma_bytes_written += l;
}
len -= l;
buf += l;
@@ -645,6 +649,7 @@ static void generic_fuzz(QTestState *s, const unsigned char
*Data, size_t Size)
op_clear_dma_patterns(s, NULL, 0);
pci_disabled = false;
+ dma_bytes_written = 0;
QPCIBus *pcibus = qpci_new_pc(s, NULL);
g_ptr_array_foreach(fuzzable_pci_devices, pci_enum, pcibus);
--
2.39.0
- [PULL 00/10] Replace fork-based fuzzing with reboots, Alexander Bulekov, 2023/02/16
- [PULL 01/10] hw/sparse-mem: clear memory on reset, Alexander Bulekov, 2023/02/16
- [PULL 02/10] fuzz: add fuzz_reset API, Alexander Bulekov, 2023/02/16
- [PULL 03/10] fuzz/generic-fuzz: use reboots instead of forks to reset state, Alexander Bulekov, 2023/02/16
- [PULL 04/10] fuzz/generic-fuzz: add a limit on DMA bytes written,
Alexander Bulekov <=
- [PULL 05/10] fuzz/virtio-scsi: remove fork-based fuzzer, Alexander Bulekov, 2023/02/16
- [PULL 06/10] fuzz/virtio-net: remove fork-based fuzzer, Alexander Bulekov, 2023/02/16
- [PULL 07/10] fuzz/virtio-blk: remove fork-based fuzzer, Alexander Bulekov, 2023/02/16
- [PULL 09/10] fuzz: remove fork-fuzzing scaffolding, Alexander Bulekov, 2023/02/16
- [PULL 08/10] fuzz/i440fx: remove fork-based fuzzer, Alexander Bulekov, 2023/02/16
- [PULL 10/10] docs/fuzz: remove mentions of fork-based fuzzing, Alexander Bulekov, 2023/02/16
- Re: [PULL 00/10] Replace fork-based fuzzing with reboots, Peter Maydell, 2023/02/21