[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 20/22] fuzz: Disable QEMU's SIG{INT,HUP,TERM} handlers
From: |
Paolo Bonzini |
Subject: |
[PULL 20/22] fuzz: Disable QEMU's SIG{INT,HUP,TERM} handlers |
Date: |
Fri, 16 Oct 2020 07:48:12 -0400 |
From: Alexander Bulekov <alxndr@bu.edu>
Prior to this patch, the only way I found to terminate the fuzzer was
either to:
1. Explicitly specify the number of fuzzer runs with the -runs= flag
2. SIGKILL the process with "pkill -9 qemu-fuzz-*" or similar
In addition to being annoying to deal with, SIGKILLing the process skips
over any exit handlers(e.g. registered with atexit()). This is bad,
since some fuzzers might create temporary files that should ideally be
removed on exit using an exit handler. The only way to achieve a clean
exit now is to specify -runs=N , but the desired "N" is tricky to
identify prior to fuzzing.
Why doesn't the process exit with standard SIGINT,SIGHUP,SIGTERM
signals? QEMU installs its own handlers for these signals in
os-posix.c:os_setup_signal_handling, which notify the main loop that an
exit was requested. The fuzzer, however, does not run qemu_main_loop,
which performs the main_loop_should_exit() check. This means that the
fuzzer effectively ignores these signals. As we don't really care about
cleanly stopping the disposable fuzzer "VM", this patch uninstalls
QEMU's signal handlers. Thus, we can stop the fuzzer with
SIG{INT,HUP,TERM} and the fuzzing code can optionally use atexit() to
clean up temporary files/resources.
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20201014142157.46028-1-alxndr@bu.edu>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
tests/qtest/fuzz/fuzz.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/tests/qtest/fuzz/fuzz.c b/tests/qtest/fuzz/fuzz.c
index d926c490c5..eb0070437f 100644
--- a/tests/qtest/fuzz/fuzz.c
+++ b/tests/qtest/fuzz/fuzz.c
@@ -217,5 +217,13 @@ int LLVMFuzzerInitialize(int *argc, char ***argv, char
***envp)
/* re-enable the rcu atfork, which was previously disabled in qemu_init */
rcu_enable_atfork();
+ /*
+ * Disable QEMU's signal handlers, since we manually control the main_loop,
+ * and don't check for main_loop_should_exit
+ */
+ signal(SIGINT, SIG_DFL);
+ signal(SIGHUP, SIG_DFL);
+ signal(SIGTERM, SIG_DFL);
+
return 0;
}
--
2.26.2
- [PULL 07/22] dockerfiles: enable Centos 8 PowerTools, (continued)
- [PULL 07/22] dockerfiles: enable Centos 8 PowerTools, Paolo Bonzini, 2020/10/16
- [PULL 13/22] meson: cleanup curses/iconv test, Paolo Bonzini, 2020/10/16
- [PULL 12/22] meson.build: don't condition iconv detection on library detection, Paolo Bonzini, 2020/10/16
- [PULL 09/22] build: cleanups to Makefile, Paolo Bonzini, 2020/10/16
- [PULL 15/22] meson: Only install icons and qemu.desktop if have_system, Paolo Bonzini, 2020/10/16
- [PULL 16/22] docs: Fix Sphinx configuration for msys2/mingw, Paolo Bonzini, 2020/10/16
- [PULL 18/22] meson: Move the detection logic for sphinx to meson, Paolo Bonzini, 2020/10/16
- [PULL 10/22] build: replace ninjatool with ninja, Paolo Bonzini, 2020/10/16
- [PULL 20/22] fuzz: Disable QEMU's SIG{INT,HUP,TERM} handlers,
Paolo Bonzini <=
- [PULL 21/22] hax: unbreak accelerator cpu code after cpus.c split, Paolo Bonzini, 2020/10/16
- [PULL 19/22] cirrus: Enable doc build on msys2/mingw, Paolo Bonzini, 2020/10/16
- [PULL 17/22] meson: move SPHINX_ARGS references within "if build_docs", Paolo Bonzini, 2020/10/16
- [PULL 22/22] ci: include configure and meson logs in all jobs if configure fails, Paolo Bonzini, 2020/10/16