Re: [PATCH v4 00/16] Add a General Virtual Device Fuzzer

[Paolo Bonzini]

If you have to do a v5, the correct word is generic not general. :)

Otherwise looks great.

Paolo

On 15/10/20 15:41, Alexander Bulekov wrote:
> v4:
>     - Replace yaml + c template-based oss-fuzz configs, with C code to
>       register a FuzzTarget for each config (as suggested by Paolo)
>     - Replicate the functionality of address_space_write_rom to ensure
>       matching behavior when QTEST_LOG is enabled
>     - Improve code documentation/comments
>     - Small formatting changes
> v3:
>       - Use flatviews to help select regions for fuzzing 
>       - Meson-related changes
>     - Add some documentation
>       - Improve minimalization script to trim write{bwlq} commands
> v2:
>       - Remove QOS dependency.
>       - Add a custom crossover function
>       - Fix broken minimization scripts
>       - Fixes to the IO region and DMA handling code
> 
> This is a general virtual-device fuzzer, designed to fuzz devices over Port 
> IO,
> MMIO, and DMA.
> 
> To get started with this:
>  1. Build the fuzzers (see docs/devel/fuzzing.txt)
>     Note: Build with --enable-sanitizers, or create a "dictionary file":
>     echo kw1=\"FUZZ\" > dict
>     and pass it as an argument to libFuzzer with -dict=./dict
>     This magic value is a command separator that lets the fuzzer perform
>     multiple IO actions with a single input.
> 
>  2. Pick the qemu arguments you wish to fuzz:
>     export QEMU_FUZZ_ARGS="-M q35 -device virtio-balloon"
> 
>  3. Tell the fuzzer which QOM objects or MemoryRegion names to fuzz. I find 
> the
>  "info qom-tree", "info qtree" and "info mtree" commands useful for 
> identifying
>  these. Supports globbing. Here I will try to simultaneously fuzz(for no good
>  reason) virtio-balloon and e1000e, which is included by default in the q35:
>     export QEMU_FUZZ_OBJECTS='virtio* e1000*'
>     You can also try to fuzz the whole machine:
>     export QEMU_FUZZ_OBJECTS='*'
> 
>  4. Run the fuzzer for 0 inputs. The fuzzer should output a list of
>  MemoryRegions/PCI Devices it will try to fuzz. Confirm that these match your
>  expectations.
>     ./i386-softmmu/qemu-fuzz-i386 --fuzz-target=general-fuzz -runs=0
> 
>  5. Run the fuzzer:
>     ./i386-softmmu/qemu-fuzz-i386 --fuzz-target=general-fuzz 
> 
> 
> Basically, at the core, this fuzzer is an interpreter that splits the input
> into a series of commands, such as mmio_write, pio_write, etc. We structure
> these commands to hit only MemoryRegions that are associated with the devices
> specified in QEMU_FUZZ_OBJECTS. Additionally, these patches add "hooks" to
> functions that are typically used by virtual-devices to read from RAM (DMA).
> These hooks attempt to populate these DMA regions with fuzzed data, just in
> time.
> 
> Some of the issues I have found or reproduced with this fuzzer:
> https://bugs.launchpad.net/bugs/1525123
> https://bugs.launchpad.net/bugs/1681439
> https://bugs.launchpad.net/bugs/1777315
> https://bugs.launchpad.net/bugs/1878034
> https://bugs.launchpad.net/bugs/1878043
> https://bugs.launchpad.net/bugs/1878054
> https://bugs.launchpad.net/bugs/1878057
> https://bugs.launchpad.net/bugs/1878067
> https://bugs.launchpad.net/bugs/1878134
> https://bugs.launchpad.net/bugs/1878136
> https://bugs.launchpad.net/bugs/1878253
> https://bugs.launchpad.net/bugs/1878255
> https://bugs.launchpad.net/bugs/1878259
> https://bugs.launchpad.net/bugs/1878263
> https://bugs.launchpad.net/bugs/1878323
> https://bugs.launchpad.net/bugs/1878641
> https://bugs.launchpad.net/bugs/1878642
> https://bugs.launchpad.net/bugs/1878645
> https://bugs.launchpad.net/bugs/1878651
> https://bugs.launchpad.net/bugs/1879223
> https://bugs.launchpad.net/bugs/1879227
> https://bugs.launchpad.net/bugs/1879531
> https://bugs.launchpad.net/bugs/1880355
> https://bugs.launchpad.net/bugs/1880539
> https://bugs.launchpad.net/bugs/1884693
> https://bugs.launchpad.net/bugs/1886362
> https://bugs.launchpad.net/bugs/1887303
> https://bugs.launchpad.net/bugs/1887309
> https://bugs.launchpad.net/bugs/697510
> 
> Alexander Bulekov (16):
>   memory: Add FlatView foreach function
>   fuzz: Add general virtual-device fuzzer
>   fuzz: Add PCI features to the general fuzzer
>   fuzz: Add DMA support to the generic-fuzzer
>   fuzz: Declare DMA Read callback function
>   fuzz: Add fuzzer callbacks to DMA-read functions
>   fuzz: Add support for custom crossover functions
>   fuzz: add a DISABLE_PCI op to general-fuzzer
>   fuzz: add a crossover function to generic-fuzzer
>   scripts/oss-fuzz: Add script to reorder a general-fuzzer trace
>   scripts/oss-fuzz: Add crash trace minimization script
>   fuzz: Add instructions for using general-fuzz
>   fuzz: add an "opaque" to the FuzzTarget struct
>   fuzz: add general-fuzz configs for oss-fuzz
>   fuzz: register predefined general-fuzz configs
>   scripts/oss-fuzz: remove the general-fuzz target
> 
>  docs/devel/fuzzing.txt                        |  39 +
>  include/exec/memory.h                         |  21 +
>  include/exec/memory_ldst_cached.h.inc         |   3 +
>  memory_ldst.c.inc                             |   4 +
>  scripts/oss-fuzz/build.sh                     |   6 +
>  scripts/oss-fuzz/minimize_qtest_trace.py      | 157 +++
>  .../oss-fuzz/reorder_fuzzer_qtest_trace.py    | 103 ++
>  softmmu/memory.c                              |  23 +
>  softmmu/physmem.c                             |   2 +
>  tests/qtest/fuzz/fuzz.c                       |  13 +
>  tests/qtest/fuzz/fuzz.h                       |  28 +
>  tests/qtest/fuzz/general_fuzz.c               | 948 ++++++++++++++++++
>  tests/qtest/fuzz/general_fuzz_configs.c       | 140 +++
>  tests/qtest/fuzz/general_fuzz_configs.h       |  24 +
>  tests/qtest/fuzz/meson.build                  |   1 +
>  15 files changed, 1512 insertions(+)
>  create mode 100755 scripts/oss-fuzz/minimize_qtest_trace.py
>  create mode 100755 scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py
>  create mode 100644 tests/qtest/fuzz/general_fuzz.c
>  create mode 100644 tests/qtest/fuzz/general_fuzz_configs.c
>  create mode 100644 tests/qtest/fuzz/general_fuzz_configs.h
>