OpenE2K
/
qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

fuzz: add virtio-9p configurations for fuzzing 

virtio-9p devices are often used to expose a virtual-filesystem to the
guest. There have been some bugs reported in this device, such as
CVE-2018-19364, and CVE-2021-20181. We should fuzz this device

This patch adds two virtio-9p configurations:
 * One with the widely used -fsdev local driver. This driver leaks some
   state in the form of files/directories created in the shared dir.
 * One with the synth driver. While it is not used in the real world, this
   driver won't leak leak state between fuzz inputs.

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20210117230924.449676-4-alxndr@bu.edu>
This commit is contained in:
Alexander Bulekov 2021-01-17 18:09:24 -05:00 committed by Paolo Bonzini
parent 3ca45fb4d2
commit fff7111fb9
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
tests/qtest/fuzz/generic_fuzz_configs.h
View File

@ -19,6 +19,16 @@ typedef struct generic_fuzz_config {
gchar* (*argfunc)(void); /* Result must be freeable by g_free() */
} generic_fuzz_config;
static inline gchar *generic_fuzzer_virtio_9p_args(void){
char tmpdir[] = "/tmp/qemu-fuzz.XXXXXX";
g_assert_nonnull(mkdtemp(tmpdir));
return g_strdup_printf("-machine q35 -nodefaults "
"-device virtio-9p,fsdev=hshare,mount_tag=hshare "
"-fsdev local,id=hshare,path=%s,security_model=mapped-xattr,"
"writeout=immediate,fmode=0600,dmode=0700", tmpdir);
}
const generic_fuzz_config predefined_configs[] = {
{
.name = "virtio-net-pci-slirp",
@ -60,6 +70,16 @@ const generic_fuzz_config predefined_configs[] = {
.name = "virtio-mouse",
.args = "-machine q35 -nodefaults -device virtio-mouse",
.objects = "virtio*",
},{
.name = "virtio-9p",
.argfunc = generic_fuzzer_virtio_9p_args,
.objects = "virtio*",
},{
.name = "virtio-9p-synth",
.args = "-machine q35 -nodefaults "
"-device virtio-9p,fsdev=hshare,mount_tag=hshare "
"-fsdev synth,id=hshare",
.objects = "virtio*",
},{
.name = "e1000",
.args = "-M q35 -nodefaults "