1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
|
/*
* virtio-serial Fuzzing Target
*
* Copyright Red Hat Inc., 2019
*
* Authors:
* Alexander Bulekov <alxndr@bu.edu>
*
* This work is licensed under the terms of the GNU GPL, version 2 or later.
* See the COPYING file in the top-level directory.
*/
#include "qemu/osdep.h"
#include "tests/qtest/libqtest.h"
#include "tests/qtest/libqos/virtio-scsi.h"
#include "tests/qtest/libqos/virtio.h"
#include "tests/qtest/libqos/virtio-pci.h"
#include "standard-headers/linux/virtio_ids.h"
#include "standard-headers/linux/virtio_pci.h"
#include "standard-headers/linux/virtio_scsi.h"
#include "fuzz.h"
#include "fork_fuzz.h"
#include "qos_fuzz.h"
#define PCI_SLOT 0x02
#define PCI_FN 0x00
#define QVIRTIO_SCSI_TIMEOUT_US (1 * 1000 * 1000)
#define MAX_NUM_QUEUES 64
/* Based on tests/virtio-scsi-test.c */
typedef struct {
int num_queues;
QVirtQueue *vq[MAX_NUM_QUEUES + 2];
} QVirtioSCSIQueues;
static QVirtioSCSIQueues *qvirtio_scsi_init(QVirtioDevice *dev, uint64_t mask)
{
QVirtioSCSIQueues *vs;
uint64_t feat;
int i;
vs = g_new0(QVirtioSCSIQueues, 1);
feat = qvirtio_get_features(dev);
if (mask) {
feat &= ~QVIRTIO_F_BAD_FEATURE | mask;
} else {
feat &= ~(QVIRTIO_F_BAD_FEATURE | (1ull << VIRTIO_RING_F_EVENT_IDX));
}
qvirtio_set_features(dev, feat);
vs->num_queues = qvirtio_config_readl(dev, 0);
for (i = 0; i < vs->num_queues + 2; i++) {
vs->vq[i] = qvirtqueue_setup(dev, fuzz_qos_alloc, i);
}
qvirtio_set_driver_ok(dev);
return vs;
}
static void virtio_scsi_fuzz(QTestState *s, QVirtioSCSIQueues* queues,
const unsigned char *Data, size_t Size)
{
/*
* Data is a sequence of random bytes. We split them up into "actions",
* followed by data:
* [vqa][dddddddd][vqa][dddd][vqa][dddddddddddd] ...
* The length of the data is specified by the preceding vqa.length
*/
typedef struct vq_action {
uint8_t queue;
uint8_t length;
uint8_t write;
uint8_t next;
uint8_t kick;
} vq_action;
/* Keep track of the free head for each queue we interact with */
bool vq_touched[MAX_NUM_QUEUES + 2] = {0};
uint32_t free_head[MAX_NUM_QUEUES + 2];
QGuestAllocator *t_alloc = fuzz_qos_alloc;
QVirtioSCSI *scsi = fuzz_qos_obj;
QVirtioDevice *dev = scsi->vdev;
QVirtQueue *q;
vq_action vqa;
while (Size >= sizeof(vqa)) {
/* Copy the action, so we can normalize length, queue and flags */
memcpy(&vqa, Data, sizeof(vqa));
Data += sizeof(vqa);
Size -= sizeof(vqa);
vqa.queue = vqa.queue % queues->num_queues;
/* Cap length at the number of remaining bytes in data */
vqa.length = vqa.length >= Size ? Size : vqa.length;
vqa.write = vqa.write & 1;
vqa.next = vqa.next & 1;
vqa.kick = vqa.kick & 1;
q = queues->vq[vqa.queue];
/* Copy the data into ram, and place it on the virtqueue */
uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
qtest_memwrite(s, req_addr, Data, vqa.length);
if (vq_touched[vqa.queue] == 0) {
vq_touched[vqa.queue] = 1;
free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length,
vqa.write, vqa.next);
} else {
qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
}
if (vqa.kick) {
qvirtqueue_kick(s, dev, q, free_head[vqa.queue]);
free_head[vqa.queue] = 0;
}
Data += vqa.length;
Size -= vqa.length;
}
/* In the end, kick each queue we interacted with */
for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) {
if (vq_touched[i]) {
qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]);
}
}
}
static void virtio_scsi_fork_fuzz(QTestState *s,
const unsigned char *Data, size_t Size)
{
QVirtioSCSI *scsi = fuzz_qos_obj;
static QVirtioSCSIQueues *queues;
if (!queues) {
queues = qvirtio_scsi_init(scsi->vdev, 0);
}
if (fork() == 0) {
virtio_scsi_fuzz(s, queues, Data, Size);
flush_events(s);
_Exit(0);
} else {
flush_events(s);
wait(NULL);
}
}
static void virtio_scsi_with_flag_fuzz(QTestState *s,
const unsigned char *Data, size_t Size)
{
QVirtioSCSI *scsi = fuzz_qos_obj;
static QVirtioSCSIQueues *queues;
if (fork() == 0) {
if (Size >= sizeof(uint64_t)) {
queues = qvirtio_scsi_init(scsi->vdev, *(uint64_t *)Data);
virtio_scsi_fuzz(s, queues,
Data + sizeof(uint64_t), Size - sizeof(uint64_t));
flush_events(s);
}
_Exit(0);
} else {
flush_events(s);
wait(NULL);
}
}
static void virtio_scsi_pre_fuzz(QTestState *s)
{
qos_init_path(s);
counter_shm_init();
}
static void *virtio_scsi_test_setup(GString *cmd_line, void *arg)
{
g_string_append(cmd_line,
" -drive file=blkdebug::null-co://,"
"file.image.read-zeroes=on,"
"if=none,id=dr1,format=raw,file.align=4k "
"-device scsi-hd,drive=dr1,lun=0,scsi-id=1");
return arg;
}
static void register_virtio_scsi_fuzz_targets(void)
{
fuzz_add_qos_target(&(FuzzTarget){
.name = "virtio-scsi-fuzz",
.description = "Fuzz the virtio-scsi virtual queues, forking "
"for each fuzz run",
.pre_vm_init = &counter_shm_init,
.pre_fuzz = &virtio_scsi_pre_fuzz,
.fuzz = virtio_scsi_fork_fuzz,},
"virtio-scsi",
&(QOSGraphTestOptions){.before = virtio_scsi_test_setup}
);
fuzz_add_qos_target(&(FuzzTarget){
.name = "virtio-scsi-flags-fuzz",
.description = "Fuzz the virtio-scsi virtual queues, forking "
"for each fuzz run (also fuzzes the virtio flags)",
.pre_vm_init = &counter_shm_init,
.pre_fuzz = &virtio_scsi_pre_fuzz,
.fuzz = virtio_scsi_with_flag_fuzz,},
"virtio-scsi",
&(QOSGraphTestOptions){.before = virtio_scsi_test_setup}
);
}
fuzz_target_init(register_virtio_scsi_fuzz_targets);
|
