@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
c 197 lines 5.48 KB
Raw
1 /*
2 * virtio-blk Fuzzing Target
3 *
4 * Copyright Red Hat Inc., 2020
5 *
6 * Based on virtio-scsi-fuzz target.
7 *
8 * This work is licensed under the terms of the GNU GPL, version 2 or later.
9 * See the COPYING file in the top-level directory.
10 */
11
12 #include "qemu/osdep.h"
13
14 #include "tests/qtest/libqtest.h"
15 #include "tests/qtest/libqos/virtio-blk.h"
16 #include "tests/qtest/libqos/virtio.h"
17 #include "tests/qtest/libqos/virtio-pci.h"
18 #include "standard-headers/linux/virtio_ids.h"
19 #include "standard-headers/linux/virtio_pci.h"
20 #include "standard-headers/linux/virtio_blk.h"
21 #include "fuzz.h"
22 #include "qos_fuzz.h"
23
24 #define TEST_IMAGE_SIZE (64 * 1024 * 1024)
25 #define PCI_SLOT 0x02
26 #define PCI_FN 0x00
27
28 #define MAX_NUM_QUEUES 64
29
30 /* Based on tests/qtest/virtio-blk-test.c. */
31 typedef struct {
32 int num_queues;
33 QVirtQueue *vq[MAX_NUM_QUEUES + 2];
34 } QVirtioBlkQueues;
35
36 static QVirtioBlkQueues *qvirtio_blk_init(QVirtioDevice *dev, uint64_t mask)
37 {
38 QVirtioBlkQueues *vs;
39 uint64_t features;
40
41 vs = g_new0(QVirtioBlkQueues, 1);
42
43 features = qvirtio_get_features(dev);
44 if (!mask) {
45 mask = ~((1u << VIRTIO_RING_F_INDIRECT_DESC) |
46 (1u << VIRTIO_RING_F_EVENT_IDX) |
47 (1u << VIRTIO_BLK_F_SCSI));
48 }
49 mask |= ~QVIRTIO_F_BAD_FEATURE;
50 features &= mask;
51 qvirtio_set_features(dev, features);
52
53 vs->num_queues = 1;
54 vs->vq[0] = qvirtqueue_setup(dev, fuzz_qos_alloc, 0);
55
56 qvirtio_set_driver_ok(dev);
57
58 return vs;
59 }
60
61 static void virtio_blk_fuzz(QTestState *s, QVirtioBlkQueues* queues,
62 const unsigned char *Data, size_t Size)
63 {
64 /*
65 * Data is a sequence of random bytes. We split them up into "actions",
66 * followed by data:
67 * [vqa][dddddddd][vqa][dddd][vqa][dddddddddddd] ...
68 * The length of the data is specified by the preceding vqa.length
69 */
70 typedef struct vq_action {
71 uint8_t queue;
72 uint8_t length;
73 uint8_t write;
74 uint8_t next;
75 uint8_t kick;
76 } vq_action;
77
78 /* Keep track of the free head for each queue we interact with */
79 bool vq_touched[MAX_NUM_QUEUES + 2] = {0};
80 uint32_t free_head[MAX_NUM_QUEUES + 2];
81
82 QGuestAllocator *t_alloc = fuzz_qos_alloc;
83
84 QVirtioBlk *blk = fuzz_qos_obj;
85 QVirtioDevice *dev = blk->vdev;
86 QVirtQueue *q;
87 vq_action vqa;
88 while (Size >= sizeof(vqa)) {
89 /* Copy the action, so we can normalize length, queue and flags */
90 memcpy(&vqa, Data, sizeof(vqa));
91
92 Data += sizeof(vqa);
93 Size -= sizeof(vqa);
94
95 vqa.queue = vqa.queue % queues->num_queues;
96 /* Cap length at the number of remaining bytes in data */
97 vqa.length = vqa.length >= Size ? Size : vqa.length;
98 vqa.write = vqa.write & 1;
99 vqa.next = vqa.next & 1;
100 vqa.kick = vqa.kick & 1;
101
102 q = queues->vq[vqa.queue];
103
104 /* Copy the data into ram, and place it on the virtqueue */
105 uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
106 qtest_memwrite(s, req_addr, Data, vqa.length);
107 if (vq_touched[vqa.queue] == 0) {
108 vq_touched[vqa.queue] = 1;
109 free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length,
110 vqa.write, vqa.next);
111 } else {
112 qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
113 }
114
115 if (vqa.kick) {
116 qvirtqueue_kick(s, dev, q, free_head[vqa.queue]);
117 free_head[vqa.queue] = 0;
118 }
119 Data += vqa.length;
120 Size -= vqa.length;
121 }
122 /* In the end, kick each queue we interacted with */
123 for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) {
124 if (vq_touched[i]) {
125 qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]);
126 }
127 }
128 }
129
130 static void virtio_blk_with_flag_fuzz(QTestState *s,
131 const unsigned char *Data, size_t Size)
132 {
133 QVirtioBlk *blk = fuzz_qos_obj;
134 static QVirtioBlkQueues *queues;
135
136 if (Size >= sizeof(uint64_t)) {
137 queues = qvirtio_blk_init(blk->vdev, *(uint64_t *)Data);
138 virtio_blk_fuzz(s, queues,
139 Data + sizeof(uint64_t), Size - sizeof(uint64_t));
140 flush_events(s);
141 }
142 fuzz_reset(s);
143 }
144
145 static void virtio_blk_pre_fuzz(QTestState *s)
146 {
147 qos_init_path(s);
148 }
149
150 static void drive_destroy(void *path)
151 {
152 unlink(path);
153 g_free(path);
154 }
155
156 static char *drive_create(void)
157 {
158 int fd, ret;
159 char *t_path;
160
161 /* Create a temporary raw image */
162 fd = g_file_open_tmp("qtest.XXXXXX", &t_path, NULL);
163 g_assert_cmpint(fd, >=, 0);
164 ret = ftruncate(fd, TEST_IMAGE_SIZE);
165 g_assert_cmpint(ret, ==, 0);
166 close(fd);
167
168 g_test_queue_destroy(drive_destroy, t_path);
169 return t_path;
170 }
171
172 static void *virtio_blk_test_setup(GString *cmd_line, void *arg)
173 {
174 char *tmp_path = drive_create();
175
176 g_string_append_printf(cmd_line,
177 " -drive if=none,id=drive0,file=%s,"
178 "format=raw,auto-read-only=off ",
179 tmp_path);
180
181 return arg;
182 }
183
184 static void register_virtio_blk_fuzz_targets(void)
185 {
186 fuzz_add_qos_target(&(FuzzTarget){
187 .name = "virtio-blk-flags-fuzz",
188 .description = "Fuzz the virtio-blk virtual queues. "
189 "Also fuzzes the virtio flags)",
190 .pre_fuzz = &virtio_blk_pre_fuzz,
191 .fuzz = virtio_blk_with_flag_fuzz,},
192 "virtio-blk",
193 &(QOSGraphTestOptions){.before = virtio_blk_test_setup}
194 );
195 }
196
197 fuzz_target_init(register_virtio_blk_fuzz_targets);