summary refs log tree commit diff
path: root/fuzz
Commit message (Collapse)AuthorAge
* fuzz: update virtqueue fuzzer for new VolatileSlice APIDaniel Verkamp2020-05-29
| | | | | | | | | | | | | | | BUG=chromium:1087578 TEST=emerge-amd64-generic crosvm Change-Id: Ia206abf03f95ca92f5944fb8efc23d3f8355e292 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2220731 Tested-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org> Commit-Queue: Dylan Reid <dgreid@chromium.org>
* fuzz: ensure sys_util path dependency is usedDaniel Verkamp2020-03-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When compiling a new-enough crosvm for fuzzing (after https://crrev.com/c/1749950), the build would fail with an error about importing two different version of sys_util: expected struct `sys_util::shm::SharedMemory`, found a different struct `sys_util::shm::SharedMemory` expected reference `sys_util::shm::SharedMemory (struct `sys_util::shm::SharedMemory`) found reference sys_util::shm::SharedMemory (struct `sys_util::shm::SharedMemory`) perhaps two different versions of crate `sys_util` are being used? Fix this by patching the version of sys_util used by audio_streams so that it also uses the path dependency instead of the sys_util from the dev-rust/sys_util ebuild in the fuzz-specific Cargo.toml. BUG=chromium:1057532 TEST=`USE='asan fuzzer' emerge-nami crosvm` Change-Id: I38252465a1111a9a8f643a59e36733016c5db99d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2086401 Reviewed-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
* disk: move qcow into disk crateDaniel Verkamp2020-01-06
| | | | | | | | | | | | | | | | | | | Move qcow from being its own crate into a module of the disk crate, similar to the composite disk module. This will allow use of qcow from disk and vice versa without introducing a circular crate dependency. BUG=None TEST=./build_test.py TEST=USE='asan fuzzer' emerge-nami crosvm Change-Id: I77512bbe4b94faff1b5460f9796ee56505135580 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1972477 Reviewed-by: Cody Schuffelen <schuffelen@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
* fuzz: add block_size to block_fuzzer constructorDaniel Verkamp2019-12-12
| | | | | | | | | | | | | | | | | | | | Fix the build of block_fuzzer after "devices: block: add block_size option for disks". It might be nice to generate the block size from the random fuzz data, but that would complicate things (we'd have to handle failure of Block::new due to invalid sizes), so let's leave that as a future improvement for now and just use a block_size of 512 to match previous behavior. BUG=chromium:942700 TEST=`USE='asan fuzzer' emerge-nami crosvm` Change-Id: Ia16ef6a57fc8ce4407f8ec9dda0e708302916c4c Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1962535 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
* fuzz: block_fuzzer: add sparse param to Block::newDaniel Verkamp2019-11-19
| | | | | | | | | | | | | | | | | | Fix the block_fuzzer build after CL:1906750, which added a new parameter to the Block::new() function without updating the fuzzer. This change passes `true` for sparse in order to keep previous behavior and maximize the available commands for fuzzing. BUG=chromium:1025757 TEST=`USE='asan fuzzer' emerge-nami crosvm` Change-Id: I29ed9945077936aee9636ddee20b59729eb78c85 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1922065 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
* devices: virtio: use signal helper for config changesDaniel Verkamp2019-11-18
| | | | | | | | | | | | | | | | Add handling of the virtio device MSI-X configuration change vector by using the signal function that was previously factored out. BUG=chromium:854765 TEST=./build_test TEST=trigger disk config change with `crosvm disk resize ...` Change-Id: I462c23e10d152f896586bb70b95634a53088d480 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1898269 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zide Chen <zide.chen@intel.corp-partner.google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
* devices: virtio: pass Interrupt to activate()Daniel Verkamp2019-11-18
| | | | | | | | | | | | | | Factor out the common creation of struct Interrupt. No functional change. BUG=chromium:854765 TEST=./build_test Change-Id: Idf8804771ba1af5181818f643e15e1b42918258a Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1898268 Tested-by: kokoro <noreply+kokoro@google.com>
* fuzz: Add virtio-fs server fuzzerChirantan Ekbote2019-11-08
| | | | | | | | | | | | | | | | Add a fuzzer for the virtio-fs server, which is responsible for decoding a byte stream into FUSE messages. BUG=none TEST=run it with cros_fuzz Change-Id: Ic7695f2106d3f81e6cf09b98ffedc51831238f1e Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1865272 Tested-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
* fuzz: Refactor and improve virtqueue_fuzzer performanceChirantan Ekbote2019-10-29
| | | | | | | | | | | | | | | | | | | | | | | | Improve the virtqueue_fuzzer's performance by reducing the maximum queue size as well as the size of the guest memory. Zeroing out 256MB of memory on every iteration was slowing things down quite a bit and we don't actually need that much memory to fuzz the virtqueue code. Additionally, refactor the fuzzer to use the virtqueue structs from the virtio spec to fill out the guest memory. This should give us more targeted fuzzing compared to the previous implementation, while also removing cases where the fuzzer would spin for thousands of iterations without making any progress. BUG=chromium:1018267 TEST=`cros_fuzz reproduce` and also run the fuzzer manually Change-Id: Ibf71aa83c31f16b7f58b23045a0919f7f6824c77 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1886533 Tested-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Sean Abraham <seanabraham@chromium.org> Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
* fuzz: convert fuzzers to cros_fuzz frameworkDaniel Verkamp2019-10-28
| | | | | | | | | | | | | This eliminates the boilerplate for catching panics and creating a Rust slice from the fuzzer input data. BUG=None TEST=`USE='asan fuzzer' emerge-nami crosvm` Change-Id: I49666a344b02e3333ad6823bfa7dace08b66b290 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1879495 Reviewed-by: Dylan Reid <dgreid@chromium.org>
* fuzz: block_fuzzer: add msix_config to activateDaniel Verkamp2019-10-25
| | | | | | | | | | | | | | Fix fuzzer build after the VirtioDevice activate() API change requiring the msix_config parameter. BUG=chromium:1017954 TEST=`USE='asan fuzzer' emerge-nami crosvm` Change-Id: I1bd63369e7d112ee55265747a88d64e6545e572a Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1880137 Reviewed-by: Manoj Gupta <manojgupta@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
* fuzz: Add virtqueue fuzzerChirantan Ekbote2019-10-24
| | | | | | | | | | | | | BUG=none TEST=Run it with cros_fuzz Cq-Depend: chromium:1863177, chromium:1863178 Change-Id: I1a989d7b90116e210a8aae63205c5e8cf6b70faa Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1863889 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: Chirantan Ekbote <chirantan@chromium.org> Legacy-Commit-Queue: Commit Bot <commit-bot@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
* fuzz: remove misleading block fuzzer commentDaniel Verkamp2019-10-24
| | | | | | | | | | | | | | | This looks like it's copied from the qcow fuzzer, and it doesn't apply to the block fuzzer. The actual behavior of the block fuzzer is correctly described by the comment later in the file. BUG=None TEST=`USE='asan fuzzer' emerge-nami crosvm` Change-Id: I9ccd6deba44af8b8df471ee0078ace385696151f Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1853698 Reviewed-by: Dylan Reid <dgreid@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com>
* fuzz: add USB descriptor parsing fuzzerDaniel Verkamp2019-10-17
| | | | | | | | | | | | | | | The new USB descriptor parsing code is a nice candidate for a fuzzer, since it takes an arbitrary stream of bytes as input and parses it. BUG=chromium:987833 TEST=`USE='asan fuzzer' emerge-nami crosvm` Cq-Depend: chromium:1863465 Change-Id: I3bbdbf081e9a9dd590c781467f8bd44fa1dcab64 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1862117 Reviewed-by: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com>
* use `SharedMemory::{named, anon}` to replace `::new`Zach Reizner2019-09-11
| | | | | | | | | | | | | | | | The new constructors are shorter and omit the bare `None` in the `anon` call sites which gave no clues to the reader what the effect of that `None` was. This should improve readability. TEST=./build_test BUG=None Change-Id: I2e34e7df9a4ccc5da50edf4e963a6a42e3d84b22 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1797188 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Commit-Queue: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com>
* fuzz: fix block fuzzer build after block API changeDaniel Verkamp2019-09-03
| | | | | | | | | | | | | | Block::new() now takes a Box of the underlying file; update the block fuzzer accordingly. BUG=chromium:1000065 TEST=`USE='asan fuzzer' emerge-nami crosvm` Change-Id: Ib636e13da5dcd347dd33c40a11508e016ea73b70 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1780336 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
* fuzz: zimage: use a fixed guest memory sizeDaniel Verkamp2019-06-25
| | | | | | | | | | | | | | | | | GuestMemory::new returns an error if the requested size is not divisible by the page size. The zimage fuzzer was using a GuestMemory size based on the size of the fuzzer input; however, it doesn't necessarily make sense to limit the guest memory to the size of the input. Pick an arbitrary 256 MB (matching the block fuzzer), which is also a page size multiple to resolve the original issue. BUG=chromium:977883 TEST=/usr/libexec/fuzzers/crosvm_zimage_fuzzer in cros_fuzz shell Change-Id: I08c6be9d920bede18d67f8a1c5c39b9d37fb839c Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1645040 Tested-by: kokoro <noreply+kokoro@google.com>
* fuzz: Comply with new guest memory requirement for page alignmentDylan Reid2019-06-21
| | | | | | | | | | | | | | | When the input's length is not page aligned, round it up. This allows the fuzzer to provide more random inputs without causing the `unwrap` call to trigger false positives when creating guest memory. BUG=chromium:972172 TEST=run fuzz case from the bug Change-Id: Iaf8f2ba943f38b90e168301dbb8c15dee5ee45c8 Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1659626 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com>
* fuzz: adapt zimage fuzzer to new kernel loader APIDaniel Verkamp2019-06-06
| | | | | | | | | | | | | | | | | | After CL:1636685, the kernel_loader API is different - we need to pass a File instead of just a slice to load_kernel(). Borrow and adapt the make_elf_bin() function from the kernel_loader tests to create a shared memory file from a slice of bytes to fix the fuzzer. BUG=chromium:970981 TEST=USE='asan fuzzer' emerge-nami crosvm Change-Id: Ic17f6479fb355d45063ce6292552cb1e5664831a Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1645039 Reviewed-by: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com>
* edition: Remove extern crate linesDavid Tolnay2019-04-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In Rust 2018 edition, `extern crate` is no longer required for importing from other crates. Instead of writing: extern crate dep; use dep::Thing; we write: use dep::Thing; In this approach, macros are imported individually from the declaring crate rather than through #[macro_use]. Before: #[macro_use] extern crate sys_util; After: use sys_util::{debug, error}; The only place that `extern crate` continues to be required is in importing the compiler's proc_macro API into a procedural macro crate. This will hopefully be fixed in a future Rust release. extern crate proc_macro; TEST=cargo check TEST=cargo check --all-features TEST=cargo check --target aarch64-unknown-linux-gnu TEST=local kokoro Change-Id: I0b43768c0d81f2a250b1959fb97ba35cbac56293 Reviewed-on: https://chromium-review.googlesource.com/1565302 Commit-Ready: David Tolnay <dtolnay@chromium.org> Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: David Tolnay <dtolnay@chromium.org>
* cargo: Sort all dependency lists in Cargo.tomlDavid Tolnay2019-04-09
| | | | | | | | | | | | | | | This may help reduce cases of conflicts between independent CLs each appending a dependency at the bottom of the list, of which I hit two today rebasing some of my open CLs. TEST=cargo check --all-features Change-Id: Ief10bb004cc7b44b107dc3841ce36c6b23632aed Reviewed-on: https://chromium-review.googlesource.com/1557172 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
* edition: Update fuzz crate to 2018 editionDavid Tolnay2019-04-07
| | | | | | | | | | | | | | | | | | Separated out of CL:1513058 to make it possible to land parts individually while the affected crate has no other significant CLs pending. This avoids repeatedly introducing non-textual conflicts with new code that adds `use` statements. TEST=cargo check TEST=cargo check --all-features TEST=cargo check --target aarch64-unknown-linux-gnu Change-Id: I355014ebd08bc2a655e1a1bbff56ecc90aa99ece Reviewed-on: https://chromium-review.googlesource.com/1519695 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: David Tolnay <dtolnay@chromium.org>
* fuzz: Add block device fuzzerDylan Reid2019-03-25
| | | | | | | | | | | | | | | Add the block device fuzzer that interprets the fuzz data input as follows: starting index 8 bytes command location 8 bytes command 16 bytes descriptors circular buffer 16 bytes * 3 Change-Id: I25b58e149bfb9a479fab7955c0ca25c67c590bf6 Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/900202 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
* fuzz: Add qcow fuzzingDylan Reid2019-03-25
| | | | | | | | | | | Fuzz using the data as a qcow image with an offset and value to write to the image. Change-Id: Iff8f2971ba716c93d978e33338ad62b5d487c115 Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/871132 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
* fuzz: update to use new cros fuzzingDylan Reid2019-03-25
| | | | | | | | | | There is now infrastructure for running fuzzers in cros, use it. Change-Id: I53ec9e195b7062fdcc38b5186c1f3194031037f3 Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1521667 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
* fmt: Format sys_util and fuzz crates using rustfmtDavid Tolnay2019-02-21
| | | | | | | | | | | | | | | | | These are each their own workspace so I guess `cargo fmt` at the top level of the repo does not hit them. I checked that none of the other workspace roots currently need to be reformatted. TEST=cargo check Change-Id: I734cbc0f909fd3c2138513d9539b917bce80c0a8 Reviewed-on: https://chromium-review.googlesource.com/1477496 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
* Add kernel_loader fuzzingDylan Reid2018-01-12
Add a top level fuzz directory. Other fuzz tests will be added here in subsequent commits. For now fuzzing must be run manually. Soon there will be a way to extract the fuzz artifacts and upload them to cluster fuzz. Change-Id: Iddfb55af78af6f412927b2221f22acb882069d36 Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/850851 Reviewed-by: Zach Reizner <zachr@chromium.org>
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-05-03 20:38:53 +0000