diff options
| author | Alexander Bulekov <alxndr@bu.edu> | 2021-01-17 18:09:24 -0500 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2021-02-08 14:43:54 +0100 |
| commit | fff7111fb90e93b148b2196175fd656b2bfea4cd (patch) | |
| tree | e09c7c74f8f6a145ab8c2296d9ca71590aa63f06 /tests/qtest/fuzz | |
| parent | 3ca45fb4d26ba92e55f1dda651829fe46ab8f863 (diff) | |
| download | qemu-fff7111fb90e93b148b2196175fd656b2bfea4cd.zip qemu-fff7111fb90e93b148b2196175fd656b2bfea4cd.tar.gz qemu-fff7111fb90e93b148b2196175fd656b2bfea4cd.tar.bz2 | |
fuzz: add virtio-9p configurations for fuzzing
virtio-9p devices are often used to expose a virtual-filesystem to the
guest. There have been some bugs reported in this device, such as
CVE-2018-19364, and CVE-2021-20181. We should fuzz this device
This patch adds two virtio-9p configurations:
* One with the widely used -fsdev local driver. This driver leaks some
state in the form of files/directories created in the shared dir.
* One with the synth driver. While it is not used in the real world, this
driver won't leak leak state between fuzz inputs.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20210117230924.449676-4-alxndr@bu.edu>
Diffstat (limited to 'tests/qtest/fuzz')
| -rw-r--r-- | tests/qtest/fuzz/generic_fuzz_configs.h | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h b/tests/qtest/fuzz/generic_fuzz_configs.h index 51e69c6..5d59976 100644 --- a/tests/qtest/fuzz/generic_fuzz_configs.h +++ b/tests/qtest/fuzz/generic_fuzz_configs.h @@ -19,6 +19,16 @@ typedef struct generic_fuzz_config { gchar* (*argfunc)(void); /* Result must be freeable by g_free() */ } generic_fuzz_config; +static inline gchar *generic_fuzzer_virtio_9p_args(void){ + char tmpdir[] = "/tmp/qemu-fuzz.XXXXXX"; + g_assert_nonnull(mkdtemp(tmpdir)); + + return g_strdup_printf("-machine q35 -nodefaults " + "-device virtio-9p,fsdev=hshare,mount_tag=hshare " + "-fsdev local,id=hshare,path=%s,security_model=mapped-xattr," + "writeout=immediate,fmode=0600,dmode=0700", tmpdir); +} + const generic_fuzz_config predefined_configs[] = { { .name = "virtio-net-pci-slirp", @@ -61,6 +71,16 @@ const generic_fuzz_config predefined_configs[] = { .args = "-machine q35 -nodefaults -device virtio-mouse", .objects = "virtio*", },{ + .name = "virtio-9p", + .argfunc = generic_fuzzer_virtio_9p_args, + .objects = "virtio*", + },{ + .name = "virtio-9p-synth", + .args = "-machine q35 -nodefaults " + "-device virtio-9p,fsdev=hshare,mount_tag=hshare " + "-fsdev synth,id=hshare", + .objects = "virtio*", + },{ .name = "e1000", .args = "-M q35 -nodefaults " "-device e1000,netdev=net0 -netdev user,id=net0", |