On Montag, 18. Januar 2021 00:09:24 CET Alexander Bulekov wrote: > virtio-9p devices are often used to expose a virtual-filesystem to the > guest. There have been some bugs reported in this device, such as > CVE-2018-19364, and CVE-2021-20181. We should fuzz this device > > This patch adds two virtio-9p configurations: > * One with the widely used -fsdev local driver. This driver leaks some > state in the form of files/directories created in the shared dir. > * One with the synth driver. While it is not used in the real world, this > driver won't leak leak state between fuzz inputs. > > Signed-off-by: Alexander Bulekov <alx...@bu.edu> > --- > CC: Christian Schoenebeck <qemu_...@crudebyte.com> > CC: Greg Kurz <gr...@kaod.org> > > I considered adding an atexit handler to remove the temp directory, > however I am worried that there might be some error that results in a > call to exit(), rather than abort(), which will cause problems for > future fork()-ed fuzzers. I don't think there are such calls in the 9p > code, however there might be something in the APIs used by 9p. As this > code is primarily for ephemeral OSS-Fuzz conainers, this shouldn't be > too much of an issue.
Yes, dealing with signal handlers for that is probably a bit intransparent and would leave a questionable feeling about its reliability. What about __attribute__((destructor)) to auto delete the fuzzer directory, like virtio-9p-test.c does for the same task? > tests/qtest/fuzz/generic_fuzz_configs.h | 20 ++++++++++++++++++++ > 1 file changed, 20 insertions(+) > > diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h > b/tests/qtest/fuzz/generic_fuzz_configs.h index 1a133655ee..f99657cdbc > 100644 > --- a/tests/qtest/fuzz/generic_fuzz_configs.h > +++ b/tests/qtest/fuzz/generic_fuzz_configs.h > @@ -19,6 +19,16 @@ typedef struct generic_fuzz_config { > gchar* (*argfunc)(void); /* Result must be freeable by g_free() */ > } generic_fuzz_config; > > +static inline gchar *generic_fuzzer_virtio_9p_args(void){ > + char tmpdir[] = "/tmp/qemu-fuzz.XXXXXX"; > + g_assert_nonnull(mkdtemp(tmpdir)); > + > + return g_strdup_printf("-machine q35 -nodefaults " > + "-device virtio-9p,fsdev=hshare,mount_tag=hshare " > + "-fsdev local,id=hshare,path=%s,security_model=mapped-xattr," > + "writeout=immediate,fmode=0600,dmode=0700", tmpdir); > +} > + > const generic_fuzz_config predefined_configs[] = { > { > .name = "virtio-net-pci-slirp", > @@ -60,6 +70,16 @@ const generic_fuzz_config predefined_configs[] = { > .name = "virtio-mouse", > .args = "-machine q35 -nodefaults -device virtio-mouse", > .objects = "virtio*", > + },{ > + .name = "virtio-9p", > + .argfunc = generic_fuzzer_virtio_9p_args, > + .objects = "virtio*", > + },{ > + .name = "virtio-9p-synth", > + .args = "-machine q35 -nodefaults " > + "-device virtio-9p,fsdev=hshare,mount_tag=hshare " > + "-fsdev synth,id=hshare", > + .objects = "virtio*", > },{ > .name = "e1000", > .args = "-M q35 -nodefaults "