1. Patchew
  2. QEMU
  3. View series

[PATCH] fuzz: refine the ide/ahci fuzzer configs

Alexander Bulekov posted 1 patch 4 years, 10 months ago
Test checkpatch passed
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20210120060745.558970-1-alxndr@bu.edu
Maintainers: Thomas Huth <thuth@redhat.com>, Alexander Bulekov <alxndr@bu.edu>, Paolo Bonzini <pbonzini@redhat.com>, Stefan Hajnoczi <stefanha@redhat.com>, Laurent Vivier <lvivier@redhat.com>, Bandan Das <bsd@redhat.com>
There is a newer version of this series
tests/qtest/fuzz/generic_fuzz_configs.h | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
[PATCH] fuzz: refine the ide/ahci fuzzer configs
Posted by Alexander Bulekov 4 years, 10 months ago 
Disks work differently depending on the x86 machine type (SATA vs PATA).
Additionally, we should fuzz the atapi code paths, which might contain
vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and
cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA)
machine types.

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
---
 tests/qtest/fuzz/generic_fuzz_configs.h | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h b/tests/qtest/fuzz/generic_fuzz_configs.h
index 7fed035345..2ec52fbb63 100644
--- a/tests/qtest/fuzz/generic_fuzz_configs.h
+++ b/tests/qtest/fuzz/generic_fuzz_configs.h
@@ -85,10 +85,28 @@ const generic_fuzz_config predefined_configs[] = {
         .objects = "intel-hda",
     },{
         .name = "ide-hd",
+        .args = "-machine pc -nodefaults "
+        "-drive file=null-co://,if=none,format=raw,id=disk0 "
+        "-device ide-hd,drive=disk0",
+        .objects = "*ide*",
+    },{
+        .name = "ide-atapi",
+        .args = "-machine pc -nodefaults "
+        "-drive file=null-co://,if=none,format=raw,id=disk0 "
+        "-device ide-cd,drive=disk0",
+        .objects = "*ide*",
+    },{
+        .name = "ahci-hd",
+        .args = "-machine q35 -nodefaults "
+        "-drive file=null-co://,if=none,format=raw,id=disk0 "
+        "-device ide-hd,drive=disk0",
+        .objects = "*ahci*",
+    },{
+        .name = "ahci-atapi",
         .args = "-machine q35 -nodefaults "
         "-drive file=null-co://,if=none,format=raw,id=disk0 "
         "-device ide-hd,drive=disk0",
-        .objects = "ahci*",
+        .objects = "*ahci*",
     },{
         .name = "floppy",
         .args = "-machine pc -nodefaults -device floppy,id=floppy0 "
-- 
2.28.0
Re: [PATCH] fuzz: refine the ide/ahci fuzzer configs
Posted by Philippe Mathieu-Daudé 4 years, 10 months ago 
On 1/20/21 7:07 AM, Alexander Bulekov wrote:
> Disks work differently depending on the x86 machine type (SATA vs PATA).
> Additionally, we should fuzz the atapi code paths, which might contain
> vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and
> cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA)
> machine types.

Yet another point for using qgraph generated configs ;)
Re: [PATCH] fuzz: refine the ide/ahci fuzzer configs
Posted by Alexander Bulekov 4 years, 10 months ago 
On 210120 1003, Philippe Mathieu-Daudé wrote:
> On 1/20/21 7:07 AM, Alexander Bulekov wrote:
> > Disks work differently depending on the x86 machine type (SATA vs PATA).
> > Additionally, we should fuzz the atapi code paths, which might contain
> > vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and
> > cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA)
> > machine types.
> 
> Yet another point for using qgraph generated configs ;)
> 
Yes. Though in this particular case, ahci-test.c and ide-test.c still
do their own disk setup, and -drive arguments. I don't think PATA is
built out within libqos at all, yet.
Re: [PATCH] fuzz: refine the ide/ahci fuzzer configs
Posted by Thomas Huth 4 years, 10 months ago 
On 20/01/2021 07.07, Alexander Bulekov wrote:
> Disks work differently depending on the x86 machine type (SATA vs PATA).
> Additionally, we should fuzz the atapi code paths, which might contain
> vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and
> cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA)
> machine types.
> 
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> ---
>   tests/qtest/fuzz/generic_fuzz_configs.h | 20 +++++++++++++++++++-
>   1 file changed, 19 insertions(+), 1 deletion(-)
> 
> diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h b/tests/qtest/fuzz/generic_fuzz_configs.h
> index 7fed035345..2ec52fbb63 100644
> --- a/tests/qtest/fuzz/generic_fuzz_configs.h
> +++ b/tests/qtest/fuzz/generic_fuzz_configs.h
> @@ -85,10 +85,28 @@ const generic_fuzz_config predefined_configs[] = {
>           .objects = "intel-hda",
>       },{
>           .name = "ide-hd",
> +        .args = "-machine pc -nodefaults "
> +        "-drive file=null-co://,if=none,format=raw,id=disk0 "
> +        "-device ide-hd,drive=disk0",
> +        .objects = "*ide*",
> +    },{
> +        .name = "ide-atapi",
> +        .args = "-machine pc -nodefaults "
> +        "-drive file=null-co://,if=none,format=raw,id=disk0 "
> +        "-device ide-cd,drive=disk0",
> +        .objects = "*ide*",
> +    },{
> +        .name = "ahci-hd",
> +        .args = "-machine q35 -nodefaults "
> +        "-drive file=null-co://,if=none,format=raw,id=disk0 "
> +        "-device ide-hd,drive=disk0",
> +        .objects = "*ahci*",
> +    },{
> +        .name = "ahci-atapi",
>           .args = "-machine q35 -nodefaults "
>           "-drive file=null-co://,if=none,format=raw,id=disk0 "
>           "-device ide-hd,drive=disk0",

Shouldn't that be ide-cd now for ahci-atapi?

  Thomas
Re: [PATCH] fuzz: refine the ide/ahci fuzzer configs
Posted by Alexander Bulekov 4 years, 10 months ago 
On 210120 1053, Thomas Huth wrote:
> On 20/01/2021 07.07, Alexander Bulekov wrote:
> > Disks work differently depending on the x86 machine type (SATA vs PATA).
> > Additionally, we should fuzz the atapi code paths, which might contain
> > vulnerabilities such as CVE-2020-29443. This patch adds hard-disk and
> > cdrom generic-fuzzer configs for both the pc (PATA) and q35 (SATA)
> > machine types.
> > 
> > Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> > ---
> >   tests/qtest/fuzz/generic_fuzz_configs.h | 20 +++++++++++++++++++-
> >   1 file changed, 19 insertions(+), 1 deletion(-)
> > 
> > diff --git a/tests/qtest/fuzz/generic_fuzz_configs.h b/tests/qtest/fuzz/generic_fuzz_configs.h
> > index 7fed035345..2ec52fbb63 100644
> > --- a/tests/qtest/fuzz/generic_fuzz_configs.h
> > +++ b/tests/qtest/fuzz/generic_fuzz_configs.h
> > @@ -85,10 +85,28 @@ const generic_fuzz_config predefined_configs[] = {
> >           .objects = "intel-hda",
> >       },{
> >           .name = "ide-hd",
> > +        .args = "-machine pc -nodefaults "
> > +        "-drive file=null-co://,if=none,format=raw,id=disk0 "
> > +        "-device ide-hd,drive=disk0",
> > +        .objects = "*ide*",
> > +    },{
> > +        .name = "ide-atapi",
> > +        .args = "-machine pc -nodefaults "
> > +        "-drive file=null-co://,if=none,format=raw,id=disk0 "
> > +        "-device ide-cd,drive=disk0",
> > +        .objects = "*ide*",
> > +    },{
> > +        .name = "ahci-hd",
> > +        .args = "-machine q35 -nodefaults "
> > +        "-drive file=null-co://,if=none,format=raw,id=disk0 "
> > +        "-device ide-hd,drive=disk0",
> > +        .objects = "*ahci*",
> > +    },{
> > +        .name = "ahci-atapi",
> >           .args = "-machine q35 -nodefaults "
> >           "-drive file=null-co://,if=none,format=raw,id=disk0 "
> >           "-device ide-hd,drive=disk0",
> 
> Shouldn't that be ide-cd now for ahci-atapi?

Thanks for catching that.
-Alex

> 
>  Thomas
>

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.