From nobody Mon Feb 9 15:55:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=bu.edu); dmarc=fail(p=none dis=none) header.from=bu.edu ARC-Seal: i=2; a=rsa-sha256; t=1626188604; cv=pass; d=zohomail.com; s=zohoarc; b=IIEhJh4jWGoAuYjfVpYDGjCYIFMKUFOLbLgp4j2ECdXZhdcOE/mQVZUsOf16ypKHt6A/RuxbW8xEWvTiGGjEVhsg4Ppj4/vRoX+zFpjecoQjBGvGBfMBOQFLkXrKrKcuvP2dQ7v1ZdFz1Yz2DbEAkozOh8xh+V4uJe3mDvbhqSU= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1626188604; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=KF9aTRQnvRLf1kNFgJ7H+mEonbE0DzCv3qCtz16lMqc=; b=TAAiZAZNX3FjnJzXKJBcF67A6oby6Q5OaTR/6Xti8vOWLclrXhyeAzd/jvqclasQLMWfxfgYNR8qfaUuHJw1thVae7Yeg48expEJsbK1qx2IMTQVKyrWy+rrTFewCXjXB+WvDIvLUT20/A30pRQWhwHnkZdSt61zSf07l50oZpQ= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=bu.edu); dmarc=fail header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1626188604539372.6441328248085; Tue, 13 Jul 2021 08:03:24 -0700 (PDT) Received: from localhost ([::1]:53482 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m3JwR-00006p-9q for importer@patchew.org; Tue, 13 Jul 2021 11:03:23 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:47198) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m3Ju3-0005Xp-Af for qemu-devel@nongnu.org; Tue, 13 Jul 2021 11:00:56 -0400 Received: from mail-dm6nam11on2096.outbound.protection.outlook.com ([40.107.223.96]:35521 helo=NAM11-DM6-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m3Ju1-0002ks-DY for qemu-devel@nongnu.org; Tue, 13 Jul 2021 11:00:54 -0400 Received: from SN6PR03MB3871.namprd03.prod.outlook.com (2603:10b6:805:6d::32) by SA2PR03MB5722.namprd03.prod.outlook.com (2603:10b6:806:110::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.22; Tue, 13 Jul 2021 15:00:48 +0000 Received: from SN6PR03MB3871.namprd03.prod.outlook.com ([fe80::24fc:a5d:be8d:eb3f]) by SN6PR03MB3871.namprd03.prod.outlook.com ([fe80::24fc:a5d:be8d:eb3f%3]) with mapi id 15.20.4308.027; Tue, 13 Jul 2021 15:00:48 +0000 Received: from stormtrooper.vrmnet (72.74.210.193) by MN2PR11CA0002.namprd11.prod.outlook.com (2603:10b6:208:23b::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20 via Frontend Transport; Tue, 13 Jul 2021 15:00:47 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZyGdF2N0wkUttieAZk2RKvffKEWfCgOzYJBBJ4cAASyTXxt55uMUHVEAafl3w20VpD0j1RDmi5FUgna0b9/6am30sLT2KchQVcHL2rRi2XkNTqhg0fMH4wqJC2vuaaVuSHPkxgvxCTGkb5iyamWQjqQouCOhsbcympZkx7NA0n7hv7eem/xkWVclnyJ7urR3OFFthaE+t8Sgg92MHzbZ/CKZppunsTiS+Hb3YPJ0Pl0RQbjXYTD8jhIbotsuYzKxKATdkD/N9TfxXfXhUMru5jZ5RkB+q9VTamHQvbHeZDxc2DdqBxJG1hDTabOWf6dzeLDwF0qjv/acKD47LJFwKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KF9aTRQnvRLf1kNFgJ7H+mEonbE0DzCv3qCtz16lMqc=; b=CTPtv0XiKwH94W5kSsI2tiy2A4UZDZtuop9gWBpCH0Okjeg69kZYeKnOwhEtuxWu2n0iTLWH+Hc2D4EoCzl3eiNB5LwN0CxobaX8k7kwKh25ZVxePPsEzs8qIkiQrFHXUuwANjOmQS7icGzVmIDam57W2LwDTazkDdCvzy1FN8DpUmpNJ7OD/RTQmmlN7m6PXNluiged/VJ1l3/PT+LAb3dJ+MzB0AqvrpEVXrhWTBM+uFV3VfxWgw6X2aeOK9K+n9CQJ0yfPO7n4OMeR07EnpIE9k4eV9dD5RU1mIP3CcsPds/DgnV/+0nNh8cthZajJB+2WQl+CCVEeCXSWJuJEA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=bu.edu; dmarc=pass action=none header.from=bu.edu; dkim=pass header.d=bu.edu; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bushare.onmicrosoft.com; s=selector2-bushare-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KF9aTRQnvRLf1kNFgJ7H+mEonbE0DzCv3qCtz16lMqc=; b=XEBRBZdw2Kyqu+6HWBoqAluu69L57GTnwKg4t5KvzE+IDYEkihiF0JMiKVz4UeH9CAYq8xKpLSEknNKSbUfilUcca+tboPRZhWe4LZusog2g6ksB354xk9Hngx9ynZ02+htBWKf84eSgrDd5sUJAwWkTpmPUS26AlkHan+bkAAo= Authentication-Results: nongnu.org; dkim=none (message not signed) header.d=none;nongnu.org; dmarc=none action=none header.from=bu.edu; From: Alexander Bulekov To: qemu-devel@nongnu.org Subject: [PULL v2 1/4] fuzz: fix sparse memory access in the DMA callback Date: Tue, 13 Jul 2021 11:00:34 -0400 Message-Id: <20210713150037.9297-2-alxndr@bu.edu> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20210713150037.9297-1-alxndr@bu.edu> References: <20210713150037.9297-1-alxndr@bu.edu> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: MN2PR11CA0002.namprd11.prod.outlook.com (2603:10b6:208:23b::7) To SN6PR03MB3871.namprd03.prod.outlook.com (2603:10b6:805:6d::32) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: eb4e1d56-fc06-4766-ce95-08d9460effb2 X-MS-TrafficTypeDiagnostic: SA2PR03MB5722: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: hmCfRySCwXuZzdS/umWMbWJHVywNkmccKh772xA/2U9/qfY8eYE7LQgDvpACJI+TjjPQGHMdY37g42IVzOGRKQ1m4NpMKir6M/ivRIvs3i9mx22RFVq2XBVq80M2jO9p7eTygfyq6+3VSrP0RkOZ+KrpdKDIMigy19SJ5xXkxtrGZ32TEFjFJ7SCLU678nG4Hdq2oSF6zMBlfYbgPXU+x1JVIZ+ZWDMA8eqTXSCyWAntAW91YU1cBdY3wiPcFw7mZbpdwuSYpMl1GARvSBN+ZvWiB2nxSVbiXwWISCJrA08dhfUx6twH6my1//RBE85ItsOxs3zRKwSLiAM28nnjqC7dtoddHJd+rul6lixEHI/gaszhb8PXkZR69FslUUeuPyGPTvMbKNzgMXe7Fg+cJneTLmCeHX+Q46eOxV9mPnVxe5O+1aIW95oh7EnJnPgMrQEJ61+EFZrRfXn4VWSW/gtfG1Yo5FrbOZ38k/l+yncWM5+SaIJzAuO275/e2Qh97PTCEDTnibOTClFlv1+aRNpwGDvZPhjrev39I4bGe+LQnGv31z9WOxYYwkV1csJ12JiewE9lZXQ0/RKABgRvcUJybt/8P0EbY88pHbsxlqovzj1pBj88yJgiVGVIIF/BIX6aAuUJmL6ays+WeEOi/Coext2zAzbDVwv1nbM5bHKu/ydVoMPb+gJv07eNbNyPW8mTvicJRTDCYsphaJiXeQ== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SN6PR03MB3871.namprd03.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(39860400002)(376002)(366004)(136003)(396003)(346002)(6916009)(2906002)(1076003)(66946007)(186003)(83380400001)(6666004)(52116002)(86362001)(66476007)(75432002)(26005)(8936002)(36756003)(8676002)(478600001)(66556008)(2616005)(5660300002)(4326008)(6486002)(54906003)(6506007)(38100700002)(316002)(38350700002)(956004)(786003)(6512007); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?OXg5WmkwUE5BQmZTWEQ5aEVnY3o0RWlscldPNHhhTzNEUkJOd0JYU0V3NmhP?= =?utf-8?B?a1B0VU5la2ZndFRsUXpoQzhKYkUvUXgxU3NtSytsaWwrTjUwY004c0hRMThQ?= =?utf-8?B?TEV2STJ4NmRhdGg3cHdBUi9tMU1mVDF5dVlldjU4YVlpclVCb1FlWXNnUDNO?= =?utf-8?B?ejBrcDRFMlNqQzhhV1BkaXZPQTYxaXJyZGZSQjlhb0R1cDFORWVEMjNURFBX?= =?utf-8?B?M3dHS1B3c0g5bHg3WUJna3I2RHNwdGI0Y2s4NklTb0M3RnMxS0ozZGYxNVEz?= =?utf-8?B?azZSanRmQVQ2MEpqUmdCVXc1bGhETDM1emJPSFkvSTFUK1ppQ1BraHdydzlK?= =?utf-8?B?ekNyYkIyMmVpaTYwTk5nd3dUTVFBQnlVdVRZMkxMdy9QTmRQem1HR2krV0hH?= =?utf-8?B?eWtlcEdCZFBsVTBvK3hvYWxIN0Q5SXNEak5xUnpHcklVZDZmMzhwSDNjNC84?= =?utf-8?B?ai9jM1JXWjMxTlJnSndvbU1EVm9uYytKYnJTTW8wWm5kUHNSQlF2SFJDZjZv?= =?utf-8?B?cnJqVnVTZ1g4QmxUL0RpZVRmNWxPV1RlWTYzeURsdVBzbW9sNkRFL2p1cDY5?= =?utf-8?B?bXZJclgxdlVCaGxEeGRvRDJMU21mb3d3cmFSZEFHaVVQRUF5TFN5Q21BSzZY?= =?utf-8?B?dkROVU8xdnZUNXRZNW9FMXBiMDlQbS9vcnFidjJTUG01VnI1cFlZUSsvZTdC?= =?utf-8?B?TXhiZmJ1dkxXWkg2TEs5Wmp3d20zODd0M1JBeERJcHZ2K2RzRTZ0cmFRQ2ND?= =?utf-8?B?dHg1eC81YUFQV3d6WUh6a3FXOG9BdTczdUVVSSttZnhHaE5HNTRuZHZ6MjVs?= =?utf-8?B?VzdpUjFYZU1heklka1VLOWpOQUk3TVpveFh0RVpKa1RJTlFhVUdpWFZsbFYw?= =?utf-8?B?RHRpeVVXd3lvMjZSOVN3a0FVcG9qek5hOEJkcXpjdy9ybGV1b1dFSWkxMXhL?= =?utf-8?B?MkJjaDZISHp1Yk1neTUzejFjRzlNcjZRSEtZSkNKLzdTMGpTWkJHa1Rad0tn?= =?utf-8?B?ZlZRcHFWRXlqc2c2Rlh1MmMzZFh1WDdXMm5PWXNKMXIzY1RQN051WXExUXZG?= =?utf-8?B?VStLbG03Y1JmSWlGWW1aUnVNZTQ2SFBZQmpIMWlZUFVvclI3WkpEbk1Fa2Fj?= =?utf-8?B?bm0rTFhpcjB6UExkcklSbURORUgzZkJQSWdiQ2s1SHdlQlpXR0FYYXRqb2tM?= =?utf-8?B?K1J4ZDVvZzNzTzluOTY4UlRFNFFqaU9Kam11a0ZmQ1hUdU1kcEQyNCsrenVW?= =?utf-8?B?OFozTU5ISUdZVlBoMWxNeFFVRkYvUEVQRDJ1OUxyMnkzaDNBblc4Mk1BMkdm?= =?utf-8?B?VGhCSUcvRlVlOEFSMjVmRVlqTmVkNm52LzR0QUh1cHk5RE1uRTV1K09Qb2No?= =?utf-8?B?TzVYQ2JOTVY0T3NtdnhHcmU4b2k1NVh5RE5LMDJmdjYwWWJ6TEZLNG4wOWx6?= =?utf-8?B?eDFIQmhyeDRvU2xmNjZlTDY0NFRsRGhNazdDWlVNcEZsczc4NFV1a1lFR3VZ?= =?utf-8?B?KytYZm8xajE2UW9Tbjh0dE1Gbmt4amlwRVc2WC9WN2FWQ0R0UDZIYUlvVzkx?= =?utf-8?B?VDZ6N05iWDRJM2dISElyUWNob3dseG5JMDZSbG1jSzN4NDhYZjdWNkxrZHpD?= =?utf-8?B?Vm1VR0p0U3NlR2UvVkVmcng5MzJOYWt6T0FLWmRTNXVFZW0ydU9YdzdqNUZo?= =?utf-8?B?OHdDU1dMMTNuLzQxVVFUK2N3SWtYeE8xVExMVmNHaGZ0dHdwb25GbDZOb255?= =?utf-8?Q?ns0Jmcvi9tTityJElD2pwgKP28LeLAvr1l0xYO3?= X-OriginatorOrg: bu.edu X-MS-Exchange-CrossTenant-Network-Message-Id: eb4e1d56-fc06-4766-ce95-08d9460effb2 X-MS-Exchange-CrossTenant-AuthSource: SN6PR03MB3871.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2021 15:00:48.6238 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d57d32cc-c121-488f-b07b-dfe705680c71 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: GyjyO68qivZgcYmhjOPzZiLr5Lujz4qHBolPvMqSkKvcgIMatiaX+Mq0KnyO5Wtb X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR03MB5722 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=40.107.223.96; envelope-from=alxndr@bu.edu; helo=NAM11-DM6-obe.outbound.protection.outlook.com X-Spam_score_int: -8 X-Spam_score: -0.9 X-Spam_bar: / X-Spam_report: (-0.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.998, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Darren Kenny , Alexander Bulekov Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @bushare.onmicrosoft.com) X-ZM-MESSAGEID: 1626188617398100003 The code mistakenly relied on address_space_translate to store the length remaining until the next memory-region. We care about this because when there is RAM or sparse-memory neighboring on an MMIO region, we should only write up to the border, to prevent inadvertently invoking MMIO handlers within the DMA callback. However address_space_translate_internal only stores the length until the end of the MemoryRegion if memory_region_is_ram(mr). Otherwise the *len is left unmodified. This caused some false-positive issues, where the fuzzer found a way to perform a nested MMIO write through a DMA callback on an [address, length] that started within sparse memory and spanned some device MMIO regions. To fix this, write to sparse memory in small chunks of memory_access_size (similar to the underlying address_space_write code), which will prevent accidentally hitting MMIO handlers through large writes. Signed-off-by: Alexander Bulekov Reviewed-by: Darren Kenny Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- tests/qtest/fuzz/generic_fuzz.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuz= z.c index 6c67522717..0ea47298b7 100644 --- a/tests/qtest/fuzz/generic_fuzz.c +++ b/tests/qtest/fuzz/generic_fuzz.c @@ -240,10 +240,17 @@ void fuzz_dma_read_cb(size_t addr, size_t len, Memory= Region *mr) addr, &addr1, &l, true, MEMTXATTRS_UNSPECIFIED); =20 - if (!(memory_region_is_ram(mr1) || - memory_region_is_romd(mr1)) && mr1 !=3D sparse_mem_mr) { + /* + * If mr1 isn't RAM, address_space_translate doesn't update l. Use + * memory_access_size to identify the number of bytes that it is = safe + * to write without accidentally writing to another MemoryRegion. + */ + if (!memory_region_is_ram(mr1)) { l =3D memory_access_size(mr1, l, addr1); - } else { + } + if (memory_region_is_ram(mr1) || + memory_region_is_romd(mr1) || + mr1 =3D=3D sparse_mem_mr) { /* ROM/RAM case */ if (qtest_log_enabled) { /* --=20 2.28.0 From nobody Mon Feb 9 15:55:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=bu.edu); dmarc=fail(p=none dis=none) header.from=bu.edu ARC-Seal: i=2; a=rsa-sha256; t=1626188709; cv=pass; d=zohomail.com; s=zohoarc; b=dUhVyvbgC9HwxgLMK782bic9tpKPHHf1yngohXp1ysHcidBb0JrLoonYoMBcZrEJC4Q08GYndyG0QD+4GPJOVqYTAaPrGStJ6+2VL5W4hnPxDtdG7C9lwhxIIRtBoqH3+FKtvadPivkVKgTg89WF5RmLxgA3KjluV/q0aOXXCow= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1626188709; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=gDuTuRvvyyjY/C3Rw978QPEPGrNt41qFTnQqUM9FCgE=; b=d99oWxDMgwzCi8PmRK8APKgK39OeM5cBWVd0KNRtee+kh+/MH9y4WaD1hH3ZOKCmSyd3YamXKsFNJO/Hl/0WDY6st/JTDciOr3s8bW62IsGNlnXs8ONTPe4W6gJGNLJuRZ+ebgdZQ8cBxoWghp6390hmokcGdDqxULQ7Pw4W++w= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=bu.edu); dmarc=fail header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1626188709697966.8164082101598; Tue, 13 Jul 2021 08:05:09 -0700 (PDT) Received: from localhost ([::1]:60350 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m3Jy8-0004fz-HU for importer@patchew.org; Tue, 13 Jul 2021 11:05:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:47222) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m3Ju5-0005Yb-4g for qemu-devel@nongnu.org; Tue, 13 Jul 2021 11:00:57 -0400 Received: from mail-dm6nam11on2096.outbound.protection.outlook.com ([40.107.223.96]:35521 helo=NAM11-DM6-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m3Ju3-0002ks-If for qemu-devel@nongnu.org; Tue, 13 Jul 2021 11:00:56 -0400 Received: from SN6PR03MB3871.namprd03.prod.outlook.com (2603:10b6:805:6d::32) by SA2PR03MB5722.namprd03.prod.outlook.com (2603:10b6:806:110::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.22; Tue, 13 Jul 2021 15:00:49 +0000 Received: from SN6PR03MB3871.namprd03.prod.outlook.com ([fe80::24fc:a5d:be8d:eb3f]) by SN6PR03MB3871.namprd03.prod.outlook.com ([fe80::24fc:a5d:be8d:eb3f%3]) with mapi id 15.20.4308.027; Tue, 13 Jul 2021 15:00:49 +0000 Received: from stormtrooper.vrmnet (72.74.210.193) by MN2PR11CA0002.namprd11.prod.outlook.com (2603:10b6:208:23b::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20 via Frontend Transport; Tue, 13 Jul 2021 15:00:48 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=emTukVd2Rwxo3Lu7G0Ivv3LVUvj0NrVae+ecJUFjaYntAd74oLQhNuo38j8jOb8+IK66UVYVyDaaLfONpm5geU1ahdONK9zjRk6Rl3KDJY0W6mX7xskenEf81joXBicnCUxs4ZYK5WGEQFR9jHYCztJdqrULJB0Trd9PM9bjlI5ufBpRa70QTUgbdsADiPd2/LgFP8bmuXJFGzeOTOc860oC0W9O+ynDc0tNes3WNpQco6rvPl2RwyXCiZ4MM8S+N85x+PzHS3Cm/tzrWhCbUHn/B+QuPfivAD+Kf1Q89u81hGDNl9g6c1IPG6rreeWx1Qepw3r+yKl/cpW+B9VVUw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gDuTuRvvyyjY/C3Rw978QPEPGrNt41qFTnQqUM9FCgE=; b=hUU0dTMqcHvWQvh/33Dmli9Jyv5jCr4ky9rY2oN0JN1zPJAtoPrWuZhMLaqx0MZ5u8K5kOdE8X8lfwXAOd5VGIBnDeTbqtN16d8sNFRVLI33psYxGFM0+UTvZjEuKxrxH/4GfBfTlduE8D7gLXF0Z1fgl8C2aYtuzlAMzDSFSqLZDrhZuEQJsofmbHneLBwdWIKTjHxZmZ6HJcDaBMjFVufMHB+3NfD5CvfIkdf5VjZF5E3SE6+bAQXATZk6NljVfxmIR9Y5lMZWSsEzYSbUovmTTf0CiWzREc11dW5XTlDd2XvAfvOA6gVyUU7KHFzsIBY9AAhbnhnnNZefgWWeIg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=bu.edu; dmarc=pass action=none header.from=bu.edu; dkim=pass header.d=bu.edu; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bushare.onmicrosoft.com; s=selector2-bushare-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gDuTuRvvyyjY/C3Rw978QPEPGrNt41qFTnQqUM9FCgE=; b=pQDGlt7OSLpZQMJ8qAuNhoQvqwpALq3ihWipFKsTWpWeGvRJCqM6cADA9Mlw9JsZpPslHx36a1itxoXNT8Ah99l80f6MjlCNvxeBfwFcv8aLnHOjc0xG+SOckJ7ruryOCBzYYsmGL7ZK7ynAKr1/QUYcUydxXNKo2yOf0s9YZNg= Authentication-Results: nongnu.org; dkim=none (message not signed) header.d=none;nongnu.org; dmarc=none action=none header.from=bu.edu; From: Alexander Bulekov To: qemu-devel@nongnu.org Subject: [PULL v2 2/4] fuzz: adjust timeout to allow for longer inputs Date: Tue, 13 Jul 2021 11:00:35 -0400 Message-Id: <20210713150037.9297-3-alxndr@bu.edu> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20210713150037.9297-1-alxndr@bu.edu> References: <20210713150037.9297-1-alxndr@bu.edu> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: MN2PR11CA0002.namprd11.prod.outlook.com (2603:10b6:208:23b::7) To SN6PR03MB3871.namprd03.prod.outlook.com (2603:10b6:805:6d::32) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f469b962-b86a-4629-4f0f-08d9460f004b X-MS-TrafficTypeDiagnostic: SA2PR03MB5722: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:765; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: rqlT6TedaxCb7NvL9Vs1m6QNZF+/JwQMdZAiWJyLPqMjvK1j8n8AQdYfA+hjiCw5F1/LFhP8iRkpf1wKOBQVLNl2/Dy5p5cB8FMnyv+O1nWwt1/oBv4vzTgsZU2G/yN5NSjPlRLH8eADPm43sk+GdogMRIqprK8tR9JosjG28x3cIyn8pUY6Sgh4zoQHM/yboMc/ZPzW+7f6kM14n30j51An0Fzv79uDhZ9irQuJgJ779i/qCwuZbTGIS7DyCB+HXJGyECs6B/DgFGiAk0xfc3UpCrPk7OPcvMw7A9AhizybJ/o9pWAk1VwDQr+Nkn9BDlOOmOAIlwfUjnuUpb1NB/o4XryU8bvYTU9VmFkaP1yfKy8vlIG27GOyrRmPBe5cHbI0Zr9rXj/a8L52JZhy6IeAbPXqZEnsTqEQeaHm1ZN/mi74NHKM5rFtjcAiF2v9jLwP+nmKgxdo1zI7ihSg01TwypdwNRKev9QC1yb23SKBZzqmoPnbSKkpFJJArvySGlfwDMUCZutYbCDdu9BGZZaCOYzNB/cwxaRx6HtNSFj8DVHkoX/jn50H8UOrLrKIc3gElYYwPBH+HPi6pKX1eH1Cqg7OI+ZGBK+LqmAzm7J55qThqK7F4T/21vuQThBnHVNoFQ/aV+4SokJKGQs8K8i3sOAGBkgtLjDouZxZMAjyfiZn+1Mp8GdwLkpr15cSu7Uqt/9bzxOSp3K8aCfEILJlwwZKIgT/3vEjV30WYL8= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SN6PR03MB3871.namprd03.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(39860400002)(376002)(366004)(136003)(396003)(346002)(6916009)(2906002)(1076003)(66946007)(186003)(83380400001)(6666004)(52116002)(86362001)(66476007)(75432002)(26005)(8936002)(36756003)(8676002)(478600001)(66556008)(2616005)(5660300002)(4326008)(6486002)(54906003)(6506007)(38100700002)(316002)(38350700002)(956004)(786003)(6512007)(148743002); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?xBmrmny0Q/vDzZuH759fZwe4leN9/KWC/5ck48q0I8peVCHMmXyYmdUe94PJ?= =?us-ascii?Q?rHTxMZF0AVF2+7ohmM+RHaK4A0dV2e0BR9E2kBZhJSQ6yTMr/FW/1x5YzBWk?= =?us-ascii?Q?Oy0qRqh7+bUF5i9Rf3q4tRSUC2YTaxhdz3RUyXlF2XpQDkeLejEZVriL3F/r?= =?us-ascii?Q?cdeEN3ZJqk4CYLYO+xmu8rcIS0Y0yd/NxSqmBFjnqNn54iqX/sS1l5VEegXj?= =?us-ascii?Q?/66rBRGgPH+ToeRq15y2cGxmH4NpMYIMzkRMMekRtc/ZyLem7amF3ADiUSa5?= =?us-ascii?Q?wAEq0l3w9eiqtXzbndbH3Pf0XQjzfrLDljbBrwRCiWrYEGl4bkI2HKw1mjQ5?= =?us-ascii?Q?5wAZ1TJzgl5MZTFVYUPyK1kRI3liIMIdj24rt+3AzZNRgxAkIeSdAsx+zAnN?= =?us-ascii?Q?KwGBBRA8FqoGXcA6H7WgLY5hjwijnx6GGxY6CQjeQN2INiVtINHVhGir5HgD?= =?us-ascii?Q?ZiXEmtjznrzV6FUz5HtiD8P82vHOmsWGBzkrWMpzvpt1X/Q8Ix6QWPT9VW6O?= =?us-ascii?Q?UOgrJU7HiOVdpo6zMnDpLoXtgLH9hcex4OXIkHkdcJQPuIpAey9s78+T4uMs?= =?us-ascii?Q?Z7T2MESCz9uKoGghgwHjcNiN9vggMma88lrQmts7pJyeaQUHIyY5ACFzpHtr?= =?us-ascii?Q?RwnYCTu+HRG3Pt/kwpiH2LlJ5/1gH6bHKeFo05PRuvVf8hZo9lo+pjPVpljC?= =?us-ascii?Q?zaPomDjzJRr8JAkWtjgxECoXcgonxmeObPhAi3NXvFCR6DQopf27akYS4//o?= =?us-ascii?Q?l9NY0rWvc8nGrl6/6Bhzk0RhEg+6wZxZBzdTm/LOg/+gms64QTskKu3h4QzW?= =?us-ascii?Q?6yfCeN3XVM6IrbN/rezh34go74G+e8F0evPpiuFauKI+qJteXDbF1zGz8oKy?= =?us-ascii?Q?lA0qQq1y36dD539cXq0baVwtbG2ORUHkY2wfr16e6uGDayWmC6qYJzgfPG6/?= =?us-ascii?Q?xLlj1zd7u18sTJMnqqpsjUnTuCXD8lRy9FdOyTdG7M+d5QI0KPo56sv+U2e9?= =?us-ascii?Q?0psl7AF1gfioduch4CCoNXfMu71cTLu/DpTOEJjypD0LmZh7kMlR0QO8F2Bp?= =?us-ascii?Q?E5OK/kykE5ylDLoHDUnN+xBjSA4F6SwMhAH7uwaV4WdRI1Djfo6IFMhjMfs7?= =?us-ascii?Q?8lmjDSkaSTxL01pkw9NJ8S5ZC5u29ZzXd5WXTrxH5REP5Bdy3rlZ3IzQQkfi?= =?us-ascii?Q?sfS+DFSK8DWIXXLkPxGGKtyjvsktbV3kRpnfIbg3a9WbSxfu4jrRnB218jni?= =?us-ascii?Q?3eDVWAnnpp5RO2geR/ZQpupHoOYeYWB6YMxc5sqnEneqoihgvKyROWdBUwte?= =?us-ascii?Q?64GgkgdgssiLJlYXQGBJlJJN?= X-OriginatorOrg: bu.edu X-MS-Exchange-CrossTenant-Network-Message-Id: f469b962-b86a-4629-4f0f-08d9460f004b X-MS-Exchange-CrossTenant-AuthSource: SN6PR03MB3871.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2021 15:00:49.5773 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d57d32cc-c121-488f-b07b-dfe705680c71 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: bB+5DGMKm0dV1bAwrX2lyKBSpIuP96M/Gn9G9uvHHeqyEy/TPgCNgXSLux8Tu1s4 X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR03MB5722 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=40.107.223.96; envelope-from=alxndr@bu.edu; helo=NAM11-DM6-obe.outbound.protection.outlook.com X-Spam_score_int: 10 X-Spam_score: 1.0 X-Spam_bar: + X-Spam_report: (1.0 / 5.0 requ) DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.998, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Darren Kenny , Alexander Bulekov Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @bushare.onmicrosoft.com) X-ZM-MESSAGEID: 1626188723955100001 Content-Type: text/plain; charset="utf-8" Using a custom timeout is useful to continue fuzzing complex devices, even after we run into some slow code-path. However, simply adding a fixed timeout to each input effectively caps the maximum input length/number of operations at some artificial value. There are two major problems with this: 1. Some code might only be reachable through long IO sequences. 2. Longer inputs can actually be _better_ for performance. While the raw number of fuzzer executions decreases with larger inputs, the number of MMIO/PIO/DMA operation/second actually increases, since were are speding proportionately less time fork()ing. With this change, we keep the custom-timeout, but we renew it, prior to each MMIO/PIO/DMA operation. Thus, we time-out only when a specific operation takes a long time. Reviewed-by: Darren Kenny Signed-off-by: Alexander Bulekov --- tests/qtest/fuzz/generic_fuzz.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuz= z.c index 0ea47298b7..80eb29bd2d 100644 --- a/tests/qtest/fuzz/generic_fuzz.c +++ b/tests/qtest/fuzz/generic_fuzz.c @@ -668,15 +668,16 @@ static void generic_fuzz(QTestState *s, const unsigne= d char *Data, size_t Size) uint8_t op; =20 if (fork() =3D=3D 0) { + struct sigaction sact; + struct itimerval timer; /* * Sometimes the fuzzer will find inputs that take quite a long ti= me to * process. Often times, these inputs do not result in new coverag= e. * Even if these inputs might be interesting, they can slow down t= he - * fuzzer, overall. Set a timeout to avoid hurting performance, to= o much + * fuzzer, overall. Set a timeout for each command to avoid hurting + * performance, too much */ if (timeout) { - struct sigaction sact; - struct itimerval timer; =20 sigemptyset(&sact.sa_mask); sact.sa_flags =3D SA_NODEFER; @@ -686,13 +687,17 @@ static void generic_fuzz(QTestState *s, const unsigne= d char *Data, size_t Size) memset(&timer, 0, sizeof(timer)); timer.it_value.tv_sec =3D timeout / USEC_IN_SEC; timer.it_value.tv_usec =3D timeout % USEC_IN_SEC; - setitimer(ITIMER_VIRTUAL, &timer, NULL); } =20 op_clear_dma_patterns(s, NULL, 0); pci_disabled =3D false; =20 while (cmd && Size) { + /* Reset the timeout, each time we run a new command */ + if (timeout) { + setitimer(ITIMER_VIRTUAL, &timer, NULL); + } + /* Get the length until the next command or end of input */ nextcmd =3D memmem(cmd, Size, SEPARATOR, strlen(SEPARATOR)); cmd_len =3D nextcmd ? nextcmd - cmd : Size; --=20 2.28.0 From nobody Mon Feb 9 15:55:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=bu.edu); dmarc=fail(p=none dis=none) header.from=bu.edu ARC-Seal: i=2; a=rsa-sha256; t=1626188612; cv=pass; d=zohomail.com; s=zohoarc; b=NJ4kKrkyYclIJSSpIPuEzs3z0EEDB3jDAxzBs2eN6+iivekyR9I5R3m0HGJyLNk5eaJYdK6ZbQOvmEvEO/GpKK0al1nlFCH94WaB/NSGEfKfSkfJhB8ckdchzE4qqQJi5YLYs0DwzU/8UPvTrFiL9UAadaU3ryYlqNhYhoJ/5GM= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1626188612; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=STAop5EeQRWZdjaIIcDmyEZvZ2r6HOsIObiX6/i4yh0=; b=EghtQERiQZpFBkmQoCzYS2IDwpOoqbY3NFy2AK2s44OMwBiHJ33EmVCLM0/efW1YNYGJ0E6DrzhqpugSHjxCeg8rn/xPM+uvxf0zVGvL9iIkCq+Wcqdzboz5VLFCFA0MrOnSFsYm/QUAdHtdUCMdqyCDWa7/xuVHGvM2YNZJIG8= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=bu.edu); dmarc=fail header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1626188611997614.7076360252413; Tue, 13 Jul 2021 08:03:31 -0700 (PDT) Received: from localhost ([::1]:54244 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m3JwY-0000cD-OB for importer@patchew.org; Tue, 13 Jul 2021 11:03:30 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:47236) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m3Ju7-0005a5-5J for qemu-devel@nongnu.org; Tue, 13 Jul 2021 11:00:59 -0400 Received: from mail-dm6nam11on2096.outbound.protection.outlook.com ([40.107.223.96]:35521 helo=NAM11-DM6-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m3Ju5-0002ks-HG for qemu-devel@nongnu.org; Tue, 13 Jul 2021 11:00:58 -0400 Received: from SN6PR03MB3871.namprd03.prod.outlook.com (2603:10b6:805:6d::32) by SA2PR03MB5722.namprd03.prod.outlook.com (2603:10b6:806:110::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.22; Tue, 13 Jul 2021 15:00:50 +0000 Received: from SN6PR03MB3871.namprd03.prod.outlook.com ([fe80::24fc:a5d:be8d:eb3f]) by SN6PR03MB3871.namprd03.prod.outlook.com ([fe80::24fc:a5d:be8d:eb3f%3]) with mapi id 15.20.4308.027; Tue, 13 Jul 2021 15:00:50 +0000 Received: from stormtrooper.vrmnet (72.74.210.193) by MN2PR11CA0002.namprd11.prod.outlook.com (2603:10b6:208:23b::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20 via Frontend Transport; Tue, 13 Jul 2021 15:00:49 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KBgGaKb3JoNSHeNPBZs8XQhmqP5Sn6t5r72n85t4Q8GYLWDyC/kiyFq2KEWHVHHekLvFxNqDiktT3rtIte5XNhPAxoGoXILcHUZ0Ew2YCDT7a9M1A31a0ALTV22vOnWU9N5KvwIqD/TEdKtIUmSRGTOic7etnVre/+wFlczDf7tm4K7Ma1sQ4pHRtB5TUuKBrc/JDpx+aYhcpcvqSBxU5Uj/aWbDBm99e7E/DA0kY1wTXKkIj8Q5r/LO+65kuzrvsR6GLWEE07f/yihjXPBR54GgoJLUgIPZMPoVk/0pak/4mIupQc76EaYjGYsOgTuqAZ8J784ZyhUFL40l/BOVqA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=STAop5EeQRWZdjaIIcDmyEZvZ2r6HOsIObiX6/i4yh0=; b=EHHmnDxRT8a3FvJ/Ctq7jSJvF6bk0jsqVHXeozBRSPlIYHEFss9QxAg3afpR8BYwKwSYUMYyzlZH7G0M0Y/YAHDMGE9F0rdQmaB3HfQ/8Q6WG1Fjhrhb8cO11SwBbxYkVrNfY+3JD0/A4h0EiNYuwkLWwkgkuP2awSFZnonucEKREDdSg0kKlcYFMsWcBqk+d4TX4ByEynvE2XhNoGKsrE0JvcK/EOz+3JC5Fd8bSeP58BMPTbVx9M4J7ULpeOwMAPf8JGgCzwASoVp0CwDwLr5eeQcyee7orsZE1Kl1ZaXMOJCGta28vM+0bg2IEV+qCjO7PVEh/rN/h0PtIAWh0Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=bu.edu; dmarc=pass action=none header.from=bu.edu; dkim=pass header.d=bu.edu; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bushare.onmicrosoft.com; s=selector2-bushare-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=STAop5EeQRWZdjaIIcDmyEZvZ2r6HOsIObiX6/i4yh0=; b=ukJ+By0V69CnSa9y0s9Mn5837eAOPUZXXjLtaAvADEMc/ZLeuC7Ws8RTmYV1ivLQ1EMlIM26dhonU/1fJChXJy2Aot3nf3oAnsNz2pMsmMEXFgZnwgppQO/Y4h4oGTzKnSn/8HnLCYrBcBkO6y5qMpr6cM5A464goX/45V6+v2A= Authentication-Results: nongnu.org; dkim=none (message not signed) header.d=none;nongnu.org; dmarc=none action=none header.from=bu.edu; From: Alexander Bulekov To: qemu-devel@nongnu.org Subject: [PULL v2 3/4] fuzz: make object-name matching case-insensitive Date: Tue, 13 Jul 2021 11:00:36 -0400 Message-Id: <20210713150037.9297-4-alxndr@bu.edu> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20210713150037.9297-1-alxndr@bu.edu> References: <20210713150037.9297-1-alxndr@bu.edu> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: MN2PR11CA0002.namprd11.prod.outlook.com (2603:10b6:208:23b::7) To SN6PR03MB3871.namprd03.prod.outlook.com (2603:10b6:805:6d::32) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ae5de95c-c49f-48f7-ad90-08d9460f00d8 X-MS-TrafficTypeDiagnostic: SA2PR03MB5722: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:323; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: u0u3gRQFruExlteKbQIR4sHJs72yA/le2w1fAZ9hA8IfObbvgA3wAiKmadb/cDv1XzOa5h7LzCm4/gfndqn3g/kfN+Naibz8roJlU/cqRD9hFKZU+hPH2ml9/jfgnVXtUftojQsobms7Bol6IFfws3ElMAalWMhIhiamiNnlZ13EDxt2hpmpulOcCJJc69+FPf3mjYshXDb9Jg2RBR7Yh1g7Pg86DgmZCJAh/zZYovMxc4E1mFCQCAuL7mYnypIknzG2wTYdAKUjwSYGQlL95YJn+BWR3Uv+2QuW1V4pGUbqBeVfr/qd6gGmNAwe+R8+3w2sOcnGtoPa7B8sue5jb01T2GlcDLVd1/fVtlwd+e5YimUf0VIz+r4k3EzrWn61lem/41TWgQrfDwOR2R2SxTnX8SxActY10pDSVQKktOtjVtY99DYm6w6eR9d4oJiVC3tEjXzpBXG02MQDAuCwEDV4M45BAwD/oy78+8zUj6HFiI44GKD30bnTmz5hLcnS/cUr4Odj6CtRzGgaoLQlxKoAS3Oc+kHxGHMTlcqgnrDTATNLBIid5YCExl8dvdCYW/gHn2zq8RL8O8dUdTG688+Lv/auRqcDUT3+Z9pQwjpYQD6AG/BHWEKXebWWYaf59isv5PXNcLBf0CPw2XaWfozIcIKwW2pu9cfrLoidrDp/CSQaVvu0tzQjhpLdIBJY X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SN6PR03MB3871.namprd03.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(39860400002)(376002)(366004)(136003)(396003)(346002)(6916009)(2906002)(1076003)(66946007)(186003)(83380400001)(6666004)(52116002)(86362001)(66476007)(75432002)(26005)(8936002)(36756003)(8676002)(478600001)(66556008)(2616005)(5660300002)(4326008)(6486002)(54906003)(6506007)(38100700002)(316002)(38350700002)(956004)(786003)(6512007); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?A56MoeZnQ8JtmyY4QfibqAUWevyDpIYLHanMHslXfjCt6N0eoQG2VhS2YSRl?= =?us-ascii?Q?Kjj5ngn/hIlOi4SGkw/bWnldskVP/nQNGNYfml7jK0kmcJeMb96pEt8OmhVS?= =?us-ascii?Q?b/P/uyvqFKUY/azmDTP7+JfLZRDPQclc6fT6mAvt1EDQoNFOOkId0z6S4mrj?= =?us-ascii?Q?+Ah+Xu05KLsGXqFH3vXtnTrGAX8EUQGP6hAJPnJR3mYmiIz/Vv4kGuKOTjlK?= =?us-ascii?Q?0+EdvWJgLE/qlHWycle8va70xAFysYPx+skXJmv7HIbHuS9weLbSmsEsxMMc?= =?us-ascii?Q?+3VIAembNAIVBJaXroKi1eIrtIiAr8bTdv8tIzMcN4txunR/i42LRRCvHxIO?= =?us-ascii?Q?vj4clIevegDZyCmRNbJBBfwJcRpsoOPIGYy0EOGXLRj8rKNqdBTUqKgRMJzI?= =?us-ascii?Q?kxsSsGKsWuAm5uRUgrDU498xWtzTDHqF1qWUWcFJqyZ7Gsy5N3bpcGHINj/Y?= =?us-ascii?Q?NEI+nED63JJ25RFQFgEDG2AMhsWJUUeDDVfw9eeqgJg+8vi+GK5GCSrh8zUE?= =?us-ascii?Q?hWjJ+WHM642izYoDSflqyyVDec5DxAKe5VdcPfNAQOX8pYA9GDJuBWYwRyAK?= =?us-ascii?Q?v4WKO8w0LORRw2krHciuvSWm/nUm1hB56mQEed6OiL3LmDq07gRCc+uFvM9z?= =?us-ascii?Q?V72JXlWwh5iHD4akxzHQV2AJ1JOaBq4n43uBXBPAqcitjih+08ZvCrCd6fHk?= =?us-ascii?Q?4diQeRHbS94zajHAClspOIStvpK59e6ti89QCHnxA4GqXr++rT/ZJ5YWRRyL?= =?us-ascii?Q?HHtyeUJf/Kc1FSybvuWSiyvEKRueoi3rPFkgCS3xnOVH7+YRTYzvjNdk8PAw?= =?us-ascii?Q?dMDl/z9LuKztlej1XP8XG3fZSmgycNRAkf+xhcYHii8yl19kdsHYFMysugKp?= =?us-ascii?Q?MOk/37lJm1ODtwvUJE621N/DXnxsQHIgE0jIVHNZATSdEu91/yJoPBnma7oi?= =?us-ascii?Q?pqqqStNBrpSGI/8KPvRLQBhXQEyF56yAuWU5mYoKYgjAB4NgBCr+X3TZ+Wtz?= =?us-ascii?Q?5S8+dJd7quUA/xQJmgh0Xo3pmKneal742kAGYaJEmbXG0IfdvRaoOMG16D/D?= =?us-ascii?Q?JMKlJXp8EsiZMyPBSbYIJx9EO9ANaEb/Pt1ZUg3YMM+bGGE/94dzQIB+0aNX?= =?us-ascii?Q?1EMtOgjYhkXI4rBfZIfttsffu8uH/8U7ofD19GUs5DZabC8wtr+w+EFzlNvf?= =?us-ascii?Q?koQdDwAEqy6jw66gy1je/BbBlTwqsMgasFMY+HCz3afidXYxUZhETFPnIv2l?= =?us-ascii?Q?BKKG4DXCegCIGpO9LQzVAVzxxXe15mQwkPNMuhWnLy+5xfRHXdec1zuBYTwU?= =?us-ascii?Q?Z6j5oW5rakceakmNBwgeb5e8?= X-OriginatorOrg: bu.edu X-MS-Exchange-CrossTenant-Network-Message-Id: ae5de95c-c49f-48f7-ad90-08d9460f00d8 X-MS-Exchange-CrossTenant-AuthSource: SN6PR03MB3871.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2021 15:00:50.4718 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d57d32cc-c121-488f-b07b-dfe705680c71 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: zUhao0a1TEFfgtH7Ss1IugeAFqwktOwJhyhaIn46dDyShFYJ622b5KNK/FoGqAEK X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR03MB5722 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=40.107.223.96; envelope-from=alxndr@bu.edu; helo=NAM11-DM6-obe.outbound.protection.outlook.com X-Spam_score_int: -8 X-Spam_score: -0.9 X-Spam_bar: / X-Spam_report: (-0.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.998, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Darren Kenny , Alexander Bulekov Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @bushare.onmicrosoft.com) X-ZM-MESSAGEID: 1626188624401100001 Content-Type: text/plain; charset="utf-8" We have some configs for devices such as the AC97 and ES1370 that were not matching memory-regions correctly, because the configs provided lowercase names. To resolve these problems and prevent them from occurring again in the future, convert both the pattern and names to lower-case, prior to checking for a match. Suggested-by: Darren Kenny Reviewed-by: Darren Kenny Signed-off-by: Alexander Bulekov --- tests/qtest/fuzz/generic_fuzz.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/tests/qtest/fuzz/generic_fuzz.c b/tests/qtest/fuzz/generic_fuz= z.c index 80eb29bd2d..3e8ce29227 100644 --- a/tests/qtest/fuzz/generic_fuzz.c +++ b/tests/qtest/fuzz/generic_fuzz.c @@ -758,8 +758,13 @@ static int locate_fuzz_memory_regions(Object *child, v= oid *opaque) =20 static int locate_fuzz_objects(Object *child, void *opaque) { + GString *type_name; + GString *path_name; char *pattern =3D opaque; - if (g_pattern_match_simple(pattern, object_get_typename(child))) { + + type_name =3D g_string_new(object_get_typename(child)); + g_string_ascii_down(type_name); + if (g_pattern_match_simple(pattern, type_name->str)) { /* Find and save ptrs to any child MemoryRegions */ object_child_foreach_recursive(child, locate_fuzz_memory_regions, = NULL); =20 @@ -776,8 +781,9 @@ static int locate_fuzz_objects(Object *child, void *opa= que) g_ptr_array_add(fuzzable_pci_devices, PCI_DEVICE(child)); } } else if (object_dynamic_cast(OBJECT(child), TYPE_MEMORY_REGION)) { - if (g_pattern_match_simple(pattern, - object_get_canonical_path_component(child))) { + path_name =3D g_string_new(object_get_canonical_path_component(chi= ld)); + g_string_ascii_down(path_name); + if (g_pattern_match_simple(pattern, path_name->str)) { MemoryRegion *mr; mr =3D MEMORY_REGION(child); if ((memory_region_is_ram(mr) || @@ -786,7 +792,9 @@ static int locate_fuzz_objects(Object *child, void *opa= que) g_hash_table_insert(fuzzable_memoryregions, mr, (gpointer)= true); } } + g_string_free(path_name, true); } + g_string_free(type_name, true); return 0; } =20 @@ -814,6 +822,7 @@ static void generic_pre_fuzz(QTestState *s) MemoryRegion *mr; QPCIBus *pcibus; char **result; + GString *name_pattern; =20 if (!getenv("QEMU_FUZZ_OBJECTS")) { usage(); @@ -843,10 +852,17 @@ static void generic_pre_fuzz(QTestState *s) =20 result =3D g_strsplit(getenv("QEMU_FUZZ_OBJECTS"), " ", -1); for (int i =3D 0; result[i] !=3D NULL; i++) { + name_pattern =3D g_string_new(result[i]); + /* + * Make the pattern lowercase. We do the same for all the MemoryRe= gion + * and Type names so the configs are case-insensitive. + */ + g_string_ascii_down(name_pattern); printf("Matching objects by name %s\n", result[i]); object_child_foreach_recursive(qdev_get_machine(), locate_fuzz_objects, - result[i]); + name_pattern->str); + g_string_free(name_pattern, true); } g_strfreev(result); printf("This process will try to fuzz the following MemoryRegions:\n"); --=20 2.28.0 From nobody Mon Feb 9 15:55:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=bu.edu); dmarc=fail(p=none dis=none) header.from=bu.edu ARC-Seal: i=2; a=rsa-sha256; t=1626188708; cv=pass; d=zohomail.com; s=zohoarc; b=iFVjzDLlfaaq6Un+po6LMz5xzR/LjpmAWcbN3HIyN6Rn6RUd+GePWfAYEgwayL2ePMcIMkx6rkNchDQ69vEfP6I2Cfapfh3y+aA4XIHMGH9AqCH8B5OOPVZvkV2AbR01PJZRUYnMTJDTK7/0v3PyLApxC6jBTpXSTQIqYH6c7VQ= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1626188708; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=QFxHskgv/DDhlRtMs0bUtJKw4NKSMc85hmoXTLn2nII=; b=jIOR0oJtRy3g7R+gQL49CJeYqPSkkWw+3rwuoj7wfd0UhI80Pq0rdKHbZ4vjZcQAyu7Yxj1+zuwqc03re3xLO5+osr41MkmZ+aMc80Db/Wg25XX3vWdNZ3rYe2cwnojd5Huoc1AMFb8Rjcd30p/tJBS4iNav+k/7B+4Y3P2Mc2w= ARC-Authentication-Results: i=2; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; arc=pass (i=1 dmarc=pass fromdomain=bu.edu); dmarc=fail header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1626188708590773.8167345794377; Tue, 13 Jul 2021 08:05:08 -0700 (PDT) Received: from localhost ([::1]:60288 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m3Jy7-0004dV-Aj for importer@patchew.org; Tue, 13 Jul 2021 11:05:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:47200) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m3Ju3-0005Xq-LJ for qemu-devel@nongnu.org; Tue, 13 Jul 2021 11:00:56 -0400 Received: from mail-dm6nam10on2119.outbound.protection.outlook.com ([40.107.93.119]:62877 helo=NAM10-DM6-obe.outbound.protection.outlook.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m3Ju1-0002nJ-RM for qemu-devel@nongnu.org; Tue, 13 Jul 2021 11:00:55 -0400 Received: from SN6PR03MB3871.namprd03.prod.outlook.com (2603:10b6:805:6d::32) by SA0PR03MB5481.namprd03.prod.outlook.com (2603:10b6:806:b4::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.21; Tue, 13 Jul 2021 15:00:51 +0000 Received: from SN6PR03MB3871.namprd03.prod.outlook.com ([fe80::24fc:a5d:be8d:eb3f]) by SN6PR03MB3871.namprd03.prod.outlook.com ([fe80::24fc:a5d:be8d:eb3f%3]) with mapi id 15.20.4308.027; Tue, 13 Jul 2021 15:00:51 +0000 Received: from stormtrooper.vrmnet (72.74.210.193) by MN2PR11CA0002.namprd11.prod.outlook.com (2603:10b6:208:23b::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20 via Frontend Transport; Tue, 13 Jul 2021 15:00:50 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Gk//zLFIroQwSkeEbq4YMWHSzz2bL3aMSPNMVViwtyLhtdd7odHOGqnEVTjbMRAWgTuviJPHmnCK4Omqy5QZbScPa8idAzSnFMn+jQooRTbqjiIvR9//v1y5KznB94x6jZuMWVaqn/1sRTnCxsHVon+snhzvS+1UG/fS6qxQ/xW/H7HWCSBnyVNmfxII0ZyqFhURaNCCc6Y1arii1BX72lnlJIZvOiqorastrOKYWBA09xkEHaNrwKn7+zvrF5FThOokmF9TT2Gr2R8AKr1P8lbcyNQ3VHiTpm8lIpOBX01lZO0ETEJMa+XweHwNG7uc1bmBRwPg9LO4s2hgC3sEFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QFxHskgv/DDhlRtMs0bUtJKw4NKSMc85hmoXTLn2nII=; b=P0K+RmCP8H06qNtUUl1MF8w1iRoKnlVJB8CbSrBOxby/vp4w7xpV2vmKYFHVliifjpk44fiNX/NLOVeUKB1InPje9flVvIleIfpVNXUAVfYXHkmx3P4SHZd8BBupAWngQ8ofPr1ZB8HrQhh7ideIa1/Uy5uKUJzNWmLOwFKI/1ERkQRFjjvSTOP1gKD0VH7i4lkreWZrN7STbHQIUD9cs10WYbEzolTI/3B9q3NHfPpm72TkKWPe+D8valHwC30VS0re2+R9c11dkFeusvFiRE5gagaPeOY/PBKhaK2GpA7ixHPsCm4pHI6gZX8DlzjMoYlR1Bi6R/QjXKFawPb8ug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=bu.edu; dmarc=pass action=none header.from=bu.edu; dkim=pass header.d=bu.edu; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bushare.onmicrosoft.com; s=selector2-bushare-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QFxHskgv/DDhlRtMs0bUtJKw4NKSMc85hmoXTLn2nII=; b=3S/DhnVoO8wF44oyhrBqoYImJsPYcyLanCwsCeyS7x0oqU8YXikiW9Yn8aX26+DMn+czv7uBViHKRfihGGVlIgKArMFhzMuts20RsX42K2/oEn09VLfHi4kf5AfqZTWbEb3C7NPxZQnIfrfw7MATNUmS/OHqN2+sxMmz5OvAupU= Authentication-Results: nongnu.org; dkim=none (message not signed) header.d=none;nongnu.org; dmarc=none action=none header.from=bu.edu; From: Alexander Bulekov To: qemu-devel@nongnu.org Subject: [PULL v2 4/4] fuzz: add an instrumentation filter Date: Tue, 13 Jul 2021 11:00:37 -0400 Message-Id: <20210713150037.9297-5-alxndr@bu.edu> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20210713150037.9297-1-alxndr@bu.edu> References: <20210713150037.9297-1-alxndr@bu.edu> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: MN2PR11CA0002.namprd11.prod.outlook.com (2603:10b6:208:23b::7) To SN6PR03MB3871.namprd03.prod.outlook.com (2603:10b6:805:6d::32) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 664dd5a0-9db9-4a26-1644-08d9460f0150 X-MS-TrafficTypeDiagnostic: SA0PR03MB5481: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: UO0vO+rEuu9SdwG309HCDh/tJxGgiYi+rNAPsa/WUcj1JFyamIIe1qZuqVBubN/Q7BblyHry8L6NPLvEGJtTDLYN/HUBBF2XZZluNoCIyuKsp0Wl8z5uBEX7Y1nbNF6i7OD5uQ4pO9nobC/xyUWi3W7kkTjKS1YiLNkOhUcs3lZPFLWnGT5lEAPlIoYb75JywidrbrTLG4DsRcffVjwlGHkpluU5t2NglrPfGjUICejyy+f3LDviZ+yzrTE/vBSViTComDbOW/sOeO8V9rPRsoQgte9ZWPVLfy5bv6dviBkcWNBu1s5spTSyl48X1Dj6jdO0lnZ6P1Ns2xeOK/lvYxPGIK5XgAs0ElOrdgQPErAgXPGW9fACf6k8D3zuDyH15lYkf5e+gw9+YlBp7nSA+WTA8SyLP8hrM201GecbwAHBgRHmvWkAsrtLHqhsIE6ZUcSfMFPHHUVtot/6wi+aXoaoy6TMmtTSZd9llINTW/Oz86yuQPgDyZD7lm5blTVkn7vsVx7E19rzWmo4P5pEuBaKg3ZoxVTQHt110pMLQvc8owQ2CKKjNCa5OQ3nr9S88PjvIBe52iIO3sOKtO95NT3micJSIEDVnlC0CvLUlZkp2TU3lFqG3ZuXJPjG052FE1Ie6BZlaZTPBBfsDANJCzbgWky7z2/wrglVL+BD605gZWUJJY2HYQWAw61/LLodScr8AF4O/EFUD95XZ7FgA3tfRi1bC/GTCW+ohZhLY0deRLHwR6WaPpTV1gpQSustwyv+L8IGaa4iuKLtm1GgwQ5rdIkWsmtrDzLbOVvtZtmCIc4M/XcmjHjzmZqBFpJ6 X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SN6PR03MB3871.namprd03.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(366004)(39860400002)(136003)(346002)(376002)(75432002)(6506007)(478600001)(66946007)(52116002)(8676002)(2906002)(86362001)(6486002)(36756003)(66556008)(316002)(26005)(5660300002)(8936002)(66476007)(83380400001)(956004)(54906003)(786003)(4326008)(2616005)(6666004)(38350700002)(38100700002)(1076003)(186003)(6512007)(6916009)(966005)(21314003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?eSpdKO0fVXDV/4oNz9tp4Sx0XUKTUU/IbT7r1El8rxPUY/WKzgvg6q7pHxB3?= =?us-ascii?Q?IZOEA/R8pULZyHdXGuXZ5nZE7RTHK+sc+dJq4IqfvNLIRW4avoaMRznEtR47?= =?us-ascii?Q?s2A2/HZpiqWg8VQmFM4XhREwXRusikC5cYPGkqBPFZY6UWUYQoUbR/z+1LXR?= =?us-ascii?Q?n1t9GLMw32YBm3yqCw/uHkjCZzJEODJ1vvRyq8CmKNSdjXsGWzweU1Fm07Ou?= =?us-ascii?Q?v+GMlVmUl/L02U7Z7FSGDKmA9TkfWjGj+4lGf7/frUKTSGfHpLTOEA8n/zHy?= =?us-ascii?Q?xFh2LeOub2YM/hGChMhJFBrDLqOFy/ymDoL7qROFY2Wz2f6Ug93I58koH37G?= =?us-ascii?Q?HNudUtWCrICLDh5w90sNj1SrYRo+ii4Asaque2qSB/DgPAK8EJ00jycJ1mfN?= =?us-ascii?Q?t7L9DxCrePvlusFMSIgUwpPF0VaLTIiU+VKVj4HrNvvgBufgyaEv3v9v2TD3?= =?us-ascii?Q?GfF2ny2SlCG9bdNxBE0yli8hHp8VEK//tLAA3YuupCS70gdlbC1C5tEeOxO5?= =?us-ascii?Q?nR/mYe+IlK99BHqTUirbxk3X/DHQ4mRey38bdOL7PTWsL42HWsYjdvI3tPEq?= =?us-ascii?Q?0zKyibCQj7wJ0KMdmXrqaE2jROXzW3BeDLufyFz93UdSCslRtmXJiaCEIJUy?= =?us-ascii?Q?KdrdlKoh39DTG0Kgvg2oCAFkzcK/Vj2efvRFPdt4yAYpMntmbP0N2vIZ+1qD?= =?us-ascii?Q?jKwmBp85I5qQAwQjoye9mjUnuvF07/MVfnN+P1cIifJ7cq9VWr2hdXKgVPAE?= =?us-ascii?Q?FVHnFyVbjE6ma+MleEEus9iClufs32CpIRbflpwW+BI88pUJ0ainZ2BL8Wr4?= =?us-ascii?Q?jPHbPybHfi/TtJB2DDXs8x1Lm2h0Q5udWOqIn3J4eJLEA7tM5ciq/sYku7ep?= =?us-ascii?Q?m8122H+x4o6GZv4ajqsu83VrZujK36hl35H5rc/RFWCRgc6229aVr3VuS6/c?= =?us-ascii?Q?oqs8mH//n00Egp8sVvTsIFV1JHaxoLUjfCYgOvliUfECBE4DehGYHbMqqSLL?= =?us-ascii?Q?f1Dr+VwGgFdu9fqyH6lTkCPFF9cIjWbNH8tx60y/yb+N0Qv+UZI0uUvepHib?= =?us-ascii?Q?6AAxxzC4P2CFCEoR6TYmMy6We/hek48+z6yfFQeAZlngHR2LMMWlEyI/IBJD?= =?us-ascii?Q?LdsFTq+qoyFXE9MPG2zaQYdkV8fmaChiF9y8c6LhjMRbyhwOcl6HLl6sxbfl?= =?us-ascii?Q?+gMsCXRFDGCr6AxWXKbBqnw63ERTX0mFduvDECWFujJySh4Ho8htos3SKMyX?= =?us-ascii?Q?JmOrmSYJchRAP7irPKMuAuIDkMElvDgsb9WyqWSjG0cz/hsPuhZqZzeB1Oax?= =?us-ascii?Q?ovz4oCkH97jo2geVzDQgwiOV?= X-OriginatorOrg: bu.edu X-MS-Exchange-CrossTenant-Network-Message-Id: 664dd5a0-9db9-4a26-1644-08d9460f0150 X-MS-Exchange-CrossTenant-AuthSource: SN6PR03MB3871.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Jul 2021 15:00:51.1894 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d57d32cc-c121-488f-b07b-dfe705680c71 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: X3CtGkOwO29X9bUX60NJzrrsXzQ/KSANLxElxd0YhzPTpqjpluXkbrVPzXtI21qY X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR03MB5481 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=40.107.93.119; envelope-from=alxndr@bu.edu; helo=NAM10-DM6-obe.outbound.protection.outlook.com X-Spam_score_int: -8 X-Spam_score: -0.9 X-Spam_bar: / X-Spam_report: (-0.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.998, MSGID_FROM_MTA_HEADER=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , Darren Kenny , Alexander Bulekov Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @bushare.onmicrosoft.com) X-ZM-MESSAGEID: 1626188710607100001 Content-Type: text/plain; charset="utf-8" By default, -fsanitize=3Dfuzzer instruments all code with coverage information. However, this means that libfuzzer will track coverage over hundreds of source files that are unrelated to virtual-devices. This means that libfuzzer will optimize inputs for coverage observed in timer code, memory APIs etc. This slows down the fuzzer and stores many inputs that are not relevant to the actual virtual-devices. With this change, clang versions that support the "-fsanitize-coverage-allowlist" will only instrument a subset of the compiled code, that is directly related to virtual-devices. Signed-off-by: Alexander Bulekov Reviewed-by: Darren Kenny --- configure | 28 +++++++++++++++---- .../oss-fuzz/instrumentation-filter-template | 15 ++++++++++ 2 files changed, 37 insertions(+), 6 deletions(-) create mode 100644 scripts/oss-fuzz/instrumentation-filter-template diff --git a/configure b/configure index e799d908a3..99d6182af9 100755 --- a/configure +++ b/configure @@ -4943,13 +4943,21 @@ fi =20 ########################################## # checks for fuzzer -if test "$fuzzing" =3D "yes" && test -z "${LIB_FUZZING_ENGINE+xxx}"; then +if test "$fuzzing" =3D "yes" ; then write_c_fuzzer_skeleton - if compile_prog "$CPU_CFLAGS -Werror -fsanitize=3Dfuzzer" ""; then - have_fuzzer=3Dyes - else - error_exit "Your compiler doesn't support -fsanitize=3Dfuzzer" - exit 1 + if test -z "${LIB_FUZZING_ENGINE+xxx}"; then + if compile_prog "$CPU_CFLAGS -Werror -fsanitize=3Dfuzzer" ""; then + have_fuzzer=3Dyes + else + error_exit "Your compiler doesn't support -fsanitize=3Dfuzzer" + exit 1 + fi + fi + + have_clang_coverage_filter=3Dno + echo > $TMPTXT + if compile_prog "$CPU_CFLAGS -Werror -fsanitize=3Dfuzzer -fsanitize-cove= rage-allowlist=3D$TMPTXT" ""; then + have_clang_coverage_filter=3Dyes fi fi =20 @@ -5843,6 +5851,14 @@ if test "$fuzzing" =3D "yes" ; then else FUZZ_EXE_LDFLAGS=3D"$LIB_FUZZING_ENGINE" fi + + # Specify a filter to only instrument code that is directly related to + # virtual-devices. + if test "$have_clang_coverage_filter" =3D "yes" ; then + cp "$source_path/scripts/oss-fuzz/instrumentation-filter-template" \ + instrumentation-filter + QEMU_CFLAGS=3D"$QEMU_CFLAGS -fsanitize-coverage-allowlist=3Dinstrument= ation-filter" + fi fi =20 if test "$plugins" =3D "yes" ; then diff --git a/scripts/oss-fuzz/instrumentation-filter-template b/scripts/oss= -fuzz/instrumentation-filter-template new file mode 100644 index 0000000000..76d2b6139a --- /dev/null +++ b/scripts/oss-fuzz/instrumentation-filter-template @@ -0,0 +1,15 @@ +# Code that we actually want the fuzzer to target +# See: https://clang.llvm.org/docs/SanitizerCoverage.html#disabling-instru= mentation-without-source-modification +# +src:*/hw/* +src:*/include/hw/* +src:*/slirp/* +src:*/net/* + +# We don't care about coverage over fuzzer-specific code, however we should +# instrument the fuzzer entry-point so libFuzzer always sees at least some +# coverage - otherwise it will exit after the first input +src:*/tests/qtest/fuzz/fuzz.c + +# Enable instrumentation for all functions in those files +fun:* --=20 2.28.0