1 /* 2 * virtio-net Fuzzing Target 3 * 4 * Copyright Red Hat Inc., 2019 5 * 6 * Authors: 7 * Alexander Bulekov <alxndr@bu.edu> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 */ 12 13 #include "qemu/osdep.h" 14 15 #include "standard-headers/linux/virtio_config.h" 16 #include "tests/qtest/libqtest.h" 17 #include "tests/qtest/libqos/virtio-net.h" 18 #include "fuzz.h" 19 #include "fork_fuzz.h" 20 #include "qos_fuzz.h" 21 22 23 #define QVIRTIO_NET_TIMEOUT_US (30 * 1000 * 1000) 24 #define QVIRTIO_RX_VQ 0 25 #define QVIRTIO_TX_VQ 1 26 #define QVIRTIO_CTRL_VQ 2 27 28 static int sockfds[2]; 29 static bool sockfds_initialized; 30 31 static void virtio_net_fuzz_multi(QTestState *s, 32 const unsigned char *Data, size_t Size, bool check_used) 33 { 34 typedef struct vq_action { 35 uint8_t queue; 36 uint8_t length; 37 uint8_t write; 38 uint8_t next; 39 uint8_t rx; 40 } vq_action; 41 42 uint32_t free_head = 0; 43 44 QGuestAllocator *t_alloc = fuzz_qos_alloc; 45 46 QVirtioNet *net_if = fuzz_qos_obj; 47 QVirtioDevice *dev = net_if->vdev; 48 QVirtQueue *q; 49 vq_action vqa; 50 while (Size >= sizeof(vqa)) { 51 memcpy(&vqa, Data, sizeof(vqa)); 52 Data += sizeof(vqa); 53 Size -= sizeof(vqa); 54 55 q = net_if->queues[vqa.queue % 3]; 56 57 vqa.length = vqa.length >= Size ? Size : vqa.length; 58 59 /* 60 * Only attempt to write incoming packets, when using the socket 61 * backend. Otherwise, always place the input on a virtqueue. 62 */ 63 if (vqa.rx && sockfds_initialized) { 64 int ignored = write(sockfds[0], Data, vqa.length); 65 (void) ignored; 66 } else { 67 vqa.rx = 0; 68 uint64_t req_addr = guest_alloc(t_alloc, vqa.length); 69 /* 70 * If checking used ring, ensure that the fuzzer doesn't trigger 71 * trivial asserion failure on zero-zied buffer 72 */ 73 qtest_memwrite(s, req_addr, Data, vqa.length); 74 75 76 free_head = qvirtqueue_add(s, q, req_addr, vqa.length, 77 vqa.write, vqa.next); 78 qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next); 79 qvirtqueue_kick(s, dev, q, free_head); 80 } 81 82 /* Run the main loop */ 83 qtest_clock_step(s, 100); 84 flush_events(s); 85 86 /* Wait on used descriptors */ 87 if (check_used && !vqa.rx) { 88 gint64 start_time = g_get_monotonic_time(); 89 /* 90 * normally, we could just use qvirtio_wait_used_elem, but since we 91 * must manually run the main-loop for all the bhs to run, we use 92 * this hack with flush_events(), to run the main_loop 93 */ 94 while (!vqa.rx && q != net_if->queues[QVIRTIO_RX_VQ]) { 95 uint32_t got_desc_idx; 96 /* Input led to a virtio_error */ 97 if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET) { 98 break; 99 } 100 if (dev->bus->get_queue_isr_status(dev, q) && 101 qvirtqueue_get_buf(s, q, &got_desc_idx, NULL)) { 102 g_assert_cmpint(got_desc_idx, ==, free_head); 103 break; 104 } 105 g_assert(g_get_monotonic_time() - start_time 106 <= QVIRTIO_NET_TIMEOUT_US); 107 108 /* Run the main loop */ 109 qtest_clock_step(s, 100); 110 flush_events(s); 111 } 112 } 113 Data += vqa.length; 114 Size -= vqa.length; 115 } 116 } 117 118 static void virtio_net_fork_fuzz(QTestState *s, 119 const unsigned char *Data, size_t Size) 120 { 121 if (fork() == 0) { 122 virtio_net_fuzz_multi(s, Data, Size, false); 123 flush_events(s); 124 _Exit(0); 125 } else { 126 flush_events(s); 127 wait(NULL); 128 } 129 } 130 131 static void virtio_net_fork_fuzz_check_used(QTestState *s, 132 const unsigned char *Data, size_t Size) 133 { 134 if (fork() == 0) { 135 virtio_net_fuzz_multi(s, Data, Size, true); 136 flush_events(s); 137 _Exit(0); 138 } else { 139 flush_events(s); 140 wait(NULL); 141 } 142 } 143 144 static void virtio_net_pre_fuzz(QTestState *s) 145 { 146 qos_init_path(s); 147 counter_shm_init(); 148 } 149 150 static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg) 151 { 152 int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sockfds); 153 g_assert_cmpint(ret, !=, -1); 154 g_unix_set_fd_nonblocking(sockfds[0], true, NULL); 155 sockfds_initialized = true; 156 g_string_append_printf(cmd_line, " -netdev socket,fd=%d,id=hs0 ", 157 sockfds[1]); 158 return arg; 159 } 160 161 static void *virtio_net_test_setup_user(GString *cmd_line, void *arg) 162 { 163 g_string_append_printf(cmd_line, " -netdev user,id=hs0 "); 164 return arg; 165 } 166 167 static void register_virtio_net_fuzz_targets(void) 168 { 169 fuzz_add_qos_target(&(FuzzTarget){ 170 .name = "virtio-net-socket", 171 .description = "Fuzz the virtio-net virtual queues. Fuzz incoming " 172 "traffic using the socket backend", 173 .pre_fuzz = &virtio_net_pre_fuzz, 174 .fuzz = virtio_net_fork_fuzz,}, 175 "virtio-net", 176 &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket} 177 ); 178 179 fuzz_add_qos_target(&(FuzzTarget){ 180 .name = "virtio-net-socket-check-used", 181 .description = "Fuzz the virtio-net virtual queues. Wait for the " 182 "descriptors to be used. Timeout may indicate improperly handled " 183 "input", 184 .pre_fuzz = &virtio_net_pre_fuzz, 185 .fuzz = virtio_net_fork_fuzz_check_used,}, 186 "virtio-net", 187 &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket} 188 ); 189 fuzz_add_qos_target(&(FuzzTarget){ 190 .name = "virtio-net-slirp", 191 .description = "Fuzz the virtio-net virtual queues with the slirp " 192 " backend. Warning: May result in network traffic emitted from the " 193 " process. Run in an isolated network environment.", 194 .pre_fuzz = &virtio_net_pre_fuzz, 195 .fuzz = virtio_net_fork_fuzz,}, 196 "virtio-net", 197 &(QOSGraphTestOptions){.before = virtio_net_test_setup_user} 198 ); 199 } 200 201 fuzz_target_init(register_virtio_net_fuzz_targets); 202