1 /* 2 * virtio-serial Fuzzing Target 3 * 4 * Copyright Red Hat Inc., 2019 5 * 6 * Authors: 7 * Alexander Bulekov <alxndr@bu.edu> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 */ 12 13 #include "qemu/osdep.h" 14 15 #include "tests/qtest/libqtest.h" 16 #include "tests/qtest/libqos/virtio-scsi.h" 17 #include "tests/qtest/libqos/virtio.h" 18 #include "tests/qtest/libqos/virtio-pci.h" 19 #include "standard-headers/linux/virtio_ids.h" 20 #include "standard-headers/linux/virtio_pci.h" 21 #include "standard-headers/linux/virtio_scsi.h" 22 #include "fuzz.h" 23 #include "qos_fuzz.h" 24 25 #define PCI_SLOT 0x02 26 #define PCI_FN 0x00 27 #define QVIRTIO_SCSI_TIMEOUT_US (1 * 1000 * 1000) 28 29 #define MAX_NUM_QUEUES 64 30 31 /* Based on tests/virtio-scsi-test.c */ 32 typedef struct { 33 int num_queues; 34 QVirtQueue *vq[MAX_NUM_QUEUES + 2]; 35 } QVirtioSCSIQueues; 36 37 static QVirtioSCSIQueues *qvirtio_scsi_init(QVirtioDevice *dev, uint64_t mask) 38 { 39 QVirtioSCSIQueues *vs; 40 uint64_t feat; 41 int i; 42 43 vs = g_new0(QVirtioSCSIQueues, 1); 44 45 feat = qvirtio_get_features(dev); 46 if (mask) { 47 feat &= ~QVIRTIO_F_BAD_FEATURE | mask; 48 } else { 49 feat &= ~(QVIRTIO_F_BAD_FEATURE | (1ull << VIRTIO_RING_F_EVENT_IDX)); 50 } 51 qvirtio_set_features(dev, feat); 52 53 vs->num_queues = qvirtio_config_readl(dev, 0); 54 55 for (i = 0; i < vs->num_queues + 2; i++) { 56 vs->vq[i] = qvirtqueue_setup(dev, fuzz_qos_alloc, i); 57 } 58 59 qvirtio_set_driver_ok(dev); 60 61 return vs; 62 } 63 64 static void virtio_scsi_fuzz(QTestState *s, QVirtioSCSIQueues* queues, 65 const unsigned char *Data, size_t Size) 66 { 67 /* 68 * Data is a sequence of random bytes. We split them up into "actions", 69 * followed by data: 70 * [vqa][dddddddd][vqa][dddd][vqa][dddddddddddd] ... 71 * The length of the data is specified by the preceding vqa.length 72 */ 73 typedef struct vq_action { 74 uint8_t queue; 75 uint8_t length; 76 uint8_t write; 77 uint8_t next; 78 uint8_t kick; 79 } vq_action; 80 81 /* Keep track of the free head for each queue we interact with */ 82 bool vq_touched[MAX_NUM_QUEUES + 2] = {0}; 83 uint32_t free_head[MAX_NUM_QUEUES + 2]; 84 85 QGuestAllocator *t_alloc = fuzz_qos_alloc; 86 87 QVirtioSCSI *scsi = fuzz_qos_obj; 88 QVirtioDevice *dev = scsi->vdev; 89 QVirtQueue *q; 90 vq_action vqa; 91 while (Size >= sizeof(vqa)) { 92 /* Copy the action, so we can normalize length, queue and flags */ 93 memcpy(&vqa, Data, sizeof(vqa)); 94 95 Data += sizeof(vqa); 96 Size -= sizeof(vqa); 97 98 vqa.queue = vqa.queue % queues->num_queues; 99 /* Cap length at the number of remaining bytes in data */ 100 vqa.length = vqa.length >= Size ? Size : vqa.length; 101 vqa.write = vqa.write & 1; 102 vqa.next = vqa.next & 1; 103 vqa.kick = vqa.kick & 1; 104 105 106 q = queues->vq[vqa.queue]; 107 108 /* Copy the data into ram, and place it on the virtqueue */ 109 uint64_t req_addr = guest_alloc(t_alloc, vqa.length); 110 qtest_memwrite(s, req_addr, Data, vqa.length); 111 if (vq_touched[vqa.queue] == 0) { 112 vq_touched[vqa.queue] = 1; 113 free_head[vqa.queue] = qvirtqueue_add(s, q, req_addr, vqa.length, 114 vqa.write, vqa.next); 115 } else { 116 qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next); 117 } 118 119 if (vqa.kick) { 120 qvirtqueue_kick(s, dev, q, free_head[vqa.queue]); 121 free_head[vqa.queue] = 0; 122 } 123 Data += vqa.length; 124 Size -= vqa.length; 125 } 126 /* In the end, kick each queue we interacted with */ 127 for (int i = 0; i < MAX_NUM_QUEUES + 2; i++) { 128 if (vq_touched[i]) { 129 qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]); 130 } 131 } 132 } 133 134 static void virtio_scsi_with_flag_fuzz(QTestState *s, 135 const unsigned char *Data, size_t Size) 136 { 137 QVirtioSCSI *scsi = fuzz_qos_obj; 138 static QVirtioSCSIQueues *queues; 139 140 if (Size >= sizeof(uint64_t)) { 141 queues = qvirtio_scsi_init(scsi->vdev, *(uint64_t *)Data); 142 virtio_scsi_fuzz(s, queues, 143 Data + sizeof(uint64_t), Size - sizeof(uint64_t)); 144 flush_events(s); 145 } 146 fuzz_reset(s); 147 } 148 149 static void virtio_scsi_pre_fuzz(QTestState *s) 150 { 151 qos_init_path(s); 152 } 153 154 static void *virtio_scsi_test_setup(GString *cmd_line, void *arg) 155 { 156 g_string_append(cmd_line, 157 " -drive file=blkdebug::null-co://," 158 "file.image.read-zeroes=on," 159 "if=none,id=dr1,format=raw,file.align=4k " 160 "-device scsi-hd,drive=dr1,lun=0,scsi-id=1"); 161 return arg; 162 } 163 164 165 static void register_virtio_scsi_fuzz_targets(void) 166 { 167 fuzz_add_qos_target(&(FuzzTarget){ 168 .name = "virtio-scsi-flags-fuzz", 169 .description = "Fuzz the virtio-scsi virtual queues. " 170 "Also fuzzes the virtio flags", 171 .pre_fuzz = &virtio_scsi_pre_fuzz, 172 .fuzz = virtio_scsi_with_flag_fuzz,}, 173 "virtio-scsi", 174 &(QOSGraphTestOptions){.before = virtio_scsi_test_setup} 175 ); 176 } 177 178 fuzz_target_init(register_virtio_scsi_fuzz_targets); 179