Clang coverage is the de-facto standard for generating coverage reports in libFuzzer based fuzzers, so add support for the same. __LLVM_PROFILE_RT_INIT_ONCE is added automatically which breaks commandhelper so filter the same. Note that the existing gcov support can also be used to generate coverage. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> --- meson.build | 11 +++++++++++ meson_options.txt | 3 ++- tests/commandhelper.c | 8 ++++++-- 3 files changed, 19 insertions(+), 3 deletions(-) diff --git a/meson.build b/meson.build index f31485c395..904524abc6 100644 --- a/meson.build +++ b/meson.build @@ -2141,6 +2141,17 @@ if get_option('test_coverage') ] endif +if get_option('test_coverage_clang') + if cc.get_id() != 'clang' + error('test_coverage_clang can only be used with the Clang compiler.') + endif + + coverage_flags = [ + '-fprofile-instr-generate', + '-fcoverage-mapping', + ] +endif + # Various definitions diff --git a/meson_options.txt b/meson_options.txt index 2d440c63d8..153e325cb5 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -8,7 +8,8 @@ option('unitdir', type: 'string', value: '', description: 'directory for systemd option('sysusersdir', type: 'string', value: '', description: 'directory for sysusers files') # dep:tests option('expensive_tests', type: 'feature', value: 'auto', description: 'set the default for enabling expensive tests (long timeouts)') -option('test_coverage', type: 'boolean', value: false, description: 'turn on code coverage instrumentation') +option('test_coverage', type: 'boolean', value: false, description: 'turn on code coverage instrumentation (gcov)') +option('test_coverage_clang', type: 'boolean', value: false, description: 'turn on code coverage instrumentation (clang)') option('git_werror', type: 'feature', value: 'auto', description: 'use -Werror if building from GIT') option('rpath', type: 'feature', value: 'auto', description: 'whether to include rpath information in installed binaries and libraries') option('docdir', type: 'string', value: '', description: 'documentation installation directory') diff --git a/tests/commandhelper.c b/tests/commandhelper.c index d4629d824e..6f562c3e28 100644 --- a/tests/commandhelper.c +++ b/tests/commandhelper.c @@ -172,9 +172,13 @@ static int printEnvironment(FILE *log) for (i = 0; i < length; i++) { /* Ignore the variables used to instruct the loader into * behaving differently, as they could throw the tests off. - * Also ignore __CF_USER_TEXT_ENCODING, which is set by macOS. */ + * Also ignore __CF_USER_TEXT_ENCODING, which is set by macOS. + * + * If LLVM coverage is enabled, __LLVM_PROFILE_RT_INIT_ONCE is + * automatically set, which should be ignored. */ if (!STRPREFIX(newenv[i], "LD_") && - !STRPREFIX(newenv[i], "__CF_USER_TEXT_ENCODING=")) { + !STRPREFIX(newenv[i], "__CF_USER_TEXT_ENCODING=") && + !STRPREFIX(newenv[i], "__LLVM_PROFILE_RT_INIT_ONCE=")) { fprintf(log, "ENV:%s\n", newenv[i]); } } -- 2.34.1

We make small modifications to the rng files to allow the relaxng-to-proto script to infer XML attribute types better. 1. Make iobase and irq refs so we can override their types in the script. 2. Replace deviceName with absFilePath so that vdpa devices get fuzzed correctly with file paths. 3. The relaxng-to-proto script does not handle regexes, so convert some of them to <choice> containing <value>. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> --- src/conf/schemas/basictypes.rng | 20 ++++++++++++++------ src/conf/schemas/domaincommon.rng | 11 +++++++---- src/conf/schemas/networkcommon.rng | 14 ++++++++------ 3 files changed, 29 insertions(+), 16 deletions(-) diff --git a/src/conf/schemas/basictypes.rng b/src/conf/schemas/basictypes.rng index 2931e316b7..db05c085fe 100644 --- a/src/conf/schemas/basictypes.rng +++ b/src/conf/schemas/basictypes.rng @@ -555,19 +555,27 @@ </element> </define> + <define name="iobase"> + <data type="string"> + <param name="pattern">0x[a-fA-F0-9]{1,4}</param> + </data> + </define> + + <define name="irq"> + <data type="string"> + <param name="pattern">0x[a-fA-F0-9]</param> + </data> + </define> + <define name="isaaddress"> <optional> <attribute name="iobase"> - <data type="string"> - <param name="pattern">0x[a-fA-F0-9]{1,4}</param> - </data> + <ref name="iobase"/> </attribute> </optional> <optional> <attribute name="irq"> - <data type="string"> - <param name="pattern">0x[a-fA-F0-9]</param> - </data> + <ref name="irq"/> </attribute> </optional> </define> diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng index 05ba697924..d635d2b179 100644 --- a/src/conf/schemas/domaincommon.rng +++ b/src/conf/schemas/domaincommon.rng @@ -3670,7 +3670,7 @@ <interleave> <element name="source"> <attribute name="dev"> - <ref name="deviceName"/> + <ref name="absFilePath"/> </attribute> </element> <ref name="interface-options"/> @@ -8495,9 +8495,12 @@ </data> </define> <define name="bridgeMode"> - <data type="string"> - <param name="pattern">(vepa|bridge|private|passthrough)</param> - </data> + <choice> + <value>vepa</value> + <value>bridge</value> + <value>private</value> + <value>passthrough</value> + </choice> </define> <define name="addrIPorName"> <choice> diff --git a/src/conf/schemas/networkcommon.rng b/src/conf/schemas/networkcommon.rng index 6df6d43f54..0254bac693 100644 --- a/src/conf/schemas/networkcommon.rng +++ b/src/conf/schemas/networkcommon.rng @@ -199,14 +199,16 @@ </data> </define> <define name="protocol"> - <data type="string"> - <param name="pattern">(tcp)|(udp)</param> - </data> + <choice> + <value>tcp</value> + <value>udp</value> + </choice> </define> <define name="addr-family"> - <data type="string"> - <param name="pattern">(ipv4)|(ipv6)</param> - </data> + <choice> + <value>ipv4</value> + <value>ipv6</value> + </choice> </define> <define name="vlan"> -- 2.34.1

This patch sets up most of the baseline code which will be used by various fuzzers as well as the build setup. proto_to_xml.cc includes logic to convert protobuf to XML. It does in a generalized fashion by using reflection APIs to recursively iterate through all protobuf fields and generating XML tags, attributes or text based on their identifiers and field types. This way, different protobuf definitions can be used with minimal modifications. proto_custom_datatypes.cc includes certain attribute datatypes that cannot be encapsulated by existing protobuf datatypes, so we implement various handlers to handle their XML serialization. run_fuzz is a helper script which sets up necessary libFuzzer flags and environment variables before executing the actual fuzzer binaries. Three protobuf definitions are provided which serve as a base for all XML domain fuzzers to follow: 1. xml_domain: Most of the XML domain format 2. xml_domain_disk_only: Only the <disk> definition 3. xml_domain_interface_only: Only the <interface> definition Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> --- meson.build | 44 ++++ meson_options.txt | 2 + tests/fuzz/meson.build | 59 +++++ tests/fuzz/proto_custom_datatypes.cc | 146 +++++++++++++ tests/fuzz/proto_custom_datatypes.h | 30 +++ tests/fuzz/proto_header_common.h | 43 ++++ tests/fuzz/proto_to_xml.cc | 205 ++++++++++++++++++ tests/fuzz/proto_to_xml.h | 28 +++ tests/fuzz/protos/meson.build | 36 +++ tests/fuzz/protos/xml_datatypes.proto | 72 ++++++ tests/fuzz/protos/xml_domain.proto | 62 ++++++ tests/fuzz/protos/xml_domain_disk_only.proto | 21 ++ .../protos/xml_domain_interface_only.proto | 21 ++ tests/fuzz/run_fuzz.in | 122 +++++++++++ tests/meson.build | 5 + 15 files changed, 896 insertions(+) create mode 100644 tests/fuzz/meson.build create mode 100644 tests/fuzz/proto_custom_datatypes.cc create mode 100644 tests/fuzz/proto_custom_datatypes.h create mode 100644 tests/fuzz/proto_header_common.h create mode 100644 tests/fuzz/proto_to_xml.cc create mode 100644 tests/fuzz/proto_to_xml.h create mode 100644 tests/fuzz/protos/meson.build create mode 100644 tests/fuzz/protos/xml_datatypes.proto create mode 100644 tests/fuzz/protos/xml_domain.proto create mode 100644 tests/fuzz/protos/xml_domain_disk_only.proto create mode 100644 tests/fuzz/protos/xml_domain_interface_only.proto create mode 100644 tests/fuzz/run_fuzz.in diff --git a/meson.build b/meson.build index 904524abc6..abc67e0062 100644 --- a/meson.build +++ b/meson.build @@ -2153,6 +2153,49 @@ if get_option('test_coverage_clang') endif +# fuzzing + +if get_option('fuzz').enabled() + add_languages('cpp') + cxx = meson.get_compiler('cpp') + + libprotobuf_mutator_dep = dependency('libprotobuf-mutator') + + if get_option('external_protobuf_dir') != '' + external_protobuf_dir = get_option('external_protobuf_dir') + protoc_prog = find_program(external_protobuf_dir / 'bin' / 'protoc') + + protobuf_inc = external_protobuf_dir / 'include' + protobuf_libdir = external_protobuf_dir / 'lib' + + protobuf_list_cmd = run_command('find', protobuf_libdir, '-name', '*.a', '-printf', '%f\n', check: true) + protobuf_lib_files = protobuf_list_cmd.stdout().strip().split('\n') + + protobuf_libs = [] + + foreach lib: protobuf_lib_files + protobuf_libs += cxx.find_library(lib.substring(3, -2), dirs: protobuf_libdir) + endforeach + + protobuf_dep = declare_dependency( + dependencies: [ protobuf_libs ], + include_directories: [ protobuf_inc ], + ) + else + protobuf_dep = dependency('protobuf') + protoc_prog = find_program('protoc') + endif + + if cc.has_argument('-fsanitize=fuzzer') and cc.has_argument('-fsanitize=fuzzer-no-link') + add_project_arguments('-fsanitize=fuzzer-no-link', language: [ 'c', 'cpp' ]) + else + error('Your compiler does not support libFuzzer') + endif + + conf.set('WITH_FUZZ', 1) +endif + + # Various definitions # Python3 < 3.7 treats the C locale as 7-bit only. We must force env vars so @@ -2389,6 +2432,7 @@ summary(win_summary, section: 'Windows', bool_yn: true) test_summary = { 'Expensive': use_expensive_tests, 'Coverage': coverage_flags.length() > 0, + 'Fuzzing': conf.has('WITH_FUZZ'), } summary(test_summary, section: 'Test suite', bool_yn: true) diff --git a/meson_options.txt b/meson_options.txt index 153e325cb5..b961192ee5 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -15,6 +15,8 @@ option('rpath', type: 'feature', value: 'auto', description: 'whether to include option('docdir', type: 'string', value: '', description: 'documentation installation directory') option('docs', type: 'feature', value: 'auto', description: 'whether to generate documentation') option('tests', type: 'feature', value: 'auto', description: 'whether to build and run tests') +option('fuzz', type: 'feature', value: 'auto', description: 'whether to build and run fuzzing engines') +option('external_protobuf_dir', type: 'string', value: '', description: 'external protobuf directory for fuzzer compilation') # build dependencies options diff --git a/tests/fuzz/meson.build b/tests/fuzz/meson.build new file mode 100644 index 0000000000..d0488c3e36 --- /dev/null +++ b/tests/fuzz/meson.build @@ -0,0 +1,59 @@ +fuzz_dep = declare_dependency( + dependencies: [ + tests_dep, + libprotobuf_mutator_dep, + protobuf_dep, + ], + include_directories: [ + test_dir, + ], + ) + +subdir('protos') + +available_fuzzers = '' +xml_fuzzers = [] + +fuzz_autogen_xml_domain_lib = static_library( + 'fuzz_autogen_xml_domain_lib', + [ + autogen_xml_domain_proto_src, + xml_datatypes_proto_src, + 'proto_custom_datatypes.cc', + ], + dependencies: [ fuzz_dep ], +) + +fuzz_autogen_xml_domain_dep = declare_dependency( + link_whole: [ fuzz_autogen_xml_domain_lib ], + include_directories: [ + fuzz_autogen_xml_domain_lib.private_dir_include(), + ] +) + +foreach fuzzer: xml_fuzzers + xml_domain_fuzz = executable(fuzzer['name'], + fuzzer['src'], + dependencies: [ fuzz_dep, fuzzer['deps'] ], + cpp_args: [ '-fsanitize=fuzzer', fuzzer['macro'] ], + link_args: [ '-fsanitize=fuzzer', libvirt_no_indirect ], + link_with: fuzzer['libs'], + ) + + available_fuzzers += '"' + fuzzer['name'] + '"' + ',' +endforeach + +run_conf = configuration_data({ + 'abs_builddir': meson.project_build_root(), + 'available_fuzzers': available_fuzzers, + 'sanitizers': get_option('b_sanitize'), + 'coverage_clang': get_option('test_coverage_clang'), +}) + +configure_file( + input: 'run_fuzz.in', + output: '@BASENAME@', + configuration: run_conf, +) + +run_command('chmod', 'a+x', meson.current_build_dir() / 'run_fuzz', check: true) diff --git a/tests/fuzz/proto_custom_datatypes.cc b/tests/fuzz/proto_custom_datatypes.cc new file mode 100644 index 0000000000..d89a6d4f59 --- /dev/null +++ b/tests/fuzz/proto_custom_datatypes.cc @@ -0,0 +1,146 @@ +/* + * proto_custom_datatypes.cc: Custom protobuf-based datatype handlers + * + * Copyright (C) 2024 Rayhan Faizel + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include "xml_datatypes.pb.h" +#include "port/protobuf.h" + +#include <unordered_map> + +using google::protobuf::Message; +using google::protobuf::Reflection; +using google::protobuf::EnumDescriptor; + +typedef std::string (*typeHandlerPtr)(const Message &); +std::string emulator = ""; + +static +std::string convertCPUSet(const Message &message) +{ + std::string value; + const libvirt::CPUSet &cpuset = (libvirt::CPUSet &) message; + uint64_t bitmap = cpuset.bitmap(); + + int cpu = 0; + for (uint8_t bit = bitmap & 1; bitmap != 0; bitmap = bitmap >> 1, bit = bitmap & 1, cpu++) + { + if (bit) { + if (value.empty()) + value += std::to_string(cpu); + else + value += "," + std::to_string(cpu); + } + } + + return value; +} + + +static +std::string convertEmulatorString(const Message &message) +{ + (void) message; /* Silence warning about unused parameter */ + return emulator; +} + + +static +std::string convertIPAddr(const Message &message) { + char value[64] = {0}; + const libvirt::IPAddr &ip_addr = (libvirt::IPAddr &) message; + + if (ip_addr.ipv6() == true) { + sprintf(value, "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x", + (uint16_t) ip_addr.lo_qword() & 0xffff, + (uint16_t) (ip_addr.lo_qword() >> 16) & 0xffff, + (uint16_t) (ip_addr.lo_qword() >> 32) & 0xffff, + (uint16_t) (ip_addr.lo_qword() >> 48) & 0xffff, + (uint16_t) ip_addr.hi_qword() & 0xffff, + (uint16_t) (ip_addr.hi_qword() >> 16) & 0xffff, + (uint16_t) (ip_addr.hi_qword() >> 32) & 0xffff, + (uint16_t) (ip_addr.hi_qword() >> 48) & 0xffff); + } else { + sprintf(value, "%d.%d.%d.%d", + (uint8_t) ip_addr.lo_qword() & 0xff, + (uint8_t) (ip_addr.lo_qword() >> 8) & 0xff, + (uint8_t) (ip_addr.lo_qword() >> 16) & 0xff, + (uint8_t) (ip_addr.lo_qword() >> 24) & 0xff); + } + + return std::string(value); +} + + +static +std::string convertMacAddr(const Message &message) { + char value[64] = {0}; + const libvirt::MacAddr &mac_addr = (libvirt::MacAddr &) message; + + sprintf(value, "%02x:%02x:%02x:%02x:%02x:%02x", + (uint8_t) mac_addr.qword() & 0xff, + (uint8_t) (mac_addr.qword() >> 8) & 0xff, + (uint8_t) (mac_addr.qword() >> 16) & 0xff, + (uint8_t) (mac_addr.qword() >> 24) & 0xff, + (uint8_t) (mac_addr.qword() >> 32) & 0xff, + (uint8_t) (mac_addr.qword() >> 40) & 0xff); + + return std::string(value); +} + + +static +std::string convertDiskTarget(const Message &message) +{ + std::string value; + const libvirt::TargetDev &target_dev = (libvirt::TargetDev &) message; + const EnumDescriptor *enum_desc = libvirt::TargetDev_TargetDevEnum_descriptor(); + std::string prefix = enum_desc->FindValueByNumber(target_dev.prefix())->name(); + + value = prefix + "a"; + + return value; +} + + +std::unordered_map<std::string, typeHandlerPtr> type_handler_table = { + {"libvirt.CPUSet", convertCPUSet}, + {"libvirt.EmulatorString", convertEmulatorString}, + {"libvirt.IPAddr", convertIPAddr}, + {"libvirt.MacAddr", convertMacAddr}, + {"libvirt.TargetDev", convertDiskTarget}, +}; + + +void handleCustomDatatype(const Message &message, + std::string tag, + bool is_attr, + std::string &xml) +{ + std::string type_name = message.GetTypeName(); + std::string value = ""; + + if (type_handler_table.find(type_name) != type_handler_table.end()) { + value = type_handler_table[type_name](message); + + if (is_attr) + xml += " " + tag + "=" + "'" + value + "'"; + else + xml += value; + } +} diff --git a/tests/fuzz/proto_custom_datatypes.h b/tests/fuzz/proto_custom_datatypes.h new file mode 100644 index 0000000000..9446b6235b --- /dev/null +++ b/tests/fuzz/proto_custom_datatypes.h @@ -0,0 +1,30 @@ +/* + * proto_custom_datatypes.h: Custom protobuf-based datatype handlers + * + * Copyright (C) 2024 Rayhan Faizel + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#pragma once + +#include "port/protobuf.h" + +using google::protobuf::Message; + +void handleCustomDatatype(const Message &message, + std::string tag, + bool is_attr, + std::string &xml); diff --git a/tests/fuzz/proto_header_common.h b/tests/fuzz/proto_header_common.h new file mode 100644 index 0000000000..5ee510896d --- /dev/null +++ b/tests/fuzz/proto_header_common.h @@ -0,0 +1,43 @@ +/* + * proto_header_common.h: Protobuf header selection and common code + * + * Copyright (C) 2024 Rayhan Faizel + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#pragma once + +#pragma GCC diagnostic ignored "-Wignored-attributes" +#pragma GCC diagnostic ignored "-Wextern-c-compat" + +#ifdef XML_DOMAIN +#include "xml_domain.pb.h" +#endif + +#ifdef XML_DOMAIN_DISK_ONLY +#include "xml_domain_disk_only.pb.h" +#endif + +#ifdef XML_DOMAIN_INTERFACE_ONLY +#include "xml_domain_interface_only.pb.h" +#endif + + +#define FUZZ_COMMON_INIT(...) \ + if (virErrorInitialize() < 0) \ + exit(EXIT_FAILURE); \ + if (g_getenv("LPM_EXE_PATH")) \ + virFileActivateDirOverrideForProg(g_getenv("LPM_EXE_PATH")); diff --git a/tests/fuzz/proto_to_xml.cc b/tests/fuzz/proto_to_xml.cc new file mode 100644 index 0000000000..13393ecb34 --- /dev/null +++ b/tests/fuzz/proto_to_xml.cc @@ -0,0 +1,205 @@ +/* + * proto_to_xml.cc: Protobuf to XML converter + * + * Copyright (C) 2024 Rayhan Faizel + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include "proto_header_common.h" +#include "port/protobuf.h" +#include "proto_custom_datatypes.h" + + +using google::protobuf::Message; +using google::protobuf::Descriptor; +using google::protobuf::FieldDescriptor; +using google::protobuf::EnumValueDescriptor; +using google::protobuf::OneofDescriptor; +using google::protobuf::Reflection; + + +static void +convertProtoFieldToXML(const Message &message, + const FieldDescriptor *field, + std::string tag, + bool is_attr, + std::string &xml) +{ + const Reflection *reflection = message.GetReflection(); + const EnumValueDescriptor *enum_desc; + std::string value = ""; + std::string alternate_value; + bool value_set = false; + + switch (field->cpp_type()) { + case FieldDescriptor::CPPTYPE_MESSAGE: + { + const Message &field_message = reflection->GetMessage(message, field); + handleCustomDatatype(field_message, tag, is_attr, xml); + return; + } + break; + case FieldDescriptor::CPPTYPE_ENUM: + enum_desc = reflection->GetEnum(message, field); + + /* Use extension to fill certain XML enum values containing special characters */ + alternate_value = enum_desc->options().GetExtension(libvirt::real_value); + + if (!alternate_value.empty()) { + value = alternate_value; + } else { + value = enum_desc->name(); + } + + value_set = true; + break; + case FieldDescriptor::CPPTYPE_BOOL: + value = reflection->GetBool(message, field) ? "yes" : "no"; + value_set = true; + break; + case FieldDescriptor::CPPTYPE_UINT32: + value = std::to_string(reflection->GetUInt32(message, field)); + value_set = true; + break; + case FieldDescriptor::CPPTYPE_UINT64: + value = std::to_string(reflection->GetUInt64(message, field)); + value_set = true; + break; + case FieldDescriptor::CPPTYPE_STRING: + value = reflection->GetString(message, field); + value_set = true; + break; + default: + break; + } + + if (value_set) { + if (is_attr) + xml += " " + tag + "='" + value + "'"; + else + xml += value; + } +} + + +static int +convertProtoToXMLInternal(const Message &message, + std::string &xml, + bool root) +{ + const Descriptor *descriptor = message.GetDescriptor(); + const Reflection *reflection = message.GetReflection(); + size_t field_count = descriptor->field_count(); + int children = 0; + bool opening_tag_close = false; + size_t i, j; + size_t repeated_size = 0; + + for (i = 0; i < field_count; i++) { + const FieldDescriptor *field = descriptor->field(i); + std::string field_name = field->name(); + std::string tag = field_name.substr(2, std::string::npos); + char field_type = field_name[0]; + std::string alternate_name = field->options().GetExtension(libvirt::real_name); + + /* Fields inside oneof are prefixed with A_OPTXX_ */ + if (tag.substr(0, 3) == "OPT") + tag = tag.substr(6, std::string::npos); + + /* Use extension to generate XML tags with names having special characters */ + if (!alternate_name.empty()) + tag = alternate_name; + + if (!field->is_repeated() && !reflection->HasField(message, field)) { + continue; + } + + switch (field_type) { + /* Handle XML attributes/properties */ + case 'A': + /* Attributes must come before inner tags in the protobuf definition */ + assert(!opening_tag_close); + + convertProtoFieldToXML(message, field, tag, true, xml); + break; + + /* Handle inner tags of current XML tag */ + case 'T': + /* We don't want to accidentally close off the tag on empty repeated fields */ + if (field->is_repeated()) { + repeated_size = reflection->FieldSize(message, field); + if (repeated_size == 0) + continue; + } + + if (!opening_tag_close && !root) { + xml += ">\n"; + opening_tag_close = true; + } + + if (field->is_repeated()) { + for (j = 0; j < repeated_size; j++) { + const Message &field_message = reflection->GetRepeatedMessage(message, field, j); + children += 1; + xml += "<" + tag; + int inner_children = convertProtoToXMLInternal(field_message, xml, false); + if (inner_children == 0) { + xml += "/>\n"; + } else { + xml += "</" + tag + ">\n"; + } + } + } else { + const Message &field_message = reflection->GetMessage(message, field); + children += 1; + xml += "<" + tag; + int inner_children = convertProtoToXMLInternal(field_message, xml, false); + + if (inner_children == 0) { + xml += "/>\n"; + } else { + xml += "</" + tag + ">\n"; + } + } + break; + + /* Handle XML text nodes. Eg: <tag>(text here)</tag> */ + case 'V': + if (!opening_tag_close && !root) { + xml += ">"; + opening_tag_close = true; + } + assert(children == 0); + children = 1; + + convertProtoFieldToXML(message, field, "", false, xml); + + return children; + + default: + break; + } + } + + return children; +} + + +void convertProtoToXML(const libvirt::MainObj &message, + std::string &xml) +{ + convertProtoToXMLInternal(message, xml, true); +} diff --git a/tests/fuzz/proto_to_xml.h b/tests/fuzz/proto_to_xml.h new file mode 100644 index 0000000000..7fe9597a19 --- /dev/null +++ b/tests/fuzz/proto_to_xml.h @@ -0,0 +1,28 @@ +/* + * proto_to_xml.h: Protobuf to XML converter + * + * Copyright (C) 2024 Rayhan Faizel + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#pragma once + +#include "proto_header_common.h" +#include "port/protobuf.h" + + +void convertProtoToXML(const libvirt::MainObj &message, + std::string &xml); diff --git a/tests/fuzz/protos/meson.build b/tests/fuzz/protos/meson.build new file mode 100644 index 0000000000..42c3a7f6a9 --- /dev/null +++ b/tests/fuzz/protos/meson.build @@ -0,0 +1,36 @@ +protos = [ + 'xml_datatypes.proto', + 'xml_domain.proto', + 'xml_domain_disk_only.proto', + 'xml_domain_interface_only.proto', +] + +autogen_proto_xml_domain_proto = custom_target('autogen_xml_domain.proto', + output : 'autogen_xml_domain.proto', + input : meson.project_source_root() / 'src' / 'conf' / 'schemas' / 'domain.rng', + command : [relaxng_to_proto_prog, '@INPUT@', '@OUTPUT@'], +) + +protoc_generator = generator(protoc_prog, + output: [ + '@BASENAME@.pb.cc', + '@BASENAME@.pb.h', + ], + arguments: [ + '--proto_path=@CURRENT_SOURCE_DIR@', + '--proto_path=@BUILD_ROOT@/tests/fuzz/protos/', + '--cpp_out=@BUILD_DIR@', + '@INPUT@', + ], + depends: [ + autogen_proto_xml_domain_proto, + ], +) + +autogen_xml_domain_proto_src = protoc_generator.process(autogen_proto_xml_domain_proto) + +foreach proto: protos + proto_src_name = proto.split('.')[0].underscorify() + proto_src = protoc_generator.process(proto) + set_variable('@0@_proto_src'.format(proto_src_name), proto_src) +endforeach diff --git a/tests/fuzz/protos/xml_datatypes.proto b/tests/fuzz/protos/xml_datatypes.proto new file mode 100644 index 0000000000..1229b9810f --- /dev/null +++ b/tests/fuzz/protos/xml_datatypes.proto @@ -0,0 +1,72 @@ +syntax = "proto2"; +package libvirt; + +import "google/protobuf/descriptor.proto"; + +/* + * Use EnumValueOptions extension to insert XML attribute values that do + * contain characters outside [A-Za-z0-9_] + */ + +extend google.protobuf.EnumValueOptions { + optional string real_value = 10000; +} + +/* + * Use FieldOptions extension to create XML tags/attributes + * with identifiers containing characters outside [A-Za-z0-9_] + */ + +extend google.protobuf.FieldOptions { + optional string real_name = 10000; +} + +enum Switch { + on = 0; + off = 1; +} + +/* If we use string, it could blow up the size of the protobuf in-memory */ +enum DummyString { + dummy = 0; + dummy2 = 1; + dummy3 = 2; + dummy4 = 3; +} + +enum DummyUUID { + dummy_uuid = 0 [(real_value) = "df6fdea1-10c3-474c-ae62-e63def80de0b"]; +} + +message IPAddr { + required bool ipv6 = 1; + required uint64 lo_qword = 2; + required uint64 hi_qword = 3; +} + +message MacAddr { + required uint64 qword = 1; +} + +message TargetDev { + enum TargetDevEnum { + hd = 0; + sd = 1; + vd = 2; + xvd = 3; + ubd = 4; + } + required TargetDevEnum prefix = 1; +} + +enum DummyPath { + devnull = 0 [(real_value) = "/dev/null"]; + devzero = 1 [(real_value) = "/dev/zero"]; + invalidpath = 2 [(real_value) = "/this/path/doesnt/exist"]; +} + +message CPUSet { + required uint64 bitmap = 1; +} + +message EmulatorString {} diff --git a/tests/fuzz/protos/xml_domain.proto b/tests/fuzz/protos/xml_domain.proto new file mode 100644 index 0000000000..9720af70d3 --- /dev/null +++ b/tests/fuzz/protos/xml_domain.proto @@ -0,0 +1,62 @@ +syntax = "proto2"; + +import "autogen_xml_domain.proto"; +import "xml_datatypes.proto"; + +package libvirt; + +/* + * <devices> container tag + * For more effective coverage, it might be a good idea to comment + * out some protobuf fields and fuzz only a few devices at a time. + */ + +message devicesTag { + repeated domainTag.devicesTag.soundTag T_sound = 1; + repeated domainTag.devicesTag.filesystemTag T_filesystem = 2; + repeated domainTag.devicesTag.inputTag T_input = 3; + repeated domainTag.devicesTag.diskTag T_disk = 4; + repeated domainTag.devicesTag.interfaceTag T_interface = 5; + repeated domainTag.devicesTag.graphicsTag T_graphics = 6; + repeated domainTag.devicesTag.serialTag T_serial = 7; + repeated domainTag.devicesTag.parallelTag T_parallel = 8; + repeated domainTag.devicesTag.channelTag T_channel = 9; + repeated domainTag.devicesTag.consoleTag T_console = 10; + repeated domainTag.devicesTag.controllerTag T_controller = 11; + repeated domainTag.devicesTag.videoTag T_video = 12; + repeated domainTag.devicesTag.rngTag T_rng = 13; + repeated domainTag.devicesTag.watchdogTag T_watchdog = 14; + repeated domainTag.devicesTag.memballoonTag T_memballoon = 15; + repeated domainTag.devicesTag.smartcardTag T_smartcard = 16; + repeated domainTag.devicesTag.redirdevTag T_redirdev = 17; + repeated domainTag.devicesTag.audioTag T_audio = 18; + repeated domainTag.devicesTag.cryptoTag T_crypto = 19; + repeated domainTag.devicesTag.panicTag T_panic = 20; + repeated domainTag.devicesTag.tpmTag T_tpm = 21; + repeated domainTag.devicesTag.shmemTag T_shmem = 22; + repeated domainTag.devicesTag.hostdevTag T_hostdev = 23; + repeated domainTag.devicesTag.leaseTag T_lease = 24; + repeated domainTag.devicesTag.redirfilterTag T_redirfilter = 25; + repeated domainTag.devicesTag.iommuTag T_iommu = 26; + repeated domainTag.devicesTag.vsockTag T_vsock = 27; + repeated domainTag.devicesTag.nvramTag T_nvram = 28; + + message EmulatorTag { + required EmulatorString V_value = 1; + } + required EmulatorTag T_emulator = 1000; +} + +/* Full XML Domain */ + +message MainObj { + optional domainTag.clockTag T_clock = 1; + optional domainTag.vcpuTag T_vcpu = 2; + optional domainTag.vcpusTag T_vcpus = 3; + optional domainTag.cpuTag T_cpu = 4; + optional domainTag.cputuneTag T_vcputune = 5; + optional domainTag.memtuneTag T_memtune = 6; + optional domainTag.blkiotuneTag T_blkiotune = 7; + + required devicesTag T_devices = 1000; +} diff --git a/tests/fuzz/protos/xml_domain_disk_only.proto b/tests/fuzz/protos/xml_domain_disk_only.proto new file mode 100644 index 0000000000..a6af43003c --- /dev/null +++ b/tests/fuzz/protos/xml_domain_disk_only.proto @@ -0,0 +1,21 @@ +syntax = "proto2"; + +import "autogen_xml_domain.proto"; +import "xml_datatypes.proto"; + +package libvirt; + +message devicesTag { + repeated domainTag.devicesTag.diskTag T_disk = 4; + + message EmulatorTag { + required EmulatorString V_value = 1; + } + required EmulatorTag T_emulator = 1000; +} + +/* Full XML Domain */ + +message MainObj { + required devicesTag T_devices = 1000; +} diff --git a/tests/fuzz/protos/xml_domain_interface_only.proto b/tests/fuzz/protos/xml_domain_interface_only.proto new file mode 100644 index 0000000000..3bac94bf79 --- /dev/null +++ b/tests/fuzz/protos/xml_domain_interface_only.proto @@ -0,0 +1,21 @@ +syntax = "proto2"; + +import "autogen_xml_domain.proto"; +import "xml_datatypes.proto"; + +package libvirt; + +message devicesTag { + repeated domainTag.devicesTag.interfaceTag T_interface = 5; + + message EmulatorTag { + required EmulatorString V_value = 1; + } + required EmulatorTag T_emulator = 1000; +} + +/* Full XML Domain */ + +message MainObj { + required devicesTag T_devices = 1000; +} diff --git a/tests/fuzz/run_fuzz.in b/tests/fuzz/run_fuzz.in new file mode 100644 index 0000000000..da3c7935b7 --- /dev/null +++ b/tests/fuzz/run_fuzz.in @@ -0,0 +1,122 @@ +#!/usr/bin/env python3 + +import argparse +import os +import sys + +available_fuzzers = [ @available_fuzzers@ ] +abs_builddir = "@abs_builddir@" +fuzz_dir = f"{abs_builddir}/tests/fuzz/" +llvm_symbolizer_path = f"{fuzz_dir}/llvm-symbolizer-wrapper" + +sanitizers = "@sanitizers@" +coverage_clang = @coverage_clang@ + +parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, + description="Fuzzing Helper") + +parser.add_argument('fuzzer', + help='Select fuzzer binary to run', + choices=available_fuzzers) + +parser.add_argument('--testcase', nargs='+', + help='Individual test case') + +parser.add_argument('--corpus', + help='Corpus Directory') + +parser.add_argument('--dump-xml', action='store_true', + help='Log XML test cases') + +parser.add_argument('--format-xml', action='store_true', + help='Run XML domain format functions') + +parser.add_argument('--arch', + help='XML domain architecture to fuzz') + +parser.add_argument('--llvm-profile-file', + help='Collect coverage report') + +parser.add_argument('--total-time', type=int, + help='Fuzz for specific amount of time (in seconds)') + +parser.add_argument('--timeout', type=int, + help='Max duration for individual test case (in seconds)') + +parser.add_argument('-j', '--jobs', type=int, default=1, + help='Run parallel fuzzers') + +parser.add_argument('--parallel-mode', choices=["jobs", "fork"], default="jobs", + help='Set parallel fuzzing method') + +parser.add_argument('--use-value-profile', action='store_true', + help='Use value profile') + +parser.add_argument('--libfuzzer-options', + help='Pass additional raw libFuzzer flags') + +args = parser.parse_args() + +process_args = [fuzz_dir + args.fuzzer] +env = os.environ + +if args.corpus and args.testcase: + print("--testcase and --corpus can't be used together") + sys.exit(1) + +if args.corpus: + process_args.extend([args.corpus]) + +if args.testcase: + process_args.extend(args.testcase) + +if args.dump_xml: + env["LPM_XML_DUMP_INPUT"] = "YES" + +if args.format_xml: + env["LPM_XML_FORMAT_ENABLE"] = "YES" + +if args.arch: + env["LPM_FUZZ_ARCH"] = args.arch + +if args.llvm_profile_file: + if not coverage_clang: + print("Please recompile your build with -Dtest_coverage_clang=true") + sys.exit(1) + env["LLVM_PROFILE_FILE"] = args.llvm_profile_file + + if not args.corpus: + print("Coverage report requires --corpus. If you do not have a corpus, do normal fuzzing to prepare one.") + sys.exit(1) + + process_args.extend(["-runs=0"]) + +if args.total_time: + process_args.extend([f"-max_total_time={str(args.total_time)}"]) + +if args.timeout: + process_args.extend([f"-timeout={str(args.timeout)}"]) + +if args.use_value_profile: + process_args.extend(["-use_value_profile=1"]) + +if args.jobs > 1: + if args.parallel_mode == "fork": + process_args.extend([f"-fork={args.jobs}", "-ignore_crashes=1", "-ignore_ooms=1", "-ignore_timeouts=1"]) + elif args.parallel_mode == "jobs": + process_args.extend([f"-jobs={args.jobs}", f"-workers={args.jobs}"]) + +exe_path = fuzz_dir + args.fuzzer + +# If libvirt is not installed in system dir, some fuzzers (QEMU, etc.) will fail +env["LPM_EXE_PATH"] = exe_path + +process_args.extend(["-print_funcs=-1"]) + +if args.libfuzzer_options: + process_args.extend([x for x in args.libfuzzer_options.split(' ') if x != '']) + +print("Selected fuzzer:", args.fuzzer) +print("Active sanitizers:", sanitizers) + +os.execvpe(exe_path, process_args, env) diff --git a/tests/meson.build b/tests/meson.build index 2f1eda1f95..18743ac45e 100644 --- a/tests/meson.build +++ b/tests/meson.build @@ -34,6 +34,7 @@ tests_dep = declare_dependency( ), ) +test_dir = include_directories('.') tests_env = [ 'abs_builddir=@0@'.format(meson.current_build_dir()), 'abs_srcdir=@0@'.format(meson.current_source_dir()), @@ -750,6 +751,10 @@ endforeach testenv = runutf8 testenv += 'VIR_TEST_FILE_ACCESS=1' +if conf.has('WITH_FUZZ') + subdir('fuzz') +endif + add_test_setup( 'access', env: testenv, -- 2.34.1

This patch implements the harness for hotplugging devices under the QEMU driver. The fuzzer exercises both attachment and detachment of various devices. It uses its own proto file xml_hotplug to fuzz only one device type at a time. Monitor setup is done such that QMP commands are processed indefinitely and removal wait times are eliminated. A table of dummy responses is referred to for generating QMP responses. A semi-hardcoded domain XML is used to hotplug and unhotplug device XMLs against it. It consists of various controllers to allow successful hotplugging. Depending on the architecture selected, some controllers may be omitted or modified. LeakSanitizer slows down the fuzzer severely, so we disable it in run_fuzz for now. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> --- src/conf/domain_conf.h | 2 + src/qemu/qemu_hotplug.c | 4 + tests/fuzz/meson.build | 6 + tests/fuzz/proto_header_common.h | 4 + tests/fuzz/protos/meson.build | 1 + tests/fuzz/protos/xml_hotplug.proto | 38 ++++ tests/fuzz/qemu_xml_hotplug_fuzz.cc | 340 ++++++++++++++++++++++++++++ tests/fuzz/run_fuzz.in | 5 + tests/qemumonitortestutils.c | 48 ++++ tests/qemumonitortestutils.h | 6 + 10 files changed, 454 insertions(+) create mode 100644 tests/fuzz/protos/xml_hotplug.proto create mode 100644 tests/fuzz/qemu_xml_hotplug_fuzz.cc diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h index 3e97dd6293..1327604fbd 100644 --- a/src/conf/domain_conf.h +++ b/src/conf/domain_conf.h @@ -3288,6 +3288,8 @@ struct _virDomainObj { int taint; size_t ndeprecations; char **deprecations; + + bool fuzz; }; G_DEFINE_AUTOPTR_CLEANUP_FUNC(virDomainObj, virObjectUnref); diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index 75b97cf736..a4a5a32346 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -5455,6 +5455,10 @@ qemuDomainWaitForDeviceRemoval(virDomainObj *vm) qemuDomainObjPrivate *priv = vm->privateData; unsigned long long until; + /* Skip the wait entirely if fuzzing is active */ + if (vm->fuzz) + return 1; + if (virTimeMillisNow(&until) < 0) return 1; until += qemuDomainGetUnplugTimeout(vm); diff --git a/tests/fuzz/meson.build b/tests/fuzz/meson.build index 12f9a719f2..9579f56749 100644 --- a/tests/fuzz/meson.build +++ b/tests/fuzz/meson.build @@ -37,6 +37,11 @@ if conf.has('WITH_QEMU') 'proto_to_xml.cc', ] + hotplug_src = [ + 'qemu_xml_hotplug_fuzz.cc', + 'proto_to_xml.cc', + ] + qemu_libs = [ test_qemu_driver_lib, test_utils_lib, @@ -48,6 +53,7 @@ if conf.has('WITH_QEMU') { 'name': 'qemu_xml_domain_fuzz', 'src': [ fuzzer_src, xml_domain_proto_src ], 'libs': qemu_libs, 'macro': '-DXML_DOMAIN', 'deps': [ fuzz_autogen_xml_domain_dep ] }, { 'name': 'qemu_xml_domain_fuzz_disk', 'src': [ fuzzer_src, xml_domain_disk_only_proto_src ], 'libs': qemu_libs, 'macro': '-DXML_DOMAIN_DISK_ONLY', 'deps': [ fuzz_autogen_xml_domain_dep ] }, { 'name': 'qemu_xml_domain_fuzz_interface', 'src': [ fuzzer_src, xml_domain_interface_only_proto_src ], 'libs': qemu_libs, 'macro': '-DXML_DOMAIN_INTERFACE_ONLY', 'deps': [ fuzz_autogen_xml_domain_dep ] }, + { 'name': 'qemu_xml_hotplug_fuzz', 'src': [ hotplug_src, xml_hotplug_proto_src ], 'libs': [ qemu_libs, test_utils_qemu_monitor_lib ], 'macro': '-DXML_HOTPLUG', 'deps': [ fuzz_autogen_xml_domain_dep ] }, ] endif diff --git a/tests/fuzz/proto_header_common.h b/tests/fuzz/proto_header_common.h index 5ee510896d..3f135c48e1 100644 --- a/tests/fuzz/proto_header_common.h +++ b/tests/fuzz/proto_header_common.h @@ -35,6 +35,10 @@ #include "xml_domain_interface_only.pb.h" #endif +#ifdef XML_HOTPLUG +#include "xml_hotplug.pb.h" +#endif + #define FUZZ_COMMON_INIT(...) \ if (virErrorInitialize() < 0) \ diff --git a/tests/fuzz/protos/meson.build b/tests/fuzz/protos/meson.build index 42c3a7f6a9..0731ef1eca 100644 --- a/tests/fuzz/protos/meson.build +++ b/tests/fuzz/protos/meson.build @@ -3,6 +3,7 @@ protos = [ 'xml_domain.proto', 'xml_domain_disk_only.proto', 'xml_domain_interface_only.proto', + 'xml_hotplug.proto', ] autogen_proto_xml_domain_proto = custom_target('autogen_xml_domain.proto', diff --git a/tests/fuzz/protos/xml_hotplug.proto b/tests/fuzz/protos/xml_hotplug.proto new file mode 100644 index 0000000000..0490b2fdb6 --- /dev/null +++ b/tests/fuzz/protos/xml_hotplug.proto @@ -0,0 +1,38 @@ +syntax = "proto2"; + +import "autogen_xml_domain.proto"; + +package libvirt; + +message MainObj { + oneof new_device { + domainTag.devicesTag.soundTag T_sound = 1; + domainTag.devicesTag.filesystemTag T_filesystem = 2; + domainTag.devicesTag.inputTag T_input = 3; + domainTag.devicesTag.diskTag T_disk = 4; + domainTag.devicesTag.interfaceTag T_interface = 5; + domainTag.devicesTag.graphicsTag T_graphics = 6; + domainTag.devicesTag.serialTag T_serial = 7; + domainTag.devicesTag.parallelTag T_parallel = 8; + domainTag.devicesTag.channelTag T_channel = 9; + domainTag.devicesTag.consoleTag T_console = 10; + domainTag.devicesTag.controllerTag T_controller = 11; + domainTag.devicesTag.videoTag T_video = 12; + domainTag.devicesTag.rngTag T_rng = 13; + domainTag.devicesTag.watchdogTag T_watchdog = 14; + domainTag.devicesTag.memballoonTag T_memballoon = 15; + domainTag.devicesTag.smartcardTag T_smartcard = 16; + domainTag.devicesTag.redirdevTag T_redirdev = 17; + domainTag.devicesTag.audioTag T_audio = 18; + domainTag.devicesTag.cryptoTag T_crypto = 19; + domainTag.devicesTag.panicTag T_panic = 20; + domainTag.devicesTag.tpmTag T_tpm = 21; + domainTag.devicesTag.shmemTag T_shmem = 22; + domainTag.devicesTag.hostdevTag T_hostdev = 23; + domainTag.devicesTag.leaseTag T_lease = 24; + domainTag.devicesTag.redirfilterTag T_redirfilter = 25; + domainTag.devicesTag.iommuTag T_iommu = 26; + domainTag.devicesTag.vsockTag T_vsock = 27; + domainTag.devicesTag.nvramTag T_nvram = 28; + } +} diff --git a/tests/fuzz/qemu_xml_hotplug_fuzz.cc b/tests/fuzz/qemu_xml_hotplug_fuzz.cc new file mode 100644 index 0000000000..6e391c1f51 --- /dev/null +++ b/tests/fuzz/qemu_xml_hotplug_fuzz.cc @@ -0,0 +1,340 @@ +/* + * qemu_xml_hotplug_fuzz.cc: QEMU hotplug fuzzing harness + * + * Copyright (C) 2024 Rayhan Faizel + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> +#include "proto_header_common.h" + +#include <libxml/parser.h> +#include <libxml/tree.h> +#include <libxml/xpath.h> + +#include <unistd.h> +#include <sys/types.h> +#include <fcntl.h> +#include <stdio.h> +#include <stdarg.h> + +extern "C" { +#include "qemu/qemu_alias.h" +#include "qemu/qemu_conf.h" +#include "qemu/qemu_hotplug.h" +#include "qemumonitortestutils.h" +#include "testutils.h" +#include "testutilsqemu.h" +#include "testutilsqemuschema.h" +#include "virhostdev.h" +#include "virfile.h" +} + +#include "port/protobuf.h" +#include "proto_to_xml.h" +#include "src/libfuzzer/libfuzzer_macro.h" + +#define QEMU_HOTPLUG_FUZZ_DOMAIN_ID 7 + +uint64_t device_parse_pass = 0; +uint64_t device_attach_pass = 0; +uint64_t success_pass = 0; +uint64_t detach_success_pass = 0; + +bool enable_xml_dump = false; + +typedef struct { + virQEMUCaps *caps; + GHashTable *schema; +} qemuFuzzHotplugData; + +#define QMP_OK "{\"return\": {}}" +#define QMP_EMPTY_ARRAY "{\"return\": []}" + +std::string getBaseDomainXML(std::string arch) { + std::string result = "<domain type='qemu'>\n" + " <name>MyGuest</name>\n" + " <uuid>4dea22b3-1d52-d8f3-2516-782e98ab3fa0</uuid>\n" + " <os>\n" + " <type arch='" + arch + "'>hvm</type>\n" + " </os>\n" + " <memory>4096</memory>\n" + " <devices>\n"; + + if (arch == "aarch64" || arch == "armv7l" || + arch == "riscv64" || + arch == "loongarch64") { + result += "<controller type='pci' model='pcie-root'/>\n"; + } else { + result += "<controller type='pci' model='pci-root'/>\n"; + } + + /* s390x does not support USB */ + if (arch != "s390x") { + result += "<controller type='usb'/>\n"; + result += "<controller type='ccid'/>\n"; + } + + /* SATA is not supported on s390x and SPARC */ + if (arch != "s390x" && arch != "sparc") + result += "<controller type='sata'/>\n"; + + result += "<controller type='virtio-serial'/>\n"; + result += "<controller type='scsi'/>\n"; + + result += "<emulator>/usr/bin/qemu-system-" + arch + "</emulator>\n" + "</devices>\n" + "</domain>\n"; + + return result; +} + + +std::string getDeviceDeletedResponse(std::string dev) { + std::string result = "{" \ + " \"timestamp\": {" \ + " \"seconds\": 1374137171," \ + " \"microseconds\": 2659" \ + " }," \ + " \"event\": \"DEVICE_DELETED\"," \ + " \"data\": {" \ + " \"device\": \"" + dev + "\"," \ + " \"path\": \"/machine/peripheral/" + dev + "\"" \ + " }" \ + "}\r\n"; + + return result; +} + + +/* Table of QMP commands and dummy responses */ +std::unordered_map<std::string, std::string> qmp_cmd_table = { + {"device_add", QMP_OK}, + {"object-add", QMP_OK}, + {"object-del", QMP_OK}, + {"netdev_add", QMP_OK}, + {"netdev_del", QMP_OK}, + {"chardev-add", QMP_OK}, + {"chardev-remove", QMP_OK}, + {"blockdev-add", QMP_OK}, + {"blockdev-del", QMP_OK}, + {"qom-list", QMP_EMPTY_ARRAY}, + {"query-block", QMP_EMPTY_ARRAY}, + {"query-fds", QMP_EMPTY_ARRAY}, + {"set-action", QMP_OK}, + {"set_link", QMP_OK}, + {"query-fdsets", QMP_EMPTY_ARRAY}, + {"add-fd", "{ \"return\": { \"fdset-id\": 1, \"fd\": 95 }}"}, + {"block_set_io_throttle", QMP_OK}, +}; + + +char *qemuMonitorFuzzGetResponse(const char *command, + virJSONValue *cmdargs) +{ + if (STREQ(command, "device_del")) { + const char *id = virJSONValueObjectGetString(cmdargs, "id"); + std::string result = getDeviceDeletedResponse(id); + + return g_strdup(result.c_str()); + } + + if (qmp_cmd_table.find(command) != qmp_cmd_table.end()) { + return g_strdup(qmp_cmd_table[command].c_str()); + } + + /* If QMP command is unknown, assume QMP_OK and warn the user of the same. */ + printf("[FUZZ WARN]: Unknown QMP command: %s\n", command); + + return g_strdup(QMP_OK); +} + + +static void +fuzzXMLHotplug(virQEMUDriver *driver, + qemuFuzzHotplugData *hotplugData, + const char *domain_xml_string, + const char *device_xml_string) +{ + virDomainObj *vm = NULL; + virDomainDef *def = NULL; + virDomainDeviceDef *dev = NULL; + virDomainDeviceDef *remove_dev = NULL; + qemuDomainObjPrivate *priv = NULL; + g_autoptr(qemuMonitorTest) test_mon = NULL; + bool attach_success = false; + + if (!(def = virDomainDefParseString(domain_xml_string, driver->xmlopt, NULL, + VIR_DOMAIN_DEF_PARSE_INACTIVE))) { + + printf("Failed to parse domain XML!\n"); + exit(EXIT_FAILURE); + } + + if (!(vm = virDomainObjNew(driver->xmlopt))) + goto cleanup; + + vm->def = def; + priv = (qemuDomainObjPrivate *) vm->privateData; + priv->qemuCaps = hotplugData->caps; + + if (qemuDomainAssignAddresses(vm->def, hotplugData->caps, + driver, vm, true) < 0) { + goto cleanup; + } + + if (qemuAssignDeviceAliases(vm->def) < 0) + goto cleanup; + + vm->def->id = QEMU_HOTPLUG_FUZZ_DOMAIN_ID; + vm->fuzz = true; + + if (qemuDomainSetPrivatePaths(driver, vm) < 0) + goto cleanup; + + device_parse_pass++; + if (!(dev = virDomainDeviceDefParse(device_xml_string, vm->def, + driver->xmlopt, NULL, + VIR_DOMAIN_DEF_PARSE_INACTIVE))) + goto cleanup; + + /* Initialize test monitor + * + * Keep it after virDomainDeviceDefParse to avoid wasting time with monitor + * creation. + */ + + if (!(test_mon = qemuMonitorTestNew(driver->xmlopt, vm, NULL, hotplugData->schema))) + goto cleanup; + + /* Enable fuzzing mode of the test monitor */ + qemuMonitorTestFuzzSetup(test_mon, qemuMonitorFuzzGetResponse); + + priv->mon = qemuMonitorTestGetMonitor(test_mon); + + virObjectUnlock(priv->mon); + + device_attach_pass++; + + if (qemuDomainAttachDeviceLive(vm, dev, driver) == 0) { + success_pass++; + attach_success = true; + } + + if (attach_success) { + /* The previous virDomainDeviceDefParse cleared out the data in dev, so + * we need to reparse it before doing the detachment. + */ + remove_dev = virDomainDeviceDefParse(device_xml_string, vm->def, + driver->xmlopt, NULL, + 0); + + if (remove_dev && qemuDomainDetachDeviceLive(vm, remove_dev, driver, false) == 0) { + detach_success_pass++; + } + } + + virObjectLock(priv->mon); + + cleanup: + if (vm) { + priv->qemuCaps = NULL; + priv->mon = NULL; + vm->def = NULL; + + virDomainObjEndAPI(&vm); + } + + virDomainDeviceDefFree(remove_dev); + virDomainDeviceDefFree(dev); + virDomainDefFree(def); +} + + +DEFINE_PROTO_FUZZER(const libvirt::MainObj &message) +{ + static GHashTable *capscache = virHashNew(virObjectUnref); + static GHashTable *capslatest = testQemuGetLatestCaps(); + static GHashTable *qapiSchemaCache = virHashNew((GDestroyNotify) g_hash_table_unref); + + static qemuFuzzHotplugData *hotplugData = g_new0(qemuFuzzHotplugData, 1); + + static virQEMUDriver driver; + static bool initialized = false; + + static const char *arch_env = g_getenv("LPM_FUZZ_ARCH"); + static const char *dump_xml_env = g_getenv("LPM_XML_DUMP_INPUT"); + + static std::string arch = ""; + static std::string domain_xml = ""; + + std::string device_xml = ""; + + /* + * One-time setup of QEMU driver. Re-running them in every + * iteration incurs a significant penalty to the speed of the fuzzer. + */ + if (!initialized) { + FUZZ_COMMON_INIT(); + + if (qemuTestDriverInit(&driver) < 0) + exit(EXIT_FAILURE); + + driver.lockManager = virLockManagerPluginNew("nop", "qemu", + driver.config->configBaseDir, + 0); + + if (arch_env) { + arch = arch_env; + } else { + arch = "x86_64"; + } + + if (!(hotplugData->caps = testQemuGetRealCaps(arch.c_str(), "latest", "", + capslatest, capscache, + qapiSchemaCache, &hotplugData->schema))) { + printf("Failed to setup QEMU capabilities (invalid arch?)\n"); + exit(EXIT_FAILURE); + } + + if (qemuTestCapsCacheInsert(driver.qemuCapsCache, hotplugData->caps) < 0) + exit(EXIT_FAILURE); + + if (!(driver.hostdevMgr = virHostdevManagerGetDefault())) + exit(EXIT_FAILURE); + + virEventRegisterDefaultImpl(); + + domain_xml = getBaseDomainXML(arch); + + /* Enable printing of XML to stdout (useful for debugging crashes) */ + if (dump_xml_env && STREQ(dump_xml_env, "YES")) + enable_xml_dump = true; + + initialized = true; + } + + convertProtoToXML(message, device_xml); + + if (enable_xml_dump) + printf("%s\n", device_xml.c_str()); + + fuzzXMLHotplug(&driver, hotplugData, domain_xml.c_str(), device_xml.c_str()); + + if (device_parse_pass % 1000 == 0) + printf("[FUZZ METRICS] Device parse: %lu, Device Attach: %lu, Attached: %lu, Detached: %lu\n", + device_parse_pass, device_attach_pass, success_pass, detach_success_pass); +} diff --git a/tests/fuzz/run_fuzz.in b/tests/fuzz/run_fuzz.in index da3c7935b7..414b99b6cf 100644 --- a/tests/fuzz/run_fuzz.in +++ b/tests/fuzz/run_fuzz.in @@ -113,6 +113,11 @@ env["LPM_EXE_PATH"] = exe_path process_args.extend(["-print_funcs=-1"]) +if args.fuzzer == "qemu_xml_hotplug_fuzz": + # LSAN slows down the hotplug fuzzer to a crawl, + # so we have to disable LeakSanitizer + env["ASAN_OPTIONS"] = "detect_leaks=0" + if args.libfuzzer_options: process_args.extend([x for x in args.libfuzzer_options.split(' ') if x != '']) diff --git a/tests/qemumonitortestutils.c b/tests/qemumonitortestutils.c index 88a369188e..448710957e 100644 --- a/tests/qemumonitortestutils.c +++ b/tests/qemumonitortestutils.c @@ -83,8 +83,14 @@ struct _qemuMonitorTest { virDomainObj *vm; GHashTable *qapischema; + + bool fuzz; + qemuMonitorFuzzResponseCallback fuzz_response_cb; }; +static int +qemuMonitorFuzzProcessCommandDefault(qemuMonitorTest *test, + const char *cmdstr); static void qemuMonitorTestItemFree(qemuMonitorTestItem *item) @@ -227,6 +233,11 @@ qemuMonitorTestProcessCommand(qemuMonitorTest *test, VIR_DEBUG("Processing string from monitor handler: '%s", cmdstr); + /* In fuzzing mode, process indefinite number of commands */ + if (test->fuzz) { + return qemuMonitorFuzzProcessCommandDefault(test, cmdstr); + } + if (test->nitems == 0) { qemuMonitorTestError("unexpected command: '%s'", cmdstr); } else { @@ -595,6 +606,34 @@ qemuMonitorTestAddItem(qemuMonitorTest *test, } +static int +qemuMonitorFuzzProcessCommandDefault(qemuMonitorTest *test, + const char *cmdstr) +{ + g_autoptr(virJSONValue) val = NULL; + virJSONValue *cmdargs = NULL; + + const char *cmdname = NULL; + g_autofree char *response = NULL; + + if (!(val = virJSONValueFromString(cmdstr))) + return -1; + + if (!(cmdname = virJSONValueObjectGetString(val, "execute"))) { + qemuMonitorTestError("Missing command name in %s", cmdstr); + return -1; + } + + cmdargs = virJSONValueObjectGet(val, "arguments"); + + response = test->fuzz_response_cb(cmdname, cmdargs); + + qemuMonitorTestAddResponse(test, response); + + return 0; +} + + static int qemuMonitorTestProcessCommandVerbatim(qemuMonitorTest *test, qemuMonitorTestItem *item, @@ -1021,6 +1060,15 @@ qemuMonitorTestSkipDeprecatedValidation(qemuMonitorTest *test, } +void +qemuMonitorTestFuzzSetup(qemuMonitorTest *test, + qemuMonitorFuzzResponseCallback response_cb) +{ + test->fuzz = true; + test->fuzz_response_cb = response_cb; +} + + static int qemuMonitorTestFullAddItem(qemuMonitorTest *test, const char *filename, diff --git a/tests/qemumonitortestutils.h b/tests/qemumonitortestutils.h index 6d26526f60..105bd10486 100644 --- a/tests/qemumonitortestutils.h +++ b/tests/qemumonitortestutils.h @@ -29,6 +29,8 @@ typedef struct _qemuMonitorTestItem qemuMonitorTestItem; typedef int (*qemuMonitorTestResponseCallback)(qemuMonitorTest *test, qemuMonitorTestItem *item, const char *message); +typedef char *(*qemuMonitorFuzzResponseCallback)(const char *command, + virJSONValue *cmdargs); void qemuMonitorTestAddHandler(qemuMonitorTest *test, @@ -61,6 +63,10 @@ void qemuMonitorTestSkipDeprecatedValidation(qemuMonitorTest *test, bool allowRemoved); +void +qemuMonitorTestFuzzSetup(qemuMonitorTest *test, + qemuMonitorFuzzResponseCallback response_cb); + int qemuMonitorTestAddItem(qemuMonitorTest *test, const char *command_name, -- 2.34.1

This patch implements the harness for the Cloud-Hypervisor driver to fuzz XML parsing and XML-to-JSON generation including virCHMonitorBuildVMJson and virCHMonitorBuildNetJson. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> --- src/ch/ch_monitor.c | 2 +- src/ch/ch_monitor.h | 3 + tests/fuzz/ch_xml_domain_fuzz.cc | 157 +++++++++++++++++++++++++++++++ tests/fuzz/meson.build | 17 ++++ tests/fuzz/proto_to_xml.cc | 18 ++++ tests/fuzz/proto_to_xml.h | 2 + 6 files changed, 198 insertions(+), 1 deletion(-) create mode 100644 tests/fuzz/ch_xml_domain_fuzz.cc diff --git a/src/ch/ch_monitor.c b/src/ch/ch_monitor.c index 3e49902791..a10dd9f03d 100644 --- a/src/ch/ch_monitor.c +++ b/src/ch/ch_monitor.c @@ -423,7 +423,7 @@ virCHMonitorBuildDevicesJson(virJSONValue *content, return 0; } -static int +int virCHMonitorBuildVMJson(virCHDriver *driver, virDomainDef *vmdef, char **jsonstr) { diff --git a/src/ch/ch_monitor.h b/src/ch/ch_monitor.h index b35f5ea027..aec4a06de8 100644 --- a/src/ch/ch_monitor.h +++ b/src/ch/ch_monitor.h @@ -133,3 +133,6 @@ virCHMonitorBuildNetJson(virDomainNetDef *netdef, int virCHMonitorBuildRestoreJson(virDomainDef *vmdef, const char *from, char **jsonstr); +int +virCHMonitorBuildVMJson(virCHDriver *driver, virDomainDef *vmdef, + char **jsonstr); diff --git a/tests/fuzz/ch_xml_domain_fuzz.cc b/tests/fuzz/ch_xml_domain_fuzz.cc new file mode 100644 index 0000000000..6733f55378 --- /dev/null +++ b/tests/fuzz/ch_xml_domain_fuzz.cc @@ -0,0 +1,157 @@ +/* + * ch_xml_domain_fuzz.cc: Cloud-Hypervisor domain fuzzing harness + * + * Copyright (C) 2024 Rayhan Faizel + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> +#include "proto_header_common.h" + +#include <libxml/parser.h> +#include <libxml/tree.h> +#include <libxml/xpath.h> + +#include <unistd.h> +#include <sys/types.h> +#include <fcntl.h> +#include <stdio.h> +#include <stdarg.h> + +extern "C" { +#include <testutils.h> +#include "ch/ch_conf.h" +#include "ch/ch_monitor.h" +} + +#include "port/protobuf.h" +#include "proto_to_xml.h" +#include "src/libfuzzer/libfuzzer_macro.h" + +uint64_t parse_pass = 0; +uint64_t format_pass = 0; +uint64_t command_line_pass = 0; +uint64_t success = 0; +uint64_t net = 0; +uint64_t net_success = 0; + +bool enable_xml_dump = false; +bool enable_xml_format = false; + +extern std::string emulator; + +static void +fuzzXMLToCommandLine(virCHDriver *driver, + const char *xml_string) +{ + virDomainDef *def = NULL; + g_autofree char *formatted_xml = NULL; + g_autofree char *json_str = NULL; + size_t i; + + parse_pass++; + if (!(def = virDomainDefParseString(xml_string, driver->xmlopt, NULL, + VIR_DOMAIN_DEF_PARSE_INACTIVE))) + goto cleanup; + + if (enable_xml_format) { + format_pass++; + if (!(formatted_xml = virDomainDefFormat(def, driver->xmlopt, + VIR_DOMAIN_DEF_FORMAT_SECURE))) + goto cleanup; + } + + command_line_pass++; + + if (virCHMonitorBuildVMJson(driver, def, &json_str) < 0) + goto cleanup; + success++; + + for (i = 0; i < def->nnets; i++) { + net++; + if (virCHMonitorBuildNetJson(def->nets[i], i, &json_str) == 0) + net_success++; + } + + cleanup: + virDomainDefFree(def); +} + + +DEFINE_PROTO_FUZZER(const libvirt::MainObj &message) +{ + static virCHDriver *driver; + static bool initialized = false; + + static const char *dump_xml_env = g_getenv("LPM_XML_DUMP_INPUT"); + static const char *format_xml_env = g_getenv("LPM_XML_FORMAT_ENABLE"); + + std::string xml = ""; + + + /* + * One-time setup of CH driver. Re-running them in every + * iteration incurs a significant penalty to the speed of the fuzzer. + */ + if (!initialized) { + FUZZ_COMMON_INIT(); + + driver = g_new0(virCHDriver, 1); + + if (!(driver->caps = virCHDriverCapsInit())) { + printf("Unable to initialize driver capabilities\n"); + exit(EXIT_FAILURE); + } + + virCapsGuest *guest = driver->caps->guests[0]; + + /* Add KVM and HYPERV capabilities */ + virCapabilitiesAddGuestDomain(guest, VIR_DOMAIN_VIRT_KVM, + NULL, NULL, 0, NULL); + + virCapabilitiesAddGuestDomain(guest, VIR_DOMAIN_VIRT_HYPERV, + NULL, NULL, 0, NULL); + + if (!(driver->xmlopt = chDomainXMLConfInit(driver))) { + printf("Unable to initialize driver XMLOPT\n"); + exit(EXIT_FAILURE); + } + + emulator = "/usr/bin/cloud-hypervisor"; + + /* Enable printing of XML to stdout (useful for debugging crashes) */ + if (dump_xml_env && STREQ(dump_xml_env, "YES")) + enable_xml_dump = true; + + /* Enable fuzzing of XML formatting */ + if (format_xml_env && STREQ(format_xml_env, "YES")) + enable_xml_format = true; + + initialized = true; + } + + convertProtoToCHXMLDomain(message, xml); + + if (enable_xml_dump) + printf("%s\n", xml.c_str()); + + fuzzXMLToCommandLine(driver, xml.c_str()); + + if (parse_pass % 1000 == 0) + printf("[FUZZ METRICS] Parse: %lu, Format: %lu, Cmdline: %lu, Success: %lu, Network: %lu, Network Success: %lu\n", + parse_pass, format_pass, command_line_pass, success, net, net_success); + +} diff --git a/tests/fuzz/meson.build b/tests/fuzz/meson.build index 9579f56749..bb27c2843d 100644 --- a/tests/fuzz/meson.build +++ b/tests/fuzz/meson.build @@ -57,6 +57,23 @@ if conf.has('WITH_QEMU') ] endif +if conf.has('WITH_CH') + fuzzer_src = [ + 'ch_xml_domain_fuzz.cc', + 'proto_to_xml.cc', + ] + + ch_libs = [ + ch_driver_impl, + test_utils_lib, + libvirt_lib, + ] + + xml_fuzzers += [ + { 'name': 'ch_xml_domain_fuzz', 'src': [ fuzzer_src, xml_domain_proto_src ], 'libs': ch_libs, 'macro': '-DXML_DOMAIN', 'deps': [ fuzz_autogen_xml_domain_dep ] }, + ] +endif + foreach fuzzer: xml_fuzzers xml_domain_fuzz = executable(fuzzer['name'], fuzzer['src'], diff --git a/tests/fuzz/proto_to_xml.cc b/tests/fuzz/proto_to_xml.cc index 36ad1028b1..40858e4779 100644 --- a/tests/fuzz/proto_to_xml.cc +++ b/tests/fuzz/proto_to_xml.cc @@ -216,6 +216,24 @@ void convertProtoToQEMUXMLDomain(const libvirt::MainObj &message, } +void convertProtoToCHXMLDomain(const libvirt::MainObj &message, + std::string &xml) +{ + xml = "<domain type='kvm'>\n" + " <name>MyGuest</name>\n" + " <uuid>4dea22b3-1d52-d8f3-2516-782e98ab3fa0</uuid>\n" + " <os>\n" + " <type>hvm</type>\n" + " <kernel>hypervisor-fw</kernel>\n" + " </os>\n" + " <memory>4096</memory>\n"; + + convertProtoToXMLInternal(message, xml, true); + + xml += "</domain>\n"; +} + + void convertProtoToXML(const libvirt::MainObj &message, std::string &xml) { diff --git a/tests/fuzz/proto_to_xml.h b/tests/fuzz/proto_to_xml.h index a87547a319..5c76772c5f 100644 --- a/tests/fuzz/proto_to_xml.h +++ b/tests/fuzz/proto_to_xml.h @@ -27,5 +27,7 @@ void convertProtoToQEMUXMLDomain(const libvirt::MainObj &message, std::string arch, std::string &xml); +void convertProtoToCHXMLDomain(const libvirt::MainObj &message, + std::string &xml); void convertProtoToXML(const libvirt::MainObj &message, std::string &xml); -- 2.34.1

This patch adds the harness for the xen driver to fuzz XML parsing, domconfig generation and JSON conversion. libxlmock.so is required to make the libXL fuzzer work outside of xen hosts. However, LD_PRELOAD breaks the fuzzer when ASAN/UBSAN is present. This is because LD_PRELOAD gets propagated to llvm-symbolizer which is undesirable and causes various undefined symbol errors. We add a wrapper binary which execs the real llvm-symbolizer with the environment unset. However, LD_PRELOAD still breaks parallel fuzzing so it is disabled for the time being. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> --- tests/fuzz/libxl_xml_domain_fuzz.cc | 159 +++++++++++++++++++++++++++ tests/fuzz/llvm_symbolizer_wrapper.c | 11 ++ tests/fuzz/meson.build | 31 ++++++ tests/fuzz/proto_to_xml.cc | 18 +++ tests/fuzz/proto_to_xml.h | 3 + tests/fuzz/run_fuzz.in | 15 +++ 6 files changed, 237 insertions(+) create mode 100644 tests/fuzz/libxl_xml_domain_fuzz.cc create mode 100644 tests/fuzz/llvm_symbolizer_wrapper.c diff --git a/tests/fuzz/libxl_xml_domain_fuzz.cc b/tests/fuzz/libxl_xml_domain_fuzz.cc new file mode 100644 index 0000000000..a8fcb62d06 --- /dev/null +++ b/tests/fuzz/libxl_xml_domain_fuzz.cc @@ -0,0 +1,159 @@ +/* + * libxl_xml_domain_fuzz.cc: libXL domain fuzzing harness + * + * Copyright (C) 2024 Rayhan Faizel + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * <http://www.gnu.org/licenses/>. + */ + +#include <config.h> +#include "proto_header_common.h" + +#include <libxml/parser.h> +#include <libxml/tree.h> +#include <libxml/xpath.h> + +#include <unistd.h> +#include <sys/types.h> +#include <fcntl.h> +#include <stdio.h> +#include <stdarg.h> + +extern "C" { +#include "testutils.h" +#include "internal.h" +#include "libxl/libxl_conf.h" +#include "testutilsxen.h" +} + +#include "port/protobuf.h" +#include "proto_to_xml.h" +#include "src/libfuzzer/libfuzzer_macro.h" + +uint64_t parse_pass = 0; +uint64_t format_pass = 0; +uint64_t config_pass = 0; +uint64_t json_pass = 0; +uint64_t command_line_pass = 0; +uint64_t success = 0; + +bool enable_xml_dump = false; +bool enable_xml_format = false; + +static void +fuzzXMLToCommandLine(libxlDriverPrivate *driver, + const char *xml_string) +{ + virDomainDef *def = NULL; + const char *formatted_xml = NULL; + g_autofree char *json_string = NULL; + libxl_domain_config config; + virPortAllocatorRange *gports = NULL; + bool config_init = false; + + g_autoptr(libxlDriverConfig) cfg = libxlDriverConfigGet(driver); + + parse_pass++; + if (!(def = virDomainDefParseString(xml_string, driver->xmlopt, NULL, + VIR_DOMAIN_DEF_PARSE_INACTIVE))) + goto cleanup; + + if (enable_xml_format) { + format_pass++; + if (!(formatted_xml = virDomainDefFormat(def, driver->xmlopt, + VIR_DOMAIN_DEF_FORMAT_SECURE))) + goto cleanup; + } + + libxl_domain_config_init(&config); + config_init = true; + + if (!(gports = virPortAllocatorRangeNew("vnc", 5900, 6000))) + goto cleanup; + + config_pass++; + if (libxlBuildDomainConfig(gports, def, cfg, &config) < 0) + goto cleanup; + + json_pass++; + if (!(json_string = libxl_domain_config_to_json(cfg->ctx, &config))) + goto cleanup; + + success++; + + cleanup: + + virPortAllocatorRangeFree(gports); + if (config_init) + libxl_domain_config_dispose(&config); + virDomainDefFree(def); +} + + +DEFINE_PROTO_FUZZER(const libvirt::MainObj &message) +{ + static libxlDriverPrivate *driver = NULL; + + static bool initialized = false; + + static const char *arch_env = g_getenv("LPM_FUZZ_ARCH"); + static const char *dump_xml_env = g_getenv("LPM_XML_DUMP_INPUT"); + static const char *format_xml_env = g_getenv("LPM_XML_FORMAT_ENABLE"); + + static std::string arch = ""; + + std::string xml = ""; + + + /* + * One-time setup of libXL driver. Re-running them in every + * iteration incurs a significant penalty to the speed of the fuzzer. + */ + if (!initialized) { + FUZZ_COMMON_INIT(); + + /* NOTE: Driver initialization will fail without libxlmock */ + if ((driver = testXLInitDriver()) == NULL) + exit(EXIT_FAILURE); + + if (arch_env) { + arch = arch_env; + } else { + arch = "x86_64"; + } + + /* Enable printing of XML to stdout (useful for debugging crashes) */ + if (dump_xml_env && STREQ(dump_xml_env, "YES")) + enable_xml_dump = true; + + /* Enable fuzzing of XML formatting */ + if (format_xml_env && STREQ(format_xml_env, "YES")) + enable_xml_format = true; + + initialized = true; + } + + convertProtoTolibXLXMLDomain(message, arch, xml); + + if (enable_xml_dump) + printf("%s\n", xml.c_str()); + + fuzzXMLToCommandLine(driver, xml.c_str()); + + if (parse_pass % 1000 == 0) + printf("[FUZZ METRICS] Parse: %lu, Format: %lu, Config: %lu, JSON: %lu, Success: %lu\n", + parse_pass, format_pass, config_pass, json_pass, success); + +} diff --git a/tests/fuzz/llvm_symbolizer_wrapper.c b/tests/fuzz/llvm_symbolizer_wrapper.c new file mode 100644 index 0000000000..d0aeba61fe --- /dev/null +++ b/tests/fuzz/llvm_symbolizer_wrapper.c @@ -0,0 +1,11 @@ +#include <config.h> + +#include <stdlib.h> +#include <unistd.h> + +int main(int argc, char **argv) { + // Avoid unused error. + (void) argc; + + execve("/usr/bin/llvm-symbolizer", argv, NULL); +} diff --git a/tests/fuzz/meson.build b/tests/fuzz/meson.build index 88b5fe103c..417b8dc1ef 100644 --- a/tests/fuzz/meson.build +++ b/tests/fuzz/meson.build @@ -90,6 +90,24 @@ if conf.has('WITH_VMX') ] endif +if conf.has('WITH_LIBXL') + fuzzer_src = [ + 'libxl_xml_domain_fuzz.cc', + 'proto_to_xml.cc', + ] + + libxl_libs = [ + test_xen_driver_lib, + test_utils_xen_lib, + test_utils_lib, + libvirt_lib, + ] + + xml_fuzzers += [ + { 'name': 'libxl_xml_domain_fuzz', 'src': [ fuzzer_src, xml_domain_proto_src ], 'libs': libxl_libs, 'macro': '-DXML_DOMAIN', 'deps': [ fuzz_autogen_xml_domain_dep, libxl_dep ] }, + ] +endif + foreach fuzzer: xml_fuzzers xml_domain_fuzz = executable(fuzzer['name'], fuzzer['src'], @@ -102,6 +120,19 @@ foreach fuzzer: xml_fuzzers available_fuzzers += '"' + fuzzer['name'] + '"' + ',' endforeach +# Wrapper binary which execs the real llvm-symbolizer but +# unsets the env vars to avoid propagating LD_PRELOAD to the +# real llvm-symbolizer and causing undefined symbol errors when ASAN/UBSAN +# is enabled. + +llvm_symbolizer_wrapper = executable( + 'llvm-symbolizer-wrapper', + 'llvm_symbolizer_wrapper.c', + dependencies: [ + tests_dep, + ], +) + run_conf = configuration_data({ 'abs_builddir': meson.project_build_root(), 'available_fuzzers': available_fuzzers, diff --git a/tests/fuzz/proto_to_xml.cc b/tests/fuzz/proto_to_xml.cc index 983256bcae..fde3394cc7 100644 --- a/tests/fuzz/proto_to_xml.cc +++ b/tests/fuzz/proto_to_xml.cc @@ -252,6 +252,24 @@ void convertProtoToVMXXMLDomain(const libvirt::MainObj &message, } +void convertProtoTolibXLXMLDomain(const libvirt::MainObj &message, + std::string arch, + std::string &xml) +{ + xml = "<domain type='xen'>\n" + " <name>MyGuest</name>\n" + " <uuid>4dea22b3-1d52-d8f3-2516-782e98ab3fa0</uuid>\n" + " <os>\n" + " <type arch='" + arch + "'>hvm</type>\n" + " </os>\n" + " <memory>4096</memory>\n"; + + convertProtoToXMLInternal(message, xml, true); + + xml += "</domain>\n"; +} + + void convertProtoToXML(const libvirt::MainObj &message, std::string &xml) { diff --git a/tests/fuzz/proto_to_xml.h b/tests/fuzz/proto_to_xml.h index 89e6726611..b4849890cc 100644 --- a/tests/fuzz/proto_to_xml.h +++ b/tests/fuzz/proto_to_xml.h @@ -32,5 +32,8 @@ void convertProtoToCHXMLDomain(const libvirt::MainObj &message, void convertProtoToVMXXMLDomain(const libvirt::MainObj &message, std::string arch, std::string &xml); +void convertProtoTolibXLXMLDomain(const libvirt::MainObj &message, + std::string arch, + std::string &xml); void convertProtoToXML(const libvirt::MainObj &message, std::string &xml); diff --git a/tests/fuzz/run_fuzz.in b/tests/fuzz/run_fuzz.in index 414b99b6cf..a2b0c66c32 100644 --- a/tests/fuzz/run_fuzz.in +++ b/tests/fuzz/run_fuzz.in @@ -118,6 +118,21 @@ if args.fuzzer == "qemu_xml_hotplug_fuzz": # so we have to disable LeakSanitizer env["ASAN_OPTIONS"] = "detect_leaks=0" +if args.fuzzer == "libxl_xml_domain_fuzz": + # To make LD_PRELOAD work without running into undefined symbol + # errors, we need to override ASAN_SYMBOLIZER_PATH with a wrapper + # that unsets LD_PRELOAD before running the real llvm-symbolizer. + + env["ASAN_SYMBOLIZER_PATH"] = llvm_symbolizer_path + env["LD_PRELOAD"] = f"{abs_builddir}/tests/libxlmock.so" + + # Note: Above workaround breaks multithreaded mode, + # so inform the user of the same. + + if args.jobs > 1: + print("libxl_xml_domain_fuzz cannot be used in parallel mode.") + sys.exit(1) + if args.libfuzzer_options: process_args.extend([x for x in args.libfuzzer_options.split(' ') if x != '']) -- 2.34.1

Document the fuzzers in two ways. 1. Explain the high level working of the fuzzers under docs/kbase. 2. Add README to explain general setup of the fuzzer and its usage. Signed-off-by: Rayhan Faizel <rayhan.faizel@gmail.com> --- docs/kbase/index.rst | 3 + docs/kbase/internals/meson.build | 1 + docs/kbase/internals/xml-fuzzing.rst | 120 ++++++++++++++++++++++++ tests/fuzz/README.rst | 131 +++++++++++++++++++++++++++ 4 files changed, 255 insertions(+) create mode 100644 docs/kbase/internals/xml-fuzzing.rst create mode 100644 tests/fuzz/README.rst diff --git a/docs/kbase/index.rst b/docs/kbase/index.rst index e51b35cbfc..9cf6268800 100644 --- a/docs/kbase/index.rst +++ b/docs/kbase/index.rst @@ -116,3 +116,6 @@ Internals `QEMU monitor event handling <internals/qemu-event-handlers.html>`__ Brief outline how events emitted by qemu on the monitor are handlded. + +`XML Fuzzing <internals/xml-fuzzing.html>`__ + Working of the structure-aware XML fuzzers. diff --git a/docs/kbase/internals/meson.build b/docs/kbase/internals/meson.build index f1e9122f8f..86b6639419 100644 --- a/docs/kbase/internals/meson.build +++ b/docs/kbase/internals/meson.build @@ -9,6 +9,7 @@ docs_kbase_internals_files = [ 'qemu-migration', 'qemu-threads', 'rpc', + 'xml-fuzzing', ] diff --git a/docs/kbase/internals/xml-fuzzing.rst b/docs/kbase/internals/xml-fuzzing.rst new file mode 100644 index 0000000000..85f565fda5 --- /dev/null +++ b/docs/kbase/internals/xml-fuzzing.rst @@ -0,0 +1,120 @@ +=================== +Libvirt XML fuzzing +=================== + +XML fuzzing is done using libFuzzer and libprotobuf-mutator. XML fuzzing +cannot be done with normal fuzzing methods, as XML is a highly structured +format. Structure-aware fuzzing is implemented using libprotobuf-mutator which +mutates and fuzzes protobuf inputs. Protobufs are used as an intermediate +format and serialized to XML. + +Protobuf to XML representation +============================== + +A protobuf definition written to fuzz libvirt XML formats may resemble the +following. + +:: + + message MainObj { + message SomeTagMessage { + optional uint32 A_number = 1; + optional DummyString A_name = 2; + + enum typeEnum { + typeA = 0; + typeB = 1; + typeC = 2; + } + + optional typeEnum A_type = 3; + + message InnerTagMessage { + optional uint32 A_number = 1; + } + + repeated InnerTagMessage T_innertag = 4; + + message SecondInnerTagMessage { + optional uint32 V_value = 1; + } + optional SecondInnerTagMessage T_secondinner = 5; + } + + optional SomeTagMessage T_sometag = 1; + } + +* Fields starting with ``T_`` represent XML tags. Their types are protobuf messages + which may further contain other protobuf-defined XML tags or attributes. + +* Fields starting with ``A_`` represent XML attributes. Most of the time, + it uses one of the primitive datatypes (Eg: ``uint32``, ``bool``, ``enum``, etc. ) available in protobuf. + + * If the attribute can take multiple data types, it is encapsulated in a ``oneof`` statement. + The field name also has a prefix of ``A_OPTXX_`` where ``XX`` is a number between 0 to 99. + * If the attribute name contains special characters, the real name is stored in + ``libvirt::real_name`` which is extended by ``FieldOptions``. + * If an enum value contains special characters, the real value is stored in + ``libvirt::real_value`` which is extended by ``EnumValueOptions``. + +* Fields starting with ``V_`` represent raw text in XML. + + * If ``T_`` and ``V_`` fields are defined in the same message, ``V_`` fields + will be preferred only if it has presence, otherwise it will process the + rest of the ``T`` fields as usual. + * ``V_`` fields can take on the same datatypes as ``A_`` fields. + +* ``repeated`` is used to allow multiple XML tags of the same name. + +``A_`` fields must always precede ``V_`` and ``T_`` fields. Likewise, ``V_`` +fields must precede ``T_`` fields if any. + +On fuzzing the above protobuf definition, one of the possible protobuf to XML +serializations could be + +:: + + <sometag number='1' name='dummy' type='typeB'> + <innertag number='2'/> + <innertag number='3'/> + <secondinner>1241232</secondinner> + </sometag> + +Custom Protobuf Datatypes +------------------------- + +Sometimes, primitive data types or enums are not enough to encode the +desired attribute values, especially if they themselves are structured. In this +case, such fields are represented by a handwritten protobuf message defined in +``xml_domain_datatypes.proto``. To serialize these messages to XML attribute +values, custom handlers are defined in ``proto_custom_datatypes.cc``. + +This is useful for data types such as IP addresses, MAC addresses, target +device names, etc. + +Protobuf generation +=================== + +``proto`` files are automatically generated on compile-time using the script +``relaxng_to_proto.py``. The script parses relaxng schemas to generate a protobuf +file containing fields and messages representing all the defined XML tags and +attributes. + +The script tries to figure out the correct datatype of the XML attribute. +However, on its own it can only figure out the general datatype or enum values +of the attribute but not the constraints or regex patterns. Some override tables +are present to improve upon that. + +Fuzzer Harnesses +================ + +Driver-specific harnesses in general re-use the existing test driver setup +as well as other existing test utilities under ``tests/``. Harnesses are +available for the following drivers: + +* QEMU XML Domain +* QEMU XML Hotplug +* CH XML Domain +* VMX XML Domain +* libXL XML Domain +* NWFilter XML diff --git a/tests/fuzz/README.rst b/tests/fuzz/README.rst new file mode 100644 index 0000000000..d92cdc94d7 --- /dev/null +++ b/tests/fuzz/README.rst @@ -0,0 +1,131 @@ +======= +Fuzzing +======= + +The XML fuzzing project was built as part of Google Summer of Code 2024. +The fuzzing project aims to find edge-case XML configurations that may crash +libvirt during parsing. The libvirt domain XML format is a highly structured +grammar so normal methods of fuzzing will not work. We use a combination +of libFuzzer and libprotobuf-mutator to perform structure-aware fuzzing of +various libvirt XML formats. The XML is represented through an intermediate +protobuf that is mutated by libprotobuf-mutator. This protobuf is automatically +generated by a Python script ``relaxng_to_proto.py`` which parses relaxNG +schemas. + +Currently, we fuzz the following: + +* QEMU XML Domain (qemu_xml_domain_fuzz, qemu_xml_domain_fuzz_disk, qemu_xml_domain_fuzz_interface) +* QEMU XML Hotplug (qemu_xml_hotplug_fuzz) +* CH XML Domain (ch_xml_domain_fuzz) +* VMX XML Domain (vmx_xml_domain_fuzz) +* LibXL XML Domain (libxl_xml_domain_fuzz) +* NWFilter XML (xml_nwfilter_fuzz) + +libprotobuf-mutator +=================== + +libprotobuf-mutator is the crux of our fuzzing methodology that +allows us to perform grammar-aware fuzzing of the XML format in the first +place. However, its setup is a bit involved. The general build and install +instructions can be followed in +https://github.com/google/libprotobuf-mutator/blob/master/README.md +but we will have to tweak it depending on the distro. One of the biggest +problems is that most distros have very outdated versions of protobuf +which will cause various build and linkage issues with the mutator. + +- If you are on a rolling release distro, the system package can likely be + used as-is. However, you may need to pass ``-std=c++17`` in ``CXXFLAGS`` + and ``-Wl,--copy-dt-needed-entries`` in ``LDFLAGS``.\ +- For every other distro with old protobuf installations, you can supply + ``-DLIB_PROTO_MUTATOR_DOWNLOAD_PROTOBUF=ON`` during libprotobuf-mutator + setup. After this, provide ``-Dexternal_protobuf_dir=<dir>`` to libvirt + meson setup pointing to the ``external.protobuf`` directory generated + during libprotobuf-mutator compilation. +- On some distros like Fedora which predominantly use PIC compiled + libraries, you may need to pass ``-fPIC`` in ``CFLAGS/CXXFLAGS`` or you + will encounter relocation errors during libvirt compilation. + +Setup +===== + +:: + + env CC=clang CXX=clang++ \ + meson setup build -Dsystem=true -Ddriver_qemu=enabled -Db_lundef=false \ + -Db_sanitize=address,undefined -Dfuzz=enabled -Dexternal_protobuf_dir=<dir> + +- This command line will introduce LLVM SanitizerCoverage across all + object files. +- libFuzzer is supported only on clang/clang++. +- To use an external protobuf dependency, use + ``-Dexternal_protobuf_dir=<dir>``. If your system has a new enough protobuf + dependency, you can ignore this. +- ``b_sanitize`` is not compulsory but it does improve the odds of the fuzzer + finding interesting test cases. It is recommended to pass + ``address,undefined`` to enable both ASAN and UBSan. Note that ASAN will + cut your performance by a factor of 2 on average. +- You can set ``b_sanitize`` to ``thread`` to enable TSAN which is useful for + fuzzing race conditions in the ``qemu_xml_hotplug_fuzz`` fuzzer especially. + +NOTE: This has only been tested on x86_64 and aarch64 Linux, but should work +identically on other architectures and possibly even other UNIX based OSes +(BSD, macOS, etc.). + +Usage +===== + +Run ``./tests/fuzz/run_fuzz <fuzzer>``. + +If the fuzzer finds a crashing test case, it will dump a separate file in your +working directory. Run +``./tests/fuzz/run_fuzz <fuzzer> --testcase <file_name>`` to reproduce the crash. +More options to configure the fuzzer can be found with the ``-h`` flag. To save/ +load a corpus, add ``--corpus <corpus_dir>``. + +To merge or minimize corpuses, run +:: + ./tests/fuzz/run_fuzz <fuzzer> --libfuzzer-options="-merge=1 <dest_corpus> <src_corpus>" + +Notable options are listed below. + +- ``--arch``: Set architecture of the domain XML to fuzz. +- ``-j, --jobs``: Run parallel fuzzing workers using either ``jobs`` or + ``fork`` based on ``--parallel-mode``. Eg: + ``./tests/fuzz/run_fuzz qemu_xml_domain_fuzz -j8 --parallel-mode fork``. +- ``--dump-xml``: Print all fuzzed XMLs (useful for debugging reproducers) +- ``--format-xml``: Exercise format function on XML domain fuzzers. +- ``--corpus``: Save or use corpus on-disk. +- ``--libfuzzer-options``: Pass additional libFuzzer flags as documented in + https://llvm.org/docs/LibFuzzer.html#options. + +Coverage Report +=============== + +- libvirt supports instrumenting builds with gcov for coverage data collection + using ``-Dtest_coverage=true``. +:: + + ./tests/fuzz/run_fuzz <fuzzer> --total_time=<duration> --corpus=<corpus_dir> + ./tests/fuzz/run_fuzz <fuzzer> --corpus=<corpus_dir> --libfuzzer-options="-runs=0" + find -name '*.gcda' -exec llvm-cov gcov {} \; # Run in build directory + gcovr --gcov-executable "llvm-cov gcov" --html-details coverage.html -r <source_directory> + +- Alternatively, we can use clang profile coverage instrumentation + enabled with ``-Dtest_coverage_clang=true``. +:: + + ./tests/fuzz/run_fuzz <fuzzer> --total_time=<duration> --corpus=<corpus_dir> + ./tests/fuzz/run_fuzz <fuzzer> --corpus=<corpus_dir> --llvm-profile-file=coverage.profraw + llvm-profdata merge coverage.profraw -output coverage.profdata + llvm-cov show --instr-profile coverage.profdata <objects> --sources <sources> --format html > coverage.html + +Tips +==== + +- libFuzzer will try to pass comparison checks using its internal TORC + (Table of Recent Comparisons), but this can get easily overwhelmed in the + case of libvirt due to its code being quite complex. You can alleviate + this to some extent by passing ``--use-value-profile`` to the fuzzer. +- If you want the fuzzer to proceed even after encountering a crash, + add ``-j<N> --parallel-mode=fork``. Do note that the memory usage will + increase exponentially with each parallel fuzzing worker. -- 2.34.1