* [PULL for-5.0 1/4] fuzz: select fuzz target using executable name
2020-05-01 8:26 [PULL for-5.0 0/4] Block patches Stefan Hajnoczi
@ 2020-05-01 8:26 ` Stefan Hajnoczi
0 siblings, 0 replies; 2+ messages in thread
From: Stefan Hajnoczi @ 2020-05-01 8:26 UTC (permalink / raw)
To: qemu-devel
Cc: Fam Zheng, Peter Maydell, Ronnie Sahlberg, Yuval Shaia,
Gerd Hoffmann, qemu-block, Juan Quintela, Markus Armbruster,
Laurent Vivier, Thomas Huth, Stefan Weil, Peter Lieven,
Dr. David Alan Gilbert, Alexander Bulekov, Alex Williamson,
Stefan Hajnoczi, Kevin Wolf, Darren Kenny, Bandan Das, Max Reitz,
Paolo Bonzini
From: Alexander Bulekov <alxndr@bu.edu>
The fuzzers are built into a binary (e.g. qemu-fuzz-i386). To select the
device to fuzz/fuzz target, we usually use the --fuzz-target= argument.
This commit allows the fuzz-target to be specified using the name of the
executable. If the executable name ends with -target-FUZZ_TARGET, then
we select the fuzz target based on this name, rather than the
--fuzz-target argument. This is useful for systems such as oss-fuzz
where we don't have control of the arguments passed to the fuzzer.
[Fixed incorrect indentation.
--Stefan]
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-id: 20200421182230.6313-1-alxndr@bu.edu
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
tests/qtest/fuzz/fuzz.c | 19 +++++++++++--------
slirp | 2 +-
2 files changed, 12 insertions(+), 9 deletions(-)
diff --git a/tests/qtest/fuzz/fuzz.c b/tests/qtest/fuzz/fuzz.c
index 0d78ac8d36..f5c923852e 100644
--- a/tests/qtest/fuzz/fuzz.c
+++ b/tests/qtest/fuzz/fuzz.c
@@ -91,6 +91,7 @@ static void usage(char *path)
printf(" * %s : %s\n", tmp->target->name,
tmp->target->description);
}
+ printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n");
exit(0);
}
@@ -143,18 +144,20 @@ int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
module_call_init(MODULE_INIT_QOM);
module_call_init(MODULE_INIT_LIBQOS);
- if (*argc <= 1) {
+ target_name = strstr(**argv, "-target-");
+ if (target_name) { /* The binary name specifies the target */
+ target_name += strlen("-target-");
+ } else if (*argc > 1) { /* The target is specified as an argument */
+ target_name = (*argv)[1];
+ if (!strstr(target_name, "--fuzz-target=")) {
+ usage(**argv);
+ }
+ target_name += strlen("--fuzz-target=");
+ } else {
usage(**argv);
}
/* Identify the fuzz target */
- target_name = (*argv)[1];
- if (!strstr(target_name, "--fuzz-target=")) {
- usage(**argv);
- }
-
- target_name += strlen("--fuzz-target=");
-
fuzz_target = fuzz_get_target(target_name);
if (!fuzz_target) {
usage(**argv);
diff --git a/slirp b/slirp
index 2faae0f778..55ab21c9a3 160000
--- a/slirp
+++ b/slirp
@@ -1 +1 @@
-Subproject commit 2faae0f778f818fadc873308f983289df697eb93
+Subproject commit 55ab21c9a36852915b81f1b41ebaf3b6509dd8ba
--
2.25.3
^ permalink raw reply related [flat|nested] 2+ messages in thread