From: Paolo Bonzini <pbonzini@redhat.com>
To: Jonathan Metzman <metzman@google.com>
Cc: Max Moroz <mmoroz@google.com>,
Stefan Hajnoczi <stefanha@gmail.com>,
Dmitry Vyukov <dvyukov@google.com>,
Oliver Chang <ochang@google.com>, Bandan Das <bsd@redhat.com>,
qemu-devel <qemu-devel@nongnu.org>,
Andrey Konovalov <andreyknvl@google.com>,
Kostya Serebryany <kcc@google.com>
Subject: Re: [Qemu-devel] Internship idea: virtio-blk oss-fuzz support
Date: Fri, 11 Jan 2019 21:27:26 +0100 [thread overview]
Message-ID: <69559aca-a3e8-bf1e-7622-4b9ebe9f404e@redhat.com> (raw)
In-Reply-To: <CAMAxoC1m2g3AB6X5u=+L+K1avq36gSHeBRv-nDXobAJNc2d3qA@mail.gmail.com>
On 11/01/19 20:09, Jonathan Metzman wrote:
> Could you clarify what you think the relationship between the qtest
> process, QEMU, and afl-fuzz will look like when fuzzing?
>
> Is it something like this:
> 1. afl-fuzz mutates a buffer, starts a qtest process, and gives the
> qtest process the mutated buffer.
> 2. The qtest process starts a QEMU process and interacts with QEMU
> process based on the buffer AFL gave it (qtest).
> 3. goto 1
>
> I don't think this works (under normal circumstances). AFL will think it
> is fuzzing qtest and will not learn about coverage or crashes from qsym.
> There probably are ways to get this working, but I just want to make
> sure I understand.
It should be possible to turn the qtest process into a test
postprocessor, and remove the second process. It's much harder to
remove the QEMU process as well and turn it into a TestOneInput function.
Paolo
next prev parent reply other threads:[~2019-01-11 20:27 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-09 17:34 [Qemu-devel] Internship idea: virtio-blk oss-fuzz support Stefan Hajnoczi
2019-01-10 10:46 ` Dmitry Vyukov
2019-01-10 13:40 ` Bandan Das
2019-01-10 14:01 ` Dmitry Vyukov
2019-01-10 16:07 ` Max Moroz
2019-01-10 23:25 ` Paolo Bonzini
2019-01-11 6:49 ` Stefan Hajnoczi
2019-01-11 15:04 ` Max Moroz
2019-01-11 15:33 ` Paolo Bonzini
2019-01-11 15:41 ` Max Moroz
2019-01-11 16:16 ` Paolo Bonzini
2019-01-11 19:09 ` Jonathan Metzman
2019-01-11 20:27 ` Paolo Bonzini [this message]
2019-01-11 22:56 ` Jonathan Metzman
2019-01-14 9:24 ` Stefan Hajnoczi
2019-01-18 7:51 ` Bandan Das
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69559aca-a3e8-bf1e-7622-4b9ebe9f404e@redhat.com \
--to=pbonzini@redhat.com \
--cc=andreyknvl@google.com \
--cc=bsd@redhat.com \
--cc=dvyukov@google.com \
--cc=kcc@google.com \
--cc=metzman@google.com \
--cc=mmoroz@google.com \
--cc=ochang@google.com \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).