* [PATCH] fuzz: do not use POSIX shm for coverage bitmap
@ 2020-06-22 16:50 Alexander Bulekov
2020-06-23 8:03 ` Darren Kenny
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Alexander Bulekov @ 2020-06-22 16:50 UTC (permalink / raw)
To: qemu-devel
Cc: Laurent Vivier, Thomas Huth, f4bug, Alexander Bulekov, Bandan Das,
Stefan Hajnoczi, Paolo Bonzini
We used shm_open with mmap to share libfuzzer's coverage bitmap with
child (runner) processes. The same functionality can be achieved with
MAP_SHARED | MAP_ANONYMOUS, since we do not care about naming or
permissioning the shared memory object.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
---
This might fix:
qemu-fuzz-i386-target-virtio-net-socket: Unexpected-exit in
counter_shm_init
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23636 (private link)
oss-fuzz does not provide access to /dev/, so it is likely that shm_open
breaks, when it tries to access /dev/shm. This seems likely, based on
the oss-fuzz minijail setup:
https://github.com/google/oss-fuzz/blob/3740c751fd9edea138c17783995d370d6b1b89bc/infra/base-images/base-runner/run_minijail
tests/qtest/fuzz/fork_fuzz.c | 40 ++++++++++++------------------------
1 file changed, 13 insertions(+), 27 deletions(-)
diff --git a/tests/qtest/fuzz/fork_fuzz.c b/tests/qtest/fuzz/fork_fuzz.c
index 2bd0851903..6ffb2a7937 100644
--- a/tests/qtest/fuzz/fork_fuzz.c
+++ b/tests/qtest/fuzz/fork_fuzz.c
@@ -17,39 +17,25 @@
void counter_shm_init(void)
{
- char *shm_path = g_strdup_printf("/qemu-fuzz-cntrs.%d", getpid());
- int fd = shm_open(shm_path, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
- g_free(shm_path);
-
- if (fd == -1) {
- perror("Error: ");
- exit(1);
- }
- if (ftruncate(fd, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START) == -1) {
- perror("Error: ");
- exit(1);
- }
- /* Copy what's in the counter region to the shm.. */
- void *rptr = mmap(NULL ,
- &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START,
- PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
- memcpy(rptr,
+ /* Copy what's in the counter region to a temporary buffer.. */
+ void *copy = malloc(&__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
+ memcpy(copy,
&__FUZZ_COUNTERS_START,
&__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
- munmap(rptr, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
-
- /* And map the shm over the counter region */
- rptr = mmap(&__FUZZ_COUNTERS_START,
- &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START,
- PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, fd, 0);
-
- close(fd);
-
- if (!rptr) {
+ /* Map a shared region over the counter region */
+ if (mmap(&__FUZZ_COUNTERS_START,
+ &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START,
+ PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED | MAP_ANONYMOUS,
+ 0, 0) == MAP_FAILED) {
perror("Error: ");
exit(1);
}
+
+ /* Copy the original data back to the counter-region */
+ memcpy(&__FUZZ_COUNTERS_START, copy,
+ &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
+ free(copy);
}
--
2.26.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] fuzz: do not use POSIX shm for coverage bitmap
2020-06-22 16:50 [PATCH] fuzz: do not use POSIX shm for coverage bitmap Alexander Bulekov
@ 2020-06-23 8:03 ` Darren Kenny
2020-06-23 8:44 ` Stefan Hajnoczi
2020-06-24 7:51 ` Thomas Huth
2 siblings, 0 replies; 4+ messages in thread
From: Darren Kenny @ 2020-06-23 8:03 UTC (permalink / raw)
To: Alexander Bulekov, qemu-devel
Cc: Laurent Vivier, Thomas Huth, f4bug, Alexander Bulekov, Bandan Das,
Stefan Hajnoczi, Paolo Bonzini
Hi Alex,
On Monday, 2020-06-22 at 12:50:40 -04, Alexander Bulekov wrote:
> We used shm_open with mmap to share libfuzzer's coverage bitmap with
> child (runner) processes. The same functionality can be achieved with
> MAP_SHARED | MAP_ANONYMOUS, since we do not care about naming or
> permissioning the shared memory object.
>
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> This might fix:
> qemu-fuzz-i386-target-virtio-net-socket: Unexpected-exit in
> counter_shm_init
> https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23636 (private link)
>
> oss-fuzz does not provide access to /dev/, so it is likely that shm_open
> breaks, when it tries to access /dev/shm. This seems likely, based on
> the oss-fuzz minijail setup:
> https://github.com/google/oss-fuzz/blob/3740c751fd9edea138c17783995d370d6b1b89bc/infra/base-images/base-runner/run_minijail
>
> tests/qtest/fuzz/fork_fuzz.c | 40 ++++++++++++------------------------
> 1 file changed, 13 insertions(+), 27 deletions(-)
>
> diff --git a/tests/qtest/fuzz/fork_fuzz.c b/tests/qtest/fuzz/fork_fuzz.c
> index 2bd0851903..6ffb2a7937 100644
> --- a/tests/qtest/fuzz/fork_fuzz.c
> +++ b/tests/qtest/fuzz/fork_fuzz.c
> @@ -17,39 +17,25 @@
>
> void counter_shm_init(void)
> {
> - char *shm_path = g_strdup_printf("/qemu-fuzz-cntrs.%d", getpid());
> - int fd = shm_open(shm_path, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
> - g_free(shm_path);
> -
> - if (fd == -1) {
> - perror("Error: ");
> - exit(1);
> - }
> - if (ftruncate(fd, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START) == -1) {
> - perror("Error: ");
> - exit(1);
> - }
> - /* Copy what's in the counter region to the shm.. */
> - void *rptr = mmap(NULL ,
> - &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START,
> - PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
> - memcpy(rptr,
> + /* Copy what's in the counter region to a temporary buffer.. */
> + void *copy = malloc(&__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
> + memcpy(copy,
> &__FUZZ_COUNTERS_START,
> &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
>
> - munmap(rptr, &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
> -
> - /* And map the shm over the counter region */
> - rptr = mmap(&__FUZZ_COUNTERS_START,
> - &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START,
> - PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, fd, 0);
> -
> - close(fd);
> -
> - if (!rptr) {
> + /* Map a shared region over the counter region */
> + if (mmap(&__FUZZ_COUNTERS_START,
> + &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START,
> + PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED | MAP_ANONYMOUS,
> + 0, 0) == MAP_FAILED) {
It's not really necessary I guess, but for completeness you might want
to free(copy) here too.
Otherwise, this looks good, so:
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Thanks,
Darren
> perror("Error: ");
> exit(1);
> }
> +
> + /* Copy the original data back to the counter-region */
> + memcpy(&__FUZZ_COUNTERS_START, copy,
> + &__FUZZ_COUNTERS_END - &__FUZZ_COUNTERS_START);
> + free(copy);
> }
>
>
> --
> 2.26.2
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] fuzz: do not use POSIX shm for coverage bitmap
2020-06-22 16:50 [PATCH] fuzz: do not use POSIX shm for coverage bitmap Alexander Bulekov
2020-06-23 8:03 ` Darren Kenny
@ 2020-06-23 8:44 ` Stefan Hajnoczi
2020-06-24 7:51 ` Thomas Huth
2 siblings, 0 replies; 4+ messages in thread
From: Stefan Hajnoczi @ 2020-06-23 8:44 UTC (permalink / raw)
To: Alexander Bulekov
Cc: Laurent Vivier, Thomas Huth, qemu-devel, f4bug, Bandan Das,
Paolo Bonzini
[-- Attachment #1: Type: text/plain, Size: 1067 bytes --]
On Mon, Jun 22, 2020 at 12:50:40PM -0400, Alexander Bulekov wrote:
> We used shm_open with mmap to share libfuzzer's coverage bitmap with
> child (runner) processes. The same functionality can be achieved with
> MAP_SHARED | MAP_ANONYMOUS, since we do not care about naming or
> permissioning the shared memory object.
>
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
> ---
> This might fix:
> qemu-fuzz-i386-target-virtio-net-socket: Unexpected-exit in
> counter_shm_init
> https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23636 (private link)
>
> oss-fuzz does not provide access to /dev/, so it is likely that shm_open
> breaks, when it tries to access /dev/shm. This seems likely, based on
> the oss-fuzz minijail setup:
> https://github.com/google/oss-fuzz/blob/3740c751fd9edea138c17783995d370d6b1b89bc/infra/base-images/base-runner/run_minijail
>
> tests/qtest/fuzz/fork_fuzz.c | 40 ++++++++++++------------------------
> 1 file changed, 13 insertions(+), 27 deletions(-)
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] fuzz: do not use POSIX shm for coverage bitmap
2020-06-22 16:50 [PATCH] fuzz: do not use POSIX shm for coverage bitmap Alexander Bulekov
2020-06-23 8:03 ` Darren Kenny
2020-06-23 8:44 ` Stefan Hajnoczi
@ 2020-06-24 7:51 ` Thomas Huth
2 siblings, 0 replies; 4+ messages in thread
From: Thomas Huth @ 2020-06-24 7:51 UTC (permalink / raw)
To: Alexander Bulekov, qemu-devel
Cc: Laurent Vivier, Paolo Bonzini, Bandan Das, f4bug, Stefan Hajnoczi
On 22/06/2020 18.50, Alexander Bulekov wrote:
> We used shm_open with mmap to share libfuzzer's coverage bitmap with
> child (runner) processes. The same functionality can be achieved with
> MAP_SHARED | MAP_ANONYMOUS, since we do not care about naming or
> permissioning the shared memory object.
>
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Thanks, queued to qtest-next now:
https://gitlab.com/huth/qemu/-/commits/qtest-next/
Thomas
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-06-24 7:53 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-06-22 16:50 [PATCH] fuzz: do not use POSIX shm for coverage bitmap Alexander Bulekov
2020-06-23 8:03 ` Darren Kenny
2020-06-23 8:44 ` Stefan Hajnoczi
2020-06-24 7:51 ` Thomas Huth
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).