/src/cloud-hypervisor/fuzz/fuzz_targets/rng.rs
Line | Count | Source |
1 | | // Copyright © 2022 Intel Corporation |
2 | | // |
3 | | // SPDX-License-Identifier: Apache-2.0 |
4 | | |
5 | | #![no_main] |
6 | | |
7 | | use libfuzzer_sys::fuzz_target; |
8 | | use seccompiler::SeccompAction; |
9 | | use std::os::unix::io::{AsRawFd, FromRawFd}; |
10 | | use std::sync::Arc; |
11 | | use virtio_devices::{VirtioDevice, VirtioInterrupt, VirtioInterruptType}; |
12 | | use virtio_queue::{Queue, QueueT}; |
13 | | use vm_memory::{bitmap::AtomicBitmap, Bytes, GuestAddress, GuestMemoryAtomic}; |
14 | | use vmm_sys_util::eventfd::{EventFd, EFD_NONBLOCK}; |
15 | | |
16 | | type GuestMemoryMmap = vm_memory::GuestMemoryMmap<AtomicBitmap>; |
17 | | |
18 | | macro_rules! align { |
19 | | ($n:expr, $align:expr) => {{ |
20 | | (($n + $align - 1) / $align) * $align |
21 | | }}; |
22 | | } |
23 | | |
24 | | const QUEUE_DATA_SIZE: usize = 4; |
25 | | const MEM_SIZE: usize = 1 * 1024 * 1024; |
26 | | |
27 | | // Max entries in the queue. |
28 | | const QUEUE_SIZE: u16 = 256; |
29 | | // Descriptor table alignment |
30 | | const DESC_TABLE_ALIGN_SIZE: u64 = 16; |
31 | | // Available ring alignment |
32 | | const AVAIL_RING_ALIGN_SIZE: u64 = 2; |
33 | | // Used ring alignment |
34 | | const USED_RING_ALIGN_SIZE: u64 = 4; |
35 | | // Descriptor table size |
36 | | const DESC_TABLE_SIZE: u64 = 16_u64 * QUEUE_SIZE as u64; |
37 | | // Available ring size |
38 | | const AVAIL_RING_SIZE: u64 = 6_u64 + 2 * QUEUE_SIZE as u64; |
39 | | // Used ring size |
40 | | const USED_RING_SIZE: u64 = 6_u64 + 8 * QUEUE_SIZE as u64; |
41 | | |
42 | | // Guest memory gap |
43 | | const GUEST_MEM_GAP: u64 = 1 * 1024 * 1024; |
44 | | // Guest physical address for descriptor table. |
45 | | const DESC_TABLE_ADDR: u64 = align!(MEM_SIZE as u64 + GUEST_MEM_GAP, DESC_TABLE_ALIGN_SIZE); |
46 | | // Guest physical address for available ring |
47 | | const AVAIL_RING_ADDR: u64 = align!(DESC_TABLE_ADDR + DESC_TABLE_SIZE, AVAIL_RING_ALIGN_SIZE); |
48 | | // Guest physical address for used ring |
49 | | const USED_RING_ADDR: u64 = align!(AVAIL_RING_ADDR + AVAIL_RING_SIZE, USED_RING_ALIGN_SIZE); |
50 | | // Virtio-queue size in bytes |
51 | | const QUEUE_BYTES_SIZE: usize = (USED_RING_ADDR + USED_RING_SIZE - DESC_TABLE_ADDR) as usize; |
52 | | |
53 | | fuzz_target!(|bytes| { |
54 | | if bytes.len() < (QUEUE_DATA_SIZE + QUEUE_BYTES_SIZE) |
55 | | || bytes.len() > (QUEUE_DATA_SIZE + QUEUE_BYTES_SIZE + MEM_SIZE) |
56 | | { |
57 | | return; |
58 | | } |
59 | | |
60 | | let mut rng = virtio_devices::Rng::new( |
61 | | "fuzzer_rng".to_owned(), |
62 | | "/dev/urandom", |
63 | | false, |
64 | | SeccompAction::Allow, |
65 | | EventFd::new(EFD_NONBLOCK).unwrap(), |
66 | | None, |
67 | | ) |
68 | | .unwrap(); |
69 | | |
70 | | let queue_data = &bytes[..QUEUE_DATA_SIZE]; |
71 | | let queue_bytes = &bytes[QUEUE_DATA_SIZE..QUEUE_DATA_SIZE + QUEUE_BYTES_SIZE]; |
72 | | let mem_bytes = &bytes[QUEUE_DATA_SIZE + QUEUE_BYTES_SIZE..]; |
73 | | |
74 | | // Setup the virt queue with the input bytes |
75 | | let q = setup_virt_queue(queue_data.try_into().unwrap()); |
76 | | |
77 | | // Setup the guest memory with the input bytes |
78 | | let mem = GuestMemoryMmap::from_ranges(&[ |
79 | | (GuestAddress(0), MEM_SIZE), |
80 | | (GuestAddress(DESC_TABLE_ADDR), QUEUE_BYTES_SIZE), |
81 | | ]) |
82 | | .unwrap(); |
83 | | if mem |
84 | | .write_slice(queue_bytes, GuestAddress(DESC_TABLE_ADDR)) |
85 | | .is_err() |
86 | | { |
87 | | return; |
88 | | } |
89 | | if mem.write_slice(mem_bytes, GuestAddress(0 as u64)).is_err() { |
90 | | return; |
91 | | } |
92 | | let guest_memory = GuestMemoryAtomic::new(mem); |
93 | | |
94 | | let evt = EventFd::new(0).unwrap(); |
95 | | let queue_evt = unsafe { EventFd::from_raw_fd(libc::dup(evt.as_raw_fd())) }; |
96 | | |
97 | | // Kick the 'queue' event before activate the rng device |
98 | | queue_evt.write(1).unwrap(); |
99 | | |
100 | | rng.activate( |
101 | | guest_memory, |
102 | | Arc::new(NoopVirtioInterrupt {}), |
103 | | vec![(0, q, evt)], |
104 | | ) |
105 | | .ok(); |
106 | | |
107 | | // Wait for the events to finish and rng device worker thread to return |
108 | | rng.wait_for_epoll_threads(); |
109 | | }); |
110 | | |
111 | | pub struct NoopVirtioInterrupt {} |
112 | | |
113 | | impl VirtioInterrupt for NoopVirtioInterrupt { |
114 | 28 | fn trigger(&self, _int_type: VirtioInterruptType) -> std::result::Result<(), std::io::Error> { |
115 | 28 | Ok(()) |
116 | 28 | } |
117 | | } |
118 | | |
119 | 411 | fn setup_virt_queue(bytes: &[u8; QUEUE_DATA_SIZE]) -> Queue { |
120 | 411 | let mut q = Queue::new(QUEUE_SIZE).unwrap(); |
121 | 411 | q.set_next_avail(bytes[0] as u16); // 'u8' is enough given the 'QUEUE_SIZE' is small |
122 | 411 | q.set_next_used(bytes[1] as u16); |
123 | 411 | q.set_event_idx(bytes[2] % 2 != 0); |
124 | 411 | q.set_size(bytes[3] as u16 % QUEUE_SIZE); |
125 | 411 | |
126 | 411 | q.try_set_desc_table_address(GuestAddress(DESC_TABLE_ADDR)) |
127 | 411 | .unwrap(); |
128 | 411 | q.try_set_avail_ring_address(GuestAddress(AVAIL_RING_ADDR)) |
129 | 411 | .unwrap(); |
130 | 411 | q.try_set_used_ring_address(GuestAddress(USED_RING_ADDR)) |
131 | 411 | .unwrap(); |
132 | 411 | q.set_ready(true); |
133 | 411 | |
134 | 411 | q |
135 | 411 | } |