Fuzz introspector: qrexec_daemon_fuzzer
For issues and ideas: https://github.com/ossf/fuzz-introspector/issues

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked Calltree index Parent function Callsite Largest blocked function
593 0 EP call site: 00000 handle_message_from_agent

Fuzzer calltree

0 LLVMFuzzerTestOneInput [function] [call site] 00000
1 fuzz_file_create [function] [call site] 00001
2 panic [function] [call site] 00002
3 fprintf [call site] 00003
3 abort [call site] 00004
1 _setjmp [call site] 00005
1 fuzz_file_destroy [function] [call site] 00006
1 handle_message_from_agent [function] [call site] 00007
2 fuzz_libvchan_recv [function] [call site] 00008
3 fuzz_libvchan_read [function] [call site] 00009
4 panic [function] [call site] 00010
4 file_input_eof [function] [call site] 00011
4 file_read [function] [call site] 00012
5 __assert_fail [call site] 00013
2 handle_vchan_error [function] [call site] 00014
3 fuzz_exit [function] [call site] 00015
4 longjmp [call site] 00016
2 sanitize_message_from_agent [function] [call site] 00017
3 fuzz_exit [function] [call site] 00018
3 fuzz_exit [function] [call site] 00019
3 fuzz_exit [function] [call site] 00020
3 fuzz_exit [function] [call site] 00021
3 fuzz_exit [function] [call site] 00022
3 fuzz_exit [function] [call site] 00023
3 fuzz_exit [function] [call site] 00024
3 fuzz_exit [function] [call site] 00025
3 fuzz_exit [function] [call site] 00026
3 fuzz_exit [function] [call site] 00027
2 fuzz_libvchan_recv [function] [call site] 00028
2 handle_vchan_error [function] [call site] 00029
2 sanitize_name [function] [call site] 00030
3 strchr [call site] 00031
2 sanitize_name [function] [call site] 00032
2 validate_request_id [function] [call site] 00033
2 send_service_refused [function] [call site] 00034
3 fuzz_libvchan_send [function] [call site] 00035
4 fuzz_write [function] [call site] 00036
5 panic [function] [call site] 00037
3 fuzz_exit [function] [call site] 00038
3 fuzz_libvchan_send [function] [call site] 00039
3 fuzz_exit [function] [call site] 00040
2 validate_service_name [function] [call site] 00041
3 sanitize_name [function] [call site] 00042
2 send_service_refused [function] [call site] 00043
2 handle_execute_service [function] [call site] 00044
3 find_policy_pending_slot [function] [call site] 00045
3 send_service_refused [function] [call site] 00046
3 fuzz_exit [function] [call site] 00047
3 atexit [call site] 00048
3 null_exit [function] [call site] 00049
4 _exit [call site] 00050
3 _exit [call site] 00051
3 sigaction [call site] 00052
3 handle_execute_service_child [function] [call site] 00053
4 syscall [call site] 00054
4 close [call site] 00055
4 connect_daemon_socket [function] [call site] 00056
5 socket [call site] 00057
5 daemon__exit [function] [call site] 00058
6 _exit [call site] 00059
5 connect [call site] 00060
5 send_request_to_daemon [function] [call site] 00061
6 asprintf [call site] 00062
6 daemon__exit [function] [call site] 00063
6 send [call site] 00064
6 abort [call site] 00065
6 __assert_fail [call site] 00066
6 daemon__exit [function] [call site] 00067
5 qubes_read_all_to_malloc [function] [call site] 00068
6 abort [call site] 00069
6 abort [call site] 00070
6 abort [call site] 00071
6 __assert_fail [call site] 00072
6 fuzz_read [function] [call site] 00073
7 panic [function] [call site] 00074
7 file_input_eof [function] [call site] 00075
7 file_read [function] [call site] 00076
6 __errno_location [call site] 00077
6 abort [call site] 00078
6 __errno_location [call site] 00079
6 abort [call site] 00080
6 __errno_location [call site] 00081
6 realloc [call site] 00082
6 __errno_location [call site] 00083
6 close [call site] 00084
5 parse_policy_response [function] [call site] 00085
6 strlen [call site] 00086
6 strsep [call site] 00087
6 strncmp [call site] 00088
6 strcmp [call site] 00089
6 strcmp [call site] 00090
6 strncmp [call site] 00091
6 strdup [call site] 00092
6 abort [call site] 00093
6 strncmp [call site] 00094
6 strdup [call site] 00095
6 abort [call site] 00096
6 strncmp [call site] 00097
6 strdup [call site] 00098
6 abort [call site] 00099
6 strncmp [call site] 00100
6 strcmp [call site] 00101
6 strcmp [call site] 00102
6 strncmp [call site] 00103
6 strdup [call site] 00104
6 abort [call site] 00105
6 strncmp [call site] 00106
6 strdup [call site] 00107
6 abort [call site] 00108
6 strncmp [call site] 00109
6 strdup [call site] 00110
6 abort [call site] 00111
6 strchr [call site] 00112
5 __assert_fail [call site] 00113
5 close [call site] 00114
5 abort [call site] 00115
5 socketpair [call site] 00116
5 daemon__exit [function] [call site] 00117
5 daemon__exit [function] [call site] 00118
5 close [call site] 00119
5 daemon__exit [function] [call site] 00120
5 dup2 [call site] 00121
5 daemon__exit [function] [call site] 00122
5 close [call site] 00123
5 abort [call site] 00124
5 snprintf [call site] 00125
5 execl [call site] 00126
5 daemon__exit [function] [call site] 00127
5 close [call site] 00128
5 abort [call site] 00129
5 qubes_read_all_to_malloc [function] [call site] 00130
5 waitpid [call site] 00131
5 daemon__exit [function] [call site] 00132
5 daemon__exit [function] [call site] 00133
5 parse_policy_response [function] [call site] 00134
4 daemon__exit [function] [call site] 00135
4 strchr [call site] 00136
4 target_refers_to_dom0 [function] [call site] 00137
5 strcmp [call site] 00138
5 strcmp [call site] 00139
5 strcmp [call site] 00140
4 asprintf [call site] 00141
4 daemon__exit [function] [call site] 00142
4 register_exec_func [function] [call site] 00143
5 abort [call site] 00144
4 do_exec [function] [call site] 00145
5 exec_qubes_rpc2 [function] [call site] 00146
6 __assert_fail [call site] 00147
6 calloc [call site] 00148
6 _exit [call site] 00149
6 should_strip_env_var [function] [call site] 00150
7 strncmp [call site] 00151
7 strncmp [call site] 00152
7 strncmp [call site] 00153
6 abort [call site] 00154
6 strdup [call site] 00155
6 _exit [call site] 00156
6 strtok_r [call site] 00157
6 _exit [call site] 00158
6 strtok_r [call site] 00159
6 _exit [call site] 00160
6 _exit [call site] 00161
6 strchr [call site] 00162
6 abort [call site] 00163
6 asprintf [call site] 00164
6 strcmp [call site] 00165
6 abort [call site] 00166
6 asprintf [call site] 00167
6 strcmp [call site] 00168
6 abort [call site] 00169
6 asprintf [call site] 00170
6 abort [call site] 00171
6 abort [call site] 00172
6 asprintf [call site] 00173
6 abort [call site] 00174
6 asprintf [call site] 00175
6 abort [call site] 00176
6 asprintf [call site] 00177
6 __assert_fail [call site] 00178
6 execve [call site] 00179
6 __errno_location [call site] 00180
6 _exit [call site] 00181
6 _exit [call site] 00182
6 strcmp [call site] 00183
6 strcmp [call site] 00184
6 asprintf [call site] 00185
6 execve [call site] 00186
6 _exit [call site] 00187
6 _exit [call site] 00188
5 execl [call site] 00189
5 _exit [call site] 00190
4 run_qrexec_to_dom0 [function] [call site] 00191
5 set_remote_domain [function] [call site] 00192
6 setenv [call site] 00193
6 abort [call site] 00194
5 connect_unix_socket_by_id [function] [call site] 00195
6 snprintf [call site] 00196
6 abort [call site] 00197
6 connect_unix_socket [function] [call site] 00198
7 socket [call site] 00199
7 snprintf [call site] 00200
7 abort [call site] 00201
7 close [call site] 00202
7 connect [call site] 00203
7 __errno_location [call site] 00204
7 close [call site] 00205
7 handle_daemon_handshake [function] [call site] 00206
8 read_all [function] [call site] 00207
9 fuzz_read [function] [call site] 00208
9 __errno_location [call site] 00209
9 __errno_location [call site] 00210
9 __errno_location [call site] 00211
9 set_block [function] [call site] 00212
10 fcntl [call site] 00213
10 fcntl [call site] 00214
8 read_all [function] [call site] 00215
8 write_all [function] [call site] 00216
9 fuzz_write [function] [call site] 00217
9 __errno_location [call site] 00218
8 write_all [function] [call site] 00219
5 negotiate_connection_params [function] [call site] 00220
6 write_all [function] [call site] 00221
6 write_all [function] [call site] 00222
6 write_all [function] [call site] 00223
6 read_all [function] [call site] 00224
6 __assert_fail [call site] 00225
6 read_all [function] [call site] 00226
5 buffer_init [function] [call site] 00227
5 parse_qubes_rpc_command [function] [call site] 00228
6 calloc [call site] 00229
6 strchr [call site] 00230
6 memdupnul [function] [call site] 00231
6 strncmp [call site] 00232
6 strncmp [call site] 00233
6 strchr [call site] 00234
6 memchr [call site] 00235
6 memdupnul [function] [call site] 00236
6 memdupnul [function] [call site] 00237
6 strchrnul [call site] 00238
6 memdupnul [function] [call site] 00239
6 destroy_qrexec_parsed_command [function] [call site] 00240
5 wait_for_session_maybe [function] [call site] 00241
6 load_service_config_v2 [function] [call site] 00242
7 __assert_fail [call site] 00243
7 load_service_config_raw [function] [call site] 00244
8 getenv [call site] 00245
8 find_file [function] [call site] 00246
9 strlen [call site] 00247
9 strchrnul [call site] 00248
9 strcpy [call site] 00249
9 lstat [call site] 00250
9 readlink [call site] 00251
9 memcmp [call site] 00252
9 memcmp [call site] 00253
9 stat [call site] 00254
9 __assert_fail [call site] 00255
9 __assert_fail [call site] 00256
9 __errno_location [call site] 00257
8 find_file [function] [call site] 00258
8 qubes_toml_config_parse [function] [call site] 00259
9 fopen [call site] 00260
9 getline [call site] 00261
9 abort [call site] 00262
9 strlen [call site] 00263
9 qubes_isspace [function] [call site] 00264
9 qubes_is_key_byte [function] [call site] 00265
9 qubes_isspace [function] [call site] 00266
9 qubes_isspace [function] [call site] 00267
9 parse_toml_value [function] [call site] 00268
10 __errno_location [call site] 00269
10 __isoc23_strtoull [call site] 00270
10 __errno_location [call site] 00271
10 strncmp [call site] 00272
10 strncmp [call site] 00273
10 strchr [call site] 00274
10 qubes_isspace [function] [call site] 00275
9 strcmp [call site] 00276
9 toml_check_dup_key [function] [call site] 00277
9 toml_value_free [function] [call site] 00278
9 toml_invalid_type [function] [call site] 00279
9 toml_value_free [function] [call site] 00280
9 strcmp [call site] 00281
9 toml_check_dup_key [function] [call site] 00282
9 toml_value_free [function] [call site] 00283
9 toml_invalid_type [function] [call site] 00284
9 toml_value_free [function] [call site] 00285
9 strcmp [call site] 00286
9 toml_check_dup_key [function] [call site] 00287
9 toml_value_free [function] [call site] 00288
9 toml_invalid_type [function] [call site] 00289
9 toml_value_free [function] [call site] 00290
9 strcmp [call site] 00291
9 toml_check_dup_key [function] [call site] 00292
9 toml_value_free [function] [call site] 00293
9 toml_invalid_type [function] [call site] 00294
9 toml_value_free [function] [call site] 00295
9 strcmp [call site] 00296
9 toml_check_dup_key [function] [call site] 00297
9 toml_value_free [function] [call site] 00298
9 toml_invalid_type [function] [call site] 00299
9 toml_value_free [function] [call site] 00300
9 toml_value_free [function] [call site] 00301
9 fclose [call site] 00302
6 close [call site] 00303
6 exec_wait_for_session [function] [call site] 00304
7 getenv [call site] 00305
7 find_file [function] [call site] 00306
7 setenv [call site] 00307
7 execl [call site] 00308
6 _exit [call site] 00309
6 waitpid [call site] 00310
5 prepare_local_fds [function] [call site] 00311
6 abort [call site] 00312
6 sigemptyset [call site] 00313
6 sigaction [call site] 00314
6 execute_parsed_qubes_rpc_command [function] [call site] 00315
7 find_qrexec_service [function] [call site] 00316
8 __assert_fail [call site] 00317
8 __assert_fail [call site] 00318
8 getenv [call site] 00319
8 find_file [function] [call site] 00320
8 find_file [function] [call site] 00321
8 socket [call site] 00322
8 strlen [call site] 00323
8 qubes_connect [function] [call site] 00324
9 mkdtemp [call site] 00325
9 symlink [call site] 00326
9 __errno_location [call site] 00327
9 connect [call site] 00328
9 __errno_location [call site] 00329
9 __errno_location [call site] 00330
9 unlink [call site] 00331
9 rmdir [call site] 00332
9 __errno_location [call site] 00333
8 close [call site] 00334
8 strlen [call site] 00335
8 buffer_append [function] [call site] 00336
9 __assert_fail [call site] 00337
9 abort [call site] 00338
9 abort [call site] 00339
9 limited_malloc [function] [call site] 00340
10 abort [call site] 00341
10 abort [call site] 00342
9 buffer_free [function] [call site] 00343
10 limited_free [function] [call site] 00344
11 abort [call site] 00345
10 buffer_init [function] [call site] 00346
8 __assert_fail [call site] 00347
8 memcmp [call site] 00348
8 __assert_fail [call site] 00349
8 strchr [call site] 00350
8 __assert_fail [call site] 00351
8 strrchr [call site] 00352
8 strlen [call site] 00353
8 buffer_append [function] [call site] 00354
8 qubes_tcp_connect [function] [call site] 00355
9 validate_port [function] [call site] 00356
10 memcmp [call site] 00357
9 strchr [call site] 00358
9 getaddrinfo [call site] 00359
9 __assert_fail [call site] 00360
9 __assert_fail [call site] 00361
9 socket [call site] 00362
9 setsockopt [call site] 00363
9 abort [call site] 00364
9 connect [call site] 00365
9 close [call site] 00366
9 freeaddrinfo [call site] 00367
8 euidaccess [call site] 00368
7 __assert_fail [call site] 00369
7 do_fork_exec [function] [call site] 00370
8 socketpair [call site] 00371
8 socketpair [call site] 00372
8 pipe2 [call site] 00373
8 signal [call site] 00374
8 abort [call site] 00375
8 fix_fds [function] [call site] 00376
9 _exit [call site] 00377
9 dup2 [call site] 00378
9 dup2 [call site] 00379
9 dup2 [call site] 00380
9 abort [call site] 00381
9 syscall [call site] 00382
9 __assert_fail [call site] 00383
9 __errno_location [call site] 00384
9 abort [call site] 00385
9 close [call site] 00386
8 fix_fds [function] [call site] 00387
8 abort [call site] 00388
8 close [call site] 00389
8 close [call site] 00390
8 close [call site] 00391
7 do_fork_exec [function] [call site] 00392
5 fuzz_libvchan_client_init_async [function] [call site] 00393
5 qubes_wait_for_vchan_connection_with_timeout [function] [call site] 00394
6 clock_gettime [call site] 00395
6 __assert_fail [call site] 00396
6 clock_gettime [call site] 00397
6 __assert_fail [call site] 00398
6 ppoll [call site] 00399
6 __errno_location [call site] 00400
6 fuzz_libvchan_wait [function] [call site] 00401
6 fuzz_libvchan_client_init_async_finish [function] [call site] 00402
7 abort [call site] 00403
5 fuzz_libvchan_close [function] [call site] 00404
5 handshake_and_go [function] [call site] 00405
6 fuzz_libvchan_is_open [function] [call site] 00406
6 handle_agent_handshake [function] [call site] 00407
7 read_vchan_all [function] [call site] 00408
8 fuzz_libvchan_read [function] [call site] 00409
7 read_vchan_all [function] [call site] 00410
7 write_vchan_all [function] [call site] 00411
8 fuzz_libvchan_write [function] [call site] 00412
9 fuzz_write [function] [call site] 00413
7 write_vchan_all [function] [call site] 00414
6 handle_failed_exec [function] [call site] 00415
7 fuzz_libvchan_send [function] [call site] 00416
7 send_exit_code [function] [call site] 00417
8 fuzz_libvchan_send [function] [call site] 00418
8 fuzz_libvchan_send [function] [call site] 00419
6 __assert_fail [call site] 00420
6 select_loop [function] [call site] 00421
7 qrexec_process_io [function] [call site] 00422
8 __assert_fail [call site] 00423
8 max_data_chunk_size [function] [call site] 00424
8 fuzz_libvchan_send [function] [call site] 00425
8 handle_vchan_error [function] [call site] 00426
9 fuzz_exit [function] [call site] 00427
8 sigemptyset [call site] 00428
8 sigaddset [call site] 00429
8 sigprocmask [call site] 00430
8 sigemptyset [call site] 00431
8 set_nonblock [function] [call site] 00432
9 fcntl [call site] 00433
9 abort [call site] 00434
9 fcntl [call site] 00435
8 set_nonblock [function] [call site] 00436
8 __assert_fail [call site] 00437
8 __assert_fail [call site] 00438
8 __assert_fail [call site] 00439
8 set_nonblock [function] [call site] 00440
8 __assert_fail [call site] 00441
8 __assert_fail [call site] 00442
8 waitpid [call site] 00443
8 fuzz_libvchan_send [function] [call site] 00444
8 close_stdio [function] [call site] 00445
9 shutdown [call site] 00446
9 __errno_location [call site] 00447
9 close [call site] 00448
9 __errno_location [call site] 00449
9 set_block [function] [call site] 00450
9 close [call site] 00451
8 send_exit_code [function] [call site] 00452
8 handle_vchan_error [function] [call site] 00453
8 fuzz_libvchan_is_open [function] [call site] 00454
8 fuzz_libvchan_data_ready [function] [call site] 00455
8 buffer_len [function] [call site] 00456
8 close_stdio [function] [call site] 00457
8 buffer_len [function] [call site] 00458
8 fuzz_libvchan_buffer_space [function] [call site] 00459
8 fuzz_libvchan_fd_for_select [function] [call site] 00460
8 buffer_len [function] [call site] 00461
8 fuzz_libvchan_data_ready [function] [call site] 00462
8 ppoll [call site] 00463
8 ppoll [call site] 00464
8 __errno_location [call site] 00465
8 fuzz_libvchan_wait [function] [call site] 00466
8 handle_vchan_error [function] [call site] 00467
8 fuzz_libvchan_send [function] [call site] 00468
8 close_stdio [function] [call site] 00469
8 handle_remote_data_v2 [function] [call site] 00470
9 abort [call site] 00471
9 flush_client_data [function] [call site] 00472
10 buffer_len [function] [call site] 00473
10 buffer_data [function] [call site] 00474
10 fuzz_write [function] [call site] 00475
10 buffer_remove [function] [call site] 00476
11 abort [call site] 00477
11 limited_malloc [function] [call site] 00478
11 buffer_free [function] [call site] 00479
9 fuzz_libvchan_data_ready [function] [call site] 00480
9 fuzz_libvchan_recv [function] [call site] 00481
9 read_vchan_all [function] [call site] 00482
9 do_replace_chars [function] [call site] 00483
9 write_stdin [function] [call site] 00484
10 buffer_len [function] [call site] 00485
10 buffer_append [function] [call site] 00486
10 fuzz_write [function] [call site] 00487
10 abort [call site] 00488
10 __errno_location [call site] 00489
10 buffer_append [function] [call site] 00490
9 __errno_location [call site] 00491
9 do_replace_chars [function] [call site] 00492
9 write_all [function] [call site] 00493
8 handle_vchan_error [function] [call site] 00494
8 fuzz_libvchan_send [function] [call site] 00495
8 close_stdio [function] [call site] 00496
8 fuzz_libvchan_send [function] [call site] 00497
8 close_stdio [function] [call site] 00498
8 handle_input_v2 [function] [call site] 00499
9 abort [call site] 00500
9 fuzz_libvchan_buffer_space [function] [call site] 00501
9 fuzz_read [function] [call site] 00502
9 write_all [function] [call site] 00503
9 __errno_location [call site] 00504
9 __errno_location [call site] 00505
9 fuzz_libvchan_send [function] [call site] 00506
9 write_vchan_all [function] [call site] 00507
8 close_stdio [function] [call site] 00508
8 handle_vchan_error [function] [call site] 00509
8 close_stdio [function] [call site] 00510
8 handle_input_v2 [function] [call site] 00511
8 handle_vchan_error [function] [call site] 00512
8 close_stderr [function] [call site] 00513
9 set_block [function] [call site] 00514
9 close [call site] 00515
8 fuzz_libvchan_send [function] [call site] 00516
8 close_stdio [function] [call site] 00517
8 close_stdio [function] [call site] 00518
8 close_stderr [function] [call site] 00519
8 waitpid [call site] 00520
6 fuzz_libvchan_close [function] [call site] 00521
4 daemon__exit [function] [call site] 00522
4 asprintf [call site] 00523
4 daemon__exit [function] [call site] 00524
4 qrexec_execute_vm [function] [call site] 00525
5 strncmp [call site] 00526
5 qubesd_call2 [function] [call site] 00527
6 strlen [call site] 00528
6 strlen [call site] 00529
6 strlen [call site] 00530
6 socket [call site] 00531
6 __errno_location [call site] 00532
6 __errno_location [call site] 00533
6 connect [call site] 00534
6 qubes_sendmsg_all [function] [call site] 00535
7 sendmsg [call site] 00536
7 __errno_location [call site] 00537
7 __assert_fail [call site] 00538
7 __errno_location [call site] 00539
6 shutdown [call site] 00540
6 qubes_read_all_to_malloc [function] [call site] 00541
6 strlen [call site] 00542
6 close [call site] 00543
5 memcmp [call site] 00544
5 strlen [call site] 00545
5 memcmp [call site] 00546
5 memcmp [call site] 00547
5 connect_unix_socket [function] [call site] 00548
5 qubesd_call [function] [call site] 00549
6 qubesd_call2 [function] [call site] 00550
5 memcmp [call site] 00551
5 memcmp [call site] 00552
5 memcmp [call site] 00553
5 connect_unix_socket [function] [call site] 00554
5 negotiate_connection_params [function] [call site] 00555
5 close [call site] 00556
5 connect_unix_socket_by_id [function] [call site] 00557
5 send_service_connect [function] [call site] 00558
6 strncpy [call site] 00559
6 write_all [function] [call site] 00560
6 write_all [function] [call site] 00561
6 write_all [function] [call site] 00562
5 close [call site] 00563
5 poll [call site] 00564
5 qubesd_call [function] [call site] 00565
4 daemon__exit [function] [call site] 00566
2 handle_vchan_error [function] [call site] 00567
2 fuzz_libvchan_recv [function] [call site] 00568
2 handle_vchan_error [function] [call site] 00569
2 sanitize_name [function] [call site] 00570
2 validate_request_id [function] [call site] 00571
2 strlen [call site] 00572
2 validate_service_name [function] [call site] 00573
2 handle_execute_service [function] [call site] 00574
2 send_service_refused [function] [call site] 00575
2 handle_vchan_error [function] [call site] 00576
2 fuzz_libvchan_recv [function] [call site] 00577
2 handle_vchan_error [function] [call site] 00578
2 sanitize_name [function] [call site] 00579
2 sanitize_name [function] [call site] 00580
2 validate_request_id [function] [call site] 00581
2 strlen [call site] 00582
2 validate_service_name [function] [call site] 00583
2 handle_execute_service [function] [call site] 00584
2 send_service_refused [function] [call site] 00585
2 handle_connection_terminated [function] [call site] 00586
3 fuzz_libvchan_recv [function] [call site] 00587
3 handle_vchan_error [function] [call site] 00588
3 fuzz_exit [function] [call site] 00589
3 release_vchan_port [function] [call site] 00590
4 terminate_client [function] [call site] 00591
5 close [call site] 00592
1 fuzz_file_destroy [function] [call site] 00593