Retire Fork-Based Fuzzing

[PATCH 06/10] fuzz/virtio-net: remove fork-based fuzzer

Posted by Alexander Bulekov 2 years, 8 months ago

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
---
 tests/qtest/fuzz/virtio_net_fuzz.c | 54 +++---------------------------
 1 file changed, 5 insertions(+), 49 deletions(-)

diff --git a/tests/qtest/fuzz/virtio_net_fuzz.c b/tests/qtest/fuzz/virtio_net_fuzz.c
index c2c15f07f0..d245ee66a1 100644
--- a/tests/qtest/fuzz/virtio_net_fuzz.c
+++ b/tests/qtest/fuzz/virtio_net_fuzz.c
@@ -16,7 +16,6 @@
 #include "tests/qtest/libqtest.h"
 #include "tests/qtest/libqos/virtio-net.h"
 #include "fuzz.h"
-#include "fork_fuzz.h"
 #include "qos_fuzz.h"
 
 
@@ -115,36 +114,18 @@ static void virtio_net_fuzz_multi(QTestState *s,
     }
 }
 
-static void virtio_net_fork_fuzz(QTestState *s,
-        const unsigned char *Data, size_t Size)
-{
-    if (fork() == 0) {
-        virtio_net_fuzz_multi(s, Data, Size, false);
-        flush_events(s);
-        _Exit(0);
-    } else {
-        flush_events(s);
-        wait(NULL);
-    }
-}
 
-static void virtio_net_fork_fuzz_check_used(QTestState *s,
+static void virtio_net_fuzz_check_used(QTestState *s,
         const unsigned char *Data, size_t Size)
 {
-    if (fork() == 0) {
-        virtio_net_fuzz_multi(s, Data, Size, true);
-        flush_events(s);
-        _Exit(0);
-    } else {
-        flush_events(s);
-        wait(NULL);
-    }
+    virtio_net_fuzz_multi(s, Data, Size, true);
+    flush_events(s);
+    fuzz_reboot(s);
 }
 
 static void virtio_net_pre_fuzz(QTestState *s)
 {
     qos_init_path(s);
-    counter_shm_init();
 }
 
 static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
@@ -158,23 +139,8 @@ static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
     return arg;
 }
 
-static void *virtio_net_test_setup_user(GString *cmd_line, void *arg)
-{
-    g_string_append_printf(cmd_line, " -netdev user,id=hs0 ");
-    return arg;
-}
-
 static void register_virtio_net_fuzz_targets(void)
 {
-    fuzz_add_qos_target(&(FuzzTarget){
-            .name = "virtio-net-socket",
-            .description = "Fuzz the virtio-net virtual queues. Fuzz incoming "
-            "traffic using the socket backend",
-            .pre_fuzz = &virtio_net_pre_fuzz,
-            .fuzz = virtio_net_fork_fuzz,},
-            "virtio-net",
-            &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
-            );
 
     fuzz_add_qos_target(&(FuzzTarget){
             .name = "virtio-net-socket-check-used",
@@ -182,20 +148,10 @@ static void register_virtio_net_fuzz_targets(void)
             "descriptors to be used. Timeout may indicate improperly handled "
             "input",
             .pre_fuzz = &virtio_net_pre_fuzz,
-            .fuzz = virtio_net_fork_fuzz_check_used,},
+            .fuzz = virtio_net_fuzz_check_used,},
             "virtio-net",
             &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
             );
-    fuzz_add_qos_target(&(FuzzTarget){
-            .name = "virtio-net-slirp",
-            .description = "Fuzz the virtio-net virtual queues with the slirp "
-            " backend. Warning: May result in network traffic emitted from the "
-            " process. Run in an isolated network environment.",
-            .pre_fuzz = &virtio_net_pre_fuzz,
-            .fuzz = virtio_net_fork_fuzz,},
-            "virtio-net",
-            &(QOSGraphTestOptions){.before = virtio_net_test_setup_user}
-            );
 }
 
 fuzz_target_init(register_virtio_net_fuzz_targets);
-- 
2.39.0

Re: [PATCH 06/10] fuzz/virtio-net: remove fork-based fuzzer

Posted by Darren Kenny 2 years, 8 months ago

On Saturday, 2023-02-04 at 23:29:47 -05, Alexander Bulekov wrote:
> Signed-off-by: Alexander Bulekov <alxndr@bu.edu>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

Thanks,

Darren.

> ---
>  tests/qtest/fuzz/virtio_net_fuzz.c | 54 +++---------------------------
>  1 file changed, 5 insertions(+), 49 deletions(-)
>
> diff --git a/tests/qtest/fuzz/virtio_net_fuzz.c b/tests/qtest/fuzz/virtio_net_fuzz.c
> index c2c15f07f0..d245ee66a1 100644
> --- a/tests/qtest/fuzz/virtio_net_fuzz.c
> +++ b/tests/qtest/fuzz/virtio_net_fuzz.c
> @@ -16,7 +16,6 @@
>  #include "tests/qtest/libqtest.h"
>  #include "tests/qtest/libqos/virtio-net.h"
>  #include "fuzz.h"
> -#include "fork_fuzz.h"
>  #include "qos_fuzz.h"
>  
>  
> @@ -115,36 +114,18 @@ static void virtio_net_fuzz_multi(QTestState *s,
>      }
>  }
>  
> -static void virtio_net_fork_fuzz(QTestState *s,
> -        const unsigned char *Data, size_t Size)
> -{
> -    if (fork() == 0) {
> -        virtio_net_fuzz_multi(s, Data, Size, false);
> -        flush_events(s);
> -        _Exit(0);
> -    } else {
> -        flush_events(s);
> -        wait(NULL);
> -    }
> -}
>  
> -static void virtio_net_fork_fuzz_check_used(QTestState *s,
> +static void virtio_net_fuzz_check_used(QTestState *s,
>          const unsigned char *Data, size_t Size)
>  {
> -    if (fork() == 0) {
> -        virtio_net_fuzz_multi(s, Data, Size, true);
> -        flush_events(s);
> -        _Exit(0);
> -    } else {
> -        flush_events(s);
> -        wait(NULL);
> -    }
> +    virtio_net_fuzz_multi(s, Data, Size, true);
> +    flush_events(s);
> +    fuzz_reboot(s);
>  }
>  
>  static void virtio_net_pre_fuzz(QTestState *s)
>  {
>      qos_init_path(s);
> -    counter_shm_init();
>  }
>  
>  static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
> @@ -158,23 +139,8 @@ static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
>      return arg;
>  }
>  
> -static void *virtio_net_test_setup_user(GString *cmd_line, void *arg)
> -{
> -    g_string_append_printf(cmd_line, " -netdev user,id=hs0 ");
> -    return arg;
> -}
> -
>  static void register_virtio_net_fuzz_targets(void)
>  {
> -    fuzz_add_qos_target(&(FuzzTarget){
> -            .name = "virtio-net-socket",
> -            .description = "Fuzz the virtio-net virtual queues. Fuzz incoming "
> -            "traffic using the socket backend",
> -            .pre_fuzz = &virtio_net_pre_fuzz,
> -            .fuzz = virtio_net_fork_fuzz,},
> -            "virtio-net",
> -            &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
> -            );
>  
>      fuzz_add_qos_target(&(FuzzTarget){
>              .name = "virtio-net-socket-check-used",
> @@ -182,20 +148,10 @@ static void register_virtio_net_fuzz_targets(void)
>              "descriptors to be used. Timeout may indicate improperly handled "
>              "input",
>              .pre_fuzz = &virtio_net_pre_fuzz,
> -            .fuzz = virtio_net_fork_fuzz_check_used,},
> +            .fuzz = virtio_net_fuzz_check_used,},
>              "virtio-net",
>              &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
>              );
> -    fuzz_add_qos_target(&(FuzzTarget){
> -            .name = "virtio-net-slirp",
> -            .description = "Fuzz the virtio-net virtual queues with the slirp "
> -            " backend. Warning: May result in network traffic emitted from the "
> -            " process. Run in an isolated network environment.",
> -            .pre_fuzz = &virtio_net_pre_fuzz,
> -            .fuzz = virtio_net_fork_fuzz,},
> -            "virtio-net",
> -            &(QOSGraphTestOptions){.before = virtio_net_test_setup_user}
> -            );
>  }
>  
>  fuzz_target_init(register_virtio_net_fuzz_targets);
> -- 
> 2.39.0