1 /*
2  * virtio-net Fuzzing Target
3  *
4  * Copyright Red Hat Inc., 2019
5  *
6  * Authors:
7  *  Alexander Bulekov   <alxndr@bu.edu>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
10  * See the COPYING file in the top-level directory.
11  */
12 
13 #include "qemu/osdep.h"
14 
15 #include "standard-headers/linux/virtio_config.h"
16 #include "tests/qtest/libqos/libqtest.h"
17 #include "tests/qtest/libqos/virtio-net.h"
18 #include "fuzz.h"
19 #include "fork_fuzz.h"
20 #include "qos_fuzz.h"
21 
22 
23 #define QVIRTIO_NET_TIMEOUT_US (30 * 1000 * 1000)
24 #define QVIRTIO_RX_VQ 0
25 #define QVIRTIO_TX_VQ 1
26 #define QVIRTIO_CTRL_VQ 2
27 
28 static int sockfds[2];
29 static bool sockfds_initialized;
30 
31 static void virtio_net_fuzz_multi(QTestState *s,
32         const unsigned char *Data, size_t Size, bool check_used)
33 {
34     typedef struct vq_action {
35         uint8_t queue;
36         uint8_t length;
37         uint8_t write;
38         uint8_t next;
39         uint8_t rx;
40     } vq_action;
41 
42     uint32_t free_head = 0;
43 
44     QGuestAllocator *t_alloc = fuzz_qos_alloc;
45 
46     QVirtioNet *net_if = fuzz_qos_obj;
47     QVirtioDevice *dev = net_if->vdev;
48     QVirtQueue *q;
49     vq_action vqa;
50     while (Size >= sizeof(vqa)) {
51         memcpy(&vqa, Data, sizeof(vqa));
52         Data += sizeof(vqa);
53         Size -= sizeof(vqa);
54 
55         q = net_if->queues[vqa.queue % 3];
56 
57         vqa.length = vqa.length >= Size ? Size :  vqa.length;
58 
59         /*
60          * Only attempt to write incoming packets, when using the socket
61          * backend. Otherwise, always place the input on a virtqueue.
62          */
63         if (vqa.rx && sockfds_initialized) {
64             int ignored = write(sockfds[0], Data, vqa.length);
65             (void) ignored;
66         } else {
67             vqa.rx = 0;
68             uint64_t req_addr = guest_alloc(t_alloc, vqa.length);
69             /*
70              * If checking used ring, ensure that the fuzzer doesn't trigger
71              * trivial asserion failure on zero-zied buffer
72              */
73             qtest_memwrite(s, req_addr, Data, vqa.length);
74 
75 
76             free_head = qvirtqueue_add(s, q, req_addr, vqa.length,
77                     vqa.write, vqa.next);
78             qvirtqueue_add(s, q, req_addr, vqa.length, vqa.write , vqa.next);
79             qvirtqueue_kick(s, dev, q, free_head);
80         }
81 
82         /* Run the main loop */
83         qtest_clock_step(s, 100);
84         flush_events(s);
85 
86         /* Wait on used descriptors */
87         if (check_used && !vqa.rx) {
88             gint64 start_time = g_get_monotonic_time();
89             /*
90              * normally, we could just use qvirtio_wait_used_elem, but since we
91              * must manually run the main-loop for all the bhs to run, we use
92              * this hack with flush_events(), to run the main_loop
93              */
94             while (!vqa.rx && q != net_if->queues[QVIRTIO_RX_VQ]) {
95                 uint32_t got_desc_idx;
96                 /* Input led to a virtio_error */
97                 if (dev->bus->get_status(dev) & VIRTIO_CONFIG_S_NEEDS_RESET) {
98                     break;
99                 }
100                 if (dev->bus->get_queue_isr_status(dev, q) &&
101                         qvirtqueue_get_buf(s, q, &got_desc_idx, NULL)) {
102                     g_assert_cmpint(got_desc_idx, ==, free_head);
103                     break;
104                 }
105                 g_assert(g_get_monotonic_time() - start_time
106                         <= QVIRTIO_NET_TIMEOUT_US);
107 
108                 /* Run the main loop */
109                 qtest_clock_step(s, 100);
110                 flush_events(s);
111             }
112         }
113         Data += vqa.length;
114         Size -= vqa.length;
115     }
116 }
117 
118 static void virtio_net_fork_fuzz(QTestState *s,
119         const unsigned char *Data, size_t Size)
120 {
121     if (fork() == 0) {
122         virtio_net_fuzz_multi(s, Data, Size, false);
123         flush_events(s);
124         _Exit(0);
125     } else {
126         flush_events(s);
127         wait(NULL);
128     }
129 }
130 
131 static void virtio_net_fork_fuzz_check_used(QTestState *s,
132         const unsigned char *Data, size_t Size)
133 {
134     if (fork() == 0) {
135         virtio_net_fuzz_multi(s, Data, Size, true);
136         flush_events(s);
137         _Exit(0);
138     } else {
139         flush_events(s);
140         wait(NULL);
141     }
142 }
143 
144 static void virtio_net_pre_fuzz(QTestState *s)
145 {
146     qos_init_path(s);
147     counter_shm_init();
148 }
149 
150 static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
151 {
152     int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sockfds);
153     g_assert_cmpint(ret, !=, -1);
154     fcntl(sockfds[0], F_SETFL, O_NONBLOCK);
155     sockfds_initialized = true;
156     g_string_append_printf(cmd_line, " -netdev socket,fd=%d,id=hs0 ",
157                            sockfds[1]);
158     return arg;
159 }
160 
161 static void *virtio_net_test_setup_user(GString *cmd_line, void *arg)
162 {
163     g_string_append_printf(cmd_line, " -netdev user,id=hs0 ");
164     return arg;
165 }
166 
167 static void register_virtio_net_fuzz_targets(void)
168 {
169     fuzz_add_qos_target(&(FuzzTarget){
170             .name = "virtio-net-socket",
171             .description = "Fuzz the virtio-net virtual queues. Fuzz incoming "
172             "traffic using the socket backend",
173             .pre_fuzz = &virtio_net_pre_fuzz,
174             .fuzz = virtio_net_fork_fuzz,},
175             "virtio-net",
176             &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
177             );
178 
179     fuzz_add_qos_target(&(FuzzTarget){
180             .name = "virtio-net-socket-check-used",
181             .description = "Fuzz the virtio-net virtual queues. Wait for the "
182             "descriptors to be used. Timeout may indicate improperly handled "
183             "input",
184             .pre_fuzz = &virtio_net_pre_fuzz,
185             .fuzz = virtio_net_fork_fuzz_check_used,},
186             "virtio-net",
187             &(QOSGraphTestOptions){.before = virtio_net_test_setup_socket}
188             );
189     fuzz_add_qos_target(&(FuzzTarget){
190             .name = "virtio-net-slirp",
191             .description = "Fuzz the virtio-net virtual queues with the slirp "
192             " backend. Warning: May result in network traffic emitted from the "
193             " process. Run in an isolated network environment.",
194             .pre_fuzz = &virtio_net_pre_fuzz,
195             .fuzz = virtio_net_fork_fuzz,},
196             "virtio-net",
197             &(QOSGraphTestOptions){.before = virtio_net_test_setup_user}
198             );
199 }
200 
201 fuzz_target_init(register_virtio_net_fuzz_targets);
202