Commit graph

11 commits

Author SHA1 Message Date
Daniel Verkamp
0d2f3d276d fuzz: ensure sys_util path dependency is used
When compiling a new-enough crosvm for fuzzing (after
https://crrev.com/c/1749950), the build would fail with an error about
importing two different version of sys_util:

expected struct `sys_util::shm::SharedMemory`, found a different struct
`sys_util::shm::SharedMemory`
expected reference `sys_util::shm::SharedMemory (struct
`sys_util::shm::SharedMemory`)
found reference sys_util::shm::SharedMemory (struct
`sys_util::shm::SharedMemory`)
perhaps two different versions of crate `sys_util` are being used?

Fix this by patching the version of sys_util used by audio_streams
so that it also uses the path dependency instead of the sys_util from
the dev-rust/sys_util ebuild in the fuzz-specific Cargo.toml.

BUG=chromium:1057532
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Change-Id: I38252465a1111a9a8f643a59e36733016c5db99d
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2086401
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2020-03-06 05:26:00 +00:00
Daniel Verkamp
f2eecc4152 disk: move qcow into disk crate
Move qcow from being its own crate into a module of the disk crate,
similar to the composite disk module.

This will allow use of qcow from disk and vice versa without introducing
a circular crate dependency.

BUG=None
TEST=./build_test.py
TEST=USE='asan fuzzer' emerge-nami crosvm

Change-Id: I77512bbe4b94faff1b5460f9796ee56505135580
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1972477
Reviewed-by: Cody Schuffelen <schuffelen@google.com>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2020-01-06 21:26:38 +00:00
Chirantan Ekbote
cfabb882f1 fuzz: Add virtio-fs server fuzzer
Add a fuzzer for the virtio-fs server, which is responsible for decoding
a byte stream into FUSE messages.

BUG=none
TEST=run it with cros_fuzz

Change-Id: Ic7695f2106d3f81e6cf09b98ffedc51831238f1e
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1865272
Tested-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2019-11-08 03:06:15 +00:00
Chirantan Ekbote
1955fd1fb3 fuzz: Add virtqueue fuzzer
BUG=none
TEST=Run it with cros_fuzz

Cq-Depend: chromium:1863177, chromium:1863178
Change-Id: I1a989d7b90116e210a8aae63205c5e8cf6b70faa
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1863889
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: Chirantan Ekbote <chirantan@chromium.org>
Legacy-Commit-Queue: Commit Bot <commit-bot@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2019-10-24 15:23:29 +00:00
Daniel Verkamp
cfb7db44eb fuzz: add USB descriptor parsing fuzzer
The new USB descriptor parsing code is a nice candidate for a fuzzer,
since it takes an arbitrary stream of bytes as input and parses it.

BUG=chromium:987833
TEST=`USE='asan fuzzer' emerge-nami crosvm`

Cq-Depend: chromium:1863465
Change-Id: I3bbdbf081e9a9dd590c781467f8bd44fa1dcab64
Signed-off-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1862117
Reviewed-by: Zach Reizner <zachr@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
2019-10-17 23:22:08 +00:00
David Tolnay
48ff4165d2 cargo: Sort all dependency lists in Cargo.toml
This may help reduce cases of conflicts between independent CLs each
appending a dependency at the bottom of the list, of which I hit two
today rebasing some of my open CLs.

TEST=cargo check --all-features

Change-Id: Ief10bb004cc7b44b107dc3841ce36c6b23632aed
Reviewed-on: https://chromium-review.googlesource.com/1557172
Commit-Ready: David Tolnay <dtolnay@chromium.org>
Tested-by: David Tolnay <dtolnay@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2019-04-09 01:55:14 -07:00
David Tolnay
c69ee11e1d edition: Update fuzz crate to 2018 edition
Separated out of CL:1513058 to make it possible to land parts
individually while the affected crate has no other significant CLs
pending. This avoids repeatedly introducing non-textual conflicts with
new code that adds `use` statements.

TEST=cargo check
TEST=cargo check --all-features
TEST=cargo check --target aarch64-unknown-linux-gnu

Change-Id: I355014ebd08bc2a655e1a1bbff56ecc90aa99ece
Reviewed-on: https://chromium-review.googlesource.com/1519695
Commit-Ready: David Tolnay <dtolnay@chromium.org>
Tested-by: David Tolnay <dtolnay@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: David Tolnay <dtolnay@chromium.org>
2019-04-07 23:24:27 -07:00
Dylan Reid
979c696ba6 fuzz: Add block device fuzzer
Add the block device fuzzer that interprets the fuzz data input as
follows:
starting index 8 bytes
command location 8 bytes
command 16 bytes
descriptors circular buffer 16 bytes * 3

Change-Id: I25b58e149bfb9a479fab7955c0ca25c67c590bf6
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/900202
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2019-03-25 21:51:15 -07:00
Dylan Reid
39028af02f fuzz: Add qcow fuzzing
Fuzz using the data as a qcow image with an offset and value to write to
the image.

Change-Id: Iff8f2971ba716c93d978e33338ad62b5d487c115
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/871132
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2019-03-25 21:51:14 -07:00
Dylan Reid
3a42190cc4 fuzz: update to use new cros fuzzing
There is now infrastructure for running fuzzers in cros, use it.

Change-Id: I53ec9e195b7062fdcc38b5186c1f3194031037f3
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1521667
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2019-03-25 17:43:51 -07:00
Dylan Reid
2b2a7d4d76 Add kernel_loader fuzzing
Add a top level fuzz directory. Other fuzz tests will be added here in
subsequent commits.

For now fuzzing must be run manually. Soon there will be a way to
extract the fuzz artifacts and upload them to cluster fuzz.

Change-Id: Iddfb55af78af6f412927b2221f22acb882069d36
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/850851
Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-01-12 22:37:48 -08:00