mirror of
https://chromium.googlesource.com/crosvm/crosvm
synced 2025-02-10 12:09:31 +00:00
646b6ea8fa
Fuzzer targets can be ran with cargo +nightly fuzz run --fuzz-dir crosvm-fuzz --features upstream-fuzz <target> This should enable us to move fuzzing to anywhere including ClusterFuzz while maintain compatibility with cros infra. TEST=`cargo fuzz` won't crash in first 30s, `USE="asan fuzzer" emerge-hatch crosvm` builds, `/build/hatch/usr/libexec/fuzzers/crosvm_qcow_fuzzer` won't crash in first 30s FIXED=b:245007212 BUG=b:244631591 Change-Id: I4b262ee1a6a90247dea96347c55a3849af793bec Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3905095 Auto-Submit: Zihan Chen <zihanchen@google.com> Commit-Queue: Dennis Kempin <denniskempin@google.com> Reviewed-by: Dennis Kempin <denniskempin@google.com>
54 lines
1.6 KiB
Rust
54 lines
1.6 KiB
Rust
// Copyright 2019 The ChromiumOS Authors
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#![no_main]
|
|
|
|
#[cfg(fuzzing)]
|
|
mod fs_server_fuzzer {
|
|
use cros_fuzz::fuzz_target;
|
|
use devices::virtio::create_descriptor_chain;
|
|
use devices::virtio::DescriptorType;
|
|
use devices::virtio::Reader;
|
|
use devices::virtio::Writer;
|
|
use fuse::fuzzing::fuzz_server;
|
|
use std::convert::TryInto;
|
|
use vm_memory::GuestAddress;
|
|
use vm_memory::GuestMemory;
|
|
|
|
const MEM_SIZE: u64 = 256 * 1024 * 1024;
|
|
const BUFFER_ADDR: GuestAddress = GuestAddress(0x100);
|
|
|
|
thread_local! {
|
|
static GUEST_MEM: GuestMemory = GuestMemory::new(&[(GuestAddress(0), MEM_SIZE)]).unwrap();
|
|
}
|
|
|
|
fuzz_target!(|data| {
|
|
use DescriptorType::*;
|
|
|
|
GUEST_MEM.with(|mem| {
|
|
mem.write_all_at_addr(data, BUFFER_ADDR).unwrap();
|
|
|
|
let chain = create_descriptor_chain(
|
|
mem,
|
|
GuestAddress(0),
|
|
BUFFER_ADDR,
|
|
vec![
|
|
(Readable, data.len().try_into().unwrap()),
|
|
(
|
|
Writable,
|
|
(MEM_SIZE as u32)
|
|
.saturating_sub(data.len().try_into().unwrap())
|
|
.saturating_sub(0x100),
|
|
),
|
|
],
|
|
0,
|
|
)
|
|
.unwrap();
|
|
|
|
let r = Reader::new(mem.clone(), chain.clone()).unwrap();
|
|
let w = Writer::new(mem.clone(), chain).unwrap();
|
|
fuzz_server(r, w);
|
|
});
|
|
});
|
|
}
|