Skip to content

Commit fc1c834

Browse files
a1xndrbonzini
a1xndr
authored and
bonzini
committed
fuzz: ignore address_space_map is_write flag
We passed an is_write flag to the fuzz_dma_read_cb function to differentiate between the mapped DMA regions that need to be populated with fuzzed data, and those that don't. We simply passed through the address_space_map is_write parameter. The goal was to cut down on unnecessarily populating mapped DMA regions, when they are not read from. Unfortunately, nothing precludes code from reading from regions mapped with is_write=true. For example, see: https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg04729.html This patch removes the is_write parameter to fuzz_dma_read_cb. As a result, we will fill all mapped DMA regions with fuzzed data, ignoring the specified transfer direction. Signed-off-by: Alexander Bulekov <[email protected]> Reviewed-by: Darren Kenny <[email protected]> Message-Id: <[email protected]>
1 parent 6f0e9c2 commit fc1c834

File tree

6 files changed

+17
-23
lines changed

6 files changed

+17
-23
lines changed

‎include/exec/memory.h

+3-5
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,11 @@ DECLARE_OBJ_CHECKERS(IOMMUMemoryRegion, IOMMUMemoryRegionClass,
4545
#ifdef CONFIG_FUZZ
4646
void fuzz_dma_read_cb(size_t addr,
4747
size_t len,
48-
MemoryRegion *mr,
49-
bool is_write);
48+
MemoryRegion *mr);
5049
#else
5150
static inline void fuzz_dma_read_cb(size_t addr,
5251
size_t len,
53-
MemoryRegion *mr,
54-
bool is_write)
52+
MemoryRegion *mr)
5553
{
5654
/* Do Nothing */
5755
}
@@ -2506,7 +2504,7 @@ address_space_read_cached(MemoryRegionCache *cache, hwaddr addr,
25062504
void *buf, hwaddr len)
25072505
{
25082506
assert(addr < cache->len && len <= cache->len - addr);
2509-
fuzz_dma_read_cb(cache->xlat + addr, len, cache->mrs.mr, false);
2507+
fuzz_dma_read_cb(cache->xlat + addr, len, cache->mrs.mr);
25102508
if (likely(cache->ptr)) {
25112509
memcpy(buf, cache->ptr + addr, len);
25122510
return MEMTX_OK;

‎include/exec/memory_ldst_cached.h.inc

+3-3
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ static inline uint32_t ADDRESS_SPACE_LD_CACHED(l)(MemoryRegionCache *cache,
2828
hwaddr addr, MemTxAttrs attrs, MemTxResult *result)
2929
{
3030
assert(addr < cache->len && 4 <= cache->len - addr);
31-
fuzz_dma_read_cb(cache->xlat + addr, 4, cache->mrs.mr, false);
31+
fuzz_dma_read_cb(cache->xlat + addr, 4, cache->mrs.mr);
3232
if (likely(cache->ptr)) {
3333
return LD_P(l)(cache->ptr + addr);
3434
} else {
@@ -40,7 +40,7 @@ static inline uint64_t ADDRESS_SPACE_LD_CACHED(q)(MemoryRegionCache *cache,
4040
hwaddr addr, MemTxAttrs attrs, MemTxResult *result)
4141
{
4242
assert(addr < cache->len && 8 <= cache->len - addr);
43-
fuzz_dma_read_cb(cache->xlat + addr, 8, cache->mrs.mr, false);
43+
fuzz_dma_read_cb(cache->xlat + addr, 8, cache->mrs.mr);
4444
if (likely(cache->ptr)) {
4545
return LD_P(q)(cache->ptr + addr);
4646
} else {
@@ -52,7 +52,7 @@ static inline uint32_t ADDRESS_SPACE_LD_CACHED(uw)(MemoryRegionCache *cache,
5252
hwaddr addr, MemTxAttrs attrs, MemTxResult *result)
5353
{
5454
assert(addr < cache->len && 2 <= cache->len - addr);
55-
fuzz_dma_read_cb(cache->xlat + addr, 2, cache->mrs.mr, false);
55+
fuzz_dma_read_cb(cache->xlat + addr, 2, cache->mrs.mr);
5656
if (likely(cache->ptr)) {
5757
return LD_P(uw)(cache->ptr + addr);
5858
} else {

‎memory_ldst.c.inc

+4-4
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ static inline uint32_t glue(address_space_ldl_internal, SUFFIX)(ARG1_DECL,
4242
MO_32 | devend_memop(endian), attrs);
4343
} else {
4444
/* RAM case */
45-
fuzz_dma_read_cb(addr, 4, mr, false);
45+
fuzz_dma_read_cb(addr, 4, mr);
4646
ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
4747
switch (endian) {
4848
case DEVICE_LITTLE_ENDIAN:
@@ -111,7 +111,7 @@ static inline uint64_t glue(address_space_ldq_internal, SUFFIX)(ARG1_DECL,
111111
MO_64 | devend_memop(endian), attrs);
112112
} else {
113113
/* RAM case */
114-
fuzz_dma_read_cb(addr, 8, mr, false);
114+
fuzz_dma_read_cb(addr, 8, mr);
115115
ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
116116
switch (endian) {
117117
case DEVICE_LITTLE_ENDIAN:
@@ -177,7 +177,7 @@ uint32_t glue(address_space_ldub, SUFFIX)(ARG1_DECL,
177177
r = memory_region_dispatch_read(mr, addr1, &val, MO_8, attrs);
178178
} else {
179179
/* RAM case */
180-
fuzz_dma_read_cb(addr, 1, mr, false);
180+
fuzz_dma_read_cb(addr, 1, mr);
181181
ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
182182
val = ldub_p(ptr);
183183
r = MEMTX_OK;
@@ -215,7 +215,7 @@ static inline uint32_t glue(address_space_lduw_internal, SUFFIX)(ARG1_DECL,
215215
MO_16 | devend_memop(endian), attrs);
216216
} else {
217217
/* RAM case */
218-
fuzz_dma_read_cb(addr, 2, mr, false);
218+
fuzz_dma_read_cb(addr, 2, mr);
219219
ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
220220
switch (endian) {
221221
case DEVICE_LITTLE_ENDIAN:

‎softmmu/memory.c

+2-3
Original file line numberDiff line numberDiff line change
@@ -1440,7 +1440,7 @@ MemTxResult memory_region_dispatch_read(MemoryRegion *mr,
14401440
unsigned size = memop_size(op);
14411441
MemTxResult r;
14421442

1443-
fuzz_dma_read_cb(addr, size, mr, false);
1443+
fuzz_dma_read_cb(addr, size, mr);
14441444
if (!memory_region_access_valid(mr, addr, size, false, attrs)) {
14451445
*pval = unassigned_mem_read(mr, addr, size);
14461446
return MEMTX_DECODE_ERROR;
@@ -3285,8 +3285,7 @@ void memory_region_init_rom_device(MemoryRegion *mr,
32853285
#ifdef CONFIG_FUZZ
32863286
void __attribute__((weak)) fuzz_dma_read_cb(size_t addr,
32873287
size_t len,
3288-
MemoryRegion *mr,
3289-
bool is_write)
3288+
MemoryRegion *mr)
32903289
{
32913290
}
32923291
#endif

‎softmmu/physmem.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -2839,7 +2839,7 @@ MemTxResult flatview_read_continue(FlatView *fv, hwaddr addr,
28392839
stn_he_p(buf, l, val);
28402840
} else {
28412841
/* RAM case */
2842-
fuzz_dma_read_cb(addr, len, mr, false);
2842+
fuzz_dma_read_cb(addr, len, mr);
28432843
ram_ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l, false);
28442844
memcpy(buf, ram_ptr, l);
28452845
}
@@ -3200,7 +3200,7 @@ void *address_space_map(AddressSpace *as,
32003200
memory_region_ref(mr);
32013201
*plen = flatview_extend_translation(fv, addr, len, mr, xlat,
32023202
l, is_write, attrs);
3203-
fuzz_dma_read_cb(addr, *plen, mr, is_write);
3203+
fuzz_dma_read_cb(addr, *plen, mr);
32043204
ptr = qemu_ram_ptr_length(mr->ram_block, xlat, plen, true);
32053205

32063206
return ptr;

‎tests/qtest/fuzz/generic_fuzz.c

+3-6
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ static int memory_access_size(MemoryRegion *mr, unsigned l, hwaddr addr)
175175
* generic_fuzz(), avoiding potential race-conditions, which we don't have
176176
* a good way for reproducing right now.
177177
*/
178-
void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr, bool is_write)
178+
void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr)
179179
{
180180
/* Are we in the generic-fuzzer or are we using another fuzz-target? */
181181
if (!qts_global) {
@@ -187,14 +187,11 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr, bool is_write)
187187
* - We have no DMA patterns defined
188188
* - The length of the DMA read request is zero
189189
* - The DMA read is hitting an MR other than the machine's main RAM
190-
* - The DMA request is not a read (what happens for a address_space_map
191-
* with is_write=True? Can the device use the same pointer to do reads?)
192190
* - The DMA request hits past the bounds of our RAM
193191
*/
194192
if (dma_patterns->len == 0
195193
|| len == 0
196194
|| mr != current_machine->ram
197-
|| is_write
198195
|| addr > current_machine->ram_size) {
199196
return;
200197
}
@@ -213,12 +210,12 @@ void fuzz_dma_read_cb(size_t addr, size_t len, MemoryRegion *mr, bool is_write)
213210
double_fetch = true;
214211
if (addr < region.addr
215212
&& avoid_double_fetches) {
216-
fuzz_dma_read_cb(addr, region.addr - addr, mr, is_write);
213+
fuzz_dma_read_cb(addr, region.addr - addr, mr);
217214
}
218215
if (addr + len > region.addr + region.size
219216
&& avoid_double_fetches) {
220217
fuzz_dma_read_cb(region.addr + region.size,
221-
addr + len - (region.addr + region.size), mr, is_write);
218+
addr + len - (region.addr + region.size), mr);
222219
}
223220
return;
224221
}

0 commit comments

Comments
 (0)