diff options
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/qtest/fuzz/fork_fuzz.ld | 5 | ||||
| -rw-r--r-- | tests/qtest/fuzz/fuzz.c | 15 | ||||
| -rw-r--r-- | tests/qtest/fuzz/i440fx_fuzz.c | 3 | ||||
| -rw-r--r-- | tests/qtest/fuzz/virtio_net_fuzz.c | 2 | ||||
| -rw-r--r-- | tests/qtest/fuzz/virtio_scsi_fuzz.c | 2 |
5 files changed, 26 insertions, 1 deletions
diff --git a/tests/qtest/fuzz/fork_fuzz.ld b/tests/qtest/fuzz/fork_fuzz.ld index e086bba873..bfb667ed06 100644 --- a/tests/qtest/fuzz/fork_fuzz.ld +++ b/tests/qtest/fuzz/fork_fuzz.ld @@ -28,6 +28,11 @@ SECTIONS /* Internal Libfuzzer TracePC object which contains the ValueProfileMap */ FuzzerTracePC*(.bss*); + /* + * In case the above line fails, explicitly specify the (mangled) name of + * the object we care about + */ + *(.bss._ZN6fuzzer3TPCE); } .data.fuzz_end : ALIGN(4K) { diff --git a/tests/qtest/fuzz/fuzz.c b/tests/qtest/fuzz/fuzz.c index f5c923852e..33365c3782 100644 --- a/tests/qtest/fuzz/fuzz.c +++ b/tests/qtest/fuzz/fuzz.c @@ -137,6 +137,7 @@ int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) { char *target_name; + char *dir; /* Initialize qgraph and modules */ qos_graph_init(); @@ -147,6 +148,20 @@ int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) target_name = strstr(**argv, "-target-"); if (target_name) { /* The binary name specifies the target */ target_name += strlen("-target-"); + /* + * With oss-fuzz, the executable is kept in the root of a directory (we + * cannot assume the path). All data (including bios binaries) must be + * in the same dir, or a subdir. Thus, we cannot place the pc-bios so + * that it would be in exec_dir/../pc-bios. + * As a workaround, oss-fuzz allows us to use argv[0] to get the + * location of the executable. Using this we add exec_dir/pc-bios to + * the datadirs. + */ + dir = g_build_filename(g_path_get_dirname(**argv), "pc-bios", NULL); + if (g_file_test(dir, G_FILE_TEST_IS_DIR)) { + qemu_add_data_dir(dir); + } + g_free(dir); } else if (*argc > 1) { /* The target is specified as an argument */ target_name = (*argv)[1]; if (!strstr(target_name, "--fuzz-target=")) { diff --git a/tests/qtest/fuzz/i440fx_fuzz.c b/tests/qtest/fuzz/i440fx_fuzz.c index bcd6769b4c..e2f31e56f9 100644 --- a/tests/qtest/fuzz/i440fx_fuzz.c +++ b/tests/qtest/fuzz/i440fx_fuzz.c @@ -151,12 +151,13 @@ static void i440fx_fuzz_qos_fork(QTestState *s, i440fx_fuzz_qos(s, Data, Size); _Exit(0); } else { + flush_events(s); wait(NULL); } } static const char *i440fx_qtest_argv = TARGET_NAME " -machine accel=qtest" - "-m 0 -display none"; + " -m 0 -display none"; static const char *i440fx_argv(FuzzTarget *t) { return i440fx_qtest_argv; diff --git a/tests/qtest/fuzz/virtio_net_fuzz.c b/tests/qtest/fuzz/virtio_net_fuzz.c index d08a47e278..a33bd73067 100644 --- a/tests/qtest/fuzz/virtio_net_fuzz.c +++ b/tests/qtest/fuzz/virtio_net_fuzz.c @@ -122,6 +122,7 @@ static void virtio_net_fork_fuzz(QTestState *s, flush_events(s); _Exit(0); } else { + flush_events(s); wait(NULL); } } @@ -134,6 +135,7 @@ static void virtio_net_fork_fuzz_check_used(QTestState *s, flush_events(s); _Exit(0); } else { + flush_events(s); wait(NULL); } } diff --git a/tests/qtest/fuzz/virtio_scsi_fuzz.c b/tests/qtest/fuzz/virtio_scsi_fuzz.c index 3b95247f12..51dce491ab 100644 --- a/tests/qtest/fuzz/virtio_scsi_fuzz.c +++ b/tests/qtest/fuzz/virtio_scsi_fuzz.c @@ -145,6 +145,7 @@ static void virtio_scsi_fork_fuzz(QTestState *s, flush_events(s); _Exit(0); } else { + flush_events(s); wait(NULL); } } @@ -164,6 +165,7 @@ static void virtio_scsi_with_flag_fuzz(QTestState *s, } _Exit(0); } else { + flush_events(s); wait(NULL); } } |