search

microsoft / ebpf-for-windows

eBPF implementation that runs on top of Windows
MIT License
2.66k stars 206 forks source link

libfuzzer based fuzzer's aren't covering all code paths #3455

Open Alan-Jowett opened 3 months ago

Alan-Jowett commented 3 months ago

1) Launch execution context fuzzer under debugger. 2) Place breakpoints on all protocol handler functions. 3) As each function is hit, remove that breakpoint.

Expected result: All protocol handles should be hit at least once.

Actual result: The following were never hit:

execution_context_fuzzer!_ebpf_core_protocol_map_update_element_with_handle
execution_context_fuzzer!_ebpf_core_protocol_ring_buffer_map_query_buffer
execution_context_fuzzer!_ebpf_core_protocol_create_program
execution_context_fuzzer!_ebpf_core_protocol_load_code
execution_context_fuzzer!_ebpf_core_protocol_map_get_next_key_value_batch
execution_context_fuzzer!_ebpf_core_protocol_get_pinned_object
execution_context_fuzzer!_ebpf_core_protocol_get_pinned_map_info
execution_context_fuzzer!_ebpf_core_protocol_create_map
execution_context_fuzzer!_ebpf_core_protocol_get_program_handle_by_id
execution_context_fuzzer!_ebpf_core_protocol_link_program
execution_context_fuzzer!_ebpf_core_protocol_close_handle
execution_context_fuzzer!_ebpf_core_protocol_map_delete_element
execution_context_fuzzer!_ebpf_core_protocol_map_update_element
execution_context_fuzzer!_ebpf_core_protocol_convert_pinning_entries_to_map_info_array
execution_context_fuzzer!_ebpf_core_protocol_get_link_handle_by_id
execution_context_fuzzer!_ebpf_core_protocol_unlink_program
execution_context_fuzzer!_ebpf_core_protocol_get_map_handle_by_id
execution_context_fuzzer!_ebpf_core_protocol_map_update_element_batch
execution_context_fuzzer!_ebpf_core_protocol_map_delete_element_batch
execution_context_fuzzer!_ebpf_core_protocol_load_native_module
execution_context_fuzzer!_ebpf_core_protocol_serialize_map_info_reply
execution_context_fuzzer!_ebpf_core_protocol_bind_map
execution_context_fuzzer!_ebpf_core_protocol_get_ec_function
shankarseal commented 2 months ago

Since libfuzzer sets the reply buffer size to random value, it misses all the protocol messages that require a specific size.