search

nutanix / libvfio-user

framework for emulating devices in userspace
BSD 3-Clause "New" or "Revised" License
166 stars 51 forks source link

support AFL++ fuzzing #623

Closed jlevon closed 2 years ago

jlevon commented 2 years ago

Why can't the existing UNIX domain socket transport be used for fuzzing?

AFL expects to be able to start a process and write to it for fuzzing, so going through unix domain socket doesn't work (easily).

I see some duplication between tran_sock and tran_pipe, could we avoid that by moving the tran_pipe stuff into tran_sock?

Yeah, at least negotiate has a ton of duplication, let me take a look at fixing this.

jlevon commented 2 years ago

Thanos: I refactored to share the negotiate code. I think trying to go any further would actually complicate things more - I don't want to add too much more to tran API.

swapnili commented 2 years ago

I do not like the fact that this code around VFU_TRANS_PIPE will be part of regular builds although used only for testing. Can we somehow extract it out and build only in case for AFL testing?

jlevon commented 2 years ago

I don't want this to regress (not build) as we make changes though. I could add a build option, and only set it for "make pre-push" (or if explicitly given) ? Would that be better?

swapnili commented 2 years ago

I don't want this to regress (not build) as we make changes though. I could add a build option, and only set it for "make pre-push" (or if explicitly given) ? Would that be better?

Yes that would be better to build only in case if explicitly asked or pre-push. Thanks

jlevon commented 2 years ago

@swapnili @tmakatos ok now?