r may be enough.
From: Klaus Jensen
Sent: Friday, December 17, 2021 16:37
To: Qiuhao Li
Cc: Alexander Bulekov; qemu-devel@nongnu.org; Laurent Vivier; Peter Maydell;
Mauro Matteo Cascella; Daniel P. Berrangé; David Hildenbrand; Jason Wang; Bin
Meng; Li Qiang; Thomas Huth; Peter Xu;
ilippe Mathieu-Daudé. Should we put the
reproducer above to https://gitlab.com/qemu-project/qemu/-/issues/556?
From: Alexander Bulekov
Sent: Friday, December 17, 2021 11:08
To: qemu-devel@nongnu.org
Cc: Alexander Bulekov ; Philippe Mathieu-Daudé
; Mauro Matteo C
rg
Cc: Paolo Bonzini ; Bandan Das ; Stefan
Hajnoczi ; Thomas Huth ; Darren Kenny
; Qiuhao Li
Subject: Possible reward for fuzzer bug fixes? Secure Open Source Rewards
Program
Recently a pilot for the Secure Open Source Rewards program was
announced [1]. Currently this program is run by the Linux F
To keep me cc-ed when something changes. Suggested by Alexander.
https://lists.gnu.org/archive/html/qemu-devel/2021-08/msg03631.html
Signed-off-by: Qiuhao Li
---
MAINTAINERS | 1 +
1 file changed, 1 insertion(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index 6b3697962c..3a979b1bc7 100644
--- a
Aha! Nice patch.
My fault. I will search first next time :)
Thanks.
Qiuhao Li
On Mon, 2021-08-23 at 08:41 -0400, Alexander Bulekov wrote:
> On 210823 2034, Qiuhao Li wrote:
> > I think the check in fuzz_dma_read_cb() is buggy because it doesn't
> > consider when the wri
/* ROM/RAM case */
// mr1 == sparse_mem_mr but it's not RAM or ROM <--
// May overlap with mmio regions<--
...
qtest_memwrite(qts_global, addr, buf, l);
Thanks.
Qiuhao Li
On Mon, 2021-08-23 at 04:14 -0400, Alexander Bulekov wrote:
> I'm not su
/technical-sessions/presentation/wang-pengfei
[2]
https://www.voidsecurity.in/2018/08/from-compiler-optimization-to-code.html
Thanks,
Qiuhao Li
e run each input in a forked process. Maybe you need to run
> "set follow-fork-mode child" in gdb?
Hi Alex,
Just curious why you choose to use the libfuzzer at first instead of
AFL and its descendants like AFL++ since they use a forkserver by
design, and the performance also seems better [1].
[1] https://www.fuzzbench.com/reports/2021-02-13-paper/index.html
Thank you.
Qiuhao Li
Public bug reported:
--[ Reproducer
cat << EOF | ./build/qemu-system-i386 -machine q35,accel=qtest -nodefaults \
-device virtio-mouse -display none -qtest stdio
outl 0xcf8 0x8820
outl 0xcfc 0xe0004000
outl 0xcf8 0x8804
outb 0xcfc 0x02
write 0xe000400c 0x4 0x003fe62e
write 0xe0004016 0x1 0
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index 4cba96dee2..20825768c2 100755
--- a/scripts/oss-fuzz
On Tue, 2021-01-12 at 16:02 +, Peter Maydell wrote:
> On Tue, 12 Jan 2021 at 15:23, Qiuhao Li
> wrote:
> > Fix Bug 1910826 [1] / OSS-Fuzz Issue 29224 [2].
> >
> > In rtl8139.c, the function rtl8139_RxBuf_write, which sets the
> > RxBuf
> > (Receive Buf
.launchpad.net/bugs/1910826
[2] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29224
[3] https://www.cs.usfca.edu/~cruse/cs326f04/RTL8139D_DataSheet.pdf
5.7 Transmit Configuration Register
[4] https://bugs.launchpad.net/qemu/+bug/1910826/comments/1
Signed-off-by: Qiuhao Li
Reported-by: A
A more concise version and corresponding notes. Might help :)
-- [ Reproducer
cat << EOF | ../build/qemu-system-i386 -machine q35 \
-nodefaults -device rtl8139,netdev=net0 \
-netdev user,id=net0 -display none -qtest stdio
outl 0xcf8 0x8804
outb 0xcfc 0x06
outl 0xcf8 0x8817
outb 0xcfc 0xf
On Mon, 2021-01-11 at 11:26 +0100, Thomas Huth wrote:
> On 11/01/2021 10.39, Qiuhao Li wrote:
> > On Mon, 2021-01-11 at 10:01 +0100, Philippe Mathieu-Daudé wrote:
> > > On 1/11/21 7:11 AM, Qiuhao Li wrote:
> > > > Simplifying the crash cases by opportunist
On Mon, 2021-01-11 at 10:01 +0100, Philippe Mathieu-Daudé wrote:
> On 1/11/21 7:11 AM, Qiuhao Li wrote:
> > Simplifying the crash cases by opportunistically setting bits in
> > operands of
> > out/write to zero may help to debug, since usually bit one means
> > turn o
If previous write commands write the same length of data with the same step,
we view it as a hint.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 56
1 file changed, 56 insertions
-M1: remove IO commands iteratively
-M2: try setting bits in operand of write/out to zero
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 30
1 file changed, 26 insertions(+), 4
Simplifying the crash cases by opportunistically setting bits in operands of
out/write to zero may help to debug, since usually bit one means turn on or
trigger a function while zero is the default turn-off setting.
Tested Bug 1908062.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
ested with Bug 1908062.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41 +++-
1 file changed, 26 insertions(+), 15 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/script
uxx
-xuxx Fail
-xuxx Fail
xuxx- Fail
...
I think the trade-off is worth it.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 29
1 f
with quadrupled trace input at:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Patched 1/6 version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Refined version:
real 0m11.412s
user 0m6.888s
sys 0m3.325s
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
[1] https://bugs.launchpad.net/qemu/+bug/1910826
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 42 +---
1 file changed, 30 insertions(+), 12 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtes
nder Bulekov
Qiuhao Li (7):
fuzz: accelerate non-crash detection
fuzz: double the IOs to remove for every loop
fuzz: split write operand using binary approach
fuzz: remove IO commands iteratively
fuzz: set bits in operand of write/out to zero
fuzz: add minimization options
fuzz: heu
On Sun, 2021-01-10 at 11:00 -0500, Alexander Bulekov wrote:
> On 210110 2110, Qiuhao Li wrote:
> > On Wed, 2021-01-06 at 23:18 -0500, Alexander Bulekov wrote:
> > > On 201229 1240, Qiuhao Li wrote:
> > > > We spend much time waiting for the timeout program d
: [PATCH 3/4] typo in comments
Discard: [PATCH 1/4] the hardcoded regex match for crash detection
Discard: [PATCH 4/4] the delaying minimizer
Thanks for the suggestions from:
Alexander Bulekov
Qiuhao Li (7):
fuzz: accelerate non-crash detection
fuzz: double the IOs to remove for every
If previous write commands write the same length of data with the same step,
we view it as a hint.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 56
1 file changed, 56 insertions
uxx
-xuxx Fail
-xuxx Fail
xuxx- Fail
...
I think the trade-off is worth it.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 29
1 f
-M1: remove IO commands iteratively
-M2: try setting bits in operand of write/out to zero
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 30
1 file changed, 26 insertions(+), 4
ested with Bug 1908062.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41 +++-
1 file changed, 26 insertions(+), 15 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/script
Simplifying the crash cases by opportunistically setting bits in operands of
out/write to zero may help to debug, since usually bit one means turn on or
trigger a function while zero is the default turn-off setting.
Tested Bug 1908062.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
with quadrupled trace input at:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Patched 1/6 version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Refined version:
real 0m11.412s
user 0m6.888s
sys 0m3.325s
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
[1] https://bugs.launchpad.net/qemu/+bug/1910826
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 43 +---
1 file changed, 31 insertions(+), 12 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index
On Wed, 2021-01-06 at 23:18 -0500, Alexander Bulekov wrote:
> On 201229 1240, Qiuhao Li wrote:
> > We spend much time waiting for the timeout program during the
> > minimization
> > process until it passes a time limit. This patch hacks the CLOSED
> > (indicates
>
If previous write commands write the same length of data with the same step,
we view it as a hint.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 56
1 file changed, 56 insertions
-M1: remove IO commands iteratively
-M2: try setting bits in operand of write/out to zero
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 30
1 file changed, 26 insertions(+), 4
Simplifying the crash cases by opportunistically setting bits in operands of
out/write to zero may help to debug, since usually bit one means turn on or
trigger a function while zero is the default turn-off setting.
Tested Bug 1908062.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
ested with Bug 1908062.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41 +++-
1 file changed, 26 insertions(+), 15 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/script
uxx
-xuxx Fail
-xuxx Fail
xuxx- Fail
...
I think the trade-off is worth it.
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
scripts/oss-fuzz/minimize_qtest_trace.py | 29
1 f
with quadrupled trace input at:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Patched 1/6 version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Refined version:
real 0m11.412s
user 0m6.888s
sys 0m3.325s
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
t:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Original version:
real 1m37.246s
user 0m13.069s
sys 0m8.399s
Refined version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Signed-off-by: Qiuhao Li
Reviewed-by: Alexander Bulekov
Tested-by: Alexander Bulekov
---
script
he hardcoded regex match for crash detection
Discard: [PATCH 4/4] the delaying minimizer
Thanks for the suggestions from:
Alexander Bulekov
Qiuhao Li (7):
fuzz: accelerate non-crash detection
fuzz: double the IOs to remove for every loop
fuzz: split write operand using binary approach
fuz
On Thu, 2021-01-07 at 23:30 -0500, Alexander Bulekov wrote:
> Hi Qiuhao,
> Can you add my Reviewed-by: tags to the patches that I have reviewed?
> Thanks
> -Alex
Ok, fixed in version 6, thanks.
>
> On 210108 1044, Qiuhao Li wrote:
> > Extend and refine the crash c
If previous write commands write the same length of data with the same step,
we view it as a hint.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 56
1 file changed, 56 insertions(+)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b
-M1: remove IO commands iteratively
-M2: try setting bits in operand of write/out to zero
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 30
1 file changed, 26 insertions(+), 4 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
Simplifying the crash cases by opportunistically setting bits in operands of
out/write to zero may help to debug, since usually bit one means turn on or
trigger a function while zero is the default turn-off setting.
Tested Bug 1908062.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz
ested with Bug 1908062.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41 +++-
1 file changed, 26 insertions(+), 15 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index 5cf39f4e6e..45c16
uxx
-xuxx Fail
-xuxx Fail
xuxx- Fail
...
I think the trade-off is worth it.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 29
1 file changed, 20 insertions(+), 9 deletions(-)
diff --git a/s
with quadrupled trace input at:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Patched 1/6 version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Refined version:
real 0m11.412s
user 0m6.888s
sys 0m3.325s
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz
t:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Original version:
real 1m37.246s
user 0m13.069s
sys 0m8.399s
Refined version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 39
1 file c
rd: [PATCH 4/4] the delaying minimizer
Thanks for the suggestions from:
Alexander Bulekov
Qiuhao Li (7):
fuzz: accelerate non-crash detection
fuzz: double the IOs to remove for every loop
fuzz: split write operand using binary approach
fuzz: remove IO commands iteratively
fuzz:
On Wed, 2021-01-06 at 23:53 -0500, Alexander Bulekov wrote:
> On 201229 1240, Qiuhao Li wrote:
> > Now we use a one-time scan and remove strategy in the remval
> > minimizer,
> > which is not suitable for timing dependent instructions.
> >
> > For example, instr
On Wed, 2021-01-06 at 23:18 -0500, Alexander Bulekov wrote:
> On 201229 1240, Qiuhao Li wrote:
> > We spend much time waiting for the timeout program during the
> > minimization
> > process until it passes a time limit. This patch hacks the CLOSED
> > (indicates
>
Kindly ping :)
Wondering if there is anything wrong with this patch?
On Tue, 2020-12-29 at 12:39 +0800, Qiuhao Li wrote:
> Extend and refine the crash case minimization process.
>
> Test input:
> Bug 1909261 full_reproducer
> 6500 QTest instructions (write mostly)
&g
-M1: loop around the remove minimizer
-M2: try setting bits in operand of write/out to zero
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 32 +++-
1 file changed, 26 insertions(+), 6 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
Simplifying the crash cases by opportunistically setting bits in operands of
out/write to zero may help to debug, since usually bit one means turn on or
trigger a function while zero is the default turn-off setting.
Tested Bug 1908062.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz
uxx
-xuxx Fail
-xuxx Fail
xuxx- Fail
...
I think the trade-off is worth it.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 29
1 file changed, 20 insertions(+), 9 deletions(-)
diff --git a/s
rging.
Tested with Bug 1908062.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41 +++-
1 file changed, 26 insertions(+), 15 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index 1a26b
If previous write commands write the same length of data with the same step,
we view it as a hint.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 56
1 file changed, 56 insertions(+)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b
with quadrupled trace input at:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Patched 1/6 version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Refined version:
real 0m11.412s
user 0m6.888s
sys 0m3.325s
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz
t:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Original version:
real 1m37.246s
user 0m13.069s
sys 0m8.399s
Refined version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41
1 file c
estions from:
Alexander Bulekov
Qiuhao Li (7):
fuzz: accelerate non-crash detection
fuzz: double the IOs to remove for every loop
fuzz: split write operand using binary approach
fuzz: loop the remove minimizer and refactoring
fuzz: set bits in operand of write/out to zero
fuzz: add minimiza
Simplifying the crash cases by opportunistically setting bits in operands of
out/write to zero may help to debug, since usually bit one means turn on or
trigger a function while zero is the default turn-off setting.
Tested Bug 1908062.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz
If previous write commands write the same length of data with the same step,
we view it as a hint.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 55
1 file changed, 55 insertions(+)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b
rging.
Tested with Bug 1908062.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 80 +++-
1 file changed, 65 insertions(+), 15 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index 1a26b
uxx
-xuxx Fail
-xuxx Fail
xuxx- Fail
...
I think the trade-off is worth it.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 29
1 file changed, 20 insertions(+), 9 deletions(-)
diff --git a/s
-M1: loop around the remove minimizer
-M2: try setting bits in operand of write/out to zero
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 30
1 file changed, 25 insertions(+), 5 deletions(-)
diff --git a/scripts/oss-fuzz
with quadrupled trace input at:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Patched 1/6 version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Refined version:
real 0m11.412s
user 0m6.888s
sys 0m3.325s
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz
t:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Original version:
real 1m37.246s
user 0m13.069s
sys 0m8.399s
Refined version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41
1 file c
4/7]
New: [PATCH v2 6/7]
New: [PATCH v2 7/7]
Fix: [PATCH 2/4] split using binary approach
Fix: [PATCH 3/4] typo in comments
Discard: [PATCH 1/4] the hardcoded regex match for crash detection
Discard: [PATCH 4/4] the delaying minimizer
Thanks for the suggestions from:
Alexander Bul
If previous write commands write the same length of data with the same step,
we view it as a hint.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 55
1 file changed, 55 insertions(+)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b
Simplifying the crash cases by opportunistically setting bits in operands of
out/write to zero may help to debug, since usually bit one means turn on or
trigger a function while zero is the default turn-off setting.
Tested Bug 1908062.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz
-M1: loop around the remove minimizer
-M2: try setting bits in operand of write/out to zero
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 30
1 file changed, 25 insertions(+), 5 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
with quadrupled trace input at:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Patched 1/6 version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Refined version:
real 0m11.412s
user 0m6.888s
sys 0m3.325s
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz
rging.
Tested with Bug 1908062.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41 +++-
1 file changed, 26 insertions(+), 15 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index dd6ee
uxx
-xuxx Fail
-xuxx Fail
xuxx- Fail
...
I think the trade-off is worth it.
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 29
1 file changed, 20 insertions(+), 9 deletions(-)
diff --git a/s
t:
https://bugs.launchpad.net/qemu/+bug/1890333/comments/1
Original version:
real 1m37.246s
user 0m13.069s
sys 0m8.399s
Refined version:
real 0m45.904s
user 0m16.874s
sys 0m10.042s
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 41
1 file c
H v2 7/7]
Fix: [PATCH 2/4] split using binary approach
Fix: [PATCH 3/4] typo in comments
Discard: [PATCH 1/4] the hardcoded regex match for crash detection
Discard: [PATCH 4/4] the delaying minimizer
Thanks for the suggestions from:
Alexander Bulekov
Qiuhao Li (7):
fuzz: accelerate non-
On Tue, 2020-12-22 at 13:30 -0500, Alexander Bulekov wrote:
> On 201222 1922, Qiuhao Li wrote:
> > On Mon, 2020-12-21 at 16:17 -0500, Alexander Bulekov wrote:
> > > On 201220 0256, Qiuhao Li wrote:
> > > > Since programmers usually trigger an IO just before they n
This email looks empty. Is this intentional?
On Mon, 2020-12-21 at 13:46 -0500, Alexander Bulekov wrote:
>
On Mon, 2020-12-21 at 16:17 -0500, Alexander Bulekov wrote:
> On 201220 0256, Qiuhao Li wrote:
> > Since programmers usually trigger an IO just before they need it.
> > Try to
> > delay some IO instructions may help us better understanding the
> > timing
> > co
On Mon, 2020-12-21 at 15:35 -0500, Alexander Bulekov wrote:
> On 201220 0256, Qiuhao Li wrote:
> > Simplifying the crash cases by opportunistically setting bits in
> > operands of
> > out/write to zero may help to debug, since usually bit one means
> > turn on
> >
On Mon, 2020-12-21 at 15:01 -0500, Alexander Bulekov wrote:
> Qiuhao Li writes:
>
> > Currently, we split the write commands' data from the middle. If it
> > does not
> > work, try to move the pivot "left" and retry until there is no
> > space left.
0x0
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 21 +
1 file changed, 21 insertions(+)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index f3e88064c4..da7aa73b3c 100755
--- a/scripts/oss-fuzz
write 0xc33002 0x1 0x8a
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_qtest_trace.py
index d3b09e6567..855c3bcb54 1
e 0x5c 0x1 0x19
write 0xc33002 0x1 0x0 <-- write 0xc33002 0x1 0x8a
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 42 +++-
1 file changed, 41 insertions(+), 1 deletion(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
input that doesn't crash
Trace input that crashes Qtest
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 59 ++--
1 file changed, 46 insertions(+), 13 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_q
Extend and refine the crash case minimization process.
I forgot to cc some reviewers in the last patch, so I merge it as the
first on in this patch series.
Qiuhao Li (4):
fuzz: refine crash detection mechanism
fuzz: split QTest writes from the rightmost byte
fuzz: setting bits in operand
input that doesn't crash
Trace input that crashes Qtest
Signed-off-by: Qiuhao Li
---
scripts/oss-fuzz/minimize_qtest_trace.py | 60 +++-
1 file changed, 47 insertions(+), 13 deletions(-)
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py
b/scripts/oss-fuzz/minimize_q
There is a new bug that fails the same assertion, and maybe its minimized
producer will help:
https://bugs.launchpad.net/qemu/+bug/1908062
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1890333
Tit
Hi,
It seems while the minimized producer doesn't fail the assertion now,
the original reproducer provided by OSS-Fuzz[1] can still crash the
latest QEMU (1758428, Dec 12, built with --enable-sanitizers --enable-
fuzzing). Could anyone check if they trigger different bugs?
Tested on:
Ubuntu: 20
--[ Original Fuzzing output
./build/qemu-fuzz-i386 --fuzz-target=generic-fuzz-virtio-vga
../fuzz/20201208/crash-da778083c63d2b24d8f7780383b2602a7a156352
qemu-fuzz-i386:
/home/qiuhao/hack/qemu/include/exec/memory_ldst_cached.h.inc:88: void
address_space_stw_le_cached(MemoryRegionCache *, hwaddr,
Public bug reported:
When I was fuzzing virtio-vga device of the latest QEMU (1758428, Dec
12, built with --enable-sanitizers --enable-fuzzing), an assertion
failed in include/exec/memory_ldst_cached.h.inc.
--[ Reproducer
cat << EOF | ./build/i386-softmmu/qemu-system-i386 -machine accel=qtest \
92 matches
Mail list logo
