From 51307dd5093536b6f2eb8aedb9311105552f5937 Mon Sep 17 00:00:00 2001
From: Bo Chen <chen.bo@intel.com>
Date: Wed, 7 Dec 2022 11:32:14 -0800
Subject: [PATCH] fuzz: Add fuzzer for 'linux loader' cmdline

Signed-off-by: Bo Chen <chen.bo@intel.com>
---
 fuzz/Cargo.toml                           |  6 ++++
 fuzz/fuzz_targets/linux_loader_cmdline.rs | 34 +++++++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 fuzz/fuzz_targets/linux_loader_cmdline.rs

diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index 4ab3d9869..0e086422e 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -82,6 +82,12 @@ path = "fuzz_targets/linux_loader.rs"
 test = false
 doc = false
 
+[[bin]]
+name = "linux_loader_cmdline"
+path = "fuzz_targets/linux_loader_cmdline.rs"
+test = false
+doc = false
+
 [[bin]]
 name = "mem"
 path = "fuzz_targets/mem.rs"
diff --git a/fuzz/fuzz_targets/linux_loader_cmdline.rs b/fuzz/fuzz_targets/linux_loader_cmdline.rs
new file mode 100644
index 000000000..82a1bd76d
--- /dev/null
+++ b/fuzz/fuzz_targets/linux_loader_cmdline.rs
@@ -0,0 +1,34 @@
+// Copyright 2018 The Chromium OS Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Copyright © 2022 Intel Corporation
+//
+// SPDX-License-Identifier: Apache-2.0 AND BSD-3-Clause
+
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use vm_memory::{bitmap::AtomicBitmap, GuestAddress};
+
+type GuestMemoryMmap = vm_memory::GuestMemoryMmap<AtomicBitmap>;
+
+const MEM_SIZE: usize = 256 * 1024 * 1024;
+// From 'arch::x86_64::layout::CMDLINE_START'
+const CMDLINE_START: GuestAddress = GuestAddress(0x20000);
+
+fuzz_target!(|bytes| {
+    let payload_config = vmm::config::PayloadConfig {
+        firmware: None,
+        kernel: None,
+        cmdline: Some(String::from_utf8_lossy(&bytes).to_string()),
+        initramfs: None,
+    };
+    let kernel_cmdline = match vmm::vm::Vm::generate_cmdline(&payload_config) {
+        Ok(cmdline) => cmdline,
+        _ => return,
+    };
+    let guest_memory = GuestMemoryMmap::from_ranges(&[(GuestAddress(0), MEM_SIZE)]).unwrap();
+
+    linux_loader::loader::load_cmdline(&guest_memory, CMDLINE_START, &kernel_cmdline).ok();
+});