fuzz: explicitly keep or reject fuzzer corpus

When the main fuzzer function returns (), it is equivalent to
returning Corpus::Keep.

In some of the return paths, we want to reject the input so that the
libfuzzer won't spend more time mutating them.

The should make fuzzing more efficient. No functional change intended.

Signed-off-by: Wei Liu <liuwe@microsoft.com>
This commit is contained in:
Wei Liu
2024-12-30 23:15:22 +00:00
committed by Wei Liu
parent ef88b2778e
commit 6fd5b0f696
13 changed files with 79 additions and 53 deletions

View File

@@ -8,7 +8,7 @@
#![no_main]
use libfuzzer_sys::fuzz_target;
use libfuzzer_sys::{fuzz_target, Corpus};
use vm_memory::bitmap::AtomicBitmap;
use vm_memory::GuestAddress;
@@ -18,7 +18,7 @@ const MEM_SIZE: usize = 256 * 1024 * 1024;
// From 'arch::x86_64::layout::CMDLINE_START'
const CMDLINE_START: GuestAddress = GuestAddress(0x20000);
fuzz_target!(|bytes| {
fuzz_target!(|bytes: &[u8]| -> Corpus {
let payload_config = vmm::vm_config::PayloadConfig {
firmware: None,
kernel: None,
@@ -29,9 +29,11 @@ fuzz_target!(|bytes| {
};
let kernel_cmdline = match vmm::vm::Vm::generate_cmdline(&payload_config) {
Ok(cmdline) => cmdline,
_ => return,
_ => return Corpus::Reject,
};
let guest_memory = GuestMemoryMmap::from_ranges(&[(GuestAddress(0), MEM_SIZE)]).unwrap();
linux_loader::loader::load_cmdline(&guest_memory, CMDLINE_START, &kernel_cmdline).ok();
Corpus::Keep
});