AFLplusplus / AFLplusplus/LibAFL

libafl-qemu: "Fast" system-mode snapshots trigger an assertion failure

Open
#2,628 11 comments 1 reaction 1 assignee Claimed by @rmalmain View on GitHub
bug qemu
Dominant language
Rust
Stars
2.6k
Forks
481
Avg merge
2d 30m
Merged PRs (30d)
16

Description

I'm trying to fuzz an [EDK II](https://github.com/tianocore/edk2) image. However, the "fast" system-mode snapshots seem to always trigger an assertion failure. Unfortunately, I can't share the compiled artifacts, but I'd imagine this could be reproduced with another system-mode target.
```rust
// cargo init
// cargo add --no-default-features --features=systemmode --git https://github.com/AFLplusplus/LibAFL libafl_qemu
// cargo run

use std::error;

const QEMU_FLAGS: &[&str] = &[
"-machine",
"q35",
"-kernel",
"edk2/bzImage",
"-append",
"'rootwait root=/dev/vda console=tty1 console=ttyS0 keep_bootcon'",
"-drive",
"if=none,format=qcow2,file=snaps.qcow2",
"-drive",
"file=edk2/rootfs.ext2,if=virtio,format=raw,readonly=on",
"-global",
"driver=cfi.pflash01,property=secure,value=on",
"-drive",
"if=pflash,format=raw,unit=0,file=edk2/OVMF_CODE.fd,readonly=on",
"-drive",
"if=pflash,format=raw,unit=1,file=edk2/OVMF_VARS.fd",
"-smp",
"2",
"-m",
"4G",
"-bios",
"edk2/OVMF.fd",
"-fw_cfg",
"name=opt/org.tianocore/X-Cpuhp-Bugcheck-Override,string=yes",
"-serial",
"file:serial.log",
"-S",
"-nodefaults",
"-vga",
"none",
"-nographic",
"-snapshot",
];

pub fn read_u64(qemu: &libafl_qemu::Qemu, addr: libafl_qemu::GuestAddr) -> u64 {
let mut val_buf = [0; 8];
qemu.read_mem(addr, &mut val_buf).unwrap();
u64::from_le_bytes(val_buf)
}

fn run_to(
qemu: &libafl_qemu::Qemu,
addr: libafl_qemu::GuestAddr,
) -> Result<(), libafl_qemu::QemuExitError> {
qemu.set_breakpoint(addr);
unsafe { qemu.run() }.unwrap();
qemu.remove_breakpoint(addr);
Ok(())
}

fn main() -> Result<(), Box> {
let mut args = vec!["qemu".to_owned()];
args.extend(QEMU_FLAGS.iter().map(|s| (*s).to_owned()));
let qemu = libafl_qemu::Qemu::init(args.as_slice())?;

let entry = 0x0007FA536BE;
println!("Running to entrypoint ({:#x})...", entry);
run_to(&qemu, entry).unwrap();

let snap = qemu.create_fast_snapshot(true);
unsafe { qemu.restore_fast_snapshot(snap) };
Ok(())
}
```
Output:
```
Could not open option rom 'kvmvapic.bin': No such file or directory
Could not open option rom 'linuxboot_dma.bin': No such file or directory
Running to entrypoint (0x7fa536be)...
libafl-snapshots: ../system/memory.c:2655: memory_region_add_subregion_common: Assertion `!subregion->container' failed.
zsh: abort (core dumped) cargo -q run
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.