AFLplusplus / AFLplusplus/LibAFL

libafl-qemu: "Fast" system-mode snapshots trigger an assertion failure

Abierto
#2,628 11 comentarios 1 reacción 1 asignado Reclamado por @rmalmain Ver en GitHub
bug qemu
Lenguaje dominante
Rust
Estrellas
2.6k
Forks
481
Merge medio
2 d 30 min
PR fusionados (30 d)
16

Descripción

I'm trying to fuzz an [EDK II](https://github.com/tianocore/edk2) image. However, the "fast" system-mode snapshots seem to always trigger an assertion failure. Unfortunately, I can't share the compiled artifacts, but I'd imagine this could be reproduced with another system-mode target.
```rust
// cargo init
// cargo add --no-default-features --features=systemmode --git https://github.com/AFLplusplus/LibAFL libafl_qemu
// cargo run

use std::error;

const QEMU_FLAGS: &[&str] = &[
"-machine",
"q35",
"-kernel",
"edk2/bzImage",
"-append",
"'rootwait root=/dev/vda console=tty1 console=ttyS0 keep_bootcon'",
"-drive",
"if=none,format=qcow2,file=snaps.qcow2",
"-drive",
"file=edk2/rootfs.ext2,if=virtio,format=raw,readonly=on",
"-global",
"driver=cfi.pflash01,property=secure,value=on",
"-drive",
"if=pflash,format=raw,unit=0,file=edk2/OVMF_CODE.fd,readonly=on",
"-drive",
"if=pflash,format=raw,unit=1,file=edk2/OVMF_VARS.fd",
"-smp",
"2",
"-m",
"4G",
"-bios",
"edk2/OVMF.fd",
"-fw_cfg",
"name=opt/org.tianocore/X-Cpuhp-Bugcheck-Override,string=yes",
"-serial",
"file:serial.log",
"-S",
"-nodefaults",
"-vga",
"none",
"-nographic",
"-snapshot",
];

pub fn read_u64(qemu: &libafl_qemu::Qemu, addr: libafl_qemu::GuestAddr) -> u64 {
let mut val_buf = [0; 8];
qemu.read_mem(addr, &mut val_buf).unwrap();
u64::from_le_bytes(val_buf)
}

fn run_to(
qemu: &libafl_qemu::Qemu,
addr: libafl_qemu::GuestAddr,
) -> Result<(), libafl_qemu::QemuExitError> {
qemu.set_breakpoint(addr);
unsafe { qemu.run() }.unwrap();
qemu.remove_breakpoint(addr);
Ok(())
}

fn main() -> Result<(), Box> {
let mut args = vec!["qemu".to_owned()];
args.extend(QEMU_FLAGS.iter().map(|s| (*s).to_owned()));
let qemu = libafl_qemu::Qemu::init(args.as_slice())?;

let entry = 0x0007FA536BE;
println!("Running to entrypoint ({:#x})...", entry);
run_to(&qemu, entry).unwrap();

let snap = qemu.create_fast_snapshot(true);
unsafe { qemu.restore_fast_snapshot(snap) };
Ok(())
}
```
Output:
```
Could not open option rom 'kvmvapic.bin': No such file or directory
Could not open option rom 'linuxboot_dma.bin': No such file or directory
Running to entrypoint (0x7fa536be)...
libafl-snapshots: ../system/memory.c:2655: memory_region_add_subregion_common: Assertion `!subregion->container' failed.
zsh: abort (core dumped) cargo -q run
```

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.