From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=bbBhnYsA; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 93ADC5A0271 for ; Wed, 12 Aug 2026 09:26:53 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1786519612; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ENtnFPbNiwSik81L0x43XNuHxEupzeA1/mwgKUR8ccQ=; b=bbBhnYsA2PCVNI6O1pnvZTREkMJUgm/yyPReC6ilb9YVSBCqSFkuEGylxkHxxE/0zhTv5+ rN8v5/NTgjL/Rop1MaeDfPVFDx0LQuS82W9Ql+0/hXneniBZD6Zx4IrO0W18JhIsC8F90A gXlhOKAKjy4PjHUcHP9KZrKzE704KrI= Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-499-higLL3CJN6WwSzlwBwgu4Q-1; Wed, 12 Aug 2026 03:26:51 -0400 X-MC-Unique: higLL3CJN6WwSzlwBwgu4Q-1 X-Mimecast-MFC-AGG-ID: higLL3CJN6WwSzlwBwgu4Q_1786519610 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E0318180028A; Wed, 12 Aug 2026 07:26:49 +0000 (UTC) Received: from anskuma-thinkpadp1gen7.bengluru.csb (unknown [10.74.80.105]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id BFBE4195DF91; Wed, 12 Aug 2026 07:26:46 +0000 (UTC) From: Anshu Kumari To: david@gibson.dropbear.id.au, sbrivio@redhat.com, passt-dev@passt.top Subject: [PATCH 3/5] fuzz: Bypass isolation and adapt sockets for AFL++ Date: Wed, 12 Aug 2026 12:56:26 +0530 Message-ID: <20260812072630.3235261-4-anskuma@redhat.com> In-Reply-To: <20260812072630.3235261-1-anskuma@redhat.com> References: <20260812072630.3235261-1-anskuma@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: ao6u_abC34VGShwnxkWtSa2vjB5gq8pNAbZaYF5tuLQ_1786519610 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit content-type: text/plain; charset="US-ASCII"; x-default=true Message-ID-Hash: 2EJNJMTD5SSZ4KYPEKRMP7FZVWSPNW5M X-Message-ID-Hash: 2EJNJMTD5SSZ4KYPEKRMP7FZVWSPNW5M X-MailFrom: anskuma@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: aerosound161@gmail.com, abdobngad@gmail.com, anskuma@redhat.com, lvivier@redhat.com X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Few components which needs to be disabled to support AFL++ to work: - isolation.c: Skip isolation and seccomp sandboxing that breaks AFL++ pipes, namespaces, and ASan mmap/mprotect operations. - util.c / tap.c: Switch UNIX socket to SOCK_SEQPACKET to preserve frame boundaries, simplifying tap_passt_input() to a single recv() and removing vnet_len framing. - passt.h: Use /tmp/passt_fuzz_%i.socket to avoid path collisions with production instances. - tcp_buf.c: Include fuzz.h to route recvmsg() through deterministic wrappers. Signed-off-by: Anshu Kumari --- isolation.c | 11 +++++++++++ passt.h | 4 ++++ tap.c | 21 +++++++++++++++++++++ tcp_buf.c | 1 + util.c | 10 ++++++++++ 5 files changed, 47 insertions(+) diff --git a/isolation.c b/isolation.c index a30b329..61fc76a 100644 --- a/isolation.c +++ b/isolation.c @@ -208,6 +208,9 @@ static int move_root(void) */ void isolate_initial(void) { +#ifdef FUZZING + return; +#endif uint64_t keep; /* We want to keep CAP_NET_BIND_SERVICE in the initial @@ -389,6 +392,10 @@ void isolate_user(const struct ctx *c, uid_t uid, gid_t gid, bool use_userns, */ int isolate_prefork(const struct ctx *c) { +#ifdef FUZZING + (void)c; + return 0; +#endif int flags = CLONE_NEWIPC | CLONE_NEWNS | CLONE_NEWUTS; uint64_t ns_caps = 0; @@ -466,6 +473,10 @@ int isolate_prefork(const struct ctx *c) */ void isolate_postfork(const struct ctx *c) { +#ifdef FUZZING + (void)c; + return; +#endif struct sock_fprog prog; prctl(PR_SET_DUMPABLE, 0); diff --git a/passt.h b/passt.h index 51ccd4f..141c9f8 100644 --- a/passt.h +++ b/passt.h @@ -7,7 +7,11 @@ #define PASST_H #define UNIX_SOCK_MAX 100 +#ifdef FUZZING +#define UNIX_SOCK_PATH "/tmp/passt_fuzz_%i.socket" +#else #define UNIX_SOCK_PATH "/tmp/passt_%i.socket" +#endif union epoll_ref; diff --git a/tap.c b/tap.c index dfa66c7..f32c9ad 100644 --- a/tap.c +++ b/tap.c @@ -14,6 +14,7 @@ */ #include +#include #include #include #include @@ -61,6 +62,7 @@ #include "vhost_user.h" #include "vu_common.h" #include "epoll_ctl.h" +#include "fuzz.h" /* Maximum allowed frame lengths (including L2 header) */ @@ -144,8 +146,10 @@ void tap_send_single(const struct ctx *c, const void *data, size_t l2len) switch (c->mode) { case MODE_PASST: +#ifndef FUZZING iov[iovcnt] = IOV_OF_LVALUE(vnet_len); iovcnt++; +#endif /* fall through */ case MODE_PASTA: iov[iovcnt].iov_base = (void *)data; @@ -1231,6 +1235,22 @@ static void tap_passt_input(struct ctx *c, const struct timespec *now) tap_flush_pools(); +#ifdef FUZZING + /* SOCK_SEQPACKET: each recv returns exactly one frame */ + do { + n = recv(c->fd_tap, pkt_buf, sizeof(pkt_buf), MSG_DONTWAIT); + } while ((n < 0) && errno == EINTR); + + if (n > 0 && n >= (ssize_t)sizeof(struct ethhdr)) { + struct iov_tail data; + + data = IOV_TAIL_FROM_BUF(pkt_buf, n, 0); + tap_add_packet(c, &data, now); + } else if (n < 0 && errno != EAGAIN && errno != EWOULDBLOCK) { + tap_sock_reset(c); + return; + } +#else if (partial_len) { /* We have a partial frame from an earlier pass. Move it to the * start of the buffer, top up with new data, then process all @@ -1281,6 +1301,7 @@ static void tap_passt_input(struct ctx *c, const struct timespec *now) partial_len = n; partial_frame = p; +#endif tap_handler(c, now); } diff --git a/tcp_buf.c b/tcp_buf.c index 72c4541..eb28abe 100644 --- a/tcp_buf.c +++ b/tcp_buf.c @@ -32,6 +32,7 @@ #include "tcp_conn.h" #include "tcp_internal.h" #include "tcp_buf.h" +#include "fuzz.h" #define TCP_FRAMES_MEM 128 #define TCP_FRAMES \ diff --git a/util.c b/util.c index 28c32e4..7f29c3b 100644 --- a/util.c +++ b/util.c @@ -36,6 +36,7 @@ #include "epoll_ctl.h" #include "pasta.h" #include "serialise.h" +#include "fuzz.h" #ifdef HAS_GETRANDOM #include #endif @@ -229,7 +230,11 @@ int sock_l4_dualstack_any(const struct ctx *c, enum epoll_type type, */ int sock_unix(char *sock_path) { +#ifdef FUZZING + int fd = socket(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC, 0); +#else int fd = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0); +#endif struct sockaddr_un addr = { .sun_family = AF_UNIX, }; @@ -248,8 +253,13 @@ int sock_unix(char *sock_path) UNIX_SOCK_PATH, i)) die_perror("Can't build UNIX domain socket path"); +#ifdef FUZZING + ex = socket(AF_UNIX, SOCK_SEQPACKET | SOCK_NONBLOCK | SOCK_CLOEXEC, + 0); +#else ex = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK | SOCK_CLOEXEC, 0); +#endif if (ex < 0) die_perror("Failed to check for UNIX domain conflicts"); -- 2.55.0