Fuzzing perf_events [LWN.net]

Fuzzing perf_events

Posted Aug 5, 2015 12:52 UTC (Wed) by wildea01 (subscriber, #71011)
Parent article: Fuzzing perf_events

> Power is notable as an architecture with elaborate perf_event support
> but, as of yet, has not been tested.

I tested ppc64 a while back (3.11) and it fell over on my G5:

http://www.willdeacon.ukfsn.org/bitbucket/oopsen/ppc64_oo...

That's one of the "problems" with fuzzing: it's a great way to crash or
exploit the system, but the bug reports can be really hard work to nail
down.

to post comments

Fuzzing perf_events

Posted Aug 5, 2015 14:21 UTC (Wed) by deater (subscriber, #11746) [Link] (7 responses)

> That's one of the "problems" with fuzzing: it's a great way to crash or
> exploit the system, but the bug reports can be really hard work to nail down.

Yes, I think my fuzzer work has been 1% writing code, 4% running the fuzzer, and 95% pushing on the bugs until the fixes make it into the kernel tree.

I really would like to get a modern Power machine to run tests on locally (as it's usually impolite to fuzz on someone else's server unless they are really nice and don't mind rebooting all the time). However Power hardware is a bit difficult to source and the price tends to be high enough to trigger extra paperwork from the purchasing department so I haven't gotten around to it yet. Maybe I should try to resurrect the old G4 laptop that was having severe power-connector issues.

Fuzzing perf_events

Posted Aug 5, 2015 19:20 UTC (Wed) by gebi (guest, #59940) [Link]

With open power at least purchase cost is not the big issue anymore.
Maybe this can help you: http://www.tyan.com/solutions/tyan_openpower_system.html

Fuzzing perf_events

Posted Aug 5, 2015 20:38 UTC (Wed) by kleptog (subscriber, #1183) [Link] (1 responses)

> I really would like to get a modern Power machine to run tests on locally (as it's usually impolite to fuzz on someone else's server unless they are really nice and don't mind rebooting all the time).

Isn't it possible to running the fuzzing under something like User Mode Linux, which would turn the machine crashing into some segfault which could be trapped by a debugger? Or some kind of virtualisation? Or are the bugs mostly race conditions that aren't accurately replicated this way?

Fuzzing perf_events

Posted Aug 6, 2015 9:48 UTC (Thu) by MarkRutland (subscriber, #74197) [Link]

You could certainly catch some bugs that way (those due to core code and/or SW PMU drivers), but you wouldn't be able to hit bugs which rely on HW PMU drivers.

Of the 20 bugs listed in the article, at least 8 require a HW PMU driver to be active to trigger.

Fuzzing perf_events

Posted Aug 5, 2015 23:57 UTC (Wed) by PaulMcKenney (✭ supporter ✭, #9624) [Link] (2 responses)

Or you could request use of the OpenPOWER systems at Oregon State University's Open Source Lab: http://osuosl.org/services/powerdev/request_hosting

Fuzzing perf_events

Posted Aug 6, 2015 13:08 UTC (Thu) by deater (subscriber, #11746) [Link] (1 responses)

> Or you could request use of the OpenPOWER systems at Oregon State
> University's Open Source Lab

Do testdrives like that allow installing custom git kernels, rebooting if there's a crash, and capturing serial console output?

Maybe the answer is yes, especially with how Power machines seem to always have a VM-like layer between the hardware and the OS. Otherwise though fuzzing tends to be a bad idea on systems you don't have local access or root permissions.

Fuzzing perf_events

Posted Aug 8, 2015 16:22 UTC (Sat) by PaulMcKenney (✭ supporter ✭, #9624) [Link]

I suggest filling out the form, stating clearly what you need to do, and see what their response is.

Fuzzing perf_events

Posted Aug 6, 2015 13:15 UTC (Thu) by tdaitx (guest, #56964) [Link]

And there is the Mini Cloud at Unicamp: http://openpower.ic.unicamp.br/minicloud/index.html

"The MiniCloud provides free access to Power® virtual machines. It allows easy access to an environment that can be configured for development, testing or migration of applications to Power. The virtual machines of MiniCloud run on PowerKVM™, which supports running a large number of virtual machines on a single scale-out Linux server."