Skip to content

platform: posix: run fuzz teardown in thread context #11168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tmleman wants to merge 1 commit into
base: main
Choose a base branch
from
+25 −1
Open

platform: posix: run fuzz teardown in thread context #11168

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 25 additions & 1 deletion src/platform/posix/ipc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,11 @@ extern size_t posix_fuzz_sz;
static uint8_t fuzz_in[65536];
static size_t fuzz_in_sz;

/* Set on the driver thread by posix_fuzz_case_begin(), consumed on the EDF
* workqueue thread by ipc_platform_do_cmd(). See posix_fuzz_case_begin().
*/
static bool posix_fuzz_teardown_pending;

/*
* posix_ipc_teardown - drop all IPC-tracked objects left over from the
* previous fuzz testcase so the next one starts from a clean topology.
Expand Down Expand Up @@ -194,7 +199,15 @@ static void posix_ipc_teardown(void)
*/
void posix_fuzz_case_begin(void)
{
posix_ipc_teardown();
/*
* Defer the teardown to the EDF workqueue thread (ipc_platform_do_cmd()).
* This runs on the libFuzzer driver thread, where native_sim treats the
* CPU as halted; posix_ipc_teardown() releases spinlocks/mutexes, and
* releasing a spinlock while the system-tick IRQ is pending makes
* native_sim deliver it synchronously and abort ("called from a HW model
* thread").
*/
posix_fuzz_teardown_pending = true;
fuzz_in_sz = 0;
}

Expand Down Expand Up @@ -362,6 +375,17 @@ enum task_state ipc_platform_do_cmd(struct ipc *ipc)
{
struct ipc_cmd_hdr *hdr;

#ifdef CONFIG_ARCH_POSIX_LIBFUZZER
/*
* Reclaim the previous testcase's topology in thread context, before
* this testcase's first command. See posix_fuzz_case_begin().
*/
if (posix_fuzz_teardown_pending) {
posix_fuzz_teardown_pending = false;
posix_ipc_teardown();
}
#endif

#ifdef CONFIG_IPC_MAJOR_4
memset(posix_hostbox, 0, SOF_IPC_MSG_MAX_SIZE);
memcpy(posix_hostbox,
Expand Down
Loading