Re: [PATCH 4/5] fuzz: Add AFL++ persistent mode fuzz loop

Not a complete review, just a few notes, mostly about the general concept: On Wed, 12 Aug 2026 12:56:27 +0530 Anshu Kumari wrote:

Add the AFL++ persistent mode fuzz loop to passt.c main(). The loop uses __AFL_LOOP() for in-process iteration and __AFL_FUZZ_TESTCASE_BUF for shared memory fuzzing.

Each iteration: - Resets deterministic clock, flow table, and epoll instance. - Drains stale data from the TAP socket. - Reads an epoll event from the AFL++ buffer. - For TAP events: constructs a packet with fixed L2/L3/L4 headers and injects it via tap_add_packet() + tap_handler(). - Exchanges a turn flag with the test server for bidirectional flow over the UNIX socket.

This complexity could probably be avoided if you switch to a model where the test server is just operating on the host side of things (accepting TCP connections and replying). More on that in a bit as a comment to 5/5.

- Calls passt_worker() to process the event. - Polls for host-side TCP events via epoll_wait(). - Runs post_handler() for deferred work.

Added the 'make fuzz' target which builds passt with afl-clang-fast, -DFUZZING, -DNDEBUG, and AddressSanitizer.

Signed-off-by: Anshu Kumari --- Makefile | 8 +++ passt.c | 189 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 197 insertions(+)

diff --git a/Makefile b/Makefile index fe1df58..8e4121e 100644 --- a/Makefile +++ b/Makefile @@ -123,6 +123,14 @@ valgrind: BASE_CPPFLAGS += -DVALGRIND valgrind: BASE_CFLAGS += -g valgrind: all

+FUZZ_CC ?= afl-clang-fast + +.PHONY: fuzz + +fuzz: + $(MAKE) clean + $(MAKE) CC="$(FUZZ_CC)" CPPFLAGS="-DFUZZING -DNDEBUG" CFLAGS="-g -fsanitize=address" passt + .PHONY: clean clean: $(RM) $(BIN) *~ *.o seccomp.h seccomp_repair.h seccomp_pesto.h pasta.1 \ diff --git a/passt.c b/passt.c index 5054551..e026eb2 100644 --- a/passt.c +++ b/passt.c @@ -35,6 +35,7 @@ #include #include #include +#include

#include "util.h" #include "passt.h" @@ -54,12 +55,56 @@ #include "repair.h" #include "netlink.h" #include "epoll_ctl.h" +#include "flow_table.h" +#include "fuzz.h"

#define NUM_EPOLL_EVENTS 8

#define TIMER_INTERVAL_ MIN(TCP_TIMER_INTERVAL, FWD_PORT_SCAN_INTERVAL) #define TIMER_INTERVAL MIN(TIMER_INTERVAL_, FLOW_TIMER_INTERVAL)

+#ifdef FUZZING + +/* AFL++ persistent mode / shared memory fuzzing compatibility macros. */ +#ifndef __AFL_FUZZ_TESTCASE_LEN + ssize_t fuzz_len; + unsigned char fuzz_buf[1024 * 1024]; +# define __AFL_FUZZ_TESTCASE_LEN fuzz_len +# define __AFL_FUZZ_TESTCASE_BUF fuzz_buf +# define __AFL_FUZZ_INIT() void sync(void) +# define __AFL_LOOP(x) \ + ((fuzz_len = read(0, fuzz_buf, sizeof(fuzz_buf))) > 0 ? 1 : 0) +# define __AFL_INIT() sync() +#endif + +#ifdef __AFL_HAVE_MANUAL_CONTROL + __AFL_FUZZ_INIT(); +#endif + +static struct fuzz_turn *fuzz_turn_ptr; + +/** + * fuzz_turn_connect() - Map the turn flag shared memory + * + * Return: pointer to mapped turn flag, or NULL on failure + */ +static struct fuzz_turn *fuzz_turn_connect(void) +{ + struct fuzz_turn *t; + int fd; + + fd = open(FUZZ_TURN_PATH, O_RDWR); + if (fd < 0) + return NULL; + + t = mmap(NULL, sizeof(*t), PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); + close(fd); + + return (t == MAP_FAILED) ? NULL : t; +} + +#endif + char pkt_buf[PKT_BUF_BYTES] __attribute__ ((aligned(PAGE_SIZE)));

struct ctx passt_ctx = { @@ -282,9 +327,17 @@ static void passt_worker(void *opaque, int nfds, struct epoll_event *events) icmp_sock_handler(c, ref, &now); break; case EPOLL_TYPE_VHOST_CMD: +#ifdef FUZZING + if (!c->vdev) + break; +#endif vu_control_handler(c->vdev, c->fd_tap, eventmask); break; case EPOLL_TYPE_VHOST_KICK: +#ifdef FUZZING + if (!c->vdev) + break; +#endif vu_kick_cb(c->vdev, ref, &now); break; case EPOLL_TYPE_REPAIR_LISTEN: @@ -450,6 +503,141 @@ int main(int argc, char **argv)

timer_init(c, &now);

+#ifdef FUZZING + fuzz_turn_ptr = fuzz_turn_connect(); + +#define FUZZ_LOOP_ITERATIONS 10000 +#define FUZZ_DRAIN_BUF_SIZE 1600 + +#ifdef __AFL_HAVE_MANUAL_CONTROL + __AFL_INIT(); +#endif + { + unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF; + + while (__AFL_LOOP(FUZZ_LOOP_ITERATIONS)) {

I think this loop is a useful implementation, as far as I understand the purpose is to avoid that AFL++ needs to restarts us at every new attempt. So I think it makes sense that you reset the state below. But, inside this loop, we need to allow AFL++ to send us arbitrary sequences of packets, not just inject a single one. Not much will happen with a single packet.

+ int len = __AFL_FUZZ_TESTCASE_LEN; + int injected = 0; + int pkt_len, round; + struct epoll_event ev; + union epoll_ref ref; + int min_pkt = sizeof(struct ethhdr) + + sizeof(struct iphdr) + + sizeof(struct tcphdr); + + if (len < (int)sizeof(ev)) + continue; + + /* Reset clock, flow table and epoll for each + * AFL++ iteration. + */ + fuzz_clock_reset(); + clock_gettime(CLOCK_MONOTONIC, &now); + timer_init(c, &now); + + flow_init(); + + /* Recreate epoll instance */ + close(c->epollfd); + c->epollfd = epoll_create1(EPOLL_CLOEXEC); + flow_epollid_register(EPOLLFD_ID_DEFAULT, c->epollfd); + + if (c->fd_tap >= 0) { + union epoll_ref tref = { + .type = EPOLL_TYPE_TAP_PASST, + .fd = c->fd_tap + }; + epoll_add(c->epollfd, + EPOLLIN | EPOLLRDHUP, tref); + + /* Drain stale socket data */ + char drain[FUZZ_DRAIN_BUF_SIZE]; + while (recv(c->fd_tap, drain, sizeof(drain), + MSG_DONTWAIT) > 0); + } + + /* Read epoll event from AFL++ buffer */ + memcpy(&ev, buf, sizeof(ev)); + ref = *((union epoll_ref *)&ev.data.u64);

This is needed to let AFL++ generate events. But if you call epoll_wait() below, with 'events' (which is not set from 'ev'), we won't actually use those events generated by AFL++. I guess you're only getting events from the test server. But I don't think that hardcoding a sequence of: - single packet from AFL++ (tap side) - four packets from the test server (all host side I guess?) will actually result in any meaningful exchange (including a TCP connection). By the way, in the approach I was suggesting, where AFL++ would act as guest and feeding data to us directly, while the test server would act as host / internet side (with data fed from AFL++), AFL++ would only generate tap-side events, so we would probably need to *add* those to 'ev' while also reacting to host-side events (for example the test server accepting a connection, or sending data over an accepted connection).

+ + /* Set recv payload in AFL++ shared memory */ + fuzz_recv_data = buf + FUZZ_RECV_OFF; + fuzz_recv_data_len = + (len > FUZZ_RECV_OFF + FUZZ_RECV_MAX) + ? FUZZ_RECV_MAX + : ((len > FUZZ_RECV_OFF) + ? len - FUZZ_RECV_OFF : 0); + + /* Inject fuzz packet for TAP events */ + if (ref.type == EPOLL_TYPE_TAP_PASST || + ref.type == EPOLL_TYPE_TAP_PASTA) { + struct iov_tail data; + struct ethhdr *eh; + struct iphdr *iph; + struct tcphdr *th; + + tap_flush_pools(); + memset(pkt_buf, 0, min_pkt); + + pkt_len = len - (int)sizeof(ev); + if (pkt_len > 0) + memcpy(pkt_buf, buf + sizeof(ev), + pkt_len); + if (pkt_len < min_pkt) + pkt_len = min_pkt; + + /* construct ethernet header */

I guess this whole path is needed to quickly get something working, but, eventually, we shouldn't need this. We need to give the possibility to AFL++ to give us multiple packets, and possibly (or especially) malformed ones. If it just generates payload, that looks relatively "safe" and is relatively unlikely to discover issues.

+ eh = (struct ethhdr *)pkt_buf; + memcpy(eh->h_dest, c->our_tap_mac, ETH_ALEN); + memcpy(eh->h_source, c->guest_mac, ETH_ALEN); + eh->h_proto = htons(ETH_P_IP); + + /* construct IPv4 header */ + iph = (struct iphdr *)(pkt_buf + sizeof(*eh)); + iph->version = 4; + iph->ihl = 5; + iph->protocol = IPPROTO_TCP; + iph->saddr = c->ip4.addr.s_addr; + iph->daddr = c->ip4.guest_gw.s_addr; + iph->tot_len = htons(pkt_len - sizeof(*eh)); + + /* Fix TCP Header */ + th = (struct tcphdr *)(pkt_buf + sizeof(*eh) + + sizeof(*iph)); + th->dest = htons(9999); + if (th->doff < 5) + th->doff = 5; + + data = IOV_TAIL_FROM_BUF(pkt_buf, pkt_len, 0); + tap_add_packet(c, &data, &now); + tap_handler(c, &now); + injected = 1; + } + + /* Turn exchange -- only if data was sent */ + if (injected && fuzz_turn_ptr) { + __atomic_store_n(&fuzz_turn_ptr->turn, 1, + __ATOMIC_RELEASE); + while (__atomic_load_n(&fuzz_turn_ptr->turn, + __ATOMIC_ACQUIRE) != 0); + } + + passt_worker(c, 1, &ev); + + /* Process host-side TCP events */ + for (round = 0; round < 4; round++) { + nfds = epoll_wait(c->epollfd, events, + NUM_EPOLL_EVENTS, 0); + if (nfds <= 0) + break; + passt_worker(c, nfds, events); + } + + post_handler(c, &now); + } + } + return 0; +#else loop: /* NOLINTBEGIN(bugprone-branch-clone): intervals can be the same */ /* cppcheck-suppress [duplicateValueTernary, unmatchedSuppression] */ @@ -461,4 +649,5 @@ loop: passt_worker(c, nfds, events);

goto loop; +#endif /* FUZZING */ }

-- Stefano