-
-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Description
Describe the bug
I am using the nyx mode for fuzzing, and my guest environment requires at least 2 CPUs to start, so I modified the qemu startup parameters for libynx and added the -smp 2 option. When I ran it, I found that the fuzzer was stuck and could not work properly. To verify this issue, I executed it in the official test virtual environment for libxml, and encountered the same problem. After further analysis, I found that when the agent executes the fast_acquire hypercall, qemu encounters a deadlock while processing this hypercall. Specifically, the front-end fuzzer sends an 'x' signal, but qemu's character device doesn't receive the message, leading to an inability to unlock. I would like to ask what causes this problem and how to fix it.
To Reproduce
Steps to reproduce the behavior:
- Modify the params.rs in libnyx and added the following two lines of code, then compiled to generate libnyx.so.
cmd.push("-smp".to_string()); cmd.push("2".to_string()); - Execute the command according to the instructions in the official documentation. afl-fuzz -i /tmp/in -o /tmp/out -X ~/targets/nyx_mytest
Screen output/Screenshots
The result is shown in the image below
