Skip to content

A bug occurs when specifying multiple CPUs in nyx mode #2539

@92wyunchao

Description

@92wyunchao

Describe the bug
I am using the nyx mode for fuzzing, and my guest environment requires at least 2 CPUs to start, so I modified the qemu startup parameters for libynx and added the -smp 2 option. When I ran it, I found that the fuzzer was stuck and could not work properly. To verify this issue, I executed it in the official test virtual environment for libxml, and encountered the same problem. After further analysis, I found that when the agent executes the fast_acquire hypercall, qemu encounters a deadlock while processing this hypercall. Specifically, the front-end fuzzer sends an 'x' signal, but qemu's character device doesn't receive the message, leading to an inability to unlock. I would like to ask what causes this problem and how to fix it.

To Reproduce
Steps to reproduce the behavior:

  1. Modify the params.rs in libnyx and added the following two lines of code, then compiled to generate libnyx.so.
    cmd.push("-smp".to_string()); cmd.push("2".to_string());
  2. Execute the command according to the instructions in the official documentation. afl-fuzz -i /tmp/in -o /tmp/out -X ~/targets/nyx_mytest

Screen output/Screenshots
The result is shown in the image below

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requesthelp wantedExtra attention is needed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions