feat: add roundtrip and malformed virtq fuzzing

Signed-off-by: Tomasz Andrzejak <andreiltd@gmail.com>

Author: andreiltd

.github/workflows/Fuzzing.yml

@@ -22,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ['fuzz_host_print', 'fuzz_guest_call', 'fuzz_host_call', 'fuzz_guest_estimate_trace_event', 'fuzz_guest_trace', 'fuzz_virtq_packed_ring']
+        target: ['fuzz_host_print', 'fuzz_guest_call', 'fuzz_host_call', 'fuzz_guest_estimate_trace_event', 'fuzz_guest_trace', 'fuzz_virtq_malformed', 'fuzz_virtq_roundtrip']
     uses: ./.github/workflows/dep_fuzzing.yml
     with:
       target: ${{ matrix.target }}

.github/workflows/ValidatePullRequest.yml

@@ -213,7 +213,7 @@ jobs:
     if: ${{ !cancelled() && !failure() }}
     strategy:
       matrix:
-        target: ['fuzz_host_print', 'fuzz_guest_call', 'fuzz_host_call', 'fuzz_guest_estimate_trace_event', 'fuzz_guest_trace', 'fuzz_virtq_packed_ring']
+        target: ['fuzz_host_print', 'fuzz_guest_call', 'fuzz_host_call', 'fuzz_guest_estimate_trace_event', 'fuzz_guest_trace', 'fuzz_virtq_malformed', 'fuzz_virtq_roundtrip']
         arch:
           - X64
         # arm64 fuzzing runs on the daily schedule (DailyArm64.yml) instead of on

CHANGELOG.md

@@ -54,6 +54,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 * Embedded byte payload tables and their value-union variants.
 
 ### Fixed
+* Allow reclaimed virtqueue completions to span multiple ring reuse cycles.
 * Virtqueue consumers return errors when payload copies or runtime bookkeeping
   cannot be allocated.
 * Use a 16 KiB-aligned default scratch size for Apple Silicon compatibility.

Justfile

@@ -218,7 +218,8 @@ like-ci config=default-target hypervisor="kvm":
     just fuzz-like-ci fuzz_host_call {{config}} {{hypervisor}}
     just fuzz-like-ci fuzz_guest_estimate_trace_event {{config}} {{hypervisor}}
     just fuzz-like-ci fuzz_guest_trace {{config}} {{hypervisor}}
-    just fuzz-like-ci fuzz_virtq_packed_ring {{config}} {{hypervisor}}
+    just fuzz-like-ci fuzz_virtq_malformed {{config}} {{hypervisor}}
+    just fuzz-like-ci fuzz_virtq_roundtrip {{config}} {{hypervisor}}
 
     @# spelling
     typos

fuzz/Cargo.toml

@@ -49,8 +49,15 @@ doc = false
 bench = false
 
 [[bin]]
-name = "fuzz_virtq_packed_ring"
-path = "fuzz_targets/virtq_packed_ring.rs"
+name = "fuzz_virtq_malformed"
+path = "fuzz_targets/virtq_malformed.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz_virtq_roundtrip"
+path = "fuzz_targets/virtq_roundtrip.rs"
 test = false
 doc = false
 bench = false

fuzz/README.md

@@ -10,7 +10,45 @@ which evaluates to the following command `cargo +nightly fuzz run fuzz_host_prin
 
 As per Microsoft's Offensive Research & Security Engineering (MORSE) team, all host exposed functions that receive or interact with guest data must be continuously fuzzed for, at least, 500 million fuzz test cases without any crashes. Because `cargo-fuzz` doesn't support setting a maximum number of iterations; instead, we use the `--max_total_time` flag to set a maximum time to run the fuzzer. We have a GitHub action (acting like a CRON job) that runs the fuzzers for 24 hours every week.
 
-Currently, we fuzz the parameters and return type to a hardcoded `PrintOutput` guest function, the `HostPrint` host function, the packed virtqueue ring parser, and canonical ring image validation. We plan to add more fuzzers in the future.
+Targets cover guest and host calls, printing, tracing, packed-ring parsing,
+canonical ring images, malformed consumer I/O, and producer/consumer round trips.
+
+## Malformed virtqueues
+
+`fuzz_virtq_malformed` exercises ring parsing, canonical images, and
+`VirtqConsumer` without a producer. Ring metadata and payloads have separate
+memory bounds. The consumer attempts at most eight polls per input, with two
+read/write rounds of at most 256 bytes per received chain, followed by completion.
+Consumer errors are accepted, including failed reads and reply writes.
+Panics and sanitizer findings fail the run.
+
+Inputs have a 16-byte header and 12-byte descriptor records. Descriptor addresses
+use signed, wrapping offsets from the payload base. Header byte 13 selects the
+I/O length minus one. Trailing three-byte records select a little-endian `u16`
+offset and a replacement byte. Offsets wrap within the ring followed by the
+payload. When available, one mutation runs before each poll, read, reply write,
+and completion.
+Mutations run on the same thread between calls.
+
+```sh
+just fuzz-timed fuzz_virtq_malformed 60
+cargo test -p hyperlight-fuzz --bin fuzz_virtq_malformed
+```
+
+## Virtqueue round trip
+
+`fuzz_virtq_roundtrip` checks one request/reply round trip without a VM. Inputs
+vary the payloads, I/O chunk size, and spare reply capacity. A fixed queue of
+16 descriptors and 64-byte pool slots exercises fragmented messages. The target
+checks payload bytes, completion types, backpressure, and resource release.
+
+Inputs have a four-byte header and at most 1024 payload bytes. The header selects
+the request/reply split, I/O chunk size, and spare reply capacity.
+The malformed target shares the memory backend and covers malformed descriptors.
+
+```sh
+just fuzz-timed fuzz_virtq_roundtrip 60
+```
 
 ## On Failure