Skip to content

chore(vmclock): Propagate VMClock restoration error#5681

Merged
zulinx86 merged 3 commits into
firecracker-microvm:mainfrom
zulinx86:snapshot_fuzz_for_vmclock
Feb 16, 2026
Merged

chore(vmclock): Propagate VMClock restoration error#5681
zulinx86 merged 3 commits into
firecracker-microvm:mainfrom
zulinx86:snapshot_fuzz_for_vmclock

Conversation

@zulinx86
Copy link
Copy Markdown
Contributor

@zulinx86 zulinx86 commented Feb 12, 2026

Changes / Reason

The fuzzer somtimes provides a too large guest address for VMClock ABI
structure as it fuzzes the snapshot data.  That makes unchecked_add()
panic at runtime when adding field offsets.  To avoid the panic,
define a new error and propagate it up the stack.

Note that Firecracker never allocates such a too large guest address.

License Acceptance

By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following Developer
Certificate of Origin and signing off your commits, please check
CONTRIBUTING.md.

PR Checklist

  • I have read and understand CONTRIBUTING.md.
  • I have run tools/devtool checkbuild --all to verify that the PR passes
    build checks on all supported architectures.
  • I have run tools/devtool checkstyle to verify that the PR passes the
    automated style checks.
  • I have described what is done in these changes, why they are needed, and
    how they are solving the problem in a clear and encompassing way.
  • [N/A] I have updated any relevant documentation (both in code and in the docs)
    in the PR.
  • [N/A] I have mentioned all user-facing changes in CHANGELOG.md.
  • [N/A] If a specific issue led to this PR, this PR closes the issue.
  • [N/A] When making API changes, I have followed the
    Runbook for Firecracker API changes.
  • I have tested all new and changed functionalities in unit tests and/or
    integration tests.
  • [N/A] I have linked an issue to every new TODO.

  • This functionality cannot be added in rust-vmm.

@codecov
Copy link
Copy Markdown

codecov Bot commented Feb 12, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.12%. Comparing base (58f058b) to head (af0c789).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #5681   +/-   ##
=======================================
  Coverage   83.12%   83.12%           
=======================================
  Files         277      277           
  Lines       29380    29376    -4     
=======================================
- Hits        24423    24420    -3     
+ Misses       4957     4956    -1     
Flag Coverage Δ
5.10-m5n.metal 83.42% <100.00%> (+<0.01%) ⬆️
5.10-m6a.metal 82.76% <100.00%> (+<0.01%) ⬆️
5.10-m6g.metal 80.12% <100.00%> (+<0.01%) ⬆️
5.10-m6i.metal 83.42% <100.00%> (+<0.01%) ⬆️
5.10-m7a.metal-48xl 82.74% <100.00%> (+<0.01%) ⬆️
5.10-m7g.metal 80.12% <100.00%> (+<0.01%) ⬆️
5.10-m7i.metal-24xl 83.39% <100.00%> (-0.01%) ⬇️
5.10-m7i.metal-48xl 83.39% <100.00%> (+<0.01%) ⬆️
5.10-m8g.metal-24xl 80.12% <100.00%> (+<0.01%) ⬆️
5.10-m8g.metal-48xl 80.12% <100.00%> (+<0.01%) ⬆️
6.1-m5n.metal 83.45% <100.00%> (+<0.01%) ⬆️
6.1-m6a.metal 82.78% <100.00%> (-0.01%) ⬇️
6.1-m6g.metal 80.12% <100.00%> (-0.01%) ⬇️
6.1-m6i.metal 83.45% <100.00%> (+<0.01%) ⬆️
6.1-m7a.metal-48xl 82.77% <100.00%> (+<0.01%) ⬆️
6.1-m7g.metal 80.12% <100.00%> (+<0.01%) ⬆️
6.1-m7i.metal-24xl 83.46% <100.00%> (+<0.01%) ⬆️
6.1-m7i.metal-48xl 83.46% <100.00%> (+<0.01%) ⬆️
6.1-m8g.metal-24xl 80.11% <100.00%> (-0.01%) ⬇️
6.1-m8g.metal-48xl 80.11% <100.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@zulinx86 zulinx86 force-pushed the snapshot_fuzz_for_vmclock branch 2 times, most recently from dc21b91 to 262fc72 Compare February 12, 2026 13:41
@zulinx86 zulinx86 enabled auto-merge (rebase) February 12, 2026 13:50
@zulinx86 zulinx86 added the Status: Awaiting review Indicates that a pull request is ready to be reviewed label Feb 12, 2026
Comment thread src/vmm/src/devices/acpi/vmclock.rs Outdated
Comment thread src/vmm/src/devices/acpi/vmclock.rs
@zulinx86 zulinx86 force-pushed the snapshot_fuzz_for_vmclock branch 2 times, most recently from 75d0ed2 to d6c4637 Compare February 12, 2026 14:48
@zulinx86 zulinx86 changed the title vmclock: Validate guest_address on snapshot restore chore(vmclock): Propagate VMClock restoration error Feb 12, 2026
@zulinx86 zulinx86 force-pushed the snapshot_fuzz_for_vmclock branch from d6c4637 to 483b5a2 Compare February 12, 2026 14:53
JackThomson2
JackThomson2 previously approved these changes Feb 12, 2026
@zulinx86 zulinx86 requested a review from ilstam February 16, 2026 10:07
Comment thread src/vmm/src/devices/acpi/vmclock.rs Outdated
@zulinx86 zulinx86 force-pushed the snapshot_fuzz_for_vmclock branch 2 times, most recently from 409b802 to 1c84c12 Compare February 16, 2026 12:07
The fuzzer somtimes provides a too large guest address for VMClock ABI
structure as it fuzzes the snapshot data.  That makes unchecked_add()
panic when adding field offsets.  To avoid the panic, call
attach_vmclock() on snapshot restore that internally calls
mem.write_slice() and returns an error for out-of-range access and
propagate the error up the stack.

Note that Firecracker never allocates such a too large guest address.

Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
VmClock::restore() does NOT mutate it at all.

Signed-off-by: Takahiro Itazuri <itazur@amazon.com>
@zulinx86 zulinx86 force-pushed the snapshot_fuzz_for_vmclock branch from 1c84c12 to 4503d0c Compare February 16, 2026 12:10
@zulinx86 zulinx86 requested a review from Manciukic February 16, 2026 13:14
@zulinx86 zulinx86 merged commit 2501b9c into firecracker-microvm:main Feb 16, 2026
7 checks passed
@zulinx86 zulinx86 deleted the snapshot_fuzz_for_vmclock branch February 16, 2026 16:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Status: Awaiting review Indicates that a pull request is ready to be reviewed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants