]>
Commit | Line | Data |
---|---|---|
5f6fd09a AB |
1 | /* |
2 | * fuzzing driver | |
3 | * | |
4 | * Copyright Red Hat Inc., 2019 | |
5 | * | |
6 | * Authors: | |
7 | * Alexander Bulekov <alxndr@bu.edu> | |
8 | * | |
9 | * This work is licensed under the terms of the GNU GPL, version 2 or later. | |
10 | * See the COPYING file in the top-level directory. | |
11 | * | |
12 | */ | |
13 | ||
14 | #include "qemu/osdep.h" | |
15 | ||
16 | #include <wordexp.h> | |
17 | ||
18 | #include "sysemu/qtest.h" | |
19 | #include "sysemu/runstate.h" | |
20 | #include "sysemu/sysemu.h" | |
21 | #include "qemu/main-loop.h" | |
230225ea | 22 | #include "qemu/rcu.h" |
a2ce7dbd | 23 | #include "tests/qtest/libqos/libqtest.h" |
5f6fd09a AB |
24 | #include "tests/qtest/libqos/qgraph.h" |
25 | #include "fuzz.h" | |
26 | ||
27 | #define MAX_EVENT_LOOPS 10 | |
28 | ||
29 | typedef struct FuzzTargetState { | |
30 | FuzzTarget *target; | |
31 | QSLIST_ENTRY(FuzzTargetState) target_list; | |
32 | } FuzzTargetState; | |
33 | ||
34 | typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList; | |
35 | ||
36 | static const char *fuzz_arch = TARGET_NAME; | |
37 | ||
38 | static FuzzTargetList *fuzz_target_list; | |
39 | static FuzzTarget *fuzz_target; | |
40 | static QTestState *fuzz_qts; | |
41 | ||
42 | ||
43 | ||
44 | void flush_events(QTestState *s) | |
45 | { | |
46 | int i = MAX_EVENT_LOOPS; | |
47 | while (g_main_context_pending(NULL) && i-- > 0) { | |
48 | main_loop_wait(false); | |
49 | } | |
50 | } | |
51 | ||
52 | static QTestState *qtest_setup(void) | |
53 | { | |
54 | qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts); | |
55 | return qtest_inproc_init(&fuzz_qts, false, fuzz_arch, | |
56 | &qtest_server_inproc_recv); | |
57 | } | |
58 | ||
59 | void fuzz_add_target(const FuzzTarget *target) | |
60 | { | |
61 | FuzzTargetState *tmp; | |
62 | FuzzTargetState *target_state; | |
63 | if (!fuzz_target_list) { | |
64 | fuzz_target_list = g_new0(FuzzTargetList, 1); | |
65 | } | |
66 | ||
67 | QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { | |
68 | if (g_strcmp0(tmp->target->name, target->name) == 0) { | |
69 | fprintf(stderr, "Error: Fuzz target name %s already in use\n", | |
70 | target->name); | |
71 | abort(); | |
72 | } | |
73 | } | |
74 | target_state = g_new0(FuzzTargetState, 1); | |
75 | target_state->target = g_new0(FuzzTarget, 1); | |
76 | *(target_state->target) = *target; | |
77 | QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list); | |
78 | } | |
79 | ||
80 | ||
81 | ||
82 | static void usage(char *path) | |
83 | { | |
84 | printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path); | |
85 | printf("where FUZZ_TARGET is one of:\n"); | |
86 | FuzzTargetState *tmp; | |
87 | if (!fuzz_target_list) { | |
88 | fprintf(stderr, "Fuzz target list not initialized\n"); | |
89 | abort(); | |
90 | } | |
91 | QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { | |
92 | printf(" * %s : %s\n", tmp->target->name, | |
93 | tmp->target->description); | |
94 | } | |
d92e1b6d AB |
95 | printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n\n" |
96 | "Set the environment variable FUZZ_SERIALIZE_QTEST=1 to serialize\n" | |
97 | "QTest commands into an ASCII protocol. Useful for building crash\n" | |
8efebd4e AB |
98 | "reproducers, but slows down execution.\n\n" |
99 | "Set the environment variable QTEST_LOG=1 to log all qtest commands" | |
100 | "\n"); | |
5f6fd09a AB |
101 | exit(0); |
102 | } | |
103 | ||
104 | static FuzzTarget *fuzz_get_target(char* name) | |
105 | { | |
106 | FuzzTargetState *tmp; | |
107 | if (!fuzz_target_list) { | |
108 | fprintf(stderr, "Fuzz target list not initialized\n"); | |
109 | abort(); | |
110 | } | |
111 | ||
112 | QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { | |
113 | if (strcmp(tmp->target->name, name) == 0) { | |
114 | return tmp->target; | |
115 | } | |
116 | } | |
117 | return NULL; | |
118 | } | |
119 | ||
120 | ||
121 | /* Executed for each fuzzing-input */ | |
122 | int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) | |
123 | { | |
124 | /* | |
125 | * Do the pre-fuzz-initialization before the first fuzzing iteration, | |
126 | * instead of before the actual fuzz loop. This is needed since libfuzzer | |
127 | * may fork off additional workers, prior to the fuzzing loop, and if | |
128 | * pre_fuzz() sets up e.g. shared memory, this should be done for the | |
129 | * individual worker processes | |
130 | */ | |
131 | static int pre_fuzz_done; | |
132 | if (!pre_fuzz_done && fuzz_target->pre_fuzz) { | |
133 | fuzz_target->pre_fuzz(fuzz_qts); | |
134 | pre_fuzz_done = true; | |
135 | } | |
136 | ||
137 | fuzz_target->fuzz(fuzz_qts, Data, Size); | |
138 | return 0; | |
139 | } | |
140 | ||
141 | /* Executed once, prior to fuzzing */ | |
142 | int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) | |
143 | { | |
144 | ||
145 | char *target_name; | |
a4c13869 PB |
146 | const char *bindir; |
147 | char *datadir; | |
d92e1b6d | 148 | bool serialize = false; |
5f6fd09a AB |
149 | |
150 | /* Initialize qgraph and modules */ | |
151 | qos_graph_init(); | |
152 | module_call_init(MODULE_INIT_FUZZ_TARGET); | |
153 | module_call_init(MODULE_INIT_QOM); | |
154 | module_call_init(MODULE_INIT_LIBQOS); | |
155 | ||
ec986777 | 156 | qemu_init_exec_dir(**argv); |
05509c8e AB |
157 | target_name = strstr(**argv, "-target-"); |
158 | if (target_name) { /* The binary name specifies the target */ | |
159 | target_name += strlen("-target-"); | |
7a071a96 AB |
160 | /* |
161 | * With oss-fuzz, the executable is kept in the root of a directory (we | |
162 | * cannot assume the path). All data (including bios binaries) must be | |
163 | * in the same dir, or a subdir. Thus, we cannot place the pc-bios so | |
164 | * that it would be in exec_dir/../pc-bios. | |
165 | * As a workaround, oss-fuzz allows us to use argv[0] to get the | |
166 | * location of the executable. Using this we add exec_dir/pc-bios to | |
167 | * the datadirs. | |
168 | */ | |
ec986777 | 169 | bindir = qemu_get_exec_dir(); |
bcbad8b0 | 170 | datadir = g_build_filename(bindir, "pc-bios", NULL); |
bcbad8b0 AB |
171 | if (g_file_test(datadir, G_FILE_TEST_IS_DIR)) { |
172 | qemu_add_data_dir(datadir); | |
ea1edcd7 PB |
173 | } else { |
174 | g_free(datadir); | |
175 | } | |
05509c8e AB |
176 | } else if (*argc > 1) { /* The target is specified as an argument */ |
177 | target_name = (*argv)[1]; | |
178 | if (!strstr(target_name, "--fuzz-target=")) { | |
179 | usage(**argv); | |
180 | } | |
181 | target_name += strlen("--fuzz-target="); | |
182 | } else { | |
5f6fd09a AB |
183 | usage(**argv); |
184 | } | |
185 | ||
d92e1b6d AB |
186 | /* Should we always serialize qtest commands? */ |
187 | if (getenv("FUZZ_SERIALIZE_QTEST")) { | |
188 | serialize = true; | |
189 | } | |
190 | ||
191 | fuzz_qtest_set_serialize(serialize); | |
192 | ||
5f6fd09a | 193 | /* Identify the fuzz target */ |
5f6fd09a AB |
194 | fuzz_target = fuzz_get_target(target_name); |
195 | if (!fuzz_target) { | |
196 | usage(**argv); | |
197 | } | |
198 | ||
199 | fuzz_qts = qtest_setup(); | |
200 | ||
201 | if (fuzz_target->pre_vm_init) { | |
202 | fuzz_target->pre_vm_init(); | |
203 | } | |
204 | ||
205 | /* Run QEMU's softmmu main with the fuzz-target dependent arguments */ | |
f5ec79f5 | 206 | GString *cmd_line = fuzz_target->get_init_cmdline(fuzz_target); |
d287961f AB |
207 | g_string_append_printf(cmd_line, " %s -qtest /dev/null ", |
208 | getenv("QTEST_LOG") ? "" : "-qtest-log none"); | |
5f6fd09a AB |
209 | |
210 | /* Split the runcmd into an argv and argc */ | |
211 | wordexp_t result; | |
f5ec79f5 AB |
212 | wordexp(cmd_line->str, &result, 0); |
213 | g_string_free(cmd_line, true); | |
5f6fd09a AB |
214 | |
215 | qemu_init(result.we_wordc, result.we_wordv, NULL); | |
216 | ||
45222b9a AB |
217 | /* re-enable the rcu atfork, which was previously disabled in qemu_init */ |
218 | rcu_enable_atfork(); | |
219 | ||
5f6fd09a AB |
220 | return 0; |
221 | } |