]>
Commit | Line | Data |
---|---|---|
5f6fd09a AB |
1 | /* |
2 | * fuzzing driver | |
3 | * | |
4 | * Copyright Red Hat Inc., 2019 | |
5 | * | |
6 | * Authors: | |
7 | * Alexander Bulekov <alxndr@bu.edu> | |
8 | * | |
9 | * This work is licensed under the terms of the GNU GPL, version 2 or later. | |
10 | * See the COPYING file in the top-level directory. | |
11 | * | |
12 | */ | |
13 | ||
14 | #include "qemu/osdep.h" | |
15 | ||
16 | #include <wordexp.h> | |
17 | ||
06680b15 | 18 | #include "qemu/cutils.h" |
2c65db5e | 19 | #include "qemu/datadir.h" |
aaad0264 | 20 | #include "sysemu/sysemu.h" |
5f6fd09a AB |
21 | #include "sysemu/qtest.h" |
22 | #include "sysemu/runstate.h" | |
5f6fd09a | 23 | #include "qemu/main-loop.h" |
230225ea | 24 | #include "qemu/rcu.h" |
907b5105 | 25 | #include "tests/qtest/libqtest.h" |
5f6fd09a AB |
26 | #include "tests/qtest/libqos/qgraph.h" |
27 | #include "fuzz.h" | |
28 | ||
29 | #define MAX_EVENT_LOOPS 10 | |
30 | ||
31 | typedef struct FuzzTargetState { | |
32 | FuzzTarget *target; | |
33 | QSLIST_ENTRY(FuzzTargetState) target_list; | |
34 | } FuzzTargetState; | |
35 | ||
36 | typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList; | |
37 | ||
38 | static const char *fuzz_arch = TARGET_NAME; | |
39 | ||
40 | static FuzzTargetList *fuzz_target_list; | |
41 | static FuzzTarget *fuzz_target; | |
42 | static QTestState *fuzz_qts; | |
43 | ||
44 | ||
45 | ||
46 | void flush_events(QTestState *s) | |
47 | { | |
48 | int i = MAX_EVENT_LOOPS; | |
49 | while (g_main_context_pending(NULL) && i-- > 0) { | |
50 | main_loop_wait(false); | |
51 | } | |
52 | } | |
53 | ||
8d1e76b3 AB |
54 | void fuzz_reset(QTestState *s) |
55 | { | |
56 | qemu_system_reset(SHUTDOWN_CAUSE_GUEST_RESET); | |
57 | main_loop_wait(true); | |
58 | } | |
59 | ||
5f6fd09a AB |
60 | static QTestState *qtest_setup(void) |
61 | { | |
62 | qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts); | |
63 | return qtest_inproc_init(&fuzz_qts, false, fuzz_arch, | |
64 | &qtest_server_inproc_recv); | |
65 | } | |
66 | ||
67 | void fuzz_add_target(const FuzzTarget *target) | |
68 | { | |
69 | FuzzTargetState *tmp; | |
70 | FuzzTargetState *target_state; | |
71 | if (!fuzz_target_list) { | |
72 | fuzz_target_list = g_new0(FuzzTargetList, 1); | |
73 | } | |
74 | ||
75 | QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { | |
76 | if (g_strcmp0(tmp->target->name, target->name) == 0) { | |
77 | fprintf(stderr, "Error: Fuzz target name %s already in use\n", | |
78 | target->name); | |
79 | abort(); | |
80 | } | |
81 | } | |
82 | target_state = g_new0(FuzzTargetState, 1); | |
83 | target_state->target = g_new0(FuzzTarget, 1); | |
84 | *(target_state->target) = *target; | |
85 | QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list); | |
86 | } | |
87 | ||
88 | ||
89 | ||
90 | static void usage(char *path) | |
91 | { | |
92 | printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path); | |
93 | printf("where FUZZ_TARGET is one of:\n"); | |
94 | FuzzTargetState *tmp; | |
95 | if (!fuzz_target_list) { | |
96 | fprintf(stderr, "Fuzz target list not initialized\n"); | |
97 | abort(); | |
98 | } | |
99 | QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { | |
100 | printf(" * %s : %s\n", tmp->target->name, | |
101 | tmp->target->description); | |
102 | } | |
d92e1b6d AB |
103 | printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n\n" |
104 | "Set the environment variable FUZZ_SERIALIZE_QTEST=1 to serialize\n" | |
105 | "QTest commands into an ASCII protocol. Useful for building crash\n" | |
8efebd4e AB |
106 | "reproducers, but slows down execution.\n\n" |
107 | "Set the environment variable QTEST_LOG=1 to log all qtest commands" | |
108 | "\n"); | |
5f6fd09a AB |
109 | exit(0); |
110 | } | |
111 | ||
112 | static FuzzTarget *fuzz_get_target(char* name) | |
113 | { | |
114 | FuzzTargetState *tmp; | |
115 | if (!fuzz_target_list) { | |
116 | fprintf(stderr, "Fuzz target list not initialized\n"); | |
117 | abort(); | |
118 | } | |
119 | ||
120 | QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { | |
121 | if (strcmp(tmp->target->name, name) == 0) { | |
122 | return tmp->target; | |
123 | } | |
124 | } | |
125 | return NULL; | |
126 | } | |
127 | ||
128 | ||
f81cb729 AB |
129 | /* Sometimes called by libfuzzer to mutate two inputs into one */ |
130 | size_t LLVMFuzzerCustomCrossOver(const uint8_t *data1, size_t size1, | |
131 | const uint8_t *data2, size_t size2, | |
132 | uint8_t *out, size_t max_out_size, | |
133 | unsigned int seed) | |
134 | { | |
135 | if (fuzz_target->crossover) { | |
136 | return fuzz_target->crossover(data1, size1, data2, size2, out, | |
137 | max_out_size, seed); | |
138 | } | |
139 | return 0; | |
140 | } | |
141 | ||
5f6fd09a AB |
142 | /* Executed for each fuzzing-input */ |
143 | int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) | |
144 | { | |
145 | /* | |
146 | * Do the pre-fuzz-initialization before the first fuzzing iteration, | |
147 | * instead of before the actual fuzz loop. This is needed since libfuzzer | |
148 | * may fork off additional workers, prior to the fuzzing loop, and if | |
149 | * pre_fuzz() sets up e.g. shared memory, this should be done for the | |
150 | * individual worker processes | |
151 | */ | |
152 | static int pre_fuzz_done; | |
153 | if (!pre_fuzz_done && fuzz_target->pre_fuzz) { | |
154 | fuzz_target->pre_fuzz(fuzz_qts); | |
155 | pre_fuzz_done = true; | |
156 | } | |
157 | ||
158 | fuzz_target->fuzz(fuzz_qts, Data, Size); | |
159 | return 0; | |
160 | } | |
161 | ||
162 | /* Executed once, prior to fuzzing */ | |
163 | int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) | |
164 | { | |
165 | ||
166 | char *target_name; | |
61f90e04 AB |
167 | GString *cmd_line; |
168 | gchar *pretty_cmd_line; | |
d92e1b6d | 169 | bool serialize = false; |
5f6fd09a AB |
170 | |
171 | /* Initialize qgraph and modules */ | |
172 | qos_graph_init(); | |
173 | module_call_init(MODULE_INIT_FUZZ_TARGET); | |
174 | module_call_init(MODULE_INIT_QOM); | |
175 | module_call_init(MODULE_INIT_LIBQOS); | |
176 | ||
ec986777 | 177 | qemu_init_exec_dir(**argv); |
05509c8e AB |
178 | target_name = strstr(**argv, "-target-"); |
179 | if (target_name) { /* The binary name specifies the target */ | |
180 | target_name += strlen("-target-"); | |
181 | } else if (*argc > 1) { /* The target is specified as an argument */ | |
182 | target_name = (*argv)[1]; | |
183 | if (!strstr(target_name, "--fuzz-target=")) { | |
184 | usage(**argv); | |
185 | } | |
186 | target_name += strlen("--fuzz-target="); | |
187 | } else { | |
5f6fd09a AB |
188 | usage(**argv); |
189 | } | |
190 | ||
d92e1b6d AB |
191 | /* Should we always serialize qtest commands? */ |
192 | if (getenv("FUZZ_SERIALIZE_QTEST")) { | |
193 | serialize = true; | |
194 | } | |
195 | ||
196 | fuzz_qtest_set_serialize(serialize); | |
197 | ||
5f6fd09a | 198 | /* Identify the fuzz target */ |
5f6fd09a AB |
199 | fuzz_target = fuzz_get_target(target_name); |
200 | if (!fuzz_target) { | |
201 | usage(**argv); | |
202 | } | |
203 | ||
204 | fuzz_qts = qtest_setup(); | |
205 | ||
206 | if (fuzz_target->pre_vm_init) { | |
207 | fuzz_target->pre_vm_init(); | |
208 | } | |
209 | ||
c2646d49 | 210 | /* Run QEMU's system main with the fuzz-target dependent arguments */ |
61f90e04 | 211 | cmd_line = fuzz_target->get_init_cmdline(fuzz_target); |
d287961f AB |
212 | g_string_append_printf(cmd_line, " %s -qtest /dev/null ", |
213 | getenv("QTEST_LOG") ? "" : "-qtest-log none"); | |
5f6fd09a AB |
214 | |
215 | /* Split the runcmd into an argv and argc */ | |
216 | wordexp_t result; | |
f5ec79f5 AB |
217 | wordexp(cmd_line->str, &result, 0); |
218 | g_string_free(cmd_line, true); | |
5f6fd09a | 219 | |
61f90e04 AB |
220 | if (getenv("QTEST_LOG")) { |
221 | pretty_cmd_line = g_strjoinv(" ", result.we_wordv + 1); | |
222 | printf("Starting %s with Arguments: %s\n", | |
223 | result.we_wordv[0], pretty_cmd_line); | |
224 | g_free(pretty_cmd_line); | |
225 | } | |
226 | ||
bab6a301 | 227 | qemu_init(result.we_wordc, result.we_wordv); |
5f6fd09a | 228 | |
45222b9a AB |
229 | /* re-enable the rcu atfork, which was previously disabled in qemu_init */ |
230 | rcu_enable_atfork(); | |
231 | ||
fc69fa21 AB |
232 | /* |
233 | * Disable QEMU's signal handlers, since we manually control the main_loop, | |
234 | * and don't check for main_loop_should_exit | |
235 | */ | |
236 | signal(SIGINT, SIG_DFL); | |
237 | signal(SIGHUP, SIG_DFL); | |
238 | signal(SIGTERM, SIG_DFL); | |
239 | ||
5f6fd09a AB |
240 | return 0; |
241 | } |