| 1 | /* |
| 2 | * fuzzing driver |
| 3 | * |
| 4 | * Copyright Red Hat Inc., 2019 |
| 5 | * |
| 6 | * Authors: |
| 7 | * Alexander Bulekov <alxndr@bu.edu> |
| 8 | * |
| 9 | * This work is licensed under the terms of the GNU GPL, version 2 or later. |
| 10 | * See the COPYING file in the top-level directory. |
| 11 | * |
| 12 | */ |
| 13 | |
| 14 | #include "qemu/osdep.h" |
| 15 | |
| 16 | #include <wordexp.h> |
| 17 | |
| 18 | #include "qemu/cutils.h" |
| 19 | #include "qemu/datadir.h" |
| 20 | #include "system/system.h" |
| 21 | #include "system/qtest.h" |
| 22 | #include "system/runstate.h" |
| 23 | #include "qemu/main-loop.h" |
| 24 | #include "qemu/rcu.h" |
| 25 | #include "qemu/target-info-qom.h" |
| 26 | #include "tests/qtest/libqtest.h" |
| 27 | #include "tests/qtest/libqos/qgraph.h" |
| 28 | #include "fuzz.h" |
| 29 | |
| 30 | #define MAX_EVENT_LOOPS 10 |
| 31 | |
| 32 | typedef struct FuzzTargetState { |
| 33 | FuzzTarget *target; |
| 34 | QSLIST_ENTRY(FuzzTargetState) target_list; |
| 35 | } FuzzTargetState; |
| 36 | |
| 37 | typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList; |
| 38 | |
| 39 | static const char *fuzz_arch = TARGET_NAME; |
| 40 | |
| 41 | static FuzzTargetList *fuzz_target_list; |
| 42 | static FuzzTarget *fuzz_target; |
| 43 | static QTestState *fuzz_qts; |
| 44 | |
| 45 | int (*qemu_main)(void); |
| 46 | |
| 47 | |
| 48 | void flush_events(QTestState *s) |
| 49 | { |
| 50 | int i = MAX_EVENT_LOOPS; |
| 51 | while (g_main_context_pending(NULL) && i-- > 0) { |
| 52 | main_loop_wait(false); |
| 53 | } |
| 54 | } |
| 55 | |
| 56 | void fuzz_reset(QTestState *s) |
| 57 | { |
| 58 | qemu_system_reset(SHUTDOWN_CAUSE_GUEST_RESET); |
| 59 | main_loop_wait(true); |
| 60 | } |
| 61 | |
| 62 | static QTestState *qtest_setup(void) |
| 63 | { |
| 64 | qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts); |
| 65 | return qtest_inproc_init(&fuzz_qts, false, fuzz_arch, |
| 66 | &qtest_server_inproc_recv); |
| 67 | } |
| 68 | |
| 69 | void fuzz_add_target(const FuzzTarget *target) |
| 70 | { |
| 71 | FuzzTargetState *tmp; |
| 72 | FuzzTargetState *target_state; |
| 73 | if (!fuzz_target_list) { |
| 74 | fuzz_target_list = g_new0(FuzzTargetList, 1); |
| 75 | } |
| 76 | |
| 77 | QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { |
| 78 | if (g_strcmp0(tmp->target->name, target->name) == 0) { |
| 79 | fprintf(stderr, "Error: Fuzz target name %s already in use\n", |
| 80 | target->name); |
| 81 | abort(); |
| 82 | } |
| 83 | } |
| 84 | target_state = g_new0(FuzzTargetState, 1); |
| 85 | target_state->target = g_new0(FuzzTarget, 1); |
| 86 | *(target_state->target) = *target; |
| 87 | QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list); |
| 88 | } |
| 89 | |
| 90 | |
| 91 | |
| 92 | static void usage(char *path) |
| 93 | { |
| 94 | printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path); |
| 95 | printf("where FUZZ_TARGET is one of:\n"); |
| 96 | FuzzTargetState *tmp; |
| 97 | if (!fuzz_target_list) { |
| 98 | fprintf(stderr, "Fuzz target list not initialized\n"); |
| 99 | abort(); |
| 100 | } |
| 101 | QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { |
| 102 | printf(" * %s : %s\n", tmp->target->name, |
| 103 | tmp->target->description); |
| 104 | } |
| 105 | printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n\n" |
| 106 | "Set the environment variable FUZZ_SERIALIZE_QTEST=1 to serialize\n" |
| 107 | "QTest commands into an ASCII protocol. Useful for building crash\n" |
| 108 | "reproducers, but slows down execution.\n\n" |
| 109 | "Set the environment variable QTEST_LOG=fuzz to log all qtest commands" |
| 110 | "\n"); |
| 111 | exit(0); |
| 112 | } |
| 113 | |
| 114 | static FuzzTarget *fuzz_get_target(char* name) |
| 115 | { |
| 116 | FuzzTargetState *tmp; |
| 117 | if (!fuzz_target_list) { |
| 118 | fprintf(stderr, "Fuzz target list not initialized\n"); |
| 119 | abort(); |
| 120 | } |
| 121 | |
| 122 | QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { |
| 123 | if (strcmp(tmp->target->name, name) == 0) { |
| 124 | return tmp->target; |
| 125 | } |
| 126 | } |
| 127 | return NULL; |
| 128 | } |
| 129 | |
| 130 | |
| 131 | /* Sometimes called by libfuzzer to mutate two inputs into one */ |
| 132 | size_t LLVMFuzzerCustomCrossOver(const uint8_t *data1, size_t size1, |
| 133 | const uint8_t *data2, size_t size2, |
| 134 | uint8_t *out, size_t max_out_size, |
| 135 | unsigned int seed) |
| 136 | { |
| 137 | if (fuzz_target->crossover) { |
| 138 | return fuzz_target->crossover(data1, size1, data2, size2, out, |
| 139 | max_out_size, seed); |
| 140 | } |
| 141 | return 0; |
| 142 | } |
| 143 | |
| 144 | /* Executed for each fuzzing-input */ |
| 145 | int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) |
| 146 | { |
| 147 | /* |
| 148 | * Do the pre-fuzz-initialization before the first fuzzing iteration, |
| 149 | * instead of before the actual fuzz loop. This is needed since libfuzzer |
| 150 | * may fork off additional workers, prior to the fuzzing loop, and if |
| 151 | * pre_fuzz() sets up e.g. shared memory, this should be done for the |
| 152 | * individual worker processes |
| 153 | */ |
| 154 | static int pre_fuzz_done; |
| 155 | if (!pre_fuzz_done && fuzz_target->pre_fuzz) { |
| 156 | fuzz_target->pre_fuzz(fuzz_qts); |
| 157 | pre_fuzz_done = true; |
| 158 | } |
| 159 | |
| 160 | fuzz_target->fuzz(fuzz_qts, Data, Size); |
| 161 | return 0; |
| 162 | } |
| 163 | |
| 164 | /* Executed once, prior to fuzzing */ |
| 165 | int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) |
| 166 | { |
| 167 | |
| 168 | char *target_name; |
| 169 | GString *cmd_line; |
| 170 | gchar *pretty_cmd_line; |
| 171 | bool serialize = false; |
| 172 | bool verbose = qtest_verbose("fuzz"); |
| 173 | |
| 174 | /* Initialize qgraph and modules */ |
| 175 | qos_graph_init(); |
| 176 | module_call_init(MODULE_INIT_TARGET_INFO); |
| 177 | target_info_qom_set_target(); |
| 178 | module_call_init(MODULE_INIT_FUZZ_TARGET); |
| 179 | module_call_init(MODULE_INIT_QOM); |
| 180 | module_call_init(MODULE_INIT_LIBQOS); |
| 181 | |
| 182 | qemu_init_exec_dir(**argv); |
| 183 | target_name = strstr(**argv, "-target-"); |
| 184 | if (target_name) { /* The binary name specifies the target */ |
| 185 | target_name += strlen("-target-"); |
| 186 | } else if (*argc > 1) { /* The target is specified as an argument */ |
| 187 | target_name = (*argv)[1]; |
| 188 | if (!strstr(target_name, "--fuzz-target=")) { |
| 189 | usage(**argv); |
| 190 | } |
| 191 | target_name += strlen("--fuzz-target="); |
| 192 | } else { |
| 193 | usage(**argv); |
| 194 | } |
| 195 | |
| 196 | /* Should we always serialize qtest commands? */ |
| 197 | if (getenv("FUZZ_SERIALIZE_QTEST")) { |
| 198 | serialize = true; |
| 199 | } |
| 200 | |
| 201 | fuzz_qtest_set_serialize(serialize); |
| 202 | |
| 203 | /* Identify the fuzz target */ |
| 204 | fuzz_target = fuzz_get_target(target_name); |
| 205 | if (!fuzz_target) { |
| 206 | usage(**argv); |
| 207 | } |
| 208 | |
| 209 | fuzz_qts = qtest_setup(); |
| 210 | |
| 211 | if (fuzz_target->pre_vm_init) { |
| 212 | fuzz_target->pre_vm_init(); |
| 213 | } |
| 214 | |
| 215 | /* Run QEMU's system main with the fuzz-target dependent arguments */ |
| 216 | cmd_line = fuzz_target->get_init_cmdline(fuzz_target); |
| 217 | g_string_append_printf(cmd_line, " %s -qtest /dev/null ", |
| 218 | verbose ? "" : "-qtest-log none"); |
| 219 | |
| 220 | /* Split the runcmd into an argv and argc */ |
| 221 | wordexp_t result; |
| 222 | wordexp(cmd_line->str, &result, 0); |
| 223 | g_string_free(cmd_line, true); |
| 224 | |
| 225 | if (verbose) { |
| 226 | pretty_cmd_line = g_strjoinv(" ", result.we_wordv + 1); |
| 227 | printf("Starting %s with Arguments: %s\n", |
| 228 | result.we_wordv[0], pretty_cmd_line); |
| 229 | g_free(pretty_cmd_line); |
| 230 | } |
| 231 | |
| 232 | qemu_init(result.we_wordc, result.we_wordv); |
| 233 | |
| 234 | /* re-enable the rcu atfork, which was previously disabled in qemu_init */ |
| 235 | rcu_enable_atfork(); |
| 236 | |
| 237 | /* |
| 238 | * Disable QEMU's signal handlers, since we manually control the main_loop, |
| 239 | * and don't check for main_loop_should_exit |
| 240 | */ |
| 241 | signal(SIGINT, SIG_DFL); |
| 242 | signal(SIGHUP, SIG_DFL); |
| 243 | signal(SIGTERM, SIG_DFL); |
| 244 | |
| 245 | return 0; |
| 246 | } |