tests/qtest/fuzz/fuzz.c

   1 /*
   2  * fuzzing driver
   3  *
   4  * Copyright Red Hat Inc., 2019
   5  *
   6  * Authors:
   7  *  Alexander Bulekov   <alxndr@bu.edu>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  10  * See the COPYING file in the top-level directory.
  11  *
  12  */
  13
  14 #include "qemu/osdep.h"
  15
  16 #include <wordexp.h>
  17
  18 #include "sysemu/qtest.h"
  19 #include "sysemu/runstate.h"
  20 #include "sysemu/sysemu.h"
  21 #include "qemu/main-loop.h"
  22 #include "qemu/rcu.h"
  23 #include "tests/qtest/libqtest.h"
  24 #include "tests/qtest/libqos/qgraph.h"
  25 #include "fuzz.h"
  26
  27 #define MAX_EVENT_LOOPS 10
  28
  29 typedef struct FuzzTargetState {
  30         FuzzTarget *target;
  31         QSLIST_ENTRY(FuzzTargetState) target_list;
  32 } FuzzTargetState;
  33
  34 typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList;
  35
  36 static const char *fuzz_arch = TARGET_NAME;
  37
  38 static FuzzTargetList *fuzz_target_list;
  39 static FuzzTarget *fuzz_target;
  40 static QTestState *fuzz_qts;
  41
  42
  43
  44 void flush_events(QTestState *s)
  45 {
  46     int i = MAX_EVENT_LOOPS;
  47     while (g_main_context_pending(NULL) && i-- > 0) {
  48         main_loop_wait(false);
  49     }
  50 }
  51
  52 static QTestState *qtest_setup(void)
  53 {
  54     qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts);
  55     return qtest_inproc_init(&fuzz_qts, false, fuzz_arch,
  56             &qtest_server_inproc_recv);
  57 }
  58
  59 void fuzz_add_target(const FuzzTarget *target)
  60 {
  61     FuzzTargetState *tmp;
  62     FuzzTargetState *target_state;
  63     if (!fuzz_target_list) {
  64         fuzz_target_list = g_new0(FuzzTargetList, 1);
  65     }
  66
  67     QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
  68         if (g_strcmp0(tmp->target->name, target->name) == 0) {
  69             fprintf(stderr, "Error: Fuzz target name %s already in use\n",
  70                     target->name);
  71             abort();
  72         }
  73     }
  74     target_state = g_new0(FuzzTargetState, 1);
  75     target_state->target = g_new0(FuzzTarget, 1);
  76     *(target_state->target) = *target;
  77     QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list);
  78 }
  79
  80
  81
  82 static void usage(char *path)
  83 {
  84     printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path);
  85     printf("where FUZZ_TARGET is one of:\n");
  86     FuzzTargetState *tmp;
  87     if (!fuzz_target_list) {
  88         fprintf(stderr, "Fuzz target list not initialized\n");
  89         abort();
  90     }
  91     QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
  92         printf(" * %s  : %s\n", tmp->target->name,
  93                 tmp->target->description);
  94     }
  95     printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n\n"
  96            "Set the environment variable FUZZ_SERIALIZE_QTEST=1 to serialize\n"
  97            "QTest commands into an ASCII protocol. Useful for building crash\n"
  98            "reproducers, but slows down execution.\n\n"
  99            "Set the environment variable QTEST_LOG=1 to log all qtest commands"
 100            "\n");
 101     exit(0);
 102 }
 103
 104 static FuzzTarget *fuzz_get_target(char* name)
 105 {
 106     FuzzTargetState *tmp;
 107     if (!fuzz_target_list) {
 108         fprintf(stderr, "Fuzz target list not initialized\n");
 109         abort();
 110     }
 111
 112     QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
 113         if (strcmp(tmp->target->name, name) == 0) {
 114             return tmp->target;
 115         }
 116     }
 117     return NULL;
 118 }
 119
 120
 121 /* Executed for each fuzzing-input */
 122 int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size)
 123 {
 124     /*
 125      * Do the pre-fuzz-initialization before the first fuzzing iteration,
 126      * instead of before the actual fuzz loop. This is needed since libfuzzer
 127      * may fork off additional workers, prior to the fuzzing loop, and if
 128      * pre_fuzz() sets up e.g. shared memory, this should be done for the
 129      * individual worker processes
 130      */
 131     static int pre_fuzz_done;
 132     if (!pre_fuzz_done && fuzz_target->pre_fuzz) {
 133         fuzz_target->pre_fuzz(fuzz_qts);
 134         pre_fuzz_done = true;
 135     }
 136
 137     fuzz_target->fuzz(fuzz_qts, Data, Size);
 138     return 0;
 139 }
 140
 141 /* Executed once, prior to fuzzing */
 142 int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
 143 {
 144
 145     char *target_name;
 146     char *bindir, *datadir;
 147     bool serialize = false;
 148
 149     /* Initialize qgraph and modules */
 150     qos_graph_init();
 151     module_call_init(MODULE_INIT_FUZZ_TARGET);
 152     module_call_init(MODULE_INIT_QOM);
 153     module_call_init(MODULE_INIT_LIBQOS);
 154
 155     target_name = strstr(**argv, "-target-");
 156     if (target_name) {        /* The binary name specifies the target */
 157         target_name += strlen("-target-");
 158         /*
 159          * With oss-fuzz, the executable is kept in the root of a directory (we
 160          * cannot assume the path). All data (including bios binaries) must be
 161          * in the same dir, or a subdir. Thus, we cannot place the pc-bios so
 162          * that it would be in exec_dir/../pc-bios.
 163          * As a workaround, oss-fuzz allows us to use argv[0] to get the
 164          * location of the executable. Using this we add exec_dir/pc-bios to
 165          * the datadirs.
 166          */
 167         bindir = g_path_get_dirname(**argv);
 168         datadir = g_build_filename(bindir, "pc-bios", NULL);
 169         g_free(bindir);
 170         if (g_file_test(datadir, G_FILE_TEST_IS_DIR)) {
 171             qemu_add_data_dir(datadir);
 172         }
 173         g_free(datadir);
 174     } else if (*argc > 1) {  /* The target is specified as an argument */
 175         target_name = (*argv)[1];
 176         if (!strstr(target_name, "--fuzz-target=")) {
 177             usage(**argv);
 178         }
 179         target_name += strlen("--fuzz-target=");
 180     } else {
 181         usage(**argv);
 182     }
 183
 184     /* Should we always serialize qtest commands? */
 185     if (getenv("FUZZ_SERIALIZE_QTEST")) {
 186         serialize = true;
 187     }
 188
 189     fuzz_qtest_set_serialize(serialize);
 190
 191     /* Identify the fuzz target */
 192     fuzz_target = fuzz_get_target(target_name);
 193     if (!fuzz_target) {
 194         usage(**argv);
 195     }
 196
 197     fuzz_qts = qtest_setup();
 198
 199     if (fuzz_target->pre_vm_init) {
 200         fuzz_target->pre_vm_init();
 201     }
 202
 203     /* Run QEMU's softmmu main with the fuzz-target dependent arguments */
 204     GString *cmd_line = fuzz_target->get_init_cmdline(fuzz_target);
 205     g_string_append_printf(cmd_line,
 206                            " -qtest /dev/null -qtest-log %s",
 207                            getenv("QTEST_LOG") ? "/dev/fd/2" : "/dev/null");
 208
 209     /* Split the runcmd into an argv and argc */
 210     wordexp_t result;
 211     wordexp(cmd_line->str, &result, 0);
 212     g_string_free(cmd_line, true);
 213
 214     qemu_init(result.we_wordc, result.we_wordv, NULL);
 215
 216     /* re-enable the rcu atfork, which was previously disabled in qemu_init */
 217     rcu_enable_atfork();
 218
 219     return 0;
 220 }