1 /* 2 * fuzzing driver 3 * 4 * Copyright Red Hat Inc., 2019 5 * 6 * Authors: 7 * Alexander Bulekov <alxndr@bu.edu> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 */ 13 14 #include "qemu/osdep.h" 15 16 #include <wordexp.h> 17 18 #include "sysemu/qtest.h" 19 #include "sysemu/runstate.h" 20 #include "sysemu/sysemu.h" 21 #include "qemu/main-loop.h" 22 #include "tests/qtest/libqtest.h" 23 #include "tests/qtest/libqos/qgraph.h" 24 #include "fuzz.h" 25 26 #define MAX_EVENT_LOOPS 10 27 28 typedef struct FuzzTargetState { 29 FuzzTarget *target; 30 QSLIST_ENTRY(FuzzTargetState) target_list; 31 } FuzzTargetState; 32 33 typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList; 34 35 static const char *fuzz_arch = TARGET_NAME; 36 37 static FuzzTargetList *fuzz_target_list; 38 static FuzzTarget *fuzz_target; 39 static QTestState *fuzz_qts; 40 41 42 43 void flush_events(QTestState *s) 44 { 45 int i = MAX_EVENT_LOOPS; 46 while (g_main_context_pending(NULL) && i-- > 0) { 47 main_loop_wait(false); 48 } 49 } 50 51 static QTestState *qtest_setup(void) 52 { 53 qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts); 54 return qtest_inproc_init(&fuzz_qts, false, fuzz_arch, 55 &qtest_server_inproc_recv); 56 } 57 58 void fuzz_add_target(const FuzzTarget *target) 59 { 60 FuzzTargetState *tmp; 61 FuzzTargetState *target_state; 62 if (!fuzz_target_list) { 63 fuzz_target_list = g_new0(FuzzTargetList, 1); 64 } 65 66 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { 67 if (g_strcmp0(tmp->target->name, target->name) == 0) { 68 fprintf(stderr, "Error: Fuzz target name %s already in use\n", 69 target->name); 70 abort(); 71 } 72 } 73 target_state = g_new0(FuzzTargetState, 1); 74 target_state->target = g_new0(FuzzTarget, 1); 75 *(target_state->target) = *target; 76 QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list); 77 } 78 79 80 81 static void usage(char *path) 82 { 83 printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path); 84 printf("where FUZZ_TARGET is one of:\n"); 85 FuzzTargetState *tmp; 86 if (!fuzz_target_list) { 87 fprintf(stderr, "Fuzz target list not initialized\n"); 88 abort(); 89 } 90 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { 91 printf(" * %s : %s\n", tmp->target->name, 92 tmp->target->description); 93 } 94 printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n\n" 95 "Set the environment variable FUZZ_SERIALIZE_QTEST=1 to serialize\n" 96 "QTest commands into an ASCII protocol. Useful for building crash\n" 97 "reproducers, but slows down execution.\n\n" 98 "Set the environment variable QTEST_LOG=1 to log all qtest commands" 99 "\n"); 100 exit(0); 101 } 102 103 static FuzzTarget *fuzz_get_target(char* name) 104 { 105 FuzzTargetState *tmp; 106 if (!fuzz_target_list) { 107 fprintf(stderr, "Fuzz target list not initialized\n"); 108 abort(); 109 } 110 111 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { 112 if (strcmp(tmp->target->name, name) == 0) { 113 return tmp->target; 114 } 115 } 116 return NULL; 117 } 118 119 120 /* Executed for each fuzzing-input */ 121 int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) 122 { 123 /* 124 * Do the pre-fuzz-initialization before the first fuzzing iteration, 125 * instead of before the actual fuzz loop. This is needed since libfuzzer 126 * may fork off additional workers, prior to the fuzzing loop, and if 127 * pre_fuzz() sets up e.g. shared memory, this should be done for the 128 * individual worker processes 129 */ 130 static int pre_fuzz_done; 131 if (!pre_fuzz_done && fuzz_target->pre_fuzz) { 132 fuzz_target->pre_fuzz(fuzz_qts); 133 pre_fuzz_done = true; 134 } 135 136 fuzz_target->fuzz(fuzz_qts, Data, Size); 137 return 0; 138 } 139 140 /* Executed once, prior to fuzzing */ 141 int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) 142 { 143 144 char *target_name; 145 char *dir; 146 bool serialize = false; 147 148 /* Initialize qgraph and modules */ 149 qos_graph_init(); 150 module_call_init(MODULE_INIT_FUZZ_TARGET); 151 module_call_init(MODULE_INIT_QOM); 152 module_call_init(MODULE_INIT_LIBQOS); 153 154 target_name = strstr(**argv, "-target-"); 155 if (target_name) { /* The binary name specifies the target */ 156 target_name += strlen("-target-"); 157 /* 158 * With oss-fuzz, the executable is kept in the root of a directory (we 159 * cannot assume the path). All data (including bios binaries) must be 160 * in the same dir, or a subdir. Thus, we cannot place the pc-bios so 161 * that it would be in exec_dir/../pc-bios. 162 * As a workaround, oss-fuzz allows us to use argv[0] to get the 163 * location of the executable. Using this we add exec_dir/pc-bios to 164 * the datadirs. 165 */ 166 dir = g_build_filename(g_path_get_dirname(**argv), "pc-bios", NULL); 167 if (g_file_test(dir, G_FILE_TEST_IS_DIR)) { 168 qemu_add_data_dir(dir); 169 } 170 g_free(dir); 171 } else if (*argc > 1) { /* The target is specified as an argument */ 172 target_name = (*argv)[1]; 173 if (!strstr(target_name, "--fuzz-target=")) { 174 usage(**argv); 175 } 176 target_name += strlen("--fuzz-target="); 177 } else { 178 usage(**argv); 179 } 180 181 /* Should we always serialize qtest commands? */ 182 if (getenv("FUZZ_SERIALIZE_QTEST")) { 183 serialize = true; 184 } 185 186 fuzz_qtest_set_serialize(serialize); 187 188 /* Identify the fuzz target */ 189 fuzz_target = fuzz_get_target(target_name); 190 if (!fuzz_target) { 191 usage(**argv); 192 } 193 194 fuzz_qts = qtest_setup(); 195 196 if (fuzz_target->pre_vm_init) { 197 fuzz_target->pre_vm_init(); 198 } 199 200 /* Run QEMU's softmmu main with the fuzz-target dependent arguments */ 201 const char *init_cmdline = fuzz_target->get_init_cmdline(fuzz_target); 202 init_cmdline = g_strdup_printf("%s -qtest /dev/null -qtest-log %s", 203 init_cmdline, 204 getenv("QTEST_LOG") ? "/dev/fd/2" 205 : "/dev/null"); 206 207 208 /* Split the runcmd into an argv and argc */ 209 wordexp_t result; 210 wordexp(init_cmdline, &result, 0); 211 212 qemu_init(result.we_wordc, result.we_wordv, NULL); 213 214 return 0; 215 } 216