1 /* 2 * fuzzing driver 3 * 4 * Copyright Red Hat Inc., 2019 5 * 6 * Authors: 7 * Alexander Bulekov <alxndr@bu.edu> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 */ 13 14 #include "qemu/osdep.h" 15 16 #include <wordexp.h> 17 18 #include "sysemu/qtest.h" 19 #include "sysemu/runstate.h" 20 #include "sysemu/sysemu.h" 21 #include "qemu/main-loop.h" 22 #include "tests/qtest/libqtest.h" 23 #include "tests/qtest/libqos/qgraph.h" 24 #include "fuzz.h" 25 26 #define MAX_EVENT_LOOPS 10 27 28 typedef struct FuzzTargetState { 29 FuzzTarget *target; 30 QSLIST_ENTRY(FuzzTargetState) target_list; 31 } FuzzTargetState; 32 33 typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList; 34 35 static const char *fuzz_arch = TARGET_NAME; 36 37 static FuzzTargetList *fuzz_target_list; 38 static FuzzTarget *fuzz_target; 39 static QTestState *fuzz_qts; 40 41 42 43 void flush_events(QTestState *s) 44 { 45 int i = MAX_EVENT_LOOPS; 46 while (g_main_context_pending(NULL) && i-- > 0) { 47 main_loop_wait(false); 48 } 49 } 50 51 static QTestState *qtest_setup(void) 52 { 53 qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts); 54 return qtest_inproc_init(&fuzz_qts, false, fuzz_arch, 55 &qtest_server_inproc_recv); 56 } 57 58 void fuzz_add_target(const FuzzTarget *target) 59 { 60 FuzzTargetState *tmp; 61 FuzzTargetState *target_state; 62 if (!fuzz_target_list) { 63 fuzz_target_list = g_new0(FuzzTargetList, 1); 64 } 65 66 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { 67 if (g_strcmp0(tmp->target->name, target->name) == 0) { 68 fprintf(stderr, "Error: Fuzz target name %s already in use\n", 69 target->name); 70 abort(); 71 } 72 } 73 target_state = g_new0(FuzzTargetState, 1); 74 target_state->target = g_new0(FuzzTarget, 1); 75 *(target_state->target) = *target; 76 QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list); 77 } 78 79 80 81 static void usage(char *path) 82 { 83 printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path); 84 printf("where FUZZ_TARGET is one of:\n"); 85 FuzzTargetState *tmp; 86 if (!fuzz_target_list) { 87 fprintf(stderr, "Fuzz target list not initialized\n"); 88 abort(); 89 } 90 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { 91 printf(" * %s : %s\n", tmp->target->name, 92 tmp->target->description); 93 } 94 printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n"); 95 exit(0); 96 } 97 98 static FuzzTarget *fuzz_get_target(char* name) 99 { 100 FuzzTargetState *tmp; 101 if (!fuzz_target_list) { 102 fprintf(stderr, "Fuzz target list not initialized\n"); 103 abort(); 104 } 105 106 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { 107 if (strcmp(tmp->target->name, name) == 0) { 108 return tmp->target; 109 } 110 } 111 return NULL; 112 } 113 114 115 /* Executed for each fuzzing-input */ 116 int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) 117 { 118 /* 119 * Do the pre-fuzz-initialization before the first fuzzing iteration, 120 * instead of before the actual fuzz loop. This is needed since libfuzzer 121 * may fork off additional workers, prior to the fuzzing loop, and if 122 * pre_fuzz() sets up e.g. shared memory, this should be done for the 123 * individual worker processes 124 */ 125 static int pre_fuzz_done; 126 if (!pre_fuzz_done && fuzz_target->pre_fuzz) { 127 fuzz_target->pre_fuzz(fuzz_qts); 128 pre_fuzz_done = true; 129 } 130 131 fuzz_target->fuzz(fuzz_qts, Data, Size); 132 return 0; 133 } 134 135 /* Executed once, prior to fuzzing */ 136 int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) 137 { 138 139 char *target_name; 140 char *dir; 141 142 /* Initialize qgraph and modules */ 143 qos_graph_init(); 144 module_call_init(MODULE_INIT_FUZZ_TARGET); 145 module_call_init(MODULE_INIT_QOM); 146 module_call_init(MODULE_INIT_LIBQOS); 147 148 target_name = strstr(**argv, "-target-"); 149 if (target_name) { /* The binary name specifies the target */ 150 target_name += strlen("-target-"); 151 /* 152 * With oss-fuzz, the executable is kept in the root of a directory (we 153 * cannot assume the path). All data (including bios binaries) must be 154 * in the same dir, or a subdir. Thus, we cannot place the pc-bios so 155 * that it would be in exec_dir/../pc-bios. 156 * As a workaround, oss-fuzz allows us to use argv[0] to get the 157 * location of the executable. Using this we add exec_dir/pc-bios to 158 * the datadirs. 159 */ 160 dir = g_build_filename(g_path_get_dirname(**argv), "pc-bios", NULL); 161 if (g_file_test(dir, G_FILE_TEST_IS_DIR)) { 162 qemu_add_data_dir(dir); 163 } 164 g_free(dir); 165 } else if (*argc > 1) { /* The target is specified as an argument */ 166 target_name = (*argv)[1]; 167 if (!strstr(target_name, "--fuzz-target=")) { 168 usage(**argv); 169 } 170 target_name += strlen("--fuzz-target="); 171 } else { 172 usage(**argv); 173 } 174 175 /* Identify the fuzz target */ 176 fuzz_target = fuzz_get_target(target_name); 177 if (!fuzz_target) { 178 usage(**argv); 179 } 180 181 fuzz_qts = qtest_setup(); 182 183 if (fuzz_target->pre_vm_init) { 184 fuzz_target->pre_vm_init(); 185 } 186 187 /* Run QEMU's softmmu main with the fuzz-target dependent arguments */ 188 const char *init_cmdline = fuzz_target->get_init_cmdline(fuzz_target); 189 190 /* Split the runcmd into an argv and argc */ 191 wordexp_t result; 192 wordexp(init_cmdline, &result, 0); 193 194 qemu_init(result.we_wordc, result.we_wordv, NULL); 195 196 return 0; 197 } 198