1 /*
2 * fuzzing driver
3 *
4 * Copyright Red Hat Inc., 2019
5 *
6 * Authors:
7 * Alexander Bulekov <alxndr@bu.edu>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
11 *
12 */
13
14 #include "qemu/osdep.h"
15
16 #include <wordexp.h>
17
18 #include "qemu/cutils.h"
19 #include "qemu/datadir.h"
20 #include "system/system.h"
21 #include "system/qtest.h"
22 #include "system/runstate.h"
23 #include "qemu/main-loop.h"
24 #include "qemu/rcu.h"
25 #include "tests/qtest/libqtest.h"
26 #include "tests/qtest/libqos/qgraph.h"
27 #include "fuzz.h"
28
29 #define MAX_EVENT_LOOPS 10
30
31 typedef struct FuzzTargetState {
32 FuzzTarget *target;
33 QSLIST_ENTRY(FuzzTargetState) target_list;
34 } FuzzTargetState;
35
36 typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList;
37
38 static const char *fuzz_arch = TARGET_NAME;
39
40 static FuzzTargetList *fuzz_target_list;
41 static FuzzTarget *fuzz_target;
42 static QTestState *fuzz_qts;
43
44 int (*qemu_main)(void);
45
46
flush_events(QTestState * s)47 void flush_events(QTestState *s)
48 {
49 int i = MAX_EVENT_LOOPS;
50 while (g_main_context_pending(NULL) && i-- > 0) {
51 main_loop_wait(false);
52 }
53 }
54
fuzz_reset(QTestState * s)55 void fuzz_reset(QTestState *s)
56 {
57 qemu_system_reset(SHUTDOWN_CAUSE_GUEST_RESET);
58 main_loop_wait(true);
59 }
60
qtest_setup(void)61 static QTestState *qtest_setup(void)
62 {
63 qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts);
64 return qtest_inproc_init(&fuzz_qts, false, fuzz_arch,
65 &qtest_server_inproc_recv);
66 }
67
fuzz_add_target(const FuzzTarget * target)68 void fuzz_add_target(const FuzzTarget *target)
69 {
70 FuzzTargetState *tmp;
71 FuzzTargetState *target_state;
72 if (!fuzz_target_list) {
73 fuzz_target_list = g_new0(FuzzTargetList, 1);
74 }
75
76 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
77 if (g_strcmp0(tmp->target->name, target->name) == 0) {
78 fprintf(stderr, "Error: Fuzz target name %s already in use\n",
79 target->name);
80 abort();
81 }
82 }
83 target_state = g_new0(FuzzTargetState, 1);
84 target_state->target = g_new0(FuzzTarget, 1);
85 *(target_state->target) = *target;
86 QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list);
87 }
88
89
90
usage(char * path)91 static void usage(char *path)
92 {
93 printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path);
94 printf("where FUZZ_TARGET is one of:\n");
95 FuzzTargetState *tmp;
96 if (!fuzz_target_list) {
97 fprintf(stderr, "Fuzz target list not initialized\n");
98 abort();
99 }
100 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
101 printf(" * %s : %s\n", tmp->target->name,
102 tmp->target->description);
103 }
104 printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n\n"
105 "Set the environment variable FUZZ_SERIALIZE_QTEST=1 to serialize\n"
106 "QTest commands into an ASCII protocol. Useful for building crash\n"
107 "reproducers, but slows down execution.\n\n"
108 "Set the environment variable QTEST_LOG=1 to log all qtest commands"
109 "\n");
110 exit(0);
111 }
112
fuzz_get_target(char * name)113 static FuzzTarget *fuzz_get_target(char* name)
114 {
115 FuzzTargetState *tmp;
116 if (!fuzz_target_list) {
117 fprintf(stderr, "Fuzz target list not initialized\n");
118 abort();
119 }
120
121 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
122 if (strcmp(tmp->target->name, name) == 0) {
123 return tmp->target;
124 }
125 }
126 return NULL;
127 }
128
129
130 /* Sometimes called by libfuzzer to mutate two inputs into one */
LLVMFuzzerCustomCrossOver(const uint8_t * data1,size_t size1,const uint8_t * data2,size_t size2,uint8_t * out,size_t max_out_size,unsigned int seed)131 size_t LLVMFuzzerCustomCrossOver(const uint8_t *data1, size_t size1,
132 const uint8_t *data2, size_t size2,
133 uint8_t *out, size_t max_out_size,
134 unsigned int seed)
135 {
136 if (fuzz_target->crossover) {
137 return fuzz_target->crossover(data1, size1, data2, size2, out,
138 max_out_size, seed);
139 }
140 return 0;
141 }
142
143 /* Executed for each fuzzing-input */
LLVMFuzzerTestOneInput(const unsigned char * Data,size_t Size)144 int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size)
145 {
146 /*
147 * Do the pre-fuzz-initialization before the first fuzzing iteration,
148 * instead of before the actual fuzz loop. This is needed since libfuzzer
149 * may fork off additional workers, prior to the fuzzing loop, and if
150 * pre_fuzz() sets up e.g. shared memory, this should be done for the
151 * individual worker processes
152 */
153 static int pre_fuzz_done;
154 if (!pre_fuzz_done && fuzz_target->pre_fuzz) {
155 fuzz_target->pre_fuzz(fuzz_qts);
156 pre_fuzz_done = true;
157 }
158
159 fuzz_target->fuzz(fuzz_qts, Data, Size);
160 return 0;
161 }
162
163 /* Executed once, prior to fuzzing */
LLVMFuzzerInitialize(int * argc,char *** argv,char *** envp)164 int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
165 {
166
167 char *target_name;
168 GString *cmd_line;
169 gchar *pretty_cmd_line;
170 bool serialize = false;
171
172 /* Initialize qgraph and modules */
173 qos_graph_init();
174 module_call_init(MODULE_INIT_FUZZ_TARGET);
175 module_call_init(MODULE_INIT_QOM);
176 module_call_init(MODULE_INIT_LIBQOS);
177
178 qemu_init_exec_dir(**argv);
179 target_name = strstr(**argv, "-target-");
180 if (target_name) { /* The binary name specifies the target */
181 target_name += strlen("-target-");
182 } else if (*argc > 1) { /* The target is specified as an argument */
183 target_name = (*argv)[1];
184 if (!strstr(target_name, "--fuzz-target=")) {
185 usage(**argv);
186 }
187 target_name += strlen("--fuzz-target=");
188 } else {
189 usage(**argv);
190 }
191
192 /* Should we always serialize qtest commands? */
193 if (getenv("FUZZ_SERIALIZE_QTEST")) {
194 serialize = true;
195 }
196
197 fuzz_qtest_set_serialize(serialize);
198
199 /* Identify the fuzz target */
200 fuzz_target = fuzz_get_target(target_name);
201 if (!fuzz_target) {
202 usage(**argv);
203 }
204
205 fuzz_qts = qtest_setup();
206
207 if (fuzz_target->pre_vm_init) {
208 fuzz_target->pre_vm_init();
209 }
210
211 /* Run QEMU's system main with the fuzz-target dependent arguments */
212 cmd_line = fuzz_target->get_init_cmdline(fuzz_target);
213 g_string_append_printf(cmd_line, " %s -qtest /dev/null ",
214 getenv("QTEST_LOG") ? "" : "-qtest-log none");
215
216 /* Split the runcmd into an argv and argc */
217 wordexp_t result;
218 wordexp(cmd_line->str, &result, 0);
219 g_string_free(cmd_line, true);
220
221 if (getenv("QTEST_LOG")) {
222 pretty_cmd_line = g_strjoinv(" ", result.we_wordv + 1);
223 printf("Starting %s with Arguments: %s\n",
224 result.we_wordv[0], pretty_cmd_line);
225 g_free(pretty_cmd_line);
226 }
227
228 qemu_init(result.we_wordc, result.we_wordv);
229
230 /* re-enable the rcu atfork, which was previously disabled in qemu_init */
231 rcu_enable_atfork();
232
233 /*
234 * Disable QEMU's signal handlers, since we manually control the main_loop,
235 * and don't check for main_loop_should_exit
236 */
237 signal(SIGINT, SIG_DFL);
238 signal(SIGHUP, SIG_DFL);
239 signal(SIGTERM, SIG_DFL);
240
241 return 0;
242 }
243