1 /* 2 * fuzzing driver 3 * 4 * Copyright Red Hat Inc., 2019 5 * 6 * Authors: 7 * Alexander Bulekov <alxndr@bu.edu> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 */ 13 14 #include "qemu/osdep.h" 15 16 #include <wordexp.h> 17 18 #include "qemu/cutils.h" 19 #include "qemu/datadir.h" 20 #include "system/system.h" 21 #include "system/qtest.h" 22 #include "system/runstate.h" 23 #include "qemu/main-loop.h" 24 #include "qemu/rcu.h" 25 #include "tests/qtest/libqtest.h" 26 #include "tests/qtest/libqos/qgraph.h" 27 #include "fuzz.h" 28 29 #define MAX_EVENT_LOOPS 10 30 31 typedef struct FuzzTargetState { 32 FuzzTarget *target; 33 QSLIST_ENTRY(FuzzTargetState) target_list; 34 } FuzzTargetState; 35 36 typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList; 37 38 static const char *fuzz_arch = TARGET_NAME; 39 40 static FuzzTargetList *fuzz_target_list; 41 static FuzzTarget *fuzz_target; 42 static QTestState *fuzz_qts; 43 44 int (*qemu_main)(void); 45 46 47 void flush_events(QTestState *s) 48 { 49 int i = MAX_EVENT_LOOPS; 50 while (g_main_context_pending(NULL) && i-- > 0) { 51 main_loop_wait(false); 52 } 53 } 54 55 void fuzz_reset(QTestState *s) 56 { 57 qemu_system_reset(SHUTDOWN_CAUSE_GUEST_RESET); 58 main_loop_wait(true); 59 } 60 61 static QTestState *qtest_setup(void) 62 { 63 qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts); 64 return qtest_inproc_init(&fuzz_qts, false, fuzz_arch, 65 &qtest_server_inproc_recv); 66 } 67 68 void fuzz_add_target(const FuzzTarget *target) 69 { 70 FuzzTargetState *tmp; 71 FuzzTargetState *target_state; 72 if (!fuzz_target_list) { 73 fuzz_target_list = g_new0(FuzzTargetList, 1); 74 } 75 76 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { 77 if (g_strcmp0(tmp->target->name, target->name) == 0) { 78 fprintf(stderr, "Error: Fuzz target name %s already in use\n", 79 target->name); 80 abort(); 81 } 82 } 83 target_state = g_new0(FuzzTargetState, 1); 84 target_state->target = g_new0(FuzzTarget, 1); 85 *(target_state->target) = *target; 86 QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list); 87 } 88 89 90 91 static void usage(char *path) 92 { 93 printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path); 94 printf("where FUZZ_TARGET is one of:\n"); 95 FuzzTargetState *tmp; 96 if (!fuzz_target_list) { 97 fprintf(stderr, "Fuzz target list not initialized\n"); 98 abort(); 99 } 100 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { 101 printf(" * %s : %s\n", tmp->target->name, 102 tmp->target->description); 103 } 104 printf("Alternatively, add -target-FUZZ_TARGET to the executable name\n\n" 105 "Set the environment variable FUZZ_SERIALIZE_QTEST=1 to serialize\n" 106 "QTest commands into an ASCII protocol. Useful for building crash\n" 107 "reproducers, but slows down execution.\n\n" 108 "Set the environment variable QTEST_LOG=1 to log all qtest commands" 109 "\n"); 110 exit(0); 111 } 112 113 static FuzzTarget *fuzz_get_target(char* name) 114 { 115 FuzzTargetState *tmp; 116 if (!fuzz_target_list) { 117 fprintf(stderr, "Fuzz target list not initialized\n"); 118 abort(); 119 } 120 121 QSLIST_FOREACH(tmp, fuzz_target_list, target_list) { 122 if (strcmp(tmp->target->name, name) == 0) { 123 return tmp->target; 124 } 125 } 126 return NULL; 127 } 128 129 130 /* Sometimes called by libfuzzer to mutate two inputs into one */ 131 size_t LLVMFuzzerCustomCrossOver(const uint8_t *data1, size_t size1, 132 const uint8_t *data2, size_t size2, 133 uint8_t *out, size_t max_out_size, 134 unsigned int seed) 135 { 136 if (fuzz_target->crossover) { 137 return fuzz_target->crossover(data1, size1, data2, size2, out, 138 max_out_size, seed); 139 } 140 return 0; 141 } 142 143 /* Executed for each fuzzing-input */ 144 int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size) 145 { 146 /* 147 * Do the pre-fuzz-initialization before the first fuzzing iteration, 148 * instead of before the actual fuzz loop. This is needed since libfuzzer 149 * may fork off additional workers, prior to the fuzzing loop, and if 150 * pre_fuzz() sets up e.g. shared memory, this should be done for the 151 * individual worker processes 152 */ 153 static int pre_fuzz_done; 154 if (!pre_fuzz_done && fuzz_target->pre_fuzz) { 155 fuzz_target->pre_fuzz(fuzz_qts); 156 pre_fuzz_done = true; 157 } 158 159 fuzz_target->fuzz(fuzz_qts, Data, Size); 160 return 0; 161 } 162 163 /* Executed once, prior to fuzzing */ 164 int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp) 165 { 166 167 char *target_name; 168 GString *cmd_line; 169 gchar *pretty_cmd_line; 170 bool serialize = false; 171 172 /* Initialize qgraph and modules */ 173 qos_graph_init(); 174 module_call_init(MODULE_INIT_FUZZ_TARGET); 175 module_call_init(MODULE_INIT_QOM); 176 module_call_init(MODULE_INIT_LIBQOS); 177 178 qemu_init_exec_dir(**argv); 179 target_name = strstr(**argv, "-target-"); 180 if (target_name) { /* The binary name specifies the target */ 181 target_name += strlen("-target-"); 182 } else if (*argc > 1) { /* The target is specified as an argument */ 183 target_name = (*argv)[1]; 184 if (!strstr(target_name, "--fuzz-target=")) { 185 usage(**argv); 186 } 187 target_name += strlen("--fuzz-target="); 188 } else { 189 usage(**argv); 190 } 191 192 /* Should we always serialize qtest commands? */ 193 if (getenv("FUZZ_SERIALIZE_QTEST")) { 194 serialize = true; 195 } 196 197 fuzz_qtest_set_serialize(serialize); 198 199 /* Identify the fuzz target */ 200 fuzz_target = fuzz_get_target(target_name); 201 if (!fuzz_target) { 202 usage(**argv); 203 } 204 205 fuzz_qts = qtest_setup(); 206 207 if (fuzz_target->pre_vm_init) { 208 fuzz_target->pre_vm_init(); 209 } 210 211 /* Run QEMU's system main with the fuzz-target dependent arguments */ 212 cmd_line = fuzz_target->get_init_cmdline(fuzz_target); 213 g_string_append_printf(cmd_line, " %s -qtest /dev/null ", 214 getenv("QTEST_LOG") ? "" : "-qtest-log none"); 215 216 /* Split the runcmd into an argv and argc */ 217 wordexp_t result; 218 wordexp(cmd_line->str, &result, 0); 219 g_string_free(cmd_line, true); 220 221 if (getenv("QTEST_LOG")) { 222 pretty_cmd_line = g_strjoinv(" ", result.we_wordv + 1); 223 printf("Starting %s with Arguments: %s\n", 224 result.we_wordv[0], pretty_cmd_line); 225 g_free(pretty_cmd_line); 226 } 227 228 qemu_init(result.we_wordc, result.we_wordv); 229 230 /* re-enable the rcu atfork, which was previously disabled in qemu_init */ 231 rcu_enable_atfork(); 232 233 /* 234 * Disable QEMU's signal handlers, since we manually control the main_loop, 235 * and don't check for main_loop_should_exit 236 */ 237 signal(SIGINT, SIG_DFL); 238 signal(SIGHUP, SIG_DFL); 239 signal(SIGTERM, SIG_DFL); 240 241 return 0; 242 } 243