tests/qtest/fuzz/fuzz.c

   1 /*
   2  * fuzzing driver
   3  *
   4  * Copyright Red Hat Inc., 2019
   5  *
   6  * Authors:
   7  *  Alexander Bulekov   <alxndr@bu.edu>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  10  * See the COPYING file in the top-level directory.
  11  *
  12  */
  13
  14 #include "qemu/osdep.h"
  15
  16 #include <wordexp.h>
  17
  18 #include "sysemu/qtest.h"
  19 #include "sysemu/runstate.h"
  20 #include "sysemu/sysemu.h"
  21 #include "qemu/main-loop.h"
  22 #include "tests/qtest/libqtest.h"
  23 #include "tests/qtest/libqos/qgraph.h"
  24 #include "fuzz.h"
  25
  26 #define MAX_EVENT_LOOPS 10
  27
  28 typedef struct FuzzTargetState {
  29         FuzzTarget *target;
  30         QSLIST_ENTRY(FuzzTargetState) target_list;
  31 } FuzzTargetState;
  32
  33 typedef QSLIST_HEAD(, FuzzTargetState) FuzzTargetList;
  34
  35 static const char *fuzz_arch = TARGET_NAME;
  36
  37 static FuzzTargetList *fuzz_target_list;
  38 static FuzzTarget *fuzz_target;
  39 static QTestState *fuzz_qts;
  40
  41
  42
  43 void flush_events(QTestState *s)
  44 {
  45     int i = MAX_EVENT_LOOPS;
  46     while (g_main_context_pending(NULL) && i-- > 0) {
  47         main_loop_wait(false);
  48     }
  49 }
  50
  51 static QTestState *qtest_setup(void)
  52 {
  53     qtest_server_set_send_handler(&qtest_client_inproc_recv, &fuzz_qts);
  54     return qtest_inproc_init(&fuzz_qts, false, fuzz_arch,
  55             &qtest_server_inproc_recv);
  56 }
  57
  58 void fuzz_add_target(const FuzzTarget *target)
  59 {
  60     FuzzTargetState *tmp;
  61     FuzzTargetState *target_state;
  62     if (!fuzz_target_list) {
  63         fuzz_target_list = g_new0(FuzzTargetList, 1);
  64     }
  65
  66     QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
  67         if (g_strcmp0(tmp->target->name, target->name) == 0) {
  68             fprintf(stderr, "Error: Fuzz target name %s already in use\n",
  69                     target->name);
  70             abort();
  71         }
  72     }
  73     target_state = g_new0(FuzzTargetState, 1);
  74     target_state->target = g_new0(FuzzTarget, 1);
  75     *(target_state->target) = *target;
  76     QSLIST_INSERT_HEAD(fuzz_target_list, target_state, target_list);
  77 }
  78
  79
  80
  81 static void usage(char *path)
  82 {
  83     printf("Usage: %s --fuzz-target=FUZZ_TARGET [LIBFUZZER ARGUMENTS]\n", path);
  84     printf("where FUZZ_TARGET is one of:\n");
  85     FuzzTargetState *tmp;
  86     if (!fuzz_target_list) {
  87         fprintf(stderr, "Fuzz target list not initialized\n");
  88         abort();
  89     }
  90     QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
  91         printf(" * %s  : %s\n", tmp->target->name,
  92                 tmp->target->description);
  93     }
  94     exit(0);
  95 }
  96
  97 static FuzzTarget *fuzz_get_target(char* name)
  98 {
  99     FuzzTargetState *tmp;
 100     if (!fuzz_target_list) {
 101         fprintf(stderr, "Fuzz target list not initialized\n");
 102         abort();
 103     }
 104
 105     QSLIST_FOREACH(tmp, fuzz_target_list, target_list) {
 106         if (strcmp(tmp->target->name, name) == 0) {
 107             return tmp->target;
 108         }
 109     }
 110     return NULL;
 111 }
 112
 113
 114 /* Executed for each fuzzing-input */
 115 int LLVMFuzzerTestOneInput(const unsigned char *Data, size_t Size)
 116 {
 117     /*
 118      * Do the pre-fuzz-initialization before the first fuzzing iteration,
 119      * instead of before the actual fuzz loop. This is needed since libfuzzer
 120      * may fork off additional workers, prior to the fuzzing loop, and if
 121      * pre_fuzz() sets up e.g. shared memory, this should be done for the
 122      * individual worker processes
 123      */
 124     static int pre_fuzz_done;
 125     if (!pre_fuzz_done && fuzz_target->pre_fuzz) {
 126         fuzz_target->pre_fuzz(fuzz_qts);
 127         pre_fuzz_done = true;
 128     }
 129
 130     fuzz_target->fuzz(fuzz_qts, Data, Size);
 131     return 0;
 132 }
 133
 134 /* Executed once, prior to fuzzing */
 135 int LLVMFuzzerInitialize(int *argc, char ***argv, char ***envp)
 136 {
 137
 138     char *target_name;
 139
 140     /* Initialize qgraph and modules */
 141     qos_graph_init();
 142     module_call_init(MODULE_INIT_FUZZ_TARGET);
 143     module_call_init(MODULE_INIT_QOM);
 144     module_call_init(MODULE_INIT_LIBQOS);
 145
 146     if (*argc <= 1) {
 147         usage(**argv);
 148     }
 149
 150     /* Identify the fuzz target */
 151     target_name = (*argv)[1];
 152     if (!strstr(target_name, "--fuzz-target=")) {
 153         usage(**argv);
 154     }
 155
 156     target_name += strlen("--fuzz-target=");
 157
 158     fuzz_target = fuzz_get_target(target_name);
 159     if (!fuzz_target) {
 160         usage(**argv);
 161     }
 162
 163     fuzz_qts = qtest_setup();
 164
 165     if (fuzz_target->pre_vm_init) {
 166         fuzz_target->pre_vm_init();
 167     }
 168
 169     /* Run QEMU's softmmu main with the fuzz-target dependent arguments */
 170     const char *init_cmdline = fuzz_target->get_init_cmdline(fuzz_target);
 171
 172     /* Split the runcmd into an argv and argc */
 173     wordexp_t result;
 174     wordexp(init_cmdline, &result, 0);
 175
 176     qemu_init(result.we_wordc, result.we_wordv, NULL);
 177
 178     return 0;
 179 }