From 3745ef39230488789b16ff01864d7d2ffeab5a52 Mon Sep 17 00:00:00 2001 From: Krzysztof Kosiński Date: Wed, 27 Jul 2022 23:42:36 +0000 Subject: Revert "Revert "Enhance fuzzer coverage."" This reverts commit 6fc375c2ede03c29db3b41740d3e42d679b8ccbe. Reason for revert: ag/19446272 added the dependency to the PDK manifest group, so this change should no longer break PDKs. Original change: ag/19379107 Bug: 239630493 Change-Id: Ie446995a28ea458b674c2e2b49b355dad8dac470 --- fuzzing/Android.bp | 21 +++++- fuzzing/corpus/hardy-octopus | Bin 0 -> 1171 bytes fuzzing/corpus/meson-g12a-sei510-android.dtb | Bin 0 -> 1363 bytes fuzzing/libfdt_fuzzer.c | 98 +++++++++++++++++++++++++-- 4 files changed, 112 insertions(+), 7 deletions(-) create mode 100644 fuzzing/corpus/hardy-octopus create mode 100644 fuzzing/corpus/meson-g12a-sei510-android.dtb (limited to 'fuzzing') diff --git a/fuzzing/Android.bp b/fuzzing/Android.bp index 09b1f4a..da1bfa6 100644 --- a/fuzzing/Android.bp +++ b/fuzzing/Android.bp @@ -11,10 +11,29 @@ cc_fuzz { static_libs: [ "libfdt", ], - host_supported: true, + corpus: ["corpus/*"], fuzz_config: { cc: [ "ptosi@google.com", ], }, + host_supported: true, +} + + +cc_afl_fuzz { + name: "afl_libfdt_fuzzer", + srcs: [ + "libfdt_fuzzer.c", + ], + static_libs: [ + "libfdt", + ], + corpus: ["corpus/*"], + fuzz_config: { + cc: [ + "mikemcternan@google.com", + ], + }, + host_supported: true, } diff --git a/fuzzing/corpus/hardy-octopus b/fuzzing/corpus/hardy-octopus new file mode 100644 index 0000000..81615e9 Binary files /dev/null and b/fuzzing/corpus/hardy-octopus differ diff --git a/fuzzing/corpus/meson-g12a-sei510-android.dtb b/fuzzing/corpus/meson-g12a-sei510-android.dtb new file mode 100644 index 0000000..317175d Binary files /dev/null and b/fuzzing/corpus/meson-g12a-sei510-android.dtb differ diff --git a/fuzzing/libfdt_fuzzer.c b/fuzzing/libfdt_fuzzer.c index 227e711..b433bbc 100644 --- a/fuzzing/libfdt_fuzzer.c +++ b/fuzzing/libfdt_fuzzer.c @@ -1,18 +1,77 @@ +/* + * Copyright (C) 2022 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/* Ensure assert() catches logical errors during fuzzing */ +#ifdef NDEBUG +#undef NDEBUG +#endif + +#include #include +#include #include #include #include +#include + +#include +#include #include "libfdt.h" #include "libfdt_env.h" -void walk_device_tree(const void *device_tree, int parent_node) { +/* check memory region is valid, for the purpose of tooling such as asan */ +static void check_mem(const void *mem, size_t len) { + + assert(mem); + +#if __has_feature(memory_sanitizer) + /* dumps if check fails */ + __msan_check_mem_is_initialized((void *)mem, len); +#endif + +#if __has_feature(address_sanitizer) || defined(__SANITIZE_ADDRESS__) + assert(!__asan_region_is_poisoned((void *)mem, len)); +#else + const volatile uint8_t *mem8 = mem; + + /* Read each byte of memory for instrumentation */ + for(size_t i = 0; i < len; i++) { + (void)mem8[i]; + } +#endif +} + + +static void walk_node_properties(const void *device_tree, int node) { + int property, len = 0; + + fdt_for_each_property_offset(property, device_tree, node) { + const struct fdt_property *prop = fdt_get_property_by_offset(device_tree, + property, &len); + check_mem(prop->data, fdt32_to_cpu(prop->len)); + } +} + + +static void walk_device_tree(const void *device_tree, int parent_node) { int len = 0; const char *node_name = fdt_get_name(device_tree, parent_node, &len); if (node_name != NULL) { - // avoid clang complaining about unused variable node_name and force - // ASan to validate string pointer in strlen call. - assert(strlen(node_name) == len); + check_mem(node_name, len); } uint32_t phandle = fdt_get_phandle(device_tree, parent_node); @@ -20,6 +79,8 @@ void walk_device_tree(const void *device_tree, int parent_node) { assert(parent_node == fdt_node_offset_by_phandle(device_tree, phandle)); } + walk_node_properties(device_tree, parent_node); + // recursively walk the node's children for (int node = fdt_first_subnode(device_tree, parent_node); node >= 0; node = fdt_next_subnode(device_tree, node)) { @@ -27,6 +88,7 @@ void walk_device_tree(const void *device_tree, int parent_node) { } } + // Information on device tree is available in external/dtc/Documentation/ // folder. int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { @@ -35,8 +97,32 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { if (fdt_check_full(data, size) != 0) return 0; - int root_node_offset = 0; - walk_device_tree(data, root_node_offset); + walk_device_tree(data, /* parent_node */ 0); return 0; } + +#ifdef AFL_STANDALONE +/* Entry point suitable for direct afl-fuzz invocation */ +int main(int argc, char *argv[]) { + uint8_t data[1024 * 1024]; + + if (argc != 2) { + fprintf(stderr, "missing argument\n"); + return EXIT_FAILURE; + } + + FILE *f = fopen(argv[1], "r"); + if (!f) { + perror("fopen() failed"); + return EXIT_FAILURE; + } + + size_t size = fread(data, 1, sizeof(data), f); + + fclose(f); + + return LLVMFuzzerTestOneInput(data, size); +} +#endif + -- cgit v1.2.3-59-g8ed1b