From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4E960C433FE for ; Thu, 14 Apr 2022 14:02:02 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 5911D83EF7; Thu, 14 Apr 2022 16:00:45 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b="oXQWYNm8"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 2237D83EA1; Thu, 14 Apr 2022 16:00:18 +0200 (CEST) Received: from mail-wm1-x34a.google.com (mail-wm1-x34a.google.com [IPv6:2a00:1450:4864:20::34a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id A935283EC5 for ; Thu, 14 Apr 2022 16:00:04 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=34yhYYgYKBq4OgQiZZUccUZS.Qcai-PcchZWghg.RSbl.RS@flex--ascull.bounces.google.com Received: by mail-wm1-x34a.google.com with SMTP id c125-20020a1c3583000000b0038e3f6e871aso2476394wma.8 for ; Thu, 14 Apr 2022 07:00:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=57TVTbHiuigkH3REUBpZdVhz6FbuAc3CWnWdHf3GwWo=; b=oXQWYNm8RT168WuNYmnicR5XwgfPXx89gs8DMnwpSxOr9cK8cLGPdErSBxh3iBUqKa 2Hym4dNF7xxCMbSJTjIzOVPtFxmn272a9lOycaV7mGHHxNTBrKZWkfYQ1pSQydw5xHPg 9SOLQj3vtBfXUVYW3kZcg+XPSfs8wGWdcCyEg0I0EAvxDyV76I+K+IXkTb6Sp/z+xvd4 O0ArFrqKRDvTk+9U20i09eToxYsRTKH347Oe4aKuuE4+du573TpzfkQj978KPu2uDNoY 5g+f0rlFEDHU7+NIQIOl3zoi+nuZWq7GUWibsVwOLEdQIipRMJXCOA1SJGs7lt01SG5O UKeA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=57TVTbHiuigkH3REUBpZdVhz6FbuAc3CWnWdHf3GwWo=; b=A2lNfzVD39YhBVJVZ/XjU8vUOZvt4RrpkHyZhi6nJUB9rfCggDp9MsNX21Okdzn8rA VlYjjDUXwZrZHfO2G5fiEF2owqj9pgW2/TU7KoeTQMuxcmCNYqxvg23Npf+QBHCIvtD2 WaopZNBX0qPTR997AL7ktaDhGi9lzrkv2vxMqrSz3F6pTz+rFNEVvzpIxG4qVYu5h2c0 jU/zCD3/sITTYbcJ75Z+pL7uk81ynq8pu0RP7UqUiNWqdwT3TocUlgVNR6qTJO094AE8 NJprC3oMhcbDmNJFzyJaqzCzf6cLlMwyg3na6eOFHbeotKghX63kvwr0aKhbd144yRbk Qh8A== X-Gm-Message-State: AOAM53280E+wuYqAoRRzmgMbFbl9KBjDr/925IAo3FKB8HLW03UfemOD O3KQgBYei0WQvALyLB1or+erZ/lcbtUkz/Q/59pa2N00WKDfjS1vtB5wBdBviY2gkdMINKAasJi Y+88p3zLyb551yI4Y2QIQtV+VZjbRfoL5aRVpZ9RuGf+7DAoiW0mA9IQTuhA= X-Google-Smtp-Source: ABdhPJzSHiQ5qUJZTkzkE2uB715T3ezyT5rnAYObsb9jr3ndpg/afyFPnNrmNu4A8WYk0LsgHmyBN3bVZkI= X-Received: from ascull.c.googlers.com ([fda3:e722:ac3:cc00:28:9cb1:c0a8:1510]) (user=ascull job=sendgmr) by 2002:a1c:35c7:0:b0:38e:4c59:6788 with SMTP id c190-20020a1c35c7000000b0038e4c596788mr14700wma.1.1649944803584; Thu, 14 Apr 2022 07:00:03 -0700 (PDT) Date: Thu, 14 Apr 2022 13:59:38 +0000 In-Reply-To: <20220414135941.1732585-1-ascull@google.com> Message-Id: <20220414135941.1732585-10-ascull@google.com> Mime-Version: 1.0 References: <20220414135941.1732585-1-ascull@google.com> X-Mailer: git-send-email 2.35.1.1178.g4f1659d476-goog Subject: [PATCH v2 09/12] sandbox: Add libfuzzer integration From: Andrew Scull To: u-boot@lists.denx.de Cc: sjg@chromium.org, xypron.glpk@gmx.de, Andrew Scull Content-Type: text/plain; charset="UTF-8" X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean Add an implementation of LLVMFuzzerTestOneInput() that starts the sandbox on a secondary thread and exposes a function to synchronize the generation of fuzzing inputs with their consumption by the sandbox. Signed-off-by: Andrew Scull Reviewed-by: Simon Glass --- arch/sandbox/config.mk | 3 + arch/sandbox/cpu/os.c | 70 +++++++++++++++++++++++ arch/sandbox/include/asm/fuzzing_engine.h | 25 ++++++++ 3 files changed, 98 insertions(+) create mode 100644 arch/sandbox/include/asm/fuzzing_engine.h diff --git a/arch/sandbox/config.mk b/arch/sandbox/config.mk index d7ce66fb6c..5fbe1f50e3 100644 --- a/arch/sandbox/config.mk +++ b/arch/sandbox/config.mk @@ -19,6 +19,9 @@ SANITIZERS := ifdef CONFIG_ASAN SANITIZERS += -fsanitize=address endif +ifdef CONFIG_FUZZ +SANITIZERS += -fsanitize=fuzzer +endif KBUILD_CFLAGS += $(SANITIZERS) cmd_u-boot__ = $(CC) -o $@ -Wl,-T u-boot.lds $(u-boot-init) \ diff --git a/arch/sandbox/cpu/os.c b/arch/sandbox/cpu/os.c index 5ea4135741..cd45d7b6b6 100644 --- a/arch/sandbox/cpu/os.c +++ b/arch/sandbox/cpu/os.c @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include @@ -26,6 +27,7 @@ #include #include +#include #include #include #include @@ -1002,7 +1004,75 @@ void os_relaunch(char *argv[]) os_exit(1); } + +#ifdef CONFIG_FUZZ +static void *fuzzer_thread(void * ptr) +{ + char cmd[64]; + char *argv[5] = {"./u-boot", "-T", "-c", cmd, NULL}; + const char *fuzz_test; + + /* Find which test to run from an environment variable. */ + fuzz_test = getenv("UBOOT_SB_FUZZ_TEST"); + if (!fuzz_test) + os_abort(); + + snprintf(cmd, sizeof(cmd), "fuzz %s", fuzz_test); + + sandbox_main(4, argv); + os_abort(); + return NULL; +} + +static bool fuzzer_initialized = false; +static pthread_mutex_t fuzzer_mutex = PTHREAD_MUTEX_INITIALIZER; +static pthread_cond_t fuzzer_cond = PTHREAD_COND_INITIALIZER; +static const uint8_t *fuzzer_data; +static size_t fuzzer_size; + +int sandbox_fuzzing_engine_get_input(const uint8_t **data, size_t *size) +{ + if (!fuzzer_initialized) + return -ENOSYS; + + /* Tell the main thread we need new inputs then wait for them. */ + pthread_mutex_lock(&fuzzer_mutex); + pthread_cond_signal(&fuzzer_cond); + pthread_cond_wait(&fuzzer_cond, &fuzzer_mutex); + *data = fuzzer_data; + *size = fuzzer_size; + pthread_mutex_unlock(&fuzzer_mutex); + return 0; +} + +int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) +{ + static pthread_t tid; + + pthread_mutex_lock(&fuzzer_mutex); + + /* Initialize the sandbox on another thread. */ + if (!fuzzer_initialized) { + fuzzer_initialized = true; + if (pthread_create(&tid, NULL, fuzzer_thread, NULL)) + os_abort(); + pthread_cond_wait(&fuzzer_cond, &fuzzer_mutex); + } + + /* Hand over the input. */ + fuzzer_data = data; + fuzzer_size = size; + pthread_cond_signal(&fuzzer_cond); + + /* Wait for the inputs to be finished with. */ + pthread_cond_wait(&fuzzer_cond, &fuzzer_mutex); + pthread_mutex_unlock(&fuzzer_mutex); + + return 0; +} +#else int main(int argc, char *argv[]) { return sandbox_main(argc, argv); } +#endif diff --git a/arch/sandbox/include/asm/fuzzing_engine.h b/arch/sandbox/include/asm/fuzzing_engine.h new file mode 100644 index 0000000000..cf6396363b --- /dev/null +++ b/arch/sandbox/include/asm/fuzzing_engine.h @@ -0,0 +1,25 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Copyright (c) 2022 Google, Inc. + * Written by Andrew Scull + */ + +#ifndef __ASM_FUZZING_ENGINE_H +#define __ASM_FUZZING_ENGINE_H + +/** Function to get fuzzing engine input data. */ +/** + * sandbox_fuzzing_engine_get_input() - get an input from the sandbox fuzzing + * engine + * + * The function will return a pointer to the input data and the size of the + * data pointed to. The pointer will remain valid until the next invocation of + * this function. + * + * @data: output pointer to input data + * @size output size of input data + * Return: 0 if OK, -ve on error + */ +int sandbox_fuzzing_engine_get_input(const uint8_t **data, size_t *size); + +#endif /* __ASM_FUZZING_ENGINE_H */ -- 2.35.1.1178.g4f1659d476-goog